Imported WebKit commit 3db4eb1820ac8fb03065d7ea73a4d9db1e8fea1a (http://svn.webkit.org/repository/webkit/trunk@110422)

This includes build fixes for the latest qtbase/qtdeclarative as well as the final QML2 API.

2642 files changed, 94919 insertions, 30533 deletions

diff --git a/Source/JavaScriptCore/API/JSObjectRef.cpp b/Source/JavaScriptCore/API/JSObjectRef.cpp
index cd8d7159e..17329ad87 100644
--- a/Source/JavaScriptCore/API/JSObjectRef.cpp
+++ b/Source/JavaScriptCore/API/JSObjectRef.cpp
@@ -312,7 +312,7 @@ void JSObjectSetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned p
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
     
-    jsObject->methodTable()->putByIndex(jsObject, exec, propertyIndex, jsValue);
+    jsObject->methodTable()->putByIndex(jsObject, exec, propertyIndex, jsValue, false);
     if (exec->hadException()) {
         if (exception)
             *exception = toRef(exec, exec->exception());
diff --git a/Source/JavaScriptCore/API/tests/JSNode.c b/Source/JavaScriptCore/API/tests/JSNode.c
index d9ac0a913..052c88a02 100644
--- a/Source/JavaScriptCore/API/tests/JSNode.c
+++ b/Source/JavaScriptCore/API/tests/JSNode.c
@@ -30,7 +30,7 @@
 #include "JSValueRef.h"
 #include "Node.h"
 #include "NodeList.h"
-#include "UnusedParam.h"
+#include <wtf/UnusedParam.h>
 #include <wtf/Assertions.h>
 
 static JSValueRef JSNode_appendChild(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
diff --git a/Source/JavaScriptCore/API/tests/JSNodeList.c b/Source/JavaScriptCore/API/tests/JSNodeList.c
index bc4a8ad99..0d194845e 100644
--- a/Source/JavaScriptCore/API/tests/JSNodeList.c
+++ b/Source/JavaScriptCore/API/tests/JSNodeList.c
@@ -27,7 +27,7 @@
 #include "JSNodeList.h"
 #include "JSObjectRef.h"
 #include "JSValueRef.h"
-#include "UnusedParam.h"
+#include <wtf/UnusedParam.h>
 #include <wtf/Assertions.h>
 
 static JSValueRef JSNodeList_item(JSContextRef context, JSObjectRef object, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 2afcbdc65..d4a51d214 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -40,6 +40,7 @@ SET(JavaScriptCore_SOURCES
     bytecode/CallLinkStatus.cpp
     bytecode/CodeBlock.cpp
     bytecode/DFGExitProfile.cpp
+    bytecode/ExecutionCounter.cpp
     bytecode/GetByIdStatus.cpp
     bytecode/JumpTable.cpp
     bytecode/LazyOperandValueProfile.cpp
@@ -67,6 +68,7 @@ SET(JavaScriptCore_SOURCES
     dfg/DFGDriver.cpp
     dfg/DFGGraph.cpp
     dfg/DFGJITCompiler.cpp
+    dfg/DFGNode.cpp
     dfg/DFGOSREntry.cpp
     dfg/DFGOSRExit.cpp
     dfg/DFGOSRExitCompiler.cpp
@@ -75,6 +77,7 @@ SET(JavaScriptCore_SOURCES
     dfg/DFGOperations.cpp
     dfg/DFGPhase.cpp
     dfg/DFGPredictionPropagationPhase.cpp
+    dfg/DFGRedundantPhiEliminationPhase.cpp
     dfg/DFGRepatch.cpp
     dfg/DFGSpeculativeJIT.cpp
     dfg/DFGSpeculativeJIT32_64.cpp
@@ -300,6 +303,7 @@ INCLUDE_DIRECTORIES(${JavaScriptCore_INCLUDE_DIRECTORIES})
 ADD_DEFINITIONS(-DBUILDING_JavaScriptCore)
 ADD_LIBRARY(${JavaScriptCore_LIBRARY_NAME} ${JavaScriptCore_LIBRARY_TYPE} ${JavaScriptCore_HEADERS} ${JavaScriptCore_SOURCES})
 TARGET_LINK_LIBRARIES(${JavaScriptCore_LIBRARY_NAME} ${JavaScriptCore_LIBRARIES})
+SET_TARGET_PROPERTIES(${JavaScriptCore_LIBRARY_NAME} PROPERTIES LINK_INTERFACE_LIBRARIES "")
 
 IF (JavaScriptCore_LINK_FLAGS)
     ADD_TARGET_PROPERTIES(${JavaScriptCore_LIBRARY_NAME} LINK_FLAGS "${JavaScriptCore_LINK_FLAGS}")
@@ -307,5 +311,5 @@ ENDIF ()
 
 IF (SHARED_CORE)
     SET_TARGET_PROPERTIES(${JavaScriptCore_LIBRARY_NAME} PROPERTIES VERSION ${PROJECT_VERSION} SOVERSION ${PROJECT_VERSION_MAJOR})
-    INSTALL(TARGETS ${JavaScriptCore_LIBRARY_NAME} DESTINATION lib)
+    INSTALL(TARGETS ${JavaScriptCore_LIBRARY_NAME} DESTINATION "${LIB_INSTALL_DIR}")
 ENDIF ()
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 87b921f0f..0092392f0 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,3472 @@
+2012-03-12  Filip Pizlo  <fpizlo@apple.com>
+
+        All DFG nodes should have a mutable set of flags
+        https://bugs.webkit.org/show_bug.cgi?id=80779
+        <rdar://problem/11026218>
+
+        Reviewed by Gavin Barraclough.
+        
+        Got rid of NodeId, and placed all of the flags that distinguished NodeId
+        from NodeType into a separate Node::flags field. Combined what was previously
+        ArithNodeFlags into Node::flags.
+        
+        In the process of debugging, I found that the debug support in the virtual
+        register allocator was lacking, so I improved it. I also realized that the
+        virtual register allocator was assuming that the nodes in a basic block were
+        contiguous, which is no longer the case. So I fixed that. The fix also made
+        it natural to have more extreme assertions, so I added them. I suspect this
+        will make it easier to catch virtual register allocation bugs in the future.
+        
+        This is mostly performance neutral; if anything it looks like a slight
+        speed-up.
+        
+        This patch does leave some work for future refactorings; for example, Node::op
+        is unencapsulated. This was already the case, though now it feels even more
+        like it should be. I avoided doing that because this patch has already grown
+        way bigger than I wanted.
+        
+        Finally, this patch creates a DFGNode.cpp file and makes a slight effort to
+        move some unnecessarily inline stuff out of DFGNode.h.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp:
+        (JSC::DFG::ArithNodeFlagsInferencePhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::endIndexForPureCSE):
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::clobbersWorld):
+        (JSC::DFG::CSEPhase::impureCSE):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::eliminate):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+        (CSEPhase):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::opName):
+        (JSC::DFG::Graph::dump):
+        (DFG):
+        * dfg/DFGNode.cpp: Added.
+        (DFG):
+        (JSC::DFG::arithNodeFlagsAsString):
+        * dfg/DFGNode.h:
+        (DFG):
+        (JSC::DFG::nodeUsedAsNumber):
+        (JSC::DFG::nodeCanTruncateInteger):
+        (JSC::DFG::nodeCanIgnoreNegativeZero):
+        (JSC::DFG::nodeMayOverflow):
+        (JSC::DFG::nodeCanSpeculateInteger):
+        (JSC::DFG::defaultFlags):
+        (JSC::DFG::Node::Node):
+        (Node):
+        (JSC::DFG::Node::setOpAndDefaultFlags):
+        (JSC::DFG::Node::mustGenerate):
+        (JSC::DFG::Node::arithNodeFlags):
+        (JSC::DFG::Node::setArithNodeFlag):
+        (JSC::DFG::Node::mergeArithNodeFlags):
+        (JSC::DFG::Node::hasResult):
+        (JSC::DFG::Node::hasInt32Result):
+        (JSC::DFG::Node::hasNumberResult):
+        (JSC::DFG::Node::hasJSResult):
+        (JSC::DFG::Node::hasBooleanResult):
+        (JSC::DFG::Node::isJump):
+        (JSC::DFG::Node::isBranch):
+        (JSC::DFG::Node::isTerminal):
+        (JSC::DFG::Node::child1):
+        (JSC::DFG::Node::child2):
+        (JSC::DFG::Node::child3):
+        (JSC::DFG::Node::firstChild):
+        (JSC::DFG::Node::numChildren):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::vote):
+        (JSC::DFG::PredictionPropagationPhase::fixupNode):
+        * dfg/DFGScoreBoard.h:
+        (ScoreBoard):
+        (JSC::DFG::ScoreBoard::~ScoreBoard):
+        (JSC::DFG::ScoreBoard::assertClear):
+        (JSC::DFG::ScoreBoard::use):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::useChildren):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+
+2012-03-10  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt should support JSVALUE64
+        https://bugs.webkit.org/show_bug.cgi?id=79609
+        <rdar://problem/10063437>
+
+        Reviewed by Gavin Barraclough and Oliver Hunt.
+        
+        Ported the LLInt, which previously only worked on 32-bit, to 64-bit. This
+        patch moves a fair bit of code from LowLevelInterpreter32_64.asm to the common
+        file, LowLevelInterpreter.asm. About 1/3 of the LLInt did not have to be
+        specialized for value representation.
+        
+        Also made some minor changes to offlineasm and the slow-paths.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntEntrypoints.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        (JSC::LLInt::llint_trace_value):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        (SlowPathReturnType):
+        (JSC::LLInt::SlowPathReturnType::SlowPathReturnType):
+        (JSC::LLInt::encodeResult):
+        * llint/LLIntThunks.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/armv7.rb:
+        * offlineasm/asm.rb:
+        * offlineasm/ast.rb:
+        * offlineasm/backends.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/parser.rb:
+        * offlineasm/registers.rb:
+        * offlineasm/transform.rb:
+        * offlineasm/x86.rb:
+        * wtf/Platform.h:
+
+2012-03-10  Yong Li  <yoli@rim.com>
+
+        Web Worker crashes with WX_EXCLUSIVE
+        https://bugs.webkit.org/show_bug.cgi?id=80532
+
+        Let each JS global object own a meta allocator
+        for WX_EXCLUSIVE to avoid conflicts from Web Worker.
+        Also fix a mutex leak in MetaAllocator's dtor.
+
+        Reviewed by Filip Pizlo.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::~DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::bytesAllocatedByAllAllocators):
+        (DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::bytesCommittedByAllocactors):
+        (JSC::DemandExecutableAllocator::dumpProfileFromAllAllocators):
+        (JSC::DemandExecutableAllocator::allocateNewSpace):
+        (JSC::DemandExecutableAllocator::allocators):
+        (JSC::DemandExecutableAllocator::allocatorsMutex):
+        (JSC):
+        (JSC::ExecutableAllocator::initializeAllocator):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutableAllocator::memoryPressureMultiplier):
+        (JSC::ExecutableAllocator::allocate):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::dumpProfile):
+        * jit/ExecutableAllocator.h:
+        (JSC):
+        (ExecutableAllocator):
+        (JSC::ExecutableAllocator::allocator):
+        * wtf/MetaAllocator.h:
+        (WTF::MetaAllocator::~MetaAllocator): Finalize the spin lock.
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Finalize): Add empty Finalize() to some implementations.
+
+2012-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Object.freeze broken on latest Nightly
+        https://bugs.webkit.org/show_bug.cgi?id=80577
+
+        Reviewed by Oliver Hunt.
+
+        The problem here is that deleteProperty rejects deletion of prototype.
+        This is correct in most cases, however defineOwnPropery is presently
+        implemented internally to ensure the attributes change by deleting the
+        old property, and creating a new one.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::deleteProperty):
+            - If deletePropery is called via defineOwnPropery, allow old prototype to be removed.
+
+2012-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Array.prototype.toLocaleString visits elements in wrong order under certain conditions
+        https://bugs.webkit.org/show_bug.cgi?id=80663
+
+        Reviewed by Michael Saboff.
+
+        The bug here is actually that we're continuing to process the array after an exception
+        has been thrown, and that the second value throw is overriding the first.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToLocaleString):
+
+2012-03-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        WebKit compiled by gcc (Xcode 3.2.6) hangs while running DOM/Accessors.html
+        https://bugs.webkit.org/show_bug.cgi?id=80080
+
+        Reviewed by Filip Pizlo.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingRegion::Locker::Locker):
+        (JSC::SamplingRegion::Locker::~Locker):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingRegion::exchangeCurrent):
+        * wtf/Atomics.h:
+        (WTF):
+        (WTF::weakCompareAndSwap):
+        (WTF::weakCompareAndSwapUIntPtr):
+
+2012-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        REGRESSION: Date.parse("Tue Nov 23 20:40:05 2010 GMT") returns NaN
+        https://bugs.webkit.org/show_bug.cgi?id=49989
+
+        Reviewed by Oliver Hunt.
+
+        Patch originally by chris reiss <christopher.reiss@nokia.com>,
+        allow the year to appear before the timezone in date strings.
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+
+2012-03-09  Mark Rowe  <mrowe@apple.com>
+
+        Ensure that the WTF headers are copied at installhdrs time.
+
+        Reviewed by Dan Bernstein and Jessie Berlin.
+
+        * Configurations/JavaScriptCore.xcconfig: Set INSTALLHDRS_SCRIPT_PHASE = YES
+        so that our script phases are invoked at installhdrs time. The only one that
+        does any useful work at that time is the one that installs WTF headers.
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Add support for ENABLE(LEGACY_NOTIFICATIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=80497
+
+        Reviewed by Adam Barth.
+
+        Prep for b80472: Update API for Web Notifications
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-09  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        Bash scripts should support LF endings only
+        https://bugs.webkit.org/show_bug.cgi?id=79509
+
+        Reviewed by David Kilzer.
+
+        * gyp/generate-derived-sources.sh: Added property svn:eol-style.
+        * gyp/run-if-exists.sh: Added property svn:eol-style.
+        * gyp/update-info-plist.sh: Added property svn:eol-style.
+
+2012-03-09  Jessie Berlin  <jberlin@apple.com>
+
+        Windows debug build fix.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::shouldBlind):
+        Fix unreachable code warnings (which we treat as errors).
+
+2012-03-09  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Zoltan Herczeg.
+
+        [Qt] Fix the SH4 build after r109834
+        https://bugs.webkit.org/show_bug.cgi?id=80492
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchAdd32):
+        (JSC::MacroAssemblerSH4::branchSub32):
+
+2012-03-09  Andy Wingo  <wingo@igalia.com>
+
+        Refactor code feature analysis in the parser
+        https://bugs.webkit.org/show_bug.cgi?id=79112
+
+        Reviewed by Geoffrey Garen.
+
+        This commit refactors the parser to more uniformly propagate flag
+        bits down and up the parse process, as the parser descends and
+        returns into nested blocks.  Some flags get passed town to
+        subscopes, some apply to specific scopes only, and some get
+        unioned up after parsing subscopes.
+
+        The goal is to eventually be very precise with scoping
+        information, once we have block scopes: one block scope might use
+        `eval', which would require the emission of a symbol table within
+        that block and containing blocks, whereas another block in the
+        same function might not, allowing us to not emit a symbol table.
+
+        * parser/Nodes.h:
+        (JSC::ScopeFlags): Rename from CodeFeatures.
+        (JSC::ScopeNode::addScopeFlags):
+        (JSC::ScopeNode::scopeFlags): New accessors for m_scopeFlags.
+        (JSC::ScopeNode::isStrictMode):
+        (JSC::ScopeNode::usesEval):
+        (JSC::ScopeNode::usesArguments):
+        (JSC::ScopeNode::setUsesArguments):
+        (JSC::ScopeNode::usesThis):
+        (JSC::ScopeNode::needsActivationForMoreThanVariables):
+        (JSC::ScopeNode::needsActivation): Refactor these accessors to
+        operate on the m_scopeFlags member.
+        (JSC::ScopeNode::source):
+        (JSC::ScopeNode::sourceURL):
+        (JSC::ScopeNode::sourceID): Shuffle these definitions around; no
+        semantic change.
+        (JSC::ScopeNode::ScopeNode)
+        (JSC::ProgramNode::ProgramNode)
+        (JSC::EvalNode::EvalNode)
+        (JSC::FunctionBodyNode::FunctionBodyNode): Have these constructors
+        take a ScopeFlags as an argument, instead of a bool inStrictContext.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create): Adapt constructors to change.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::ASTBuilder):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::addVar):
+        (JSC::ASTBuilder::Scope::Scope):
+        (Scope):
+        (ASTBuilder):
+        (JSC::ASTBuilder::makeFunctionCallNode): Don't track scope
+        features here.  Instead rely on the base Parser mechanism to track
+        features.
+
+        * parser/NodeInfo.h (NodeInfo, NodeDeclarationInfo): "ScopeFlags".
+
+        * parser/Parser.h:
+        (JSC::Scope::Scope): Manage scope through flags, not
+        bit-booleans.  This lets us uniformly propagate them up and down.
+        (JSC::Scope::declareWrite):
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::useVariable):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::getCapturedVariables):
+        (JSC::Scope::saveFunctionInfo):
+        (JSC::Scope::restoreFunctionInfo):
+        (JSC::Parser::pushScope): Adapt to use scope flags and their
+        accessors instead of bit-booleans.
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseInner):
+        (JSC::::didFinishParsing):
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseConstDeclarationList):
+        (JSC::::parseWithStatement):
+        (JSC::::parseTryStatement):
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::::parsePrimaryExpression): Hoist some of the flag handling
+        out of the "context" (ASTBuilder or SyntaxChecker) and to here.
+        Does not seem to have a performance impact.
+
+        * parser/SourceProviderCacheItem.h (SourceProviderCacheItem):
+        Cache the scopeflags.
+        * parser/SyntaxChecker.h: Remove evalCount() decl.
+
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::ScriptExecutable::isStrictMode):
+        (JSC::ScriptExecutable::recordParse):
+        (ScriptExecutable): ScopeFlags, not features.
+
+2012-03-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Build fix for MSVC after r110266
+
+        Unreviewed. A #ifdef for MSVC was left over in r110266.
+
+        * runtime/RegExpObject.h:
+        (RegExpObject):
+
+2012-03-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Allocate the RegExpObject's data with the Cell
+        https://bugs.webkit.org/show_bug.cgi?id=80654
+
+        Reviewed by Gavin Barraclough.
+
+        This patch removes the creation of RegExpObject's data to avoid the overhead
+        create by the allocation and destruction.
+
+        We RegExp are created repeatedly, this provides some performance improvment.
+        The PeaceKeeper test stringDetectBrowser improves by 10%.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        (JSC::RegExpObject::visitChildren):
+        (JSC::RegExpObject::getOwnPropertyDescriptor):
+        (JSC::RegExpObject::defineOwnProperty):
+        (JSC::RegExpObject::match):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setRegExp):
+        (JSC::RegExpObject::regExp):
+        (JSC::RegExpObject::setLastIndex):
+        (JSC::RegExpObject::getLastIndex):
+        (RegExpObject):
+
+2012-03-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Separate WTF parts of JavaScriptCoreGenerated into WTFGenerated for Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=80657
+        
+        Preparation for WTF separation from JavaScriptCore.
+        The "Generated" vcproj files on Windows are necessary so Visual Studio can calculate correct
+        dependencies for generated files.
+        
+        This also removes the PGO build targets from the WTF code, since we can't build instrumentation/optimization
+        versions of the WTF code independent of the JavaScriptCore code.
+
+        Reviewed by Jessie Berlin.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Add WTFGenerated, update dependent projects.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Removed WTF specific parts.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Removed WTF specific parts.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Removed WTF specific parts.
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: Removed WTF specific parts.
+        * JavaScriptCore.vcproj/JavaScriptCore/work-around-vs-dependency-tracking-bugs.py: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Add WTFGenerated, update dependent projects.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Remove PGO targets from WTF.
+        * JavaScriptCore.vcproj/WTF/WTFGenerated.make: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make.
+        * JavaScriptCore.vcproj/WTF/WTFGenerated.vcproj: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedCommon.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedDebug.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedDebugAll.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedDebugCairoCFLite.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedRelease.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedReleaseCairoCFLite.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/build-generated-files.sh: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh.
+        * JavaScriptCore.vcproj/WTF/copy-files.cmd: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd.
+        * JavaScriptCore.vcproj/WTF/work-around-vs-dependency-tracking-bugs.py: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/work-around-vs-dependency-tracking-bugs.py.
+
+2012-03-08  Benjamin Poulain  <benjamin@webkit.org>
+
+        Fix the build of WebKit with WTFURL following the removal of ForwardingHeaders/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=80652
+
+        Reviewed by Eric Seidel.
+
+        Fix the header, URLSegments.h is not part of the API.
+
+        * wtf/url/api/ParsedURL.h:
+
+2012-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix for micro data API.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-08  Gavin Barraclough  <barraclough@apple.com>
+
+        String.prototype.match and replace do not clear global regexp lastIndex per ES5.1 15.5.4.10
+        https://bugs.webkit.org/show_bug.cgi?id=26890
+
+        Reviewed by Oliver Hunt.
+
+        Per 15.10.6.2 step 9.a.1 called via the action of the last iteration of 15.5.4.10 8.f.i.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::stringProtoFuncMatch):
+            - added calls to setLastIndex.
+
+2012-03-08  Matt Lilek  <mrl@apple.com>
+
+        Don't enable VIDEO_TRACK on all OS X platforms
+        https://bugs.webkit.org/show_bug.cgi?id=80635
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.  That day is not today.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::shouldBlind):
+        * assembler/MacroAssemblerX86Common.h:
+        (MacroAssemblerX86Common):
+        (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
+
+2012-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Build fix. One of these days I'll manage to commit something that works everywhere.
+
+        * assembler/AbstractMacroAssembler.h:
+        (AbstractMacroAssembler):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
+        (MacroAssemblerX86Common):
+
+2012-03-08  Chao-ying Fu  <fu@mips.com>
+
+        Update MIPS patchOffsetGetByIdSlowCaseCall
+        https://bugs.webkit.org/show_bug.cgi?id=80302
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JIT.h:
+        (JIT):
+
+2012-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Missing some places where we should be blinding 64bit values (and blinding something we shouldn't)
+        https://bugs.webkit.org/show_bug.cgi?id=80633
+
+        Reviewed by Gavin Barraclough.
+
+        Add 64-bit trap for shouldBlindForSpecificArch, so that we always blind
+        if there isn't a machine specific implementation (otherwise the 64bit value
+        got truncated and 32bit checks were used -- leaving 32bits untested).
+        Also add a bit of logic to ensure that we don't try to blind a few common
+        constants that go through the ImmPtr paths -- encoded numeric JSValues and
+        unencoded doubles with common "safe" values.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::shouldBlindDouble):
+        (MacroAssembler):
+        (JSC::MacroAssembler::shouldBlind):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
+
+2012-03-08  Mark Rowe  <mrowe@apple.com>
+
+        <rdar://problem/11012572> Ensure that the staged frameworks path is in the search path for JavaScriptCore
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+
+2012-03-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix line endings for copy-files.cmd.
+        
+        If a cmd file doesn't have Windows line endings, it doesn't work properly.
+        In this case, the label :clean wasn't found, breaking the clean build.
+        
+        Reviewed by Jessie Berlin.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+
+2012-03-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA incorrectly handles ValueToInt32
+        https://bugs.webkit.org/show_bug.cgi?id=80568
+
+        Reviewed by Gavin Barraclough.
+        
+        Changed it match exactly the decision pattern used in
+        DFG::SpeculativeJIT::compileValueToInt32
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2012-03-08  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        [Qt] [WK2] Webkit fails to link when compiled with force_static_libs_as_shared
+        https://bugs.webkit.org/show_bug.cgi?id=80524
+
+        Reviewed by Simon Hausmann.
+
+        Move IdentifierTable methods defintion to WTFThreadData.cpp to fix linking 
+        of WTF library.
+
+        * runtime/Identifier.cpp:
+        * wtf/WTFThreadData.cpp:
+        (JSC):
+        (JSC::IdentifierTable::~IdentifierTable):
+        (JSC::IdentifierTable::add):
+
+2012-03-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG instruction count threshold should be lifted to 10000
+        https://bugs.webkit.org/show_bug.cgi?id=80579
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/Options.cpp:
+        (JSC::Options::initializeOptions):
+
+2012-03-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Incorrect tracking of abstract values of variables forced double
+        https://bugs.webkit.org/show_bug.cgi?id=80566
+        <rdar://problem/11001442>
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+
+2012-03-07  Chao-yng Fu  <fu@mips.com>
+
+        [Qt] Fix the MIPS/SH4 build after r109834
+        https://bugs.webkit.org/show_bug.cgi?id=80492
+
+        Reviewed by Oliver Hunt.
+
+        Implement three-argument branch(Add,Sub)32.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::add32):
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        (JSC::MacroAssemblerMIPS::branchSub32):
+
+2012-03-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110127.
+        http://trac.webkit.org/changeset/110127
+        https://bugs.webkit.org/show_bug.cgi?id=80562
+
+        compile failed on AppleWin (Requested by ukai on #webkit).
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::finalize):
+        * runtime/Executable.h:
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::create):
+        * runtime/JSGlobalData.cpp:
+        (WTF):
+        (Recompiler):
+        (WTF::Recompiler::operator()):
+        (JSC::JSGlobalData::recompileAllJSFunctions):
+        (JSC):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+
+2012-03-07  Hojong Han  <hojong.han@samsung.com>
+
+        The end atom of the marked block considered to filter invalid cells
+        https://bugs.webkit.org/show_bug.cgi?id=79191
+
+        Reviewed by Geoffrey Garen.
+
+        Register file could have stale pointers beyond the end atom of marked block.
+        Those pointers can weasel out of filtering in-middle-of-cell pointer.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isLiveCell):
+
+2012-03-07  Jessie Berlin  <jberlin@apple.com>
+
+        Clean Windows build fails after r110033
+        https://bugs.webkit.org/show_bug.cgi?id=80553
+
+        Rubber-stamped by Jon Honeycutt and Eric Seidel.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        Place the implementation files next to their header files in the wtf/text subdirectory.
+        Use echo -F to tell xcopy that these are files (since there is apparently no flag).
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        Update the path to those implementation files.
+        * JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj:
+        Ditto.
+
+2012-03-07  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Eliminate redundant Phis in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=80415
+
+        Reviewed by Filip Pizlo.
+
+        Although this may not have any advantage at current stage, this is towards
+        minimal SSA to make more high level optimizations (like bug 76770) easier.
+        We have the choices either to build minimal SSA from scratch or to
+        keep current simple Phi insertion mechanism and remove the redundancy
+        in another phase. Currently we choose the latter because the change
+        could be smaller.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGRedundantPhiEliminationPhase.cpp: Added.
+        (DFG):
+        (RedundantPhiEliminationPhase):
+        (JSC::DFG::RedundantPhiEliminationPhase::RedundantPhiEliminationPhase):
+        (JSC::DFG::RedundantPhiEliminationPhase::run):
+        (JSC::DFG::RedundantPhiEliminationPhase::getRedundantReplacement):
+        (JSC::DFG::RedundantPhiEliminationPhase::replacePhiChild):
+        (JSC::DFG::RedundantPhiEliminationPhase::fixupPhis):
+        (JSC::DFG::RedundantPhiEliminationPhase::updateBlockVariableInformation):
+        (JSC::DFG::performRedundantPhiElimination):
+        * dfg/DFGRedundantPhiEliminationPhase.h: Added.
+        (DFG):
+
+2012-03-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Refactor recompileAllJSFunctions() to be less expensive
+        https://bugs.webkit.org/show_bug.cgi?id=80330
+
+        Reviewed by Geoffrey Garen.
+
+        This change is performance neutral on the JS benchmarks we track. It's mostly to improve page 
+        load performance, which currently does at least a couple full GCs per navigation.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::discardAllCompiledCode): Rename recompileAllJSFunctions to discardAllCompiledCode 
+        because the function doesn't actually recompile anything (and never did); it simply throws code
+        away for it to be recompiled later if we determine we should do so.
+        (JSC):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::addFunctionExecutable): Adds a newly created FunctionExecutable to the Heap's list.
+        (JSC::Heap::removeFunctionExecutable): Removes the specified FunctionExecutable from the Heap's list.
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        * runtime/Executable.cpp: Added next and prev fields to FunctionExecutables so that they can 
+        be used in DoublyLinkedLists.
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::finalize): Removes the FunctionExecutable from the Heap's list.
+        * runtime/Executable.h:
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::create): Adds the FunctionExecutable to the Heap's list.
+        * runtime/JSGlobalData.cpp: Remove recompileAllJSFunctions, as it's the Heap's job to own and manage 
+        the list of FunctionExecutables.
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Use the new discardAllCompiledCode.
+
+2012-03-06  Oliver Hunt  <oliver@apple.com>
+
+        Further harden 64-bit JIT
+        https://bugs.webkit.org/show_bug.cgi?id=80457
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements blinding for ImmPtr.  Rather than xor based blinding
+        we perform randomised pointer rotations in order to avoid the significant
+        cost in executable memory that would otherwise be necessary (and to avoid
+        the need for an additional scratch register in some cases).
+
+        As with the prior blinding patch there's a moderate amount of noise as we
+        correct the use of ImmPtr vs. TrustedImmPtr.
+
+        * assembler/AbstractMacroAssembler.h:
+        (ImmPtr):
+        (JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr):
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::shouldBlind):
+        (JSC::MacroAssembler::RotatedImmPtr::RotatedImmPtr):
+        (RotatedImmPtr):
+        (JSC::MacroAssembler::rotationBlindConstant):
+        (JSC::MacroAssembler::loadRotationBlindedConstant):
+        (JSC::MacroAssembler::convertInt32ToDouble):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::poke):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        (JSC::MacroAssemblerARMv7::branchAdd32):
+        * assembler/MacroAssemblerX86_64.h:
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::rotateRightPtr):
+        (JSC::MacroAssemblerX86_64::xorPtr):
+        * assembler/X86Assembler.h:
+        (X86Assembler):
+        (JSC::X86Assembler::xorq_rm):
+        (JSC::X86Assembler::rorq_i8r):
+        * dfg/DFGCCallHelpers.h:
+        (CCallHelpers):
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::createOSREntries):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentFillGPR):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::emitEdgeCode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSlow_op_post_inc):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitValueProfilingSite):
+        (JSC::JIT::emitGetVirtualRegister):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_strcat):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        (JSC::JIT::emit_op_jmp_scopes):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        (JSC::JIT::emit_op_throw_reference_error):
+        (JSC::JIT::emit_op_debug):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+        (JSC::JIT::emit_op_new_array):
+        (JSC::JIT::emitSlow_op_new_array):
+        (JSC::JIT::emit_op_new_array_buffer):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_strcat):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        (JSC::JIT::emit_op_jmp_scopes):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_index):
+        * jit/JITStubCall.h:
+        (JITStubCall):
+        (JSC::JITStubCall::addArgument):
+
+2012-03-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        ARM build fix.
+
+        Reviewed by Zoltan Herczeg.
+
+        Implement three-argument branch(Add,Sub)32.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::add32):
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::branchAdd32):
+        (JSC::MacroAssemblerARM::branchSub32):
+
+2012-03-07  Andy Wingo  <wingo@igalia.com>
+
+        Parser: Inline ScopeNodeData into ScopeNode
+        https://bugs.webkit.org/show_bug.cgi?id=79776
+
+        Reviewed by Geoffrey Garen.
+
+        It used to be that some ScopeNode members were kept in a separate
+        structure because sometimes they wouldn't be needed, and
+        allocating a ParserArena was expensive.  This patch makes
+        ParserArena lazily allocate its IdentifierArena, allowing the
+        members to be included directly, which is simpler and easier to
+        reason about.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena):
+        (JSC::ParserArena::reset):
+        (JSC::ParserArena::isEmpty):
+        * parser/ParserArena.h:
+        (JSC::ParserArena::identifierArena): Lazily allocate the
+        IdentifierArena.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ScopeNode::singleStatement):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::destroyData):
+        (JSC::ScopeNode::needsActivationForMoreThanVariables):
+        (JSC::ScopeNode::needsActivation):
+        (JSC::ScopeNode::hasCapturedVariables):
+        (JSC::ScopeNode::capturedVariableCount):
+        (JSC::ScopeNode::captures):
+        (JSC::ScopeNode::varStack):
+        (JSC::ScopeNode::functionStack):
+        (JSC::ScopeNode::neededConstants):
+        (ScopeNode):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ScopeNode::emitStatementsBytecode): Inline ScopeNodeData
+        into ScopeNode.  Adapt accessors.
+
+2012-03-06  Eric Seidel  <eric@webkit.org>
+
+        Make WTF public headers use fully-qualified include paths and remove ForwardingHeaders/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=80363
+
+        Reviewed by Mark Rowe.
+
+        Historically WTF has been part of JavaScriptCore, and on Mac and Windows
+        its headers have appeared as part of the "private" headers exported by
+        JavaScriptCore.  All of the WTF headers there are "flattened" into a single
+        private headers directory, and WebCore, WebKit and WebKit2 have used "ForwardingHeaders"
+        to re-map fully-qualified <wtf/text/Foo.h> includes to simple <JavaScriptCore/Foo.h> includes.
+
+        However, very soon, we are moving the WTF source code out of JavaScriptCore into its
+        own directory and project.  As part of such, the WTF headers will no longer be part of
+        the JavaScriptCore private interfaces.
+        In preparation for that, this change makes both the Mac and Win builds export
+        WTF headers in a non-flattened manner.  On Mac, that means into usr/local/include/wtf
+        (and subdirectories), on Windows for now that means JavaScriptCore/wtf (and subdirectories).
+
+        There are 5 parts to this change.
+        1.  Updates the JavaScriptCore XCode and VCProj files to actually install these headers
+            (and header directories) into the appropriate places in the build directory.
+        2.  Updates JavaScriptCore.xcodeproj to look for these WTF headers in this install location
+            (WebCore, WebKit, etc. had already been taught to look in previous patches).
+        3.  Fixes all JavaScriptCore source files, and WTF headers to include WTF headers
+            using fully qualified paths.
+        4.  Stops the Mac and Win builds from installing these WTF headers in their old "flattened" location.
+        5.  Removes WebCore and WebKit ForwardingHeaders/wtf directories now that the flattened headers no longer exist.
+
+        Unfortunately we see no way to do this change in smaller parts, since all of these steps are interdependant.
+        It is possible there are internal Apple projects which depend on JavaScriptCore/Foo.h working for WTF
+        headers, those will have to be updated to use <wtf/Foo.h> after this change.
+        I've discussed this proposed change at length with Mark Rowe, and my understanding is they
+        are ready for (and interested in) this change happening.
+
+        * API/tests/JSNode.c:
+        * API/tests/JSNodeList.c:
+        * Configurations/Base.xcconfig:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerCodeRef.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGOperations.cpp:
+        * heap/GCAssertions.h:
+        * heap/HandleHeap.h:
+        * heap/HandleStack.h:
+        * heap/MarkedSpace.h:
+        * heap/PassWeak.h:
+        * heap/Strong.h:
+        * heap/Weak.h:
+        * jit/HostCallReturnValue.cpp:
+        * jit/JIT.cpp:
+        * jit/JITStubs.cpp:
+        * jit/ThunkGenerators.cpp:
+        * parser/Lexer.cpp:
+        * runtime/Completion.cpp:
+        * runtime/Executable.cpp:
+        * runtime/Identifier.h:
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSDateMath.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSStringBuilder.h:
+        * runtime/JSVariableObject.h:
+        * runtime/NumberPrototype.cpp:
+        * runtime/WriteBarrier.h:
+        * tools/CodeProfile.cpp:
+        * tools/TieredMMapArray.h:
+        * wtf/AVLTree.h:
+        * wtf/Alignment.h:
+        * wtf/AlwaysInline.h:
+        * wtf/ArrayBufferView.h:
+        * wtf/Assertions.h:
+        * wtf/Atomics.h:
+        * wtf/Bitmap.h:
+        * wtf/BoundsCheckedPointer.h:
+        * wtf/CheckedArithmetic.h:
+        * wtf/Deque.h:
+        * wtf/ExportMacros.h:
+        * wtf/FastAllocBase.h:
+        * wtf/FastMalloc.h:
+        * wtf/Float32Array.h:
+        * wtf/Float64Array.h:
+        * wtf/Functional.h:
+        * wtf/HashCountedSet.h:
+        * wtf/HashFunctions.h:
+        * wtf/HashMap.h:
+        * wtf/HashSet.h:
+        * wtf/HashTable.h:
+        * wtf/HashTraits.h:
+        * wtf/Int16Array.h:
+        * wtf/Int32Array.h:
+        * wtf/Int8Array.h:
+        * wtf/IntegralTypedArrayBase.h:
+        * wtf/ListHashSet.h:
+        * wtf/MainThread.h:
+        * wtf/MetaAllocator.h:
+        * wtf/Noncopyable.h:
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnPtr.h:
+        * wtf/PackedIntVector.h:
+        * wtf/ParallelJobs.h:
+        * wtf/PassOwnArrayPtr.h:
+        * wtf/PassOwnPtr.h:
+        * wtf/PassRefPtr.h:
+        * wtf/PassTraits.h:
+        * wtf/Platform.h:
+        * wtf/PossiblyNull.h:
+        * wtf/RefCounted.h:
+        * wtf/RefCountedLeakCounter.h:
+        * wtf/RefPtr.h:
+        * wtf/RetainPtr.h:
+        * wtf/SimpleStats.h:
+        * wtf/Spectrum.h:
+        * wtf/StdLibExtras.h:
+        * wtf/TCPageMap.h:
+        * wtf/TemporaryChange.h:
+        * wtf/ThreadSafeRefCounted.h:
+        * wtf/Threading.h:
+        * wtf/ThreadingPrimitives.h:
+        * wtf/TypeTraits.h:
+        * wtf/TypedArrayBase.h:
+        * wtf/Uint16Array.h:
+        * wtf/Uint32Array.h:
+        * wtf/Uint8Array.h:
+        * wtf/Uint8ClampedArray.h:
+        * wtf/UnusedParam.h:
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+        * wtf/dtoa/double-conversion.h:
+        * wtf/dtoa/utils.h:
+        * wtf/gobject/GRefPtr.h:
+        * wtf/gobject/GlibUtilities.h:
+        * wtf/text/AtomicString.h:
+        * wtf/text/AtomicStringImpl.h:
+        * wtf/text/CString.h:
+        * wtf/text/StringConcatenate.h:
+        * wtf/text/StringHash.h:
+        * wtf/text/WTFString.h:
+        * wtf/unicode/CharacterNames.h:
+        * wtf/unicode/UTF8.h:
+        * wtf/unicode/glib/UnicodeGLib.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        * wtf/unicode/wince/UnicodeWinCE.h:
+        * wtf/url/api/ParsedURL.h:
+        * wtf/url/api/URLString.h:
+        * wtf/wince/FastMallocWinCE.h:
+        * yarr/YarrJIT.cpp:
+
+2012-03-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Array.prototype functions should throw if delete fails
+        https://bugs.webkit.org/show_bug.cgi?id=80467
+
+        Reviewed by Oliver Hunt.
+
+        All calls to [[Delete]] from Array.prototype are specified to pass 'true' as the value of Throw.
+        In the case of shift/unshift, these are also missing a throw from the 'put' in the implementations
+        in JSArray.cpp. There are effectively three copies of each of the generic shift/unshift routines,
+        one in splice, one in ArrayPrototype's shift/unshift methods, and one in JSArray's shift/unshift
+        routines, for handling arrays with holes. These three copies should be unified.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        (JSC::unshift):
+            - Added - shared copies of the shift/unshift functionality.
+        (JSC::arrayProtoFuncPop):
+            - should throw if the delete fails.
+        (JSC::arrayProtoFuncReverse):
+            - should throw if the delete fails.
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+            - use shift/unshift.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+            - Don't try to handle arrays with holes; return a value indicating
+              the generic routine should be used instead.
+        * runtime/JSArray.h:
+            - declaration for shiftCount/unshiftCount changed.
+        * tests/mozilla/js1_6/Array/regress-304828.js:
+            - this was asserting incorrect behaviour.
+
+2012-03-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Make the removal of transitive library dependencies work with CMake < 2.8.7.
+        https://bugs.webkit.org/show_bug.cgi?id=80469
+
+        Reviewed by Antonio Gomes.
+
+        * CMakeLists.txt: Manually set the LINK_INTERFACE_LIBRARIES target
+        property on the library being created.
+
+2012-03-06  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG BasicBlock should group the Phi nodes together and separate them
+        from the other nodes
+        https://bugs.webkit.org/show_bug.cgi?id=80361
+
+        Reviewed by Filip Pizlo.
+
+        This would make it more efficient to remove the redundant Phi nodes or
+        insert new Phi nodes for SSA, besides providing a cleaner BasicBlock structure.
+        This is performance neutral on SunSpider, V8 and Kraken.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::clobberStructures):
+        (JSC::DFG::AbstractState::dump):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (BasicBlock):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::insertPhiNode):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::impureCSE):
+        (JSC::DFG::CSEPhase::globalVarLoadElimination):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkFunctionElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getScopeChainLoadElimination):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-03-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        GCActivityCallback timer should vary with the length of the previous GC
+        https://bugs.webkit.org/show_bug.cgi?id=80344
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.cpp: Gave Heap the ability to keep track of the length of its last 
+        GC length so that the GC Activity Callback can use it.
+        (JSC::Heap::Heap):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (JSC::Heap::lastGCLength):
+        (Heap):
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC):
+        (JSC::DefaultGCActivityCallback::operator()): Use the length of the Heap's last 
+        GC to determine the length of our timer trigger (currently set at 100x the duration 
+        of the last GC).
+
+2012-03-06  Rob Buis  <rbuis@rim.com>
+
+        BlackBerry] Fix cast-align gcc warnings when compiling JSC
+        https://bugs.webkit.org/show_bug.cgi?id=80420
+
+        Reviewed by Gavin Barraclough.
+
+        Fix warnings given in Blackberry build.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::CopiedBlock):
+        * wtf/RefCountedArray.h:
+        (WTF::RefCountedArray::Header::fromPayload):
+
+2012-03-06  Gavin Barraclough  <barraclough@apple.com>
+
+        writable/configurable not respected for some properties of Function/String/Arguments
+        https://bugs.webkit.org/show_bug.cgi?id=80436
+
+        Reviewed by Oliver Hunt.
+
+        Special properties should behave like regular properties.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::defineOwnProperty):
+            - Mis-nested logic for making read-only properties non-live.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+            - arguments/length/caller are non-writable, non-configurable - reject appropriately.
+        (JSC::JSFunction::deleteProperty):
+            - Attempting to delete prototype/caller should fail.
+        (JSC::JSFunction::defineOwnProperty):
+            - Ensure prototype is reified on attempt to reify it.
+            - arguments/length/caller are non-writable, non-configurable - reject appropriately.
+        * runtime/JSFunction.h:
+            - added declaration for defineOwnProperty.
+        (JSFunction):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+            - length is non-writable, non-configurable - reject appropriately.
+
+2012-03-06  Ulan Degenbaev  <ulan@chromium.org>
+
+        TypedArray subarray call for subarray does not clamp the end index parameter properly
+        https://bugs.webkit.org/show_bug.cgi?id=80285
+
+        Reviewed by Kenneth Russell.
+
+        * wtf/ArrayBufferView.h:
+        (WTF::ArrayBufferView::calculateOffsetAndLength):
+
+2012-03-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r109837.
+        http://trac.webkit.org/changeset/109837
+        https://bugs.webkit.org/show_bug.cgi?id=80399
+
+        breaks Mac Productions builds, too late to try and fix it
+        tonight (Requested by eseidel on #webkit).
+
+        * API/tests/JSNode.c:
+        * API/tests/JSNodeList.c:
+        * Configurations/Base.xcconfig:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerCodeRef.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGOperations.cpp:
+        * heap/GCAssertions.h:
+        * heap/HandleHeap.h:
+        * heap/HandleStack.h:
+        * heap/MarkedSpace.h:
+        * heap/PassWeak.h:
+        * heap/Strong.h:
+        * heap/Weak.h:
+        * jit/HostCallReturnValue.cpp:
+        * jit/JIT.cpp:
+        * jit/JITStubs.cpp:
+        * jit/ThunkGenerators.cpp:
+        * parser/Lexer.cpp:
+        * runtime/Completion.cpp:
+        * runtime/Executable.cpp:
+        * runtime/Identifier.h:
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSDateMath.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSStringBuilder.h:
+        * runtime/JSVariableObject.h:
+        * runtime/NumberPrototype.cpp:
+        * runtime/WriteBarrier.h:
+        * tools/CodeProfile.cpp:
+        * tools/TieredMMapArray.h:
+        * yarr/YarrJIT.cpp:
+
+2012-03-06  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt][ARM] Speculative buildfix after r109834.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::and32):
+        (MacroAssemblerARM):
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed windows build fix pt 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed windows build fix pt 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        putByIndex should throw in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=80335
+
+        Reviewed by Filip Pizlo.
+
+        Make the MethodTable PutByIndex trap take a boolean 'shouldThrow' parameter.
+
+        This is a largely mechanical change, simply adding an extra parameter to a number
+        of functions. Some call sites need perform additional exception checks, and
+        operationPutByValBeyondArrayBounds needs to know whether it is strict or not.
+
+        This patch doesn't fix a missing throw from some cases of shift/unshift (this is
+        an existing bug), I'll follow up with a third patch to handle that.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPropertyAtIndex):
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::putByIndex):
+        * runtime/Arguments.h:
+        (Arguments):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/ClassInfo.h:
+        (MethodTable):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putByIndex):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        * runtime/JSArray.h:
+        (SparseArrayValueMap):
+        (JSArray):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::putByIndex):
+        * runtime/JSByteArray.h:
+        (JSByteArray):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::putByIndex):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::putByIndex):
+        * runtime/JSNotAnObject.h:
+        (JSNotAnObject):
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndex):
+        * runtime/JSObject.h:
+        (JSC::JSValue::putByIndex):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::putByIndex):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplit):
+
+2012-03-05  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        PredictNone is incorrectly treated as isDoublePrediction
+        https://bugs.webkit.org/show_bug.cgi?id=80365
+
+        Reviewed by Filip Pizlo.
+
+        Also it is incorrectly treated as isFixedIndexedStorageObjectPrediction.
+
+        * bytecode/PredictedType.h:
+        (JSC::isFixedIndexedStorageObjectPrediction):
+        (JSC::isDoublePrediction):
+
+2012-03-05  Filip Pizlo  <fpizlo@apple.com>
+
+        The LLInt should work even when the JIT is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=80340
+        <rdar://problem/10922235>
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
+        (MacroAssemblerCodeRef):
+        (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTINativeCall):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiNativeCall):
+        (JSC::JITThunks::ctiNativeConstruct):
+        * llint/LLIntEntrypoints.cpp:
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (LLInt):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * runtime/Executable.h:
+        (NativeExecutable):
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::finishCreation):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::parse):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+        * wtf/Platform.h:
+
+2012-03-05  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Checks for dead variables are not sufficient when fixing the expected
+        values in DFG OSR entry
+        https://bugs.webkit.org/show_bug.cgi?id=80371
+
+        Reviewed by Filip Pizlo.
+
+        A dead variable should be identified when there's no node referencing it.
+        But we currently failed to catch the case where there are some nodes
+        referencing a variable but those nodes are actually not referenced by
+        others so will be ignored in code generation. In such case we should
+        also consider that variable to be a dead variable in the block and fix
+        the expected values.
+        This is performance neutral on SunSpider, V8 and Kraken.
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+
+2012-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Fix Qt build.
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSub32Constant):
+
+2012-03-05  Eric Seidel  <eric@webkit.org>
+
+        Update JavaScriptCore files to use fully-qualified WTF include paths
+        https://bugs.webkit.org/show_bug.cgi?id=79960
+
+        Reviewed by Adam Barth.
+
+        This change does 5 small/related things:
+         1. Updates JavaScriptCore.xcodeproj to install WTF headers into $BUILD/usr/local/include
+            (WebCore, WebKit were already setup to look there, but JavaScriptCore.xcodeproj
+            was not installing headers there.)
+         2. Makes JavaScriptCore targets include $BUILD/usr/local/include in their
+            header search path, as that's where the WTF headers will be installed.
+         3. Similarly updates JavaScriptCore.vcproj/copy-files.cmd to copy WTF headers to PrivateHeaders/wtf/*
+            in addition to the current behavior of flattening all headers to PrivateHeaders/*.h.
+         4. Updates a bunch of JSC files to use #include <wtf/Foo.h> instead of #include "Foo.h"
+            since soon the WTF headers will not be part of the JavaScriptCore Xcode project.
+         5. Makes build-webkit build the WTF XCode project by default.
+
+        * API/tests/JSNode.c:
+        * API/tests/JSNodeList.c:
+        * Configurations/Base.xcconfig:
+        * assembler/MacroAssemblerCodeRef.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGOperations.cpp:
+        * heap/GCAssertions.h:
+        * heap/HandleHeap.h:
+        * heap/HandleStack.h:
+        * heap/MarkedSpace.h:
+        * heap/PassWeak.h:
+        * heap/Strong.h:
+        * heap/Weak.h:
+        * jit/HostCallReturnValue.cpp:
+        * jit/JIT.cpp:
+        * jit/JITStubs.cpp:
+        * jit/ThunkGenerators.cpp:
+        * parser/Lexer.cpp:
+        * runtime/Completion.cpp:
+        * runtime/Executable.cpp:
+        * runtime/Identifier.h:
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSDateMath.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSStringBuilder.h:
+        * runtime/JSVariableObject.h:
+        * runtime/NumberPrototype.cpp:
+        * runtime/WriteBarrier.h:
+        * tools/CodeProfile.cpp:
+        * tools/TieredMMapArray.h:
+        * yarr/YarrJIT.cpp:
+
+2012-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Add basic support for constant blinding to the JIT
+        https://bugs.webkit.org/show_bug.cgi?id=80354
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds basic constant blinding support to the JIT, at the
+        MacroAssembler level.  This means all JITs in JSC (Yarr, baseline, and DFG)
+        get constant blinding.  Woo!
+
+        This patch only introduces blinding for Imm32, a later patch will do similar
+        for ImmPtr.  In order to make misuse of Imm32 as a trusted type essentially
+        impossible, we make TrustedImm32 a private parent of Imm32 and add an explicit
+        accessor that's needed to access the actual value.  This also means you cannot
+        accidentally pass an untrusted value to a function that does not perform
+        blinding.
+
+        To make everything work sensibly, this patch also corrects some code that was using
+        Imm32 when TrustedImm32 could be used, and refactors a few callers that use
+        untrusted immediates, so that they call slightly different varaints of the functions
+        that they used previously.  This is largely necessary to deal with x86-32 not having
+        sufficient registers to handle the additional work required when we choose to blind
+        a constant.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::asTrustedImm32):
+        (Imm32):
+        (JSC::AbstractMacroAssembler::beginUninterruptedSequence):
+        (JSC::AbstractMacroAssembler::endUninterruptedSequence):
+        (JSC::AbstractMacroAssembler::AbstractMacroAssembler):
+        (AbstractMacroAssembler):
+        (JSC::AbstractMacroAssembler::inUninterruptedSequence):
+        (JSC::AbstractMacroAssembler::random):
+        (JSC::AbstractMacroAssembler::scratchRegisterForBlinding):
+        (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addressForPoke):
+        (MacroAssembler):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::convertInt32ToDouble):
+        (JSC::MacroAssembler::shouldBlind):
+        (JSC::MacroAssembler::BlindedImm32::BlindedImm32):
+        (BlindedImm32):
+        (JSC::MacroAssembler::keyForConstant):
+        (JSC::MacroAssembler::xorBlindConstant):
+        (JSC::MacroAssembler::additionBlindedConstant):
+        (JSC::MacroAssembler::andBlindedConstant):
+        (JSC::MacroAssembler::orBlindedConstant):
+        (JSC::MacroAssembler::loadXorBlindedConstant):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::and32):
+        (JSC::MacroAssembler::andPtr):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::xor32):
+        (JSC::MacroAssembler::branchAdd32):
+        (JSC::MacroAssembler::branchMul32):
+        (JSC::MacroAssembler::branchSub32):
+        (JSC::MacroAssembler::trustedImm32ForShift):
+        (JSC::MacroAssembler::lshift32):
+        (JSC::MacroAssembler::rshift32):
+        (JSC::MacroAssembler::urshift32):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::scratchRegisterForBlinding):
+        (JSC::MacroAssemblerARMv7::shouldBlindForSpecificArch):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::scratchRegisterForBlinding):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emit_op_div):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitSub32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_div):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::updateTopCallFrame):
+        (JSC::JIT::emitValueProfilingSite):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emitSlow_op_jtrue):
+        * jit/JITStubCall.h:
+        (JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::backtrack):
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        putByIndex should throw in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=80335
+
+        Reviewed by Filip Pizlo.
+
+        We'll need to pass an additional parameter.
+
+        Part 1 - rename JSValue::put() for integer indices to JSValue::putByIndex()
+        to match the method in the MethodTable, make this take a parameter indicating
+        whether the put should throw. This fixes the cases where the base of the put
+        is a primitive.
+
+        * dfg/DFGOperations.cpp:
+        (DFG):
+        (JSC::DFG::putByVal):
+        (JSC::DFG::operationPutByValInternal):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSObject.h:
+        (JSC::JSValue::putByIndex):
+        * runtime/JSValue.cpp:
+        (JSC):
+        * runtime/JSValue.h:
+        (JSValue):
+
+2012-03-05  Sam Weinig  <sam@webkit.org>
+
+        Add support for hosting layers in the window server in WebKit2
+        <rdar://problem/10400246>
+        https://bugs.webkit.org/show_bug.cgi?id=80310
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/Platform.h:
+        Add HAVE_LAYER_HOSTING_IN_WINDOW_SERVER.
+
+2012-03-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, attempted build fix for !ENABLE(JIT) after r109705.
+
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::applyMemoryUsageHeuristics):
+        * bytecode/ExecutionCounter.h:
+
+2012-03-05  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r109705.
+
+        * bytecode/ExecutionCounter.cpp:
+        * bytecode/ExecutionCounter.h:
+
+2012-03-05  Andy Wingo  <wingo@igalia.com>
+
+        Lexer: Specialize character predicates for LChar, UChar
+        https://bugs.webkit.org/show_bug.cgi?id=79677
+
+        Reviewed by Oliver Hunt.
+
+        This patch specializes isIdentStart, isIdentPart, isWhiteSpace,
+        and isLineTerminator to perform a more limited number of checks if
+        the lexer is being instantiated to work on LChar sequences.  This
+        is about a 1.5% win on the --parse-only suite, here.
+
+        * parser/Lexer.cpp:
+        (JSC::isLatin1): New static helper, specialized for LChar and
+        UChar.
+        (JSC::typesOfLatin1Characters): Rename from
+        typesOfASCIICharacters, and expand to the range of the LChar
+        type.  All uses of isASCII are changed to use isLatin1.  Generated
+        using libunistring.
+        (JSC::isNonLatin1IdentStart):
+        (JSC::isIdentStart):
+        (JSC::isNonLatin1IdentPart):
+        (JSC::isIdentPart):
+        (JSC::Lexer::shiftLineTerminator):
+        (JSC::Lexer::parseIdentifier):
+        (JSC::Lexer::parseIdentifierSlowCase):
+        (JSC::Lexer::parseStringSlowCase):
+        (JSC::Lexer::parseMultilineComment):
+        (JSC::Lexer::lex):
+        (JSC::Lexer::scanRegExp):
+        (JSC::Lexer::skipRegExp): Sprinkle static_cast<T>(_) around.
+        * parser/Lexer.h:
+        (JSC::Lexer::isWhiteSpace):
+        (JSC::Lexer::isLineTerminator):
+        * KeywordLookupGenerator.py:
+        (Trie.printAsC): Declare specialized isIdentPart static functions.
+
+2012-03-05  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
+2012-03-05  Andy Wingo  <wingo@igalia.com>
+
+        WTF: Micro-optimize cleanup of empty vectors and hash tables
+        https://bugs.webkit.org/show_bug.cgi?id=79903
+
+        Reviewed by Michael Saboff and Geoffrey Garen.
+
+        This patch speeds up cleanup of vectors and hash tables whose
+        backing store was never allocated.  This is the case by default
+        for most vectors / hash tables that never had any entries added.
+
+        The result for me is that calling checkSyntax 1000 times on
+        concat-jquery-mootools-prototype.js goes from 6.234s to 6.068s, a
+        2.4% speedup.
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::~HashTable):
+        (WTF::::clear): Don't deallocate the storage or frob member
+        variables if there is no backing storage.
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::deallocateBuffer): Likewise.
+
+2012-03-04  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT heuristics should be hyperbolic
+        https://bugs.webkit.org/show_bug.cgi?id=80055
+        <rdar://problem/10922260>
+
+        Reviewed by Oliver Hunt.
+        
+        Added tracking of the amount of executable memory typically used for a bytecode
+        instruction. Modified the execution counter scheme to use this, and the amount
+        of free memory, to determine how long to wait before invoking the JIT.
+        
+        The result is that even if we bomb the VM with more code than can fit in our
+        executable memory pool, we still keep running and almost never run out of
+        executable memory - which ensures that if we have to JIT something critical, then
+        we'll likely have enough memory to do so. This also does not regress performance
+        on the three main benchmarks.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::predictedMachineCodeSize):
+        (JSC):
+        (JSC::CodeBlock::usesOpcode):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::checkIfJITThresholdReached):
+        (JSC::CodeBlock::dontJITAnytimeSoon):
+        (JSC::CodeBlock::jitAfterWarmUp):
+        (JSC::CodeBlock::jitSoon):
+        (JSC::CodeBlock::llintExecuteCounter):
+        (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
+        (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
+        (JSC::CodeBlock::addressOfJITExecuteCounter):
+        (JSC::CodeBlock::offsetOfJITExecuteCounter):
+        (JSC::CodeBlock::offsetOfJITExecutionActiveThreshold):
+        (JSC::CodeBlock::offsetOfJITExecutionTotalCount):
+        (JSC::CodeBlock::jitExecuteCounter):
+        (JSC::CodeBlock::checkIfOptimizationThresholdReached):
+        (JSC::CodeBlock::optimizeNextInvocation):
+        (JSC::CodeBlock::dontOptimizeAnytimeSoon):
+        (JSC::CodeBlock::optimizeAfterWarmUp):
+        (JSC::CodeBlock::optimizeAfterLongWarmUp):
+        (JSC::CodeBlock::optimizeSoon):
+        * bytecode/ExecutionCounter.cpp: Added.
+        (JSC):
+        (JSC::ExecutionCounter::ExecutionCounter):
+        (JSC::ExecutionCounter::checkIfThresholdCrossedAndSet):
+        (JSC::ExecutionCounter::setNewThreshold):
+        (JSC::ExecutionCounter::deferIndefinitely):
+        (JSC::ExecutionCounter::applyMemoryUsageHeuristics):
+        (JSC::ExecutionCounter::applyMemoryUsageHeuristicsAndConvertToInt):
+        (JSC::ExecutionCounter::hasCrossedThreshold):
+        (JSC::ExecutionCounter::setThreshold):
+        (JSC::ExecutionCounter::reset):
+        * bytecode/ExecutionCounter.h: Added.
+        (JSC):
+        (ExecutionCounter):
+        (JSC::ExecutionCounter::formattedTotalCount):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::allocateNewSpace):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC):
+        (JSC::ExecutableAllocator::memoryPressureMultiplier):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::memoryPressureMultiplier):
+        (JSC):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        * llint/LowLevelInterpreter32_64.asm:
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+        * wtf/SimpleStats.h: Added.
+        (WTF):
+        (SimpleStats):
+        (WTF::SimpleStats::SimpleStats):
+        (WTF::SimpleStats::add):
+        (WTF::SimpleStats::operator!):
+        (WTF::SimpleStats::count):
+        (WTF::SimpleStats::sum):
+        (WTF::SimpleStats::sumOfSquares):
+        (WTF::SimpleStats::mean):
+        (WTF::SimpleStats::variance):
+        (WTF::SimpleStats::standardDeviation):
+
+2012-03-04  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Libraries are installed to /usr/lib and not /usr/lib64 on x86_64
+        https://bugs.webkit.org/show_bug.cgi?id=71507
+
+        Reviewed by Antonio Gomes.
+
+        * CMakeLists.txt: Use ${LIB_INSTALL_DIR} instead of hardcoding "lib".
+
+2012-03-04  David Kilzer  <ddkilzer@apple.com>
+
+        Fix build when the classic interpreter is enabled
+
+        Reviewed by Gavin Barraclough.
+
+        Fixes the following build error when running the "Generate
+        Derived Sources" build phase script:
+
+            offlineasm: Parsing JavaScriptCore/llint/LowLevelInterpreter.asm and ../../JSCLLIntOffsetsExtractor and creating assembly file LLIntAssembly.h.
+            ./JavaScriptCore/offlineasm/offsets.rb:145:in `offsetsAndConfigurationIndex': unhandled exception
+                    from JavaScriptCore/offlineasm/asm.rb:131
+            Command /bin/sh failed with exit code 1
+
+        Gavin's fix in r109674 avoided the #error statement in
+        JITStubs.h when compiling LLIntOffsetsExtractor.cpp, but it
+        caused the "Generate Derived Sources" build phase script to fail
+        when JavaScriptCore/offlineasm/asm.rb was run.  The solution is
+        to detect when the classic interpreter is being built and simply
+        exit early from asm.rb in that case.
+
+        * llint/LLIntOffsetsExtractor.cpp:
+        (JSC::LLIntOffsetsExtractor::dummy): Return NULL pointer if the
+        JIT is disabled.  Note that offsets.rb doesn't care about the
+        return value here, but instead it cares about finding the magic
+        values in the binary.  The magic values are no longer present
+        when the JIT is disabled.
+        * offlineasm/asm.rb: Catch MissingMagicValuesException and exit
+        early with a status message.
+        * offlineasm/offsets.rb:
+        (MissingMagicValuesException): Add new exception class.
+        (offsetsAndConfigurationIndex): Throw
+        MissingMagicValuesException when no magic values are found.
+
+2012-03-04  Jurij Smakov  <jurij@wooyd.org>
+
+        SPARC also needs aligned accesses.
+
+        Rubber-stamped by Gustavo Noronha Silva.
+
+        * wtf/Platform.h:
+
+2012-03-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed build fix.
+
+        * jit/JITStubs.h:
+            - Move ENABLE(JIT) to head of file.
+
+2012-03-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Split JSArray's [[Put]] & [[DefineOwnProperty]] traps.
+        https://bugs.webkit.org/show_bug.cgi?id=80217
+
+        Reviewed by Filip Pizlo.
+
+        putByIndex() provides similar behavior to put(), but for indexed property names.
+        Many places in ArrayPrototype call putByIndex() where they really mean to call
+        [[DefineOwnProperty]]. This is only okay due to a bug – putByIndex should be
+        calling numeric accessors (& respecting numeric read only properties) on the
+        prototype chain, but isn't. Add a new putDirectIndex (matching JSObject's
+        putDirect* methods), to correctly provide a fast [[DefineOwnProperty]] interface.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        * runtime/JSArray.cpp:
+        (JSC):
+        (JSC::reject):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        * runtime/JSArray.h:
+        (SparseArrayValueMap):
+        (JSArray):
+        (JSC::JSArray::putDirectIndex):
+
+2012-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        Implement the basis of KURLWTFURL
+        https://bugs.webkit.org/show_bug.cgi?id=79600
+
+        Reviewed by Adam Barth.
+
+        Add an API to know if a ParsedURL is valid.
+
+        * wtf/url/api/ParsedURL.cpp:
+        (WTF::ParsedURL::ParsedURL):
+        (WTF):
+        (WTF::ParsedURL::isolatedCopy): This is needed by APIs moving URL objects between thread
+        and by KURL's detach() on write.
+        (WTF::ParsedURL::baseAsString):
+        (WTF::ParsedURL::segment):
+        Add a stronger constraint on accessors: the client of this API should never ask for the segments
+        on an invalid URL.
+        * wtf/url/api/ParsedURL.h:
+        (WTF):
+        (WTF::ParsedURL::ParsedURL):
+        (ParsedURL):
+        (WTF::ParsedURL::isValid):
+
+2012-03-03  Hans Wennborg  <hans@chromium.org>
+
+        Implement Speech JavaScript API
+        https://bugs.webkit.org/show_bug.cgi?id=80019
+
+        Reviewed by Adam Barth.
+
+        Add ENABLE_SCRIPTED_SPEECH.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        When getting the line number of a call into a call frame with no code block, it's
+        incorrect to rely on the returnPC
+        https://bugs.webkit.org/show_bug.cgi?id=80195
+
+        Reviewed by Oliver Hunt.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+
+2012-03-02  Han Hojong  <hojong.han@samsung.com>
+
+        Expected results updated for checking type conversion
+        https://bugs.webkit.org/show_bug.cgi?id=80138
+
+        Reviewed by Gavin Barraclough.
+
+        * tests/mozilla/ecma/TypeConversion/9.3.1-3.js:
+
+2012-03-02  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Added USE(ZLIB) flag.
+
+        Reviewed by Kent Tamura.
+
+        * wtf/Platform.h:
+
+2012-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for platforms that have DFG_JIT disabled but PARALLEL_GC enabled.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+
+2012-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGCodeBlocks should not trace CodeBlocks that are also going to be traced by
+        virtue of being in the transitive closure
+        https://bugs.webkit.org/show_bug.cgi?id=80098
+ 
+        Reviewed by Anders Carlsson.
+        
+        If DFGCodeBlocks traces a CodeBlock that might also be traced via its owner Executable,
+        then you might have the visitAggregate() method called concurrently by multiple threads.
+        This is benign on 64-bit -- visitAggregate() and everything it calls turns out to be
+        racy and slightly imprecise but not unsound. But on 32-bit, visitAggregate() may crash
+        due to word tearing in ValueProfile bucket updates inside of computeUpdatedPrediction().
+        
+        It would seem that the fix is just to have DFGCodeBlocks not trace CodeBlocks that are
+        not jettisoned. But CodeBlocks may be jettisoned later during the GC, so it must trace
+        any CodeBlock that it knows to be live by virtue of it being reachable from the stack.
+        Hence the real fix is to make sure that concurrent calls into CodeBlock::visitAggregate()
+        don't lead to two threads racing over each other as they clobber state. This patch
+        achieves this with a simple CAS loop: whichever thread wins the CAS race (which is
+        trivially linearizable) will get to trace the CodeBlock; all other threads give up and
+        go home.
+        
+        Unfortunately there will be no new tests. It's possible to reproduce this maybe 1/10
+        times by running V8-v6's raytrace repeatedly, using the V8 harness hacked to rerun it
+        even when it's gotten sufficient counts. But that takes a while - sometimes up to a
+        minute to get a crash. I have no other reliable repro case.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        (DFGData):
+        * heap/DFGCodeBlocks.cpp:
+        (JSC::DFGCodeBlocks::clearMarks):
+
+2012-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        The JIT should not crash the entire process just because there is not enough executable
+        memory, if the LLInt is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=79962
+
+        Reviewed by Csaba Osztrogonác.
+        
+        Fix for ARM, SH4.
+
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::executableCopy):
+
+2012-03-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Revert my change. Broke builds.
+        Source/JavaScriptCore/wtf/Atomics.h:188: error: redefinition of 'bool WTF::weakCompareAndSwap(volatile uintptr_t*, uintptr_t, uintptr_t)'
+        Source/JavaScriptCore/wtf/Atomics.h:122: error: 'bool WTF::weakCompareAndSwap(volatile unsigned int*, unsigned int, unsigned i
+
+        * wtf/Atomics.h:
+        (WTF):
+        (WTF::weakCompareAndSwap):
+
+2012-03-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Gcc build fix.
+
+        Rubber-stamped by Filip Pizlo.
+
+        * wtf/Atomics.h:
+        (WTF):
+        (WTF::weakCompareAndSwap):
+
+2012-03-01  Gavin Barraclough  <barraclough@apple.com>
+
+        ES5.1-15.3.5.4. prohibits Function.caller from [[Get]]ting a strict caller
+        https://bugs.webkit.org/show_bug.cgi?id=80011
+
+        Reviewed by Oliver Hunt.
+
+        Also, fix getting the caller from within a bound function, for within a getter,
+        or setter (make our implementation match other browsers).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+            - Allow this to get the caller of host functions.
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+            - This should use getCallerInfo, and should skip over function bindings.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::callerGetter):
+            - This should never return a strict-mode function.
+
+2012-03-01  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG local CSE for a node can be terminated earlier
+        https://bugs.webkit.org/show_bug.cgi?id=80014
+
+        Reviewed by Filip Pizlo.
+
+        When one of the node's childredn is met in the process of back traversing
+        the nodes, we don't need to traverse the remaining nodes.
+        This is performance neutral on SunSpider, V8 and Kraken.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::impureCSE):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkFunctionElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+
+2012-02-29  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG BasicBlocks should not require that their nodes have continuous indices in the graph
+        https://bugs.webkit.org/show_bug.cgi?id=79899
+
+        Reviewed by Filip Pizlo.
+
+        This will make it more convenient to insert nodes into the DFG.
+        With this capability we now place the Phi nodes in the corresponding
+        blocks.
+        Local CSE is modified to not to rely on the assumption of continuous
+        node indices in a block.
+        This is performance neutral on SunSpider, V8 and Kraken.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::AbstractState):
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::clobberStructures):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        (JSC::DFG::AbstractState::dump):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::forNode):
+        (AbstractState):
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp:
+        (ArithNodeFlagsInferencePhase):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (BasicBlock):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::insertPhiNode):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::determineReachability):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        (CFAPhase):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::CSEPhase):
+        (JSC::DFG::CSEPhase::endIndexForPureCSE):
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::impureCSE):
+        (JSC::DFG::CSEPhase::globalVarLoadElimination):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkFunctionElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getScopeChainLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+        (CSEPhase):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGPhase.cpp:
+        (JSC::DFG::Phase::beginPhase):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+
+2012-02-29  Filip Pizlo  <fpizlo@apple.com>
+
+        The JIT should not crash the entire process just because there is not
+        enough executable memory, if the LLInt is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=79962
+        <rdar://problem/10922215>
+
+        Unreviewed, adding forgotten file.
+
+        * jit/JITCompilationEffort.h: Added.
+        (JSC):
+
+2012-02-29  Filip Pizlo  <fpizlo@apple.com>
+
+        The JIT should not crash the entire process just because there is not
+        enough executable memory, if the LLInt is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=79962
+        <rdar://problem/10922215>
+
+        Reviewed by Gavin Barraclough.
+        
+        Added the notion of JITCompilationEffort. If we're JIT'ing as a result of
+        a tier-up, then we set it to JITCompilationCanFail. Otherwise it's
+        JITCompilationMustSucceed. This preserves the old behavior of LLInt is
+        disabled or if we're compiling something that can't be interpreted (like
+        an OSR exit stub).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        (ARMAssembler):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::~LinkBuffer):
+        (LinkBuffer):
+        (JSC::LinkBuffer::didFailToAllocate):
+        (JSC::LinkBuffer::isValid):
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::performFinalization):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::executableCopy):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
+        * bytecode/CodeBlock.cpp:
+        (JSC::ProgramCodeBlock::jitCompileImpl):
+        (JSC::EvalCodeBlock::jitCompileImpl):
+        (JSC::FunctionCodeBlock::jitCompileImpl):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::jitCompile):
+        (CodeBlock):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::allocateNewSpace):
+        (JSC::ExecutableAllocator::allocate):
+        * jit/ExecutableAllocator.h:
+        (ExecutableAllocator):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::allocate):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        (JIT):
+        * jit/JITCompilationEffort.h: Added.
+        (JSC):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::jitCompile):
+        (JSC::ProgramExecutable::jitCompile):
+        (JSC::FunctionExecutable::jitCompileForCall):
+        (JSC::FunctionExecutable::jitCompileForConstruct):
+        * runtime/Executable.h:
+        (EvalExecutable):
+        (ProgramExecutable):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::jitCompileFor):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+
+2012-02-29  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Get rid of the #ifdef mess in LayerTreeHost[Proxy]
+        https://bugs.webkit.org/show_bug.cgi?id=79501
+
+        Enable WTF_USE_UI_SIDE_COMPOSITING for Qt.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * wtf/Platform.h:
+
+2012-02-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        * tests/mozilla/ecma_2/RegExp/constructor-001.js:
+        * tests/mozilla/ecma_2/RegExp/function-001.js:
+        * tests/mozilla/ecma_2/RegExp/properties-001.js:
+            - Check in new test cases results.
+
+2012-02-29  Mark Rowe  <mrowe@apple.com>
+
+        Stop installing JSCLLIntOffsetsExtractor.
+
+        Replace the separate TestRegExp and TestAPI xcconfig files with a single ToolExecutable xcconfig file
+        that derives the product name from the target name. We can then use that xcconfig file for JSCLLIntOffsetsExtractor.
+        This has the results of setting SKIP_INSTALL = YES for JSCLLIntOffsetsExtractor.
+
+        While I was doing this fiddling I noticed that the JSCLLIntOffsetsExtractor target had a custom value
+        for USER_HEADER_SEARCH_PATHS to allow it to find LLIntDesiredOffsets.h. A better way of doing that is
+        to add LLIntDesiredOffsets.h to the Xcode project so that it'll be included in the header map. That
+        allows us to remove the override of USER_HEADER_SEARCH_PATHS entirely. So I did that too!
+
+        Reviewed by Filip Pizlo.
+
+        * Configurations/TestRegExp.xcconfig: Removed.
+        * Configurations/ToolExecutable.xcconfig: Renamed from Source/JavaScriptCore/Configurations/TestAPI.xcconfig.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        RefCounted::deprecatedTurnOffVerifier() should not be deprecated
+        https://bugs.webkit.org/show_bug.cgi?id=79864
+
+        Reviewed by Oliver Hunt.
+        
+        Removed the word "deprecated" from the name of this method, since this method
+        should not be deprecated. It works just fine as it is, and there is simply no
+        alternative to calling this method for many interesting JSC classes.
+
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::SharedSymbolTable):
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocatorHandle::MetaAllocatorHandle):
+        (WTF::MetaAllocator::allocate):
+        * wtf/RefCounted.h:
+        (RefCountedBase):
+        (WTF::RefCountedBase::turnOffVerifier):
+
+2012-02-29  Gavin Barraclough  <barraclough@apple.com>
+
+        'source' property of RegExp instance cannot be ""
+        https://bugs.webkit.org/show_bug.cgi?id=79938
+
+        Reviewed by Oliver Hunt.
+
+        15.10.6.4 specifies that RegExp.prototype.toString must return '/' + source + '/',
+        and also states that the result must be a valid RegularExpressionLiteral. '//' is
+        not a valid RegularExpressionLiteral (since it is a single line comment), and hence
+        source cannot ever validly be "". If the source is empty, return a different Pattern
+        that would match the same thing.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectSource):
+            - Do not return "" if the source is empty, this would lead to invalid behaviour in toString.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+            - No need to special case the empty string - this should be being done by 'source'.
+
+2012-02-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Writable attribute not set correctly when redefining an accessor to a data descriptor
+        https://bugs.webkit.org/show_bug.cgi?id=79931
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnProperty):
+            - use attributesOverridingCurrent instead of attributesWithOverride.
+        * runtime/PropertyDescriptor.cpp:
+        * runtime/PropertyDescriptor.h:
+            - remove attributesWithOverride - attributesOverridingCurrent does the same thing.
+
+2012-02-29  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Add JSCore symbol exports needed by wx port
+        https://bugs.webkit.org/show_bug.cgi?id=77280
+
+        Reviewed by Hajime Morita.
+
+        * wtf/ArrayBufferView.h:
+        * wtf/ExportMacros.h:
+
+2012-02-28  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Always build wtf as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=79857
+
+        Reviewed by Eric Seidel.
+
+        To help the efforts in bug 75673 to move WTF out of
+        JavaScriptCore, act more like the other ports and remove the
+        possibility of building WTF as a shared library.
+
+        It does not make much sense to, for example, ship WTF as a
+        separate .so with webkit-efl packages, and it should be small
+        enough not to cause problems during linking.
+
+        * wtf/CMakeLists.txt:
+
+2012-02-28  Dmitry Lomov  <dslomov@google.com>
+
+        [JSC] Implement ArrayBuffer transfer
+        https://bugs.webkit.org/show_bug.cgi?id=73493.
+        Implement ArrayBuffer transfer, per Khronos spec:  http://www.khronos.org/registry/typedarray/specs/latest/#9.
+        This brings parity with V8 implementation of transferable typed arrays.
+
+        Reviewed by Oliver Hunt.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Extra export.
+        * wtf/ArrayBuffer.h:
+        (ArrayBuffer): Added extra export.
+
+2012-02-28  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed. Build fix after recent LLInt additions.
+        
+        * wscript:
+
+2012-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Refactor SpeculativeJIT::emitAllocateJSFinalObject
+        https://bugs.webkit.org/show_bug.cgi?id=79801
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Split emitAllocateJSFinalObject out to form this
+        function, which is more generic in that it can allocate a variety of classes.
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): Changed to use the new helper function.
+
+2012-02-28  Gavin Barraclough  <barraclough@apple.com>
+
+        [[Get]]/[[Put]] for primitives should not wrap on strict accessor call
+        https://bugs.webkit.org/show_bug.cgi?id=79588
+
+        Reviewed by Oliver Hunt.
+
+        In the case of [[Get]], this is a pretty trivial bug - just don't wrap
+        primitives at the point you call a getter.
+
+        For setters, this is a little more involved, since we have already wrapped
+        the value up in a synthesized object. Stop doing so. There is also a further
+        subtely, that in strict mode all attempts to create a new data property on
+        the object should throw.
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+            - [[Put]] to a string primitive should use JSValue::putToPrimitive.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+            - Remove static function called in one place.
+        * runtime/JSObject.h:
+        (JSC::JSValue::put):
+            - [[Put]] to a non-cell JSValue should use JSValue::putToPrimitive.
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::synthesizePrototype):
+            - Add support for synthesizing the prototype of strings.
+        (JSC::JSValue::putToPrimitive):
+            - Added, implements [[Put]] for primitive bases, per 8.7.2.
+        * runtime/JSValue.h:
+        (JSValue):
+            - Add declaration for JSValue::putToPrimitive.
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+            - Don't call ToObject on primitive this values.
+
+2012-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Re-enable parallel GC on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=79837
+
+        Rubber stamped by Filip Pizlo.
+
+        * runtime/Options.cpp:
+        (JSC::Options::initializeOptions): We accidentally disabled parallel GC with this line,
+        so we removed it and things should go back to normal.
+
+2012-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Some run-javascriptcore-tests broken for 32-bit debug
+        https://bugs.webkit.org/show_bug.cgi?id=79844
+
+        Rubber stamped by Oliver Hunt.
+        
+        These assertions are just plain wrong for 32-bit. We could either have a massive
+        assertion that depends on value representation, that has to be changed every
+        time we change the JITs, resulting in a bug tail of debug-mode crashes, or we
+        could get rid of the assertions. I pick the latter.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2012-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Get rid of padding cruft in CopiedBlock
+        https://bugs.webkit.org/show_bug.cgi?id=79686
+
+        Reviewed by Filip Pizlo.
+
+        * heap/CopiedBlock.h:
+        (CopiedBlock): Removed the extra padding that was used for alignment purposes until 
+        the calculation of the payload offset into CopiedBlocks was redone recently.
+
+2012-02-28  Anders Carlsson  <andersca@apple.com>
+
+        Fix build with newer versions of clang.
+
+        Clang now warns since we're not passing a CFString literal to CFStringCreateWithFormatAndArguments,
+        but it's OK to ignore this warning since clang is also checking that the caller (vprintf_stderr_common)
+        takes a string literal.
+
+        * wtf/Assertions.cpp:
+
+2012-02-28  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add GMainLoop and GMainContext to be handled by GRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=79496
+
+        Reviewed by Martin Robinson.
+
+        Handle GMainLoop and GMainContext in GRefPtr, by calling
+        g_main_loop_(un)ref and g_main_context_(un)ref in the
+        implementation of the refGPtr and derefGPtr template functions.
+
+        * wtf/gobject/GRefPtr.cpp:
+        (WTF::refGPtr):
+        (WTF):
+        (WTF::derefGPtr):
+        * wtf/gobject/GRefPtr.h:
+        (WTF):
+        * wtf/gobject/GTypedefs.h:
+
+2012-02-28  Yong Li  <yoli@rim.com>
+
+        JSString::resolveRope() should report extra memory cost to the heap.
+        https://bugs.webkit.org/show_bug.cgi?id=79555
+
+        Reviewed by Michael Saboff.
+
+        At the time a JSString is constructed with fibers, it doesn't report
+        extra memory cost, which is reasonable because it hasn't allocate
+        new memory. However when the rope is resolved, it should report meory
+        cost for the new buffer.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+
+2012-02-27  Oliver Hunt  <oliver@apple.com>
+
+        sputnik/Unicode/Unicode_500/S7.2_A1.6_T1.html crashes in the interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=79728
+
+        Reviewed by Gavin Barraclough.
+
+        When initialising a chained get instruction we may end up in a state where
+        the instruction stream says we have a scopechain, but it has not yet been set
+        (eg. if allocating the StructureChain itself is what leads to the GC).  We could
+        re-order the allocation, but it occurs in a couple of places, so it seems less
+        fragile simply to null check the scopechain slot before we actually visit the slot.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitStructures):
+
+2012-02-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Old JIT's style of JSVALUE64 strict equality is subtly wrong
+        https://bugs.webkit.org/show_bug.cgi?id=79700
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::comparePtr):
+        (MacroAssemblerX86_64):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2012-02-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement support for op_negate and op_bitnot in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=79617
+
+        Reviewed by Filip Pizlo.
+
+        Add an ArithNegate op to the DFG JIT, to implement op_negate.
+
+        This patch also adds support for op_negate to the JSVALUE64 baseline JIT
+        (JSVALUE32_64 already had this), so that we can profile the slowpath usage.
+
+        This is a 2.5%-3% Sunspider progression and a 1% win on Kraken.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::sub_S):
+            - Added sub_S from immediate.
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::vneg):
+            - Added double negate.
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::negateDouble):
+            - Added double negate.
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::branchNeg32):
+            - Added.
+        * assembler/MacroAssemblerX86.h:
+        (MacroAssemblerX86):
+            - moved loadDouble, absDouble to common.
+        * assembler/MacroAssemblerX86Common.h:
+        (MacroAssemblerX86Common):
+        (JSC::MacroAssemblerX86Common::absDouble):
+            - implementation can be shared.
+        (JSC::MacroAssemblerX86Common::negateDouble):
+            - Added.
+        (JSC::MacroAssemblerX86Common::loadDouble):
+            - allow absDouble to have a common implementation.
+        * assembler/MacroAssemblerX86_64.h:
+        (MacroAssemblerX86_64):
+            - moved loadDouble, absDouble to common.
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+            - support ArithNegate.
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp:
+        (JSC::DFG::ArithNodeFlagsInferencePhase::propagate):
+            - support ArithNegate.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+            - support ArithNegate.
+        (JSC::DFG::ByteCodeParser::parseBlock):
+            - support op_negate.
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+            - support ArithNegate.
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+            - support op_negate.
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::negateShouldSpeculateInteger):
+            - support ArithNegate.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArithNodeFlags):
+            - support ArithNegate.
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+            - support ArithNegate.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+            - support ArithNegate.
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+            - support ArithNegate.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - support ArithNegate.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - support ArithNegate.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+            - Add support for op_negate in JSVALUE64.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
+            - Add support for op_negate in JSVALUE64.
+
+2012-02-27  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        Unreviewed. Build fix for linux-bot (qt) after r109021.
+
+        * runtime/Error.cpp:
+
+2012-02-27  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION (r108112): AWS Management Console at amazon.com fails to initialize
+        https://bugs.webkit.org/show_bug.cgi?id=79693
+
+        Reviewed by Filip Pizlo.
+
+        Alas we can't provide the stack trace as an array, as despite everyone wanting
+        an array, everyone arbitrarily creates the array by calling split on the stack
+        trace.  To create the array we would have provided them in the first place.
+
+        This changes the exception's stack property to a \n separated string.  To get the
+        old array just do <exception>.stack.split("\n").
+
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+
+2012-02-27  Gavin Barraclough  <barraclough@apple.com>
+
+        RegExp lastIndex should behave as a regular property
+        https://bugs.webkit.org/show_bug.cgi?id=79446
+
+        Reviewed by Sam Weinig.
+
+        lastIndex should be a regular data descriptor, with the attributes configurable:false,
+        enumerable:false, writable:true. As such, it should be possible to reconfigure writable
+        as false. If the lastIndex property is reconfigured to be read-only, we should respect
+        this correctly.
+
+        * runtime/CommonIdentifiers.h:
+            - Removed some unused identifiers, added lastIndex.
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertySlot):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::getOwnPropertyDescriptor):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::deleteProperty):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::getOwnPropertyNames):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::getPropertyNames):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::reject):
+            - helper function for defineOwnProperty.
+        (JSC::RegExpObject::defineOwnProperty):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::put):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::match):
+            - Pass setLastIndex an ExecState, so it can throw if read-only.
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+            - Pass setLastIndex an ExecState, so it can throw if read-only.
+        (RegExpObjectData):
+            - Added lastIndexIsWritable.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+            - Pass setLastIndex an ExecState, so it can throw if read-only.
+
+2012-02-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement support for op_negate and op_bitnot in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=79617
+
+        Reviewed by Sam Weinig.
+
+        Remove op_bitnop - this is redundant, ~x === x^-1.
+        This is a fractional (<1%) progression.
+
+        Remove not32(X) from the MacroAssemblers - make this an optimization to add32(-1, X).
+        Remove CanReuse from the result type - this was unused.
+        Remove op_bitnot.
+
+        * assembler/MacroAssemblerARM.h:
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::xor32):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::xor32):
+        * assembler/MacroAssemblerMIPS.h:
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::xor32):
+        * assembler/MacroAssemblerSH4.h:
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::xor32):
+        * assembler/MacroAssemblerX86Common.h:
+        (MacroAssemblerX86Common):
+        (JSC::MacroAssemblerX86Common::xor32):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC):
+        (JSC::BitwiseNotNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC):
+        * jit/JITOpcodes.cpp:
+        (JSC):
+        * jit/JITStubs.cpp:
+        (JSC):
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter32_64.asm:
+        * parser/NodeConstructors.h:
+        (JSC::NegateNode::NegateNode):
+        (JSC::BitwiseNotNode::BitwiseNotNode):
+        (JSC::MultNode::MultNode):
+        (JSC::DivNode::DivNode):
+        (JSC::ModNode::ModNode):
+        (JSC::SubNode::SubNode):
+        (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
+        * parser/Nodes.h:
+        (BitwiseNotNode):
+        (JSC::BitwiseNotNode::expr):
+        (JSC):
+        * parser/ResultType.h:
+        (ResultType):
+        (JSC::ResultType::numberTypeIsInt32):
+        (JSC::ResultType::stringOrNumberType):
+        (JSC::ResultType::forAdd):
+        (JSC::ResultType::forBitOp):
+
+2012-02-27  Michael Saboff  <msaboff@apple.com>
+
+        Error check regexp min quantifier
+        https://bugs.webkit.org/show_bug.cgi?id=70648
+
+        Reviewed by Gavin Barraclough.
+
+        Added checking for min or only quantifier being UINT_MAX.
+        When encountered this becomes a SyntaxError during parsing.
+
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::parseQuantifier):
+        (JSC::Yarr::Parser::parse):
+        (Parser):
+
+2012-02-27  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing files.
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        Added ACCESSIBILITY_CONTEXT_MENUS.
+
+        * wtf/Platform.h:
+
+2012-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        LayoutTests/fast/xpath/xpath-functional-test.html is crashing in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=79616
+
+        Reviewed by Oliver Hunt.
+        
+        Guard against the fact that in JSVALUE64, JSValue().isCell() == true.
+
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::validate):
+
+2012-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should support activations and nested functions
+        https://bugs.webkit.org/show_bug.cgi?id=79554
+
+        Reviewed by Sam Weinig.
+        
+        Fix 32-bit. The 32-bit function+activation code had some really weird
+        register reuse bugs.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Getting the instruction stream for a code block should not require two loads
+        https://bugs.webkit.org/show_bug.cgi?id=79608
+
+        Reviewed by Sam Weinig.
+        
+        Introduced the RefCountedArray class, which contains a single inline pointer
+        to a ref-counted non-resizeable vector backing store. This satisfies the
+        requirements of CodeBlock, which desires the ability to share instruction
+        streams with other CodeBlocks. It also reduces the number of loads required
+        for getting the instruction stream by one.
+        
+        This patch also gets rid of the bytecode discarding logic, since we don't
+        use it anymore and it's unlikely to ever work right with DFG or LLInt. And
+        I didn't feel like porting dead code to use RefCountedArray.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::instructionOffsetForNth):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::numberOfInstructions):
+        (JSC::CodeBlock::instructions):
+        (JSC::CodeBlock::instructionCount):
+        (JSC::CodeBlock::valueProfileForBytecodeOffset):
+        (JSC):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::Label::setLocation):
+        (JSC):
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::newLabel):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC):
+        (BytecodeGenerator):
+        (JSC::BytecodeGenerator::instructions):
+        * bytecompiler/Label.h:
+        (JSC::Label::Label):
+        (Label):
+        * dfg/DFGByteCodeCache.h:
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * jit/JITExceptions.cpp:
+        (JSC::genericThrow):
+        * llint/LowLevelInterpreter32_64.asm:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::codeBlockWithBytecodeFor):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        * wtf/RefCountedArray.h: Added.
+        (WTF):
+        (RefCountedArray):
+        (WTF::RefCountedArray::RefCountedArray):
+        (WTF::RefCountedArray::operator=):
+        (WTF::RefCountedArray::~RefCountedArray):
+        (WTF::RefCountedArray::size):
+        (WTF::RefCountedArray::data):
+        (WTF::RefCountedArray::begin):
+        (WTF::RefCountedArray::end):
+        (WTF::RefCountedArray::at):
+        (WTF::RefCountedArray::operator[]):
+        (Header):
+        (WTF::RefCountedArray::Header::size):
+        (WTF::RefCountedArray::Header::payload):
+        (WTF::RefCountedArray::Header::fromPayload):
+        * wtf/Platform.h:
+
+2012-02-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        StringLiteral and NumericLiteral are allowed as ObjectLiteral getter / setter name
+        https://bugs.webkit.org/show_bug.cgi?id=79571
+
+        Reviewed by Gavin Barraclough.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        * parser/Parser.cpp:
+        (JSC::::parseProperty):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+
+2012-02-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Implement fast path for op_new_array in the baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=78612
+
+        Reviewed by Filip Pizlo.
+
+        heap/CopiedAllocator.h:
+        (CopiedAllocator): Friended the JIT to allow access to m_currentOffset.
+        * heap/CopiedSpace.h:
+        (CopiedSpace): Friended the JIT to allow access to isOversize.
+        (JSC::CopiedSpace::allocator):
+        * heap/Heap.h:
+        (JSC::Heap::storageAllocator): Added a getter for the CopiedAllocator class so the JIT
+        can use it for simple allocation i.e. when we can just bump the offset without having to 
+        do anything else.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases): Added new slow case for op_new_array for when
+        we have to bail out because the fast allocation path fails for whatever reason.
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicStorage): Added utility function that allows objects to 
+        allocate generic backing stores. This function is used by emitAllocateJSArray.
+        (JSC):
+        (JSC::JIT::emitAllocateJSArray): Added utility function that allows the client to 
+        more easily allocate JSArrays. This function is used by emit_op_new_array and I expect 
+        it will also be used for emit_op_new_array_buffer.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array): Changed to do inline allocation of JSArrays. Still does 
+        a stub call for oversize arrays.
+        (JSC):
+        (JSC::JIT::emitSlow_op_new_array): New slow path that just bails out to a stub call if we 
+        fail in any way on the fast path.
+        * runtime/JSArray.cpp:
+        (JSC):
+        * runtime/JSArray.h: Added lots of offset functions for all the fields that we need to 
+        initialize in the JIT.
+        (ArrayStorage):
+        (JSC::ArrayStorage::lengthOffset):
+        (JSC::ArrayStorage::numValuesInVectorOffset):
+        (JSC::ArrayStorage::allocBaseOffset):
+        (JSC::ArrayStorage::vectorOffset):
+        (JSArray):
+        (JSC::JSArray::sparseValueMapOffset):
+        (JSC::JSArray::subclassDataOffset):
+        (JSC::JSArray::indexBiasOffset):
+        (JSC):
+        (JSC::JSArray::storageSize): Moved this function from being a static function in the cpp file
+        to being a static function in the JSArray class. This move allows the JIT to call it to 
+        see what size it should allocate.
+
+2012-02-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for ENABLE(CLASSIC_INTERPRETER) after r108681.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getLineNumberForCallFrame):
+        (JSC::Interpreter::getStackTrace):
+
+2012-02-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r108681.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getLineNumberForCallFrame):
+
+2012-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt assembly file should be split into 32-bit and 64-bit parts
+        https://bugs.webkit.org/show_bug.cgi?id=79584
+
+        Reviewed by Sam Weinig.
+        
+        Moved LowLevelInterpreter.asm to LowLevelInterpreter32_64.asm. Gave offlineasm
+        the ability to include files, and correctly track dependencies: it restricts
+        the include mechanism to using the same directory as the source file, and uses
+        the SHA1 hash of all .asm files in that directory as an input hash.
+
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm: Added.
+            - This is just the entire contents of what was previously LowLevelInterpreter.asm
+        * llint/LowLevelInterpreter64.asm: Added.
+        * offlineasm/asm.rb:
+        * offlineasm/ast.rb:
+        * offlineasm/generate_offset_extractor.rb:
+        * offlineasm/parser.rb:
+        * offlineasm/self_hash.rb:
+
+2012-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Offlineasm should support X86_64
+        https://bugs.webkit.org/show_bug.cgi?id=79581
+
+        Reviewed by Oliver Hunt.
+
+        * llint/LLIntOfflineAsmConfig.h:
+        * offlineasm/backends.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/settings.rb:
+        * offlineasm/x86.rb:
+
+2012-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should support activations and nested functions
+        https://bugs.webkit.org/show_bug.cgi?id=79554
+
+        Reviewed by Oliver Hunt.
+        
+        Wrote the simplest possible implementation of activations. Big speed-up on
+        code that uses activations, no speed-up on major benchmarks (SunSpider, V8,
+        Kraken) because they do not appear to have sufficient coverage over code
+        that uses activations.
+
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        (JSC::predictionFromValue):
+        * bytecode/PredictedType.h:
+        (JSC):
+        (JSC::isEmptyPrediction):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::buildOperandMapsIfNecessary):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::needsActivation):
+        * dfg/DFGNode.h:
+        (DFG):
+        (JSC::DFG::Node::storageAccessDataIndex):
+        (Node):
+        (JSC::DFG::Node::hasFunctionDeclIndex):
+        (JSC::DFG::Node::functionDeclIndex):
+        (JSC::DFG::Node::hasFunctionExprIndex):
+        (JSC::DFG::Node::functionExprIndex):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-02-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add an empty skeleton of KURL for WTFURL
+        https://bugs.webkit.org/show_bug.cgi?id=78990
+
+        Reviewed by Adam Barth.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Export the relevant classes from WTFURL
+        so that can use them in WebCore.
+
+2012-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build for DFG disabled and LLInt enabled.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2012-02-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix the CopiedBlock offset alignment in a cross platform fashion
+        https://bugs.webkit.org/show_bug.cgi?id=79556
+
+        Reviewed by Filip Pizlo.
+
+        Replaced m_payload with a payload() method that calculates the offset
+        of the payload with the proper alignment. This change allows us to 
+        avoid alignment-related issues in a cross-platform manner.
+
+        * heap/CopiedAllocator.h:
+        (JSC::CopiedAllocator::currentUtilization):
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::CopiedBlock):
+        (JSC::CopiedBlock::payload):
+        (CopiedBlock):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneFillingBlock):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::borrowBlock):
+        (JSC::CopiedSpace::allocateFromBlock):
+
+2012-02-24  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed, Windows build fix.  Changed signature in export to match
+        change made in r108858.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG support for op_new_regexp should be enabled
+        https://bugs.webkit.org/show_bug.cgi?id=79538
+
+        Reviewed by Oliver Hunt.
+        
+        No performance change.
+
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGCommon.h:
+
+2012-02-24  Michael Saboff  <msaboff@apple.com>
+
+        ASSERT(position < 0) in JSC::Yarr::Interpreter::InputStream::readChecked
+        https://bugs.webkit.org/show_bug.cgi?id=73728
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed the mixing of signed and unsigned character indeces in YARR
+        interpreter.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match): Added code to check for match longer than 2^31 and
+        return no match after resetting the offsets.
+        * yarr/YarrInterpreter.cpp: Changed to use unsigned for all character index
+        handling except when matching back references.
+        (JSC::Yarr::Interpreter::InputStream::readChecked):
+        (JSC::Yarr::Interpreter::InputStream::checkInput):
+        (JSC::Yarr::Interpreter::InputStream::uncheckInput):
+        (JSC::Yarr::Interpreter::InputStream::atStart):
+        (JSC::Yarr::Interpreter::InputStream::atEnd):
+        (JSC::Yarr::Interpreter::InputStream::isAvailableInput):
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::checkCasedCharacter):
+        (JSC::Yarr::Interpreter::checkCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::matchAssertionBOL):
+        (JSC::Yarr::Interpreter::matchAssertionWordBoundary):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
+        (JSC::Yarr::Interpreter::matchCharacterClass):
+        (JSC::Yarr::Interpreter::backtrackCharacterClass):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/YarrInterpreter.h:
+
+2012-02-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix for builds where the DFG is disabled but the LLInt is
+        enabled.
+
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter.asm:
+
+2012-02-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to handle variables getting captured
+        https://bugs.webkit.org/show_bug.cgi?id=79469
+
+        Reviewed by Oliver Hunt.
+        
+        Made captured variables work by placing a Flush on the SetLocal and
+        forcing the emission of the GetLocal even if copy propagation tells us
+        who has the value.
+        
+        Changed the CFA and various prediction codes to understand that we can't
+        really prove anything about captured variables. Well, we could in the
+        future by just looking at what side effects are happening, but in this
+        first cut we just assume that we can't reason about captured variables.
+        
+        Also added a mode where the DFG pretends that all variables and arguments
+        got captured. Used this mode to harden the code.
+        
+        This is performance neutral. Capturing all variables is a slow down, but
+        not too big of one. This seems to predict that when we add activation
+        support, the amount of speed benefit we'll get from increased coverage
+        will far outweigh the pessimism that we'll have to endure for captured
+        variables.
+
+        * bytecode/CodeType.h:
+        (JSC::codeTypeToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::merge):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::flushArgument):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::mightInlineFunctionForCall):
+        (JSC::DFG::mightInlineFunctionForConstruct):
+        * dfg/DFGCommon.h:
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::needsActivation):
+        (Graph):
+        (JSC::DFG::Graph::argumentIsCaptured):
+        (JSC::DFG::Graph::localIsCaptured):
+        (JSC::DFG::Graph::isCaptured):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldGenerate):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (DFG):
+        (JSC::DFG::ValueSource::dump):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (ValueSource):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+
+2012-02-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Should not allow malformed \x escapes
+        https://bugs.webkit.org/show_bug.cgi?id=79462
+
+        Reviewed by Oliver Hunt.
+
+        * parser/Lexer.cpp:
+        (JSC::::parseString):
+        (JSC::::parseStringSlowCase):
+            - Prohibit malformed '\x' escapes
+        * tests/mozilla/ecma/Array/15.4.5.1-1.js:
+        * tests/mozilla/ecma/LexicalConventions/7.7.4.js:
+        * tests/mozilla/ecma_2/RegExp/hex-001.js:
+        * tests/mozilla/js1_2/regexp/hexadecimal.js:
+            - Remove erroneous test cases (correct behaviour is tested by LayoutTests/sputnik).
+
+2012-02-24  Daniel Bates  <dbates@webkit.org>
+
+        Fix change log entry for changeset r108819; add bug URL
+        https://bugs.webkit.org/show_bug.cgi?id=79504
+
+        Changeset r108819 is associated with bug #79504.
+
+        * ChangeLog
+
+2012-02-24  Daniel Bates  <dbates@webkit.org>
+
+        Substitute ENABLE(CLASSIC_INTERPRETER) for ENABLE(INTERPRETER) in Interpreter.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79504
+
+        Reviewed by Oliver Hunt.
+
+        There are a few places in Interpreter.cpp that need to be updated to use
+        ENABLE(CLASSIC_INTERPRETER) following the renaming of ENABLE_INTERPRETER to
+        ENABLE_CLASSIC_INTERPRETER in changeset <http://trac.webkit.org/changeset/108020>
+        (https://bugs.webkit.org/show_bug.cgi?id=78791).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getLineNumberForCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::getSourceURLFromCallFrame):
+
+2012-02-24  Adam Roben  <aroben@apple.com>
+
+        Undo the BUILDING_WTF part of r108808
+
+        This broke the build, which is obviously worse than the linker warning it was trying to
+        solve.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+
+2012-02-24  Adam Roben  <aroben@apple.com>
+
+        Fix linker warnings on Windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed symbols that are already
+        exported via JS_EXPORTDATA.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Define BUILDING_WTF. We
+        aren't actually building WTF, but we are statically linking it, so we need to define this
+        symbol so that we export WTF's exports.
+
+2012-02-24  Philippe Normand  <pnormand@igalia.com>
+
+        Fix GTK WebAudio build for WebKitGTK 1.7.90.
+
+        Patch by Priit Laes <plaes@plaes.org> on 2012-02-24
+        Rubber-stamped by Philippe Normand.
+
+        * GNUmakefile.list.am: Add Complex.h to the list of files so it
+        gets disted in the tarballs.
+
 2012-02-24  Zoltan Herczeg  <zherczeg@webkit.org>
 
         [Qt] Buildfix for "Zero out CopiedBlocks on initialization".
diff --git a/Source/JavaScriptCore/Configurations/Base.xcconfig b/Source/JavaScriptCore/Configurations/Base.xcconfig
index 40c11b647..e4d3617fd 100644
--- a/Source/JavaScriptCore/Configurations/Base.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Base.xcconfig
@@ -71,7 +71,7 @@ WARNING_CFLAGS_macosx_ppc = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 // FIXME: JavaScriptCore 64-bit builds should build with -Wshorten-64-to-32
 WARNING_CFLAGS_macosx_ppc64 = $(WARNING_CFLAGS_BASE);
 WARNING_CFLAGS_macosx_x86_64 = $(WARNING_CFLAGS_BASE);
-HEADER_SEARCH_PATHS = . icu $(HEADER_SEARCH_PATHS);
+HEADER_SEARCH_PATHS = . icu "${BUILT_PRODUCTS_DIR}/usr/local/include" $(HEADER_SEARCH_PATHS);
 
 CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 CLANG_CXX_LIBRARY_1060 = libstdc++;
@@ -87,6 +87,11 @@ REAL_PLATFORM_NAME_macosx = macosx;
 
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
+FRAMEWORK_SEARCH_PATHS = $(STAGED_FRAMEWORKS_SEARCH_PATH);
+
+STAGED_FRAMEWORKS_SEARCH_PATH = $(STAGED_FRAMEWORKS_SEARCH_PATH_$(USE_STAGING_INSTALL_PATH));
+STAGED_FRAMEWORKS_SEARCH_PATH_YES = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
+
 NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR = $(NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
 NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR_iphonesimulator = $(NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR_iphoneos);
diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 576e746ad..58a02f521 100644
--- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -90,12 +90,14 @@ ENABLE_INDEXED_DATABASE = ;
 ENABLE_INPUT_COLOR = ;
 ENABLE_INPUT_SPEECH = ;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
+ENABLE_LEGACY_NOTIFICATIONS = ENABLE_LEGACY_NOTIFICATIONS;
 ENABLE_LINK_PREFETCH = ;
 ENABLE_MATHML = ENABLE_MATHML;
 ENABLE_MEDIA_SOURCE = ;
 ENABLE_MEDIA_STATISTICS = ;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_MHTML = ;
+ENABLE_MICRODATA = ;
 ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 
 ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
@@ -109,6 +111,7 @@ ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 ENABLE_QUOTA = ;
 ENABLE_REGISTER_PROTOCOL_HANDLER = ;
 ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
+ENABLE_SCRIPTED_SPEECH = ;
 ENABLE_SHADOW_DOM = ;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SQL_DATABASE = ENABLE_SQL_DATABASE;
@@ -118,7 +121,10 @@ ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
 ENABLE_VIDEO = ENABLE_VIDEO;
-ENABLE_VIDEO_TRACK = ;
+
+ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(REAL_PLATFORM_NAME));
+ENABLE_VIDEO_TRACK_macosx = ENABLE_VIDEO_TRACK;
+
 ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
@@ -126,4 +132,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LINK_PREFETCH) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig b/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
index d88b46e4e..fcef7550c 100644
--- a/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
+++ b/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
@@ -50,3 +50,5 @@ INFOPLIST_FILE = Info.plist;
 INSTALL_PATH = $(JAVASCRIPTCORE_FRAMEWORKS_DIR);
 DYLIB_INSTALL_NAME_BASE = $(NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR);
 PRODUCT_NAME = JavaScriptCore;
+
+INSTALLHDRS_SCRIPT_PHASE = YES;
diff --git a/Source/JavaScriptCore/Configurations/TestRegExp.xcconfig b/Source/JavaScriptCore/Configurations/TestRegExp.xcconfig
deleted file mode 100644
index 963ec34b3..000000000
--- a/Source/JavaScriptCore/Configurations/TestRegExp.xcconfig
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright (C) 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-INSTALL_PATH = $(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/Resources
-PRODUCT_NAME = testRegExp;
-
-SKIP_INSTALL = $(SKIP_INSTALL_$(FORCE_TOOL_INSTALL));
-SKIP_INSTALL_ = YES;
-SKIP_INSTALL_NO = YES;
-SKIP_INSTALL_YES = NO;
diff --git a/Source/JavaScriptCore/Configurations/TestAPI.xcconfig b/Source/JavaScriptCore/Configurations/ToolExecutable.xcconfig
index 65ac95ea0..194c240fa 100644
--- a/Source/JavaScriptCore/Configurations/TestAPI.xcconfig
+++ b/Source/JavaScriptCore/Configurations/ToolExecutable.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 INSTALL_PATH = $(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/Resources
-PRODUCT_NAME = testapi;
+PRODUCT_NAME = $(TARGET_NAME);
 
 SKIP_INSTALL = $(SKIP_INSTALL_$(FORCE_TOOL_INSTALL));
 SKIP_INSTALL_ = YES;
diff --git a/Source/JavaScriptCore/Configurations/Version.xcconfig b/Source/JavaScriptCore/Configurations/Version.xcconfig
index 7e3f57ea8..7477f4b74 100644
--- a/Source/JavaScriptCore/Configurations/Version.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Version.xcconfig
@@ -21,8 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-MAJOR_VERSION = 535;
-MINOR_VERSION = 23;
+MAJOR_VERSION = 536;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am
index 36b64a375..430b564c0 100644
--- a/Source/JavaScriptCore/GNUmakefile.list.am
+++ b/Source/JavaScriptCore/GNUmakefile.list.am
@@ -95,6 +95,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/bytecode/DFGExitProfile.cpp \
 	Source/JavaScriptCore/bytecode/DFGExitProfile.h \
 	Source/JavaScriptCore/bytecode/EvalCodeCache.h \
+	Source/JavaScriptCore/bytecode/ExecutionCounter.cpp \
+	Source/JavaScriptCore/bytecode/ExecutionCounter.h \
 	Source/JavaScriptCore/bytecode/ExpressionRangeInfo.h \
 	Source/JavaScriptCore/bytecode/GetByIdStatus.cpp \
 	Source/JavaScriptCore/bytecode/GetByIdStatus.h \
@@ -167,6 +169,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGGraph.h \
 	Source/JavaScriptCore/dfg/DFGJITCompiler.cpp \
 	Source/JavaScriptCore/dfg/DFGJITCompiler.h \
+	Source/JavaScriptCore/dfg/DFGNode.cpp \
 	Source/JavaScriptCore/dfg/DFGNode.h \
 	Source/JavaScriptCore/dfg/DFGNodeReferenceBlob.h \
 	Source/JavaScriptCore/dfg/DFGNodeUse.h \
@@ -185,6 +188,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGPhase.h \
 	Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp \
 	Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.h \
+	Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp \
+	Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.h \
 	Source/JavaScriptCore/dfg/DFGRegisterBank.h \
 	Source/JavaScriptCore/dfg/DFGRepatch.cpp \
 	Source/JavaScriptCore/dfg/DFGRepatch.h \
@@ -309,6 +314,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/jit/JITCall32_64.cpp \
 	Source/JavaScriptCore/jit/JITCall.cpp \
 	Source/JavaScriptCore/jit/JITCode.h \
+	Source/JavaScriptCore/jit/JITCompilationEffort.h \
 	Source/JavaScriptCore/jit/JITDriver.h \
 	Source/JavaScriptCore/jit/JIT.cpp \
 	Source/JavaScriptCore/jit/JIT.h \
@@ -328,6 +334,10 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/jit/ThunkGenerators.cpp \
 	Source/JavaScriptCore/jit/ThunkGenerators.h \
 	Source/JavaScriptCore/llint/LLIntData.h \
+	Source/JavaScriptCore/llint/LLIntEntrypoints.cpp \
+	Source/JavaScriptCore/llint/LLIntEntrypoints.h \
+	Source/JavaScriptCore/llint/LowLevelInterpreter.cpp \
+	Source/JavaScriptCore/llint/LowLevelInterpreter.h \
 	Source/JavaScriptCore/os-win32/stdbool.h \
 	Source/JavaScriptCore/os-win32/stdint.h \
 	Source/JavaScriptCore/parser/ASTBuilder.h \
@@ -583,7 +593,9 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/wtf/ByteArray.h \
 	Source/JavaScriptCore/wtf/CheckedArithmetic.h \
 	Source/JavaScriptCore/wtf/CheckedBoolean.h \
+	Source/JavaScriptCore/wtf/RefCountedArray.h \
 	Source/JavaScriptCore/wtf/Compiler.h \
+	Source/JavaScriptCore/wtf/Complex.h \
 	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp \
 	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h \
 	Source/JavaScriptCore/wtf/CurrentTime.cpp \
@@ -710,6 +722,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/wtf/SentinelLinkedList.h \
 	Source/JavaScriptCore/wtf/SHA1.cpp \
 	Source/JavaScriptCore/wtf/SHA1.h \
+	Source/JavaScriptCore/wtf/SimpleStats.h \
 	Source/JavaScriptCore/wtf/SinglyLinkedList.h \
 	Source/JavaScriptCore/wtf/Spectrum.h \
 	Source/JavaScriptCore/wtf/StackBounds.cpp \
@@ -831,4 +844,5 @@ Programs_minidom_SOURCES = \
 	Source/JavaScriptCore/API/tests/minidom.c
 
 Programs_jsc_@WEBKITGTK_API_MAJOR_VERSION@_SOURCES = \
+	Source/JavaScriptCore/JSCTypedArrayStubs.h \
 	Source/JavaScriptCore/jsc.cpp
diff --git a/Source/JavaScriptCore/JSCTypedArrayStubs.h b/Source/JavaScriptCore/JSCTypedArrayStubs.h
index cda55fc9b..e3546ee65 100644
--- a/Source/JavaScriptCore/JSCTypedArrayStubs.h
+++ b/Source/JavaScriptCore/JSCTypedArrayStubs.h
@@ -151,7 +151,7 @@ void JS##name##Array::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSV
     m_impl->set(index, value.toNumber(exec));\
 }\
 \
-void JS##name##Array::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value)\
+void JS##name##Array::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool)\
 {\
     JS##name##Array* thisObject = jsCast<JS##name##Array*>(cell);\
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
index 009a8a044..0834a3fe8 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
@@ -3,7 +3,7 @@ Microsoft Visual Studio Solution File, Format Version 9.00
 # Visual Studio 2005
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCore", "JavaScriptCore\JavaScriptCore.vcproj", "{011D10F1-B656-4A1B-A0C3-3842F02122C5}"
 	ProjectSection(ProjectDependencies) = postProject
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}
 	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "jsc\jsc.vcproj", "{C59E5129-B453-49B7-A52B-1E104715F76E}"
@@ -13,16 +13,21 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "jsc\jsc.vcproj", "{C
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTF", "WTF\WTF.vcproj", "{AA8A5A85-592B-4357-BC60-E0E91E026AF6}"
 	ProjectSection(ProjectDependencies) = postProject
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950} = {5AE5F5E4-782D-4F63-B4D7-3977B52B9950}
 	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "JavaScriptCore\JavaScriptCoreGenerated.vcproj", "{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"
+	ProjectSection(ProjectDependencies) = postProject
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}
+	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "testRegExp", "testRegExp\testRegExp.vcproj", "{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}"
 	ProjectSection(ProjectDependencies) = postProject
 		{C59E5129-B453-49B7-A52B-1E104715F76E} = {C59E5129-B453-49B7-A52B-1E104715F76E}
 	EndProjectSection
 EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTFGenerated", "WTF\WTFGenerated.vcproj", "{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
@@ -77,10 +82,10 @@ Global
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.Build.0 = Production|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.ActiveCfg = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.Build.0 = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.ActiveCfg = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.Build.0 = Production|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -115,6 +120,22 @@ Global
 		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
 		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release|Win32.ActiveCfg = Release|Win32
 		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release|Win32.Build.0 = Release|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_All|Win32.Build.0 = Debug_All|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug|Win32.ActiveCfg = Debug|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug|Win32.Build.0 = Debug|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Production|Win32.ActiveCfg = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Production|Win32.Build.0 = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO_Optimize|Win32.ActiveCfg = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO_Optimize|Win32.Build.0 = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO|Win32.ActiveCfg = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO|Win32.Build.0 = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release|Win32.ActiveCfg = Release|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index acdf47b7c..c50a4252b 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -137,7 +137,6 @@ EXPORTS
     ?dayInMonthFromDayInYear@WTF@@YAHH_N@Z
     ?dayInYear@WTF@@YAHNH@Z
     ?decrement@RefCountedLeakCounter@WTF@@QAEXXZ
-    ?defaultAttributes@PropertyDescriptor@JSC@@0IA
     ?defaultValue@JSObject@JSC@@SA?AVJSValue@2@PBV12@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
     ?defineOwnProperty@JSGlobalObject@JSC@@SA_NPAVJSObject@2@PAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@_N@Z
     ?defineOwnProperty@JSObject@JSC@@SA_NPAV12@PAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@_N@Z
@@ -230,7 +229,7 @@ EXPORTS
     ?initializeMainThread@WTF@@YAXXZ
     ?initializeThreading@JSC@@YAXXZ
     ?initializeThreading@WTF@@YAXXZ
-    ?interpret@Yarr@JSC@@YAHPAUBytecodePattern@12@ABVUString@2@IIPAH@Z
+    ?interpret@Yarr@JSC@@YAIPAUBytecodePattern@12@ABVUString@2@IIPAI@Z
     ?isAccessorDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
     ?isBusy@Heap@JSC@@QAE_NXZ
     ?isDataDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
@@ -276,8 +275,8 @@ EXPORTS
     ?put@JSByteArray@JSC@@SAXPAVJSCell@2@PAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
     ?put@JSGlobalObject@JSC@@SAXPAVJSCell@2@PAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
     ?put@JSObject@JSC@@SAXPAVJSCell@2@PAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
-    ?putByIndex@JSByteArray@JSC@@SAXPAVJSCell@2@PAVExecState@2@IVJSValue@2@@Z
-    ?putByIndex@JSObject@JSC@@SAXPAVJSCell@2@PAVExecState@2@IVJSValue@2@@Z
+    ?putByIndex@JSObject@JSC@@SAXPAVJSCell@2@PAVExecState@2@IVJSValue@2@_N@Z
+    ?putDirectIndexBeyondVectorLength@JSArray@JSC@@AAE_NPAVExecState@2@IVJSValue@2@_N@Z
     ?putDirectVirtual@JSGlobalObject@JSC@@SAXPAVJSObject@2@PAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
     ?putDirectVirtual@JSObject@JSC@@SAXPAV12@PAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
     ?randomNumber@WTF@@YANXZ
@@ -298,7 +297,6 @@ EXPORTS
     ?restoreAll@Profile@JSC@@QAEXXZ
     ?retrieveCallerFromVMCode@Interpreter@JSC@@QBE?AVJSValue@2@PAVExecState@2@PAVJSFunction@2@@Z
     ?retrieveLastCaller@Interpreter@JSC@@QBEXPAVExecState@2@AAH1AAVUString@2@AAVJSValue@2@@Z
-    ?s_globalObjectMethodTable@JSGlobalObject@JSC@@1UGlobalObjectMethodTable@2@B
     ?setConfigurable@PropertyDescriptor@JSC@@QAEX_N@Z
     ?setDescriptor@PropertyDescriptor@JSC@@QAEXVJSValue@2@I@Z
     ?setDumpsGeneratedCode@BytecodeGenerator@JSC@@SAX_N@Z
@@ -350,6 +348,7 @@ EXPORTS
     ?toThisObject@JSObject@JSC@@SAPAV12@PAVJSCell@2@PAVExecState@2@@Z
     ?toThisObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
     ?toUInt32@Identifier@JSC@@SAIABVUString@2@AA_N@Z
+    ?transfer@ArrayBuffer@WTF@@QAE_NAAVArrayBufferContents@2@AAV?$Vector@V?$RefPtr@VArrayBufferView@WTF@@@WTF@@$0A@@2@@Z
     ?tryFastCalloc@WTF@@YA?AUTryMallocReturnValue@1@II@Z
     ?tryFastMalloc@WTF@@YA?AUTryMallocReturnValue@1@I@Z
     ?tryFastRealloc@WTF@@YA?AUTryMallocReturnValue@1@PAXI@Z
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index b9e0f3152..8599dedb8 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -1478,6 +1478,10 @@
 			Name="bytecode"
 			>
 			<File
+				RelativePath="..\..\bytecode\ExecutionCounter.cpp"
+				>
+			</File>
+			<File
 				RelativePath="..\..\bytecode\MethodOfGettingAValueProfile.cpp"
 				>
 			</File>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
index 20a9a5078..c7c640b0d 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
@@ -1,9 +1,6 @@
 all:
     touch "%ConfigurationBuildDir%\buildfailed"
     bash build-generated-files.sh "%ConfigurationBuildDir%" "$(WEBKITLIBRARIESDIR)"
-!IF "$(OFFICIAL_BUILD)"!="1"
-    bash -c "python work-around-vs-dependency-tracking-bugs.py"
-!ENDIF
     copy-files.cmd
 
     -del "%ConfigurationBuildDir%\include\private\JavaScriptCore\stdbool.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore\stdint.h"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
index 6d3351ee1..5e91b148b 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
@@ -69,15 +69,6 @@
 				Name="VCNMakeTool"
 			/>
 		</Configuration>
-		<Configuration
-			Name="Release_PGO|Win32"
-			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedReleasePGO.vsprops"
-			>
-			<Tool
-				Name="VCNMakeTool"
-			/>
-		</Configuration>
 	</Configurations>
 	<References>
 	</References>
@@ -98,10 +89,6 @@
 			RelativePath=".\JavaScriptCoreGenerated.make"
 			>
 		</File>
-		<File
-			RelativePath=".\work-around-vs-dependency-tracking-bugs.py"
-			>
-		</File>
 	</Files>
 	<Globals>
 	</Globals>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh
index 3998c65f9..56316e9d7 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh
@@ -1,15 +1,5 @@
 #!/usr/bin/bash
 
-# Determine whether we have the versioned ICU 4.0 or the unversioned ICU 4.4
-UNVERSIONED_ICU_LIB_PATH=$(cygpath -u "${WEBKITLIBRARIESDIR}/lib/libicuuc.lib")
-ICUVERSION_H_PATH=$(cygpath -u "${CONFIGURATIONBUILDDIR}/include/private/ICUVersion.h")
-if test \( ! -f "${ICUVERSION_H_PATH}" \) -o \( -f "${UNVERSIONED_ICU_LIB_PATH}" -a \( "${UNVERSIONED_ICU_LIB_PATH}" -nt "${ICUVERSION_H_PATH}" \) \)
-then
-    mkdir -p "$(dirname "${ICUVERSION_H_PATH}")"
-    test ! -f "${UNVERSIONED_ICU_LIB_PATH}"
-    echo "#define U_DISABLE_RENAMING $?" > "${ICUVERSION_H_PATH}"
-fi
-
 NUMCPUS=`../../../../Tools/Scripts/num-cpus`
 
 XSRCROOT="`pwd`/../.."
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd
index 2c0cfad02..524e38037 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd
@@ -1,83 +1,66 @@
-@echo off
-
-set PublicHeadersDirectory=%CONFIGURATIONBUILDDIR%\include\JavaScriptCore
-set PrivateHeadersDirectory=%CONFIGURATIONBUILDDIR%\include\private\JavaScriptCore
-set ResourcesDirectory=%CONFIGURATIONBUILDDIR%\bin\JavaScriptCore.resources
-
-if "%1" EQU "clean" goto :clean
-if "%1" EQU "rebuild" call :clean
-
-echo Copying public headers...
-mkdir "%PublicHeadersDirectory%" 2>NUL
-for %%f in (
-    APICast.h
-    APIShims.h
-    JSBase.h
-    JSContextRef.h
-    JSContextRefPrivate.h
-    JSObjectRef.h
-    JSObjectRefPrivate.h
-    JSRetainPtr.h
-    JSRetainPtr.h
-    JSStringRef.h
-    JSStringRefBSTR.h
-    JSStringRefCF.h
-    JSValueRef.h
-    JSWeakObjectMapRefInternal.h
-    JSWeakObjectMapRefPrivate.h
-    JavaScript.h
-    JavaScriptCore.h
-    OpaqueJSString.h
-    WebKitAvailability.h
-) do (
-    xcopy /y /d ..\..\API\%%f "%PublicHeadersDirectory%" >NUL
-)
-
-echo Copying private headers...
-mkdir "%PrivateHeadersDirectory%" 2>NUL
-for %%d in (
-    assembler
-    bytecode
-    dfg
-    heap
-    debugger
-    interpreter
-    jit
-    llint
-    parser
-    profiler
-    runtime
-    wtf
-    wtf\dtoa
-    wtf\text
-    wtf\threads
-    wtf\unicode
-    wtf\unicode\icu
-    yarr
-) do (
-    xcopy /y /d ..\..\%%d\*.h "%PrivateHeadersDirectory%" >NUL
-)
-
-echo Copying resources...
-mkdir "%ResourcesDirectory%" 2>NUL
-xcopy /y /d ..\JavaScriptCore.resources\* "%ResourcesDirectory%" >NUL
-
-echo Copying other files...
-for %%f in (
-    create_hash_table
-    wtf\text\AtomicString.cpp
-    wtf\text\StringBuilder.cpp
-    wtf\text\StringImpl.cpp
-    wtf\text\WTFString.cpp
-) do (
-    xcopy /y /d ..\..\%%f "%PrivateHeadersDirectory%" >NUL
-)
-
-goto :EOF
-
-:clean
-
-echo Deleting copied files...
-if exist "%PublicHeadersDirectory%" rmdir /s /q "%PublicHeadersDirectory%" >NUL
-if exist "%PrivateHeadersDirectory%" rmdir /s /q "%PrivateHeadersDirectory%" >NUL
-if exist "%ResourcesDirectory%" rmdir /s /q "%ResourcesDirectory%" >NUL
+@echo off

+

+set PublicHeadersDirectory=%CONFIGURATIONBUILDDIR%\include\JavaScriptCore

+set PrivateHeadersDirectory=%CONFIGURATIONBUILDDIR%\include\private\JavaScriptCore

+set ResourcesDirectory=%CONFIGURATIONBUILDDIR%\bin\JavaScriptCore.resources

+

+if "%1" EQU "clean" goto :clean

+if "%1" EQU "rebuild" call :clean

+

+echo Copying public headers...

+mkdir "%PublicHeadersDirectory%" 2>NUL

+for %%f in (

+    APICast.h

+    APIShims.h

+    JSBase.h

+    JSContextRef.h

+    JSContextRefPrivate.h

+    JSObjectRef.h

+    JSObjectRefPrivate.h

+    JSRetainPtr.h

+    JSRetainPtr.h

+    JSStringRef.h

+    JSStringRefBSTR.h

+    JSStringRefCF.h

+    JSValueRef.h

+    JSWeakObjectMapRefInternal.h

+    JSWeakObjectMapRefPrivate.h

+    JavaScript.h

+    JavaScriptCore.h

+    OpaqueJSString.h

+    WebKitAvailability.h

+) do (

+    xcopy /y /d ..\..\API\%%f "%PublicHeadersDirectory%" >NUL

+)

+

+echo Copying private headers...

+mkdir "%PrivateHeadersDirectory%" 2>NUL

+for %%d in (

+    assembler

+    bytecode

+    dfg

+    heap

+    debugger

+    interpreter

+    jit

+    llint

+    parser

+    profiler

+    runtime

+    yarr

+) do (

+    xcopy /y /d ..\..\%%d\*.h "%PrivateHeadersDirectory%" >NUL

+)

+

+echo Copying resources...

+mkdir "%ResourcesDirectory%" 2>NUL

+xcopy /y /d ..\JavaScriptCore.resources\* "%ResourcesDirectory%" >NUL

+

+goto :EOF

+

+:clean

+

+echo Deleting copied files...

+if exist "%PublicHeadersDirectory%" rmdir /s /q "%PublicHeadersDirectory%" >NUL

+if exist "%PrivateHeadersDirectory%" rmdir /s /q "%PrivateHeadersDirectory%" >NUL

+if exist "%ResourcesDirectory%" rmdir /s /q "%ResourcesDirectory%" >NUL

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
index 1e24f2870..2ff339fb1 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
@@ -3,26 +3,33 @@ Microsoft Visual Studio Solution File, Format Version 9.00
 # Visual Studio 2005
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCore", "JavaScriptCore\JavaScriptCore.vcproj", "{011D10F1-B656-4A1B-A0C3-3842F02122C5}"
 	ProjectSection(ProjectDependencies) = postProject
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTF", "WTF\WTF.vcproj", "{AA8A5A85-592B-4357-BC60-E0E91E026AF6}"
-	ProjectSection(ProjectDependencies) = postProject
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}
 	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "JavaScriptCore\JavaScriptCoreGenerated.vcproj", "{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"
+	ProjectSection(ProjectDependencies) = postProject
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}
+	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "jsc\jsc.vcproj", "{C59E5129-B453-49B7-A52B-1E104715F76E}"
 	ProjectSection(ProjectDependencies) = postProject
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5} = {011D10F1-B656-4A1B-A0C3-3842F02122C5}
 	EndProjectSection
 EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTF", "WTF\WTF.vcproj", "{AA8A5A85-592B-4357-BC60-E0E91E026AF6}"
+	ProjectSection(ProjectDependencies) = postProject
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950} = {5AE5F5E4-782D-4F63-B4D7-3977B52B9950}
+	EndProjectSection
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTFGenerated", "WTF\WTFGenerated.vcproj", "{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
+		Debug_Cairo_CFLite|Win32 = Debug_Cairo_CFLite|Win32
 		Debug|Win32 = Debug|Win32
 		Production|Win32 = Production|Win32
+		Release_Cairo_CFLite|Win32 = Release_Cairo_CFLite|Win32
 		Release_PGO_Optimize|Win32 = Release_PGO_Optimize|Win32
 		Release_PGO|Win32 = Release_PGO|Win32
 		Release|Win32 = Release|Win32
@@ -30,34 +37,30 @@ Global
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.ActiveCfg = Production|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.Build.0 = Production|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO_Optimize|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO_Optimize|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.Build.0 = Debug|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.ActiveCfg = Production|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.Build.0 = Production|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = Debug_All|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Debug|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Debug|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.ActiveCfg = Production|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.Build.0 = Production|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -66,16 +69,52 @@ Global
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = Release|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.ActiveCfg = Production|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.Build.0 = Production|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.ActiveCfg = Release|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.Build.0 = Release|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.Build.0 = Debug|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.ActiveCfg = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.Build.0 = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.ActiveCfg = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.Build.0 = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.ActiveCfg = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.Build.0 = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_All|Win32.Build.0 = Debug_All|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug|Win32.ActiveCfg = Debug|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug|Win32.Build.0 = Debug|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Production|Win32.ActiveCfg = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Production|Win32.Build.0 = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO_Optimize|Win32.ActiveCfg = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO_Optimize|Win32.Build.0 = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO|Win32.ActiveCfg = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO|Win32.Build.0 = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release|Win32.ActiveCfg = Release|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
index 5689b2608..3bf7817f3 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
@@ -328,58 +328,6 @@
 				Name="VCPostBuildEventTool"
 			/>
 		</Configuration>
-		<Configuration
-			Name="Release_PGO|Win32"
-			ConfigurationType="4"
-			InheritedPropertySheets=".\WTFReleasePGO.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLibrarianTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
 	</Configurations>
 	<References>
 	</References>
@@ -512,93 +460,85 @@
 				>
 			</File>
 		</Filter>
-        <Filter
-            Name="dtoa"
-            >
-            <File
-                RelativePath="..\..\wtf\dtoa\bignum-dtoa.cc"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\bignum-dtoa.h"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\bignum.cc"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\bignum.h"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\cached-powers.cc"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\cached-powers.h"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\diy-fp.cc"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\diy-fp.h"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\double-conversion.cc"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\double-conversion.h"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\double.h"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\fast-dtoa.cc"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\fast-dtoa.h"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\fixed-dtoa.cc"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\fixed-dtoa.h"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\strtod.cc"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\strtod.h"
-                >
-            </File>
-            <File
-                RelativePath="..\..\wtf\dtoa\utils.h"
-                >
-            </File>
-        </Filter>
+		<Filter
+			Name="dtoa"
+			>
+			<File
+				RelativePath="..\..\wtf\dtoa\bignum-dtoa.cc"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\bignum-dtoa.h"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\bignum.cc"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\bignum.h"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\cached-powers.cc"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\cached-powers.h"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\diy-fp.cc"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\diy-fp.h"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\double-conversion.cc"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\double-conversion.h"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\double.h"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\fast-dtoa.cc"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\fast-dtoa.h"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\fixed-dtoa.cc"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\fixed-dtoa.h"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\strtod.cc"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\strtod.h"
+				>
+			</File>
+			<File
+				RelativePath="..\..\wtf\dtoa\utils.h"
+				>
+			</File>
+		</Filter>
 		<Filter
 			Name="threads"
 			>
-    		<Filter
-    			Name="win"
-    			>
-    			<File
-    				RelativePath="..\..\wtf\threads\win\BinarySemaphoreWin.cpp"
-    				>
-    			</File>
-    		</Filter>
 			<File
 				RelativePath="..\..\wtf\threads\BinarySemaphore.cpp"
 				>
@@ -607,6 +547,14 @@
 				RelativePath="..\..\wtf\threads\BinarySemaphore.h"
 				>
 			</File>
+			<Filter
+				Name="win"
+				>
+				<File
+					RelativePath="..\..\wtf\threads\win\BinarySemaphoreWin.cpp"
+					>
+				</File>
+			</Filter>
 		</Filter>
 		<File
 			RelativePath="..\..\wtf\Alignment.h"
@@ -653,15 +601,15 @@
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\BitVector.cpp"
+			RelativePath="..\..\wtf\Bitmap.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\BitVector.h"
+			RelativePath="..\..\wtf\BitVector.cpp"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\Bitmap.h"
+			RelativePath="..\..\wtf\BitVector.h"
 			>
 		</File>
 		<File
@@ -721,23 +669,23 @@
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\DecimalNumber.cpp"
+			RelativePath="..\..\wtf\DataLog.cpp"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\DecimalNumber.h"
+			RelativePath="..\..\wtf\DataLog.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\Decoder.h"
+			RelativePath="..\..\wtf\DecimalNumber.cpp"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\DataLog.cpp"
+			RelativePath="..\..\wtf\DecimalNumber.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\DataLog.h"
+			RelativePath="..\..\wtf\Decoder.h"
 			>
 		</File>
 		<File
@@ -753,27 +701,19 @@
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\DynamicAnnotations.cpp"
-			>
-		</File>
-		<File
-			RelativePath="..\..\wtf\DynamicAnnotations.h"
-			>
-		</File>
-		<File
-			RelativePath="..\..\wtf\Float32Array.h"
+			RelativePath="..\..\wtf\dtoa.cpp"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\Float64Array.h"
+			RelativePath="..\..\wtf\dtoa.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\dtoa.cpp"
+			RelativePath="..\..\wtf\DynamicAnnotations.cpp"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\dtoa.h"
+			RelativePath="..\..\wtf\DynamicAnnotations.h"
 			>
 		</File>
 		<File
@@ -811,14 +751,6 @@
 					DisableSpecificWarnings="4702"
 				/>
 			</FileConfiguration>
-			<FileConfiguration
-				Name="Release_PGO|Win32"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					DisableSpecificWarnings="4702"
-				/>
-			</FileConfiguration>
 		</File>
 		<File
 			RelativePath="..\..\wtf\FastMalloc.h"
@@ -829,6 +761,14 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\wtf\Float32Array.h"
+			>
+		</File>
+		<File
+			RelativePath="..\..\wtf\Float64Array.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\Forward.h"
 			>
 		</File>
@@ -917,27 +857,27 @@
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\MetaAllocator.cpp"
+			RelativePath="..\..\wtf\MD5.cpp"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\MetaAllocator.h"
+			RelativePath="..\..\wtf\MD5.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\MetaAllocatorHandle.h"
+			RelativePath="..\..\wtf\MessageQueue.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\MD5.cpp"
+			RelativePath="..\..\wtf\MetaAllocator.cpp"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\MD5.h"
+			RelativePath="..\..\wtf\MetaAllocator.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\MessageQueue.h"
+			RelativePath="..\..\wtf\MetaAllocatorHandle.h"
 			>
 		</File>
 		<File
@@ -1021,39 +961,39 @@
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\PassOwnArrayPtr.h"
+			RelativePath="..\..\wtf\ParallelJobs.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\PassOwnPtr.h"
+			RelativePath="..\..\wtf\ParallelJobsGeneric.cpp"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\PassRefPtr.h"
+			RelativePath="..\..\wtf\ParallelJobsGeneric.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\PassTraits.h"
+			RelativePath="..\..\wtf\ParallelJobsLibdispatch.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\ParallelJobs.h"
+			RelativePath="..\..\wtf\ParallelJobsOpenMP.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\ParallelJobsGeneric.cpp"
+			RelativePath="..\..\wtf\PassOwnArrayPtr.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\ParallelJobsGeneric.h"
+			RelativePath="..\..\wtf\PassOwnPtr.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\ParallelJobsLibdispatch.h"
+			RelativePath="..\..\wtf\PassRefPtr.h"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\ParallelJobsOpenMP.h"
+			RelativePath="..\..\wtf\PassTraits.h"
 			>
 		</File>
 		<File
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGenerated.make b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGenerated.make
new file mode 100644
index 000000000..e7896fdfb
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGenerated.make
@@ -0,0 +1,13 @@
+all:
+    touch "%ConfigurationBuildDir%\buildfailed"
+    bash build-generated-files.sh "%ConfigurationBuildDir%" "$(WEBKITLIBRARIESDIR)"
+!IF "$(OFFICIAL_BUILD)"!="1"
+    bash -c "python work-around-vs-dependency-tracking-bugs.py"
+!ENDIF
+    copy-files.cmd
+
+    -del "%ConfigurationBuildDir%\buildfailed"
+
+clean:
+    -del "%ConfigurationBuildDir%\buildfailed"
+    copy-files.cmd clean
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGenerated.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGenerated.vcproj
new file mode 100644
index 000000000..3cb825062
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGenerated.vcproj
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioProject
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFGenerated"
+	ProjectGUID="{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}"
+	RootNamespace="WTFGenerated"
+	Keyword="MakeFileProj"
+	>
+	<Platforms>
+		<Platform
+			Name="Win32"
+		/>
+	</Platforms>
+	<ToolFiles>
+	</ToolFiles>
+	<Configurations>
+		<Configuration
+			Name="Debug|Win32"
+			ConfigurationType="0"
+			InheritedPropertySheets=".\WTFGeneratedDebug.vsprops"
+			>
+			<Tool
+				Name="VCNMakeTool"
+			/>
+		</Configuration>
+		<Configuration
+			Name="Debug_All|Win32"
+			ConfigurationType="0"
+			InheritedPropertySheets=".\WTFGeneratedDebugAll.vsprops"
+			>
+			<Tool
+				Name="VCNMakeTool"
+			/>
+		</Configuration>
+		<Configuration
+			Name="Release|Win32"
+			ConfigurationType="0"
+			InheritedPropertySheets=".\WTFGeneratedRelease.vsprops"
+			>
+			<Tool
+				Name="VCNMakeTool"
+			/>
+		</Configuration>
+		<Configuration
+			Name="Production|Win32"
+			ConfigurationType="0"
+			InheritedPropertySheets=".\WTFGeneratedProduction.vsprops"
+			>
+			<Tool
+				Name="VCNMakeTool"
+			/>
+		</Configuration>
+		<Configuration
+			Name="Release_Cairo_CFLite|Win32"
+			ConfigurationType="0"
+			InheritedPropertySheets=".\WTFGeneratedReleaseCairoCFLite.vsprops"
+			>
+			<Tool
+				Name="VCNMakeTool"
+			/>
+		</Configuration>
+		<Configuration
+			Name="Debug_Cairo_CFLite|Win32"
+			ConfigurationType="0"
+			InheritedPropertySheets=".\WTFGeneratedDebugCairoCFLite.vsprops"
+			>
+			<Tool
+				Name="VCNMakeTool"
+			/>
+		</Configuration>
+	</Configurations>
+	<References>
+	</References>
+	<Files>
+		<File
+			RelativePath=".\build-generated-files.sh"
+			>
+		</File>
+		<File
+			RelativePath=".\copy-files.cmd"
+			>
+		</File>
+		<File
+			RelativePath=".\work-around-vs-dependency-tracking-bugs.py"
+			>
+		</File>
+		<File
+			RelativePath=".\WTFGenerated.make"
+			>
+		</File>
+	</Files>
+	<Globals>
+	</Globals>
+</VisualStudioProject>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedCommon.vsprops
new file mode 100644
index 000000000..5173df8ef
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedCommon.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFGeneratedCommon"
+	OutputDirectory="$(ConfigurationBuildDir)\lib"
+	>
+	<Tool
+		Name="VCNMakeTool"
+		BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f WTFGenerated.make"
+		ReBuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f WTFGenerated.make clean&#x0D;&#x0A;nmake -f WTFGenerated.make"
+		CleanCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f WTFGenerated.make clean"
+	/>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedDebug.vsprops
new file mode 100644
index 000000000..bc16aca94
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedDebug.vsprops
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFGeneratedDebug"
+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WTFGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedDebugAll.vsprops
new file mode 100644
index 000000000..cacea402c
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedDebugAll.vsprops
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFGeneratedDebugAll"
+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\WTFGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedDebugCairoCFLite.vsprops
new file mode 100644
index 000000000..fbc371372
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedDebugCairoCFLite.vsprops
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFGeneratedDebugCairoCFLite"
+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\WTFGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedProduction.vsprops
new file mode 100644
index 000000000..3e49ed6ea
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedProduction.vsprops
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFGeneratedProduction"
+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\WTFGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedRelease.vsprops
index 41b7f7bfa..74a4debaa 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedRelease.vsprops
@@ -2,7 +2,7 @@
 <VisualStudioPropertySheet
 	ProjectType="Visual C++"
 	Version="8.00"
-	Name="WTFReleasePGO"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\WTFCommon.vsprops"
+	Name="WTFGeneratedRelease"
+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WTFGeneratedCommon.vsprops"
 	>
 </VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedReleaseCairoCFLite.vsprops
new file mode 100644
index 000000000..730d71941
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFGeneratedReleaseCairoCFLite.vsprops
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFGeneratedReleaseCairoCFLite"
+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\WTFGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/build-generated-files.sh b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/build-generated-files.sh
new file mode 100755
index 000000000..d1a4e560f
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/build-generated-files.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/bash
+
+# Determine whether we have the versioned ICU 4.0 or the unversioned ICU 4.4
+UNVERSIONED_ICU_LIB_PATH=$(cygpath -u "${WEBKITLIBRARIESDIR}/lib/libicuuc.lib")
+ICUVERSION_H_PATH=$(cygpath -u "${CONFIGURATIONBUILDDIR}/include/private/ICUVersion.h")
+if test \( ! -f "${ICUVERSION_H_PATH}" \) -o \( -f "${UNVERSIONED_ICU_LIB_PATH}" -a \( "${UNVERSIONED_ICU_LIB_PATH}" -nt "${ICUVERSION_H_PATH}" \) \)
+then
+    mkdir -p "$(dirname "${ICUVERSION_H_PATH}")"
+    test ! -f "${UNVERSIONED_ICU_LIB_PATH}"
+    echo "#define U_DISABLE_RENAMING $?" > "${ICUVERSION_H_PATH}"
+fi
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/copy-files.cmd b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/copy-files.cmd
new file mode 100755
index 000000000..3160e5cc1
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/copy-files.cmd
@@ -0,0 +1,37 @@
+@echo off

+

+set PrivateHeadersDirectory=%CONFIGURATIONBUILDDIR%\include\private\JavaScriptCore

+

+if "%1" EQU "clean" goto :clean

+if "%1" EQU "rebuild" call :clean

+

+echo Copying WTF headers...

+for %%d in (

+    wtf

+    wtf\dtoa

+    wtf\text

+    wtf\threads

+    wtf\unicode

+    wtf\unicode\icu

+) do (

+    mkdir "%PrivateHeadersDirectory%\%%d" 2>NUL

+    xcopy /y /d ..\..\%%d\*.h "%PrivateHeadersDirectory%\%%d" >NUL

+)

+

+echo Copying other files...

+for %%f in (

+    create_hash_table

+    wtf\text\AtomicString.cpp

+    wtf\text\StringBuilder.cpp

+    wtf\text\StringImpl.cpp

+    wtf\text\WTFString.cpp

+) do (

+    echo F | xcopy /y /d ..\..\%%f "%PrivateHeadersDirectory%\%%f" >NUL

+)

+

+goto :EOF

+

+:clean

+

+echo Deleting copied files...

+if exist "%PrivateHeadersDirectory%" rmdir /s /q "%PrivateHeadersDirectory%" >NUL

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/work-around-vs-dependency-tracking-bugs.py b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/work-around-vs-dependency-tracking-bugs.py
index 5060f69c4..5060f69c4 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/work-around-vs-dependency-tracking-bugs.py
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/work-around-vs-dependency-tracking-bugs.py
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
index a650cd2e5..21f13fc47 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
@@ -448,7 +448,7 @@
 	</References>
 	<Files>
 		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\AtomicString.cpp"
+			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\AtomicString.cpp"
 			>
 		</File>
 		<File
@@ -456,15 +456,15 @@
 			>
 		</File>
 		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\StringBuilder.cpp"
+			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\StringBuilder.cpp"
 			>
 		</File>
 		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\StringImpl.cpp"
+			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\StringImpl.cpp"
 			>
 		</File>
 		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\WTFString.cpp"
+			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\WTFString.cpp"
 			>
 		</File>
 	</Files>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj
index b80b059f6..6d44dce91 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj
@@ -448,15 +448,15 @@
 	</References>
 	<Files>
 		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\AtomicString.cpp"
+			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\AtomicString.cpp"
 			>
 		</File>
 		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\StringBuilder.cpp"
+			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\StringBuilder.cpp"
 			>
 		</File>
 		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\StringImpl.cpp"
+			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\StringImpl.cpp"
 			>
 		</File>
 		<File
@@ -464,7 +464,7 @@
 			>
 		</File>
 		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\WTFString.cpp"
+			RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\WTFString.cpp"
 			>
 		</File>
 	</Files>
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index d9d8e1631..a72046e2c 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -49,17 +49,13 @@
 /* Begin PBXBuildFile section */
 		06D358B30DAADAA4003B174E /* MainThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 06D358A20DAAD9C4003B174E /* MainThread.cpp */; };
 		06D358B40DAADAAA003B174E /* MainThreadMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 06D358A10DAAD9C4003B174E /* MainThreadMac.mm */; };
-		081469491264378500DFF935 /* StringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 081469481264375E00DFF935 /* StringBuilder.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		088FA5BB0EF76D4300578E6F /* RandomNumber.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 088FA5B90EF76D4300578E6F /* RandomNumber.cpp */; };
-		088FA5BC0EF76D4300578E6F /* RandomNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = 088FA5BA0EF76D4300578E6F /* RandomNumber.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		08CABBA61265AB3900B206CE /* StringConcatenate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0896C29E1265AB0900B1CDD3 /* StringConcatenate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		08DDA5C11264631700751732 /* UStringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 08DDA5BB12645F1D00751732 /* UStringBuilder.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		08E279E90EF83B10007DB523 /* RandomNumberSeed.h in Headers */ = {isa = PBXBuildFile; fileRef = 08E279E80EF83B10007DB523 /* RandomNumberSeed.h */; };
+		0A4337BB1506218800991C95 /* DFGRedundantPhiEliminationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0A4337BA1506218800991C95 /* DFGRedundantPhiEliminationPhase.cpp */; };
+		0A4337BE1506219B00991C95 /* DFGRedundantPhiEliminationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0A4337BD1506219B00991C95 /* DFGRedundantPhiEliminationPhase.h */; };
 		0B330C270F38C62300692DE3 /* TypeTraits.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0B330C260F38C62300692DE3 /* TypeTraits.cpp */; };
-		0B4D7E630F319AC800AD7E58 /* TypeTraits.h in Headers */ = {isa = PBXBuildFile; fileRef = 0B4D7E620F319AC800AD7E58 /* TypeTraits.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		0BAC94A01338728400CF135B /* ThreadRestrictionVerifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BAC949E1338728400CF135B /* ThreadRestrictionVerifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		0BCD83571485845200EA2003 /* TemporaryChange.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BCD83541485841200EA2003 /* TemporaryChange.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0BF28A2911A33DC300638F84 /* SizeLimits.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0BF28A2811A33DC300638F84 /* SizeLimits.cpp */; };
+		0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0776BD14FF002800102332 /* JITCompilationEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0B839A14BCF45D00885B4F /* LLIntEntrypoints.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */; };
 		0F0B839B14BCF46000885B4F /* LLIntEntrypoints.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */; };
@@ -77,6 +73,7 @@
 		0F0FC45A14BD15F500B81154 /* LLIntCallLinkInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F15F15F14B7A73E005DE37D /* CommonSlowPaths.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F16D726142C39C000CF784A /* BitVector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F16D724142C39A200CF784A /* BitVector.cpp */; };
+		0F1D0861150C5A860074D109 /* DFGNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F1D085F150C5A800074D109 /* DFGNode.cpp */; };
 		0F21C26814BE5F6800ADC64B /* JITDriver.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C26614BE5F5E00ADC64B /* JITDriver.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F21C27C14BE727600ADC64B /* ExecutionHarness.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27A14BE727300ADC64B /* ExecutionHarness.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F21C27D14BE727A00ADC64B /* CodeSpecializationKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -84,7 +81,6 @@
 		0F242DA713F3B1E8007ADD4C /* WeakReferenceHarvester.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F2C556F14738F3100121E4F /* DFGCodeBlocks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2C556E14738F2E00121E4F /* DFGCodeBlocks.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F2C557014738F3500121E4F /* DFGCodeBlocks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2C556D14738F2E00121E4F /* DFGCodeBlocks.cpp */; };
-		0F2E5BF7146357D5003EB2EB /* Spectrum.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2E5BF5146357D2003EB2EB /* Spectrum.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F426A481460CBB300131F8F /* ValueRecovery.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A451460CBAB00131F8F /* ValueRecovery.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F426A491460CBB700131F8F /* VirtualRegister.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A461460CBAB00131F8F /* VirtualRegister.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F426A4B1460CD6E00131F8F /* DataFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A4A1460CD6B00131F8F /* DataFormat.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -105,6 +101,8 @@
 		0F4680D514BBD24B00BFE272 /* HostCallReturnValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F55F0F414D1063900AC7649 /* AbstractPC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F55F0F114D1063600AC7649 /* AbstractPC.cpp */; };
 		0F55F0F514D1063C00AC7649 /* AbstractPC.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F55F0F214D1063600AC7649 /* AbstractPC.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F56A1D315000F35002992B1 /* ExecutionCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F56A1D115000F31002992B1 /* ExecutionCounter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F56A1D515001CF4002992B1 /* ExecutionCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */; };
 		0F5F08CF146C7633000472A9 /* UnconditionalFinalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5F08CE146C762F000472A9 /* UnconditionalFinalizer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F620174143FCD330068B77C /* DFGVariableAccessData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F620172143FCD2F0068B77C /* DFGVariableAccessData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F620175143FCD370068B77C /* DFGOperands.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F620171143FCD2F0068B77C /* DFGOperands.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -112,7 +110,6 @@
 		0F620177143FCD3F0068B77C /* DFGAbstractValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F62016F143FCD2F0068B77C /* DFGAbstractValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F620178143FCD440068B77C /* DFGAbstractState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F62016E143FCD2F0068B77C /* DFGAbstractState.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F620179143FCD480068B77C /* DFGAbstractState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F62016D143FCD2F0068B77C /* DFGAbstractState.cpp */; };
-		0F636DA0142D27D700B2E66A /* PackedIntVector.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F636D9F142D27D200B2E66A /* PackedIntVector.h */; };
 		0F66E16B14DF3F1600B7B2E4 /* DFGNodeReferenceBlob.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16814DF3F1300B7B2E4 /* DFGNodeReferenceBlob.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F66E16C14DF3F1600B7B2E4 /* DFGNodeUse.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16914DF3F1300B7B2E4 /* DFGNodeUse.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F7700921402FF3C0078EB39 /* SamplingCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7700911402FF280078EB39 /* SamplingCounter.cpp */; };
@@ -129,16 +126,12 @@
 		0F9332A314CA7DD70085F3C6 /* PutByIdStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F93329914CA7DC10085F3C6 /* PutByIdStatus.cpp */; };
 		0F9332A414CA7DD90085F3C6 /* PutByIdStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F9332A514CA7DDD0085F3C6 /* StructureSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329B14CA7DC10085F3C6 /* StructureSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		0F963B2713F753BB0002D9B2 /* RedBlackTree.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B2613F753990002D9B2 /* RedBlackTree.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F963B2C13F853EC0002D9B2 /* MetaAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F963B2B13F853C70002D9B2 /* MetaAllocator.cpp */; settings = {COMPILER_FLAGS = "-fno-strict-aliasing"; }; };
-		0F963B2D13F854020002D9B2 /* MetaAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B2A13F853BD0002D9B2 /* MetaAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		0F963B2F13FC66BB0002D9B2 /* MetaAllocatorHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B2E13FC66AE0002D9B2 /* MetaAllocatorHandle.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F963B3813FC6FE90002D9B2 /* ValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B3613FC6FDE0002D9B2 /* ValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F9FC8C314E1B5FE00D52AE0 /* PolymorphicPutByIdList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9FC8BF14E1B5FB00D52AE0 /* PolymorphicPutByIdList.cpp */; };
 		0F9FC8C414E1B60000D52AE0 /* PolymorphicPutByIdList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9FC8C014E1B5FB00D52AE0 /* PolymorphicPutByIdList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F9FC8C514E1B60400D52AE0 /* PutKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F9FC8D014E612D800D52AE0 /* DataLog.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9FC8CD14E612D500D52AE0 /* DataLog.cpp */; };
-		0F9FC8D114E612DA00D52AE0 /* DataLog.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9FC8CE14E612D500D52AE0 /* DataLog.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FB5467714F59B5C002C2989 /* LazyOperandValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FB5467914F5C46B002C2989 /* LazyOperandValueProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */; };
 		0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -164,16 +157,13 @@
 		0FC81516140511B500CFA603 /* VTableSpectrum.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC815121405118600CFA603 /* VTableSpectrum.cpp */; };
 		0FD3C82614115D4000FD81CB /* DFGDriver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3C82014115CF800FD81CB /* DFGDriver.cpp */; };
 		0FD3C82814115D4F00FD81CB /* DFGDriver.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3C82214115D0E00FD81CB /* DFGDriver.h */; };
-		0FD52AAE143035A00026DC9F /* UnionFind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD52AAC1430359D0026DC9F /* UnionFind.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FD82E2114172CE300179C94 /* DFGCapabilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD82E1E14172C2F00179C94 /* DFGCapabilities.cpp */; };
 		0FD82E39141AB14D00179C94 /* CompactJITCodeMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E37141AB14200179C94 /* CompactJITCodeMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FD82E54141DAEEE00179C94 /* PredictedType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E4F141DAEA100179C94 /* PredictedType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FD82E55141DAEEE00179C94 /* PredictionTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E50141DAEA100179C94 /* PredictionTracker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FD82E56141DAF0800179C94 /* DFGOSREntry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD82E52141DAEDE00179C94 /* DFGOSREntry.cpp */; };
 		0FD82E57141DAF1000179C94 /* DFGOSREntry.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E53141DAEDE00179C94 /* DFGOSREntry.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		0FD82E85141F3FE300179C94 /* BoundsCheckedPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E82141F3FC900179C94 /* BoundsCheckedPointer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FD82E86141F3FF100179C94 /* PredictedType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD82E84141F3FDA00179C94 /* PredictedType.cpp */; };
-		0FD82F4B142806A100179C94 /* BitVector.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82F491428069200179C94 /* BitVector.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FE228ED1436AB2700196C48 /* Options.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE228EB1436AB2300196C48 /* Options.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FE228EE1436AB2C00196C48 /* Options.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE228EA1436AB2300196C48 /* Options.cpp */; };
 		0FF922D414F46B410041A24E /* LLIntOffsetsExtractor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */; };
@@ -189,7 +179,6 @@
 		0FFFC95E14EF90B700C72532 /* DFGPredictionPropagationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC95214EF909500C72532 /* DFGPredictionPropagationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FFFC95F14EF90BB00C72532 /* DFGVirtualRegisterAllocationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */; };
 		0FFFC96014EF90BD00C72532 /* DFGVirtualRegisterAllocationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1400067712A6F7830064D123 /* OSAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 1400067612A6F7830064D123 /* OSAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1400069312A6F9E10064D123 /* OSAllocatorPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1400069212A6F9E10064D123 /* OSAllocatorPosix.cpp */; };
 		140566C4107EC255005DBC8D /* JSAPIValueWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */; };
 		140566D1107EC267005DBC8D /* JSStaticScopeObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E42C190E3938830065A544 /* JSStaticScopeObject.cpp */; };
@@ -253,7 +242,6 @@
 		1440F8920A508B100005F061 /* JSCallbackFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440F8900A508B100005F061 /* JSCallbackFunction.cpp */; };
 		1440F8AF0A508D200005F061 /* JSCallbackConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440F8AD0A508D200005F061 /* JSCallbackConstructor.cpp */; };
 		1440FCE40A51E46B0005F061 /* JSClassRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440FCE20A51E46B0005F061 /* JSClassRef.cpp */; };
-		14456A321314657800212CA3 /* DoublyLinkedList.h in Headers */ = {isa = PBXBuildFile; fileRef = 14456A311314657800212CA3 /* DoublyLinkedList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14469DD7107EC79E00650446 /* dtoa.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 651F6412039D5B5F0078395C /* dtoa.cpp */; };
 		14469DDE107EC7E700650446 /* Lookup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8680255597D01FF60F7 /* Lookup.cpp */; };
 		14469DDF107EC7E700650446 /* MathObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A86A0255597D01FF60F7 /* MathObject.cpp */; };
@@ -318,7 +306,6 @@
 		14A42E3F0F4F60EE00599099 /* TimeoutChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14A42E3D0F4F60EE00599099 /* TimeoutChecker.cpp */; };
 		14A42E400F4F60EE00599099 /* TimeoutChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A42E3E0F4F60EE00599099 /* TimeoutChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14ABDF600A437FEF00ECCA01 /* JSCallbackObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14ABDF5E0A437FEF00ECCA01 /* JSCallbackObject.cpp */; };
-		14B3EF0512BC24DD00D29EFF /* PageBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14B3EF0312BC24DD00D29EFF /* PageBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14B3EF0612BC24DD00D29EFF /* PageBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14B3EF0412BC24DD00D29EFF /* PageBlock.cpp */; };
 		14B723B212D7DA46003BD5ED /* MachineStackMarker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14B7233F12D7D0DA003BD5ED /* MachineStackMarker.cpp */; };
 		14B723B812D7DA6F003BD5ED /* MachineStackMarker.h in Headers */ = {isa = PBXBuildFile; fileRef = 14B7234012D7D0DA003BD5ED /* MachineStackMarker.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -338,43 +325,20 @@
 		14F8BA43107EC88C009892DC /* TCSystemAlloc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6541BD7008E80A17002CBEE7 /* TCSystemAlloc.cpp */; };
 		14F97447138C853E00DA1C67 /* HeapRootVisitor.h in Headers */ = {isa = PBXBuildFile; fileRef = 14F97446138C853E00DA1C67 /* HeapRootVisitor.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14FFF98C12BFFF7500795BB8 /* PageAllocationAligned.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14FFF98A12BFFF7500795BB8 /* PageAllocationAligned.cpp */; };
-		14FFF98D12BFFF7500795BB8 /* PageAllocationAligned.h in Headers */ = {isa = PBXBuildFile; fileRef = 14FFF98B12BFFF7500795BB8 /* PageAllocationAligned.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		180B9B080F16D94F009BDBC5 /* CurrentTime.h in Headers */ = {isa = PBXBuildFile; fileRef = 180B9AF00F16C569009BDBC5 /* CurrentTime.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		180B9BFE0F16E94D009BDBC5 /* CurrentTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 180B9AEF0F16C569009BDBC5 /* CurrentTime.cpp */; };
 		18BAB55310DAE054000D945B /* ThreadIdentifierDataPthreads.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 18BAB52710DADFCD000D945B /* ThreadIdentifierDataPthreads.cpp */; };
-		18BAB55410DAE066000D945B /* ThreadIdentifierDataPthreads.h in Headers */ = {isa = PBXBuildFile; fileRef = 18BAB52810DADFCD000D945B /* ThreadIdentifierDataPthreads.h */; };
 		1A082779142168D70090CCAC /* BinarySemaphore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A082777142168D70090CCAC /* BinarySemaphore.cpp */; };
 		1A08277A142168D70090CCAC /* BinarySemaphore.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A082778142168D70090CCAC /* BinarySemaphore.h */; };
-		1AA9E5511498093500001A8A /* Functional.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AA9E5501498093500001A8A /* Functional.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		2684B2D314D4A9B20072C0B6 /* ParsedURL.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2684B2C414D4A9B20072C0B6 /* ParsedURL.cpp */; };
-		2684B2D414D4A9B20072C0B6 /* ParsedURL.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2C514D4A9B20072C0B6 /* ParsedURL.h */; };
-		2684B2D514D4A9B20072C0B6 /* URLString.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2C614D4A9B20072C0B6 /* URLString.h */; };
-		2684B2D614D4A9B20072C0B6 /* RawURLBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2C814D4A9B20072C0B6 /* RawURLBuffer.h */; };
-		2684B2D714D4A9B20072C0B6 /* URLBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2C914D4A9B20072C0B6 /* URLBuffer.h */; };
 		2684B2D814D4A9B20072C0B6 /* URLCharacterTypes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2684B2CA14D4A9B20072C0B6 /* URLCharacterTypes.cpp */; };
-		2684B2D914D4A9B20072C0B6 /* URLCharacterTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2CB14D4A9B20072C0B6 /* URLCharacterTypes.h */; };
-		2684B2DA14D4A9B20072C0B6 /* URLComponent.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2CC14D4A9B20072C0B6 /* URLComponent.h */; };
 		2684B2DB14D4A9B20072C0B6 /* URLEscape.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2684B2CD14D4A9B20072C0B6 /* URLEscape.cpp */; };
-		2684B2DC14D4A9B20072C0B6 /* URLEscape.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2CE14D4A9B20072C0B6 /* URLEscape.h */; };
-		2684B2DD14D4A9B20072C0B6 /* URLParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2CF14D4A9B20072C0B6 /* URLParser.h */; };
-		2684B2DE14D4A9B20072C0B6 /* URLQueryCanonicalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2D014D4A9B20072C0B6 /* URLQueryCanonicalizer.h */; };
 		2684B2DF14D4A9B20072C0B6 /* URLSegments.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2684B2D114D4A9B20072C0B6 /* URLSegments.cpp */; };
-		2684B2E014D4A9B20072C0B6 /* URLSegments.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2D214D4A9B20072C0B6 /* URLSegments.h */; };
-		2CFC5D1E12F45B48004914E2 /* CharacterNames.h in Headers */ = {isa = PBXBuildFile; fileRef = 2CFC5B7A12F44714004914E2 /* CharacterNames.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41359CF30FDD89AD00206180 /* DateConversion.h in Headers */ = {isa = PBXBuildFile; fileRef = D21202290AD4310C00ED79B6 /* DateConversion.h */; };
 		41359CF60FDD89CB00206180 /* DateMath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41359CF40FDD89CB00206180 /* DateMath.cpp */; };
-		41359CF70FDD89CB00206180 /* DateMath.h in Headers */ = {isa = PBXBuildFile; fileRef = 41359CF50FDD89CB00206180 /* DateMath.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		434A8E7114956A50009126F7 /* ASCIIFastPath.h in Headers */ = {isa = PBXBuildFile; fileRef = 434A8E7014956A50009126F7 /* ASCIIFastPath.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		4409D8470FAF80A200523B87 /* OwnPtrCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 440B7AED0FAF7FCB0073323E /* OwnPtrCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		44DD48530FAEA85000D6B4EB /* PassOwnPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 44DD48520FAEA85000D6B4EB /* PassOwnPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		451539B912DC994500EF7AC4 /* Yarr.h in Headers */ = {isa = PBXBuildFile; fileRef = 451539B812DC994500EF7AC4 /* Yarr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		511FC4C9117EE28700425272 /* MD5.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511FC4C7117EE23D00425272 /* MD5.cpp */; };
-		511FC4CB117EE2A800425272 /* MD5.h in Headers */ = {isa = PBXBuildFile; fileRef = 511FC4CA117EE2A800425272 /* MD5.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		5135FAF212D26ACE003C083B /* Decoder.h in Headers */ = {isa = PBXBuildFile; fileRef = 5135FAD512D26856003C083B /* Decoder.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		5135FAF312D26AD1003C083B /* Encoder.h in Headers */ = {isa = PBXBuildFile; fileRef = 5135FAD612D26856003C083B /* Encoder.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5D53726F0E1C54880021E549 /* Tracing.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D53726E0E1C54880021E549 /* Tracing.h */; };
 		5D5D8AD10E0D0EBE00F9C692 /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
-		5D63E9AD10F2BD6E00FC8AE9 /* StringHasher.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D63E9AC10F2BD6E00FC8AE9 /* StringHasher.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5D6A566B0F05995500266145 /* Threading.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D6A566A0F05995500266145 /* Threading.cpp */; };
 		5DBB151B131D0B310056AD36 /* testapi.js in Copy Support Script */ = {isa = PBXBuildFile; fileRef = 14D857740A4696C80032146C /* testapi.js */; };
 		5DBB1525131D0BD70056AD36 /* minidom.js in Copy Support Script */ = {isa = PBXBuildFile; fileRef = 1412110D0A48788700480255 /* minidom.js */; };
@@ -383,21 +347,12 @@
 		651122FD14046A4C002B101D /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
 		651122FE14046A4C002B101D /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
 		6511230714046B0A002B101D /* testRegExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 651122E5140469BA002B101D /* testRegExp.cpp */; };
-		651DCA04136A6FEF00F74194 /* PassTraits.h in Headers */ = {isa = PBXBuildFile; fileRef = 651DCA02136A6FAB00F74194 /* PassTraits.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		65303D641447B9E100D3F904 /* ParserTokens.h in Headers */ = {isa = PBXBuildFile; fileRef = 65303D631447B9E100D3F904 /* ParserTokens.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 655EB29A10CE2581001A990E /* NodesCodegen.cpp */; };
 		65DFC93308EA173A00F7300B /* HashTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65DFC92D08EA173A00F7300B /* HashTable.cpp */; };
-		65E1A3DF122B894500B26097 /* NonCopyingSort.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E1A2F4122B880D00B26097 /* NonCopyingSort.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		65FDE49C0BDD1D4A00E80111 /* Assertions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B808E7EECC0023E5F6 /* Assertions.cpp */; };
-		7186A6EC13100BA5004479E1 /* HexNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = 7186A6E813100B57004479E1 /* HexNumber.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		71DA9D82134F3F3D00B767E7 /* StringOperators.h in Headers */ = {isa = PBXBuildFile; fileRef = 718A8482134F3A1200B87529 /* StringOperators.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		76FB9F0F12E851860051A2EB /* SHA1.h in Headers */ = {isa = PBXBuildFile; fileRef = 76FB9F0E12E851860051A2EB /* SHA1.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		76FB9F1112E851960051A2EB /* SHA1.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 76FB9F1012E851960051A2EB /* SHA1.cpp */; };
-		7934BB7B1361979300CB99A1 /* ParallelJobs.h in Headers */ = {isa = PBXBuildFile; fileRef = 7934BB761361979300CB99A1 /* ParallelJobs.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7934BB7C1361979400CB99A1 /* ParallelJobsGeneric.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7934BB771361979300CB99A1 /* ParallelJobsGeneric.cpp */; };
-		7934BB7D1361979400CB99A1 /* ParallelJobsGeneric.h in Headers */ = {isa = PBXBuildFile; fileRef = 7934BB781361979300CB99A1 /* ParallelJobsGeneric.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		7934BB7E1361979400CB99A1 /* ParallelJobsLibdispatch.h in Headers */ = {isa = PBXBuildFile; fileRef = 7934BB791361979300CB99A1 /* ParallelJobsLibdispatch.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		7934BB7F1361979400CB99A1 /* ParallelJobsOpenMP.h in Headers */ = {isa = PBXBuildFile; fileRef = 7934BB7A1361979300CB99A1 /* ParallelJobsOpenMP.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7E4EE7090EBB7963005934AA /* StructureChain.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E4EE7080EBB7963005934AA /* StructureChain.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7E4EE70F0EBB7A5B005934AA /* StructureChain.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E4EE70E0EBB7A5B005934AA /* StructureChain.cpp */; };
 		7EFF00640EC05A9A00AA7C93 /* NodeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EFF00630EC05A9A00AA7C93 /* NodeInfo.h */; };
@@ -409,16 +364,13 @@
 		8604F505143CE1C200B295F5 /* JSGlobalThis.h in Headers */ = {isa = PBXBuildFile; fileRef = 8604F503143CE1C100B295F5 /* JSGlobalThis.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		860BD801148EA6F200112B2F /* Intrinsic.h in Headers */ = {isa = PBXBuildFile; fileRef = 86BF642A148DB2B5004DE36A /* Intrinsic.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		8626BECF11928E3900782FAB /* StringStatics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8626BECE11928E3900782FAB /* StringStatics.cpp */; };
-		8627E5EC11F1281900A313B5 /* PageAllocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 8627E5EA11F1281900A313B5 /* PageAllocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		863B23E00FC6118900703AA4 /* MacroAssemblerCodeRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 863B23DF0FC60E6200703AA4 /* MacroAssemblerCodeRef.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86438FC41265503E00E0DFCA /* StringBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86438FC31265503E00E0DFCA /* StringBuilder.cpp */; };
 		86565742115BE3DA00291F40 /* CString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86565740115BE3DA00291F40 /* CString.cpp */; };
-		86565743115BE3DA00291F40 /* CString.h in Headers */ = {isa = PBXBuildFile; fileRef = 86565741115BE3DA00291F40 /* CString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		865A30F1135007E100CDB49E /* JSValueInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = 865A30F0135007E100CDB49E /* JSValueInlineMethods.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		865F408810E7D56300947361 /* APIShims.h in Headers */ = {isa = PBXBuildFile; fileRef = 865F408710E7D56300947361 /* APIShims.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		866739D213BFDE710023D87C /* BigInteger.h in Headers */ = {isa = PBXBuildFile; fileRef = 866739D013BFDE710023D87C /* BigInteger.h */; };
 		866739D313BFDE710023D87C /* Uint16WithFraction.h in Headers */ = {isa = PBXBuildFile; fileRef = 866739D113BFDE710023D87C /* Uint16WithFraction.h */; };
-		86676D5211FED9BC004B6863 /* BumpPointerAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 86676D4D11FED55D004B6863 /* BumpPointerAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B4012DB8A8100A9FE7B /* YarrSyntaxChecker.cpp */; };
 		86704B4312DB8A8100A9FE7B /* YarrSyntaxChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B4112DB8A8100A9FE7B /* YarrSyntaxChecker.h */; };
 		86704B8412DBA33700A9FE7B /* YarrInterpreter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B7D12DBA33700A9FE7B /* YarrInterpreter.cpp */; };
@@ -431,15 +383,8 @@
 		86880F1F14328BB900B08D42 /* DFGSpeculativeJIT32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86880F1B14328BB900B08D42 /* DFGSpeculativeJIT32_64.cpp */; };
 		86880F4D14353B2100B08D42 /* DFGSpeculativeJIT64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86880F4C14353B2100B08D42 /* DFGSpeculativeJIT64.cpp */; };
 		868BFA08117CEFD100B908B1 /* AtomicString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 868BFA00117CEFD100B908B1 /* AtomicString.cpp */; };
-		868BFA09117CEFD100B908B1 /* AtomicString.h in Headers */ = {isa = PBXBuildFile; fileRef = 868BFA01117CEFD100B908B1 /* AtomicString.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		868BFA0A117CEFD100B908B1 /* AtomicStringImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 868BFA02117CEFD100B908B1 /* AtomicStringImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		868BFA0D117CEFD100B908B1 /* StringHash.h in Headers */ = {isa = PBXBuildFile; fileRef = 868BFA05117CEFD100B908B1 /* StringHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		868BFA0E117CEFD100B908B1 /* StringImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 868BFA06117CEFD100B908B1 /* StringImpl.cpp */; };
-		868BFA0F117CEFD100B908B1 /* StringImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 868BFA07117CEFD100B908B1 /* StringImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		868BFA17117CF19900B908B1 /* WTFString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 868BFA15117CF19900B908B1 /* WTFString.cpp */; };
-		868BFA18117CF19900B908B1 /* WTFString.h in Headers */ = {isa = PBXBuildFile; fileRef = 868BFA16117CF19900B908B1 /* WTFString.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		868BFA60117D048200B908B1 /* StaticConstructors.h in Headers */ = {isa = PBXBuildFile; fileRef = 868BFA5F117D048200B908B1 /* StaticConstructors.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		8690231512092D5C00630AF9 /* PageReservation.h in Headers */ = {isa = PBXBuildFile; fileRef = 8690231412092D5C00630AF9 /* PageReservation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		869D04AF1193B54D00803475 /* CachedTranscendentalFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 869D04AE1193B54D00803475 /* CachedTranscendentalFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		869EBCB70E8C6D4A008722CC /* ResultType.h in Headers */ = {isa = PBXBuildFile; fileRef = 869EBCB60E8C6D4A008722CC /* ResultType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86A90ED00EE7D51F00AB350D /* JITArithmetic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86A90ECF0EE7D51F00AB350D /* JITArithmetic.cpp */; };
@@ -452,7 +397,6 @@
 		86AE6C4E136A11E400963012 /* DFGGPRInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 86AE6C4C136A11E400963012 /* DFGGPRInfo.h */; };
 		86B5826714D2796C00A9C306 /* CodeProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86B5822E14D2373B00A9C306 /* CodeProfile.cpp */; };
 		86B5826914D2797000A9C306 /* CodeProfiling.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8603CEF214C7546400AE59E3 /* CodeProfiling.cpp */; };
-		86B99AE3117E578100DF5A90 /* StringBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 86B99AE1117E578100DF5A90 /* StringBuffer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86BB09C0138E381B0056702F /* DFGRepatch.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86BB09BE138E381B0056702F /* DFGRepatch.cpp */; };
 		86BB09C1138E381B0056702F /* DFGRepatch.h in Headers */ = {isa = PBXBuildFile; fileRef = 86BB09BF138E381B0056702F /* DFGRepatch.h */; };
 		86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -466,7 +410,6 @@
 		86CC85C40EE7A89400288682 /* JITPropertyAccess.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86CC85C30EE7A89400288682 /* JITPropertyAccess.cpp */; };
 		86CCEFDE0F413F8900FD7F9E /* JITCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 86CCEFDD0F413F8900FD7F9E /* JITCode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86D08D5311793613006E5ED0 /* WTFThreadData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86D08D5111793613006E5ED0 /* WTFThreadData.cpp */; };
-		86D08D5411793613006E5ED0 /* WTFThreadData.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D08D5211793613006E5ED0 /* WTFThreadData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86D3B2C310156BDE002865E7 /* ARMAssembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86D3B2BF10156BDE002865E7 /* ARMAssembler.cpp */; };
 		86D3B2C410156BDE002865E7 /* ARMAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D3B2C010156BDE002865E7 /* ARMAssembler.h */; };
 		86D3B2C510156BDE002865E7 /* AssemblerBufferWithConstantPool.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D3B2C110156BDE002865E7 /* AssemblerBufferWithConstantPool.h */; };
@@ -474,7 +417,6 @@
 		86D3B3C310159D7F002865E7 /* LinkBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D3B3C110159D7F002865E7 /* LinkBuffer.h */; };
 		86D3B3C410159D7F002865E7 /* RepatchBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D3B3C210159D7F002865E7 /* RepatchBuffer.h */; };
 		86D87DAE12BCA7D1008E73A1 /* StackBounds.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86D87DA512BC4B14008E73A1 /* StackBounds.cpp */; };
-		86D87DDB12BCAF94008E73A1 /* StackBounds.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D87DA612BC4B14008E73A1 /* StackBounds.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86DB64640F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */; };
 		86E116B10FE75AC800B512BC /* CodeLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E116B00FE75AC800B512BC /* CodeLocation.h */; };
 		86E85539111B9968001AF51E /* JSStringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E85538111B9968001AF51E /* JSStringBuilder.h */; };
@@ -492,14 +434,11 @@
 		86EC9DD31328DF82002B2AD7 /* DFGSpeculativeJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DC31328DF82002B2AD7 /* DFGSpeculativeJIT.h */; };
 		86ECA3EA132DEF1C002B2AD7 /* DFGNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */; };
 		86ECA3FA132DF25A002B2AD7 /* DFGScoreBoard.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */; };
-		86F38859121130CA007A7CE3 /* AtomicStringHash.h in Headers */ = {isa = PBXBuildFile; fileRef = 86F38858121130CA007A7CE3 /* AtomicStringHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86FA9E91142BBB2E001773B7 /* JSBoundFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86FA9E8F142BBB2D001773B7 /* JSBoundFunction.cpp */; };
 		86FA9E92142BBB2E001773B7 /* JSBoundFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 86FA9E90142BBB2E001773B7 /* JSBoundFunction.h */; };
 		90213E3D123A40C200D422F3 /* MemoryStatistics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */; };
 		90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */ = {isa = PBXBuildFile; fileRef = 90213E3C123A40C200D422F3 /* MemoryStatistics.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		905B02AE0E28640F006DF882 /* RefCountedLeakCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 905B02AD0E28640F006DF882 /* RefCountedLeakCounter.cpp */; };
-		90D3469C0E285280009492EE /* RefCountedLeakCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 90D3469B0E285280009492EE /* RefCountedLeakCounter.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		91A3905614C0F47200F67901 /* Uint8ClampedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 91A3905514C0F47200F67901 /* Uint8ClampedArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93052C320FB792190048FDC3 /* ParserArena.cpp */; };
 		93052C350FB792190048FDC3 /* ParserArena.h in Headers */ = {isa = PBXBuildFile; fileRef = 93052C330FB792190048FDC3 /* ParserArena.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		932F5BD30822A1C700736975 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */; };
@@ -510,7 +449,6 @@
 		933040040E6A749400786E6A /* SmallStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = 93303FEA0E6A72C000786E6A /* SmallStrings.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93303FE80E6A72B500786E6A /* SmallStrings.cpp */; };
 		9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93345A8712D838C400302BE3 /* StringRecursionChecker.cpp */; };
-		933F5CDC1269229B0049191E /* NullPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 933F5CDB126922690049191E /* NullPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93854A9A12C93D3B00DAAF77 /* NullPtr.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93854A9912C93D3B00DAAF77 /* NullPtr.cpp */; };
 		9534AAFB0E5B7A9600B8A45B /* JSProfilerPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 952C63AC0E4777D600C13936 /* JSProfilerPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		95742F650DD11F5A000917FB /* Profile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 95742F630DD11F5A000917FB /* Profile.cpp */; };
@@ -527,25 +465,20 @@
 		969A07230ED1CE3300F1F681 /* BytecodeGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07210ED1CE3300F1F681 /* BytecodeGenerator.h */; };
 		969A072A0ED1CE6900F1F681 /* Label.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07270ED1CE6900F1F681 /* Label.h */; };
 		969A072B0ED1CE6900F1F681 /* RegisterID.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07280ED1CE6900F1F681 /* RegisterID.h */; };
-		969A072C0ED1CE6900F1F681 /* SegmentedVector.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07290ED1CE6900F1F681 /* SegmentedVector.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		969A07960ED1D3AE00F1F681 /* CodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 969A07900ED1D3AE00F1F681 /* CodeBlock.cpp */; settings = {COMPILER_FLAGS = "-fno-strict-aliasing"; }; };
 		969A07970ED1D3AE00F1F681 /* CodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07910ED1D3AE00F1F681 /* CodeBlock.h */; settings = {ATTRIBUTES = (); }; };
 		969A07980ED1D3AE00F1F681 /* EvalCodeCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07920ED1D3AE00F1F681 /* EvalCodeCache.h */; };
 		969A07990ED1D3AE00F1F681 /* Instruction.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07930ED1D3AE00F1F681 /* Instruction.h */; };
 		969A079A0ED1D3AE00F1F681 /* Opcode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 969A07940ED1D3AE00F1F681 /* Opcode.cpp */; };
 		969A079B0ED1D3AE00F1F681 /* Opcode.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07950ED1D3AE00F1F681 /* Opcode.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		96DD73790F9DA3100027FBCC /* VMTags.h in Headers */ = {isa = PBXBuildFile; fileRef = 96DD73780F9DA3100027FBCC /* VMTags.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		971EDEA61169E0D3005E4262 /* Terminator.h in Headers */ = {isa = PBXBuildFile; fileRef = 97F6903A1169DF7F00A6BB46 /* Terminator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		978801401471AD920041B016 /* JSDateMath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9788FC221471AD0C0068CE2D /* JSDateMath.cpp */; };
 		978801411471AD920041B016 /* JSDateMath.h in Headers */ = {isa = PBXBuildFile; fileRef = 9788FC231471AD0C0068CE2D /* JSDateMath.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97941A5713029AAB004A3447 /* OSRandomSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97941A3F130299DB004A3447 /* OSRandomSource.cpp */; };
-		97941A5A13029ACC004A3447 /* OSRandomSource.h in Headers */ = {isa = PBXBuildFile; fileRef = 97941A40130299DB004A3447 /* OSRandomSource.h */; };
 		97941A7E1302A098004A3447 /* CryptographicallyRandomNumber.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97941A7C1302A098004A3447 /* CryptographicallyRandomNumber.cpp */; };
-		97941A7F1302A098004A3447 /* CryptographicallyRandomNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = 97941A7D1302A098004A3447 /* CryptographicallyRandomNumber.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A1712B3B11C7B212007A5315 /* RegExpCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1712B3A11C7B212007A5315 /* RegExpCache.cpp */; };
 		A1712B3F11C7B228007A5315 /* RegExpCache.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B3E11C7B228007A5315 /* RegExpCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A1712B4111C7B235007A5315 /* RegExpKey.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B4011C7B235007A5315 /* RegExpKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A1D764521354448B00C5C7C0 /* Alignment.h in Headers */ = {isa = PBXBuildFile; fileRef = A1D764511354448B00C5C7C0 /* Alignment.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A71236E51195F33C00BD2174 /* JITOpcodes32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A71236E41195F33C00BD2174 /* JITOpcodes32_64.cpp */; };
 		A72700900DAC6BBC00E548D7 /* JSNotAnObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A72700780DAC605600E548D7 /* JSNotAnObject.cpp */; };
 		A72701B90DADE94900E548D7 /* ExceptionHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = A72701B30DADE94900E548D7 /* ExceptionHelpers.h */; };
@@ -559,19 +492,7 @@
 		A7386555118697B400540279 /* ThunkGenerators.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7386552118697B400540279 /* ThunkGenerators.cpp */; };
 		A7386556118697B400540279 /* ThunkGenerators.h in Headers */ = {isa = PBXBuildFile; fileRef = A7386553118697B400540279 /* ThunkGenerators.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A73BE168148420520091204B /* ArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A73BE154148420520091204B /* ArrayBuffer.cpp */; };
-		A73BE169148420520091204B /* ArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE155148420520091204B /* ArrayBuffer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A73BE16A148420520091204B /* ArrayBufferView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A73BE156148420520091204B /* ArrayBufferView.cpp */; };
-		A73BE16B148420520091204B /* ArrayBufferView.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE157148420520091204B /* ArrayBufferView.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A73BE16D148420520091204B /* Float32Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE159148420520091204B /* Float32Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A73BE16F148420520091204B /* Float64Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE15B148420520091204B /* Float64Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A73BE171148420520091204B /* Int8Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE15D148420520091204B /* Int8Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A73BE173148420520091204B /* Int16Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE15F148420520091204B /* Int16Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A73BE175148420520091204B /* Int32Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE161148420520091204B /* Int32Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A73BE177148420520091204B /* Uint8Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE163148420520091204B /* Uint8Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A73BE179148420520091204B /* Uint16Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE165148420520091204B /* Uint16Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A73BE17B148420520091204B /* Uint32Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE167148420520091204B /* Uint32Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A73BE17E148420840091204B /* TypedArrayBase.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE17D148420840091204B /* TypedArrayBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A73BE180148420A80091204B /* IntegralTypedArrayBase.h in Headers */ = {isa = PBXBuildFile; fileRef = A73BE17F148420A80091204B /* IntegralTypedArrayBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7482B9311671147003B0712 /* JSWeakObjectMapRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7482B9411671147003B0712 /* JSWeakObjectMapRefPrivate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */; };
 		A7482E93116A7CAD003B0712 /* JSWeakObjectMapRefInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = A7482E37116A697B003B0712 /* JSWeakObjectMapRefInternal.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -587,24 +508,16 @@
 		A791EF280F11E07900AE1F68 /* JSByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A791EF260F11E07900AE1F68 /* JSByteArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A791EF290F11E07900AE1F68 /* JSByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A791EF270F11E07900AE1F68 /* JSByteArray.cpp */; };
 		A7A1F7AC0F252B3C00E184E2 /* ByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7A1F7AA0F252B3C00E184E2 /* ByteArray.cpp */; };
-		A7A1F7AD0F252B3C00E184E2 /* ByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */; };
 		A7B4ACAF1484C9CE00B38A36 /* JSExportMacros.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B4ACAE1484C9CE00B38A36 /* JSExportMacros.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A7BC0C82140608B000B1BB71 /* CheckedArithmetic.h in Headers */ = {isa = PBXBuildFile; fileRef = A7BC0C81140608B000B1BB71 /* CheckedArithmetic.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7C1E8E4112E72EF00A37F98 /* JITPropertyAccess32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C1E8C8112E701C00A37F98 /* JITPropertyAccess32_64.cpp */; };
-		A7C40C0A130B057D00D002A1 /* BlockStack.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C40C07130B057D00D002A1 /* BlockStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A7C40C0B130B057D00D002A1 /* SentinelLinkedList.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C40C08130B057D00D002A1 /* SentinelLinkedList.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A7C40C0C130B057D00D002A1 /* SinglyLinkedList.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C40C09130B057D00D002A1 /* SinglyLinkedList.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A7D649AA1015224E009B2E1B /* PossiblyNull.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D649A91015224E009B2E1B /* PossiblyNull.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = A7DCB77912E3D90500911940 /* WriteBarrier.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E2EA690FB460CF00601F06 /* LiteralParser.h */; };
 		A7E2EA6C0FB460CF00601F06 /* LiteralParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */; };
-		A7F19ECE11DD490900931E70 /* FixedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F19ECD11DD490900931E70 /* FixedArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7F9935F0FD7325100A0B2D0 /* JSONObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F9935D0FD7325100A0B2D0 /* JSONObject.h */; };
 		A7F993600FD7325100A0B2D0 /* JSONObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7F9935E0FD7325100A0B2D0 /* JSONObject.cpp */; };
 		A7FB60A4103F7DC20017A286 /* PropertyDescriptor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7FB60A3103F7DC20017A286 /* PropertyDescriptor.cpp */; };
 		A7FB61001040C38B0017A286 /* PropertyDescriptor.h in Headers */ = {isa = PBXBuildFile; fileRef = A7FB604B103F5EAB0017A286 /* PropertyDescriptor.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A7FEE67614837B32005DC1A6 /* ExportMacros.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A275F514837A8E001DBB39 /* ExportMacros.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC02E90D0E1839DB000F9297 /* ErrorConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9050E1839DB000F9297 /* ErrorConstructor.h */; };
 		BC02E90F0E1839DB000F9297 /* ErrorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9070E1839DB000F9297 /* ErrorPrototype.h */; };
 		BC02E9110E1839DB000F9297 /* NativeErrorConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9090E1839DB000F9297 /* NativeErrorConstructor.h */; };
@@ -613,38 +526,20 @@
 		BC1166020E1997B4008066DD /* DateInstance.h in Headers */ = {isa = PBXBuildFile; fileRef = BC1166010E1997B1008066DD /* DateInstance.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC11667B0E199C05008066DD /* InternalFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC11667A0E199C05008066DD /* InternalFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC1167DA0E19BCC9008066DD /* JSCell.h in Headers */ = {isa = PBXBuildFile; fileRef = BC1167D80E19BCC9008066DD /* JSCell.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C3E40E16F5CD00B34460 /* AlwaysInline.h in Headers */ = {isa = PBXBuildFile; fileRef = 93AA4F770957251F0084B3A7 /* AlwaysInline.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3E50E16F5CD00B34460 /* APICast.h in Headers */ = {isa = PBXBuildFile; fileRef = 1482B78A0A4305AB00517CFC /* APICast.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3E60E16F5CD00B34460 /* ArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7952070E15E8A800A898AB /* ArrayConstructor.h */; };
 		BC18C3E70E16F5CD00B34460 /* ArrayPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A84E0255597D01FF60F7 /* ArrayPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C3E90E16F5CD00B34460 /* ASCIICType.h in Headers */ = {isa = PBXBuildFile; fileRef = 938C4F690CA06BC700D9310A /* ASCIICType.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C3EA0E16F5CD00B34460 /* Assertions.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E217B708E7EECC0023E5F6 /* Assertions.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C3EB0E16F5CD00B34460 /* AVLTree.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A596370DE3E1C300C17E37 /* AVLTree.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3EC0E16F5CD00B34460 /* BooleanObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 704FD35305697E6D003DBED9 /* BooleanObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3ED0E16F5CD00B34460 /* CallData.h in Headers */ = {isa = PBXBuildFile; fileRef = 145C507F0D9DF63B0088F6B9 /* CallData.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C3F00E16F5CD00B34460 /* Collator.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A862AA0D7EBB7D001EC6AA /* Collator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3F30E16F5CD00B34460 /* CommonIdentifiers.h in Headers */ = {isa = PBXBuildFile; fileRef = 65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3F40E16F5CD00B34460 /* Completion.h in Headers */ = {isa = PBXBuildFile; fileRef = F5BB2BC5030F772101FCFE1D /* Completion.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3F50E16F5CD00B34460 /* config.h in Headers */ = {isa = PBXBuildFile; fileRef = F68EBB8C0255D4C601FF60F7 /* config.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3F60E16F5CD00B34460 /* ConstructData.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8F3CCF0DAF17BA00577A80 /* ConstructData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3FA0E16F5CD00B34460 /* Debugger.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8590255597D01FF60F7 /* Debugger.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3FB0E16F5CD00B34460 /* DebuggerCallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 1480DB9B0DDC227F003CFDF2 /* DebuggerCallFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C3FC0E16F5CD00B34460 /* Deque.h in Headers */ = {isa = PBXBuildFile; fileRef = 5186111D0CC824830081412B /* Deque.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C3FD0E16F5CD00B34460 /* DisallowCType.h in Headers */ = {isa = PBXBuildFile; fileRef = 938C4F6B0CA06BCE00D9310A /* DisallowCType.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C3FE0E16F5CD00B34460 /* dtoa.h in Headers */ = {isa = PBXBuildFile; fileRef = 651F6413039D5B5F0078395C /* dtoa.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4000E16F5CD00B34460 /* ExceptionHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = A72701B30DADE94900E548D7 /* ExceptionHelpers.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4020E16F5CD00B34460 /* FastMalloc.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E217BA08E7EECC0023E5F6 /* FastMalloc.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4030E16F5CD00B34460 /* Forward.h in Headers */ = {isa = PBXBuildFile; fileRef = 935AF46909E9D9DB00ACD1D8 /* Forward.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4040E16F5CD00B34460 /* FunctionConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680C10E16D4E900A06E92 /* FunctionConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4050E16F5CD00B34460 /* FunctionPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A85D0255597D01FF60F7 /* FunctionPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4060E16F5CD00B34460 /* GetPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 93B6A0DE0AA64DA40076DE27 /* GetPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4080E16F5CD00B34460 /* HashCountedSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 657EEBBF094E445E008C9C7B /* HashCountedSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4090E16F5CD00B34460 /* HashFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DFC92A08EA173A00F7300B /* HashFunctions.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C40A0E16F5CD00B34460 /* HashIterators.h in Headers */ = {isa = PBXBuildFile; fileRef = 652246A40C8D7A0E007BDAF7 /* HashIterators.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C40B0E16F5CD00B34460 /* HashMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DFC92B08EA173A00F7300B /* HashMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C40C0E16F5CD00B34460 /* HashSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DFC92C08EA173A00F7300B /* HashSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C40D0E16F5CD00B34460 /* HashTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DFC92E08EA173A00F7300B /* HashTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C40E0E16F5CD00B34460 /* HashTraits.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DFC92F08EA173A00F7300B /* HashTraits.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C40F0E16F5CD00B34460 /* Identifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 933A349A038AE7C6008635CE /* Identifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4100E16F5CD00B34460 /* InitializeThreading.h in Headers */ = {isa = PBXBuildFile; fileRef = E178633F0D9BEC0000D74E75 /* InitializeThreading.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4130E16F5CD00B34460 /* JavaScript.h in Headers */ = {isa = PBXBuildFile; fileRef = 1CAA8B4A0D32C39A0041BCFF /* JavaScript.h */; settings = {ATTRIBUTES = (Public, ); }; };
@@ -675,17 +570,9 @@
 		BC18C42D0E16F5CD00B34460 /* JSVariableObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 14F252560D08DD8D004ECFFF /* JSVariableObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C42E0E16F5CD00B34460 /* JSWrapperObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 65C7A1720A8EAACB00FA37EA /* JSWrapperObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4310E16F5CD00B34460 /* Lexer.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8660255597D01FF60F7 /* Lexer.h */; };
-		BC18C4340E16F5CD00B34460 /* ListHashSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 657EB7450B708F540063461B /* ListHashSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4350E16F5CD00B34460 /* ListRefPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 148A1626095D16BB00666D0D /* ListRefPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4360E16F5CD00B34460 /* Locker.h in Headers */ = {isa = PBXBuildFile; fileRef = E1EE79270D6C964500FEA3BA /* Locker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4370E16F5CD00B34460 /* Lookup.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8690255597D01FF60F7 /* Lookup.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4390E16F5CD00B34460 /* MainThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 06D358A30DAAD9C4003B174E /* MainThread.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C43A0E16F5CD00B34460 /* MallocZoneSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DBD18AF0C5401A700C15EAE /* MallocZoneSupport.h */; settings = {ATTRIBUTES = (); }; };
-		BC18C43B0E16F5CD00B34460 /* MathExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF6553B0A2048DE0038A194 /* MathExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A86B0255597D01FF60F7 /* MathObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C43E0E16F5CD00B34460 /* MessageQueue.h in Headers */ = {isa = PBXBuildFile; fileRef = E1EE798B0D6CA53D00FEA3BA /* MessageQueue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C43F0E16F5CD00B34460 /* Nodes.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A86E0255597D01FF60F7 /* Nodes.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4400E16F5CD00B34460 /* Noncopyable.h in Headers */ = {isa = PBXBuildFile; fileRef = 9303F5690991190000AD71B8 /* Noncopyable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4410E16F5CD00B34460 /* NumberConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680C30E16D4E900A06E92 /* NumberConstructor.h */; };
 		BC18C4420E16F5CD00B34460 /* NumberConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */; };
 		BC18C4430E16F5CD00B34460 /* NumberObject.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8710255597D01FF60F7 /* NumberObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -693,46 +580,25 @@
 		BC18C4450E16F5CD00B34460 /* ObjectConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680C70E16D4E900A06E92 /* ObjectConstructor.h */; };
 		BC18C4460E16F5CD00B34460 /* ObjectPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680C90E16D4E900A06E92 /* ObjectPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4480E16F5CD00B34460 /* Operations.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8780255597D01FF60F7 /* Operations.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4490E16F5CD00B34460 /* OwnArrayPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 9303F5A409911A5800AD71B8 /* OwnArrayPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C44A0E16F5CD00B34460 /* OwnPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 9303F567099118FA00AD71B8 /* OwnPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */ = {isa = PBXBuildFile; fileRef = 93F0B3AA09BB4DC00068FCE3 /* Parser.h */; settings = {ATTRIBUTES = (); }; };
-		BC18C44C0E16F5CD00B34460 /* PassRefPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 6580F795094070560082C219 /* PassRefPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C44F0E16F5CD00B34460 /* Platform.h in Headers */ = {isa = PBXBuildFile; fileRef = 65D6D87E09B5A32E0002E4D7 /* Platform.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4500E16F5CD00B34460 /* Profile.h in Headers */ = {isa = PBXBuildFile; fileRef = 95742F640DD11F5A000917FB /* Profile.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4510E16F5CD00B34460 /* ProfileNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 95AB83550DA43B4400BC83F3 /* ProfileNode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4520E16F5CD00B34460 /* Profiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 95AB832F0DA42CAD00BC83F3 /* Profiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4540E16F5CD00B34460 /* PropertyNameArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 65400C100A69BAF200509887 /* PropertyNameArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4550E16F5CD00B34460 /* PropertySlot.h in Headers */ = {isa = PBXBuildFile; fileRef = 65621E6C089E859700760F35 /* PropertySlot.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4560E16F5CD00B34460 /* Protect.h in Headers */ = {isa = PBXBuildFile; fileRef = 65C02FBB0637462A003E7EE6 /* Protect.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4570E16F5CD00B34460 /* RefCounted.h in Headers */ = {isa = PBXBuildFile; fileRef = 1419D32C0CEA7CDE00FF507A /* RefCounted.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4580E16F5CD00B34460 /* RefPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 65C647B3093EF8D60022C380 /* RefPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4590E16F5CD00B34460 /* RefPtrHashMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 148A1ECD0D10C23B0069A47C /* RefPtrHashMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C45A0E16F5CD00B34460 /* RegExp.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A87E0255597D01FF60F7 /* RegExp.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C45B0E16F5CD00B34460 /* RegExpObject.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A87C0255597D01FF60F7 /* RegExpObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C45D0E16F5CD00B34460 /* Register.h in Headers */ = {isa = PBXBuildFile; fileRef = 149B24FF0D8AF6D1009CB8C7 /* Register.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C45E0E16F5CD00B34460 /* RegisterFile.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D792640DAA03FB001A9F05 /* RegisterFile.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4600E16F5CD00B34460 /* RetainPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 51F648D60BB4E2CA0033D760 /* RetainPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4610E16F5CD00B34460 /* ScopeChain.h in Headers */ = {isa = PBXBuildFile; fileRef = 9374D3A7038D9D74008635CE /* ScopeChain.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4630E16F5CD00B34460 /* SourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E866ED0DD59AFA00A2B2A1 /* SourceProvider.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4640E16F5CD00B34460 /* SourceCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E866EE0DD59AFA00A2B2A1 /* SourceCode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4660E16F5CD00B34460 /* StringConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C3C10E16EE3300B34460 /* StringConstructor.h */; };
-		BC18C4670E16F5CD00B34460 /* StringExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = E11D51750B2E798D0056C188 /* StringExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4680E16F5CD00B34460 /* StringObject.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C3C30E16EE3300B34460 /* StringObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C46A0E16F5CD00B34460 /* StringPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C3C60E16EE3300B34460 /* StringPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C46B0E16F5CD00B34460 /* SymbolTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A396A60CD2933100B5B4FF /* SymbolTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C46C0E16F5CD00B34460 /* TCPackedCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DA479650CFBCF56009328A0 /* TCPackedCache.h */; };
-		BC18C46D0E16F5CD00B34460 /* TCPageMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 6541BD6E08E80A17002CBEE7 /* TCPageMap.h */; };
-		BC18C46E0E16F5CD00B34460 /* TCSpinLock.h in Headers */ = {isa = PBXBuildFile; fileRef = 6541BD6F08E80A17002CBEE7 /* TCSpinLock.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C46F0E16F5CD00B34460 /* TCSystemAlloc.h in Headers */ = {isa = PBXBuildFile; fileRef = 6541BD7108E80A17002CBEE7 /* TCSystemAlloc.h */; };
-		BC18C4700E16F5CD00B34460 /* Threading.h in Headers */ = {isa = PBXBuildFile; fileRef = E1EE79220D6C95CD00FEA3BA /* Threading.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4710E16F5CD00B34460 /* ThreadSpecific.h in Headers */ = {isa = PBXBuildFile; fileRef = E1B7C8BD0DA3A3360074B0DC /* ThreadSpecific.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4730E16F5CD00B34460 /* Unicode.h in Headers */ = {isa = PBXBuildFile; fileRef = E195679409E7CF1200B89D13 /* Unicode.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4740E16F5CD00B34460 /* UnicodeIcu.h in Headers */ = {isa = PBXBuildFile; fileRef = E195678F09E7CF1200B89D13 /* UnicodeIcu.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4750E16F5CD00B34460 /* UnusedParam.h in Headers */ = {isa = PBXBuildFile; fileRef = 935AF46B09E9D9DB00ACD1D8 /* UnusedParam.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4760E16F5CD00B34460 /* UString.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8860255597D01FF60F7 /* UString.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4770E16F5CD00B34460 /* UTF8.h in Headers */ = {isa = PBXBuildFile; fileRef = E1EF79A90CE97BA60088D500 /* UTF8.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4780E16F5CD00B34460 /* Vector.h in Headers */ = {isa = PBXBuildFile; fileRef = 6592C316098B7DE10003D4F6 /* Vector.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4790E16F5CD00B34460 /* VectorTraits.h in Headers */ = {isa = PBXBuildFile; fileRef = 6592C317098B7DE10003D4F6 /* VectorTraits.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C47A0E16F5CD00B34460 /* WebKitAvailability.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DE3D0F40DD8DDFB00468714 /* WebKitAvailability.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		BC18C5240E16FC8A00B34460 /* ArrayPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C5230E16FC8A00B34460 /* ArrayPrototype.lut.h */; };
 		BC18C5260E16FCA700B34460 /* StringPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C5250E16FCA700B34460 /* StringPrototype.lut.h */; };
@@ -744,10 +610,6 @@
 		BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3135620F302FA3003DFD3A /* DebuggerActivation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */; };
 		BC3C4CA01458F5450025FB62 /* JSGlobalThis.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC3C4C9F1458F5450025FB62 /* JSGlobalThis.cpp */; };
-		BC5F7BBE11823B590052C02C /* Atomics.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBB11823B590052C02C /* Atomics.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC5F7BBF11823B590052C02C /* ThreadingPrimitives.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBC11823B590052C02C /* ThreadingPrimitives.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC5F7BC011823B590052C02C /* ThreadSafeRefCounted.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBD11823B590052C02C /* ThreadSafeRefCounted.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC66BAE413F492CC00C23FAE /* Compiler.h in Headers */ = {isa = PBXBuildFile; fileRef = BC66BAE213F4928F00C23FAE /* Compiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; };
 		BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC87CDB810712ACA000614CF /* JSONObject.lut.h */; };
@@ -766,63 +628,40 @@
 		BCDE3AB80E6C82F5001453A7 /* Structure.h in Headers */ = {isa = PBXBuildFile; fileRef = BCDE3AB10E6C82CF001453A7 /* Structure.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCDE3B430E6C832D001453A7 /* Structure.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCDE3AB00E6C82CF001453A7 /* Structure.cpp */; };
 		BCF605140E203EF800B9A64D /* ArgList.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF605120E203EF800B9A64D /* ArgList.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BCFBE696122560E800309E9D /* PassOwnArrayPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFBE695122560E800309E9D /* PassOwnArrayPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCFD8C920EEB2EE700283848 /* JumpTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFD8C900EEB2EE700283848 /* JumpTable.cpp */; };
 		BCFD8C930EEB2EE700283848 /* JumpTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFD8C910EEB2EE700283848 /* JumpTable.h */; };
-		C0A272630E50A06300E96E15 /* NotFound.h in Headers */ = {isa = PBXBuildFile; fileRef = C0A2723F0E509F1E00E96E15 /* NotFound.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C22B31B9140577D700DB475A /* SamplingCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F77008E1402FDD60078EB39 /* SamplingCounter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C22C52F113FAF6EF00B7DC0D /* bignum-dtoa.cc in Sources */ = {isa = PBXBuildFile; fileRef = C22C529013FAF6EF00B7DC0D /* bignum-dtoa.cc */; };
-		C22C52F213FAF6EF00B7DC0D /* bignum-dtoa.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C529113FAF6EF00B7DC0D /* bignum-dtoa.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C22C52F313FAF6EF00B7DC0D /* bignum.cc in Sources */ = {isa = PBXBuildFile; fileRef = C22C529213FAF6EF00B7DC0D /* bignum.cc */; };
-		C22C52F413FAF6EF00B7DC0D /* bignum.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C529313FAF6EF00B7DC0D /* bignum.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C22C52F513FAF6EF00B7DC0D /* cached-powers.cc in Sources */ = {isa = PBXBuildFile; fileRef = C22C529413FAF6EF00B7DC0D /* cached-powers.cc */; };
-		C22C52F613FAF6EF00B7DC0D /* cached-powers.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C529513FAF6EF00B7DC0D /* cached-powers.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C22C52F713FAF6EF00B7DC0D /* diy-fp.cc in Sources */ = {isa = PBXBuildFile; fileRef = C22C529713FAF6EF00B7DC0D /* diy-fp.cc */; };
-		C22C52F813FAF6EF00B7DC0D /* diy-fp.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C529813FAF6EF00B7DC0D /* diy-fp.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C22C52F913FAF6EF00B7DC0D /* double-conversion.cc in Sources */ = {isa = PBXBuildFile; fileRef = C22C529913FAF6EF00B7DC0D /* double-conversion.cc */; };
-		C22C52FA13FAF6EF00B7DC0D /* double-conversion.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C529A13FAF6EF00B7DC0D /* double-conversion.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		C22C52FB13FAF6EF00B7DC0D /* double.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C529B13FAF6EF00B7DC0D /* double.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C22C52FC13FAF6EF00B7DC0D /* fast-dtoa.cc in Sources */ = {isa = PBXBuildFile; fileRef = C22C529C13FAF6EF00B7DC0D /* fast-dtoa.cc */; };
-		C22C52FD13FAF6EF00B7DC0D /* fast-dtoa.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C529D13FAF6EF00B7DC0D /* fast-dtoa.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C22C52FE13FAF6EF00B7DC0D /* fixed-dtoa.cc in Sources */ = {isa = PBXBuildFile; fileRef = C22C529E13FAF6EF00B7DC0D /* fixed-dtoa.cc */; };
-		C22C52FF13FAF6EF00B7DC0D /* fixed-dtoa.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C529F13FAF6EF00B7DC0D /* fixed-dtoa.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C22C531313FAF6EF00B7DC0D /* strtod.cc in Sources */ = {isa = PBXBuildFile; fileRef = C22C52B913FAF6EF00B7DC0D /* strtod.cc */; };
-		C22C531413FAF6EF00B7DC0D /* strtod.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C52BA13FAF6EF00B7DC0D /* strtod.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		C22C531513FAF6EF00B7DC0D /* utils.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C52BB13FAF6EF00B7DC0D /* utils.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C240305514B404E60079EB64 /* CopiedSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C240305314B404C90079EB64 /* CopiedSpace.cpp */; };
 		C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2B916C514DA040C00CBAC86 /* MarkedAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */; };
 		C2C8D02D14A3C6E000578E65 /* CopiedSpaceInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = C2C8D02B14A3C6B200578E65 /* CopiedSpaceInlineMethods.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2C8D03014A3CEFC00578E65 /* CopiedBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = C2C8D02E14A3CEFC00578E65 /* CopiedBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2C8D03114A3CEFC00578E65 /* HeapBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = C2C8D02F14A3CEFC00578E65 /* HeapBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		C2D9CA1314BCC04600304B46 /* CheckedBoolean.h in Headers */ = {isa = PBXBuildFile; fileRef = C2D9CA1214BCC04600304B46 /* CheckedBoolean.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2EAA3FA149A835E00FCE112 /* CopiedSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = C2EAA3F8149A830800FCE112 /* CopiedSpace.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2EAD2FC14F0249800A4B159 /* CopiedAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = C2EAD2FB14F0249800A4B159 /* CopiedAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		C2EE59A013FC973F009CEAFE /* DecimalNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = C2EE599E13FC972A009CEAFE /* DecimalNumber.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2EE59A113FC9768009CEAFE /* DecimalNumber.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2EE599D13FC972A009CEAFE /* DecimalNumber.cpp */; };
-		D7A46A4F1338FFEA00ED695C /* DynamicAnnotations.h in Headers */ = {isa = PBXBuildFile; fileRef = D75AF59612F8CB9500FC0ADF /* DynamicAnnotations.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		DD377CBC12072C18006A2517 /* Bitmap.h in Headers */ = {isa = PBXBuildFile; fileRef = DD377CBB12072C18006A2517 /* Bitmap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DDF7ABD411F60ED200108E36 /* GCActivityCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = DDF7ABD211F60ED200108E36 /* GCActivityCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DDF7ABD511F60ED200108E36 /* GCActivityCallbackCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DDF7ABD311F60ED200108E36 /* GCActivityCallbackCF.cpp */; };
 		E124A8F70E555775003091F1 /* OpaqueJSString.h in Headers */ = {isa = PBXBuildFile; fileRef = E124A8F50E555775003091F1 /* OpaqueJSString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E124A8F80E555775003091F1 /* OpaqueJSString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E124A8F60E555775003091F1 /* OpaqueJSString.cpp */; };
 		E178636D0D9BEEC300D74E75 /* InitializeThreading.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E178636C0D9BEEC300D74E75 /* InitializeThreading.cpp */; };
-		E17FF771112131D200076A19 /* ValueCheck.h in Headers */ = {isa = PBXBuildFile; fileRef = E17FF770112131D200076A19 /* ValueCheck.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E18E3A590DF9278C00D90B34 /* JSGlobalData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18E3A570DF9278C00D90B34 /* JSGlobalData.cpp */; };
 		E1A862A90D7EBB76001EC6AA /* CollatorICU.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A862A80D7EBB76001EC6AA /* CollatorICU.cpp */; settings = {COMPILER_FLAGS = "-fno-strict-aliasing"; }; };
 		E1A862D60D7F2B5C001EC6AA /* CollatorDefault.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A862D50D7F2B5C001EC6AA /* CollatorDefault.cpp */; };
 		E1EE793D0D6C9B9200FEA3BA /* ThreadingPthreads.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1EE793C0D6C9B9200FEA3BA /* ThreadingPthreads.cpp */; };
 		E1EF79AA0CE97BA60088D500 /* UTF8.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1EF79A80CE97BA60088D500 /* UTF8.cpp */; };
-		E48E0F2D0F82151700A8CA37 /* FastAllocBase.h in Headers */ = {isa = PBXBuildFile; fileRef = E48E0F2C0F82151700A8CA37 /* FastAllocBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E49DC15512EF277200184A1F /* SourceProviderCache.cpp */; };
 		E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC15112EF272200184A1F /* SourceProviderCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		E4D8CEFB12FC439600BC9F5A /* BloomFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = E4D8CE9B12FC42E100BC9F5A /* BloomFilter.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		F3BD31ED126735770065467F /* TextPosition.h in Headers */ = {isa = PBXBuildFile; fileRef = F3BD31D0126730180065467F /* TextPosition.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F69E86C314C6E551002C2C62 /* NumberOfCores.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F69E86C114C6E551002C2C62 /* NumberOfCores.cpp */; };
-		F69E86C414C6E551002C2C62 /* NumberOfCores.h in Headers */ = {isa = PBXBuildFile; fileRef = F69E86C214C6E551002C2C62 /* NumberOfCores.h */; };
-		FDA15C1E12B0305C003A583A /* Complex.h in Headers */ = {isa = PBXBuildFile; fileRef = FDA15C1612B03028003A583A /* Complex.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		FE1B447A0ECCD73B004F4DD1 /* StdLibExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = FE1B44790ECCD73B004F4DD1 /* StdLibExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -920,11 +759,14 @@
 		0896C29E1265AB0900B1CDD3 /* StringConcatenate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = StringConcatenate.h; path = text/StringConcatenate.h; sourceTree = "<group>"; };
 		08DDA5BB12645F1D00751732 /* UStringBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UStringBuilder.h; sourceTree = "<group>"; };
 		08E279E80EF83B10007DB523 /* RandomNumberSeed.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RandomNumberSeed.h; sourceTree = "<group>"; };
+		0A4337BA1506218800991C95 /* DFGRedundantPhiEliminationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGRedundantPhiEliminationPhase.cpp; path = dfg/DFGRedundantPhiEliminationPhase.cpp; sourceTree = "<group>"; };
+		0A4337BD1506219B00991C95 /* DFGRedundantPhiEliminationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGRedundantPhiEliminationPhase.h; path = dfg/DFGRedundantPhiEliminationPhase.h; sourceTree = "<group>"; };
 		0B330C260F38C62300692DE3 /* TypeTraits.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypeTraits.cpp; sourceTree = "<group>"; };
 		0B4D7E620F319AC800AD7E58 /* TypeTraits.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeTraits.h; sourceTree = "<group>"; };
 		0BAC949E1338728400CF135B /* ThreadRestrictionVerifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadRestrictionVerifier.h; sourceTree = "<group>"; };
 		0BCD83541485841200EA2003 /* TemporaryChange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TemporaryChange.h; sourceTree = "<group>"; };
 		0BF28A2811A33DC300638F84 /* SizeLimits.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SizeLimits.cpp; sourceTree = "<group>"; };
+		0F0776BD14FF002800102332 /* JITCompilationEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCompilationEffort.h; sourceTree = "<group>"; };
 		0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntEntrypoints.cpp; path = llint/LLIntEntrypoints.cpp; sourceTree = "<group>"; };
 		0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntEntrypoints.h; path = llint/LLIntEntrypoints.h; sourceTree = "<group>"; };
 		0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntThunks.cpp; path = llint/LLIntThunks.cpp; sourceTree = "<group>"; };
@@ -942,6 +784,7 @@
 		0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LLIntCallLinkInfo.h; sourceTree = "<group>"; };
 		0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CommonSlowPaths.h; sourceTree = "<group>"; };
 		0F16D724142C39A200CF784A /* BitVector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BitVector.cpp; sourceTree = "<group>"; };
+		0F1D085F150C5A800074D109 /* DFGNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGNode.cpp; path = dfg/DFGNode.cpp; sourceTree = "<group>"; };
 		0F21C26614BE5F5E00ADC64B /* JITDriver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITDriver.h; sourceTree = "<group>"; };
 		0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeSpecializationKind.h; sourceTree = "<group>"; };
 		0F21C27A14BE727300ADC64B /* ExecutionHarness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutionHarness.h; sourceTree = "<group>"; };
@@ -971,6 +814,9 @@
 		0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HostCallReturnValue.h; sourceTree = "<group>"; };
 		0F55F0F114D1063600AC7649 /* AbstractPC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AbstractPC.cpp; sourceTree = "<group>"; };
 		0F55F0F214D1063600AC7649 /* AbstractPC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AbstractPC.h; sourceTree = "<group>"; };
+		0F56A1D115000F31002992B1 /* ExecutionCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutionCounter.h; sourceTree = "<group>"; };
+		0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutionCounter.cpp; sourceTree = "<group>"; };
+		0F56A1D6150028B9002992B1 /* SimpleStats.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SimpleStats.h; sourceTree = "<group>"; };
 		0F5F08CC146BE602000472A9 /* DFGByteCodeCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGByteCodeCache.h; path = dfg/DFGByteCodeCache.h; sourceTree = "<group>"; };
 		0F5F08CE146C762F000472A9 /* UnconditionalFinalizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnconditionalFinalizer.h; sourceTree = "<group>"; };
 		0F62016D143FCD2F0068B77C /* DFGAbstractState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAbstractState.cpp; path = dfg/DFGAbstractState.cpp; sourceTree = "<group>"; };
@@ -1008,6 +854,7 @@
 		0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LazyOperandValueProfile.cpp; sourceTree = "<group>"; };
 		0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MethodOfGettingAValueProfile.h; sourceTree = "<group>"; };
 		0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MethodOfGettingAValueProfile.cpp; sourceTree = "<group>"; };
+		0FB5468E14FADA6F002C2989 /* RefCountedArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RefCountedArray.h; sourceTree = "<group>"; };
 		0FBC0AE41496C7C100D4FBDD /* DFGExitProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DFGExitProfile.cpp; sourceTree = "<group>"; };
 		0FBC0AE51496C7C100D4FBDD /* DFGExitProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DFGExitProfile.h; sourceTree = "<group>"; };
 		0FBD7E671447998F00481315 /* CodeOrigin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeOrigin.h; sourceTree = "<group>"; };
@@ -1216,8 +1063,8 @@
 		5D6A566A0F05995500266145 /* Threading.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Threading.cpp; sourceTree = "<group>"; };
 		5DA479650CFBCF56009328A0 /* TCPackedCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TCPackedCache.h; sourceTree = "<group>"; };
 		5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = JSC.xcconfig; sourceTree = "<group>"; };
-		5DAFD6CC146B68B900FBEFB4 /* TestRegExp.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = TestRegExp.xcconfig; sourceTree = "<group>"; };
 		5DBD18AF0C5401A700C15EAE /* MallocZoneSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MallocZoneSupport.h; sourceTree = "<group>"; };
+		5DDDF44614FEE72200B4FB4D /* LLIntDesiredOffsets.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntDesiredOffsets.h; path = LLIntOffsets/LLIntDesiredOffsets.h; sourceTree = BUILT_PRODUCTS_DIR; };
 		5DE3D0F40DD8DDFB00468714 /* WebKitAvailability.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAvailability.h; sourceTree = "<group>"; };
 		6507D2970E871E4A00D7D896 /* JSTypeInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypeInfo.h; sourceTree = "<group>"; };
 		651122E5140469BA002B101D /* testRegExp.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = testRegExp.cpp; sourceTree = "<group>"; };
@@ -1526,7 +1373,7 @@
 		A8E894310CD0602400367179 /* JSCallbackObjectFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackObjectFunctions.h; sourceTree = "<group>"; };
 		A8E894330CD0603F00367179 /* JSGlobalObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObject.h; sourceTree = "<group>"; };
 		BC021BF1136900C300FC5467 /* CompilerVersion.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = CompilerVersion.xcconfig; sourceTree = "<group>"; };
-		BC021BF2136900C300FC5467 /* TestAPI.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = TestAPI.xcconfig; sourceTree = "<group>"; };
+		BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = ToolExecutable.xcconfig; sourceTree = "<group>"; };
 		BC02E9040E1839DB000F9297 /* ErrorConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ErrorConstructor.cpp; sourceTree = "<group>"; };
 		BC02E9050E1839DB000F9297 /* ErrorConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ErrorConstructor.h; sourceTree = "<group>"; };
 		BC02E9060E1839DB000F9297 /* ErrorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ErrorPrototype.cpp; sourceTree = "<group>"; };
@@ -1867,6 +1714,7 @@
 		0F46809C14BA7F4D00BFE272 /* llint */ = {
 			isa = PBXGroup;
 			children = (
+				5DDDF44614FEE72200B4FB4D /* LLIntDesiredOffsets.h */,
 				0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */,
 				0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */,
 				0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */,
@@ -1920,6 +1768,7 @@
 		1429D92C0ED22D7000B89619 /* jit */ = {
 			isa = PBXGroup;
 			children = (
+				0F0776BD14FF002800102332 /* JITCompilationEffort.h */,
 				0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */,
 				0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */,
 				0F46807F14BA572700BFE272 /* JITExceptions.cpp */,
@@ -2104,8 +1953,7 @@
 				449097EE0F8F81B50076A327 /* FeatureDefines.xcconfig */,
 				5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */,
 				1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */,
-				BC021BF2136900C300FC5467 /* TestAPI.xcconfig */,
-				5DAFD6CC146B68B900FBEFB4 /* TestRegExp.xcconfig */,
+				BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */,
 				1C9051420BA9E8A70081E9D0 /* Version.xcconfig */,
 			);
 			path = Configurations;
@@ -2204,6 +2052,7 @@
 				A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */,
 				A7BC0C81140608B000B1BB71 /* CheckedArithmetic.h */,
 				C2D9CA1214BCC04600304B46 /* CheckedBoolean.h */,
+				0FB5468E14FADA6F002C2989 /* RefCountedArray.h */,
 				BC66BAE213F4928F00C23FAE /* Compiler.h */,
 				FDA15C1612B03028003A583A /* Complex.h */,
 				97941A7C1302A098004A3447 /* CryptographicallyRandomNumber.cpp */,
@@ -2308,6 +2157,7 @@
 				A7C40C08130B057D00D002A1 /* SentinelLinkedList.h */,
 				76FB9F1012E851960051A2EB /* SHA1.cpp */,
 				76FB9F0E12E851860051A2EB /* SHA1.h */,
+				0F56A1D6150028B9002992B1 /* SimpleStats.h */,
 				A7C40C09130B057D00D002A1 /* SinglyLinkedList.h */,
 				0BF28A2811A33DC300638F84 /* SizeLimits.cpp */,
 				0F2E5BF5146357D2003EB2EB /* Spectrum.h */,
@@ -2656,6 +2506,7 @@
 		86EC9DB31328DF44002B2AD7 /* dfg */ = {
 			isa = PBXGroup;
 			children = (
+				0F1D085F150C5A800074D109 /* DFGNode.cpp */,
 				0FFFC94914EF909500C72532 /* DFGArithNodeFlagsInferencePhase.cpp */,
 				0FFFC94A14EF909500C72532 /* DFGArithNodeFlagsInferencePhase.h */,
 				0F62016D143FCD2F0068B77C /* DFGAbstractState.cpp */,
@@ -2704,6 +2555,8 @@
 				0FFFC95014EF909500C72532 /* DFGPhase.h */,
 				0FFFC95114EF909500C72532 /* DFGPredictionPropagationPhase.cpp */,
 				0FFFC95214EF909500C72532 /* DFGPredictionPropagationPhase.h */,
+				0A4337BA1506218800991C95 /* DFGRedundantPhiEliminationPhase.cpp */,
+				0A4337BD1506219B00991C95 /* DFGRedundantPhiEliminationPhase.h */,
 				86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */,
 				86BB09BE138E381B0056702F /* DFGRepatch.cpp */,
 				86BB09BF138E381B0056702F /* DFGRepatch.h */,
@@ -2782,6 +2635,8 @@
 		969A078F0ED1D3AE00F1F681 /* bytecode */ = {
 			isa = PBXGroup;
 			children = (
+				0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */,
+				0F56A1D115000F31002992B1 /* ExecutionCounter.h */,
 				0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */,
 				0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */,
 				0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */,
@@ -2910,89 +2765,54 @@
 			buildActionMask = 2147483647;
 			files = (
 				860161E30F3A83C100F84710 /* AbstractMacroAssembler.h in Headers */,
-				A1D764521354448B00C5C7C0 /* Alignment.h in Headers */,
-				BC18C3E40E16F5CD00B34460 /* AlwaysInline.h in Headers */,
 				BC18C3E50E16F5CD00B34460 /* APICast.h in Headers */,
 				865F408810E7D56300947361 /* APIShims.h in Headers */,
 				BCF605140E203EF800B9A64D /* ArgList.h in Headers */,
 				BC257DE80E1F51C50016B6C9 /* Arguments.h in Headers */,
 				86D3B2C410156BDE002865E7 /* ARMAssembler.h in Headers */,
 				86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */,
-				A73BE169148420520091204B /* ArrayBuffer.h in Headers */,
-				C2D9CA1314BCC04600304B46 /* CheckedBoolean.h in Headers */,
-				A73BE16B148420520091204B /* ArrayBufferView.h in Headers */,
 				C2EAD2FC14F0249800A4B159 /* CopiedAllocator.h in Headers */,
 				C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */,
 				BC18C3E60E16F5CD00B34460 /* ArrayConstructor.h in Headers */,
 				BC18C3E70E16F5CD00B34460 /* ArrayPrototype.h in Headers */,
 				BC18C5240E16FC8A00B34460 /* ArrayPrototype.lut.h in Headers */,
-				BC18C3E90E16F5CD00B34460 /* ASCIICType.h in Headers */,
-				434A8E7114956A50009126F7 /* ASCIIFastPath.h in Headers */,
 				9688CB150ED12B4E001D649F /* AssemblerBuffer.h in Headers */,
 				86D3B2C510156BDE002865E7 /* AssemblerBufferWithConstantPool.h in Headers */,
-				BC18C3EA0E16F5CD00B34460 /* Assertions.h in Headers */,
 				A784A26111D16622005776AC /* ASTBuilder.h in Headers */,
-				BC5F7BBE11823B590052C02C /* Atomics.h in Headers */,
-				868BFA09117CEFD100B908B1 /* AtomicString.h in Headers */,
-				86F38859121130CA007A7CE3 /* AtomicStringHash.h in Headers */,
-				868BFA0A117CEFD100B908B1 /* AtomicStringImpl.h in Headers */,
-				BC18C3EB0E16F5CD00B34460 /* AVLTree.h in Headers */,
 				147B83AC0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h in Headers */,
 				866739D213BFDE710023D87C /* BigInteger.h in Headers */,
-				C22C52F213FAF6EF00B7DC0D /* bignum-dtoa.h in Headers */,
-				C22C52F413FAF6EF00B7DC0D /* bignum.h in Headers */,
 				1A08277A142168D70090CCAC /* BinarySemaphore.h in Headers */,
-				DD377CBC12072C18006A2517 /* Bitmap.h in Headers */,
-				0FD82F4B142806A100179C94 /* BitVector.h in Headers */,
-				A7C40C0A130B057D00D002A1 /* BlockStack.h in Headers */,
-				E4D8CEFB12FC439600BC9F5A /* BloomFilter.h in Headers */,
 				BC18C3EC0E16F5CD00B34460 /* BooleanObject.h in Headers */,
-				0FD82E85141F3FE300179C94 /* BoundsCheckedPointer.h in Headers */,
 				C2C8D03014A3CEFC00578E65 /* CopiedBlock.h in Headers */,
-				86676D5211FED9BC004B6863 /* BumpPointerAllocator.h in Headers */,
 				C2EAA3FA149A835E00FCE112 /* CopiedSpace.h in Headers */,
 				C2C8D02D14A3C6E000578E65 /* CopiedSpaceInlineMethods.h in Headers */,
-				A7A1F7AD0F252B3C00E184E2 /* ByteArray.h in Headers */,
 				969A07230ED1CE3300F1F681 /* BytecodeGenerator.h in Headers */,
-				C22C52F613FAF6EF00B7DC0D /* cached-powers.h in Headers */,
 				869D04AF1193B54D00803475 /* CachedTranscendentalFunction.h in Headers */,
 				BC18C3ED0E16F5CD00B34460 /* CallData.h in Headers */,
 				1429D8DE0ED2205B00B89619 /* CallFrame.h in Headers */,
 				95E3BC050E1AE68200B2D1C1 /* CallIdentifier.h in Headers */,
 				A7521E131429169A003C8D0C /* CardSet.h in Headers */,
-				2CFC5D1E12F45B48004914E2 /* CharacterNames.h in Headers */,
-				A7BC0C82140608B000B1BB71 /* CheckedArithmetic.h in Headers */,
 				BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */,
 				969A07970ED1D3AE00F1F681 /* CodeBlock.h in Headers */,
 				86E116B10FE75AC800B512BC /* CodeLocation.h in Headers */,
 				0FBD7E691447999600481315 /* CodeOrigin.h in Headers */,
-				BC18C3F00E16F5CD00B34460 /* Collator.h in Headers */,
 				BC18C3F30E16F5CD00B34460 /* CommonIdentifiers.h in Headers */,
 				0FD82E39141AB14D00179C94 /* CompactJITCodeMap.h in Headers */,
-				BC66BAE413F492CC00C23FAE /* Compiler.h in Headers */,
 				BC18C3F40E16F5CD00B34460 /* Completion.h in Headers */,
-				FDA15C1E12B0305C003A583A /* Complex.h in Headers */,
 				BC18C3F50E16F5CD00B34460 /* config.h in Headers */,
 				144836E7132DA7BE005BE785 /* ConservativeRoots.h in Headers */,
 				BC18C3F60E16F5CD00B34460 /* ConstructData.h in Headers */,
 				5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */,
-				97941A7F1302A098004A3447 /* CryptographicallyRandomNumber.h in Headers */,
-				86565743115BE3DA00291F40 /* CString.h in Headers */,
-				180B9B080F16D94F009BDBC5 /* CurrentTime.h in Headers */,
 				0F426A4B1460CD6E00131F8F /* DataFormat.h in Headers */,
 				BCD2034A0E17135E002C7E82 /* DateConstructor.h in Headers */,
 				41359CF30FDD89AD00206180 /* DateConversion.h in Headers */,
 				BC1166020E1997B4008066DD /* DateInstance.h in Headers */,
 				14A1563210966365006FA260 /* DateInstanceCache.h in Headers */,
-				41359CF70FDD89CB00206180 /* DateMath.h in Headers */,
 				BCD2034C0E17135E002C7E82 /* DatePrototype.h in Headers */,
 				BCD203E80E1718F4002C7E82 /* DatePrototype.lut.h in Headers */,
 				BC18C3FA0E16F5CD00B34460 /* Debugger.h in Headers */,
 				BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */,
 				BC18C3FB0E16F5CD00B34460 /* DebuggerCallFrame.h in Headers */,
-				C2EE59A013FC973F009CEAFE /* DecimalNumber.h in Headers */,
-				5135FAF212D26ACE003C083B /* Decoder.h in Headers */,
-				BC18C3FC0E16F5CD00B34460 /* Deque.h in Headers */,
 				0F620178143FCD440068B77C /* DFGAbstractState.h in Headers */,
 				0F620177143FCD3F0068B77C /* DFGAbstractValue.h in Headers */,
 				0FC0976D1468AB4E00CF2442 /* DFGAssemblyHelpers.h in Headers */,
@@ -3019,14 +2839,6 @@
 				86EC9DD31328DF82002B2AD7 /* DFGSpeculativeJIT.h in Headers */,
 				0FC097A2146B28CC00CF2442 /* DFGThunks.h in Headers */,
 				0F620174143FCD330068B77C /* DFGVariableAccessData.h in Headers */,
-				BC18C3FD0E16F5CD00B34460 /* DisallowCType.h in Headers */,
-				C22C52F813FAF6EF00B7DC0D /* diy-fp.h in Headers */,
-				C22C52FA13FAF6EF00B7DC0D /* double-conversion.h in Headers */,
-				C22C52FB13FAF6EF00B7DC0D /* double.h in Headers */,
-				14456A321314657800212CA3 /* DoublyLinkedList.h in Headers */,
-				BC18C3FE0E16F5CD00B34460 /* dtoa.h in Headers */,
-				D7A46A4F1338FFEA00ED695C /* DynamicAnnotations.h in Headers */,
-				5135FAF312D26AD1003C083B /* Encoder.h in Headers */,
 				BC3046070E1F497F003232CF /* Error.h in Headers */,
 				BC02E90D0E1839DB000F9297 /* ErrorConstructor.h in Headers */,
 				BC02E98D0E183E38000F9297 /* ErrorInstance.h in Headers */,
@@ -3035,42 +2847,19 @@
 				BC18C4000E16F5CD00B34460 /* ExceptionHelpers.h in Headers */,
 				86CAFEE31035DDE60028A609 /* Executable.h in Headers */,
 				A766B44F0EE8DCD1009518CA /* ExecutableAllocator.h in Headers */,
-				A7FEE67614837B32005DC1A6 /* ExportMacros.h in Headers */,
-				C22C52FD13FAF6EF00B7DC0D /* fast-dtoa.h in Headers */,
-				E48E0F2D0F82151700A8CA37 /* FastAllocBase.h in Headers */,
-				BC18C4020E16F5CD00B34460 /* FastMalloc.h in Headers */,
-				C22C52FF13FAF6EF00B7DC0D /* fixed-dtoa.h in Headers */,
-				A7F19ECE11DD490900931E70 /* FixedArray.h in Headers */,
-				A73BE16D148420520091204B /* Float32Array.h in Headers */,
-				A73BE16F148420520091204B /* Float64Array.h in Headers */,
-				BC18C4030E16F5CD00B34460 /* Forward.h in Headers */,
-				1AA9E5511498093500001A8A /* Functional.h in Headers */,
 				BC18C4040E16F5CD00B34460 /* FunctionConstructor.h in Headers */,
 				BC18C4050E16F5CD00B34460 /* FunctionPrototype.h in Headers */,
 				DDF7ABD411F60ED200108E36 /* GCActivityCallback.h in Headers */,
-				BC18C4060E16F5CD00B34460 /* GetPtr.h in Headers */,
 				142E3134134FF0A600AFADB5 /* Handle.h in Headers */,
 				142E3136134FF0A600AFADB5 /* HandleHeap.h in Headers */,
 				142E3138134FF0A600AFADB5 /* HandleStack.h in Headers */,
 				1478297B1379E8A800A7C2A3 /* HandleTypes.h in Headers */,
-				BC18C4080E16F5CD00B34460 /* HashCountedSet.h in Headers */,
-				BC18C4090E16F5CD00B34460 /* HashFunctions.h in Headers */,
-				BC18C40A0E16F5CD00B34460 /* HashIterators.h in Headers */,
-				BC18C40B0E16F5CD00B34460 /* HashMap.h in Headers */,
-				BC18C40C0E16F5CD00B34460 /* HashSet.h in Headers */,
-				BC18C40D0E16F5CD00B34460 /* HashTable.h in Headers */,
-				BC18C40E0E16F5CD00B34460 /* HashTraits.h in Headers */,
 				14BA7A9813AADFF8005B7C2C /* Heap.h in Headers */,
 				C2C8D03114A3CEFC00578E65 /* HeapBlock.h in Headers */,
 				14F97447138C853E00DA1C67 /* HeapRootVisitor.h in Headers */,
-				7186A6EC13100BA5004479E1 /* HexNumber.h in Headers */,
 				BC18C40F0E16F5CD00B34460 /* Identifier.h in Headers */,
 				BC18C4100E16F5CD00B34460 /* InitializeThreading.h in Headers */,
 				969A07990ED1D3AE00F1F681 /* Instruction.h in Headers */,
-				A73BE173148420520091204B /* Int16Array.h in Headers */,
-				A73BE175148420520091204B /* Int32Array.h in Headers */,
-				A73BE171148420520091204B /* Int8Array.h in Headers */,
-				A73BE180148420A80091204B /* IntegralTypedArrayBase.h in Headers */,
 				BC11667B0E199C05008066DD /* InternalFunction.h in Headers */,
 				1429D77C0ED20D7300B89619 /* Interpreter.h in Headers */,
 				860BD801148EA6F200112B2F /* Intrinsic.h in Headers */,
@@ -3135,12 +2924,9 @@
 				BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */,
 				86D3B3C310159D7F002865E7 /* LinkBuffer.h in Headers */,
 				0F431738146BAC69007E3890 /* ListableHandler.h in Headers */,
-				BC18C4340E16F5CD00B34460 /* ListHashSet.h in Headers */,
-				BC18C4350E16F5CD00B34460 /* ListRefPtr.h in Headers */,
 				A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */,
 				142E3139134FF0A600AFADB5 /* Local.h in Headers */,
 				142E313A134FF0A600AFADB5 /* LocalScope.h in Headers */,
-				BC18C4360E16F5CD00B34460 /* Locker.h in Headers */,
 				BC18C4370E16F5CD00B34460 /* Lookup.h in Headers */,
 				14B723B812D7DA6F003BD5ED /* MachineStackMarker.h in Headers */,
 				86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */,
@@ -3152,29 +2938,18 @@
 				860161E40F3A83C100F84710 /* MacroAssemblerX86.h in Headers */,
 				860161E50F3A83C100F84710 /* MacroAssemblerX86_64.h in Headers */,
 				860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */,
-				BC18C4390E16F5CD00B34460 /* MainThread.h in Headers */,
-				BC18C43A0E16F5CD00B34460 /* MallocZoneSupport.h in Headers */,
 				142D6F0913539A2800B02E86 /* MarkedBlock.h in Headers */,
 				141448CB13A176EC00F5BA1A /* MarkedBlockSet.h in Headers */,
 				14D2F3DB139F4BE200491031 /* MarkedSpace.h in Headers */,
 				142D6F1213539A4100B02E86 /* MarkStack.h in Headers */,
-				BC18C43B0E16F5CD00B34460 /* MathExtras.h in Headers */,
 				BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */,
 				BC18C52A0E16FCC200B34460 /* MathObject.lut.h in Headers */,
-				511FC4CB117EE2A800425272 /* MD5.h in Headers */,
 				90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */,
-				BC18C43E0E16F5CD00B34460 /* MessageQueue.h in Headers */,
-				0F963B2D13F854020002D9B2 /* MetaAllocator.h in Headers */,
-				0F963B2F13FC66BB0002D9B2 /* MetaAllocatorHandle.h in Headers */,
 				86C568E211A213EE0007F7F0 /* MIPSAssembler.h in Headers */,
 				BC02E9110E1839DB000F9297 /* NativeErrorConstructor.h in Headers */,
 				BC02E9130E1839DB000F9297 /* NativeErrorPrototype.h in Headers */,
 				7EFF00640EC05A9A00AA7C93 /* NodeInfo.h in Headers */,
 				BC18C43F0E16F5CD00B34460 /* Nodes.h in Headers */,
-				BC18C4400E16F5CD00B34460 /* Noncopyable.h in Headers */,
-				65E1A3DF122B894500B26097 /* NonCopyingSort.h in Headers */,
-				C0A272630E50A06300E96E15 /* NotFound.h in Headers */,
-				933F5CDC1269229B0049191E /* NullPtr.h in Headers */,
 				BC18C4410E16F5CD00B34460 /* NumberConstructor.h in Headers */,
 				BC18C4420E16F5CD00B34460 /* NumberConstructor.lut.h in Headers */,
 				BC18C4430E16F5CD00B34460 /* NumberObject.h in Headers */,
@@ -3186,34 +2961,12 @@
 				969A079B0ED1D3AE00F1F681 /* Opcode.h in Headers */,
 				BC18C4480E16F5CD00B34460 /* Operations.h in Headers */,
 				0FE228ED1436AB2700196C48 /* Options.h in Headers */,
-				1400067712A6F7830064D123 /* OSAllocator.h in Headers */,
-				97941A5A13029ACC004A3447 /* OSRandomSource.h in Headers */,
-				BC18C4490E16F5CD00B34460 /* OwnArrayPtr.h in Headers */,
-				BC18C44A0E16F5CD00B34460 /* OwnPtr.h in Headers */,
-				4409D8470FAF80A200523B87 /* OwnPtrCommon.h in Headers */,
-				0F636DA0142D27D700B2E66A /* PackedIntVector.h in Headers */,
-				8627E5EC11F1281900A313B5 /* PageAllocation.h in Headers */,
-				14FFF98D12BFFF7500795BB8 /* PageAllocationAligned.h in Headers */,
-				14B3EF0512BC24DD00D29EFF /* PageBlock.h in Headers */,
-				8690231512092D5C00630AF9 /* PageReservation.h in Headers */,
-				7934BB7B1361979300CB99A1 /* ParallelJobs.h in Headers */,
-				7934BB7D1361979400CB99A1 /* ParallelJobsGeneric.h in Headers */,
-				7934BB7E1361979400CB99A1 /* ParallelJobsLibdispatch.h in Headers */,
-				7934BB7F1361979400CB99A1 /* ParallelJobsOpenMP.h in Headers */,
-				2684B2D414D4A9B20072C0B6 /* ParsedURL.h in Headers */,
 				BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */,
 				93052C350FB792190048FDC3 /* ParserArena.h in Headers */,
 				65303D641447B9E100D3F904 /* ParserTokens.h in Headers */,
-				BCFBE696122560E800309E9D /* PassOwnArrayPtr.h in Headers */,
-				44DD48530FAEA85000D6B4EB /* PassOwnPtr.h in Headers */,
-				BC18C44C0E16F5CD00B34460 /* PassRefPtr.h in Headers */,
-				651DCA04136A6FEF00F74194 /* PassTraits.h in Headers */,
-				BC18C44F0E16F5CD00B34460 /* Platform.h in Headers */,
-				A7D649AA1015224E009B2E1B /* PossiblyNull.h in Headers */,
 				0FD82E54141DAEEE00179C94 /* PredictedType.h in Headers */,
 				0FD82E55141DAEEE00179C94 /* PredictionTracker.h in Headers */,
 				BC18C4500E16F5CD00B34460 /* Profile.h in Headers */,
-				95CD45770E1C4FDD0085358E /* ProfileGenerator.h in Headers */,
 				BC18C4510E16F5CD00B34460 /* ProfileNode.h in Headers */,
 				BC18C4520E16F5CD00B34460 /* Profiler.h in Headers */,
 				A7FB61001040C38B0017A286 /* PropertyDescriptor.h in Headers */,
@@ -3222,14 +2975,6 @@
 				BC18C4550E16F5CD00B34460 /* PropertySlot.h in Headers */,
 				BC18C4560E16F5CD00B34460 /* Protect.h in Headers */,
 				147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */,
-				088FA5BC0EF76D4300578E6F /* RandomNumber.h in Headers */,
-				08E279E90EF83B10007DB523 /* RandomNumberSeed.h in Headers */,
-				2684B2D614D4A9B20072C0B6 /* RawURLBuffer.h in Headers */,
-				0F963B2713F753BB0002D9B2 /* RedBlackTree.h in Headers */,
-				BC18C4570E16F5CD00B34460 /* RefCounted.h in Headers */,
-				90D3469C0E285280009492EE /* RefCountedLeakCounter.h in Headers */,
-				BC18C4580E16F5CD00B34460 /* RefPtr.h in Headers */,
-				BC18C4590E16F5CD00B34460 /* RefPtrHashMap.h in Headers */,
 				BC18C45A0E16F5CD00B34460 /* RegExp.h in Headers */,
 				A1712B3F11C7B228007A5315 /* RegExpCache.h in Headers */,
 				BCD202C20E1706A7002C7E82 /* RegExpConstructor.h in Headers */,
@@ -3243,15 +2988,10 @@
 				969A072B0ED1CE6900F1F681 /* RegisterID.h in Headers */,
 				86D3B3C410159D7F002865E7 /* RepatchBuffer.h in Headers */,
 				869EBCB70E8C6D4A008722CC /* ResultType.h in Headers */,
-				BC18C4600E16F5CD00B34460 /* RetainPtr.h in Headers */,
 				C22B31B9140577D700DB475A /* SamplingCounter.h in Headers */,
 				1429D8860ED21C3D00B89619 /* SamplingTool.h in Headers */,
 				BC18C4610E16F5CD00B34460 /* ScopeChain.h in Headers */,
-				969A072C0ED1CE6900F1F681 /* SegmentedVector.h in Headers */,
-				A7C40C0B130B057D00D002A1 /* SentinelLinkedList.h in Headers */,
 				86AE64AA135E5E1C00963012 /* SH4Assembler.h in Headers */,
-				76FB9F0F12E851860051A2EB /* SHA1.h in Headers */,
-				A7C40C0C130B057D00D002A1 /* SinglyLinkedList.h in Headers */,
 				14BA78F113AAB88F005B7C2C /* SlotVisitor.h in Headers */,
 				933040040E6A749400786E6A /* SmallStrings.h in Headers */,
 				BC18C4640E16F5CD00B34460 /* SourceCode.h in Headers */,
@@ -3259,80 +2999,32 @@
 				E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */,
 				E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */,
 				A7386554118697B400540279 /* SpecializedThunkJIT.h in Headers */,
-				0F2E5BF7146357D5003EB2EB /* Spectrum.h in Headers */,
-				86D87DDB12BCAF94008E73A1 /* StackBounds.h in Headers */,
-				868BFA60117D048200B908B1 /* StaticConstructors.h in Headers */,
-				FE1B447A0ECCD73B004F4DD1 /* StdLibExtras.h in Headers */,
 				A781E359141970C700094D90 /* StorageBarrier.h in Headers */,
 				A730B6121250068F009D25B1 /* StrictEvalActivation.h in Headers */,
-				86B99AE3117E578100DF5A90 /* StringBuffer.h in Headers */,
-				081469491264378500DFF935 /* StringBuilder.h in Headers */,
-				08CABBA61265AB3900B206CE /* StringConcatenate.h in Headers */,
 				BC18C4660E16F5CD00B34460 /* StringConstructor.h in Headers */,
-				BC18C4670E16F5CD00B34460 /* StringExtras.h in Headers */,
-				868BFA0D117CEFD100B908B1 /* StringHash.h in Headers */,
-				5D63E9AD10F2BD6E00FC8AE9 /* StringHasher.h in Headers */,
-				868BFA0F117CEFD100B908B1 /* StringImpl.h in Headers */,
 				BC18C4680E16F5CD00B34460 /* StringObject.h in Headers */,
-				71DA9D82134F3F3D00B767E7 /* StringOperators.h in Headers */,
 				BC18C46A0E16F5CD00B34460 /* StringPrototype.h in Headers */,
 				BC18C5260E16FCA700B34460 /* StringPrototype.lut.h in Headers */,
 				142E313B134FF0A600AFADB5 /* Strong.h in Headers */,
 				145722861437E140005FDE26 /* StrongInlines.h in Headers */,
-				C22C531413FAF6EF00B7DC0D /* strtod.h in Headers */,
 				BCDE3AB80E6C82F5001453A7 /* Structure.h in Headers */,
 				7E4EE7090EBB7963005934AA /* StructureChain.h in Headers */,
 				BCCF0D080EF0AAB900413C8F /* StructureStubInfo.h in Headers */,
 				BC9041480EB9250900FE26FA /* StructureTransitionTable.h in Headers */,
 				BC18C46B0E16F5CD00B34460 /* SymbolTable.h in Headers */,
 				A784A26411D16622005776AC /* SyntaxChecker.h in Headers */,
-				BC18C46C0E16F5CD00B34460 /* TCPackedCache.h in Headers */,
-				BC18C46D0E16F5CD00B34460 /* TCPageMap.h in Headers */,
-				BC18C46E0E16F5CD00B34460 /* TCSpinLock.h in Headers */,
-				BC18C46F0E16F5CD00B34460 /* TCSystemAlloc.h in Headers */,
-				0BCD83571485845200EA2003 /* TemporaryChange.h in Headers */,
 				971EDEA61169E0D3005E4262 /* Terminator.h in Headers */,
-				F3BD31ED126735770065467F /* TextPosition.h in Headers */,
-				18BAB55410DAE066000D945B /* ThreadIdentifierDataPthreads.h in Headers */,
-				BC18C4700E16F5CD00B34460 /* Threading.h in Headers */,
-				BC5F7BBF11823B590052C02C /* ThreadingPrimitives.h in Headers */,
-				0BAC94A01338728400CF135B /* ThreadRestrictionVerifier.h in Headers */,
-				BC5F7BC011823B590052C02C /* ThreadSafeRefCounted.h in Headers */,
-				BC18C4710E16F5CD00B34460 /* ThreadSpecific.h in Headers */,
 				A7386556118697B400540279 /* ThunkGenerators.h in Headers */,
 				14A42E400F4F60EE00599099 /* TimeoutChecker.h in Headers */,
 				141448CD13A1783700F5BA1A /* TinyBloomFilter.h in Headers */,
 				5D53726F0E1C54880021E549 /* Tracing.h in Headers */,
-				A73BE17E148420840091204B /* TypedArrayBase.h in Headers */,
-				0B4D7E630F319AC800AD7E58 /* TypeTraits.h in Headers */,
-				A73BE179148420520091204B /* Uint16Array.h in Headers */,
 				866739D313BFDE710023D87C /* Uint16WithFraction.h in Headers */,
-				A73BE17B148420520091204B /* Uint32Array.h in Headers */,
-				A73BE177148420520091204B /* Uint8Array.h in Headers */,
 				0F5F08CF146C7633000472A9 /* UnconditionalFinalizer.h in Headers */,
-				BC18C4730E16F5CD00B34460 /* Unicode.h in Headers */,
-				BC18C4740E16F5CD00B34460 /* UnicodeIcu.h in Headers */,
-				0FD52AAE143035A00026DC9F /* UnionFind.h in Headers */,
-				BC18C4750E16F5CD00B34460 /* UnusedParam.h in Headers */,
-				2684B2D514D4A9B20072C0B6 /* URLString.h in Headers */,
-				2684B2D714D4A9B20072C0B6 /* URLBuffer.h in Headers */,
-				2684B2D914D4A9B20072C0B6 /* URLCharacterTypes.h in Headers */,
-				2684B2DA14D4A9B20072C0B6 /* URLComponent.h in Headers */,
-				2684B2DC14D4A9B20072C0B6 /* URLEscape.h in Headers */,
-				2684B2DD14D4A9B20072C0B6 /* URLParser.h in Headers */,
-				2684B2DE14D4A9B20072C0B6 /* URLQueryCanonicalizer.h in Headers */,
-				2684B2E014D4A9B20072C0B6 /* URLSegments.h in Headers */,
 				BC18C4760E16F5CD00B34460 /* UString.h in Headers */,
 				08DDA5C11264631700751732 /* UStringBuilder.h in Headers */,
-				BC18C4770E16F5CD00B34460 /* UTF8.h in Headers */,
-				C22C531513FAF6EF00B7DC0D /* utils.h in Headers */,
-				E17FF771112131D200076A19 /* ValueCheck.h in Headers */,
 				0F963B3813FC6FE90002D9B2 /* ValueProfile.h in Headers */,
 				0F426A481460CBB300131F8F /* ValueRecovery.h in Headers */,
-				BC18C4780E16F5CD00B34460 /* Vector.h in Headers */,
-				BC18C4790E16F5CD00B34460 /* VectorTraits.h in Headers */,
 				0F426A491460CBB700131F8F /* VirtualRegister.h in Headers */,
-				96DD73790F9DA3100027FBCC /* VMTags.h in Headers */,
 				0FC815151405119B00CFA603 /* VTableSpectrum.h in Headers */,
 				142E313C134FF0A600AFADB5 /* Weak.h in Headers */,
 				14BFCE6910CDB1FC00364CCE /* WeakGCMap.h in Headers */,
@@ -3341,8 +3033,6 @@
 				BC18C47A0E16F5CD00B34460 /* WebKitAvailability.h in Headers */,
 				A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */,
 				0FC8150A14043BF500CFA603 /* WriteBarrierSupport.h in Headers */,
-				868BFA18117CF19900B908B1 /* WTFString.h in Headers */,
-				86D08D5411793613006E5ED0 /* WTFThreadData.h in Headers */,
 				9688CB160ED12B4E001D649F /* X86Assembler.h in Headers */,
 				451539B912DC994500EF7AC4 /* Yarr.h in Headers */,
 				86704B8512DBA33700A9FE7B /* YarrInterpreter.h in Headers */,
@@ -3371,6 +3061,7 @@
 				0F0B83B914BCF95F00885B4F /* CallReturnOffsetToBytecodeOffset.h in Headers */,
 				0F0FC45A14BD15F500B81154 /* LLIntCallLinkInfo.h in Headers */,
 				0F21C26814BE5F6800ADC64B /* JITDriver.h in Headers */,
+				95CD45770E1C4FDD0085358E /* ProfileGenerator.h in Headers */,
 				0F21C27C14BE727600ADC64B /* ExecutionHarness.h in Headers */,
 				0F21C27D14BE727A00ADC64B /* CodeSpecializationKind.h in Headers */,
 				0F21C27F14BEAA8200ADC64B /* BytecodeConventions.h in Headers */,
@@ -3378,8 +3069,6 @@
 				0F7B294B14C3CD2F007C3DB1 /* DFGCapabilities.h in Headers */,
 				0F7B294C14C3CD43007C3DB1 /* DFGByteCodeCache.h in Headers */,
 				0F7B294D14C3CD4C007C3DB1 /* DFGCommon.h in Headers */,
-				91A3905614C0F47200F67901 /* Uint8ClampedArray.h in Headers */,
-				F69E86C414C6E551002C2C62 /* NumberOfCores.h in Headers */,
 				0F93329E14CA7DC50085F3C6 /* CallLinkStatus.h in Headers */,
 				0F9332A014CA7DCD0085F3C6 /* GetByIdStatus.h in Headers */,
 				0F9332A214CA7DD30085F3C6 /* MethodCallLinkStatus.h in Headers */,
@@ -3388,7 +3077,6 @@
 				0F55F0F514D1063C00AC7649 /* AbstractPC.h in Headers */,
 				0F66E16B14DF3F1600B7B2E4 /* DFGNodeReferenceBlob.h in Headers */,
 				0F66E16C14DF3F1600B7B2E4 /* DFGNodeUse.h in Headers */,
-				0F9FC8D114E612DA00D52AE0 /* DataLog.h in Headers */,
 				0F9FC8C414E1B60000D52AE0 /* PolymorphicPutByIdList.h in Headers */,
 				0F9FC8C514E1B60400D52AE0 /* PutKind.h in Headers */,
 				BCBE2CAE14E985AA000593AD /* GCAssertions.h in Headers */,
@@ -3401,6 +3089,9 @@
 				1497209114EB831500FEB1B7 /* PassWeak.h in Headers */,
 				0FB5467714F59B5C002C2989 /* LazyOperandValueProfile.h in Headers */,
 				0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */,
+				0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers */,
+				0F56A1D315000F35002992B1 /* ExecutionCounter.h in Headers */,
+				0A4337BE1506219B00991C95 /* DFGRedundantPhiEliminationPhase.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3483,6 +3174,7 @@
 			buildConfigurationList = 149C275D08902AFE008A9EFC /* Build configuration list for PBXNativeTarget "JavaScriptCore" */;
 			buildPhases = (
 				5D2F7CF90C6875BB00B5B72B /* Update Info.plist with version information */,
+				A8D7082715049EA2001063BC /* Copy WTF Headers */,
 				932F5B3F0822A1C700736975 /* Headers */,
 				932F5B910822A1C700736975 /* Sources */,
 				932F5BD20822A1C700736975 /* Frameworks */,
@@ -3711,6 +3403,20 @@
 			shellPath = /bin/sh;
 			shellScript = "if [ \"${TARGET_GCC_VERSION}\" = \"LLVM_COMPILER\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-exit-time-destructors ]; then\n    ../../Tools/Scripts/check-for-exit-time-destructors || exit $?\nfi";
 		};
+		A8D7082715049EA2001063BC /* Copy WTF Headers */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "Copy WTF Headers";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "# WTF_PRIVATE_HEADERS_PATH will be replaced by PRIVATE_HEADERS_FOLDER_PATH\n# in the equivalent build-phase when WTF is its own project.\nWTF_PRIVATE_HEADERS_PATH=\"/usr/local/include\"\n\nif [[ \"${DEPLOYMENT_LOCATION}\" == \"NO\" ]]; then\nPRIVATE_HEADERS_PATH=\"${TARGET_BUILD_DIR%%/}${WTF_PRIVATE_HEADERS_PATH}\"\nelse\nPRIVATE_HEADERS_PATH=\"${DSTROOT%%/}${WTF_PRIVATE_HEADERS_PATH}\"\nfi;\n\nmkdir -p \"${PRIVATE_HEADERS_PATH}\"\nrsync -av --prune-empty-dirs --exclude \".svn\" --exclude \"usr\" --exclude \"DerivedSources\" --include \"*/\" --include \"*.h\" --exclude \"*\" \"${SRCROOT}/wtf\" \"${PRIVATE_HEADERS_PATH}\"\n";
+		};
 /* End PBXShellScriptBuildPhase section */
 
 /* Begin PBXSourcesBuildPhase section */
@@ -4010,6 +3716,9 @@
 				0FFFC95F14EF90BB00C72532 /* DFGVirtualRegisterAllocationPhase.cpp in Sources */,
 				0FB5467914F5C46B002C2989 /* LazyOperandValueProfile.cpp in Sources */,
 				0FB5467D14F5CFD6002C2989 /* MethodOfGettingAValueProfile.cpp in Sources */,
+				0F56A1D515001CF4002992B1 /* ExecutionCounter.cpp in Sources */,
+				0A4337BB1506218800991C95 /* DFGRedundantPhiEliminationPhase.cpp in Sources */,
+				0F1D0861150C5A860074D109 /* DFGNode.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -4097,37 +3806,29 @@
 		};
 		0FF922CB14F46B130041A24E /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
-				PRODUCT_NAME = JSCLLIntOffsetsExtractor;
-				USER_HEADER_SEARCH_PATHS = ". icu $(HEADER_SEARCH_PATHS) $(BUILT_PRODUCTS_DIR)/LLIntOffsets";
 			};
 			name = Debug;
 		};
 		0FF922CC14F46B130041A24E /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
-				PRODUCT_NAME = JSCLLIntOffsetsExtractor;
-				USER_HEADER_SEARCH_PATHS = ". icu $(HEADER_SEARCH_PATHS) $(BUILT_PRODUCTS_DIR)/LLIntOffsets";
 			};
 			name = Release;
 		};
 		0FF922CD14F46B130041A24E /* Profiling */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
-				PRODUCT_NAME = JSCLLIntOffsetsExtractor;
-				USER_HEADER_SEARCH_PATHS = ". icu $(HEADER_SEARCH_PATHS) $(BUILT_PRODUCTS_DIR)/LLIntOffsets";
 			};
 			name = Profiling;
 		};
 		0FF922CE14F46B130041A24E /* Production */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
-				PRODUCT_NAME = JSCLLIntOffsetsExtractor;
-				USER_HEADER_SEARCH_PATHS = ". icu $(HEADER_SEARCH_PATHS) $(BUILT_PRODUCTS_DIR)/LLIntOffsets";
 			};
 			name = Production;
 		};
@@ -4249,49 +3950,49 @@
 		};
 		14BD59D70A3E8FC900BAF59C /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = BC021BF2136900C300FC5467 /* TestAPI.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
 			};
 			name = Debug;
 		};
 		14BD59D80A3E8FC900BAF59C /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = BC021BF2136900C300FC5467 /* TestAPI.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
 			};
 			name = Release;
 		};
 		14BD59D90A3E8FC900BAF59C /* Production */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = BC021BF2136900C300FC5467 /* TestAPI.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
 			};
 			name = Production;
 		};
 		6511230114046A4C002B101D /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5DAFD6CC146B68B900FBEFB4 /* TestRegExp.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
 			};
 			name = Debug;
 		};
 		6511230214046A4C002B101D /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5DAFD6CC146B68B900FBEFB4 /* TestRegExp.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
 			};
 			name = Release;
 		};
 		6511230314046A4C002B101D /* Profiling */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5DAFD6CC146B68B900FBEFB4 /* TestRegExp.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
 			};
 			name = Profiling;
 		};
 		6511230414046A4C002B101D /* Production */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5DAFD6CC146B68B900FBEFB4 /* TestRegExp.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
 			};
 			name = Production;
@@ -4357,7 +4058,7 @@
 		};
 		A76148420E6402F700E357FA /* Profiling */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = BC021BF2136900C300FC5467 /* TestAPI.xcconfig */;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
 			};
 			name = Profiling;
diff --git a/Source/JavaScriptCore/KeywordLookupGenerator.py b/Source/JavaScriptCore/KeywordLookupGenerator.py
index dc779e0c5..29f50dfe0 100644
--- a/Source/JavaScriptCore/KeywordLookupGenerator.py
+++ b/Source/JavaScriptCore/KeywordLookupGenerator.py
@@ -169,7 +169,8 @@ class Trie:
     def printAsC(self):
         print("namespace JSC {")
         print("")
-        print("static ALWAYS_INLINE bool isIdentPart(int c);")
+        print("static ALWAYS_INLINE bool isIdentPart(LChar c);")
+        print("static ALWAYS_INLINE bool isIdentPart(UChar c);")
         # max length + 1 so we don't need to do any bounds checking at all
         print("static const int maxTokenLength = %d;" % (self.maxLength() + 1))
         print("")
diff --git a/Source/JavaScriptCore/Target.pri b/Source/JavaScriptCore/Target.pri
index 8fa498c08..1480ae74b 100644
--- a/Source/JavaScriptCore/Target.pri
+++ b/Source/JavaScriptCore/Target.pri
@@ -53,6 +53,7 @@ SOURCES += \
     bytecode/CallLinkStatus.cpp \
     bytecode/CodeBlock.cpp \
     bytecode/DFGExitProfile.cpp \
+    bytecode/ExecutionCounter.cpp \
     bytecode/GetByIdStatus.cpp \
     bytecode/JumpTable.cpp \
     bytecode/LazyOperandValueProfile.cpp \
@@ -94,6 +95,7 @@ SOURCES += \
     dfg/DFGDriver.cpp \
     dfg/DFGGraph.cpp \
     dfg/DFGJITCompiler.cpp \
+    dfg/DFGNode.cpp \
     dfg/DFGOperations.cpp \
     dfg/DFGOSREntry.cpp \
     dfg/DFGOSRExit.cpp \
@@ -102,6 +104,7 @@ SOURCES += \
     dfg/DFGOSRExitCompiler32_64.cpp \
     dfg/DFGPhase.cpp \
     dfg/DFGPredictionPropagationPhase.cpp \
+    dfg/DFGRedundantPhiEliminationPhase.cpp \
     dfg/DFGRepatch.cpp \
     dfg/DFGSpeculativeJIT.cpp \
     dfg/DFGSpeculativeJIT32_64.cpp \
diff --git a/Source/JavaScriptCore/assembler/ARMAssembler.cpp b/Source/JavaScriptCore/assembler/ARMAssembler.cpp
index 4ded0e88e..b880f50bf 100644
--- a/Source/JavaScriptCore/assembler/ARMAssembler.cpp
+++ b/Source/JavaScriptCore/assembler/ARMAssembler.cpp
@@ -344,14 +344,14 @@ void ARMAssembler::doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID b
     fdtr_u(isLoad, srcDst, ARMRegisters::S0, 0);
 }
 
-PassRefPtr<ExecutableMemoryHandle> ARMAssembler::executableCopy(JSGlobalData& globalData, void* ownerUID)
+PassRefPtr<ExecutableMemoryHandle> ARMAssembler::executableCopy(JSGlobalData& globalData, void* ownerUID, JITCompilationEffort effort)
 {
     // 64-bit alignment is required for next constant pool and JIT code as well
     m_buffer.flushWithoutBarrier(true);
     if (!m_buffer.isAligned(8))
         bkpt(0);
 
-    RefPtr<ExecutableMemoryHandle> result = m_buffer.executableCopy(globalData, ownerUID);
+    RefPtr<ExecutableMemoryHandle> result = m_buffer.executableCopy(globalData, ownerUID, effort);
     char* data = reinterpret_cast<char*>(result->start());
 
     for (Jumps::Iterator iter = m_jumps.begin(); iter != m_jumps.end(); ++iter) {
diff --git a/Source/JavaScriptCore/assembler/ARMAssembler.h b/Source/JavaScriptCore/assembler/ARMAssembler.h
index ef199d2d1..a9ecf5091 100644
--- a/Source/JavaScriptCore/assembler/ARMAssembler.h
+++ b/Source/JavaScriptCore/assembler/ARMAssembler.h
@@ -30,6 +30,7 @@
 #if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "AssemblerBufferWithConstantPool.h"
+#include "JITCompilationEffort.h"
 #include <wtf/Assertions.h>
 namespace JSC {
 
@@ -679,7 +680,7 @@ namespace JSC {
             return loadBranchTarget(ARMRegisters::pc, cc, useConstantPool);
         }
 
-        PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData&, void* ownerUID);
+        PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData&, void* ownerUID, JITCompilationEffort);
 
         unsigned debugOffset() { return m_buffer.debugOffset(); }
 
diff --git a/Source/JavaScriptCore/assembler/ARMv7Assembler.h b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
index 5f376bf3d..51788da08 100644
--- a/Source/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -584,6 +584,7 @@ private:
         OP_VMOV_T2      = 0xEEB0,
         OP_VMOV_IMM_T2  = 0xEEB0,
         OP_VMRS         = 0xEEB0,
+        OP_VNEG_T2      = 0xEEB0,
         OP_VSQRT_T1     = 0xEEB0,
         OP_B_T3a        = 0xF000,
         OP_B_T4a        = 0xF000,
@@ -601,6 +602,7 @@ private:
         OP_SUB_S_imm_T3 = 0xF1B0,
         OP_CMP_imm_T2   = 0xF1B0,
         OP_RSB_imm_T2   = 0xF1C0,
+        OP_RSB_S_imm_T2 = 0xF1D0,
         OP_ADD_imm_T4   = 0xF200,
         OP_MOV_imm_T3   = 0xF240,
         OP_SUB_imm_T4   = 0xF2A0,
@@ -649,6 +651,7 @@ private:
         OP_VABS_T2b     = 0x0A40,
         OP_VCMPb        = 0x0A40,
         OP_VCVT_FPIVFPb = 0x0A40,
+        OP_VNEG_T2b     = 0x0A40,
         OP_VSUB_T2b     = 0x0A40,
         OP_VSQRT_T1b    = 0x0A40,
         OP_NOP_T2b      = 0x8000,
@@ -1584,6 +1587,16 @@ public:
         m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_SUB_S_imm_T3, rn, rd, imm);
     }
 
+    ALWAYS_INLINE void sub_S(RegisterID rd, ARMThumbImmediate imm, RegisterID rn)
+    {
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isValid());
+        ASSERT(imm.isUInt12());
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_RSB_S_imm_T2, rn, rd, imm);
+    }
+
     // Not allowed in an IT (if then) block?
     ALWAYS_INLINE void sub_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
@@ -1734,6 +1747,11 @@ public:
         m_formatter.vfpOp(OP_VABS_T2, OP_VABS_T2b, true, VFPOperand(16), rd, rm);
     }
 
+    void vneg(FPDoubleRegisterID rd, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VNEG_T2, OP_VNEG_T2b, true, VFPOperand(1), rd, rm);
+    }
+
     void vsqrt(FPDoubleRegisterID rd, FPDoubleRegisterID rm)
     {
         m_formatter.vfpOp(OP_VSQRT_T1, OP_VSQRT_T1b, true, VFPOperand(17), rd, rm);
diff --git a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
index b4262e894..ab343977e 100644
--- a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -28,11 +28,21 @@
 
 #include "CodeLocation.h"
 #include "MacroAssemblerCodeRef.h"
+#include <wtf/CryptographicallyRandomNumber.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/UnusedParam.h>
 
 #if ENABLE(ASSEMBLER)
 
+
+#if PLATFORM(QT)
+#define ENABLE_JIT_CONSTANT_BLINDING 0
+#endif
+
+#ifndef ENABLE_JIT_CONSTANT_BLINDING
+#define ENABLE_JIT_CONSTANT_BLINDING 1
+#endif
+
 namespace JSC {
 
 class LinkBuffer;
@@ -186,11 +196,19 @@ public:
         const void* m_value;
     };
 
-    struct ImmPtr : public TrustedImmPtr {
+    struct ImmPtr : 
+#if ENABLE(JIT_CONSTANT_BLINDING)
+        private TrustedImmPtr 
+#else
+        public TrustedImmPtr
+#endif
+    {
         explicit ImmPtr(const void* value)
             : TrustedImmPtr(value)
         {
         }
+
+        TrustedImmPtr asTrustedImmPtr() { return *this; }
     };
 
     // TrustedImm32:
@@ -232,7 +250,13 @@ public:
     };
 
 
-    struct Imm32 : public TrustedImm32 {
+    struct Imm32 : 
+#if ENABLE(JIT_CONSTANT_BLINDING)
+        private TrustedImm32 
+#else
+        public TrustedImm32
+#endif
+    {
         explicit Imm32(int32_t value)
             : TrustedImm32(value)
         {
@@ -243,6 +267,8 @@ public:
         {
         }
 #endif
+        const TrustedImm32& asTrustedImm32() const { return *this; }
+
     };
     
     // Section 2: MacroAssembler code buffer handles
@@ -535,14 +561,41 @@ public:
         return reinterpret_cast<ptrdiff_t>(b.executableAddress()) - reinterpret_cast<ptrdiff_t>(a.executableAddress());
     }
 
-    void beginUninterruptedSequence() { }
-    void endUninterruptedSequence() { }
+    void beginUninterruptedSequence() { m_inUninterruptedSequence = true; }
+    void endUninterruptedSequence() { m_inUninterruptedSequence = false; }
 
     unsigned debugOffset() { return m_assembler.debugOffset(); }
 
 protected:
+    AbstractMacroAssembler()
+        : m_inUninterruptedSequence(false)
+        , m_randomSource(cryptographicallyRandomNumber())
+    {
+    }
+
     AssemblerType m_assembler;
 
+    bool inUninterruptedSequence()
+    {
+        return m_inUninterruptedSequence;
+    }
+
+    bool m_inUninterruptedSequence;
+    
+    
+    uint32_t random()
+    {
+        return m_randomSource.getUint32();
+    }
+
+    WeakRandom m_randomSource;
+
+#if ENABLE(JIT_CONSTANT_BLINDING)
+    static bool scratchRegisterForBlinding() { return false; }
+    static bool shouldBlindForSpecificArch(uint32_t) { return true; }
+    static bool shouldBlindForSpecificArch(uint64_t) { return true; }
+#endif
+
     friend class LinkBuffer;
     friend class RepatchBuffer;
 
diff --git a/Source/JavaScriptCore/assembler/AssemblerBuffer.h b/Source/JavaScriptCore/assembler/AssemblerBuffer.h
index 55706c1ab..d1deef234 100644
--- a/Source/JavaScriptCore/assembler/AssemblerBuffer.h
+++ b/Source/JavaScriptCore/assembler/AssemblerBuffer.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(ASSEMBLER)
 
+#include "JITCompilationEffort.h"
 #include "JSGlobalData.h"
 #include "stdint.h"
 #include <string.h>
@@ -129,12 +130,12 @@ namespace JSC {
             return AssemblerLabel(m_index);
         }
 
-        PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID)
+        PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID, JITCompilationEffort effort)
         {
             if (!m_index)
                 return 0;
 
-            RefPtr<ExecutableMemoryHandle> result = globalData.executableAllocator.allocate(globalData, m_index, ownerUID);
+            RefPtr<ExecutableMemoryHandle> result = globalData.executableAllocator.allocate(globalData, m_index, ownerUID, effort);
 
             if (!result)
                 return 0;
diff --git a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
index 68afa766b..e2ea261ee 100644
--- a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
+++ b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
@@ -195,10 +195,10 @@ public:
         putIntegralUnchecked(value.low);
     }
 
-    PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID)
+    PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID, JITCompilationEffort effort)
     {
         flushConstantPool(false);
-        return AssemblerBuffer::executableCopy(globalData, ownerUID);
+        return AssemblerBuffer::executableCopy(globalData, ownerUID, effort);
     }
 
     void putShortWithConstantInt(uint16_t insn, uint32_t constant, bool isReusable = false)
diff --git a/Source/JavaScriptCore/assembler/LinkBuffer.h b/Source/JavaScriptCore/assembler/LinkBuffer.h
index 2c07d13fc..6ec9a7eb9 100644
--- a/Source/JavaScriptCore/assembler/LinkBuffer.h
+++ b/Source/JavaScriptCore/assembler/LinkBuffer.h
@@ -34,6 +34,7 @@
 #define GLOBAL_THUNK_ID reinterpret_cast<void*>(static_cast<intptr_t>(-1))
 #define REGEXP_CODE_ID reinterpret_cast<void*>(static_cast<intptr_t>(-2))
 
+#include "JITCompilationEffort.h"
 #include "MacroAssembler.h"
 #include <wtf/DataLog.h>
 #include <wtf/Noncopyable.h>
@@ -73,7 +74,7 @@ class LinkBuffer {
 #endif
 
 public:
-    LinkBuffer(JSGlobalData& globalData, MacroAssembler* masm, void* ownerUID)
+    LinkBuffer(JSGlobalData& globalData, MacroAssembler* masm, void* ownerUID, JITCompilationEffort effort = JITCompilationMustSucceed)
         : m_size(0)
 #if ENABLE(BRANCH_COMPACTION)
         , m_initialSize(0)
@@ -83,16 +84,27 @@ public:
         , m_globalData(&globalData)
 #ifndef NDEBUG
         , m_completed(false)
+        , m_effort(effort)
 #endif
     {
-        linkCode(ownerUID);
+        linkCode(ownerUID, effort);
     }
 
     ~LinkBuffer()
     {
-        ASSERT(m_completed);
+        ASSERT(m_completed || (!m_executableMemory && m_effort == JITCompilationCanFail));
+    }
+    
+    bool didFailToAllocate() const
+    {
+        return !m_executableMemory;
     }
 
+    bool isValid() const
+    {
+        return !didFailToAllocate();
+    }
+    
     // These methods are used to link or set values at code generation time.
 
     void link(Call call, FunctionPtr function)
@@ -218,11 +230,11 @@ private:
         return m_code;
     }
 
-    void linkCode(void* ownerUID)
+    void linkCode(void* ownerUID, JITCompilationEffort effort)
     {
         ASSERT(!m_code);
 #if !ENABLE(BRANCH_COMPACTION)
-        m_executableMemory = m_assembler->m_assembler.executableCopy(*m_globalData, ownerUID);
+        m_executableMemory = m_assembler->m_assembler.executableCopy(*m_globalData, ownerUID, effort);
         if (!m_executableMemory)
             return;
         m_code = m_executableMemory->start();
@@ -230,7 +242,7 @@ private:
         ASSERT(m_code);
 #else
         m_initialSize = m_assembler->m_assembler.codeSize();
-        m_executableMemory = m_globalData->executableAllocator.allocate(*m_globalData, m_initialSize, ownerUID);
+        m_executableMemory = m_globalData->executableAllocator.allocate(*m_globalData, m_initialSize, ownerUID, effort);
         if (!m_executableMemory)
             return;
         m_code = (uint8_t*)m_executableMemory->start();
@@ -307,6 +319,7 @@ private:
     {
 #ifndef NDEBUG
         ASSERT(!m_completed);
+        ASSERT(isValid());
         m_completed = true;
 #endif
 
@@ -375,6 +388,7 @@ private:
     JSGlobalData* m_globalData;
 #ifndef NDEBUG
     bool m_completed;
+    JITCompilationEffort m_effort;
 #endif
 };
 
diff --git a/Source/JavaScriptCore/assembler/MIPSAssembler.h b/Source/JavaScriptCore/assembler/MIPSAssembler.h
index b59fa0b8f..5e0645129 100644
--- a/Source/JavaScriptCore/assembler/MIPSAssembler.h
+++ b/Source/JavaScriptCore/assembler/MIPSAssembler.h
@@ -32,6 +32,7 @@
 #if ENABLE(ASSEMBLER) && CPU(MIPS)
 
 #include "AssemblerBuffer.h"
+#include "JITCompilationEffort.h"
 #include <wtf/Assertions.h>
 #include <wtf/SegmentedVector.h>
 
@@ -645,9 +646,9 @@ public:
         return m_buffer.codeSize();
     }
 
-    PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID)
+    PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID, JITCompilationEffort effort)
     {
-        RefPtr<ExecutableMemoryHandle> result = m_buffer.executableCopy(globalData, ownerUID);
+        RefPtr<ExecutableMemoryHandle> result = m_buffer.executableCopy(globalData, ownerUID, effort);
         if (!result)
             return 0;
 
diff --git a/Source/JavaScriptCore/assembler/MacroAssembler.h b/Source/JavaScriptCore/assembler/MacroAssembler.h
index 347cd0ea0..4c54e29aa 100644
--- a/Source/JavaScriptCore/assembler/MacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/MacroAssembler.h
@@ -60,7 +60,6 @@ typedef MacroAssemblerSH4 MacroAssemblerBase;
 #error "The MacroAssembler is not supported on this platform."
 #endif
 
-
 namespace JSC {
 
 class MacroAssembler : public MacroAssemblerBase {
@@ -73,6 +72,22 @@ public:
     using MacroAssemblerBase::branchPtr;
     using MacroAssemblerBase::branchTestPtr;
 #endif
+    using MacroAssemblerBase::move;
+
+#if ENABLE(JIT_CONSTANT_BLINDING)
+    using MacroAssemblerBase::add32;
+    using MacroAssemblerBase::and32;
+    using MacroAssemblerBase::branchAdd32;
+    using MacroAssemblerBase::branchMul32;
+    using MacroAssemblerBase::branchSub32;
+    using MacroAssemblerBase::lshift32;
+    using MacroAssemblerBase::or32;
+    using MacroAssemblerBase::rshift32;
+    using MacroAssemblerBase::store32;
+    using MacroAssemblerBase::sub32;
+    using MacroAssemblerBase::urshift32;
+    using MacroAssemblerBase::xor32;
+#endif
 
     // Utilities used by the DFG JIT.
 #if ENABLE(DFG_JIT)
@@ -148,19 +163,24 @@ public:
         loadPtr(Address(stackPointerRegister, (index * sizeof(void*))), dest);
     }
 
+    Address addressForPoke(int index)
+    {
+        return Address(stackPointerRegister, (index * sizeof(void*)));
+    }
+    
     void poke(RegisterID src, int index = 0)
     {
-        storePtr(src, Address(stackPointerRegister, (index * sizeof(void*))));
+        storePtr(src, addressForPoke(index));
     }
 
     void poke(TrustedImm32 value, int index = 0)
     {
-        store32(value, Address(stackPointerRegister, (index * sizeof(void*))));
+        store32(value, addressForPoke(index));
     }
 
     void poke(TrustedImmPtr imm, int index = 0)
     {
-        storePtr(imm, Address(stackPointerRegister, (index * sizeof(void*))));
+        storePtr(imm, addressForPoke(index));
     }
 
 
@@ -169,6 +189,10 @@ public:
     {
         branchPtr(cond, op1, imm).linkTo(target, this);
     }
+    void branchPtr(RelationalCondition cond, RegisterID op1, ImmPtr imm, Label target)
+    {
+        branchPtr(cond, op1, imm).linkTo(target, this);
+    }
 
     void branch32(RelationalCondition cond, RegisterID op1, RegisterID op2, Label target)
     {
@@ -179,6 +203,11 @@ public:
     {
         branch32(cond, op1, imm).linkTo(target, this);
     }
+    
+    void branch32(RelationalCondition cond, RegisterID op1, Imm32 imm, Label target)
+    {
+        branch32(cond, op1, imm).linkTo(target, this);
+    }
 
     void branch32(RelationalCondition cond, RegisterID left, Address right, Label target)
     {
@@ -190,6 +219,11 @@ public:
         return branch32(commute(cond), right, left);
     }
 
+    Jump branch32(RelationalCondition cond, Imm32 left, RegisterID right)
+    {
+        return branch32(commute(cond), right, left);
+    }
+
     void branchTestPtr(ResultCondition cond, RegisterID reg, Label target)
     {
         branchTestPtr(cond, reg).linkTo(target, this);
@@ -340,6 +374,11 @@ public:
         return load32WithCompactAddressOffsetPatch(address, dest);
     }
 
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        move(Imm32(imm.asTrustedImmPtr()), dest);
+    }
+
     void comparePtr(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         compare32(cond, left, right, dest);
@@ -364,6 +403,11 @@ public:
     {
         store32(TrustedImm32(imm), address);
     }
+    
+    void storePtr(ImmPtr imm, Address address)
+    {
+        store32(Imm32(imm.asTrustedImmPtr()), address);
+    }
 
     void storePtr(TrustedImmPtr imm, void* address)
     {
@@ -375,7 +419,6 @@ public:
         return store32WithAddressOffsetPatch(src, address);
     }
 
-
     Jump branchPtr(RelationalCondition cond, RegisterID left, RegisterID right)
     {
         return branch32(cond, left, right);
@@ -385,6 +428,11 @@ public:
     {
         return branch32(cond, left, TrustedImm32(right));
     }
+    
+    Jump branchPtr(RelationalCondition cond, RegisterID left, ImmPtr right)
+    {
+        return branch32(cond, left, Imm32(right.asTrustedImmPtr()));
+    }
 
     Jump branchPtr(RelationalCondition cond, RegisterID left, Address right)
     {
@@ -405,7 +453,7 @@ public:
     {
         return branch32(cond, left, TrustedImm32(right));
     }
-
+    
     Jump branchPtr(RelationalCondition cond, AbsoluteAddress left, TrustedImmPtr right)
     {
         return branch32(cond, left, TrustedImm32(right));
@@ -431,7 +479,6 @@ public:
         return branchTest32(cond, address, mask);
     }
 
-
     Jump branchAddPtr(ResultCondition cond, RegisterID src, RegisterID dest)
     {
         return branchAdd32(cond, src, dest);
@@ -446,8 +493,499 @@ public:
     {
         return MacroAssemblerBase::branchTest8(cond, Address(address.base, address.offset), mask);
     }
+#else
+    
+#if ENABLE(JIT_CONSTANT_BLINDING)
+    using MacroAssemblerBase::addPtr;
+    using MacroAssemblerBase::andPtr;
+    using MacroAssemblerBase::branchSubPtr;
+    using MacroAssemblerBase::convertInt32ToDouble;
+    using MacroAssemblerBase::storePtr;
+    using MacroAssemblerBase::subPtr;
+    using MacroAssemblerBase::xorPtr;
+    
+    bool shouldBlindDouble(double value)
+    {
+        // Don't trust NaN or +/-Infinity
+        if (!isfinite(value))
+            return true;
+
+        // Try to force normalisation, and check that there's no change
+        // in the bit pattern
+        if (bitwise_cast<uintptr_t>(value * 1.0) != bitwise_cast<uintptr_t>(value))
+            return true;
+
+        value = abs(value);
+        // Only allow a limited set of fractional components
+        double scaledValue = value * 8;
+        if (scaledValue / 8 != value)
+            return true;
+        double frac = scaledValue - floor(scaledValue);
+        if (frac != 0.0)
+            return true;
+
+        return value > 0xff;
+    }
+    
+    bool shouldBlind(ImmPtr imm)
+    { 
+        ASSERT(!inUninterruptedSequence());
+#if !defined(NDEBUG)
+        UNUSED_PARAM(imm);
+        // Debug always blind all constants, if only so we know
+        // if we've broken blinding during patch development.
+        return true;        
+#endif
+
+        // First off we'll special case common, "safe" values to avoid hurting
+        // performance too much
+        uintptr_t value = imm.asTrustedImmPtr().asIntptr();
+        switch (value) {
+        case 0xffff:
+        case 0xffffff:
+        case 0xffffffffL:
+        case 0xffffffffffL:
+        case 0xffffffffffffL:
+        case 0xffffffffffffffL:
+        case 0xffffffffffffffffL:
+            return false;
+        default: {
+            if (value <= 0xff)
+                return false;
+#if CPU(X86_64)
+            JSValue jsValue = JSValue::decode(reinterpret_cast<void*>(value));
+            if (jsValue.isInt32())
+                return shouldBlind(Imm32(jsValue.asInt32()));
+            if (jsValue.isDouble() && !shouldBlindDouble(jsValue.asDouble()))
+                return false;
+
+            if (!shouldBlindDouble(bitwise_cast<double>(value)))
+                return false;
+#endif 
+        }
+        }
+        return shouldBlindForSpecificArch(value);
+    }
+    
+    struct RotatedImmPtr {
+        RotatedImmPtr(uintptr_t v1, uint8_t v2)
+            : value(v1)
+            , rotation(v2)
+        {
+        }
+        TrustedImmPtr value;
+        TrustedImm32 rotation;
+    };
+    
+    RotatedImmPtr rotationBlindConstant(ImmPtr imm)
+    {
+        uint8_t rotation = random() % (sizeof(void*) * 8);
+        uintptr_t value = imm.asTrustedImmPtr().asIntptr();
+        value = (value << rotation) | (value >> (sizeof(void*) * 8 - rotation));
+        return RotatedImmPtr(value, rotation);
+    }
+    
+    void loadRotationBlindedConstant(RotatedImmPtr constant, RegisterID dest)
+    {
+        move(constant.value, dest);
+        rotateRightPtr(constant.rotation, dest);
+    }
+
+    void convertInt32ToDouble(Imm32 imm, FPRegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            RegisterID scratchRegister = scratchRegisterForBlinding();
+            loadXorBlindedConstant(xorBlindConstant(imm), scratchRegister);
+            convertInt32ToDouble(scratchRegister, dest);
+        } else
+            convertInt32ToDouble(imm.asTrustedImm32(), dest);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        if (shouldBlind(imm))
+            loadRotationBlindedConstant(rotationBlindConstant(imm), dest);
+        else
+            move(imm.asTrustedImmPtr(), dest);
+    }
+
+    Jump branchPtr(RelationalCondition cond, RegisterID left, ImmPtr right)
+    {
+        if (shouldBlind(right)) {
+            RegisterID scratchRegister = scratchRegisterForBlinding();
+            loadRotationBlindedConstant(rotationBlindConstant(right), scratchRegister);
+            return branchPtr(cond, left, scratchRegister);
+        }
+        return branchPtr(cond, left, right.asTrustedImmPtr());
+    }
+    
+    void storePtr(ImmPtr imm, Address dest)
+    {
+        if (shouldBlind(imm)) {
+            RegisterID scratchRegister = scratchRegisterForBlinding();
+            loadRotationBlindedConstant(rotationBlindConstant(imm), scratchRegister);
+            storePtr(scratchRegister, dest);
+        } else
+            storePtr(imm.asTrustedImmPtr(), dest);
+    }
+
+#endif
+
 #endif // !CPU(X86_64)
 
+#if ENABLE(JIT_CONSTANT_BLINDING)
+    bool shouldBlind(Imm32 imm)
+    { 
+        ASSERT(!inUninterruptedSequence());
+#if !defined(NDEBUG)
+        UNUSED_PARAM(imm);
+        // Debug always blind all constants, if only so we know
+        // if we've broken blinding during patch development.
+        return true;
+#else
+
+        // First off we'll special case common, "safe" values to avoid hurting
+        // performance too much
+        uint32_t value = imm.asTrustedImm32().m_value;
+        switch (value) {
+        case 0xffff:
+        case 0xffffff:
+        case 0xffffffff:
+            return false;
+        default:
+            if (value <= 0xff)
+                return false;
+        }
+        return shouldBlindForSpecificArch(value);
+#endif
+    }
+
+    struct BlindedImm32 {
+        BlindedImm32(int32_t v1, int32_t v2)
+            : value1(v1)
+            , value2(v2)
+        {
+        }
+        TrustedImm32 value1;
+        TrustedImm32 value2;
+    };
+
+    uint32_t keyForConstant(uint32_t value, uint32_t& mask)
+    {
+        uint32_t key = random();
+        if (value <= 0xff)
+            mask = 0xff;
+        else if (value <= 0xffff)
+            mask = 0xffff;
+        else if (value <= 0xffffff)
+            mask = 0xffffff;
+        else
+            mask = 0xffffffff;
+        return key & mask;
+    }
+
+    uint32_t keyForConstant(uint32_t value)
+    {
+        uint32_t mask = 0;
+        return keyForConstant(value, mask);
+    }
+
+    BlindedImm32 xorBlindConstant(Imm32 imm)
+    {
+        uint32_t baseValue = imm.asTrustedImm32().m_value;
+        uint32_t key = keyForConstant(baseValue);
+        return BlindedImm32(baseValue ^ key, key);
+    }
+
+    BlindedImm32 additionBlindedConstant(Imm32 imm)
+    {
+        uint32_t baseValue = imm.asTrustedImm32().m_value;
+        uint32_t key = keyForConstant(baseValue);
+        if (key > baseValue)
+            key = key - baseValue;
+        return BlindedImm32(baseValue - key, key);
+    }
+    
+    BlindedImm32 andBlindedConstant(Imm32 imm)
+    {
+        uint32_t baseValue = imm.asTrustedImm32().m_value;
+        uint32_t mask = 0;
+        uint32_t key = keyForConstant(baseValue, mask);
+        ASSERT((baseValue & mask) == baseValue);
+        return BlindedImm32(((baseValue & key) | ~key) & mask, ((baseValue & ~key) | key) & mask);
+    }
+    
+    BlindedImm32 orBlindedConstant(Imm32 imm)
+    {
+        uint32_t baseValue = imm.asTrustedImm32().m_value;
+        uint32_t mask = 0;
+        uint32_t key = keyForConstant(baseValue, mask);
+        ASSERT((baseValue & mask) == baseValue);
+        return BlindedImm32((baseValue & key) & mask, (baseValue & ~key) & mask);
+    }
+    
+    void loadXorBlindedConstant(BlindedImm32 constant, RegisterID dest)
+    {
+        move(constant.value1, dest);
+        xor32(constant.value2, dest);
+    }
+    
+    void add32(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = additionBlindedConstant(imm);
+            add32(key.value1, dest);
+            add32(key.value2, dest);
+        } else
+            add32(imm.asTrustedImm32(), dest);
+    }
+    
+    void addPtr(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = additionBlindedConstant(imm);
+            addPtr(key.value1, dest);
+            addPtr(key.value2, dest);
+        } else
+            addPtr(imm.asTrustedImm32(), dest);
+    }
+
+    void and32(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = andBlindedConstant(imm);
+            and32(key.value1, dest);
+            and32(key.value2, dest);
+        } else
+            and32(imm.asTrustedImm32(), dest);
+    }
+
+    void andPtr(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = andBlindedConstant(imm);
+            andPtr(key.value1, dest);
+            andPtr(key.value2, dest);
+        } else
+            andPtr(imm.asTrustedImm32(), dest);
+    }
+    
+    void and32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            if (src == dest)
+                return and32(imm.asTrustedImm32(), dest);
+            loadXorBlindedConstant(xorBlindConstant(imm), dest);
+            and32(src, dest);
+        } else
+            and32(imm.asTrustedImm32(), src, dest);
+    }
+
+    void move(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm))
+            loadXorBlindedConstant(xorBlindConstant(imm), dest);
+        else
+            move(imm.asTrustedImm32(), dest);
+    }
+    
+    void or32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            if (src == dest)
+                return or32(imm, dest);
+            loadXorBlindedConstant(xorBlindConstant(imm), dest);
+            or32(src, dest);
+        } else
+            or32(imm.asTrustedImm32(), src, dest);
+    }
+    
+    void or32(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = orBlindedConstant(imm);
+            or32(key.value1, dest);
+            or32(key.value2, dest);
+        } else
+            or32(imm.asTrustedImm32(), dest);
+    }
+    
+    void poke(Imm32 value, int index = 0)
+    {
+        store32(value, addressForPoke(index));
+    }
+    
+    void poke(ImmPtr value, int index = 0)
+    {
+        storePtr(value, addressForPoke(index));
+    }
+    
+    void store32(Imm32 imm, Address dest)
+    {
+        if (shouldBlind(imm)) {
+#if CPU(X86) || CPU(X86_64)
+            BlindedImm32 blind = xorBlindConstant(imm);
+            store32(blind.value1, dest);
+            xor32(blind.value2, dest);
+#else
+            RegisterID scratchRegister = (RegisterID)scratchRegisterForBlinding();
+            loadXorBlindedConstant(xorBlindConstant(imm), scratchRegister);
+            store32(scratchRegister, dest);
+#endif
+        } else
+            store32(imm.asTrustedImm32(), dest);
+    }
+    
+    void sub32(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = additionBlindedConstant(imm);
+            sub32(key.value1, dest);
+            sub32(key.value2, dest);
+        } else
+            sub32(imm.asTrustedImm32(), dest);
+    }
+    
+    void subPtr(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = additionBlindedConstant(imm);
+            subPtr(key.value1, dest);
+            subPtr(key.value2, dest);
+        } else
+            subPtr(imm.asTrustedImm32(), dest);
+    }
+    
+    void xor32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 blind = xorBlindConstant(imm);
+            xor32(blind.value1, src, dest);
+            xor32(blind.value2, dest);
+        } else
+            xor32(imm.asTrustedImm32(), src, dest);
+    }
+    
+    void xor32(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 blind = xorBlindConstant(imm);
+            xor32(blind.value1, dest);
+            xor32(blind.value2, dest);
+        } else
+            xor32(imm.asTrustedImm32(), dest);
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, Imm32 right)
+    {
+        if (shouldBlind(right)) {
+            if (RegisterID scratchRegister = (RegisterID)scratchRegisterForBlinding()) {
+                loadXorBlindedConstant(xorBlindConstant(right), scratchRegister);
+                return branch32(cond, left, scratchRegister);
+            }
+            // If we don't have a scratch register available for use, we'll just 
+            // place a random number of nops.
+            uint32_t nopCount = random() & 3;
+            while (nopCount--)
+                nop();
+            return branch32(cond, left, right.asTrustedImm32());
+        }
+        
+        return branch32(cond, left, right.asTrustedImm32());
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, Imm32 imm, RegisterID dest)
+    {
+        if (src == dest) {
+            if (!scratchRegisterForBlinding()) {
+                // Release mode ASSERT, if this fails we will perform incorrect codegen.
+                CRASH();
+            }
+        }
+        if (shouldBlind(imm)) {
+            if (src == dest) {
+                if (RegisterID scratchRegister = (RegisterID)scratchRegisterForBlinding()) {
+                    move(src, scratchRegister);
+                    src = scratchRegister;
+                }
+            }
+            loadXorBlindedConstant(xorBlindConstant(imm), dest);
+            return branchAdd32(cond, src, dest);  
+        }
+        return branchAdd32(cond, src, imm.asTrustedImm32(), dest);            
+    }
+    
+    Jump branchMul32(ResultCondition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (src == dest) {
+            if (!scratchRegisterForBlinding()) {
+                // Release mode ASSERT, if this fails we will perform incorrect codegen.
+                CRASH();
+            }
+        }
+        if (shouldBlind(imm)) {
+            if (src == dest) {
+                if (RegisterID scratchRegister = (RegisterID)scratchRegisterForBlinding()) {
+                    move(src, scratchRegister);
+                    src = scratchRegister;
+                }
+            }
+            loadXorBlindedConstant(xorBlindConstant(imm), dest);
+            return branchMul32(cond, src, dest);  
+        }
+        return branchMul32(cond, imm.asTrustedImm32(), src, dest);
+    }
+
+    // branchSub32 takes a scratch register as 32 bit platforms make use of this,
+    // with src == dst, and on x86-32 we don't have a platform scratch register.
+    Jump branchSub32(ResultCondition cond, RegisterID src, Imm32 imm, RegisterID dest, RegisterID scratch)
+    {
+        if (shouldBlind(imm)) {
+            ASSERT(scratch != dest);
+            ASSERT(scratch != src);
+            loadXorBlindedConstant(xorBlindConstant(imm), scratch);
+            return branchSub32(cond, src, scratch, dest);
+        }
+        return branchSub32(cond, src, imm.asTrustedImm32(), dest);            
+    }
+    
+    // Immediate shifts only have 5 controllable bits
+    // so we'll consider them safe for now.
+    TrustedImm32 trustedImm32ForShift(Imm32 imm)
+    {
+        return TrustedImm32(imm.asTrustedImm32().m_value & 31);
+    }
+
+    void lshift32(Imm32 imm, RegisterID dest)
+    {
+        lshift32(trustedImm32ForShift(imm), dest);
+    }
+    
+    void lshift32(RegisterID src, Imm32 amount, RegisterID dest)
+    {
+        lshift32(src, trustedImm32ForShift(amount), dest);
+    }
+    
+    void rshift32(Imm32 imm, RegisterID dest)
+    {
+        rshift32(trustedImm32ForShift(imm), dest);
+    }
+    
+    void rshift32(RegisterID src, Imm32 amount, RegisterID dest)
+    {
+        rshift32(src, trustedImm32ForShift(amount), dest);
+    }
+    
+    void urshift32(Imm32 imm, RegisterID dest)
+    {
+        urshift32(trustedImm32ForShift(imm), dest);
+    }
+    
+    void urshift32(RegisterID src, Imm32 amount, RegisterID dest)
+    {
+        urshift32(src, trustedImm32ForShift(amount), dest);
+    }
+#endif
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
index 51173895a..c0cd766cb 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -108,6 +108,11 @@ public:
         add32(ARMRegisters::S1, dest);
     }
 
+    void add32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.adds_r(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+    }
+
     void and32(RegisterID src, RegisterID dest)
     {
         m_assembler.ands_r(dest, dest, src);
@@ -122,6 +127,15 @@ public:
             m_assembler.ands_r(dest, dest, w);
     }
 
+    void and32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        ARMWord w = m_assembler.getImm(imm.m_value, ARMRegisters::S0, true);
+        if (w & ARMAssembler::OP2_INV_IMM)
+            m_assembler.bics_r(dest, src, w & ~ARMAssembler::OP2_INV_IMM);
+        else
+            m_assembler.ands_r(dest, src, w);
+    }
+
     void lshift32(RegisterID shift_amount, RegisterID dest)
     {
         ARMWord w = ARMAssembler::getOp2(0x1f);
@@ -156,11 +170,6 @@ public:
         m_assembler.rsbs_r(srcDest, srcDest, ARMAssembler::getOp2(0));
     }
 
-    void not32(RegisterID dest)
-    {
-        m_assembler.mvns_r(dest, dest);
-    }
-
     void or32(RegisterID src, RegisterID dest)
     {
         m_assembler.orrs_r(dest, dest, src);
@@ -232,6 +241,11 @@ public:
         sub32(ARMRegisters::S1, dest);
     }
 
+    void sub32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.subs_r(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+    }
+
     void xor32(RegisterID src, RegisterID dest)
     {
         m_assembler.eors_r(dest, dest, src);
@@ -239,7 +253,10 @@ public:
 
     void xor32(TrustedImm32 imm, RegisterID dest)
     {
-        m_assembler.eors_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+        if (imm.m_value == -1)
+            m_assembler.mvns_r(dest, dest);
+        else
+            m_assembler.eors_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
     void countLeadingZeros32(RegisterID src, RegisterID dest)
@@ -547,6 +564,13 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
+    Jump branchAdd32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        add32(src, imm, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
     void mull32(RegisterID src1, RegisterID src2, RegisterID dest)
     {
         if (src1 == dest) {
@@ -596,6 +620,13 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
+    Jump branchSub32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        sub32(src, imm, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
     Jump branchNeg32(ResultCondition cond, RegisterID srcDest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index d883abf4f..43ea2ed5a 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -51,14 +51,7 @@ public:
     // Magic number is the biggest useful offset we can get on ARMv7 with
     // a LDR_imm_T2 encoding
     static const int MaximumCompactPtrAlignedAddressOffset = 124;
-
-    MacroAssemblerARMv7()
-        : m_inUninterruptedSequence(false)
-    {
-    }
     
-    void beginUninterruptedSequence() { m_inUninterruptedSequence = true; }
-    void endUninterruptedSequence() { m_inUninterruptedSequence = false; }
     Vector<LinkRecord>& jumpsToLink() { return m_assembler.jumpsToLink(); }
     void* unlinkedCode() { return m_assembler.unlinkedCode(); }
     bool canCompact(JumpType jumpType) { return m_assembler.canCompact(jumpType); }
@@ -303,11 +296,6 @@ public:
         m_assembler.neg(srcDest, srcDest);
     }
 
-    void not32(RegisterID srcDest)
-    {
-        m_assembler.mvn(srcDest, srcDest);
-    }
-
     void or32(RegisterID src, RegisterID dest)
     {
         m_assembler.orr(dest, dest, src);
@@ -447,6 +435,11 @@ public:
 
     void xor32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
+        if (imm.m_value == -1) {
+            m_assembler.mvn(dest, src);
+            return;
+        }
+
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
         if (armImm.isValid())
             m_assembler.eor(dest, src, armImm);
@@ -463,7 +456,10 @@ public:
 
     void xor32(TrustedImm32 imm, RegisterID dest)
     {
-        xor32(imm, dest, dest);
+        if (imm.m_value == -1)
+            m_assembler.mvn(dest, dest);
+        else
+            xor32(imm, dest, dest);
     }
     
 
@@ -527,6 +523,7 @@ private:
         unreachableForPlatform();
     }
 
+protected:
     void store32(RegisterID src, ArmAddress address)
     {
         if (address.type == ArmAddress::HasIndex)
@@ -541,6 +538,7 @@ private:
         }
     }
 
+private:
     void store8(RegisterID src, ArmAddress address)
     {
         if (address.type == ArmAddress::HasIndex)
@@ -723,6 +721,26 @@ public:
         store16(src, setupArmAddress(address));
     }
 
+#if ENABLE(JIT_CONSTANT_BLINDING)
+    static RegisterID scratchRegisterForBlinding() { return dataTempRegister; }
+    static bool shouldBlindForSpecificArch(uint32_t value)
+    {
+        ARMThumbImmediate immediate = ARMThumbImmediate::makeEncodedImm(value);
+
+        // Couldn't be encoded as an immediate, so assume it's untrusted.
+        if (!immediate.isValid())
+            return true;
+        
+        // If we can encode the immediate, we have less than 16 attacker
+        // controlled bits.
+        if (immediate.isEncodedImm())
+            return false;
+
+        // Don't let any more than 12 bits of an instruction word
+        // be controlled by an attacker.
+        return !immediate.isUInt12();
+    }
+#endif
 
     // Floating-point operations:
 
@@ -789,7 +807,7 @@ public:
 
     void storeDouble(FPRegisterID src, const void* address)
     {
-        move(ImmPtr(address), addressTempRegister);
+        move(TrustedImmPtr(address), addressTempRegister);
         storeDouble(src, addressTempRegister);
     }
 
@@ -883,6 +901,11 @@ public:
         m_assembler.vabs(dest, src);
     }
 
+    void negateDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vneg(dest, src);
+    }
+
     void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
     {
         m_assembler.vmov(fpTempRegisterAsSingle(), src);
@@ -954,7 +977,7 @@ public:
         // clamped to 0x80000000, so 2x dest is zero in this case. In the case of
         // overflow the result will be equal to -2.
         Jump underflow = branchAdd32(Zero, dest, dest, dataTempRegister);
-        Jump noOverflow = branch32(NotEqual, dataTempRegister, Imm32(-2));
+        Jump noOverflow = branch32(NotEqual, dataTempRegister, TrustedImm32(-2));
 
         // For BranchIfTruncateSuccessful, we branch if 'noOverflow' jumps.
         underflow.link(this);
@@ -1356,7 +1379,7 @@ public:
     {
         // Move the high bits of the address into addressTempRegister,
         // and load the value into dataTempRegister.
-        move(ImmPtr(dest.m_ptr), addressTempRegister);
+        move(TrustedImmPtr(dest.m_ptr), addressTempRegister);
         m_assembler.ldr(dataTempRegister, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
 
         // Do the add.
@@ -1369,7 +1392,7 @@ public:
             // we'll need to reload it with the high bits of the address afterwards.
             move(imm, addressTempRegister);
             m_assembler.add_S(dataTempRegister, dataTempRegister, addressTempRegister);
-            move(ImmPtr(dest.m_ptr), addressTempRegister);
+            move(TrustedImmPtr(dest.m_ptr), addressTempRegister);
         }
 
         // Store the result.
@@ -1401,6 +1424,13 @@ public:
         return branchMul32(cond, dataTempRegister, src, dest);
     }
 
+    Jump branchNeg32(ResultCondition cond, RegisterID srcDest)
+    {
+        ARMThumbImmediate zero = ARMThumbImmediate::makeUInt12(0);
+        m_assembler.sub_S(srcDest, zero, srcDest);
+        return Jump(makeBranch(cond));
+    }
+
     Jump branchOr32(ResultCondition cond, RegisterID src, RegisterID dest)
     {
         m_assembler.orr_S(dest, dest, src);
@@ -1586,10 +1616,6 @@ public:
     }
 
 protected:
-    bool inUninterruptedSequence()
-    {
-        return m_inUninterruptedSequence;
-    }
 
     ALWAYS_INLINE Jump jump()
     {
@@ -1697,8 +1723,7 @@ private:
     {
         ARMv7Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
     }
-    
-    bool m_inUninterruptedSequence;
+
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index 3d7d84534..ac62c4221 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -27,9 +27,9 @@
 #define MacroAssemblerCodeRef_h
 
 #include "ExecutableAllocator.h"
-#include "PassRefPtr.h"
-#include "RefPtr.h"
-#include "UnusedParam.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/UnusedParam.h>
 
 // ASSERT_VALID_CODE_POINTER checks that ptr is a non-null pointer, and that it is a valid
 // instruction address on the platform (for example, check any alignment requirements).
@@ -280,6 +280,10 @@ public:
         return result;
     }
 
+    static MacroAssemblerCodePtr createLLIntCodePtr(void (*function)())
+    {
+        return createFromExecutableAddress(bitwise_cast<void*>(function));
+    }
     explicit MacroAssemblerCodePtr(ReturnAddressPtr ra)
         : m_value(ra.value())
     {
@@ -340,6 +344,12 @@ public:
         return MacroAssemblerCodeRef(codePtr);
     }
     
+    // Helper for creating self-managed code refs from LLInt.
+    static MacroAssemblerCodeRef createLLIntCodeRef(void (*function)())
+    {
+        return createSelfManagedCodeRef(MacroAssemblerCodePtr::createFromExecutableAddress(bitwise_cast<void*>(function)));
+    }
+    
     ExecutableMemoryHandle* executableMemory() const
     {
         return m_executableMemory.get();
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
index f1aa6d4ad..910bc5a47 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
@@ -132,6 +132,11 @@ public:
         }
     }
 
+    void add32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        add32(imm, src, dest);
+    }
+
     void add32(TrustedImm32 imm, Address address)
     {
         if (address.offset >= -32768 && address.offset <= 32767
@@ -291,11 +296,6 @@ public:
         m_assembler.subu(srcDest, MIPSRegisters::zero, srcDest);
     }
 
-    void not32(RegisterID srcDest)
-    {
-        m_assembler.nor(srcDest, srcDest, MIPSRegisters::zero);
-    }
-
     void or32(RegisterID src, RegisterID dest)
     {
         m_assembler.orInsn(dest, dest, src);
@@ -373,6 +373,24 @@ public:
         }
     }
 
+    void sub32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && imm.m_value >= -32767 && imm.m_value <= 32768
+            && !m_fixedWidth) {
+            /*
+              addiu     dest, src, imm
+            */
+            m_assembler.addiu(dest, src, -imm.m_value);
+        } else {
+            /*
+              li        immTemp, imm
+              subu      dest, src, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.subu(dest, src, immTempRegister);
+        }
+    }
+
     void sub32(TrustedImm32 imm, Address address)
     {
         if (address.offset >= -32768 && address.offset <= 32767
@@ -458,6 +476,11 @@ public:
 
     void xor32(TrustedImm32 imm, RegisterID dest)
     {
+        if (imm.m_value == -1) {
+            m_assembler.nor(dest, dest, MIPSRegisters::zero);
+            return;
+        }
+
         /*
             li  immTemp, imm
             xor dest, dest, immTemp
@@ -1203,6 +1226,13 @@ public:
         return branchAdd32(cond, immTempRegister, dest);
     }
 
+    Jump branchAdd32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        move(src, dest);
+        return branchAdd32(cond, immTempRegister, dest);
+    }
+
     Jump branchMul32(ResultCondition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -1308,6 +1338,13 @@ public:
         return branchSub32(cond, immTempRegister, dest);
     }
 
+    Jump branchSub32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        move(src, dest);
+        return branchSub32(cond, immTempRegister, dest);
+    }
+
     Jump branchOr32(ResultCondition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
index a84f33748..2b5c0cc44 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
@@ -209,11 +209,6 @@ public:
         releaseScratch(scr);
     }
 
-    void not32(RegisterID src, RegisterID dest)
-    {
-        m_assembler.notlReg(src, dest);
-    }
-
     void or32(RegisterID src, RegisterID dest)
     {
         m_assembler.orlRegReg(src, dest);
@@ -380,6 +375,11 @@ public:
 
     void xor32(TrustedImm32 imm, RegisterID srcDest)
     {
+        if (imm.m_value == -1) {
+            m_assembler.notlReg(srcDest, srcDest);
+            return;
+        }
+
         if ((srcDest != SH4Registers::r0) || (imm.m_value > 255) || (imm.m_value < 0)) {
             RegisterID scr = claimScratch();
             m_assembler.loadConstant((imm.m_value), scr);
@@ -1565,6 +1565,33 @@ public:
         return branchAdd32(cond, scratchReg3, dest);
     }
 
+    Jump branchAdd32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (src != dest)
+            move(src, dest);
+
+        if (cond == Overflow) {
+            move(imm, scratchReg3);
+            m_assembler.addvlRegReg(scratchReg3, dest);
+            return branchTrue();
+        }
+
+        add32(imm, dest);
+
+        if (cond == Signed) {
+            m_assembler.cmppz(dest);
+            return branchFalse();
+        }
+
+        compare32(0, dest, Equal);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
     Jump branchMul32(ResultCondition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -1642,6 +1669,14 @@ public:
         return branchSub32(cond, scratchReg3, dest);
     }
 
+    Jump branchSub32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, scratchReg3);
+        if (src != dest)
+            move(src, dest);
+        return branchSub32(cond, scratchReg3, dest);
+    }
+
     Jump branchOr32(ResultCondition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -1681,11 +1716,6 @@ public:
         m_assembler.neg(dst, dst);
     }
 
-    void not32(RegisterID dst)
-    {
-        m_assembler.notlReg(dst, dst);
-    }
-
     void urshift32(RegisterID shiftamount, RegisterID dest)
     {
         if (shiftamount == SH4Registers::r0)
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
index cb2450f62..088fe196b 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
@@ -93,12 +93,6 @@ public:
         m_assembler.addsd_mr(address.m_ptr, dest);
     }
 
-    void loadDouble(const void* address, FPRegisterID dest)
-    {
-        ASSERT(isSSE2Present());
-        m_assembler.movsd_mr(address, dest);
-    }
-
     void storeDouble(FPRegisterID src, const void* address)
     {
         ASSERT(isSSE2Present());
@@ -110,14 +104,6 @@ public:
         m_assembler.cvtsi2sd_mr(src.m_ptr, dest);
     }
 
-    void absDouble(FPRegisterID src, FPRegisterID dst)
-    {
-        ASSERT(src != dst);
-        static const double negativeZeroConstant = -0.0;
-        loadDouble(&negativeZeroConstant, dst);
-        m_assembler.andnpd_rr(src, dst);
-    }
-
     void store32(TrustedImm32 imm, void* address)
     {
         m_assembler.movl_i32m(imm.m_value, address);
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index e6c39598b..8cb442cc5 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -34,6 +34,11 @@
 namespace JSC {
 
 class MacroAssemblerX86Common : public AbstractMacroAssembler<X86Assembler> {
+protected:
+#if CPU(X86_64)
+    static const X86Registers::RegisterID scratchRegister = X86Registers::r11;
+#endif
+
     static const int DoubleConditionBitInvert = 0x10;
     static const int DoubleConditionBitSpecial = 0x20;
     static const int DoubleConditionBits = DoubleConditionBitInvert | DoubleConditionBitSpecial;
@@ -86,6 +91,13 @@ public:
 
     static const RegisterID stackPointerRegister = X86Registers::esp;
 
+#if ENABLE(JIT_CONSTANT_BLINDING)
+    static bool shouldBlindForSpecificArch(uint32_t value) { return value >= 0x00ffffff; }
+#if CPU(X86_64)
+    static bool shouldBlindForSpecificArch(uintptr_t value) { return value >= 0x00ffffff; }
+#endif
+#endif
+
     // Integer arithmetic operations:
     //
     // Operations are typically two operand - operation(source, srcDst)
@@ -223,16 +235,6 @@ public:
         m_assembler.negl_m(srcDest.offset, srcDest.base);
     }
 
-    void not32(RegisterID srcDest)
-    {
-        m_assembler.notl_r(srcDest);
-    }
-
-    void not32(Address srcDest)
-    {
-        m_assembler.notl_m(srcDest.offset, srcDest.base);
-    }
-    
     void or32(RegisterID src, RegisterID dest)
     {
         m_assembler.orl_rr(src, dest);
@@ -375,7 +377,6 @@ public:
         m_assembler.subl_rm(src, dest.offset, dest.base);
     }
 
-
     void xor32(RegisterID src, RegisterID dest)
     {
         m_assembler.xorl_rr(src, dest);
@@ -383,11 +384,17 @@ public:
 
     void xor32(TrustedImm32 imm, Address dest)
     {
-        m_assembler.xorl_im(imm.m_value, dest.offset, dest.base);
+        if (imm.m_value == -1)
+            m_assembler.notl_m(dest.offset, dest.base);
+        else
+            m_assembler.xorl_im(imm.m_value, dest.offset, dest.base);
     }
 
     void xor32(TrustedImm32 imm, RegisterID dest)
     {
+        if (imm.m_value == -1)
+        m_assembler.notl_r(dest);
+        else
         m_assembler.xorl_ir(imm.m_value, dest);
     }
 
@@ -424,6 +431,23 @@ public:
         m_assembler.sqrtsd_rr(src, dst);
     }
 
+    void absDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        ASSERT(src != dst);
+        static const double negativeZeroConstant = -0.0;
+        loadDouble(&negativeZeroConstant, dst);
+        m_assembler.andnpd_rr(src, dst);
+    }
+
+    void negateDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        ASSERT(src != dst);
+        static const double negativeZeroConstant = -0.0;
+        loadDouble(&negativeZeroConstant, dst);
+        m_assembler.xorpd_rr(src, dst);
+    }
+
+
     // Memory access operations:
     //
     // Loads are of the form load(address, destination) and stores of the form
@@ -620,6 +644,17 @@ public:
             m_assembler.movsd_rr(src, dest);
     }
 
+    void loadDouble(const void* address, FPRegisterID dest)
+    {
+#if CPU(X86)
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_mr(address, dest);
+#else
+        move(TrustedImmPtr(address), scratchRegister);
+        loadDouble(scratchRegister, dest);
+#endif
+    }
+
     void loadDouble(ImplicitAddress address, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index 846049999..a2b4311e5 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -35,9 +35,6 @@
 namespace JSC {
 
 class MacroAssemblerX86_64 : public MacroAssemblerX86Common {
-protected:
-    static const X86Registers::RegisterID scratchRegister = X86Registers::r11;
-
 public:
     static const Scale ScalePtr = TimesEight;
 
@@ -88,12 +85,6 @@ public:
         }
     }
 
-    void loadDouble(const void* address, FPRegisterID dest)
-    {
-        move(TrustedImmPtr(address), scratchRegister);
-        loadDouble(scratchRegister, dest);
-    }
-
     void addDouble(AbsoluteAddress address, FPRegisterID dest)
     {
         move(TrustedImmPtr(address.m_ptr), scratchRegister);
@@ -106,14 +97,6 @@ public:
         m_assembler.cvtsi2sd_rr(scratchRegister, dest);
     }
 
-    void absDouble(FPRegisterID src, FPRegisterID dst)
-    {
-        ASSERT(src != dst);
-        static const double negativeZeroConstant = -0.0;
-        loadDouble(&negativeZeroConstant, dst);
-        m_assembler.andnpd_rr(src, dst);
-    }
-
     void store32(TrustedImm32 imm, void* address)
     {
         move(TrustedImmPtr(address), scratchRegister);
@@ -233,6 +216,11 @@ public:
         move(src, dest);
         orPtr(imm, dest);
     }
+    
+    void rotateRightPtr(TrustedImm32 imm, RegisterID srcDst)
+    {
+        m_assembler.rorq_i8r(imm.m_value, srcDst);
+    }
 
     void subPtr(RegisterID src, RegisterID dest)
     {
@@ -254,13 +242,17 @@ public:
     {
         m_assembler.xorq_rr(src, dest);
     }
+    
+    void xorPtr(RegisterID src, Address dest)
+    {
+        m_assembler.xorq_rm(src, dest.offset, dest.base);
+    }
 
     void xorPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         m_assembler.xorq_ir(imm.m_value, srcDest);
     }
 
-
     void loadPtr(ImplicitAddress address, RegisterID dest)
     {
         m_assembler.movq_mr(address.offset, address.base, dest);
@@ -351,6 +343,13 @@ public:
         m_assembler.movzbl_rr(dest, dest);
     }
     
+    void comparePtr(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmpq_rr(right, left);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
+    }
+    
     Jump branchAdd32(ResultCondition cond, TrustedImm32 src, AbsoluteAddress dest)
     {
         move(TrustedImmPtr(dest.m_ptr), scratchRegister);
@@ -459,6 +458,12 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branchSubPtr(ResultCondition cond, RegisterID src1, TrustedImm32 src2, RegisterID dest)
+    {
+        move(src1, dest);
+        return branchSubPtr(cond, src2, dest);
+    }
+
     DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
     {
         m_assembler.movq_i64r(initialValue.asIntptr(), dest);
@@ -503,6 +508,8 @@ public:
         return FunctionPtr(X86Assembler::readPointer(call.dataLabelPtrAtOffset(-REPTACH_OFFSET_CALL_R11).dataLocation()));
     }
 
+    static RegisterID scratchRegisterForBlinding() { return scratchRegister; }
+
 private:
     friend class LinkBuffer;
     friend class RepatchBuffer;
diff --git a/Source/JavaScriptCore/assembler/SH4Assembler.h b/Source/JavaScriptCore/assembler/SH4Assembler.h
index 280a5de85..1cf96b735 100644
--- a/Source/JavaScriptCore/assembler/SH4Assembler.h
+++ b/Source/JavaScriptCore/assembler/SH4Assembler.h
@@ -31,6 +31,7 @@
 
 #include "AssemblerBuffer.h"
 #include "AssemblerBufferWithConstantPool.h"
+#include "JITCompilationEffort.h"
 #include <stdarg.h>
 #include <stdint.h>
 #include <stdio.h>
@@ -1514,9 +1515,9 @@ public:
         return reinterpret_cast<void*>(readPCrelativeAddress((*instructionPtr & 0xff), instructionPtr));
     }
 
-    PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID)
+    PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID, JITCompilationEffort effort)
     {
-        return m_buffer.executableCopy(globalData, ownerUID);
+        return m_buffer.executableCopy(globalData, ownerUID, effort);
     }
 
     void prefix(uint16_t pre)
diff --git a/Source/JavaScriptCore/assembler/X86Assembler.h b/Source/JavaScriptCore/assembler/X86Assembler.h
index 25f8602e8..b24fffb8f 100644
--- a/Source/JavaScriptCore/assembler/X86Assembler.h
+++ b/Source/JavaScriptCore/assembler/X86Assembler.h
@@ -29,6 +29,7 @@
 #if ENABLE(ASSEMBLER) && (CPU(X86) || CPU(X86_64))
 
 #include "AssemblerBuffer.h"
+#include "JITCompilationEffort.h"
 #include <stdint.h>
 #include <wtf/Assertions.h>
 #include <wtf/Vector.h>
@@ -215,7 +216,12 @@ private:
         GROUP1_OP_CMP = 7,
 
         GROUP1A_OP_POP = 0,
-
+        
+        GROUP2_OP_ROL = 0,
+        GROUP2_OP_ROR = 1,
+        GROUP2_OP_RCL = 2,
+        GROUP2_OP_RCR = 3,
+        
         GROUP2_OP_SHL = 4,
         GROUP2_OP_SHR = 5,
         GROUP2_OP_SAR = 7,
@@ -635,6 +641,22 @@ public:
             m_formatter.immediate32(imm);
         }
     }
+    
+    void xorq_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_XOR_EvGv, src, base, offset);
+    }
+    
+    void rorq_i8r(int imm, RegisterID dst)
+    {
+        if (imm == 1)
+            m_formatter.oneByteOp64(OP_GROUP2_Ev1, GROUP2_OP_ROR, dst);
+        else {
+            m_formatter.oneByteOp64(OP_GROUP2_EvIb, GROUP2_OP_ROR, dst);
+            m_formatter.immediate8(imm);
+        }
+    }
+
 #endif
 
     void sarl_i8r(int imm, RegisterID dst)
@@ -1782,9 +1804,9 @@ public:
         return b.m_offset - a.m_offset;
     }
     
-    PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID)
+    PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID, JITCompilationEffort effort)
     {
-        return m_formatter.executableCopy(globalData, ownerUID);
+        return m_formatter.executableCopy(globalData, ownerUID, effort);
     }
 
     unsigned debugOffset() { return m_formatter.debugOffset(); }
@@ -2130,9 +2152,9 @@ private:
         bool isAligned(int alignment) const { return m_buffer.isAligned(alignment); }
         void* data() const { return m_buffer.data(); }
 
-        PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID)
+        PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData, void* ownerUID, JITCompilationEffort effort)
         {
-            return m_buffer.executableCopy(globalData, ownerUID);
+            return m_buffer.executableCopy(globalData, ownerUID, effort);
         }
 
         unsigned debugOffset() { return m_buffer.debugOffset(); }
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index ab89ad965..20972cc63 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -226,7 +226,7 @@ static bool isPropertyAccess(OpcodeID opcodeID)
     }
 }
 
-static unsigned instructionOffsetForNth(ExecState* exec, const Vector<Instruction>& instructions, int nth, bool (*predicate)(OpcodeID))
+static unsigned instructionOffsetForNth(ExecState* exec, const RefCountedArray<Instruction>& instructions, int nth, bool (*predicate)(OpcodeID))
 {
     size_t i = 0;
     while (i < instructions.size()) {
@@ -347,18 +347,13 @@ void CodeBlock::printStructures(const Instruction* vPC) const
 
 void CodeBlock::dump(ExecState* exec) const
 {
-    if (!m_instructions) {
-        dataLog("No instructions available.\n");
-        return;
-    }
-
     size_t instructionCount = 0;
 
     for (size_t i = 0; i < instructions().size(); i += opcodeLengths[exec->interpreter()->getOpcodeID(instructions()[i].u.opcode)])
         ++instructionCount;
 
     dataLog("%lu m_instructions; %lu bytes at %p; %d parameter(s); %d callee register(s); %d variable(s)\n\n",
-        static_cast<unsigned long>(instructionCount),
+        static_cast<unsigned long>(instructions().size()),
         static_cast<unsigned long>(instructions().size() * sizeof(Instruction)),
         this, m_numParameters, m_numCalleeRegisters, m_numVars);
 
@@ -689,10 +684,6 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             ++it;
             break;
         }
-        case op_bitnot: {
-            printUnaryOp(exec, location, it, "bitnot");
-            break;
-        }
         case op_check_has_instance: {
             int base = (++it)->u.operand;
             dataLog("[%4d] check_has_instance\t\t %s\n", location, registerName(exec, base).data());
@@ -1424,11 +1415,9 @@ CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other, SymbolTable* symTab)
     , m_numVars(other.m_numVars)
     , m_numCapturedVars(other.m_numCapturedVars)
     , m_isConstructor(other.m_isConstructor)
-    , m_shouldDiscardBytecode(false)
     , m_ownerExecutable(*other.m_globalData, other.m_ownerExecutable.get(), other.m_ownerExecutable.get())
     , m_globalData(other.m_globalData)
     , m_instructions(other.m_instructions)
-    , m_instructionCount(other.m_instructionCount)
     , m_thisRegister(other.m_thisRegister)
     , m_argumentsRegister(other.m_argumentsRegister)
     , m_activationRegister(other.m_activationRegister)
@@ -1484,12 +1473,9 @@ CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlo
     , m_numCalleeRegisters(0)
     , m_numVars(0)
     , m_isConstructor(isConstructor)
-    , m_shouldDiscardBytecode(false)
     , m_numParameters(0)
     , m_ownerExecutable(globalObject->globalData(), ownerExecutable, ownerExecutable)
     , m_globalData(0)
-    , m_instructions(adoptRef(new Instructions))
-    , m_instructionCount(0)
     , m_argumentsRegister(-1)
     , m_needsFullScopeChain(ownerExecutable->needsActivation())
     , m_usesEval(ownerExecutable->usesEval())
@@ -1595,13 +1581,15 @@ void CodeBlock::visitStructures(SlotVisitor& visitor, Instruction* vPC) const
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain)) {
         visitor.append(&vPC[4].u.structure);
-        visitor.append(&vPC[5].u.structureChain);
+        if (vPC[5].u.structureChain)
+            visitor.append(&vPC[5].u.structureChain);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition)) {
         visitor.append(&vPC[4].u.structure);
         visitor.append(&vPC[5].u.structure);
-        visitor.append(&vPC[6].u.structureChain);
+        if (vPC[6].u.structureChain)
+            visitor.append(&vPC[6].u.structureChain);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id) && vPC[4].u.structure) {
@@ -1631,6 +1619,32 @@ void EvalCodeCache::visitAggregate(SlotVisitor& visitor)
 
 void CodeBlock::visitAggregate(SlotVisitor& visitor)
 {
+#if ENABLE(PARALLEL_GC) && ENABLE(DFG_JIT)
+    if (!!m_dfgData) {
+        // I may be asked to scan myself more than once, and it may even happen concurrently.
+        // To this end, use a CAS loop to check if I've been called already. Only one thread
+        // may proceed past this point - whichever one wins the CAS race.
+        unsigned oldValue;
+        do {
+            oldValue = m_dfgData->visitAggregateHasBeenCalled;
+            if (oldValue) {
+                // Looks like someone else won! Return immediately to ensure that we don't
+                // trace the same CodeBlock concurrently. Doing so is hazardous since we will
+                // be mutating the state of ValueProfiles, which contain JSValues, which can
+                // have word-tearing on 32-bit, leading to awesome timing-dependent crashes
+                // that are nearly impossible to track down.
+                
+                // Also note that it must be safe to return early as soon as we see the
+                // value true (well, (unsigned)1), since once a GC thread is in this method
+                // and has won the CAS race (i.e. was responsible for setting the value true)
+                // it will definitely complete the rest of this method before declaring
+                // termination.
+                return;
+            }
+        } while (!WTF::weakCompareAndSwap(&m_dfgData->visitAggregateHasBeenCalled, 0, 1));
+    }
+#endif // ENABLE(PARALLEL_GC) && ENABLE(DFG_JIT)
+    
     if (!!m_alternative)
         m_alternative->visitAggregate(visitor);
 
@@ -1903,12 +1917,6 @@ void CodeBlock::finalizeUnconditionally()
         }
     }
 #endif
-
-    // Handle the bytecode discarding chore.
-    if (m_shouldDiscardBytecode) {
-        discardBytecode();
-        m_shouldDiscardBytecode = false;
-    }
 }
 
 void CodeBlock::stronglyVisitStrongReferences(SlotVisitor& visitor)
@@ -1980,7 +1988,7 @@ void CodeBlock::stronglyVisitWeakReferences(SlotVisitor& visitor)
 
 HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
 {
-    ASSERT(bytecodeOffset < m_instructionCount);
+    ASSERT(bytecodeOffset < instructions().size());
 
     if (!m_rareData)
         return 0;
@@ -1998,7 +2006,7 @@ HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
 
 int CodeBlock::lineNumberForBytecodeOffset(unsigned bytecodeOffset)
 {
-    ASSERT(bytecodeOffset < m_instructionCount);
+    ASSERT(bytecodeOffset < instructions().size());
 
     if (!m_rareData)
         return m_ownerExecutable->source().firstLine();
@@ -2022,7 +2030,7 @@ int CodeBlock::lineNumberForBytecodeOffset(unsigned bytecodeOffset)
 
 void CodeBlock::expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& divot, int& startOffset, int& endOffset)
 {
-    ASSERT(bytecodeOffset < m_instructionCount);
+    ASSERT(bytecodeOffset < instructions().size());
 
     if (!m_rareData) {
         startOffset = 0;
@@ -2102,8 +2110,6 @@ bool CodeBlock::hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset)
 
 void CodeBlock::shrinkToFit()
 {
-    instructions().shrinkToFit();
-
 #if ENABLE(CLASSIC_INTERPRETER)
     m_propertyAccessInstructions.shrinkToFit();
     m_globalResolveInstructions.shrinkToFit();
@@ -2345,21 +2351,21 @@ void FunctionCodeBlock::jettison()
     static_cast<FunctionExecutable*>(ownerExecutable())->jettisonOptimizedCodeFor(*globalData(), m_isConstructor ? CodeForConstruct : CodeForCall);
 }
 
-void ProgramCodeBlock::jitCompileImpl(JSGlobalData& globalData)
+bool ProgramCodeBlock::jitCompileImpl(JSGlobalData& globalData)
 {
     ASSERT(getJITType() == JITCode::InterpreterThunk);
     ASSERT(this == replacement());
     return static_cast<ProgramExecutable*>(ownerExecutable())->jitCompile(globalData);
 }
 
-void EvalCodeBlock::jitCompileImpl(JSGlobalData& globalData)
+bool EvalCodeBlock::jitCompileImpl(JSGlobalData& globalData)
 {
     ASSERT(getJITType() == JITCode::InterpreterThunk);
     ASSERT(this == replacement());
     return static_cast<EvalExecutable*>(ownerExecutable())->jitCompile(globalData);
 }
 
-void FunctionCodeBlock::jitCompileImpl(JSGlobalData& globalData)
+bool FunctionCodeBlock::jitCompileImpl(JSGlobalData& globalData)
 {
     ASSERT(getJITType() == JITCode::InterpreterThunk);
     ASSERT(this == replacement());
@@ -2467,7 +2473,38 @@ void CodeBlock::dumpValueProfiles()
 }
 #endif
 
-#ifndef NDEBUG
+size_t CodeBlock::predictedMachineCodeSize()
+{
+    // This will be called from CodeBlock::CodeBlock before either m_globalData or the
+    // instructions have been initialized. It's OK to return 0 because what will really
+    // matter is the recomputation of this value when the slow path is triggered.
+    if (!m_globalData)
+        return 0;
+    
+    if (!m_globalData->machineCodeBytesPerBytecodeWordForBaselineJIT)
+        return 0; // It's as good of a prediction as we'll get.
+    
+    // Be conservative: return a size that will be an overestimation 84% of the time.
+    double multiplier = m_globalData->machineCodeBytesPerBytecodeWordForBaselineJIT.mean() +
+        m_globalData->machineCodeBytesPerBytecodeWordForBaselineJIT.standardDeviation();
+    
+    // Be paranoid: silently reject bogus multipiers. Silently doing the "wrong" thing
+    // here is OK, since this whole method is just a heuristic.
+    if (multiplier < 0 || multiplier > 1000)
+        return 0;
+    
+    double doubleResult = multiplier * m_instructions.size();
+    
+    // Be even more paranoid: silently reject values that won't fit into a size_t. If
+    // the function is so huge that we can't even fit it into virtual memory then we
+    // should probably have some other guards in place to prevent us from even getting
+    // to this point.
+    if (doubleResult > std::numeric_limits<size_t>::max())
+        return 0;
+    
+    return static_cast<size_t>(doubleResult);
+}
+
 bool CodeBlock::usesOpcode(OpcodeID opcodeID)
 {
     Interpreter* interpreter = globalData()->interpreter;
@@ -2492,6 +2529,5 @@ bool CodeBlock::usesOpcode(OpcodeID opcodeID)
     
     return false;
 }
-#endif
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 195aa62ca..469028097 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -41,6 +41,7 @@
 #include "DFGOSREntry.h"
 #include "DFGOSRExit.h"
 #include "EvalCodeCache.h"
+#include "ExecutionCounter.h"
 #include "ExpressionRangeInfo.h"
 #include "GlobalResolveInfo.h"
 #include "HandlerInfo.h"
@@ -61,6 +62,7 @@
 #include "UString.h"
 #include "UnconditionalFinalizer.h"
 #include "ValueProfile.h"
+#include <wtf/RefCountedArray.h>
 #include <wtf/FastAllocBase.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
@@ -127,8 +129,6 @@ namespace JSC {
         }
 #endif
         
-        bool canProduceCopyWithBytecode() { return hasInstructions(); }
-
         void visitAggregate(SlotVisitor&);
 
         static void dumpStatistics();
@@ -341,20 +341,15 @@ namespace JSC {
         void setIsNumericCompareFunction(bool isNumericCompareFunction) { m_isNumericCompareFunction = isNumericCompareFunction; }
         bool isNumericCompareFunction() { return m_isNumericCompareFunction; }
 
-        bool hasInstructions() const { return !!m_instructions; }
-        unsigned numberOfInstructions() const { return !m_instructions ? 0 : m_instructions->m_instructions.size(); }
-        Vector<Instruction>& instructions() { return m_instructions->m_instructions; }
-        const Vector<Instruction>& instructions() const { return m_instructions->m_instructions; }
-        void discardBytecode() { m_instructions.clear(); }
-        void discardBytecodeLater()
-        {
-            m_shouldDiscardBytecode = true;
-        }
+        unsigned numberOfInstructions() const { return m_instructions.size(); }
+        RefCountedArray<Instruction>& instructions() { return m_instructions; }
+        const RefCountedArray<Instruction>& instructions() const { return m_instructions; }
+        
+        size_t predictedMachineCodeSize();
         
         bool usesOpcode(OpcodeID);
 
-        unsigned instructionCount() { return m_instructionCount; }
-        void setInstructionCount(unsigned instructionCount) { m_instructionCount = instructionCount; }
+        unsigned instructionCount() { return m_instructions.size(); }
 
 #if ENABLE(JIT)
         void setJITCode(const JITCode& code, MacroAssemblerCodePtr codeWithArityCheck)
@@ -374,18 +369,20 @@ namespace JSC {
         ExecutableMemoryHandle* executableMemory() { return getJITCode().getExecutableMemory(); }
         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*) = 0;
         virtual void jettison() = 0;
-        bool jitCompile(JSGlobalData& globalData)
+        enum JITCompilationResult { AlreadyCompiled, CouldNotCompile, CompiledSuccessfully };
+        JITCompilationResult jitCompile(JSGlobalData& globalData)
         {
             if (getJITType() != JITCode::InterpreterThunk) {
                 ASSERT(getJITType() == JITCode::BaselineJIT);
-                return false;
+                return AlreadyCompiled;
             }
 #if ENABLE(JIT)
-            jitCompileImpl(globalData);
-            return true;
+            if (jitCompileImpl(globalData))
+                return CompiledSuccessfully;
+            return CouldNotCompile;
 #else
             UNUSED_PARAM(globalData);
-            return false;
+            return CouldNotCompile;
 #endif
         }
         virtual CodeBlock* replacement() = 0;
@@ -541,11 +538,10 @@ namespace JSC {
         {
             ValueProfile* result = WTF::genericBinarySearch<ValueProfile, int, getValueProfileBytecodeOffset>(m_valueProfiles, m_valueProfiles.size(), bytecodeOffset);
             ASSERT(result->m_bytecodeOffset != -1);
-            ASSERT(!hasInstructions()
-                   || instructions()[bytecodeOffset + opcodeLength(
-                           m_globalData->interpreter->getOpcodeID(
-                               instructions()[
-                                   bytecodeOffset].u.opcode)) - 1].u.profile == result);
+            ASSERT(instructions()[bytecodeOffset + opcodeLength(
+                       m_globalData->interpreter->getOpcodeID(
+                           instructions()[
+                               bytecodeOffset].u.opcode)) - 1].u.profile == result);
             return result;
         }
         PredictedType valueProfilePredictionForBytecodeOffset(int bytecodeOffset)
@@ -839,24 +835,29 @@ namespace JSC {
         // Functions for controlling when JITting kicks in, in a mixed mode
         // execution world.
         
+        bool checkIfJITThresholdReached()
+        {
+            return m_llintExecuteCounter.checkIfThresholdCrossedAndSet(this);
+        }
+        
         void dontJITAnytimeSoon()
         {
-            m_llintExecuteCounter = Options::executionCounterValueForDontJITAnytimeSoon;
+            m_llintExecuteCounter.deferIndefinitely();
         }
         
         void jitAfterWarmUp()
         {
-            m_llintExecuteCounter = Options::executionCounterValueForJITAfterWarmUp;
+            m_llintExecuteCounter.setNewThreshold(Options::thresholdForJITAfterWarmUp, this);
         }
         
         void jitSoon()
         {
-            m_llintExecuteCounter = Options::executionCounterValueForJITSoon;
+            m_llintExecuteCounter.setNewThreshold(Options::thresholdForJITSoon, this);
         }
         
         int32_t llintExecuteCounter() const
         {
-            return m_llintExecuteCounter;
+            return m_llintExecuteCounter.m_counter;
         }
         
         // Functions for controlling when tiered compilation kicks in. This
@@ -895,31 +896,41 @@ namespace JSC {
         
         int32_t counterValueForOptimizeAfterWarmUp()
         {
-            return Options::executionCounterValueForOptimizeAfterWarmUp << reoptimizationRetryCounter();
+            return Options::thresholdForOptimizeAfterWarmUp << reoptimizationRetryCounter();
         }
         
         int32_t counterValueForOptimizeAfterLongWarmUp()
         {
-            return Options::executionCounterValueForOptimizeAfterLongWarmUp << reoptimizationRetryCounter();
+            return Options::thresholdForOptimizeAfterLongWarmUp << reoptimizationRetryCounter();
         }
         
         int32_t* addressOfJITExecuteCounter()
         {
-            return &m_jitExecuteCounter;
+            return &m_jitExecuteCounter.m_counter;
         }
         
-        static ptrdiff_t offsetOfJITExecuteCounter() { return OBJECT_OFFSETOF(CodeBlock, m_jitExecuteCounter); }
+        static ptrdiff_t offsetOfJITExecuteCounter() { return OBJECT_OFFSETOF(CodeBlock, m_jitExecuteCounter) + OBJECT_OFFSETOF(ExecutionCounter, m_counter); }
+        static ptrdiff_t offsetOfJITExecutionActiveThreshold() { return OBJECT_OFFSETOF(CodeBlock, m_jitExecuteCounter) + OBJECT_OFFSETOF(ExecutionCounter, m_activeThreshold); }
+        static ptrdiff_t offsetOfJITExecutionTotalCount() { return OBJECT_OFFSETOF(CodeBlock, m_jitExecuteCounter) + OBJECT_OFFSETOF(ExecutionCounter, m_totalCount); }
 
-        int32_t jitExecuteCounter() const { return m_jitExecuteCounter; }
+        int32_t jitExecuteCounter() const { return m_jitExecuteCounter.m_counter; }
         
         unsigned optimizationDelayCounter() const { return m_optimizationDelayCounter; }
         
+        // Check if the optimization threshold has been reached, and if not,
+        // adjust the heuristics accordingly. Returns true if the threshold has
+        // been reached.
+        bool checkIfOptimizationThresholdReached()
+        {
+            return m_jitExecuteCounter.checkIfThresholdCrossedAndSet(this);
+        }
+        
         // Call this to force the next optimization trigger to fire. This is
         // rarely wise, since optimization triggers are typically more
         // expensive than executing baseline code.
         void optimizeNextInvocation()
         {
-            m_jitExecuteCounter = Options::executionCounterValueForOptimizeNextInvocation;
+            m_jitExecuteCounter.setNewThreshold(0, this);
         }
         
         // Call this to prevent optimization from happening again. Note that
@@ -929,7 +940,7 @@ namespace JSC {
         // the future as well.
         void dontOptimizeAnytimeSoon()
         {
-            m_jitExecuteCounter = Options::executionCounterValueForDontOptimizeAnytimeSoon;
+            m_jitExecuteCounter.deferIndefinitely();
         }
         
         // Call this to reinitialize the counter to its starting state,
@@ -940,14 +951,14 @@ namespace JSC {
         // counter that this corresponds to is also available directly.
         void optimizeAfterWarmUp()
         {
-            m_jitExecuteCounter = counterValueForOptimizeAfterWarmUp();
+            m_jitExecuteCounter.setNewThreshold(counterValueForOptimizeAfterWarmUp(), this);
         }
         
         // Call this to force an optimization trigger to fire only after
         // a lot of warm-up.
         void optimizeAfterLongWarmUp()
         {
-            m_jitExecuteCounter = counterValueForOptimizeAfterLongWarmUp();
+            m_jitExecuteCounter.setNewThreshold(counterValueForOptimizeAfterLongWarmUp(), this);
         }
         
         // Call this to cause an optimization trigger to fire soon, but
@@ -970,7 +981,7 @@ namespace JSC {
         // in the baseline code.
         void optimizeSoon()
         {
-            m_jitExecuteCounter = Options::executionCounterValueForOptimizeSoon << reoptimizationRetryCounter();
+            m_jitExecuteCounter.setNewThreshold(Options::thresholdForOptimizeSoon << reoptimizationRetryCounter(), this);
         }
         
         // The speculative JIT tracks its success rate, so that we can
@@ -1047,12 +1058,9 @@ namespace JSC {
         int m_numCapturedVars;
         bool m_isConstructor;
 
-        // This is public because otherwise we would have many friends.
-        bool m_shouldDiscardBytecode;
-
     protected:
 #if ENABLE(JIT)
-        virtual void jitCompileImpl(JSGlobalData&) = 0;
+        virtual bool jitCompileImpl(JSGlobalData&) = 0;
 #endif
         virtual void visitWeakReferences(SlotVisitor&);
         virtual void finalizeUnconditionally();
@@ -1115,11 +1123,7 @@ namespace JSC {
         WriteBarrier<ScriptExecutable> m_ownerExecutable;
         JSGlobalData* m_globalData;
 
-        struct Instructions : public RefCounted<Instructions> {
-            Vector<Instruction> m_instructions;
-        };
-        RefPtr<Instructions> m_instructions;
-        unsigned m_instructionCount;
+        RefCountedArray<Instruction> m_instructions;
 
         int m_thisRegister;
         int m_argumentsRegister;
@@ -1186,6 +1190,7 @@ namespace JSC {
             bool isJettisoned;
             bool livenessHasBeenProved; // Initialized and used on every GC.
             bool allTransitionsHaveBeenMarked; // Initialized and used on every GC.
+            unsigned visitAggregateHasBeenCalled; // Unsigned to make it work seamlessly with the broadest set of CAS implementations.
         };
         
         OwnPtr<DFGData> m_dfgData;
@@ -1217,13 +1222,14 @@ namespace JSC {
 
         OwnPtr<CodeBlock> m_alternative;
         
-        int32_t m_llintExecuteCounter;
+        ExecutionCounter m_llintExecuteCounter;
         
-        int32_t m_jitExecuteCounter;
+        ExecutionCounter m_jitExecuteCounter;
+        int32_t m_totalJITExecutions;
         uint32_t m_speculativeSuccessCounter;
         uint32_t m_speculativeFailCounter;
-        uint8_t m_optimizationDelayCounter;
-        uint8_t m_reoptimizationRetryCounter;
+        uint16_t m_optimizationDelayCounter;
+        uint16_t m_reoptimizationRetryCounter;
         
         struct RareData {
            WTF_MAKE_FAST_ALLOCATED;
@@ -1300,7 +1306,7 @@ namespace JSC {
     protected:
         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*);
         virtual void jettison();
-        virtual void jitCompileImpl(JSGlobalData&);
+        virtual bool jitCompileImpl(JSGlobalData&);
         virtual CodeBlock* replacement();
         virtual bool canCompileWithDFGInternal();
 #endif
@@ -1335,7 +1341,7 @@ namespace JSC {
     protected:
         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*);
         virtual void jettison();
-        virtual void jitCompileImpl(JSGlobalData&);
+        virtual bool jitCompileImpl(JSGlobalData&);
         virtual CodeBlock* replacement();
         virtual bool canCompileWithDFGInternal();
 #endif
@@ -1373,33 +1379,12 @@ namespace JSC {
     protected:
         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*);
         virtual void jettison();
-        virtual void jitCompileImpl(JSGlobalData&);
+        virtual bool jitCompileImpl(JSGlobalData&);
         virtual CodeBlock* replacement();
         virtual bool canCompileWithDFGInternal();
 #endif
     };
 
-    // Use this if you want to copy a code block and you're paranoid about a GC
-    // happening.
-    class BytecodeDestructionBlocker {
-    public:
-        BytecodeDestructionBlocker(CodeBlock* codeBlock)
-            : m_codeBlock(codeBlock)
-            , m_oldValueOfShouldDiscardBytecode(codeBlock->m_shouldDiscardBytecode)
-        {
-            codeBlock->m_shouldDiscardBytecode = false;
-        }
-        
-        ~BytecodeDestructionBlocker()
-        {
-            m_codeBlock->m_shouldDiscardBytecode = m_oldValueOfShouldDiscardBytecode;
-        }
-        
-    private:
-        CodeBlock* m_codeBlock;
-        bool m_oldValueOfShouldDiscardBytecode;
-    };
-
     inline CodeBlock* baselineCodeBlockForOriginAndBaselineCodeBlock(const CodeOrigin& codeOrigin, CodeBlock* baselineCodeBlock)
     {
         if (codeOrigin.inlineCallFrame) {
diff --git a/Source/JavaScriptCore/bytecode/CodeType.h b/Source/JavaScriptCore/bytecode/CodeType.h
index 03485e564..d33677ae7 100644
--- a/Source/JavaScriptCore/bytecode/CodeType.h
+++ b/Source/JavaScriptCore/bytecode/CodeType.h
@@ -26,11 +26,28 @@
 #ifndef CodeType_h
 #define CodeType_h
 
+#include <wtf/Platform.h>
+
 namespace JSC {
 
 enum CodeType { GlobalCode, EvalCode, FunctionCode };
 
+inline const char* codeTypeToString(CodeType codeType)
+{
+    switch (codeType) {
+    case GlobalCode:
+        return "GlobalCode";
+    case EvalCode:
+        return "EvalCode";
+    case FunctionCode:
+        return "FunctionCode";
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
 }
 
+} // namespace JSC
+
 #endif // CodeType_h
 
diff --git a/Source/JavaScriptCore/bytecode/ExecutionCounter.cpp b/Source/JavaScriptCore/bytecode/ExecutionCounter.cpp
new file mode 100644
index 000000000..b3fd3ef26
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/ExecutionCounter.cpp
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ExecutionCounter.h"
+
+#include "CodeBlock.h"
+#include "ExecutableAllocator.h"
+#include <wtf/DataLog.h>
+
+namespace JSC {
+
+ExecutionCounter::ExecutionCounter()
+{
+    reset();
+}
+
+bool ExecutionCounter::checkIfThresholdCrossedAndSet(CodeBlock* codeBlock)
+{
+    if (hasCrossedThreshold(codeBlock))
+        return true;
+    
+    if (setThreshold(codeBlock))
+        return true;
+    
+    return false;
+}
+
+void ExecutionCounter::setNewThreshold(int32_t threshold, CodeBlock* codeBlock)
+{
+    reset();
+    m_activeThreshold = threshold;
+    setThreshold(codeBlock);
+}
+
+void ExecutionCounter::deferIndefinitely()
+{
+    m_totalCount = 0;
+    m_activeThreshold = std::numeric_limits<int32_t>::max();
+    m_counter = std::numeric_limits<int32_t>::min();
+}
+
+double ExecutionCounter::applyMemoryUsageHeuristics(int32_t value, CodeBlock* codeBlock)
+{
+#if ENABLE(JIT)
+    double multiplier =
+        ExecutableAllocator::memoryPressureMultiplier(
+            codeBlock->predictedMachineCodeSize());
+#else
+    // This code path will probably not be taken, but if it is, we fake it.
+    double multiplier = 1.0;
+    UNUSED_PARAM(codeBlock);
+#endif
+    ASSERT(multiplier >= 1.0);
+    return multiplier * value;
+}
+
+int32_t ExecutionCounter::applyMemoryUsageHeuristicsAndConvertToInt(
+    int32_t value, CodeBlock* codeBlock)
+{
+    double doubleResult = applyMemoryUsageHeuristics(value, codeBlock);
+    
+    ASSERT(doubleResult >= 0);
+    
+    if (doubleResult > std::numeric_limits<int32_t>::max())
+        return std::numeric_limits<int32_t>::max();
+    
+    return static_cast<int32_t>(doubleResult);
+}
+
+bool ExecutionCounter::hasCrossedThreshold(CodeBlock* codeBlock) const
+{
+    // This checks if the current count rounded up to the threshold we were targeting.
+    // For example, if we are using half of available executable memory and have
+    // m_activeThreshold = 1000, applyMemoryUsageHeuristics(m_activeThreshold) will be
+    // 2000, but we will pretend as if the threshold was crossed if we reach 2000 -
+    // 1000 / 2, or 1500. The reasoning here is that we want to avoid thrashing. If
+    // this method returns false, then the JIT's threshold for when it will again call
+    // into the slow path (which will call this method a second time) will be set
+    // according to the difference between the current count and the target count
+    // according to *current* memory usage. But by the time we call into this again, we
+    // may have JIT'ed more code, and so the target count will increase slightly. This
+    // may lead to a repeating pattern where the target count is slightly incremented,
+    // the JIT immediately matches that increase, calls into the slow path again, and
+    // again the target count is slightly incremented. Instead of having this vicious
+    // cycle, we declare victory a bit early if the difference between the current
+    // total and our target according to memory heuristics is small. Our definition of
+    // small is arbitrarily picked to be half of the original threshold (i.e.
+    // m_activeThreshold).
+    
+    double modifiedThreshold = applyMemoryUsageHeuristics(m_activeThreshold, codeBlock);
+    
+    return static_cast<double>(m_totalCount) + m_counter >=
+         modifiedThreshold - static_cast<double>(m_activeThreshold) / 2;
+}
+
+bool ExecutionCounter::setThreshold(CodeBlock* codeBlock)
+{
+    if (m_activeThreshold == std::numeric_limits<int32_t>::max()) {
+        deferIndefinitely();
+        return false;
+    }
+        
+    ASSERT(!hasCrossedThreshold(codeBlock));
+        
+    // Compute the true total count.
+    double trueTotalCount = static_cast<double>(m_totalCount) + m_counter;
+        
+    // Correct the threshold for current memory usage.
+    double threshold = applyMemoryUsageHeuristics(m_activeThreshold, codeBlock);
+        
+    // Threshold must be non-negative and not NaN.
+    ASSERT(threshold >= 0);
+        
+    // Adjust the threshold according to the number of executions we have already
+    // seen. This shouldn't go negative, but it might, because of round-off errors.
+    threshold -= trueTotalCount;
+        
+    if (threshold <= 0) {
+        m_counter = 0;
+        m_totalCount = trueTotalCount;
+        return true;
+    }
+
+    if (threshold > std::numeric_limits<int32_t>::max())
+        threshold = std::numeric_limits<int32_t>::max();
+        
+    m_counter = static_cast<int32_t>(-threshold);
+        
+    m_totalCount = trueTotalCount + threshold;
+        
+    return false;
+}
+
+void ExecutionCounter::reset()
+{
+    m_counter = 0;
+    m_totalCount = 0;
+    m_activeThreshold = 0;
+}
+
+} // namespace JSC
+
diff --git a/Source/JavaScriptCore/bytecode/ExecutionCounter.h b/Source/JavaScriptCore/bytecode/ExecutionCounter.h
new file mode 100644
index 000000000..d2ffbb649
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/ExecutionCounter.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ExecutionCounter_h
+#define ExecutionCounter_h
+
+#include <wtf/SimpleStats.h>
+
+namespace JSC {
+
+class CodeBlock;
+
+class ExecutionCounter {
+public:
+    ExecutionCounter();
+    bool checkIfThresholdCrossedAndSet(CodeBlock*);
+    void setNewThreshold(int32_t threshold, CodeBlock*);
+    void deferIndefinitely();
+    static double applyMemoryUsageHeuristics(int32_t value, CodeBlock*);
+    static int32_t applyMemoryUsageHeuristicsAndConvertToInt(int32_t value, CodeBlock*);
+
+    static int32_t formattedTotalCount(float value)
+    {
+        union {
+            int32_t i;
+            float f;
+        } u;
+        u.f = value;
+        return u.i;
+    }
+    
+private:
+    bool hasCrossedThreshold(CodeBlock*) const;
+    bool setThreshold(CodeBlock*);
+    void reset();
+
+public:
+
+    // NB. These are intentionally public because it will be modified from machine code.
+    
+    // This counter is incremented by the JIT or LLInt. It starts out negative and is
+    // counted up until it becomes non-negative. At the start of a counting period,
+    // the threshold we wish to reach is m_totalCount + m_counter, in the sense that
+    // we will add X to m_totalCount and subtract X from m_counter.
+    int32_t m_counter;
+
+    // Counts the total number of executions we have seen plus the ones we've set a
+    // threshold for in m_counter. Because m_counter's threshold is negative, the
+    // total number of actual executions can always be computed as m_totalCount +
+    // m_counter.
+    float m_totalCount;
+
+    // This is the threshold we were originally targetting, without any correction for
+    // the memory usage heuristics.
+    int32_t m_activeThreshold;
+};
+
+} // namespace JSC
+
+#endif // ExecutionCounter_h
+
diff --git a/Source/JavaScriptCore/bytecode/Opcode.h b/Source/JavaScriptCore/bytecode/Opcode.h
index a47fa5e9b..45598f899 100644
--- a/Source/JavaScriptCore/bytecode/Opcode.h
+++ b/Source/JavaScriptCore/bytecode/Opcode.h
@@ -82,7 +82,6 @@ namespace JSC {
         macro(op_bitand, 5) \
         macro(op_bitxor, 5) \
         macro(op_bitor, 5) \
-        macro(op_bitnot, 3) \
         \
         macro(op_check_has_instance, 2) \
         macro(op_instanceof, 5) \
diff --git a/Source/JavaScriptCore/bytecode/PredictedType.cpp b/Source/JavaScriptCore/bytecode/PredictedType.cpp
index 2b490c24e..b04ff1f57 100644
--- a/Source/JavaScriptCore/bytecode/PredictedType.cpp
+++ b/Source/JavaScriptCore/bytecode/PredictedType.cpp
@@ -153,8 +153,13 @@ const char* predictionToString(PredictedType value)
     else
         isTop = false;
     
-    if (isTop)
-        return "Top";
+    if (isTop) {
+        ptr = description;
+        ptr.strcat("Top");
+    }
+    
+    if (value & PredictEmpty)
+        ptr.strcat("Empty");
     
     *ptr++ = 0;
     
@@ -221,6 +226,8 @@ PredictedType predictionFromCell(JSCell* cell)
 
 PredictedType predictionFromValue(JSValue value)
 {
+    if (value.isEmpty())
+        return PredictEmpty;
     if (value.isInt32())
         return PredictInt32;
     if (value.isDouble()) {
diff --git a/Source/JavaScriptCore/bytecode/PredictedType.h b/Source/JavaScriptCore/bytecode/PredictedType.h
index efbe9b30d..0b7916610 100644
--- a/Source/JavaScriptCore/bytecode/PredictedType.h
+++ b/Source/JavaScriptCore/bytecode/PredictedType.h
@@ -61,8 +61,10 @@ static const PredictedType PredictDoubleNaN         = 0x00040000; // It's defini
 static const PredictedType PredictDouble            = 0x00060000; // It's either a non-NaN or a NaN double.
 static const PredictedType PredictNumber            = 0x00070000; // It's either an Int32 or a Double.
 static const PredictedType PredictBoolean           = 0x00080000; // It's definitely a Boolean.
-static const PredictedType PredictOther             = 0x40000000; // It's definitely none of the above.
-static const PredictedType PredictTop               = 0x7fffffff; // It can be any of the above.
+static const PredictedType PredictOther             = 0x08000000; // It's definitely none of the above.
+static const PredictedType PredictTop               = 0x0fffffff; // It can be any of the above.
+static const PredictedType PredictEmpty             = 0x10000000; // It's definitely an empty value marker.
+static const PredictedType PredictEmptyOrTop        = 0x1fffffff; // It can be any of the above.
 static const PredictedType FixedIndexedStorageMask = PredictByteArray | PredictInt8Array | PredictInt16Array | PredictInt32Array | PredictUint8Array | PredictUint8ClampedArray | PredictUint16Array | PredictUint32Array | PredictFloat32Array | PredictFloat64Array;
 
 typedef bool (*PredictionChecker)(PredictedType);
@@ -89,7 +91,7 @@ inline bool isFinalObjectOrOtherPrediction(PredictedType value)
 
 inline bool isFixedIndexedStorageObjectPrediction(PredictedType value)
 {
-    return (value & FixedIndexedStorageMask) == value;
+    return !!value && (value & FixedIndexedStorageMask) == value;
 }
 
 inline bool isStringPrediction(PredictedType value)
@@ -199,7 +201,7 @@ inline bool isDoubleRealPrediction(PredictedType value)
 
 inline bool isDoublePrediction(PredictedType value)
 {
-    return (value & PredictDouble) == value;
+    return !!value && (value & PredictDouble) == value;
 }
 
 inline bool isNumberPrediction(PredictedType value)
@@ -217,6 +219,11 @@ inline bool isOtherPrediction(PredictedType value)
     return value == PredictOther;
 }
 
+inline bool isEmptyPrediction(PredictedType value)
+{
+    return value == PredictEmpty;
+}
+
 const char* predictionToString(PredictedType value);
 
 // Merge two predictions. Note that currently this just does left | right. It may
diff --git a/Source/JavaScriptCore/bytecode/SamplingTool.cpp b/Source/JavaScriptCore/bytecode/SamplingTool.cpp
index 077f041f4..f07dc79fb 100644
--- a/Source/JavaScriptCore/bytecode/SamplingTool.cpp
+++ b/Source/JavaScriptCore/bytecode/SamplingTool.cpp
@@ -100,7 +100,7 @@ SamplingRegion::Locker::Locker()
 #endif
             continue;
         }
-        if (WTF::weakCompareAndSwap(&s_currentOrReserved, previous, previous | 1))
+        if (WTF::weakCompareAndSwapUIntPtr(&s_currentOrReserved, previous, previous | 1))
             break;
     }
 }
@@ -113,7 +113,7 @@ SamplingRegion::Locker::~Locker()
     uintptr_t previous;
     do {
         previous = s_currentOrReserved;
-    } while (!WTF::weakCompareAndSwap(&s_currentOrReserved, previous, previous & ~1));
+    } while (!WTF::weakCompareAndSwapUIntPtr(&s_currentOrReserved, previous, previous & ~1));
 }
 
 void SamplingRegion::sample()
diff --git a/Source/JavaScriptCore/bytecode/SamplingTool.h b/Source/JavaScriptCore/bytecode/SamplingTool.h
index 28fd528d0..fcb1986fd 100644
--- a/Source/JavaScriptCore/bytecode/SamplingTool.h
+++ b/Source/JavaScriptCore/bytecode/SamplingTool.h
@@ -148,7 +148,7 @@ namespace JSC {
                 if (previousPtr)
                     *previousPtr = bitwise_cast<SamplingRegion*>(previous);
                 
-                if (WTF::weakCompareAndSwap(&s_currentOrReserved, previous, bitwise_cast<uintptr_t>(current)))
+                if (WTF::weakCompareAndSwapUIntPtr(&s_currentOrReserved, previous, bitwise_cast<uintptr_t>(current)))
                     break;
             }
         }
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 6fa0ce96b..4a6f4653e 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -119,6 +119,15 @@ namespace JSC {
     expected by the callee.
 */
 
+void Label::setLocation(unsigned location)
+{
+    m_location = location;
+    
+    unsigned size = m_unresolvedJumps.size();
+    for (unsigned i = 0; i < size; ++i)
+        m_generator->m_instructions[m_unresolvedJumps[i].second].u.operand = m_location - m_unresolvedJumps[i].first;
+}
+
 #ifndef NDEBUG
 void ResolveResult::checkValidity()
 {
@@ -171,8 +180,8 @@ JSObject* BytecodeGenerator::generate()
     m_codeBlock->setThisRegister(m_thisRegister.index());
 
     m_scopeNode->emitBytecode(*this);
-
-    m_codeBlock->setInstructionCount(m_codeBlock->instructions().size());
+    
+    m_codeBlock->instructions() = RefCountedArray<Instruction>(m_instructions);
 
     if (s_dumpsGeneratedCode)
         m_codeBlock->dump(m_scopeChain->globalObject->globalExec());
@@ -607,7 +616,7 @@ PassRefPtr<Label> BytecodeGenerator::newLabel()
         m_labels.removeLast();
 
     // Allocate new label ID.
-    m_labels.append(m_codeBlock);
+    m_labels.append(this);
     return &m_labels.last();
 }
 
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index d61b42b76..e7fe236e5 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -32,7 +32,7 @@
 #define BytecodeGenerator_h
 
 #include "CodeBlock.h"
-#include "HashTraits.h"
+#include <wtf/HashTraits.h>
 #include "Instruction.h"
 #include "Label.h"
 #include "LabelScope.h"
@@ -48,6 +48,7 @@
 namespace JSC {
 
     class Identifier;
+    class Label;
     class ScopeChainNode;
 
     class CallArguments {
@@ -532,6 +533,8 @@ namespace JSC {
         ScopeChainNode* scopeChain() const { return m_scopeChain.get(); }
 
     private:
+        friend class Label;
+        
         void emitOpcode(OpcodeID);
         ValueProfile* emitProfiledOpcode(OpcodeID);
         void retrieveLastBinaryOp(int& dstIndex, int& src1Index, int& src2Index);
@@ -611,7 +614,7 @@ namespace JSC {
 
         RegisterID* emitInitLazyRegister(RegisterID*);
 
-        Vector<Instruction>& instructions() { return m_codeBlock->instructions(); }
+        Vector<Instruction>& instructions() { return m_instructions; }
         SymbolTable& symbolTable() { return *m_symbolTable; }
 
         bool shouldOptimizeLocals()
@@ -644,6 +647,8 @@ namespace JSC {
         void createArgumentsIfNecessary();
         void createActivationIfNecessary();
         RegisterID* createLazyRegisterIfNecessary(RegisterID*);
+        
+        Vector<Instruction> m_instructions;
 
         bool m_shouldEmitDebugHooks;
         bool m_shouldEmitProfileHooks;
diff --git a/Source/JavaScriptCore/bytecompiler/Label.h b/Source/JavaScriptCore/bytecompiler/Label.h
index 8cab1dbc0..21fa46309 100644
--- a/Source/JavaScriptCore/bytecompiler/Label.h
+++ b/Source/JavaScriptCore/bytecompiler/Label.h
@@ -39,21 +39,14 @@ namespace JSC {
 
     class Label {
     public:
-        explicit Label(CodeBlock* codeBlock)
+        explicit Label(BytecodeGenerator* generator)
             : m_refCount(0)
             , m_location(invalidLocation)
-            , m_codeBlock(codeBlock)
+            , m_generator(generator)
         {
         }
 
-        void setLocation(unsigned location)
-        {
-            m_location = location;
-
-            unsigned size = m_unresolvedJumps.size();
-            for (unsigned i = 0; i < size; ++i)
-                m_codeBlock->instructions()[m_unresolvedJumps[i].second].u.operand = m_location - m_unresolvedJumps[i].first;
-        }
+        void setLocation(unsigned);
 
         int bind(int opcode, int offset) const
         {
@@ -81,7 +74,7 @@ namespace JSC {
 
         int m_refCount;
         unsigned m_location;
-        CodeBlock* m_codeBlock;
+        BytecodeGenerator* m_generator;
         mutable JumpVector m_unresolvedJumps;
     };
 
diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index 2d4181912..bb95cafb6 100644
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -871,7 +871,15 @@ RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
     return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
 }
 
-
+// ------------------------------ BitwiseNotNode -----------------------------------
+ 
+RegisterID* BitwiseNotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src2 = generator.emitLoad(generator.newTemporary(), jsNumber(-1));
+    RegisterID* src1 = generator.emitNode(m_expr);
+    return generator.emitBinaryOp(op_bitxor, generator.finalDestination(dst, src1), src1, src2.get(), OperandTypes(m_expr->resultDescriptor(), ResultType::numberTypeIsInt32()));
+}
+ 
 // ------------------------------ LogicalNotNode -----------------------------------
 
 void LogicalNotNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
@@ -2009,8 +2017,8 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
 inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    if (m_data->m_statements)
-        m_data->m_statements->emitBytecode(generator, dst);
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
 }
 
 // ------------------------------ ProgramNode -----------------------------
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index ee0cc9ab7..7ab05f329 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -54,13 +54,7 @@ AbstractState::AbstractState(Graph& graph)
     , m_variables(m_codeBlock->numParameters(), graph.m_localVars)
     , m_block(0)
 {
-    size_t maxBlockSize = 0;
-    for (size_t i = 0; i < graph.m_blocks.size(); ++i) {
-        BasicBlock* block = graph.m_blocks[i].get();
-        if (block->end - block->begin > maxBlockSize)
-            maxBlockSize = block->end - block->begin;
-    }
-    m_nodes.resize(maxBlockSize);
+    m_nodes.resize(graph.size());
 }
 
 AbstractState::~AbstractState() { }
@@ -75,8 +69,9 @@ void AbstractState::beginBasicBlock(BasicBlock* basicBlock)
     ASSERT(basicBlock->variablesAtTail.numberOfLocals() == basicBlock->valuesAtTail.numberOfLocals());
     ASSERT(basicBlock->variablesAtHead.numberOfLocals() == basicBlock->variablesAtTail.numberOfLocals());
     
-    for (size_t i = 0; i < basicBlock->end - basicBlock->begin; ++i)
-        m_nodes[i].clear();
+    for (size_t i = 0; i < basicBlock->size(); i++)
+        m_nodes[basicBlock->at(i)].clear();
+
     m_variables = basicBlock->valuesAtHead;
     m_haveStructures = false;
     for (size_t i = 0; i < m_variables.numberOfArguments(); ++i) {
@@ -113,6 +108,11 @@ void AbstractState::initialize(Graph& graph)
             continue;
         }
         
+        if (graph.argumentIsCaptured(i)) {
+            root->valuesAtHead.argument(i).makeTop();
+            continue;
+        }
+        
         PredictedType prediction = node.variableAccessData()->prediction();
         if (isInt32Prediction(prediction))
             root->valuesAtHead.argument(i).set(PredictInt32);
@@ -143,6 +143,11 @@ void AbstractState::initialize(Graph& graph)
         else
             root->valuesAtHead.argument(i).makeTop();
     }
+    for (size_t i = 0; i < root->valuesAtHead.numberOfLocals(); ++i) {
+        if (!graph.localIsCaptured(i))
+            continue;
+        root->valuesAtHead.local(i).makeTop();
+    }
 }
 
 bool AbstractState::endBasicBlock(MergeMode mergeMode)
@@ -164,14 +169,28 @@ bool AbstractState::endBasicBlock(MergeMode mergeMode)
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
             dataLog("        Merging state for argument %zu.\n", argument);
 #endif
-            changed |= mergeStateAtTail(block->valuesAtTail.argument(argument), m_variables.argument(argument), block->variablesAtTail.argument(argument));
+            AbstractValue& destination = block->valuesAtTail.argument(argument);
+            if (m_graph.argumentIsCaptured(argument)) {
+                if (!destination.isTop()) {
+                    destination.makeTop();
+                    changed = true;
+                }
+            } else
+                changed |= mergeStateAtTail(destination, m_variables.argument(argument), block->variablesAtTail.argument(argument));
         }
         
         for (size_t local = 0; local < block->variablesAtTail.numberOfLocals(); ++local) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
             dataLog("        Merging state for local %zu.\n", local);
 #endif
-            changed |= mergeStateAtTail(block->valuesAtTail.local(local), m_variables.local(local), block->variablesAtTail.local(local));
+            AbstractValue& destination = block->valuesAtTail.local(local);
+            if (m_graph.localIsCaptured(local)) {
+                if (!destination.isTop()) {
+                    destination.makeTop();
+                    changed = true;
+                }
+            } else
+                changed |= mergeStateAtTail(destination, m_variables.local(local), block->variablesAtTail.local(local));
         }
     }
     
@@ -191,12 +210,13 @@ void AbstractState::reset()
     m_isValid = false;
 }
 
-bool AbstractState::execute(NodeIndex nodeIndex)
+bool AbstractState::execute(unsigned indexInBlock)
 {
     PROFILE(FLAG_FOR_EXECUTION);
     ASSERT(m_block);
     ASSERT(m_isValid);
         
+    NodeIndex nodeIndex = m_block->at(indexInBlock);
     Node& node = m_graph[nodeIndex];
         
     if (!node.shouldGenerate())
@@ -216,11 +236,17 @@ bool AbstractState::execute(NodeIndex nodeIndex)
     }
             
     case GetLocal: {
-        forNode(nodeIndex) = m_variables.operand(node.local());
+        if (m_graph.isCaptured(node.local()))
+            forNode(nodeIndex).makeTop();
+        else
+            forNode(nodeIndex) = m_variables.operand(node.local());
         break;
     }
         
     case SetLocal: {
+        if (m_graph.isCaptured(node.local()))
+            break;
+        
         if (node.variableAccessData()->shouldUseDoubleFormat()) {
             forNode(node.child1()).filter(PredictNumber);
             m_variables.operand(node.local()).set(PredictDouble);
@@ -265,12 +291,12 @@ bool AbstractState::execute(NodeIndex nodeIndex)
         break;
             
     case ValueToInt32:
-        if (!m_graph[node.child1()].shouldNotSpeculateInteger()) {
+        if (m_graph[node.child1()].shouldNotSpeculateInteger()) {
             if (m_graph[node.child1()].shouldSpeculateDouble())
                 forNode(node.child1()).filter(PredictNumber);
-            else
-                forNode(node.child1()).filter(PredictInt32);
-        }
+        } else
+            forNode(node.child1()).filter(PredictInt32);
+        
         forNode(nodeIndex).set(PredictInt32);
         break;
             
@@ -289,7 +315,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
             break;
         }
         if (node.op == ValueAdd) {
-            clobberStructures(nodeIndex);
+            clobberStructures(indexInBlock);
             forNode(nodeIndex).set(PredictString | PredictInt32 | PredictNumber);
             break;
         }
@@ -311,6 +337,17 @@ bool AbstractState::execute(NodeIndex nodeIndex)
         break;
     }
         
+    case ArithNegate: {
+        if (m_graph.negateShouldSpeculateInteger(node)) {
+            forNode(node.child1()).filter(PredictInt32);
+            forNode(nodeIndex).set(PredictInt32);
+            break;
+        }
+        forNode(node.child1()).filter(PredictNumber);
+        forNode(nodeIndex).set(PredictDouble);
+        break;
+    }
+        
     case ArithMul:
     case ArithDiv:
     case ArithMin:
@@ -368,7 +405,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
         else if (child.shouldSpeculateNumber())
             forNode(node.child1()).filter(PredictNumber);
         else
-            clobberStructures(nodeIndex);
+            clobberStructures(indexInBlock);
         forNode(nodeIndex).set(PredictBoolean);
         break;
     }
@@ -391,7 +428,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
             filter = PredictArray;
         else {
             filter = PredictTop;
-            clobberStructures(nodeIndex);
+            clobberStructures(indexInBlock);
         }
         forNode(node.child1()).filter(filter);
         forNode(node.child2()).filter(filter);
@@ -421,7 +458,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
             break;
         }
         if (!isActionableArrayPrediction(m_graph[node.child1()].prediction()) || !m_graph[node.child2()].shouldSpeculateInteger()) {
-            clobberStructures(nodeIndex);
+            clobberStructures(indexInBlock);
             forNode(nodeIndex).makeTop();
             break;
         }
@@ -507,7 +544,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
         }
         if (!m_graph[node.child2()].shouldSpeculateInteger() || !isActionableMutableArrayPrediction(m_graph[node.child1()].prediction())) {
             ASSERT(node.op == PutByVal);
-            clobberStructures(nodeIndex);
+            clobberStructures(indexInBlock);
             forNode(nodeIndex).makeTop();
             break;
         }
@@ -693,10 +730,25 @@ bool AbstractState::execute(NodeIndex nodeIndex)
     }
             
     case NewObject:
-        forNode(nodeIndex).set(m_codeBlock->globalObject()->emptyObjectStructure());
+        forNode(nodeIndex).set(m_codeBlock->globalObjectFor(node.codeOrigin)->emptyObjectStructure());
         m_haveStructures = true;
         break;
-            
+        
+    case CreateActivation:
+        forNode(nodeIndex).set(m_graph.m_globalData.activationStructure.get());
+        m_haveStructures = true;
+        break;
+        
+    case TearOffActivation:
+        // Does nothing that is user-visible.
+        break;
+        
+    case NewFunction:
+    case NewFunctionExpression:
+    case NewFunctionNoCheck:
+        forNode(nodeIndex).set(m_codeBlock->globalObjectFor(node.codeOrigin)->functionStructure());
+        break;
+        
     case GetCallee:
         forNode(nodeIndex).set(PredictFunction);
         break;
@@ -710,7 +762,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
         break;
             
     case PutScopedVar:
-        clobberStructures(nodeIndex);
+        clobberStructures(indexInBlock);
         break;
             
     case GetById:
@@ -721,7 +773,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
         }
         if (isCellPrediction(m_graph[node.child1()].prediction()))
             forNode(node.child1()).filter(PredictCell);
-        clobberStructures(nodeIndex);
+        clobberStructures(indexInBlock);
         forNode(nodeIndex).makeTop();
         break;
             
@@ -783,7 +835,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
         break;
             
     case PutStructure:
-        clobberStructures(nodeIndex);
+        clobberStructures(indexInBlock);
         forNode(node.child1()).set(node.structureTransitionData().newStructure);
         m_haveStructures = true;
         break;
@@ -874,7 +926,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
     case PutById:
     case PutByIdDirect:
         forNode(node.child1()).filter(PredictCell);
-        clobberStructures(nodeIndex);
+        clobberStructures(indexInBlock);
         break;
             
     case GetGlobalVar:
@@ -910,7 +962,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
     case ResolveBase:
     case ResolveBaseStrictPut:
     case ResolveGlobal:
-        clobberStructures(nodeIndex);
+        clobberStructures(indexInBlock);
         forNode(nodeIndex).makeTop();
         break;
             
@@ -927,13 +979,13 @@ bool AbstractState::execute(NodeIndex nodeIndex)
     return m_isValid;
 }
 
-inline void AbstractState::clobberStructures(NodeIndex nodeIndex)
+inline void AbstractState::clobberStructures(unsigned indexInBlock)
 {
     PROFILE(FLAG_FOR_STRUCTURE_CLOBBERING);
     if (!m_haveStructures)
         return;
-    for (size_t i = nodeIndex - m_block->begin + 1; i-- > 0;)
-        m_nodes[i].clobberStructures();
+    for (size_t i = indexInBlock + 1; i--;)
+        forNode(m_block->at(i)).clobberStructures();
     for (size_t i = 0; i < m_variables.numberOfArguments(); ++i)
         m_variables.argument(i).clobberStructures();
     for (size_t i = 0; i < m_variables.numberOfLocals(); ++i)
@@ -946,7 +998,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
     if (nodeIndex == NoNode)
         return false;
         
-    AbstractValue* source;
+    AbstractValue source;
         
     Node& node = m_graph[nodeIndex];
     if (!node.refCount())
@@ -961,7 +1013,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
     case SetArgument:
     case Flush:
         // The block transfers the value from head to tail.
-        source = &inVariable;
+        source = inVariable;
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
         dataLog("          Transfering from head to tail.\n");
 #endif
@@ -969,7 +1021,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
             
     case GetLocal:
         // The block refines the value with additional speculations.
-        source = &forNode(nodeIndex);
+        source = forNode(nodeIndex);
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
         dataLog("          Refining.\n");
 #endif
@@ -978,7 +1030,10 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
     case SetLocal:
         // The block sets the variable, and potentially refines it, both
         // before and after setting it.
-        source = &forNode(node.child1());
+        if (node.variableAccessData()->shouldUseDoubleFormat())
+            source.set(PredictDouble);
+        else
+            source = forNode(node.child1());
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
         dataLog("          Setting.\n");
 #endif
@@ -986,11 +1041,10 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
         
     default:
         ASSERT_NOT_REACHED();
-        source = 0;
         break;
     }
     
-    if (destination == *source) {
+    if (destination == source) {
         // Abstract execution did not change the output value of the variable, for this
         // basic block, on this iteration.
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
@@ -1002,7 +1056,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
     // Abstract execution reached a new conclusion about the speculations reached about
     // this variable after execution of this basic block. Update the state, and return
     // true to indicate that the fixpoint must go on!
-    destination = *source;
+    destination = source;
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
     dataLog("          Changed!\n");
 #endif
@@ -1016,11 +1070,29 @@ inline bool AbstractState::merge(BasicBlock* from, BasicBlock* to)
     
     bool changed = false;
     
-    for (size_t argument = 0; argument < from->variablesAtTail.numberOfArguments(); ++argument)
-        changed |= mergeVariableBetweenBlocks(to->valuesAtHead.argument(argument), from->valuesAtTail.argument(argument), to->variablesAtHead.argument(argument), from->variablesAtTail.argument(argument));
+    for (size_t argument = 0; argument < from->variablesAtTail.numberOfArguments(); ++argument) {
+        AbstractValue& destination = to->valuesAtHead.argument(argument);
+        if (m_graph.argumentIsCaptured(argument)) {
+            if (destination.isTop())
+                continue;
+            destination.makeTop();
+            changed = true;
+            continue;
+        }
+        changed |= mergeVariableBetweenBlocks(destination, from->valuesAtTail.argument(argument), to->variablesAtHead.argument(argument), from->variablesAtTail.argument(argument));
+    }
     
-    for (size_t local = 0; local < from->variablesAtTail.numberOfLocals(); ++local)
-        changed |= mergeVariableBetweenBlocks(to->valuesAtHead.local(local), from->valuesAtTail.local(local), to->variablesAtHead.local(local), from->variablesAtTail.local(local));
+    for (size_t local = 0; local < from->variablesAtTail.numberOfLocals(); ++local) {
+        AbstractValue& destination = to->valuesAtHead.local(local);
+        if (m_graph.localIsCaptured(local)) {
+            if (destination.isTop())
+                continue;
+            destination.makeTop();
+            changed = true;
+            continue;
+        }
+        changed |= mergeVariableBetweenBlocks(destination, from->valuesAtTail.local(local), to->variablesAtHead.local(local), from->variablesAtTail.local(local));
+    }
 
     if (!to->cfaHasVisited)
         changed = true;
@@ -1034,7 +1106,7 @@ inline bool AbstractState::mergeToSuccessors(Graph& graph, BasicBlock* basicBloc
 {
     PROFILE(FLAG_FOR_MERGE_TO_SUCCESSORS);
 
-    Node& terminal = graph[basicBlock->end - 1];
+    Node& terminal = graph[basicBlock->last()];
     
     ASSERT(terminal.isTerminal());
     
@@ -1073,15 +1145,17 @@ inline bool AbstractState::mergeVariableBetweenBlocks(AbstractValue& destination
 void AbstractState::dump(FILE* out)
 {
     bool first = true;
-    for (size_t i = 0; i < m_nodes.size(); ++i) {
-        if (m_nodes[i].isClear())
+    for (size_t i = 0; i < m_block->size(); ++i) {
+        NodeIndex index = m_block->at(i);
+        AbstractValue& value = m_nodes[index];
+        if (value.isClear())
             continue;
         if (first)
             first = false;
         else
             fprintf(out, " ");
-        fprintf(out, "@%lu:", static_cast<unsigned long>(i + m_block->begin));
-        m_nodes[i].dump(out);
+        fprintf(out, "@%lu:", static_cast<unsigned long>(index));
+        value.dump(out);
     }
 }
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.h b/Source/JavaScriptCore/dfg/DFGAbstractState.h
index 256e7495f..d9d5cc0f8 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.h
@@ -98,7 +98,7 @@ public:
     
     AbstractValue& forNode(NodeIndex nodeIndex)
     {
-        return m_nodes[nodeIndex - m_block->begin];
+        return m_nodes[nodeIndex];
     }
     
     AbstractValue& forNode(NodeUse nodeUse)
@@ -152,7 +152,7 @@ public:
     // if execution should continue past this node. Notably, it will return true
     // for block terminals, so long as those terminals are not Return or variants
     // of Throw.
-    bool execute(NodeIndex);
+    bool execute(unsigned);
     
     // Is the execution state still valid? This will be false if execute() has
     // returned false previously.
@@ -163,20 +163,20 @@ public:
     // that block must be abstractly interpreted again. This also sets
     // to->cfaShouldRevisit to true, if it returns true, or if to has not been
     // visited yet.
-    static bool merge(BasicBlock* from, BasicBlock* to);
+    bool merge(BasicBlock* from, BasicBlock* to);
     
     // Merge the abstract state stored at the block's tail into all of its
     // successors. Returns true if any of the successors' states changed. Note
     // that this is automatically called in endBasicBlock() if MergeMode is
     // MergeToSuccessors.
-    static bool mergeToSuccessors(Graph&, BasicBlock*);
+    bool mergeToSuccessors(Graph&, BasicBlock*);
 
 #ifndef NDEBUG
     void dump(FILE* out);
 #endif
     
 private:
-    void clobberStructures(NodeIndex);
+    void clobberStructures(unsigned);
     
     bool mergeStateAtTail(AbstractValue& destination, AbstractValue& inVariable, NodeIndex);
     
@@ -185,7 +185,7 @@ private:
     CodeBlock* m_codeBlock;
     Graph& m_graph;
     
-    Vector<AbstractValue, 32> m_nodes;
+    Vector<AbstractValue, 64> m_nodes;
     Operands<AbstractValue> m_variables;
     BasicBlock* m_block;
     bool m_haveStructures;
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractValue.h b/Source/JavaScriptCore/dfg/DFGAbstractValue.h
index aa5518187..682c7a90f 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractValue.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractValue.h
@@ -442,6 +442,11 @@ struct AbstractValue {
         if (mergePredictions(m_type, predictionFromValue(value)) != m_type)
             return false;
         
+        if (value.isEmpty()) {
+            ASSERT(m_type & PredictEmpty);
+            return true;
+        }
+        
         if (m_structure.isTop())
             return true;
         
diff --git a/Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.cpp b/Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.cpp
index f55533a61..9a49364dd 100644
--- a/Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.cpp
@@ -80,11 +80,8 @@ private:
         if (!node.shouldGenerate())
             return;
         
-        NodeType op = node.op;
-        ArithNodeFlags flags = 0;
-        
-        if (node.hasArithNodeFlags())
-            flags = node.rawArithNodeFlags();
+        NodeType op = static_cast<NodeType>(node.op);
+        NodeFlags flags = node.flags;
         
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
         dataLog("   %s @%u: %s ", Graph::opName(op), m_compileIndex, arithNodeFlagsAsString(flags));
@@ -131,6 +128,11 @@ private:
             break;
         }
             
+        case ArithNegate: {
+            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
+            break;
+        }
+            
         case ArithMul:
         case ArithDiv: {
             // As soon as a multiply happens, we can easily end up in the part
@@ -173,7 +175,7 @@ private:
             
         default:
             flags |= NodeUsedAsNumber | NodeNeedsNegZero;
-            if (op & NodeHasVarArgs) {
+            if (node.flags & NodeHasVarArgs) {
                 for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
                     changed |= m_graph[m_graph.m_varArgChildren[childIdx]].mergeArithNodeFlags(flags);
             } else {
@@ -217,6 +219,9 @@ private:
     
     NodeIndex m_compileIndex;
     bool m_changed;
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+    unsigned m_count;
+#endif
 };
 
 void performArithNodeFlagsInference(Graph& graph)
diff --git a/Source/JavaScriptCore/dfg/DFGBasicBlock.h b/Source/JavaScriptCore/dfg/DFGBasicBlock.h
index 9d464bdc2..1c890b498 100644
--- a/Source/JavaScriptCore/dfg/DFGBasicBlock.h
+++ b/Source/JavaScriptCore/dfg/DFGBasicBlock.h
@@ -38,11 +38,9 @@ namespace JSC { namespace DFG {
 
 typedef Vector <BlockIndex, 2> PredecessorList;
 
-struct BasicBlock {
-    BasicBlock(unsigned bytecodeBegin, NodeIndex begin, unsigned numArguments, unsigned numLocals)
+struct BasicBlock : Vector<NodeIndex, 8> {
+    BasicBlock(unsigned bytecodeBegin, unsigned numArguments, unsigned numLocals)
         : bytecodeBegin(bytecodeBegin)
-        , begin(begin)
-        , end(NoNode)
         , isOSRTarget(false)
         , cfaHasVisited(false)
         , cfaShouldRevisit(false)
@@ -69,8 +67,6 @@ struct BasicBlock {
     // for other purposes due to inlining.
     unsigned bytecodeBegin;
     
-    NodeIndex begin;
-    NodeIndex end;
     bool isOSRTarget;
     bool cfaHasVisited;
     bool cfaShouldRevisit;
@@ -79,6 +75,7 @@ struct BasicBlock {
 #endif
     bool isReachable;
     
+    Vector<NodeIndex> phis;
     PredecessorList m_predecessors;
     
     Operands<NodeIndex, NodeIndexTraits> variablesAtHead;
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeCache.h b/Source/JavaScriptCore/dfg/DFGByteCodeCache.h
index fd3b5147f..f6a745c66 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeCache.h
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeCache.h
@@ -138,7 +138,6 @@ public:
                 delete iter->second.codeBlock;
                 continue;
             }
-            iter->second.codeBlock->m_shouldDiscardBytecode = iter->second.oldValueOfShouldDiscardBytecode;
         }
     }
     
@@ -155,7 +154,6 @@ public:
         value.codeBlock = key.executable()->codeBlockWithBytecodeFor(key.kind());
         if (value.codeBlock) {
             value.owned = false;
-            value.oldValueOfShouldDiscardBytecode = value.codeBlock->m_shouldDiscardBytecode;
         } else {
             // Nope, so try to parse one.
             JSObject* exception;
@@ -171,13 +169,6 @@ public:
             value.codeBlock = 0;
         }
         
-        // If we're about to return a code block, make sure that we're not going
-        // to be discarding its bytecode if a GC were to happen during DFG
-        // compilation. That's unlikely, but it's good to thoroughly enjoy this
-        // kind of paranoia.
-        if (!!value.codeBlock)
-            value.codeBlock->m_shouldDiscardBytecode = false;
-        
         m_map.add(key, value);
         
         return value.codeBlock;
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index 0e575db4e..3a3678d12 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -66,6 +66,7 @@ public:
         , m_globalResolveNumber(0)
         , m_inlineStackTop(0)
         , m_haveBuiltOperandMaps(false)
+        , m_emptyJSValueIndex(UINT_MAX)
     {
         ASSERT(m_profiledBlock);
         
@@ -185,16 +186,32 @@ private:
                 // Two possibilities: either the block wants the local to be live
                 // but has not loaded its value, or it has loaded its value, in
                 // which case we're done.
-                Node& flushChild = m_graph[nodePtr->child1()];
+                nodeIndex = nodePtr->child1().index();
+                Node& flushChild = m_graph[nodeIndex];
                 if (flushChild.op == Phi) {
                     VariableAccessData* variableAccessData = flushChild.variableAccessData();
-                    nodeIndex = injectLazyOperandPrediction(addToGraph(GetLocal, OpInfo(variableAccessData), nodePtr->child1().index()));
+                    nodeIndex = injectLazyOperandPrediction(addToGraph(GetLocal, OpInfo(variableAccessData), nodeIndex));
                     m_currentBlock->variablesAtTail.local(operand) = nodeIndex;
                     return nodeIndex;
                 }
                 nodePtr = &flushChild;
             }
+            
+            ASSERT(&m_graph[nodeIndex] == nodePtr);
             ASSERT(nodePtr->op != Flush);
+
+            if (m_graph.localIsCaptured(operand)) {
+                // We wish to use the same variable access data as the previous access,
+                // but for all other purposes we want to issue a load since for all we
+                // know, at this stage of compilation, the local has been clobbered.
+                
+                // Make sure we link to the Phi node, not to the GetLocal.
+                if (nodePtr->op == GetLocal)
+                    nodeIndex = nodePtr->child1().index();
+                
+                return injectLazyOperandPrediction(addToGraph(GetLocal, OpInfo(nodePtr->variableAccessData()), nodeIndex));
+            }
+            
             if (nodePtr->op == GetLocal)
                 return nodeIndex;
             ASSERT(nodePtr->op == SetLocal);
@@ -218,7 +235,11 @@ private:
     }
     void setLocal(unsigned operand, NodeIndex value)
     {
-        m_currentBlock->variablesAtTail.local(operand) = addToGraph(SetLocal, OpInfo(newVariableAccessData(operand)), value);
+        VariableAccessData* variableAccessData = newVariableAccessData(operand);
+        NodeIndex nodeIndex = addToGraph(SetLocal, OpInfo(variableAccessData), value);
+        m_currentBlock->variablesAtTail.local(operand) = nodeIndex;
+        if (m_graph.localIsCaptured(operand))
+            addToGraph(Flush, OpInfo(variableAccessData), nodeIndex);
     }
 
     // Used in implementing get/set, above, where the operand is an argument.
@@ -226,7 +247,7 @@ private:
     {
         unsigned argument = operandToArgument(operand);
         ASSERT(argument < m_numArguments);
-
+        
         NodeIndex nodeIndex = m_currentBlock->variablesAtTail.argument(argument);
 
         if (nodeIndex != NoNode) {
@@ -235,16 +256,18 @@ private:
                 // Two possibilities: either the block wants the local to be live
                 // but has not loaded its value, or it has loaded its value, in
                 // which case we're done.
-                Node& flushChild = m_graph[nodePtr->child1()];
+                nodeIndex = nodePtr->child1().index();
+                Node& flushChild = m_graph[nodeIndex];
                 if (flushChild.op == Phi) {
                     VariableAccessData* variableAccessData = flushChild.variableAccessData();
-                    nodeIndex = injectLazyOperandPrediction(addToGraph(GetLocal, OpInfo(variableAccessData), nodePtr->child1().index()));
+                    nodeIndex = injectLazyOperandPrediction(addToGraph(GetLocal, OpInfo(variableAccessData), nodeIndex));
                     m_currentBlock->variablesAtTail.local(operand) = nodeIndex;
                     return nodeIndex;
                 }
                 nodePtr = &flushChild;
             }
             
+            ASSERT(&m_graph[nodeIndex] == nodePtr);
             ASSERT(nodePtr->op != Flush);
             
             if (nodePtr->op == SetArgument) {
@@ -256,6 +279,12 @@ private:
                 return nodeIndex;
             }
             
+            if (m_graph.argumentIsCaptured(argument)) {
+                if (nodePtr->op == GetLocal)
+                    nodeIndex = nodePtr->child1().index();
+                return injectLazyOperandPrediction(addToGraph(GetLocal, OpInfo(nodePtr->variableAccessData()), nodeIndex));
+            }
+            
             if (nodePtr->op == GetLocal)
                 return nodeIndex;
             
@@ -278,11 +307,15 @@ private:
     {
         unsigned argument = operandToArgument(operand);
         ASSERT(argument < m_numArguments);
-
-        m_currentBlock->variablesAtTail.argument(argument) = addToGraph(SetLocal, OpInfo(newVariableAccessData(operand)), value);
+        
+        VariableAccessData* variableAccessData = newVariableAccessData(operand);
+        NodeIndex nodeIndex = addToGraph(SetLocal, OpInfo(variableAccessData), value);
+        m_currentBlock->variablesAtTail.argument(argument) = nodeIndex;
+        if (m_graph.argumentIsCaptured(argument))
+            addToGraph(Flush, OpInfo(variableAccessData), nodeIndex);
     }
     
-    void flush(int operand)
+    void flushArgument(int operand)
     {
         // FIXME: This should check if the same operand had already been flushed to
         // some other local variable.
@@ -308,7 +341,10 @@ private:
                 nodeIndex = node.child1().index();
             
             ASSERT(m_graph[nodeIndex].op != Flush);
-        
+            
+            // Emit a Flush regardless of whether we already flushed it.
+            // This gives us guidance to see that the variable also needs to be flushed
+            // for arguments, even if it already had to be flushed for other reasons.
             addToGraph(Flush, OpInfo(node.variableAccessData()), nodeIndex);
             return;
         }
@@ -533,8 +569,10 @@ private:
     {
         NodeIndex resultIndex = (NodeIndex)m_graph.size();
         m_graph.append(Node(op, currentCodeOrigin(), child1, child2, child3));
+        ASSERT(op != Phi);
+        m_currentBlock->append(resultIndex);
 
-        if (op & NodeMustGenerate)
+        if (defaultFlags(op) & NodeMustGenerate)
             m_graph.ref(resultIndex);
         return resultIndex;
     }
@@ -542,8 +580,12 @@ private:
     {
         NodeIndex resultIndex = (NodeIndex)m_graph.size();
         m_graph.append(Node(op, currentCodeOrigin(), info, child1, child2, child3));
+        if (op == Phi)
+            m_currentBlock->phis.append(resultIndex);
+        else
+            m_currentBlock->append(resultIndex);
 
-        if (op & NodeMustGenerate)
+        if (defaultFlags(op) & NodeMustGenerate)
             m_graph.ref(resultIndex);
         return resultIndex;
     }
@@ -551,8 +593,10 @@ private:
     {
         NodeIndex resultIndex = (NodeIndex)m_graph.size();
         m_graph.append(Node(op, currentCodeOrigin(), info1, info2, child1, child2, child3));
+        ASSERT(op != Phi);
+        m_currentBlock->append(resultIndex);
 
-        if (op & NodeMustGenerate)
+        if (defaultFlags(op) & NodeMustGenerate)
             m_graph.ref(resultIndex);
         return resultIndex;
     }
@@ -561,13 +605,25 @@ private:
     {
         NodeIndex resultIndex = (NodeIndex)m_graph.size();
         m_graph.append(Node(Node::VarArg, op, currentCodeOrigin(), info1, info2, m_graph.m_varArgChildren.size() - m_numPassedVarArgs, m_numPassedVarArgs));
+        ASSERT(op != Phi);
+        m_currentBlock->append(resultIndex);
         
         m_numPassedVarArgs = 0;
         
-        if (op & NodeMustGenerate)
+        if (defaultFlags(op) & NodeMustGenerate)
             m_graph.ref(resultIndex);
         return resultIndex;
     }
+
+    NodeIndex insertPhiNode(OpInfo info, BasicBlock* block)
+    {
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(Phi, currentCodeOrigin(), info));
+        block->phis.append(resultIndex);
+
+        return resultIndex;
+    }
+
     void addVarArgChild(NodeIndex child)
     {
         m_graph.m_varArgChildren.append(NodeUse(child));
@@ -643,13 +699,14 @@ private:
             return nodeIndex;
         
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        dataLog("Making %s @%u safe at bc#%u because slow-case counter is at %u and exit profiles say %d, %d\n", Graph::opName(m_graph[nodeIndex].op), nodeIndex, m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero));
+        dataLog("Making %s @%u safe at bc#%u because slow-case counter is at %u and exit profiles say %d, %d\n", Graph::opName(static_cast<NodeType>(m_graph[nodeIndex].op)), nodeIndex, m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero));
 #endif
         
         switch (m_graph[nodeIndex].op) {
         case UInt32ToNumber:
         case ArithAdd:
         case ArithSub:
+        case ArithNegate:
         case ValueAdd:
         case ArithMod: // for ArithMode "MayOverflow" means we tried to divide by zero, or we saw double.
             m_graph[nodeIndex].mergeArithNodeFlags(NodeMayOverflow);
@@ -695,7 +752,7 @@ private:
             return nodeIndex;
         
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        dataLog("Making %s @%u safe at bc#%u because special fast-case counter is at %u and exit profiles say %d, %d\n", Graph::opName(m_graph[nodeIndex].op), nodeIndex, m_currentIndex, m_inlineStackTop->m_profiledBlock->specialFastCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero));
+        dataLog("Making %s @%u safe at bc#%u because special fast-case counter is at %u and exit profiles say %d, %d\n", Graph::opName(static_cast<NodeType>(m_graph[nodeIndex].op)), nodeIndex, m_currentIndex, m_inlineStackTop->m_profiledBlock->specialFastCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero));
 #endif
         
         // FIXME: It might be possible to make this more granular. The DFG certainly can
@@ -912,6 +969,9 @@ private:
     IdentifierMap m_identifierMap;
     // Mapping between values and constant numbers.
     JSValueMap m_jsValueMap;
+    // Index of the empty value, or UINT_MAX if there is no mapping. This is a horrible
+    // work-around for the fact that JSValueMap can't handle "empty" values.
+    unsigned m_emptyJSValueIndex;
     
     // Cache of code blocks that we've generated bytecode for.
     ByteCodeCache<canInlineFunctionFor> m_codeBlockCache;
@@ -1066,7 +1126,7 @@ bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex c
     // FIXME: Don't flush constants!
     
     for (int i = 1; i < argumentCountIncludingThis; ++i)
-        flush(registerOffset + argumentToOperand(i));
+        flushArgument(registerOffset + argumentToOperand(i));
     
     int inlineCallFrameStart = m_inlineStackTop->remapOperand(registerOffset) - RegisterFile::CallFrameHeaderSize;
     
@@ -1129,7 +1189,7 @@ bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex c
     // the caller to continue in whatever basic block we're in right now.
     if (!inlineStackEntry.m_didEarlyReturn && inlineStackEntry.m_didReturn) {
         BasicBlock* lastBlock = m_graph.m_blocks.last().get();
-        ASSERT(lastBlock->begin == lastBlock->end || !m_graph.last().isTerminal());
+        ASSERT(lastBlock->isEmpty() || !m_graph.last().isTerminal());
         
         // If we created new blocks then the last block needs linking, but in the
         // caller. It doesn't need to be linked to, but it needs outgoing links.
@@ -1161,7 +1221,7 @@ bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex c
             continue;
         BasicBlock* block = m_graph.m_blocks[inlineStackEntry.m_unlinkedBlocks[i].m_blockIndex].get();
         ASSERT(!block->isLinked);
-        Node& node = m_graph[block->end - 1];
+        Node& node = m_graph[block->last()];
         ASSERT(node.op == Jump);
         ASSERT(node.takenBlockIndex() == NoBlock);
         node.setTakenBlockIndex(m_graph.m_blocks.size());
@@ -1172,7 +1232,7 @@ bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex c
     }
     
     // Need to create a new basic block for the continuation at the caller.
-    OwnPtr<BasicBlock> block = adoptPtr(new BasicBlock(nextOffset, m_graph.size(), m_numArguments, m_numLocals));
+    OwnPtr<BasicBlock> block = adoptPtr(new BasicBlock(nextOffset, m_numArguments, m_numLocals));
 #if DFG_ENABLE(DEBUG_VERBOSE)
     dataLog("Creating inline epilogue basic block %p, #%zu for %p bc#%u at inline depth %u.\n", block.get(), m_graph.m_blocks.size(), m_inlineStackTop->executable(), m_currentIndex, CodeOrigin::inlineDepthForCallFrame(m_inlineStackTop->m_inlineCallFrame));
 #endif
@@ -1207,7 +1267,7 @@ bool ByteCodeParser::handleMinMax(bool usesResult, int resultOperand, NodeType o
     }
     
     if (argumentCountIncludingThis == 3) { // Math.min(x, y)
-        set(resultOperand, addToGraph(op, OpInfo(NodeUseBottom), get(registerOffset + argumentToOperand(1)), get(registerOffset + argumentToOperand(2))));
+        set(resultOperand, addToGraph(op, get(registerOffset + argumentToOperand(1)), get(registerOffset + argumentToOperand(2))));
         return true;
     }
     
@@ -1235,7 +1295,7 @@ bool ByteCodeParser::handleIntrinsic(bool usesResult, int resultOperand, Intrins
         if (!MacroAssembler::supportsFloatingPointAbs())
             return false;
 
-        NodeIndex nodeIndex = addToGraph(ArithAbs, OpInfo(NodeUseBottom), get(registerOffset + argumentToOperand(1)));
+        NodeIndex nodeIndex = addToGraph(ArithAbs, get(registerOffset + argumentToOperand(1)));
         if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow))
             m_graph[nodeIndex].mergeArithNodeFlags(NodeMayOverflow);
         set(resultOperand, nodeIndex);
@@ -1364,7 +1424,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             // logic relies on every bytecode resulting in one or more nodes, which would
             // be true anyway except for op_loop_hint, which emits a Phantom to force this
             // to be true.
-            if (m_currentBlock->begin != m_graph.size())
+            if (!m_currentBlock->isEmpty())
                 addToGraph(Jump, OpInfo(m_currentIndex));
             else {
 #if DFG_ENABLE(DEBUG_VERBOSE)
@@ -1502,11 +1562,11 @@ bool ByteCodeParser::parseBlock(unsigned limit)
                 if (valueOfInt32Constant(op2) & 0x1f)
                     result = addToGraph(BitURShift, op1, op2);
                 else
-                    result = makeSafe(addToGraph(UInt32ToNumber, OpInfo(NodeUseBottom), op1));
+                    result = makeSafe(addToGraph(UInt32ToNumber, op1));
             }  else {
                 // Cannot optimize at this stage; shift & potentially rebox as a double.
                 result = addToGraph(BitURShift, op1, op2);
-                result = makeSafe(addToGraph(UInt32ToNumber, OpInfo(NodeUseBottom), result));
+                result = makeSafe(addToGraph(UInt32ToNumber, result));
             }
             set(currentInstruction[1].u.operand, result);
             NEXT_OPCODE(op_urshift);
@@ -1517,7 +1577,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
         case op_pre_inc: {
             unsigned srcDst = currentInstruction[1].u.operand;
             NodeIndex op = get(srcDst);
-            set(srcDst, makeSafe(addToGraph(ArithAdd, OpInfo(NodeUseBottom), op, one())));
+            set(srcDst, makeSafe(addToGraph(ArithAdd, op, one())));
             NEXT_OPCODE(op_pre_inc);
         }
 
@@ -1527,14 +1587,14 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             ASSERT(result != srcDst); // Required for assumptions we make during OSR.
             NodeIndex op = get(srcDst);
             set(result, op);
-            set(srcDst, makeSafe(addToGraph(ArithAdd, OpInfo(NodeUseBottom), op, one())));
+            set(srcDst, makeSafe(addToGraph(ArithAdd, op, one())));
             NEXT_OPCODE(op_post_inc);
         }
 
         case op_pre_dec: {
             unsigned srcDst = currentInstruction[1].u.operand;
             NodeIndex op = get(srcDst);
-            set(srcDst, makeSafe(addToGraph(ArithSub, OpInfo(NodeUseBottom), op, one())));
+            set(srcDst, makeSafe(addToGraph(ArithSub, op, one())));
             NEXT_OPCODE(op_pre_dec);
         }
 
@@ -1543,7 +1603,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             unsigned srcDst = currentInstruction[2].u.operand;
             NodeIndex op = get(srcDst);
             set(result, op);
-            set(srcDst, makeSafe(addToGraph(ArithSub, OpInfo(NodeUseBottom), op, one())));
+            set(srcDst, makeSafe(addToGraph(ArithSub, op, one())));
             NEXT_OPCODE(op_post_dec);
         }
 
@@ -1553,38 +1613,44 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             NodeIndex op1 = get(currentInstruction[2].u.operand);
             NodeIndex op2 = get(currentInstruction[3].u.operand);
             if (m_graph[op1].hasNumberResult() && m_graph[op2].hasNumberResult())
-                set(currentInstruction[1].u.operand, makeSafe(addToGraph(ArithAdd, OpInfo(NodeUseBottom), op1, op2)));
+                set(currentInstruction[1].u.operand, makeSafe(addToGraph(ArithAdd, op1, op2)));
             else
-                set(currentInstruction[1].u.operand, makeSafe(addToGraph(ValueAdd, OpInfo(NodeUseBottom), op1, op2)));
+                set(currentInstruction[1].u.operand, makeSafe(addToGraph(ValueAdd, op1, op2)));
             NEXT_OPCODE(op_add);
         }
 
         case op_sub: {
             NodeIndex op1 = get(currentInstruction[2].u.operand);
             NodeIndex op2 = get(currentInstruction[3].u.operand);
-            set(currentInstruction[1].u.operand, makeSafe(addToGraph(ArithSub, OpInfo(NodeUseBottom), op1, op2)));
+            set(currentInstruction[1].u.operand, makeSafe(addToGraph(ArithSub, op1, op2)));
             NEXT_OPCODE(op_sub);
         }
 
+        case op_negate: {
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            set(currentInstruction[1].u.operand, makeSafe(addToGraph(ArithNegate, op1)));
+            NEXT_OPCODE(op_negate);
+        }
+
         case op_mul: {
             // Multiply requires that the inputs are not truncated, unfortunately.
             NodeIndex op1 = get(currentInstruction[2].u.operand);
             NodeIndex op2 = get(currentInstruction[3].u.operand);
-            set(currentInstruction[1].u.operand, makeSafe(addToGraph(ArithMul, OpInfo(NodeUseBottom), op1, op2)));
+            set(currentInstruction[1].u.operand, makeSafe(addToGraph(ArithMul, op1, op2)));
             NEXT_OPCODE(op_mul);
         }
 
         case op_mod: {
             NodeIndex op1 = get(currentInstruction[2].u.operand);
             NodeIndex op2 = get(currentInstruction[3].u.operand);
-            set(currentInstruction[1].u.operand, makeSafe(addToGraph(ArithMod, OpInfo(NodeUseBottom), op1, op2)));
+            set(currentInstruction[1].u.operand, makeSafe(addToGraph(ArithMod, op1, op2)));
             NEXT_OPCODE(op_mod);
         }
 
         case op_div: {
             NodeIndex op1 = get(currentInstruction[2].u.operand);
             NodeIndex op2 = get(currentInstruction[3].u.operand);
-            set(currentInstruction[1].u.operand, makeDivSafe(addToGraph(ArithDiv, OpInfo(NodeUseBottom), op1, op2)));
+            set(currentInstruction[1].u.operand, makeDivSafe(addToGraph(ArithDiv, op1, op2)));
             NEXT_OPCODE(op_div);
         }
 
@@ -2187,6 +2253,42 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             
             NEXT_OPCODE(op_loop_hint);
         }
+            
+        case op_init_lazy_reg: {
+            set(currentInstruction[1].u.operand, getJSConstantForValue(JSValue()));
+            NEXT_OPCODE(op_init_lazy_reg);
+        }
+            
+        case op_create_activation: {
+            set(currentInstruction[1].u.operand, addToGraph(CreateActivation, get(currentInstruction[1].u.operand)));
+            NEXT_OPCODE(op_create_activation);
+        }
+            
+        case op_tear_off_activation: {
+            // This currently ignores arguments because we don't support them yet.
+            addToGraph(TearOffActivation, get(currentInstruction[1].u.operand));
+            NEXT_OPCODE(op_tear_off_activation);
+        }
+            
+        case op_new_func: {
+            if (!currentInstruction[3].u.operand) {
+                set(currentInstruction[1].u.operand,
+                    addToGraph(NewFunctionNoCheck, OpInfo(currentInstruction[2].u.operand)));
+            } else {
+                set(currentInstruction[1].u.operand,
+                    addToGraph(
+                        NewFunction,
+                        OpInfo(currentInstruction[2].u.operand),
+                        get(currentInstruction[1].u.operand)));
+            }
+            NEXT_OPCODE(op_new_func);
+        }
+            
+        case op_new_func_exp: {
+            set(currentInstruction[1].u.operand,
+                addToGraph(NewFunctionExpression, OpInfo(currentInstruction[2].u.operand)));
+            NEXT_OPCODE(op_new_func_exp);
+        }
 
         default:
             // Parse failed! This should not happen because the capabilities checker
@@ -2231,7 +2333,7 @@ void ByteCodeParser::processPhiStack()
                 dataLog("      Did not find node, adding phi.\n");
 #endif
 
-                valueInPredecessor = addToGraph(Phi, OpInfo(newVariableAccessData(stackType == ArgumentPhiStack ? argumentToOperand(varNo) : static_cast<int>(varNo))));
+                valueInPredecessor = insertPhiNode(OpInfo(newVariableAccessData(stackType == ArgumentPhiStack ? argumentToOperand(varNo) : static_cast<int>(varNo))), predecessorBlock);
                 var = valueInPredecessor;
                 if (stackType == ArgumentPhiStack)
                     predecessorBlock->variablesAtHead.setArgumentFirstTime(varNo, valueInPredecessor);
@@ -2255,7 +2357,11 @@ void ByteCodeParser::processPhiStack()
                 dataLog("      Found @%u.\n", valueInPredecessor);
 #endif
             }
-            ASSERT(m_graph[valueInPredecessor].op == SetLocal || m_graph[valueInPredecessor].op == Phi || m_graph[valueInPredecessor].op == Flush || (m_graph[valueInPredecessor].op == SetArgument && stackType == ArgumentPhiStack));
+            ASSERT(m_graph[valueInPredecessor].op == SetLocal
+                   || m_graph[valueInPredecessor].op == Phi
+                   || m_graph[valueInPredecessor].op == Flush
+                   || (m_graph[valueInPredecessor].op == SetArgument
+                       && stackType == ArgumentPhiStack));
             
             VariableAccessData* dataForPredecessor = m_graph[valueInPredecessor].variableAccessData();
             
@@ -2309,7 +2415,7 @@ void ByteCodeParser::processPhiStack()
                 continue;
             }
             
-            NodeIndex newPhi = addToGraph(Phi, OpInfo(dataForPhi));
+            NodeIndex newPhi = insertPhiNode(OpInfo(dataForPhi), entry.m_block);
             
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
             dataLog("      Splitting @%u, created @%u.\n", entry.m_phi, newPhi);
@@ -2349,10 +2455,9 @@ void ByteCodeParser::fixVariableAccessPredictions()
 
 void ByteCodeParser::linkBlock(BasicBlock* block, Vector<BlockIndex>& possibleTargets)
 {
-    ASSERT(block->end != NoNode);
     ASSERT(!block->isLinked);
-    ASSERT(block->end > block->begin);
-    Node& node = m_graph[block->end - 1];
+    ASSERT(!block->isEmpty());
+    Node& node = m_graph[block->last()];
     ASSERT(node.isTerminal());
     
     switch (node.op) {
@@ -2416,7 +2521,7 @@ void ByteCodeParser::determineReachability()
         BasicBlock* block = m_graph.m_blocks[index].get();
         ASSERT(block->isLinked);
         
-        Node& node = m_graph[block->end - 1];
+        Node& node = m_graph[block->last()];
         ASSERT(node.isTerminal());
         
         if (node.isJump())
@@ -2435,8 +2540,13 @@ void ByteCodeParser::buildOperandMapsIfNecessary()
     
     for (size_t i = 0; i < m_codeBlock->numberOfIdentifiers(); ++i)
         m_identifierMap.add(m_codeBlock->identifier(i).impl(), i);
-    for (size_t i = 0; i < m_codeBlock->numberOfConstantRegisters(); ++i)
-        m_jsValueMap.add(JSValue::encode(m_codeBlock->getConstant(i + FirstConstantRegisterIndex)), i + FirstConstantRegisterIndex);
+    for (size_t i = 0; i < m_codeBlock->numberOfConstantRegisters(); ++i) {
+        JSValue value = m_codeBlock->getConstant(i + FirstConstantRegisterIndex);
+        if (!value)
+            m_emptyJSValueIndex = i + FirstConstantRegisterIndex;
+        else
+            m_jsValueMap.add(JSValue::encode(value), i + FirstConstantRegisterIndex);
+    }
     
     m_haveBuiltOperandMaps = true;
 }
@@ -2486,6 +2596,15 @@ ByteCodeParser::InlineStackEntry::InlineStackEntry(ByteCodeParser* byteCodeParse
         }
         for (size_t i = 0; i < codeBlock->numberOfConstantRegisters(); ++i) {
             JSValue value = codeBlock->getConstant(i + FirstConstantRegisterIndex);
+            if (!value) {
+                if (byteCodeParser->m_emptyJSValueIndex == UINT_MAX) {
+                    byteCodeParser->m_emptyJSValueIndex = byteCodeParser->m_codeBlock->numberOfConstantRegisters() + FirstConstantRegisterIndex;
+                    byteCodeParser->m_codeBlock->addConstant(JSValue());
+                    byteCodeParser->m_constants.append(ConstantRecord());
+                }
+                m_constantRemap[i] = byteCodeParser->m_emptyJSValueIndex;
+                continue;
+            }
             pair<JSValueMap::iterator, bool> result = byteCodeParser->m_jsValueMap.add(JSValue::encode(value), byteCodeParser->m_codeBlock->numberOfConstantRegisters() + FirstConstantRegisterIndex);
             if (result.second) {
                 byteCodeParser->m_codeBlock->addConstant(value);
@@ -2527,6 +2646,16 @@ void ByteCodeParser::parseCodeBlock()
 {
     CodeBlock* codeBlock = m_inlineStackTop->m_codeBlock;
     
+#if DFG_ENABLE(DEBUG_VERBOSE)
+    dataLog("Parsing code block %p. codeType = %s, numCapturedVars = %u, needsFullScopeChain = %s, needsActivation = %s, isStrictMode = %s\n",
+            codeBlock,
+            codeTypeToString(codeBlock->codeType()),
+            codeBlock->m_numCapturedVars,
+            codeBlock->needsFullScopeChain()?"true":"false",
+            codeBlock->ownerExecutable()->needsActivation()?"true":"false",
+            codeBlock->ownerExecutable()->isStrictMode()?"true":"false");
+#endif
+    
     for (unsigned jumpTargetIndex = 0; jumpTargetIndex <= codeBlock->numberOfJumpTargets(); ++jumpTargetIndex) {
         // The maximum bytecode offset to go into the current basicblock is either the next jump target, or the end of the instructions.
         unsigned limit = jumpTargetIndex < codeBlock->numberOfJumpTargets() ? codeBlock->jumpTarget(jumpTargetIndex) : codeBlock->instructions().size();
@@ -2539,7 +2668,7 @@ void ByteCodeParser::parseCodeBlock()
         do {
             if (!m_currentBlock) {
                 // Check if we can use the last block.
-                if (!m_graph.m_blocks.isEmpty() && m_graph.m_blocks.last()->begin == m_graph.m_blocks.last()->end) {
+                if (!m_graph.m_blocks.isEmpty() && m_graph.m_blocks.last()->isEmpty()) {
                     // This must be a block belonging to us.
                     ASSERT(m_inlineStackTop->m_unlinkedBlocks.last().m_blockIndex == m_graph.m_blocks.size() - 1);
                     // Either the block is linkable or it isn't. If it's linkable then it's the last
@@ -2557,7 +2686,7 @@ void ByteCodeParser::parseCodeBlock()
 #endif
                     m_currentBlock->bytecodeBegin = m_currentIndex;
                 } else {
-                    OwnPtr<BasicBlock> block = adoptPtr(new BasicBlock(m_currentIndex, m_graph.size(), m_numArguments, m_numLocals));
+                    OwnPtr<BasicBlock> block = adoptPtr(new BasicBlock(m_currentIndex, m_numArguments, m_numLocals));
 #if DFG_ENABLE(DEBUG_VERBOSE)
                     dataLog("Creating basic block %p, #%zu for %p bc#%u at inline depth %u.\n", block.get(), m_graph.m_blocks.size(), m_inlineStackTop->executable(), m_currentIndex, CodeOrigin::inlineDepthForCallFrame(m_inlineStackTop->m_inlineCallFrame));
 #endif
@@ -2580,10 +2709,8 @@ void ByteCodeParser::parseCodeBlock()
             // are at the end of an inline function, or we realized that we
             // should stop parsing because there was a return in the first
             // basic block.
-            ASSERT(m_currentBlock->begin == m_graph.size() || m_graph.last().isTerminal() || (m_currentIndex == codeBlock->instructions().size() && m_inlineStackTop->m_inlineCallFrame) || !shouldContinueParsing);
+            ASSERT(m_currentBlock->isEmpty() || m_graph.last().isTerminal() || (m_currentIndex == codeBlock->instructions().size() && m_inlineStackTop->m_inlineCallFrame) || !shouldContinueParsing);
 
-            m_currentBlock->end = m_graph.size();
-            
             if (!shouldContinueParsing)
                 return;
             
@@ -2600,6 +2727,11 @@ bool ByteCodeParser::parse()
     // Set during construction.
     ASSERT(!m_currentIndex);
     
+#if DFG_ENABLE(ALL_VARIABLES_CAPTURED)
+    // We should be pretending that the code has an activation.
+    ASSERT(m_graph.needsActivation());
+#endif
+    
     InlineStackEntry inlineStackEntry(this, m_codeBlock, m_profiledBlock, NoBlock, InvalidVirtualRegister, 0, InvalidVirtualRegister, InvalidVirtualRegister, CodeForCall);
     
     parseCodeBlock();
diff --git a/Source/JavaScriptCore/dfg/DFGCCallHelpers.h b/Source/JavaScriptCore/dfg/DFGCCallHelpers.h
index 3481f99e8..16793bb46 100644
--- a/Source/JavaScriptCore/dfg/DFGCCallHelpers.h
+++ b/Source/JavaScriptCore/dfg/DFGCCallHelpers.h
@@ -420,6 +420,13 @@ public:
         move(arg2, GPRInfo::argumentGPR2);
         move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
     }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, ImmPtr arg2)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
 
     ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2)
     {
@@ -427,6 +434,13 @@ public:
         move(arg1, GPRInfo::argumentGPR1);
         move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
     }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(ImmPtr arg1, GPRReg arg2)
+    {
+        move(arg2, GPRInfo::argumentGPR2); // Move this first, so setting arg1 does not trample!
+        move(arg1, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
 
     ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImm32 arg2)
     {
diff --git a/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp b/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp
index ac1e26c19..b4e75f808 100644
--- a/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp
@@ -82,15 +82,16 @@ private:
         dumpOperands(block->valuesAtHead, WTF::dataFile());
         dataLog("\n");
 #endif
-        for (NodeIndex nodeIndex = block->begin; nodeIndex < block->end; ++nodeIndex) {
+        for (unsigned i = 0; i < block->size(); ++i) {
+            NodeIndex nodeIndex = block->at(i);
             if (!m_graph[nodeIndex].shouldGenerate())
                 continue;
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            dataLog("      %s @%u: ", Graph::opName(m_graph[nodeIndex].op), nodeIndex);
+            dataLog("      %s @%u: ", Graph::opName(static_cast<NodeType>(m_graph[nodeIndex].op)), nodeIndex);
             m_state.dump(WTF::dataFile());
             dataLog("\n");
 #endif
-            if (!m_state.execute(nodeIndex))
+            if (!m_state.execute(i))
                 break;
         }
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
@@ -120,6 +121,9 @@ private:
     AbstractState m_state;
     
     bool m_changed;
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+    unsigned m_count;
+#endif
 };
 
 void performCFA(Graph& graph)
diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
index a3c27ebc1..82e1b4609 100644
--- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
@@ -43,9 +43,6 @@ public:
         
         for (unsigned i = 0; i < m_graph.size(); ++i)
             m_replacements[i] = NoNode;
-        
-        for (unsigned i = 0; i < LastNodeId; ++i)
-            m_lastSeen[i] = NoNode;
     }
     
     void run()
@@ -71,68 +68,14 @@ private:
         return canonicalize(nodeUse.indexUnchecked());
     }
     
-    // Computes where the search for a candidate for CSE should start. Don't call
-    // this directly; call startIndex() instead as it does logging in debug mode.
-    NodeIndex computeStartIndexForChildren(NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+    unsigned endIndexForPureCSE()
     {
-        const unsigned limit = 300;
-        
-        NodeIndex start = m_start;
-        if (m_compileIndex - start > limit)
-            start = m_compileIndex - limit;
-        
-        ASSERT(start >= m_start);
-        
-        NodeIndex child = canonicalize(child1);
-        if (child == NoNode)
-            return start;
-        
-        if (start < child)
-            start = child;
-        
-        child = canonicalize(child2);
-        if (child == NoNode)
-            return start;
-        
-        if (start < child)
-            start = child;
-        
-        child = canonicalize(child3);
-        if (child == NoNode)
-            return start;
-        
-        if (start < child)
-            start = child;
-        
-        return start;
-    }
-    
-    NodeIndex startIndexForChildren(NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
-    {
-        NodeIndex result = computeStartIndexForChildren(child1, child2, child3);
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        dataLog("  lookback %u: ", result);
-#endif
-        return result;
-    }
-    
-    NodeIndex startIndex()
-    {
-        Node& node = m_graph[m_compileIndex];
-        return startIndexForChildren(
-            node.child1().indexUnchecked(),
-            node.child2().indexUnchecked(),
-            node.child3().indexUnchecked());
-    }
-    
-    NodeIndex endIndexForPureCSE()
-    {
-        NodeIndex result = m_lastSeen[m_graph[m_compileIndex].op & NodeIdMask];
-        if (result == NoNode)
+        unsigned result = m_lastSeen[m_graph[m_compileIndex].op];
+        if (result == UINT_MAX)
             result = 0;
         else
             result++;
-        ASSERT(result <= m_compileIndex);
+        ASSERT(result <= m_indexInBlock);
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
         dataLog("  limit %u: ", result);
 #endif
@@ -145,13 +88,16 @@ private:
         NodeIndex child2 = canonicalize(node.child2());
         NodeIndex child3 = canonicalize(node.child3());
         
-        NodeIndex start = startIndex();
-        for (NodeIndex index = endIndexForPureCSE(); index-- > start;) {
+        for (unsigned i = endIndexForPureCSE(); i--;) {
+            NodeIndex index = m_currentBlock->at(i);
+            if (index == child1 || index == child2 || index == child3)
+                break;
+
             Node& otherNode = m_graph[index];
             if (node.op != otherNode.op)
                 continue;
             
-            if (node.arithNodeFlagsForCompare() != otherNode.arithNodeFlagsForCompare())
+            if (node.arithNodeFlags() != otherNode.arithNodeFlags())
                 continue;
             
             NodeIndex otherChild = canonicalize(otherNode.child1());
@@ -201,9 +147,9 @@ private:
     bool clobbersWorld(NodeIndex nodeIndex)
     {
         Node& node = m_graph[nodeIndex];
-        if (node.op & NodeClobbersWorld)
+        if (node.flags & NodeClobbersWorld)
             return true;
-        if (!(node.op & NodeMightClobber))
+        if (!(node.flags & NodeMightClobber))
             return false;
         switch (node.op) {
         case ValueAdd:
@@ -229,11 +175,14 @@ private:
         NodeIndex child2 = canonicalize(node.child2());
         NodeIndex child3 = canonicalize(node.child3());
         
-        NodeIndex start = startIndex();
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
+        for (unsigned i = m_indexInBlock; i--;) {
+            NodeIndex index = m_currentBlock->at(i);
+            if (index == child1 || index == child2 || index == child3)
+                break;
+
             Node& otherNode = m_graph[index];
             if (node.op == otherNode.op
-                && node.arithNodeFlagsForCompare() == otherNode.arithNodeFlagsForCompare()) {
+                && node.arithNodeFlags() == otherNode.arithNodeFlags()) {
                 NodeIndex otherChild = canonicalize(otherNode.child1());
                 if (otherChild == NoNode)
                     return index;
@@ -258,8 +207,8 @@ private:
     
     NodeIndex globalVarLoadElimination(unsigned varNumber, JSGlobalObject* globalObject)
     {
-        NodeIndex start = startIndexForChildren();
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
+        for (unsigned i = m_indexInBlock; i--;) {
+            NodeIndex index = m_currentBlock->at(i);
             Node& node = m_graph[index];
             switch (node.op) {
             case GetGlobalVar:
@@ -281,8 +230,11 @@ private:
     
     NodeIndex getByValLoadElimination(NodeIndex child1, NodeIndex child2)
     {
-        NodeIndex start = startIndexForChildren(child1, child2);
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
+        for (unsigned i = m_indexInBlock; i--;) {
+            NodeIndex index = m_currentBlock->at(i);
+            if (index == child1 || index == canonicalize(child2)) 
+                break;
+
             Node& node = m_graph[index];
             switch (node.op) {
             case GetByVal:
@@ -322,8 +274,11 @@ private:
 
     bool checkFunctionElimination(JSFunction* function, NodeIndex child1)
     {
-        NodeIndex start = startIndexForChildren(child1);
-        for (NodeIndex index = endIndexForPureCSE(); index-- > start;) {
+        for (unsigned i = endIndexForPureCSE(); i--;) {
+            NodeIndex index = m_currentBlock->at(i);
+            if (index == child1) 
+                break;
+
             Node& node = m_graph[index];
             if (node.op == CheckFunction && node.child1() == child1 && node.function() == function)
                 return true;
@@ -333,8 +288,11 @@ private:
 
     bool checkStructureLoadElimination(const StructureSet& structureSet, NodeIndex child1)
     {
-        NodeIndex start = startIndexForChildren(child1);
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
+        for (unsigned i = m_indexInBlock; i--;) {
+            NodeIndex index = m_currentBlock->at(i);
+            if (index == child1) 
+                break;
+
             Node& node = m_graph[index];
             switch (node.op) {
             case CheckStructure:
@@ -376,8 +334,11 @@ private:
     
     NodeIndex getByOffsetLoadElimination(unsigned identifierNumber, NodeIndex child1)
     {
-        NodeIndex start = startIndexForChildren(child1);
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
+        for (unsigned i = m_indexInBlock; i--;) {
+            NodeIndex index = m_currentBlock->at(i);
+            if (index == child1) 
+                break;
+
             Node& node = m_graph[index];
             switch (node.op) {
             case GetByOffset:
@@ -419,8 +380,11 @@ private:
     
     NodeIndex getPropertyStorageLoadElimination(NodeIndex child1)
     {
-        NodeIndex start = startIndexForChildren(child1);
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
+        for (unsigned i = m_indexInBlock; i--;) {
+            NodeIndex index = m_currentBlock->at(i);
+            if (index == child1) 
+                break;
+
             Node& node = m_graph[index];
             switch (node.op) {
             case GetPropertyStorage:
@@ -455,8 +419,11 @@ private:
 
     NodeIndex getIndexedPropertyStorageLoadElimination(NodeIndex child1, bool hasIntegerIndexPrediction)
     {
-        NodeIndex start = startIndexForChildren(child1);
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
+        for (unsigned i = m_indexInBlock; i--;) {
+            NodeIndex index = m_currentBlock->at(i);
+            if (index == child1) 
+                break;
+
             Node& node = m_graph[index];
             switch (node.op) {
             case GetIndexedPropertyStorage: {
@@ -493,8 +460,8 @@ private:
     
     NodeIndex getScopeChainLoadElimination(unsigned depth)
     {
-        NodeIndex start = startIndexForChildren();
-        for (NodeIndex index = endIndexForPureCSE(); index-- > start;) {
+        for (unsigned i = endIndexForPureCSE(); i--;) {
+            NodeIndex index = m_currentBlock->at(i);
             Node& node = m_graph[index];
             if (node.op == GetScopeChain
                 && node.scopeChainDepth() == depth)
@@ -539,7 +506,7 @@ private:
 #endif
         
         Node& node = m_graph[m_compileIndex];
-        node.op = Phantom;
+        node.setOpAndDefaultFlags(Phantom);
         node.setRefCount(1);
         
         // At this point we will eliminate all references to this node.
@@ -555,14 +522,14 @@ private:
         Node& node = m_graph[m_compileIndex];
         ASSERT(node.refCount() == 1);
         ASSERT(node.mustGenerate());
-        node.op = Phantom;
+        node.setOpAndDefaultFlags(Phantom);
     }
     
     void performNodeCSE(Node& node)
     {
         bool shouldGenerate = node.shouldGenerate();
 
-        if (node.op & NodeHasVarArgs) {
+        if (node.flags & NodeHasVarArgs) {
             for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
                 performSubstitution(m_graph.m_varArgChildren[childIdx], shouldGenerate);
         } else {
@@ -575,7 +542,7 @@ private:
             return;
         
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        dataLog("   %s @%u: ", Graph::opName(m_graph[m_compileIndex].op), m_compileIndex);
+        dataLog("   %s @%u: ", Graph::opName(static_cast<NodeType>(m_graph[m_compileIndex].op)), m_compileIndex);
 #endif
         
         // NOTE: there are some nodes that we deliberately don't CSE even though we
@@ -598,6 +565,7 @@ private:
         case BitURShift:
         case ArithAdd:
         case ArithSub:
+        case ArithNegate:
         case ArithMul:
         case ArithMod:
         case ArithDiv:
@@ -701,7 +669,7 @@ private:
             break;
         }
         
-        m_lastSeen[node.op & NodeIdMask] = m_compileIndex;
+        m_lastSeen[node.op] = m_indexInBlock;
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
         dataLog("\n");
 #endif
@@ -709,16 +677,21 @@ private:
     
     void performBlockCSE(BasicBlock& block)
     {
-        m_start = block.begin;
-        NodeIndex end = block.end;
-        for (m_compileIndex = m_start; m_compileIndex < end; ++m_compileIndex)
+        m_currentBlock = &block;
+        for (unsigned i = 0; i < LastNodeType; ++i)
+            m_lastSeen[i] = UINT_MAX;
+
+        for (m_indexInBlock = 0; m_indexInBlock < block.size(); ++m_indexInBlock) {
+            m_compileIndex = block[m_indexInBlock];
             performNodeCSE(m_graph[m_compileIndex]);
+        }
     }
     
-    NodeIndex m_start;
+    BasicBlock* m_currentBlock;
     NodeIndex m_compileIndex;
+    unsigned m_indexInBlock;
     Vector<NodeIndex, 16> m_replacements;
-    FixedArray<NodeIndex, LastNodeId> m_lastSeen;
+    FixedArray<unsigned, LastNodeType> m_lastSeen;
 };
 
 void performCSE(Graph& graph)
diff --git a/Source/JavaScriptCore/dfg/DFGCapabilities.h b/Source/JavaScriptCore/dfg/DFGCapabilities.h
index e339714e9..6509dbc3d 100644
--- a/Source/JavaScriptCore/dfg/DFGCapabilities.h
+++ b/Source/JavaScriptCore/dfg/DFGCapabilities.h
@@ -57,11 +57,13 @@ inline bool mightCompileFunctionForConstruct(CodeBlock* codeBlock)
 
 inline bool mightInlineFunctionForCall(CodeBlock* codeBlock)
 {
-    return codeBlock->instructionCount() <= Options::maximumFunctionForCallInlineCandidateInstructionCount;
+    return codeBlock->instructionCount() <= Options::maximumFunctionForCallInlineCandidateInstructionCount
+        && !codeBlock->ownerExecutable()->needsActivation();
 }
 inline bool mightInlineFunctionForConstruct(CodeBlock* codeBlock)
 {
-    return codeBlock->instructionCount() <= Options::maximumFunctionForConstructInlineCandidateInstructionCount;
+    return codeBlock->instructionCount() <= Options::maximumFunctionForConstructInlineCandidateInstructionCount
+        && !codeBlock->ownerExecutable()->needsActivation();
 }
 
 // Opcode checking.
@@ -84,6 +86,7 @@ inline bool canCompileOpcode(OpcodeID opcodeID)
     case op_post_dec:
     case op_add:
     case op_sub:
+    case op_negate:
     case op_mul:
     case op_mod:
     case op_div:
@@ -151,21 +154,14 @@ inline bool canCompileOpcode(OpcodeID opcodeID)
     case op_throw_reference_error:
     case op_call:
     case op_construct:
-        return true;
-        
-    // Opcodes we support conditionally. Enabling these opcodes currently results in
-    // performance regressions. Each node that we disable under restrictions has a
-    // comment describing what we know about the regression so far.
-        
-    // Regresses string-validate-input, probably because it uses comparisons (< and >)
-    // on strings, which currently will cause speculation failures in some cases.
     case op_new_regexp: 
-#if DFG_ENABLE(RESTRICTIONS)
-        return false;
-#else
+    case op_init_lazy_reg:
+    case op_create_activation:
+    case op_tear_off_activation:
+    case op_new_func:
+    case op_new_func_exp:
         return true;
-#endif
-      
+        
     default:
         return false;
     }
@@ -191,6 +187,14 @@ inline bool canInlineOpcode(OpcodeID opcodeID)
     case op_new_regexp:
         return false;
         
+    // We don't support inlining code that creates activations or has nested functions.
+    case op_init_lazy_reg:
+    case op_create_activation:
+    case op_tear_off_activation:
+    case op_new_func:
+    case op_new_func_exp:
+        return false;
+        
     default:
         return canCompileOpcode(opcodeID);
     }
diff --git a/Source/JavaScriptCore/dfg/DFGCommon.h b/Source/JavaScriptCore/dfg/DFGCommon.h
index 330504c3e..8ff1e5cdd 100644
--- a/Source/JavaScriptCore/dfg/DFGCommon.h
+++ b/Source/JavaScriptCore/dfg/DFGCommon.h
@@ -53,7 +53,7 @@
 #define DFG_ENABLE_CONSISTENCY_CHECK 0
 // Emit a breakpoint into the head of every generated function, to aid debugging in GDB.
 #define DFG_ENABLE_JIT_BREAK_ON_EVERY_FUNCTION 0
-// Emit a breakpoint into the head of every generated node, to aid debugging in GDB.
+// Emit a breakpoint into the head of every generated block, to aid debugging in GDB.
 #define DFG_ENABLE_JIT_BREAK_ON_EVERY_BLOCK 0
 // Emit a breakpoint into the head of every generated node, to aid debugging in GDB.
 #define DFG_ENABLE_JIT_BREAK_ON_EVERY_NODE 0
@@ -69,10 +69,11 @@
 #define DFG_ENABLE_OSR_ENTRY ENABLE(DFG_JIT)
 // Generate stats on how successful we were in making use of the DFG jit, and remaining on the hot path.
 #define DFG_ENABLE_SUCCESS_STATS 0
-// Used to enable conditionally supported opcodes that currently result in performance regressions.
-#define DFG_ENABLE_RESTRICTIONS 1
 // Enable verification that the DFG is able to insert code for control flow edges.
 #define DFG_ENABLE_EDGE_CODE_VERIFICATION 0
+// Pretend that all variables in the top-level code block got captured. Great
+// for testing code gen for activations.
+#define DFG_ENABLE_ALL_VARIABLES_CAPTURED 0
 
 namespace JSC { namespace DFG {
 
diff --git a/Source/JavaScriptCore/dfg/DFGDriver.cpp b/Source/JavaScriptCore/dfg/DFGDriver.cpp
index 124d7e637..a0af3e6ad 100644
--- a/Source/JavaScriptCore/dfg/DFGDriver.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDriver.cpp
@@ -34,6 +34,7 @@
 #include "DFGCSEPhase.h"
 #include "DFGJITCompiler.h"
 #include "DFGPredictionPropagationPhase.h"
+#include "DFGRedundantPhiEliminationPhase.h"
 #include "DFGVirtualRegisterAllocationPhase.h"
 
 namespace JSC { namespace DFG {
@@ -58,6 +59,7 @@ inline bool compile(CompileMode compileMode, JSGlobalData& globalData, CodeBlock
     if (compileMode == CompileFunction)
         dfg.predictArgumentTypes();
 
+    performRedundantPhiElimination(dfg);
     performArithNodeFlagsInference(dfg);
     performPredictionPropagation(dfg);
     performCSE(dfg);
@@ -70,18 +72,19 @@ inline bool compile(CompileMode compileMode, JSGlobalData& globalData, CodeBlock
 #endif
     
     JITCompiler dataFlowJIT(dfg);
+    bool result;
     if (compileMode == CompileFunction) {
         ASSERT(jitCodeWithArityCheck);
         
-        dataFlowJIT.compileFunction(jitCode, *jitCodeWithArityCheck);
+        result = dataFlowJIT.compileFunction(jitCode, *jitCodeWithArityCheck);
     } else {
         ASSERT(compileMode == CompileOther);
         ASSERT(!jitCodeWithArityCheck);
         
-        dataFlowJIT.compile(jitCode);
+        result = dataFlowJIT.compile(jitCode);
     }
     
-    return true;
+    return result;
 }
 
 bool tryCompile(JSGlobalData& globalData, CodeBlock* codeBlock, JITCode& jitCode)
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
index b8eec93c7..900251e10 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.cpp
+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -41,7 +41,7 @@ static const char* dfgOpNames[] = {
 
 const char *Graph::opName(NodeType op)
 {
-    return dfgOpNames[op & NodeIdMask];
+    return dfgOpNames[op];
 }
 
 const char* Graph::nameOfVariableAccessData(VariableAccessData* variableAccessData)
@@ -120,7 +120,7 @@ void Graph::dumpCodeOrigin(NodeIndex nodeIndex)
 void Graph::dump(NodeIndex nodeIndex)
 {
     Node& node = at(nodeIndex);
-    NodeType op = node.op;
+    NodeType op = static_cast<NodeType>(node.op);
 
     unsigned refCount = node.refCount();
     bool skipped = !refCount;
@@ -157,7 +157,7 @@ void Graph::dump(NodeIndex nodeIndex)
         dataLog("-");
     dataLog(">\t%s(", opName(op));
     bool hasPrinted = false;
-    if (op & NodeHasVarArgs) {
+    if (node.flags & NodeHasVarArgs) {
         for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++) {
             if (hasPrinted)
                 dataLog(", ");
@@ -175,8 +175,8 @@ void Graph::dump(NodeIndex nodeIndex)
         hasPrinted = !!node.child1();
     }
 
-    if (node.hasArithNodeFlags()) {
-        dataLog("%s%s", hasPrinted ? ", " : "", arithNodeFlagsAsString(node.rawArithNodeFlags()));
+    if (node.arithNodeFlags()) {
+        dataLog("%s%s", hasPrinted ? ", " : "", arithNodeFlagsAsString(node.arithNodeFlags()));
         hasPrinted = true;
     }
     if (node.hasVarNumber()) {
@@ -265,6 +265,12 @@ void Graph::dump()
     for (size_t b = 0; b < m_blocks.size(); ++b) {
         BasicBlock* block = m_blocks[b].get();
         dataLog("Block #%u (bc#%u): %s%s\n", (int)b, block->bytecodeBegin, block->isReachable ? "" : " (skipped)", block->isOSRTarget ? " (OSR target)" : "");
+        dataLog("  Phi Nodes:\n");
+        for (size_t i = 0; i < block->phis.size(); ++i) {
+            // Dumping the dead Phi nodes is just annoying!
+            if (at(block->phis[i]).refCount())
+                dump(block->phis[i]);
+        }
         dataLog("  vars before: ");
         if (block->cfaHasVisited)
             dumpOperands(block->valuesAtHead, WTF::dataFile());
@@ -274,8 +280,8 @@ void Graph::dump()
         dataLog("  var links: ");
         dumpOperands(block->variablesAtHead, WTF::dataFile());
         dataLog("\n");
-        for (size_t i = block->begin; i < block->end; ++i)
-            dump(i);
+        for (size_t i = 0; i < block->size(); ++i)
+            dump(block->at(i));
         dataLog("  vars after: ");
         if (block->cfaHasVisited)
             dumpOperands(block->valuesAtTail, WTF::dataFile());
@@ -283,15 +289,12 @@ void Graph::dump()
             dataLog("<empty>");
         dataLog("\n");
     }
-    dataLog("Phi Nodes:\n");
-    for (size_t i = m_blocks.last()->end; i < size(); ++i)
-        dump(i);
 }
 
 // FIXME: Convert this to be iterative, not recursive.
 #define DO_TO_CHILDREN(node, thingToDo) do {                            \
         Node& _node = (node);                                           \
-        if (_node.op & NodeHasVarArgs) {                                \
+        if (_node.flags & NodeHasVarArgs) {                             \
             for (unsigned _childIdx = _node.firstChild();               \
                  _childIdx < _node.firstChild() + _node.numChildren();  \
                  _childIdx++)                                           \
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index 88d6a4eec..bacbac827 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -177,6 +177,12 @@ public:
         return Node::shouldSpeculateInteger(left, right) && add.canSpeculateInteger();
     }
     
+    bool negateShouldSpeculateInteger(Node& negate)
+    {
+        ASSERT(negate.op == ArithNegate);
+        return at(negate.child1()).shouldSpeculateInteger() && negate.canSpeculateInteger();
+    }
+    
     bool addShouldSpeculateInteger(NodeIndex nodeIndex)
     {
         return addShouldSpeculateInteger(at(nodeIndex));
@@ -305,6 +311,41 @@ public:
         return MethodOfGettingAValueProfile(valueProfileFor(nodeIndex));
     }
     
+    bool needsActivation() const
+    {
+#if DFG_ENABLE(ALL_VARIABLES_CAPTURED)
+        return true;
+#else
+        return m_codeBlock->needsFullScopeChain() && m_codeBlock->codeType() != GlobalCode;
+#endif
+    }
+    
+    // Pass an argument index. Currently it's ignored, but that's somewhat
+    // of a bug.
+    bool argumentIsCaptured(int) const
+    {
+        return needsActivation();
+    }
+    bool localIsCaptured(int operand) const
+    {
+#if DFG_ENABLE(ALL_VARIABLES_CAPTURED)
+        return operand < m_codeBlock->m_numVars;
+#else
+        return operand < m_codeBlock->m_numCapturedVars;
+#endif
+    }
+    
+    bool isCaptured(int operand) const
+    {
+        if (operandIsArgument(operand))
+            return argumentIsCaptured(operandToArgument(operand));
+        return localIsCaptured(operand);
+    }
+    bool isCaptured(VirtualRegister virtualRegister) const
+    {
+        return isCaptured(static_cast<int>(virtualRegister));
+    }
+    
     JSGlobalData& m_globalData;
     CodeBlock* m_codeBlock;
     CodeBlock* m_profiledBlock;
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
index 7b2bbc788..af98f8d7a 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
@@ -44,7 +44,7 @@ void JITCompiler::linkOSRExits()
     for (unsigned i = 0; i < codeBlock()->numberOfOSRExits(); ++i) {
         OSRExit& exit = codeBlock()->osrExit(i);
         exit.m_check.initialJump().link(this);
-        store32(Imm32(i), &globalData()->osrExitIndex);
+        store32(TrustedImm32(i), &globalData()->osrExitIndex);
         beginUninterruptedSequence();
         exit.m_check.switchToLateJump(jump());
         endUninterruptedSequence();
@@ -75,7 +75,7 @@ void JITCompiler::compileBody(SpeculativeJIT& speculative)
     breakpoint();
 #endif
     
-    addPtr(Imm32(1), AbsoluteAddress(codeBlock()->addressOfSpeculativeSuccessCounter()));
+    addPtr(TrustedImm32(1), AbsoluteAddress(codeBlock()->addressOfSpeculativeSuccessCounter()));
 
     bool compiledSpeculative = speculative.compile();
     ASSERT_UNUSED(compiledSpeculative, compiledSpeculative);
@@ -195,7 +195,7 @@ void JITCompiler::link(LinkBuffer& linkBuffer)
     codeBlock()->shrinkWeakReferenceTransitionsToFit();
 }
 
-void JITCompiler::compile(JITCode& entry)
+bool JITCompiler::compile(JITCode& entry)
 {
     compileEntry();
     SpeculativeJIT speculative(*this);
@@ -204,14 +204,17 @@ void JITCompiler::compile(JITCode& entry)
     // Create OSR entry trampolines if necessary.
     speculative.createOSREntries();
 
-    LinkBuffer linkBuffer(*m_globalData, this, m_codeBlock);
+    LinkBuffer linkBuffer(*m_globalData, this, m_codeBlock, JITCompilationCanFail);
+    if (linkBuffer.didFailToAllocate())
+        return false;
     link(linkBuffer);
     speculative.linkOSREntries(linkBuffer);
 
     entry = JITCode(linkBuffer.finalizeCode(), JITCode::DFGJIT);
+    return true;
 }
 
-void JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWithArityCheck)
+bool JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWithArityCheck)
 {
     compileEntry();
 
@@ -222,7 +225,7 @@ void JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWi
     Label fromArityCheck(this);
     // Plant a check that sufficient space is available in the RegisterFile.
     // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56291
-    addPtr(Imm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::regT1);
+    addPtr(TrustedImm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::regT1);
     Jump registerFileCheck = branchPtr(Below, AbsoluteAddress(m_globalData->interpreter->registerFile().addressOfEnd()), GPRInfo::regT1);
     // Return here after register file check.
     Label fromRegisterFileCheck = label();
@@ -258,7 +261,7 @@ void JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWi
     compileEntry();
 
     load32(AssemblyHelpers::payloadFor((VirtualRegister)RegisterFile::ArgumentCount), GPRInfo::regT1);
-    branch32(AboveOrEqual, GPRInfo::regT1, Imm32(m_codeBlock->numParameters())).linkTo(fromArityCheck, this);
+    branch32(AboveOrEqual, GPRInfo::regT1, TrustedImm32(m_codeBlock->numParameters())).linkTo(fromArityCheck, this);
     move(stackPointerRegister, GPRInfo::argumentGPR0);
     poke(GPRInfo::callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
     token = beginCall();
@@ -272,7 +275,9 @@ void JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWi
 
 
     // === Link ===
-    LinkBuffer linkBuffer(*m_globalData, this, m_codeBlock);
+    LinkBuffer linkBuffer(*m_globalData, this, m_codeBlock, JITCompilationCanFail);
+    if (linkBuffer.didFailToAllocate())
+        return false;
     link(linkBuffer);
     speculative.linkOSREntries(linkBuffer);
     
@@ -282,6 +287,7 @@ void JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWi
 
     entryWithArityCheck = linkBuffer.locationOf(arityCheck);
     entry = JITCode(linkBuffer.finalizeCode(), JITCode::DFGJIT);
+    return true;
 }
 
 } } // namespace JSC::DFG
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.h b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
index a0c68fe4b..2df2703b0 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.h
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
@@ -194,8 +194,8 @@ public:
     {
     }
 
-    void compile(JITCode& entry);
-    void compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWithArityCheck);
+    bool compile(JITCode& entry);
+    bool compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWithArityCheck);
 
     // Accessors for properties.
     Graph& graph() { return m_graph; }
@@ -297,12 +297,13 @@ public:
         // value of (None, []). But the old JIT may stash some values there. So we really
         // need (Top, TOP).
         for (size_t argument = 0; argument < basicBlock.variablesAtHead.numberOfArguments(); ++argument) {
-            if (basicBlock.variablesAtHead.argument(argument) == NoNode)
+            NodeIndex nodeIndex = basicBlock.variablesAtHead.argument(argument);
+            if (nodeIndex == NoNode || !m_graph[nodeIndex].shouldGenerate())
                 entry->m_expectedValues.argument(argument).makeTop();
         }
         for (size_t local = 0; local < basicBlock.variablesAtHead.numberOfLocals(); ++local) {
             NodeIndex nodeIndex = basicBlock.variablesAtHead.local(local);
-            if (nodeIndex == NoNode)
+            if (nodeIndex == NoNode || !m_graph[nodeIndex].shouldGenerate())
                 entry->m_expectedValues.local(local).makeTop();
             else if (m_graph[nodeIndex].variableAccessData()->shouldUseDoubleFormat())
                 entry->m_localsForcedDouble.set(local);
diff --git a/Source/JavaScriptCore/dfg/DFGNode.cpp b/Source/JavaScriptCore/dfg/DFGNode.cpp
new file mode 100644
index 000000000..c53817ba9
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGNode.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGNode.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+const char* arithNodeFlagsAsString(NodeFlags flags)
+{
+    flags &= NodeArithMask;
+    
+    if (!flags)
+        return "<empty>";
+
+    static const int size = 64;
+    static char description[size];
+    BoundsCheckedPointer<char> ptr(description, size);
+    
+    bool hasPrinted = false;
+    
+    if (flags & NodeUsedAsNumber) {
+        ptr.strcat("UsedAsNum");
+        hasPrinted = true;
+    }
+    
+    if (flags & NodeNeedsNegZero) {
+        if (hasPrinted)
+            ptr.strcat("|");
+        ptr.strcat("NeedsNegZero");
+        hasPrinted = true;
+    }
+    
+    if (flags & NodeMayOverflow) {
+        if (hasPrinted)
+            ptr.strcat("|");
+        ptr.strcat("MayOverflow");
+        hasPrinted = true;
+    }
+    
+    if (flags & NodeMayNegZero) {
+        if (hasPrinted)
+            ptr.strcat("|");
+        ptr.strcat("MayNegZero");
+        hasPrinted = true;
+    }
+    
+    *ptr++ = 0;
+    
+    return description;
+}
+
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
index 87dae7786..b672b67c5 100644
--- a/Source/JavaScriptCore/dfg/DFGNode.h
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -57,36 +57,50 @@ struct StructureTransitionData {
     }
 };
 
-typedef unsigned ArithNodeFlags;
-#define NodeUseBottom      0x00
-#define NodeUsedAsNumber   0x01
-#define NodeNeedsNegZero   0x02
-#define NodeUsedAsMask     0x03
-#define NodeMayOverflow    0x04
-#define NodeMayNegZero     0x08
-#define NodeBehaviorMask   0x0c
+// Entries in the NodeType enum (below) are composed of an id, a result type (possibly none)
+// and some additional informative flags (must generate, is constant, etc).
+#define NodeResultMask       0xF
+#define NodeResultJS         0x1
+#define NodeResultNumber     0x2
+#define NodeResultInt32      0x3
+#define NodeResultBoolean    0x4
+#define NodeResultStorage    0x5
+#define NodeMustGenerate    0x10 // set on nodes that have side effects, and may not trivially be removed by DCE.
+#define NodeHasVarArgs      0x20
+#define NodeClobbersWorld   0x40
+#define NodeMightClobber    0x80
+#define NodeArithMask      0xF00
+#define NodeUseBottom      0x000
+#define NodeUsedAsNumber   0x100
+#define NodeNeedsNegZero   0x200
+#define NodeUsedAsMask     0x300
+#define NodeMayOverflow    0x400
+#define NodeMayNegZero     0x800
+#define NodeBehaviorMask   0xc00
 
-static inline bool nodeUsedAsNumber(ArithNodeFlags flags)
+typedef uint16_t NodeFlags;
+
+static inline bool nodeUsedAsNumber(NodeFlags flags)
 {
     return !!(flags & NodeUsedAsNumber);
 }
 
-static inline bool nodeCanTruncateInteger(ArithNodeFlags flags)
+static inline bool nodeCanTruncateInteger(NodeFlags flags)
 {
     return !nodeUsedAsNumber(flags);
 }
 
-static inline bool nodeCanIgnoreNegativeZero(ArithNodeFlags flags)
+static inline bool nodeCanIgnoreNegativeZero(NodeFlags flags)
 {
     return !(flags & NodeNeedsNegZero);
 }
 
-static inline bool nodeMayOverflow(ArithNodeFlags flags)
+static inline bool nodeMayOverflow(NodeFlags flags)
 {
     return !!(flags & NodeMayOverflow);
 }
 
-static inline bool nodeCanSpeculateInteger(ArithNodeFlags flags)
+static inline bool nodeCanSpeculateInteger(NodeFlags flags)
 {
     if (flags & NodeMayOverflow)
         return !nodeUsedAsNumber(flags);
@@ -97,67 +111,7 @@ static inline bool nodeCanSpeculateInteger(ArithNodeFlags flags)
     return true;
 }
 
-static inline const char* arithNodeFlagsAsString(ArithNodeFlags flags)
-{
-    if (!flags)
-        return "<empty>";
-
-    static const int size = 64;
-    static char description[size];
-    BoundsCheckedPointer<char> ptr(description, size);
-    
-    bool hasPrinted = false;
-    
-    if (flags & NodeUsedAsNumber) {
-        ptr.strcat("UsedAsNum");
-        hasPrinted = true;
-    }
-    
-    if (flags & NodeNeedsNegZero) {
-        if (hasPrinted)
-            ptr.strcat("|");
-        ptr.strcat("NeedsNegZero");
-        hasPrinted = true;
-    }
-    
-    if (flags & NodeMayOverflow) {
-        if (hasPrinted)
-            ptr.strcat("|");
-        ptr.strcat("MayOverflow");
-        hasPrinted = true;
-    }
-    
-    if (flags & NodeMayNegZero) {
-        if (hasPrinted)
-            ptr.strcat("|");
-        ptr.strcat("MayNegZero");
-        hasPrinted = true;
-    }
-    
-    *ptr++ = 0;
-    
-    return description;
-}
-
-// Entries in the NodeType enum (below) are composed of an id, a result type (possibly none)
-// and some additional informative flags (must generate, is constant, etc).
-#define NodeIdMask           0xFFF
-#define NodeResultMask      0xF000
-#define NodeMustGenerate   0x10000 // set on nodes that have side effects, and may not trivially be removed by DCE.
-#define NodeIsConstant     0x20000
-#define NodeIsJump         0x40000
-#define NodeIsBranch       0x80000
-#define NodeIsTerminal    0x100000
-#define NodeHasVarArgs    0x200000
-#define NodeClobbersWorld 0x400000
-#define NodeMightClobber  0x800000
-
-// These values record the result type of the node (as checked by NodeResultMask, above), 0 for no result.
-#define NodeResultJS        0x1000
-#define NodeResultNumber    0x2000
-#define NodeResultInt32     0x3000
-#define NodeResultBoolean   0x4000
-#define NodeResultStorage   0x5000
+const char* arithNodeFlagsAsString(NodeFlags);
 
 // This macro defines a set of information about all known node types, used to populate NodeId, NodeType below.
 #define FOR_EACH_DFG_OP(macro) \
@@ -204,6 +158,7 @@ static inline const char* arithNodeFlagsAsString(ArithNodeFlags flags)
     /* Nodes for arithmetic operations. */\
     macro(ArithAdd, NodeResultNumber) \
     macro(ArithSub, NodeResultNumber) \
+    macro(ArithNegate, NodeResultNumber) \
     macro(ArithMul, NodeResultNumber) \
     macro(ArithDiv, NodeResultNumber) \
     macro(ArithMod, NodeResultNumber) \
@@ -291,12 +246,23 @@ static inline const char* arithNodeFlagsAsString(ArithNodeFlags flags)
     macro(ToPrimitive, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
     macro(StrCat, NodeResultJS | NodeMustGenerate | NodeHasVarArgs | NodeClobbersWorld) \
     \
+    /* Nodes used for activations. Activation support works by having it anchored at */\
+    /* epilgoues via TearOffActivation, and all CreateActivation nodes kept alive by */\
+    /* being threaded with each other. */\
+    macro(CreateActivation, NodeResultJS) \
+    macro(TearOffActivation, NodeMustGenerate) \
+    \
+    /* Nodes for creating functions. */\
+    macro(NewFunctionNoCheck, NodeResultJS) \
+    macro(NewFunction, NodeResultJS) \
+    macro(NewFunctionExpression, NodeResultJS) \
+    \
     /* Block terminals. */\
-    macro(Jump, NodeMustGenerate | NodeIsTerminal | NodeIsJump) \
-    macro(Branch, NodeMustGenerate | NodeIsTerminal | NodeIsBranch) \
-    macro(Return, NodeMustGenerate | NodeIsTerminal) \
-    macro(Throw, NodeMustGenerate | NodeIsTerminal) \
-    macro(ThrowReferenceError, NodeMustGenerate | NodeIsTerminal) \
+    macro(Jump, NodeMustGenerate) \
+    macro(Branch, NodeMustGenerate) \
+    macro(Return, NodeMustGenerate) \
+    macro(Throw, NodeMustGenerate) \
+    macro(ThrowReferenceError, NodeMustGenerate) \
     \
     /* This is a pseudo-terminal. It means that execution should fall out of DFG at */\
     /* this point, but execution does continue in the basic block - just in a */\
@@ -305,20 +271,25 @@ static inline const char* arithNodeFlagsAsString(ArithNodeFlags flags)
 
 // This enum generates a monotonically increasing id for all Node types,
 // and is used by the subsequent enum to fill out the id (as accessed via the NodeIdMask).
-enum NodeId {
-#define DFG_OP_ENUM(opcode, flags) opcode##_id,
+enum NodeType {
+#define DFG_OP_ENUM(opcode, flags) opcode,
     FOR_EACH_DFG_OP(DFG_OP_ENUM)
 #undef DFG_OP_ENUM
-    LastNodeId
+    LastNodeType
 };
 
-// Entries in this enum describe all Node types.
-// The enum value contains a monotonically increasing id, a result type, and additional flags.
-enum NodeType {
-#define DFG_OP_ENUM(opcode, flags) opcode = opcode##_id | (flags),
+// Specifies the default flags for each node.
+inline NodeFlags defaultFlags(NodeType op)
+{
+    switch (op) {
+#define DFG_OP_ENUM(opcode, flags) case opcode: return flags;
     FOR_EACH_DFG_OP(DFG_OP_ENUM)
 #undef DFG_OP_ENUM
-};
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
 
 // This type used in passing an immediate argument to Node constructor;
 // distinguishes an immediate value (typically an index into a CodeBlock data structure - 
@@ -341,34 +312,32 @@ struct Node {
 
     // Construct a node with up to 3 children, no immediate value.
     Node(NodeType op, CodeOrigin codeOrigin, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
-        : op(op)
-        , codeOrigin(codeOrigin)
+        : codeOrigin(codeOrigin)
         , children(NodeReferenceBlob::Fixed, child1, child2, child3)
         , m_virtualRegister(InvalidVirtualRegister)
         , m_refCount(0)
         , m_prediction(PredictNone)
     {
-        ASSERT(!(op & NodeHasVarArgs));
-        ASSERT(!hasArithNodeFlags());
+        setOpAndDefaultFlags(op);
+        ASSERT(!(flags & NodeHasVarArgs));
     }
 
     // Construct a node with up to 3 children and an immediate value.
     Node(NodeType op, CodeOrigin codeOrigin, OpInfo imm, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
-        : op(op)
-        , codeOrigin(codeOrigin)
+        : codeOrigin(codeOrigin)
         , children(NodeReferenceBlob::Fixed, child1, child2, child3)
         , m_virtualRegister(InvalidVirtualRegister)
         , m_refCount(0)
         , m_opInfo(imm.m_value)
         , m_prediction(PredictNone)
     {
-        ASSERT(!(op & NodeHasVarArgs));
+        setOpAndDefaultFlags(op);
+        ASSERT(!(flags & NodeHasVarArgs));
     }
 
     // Construct a node with up to 3 children and two immediate values.
     Node(NodeType op, CodeOrigin codeOrigin, OpInfo imm1, OpInfo imm2, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
-        : op(op)
-        , codeOrigin(codeOrigin)
+        : codeOrigin(codeOrigin)
         , children(NodeReferenceBlob::Fixed, child1, child2, child3)
         , m_virtualRegister(InvalidVirtualRegister)
         , m_refCount(0)
@@ -376,13 +345,13 @@ struct Node {
         , m_opInfo2(safeCast<unsigned>(imm2.m_value))
         , m_prediction(PredictNone)
     {
-        ASSERT(!(op & NodeHasVarArgs));
+        setOpAndDefaultFlags(op);
+        ASSERT(!(flags & NodeHasVarArgs));
     }
     
     // Construct a node with a variable number of children and two immediate values.
     Node(VarArgTag, NodeType op, CodeOrigin codeOrigin, OpInfo imm1, OpInfo imm2, unsigned firstChild, unsigned numChildren)
-        : op(op)
-        , codeOrigin(codeOrigin)
+        : codeOrigin(codeOrigin)
         , children(NodeReferenceBlob::Variable, firstChild, numChildren)
         , m_virtualRegister(InvalidVirtualRegister)
         , m_refCount(0)
@@ -390,12 +359,19 @@ struct Node {
         , m_opInfo2(safeCast<unsigned>(imm2.m_value))
         , m_prediction(PredictNone)
     {
-        ASSERT(op & NodeHasVarArgs);
+        setOpAndDefaultFlags(op);
+        ASSERT(flags & NodeHasVarArgs);
+    }
+    
+    void setOpAndDefaultFlags(NodeType op)
+    {
+        this->op = op;
+        flags = defaultFlags(op);
     }
 
     bool mustGenerate()
     {
-        return op & NodeMustGenerate;
+        return flags & NodeMustGenerate;
     }
 
     bool isConstant()
@@ -520,6 +496,7 @@ struct Node {
         case UInt32ToNumber:
         case ArithAdd:
         case ArithSub:
+        case ArithNegate:
         case ArithMul:
         case ArithAbs:
         case ArithMin:
@@ -533,44 +510,32 @@ struct Node {
         }
     }
     
-    ArithNodeFlags rawArithNodeFlags()
-    {
-        ASSERT(hasArithNodeFlags());
-        return m_opInfo;
-    }
-    
     // This corrects the arithmetic node flags, so that irrelevant bits are
     // ignored. In particular, anything other than ArithMul does not need
     // to know if it can speculate on negative zero.
-    ArithNodeFlags arithNodeFlags()
+    NodeFlags arithNodeFlags()
     {
-        ArithNodeFlags result = rawArithNodeFlags();
+        NodeFlags result = flags & NodeArithMask;
         if (op == ArithMul)
             return result;
         return result & ~NodeNeedsNegZero;
     }
     
-    ArithNodeFlags arithNodeFlagsForCompare()
-    {
-        if (hasArithNodeFlags())
-            return arithNodeFlags();
-        return 0;
-    }
-    
-    void setArithNodeFlag(ArithNodeFlags flags)
+    void setArithNodeFlag(NodeFlags newFlags)
     {
-        ASSERT(hasArithNodeFlags());
-        m_opInfo = flags;
+        ASSERT(!(newFlags & ~NodeArithMask));
+        
+        flags &= ~NodeArithMask;
+        flags |= newFlags;
     }
     
-    bool mergeArithNodeFlags(ArithNodeFlags flags)
+    bool mergeArithNodeFlags(NodeFlags newFlags)
     {
-        if (!hasArithNodeFlags())
+        ASSERT(!(newFlags & ~NodeArithMask));
+        newFlags = flags | newFlags;
+        if (newFlags == flags)
             return false;
-        ArithNodeFlags newFlags = m_opInfo | flags;
-        if (newFlags == m_opInfo)
-            return false;
-        m_opInfo = newFlags;
+        flags = newFlags;
         return true;
     }
     
@@ -626,42 +591,51 @@ struct Node {
 
     bool hasResult()
     {
-        return op & NodeResultMask;
+        return flags & NodeResultMask;
     }
 
     bool hasInt32Result()
     {
-        return (op & NodeResultMask) == NodeResultInt32;
+        return (flags & NodeResultMask) == NodeResultInt32;
     }
     
     bool hasNumberResult()
     {
-        return (op & NodeResultMask) == NodeResultNumber;
+        return (flags & NodeResultMask) == NodeResultNumber;
     }
     
     bool hasJSResult()
     {
-        return (op & NodeResultMask) == NodeResultJS;
+        return (flags & NodeResultMask) == NodeResultJS;
     }
     
     bool hasBooleanResult()
     {
-        return (op & NodeResultMask) == NodeResultBoolean;
+        return (flags & NodeResultMask) == NodeResultBoolean;
     }
 
     bool isJump()
     {
-        return op & NodeIsJump;
+        return op == Jump;
     }
 
     bool isBranch()
     {
-        return op & NodeIsBranch;
+        return op == Branch;
     }
 
     bool isTerminal()
     {
-        return op & NodeIsTerminal;
+        switch (op) {
+        case Jump:
+        case Branch:
+        case Return:
+        case Throw:
+        case ThrowReferenceError:
+            return true;
+        default:
+            return false;
+        }
     }
 
     unsigned takenBytecodeOffsetDuringParsing()
@@ -775,6 +749,30 @@ struct Node {
     
     unsigned storageAccessDataIndex()
     {
+        ASSERT(hasStorageAccessData());
+        return m_opInfo;
+    }
+    
+    bool hasFunctionDeclIndex()
+    {
+        return op == NewFunction
+            || op == NewFunctionNoCheck;
+    }
+    
+    unsigned functionDeclIndex()
+    {
+        ASSERT(hasFunctionDeclIndex());
+        return m_opInfo;
+    }
+    
+    bool hasFunctionExprIndex()
+    {
+        return op == NewFunctionExpression;
+    }
+    
+    unsigned functionExprIndex()
+    {
+        ASSERT(hasFunctionExprIndex());
         return m_opInfo;
     }
     
@@ -799,7 +797,7 @@ struct Node {
 
     bool shouldGenerate()
     {
-        return m_refCount && op != Phi && op != Flush;
+        return m_refCount;
     }
 
     unsigned refCount()
@@ -834,7 +832,7 @@ struct Node {
     
     NodeUse child1()
     {
-        ASSERT(!(op & NodeHasVarArgs));
+        ASSERT(!(flags & NodeHasVarArgs));
         return children.child1();
     }
     
@@ -848,25 +846,25 @@ struct Node {
 
     NodeUse child2()
     {
-        ASSERT(!(op & NodeHasVarArgs));
+        ASSERT(!(flags & NodeHasVarArgs));
         return children.child2();
     }
 
     NodeUse child3()
     {
-        ASSERT(!(op & NodeHasVarArgs));
+        ASSERT(!(flags & NodeHasVarArgs));
         return children.child3();
     }
     
     unsigned firstChild()
     {
-        ASSERT(op & NodeHasVarArgs);
+        ASSERT(flags & NodeHasVarArgs);
         return children.firstChild();
     }
     
     unsigned numChildren()
     {
-        ASSERT(op & NodeHasVarArgs);
+        ASSERT(flags & NodeHasVarArgs);
         return children.numChildren();
     }
     
@@ -1032,8 +1030,8 @@ struct Node {
         fprintf(out, ", @%u", child3().index());
     }
     
-    // This enum value describes the type of the node.
-    NodeType op;
+    uint16_t op; // real type is NodeType
+    NodeFlags flags;
     // Used to look up exception handling information (currently implemented as a bytecode index).
     CodeOrigin codeOrigin;
     // References to up to 3 children, or links to a variable length set of children.
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
index a672234a3..bd45020d1 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
@@ -98,7 +98,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             m_jit.store32(scratch, &bitwise_cast<EncodedValueDescriptor*>(bucket)->asBits.payload);
             m_jit.load32(scratchBuffer, scratch);
         } else if (exit.m_jsValueSource.hasKnownTag()) {
-            m_jit.store32(AssemblyHelpers::Imm32(exit.m_jsValueSource.tag()), &bitwise_cast<EncodedValueDescriptor*>(bucket)->asBits.tag);
+            m_jit.store32(AssemblyHelpers::TrustedImm32(exit.m_jsValueSource.tag()), &bitwise_cast<EncodedValueDescriptor*>(bucket)->asBits.tag);
             m_jit.store32(exit.m_jsValueSource.payloadGPR(), &bitwise_cast<EncodedValueDescriptor*>(bucket)->asBits.payload);
         } else {
             m_jit.store32(exit.m_jsValueSource.tagGPR(), &bitwise_cast<EncodedValueDescriptor*>(bucket)->asBits.tag);
@@ -562,32 +562,40 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     //     counter to 0; otherwise we set the counter to
     //     counterValueForOptimizeAfterWarmUp().
     
-    m_jit.add32(AssemblyHelpers::Imm32(1), AssemblyHelpers::AbsoluteAddress(&exit.m_count));
+    m_jit.add32(AssemblyHelpers::TrustedImm32(1), AssemblyHelpers::AbsoluteAddress(&exit.m_count));
     
     m_jit.move(AssemblyHelpers::TrustedImmPtr(m_jit.codeBlock()), GPRInfo::regT0);
     
     m_jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeFailCounter()), GPRInfo::regT2);
     m_jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeSuccessCounter()), GPRInfo::regT1);
-    m_jit.add32(AssemblyHelpers::Imm32(1), GPRInfo::regT2);
-    m_jit.add32(AssemblyHelpers::Imm32(-1), GPRInfo::regT1);
+    m_jit.add32(AssemblyHelpers::TrustedImm32(1), GPRInfo::regT2);
+    m_jit.add32(AssemblyHelpers::TrustedImm32(-1), GPRInfo::regT1);
     m_jit.store32(GPRInfo::regT2, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeFailCounter()));
     m_jit.store32(GPRInfo::regT1, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeSuccessCounter()));
     
     m_jit.move(AssemblyHelpers::TrustedImmPtr(m_jit.baselineCodeBlock()), GPRInfo::regT0);
     
-    AssemblyHelpers::Jump fewFails = m_jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, AssemblyHelpers::Imm32(m_jit.codeBlock()->largeFailCountThreshold()));
-    m_jit.mul32(AssemblyHelpers::Imm32(Options::desiredSpeculativeSuccessFailRatio), GPRInfo::regT2, GPRInfo::regT2);
+    AssemblyHelpers::Jump fewFails = m_jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, AssemblyHelpers::TrustedImm32(m_jit.codeBlock()->largeFailCountThreshold()));
+    m_jit.mul32(AssemblyHelpers::TrustedImm32(Options::desiredSpeculativeSuccessFailRatio), GPRInfo::regT2, GPRInfo::regT2);
     
     AssemblyHelpers::Jump lowFailRate = m_jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, GPRInfo::regT1);
     
     // Reoptimize as soon as possible.
-    m_jit.store32(AssemblyHelpers::Imm32(Options::executionCounterValueForOptimizeNextInvocation), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()));
+    m_jit.store32(AssemblyHelpers::TrustedImm32(0), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()));
+    m_jit.store32(AssemblyHelpers::TrustedImm32(0), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecutionActiveThreshold()));
     AssemblyHelpers::Jump doneAdjusting = m_jit.jump();
     
     fewFails.link(&m_jit);
     lowFailRate.link(&m_jit);
     
-    m_jit.store32(AssemblyHelpers::Imm32(m_jit.baselineCodeBlock()->counterValueForOptimizeAfterLongWarmUp()), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()));
+    // Adjust the execution counter such that the target is to only optimize after a while.
+    int32_t targetValue =
+        ExecutionCounter::applyMemoryUsageHeuristicsAndConvertToInt(
+            m_jit.baselineCodeBlock()->counterValueForOptimizeAfterLongWarmUp(),
+            m_jit.baselineCodeBlock());
+    m_jit.store32(AssemblyHelpers::TrustedImm32(-targetValue), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()));
+    m_jit.store32(AssemblyHelpers::TrustedImm32(targetValue), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecutionActiveThreshold()));
+    m_jit.store32(AssemblyHelpers::TrustedImm32(ExecutionCounter::formattedTotalCount(targetValue)), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecutionTotalCount()));
     
     doneAdjusting.link(&m_jit);
     
@@ -618,24 +626,24 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
 
         GPRReg callerFrameGPR;
         if (inlineCallFrame->caller.inlineCallFrame) {
-            m_jit.add32(AssemblyHelpers::Imm32(inlineCallFrame->caller.inlineCallFrame->stackOffset * sizeof(EncodedJSValue)), GPRInfo::callFrameRegister, GPRInfo::regT3);
+            m_jit.add32(AssemblyHelpers::TrustedImm32(inlineCallFrame->caller.inlineCallFrame->stackOffset * sizeof(EncodedJSValue)), GPRInfo::callFrameRegister, GPRInfo::regT3);
             callerFrameGPR = GPRInfo::regT3;
         } else
             callerFrameGPR = GPRInfo::callFrameRegister;
         
         m_jit.storePtr(AssemblyHelpers::TrustedImmPtr(baselineCodeBlock), AssemblyHelpers::addressFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::CodeBlock)));
-        m_jit.store32(AssemblyHelpers::Imm32(JSValue::CellTag), AssemblyHelpers::tagFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::ScopeChain)));
+        m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::CellTag), AssemblyHelpers::tagFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::ScopeChain)));
         m_jit.storePtr(AssemblyHelpers::TrustedImmPtr(inlineCallFrame->callee->scope()), AssemblyHelpers::payloadFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::ScopeChain)));
-        m_jit.store32(AssemblyHelpers::Imm32(JSValue::CellTag), AssemblyHelpers::tagFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::CallerFrame)));
+        m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::CellTag), AssemblyHelpers::tagFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::CallerFrame)));
         m_jit.storePtr(callerFrameGPR, AssemblyHelpers::payloadFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::CallerFrame)));
         m_jit.storePtr(AssemblyHelpers::TrustedImmPtr(jumpTarget), AssemblyHelpers::payloadFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::ReturnPC)));
-        m_jit.store32(AssemblyHelpers::Imm32(inlineCallFrame->arguments.size()), AssemblyHelpers::payloadFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::ArgumentCount)));
-        m_jit.store32(AssemblyHelpers::Imm32(JSValue::CellTag), AssemblyHelpers::tagFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::Callee)));
+        m_jit.store32(AssemblyHelpers::TrustedImm32(inlineCallFrame->arguments.size()), AssemblyHelpers::payloadFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::ArgumentCount)));
+        m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::CellTag), AssemblyHelpers::tagFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::Callee)));
         m_jit.storePtr(AssemblyHelpers::TrustedImmPtr(inlineCallFrame->callee.get()), AssemblyHelpers::payloadFor((VirtualRegister)(inlineCallFrame->stackOffset + RegisterFile::Callee)));
     }
     
     if (exit.m_codeOrigin.inlineCallFrame)
-        m_jit.addPtr(AssemblyHelpers::Imm32(exit.m_codeOrigin.inlineCallFrame->stackOffset * sizeof(EncodedJSValue)), GPRInfo::callFrameRegister);
+        m_jit.addPtr(AssemblyHelpers::TrustedImm32(exit.m_codeOrigin.inlineCallFrame->stackOffset * sizeof(EncodedJSValue)), GPRInfo::callFrameRegister);
 
     // 14) Jump into the corresponding baseline JIT code.
     
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
index f5e03973c..91a515c48 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
@@ -227,7 +227,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
                 break;
                 
             case AlreadyInRegisterFileAsUnboxedInt32:
-                m_jit.store32(AssemblyHelpers::Imm32(static_cast<uint32_t>(TagTypeNumber >> 32)), AssemblyHelpers::tagFor(static_cast<VirtualRegister>(exit.operandForIndex(index))));
+                m_jit.store32(AssemblyHelpers::TrustedImm32(static_cast<uint32_t>(TagTypeNumber >> 32)), AssemblyHelpers::tagFor(static_cast<VirtualRegister>(exit.operandForIndex(index))));
                 break;
                 
             case UInt32InGPR: {
@@ -541,32 +541,40 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     //     counter to 0; otherwise we set the counter to
     //     counterValueForOptimizeAfterWarmUp().
     
-    m_jit.add32(AssemblyHelpers::Imm32(1), AssemblyHelpers::AbsoluteAddress(&exit.m_count));
+    m_jit.add32(AssemblyHelpers::TrustedImm32(1), AssemblyHelpers::AbsoluteAddress(&exit.m_count));
     
     m_jit.move(AssemblyHelpers::TrustedImmPtr(m_jit.codeBlock()), GPRInfo::regT0);
     
     m_jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeFailCounter()), GPRInfo::regT2);
     m_jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeSuccessCounter()), GPRInfo::regT1);
-    m_jit.add32(AssemblyHelpers::Imm32(1), GPRInfo::regT2);
-    m_jit.add32(AssemblyHelpers::Imm32(-1), GPRInfo::regT1);
+    m_jit.add32(AssemblyHelpers::TrustedImm32(1), GPRInfo::regT2);
+    m_jit.add32(AssemblyHelpers::TrustedImm32(-1), GPRInfo::regT1);
     m_jit.store32(GPRInfo::regT2, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeFailCounter()));
     m_jit.store32(GPRInfo::regT1, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeSuccessCounter()));
     
     m_jit.move(AssemblyHelpers::TrustedImmPtr(m_jit.baselineCodeBlock()), GPRInfo::regT0);
     
-    AssemblyHelpers::Jump fewFails = m_jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, AssemblyHelpers::Imm32(m_jit.codeBlock()->largeFailCountThreshold()));
-    m_jit.mul32(AssemblyHelpers::Imm32(Options::desiredSpeculativeSuccessFailRatio), GPRInfo::regT2, GPRInfo::regT2);
+    AssemblyHelpers::Jump fewFails = m_jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, AssemblyHelpers::TrustedImm32(m_jit.codeBlock()->largeFailCountThreshold()));
+    m_jit.mul32(AssemblyHelpers::TrustedImm32(Options::desiredSpeculativeSuccessFailRatio), GPRInfo::regT2, GPRInfo::regT2);
     
     AssemblyHelpers::Jump lowFailRate = m_jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, GPRInfo::regT1);
     
     // Reoptimize as soon as possible.
-    m_jit.store32(AssemblyHelpers::Imm32(Options::executionCounterValueForOptimizeNextInvocation), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()));
+    m_jit.store32(AssemblyHelpers::TrustedImm32(0), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()));
+    m_jit.store32(AssemblyHelpers::TrustedImm32(0), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecutionActiveThreshold()));
     AssemblyHelpers::Jump doneAdjusting = m_jit.jump();
     
     fewFails.link(&m_jit);
     lowFailRate.link(&m_jit);
     
-    m_jit.store32(AssemblyHelpers::Imm32(m_jit.baselineCodeBlock()->counterValueForOptimizeAfterLongWarmUp()), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()));
+    // Adjust the execution counter such that the target is to only optimize after a while.
+    int32_t targetValue =
+        ExecutionCounter::applyMemoryUsageHeuristicsAndConvertToInt(
+            m_jit.baselineCodeBlock()->counterValueForOptimizeAfterLongWarmUp(),
+            m_jit.baselineCodeBlock());
+    m_jit.store32(AssemblyHelpers::TrustedImm32(-targetValue), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()));
+    m_jit.store32(AssemblyHelpers::TrustedImm32(targetValue), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecutionActiveThreshold()));
+    m_jit.store32(AssemblyHelpers::TrustedImm32(ExecutionCounter::formattedTotalCount(targetValue)), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecutionTotalCount()));
     
     doneAdjusting.link(&m_jit);
     
@@ -595,7 +603,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
 
         GPRReg callerFrameGPR;
         if (inlineCallFrame->caller.inlineCallFrame) {
-            m_jit.addPtr(AssemblyHelpers::Imm32(inlineCallFrame->caller.inlineCallFrame->stackOffset * sizeof(EncodedJSValue)), GPRInfo::callFrameRegister, GPRInfo::regT3);
+            m_jit.addPtr(AssemblyHelpers::TrustedImm32(inlineCallFrame->caller.inlineCallFrame->stackOffset * sizeof(EncodedJSValue)), GPRInfo::callFrameRegister, GPRInfo::regT3);
             callerFrameGPR = GPRInfo::regT3;
         } else
             callerFrameGPR = GPRInfo::callFrameRegister;
@@ -609,7 +617,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     }
     
     if (exit.m_codeOrigin.inlineCallFrame)
-        m_jit.addPtr(AssemblyHelpers::Imm32(exit.m_codeOrigin.inlineCallFrame->stackOffset * sizeof(EncodedJSValue)), GPRInfo::callFrameRegister);
+        m_jit.addPtr(AssemblyHelpers::TrustedImm32(exit.m_codeOrigin.inlineCallFrame->stackOffset * sizeof(EncodedJSValue)), GPRInfo::callFrameRegister);
     
     // 16) Jump into the corresponding baseline JIT code.
     
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 165a21416..304c54d95 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -31,10 +31,12 @@
 #include "DFGRepatch.h"
 #include "HostCallReturnValue.h"
 #include "GetterSetter.h"
-#include "InlineASM.h"
+#include <wtf/InlineASM.h>
 #include "Interpreter.h"
+#include "JSActivation.h"
 #include "JSByteArray.h"
 #include "JSGlobalData.h"
+#include "JSStaticScopeObject.h"
 #include "Operations.h"
 
 #if ENABLE(DFG_JIT)
@@ -144,6 +146,7 @@ FUNCTION_WRAPPER_WITH_RETURN_ADDRESS_EJCI(function)
 
 namespace JSC { namespace DFG {
 
+template<bool strict>
 static inline void putByVal(ExecState* exec, JSValue baseValue, uint32_t index, JSValue value)
 {
     JSGlobalData* globalData = &exec->globalData();
@@ -155,7 +158,7 @@ static inline void putByVal(ExecState* exec, JSValue baseValue, uint32_t index,
             return;
         }
 
-        JSArray::putByIndex(array, exec, index, value);
+        JSArray::putByIndex(array, exec, index, value, strict);
         return;
     }
 
@@ -173,7 +176,7 @@ static inline void putByVal(ExecState* exec, JSValue baseValue, uint32_t index,
         }
     }
 
-    baseValue.put(exec, index, value);
+    baseValue.putByIndex(exec, index, value, strict);
 }
 
 template<bool strict>
@@ -187,7 +190,7 @@ ALWAYS_INLINE static void DFG_OPERATION operationPutByValInternal(ExecState* exe
     JSValue value = JSValue::decode(encodedValue);
 
     if (LIKELY(property.isUInt32())) {
-        putByVal(exec, baseValue, property.asUInt32(), value);
+        putByVal<strict>(exec, baseValue, property.asUInt32(), value);
         return;
     }
 
@@ -195,7 +198,7 @@ ALWAYS_INLINE static void DFG_OPERATION operationPutByValInternal(ExecState* exe
         double propertyAsDouble = property.asDouble();
         uint32_t propertyAsUInt32 = static_cast<uint32_t>(propertyAsDouble);
         if (propertyAsDouble == propertyAsUInt32) {
-            putByVal(exec, baseValue, propertyAsUInt32, value);
+            putByVal<strict>(exec, baseValue, propertyAsUInt32, value);
             return;
         }
     }
@@ -471,14 +474,24 @@ void DFG_OPERATION operationPutByValCellNonStrict(ExecState* exec, JSCell* cell,
     operationPutByValInternal<false>(exec, JSValue::encode(cell), encodedProperty, encodedValue);
 }
 
-void DFG_OPERATION operationPutByValBeyondArrayBounds(ExecState* exec, JSArray* array, int32_t index, EncodedJSValue encodedValue)
+void DFG_OPERATION operationPutByValBeyondArrayBoundsStrict(ExecState* exec, JSArray* array, int32_t index, EncodedJSValue encodedValue)
+{
+    JSGlobalData* globalData = &exec->globalData();
+    NativeCallFrameTracer tracer(globalData, exec);
+    
+    // We should only get here if index is outside the existing vector.
+    ASSERT(!array->canSetIndex(index));
+    JSArray::putByIndex(array, exec, index, JSValue::decode(encodedValue), true);
+}
+
+void DFG_OPERATION operationPutByValBeyondArrayBoundsNonStrict(ExecState* exec, JSArray* array, int32_t index, EncodedJSValue encodedValue)
 {
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
     // We should only get here if index is outside the existing vector.
     ASSERT(!array->canSetIndex(index));
-    JSArray::putByIndex(array, exec, index, JSValue::decode(encodedValue));
+    JSArray::putByIndex(array, exec, index, JSValue::decode(encodedValue), false);
 }
 
 EncodedJSValue DFG_OPERATION operationArrayPush(ExecState* exec, EncodedJSValue encodedValue, JSArray* array)
@@ -734,8 +747,11 @@ size_t DFG_OPERATION operationCompareStrictEq(ExecState* exec, EncodedJSValue en
 {
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
+
+    JSValue src1 = JSValue::decode(encodedOp1);
+    JSValue src2 = JSValue::decode(encodedOp2);
     
-    return JSValue::strictEqual(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+    return JSValue::strictEqual(exec, src1, src2);
 }
 
 static void* handleHostCall(ExecState* execCallee, JSValue callee, CodeSpecializationKind kind)
@@ -974,6 +990,43 @@ EncodedJSValue DFG_OPERATION operationNewRegexp(ExecState* exec, void* regexpPtr
     return JSValue::encode(RegExpObject::create(exec->globalData(), exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regexp));
 }
 
+JSCell* DFG_OPERATION operationCreateActivation(ExecState* exec)
+{
+    JSGlobalData& globalData = exec->globalData();
+    JSActivation* activation = JSActivation::create(
+        globalData, exec, static_cast<FunctionExecutable*>(exec->codeBlock()->ownerExecutable()));
+    exec->setScopeChain(exec->scopeChain()->push(activation));
+    return activation;
+}
+
+void DFG_OPERATION operationTearOffActivation(ExecState* exec, JSCell* activation)
+{
+    ASSERT(activation);
+    ASSERT(activation->inherits(&JSActivation::s_info));
+    static_cast<JSActivation*>(activation)->tearOff(exec->globalData());
+}
+
+JSCell* DFG_OPERATION operationNewFunction(ExecState* exec, JSCell* functionExecutable)
+{
+    ASSERT(functionExecutable->inherits(&FunctionExecutable::s_info));
+    return static_cast<FunctionExecutable*>(functionExecutable)->make(exec, exec->scopeChain());
+}
+
+JSCell* DFG_OPERATION operationNewFunctionExpression(ExecState* exec, JSCell* functionExecutableAsCell)
+{
+    ASSERT(functionExecutableAsCell->inherits(&FunctionExecutable::s_info));
+    FunctionExecutable* functionExecutable =
+        static_cast<FunctionExecutable*>(functionExecutableAsCell);
+    JSFunction *function = functionExecutable->make(exec, exec->scopeChain());
+    if (!functionExecutable->name().isNull()) {
+        JSStaticScopeObject* functionScopeObject =
+            JSStaticScopeObject::create(
+                exec, functionExecutable->name(), function, ReadOnly | DontDelete);
+        function->setScope(exec->globalData(), function->scope()->push(functionScopeObject));
+    }
+    return function;
+}
+
 DFGHandlerEncoded DFG_OPERATION lookupExceptionHandler(ExecState* exec, uint32_t callIndex)
 {
     JSGlobalData* globalData = &exec->globalData();
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
index cdb88de27..4ca58d621 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.h
+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
@@ -89,6 +89,7 @@ typedef void DFG_OPERATION (*V_DFGOperation_EAZJ)(ExecState*, JSArray*, int32_t,
 typedef double DFG_OPERATION (*D_DFGOperation_DD)(double, double);
 typedef double DFG_OPERATION (*D_DFGOperation_EJ)(ExecState*, EncodedJSValue);
 typedef void* DFG_OPERATION (*P_DFGOperation_E)(ExecState*);
+typedef void DFG_OPERATION (V_DFGOperation_EC)(ExecState*, JSCell*);
 
 // These routines are provide callbacks out to C++ implementations of operations too complex to JIT.
 JSCell* DFG_OPERATION operationNewObject(ExecState*);
@@ -118,7 +119,8 @@ void DFG_OPERATION operationPutByValStrict(ExecState*, EncodedJSValue encodedBas
 void DFG_OPERATION operationPutByValNonStrict(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue);
 void DFG_OPERATION operationPutByValCellStrict(ExecState*, JSCell*, EncodedJSValue encodedProperty, EncodedJSValue encodedValue);
 void DFG_OPERATION operationPutByValCellNonStrict(ExecState*, JSCell*, EncodedJSValue encodedProperty, EncodedJSValue encodedValue);
-void DFG_OPERATION operationPutByValBeyondArrayBounds(ExecState*, JSArray*, int32_t index, EncodedJSValue encodedValue);
+void DFG_OPERATION operationPutByValBeyondArrayBoundsStrict(ExecState*, JSArray*, int32_t index, EncodedJSValue encodedValue);
+void DFG_OPERATION operationPutByValBeyondArrayBoundsNonStrict(ExecState*, JSArray*, int32_t index, EncodedJSValue encodedValue);
 EncodedJSValue DFG_OPERATION operationArrayPush(ExecState*, EncodedJSValue encodedValue, JSArray*);
 EncodedJSValue DFG_OPERATION operationArrayPop(ExecState*, JSArray*);
 void DFG_OPERATION operationPutByIdStrict(ExecState*, EncodedJSValue encodedValue, JSCell* base, Identifier*);
@@ -145,6 +147,10 @@ void* DFG_OPERATION operationVirtualCall(ExecState*);
 void* DFG_OPERATION operationLinkCall(ExecState*);
 void* DFG_OPERATION operationVirtualConstruct(ExecState*);
 void* DFG_OPERATION operationLinkConstruct(ExecState*);
+JSCell* DFG_OPERATION operationCreateActivation(ExecState*);
+void DFG_OPERATION operationTearOffActivation(ExecState*, JSCell*);
+JSCell* DFG_OPERATION operationNewFunction(ExecState*, JSCell*);
+JSCell* DFG_OPERATION operationNewFunctionExpression(ExecState*, JSCell*);
 
 // This method is used to lookup an exception hander, keyed by faultLocation, which is
 // the return location from one of the calls out to one of the helper operations above.
diff --git a/Source/JavaScriptCore/dfg/DFGPhase.cpp b/Source/JavaScriptCore/dfg/DFGPhase.cpp
index bc1eabff4..bae12b1cc 100644
--- a/Source/JavaScriptCore/dfg/DFGPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGPhase.cpp
@@ -35,7 +35,7 @@ void Phase::beginPhase()
 {
     dataLog("Beginning DFG phase %s.\n", m_name);
     dataLog("Graph before %s:\n", m_name);
-    m_graph.dump(m_codeBlock);
+    m_graph.dump();
 }
 
 void Phase::endPhase()
diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
index b4c9e075a..98bdaac06 100644
--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
@@ -105,7 +105,7 @@ private:
         if (!node.shouldGenerate())
             return;
         
-        NodeType op = node.op;
+        NodeType op = static_cast<NodeType>(node.op);
 
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
         dataLog("   %s @%u: ", Graph::opName(op), m_compileIndex);
@@ -209,6 +209,15 @@ private:
             break;
         }
             
+        case ArithNegate:
+            if (m_graph[node.child1()].prediction()) {
+                if (m_graph.negateShouldSpeculateInteger(node))
+                    changed |= mergePrediction(PredictInt32);
+                else
+                    changed |= mergePrediction(PredictDouble);
+            }
+            break;
+            
         case ArithMul:
         case ArithMin:
         case ArithMax:
@@ -397,6 +406,18 @@ private:
             break;
         }
             
+        case CreateActivation: {
+            changed |= setPrediction(PredictObjectOther);
+            break;
+        }
+            
+        case NewFunction:
+        case NewFunctionNoCheck:
+        case NewFunctionExpression: {
+            changed |= setPrediction(PredictFunction);
+            break;
+        }
+            
         case GetArrayLength:
         case GetByteArrayLength:
         case GetInt8ArrayLength:
@@ -415,6 +436,9 @@ private:
             break;
         }
         
+        case Flush:
+            break;
+
 #ifndef NDEBUG
         // These get ignored because they don't return anything.
         case PutScopedVar:
@@ -424,7 +448,6 @@ private:
         case Return:
         case CheckHasInstance:
         case Phi:
-        case Flush:
         case Throw:
         case ThrowReferenceError:
         case ForceOSRExit:
@@ -437,6 +460,7 @@ private:
         case CheckFunction:
         case PutStructure:
         case PutByOffset:
+        case TearOffActivation:
             break;
             
         // These gets ignored because it doesn't do anything.
@@ -444,6 +468,10 @@ private:
         case InlineStart:
         case Nop:
             break;
+            
+        case LastNodeType:
+            ASSERT_NOT_REACHED();
+            break;
 #else
         default:
             break;
@@ -492,7 +520,7 @@ private:
     
     void vote(Node& node, VariableAccessData::Ballot ballot)
     {
-        if (node.op & NodeHasVarArgs) {
+        if (node.flags & NodeHasVarArgs) {
             for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
                 vote(m_graph.m_varArgChildren[childIdx], ballot);
             return;
@@ -586,8 +614,13 @@ private:
                 break;
             }
         }
-        for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i)
-            m_changed |= m_graph.m_variableAccessData[i].find()->tallyVotesForShouldUseDoubleFormat();
+        for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i) {
+            VariableAccessData* variableAccessData = m_graph.m_variableAccessData[i].find();
+            if (operandIsArgument(variableAccessData->local())
+                || m_graph.isCaptured(variableAccessData->local()))
+                continue;
+            m_changed |= variableAccessData->tallyVotesForShouldUseDoubleFormat();
+        }
     }
     
     void fixupNode(Node& node)
@@ -595,7 +628,7 @@ private:
         if (!node.shouldGenerate())
             return;
         
-        NodeType op = node.op;
+        NodeType op = static_cast<NodeType>(node.op);
 
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
         dataLog("   %s @%u: ", Graph::opName(op), m_compileIndex);
@@ -651,13 +684,16 @@ private:
                 node.op = GetFloat64ArrayLength;
             else
                 ASSERT_NOT_REACHED();
-            m_graph.deref(m_compileIndex); // No longer MustGenerate
+            // No longer MustGenerate
+            ASSERT(node.flags & NodeMustGenerate);
+            node.flags &= ~NodeMustGenerate;
+            m_graph.deref(m_compileIndex);
             break;
         }
         case GetIndexedPropertyStorage: {
             PredictedType basePrediction = m_graph[node.child2()].prediction();
             if (!(basePrediction & PredictInt32) && basePrediction) {
-                node.op = Nop;
+                node.setOpAndDefaultFlags(Nop);
                 m_graph.clearAndDerefChild1(node);
                 m_graph.clearAndDerefChild2(node);
                 m_graph.clearAndDerefChild3(node);
diff --git a/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp b/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp
new file mode 100644
index 000000000..fb30de742
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGRedundantPhiEliminationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+class RedundantPhiEliminationPhase : public Phase {
+public:
+    RedundantPhiEliminationPhase(Graph& graph)
+        : Phase(graph, "redundant phi elimination")
+    {
+    }
+    
+    void run()
+    {
+        bool changed = false;
+        do {
+            changed = fixupPhis();
+        } while (changed);
+
+        updateBlockVariableInformation();
+
+        // Update the Phi references from non-Phi nodes, e.g., the GetLocals.
+        for (NodeIndex index = 0; index < m_graph.size(); ++index) {
+            Node& node = m_graph[index];
+
+            if (!node.shouldGenerate())
+                continue;
+
+            switch (node.op) {
+            case GetLocal:
+                replacePhiChild(node, 0);
+                break;
+            default:
+                break;
+            }
+        }
+
+    }
+
+private:
+    NodeIndex getRedundantReplacement(NodeIndex phi)
+    {
+        NodeIndex child1 = m_graph[phi].child1().indexUnchecked();
+        NodeIndex candidate = child1 == phi ? NoNode : child1;
+
+        NodeIndex child2 = m_graph[phi].child2().indexUnchecked();
+        if (candidate != NoNode) {
+            if (child2 != NoNode && child2 != candidate && child2 != phi)
+                return NoNode;
+        } else if (child2 != phi)
+            candidate = child2;
+
+        NodeIndex child3 = m_graph[phi].child3().indexUnchecked();
+        if (candidate != NoNode) {
+            if (child3 != NoNode && child3 != candidate && child3 != phi)
+                return NoNode;
+        } else if (child3 != phi)
+            candidate = child3;
+        
+        return candidate;
+    }
+
+    bool replacePhiChild(Node& node, unsigned childIndex)
+    {
+        ASSERT(childIndex < 3);
+
+        bool replaced = false;
+        NodeIndex child = node.children.child(childIndex).indexUnchecked();
+        if (child != NoNode && m_graph[child].op == Phi) {
+            NodeIndex childReplacement = getRedundantReplacement(child);
+            if (childReplacement != NoNode) {
+                node.children.child(childIndex).setIndex(childReplacement);
+                replaced = true;
+                if (node.refCount()) {
+                    m_graph[childReplacement].ref();
+                    m_graph.deref(child);
+                }
+            }
+        }
+        return replaced;
+    }
+
+    bool fixupPhis()
+    {
+        bool changed = false;
+
+        for (BlockIndex block = 0; block < m_graph.m_blocks.size(); ++block) {
+            Vector<NodeIndex>& phis = m_graph.m_blocks[block]->phis;
+
+            for (size_t i = 0; i < phis.size(); ++i) {
+                NodeIndex phi = phis[i];
+                Node& phiNode = m_graph[phi];
+
+                changed |= (replacePhiChild(phiNode, 0) && phiNode.refCount());
+                changed |= (replacePhiChild(phiNode, 1) && phiNode.refCount());
+                changed |= (replacePhiChild(phiNode, 2) && phiNode.refCount());
+            }
+        }
+
+        return changed;
+    }
+
+    void updateBlockVariableInformation()
+    {
+        // Redundant Phi nodes are eliminated, we need to update
+        // the variable information if it references them.
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
+            BasicBlock* basicBlock = m_graph.m_blocks[blockIndex].get();
+
+            for (size_t arg = 0; arg < basicBlock->variablesAtHead.numberOfArguments(); ++arg) {
+                NodeIndex nodeIndex = basicBlock->variablesAtHead.argument(arg);
+                if (nodeIndex != NoNode && m_graph[nodeIndex].op == Phi && !m_graph[nodeIndex].refCount()) {
+                    NodeIndex replacement = getRedundantReplacement(nodeIndex);
+                    if (replacement != NoNode) {
+                        // This argument must be unused in this block.
+                        ASSERT(basicBlock->variablesAtTail.argument(arg) == nodeIndex);
+                        basicBlock->variablesAtHead.argument(arg) = replacement;
+                        basicBlock->variablesAtTail.argument(arg) = replacement;
+                    }
+                }
+            }
+
+            for (size_t local = 0; local < basicBlock->variablesAtHead.numberOfLocals(); ++local) {
+                NodeIndex nodeIndex = basicBlock->variablesAtHead.local(local);
+                if (nodeIndex != NoNode && m_graph[nodeIndex].op == Phi && !m_graph[nodeIndex].refCount()) {
+                    NodeIndex replacement = getRedundantReplacement(nodeIndex);
+                    if (replacement != NoNode) {
+                        // This local variable must be unused in this block.
+                        ASSERT(basicBlock->variablesAtTail.local(local) == nodeIndex);
+                        basicBlock->variablesAtHead.local(local) = replacement;
+                        basicBlock->variablesAtTail.local(local) = replacement;
+                    }
+                }
+            }
+        }
+    }
+
+};
+
+void performRedundantPhiElimination(Graph& graph)
+{
+    runPhase<RedundantPhiEliminationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.h b/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.h
new file mode 100644
index 000000000..202ab4441
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGRedundantPhiEliminationPhase_h
+#define DFGRedundantPhiEliminationPhase_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGPhase.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// We inserted many can-be-redundant Phi nodes when building the graph.
+// This phase will just remove them.
+
+void performRedundantPhiElimination(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGRedundantPhiEliminationPhase_h
+
diff --git a/Source/JavaScriptCore/dfg/DFGScoreBoard.h b/Source/JavaScriptCore/dfg/DFGScoreBoard.h
index 912b3e8fd..140de185b 100644
--- a/Source/JavaScriptCore/dfg/DFGScoreBoard.h
+++ b/Source/JavaScriptCore/dfg/DFGScoreBoard.h
@@ -58,14 +58,27 @@ public:
         }
     }
 
-#if DFG_ENABLE(CONSISTENCY_CHECK)
     ~ScoreBoard()
     {
-        // For every entry in the used list the use count of the virtual register should be zero.
-        for (size_t i = 0; i < m_free.size(); ++i)
-            ASSERT(!m_used[i] || m_used[i] == max());
+        assertClear();
     }
+    
+    void assertClear()
+    {
+#if !ASSERT_DISABLED
+        // For every entry in the used list the use count of the virtual register should be zero, or max, due to it being a preserved local.
+        for (size_t i = 0; i < m_used.size(); ++i)
+            ASSERT(!m_used[i] || m_used[i] == max());
+        // For every entry in the free list, the use count should be zero.
+        for (size_t i = 0; i < m_free.size(); ++i)
+            ASSERT(!m_used[m_free[i]]);
+        // There must not be duplicates in the free list.
+        for (size_t i = 0; i < m_free.size(); ++i) {
+            for (size_t j = i + 1; j < m_free.size(); ++j)
+                ASSERT(m_free[i] != m_free[j]);
+        }
 #endif
+    }
 
     VirtualRegister allocate()
     {
@@ -99,6 +112,9 @@ public:
         uint32_t index = node.virtualRegister();
         ASSERT(m_used[index] != max());
         if (node.refCount() == ++m_used[index]) {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+            dataLog(" Freeing virtual register %u.", index);
+#endif
             // If the use count in the scoreboard reaches the use count for the node,
             // then this was its last use; the virtual register is now free.
             // Clear the use count & add to the free list.
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 8578337f5..7bcb44576 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -83,7 +83,7 @@ GPRReg SpeculativeJIT::fillStorage(NodeIndex nodeIndex)
 
 void SpeculativeJIT::useChildren(Node& node)
 {
-    if (node.op & NodeHasVarArgs) {
+    if (node.flags & NodeHasVarArgs) {
         for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
             use(m_jit.graph().m_varArgChildren[childIdx]);
     } else {
@@ -365,12 +365,15 @@ void SpeculativeJIT::writeBarrier(JSCell* owner, GPRReg valueGPR, NodeUse valueU
 
 bool SpeculativeJIT::nonSpeculativeCompare(Node& node, MacroAssembler::RelationalCondition cond, S_DFGOperation_EJJ helperFunction)
 {
-    NodeIndex branchNodeIndex = detectPeepHoleBranch();
-    if (branchNodeIndex != NoNode) {
+    unsigned branchIndexInBlock = detectPeepHoleBranch();
+    if (branchIndexInBlock != UINT_MAX) {
+        NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
+
         ASSERT(node.adjustedRefCount() == 1);
         
         nonSpeculativePeepholeBranch(node, branchNodeIndex, cond, helperFunction);
     
+        m_indexInBlock = branchIndexInBlock;
         m_compileIndex = branchNodeIndex;
         
         return true;
@@ -383,15 +386,15 @@ bool SpeculativeJIT::nonSpeculativeCompare(Node& node, MacroAssembler::Relationa
 
 bool SpeculativeJIT::nonSpeculativeStrictEq(Node& node, bool invert)
 {
-    if (!invert && (isKnownNumeric(node.child1().index()) || isKnownNumeric(node.child2().index())))
-        return nonSpeculativeCompare(node, MacroAssembler::Equal, operationCompareStrictEq);
-    
-    NodeIndex branchNodeIndex = detectPeepHoleBranch();
-    if (branchNodeIndex != NoNode) {
+    unsigned branchIndexInBlock = detectPeepHoleBranch();
+    if (branchIndexInBlock != UINT_MAX) {
+        NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
+
         ASSERT(node.adjustedRefCount() == 1);
         
         nonSpeculativePeepholeStrictEq(node, branchNodeIndex, invert);
     
+        m_indexInBlock = branchIndexInBlock;
         m_compileIndex = branchNodeIndex;
         
         return true;
@@ -765,7 +768,6 @@ FPRTemporary::FPRTemporary(SpeculativeJIT* jit, JSValueOperand& op1)
 }
 #endif
 
-#ifndef NDEBUG
 void ValueSource::dump(FILE* out) const
 {
     switch (kind()) {
@@ -792,7 +794,6 @@ void ValueSource::dump(FILE* out) const
         break;
     }
 }
-#endif
 
 void SpeculativeJIT::compilePeepHoleDoubleBranch(Node& node, NodeIndex branchNodeIndex, JITCompiler::DoubleCondition condition)
 {
@@ -873,8 +874,10 @@ void SpeculativeJIT::compilePeepHoleIntegerBranch(Node& node, NodeIndex branchNo
 bool SpeculativeJIT::compilePeepHoleBranch(Node& node, MacroAssembler::RelationalCondition condition, MacroAssembler::DoubleCondition doubleCondition, S_DFGOperation_EJJ operation)
 {
     // Fused compare & branch.
-    NodeIndex branchNodeIndex = detectPeepHoleBranch();
-    if (branchNodeIndex != NoNode) {
+    unsigned branchIndexInBlock = detectPeepHoleBranch();
+    if (branchIndexInBlock != UINT_MAX) {
+        NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
+
         // detectPeepHoleBranch currently only permits the branch to be the very next node,
         // so can be no intervening nodes to also reference the compare. 
         ASSERT(node.adjustedRefCount() == 1);
@@ -898,6 +901,7 @@ bool SpeculativeJIT::compilePeepHoleBranch(Node& node, MacroAssembler::Relationa
         } else
             nonSpeculativePeepholeBranch(node, branchNodeIndex, condition, operation);
 
+        m_indexInBlock = branchIndexInBlock;
         m_compileIndex = branchNodeIndex;
         return true;
     }
@@ -915,12 +919,9 @@ void SpeculativeJIT::compileMovHint(Node& node)
 void SpeculativeJIT::compile(BasicBlock& block)
 {
     ASSERT(m_compileOkay);
-    ASSERT(m_compileIndex == block.begin);
     
-    if (!block.isReachable) {
-        m_compileIndex = block.end;
+    if (!block.isReachable)
         return;
-    }
 
     m_blockHeads[m_block] = m_jit.label();
 #if DFG_ENABLE(JIT_BREAK_ON_EVERY_BLOCK)
@@ -930,7 +931,7 @@ void SpeculativeJIT::compile(BasicBlock& block)
     ASSERT(m_arguments.size() == block.variablesAtHead.numberOfArguments());
     for (size_t i = 0; i < m_arguments.size(); ++i) {
         NodeIndex nodeIndex = block.variablesAtHead.argument(i);
-        if (nodeIndex == NoNode)
+        if (nodeIndex == NoNode || m_jit.graph().argumentIsCaptured(i))
             m_arguments[i] = ValueSource(ValueInRegisterFile);
         else
             m_arguments[i] = ValueSource::forPrediction(at(nodeIndex).variableAccessData()->prediction());
@@ -942,7 +943,7 @@ void SpeculativeJIT::compile(BasicBlock& block)
     ASSERT(m_variables.size() == block.variablesAtHead.numberOfLocals());
     for (size_t i = 0; i < m_variables.size(); ++i) {
         NodeIndex nodeIndex = block.variablesAtHead.local(i);
-        if (nodeIndex == NoNode)
+        if (nodeIndex == NoNode || m_jit.graph().localIsCaptured(i))
             m_variables[i] = ValueSource(ValueInRegisterFile);
         else if (at(nodeIndex).variableAccessData()->shouldUseDoubleFormat())
             m_variables[i] = ValueSource(DoubleInRegisterFile);
@@ -955,12 +956,13 @@ void SpeculativeJIT::compile(BasicBlock& block)
     
     if (DFG_ENABLE_EDGE_CODE_VERIFICATION) {
         JITCompiler::Jump verificationSucceeded =
-            m_jit.branch32(JITCompiler::Equal, GPRInfo::regT0, Imm32(m_block));
+            m_jit.branch32(JITCompiler::Equal, GPRInfo::regT0, TrustedImm32(m_block));
         m_jit.breakpoint();
         verificationSucceeded.link(&m_jit);
     }
 
-    for (; m_compileIndex < block.end; ++m_compileIndex) {
+    for (m_indexInBlock = 0; m_indexInBlock < block.size(); ++m_indexInBlock) {
+        m_compileIndex = block[m_indexInBlock];
         Node& node = at(m_compileIndex);
         m_codeOriginForOSR = node.codeOrigin;
         if (!node.shouldGenerate()) {
@@ -1005,7 +1007,6 @@ void SpeculativeJIT::compile(BasicBlock& block)
             compile(node);
             if (!m_compileOkay) {
                 m_compileOkay = true;
-                m_compileIndex = block.end;
                 clearGenerationInfo();
                 return;
             }
@@ -1045,7 +1046,7 @@ void SpeculativeJIT::compile(BasicBlock& block)
 #endif
         
         // Make sure that the abstract state is rematerialized for the next node.
-        m_state.execute(m_compileIndex);
+        m_state.execute(m_indexInBlock);
         
         if (node.shouldGenerate())
             checkConsistency();
@@ -1232,7 +1233,7 @@ bool SpeculativeJIT::compile()
     checkArgumentTypes();
 
     if (DFG_ENABLE_EDGE_CODE_VERIFICATION)
-        m_jit.move(Imm32(0), GPRInfo::regT0);
+        m_jit.move(TrustedImm32(0), GPRInfo::regT0);
 
     ASSERT(!m_compileIndex);
     for (m_block = 0; m_block < m_jit.graph().m_blocks.size(); ++m_block)
@@ -1258,7 +1259,7 @@ void SpeculativeJIT::createOSREntries()
         }
         
         m_osrEntryHeads.append(m_jit.label());
-        m_jit.move(Imm32(blockIndex), GPRInfo::regT0);
+        m_jit.move(TrustedImm32(blockIndex), GPRInfo::regT0);
         m_jit.jump().linkTo(m_blockHeads[blockIndex], &m_jit);
     }
 }
@@ -2318,8 +2319,14 @@ void SpeculativeJIT::compileArithSub(Node& node)
             if (nodeCanTruncateInteger(node.arithNodeFlags())) {
                 m_jit.move(op1.gpr(), result.gpr());
                 m_jit.sub32(Imm32(imm2), result.gpr());
-            } else
+            } else {
+#if ENABLE(JIT_CONSTANT_BLINDING)
+                GPRTemporary scratch(this);
+                speculationCheck(Overflow, JSValueRegs(), NoNode, m_jit.branchSub32(MacroAssembler::Overflow, op1.gpr(), Imm32(imm2), result.gpr(), scratch.gpr()));
+#else
                 speculationCheck(Overflow, JSValueRegs(), NoNode, m_jit.branchSub32(MacroAssembler::Overflow, op1.gpr(), Imm32(imm2), result.gpr()));
+#endif
+            }
 
             integerResult(result.gpr(), m_compileIndex);
             return;
@@ -2365,6 +2372,34 @@ void SpeculativeJIT::compileArithSub(Node& node)
     doubleResult(result.fpr(), m_compileIndex);
 }
 
+void SpeculativeJIT::compileArithNegate(Node& node)
+{
+    if (m_jit.graph().negateShouldSpeculateInteger(node)) {
+        SpeculateIntegerOperand op1(this, node.child1());
+        GPRTemporary result(this);
+
+        m_jit.move(op1.gpr(), result.gpr());
+
+        if (nodeCanTruncateInteger(node.arithNodeFlags()))
+            m_jit.neg32(result.gpr());
+        else {
+            speculationCheck(Overflow, JSValueRegs(), NoNode, m_jit.branchNeg32(MacroAssembler::Overflow, result.gpr()));
+            if (!nodeCanIgnoreNegativeZero(node.arithNodeFlags()))
+                speculationCheck(Overflow, JSValueRegs(), NoNode, m_jit.branchTest32(MacroAssembler::Zero, result.gpr()));
+        }
+
+        integerResult(result.gpr(), m_compileIndex);
+        return;
+    }
+        
+    SpeculateDoubleOperand op1(this, node.child1());
+    FPRTemporary result(this);
+
+    m_jit.negateDouble(op1.fpr(), result.fpr());
+
+    doubleResult(result.fpr(), m_compileIndex);
+}
+
 void SpeculativeJIT::compileArithMul(Node& node)
 {
     if (Node::shouldSpeculateInteger(at(node.child1()), at(node.child2())) && node.canSpeculateInteger()) {
@@ -2456,8 +2491,9 @@ bool SpeculativeJIT::compileStrictEqForConstant(Node& node, NodeUse value, JSVal
 {
     JSValueOperand op1(this, value);
     
-    NodeIndex branchNodeIndex = detectPeepHoleBranch();
-    if (branchNodeIndex != NoNode) {
+    unsigned branchIndexInBlock = detectPeepHoleBranch();
+    if (branchIndexInBlock != UINT_MAX) {
+        NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
         Node& branchNode = at(branchNodeIndex);
         BlockIndex taken = branchNode.takenBlockIndex();
         BlockIndex notTaken = branchNode.notTakenBlockIndex();
@@ -2493,6 +2529,7 @@ bool SpeculativeJIT::compileStrictEqForConstant(Node& node, NodeUse value, JSVal
         
         use(node.child1());
         use(node.child2());
+        m_indexInBlock = branchIndexInBlock;
         m_compileIndex = branchNodeIndex;
         return true;
     }
@@ -2504,18 +2541,18 @@ bool SpeculativeJIT::compileStrictEqForConstant(Node& node, NodeUse value, JSVal
     GPRReg resultGPR = result.gpr();
     m_jit.move(MacroAssembler::TrustedImmPtr(bitwise_cast<void*>(ValueFalse)), resultGPR);
     MacroAssembler::Jump notEqual = m_jit.branchPtr(MacroAssembler::NotEqual, op1GPR, MacroAssembler::TrustedImmPtr(bitwise_cast<void*>(JSValue::encode(constant))));
-    m_jit.or32(MacroAssembler::Imm32(1), resultGPR);
+    m_jit.or32(MacroAssembler::TrustedImm32(1), resultGPR);
     notEqual.link(&m_jit);
     jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean);
 #else
     GPRReg op1PayloadGPR = op1.payloadGPR();
     GPRReg op1TagGPR = op1.tagGPR();
     GPRReg resultGPR = result.gpr();
-    m_jit.move(Imm32(0), resultGPR);
+    m_jit.move(TrustedImm32(0), resultGPR);
     MacroAssembler::JumpList notEqual;
     notEqual.append(m_jit.branch32(MacroAssembler::NotEqual, op1TagGPR, MacroAssembler::Imm32(constant.tag())));
     notEqual.append(m_jit.branch32(MacroAssembler::NotEqual, op1PayloadGPR, MacroAssembler::Imm32(constant.payload())));
-    m_jit.move(Imm32(1), resultGPR);
+    m_jit.move(TrustedImm32(1), resultGPR);
     notEqual.link(&m_jit);
     booleanResult(resultGPR, m_compileIndex);
 #endif
@@ -2543,11 +2580,13 @@ bool SpeculativeJIT::compileStrictEq(Node& node)
     // 2) If the operands are predicted integer, do an integer comparison.
     
     if (Node::shouldSpeculateInteger(at(node.child1()), at(node.child2()))) {
-        NodeIndex branchNodeIndex = detectPeepHoleBranch();
-        if (branchNodeIndex != NoNode) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
             compilePeepHoleIntegerBranch(node, branchNodeIndex, MacroAssembler::Equal);
             use(node.child1());
             use(node.child2());
+            m_indexInBlock = branchIndexInBlock;
             m_compileIndex = branchNodeIndex;
             return true;
         }
@@ -2558,11 +2597,13 @@ bool SpeculativeJIT::compileStrictEq(Node& node)
     // 3) If the operands are predicted double, do a double comparison.
     
     if (Node::shouldSpeculateNumber(at(node.child1()), at(node.child2()))) {
-        NodeIndex branchNodeIndex = detectPeepHoleBranch();
-        if (branchNodeIndex != NoNode) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
             compilePeepHoleDoubleBranch(node, branchNodeIndex, MacroAssembler::DoubleEqual);
             use(node.child1());
             use(node.child2());
+            m_indexInBlock = branchIndexInBlock;
             m_compileIndex = branchNodeIndex;
             return true;
         }
@@ -2574,11 +2615,13 @@ bool SpeculativeJIT::compileStrictEq(Node& node)
     //    or array comparison.
     
     if (Node::shouldSpeculateFinalObject(at(node.child1()), at(node.child2()))) {
-        NodeIndex branchNodeIndex = detectPeepHoleBranch();
-        if (branchNodeIndex != NoNode) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
             compilePeepHoleObjectEquality(node, branchNodeIndex, &JSFinalObject::s_info, isFinalObjectPrediction);
             use(node.child1());
             use(node.child2());
+            m_indexInBlock = branchIndexInBlock;
             m_compileIndex = branchNodeIndex;
             return true;
         }
@@ -2587,11 +2630,13 @@ bool SpeculativeJIT::compileStrictEq(Node& node)
     }
     
     if (Node::shouldSpeculateArray(at(node.child1()), at(node.child2()))) {
-        NodeIndex branchNodeIndex = detectPeepHoleBranch();
-        if (branchNodeIndex != NoNode) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
             compilePeepHoleObjectEquality(node, branchNodeIndex, &JSArray::s_info, isArrayPrediction);
             use(node.child1());
             use(node.child2());
+            m_indexInBlock = branchIndexInBlock;
             m_compileIndex = branchNodeIndex;
             return true;
         }
@@ -2691,6 +2736,28 @@ void SpeculativeJIT::compileGetIndexedPropertyStorage(Node& node)
     storageResult(storageReg, m_compileIndex);
 }
 
+void SpeculativeJIT::compileNewFunctionNoCheck(Node& node)
+{
+    GPRResult result(this);
+    GPRReg resultGPR = result.gpr();
+    flushRegisters();
+    callOperation(
+        operationNewFunction, resultGPR, m_jit.codeBlock()->functionDecl(node.functionDeclIndex()));
+    cellResult(resultGPR, m_compileIndex);
+}
+
+void SpeculativeJIT::compileNewFunctionExpression(Node& node)
+{
+    GPRResult result(this);
+    GPRReg resultGPR = result.gpr();
+    flushRegisters();
+    callOperation(
+        operationNewFunctionExpression,
+        resultGPR,
+        m_jit.codeBlock()->functionExpr(node.functionExprIndex()));
+    cellResult(resultGPR, m_compileIndex);
+}
+
 } } // namespace JSC::DFG
 
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index 5d95b064f..1744a03f3 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -104,9 +104,7 @@ public:
         return m_nodeIndex;
     }
     
-#ifndef NDEBUG
     void dump(FILE* out) const;
-#endif
     
 private:
     static NodeIndex nodeIndexFromKind(ValueSourceKind kind)
@@ -454,7 +452,7 @@ private:
             ASSERT(info.gpr() == target);
             if (node.hasConstant()) {
                 ASSERT(isBooleanConstant(nodeIndex));
-                m_jit.move(Imm32(valueOfBooleanConstant(nodeIndex)), target);
+                m_jit.move(TrustedImm32(valueOfBooleanConstant(nodeIndex)), target);
             } else
                 m_jit.load32(JITCompiler::payloadFor(spillMe), target);
 #endif
@@ -466,7 +464,7 @@ private:
             if (node.hasConstant()) {
                 JSValue value = valueOfJSConstant(nodeIndex);
                 ASSERT(value.isCell());
-                m_jit.move(ImmPtr(value.asCell()), target);
+                m_jit.move(TrustedImmPtr(value.asCell()), target);
             } else
                 m_jit.loadPtr(JITCompiler::payloadFor(spillMe), target);
             return;
@@ -481,9 +479,12 @@ private:
         ASSERT(registerFormat & DataFormatJS);
 #if USE(JSVALUE64)
         ASSERT(info.gpr() == target);
-        if (node.hasConstant())
-            m_jit.move(valueOfJSConstantAsImmPtr(nodeIndex), target);
-        else if (info.spillFormat() == DataFormatInteger) {
+        if (node.hasConstant()) {
+            if (valueOfJSConstant(nodeIndex).isCell())
+                m_jit.move(valueOfJSConstantAsImmPtr(nodeIndex).asTrustedImmPtr(), target);
+            else
+                m_jit.move(valueOfJSConstantAsImmPtr(nodeIndex), target);
+        } else if (info.spillFormat() == DataFormatInteger) {
             ASSERT(registerFormat == DataFormatJSInteger);
             m_jit.load32(JITCompiler::payloadFor(spillMe), target);
             m_jit.orPtr(GPRInfo::tagTypeNumberRegister, target);
@@ -875,20 +876,21 @@ private:
         }
     }
     
-    // Returns the node index of the branch node if peephole is okay, NoNode otherwise.
-    NodeIndex detectPeepHoleBranch()
+    // Returns the index of the branch node if peephole is okay, UINT_MAX otherwise.
+    unsigned detectPeepHoleBranch()
     {
-        NodeIndex lastNodeIndex = m_jit.graph().m_blocks[m_block]->end - 1;
+        BasicBlock* block = m_jit.graph().m_blocks[m_block].get();
 
         // Check that no intervening nodes will be generated.
-        for (NodeIndex index = m_compileIndex + 1; index < lastNodeIndex; ++index) {
-            if (at(index).shouldGenerate())
-                return NoNode;
+        for (unsigned index = m_indexInBlock + 1; index < block->size() - 1; ++index) {
+            NodeIndex nodeIndex = block->at(index);
+            if (at(nodeIndex).shouldGenerate())
+                return UINT_MAX;
         }
 
         // Check if the lastNode is a branch on this node.
-        Node& lastNode = at(lastNodeIndex);
-        return lastNode.op == Branch && lastNode.child1().index() == m_compileIndex ? lastNodeIndex : NoNode;
+        Node& lastNode = at(block->last());
+        return lastNode.op == Branch && lastNode.child1().index() == m_compileIndex ? block->size() - 1 : UINT_MAX;
     }
     
     void nonSpeculativeValueToNumber(Node&);
@@ -1124,7 +1126,7 @@ private:
     }
     JITCompiler::Call callOperation(J_DFGOperation_ESS operation, GPRReg result, int startConstant, int numConstants)
     {
-        m_jit.setupArgumentsWithExecState(Imm32(startConstant), Imm32(numConstants));
+        m_jit.setupArgumentsWithExecState(TrustedImm32(startConstant), TrustedImm32(numConstants));
         return appendCallWithExceptionCheckSetResult(operation, result);
     }
     JITCompiler::Call callOperation(J_DFGOperation_EPP operation, GPRReg result, GPRReg arg1, void* pointer)
@@ -1162,6 +1164,11 @@ private:
         m_jit.setupArgumentsWithExecState(arg1);
         return appendCallWithExceptionCheckSetResult(operation, result);
     }
+    JITCompiler::Call callOperation(C_DFGOperation_EC operation, GPRReg result, JSCell* cell)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(cell));
+        return appendCallWithExceptionCheckSetResult(operation, result);
+    }
     JITCompiler::Call callOperation(C_DFGOperation_ECC operation, GPRReg result, GPRReg arg1, JSCell* cell)
     {
         m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(cell));
@@ -1182,14 +1189,14 @@ private:
         m_jit.setupArgumentsWithExecState(arg1, arg2);
         return appendCallWithExceptionCheckSetResult(operation, result);
     }
-    JITCompiler::Call callOperation(J_DFGOperation_EJJ operation, GPRReg result, GPRReg arg1, MacroAssembler::Imm32 imm)
+    JITCompiler::Call callOperation(J_DFGOperation_EJJ operation, GPRReg result, GPRReg arg1, MacroAssembler::TrustedImm32 imm)
     {
-        m_jit.setupArgumentsWithExecState(arg1, MacroAssembler::ImmPtr(static_cast<const void*>(JSValue::encode(jsNumber(imm.m_value)))));
+        m_jit.setupArgumentsWithExecState(arg1, MacroAssembler::TrustedImmPtr(static_cast<const void*>(JSValue::encode(jsNumber(imm.m_value)))));
         return appendCallWithExceptionCheckSetResult(operation, result);
     }
-    JITCompiler::Call callOperation(J_DFGOperation_EJJ operation, GPRReg result, MacroAssembler::Imm32 imm, GPRReg arg2)
+    JITCompiler::Call callOperation(J_DFGOperation_EJJ operation, GPRReg result, MacroAssembler::TrustedImm32 imm, GPRReg arg2)
     {
-        m_jit.setupArgumentsWithExecState(MacroAssembler::ImmPtr(static_cast<const void*>(JSValue::encode(jsNumber(imm.m_value)))), arg2);
+        m_jit.setupArgumentsWithExecState(MacroAssembler::TrustedImmPtr(static_cast<const void*>(JSValue::encode(jsNumber(imm.m_value)))), arg2);
         return appendCallWithExceptionCheckSetResult(operation, result);
     }
     JITCompiler::Call callOperation(J_DFGOperation_ECJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
@@ -1197,6 +1204,11 @@ private:
         m_jit.setupArgumentsWithExecState(arg1, arg2);
         return appendCallWithExceptionCheckSetResult(operation, result);
     }
+    JITCompiler::Call callOperation(V_DFGOperation_EC operation, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallWithExceptionCheck(operation);
+    }
     JITCompiler::Call callOperation(V_DFGOperation_EJPP operation, GPRReg arg1, GPRReg arg2, void* pointer)
     {
         m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(pointer));
@@ -1287,7 +1299,7 @@ private:
     }
     JITCompiler::Call callOperation(J_DFGOperation_EJP operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1Tag, GPRReg arg1Payload, void* pointer)
     {
-        m_jit.setupArgumentsWithExecState(arg1Payload, arg1Tag, ImmPtr(pointer));
+        m_jit.setupArgumentsWithExecState(arg1Payload, arg1Tag, TrustedImmPtr(pointer));
         return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
     }
     JITCompiler::Call callOperation(J_DFGOperation_EJP operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2)
@@ -1330,6 +1342,11 @@ private:
         m_jit.setupArgumentsWithExecState(arg1);
         return appendCallWithExceptionCheckSetResult(operation, result);
     }
+    JITCompiler::Call callOperation(C_DFGOperation_EC operation, GPRReg result, JSCell* cell)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(cell));
+        return appendCallWithExceptionCheckSetResult(operation, result);
+    }
     JITCompiler::Call callOperation(C_DFGOperation_ECC operation, GPRReg result, GPRReg arg1, JSCell* cell)
     {
         m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(cell));
@@ -1350,12 +1367,12 @@ private:
         m_jit.setupArgumentsWithExecState(arg1Payload, arg1Tag, arg2Payload, arg2Tag);
         return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
     }
-    JITCompiler::Call callOperation(J_DFGOperation_EJJ operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1Tag, GPRReg arg1Payload, MacroAssembler::Imm32 imm)
+    JITCompiler::Call callOperation(J_DFGOperation_EJJ operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1Tag, GPRReg arg1Payload, MacroAssembler::TrustedImm32 imm)
     {
         m_jit.setupArgumentsWithExecState(arg1Payload, arg1Tag, imm, TrustedImm32(JSValue::Int32Tag));
         return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
     }
-    JITCompiler::Call callOperation(J_DFGOperation_EJJ operation, GPRReg resultTag, GPRReg resultPayload, MacroAssembler::Imm32 imm, GPRReg arg2Tag, GPRReg arg2Payload)
+    JITCompiler::Call callOperation(J_DFGOperation_EJJ operation, GPRReg resultTag, GPRReg resultPayload, MacroAssembler::TrustedImm32 imm, GPRReg arg2Tag, GPRReg arg2Payload)
     {
         m_jit.setupArgumentsWithExecState(imm, TrustedImm32(JSValue::Int32Tag), arg2Payload, arg2Tag);
         return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
@@ -1365,6 +1382,11 @@ private:
         m_jit.setupArgumentsWithExecState(arg1, arg2Payload, arg2Tag);
         return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
     }
+    JITCompiler::Call callOperation(V_DFGOperation_EC operation, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallWithExceptionCheck(operation);
+    }
     JITCompiler::Call callOperation(V_DFGOperation_EJPP operation, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2, void* pointer)
     {
         m_jit.setupArgumentsWithExecState(arg1Payload, arg1Tag, arg2, TrustedImmPtr(pointer));
@@ -1620,7 +1642,7 @@ private:
     {
         if (!DFG_ENABLE_EDGE_CODE_VERIFICATION)
             return;
-        m_jit.move(Imm32(destination), GPRInfo::regT0);
+        m_jit.move(TrustedImm32(destination), GPRInfo::regT0);
     }
 
     void addBranch(const MacroAssembler::Jump& jump, BlockIndex destination)
@@ -1693,6 +1715,7 @@ private:
     void compilePutByValForByteArray(GPRReg base, GPRReg property, Node&);
     void compileAdd(Node&);
     void compileArithSub(Node&);
+    void compileArithNegate(Node&);
     void compileArithMul(Node&);
     void compileArithMod(Node&);
     void compileSoftModulo(Node&);
@@ -1715,14 +1738,18 @@ private:
     void compilePutByValForIntTypedArray(const TypedArrayDescriptor&, GPRReg base, GPRReg property, Node&, size_t elementSize, TypedArraySpeculationRequirements, TypedArraySignedness, TypedArrayRounding = TruncateRounding);
     void compileGetByValOnFloatTypedArray(const TypedArrayDescriptor&, Node&, size_t elementSize, TypedArraySpeculationRequirements);
     void compilePutByValForFloatTypedArray(const TypedArrayDescriptor&, GPRReg base, GPRReg property, Node&, size_t elementSize, TypedArraySpeculationRequirements);
+    void compileNewFunctionNoCheck(Node& node);
+    void compileNewFunctionExpression(Node& node);
     
-    // It is acceptable to have structure be equal to scratch, so long as you're fine
-    // with the structure GPR being clobbered.
-    template<typename T>
-    void emitAllocateJSFinalObject(T structure, GPRReg resultGPR, GPRReg scratchGPR, MacroAssembler::JumpList& slowPath)
+    template <typename ClassType, bool destructor, typename StructureType> 
+    void emitAllocateBasicJSObject(StructureType structure, GPRReg resultGPR, GPRReg scratchGPR, MacroAssembler::JumpList& slowPath)
     {
-        MarkedAllocator* allocator = &m_jit.globalData()->heap.allocatorForObjectWithoutDestructor(sizeof(JSFinalObject));
-        
+        MarkedAllocator* allocator = 0;
+        if (destructor)
+            allocator = &m_jit.globalData()->heap.allocatorForObjectWithDestructor(sizeof(ClassType));
+        else
+            allocator = &m_jit.globalData()->heap.allocatorForObjectWithoutDestructor(sizeof(ClassType));
+
         m_jit.loadPtr(&allocator->m_firstFreeCell, resultGPR);
         slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, resultGPR));
         
@@ -1738,14 +1765,22 @@ private:
         m_jit.storePtr(scratchGPR, &allocator->m_firstFreeCell);
         
         // Initialize the object's classInfo pointer
-        m_jit.storePtr(MacroAssembler::TrustedImmPtr(&JSFinalObject::s_info), MacroAssembler::Address(resultGPR, JSCell::classInfoOffset()));
+        m_jit.storePtr(MacroAssembler::TrustedImmPtr(&ClassType::s_info), MacroAssembler::Address(resultGPR, JSCell::classInfoOffset()));
         
         // Initialize the object's inheritorID.
         m_jit.storePtr(MacroAssembler::TrustedImmPtr(0), MacroAssembler::Address(resultGPR, JSObject::offsetOfInheritorID()));
         
         // Initialize the object's property storage pointer.
         m_jit.addPtr(MacroAssembler::TrustedImm32(sizeof(JSObject)), resultGPR, scratchGPR);
-        m_jit.storePtr(scratchGPR, MacroAssembler::Address(resultGPR, JSFinalObject::offsetOfPropertyStorage()));
+        m_jit.storePtr(scratchGPR, MacroAssembler::Address(resultGPR, ClassType::offsetOfPropertyStorage()));
+    }
+
+    // It is acceptable to have structure be equal to scratch, so long as you're fine
+    // with the structure GPR being clobbered.
+    template<typename T>
+    void emitAllocateJSFinalObject(T structure, GPRReg resultGPR, GPRReg scratchGPR, MacroAssembler::JumpList& slowPath)
+    {
+        return emitAllocateBasicJSObject<JSFinalObject, false>(structure, resultGPR, scratchGPR, slowPath);
     }
 
 #if USE(JSVALUE64) 
@@ -1849,6 +1884,7 @@ private:
     // The current node being generated.
     BlockIndex m_block;
     NodeIndex m_compileIndex;
+    unsigned m_indexInBlock;
     // Virtual and physical register maps.
     Vector<GenerationInfo, 32> m_generationInfo;
     RegisterBank<GPRInfo> m_gprs;
@@ -2482,6 +2518,7 @@ inline SpeculativeJIT::SpeculativeJIT(JITCompiler& jit)
     : m_compileOkay(true)
     , m_jit(jit)
     , m_compileIndex(0)
+    , m_indexInBlock(0)
     , m_generationInfo(m_jit.codeBlock()->m_numCalleeRegisters)
     , m_blockHeads(jit.graph().m_blocks.size())
     , m_arguments(jit.codeBlock()->numParameters())
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index 8c4d8c030..b6814229c 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -652,14 +652,17 @@ void SpeculativeJIT::nonSpeculativePeepholeBranchNull(NodeUse operand, NodeIndex
 
 bool SpeculativeJIT::nonSpeculativeCompareNull(Node& node, NodeUse operand, bool invert)
 {
-    NodeIndex branchNodeIndex = detectPeepHoleBranch();
-    if (branchNodeIndex != NoNode) {
+    unsigned branchIndexInBlock = detectPeepHoleBranch();
+    if (branchIndexInBlock != UINT_MAX) {
+        NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
+
         ASSERT(node.adjustedRefCount() == 1);
         
         nonSpeculativePeepholeBranchNull(operand, branchNodeIndex, invert);
     
         use(node.child1());
         use(node.child2());
+        m_indexInBlock = branchIndexInBlock;
         m_compileIndex = branchNodeIndex;
         
         return true;
@@ -947,7 +950,7 @@ void SpeculativeJIT::emitCall(Node& node)
     m_jit.storePtr(resultPayloadGPR, callFramePayloadSlot(RegisterFile::ScopeChain));
     m_jit.store32(MacroAssembler::TrustedImm32(JSValue::CellTag), callFrameTagSlot(RegisterFile::ScopeChain));
 
-    m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
+    m_jit.addPtr(TrustedImm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
 
     CodeOrigin codeOrigin = at(m_compileIndex).codeOrigin;
     CallBeginToken token = m_jit.beginJSCall();
@@ -958,12 +961,12 @@ void SpeculativeJIT::emitCall(Node& node)
 
     slowPath.link(&m_jit);
 
-    m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    m_jit.addPtr(TrustedImm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
     m_jit.poke(GPRInfo::argumentGPR0);
     token = m_jit.beginCall();
     JITCompiler::Call slowCall = m_jit.appendCall(slowCallFunction);
     m_jit.addFastExceptionCheck(slowCall, codeOrigin, token);
-    m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
+    m_jit.addPtr(TrustedImm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
     token = m_jit.beginJSCall();
     JITCompiler::Call theCall = m_jit.call(GPRInfo::returnValueGPR);
     m_jit.notifyCall(theCall, codeOrigin, token);
@@ -1387,10 +1390,10 @@ void SpeculativeJIT::compileObjectEquality(Node& node, const ClassInfo* classInf
     GPRReg resultPayloadGPR = resultPayload.gpr();
     
     MacroAssembler::Jump falseCase = m_jit.branchPtr(MacroAssembler::NotEqual, op1GPR, op2GPR);
-    m_jit.move(Imm32(1), resultPayloadGPR);
+    m_jit.move(TrustedImm32(1), resultPayloadGPR);
     MacroAssembler::Jump done = m_jit.jump();
     falseCase.link(&m_jit);
-    m_jit.move(Imm32(0), resultPayloadGPR);
+    m_jit.move(TrustedImm32(0), resultPayloadGPR);
     done.link(&m_jit);
 
     booleanResult(resultPayloadGPR, m_compileIndex);
@@ -1414,9 +1417,9 @@ void SpeculativeJIT::compileDoubleCompare(Node& node, MacroAssembler::DoubleCond
     SpeculateDoubleOperand op2(this, node.child2());
     GPRTemporary resultPayload(this);
     
-    m_jit.move(Imm32(1), resultPayload.gpr());
+    m_jit.move(TrustedImm32(1), resultPayload.gpr());
     MacroAssembler::Jump trueCase = m_jit.branchDouble(condition, op1.fpr(), op2.fpr());
-    m_jit.move(Imm32(0), resultPayload.gpr());
+    m_jit.move(TrustedImm32(0), resultPayload.gpr());
     trueCase.link(&m_jit);
     
     booleanResult(resultPayload.gpr(), m_compileIndex);
@@ -1637,7 +1640,7 @@ void SpeculativeJIT::emitBranch(Node& node)
 
 void SpeculativeJIT::compile(Node& node)
 {
-    NodeType op = node.op;
+    NodeType op = static_cast<NodeType>(node.op);
 
     switch (op) {
     case JSConstant:
@@ -1654,54 +1657,59 @@ void SpeculativeJIT::compile(Node& node)
         AbstractValue& value = block()->valuesAtHead.operand(node.local());
 
         // If we have no prediction for this local, then don't attempt to compile.
-        if (prediction == PredictNone) {
+        if (prediction == PredictNone || value.isClear()) {
             terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
             break;
         }
         
-        if (node.variableAccessData()->shouldUseDoubleFormat()) {
-            FPRTemporary result(this);
-            m_jit.loadDouble(JITCompiler::addressFor(node.local()), result.fpr());
-            VirtualRegister virtualRegister = node.virtualRegister();
-            m_fprs.retain(result.fpr(), virtualRegister, SpillOrderDouble);
-            m_generationInfo[virtualRegister].initDouble(m_compileIndex, node.refCount(), result.fpr());
-            break;
-        }
+        if (!m_jit.graph().isCaptured(node.local())) {
+            if (node.variableAccessData()->shouldUseDoubleFormat()) {
+                FPRTemporary result(this);
+                m_jit.loadDouble(JITCompiler::addressFor(node.local()), result.fpr());
+                VirtualRegister virtualRegister = node.virtualRegister();
+                m_fprs.retain(result.fpr(), virtualRegister, SpillOrderDouble);
+                m_generationInfo[virtualRegister].initDouble(m_compileIndex, node.refCount(), result.fpr());
+                break;
+            }
         
-        GPRTemporary result(this);
-        if (isInt32Prediction(prediction)) {
-            m_jit.load32(JITCompiler::payloadFor(node.local()), result.gpr());
-
-            // Like integerResult, but don't useChildren - our children are phi nodes,
-            // and don't represent values within this dataflow with virtual registers.
-            VirtualRegister virtualRegister = node.virtualRegister();
-            m_gprs.retain(result.gpr(), virtualRegister, SpillOrderInteger);
-            m_generationInfo[virtualRegister].initInteger(m_compileIndex, node.refCount(), result.gpr());
-            break;
-        }
+            if (isInt32Prediction(prediction)) {
+                GPRTemporary result(this);
+                m_jit.load32(JITCompiler::payloadFor(node.local()), result.gpr());
 
-        if (isArrayPrediction(prediction) || isByteArrayPrediction(prediction)) {
-            m_jit.load32(JITCompiler::payloadFor(node.local()), result.gpr());
+                // Like integerResult, but don't useChildren - our children are phi nodes,
+                // and don't represent values within this dataflow with virtual registers.
+                VirtualRegister virtualRegister = node.virtualRegister();
+                m_gprs.retain(result.gpr(), virtualRegister, SpillOrderInteger);
+                m_generationInfo[virtualRegister].initInteger(m_compileIndex, node.refCount(), result.gpr());
+                break;
+            }
 
-            // Like cellResult, but don't useChildren - our children are phi nodes,
-            // and don't represent values within this dataflow with virtual registers.
-            VirtualRegister virtualRegister = node.virtualRegister();
-            m_gprs.retain(result.gpr(), virtualRegister, SpillOrderCell);
-            m_generationInfo[virtualRegister].initCell(m_compileIndex, node.refCount(), result.gpr());
-            break;
-        }
+            if (isArrayPrediction(prediction) || isByteArrayPrediction(prediction)) {
+                GPRTemporary result(this);
+                m_jit.load32(JITCompiler::payloadFor(node.local()), result.gpr());
+
+                // Like cellResult, but don't useChildren - our children are phi nodes,
+                // and don't represent values within this dataflow with virtual registers.
+                VirtualRegister virtualRegister = node.virtualRegister();
+                m_gprs.retain(result.gpr(), virtualRegister, SpillOrderCell);
+                m_generationInfo[virtualRegister].initCell(m_compileIndex, node.refCount(), result.gpr());
+                break;
+            }
 
-        if (isBooleanPrediction(prediction)) {
-            m_jit.load32(JITCompiler::payloadFor(node.local()), result.gpr());
+            if (isBooleanPrediction(prediction)) {
+                GPRTemporary result(this);
+                m_jit.load32(JITCompiler::payloadFor(node.local()), result.gpr());
 
-            // Like booleanResult, but don't useChildren - our children are phi nodes,
-            // and don't represent values within this dataflow with virtual registers.
-            VirtualRegister virtualRegister = node.virtualRegister();
-            m_gprs.retain(result.gpr(), virtualRegister, SpillOrderBoolean);
-            m_generationInfo[virtualRegister].initBoolean(m_compileIndex, node.refCount(), result.gpr());
-            break;
+                // Like booleanResult, but don't useChildren - our children are phi nodes,
+                // and don't represent values within this dataflow with virtual registers.
+                VirtualRegister virtualRegister = node.virtualRegister();
+                m_gprs.retain(result.gpr(), virtualRegister, SpillOrderBoolean);
+                m_generationInfo[virtualRegister].initBoolean(m_compileIndex, node.refCount(), result.gpr());
+                break;
+            }
         }
 
+        GPRTemporary result(this);
         GPRTemporary tag(this);
         m_jit.load32(JITCompiler::payloadFor(node.local()), result.gpr());
         m_jit.load32(JITCompiler::tagFor(node.local()), tag.gpr());
@@ -1712,7 +1720,12 @@ void SpeculativeJIT::compile(Node& node)
         m_gprs.retain(result.gpr(), virtualRegister, SpillOrderJS);
         m_gprs.retain(tag.gpr(), virtualRegister, SpillOrderJS);
 
-        DataFormat format = isCellPrediction(value.m_type) ? DataFormatJSCell : DataFormatJS;
+        DataFormat format;
+        if (isCellPrediction(value.m_type)
+            && !m_jit.graph().isCaptured(node.local()))
+            format = DataFormatJSCell;
+        else
+            format = DataFormatJS;
         m_generationInfo[virtualRegister].initJSValue(m_compileIndex, node.refCount(), tag.gpr(), result.gpr(), format);
         break;
     }
@@ -1733,53 +1746,65 @@ void SpeculativeJIT::compile(Node& node)
         
         m_codeOriginForOSR = nextNode.codeOrigin;
         
-        if (node.variableAccessData()->shouldUseDoubleFormat()) {
-            SpeculateDoubleOperand value(this, node.child1());
-            m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node.local()));
-            noResult(m_compileIndex);
-            // Indicate that it's no longer necessary to retrieve the value of
-            // this bytecode variable from registers or other locations in the register file,
-            // but that it is stored as a double.
-            valueSourceReferenceForOperand(node.local()) = ValueSource(DoubleInRegisterFile);
-        } else {
+        if (!m_jit.graph().isCaptured(node.local())) {
+            if (node.variableAccessData()->shouldUseDoubleFormat()) {
+                SpeculateDoubleOperand value(this, node.child1());
+                m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node.local()));
+                noResult(m_compileIndex);
+                // Indicate that it's no longer necessary to retrieve the value of
+                // this bytecode variable from registers or other locations in the register file,
+                // but that it is stored as a double.
+                valueSourceReferenceForOperand(node.local()) = ValueSource(DoubleInRegisterFile);
+                break;
+            }
             PredictedType predictedType = node.variableAccessData()->prediction();
             if (m_generationInfo[at(node.child1()).virtualRegister()].registerFormat() == DataFormatDouble) {
                 DoubleOperand value(this, node.child1());
                 m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node.local()));
                 noResult(m_compileIndex);
-            } else if (isInt32Prediction(predictedType)) {
+                valueSourceReferenceForOperand(node.local()) = ValueSource(DoubleInRegisterFile);
+                break;
+            }
+            if (isInt32Prediction(predictedType)) {
                 SpeculateIntegerOperand value(this, node.child1());
                 m_jit.store32(value.gpr(), JITCompiler::payloadFor(node.local()));
                 noResult(m_compileIndex);
-            } else if (isArrayPrediction(predictedType)) {
+                valueSourceReferenceForOperand(node.local()) = ValueSource(Int32InRegisterFile);
+                break;
+            }
+            if (isArrayPrediction(predictedType)) {
                 SpeculateCellOperand cell(this, node.child1());
                 GPRReg cellGPR = cell.gpr();
                 if (!isArrayPrediction(m_state.forNode(node.child1()).m_type))
                     speculationCheck(BadType, JSValueSource::unboxedCell(cellGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(cellGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
                 m_jit.storePtr(cellGPR, JITCompiler::payloadFor(node.local()));
                 noResult(m_compileIndex);
-            } else if (isByteArrayPrediction(predictedType)) {
+                valueSourceReferenceForOperand(node.local()) = ValueSource(CellInRegisterFile);
+                break;
+            }
+            if (isByteArrayPrediction(predictedType)) {
                 SpeculateCellOperand cell(this, node.child1());
                 GPRReg cellGPR = cell.gpr();
                 if (!isByteArrayPrediction(m_state.forNode(node.child1()).m_type))
                     speculationCheck(BadType, JSValueSource::unboxedCell(cellGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(cellGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
                 m_jit.storePtr(cellGPR, JITCompiler::payloadFor(node.local()));
                 noResult(m_compileIndex);
-            } else if (isBooleanPrediction(predictedType)) {
+                valueSourceReferenceForOperand(node.local()) = ValueSource(CellInRegisterFile);
+                break;
+            }
+            if (isBooleanPrediction(predictedType)) {
                 SpeculateBooleanOperand value(this, node.child1());
                 m_jit.store32(value.gpr(), JITCompiler::payloadFor(node.local()));
                 noResult(m_compileIndex);
-            } else {
-                JSValueOperand value(this, node.child1());
-                m_jit.store32(value.payloadGPR(), JITCompiler::payloadFor(node.local()));
-                m_jit.store32(value.tagGPR(), JITCompiler::tagFor(node.local()));
-                noResult(m_compileIndex);
+                valueSourceReferenceForOperand(node.local()) = ValueSource(BooleanInRegisterFile);
+                break;
             }
-
-            // Indicate that it's no longer necessary to retrieve the value of
-            // this bytecode variable from registers or other locations in the register file.
-            valueSourceReferenceForOperand(node.local()) = ValueSource::forPrediction(predictedType);
         }
+        JSValueOperand value(this, node.child1());
+        m_jit.store32(value.payloadGPR(), JITCompiler::payloadFor(node.local()));
+        m_jit.store32(value.tagGPR(), JITCompiler::tagFor(node.local()));
+        noResult(m_compileIndex);
+        valueSourceReferenceForOperand(node.local()) = ValueSource(ValueInRegisterFile);
         break;
     }
 
@@ -1863,6 +1888,10 @@ void SpeculativeJIT::compile(Node& node)
         compileArithSub(node);
         break;
 
+    case ArithNegate:
+        compileArithNegate(node);
+        break;
+
     case ArithMul:
         compileArithMul(node);
         break;
@@ -1951,7 +1980,7 @@ void SpeculativeJIT::compile(Node& node)
     case ArithAbs: {
         if (at(node.child1()).shouldSpeculateInteger() && node.canSpeculateInteger()) {
             SpeculateIntegerOperand op1(this, node.child1());
-            GPRTemporary result(this);
+            GPRTemporary result(this, op1);
             GPRTemporary scratch(this);
             
             m_jit.zeroExtend32ToPtr(op1.gpr(), result.gpr());
@@ -2350,7 +2379,7 @@ void SpeculativeJIT::compile(Node& node)
 
         // Code to handle put beyond array bounds.
         silentSpillAllRegisters(scratchReg);
-        callOperation(operationPutByValBeyondArrayBounds, baseReg, propertyReg, valueTagReg, valuePayloadReg);
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict, baseReg, propertyReg, valueTagReg, valuePayloadReg);
         silentFillAllRegisters(scratchReg);
         JITCompiler::Jump wasBeyondArrayBounds = m_jit.jump();
 
@@ -2514,10 +2543,10 @@ void SpeculativeJIT::compile(Node& node)
         m_jit.store32(valueTagGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
         m_jit.store32(valuePayloadGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
         
-        m_jit.add32(Imm32(1), storageLengthGPR);
+        m_jit.add32(TrustedImm32(1), storageLengthGPR);
         m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)));
-        m_jit.add32(Imm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
-        m_jit.move(Imm32(JSValue::Int32Tag), storageGPR);
+        m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+        m_jit.move(TrustedImm32(JSValue::Int32Tag), storageGPR);
         
         MacroAssembler::Jump done = m_jit.jump();
         
@@ -2554,7 +2583,7 @@ void SpeculativeJIT::compile(Node& node)
         
         MacroAssembler::Jump emptyArrayCase = m_jit.branchTest32(MacroAssembler::Zero, storageLengthGPR);
         
-        m_jit.sub32(Imm32(1), storageLengthGPR);
+        m_jit.sub32(TrustedImm32(1), storageLengthGPR);
         
         MacroAssembler::Jump slowCase = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(baseGPR, JSArray::vectorLengthOffset()));
         
@@ -2563,11 +2592,11 @@ void SpeculativeJIT::compile(Node& node)
         
         m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)));
 
-        MacroAssembler::Jump holeCase = m_jit.branch32(MacroAssembler::Equal, Imm32(JSValue::EmptyValueTag), valueTagGPR);
+        MacroAssembler::Jump holeCase = m_jit.branch32(MacroAssembler::Equal, TrustedImm32(JSValue::EmptyValueTag), valueTagGPR);
         
         m_jit.store32(TrustedImm32(JSValue::EmptyValueTag), MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
 
-        m_jit.sub32(MacroAssembler::Imm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+        m_jit.sub32(TrustedImm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
         
         MacroAssembler::JumpList done;
         
@@ -2575,8 +2604,8 @@ void SpeculativeJIT::compile(Node& node)
         
         holeCase.link(&m_jit);
         emptyArrayCase.link(&m_jit);
-        m_jit.move(MacroAssembler::Imm32(jsUndefined().tag()), valueTagGPR);
-        m_jit.move(MacroAssembler::Imm32(jsUndefined().payload()), valuePayloadGPR);
+        m_jit.move(MacroAssembler::TrustedImm32(jsUndefined().tag()), valueTagGPR);
+        m_jit.move(MacroAssembler::TrustedImm32(jsUndefined().payload()), valuePayloadGPR);
         done.append(m_jit.jump());
         
         slowCase.link(&m_jit);
@@ -3384,7 +3413,7 @@ void SpeculativeJIT::compile(Node& node)
 
     case Phi:
     case Flush:
-        ASSERT_NOT_REACHED();
+        break;
 
     case Breakpoint:
 #if ENABLE(DEBUG_WITH_BREAKPOINT)
@@ -3466,6 +3495,77 @@ void SpeculativeJIT::compile(Node& node)
         break;
     }
 
+    case CreateActivation: {
+        JSValueOperand value(this, node.child1());
+        GPRTemporary result(this, value, false);
+        
+        GPRReg valueTagGPR = value.tagGPR();
+        GPRReg valuePayloadGPR = value.payloadGPR();
+        GPRReg resultGPR = result.gpr();
+        
+        m_jit.move(valuePayloadGPR, resultGPR);
+        
+        JITCompiler::Jump alreadyCreated = m_jit.branch32(JITCompiler::NotEqual, valueTagGPR, TrustedImm32(JSValue::EmptyValueTag));
+        
+        silentSpillAllRegisters(resultGPR);
+        callOperation(operationCreateActivation, resultGPR);
+        silentFillAllRegisters(resultGPR);
+        
+        alreadyCreated.link(&m_jit);
+        
+        cellResult(resultGPR, m_compileIndex);
+        break;
+    }
+        
+    case TearOffActivation: {
+        JSValueOperand value(this, node.child1());
+        
+        GPRReg valueTagGPR = value.tagGPR();
+        GPRReg valuePayloadGPR = value.payloadGPR();
+        
+        JITCompiler::Jump notCreated = m_jit.branch32(JITCompiler::Equal, valueTagGPR, TrustedImm32(JSValue::EmptyValueTag));
+        
+        silentSpillAllRegisters(InvalidGPRReg);
+        callOperation(operationTearOffActivation, valuePayloadGPR);
+        silentFillAllRegisters(InvalidGPRReg);
+        
+        notCreated.link(&m_jit);
+        
+        noResult(m_compileIndex);
+        break;
+    }
+        
+    case NewFunctionNoCheck:
+        compileNewFunctionNoCheck(node);
+        break;
+        
+    case NewFunction: {
+        JSValueOperand value(this, node.child1());
+        GPRTemporary result(this, value, false);
+        
+        GPRReg valueTagGPR = value.tagGPR();
+        GPRReg valuePayloadGPR = value.payloadGPR();
+        GPRReg resultGPR = result.gpr();
+        
+        m_jit.move(valuePayloadGPR, resultGPR);
+        
+        JITCompiler::Jump alreadyCreated = m_jit.branch32(JITCompiler::NotEqual, valueTagGPR, TrustedImm32(JSValue::EmptyValueTag));
+        
+        silentSpillAllRegisters(resultGPR);
+        callOperation(
+            operationNewFunction, resultGPR, m_jit.codeBlock()->functionDecl(node.functionDeclIndex()));
+        silentFillAllRegisters(resultGPR);
+        
+        alreadyCreated.link(&m_jit);
+        
+        cellResult(resultGPR, m_compileIndex);
+        break;
+    }
+        
+    case NewFunctionExpression:
+        compileNewFunctionExpression(node);
+        break;
+
     case ForceOSRExit: {
         terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
         break;
@@ -3478,10 +3578,11 @@ void SpeculativeJIT::compile(Node& node)
 
     case InlineStart:
     case Nop:
+    case LastNodeType:
         ASSERT_NOT_REACHED();
         break;
     }
-
+    
     if (!m_compileOkay)
         return;
     
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index 6d375f81f..1597b1674 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -57,7 +57,7 @@ GPRReg SpeculativeJIT::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat
             } else {
                 ASSERT(isJSConstant(nodeIndex));
                 JSValue jsValue = valueOfJSConstant(nodeIndex);
-                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gpr);
+                m_jit.move(MacroAssembler::TrustedImmPtr(JSValue::encode(jsValue)), gpr);
             }
         } else if (info.spillFormat() == DataFormatInteger) {
             m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
@@ -141,7 +141,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
                 // FIXME: should not be reachable?
                 ASSERT(isJSConstant(nodeIndex));
                 JSValue jsValue = valueOfJSConstant(nodeIndex);
-                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gpr);
+                m_jit.move(MacroAssembler::TrustedImmPtr(JSValue::encode(jsValue)), gpr);
                 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
                 info.fillJSValue(gpr, DataFormatJS);
                 unlock(gpr);
@@ -283,7 +283,7 @@ GPRReg SpeculativeJIT::fillJSValue(NodeIndex nodeIndex)
             } else {
                 ASSERT(isJSConstant(nodeIndex));
                 JSValue jsValue = valueOfJSConstant(nodeIndex);
-                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gpr);
+                m_jit.move(MacroAssembler::TrustedImmPtr(JSValue::encode(jsValue)), gpr);
                 info.fillJSValue(gpr, DataFormatJS);
             }
 
@@ -628,14 +628,17 @@ void SpeculativeJIT::nonSpeculativePeepholeBranchNull(NodeUse operand, NodeIndex
 
 bool SpeculativeJIT::nonSpeculativeCompareNull(Node& node, NodeUse operand, bool invert)
 {
-    NodeIndex branchNodeIndex = detectPeepHoleBranch();
-    if (branchNodeIndex != NoNode) {
+    unsigned branchIndexInBlock = detectPeepHoleBranch();
+    if (branchIndexInBlock != UINT_MAX) {
+        NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
+
         ASSERT(node.adjustedRefCount() == 1);
         
         nonSpeculativePeepholeBranchNull(operand, branchNodeIndex, invert);
     
         use(node.child1());
         use(node.child2());
+        m_indexInBlock = branchIndexInBlock;
         m_compileIndex = branchNodeIndex;
         
         return true;
@@ -808,15 +811,21 @@ void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node& node, NodeIndex branch
         
         JITCompiler::Jump twoCellsCase = m_jit.branchTestPtr(JITCompiler::Zero, resultGPR, GPRInfo::tagMaskRegister);
         
-        JITCompiler::Jump numberCase = m_jit.branchTestPtr(JITCompiler::NonZero, resultGPR, GPRInfo::tagTypeNumberRegister);
+        JITCompiler::Jump leftOK = m_jit.branchPtr(JITCompiler::AboveOrEqual, arg1GPR, GPRInfo::tagTypeNumberRegister);
+        JITCompiler::Jump leftDouble = m_jit.branchTestPtr(JITCompiler::NonZero, arg1GPR, GPRInfo::tagTypeNumberRegister);
+        leftOK.link(&m_jit);
+        JITCompiler::Jump rightOK = m_jit.branchPtr(JITCompiler::AboveOrEqual, arg2GPR, GPRInfo::tagTypeNumberRegister);
+        JITCompiler::Jump rightDouble = m_jit.branchTestPtr(JITCompiler::NonZero, arg2GPR, GPRInfo::tagTypeNumberRegister);
+        rightOK.link(&m_jit);
         
-        branch32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, arg1GPR, arg2GPR, taken);
+        branchPtr(invert ? JITCompiler::NotEqual : JITCompiler::Equal, arg1GPR, arg2GPR, taken);
         jump(notTaken, ForceJump);
         
         twoCellsCase.link(&m_jit);
         branchPtr(JITCompiler::Equal, arg1GPR, arg2GPR, invert ? notTaken : taken);
         
-        numberCase.link(&m_jit);
+        leftDouble.link(&m_jit);
+        rightDouble.link(&m_jit);
         
         silentSpillAllRegisters(resultGPR);
         callOperation(operationCompareStrictEq, resultGPR, arg1GPR, arg2GPR);
@@ -865,9 +874,14 @@ void SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq(Node& node, bool invert)
         
         JITCompiler::Jump twoCellsCase = m_jit.branchTestPtr(JITCompiler::Zero, resultGPR, GPRInfo::tagMaskRegister);
         
-        JITCompiler::Jump numberCase = m_jit.branchTestPtr(JITCompiler::NonZero, resultGPR, GPRInfo::tagTypeNumberRegister);
+        JITCompiler::Jump leftOK = m_jit.branchPtr(JITCompiler::AboveOrEqual, arg1GPR, GPRInfo::tagTypeNumberRegister);
+        JITCompiler::Jump leftDouble = m_jit.branchTestPtr(JITCompiler::NonZero, arg1GPR, GPRInfo::tagTypeNumberRegister);
+        leftOK.link(&m_jit);
+        JITCompiler::Jump rightOK = m_jit.branchPtr(JITCompiler::AboveOrEqual, arg2GPR, GPRInfo::tagTypeNumberRegister);
+        JITCompiler::Jump rightDouble = m_jit.branchTestPtr(JITCompiler::NonZero, arg2GPR, GPRInfo::tagTypeNumberRegister);
+        rightOK.link(&m_jit);
         
-        m_jit.compare32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, arg1GPR, arg2GPR, resultGPR);
+        m_jit.comparePtr(invert ? JITCompiler::NotEqual : JITCompiler::Equal, arg1GPR, arg2GPR, resultGPR);
         
         JITCompiler::Jump done1 = m_jit.jump();
         
@@ -878,7 +892,8 @@ void SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq(Node& node, bool invert)
         
         JITCompiler::Jump done2 = m_jit.jump();
         
-        numberCase.link(&m_jit);
+        leftDouble.link(&m_jit);
+        rightDouble.link(&m_jit);
         notEqualCase.link(&m_jit);
         
         silentSpillAllRegisters(resultGPR);
@@ -948,7 +963,7 @@ void SpeculativeJIT::emitCall(Node& node)
     m_jit.loadPtr(MacroAssembler::Address(calleeGPR, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), resultGPR);
     m_jit.storePtr(resultGPR, callFrameSlot(RegisterFile::ScopeChain));
 
-    m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
+    m_jit.addPtr(TrustedImm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
     
     CodeOrigin codeOrigin = at(m_compileIndex).codeOrigin;
     CallBeginToken token = m_jit.beginJSCall();
@@ -959,11 +974,11 @@ void SpeculativeJIT::emitCall(Node& node)
     
     slowPath.link(&m_jit);
     
-    m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    m_jit.addPtr(TrustedImm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
     token = m_jit.beginCall();
     JITCompiler::Call slowCall = m_jit.appendCall(slowCallFunction);
     m_jit.addFastExceptionCheck(slowCall, codeOrigin, token);
-    m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
+    m_jit.addPtr(TrustedImm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
     token = m_jit.beginJSCall();
     JITCompiler::Call theCall = m_jit.call(GPRInfo::returnValueGPR);
     m_jit.notifyCall(theCall, codeOrigin, token);
@@ -1461,10 +1476,10 @@ void SpeculativeJIT::compileObjectEquality(Node& node, const ClassInfo* classInf
         speculationCheck(BadType, JSValueRegs(op2GPR), node.child2().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
     
     MacroAssembler::Jump falseCase = m_jit.branchPtr(MacroAssembler::NotEqual, op1GPR, op2GPR);
-    m_jit.move(Imm32(ValueTrue), resultGPR);
+    m_jit.move(TrustedImm32(ValueTrue), resultGPR);
     MacroAssembler::Jump done = m_jit.jump();
     falseCase.link(&m_jit);
-    m_jit.move(Imm32(ValueFalse), resultGPR);
+    m_jit.move(TrustedImm32(ValueFalse), resultGPR);
     done.link(&m_jit);
 
     jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean);
@@ -1491,7 +1506,7 @@ void SpeculativeJIT::compileDoubleCompare(Node& node, MacroAssembler::DoubleCond
     
     m_jit.move(TrustedImm32(ValueTrue), result.gpr());
     MacroAssembler::Jump trueCase = m_jit.branchDouble(condition, op1.fpr(), op2.fpr());
-    m_jit.xorPtr(Imm32(true), result.gpr());
+    m_jit.xorPtr(TrustedImm32(true), result.gpr());
     trueCase.link(&m_jit);
     
     jsValueResult(result.gpr(), m_compileIndex, DataFormatJSBoolean);
@@ -1577,7 +1592,7 @@ void SpeculativeJIT::compileLogicalNot(Node& node)
         GPRTemporary result(this);
         m_jit.move(TrustedImm32(ValueFalse), result.gpr());
         MacroAssembler::Jump nonZero = m_jit.branchDoubleNonZero(value.fpr(), scratch.fpr());
-        m_jit.xor32(Imm32(true), result.gpr());
+        m_jit.xor32(TrustedImm32(true), result.gpr());
         nonZero.link(&m_jit);
         jsValueResult(result.gpr(), m_compileIndex, DataFormatJSBoolean);
         return;
@@ -1699,18 +1714,18 @@ void SpeculativeJIT::emitBranch(Node& node)
         bool predictBoolean = isBooleanPrediction(m_jit.getPrediction(node.child1()));
     
         if (predictBoolean) {
-            branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(false))), notTaken);
-            branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(true))), taken);
+            branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImmPtr(JSValue::encode(jsBoolean(false))), notTaken);
+            branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImmPtr(JSValue::encode(jsBoolean(true))), taken);
 
             speculationCheck(BadType, JSValueRegs(valueGPR), node.child1(), m_jit.jump());
             value.use();
         } else {
-            branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsNumber(0))), notTaken);
+            branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImmPtr(JSValue::encode(jsNumber(0))), notTaken);
             branchPtr(MacroAssembler::AboveOrEqual, valueGPR, GPRInfo::tagTypeNumberRegister, taken);
     
             if (!predictBoolean) {
-                branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(false))), notTaken);
-                branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(true))), taken);
+                branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImmPtr(JSValue::encode(jsBoolean(false))), notTaken);
+                branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImmPtr(JSValue::encode(jsBoolean(true))), taken);
             }
     
             value.use();
@@ -1729,7 +1744,7 @@ void SpeculativeJIT::emitBranch(Node& node)
 
 void SpeculativeJIT::compile(Node& node)
 {
-    NodeType op = node.op;
+    NodeType op = static_cast<NodeType>(node.op);
 
     switch (op) {
     case JSConstant:
@@ -1751,27 +1766,30 @@ void SpeculativeJIT::compile(Node& node)
             break;
         }
         
-        if (node.variableAccessData()->shouldUseDoubleFormat()) {
-            FPRTemporary result(this);
-            m_jit.loadDouble(JITCompiler::addressFor(node.local()), result.fpr());
-            VirtualRegister virtualRegister = node.virtualRegister();
-            m_fprs.retain(result.fpr(), virtualRegister, SpillOrderDouble);
-            m_generationInfo[virtualRegister].initDouble(m_compileIndex, node.refCount(), result.fpr());
-            break;
-        }
-        
-        GPRTemporary result(this);
-        if (isInt32Prediction(value.m_type)) {
-            m_jit.load32(JITCompiler::payloadFor(node.local()), result.gpr());
-
-            // Like integerResult, but don't useChildren - our children are phi nodes,
-            // and don't represent values within this dataflow with virtual registers.
-            VirtualRegister virtualRegister = node.virtualRegister();
-            m_gprs.retain(result.gpr(), virtualRegister, SpillOrderInteger);
-            m_generationInfo[virtualRegister].initInteger(m_compileIndex, node.refCount(), result.gpr());
-            break;
+        if (!m_jit.graph().isCaptured(node.local())) {
+            if (node.variableAccessData()->shouldUseDoubleFormat()) {
+                FPRTemporary result(this);
+                m_jit.loadDouble(JITCompiler::addressFor(node.local()), result.fpr());
+                VirtualRegister virtualRegister = node.virtualRegister();
+                m_fprs.retain(result.fpr(), virtualRegister, SpillOrderDouble);
+                m_generationInfo[virtualRegister].initDouble(m_compileIndex, node.refCount(), result.fpr());
+                break;
+            }
+            
+            if (isInt32Prediction(value.m_type)) {
+                GPRTemporary result(this);
+                m_jit.load32(JITCompiler::payloadFor(node.local()), result.gpr());
+                
+                // Like integerResult, but don't useChildren - our children are phi nodes,
+                // and don't represent values within this dataflow with virtual registers.
+                VirtualRegister virtualRegister = node.virtualRegister();
+                m_gprs.retain(result.gpr(), virtualRegister, SpillOrderInteger);
+                m_generationInfo[virtualRegister].initInteger(m_compileIndex, node.refCount(), result.gpr());
+                break;
+            }
         }
 
+        GPRTemporary result(this);
         m_jit.loadPtr(JITCompiler::addressFor(node.local()), result.gpr());
 
         // Like jsValueResult, but don't useChildren - our children are phi nodes,
@@ -1780,7 +1798,9 @@ void SpeculativeJIT::compile(Node& node)
         m_gprs.retain(result.gpr(), virtualRegister, SpillOrderJS);
 
         DataFormat format;
-        if (isCellPrediction(value.m_type))
+        if (m_jit.graph().isCaptured(node.local()))
+            format = DataFormatJS;
+        else if (isCellPrediction(value.m_type))
             format = DataFormatJSCell;
         else if (isBooleanPrediction(value.m_type))
             format = DataFormatJSBoolean;
@@ -1817,48 +1837,60 @@ void SpeculativeJIT::compile(Node& node)
         // OSR exit, would not be visible to the old JIT in any way.
         m_codeOriginForOSR = nextNode.codeOrigin;
         
-        if (node.variableAccessData()->shouldUseDoubleFormat()) {
-            SpeculateDoubleOperand value(this, node.child1());
-            m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node.local()));
-            noResult(m_compileIndex);
-            // Indicate that it's no longer necessary to retrieve the value of
-            // this bytecode variable from registers or other locations in the register file,
-            // but that it is stored as a double.
-            valueSourceReferenceForOperand(node.local()) = ValueSource(DoubleInRegisterFile);
-        } else {
+        if (!m_jit.graph().isCaptured(node.local())) {
+            if (node.variableAccessData()->shouldUseDoubleFormat()) {
+                SpeculateDoubleOperand value(this, node.child1());
+                m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node.local()));
+                noResult(m_compileIndex);
+                // Indicate that it's no longer necessary to retrieve the value of
+                // this bytecode variable from registers or other locations in the register file,
+                // but that it is stored as a double.
+                valueSourceReferenceForOperand(node.local()) = ValueSource(DoubleInRegisterFile);
+                break;
+            }
+        
             PredictedType predictedType = node.variableAccessData()->prediction();
             if (isInt32Prediction(predictedType)) {
                 SpeculateIntegerOperand value(this, node.child1());
                 m_jit.store32(value.gpr(), JITCompiler::payloadFor(node.local()));
                 noResult(m_compileIndex);
-            } else if (isArrayPrediction(predictedType)) {
+                valueSourceReferenceForOperand(node.local()) = ValueSource(Int32InRegisterFile);
+                break;
+            }
+            if (isArrayPrediction(predictedType)) {
                 SpeculateCellOperand cell(this, node.child1());
                 GPRReg cellGPR = cell.gpr();
                 if (!isArrayPrediction(m_state.forNode(node.child1()).m_type))
                     speculationCheck(BadType, JSValueRegs(cellGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(cellGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
                 m_jit.storePtr(cellGPR, JITCompiler::addressFor(node.local()));
                 noResult(m_compileIndex);
-            } else if (isByteArrayPrediction(predictedType)) {
+                valueSourceReferenceForOperand(node.local()) = ValueSource(CellInRegisterFile);
+                break;
+            }
+            if (isByteArrayPrediction(predictedType)) {
                 SpeculateCellOperand cell(this, node.child1());
                 GPRReg cellGPR = cell.gpr();
                 if (!isByteArrayPrediction(m_state.forNode(node.child1()).m_type))
                     speculationCheck(BadType, JSValueRegs(cellGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(cellGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
                 m_jit.storePtr(cellGPR, JITCompiler::addressFor(node.local()));
                 noResult(m_compileIndex);
-            } else if (isBooleanPrediction(predictedType)) {
+                valueSourceReferenceForOperand(node.local()) = ValueSource(CellInRegisterFile);
+                break;
+            }
+            if (isBooleanPrediction(predictedType)) {
                 SpeculateBooleanOperand boolean(this, node.child1());
                 m_jit.storePtr(boolean.gpr(), JITCompiler::addressFor(node.local()));
                 noResult(m_compileIndex);
-            } else {
-                JSValueOperand value(this, node.child1());
-                m_jit.storePtr(value.gpr(), JITCompiler::addressFor(node.local()));
-                noResult(m_compileIndex);
+                valueSourceReferenceForOperand(node.local()) = ValueSource(BooleanInRegisterFile);
+                break;
             }
-
-            // Indicate that it's no longer necessary to retrieve the value of
-            // this bytecode variable from registers or other locations in the register file.
-            valueSourceReferenceForOperand(node.local()) = ValueSource::forPrediction(predictedType);
         }
+        
+        JSValueOperand value(this, node.child1());
+        m_jit.storePtr(value.gpr(), JITCompiler::addressFor(node.local()));
+        noResult(m_compileIndex);
+
+        valueSourceReferenceForOperand(node.local()) = ValueSource(ValueInRegisterFile);
         break;
     }
 
@@ -1942,6 +1974,10 @@ void SpeculativeJIT::compile(Node& node)
         compileArithSub(node);
         break;
 
+    case ArithNegate:
+        compileArithNegate(node);
+        break;
+
     case ArithMul:
         compileArithMul(node);
         break;
@@ -2007,7 +2043,7 @@ void SpeculativeJIT::compile(Node& node)
     case ArithAbs: {
         if (at(node.child1()).shouldSpeculateInteger() && node.canSpeculateInteger()) {
             SpeculateIntegerOperand op1(this, node.child1());
-            GPRTemporary result(this, op1);
+            GPRTemporary result(this);
             GPRTemporary scratch(this);
             
             m_jit.zeroExtend32ToPtr(op1.gpr(), result.gpr());
@@ -2389,7 +2425,7 @@ void SpeculativeJIT::compile(Node& node)
 
         // Code to handle put beyond array bounds.
         silentSpillAllRegisters(scratchReg);
-        callOperation(operationPutByValBeyondArrayBounds, baseReg, propertyReg, valueReg);
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict, baseReg, propertyReg, valueReg);
         silentFillAllRegisters(scratchReg);
         JITCompiler::Jump wasBeyondArrayBounds = m_jit.jump();
 
@@ -2549,9 +2585,9 @@ void SpeculativeJIT::compile(Node& node)
         
         m_jit.storePtr(valueGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
         
-        m_jit.add32(Imm32(1), storageLengthGPR);
+        m_jit.add32(TrustedImm32(1), storageLengthGPR);
         m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)));
-        m_jit.add32(Imm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+        m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
         m_jit.orPtr(GPRInfo::tagTypeNumberRegister, storageLengthGPR);
         
         MacroAssembler::Jump done = m_jit.jump();
@@ -2587,7 +2623,7 @@ void SpeculativeJIT::compile(Node& node)
         
         MacroAssembler::Jump emptyArrayCase = m_jit.branchTest32(MacroAssembler::Zero, storageLengthGPR);
         
-        m_jit.sub32(Imm32(1), storageLengthGPR);
+        m_jit.sub32(TrustedImm32(1), storageLengthGPR);
         
         MacroAssembler::Jump slowCase = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(baseGPR, JSArray::vectorLengthOffset()));
         
@@ -2598,7 +2634,7 @@ void SpeculativeJIT::compile(Node& node)
         MacroAssembler::Jump holeCase = m_jit.branchTestPtr(MacroAssembler::Zero, valueGPR);
         
         m_jit.storePtr(MacroAssembler::TrustedImmPtr(0), MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
-        m_jit.sub32(MacroAssembler::Imm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+        m_jit.sub32(MacroAssembler::TrustedImm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
         
         MacroAssembler::JumpList done;
         
@@ -3358,9 +3394,9 @@ void SpeculativeJIT::compile(Node& node)
         break;
     }
 
-    case Phi:
     case Flush:
-        ASSERT_NOT_REACHED();
+    case Phi:
+        break;
 
     case Breakpoint:
 #if ENABLE(DEBUG_WITH_BREAKPOINT)
@@ -3434,6 +3470,73 @@ void SpeculativeJIT::compile(Node& node)
         jsValueResult(resultGPR, m_compileIndex);
         break;
     }
+        
+    case CreateActivation: {
+        JSValueOperand value(this, node.child1());
+        GPRTemporary result(this, value);
+        
+        GPRReg valueGPR = value.gpr();
+        GPRReg resultGPR = result.gpr();
+        
+        m_jit.move(valueGPR, resultGPR);
+        
+        JITCompiler::Jump alreadyCreated = m_jit.branchTestPtr(JITCompiler::NonZero, resultGPR);
+        
+        silentSpillAllRegisters(resultGPR);
+        callOperation(operationCreateActivation, resultGPR);
+        silentFillAllRegisters(resultGPR);
+        
+        alreadyCreated.link(&m_jit);
+        
+        cellResult(resultGPR, m_compileIndex);
+        break;
+    }
+        
+    case TearOffActivation: {
+        JSValueOperand value(this, node.child1());
+        GPRReg valueGPR = value.gpr();
+        
+        JITCompiler::Jump notCreated = m_jit.branchTestPtr(JITCompiler::Zero, valueGPR);
+        
+        silentSpillAllRegisters(InvalidGPRReg);
+        callOperation(operationTearOffActivation, valueGPR);
+        silentFillAllRegisters(InvalidGPRReg);
+        
+        notCreated.link(&m_jit);
+        
+        noResult(m_compileIndex);
+        break;
+    }
+        
+    case NewFunctionNoCheck:
+        compileNewFunctionNoCheck(node);
+        break;
+        
+    case NewFunction: {
+        JSValueOperand value(this, node.child1());
+        GPRTemporary result(this, value);
+        
+        GPRReg valueGPR = value.gpr();
+        GPRReg resultGPR = result.gpr();
+        
+        m_jit.move(valueGPR, resultGPR);
+        
+        JITCompiler::Jump alreadyCreated = m_jit.branchTestPtr(JITCompiler::NonZero, resultGPR);
+        
+        silentSpillAllRegisters(resultGPR);
+        callOperation(
+            operationNewFunction, resultGPR, m_jit.codeBlock()->functionDecl(node.functionDeclIndex()));
+        silentFillAllRegisters(resultGPR);
+        
+        alreadyCreated.link(&m_jit);
+        
+        cellResult(resultGPR, m_compileIndex);
+        break;
+    }
+        
+    case NewFunctionExpression:
+        compileNewFunctionExpression(node);
+        break;
 
     case ForceOSRExit: {
         terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
@@ -3449,6 +3552,10 @@ void SpeculativeJIT::compile(Node& node)
     case Nop:
         ASSERT_NOT_REACHED();
         break;
+        
+    case LastNodeType:
+        ASSERT_NOT_REACHED();
+        break;
     }
 
     if (!m_compileOkay)
diff --git a/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp b/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp
index c0b9fae65..255003612 100644
--- a/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp
@@ -48,39 +48,62 @@ public:
         dataLog("\n");
 #endif
         ScoreBoard scoreBoard(m_graph, m_graph.m_preservedVars);
-        unsigned sizeExcludingPhiNodes = m_graph.m_blocks.last()->end;
-        for (size_t i = 0; i < sizeExcludingPhiNodes; ++i) {
-            Node& node = m_graph[i];
-        
-            if (!node.shouldGenerate())
-                continue;
+        scoreBoard.assertClear();
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        bool needsNewLine = false;
+#endif
+        for (size_t blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
+            BasicBlock* block = m_graph.m_blocks[blockIndex].get();
+            for (size_t indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
+                NodeIndex nodeIndex = block->at(indexInBlock);
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+                if (needsNewLine)
+                    dataLog("\n");
+                dataLog("   @%u:", nodeIndex);
+                needsNewLine = true;
+#endif
+                Node& node = m_graph[nodeIndex];
         
-            // GetLocal nodes are effectively phi nodes in the graph, referencing
-            // results from prior blocks.
-            if (node.op != GetLocal) {
-                // First, call use on all of the current node's children, then
-                // allocate a VirtualRegister for this node. We do so in this
-                // order so that if a child is on its last use, and a
-                // VirtualRegister is freed, then it may be reused for node.
-                if (node.op & NodeHasVarArgs) {
-                    for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
-                        scoreBoard.use(m_graph.m_varArgChildren[childIdx]);
-                } else {
-                    scoreBoard.use(node.child1());
-                    scoreBoard.use(node.child2());
-                    scoreBoard.use(node.child3());
+                if (!node.shouldGenerate() || node.op == Phi || node.op == Flush)
+                    continue;
+            
+                // GetLocal nodes are effectively phi nodes in the graph, referencing
+                // results from prior blocks.
+                if (node.op != GetLocal) {
+                    // First, call use on all of the current node's children, then
+                    // allocate a VirtualRegister for this node. We do so in this
+                    // order so that if a child is on its last use, and a
+                    // VirtualRegister is freed, then it may be reused for node.
+                    if (node.flags & NodeHasVarArgs) {
+                        for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
+                            scoreBoard.use(m_graph.m_varArgChildren[childIdx]);
+                    } else {
+                        scoreBoard.use(node.child1());
+                        scoreBoard.use(node.child2());
+                        scoreBoard.use(node.child3());
+                    }
                 }
-            }
 
-            if (!node.hasResult())
-                continue;
+                if (!node.hasResult())
+                    continue;
 
-            node.setVirtualRegister(scoreBoard.allocate());
-            // 'mustGenerate' nodes have their useCount artificially elevated,
-            // call use now to account for this.
-            if (node.mustGenerate())
-                scoreBoard.use(i);
+                VirtualRegister virtualRegister = scoreBoard.allocate();
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+                dataLog(" Assigning virtual register %u to node %u.",
+                        virtualRegister, nodeIndex);
+#endif
+                node.setVirtualRegister(virtualRegister);
+                // 'mustGenerate' nodes have their useCount artificially elevated,
+                // call use now to account for this.
+                if (node.mustGenerate())
+                    scoreBoard.use(nodeIndex);
+            }
+            scoreBoard.assertClear();
         }
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        if (needsNewLine)
+            dataLog("\n");
+#endif
 
         // 'm_numCalleeRegisters' is the number of locals and temporaries allocated
         // for the function (and checked for on entry). Since we perform a new and
diff --git a/Source/JavaScriptCore/heap/CopiedAllocator.h b/Source/JavaScriptCore/heap/CopiedAllocator.h
index c5ba50d78..dc3c5dfed 100644
--- a/Source/JavaScriptCore/heap/CopiedAllocator.h
+++ b/Source/JavaScriptCore/heap/CopiedAllocator.h
@@ -31,6 +31,7 @@
 namespace JSC {
 
 class CopiedAllocator {
+    friend class JIT;
 public:
     CopiedAllocator();
     void* allocate(size_t);
@@ -93,7 +94,7 @@ inline void CopiedAllocator::resetCurrentBlock(CopiedBlock* newBlock)
 
 inline size_t CopiedAllocator::currentUtilization()
 {
-    return static_cast<size_t>(m_currentOffset - m_currentBlock->m_payload);
+    return static_cast<size_t>(m_currentOffset - m_currentBlock->payload());
 }
 
 inline void CopiedAllocator::resetLastAllocation(void* ptr)
diff --git a/Source/JavaScriptCore/heap/CopiedBlock.h b/Source/JavaScriptCore/heap/CopiedBlock.h
index a57c1150c..387b2ddab 100644
--- a/Source/JavaScriptCore/heap/CopiedBlock.h
+++ b/Source/JavaScriptCore/heap/CopiedBlock.h
@@ -40,26 +40,29 @@ class CopiedBlock : public HeapBlock {
 public:
     CopiedBlock(PageAllocationAligned& allocation)
         : HeapBlock(allocation)
-        , m_offset(m_payload)
+        , m_offset(payload())
         , m_isPinned(false)
     {
-        ASSERT(is8ByteAligned(static_cast<void*>(m_payload)));
+        ASSERT(is8ByteAligned(static_cast<void*>(m_offset)));
 #if USE(JSVALUE64)
-        memset(static_cast<void*>(m_payload), 0, static_cast<size_t>((reinterpret_cast<char*>(this) + allocation.size()) - m_payload));
+        char* offset = static_cast<char*>(m_offset);
+        memset(static_cast<void*>(offset), 0, static_cast<size_t>((reinterpret_cast<char*>(this) + allocation.size()) - offset));
 #else
         JSValue emptyValue;
-        JSValue* limit = reinterpret_cast<JSValue*>(reinterpret_cast<char*>(this) + allocation.size());
-        for (JSValue* currentValue = reinterpret_cast<JSValue*>(m_payload); currentValue < limit; currentValue++)
+        JSValue* limit = reinterpret_cast_ptr<JSValue*>(reinterpret_cast<char*>(this) + allocation.size());
+        for (JSValue* currentValue = reinterpret_cast<JSValue*>(m_offset); currentValue < limit; currentValue++)
             *currentValue = emptyValue;
 #endif
     }
 
+    char* payload()
+    {
+        return reinterpret_cast<char*>(this) + ((sizeof(CopiedBlock) + 7) & ~7);
+    }
+
 private:
     void* m_offset;
     uintptr_t m_isPinned;
-    uintptr_t m_padding;
-    uintptr_t m_dummy;
-    char m_payload[1];
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/CopiedSpace.cpp b/Source/JavaScriptCore/heap/CopiedSpace.cpp
index 3310d2c58..c8470120f 100644
--- a/Source/JavaScriptCore/heap/CopiedSpace.cpp
+++ b/Source/JavaScriptCore/heap/CopiedSpace.cpp
@@ -153,7 +153,7 @@ void CopiedSpace::doneFillingBlock(CopiedBlock* block)
     ASSERT(block->m_offset < reinterpret_cast<char*>(block) + HeapBlock::s_blockSize);
     ASSERT(m_inCopyingPhase);
 
-    if (block->m_offset == block->m_payload) {
+    if (block->m_offset == block->payload()) {
         recycleBlock(block);
         return;
     }
@@ -167,7 +167,7 @@ void CopiedSpace::doneFillingBlock(CopiedBlock* block)
 
     {
         MutexLocker locker(m_memoryStatsLock);
-        m_totalMemoryUtilized += static_cast<size_t>(static_cast<char*>(block->m_offset) - block->m_payload);
+        m_totalMemoryUtilized += static_cast<size_t>(static_cast<char*>(block->m_offset) - block->payload());
     }
 
     {
diff --git a/Source/JavaScriptCore/heap/CopiedSpace.h b/Source/JavaScriptCore/heap/CopiedSpace.h
index 285e2b9a2..e8fa80055 100644
--- a/Source/JavaScriptCore/heap/CopiedSpace.h
+++ b/Source/JavaScriptCore/heap/CopiedSpace.h
@@ -46,6 +46,7 @@ class HeapBlock;
 
 class CopiedSpace {
     friend class SlotVisitor;
+    friend class JIT;
 public:
     CopiedSpace(Heap*);
     void init();
@@ -53,6 +54,8 @@ public:
     CheckedBoolean tryAllocate(size_t, void**);
     CheckedBoolean tryReallocate(void**, size_t, size_t);
     
+    CopiedAllocator& allocator() { return m_allocator; }
+
     void startedCopying();
     void doneCopying();
     bool isInCopyPhase() { return m_inCopyingPhase; }
diff --git a/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h b/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h
index 9a1f63cec..0b1b38d32 100644
--- a/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h
+++ b/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h
@@ -92,7 +92,7 @@ inline CheckedBoolean CopiedSpace::borrowBlock(CopiedBlock** outBlock)
     MutexLocker locker(m_loanedBlocksLock);
     m_numberOfLoanedBlocks++;
 
-    ASSERT(block->m_offset == block->m_payload);
+    ASSERT(block->m_offset == block->payload());
     *outBlock = block;
     return true;
 }
@@ -151,9 +151,9 @@ inline void* CopiedSpace::allocateFromBlock(CopiedBlock* block, size_t bytes)
     ASSERT(is8ByteAligned(block->m_offset));
     
     void* ptr = block->m_offset;
-    ASSERT(block->m_offset >= block->m_payload && block->m_offset < reinterpret_cast<char*>(block) + HeapBlock::s_blockSize);
+    ASSERT(block->m_offset >= block->payload() && block->m_offset < reinterpret_cast<char*>(block) + HeapBlock::s_blockSize);
     block->m_offset = static_cast<void*>((static_cast<char*>(ptr) + bytes));
-    ASSERT(block->m_offset >= block->m_payload && block->m_offset < reinterpret_cast<char*>(block) + HeapBlock::s_blockSize);
+    ASSERT(block->m_offset >= block->payload() && block->m_offset < reinterpret_cast<char*>(block) + HeapBlock::s_blockSize);
 
     ASSERT(is8ByteAligned(ptr));
     return ptr;
diff --git a/Source/JavaScriptCore/heap/DFGCodeBlocks.cpp b/Source/JavaScriptCore/heap/DFGCodeBlocks.cpp
index 03c8df2ff..f0d7c0c89 100644
--- a/Source/JavaScriptCore/heap/DFGCodeBlocks.cpp
+++ b/Source/JavaScriptCore/heap/DFGCodeBlocks.cpp
@@ -67,8 +67,10 @@ void DFGCodeBlocks::jettison(PassOwnPtr<CodeBlock> codeBlockPtr)
 
 void DFGCodeBlocks::clearMarks()
 {
-    for (HashSet<CodeBlock*>::iterator iter = m_set.begin(); iter != m_set.end(); ++iter)
+    for (HashSet<CodeBlock*>::iterator iter = m_set.begin(); iter != m_set.end(); ++iter) {
         (*iter)->m_dfgData->mayBeExecuting = false;
+        (*iter)->m_dfgData->visitAggregateHasBeenCalled = false;
+    }
 }
 
 void DFGCodeBlocks::deleteUnmarkedJettisonedCodeBlocks()
diff --git a/Source/JavaScriptCore/heap/GCAssertions.h b/Source/JavaScriptCore/heap/GCAssertions.h
index f044df6f0..9feefe1d1 100644
--- a/Source/JavaScriptCore/heap/GCAssertions.h
+++ b/Source/JavaScriptCore/heap/GCAssertions.h
@@ -26,7 +26,7 @@
 #ifndef GCAssertions_h
 #define GCAssertions_h
 
-#include "Assertions.h"
+#include <wtf/Assertions.h>
 
 #if ENABLE(GC_VALIDATION)
 #define ASSERT_GC_OBJECT_LOOKS_VALID(cell) do { \
diff --git a/Source/JavaScriptCore/heap/HandleHeap.h b/Source/JavaScriptCore/heap/HandleHeap.h
index 3b9db37a2..c9ee11b2f 100644
--- a/Source/JavaScriptCore/heap/HandleHeap.h
+++ b/Source/JavaScriptCore/heap/HandleHeap.h
@@ -26,11 +26,11 @@
 #ifndef HandleHeap_h
 #define HandleHeap_h
 
-#include "BlockStack.h"
+#include <wtf/BlockStack.h>
 #include "Handle.h"
-#include "HashCountedSet.h"
-#include "SentinelLinkedList.h"
-#include "SinglyLinkedList.h"
+#include <wtf/HashCountedSet.h>
+#include <wtf/SentinelLinkedList.h>
+#include <wtf/SinglyLinkedList.h>
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/heap/HandleStack.h b/Source/JavaScriptCore/heap/HandleStack.h
index a1e8a0b2a..858ebf23f 100644
--- a/Source/JavaScriptCore/heap/HandleStack.h
+++ b/Source/JavaScriptCore/heap/HandleStack.h
@@ -26,8 +26,8 @@
 #ifndef HandleStack_h
 #define HandleStack_h
 
-#include "Assertions.h"
-#include "BlockStack.h"
+#include <wtf/Assertions.h>
+#include <wtf/BlockStack.h>
 #include "Handle.h"
 
 #include <wtf/UnusedParam.h>
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index 1333c7b2c..a5d4a063f 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -328,6 +328,7 @@ Heap::Heap(JSGlobalData* globalData, HeapSize heapSize)
     , m_handleHeap(globalData)
     , m_isSafeToCollect(false)
     , m_globalData(globalData)
+    , m_lastGCLength(0)
 {
     (*m_activityCallback)();
     m_numberOfFreeBlocks = 0;
@@ -781,6 +782,7 @@ void Heap::collect(SweepToggle sweepToggle)
     ASSERT(globalData()->identifierTable == wtfThreadData().currentIdentifierTable());
     ASSERT(m_isSafeToCollect);
     JAVASCRIPTCORE_GC_BEGIN();
+    double lastGCStartTime = WTF::currentTime();
 #if ENABLE(GGC)
     bool fullGC = sweepToggle == DoSweep;
     if (!fullGC)
@@ -835,6 +837,8 @@ void Heap::collect(SweepToggle sweepToggle)
         m_lastFullGCSize = newSize;
         setHighWaterMark(max(proportionalBytes, m_minBytesPerCycle));
     }
+    double lastGCEndTime = WTF::currentTime();
+    m_lastGCLength = lastGCEndTime - lastGCStartTime;
     JAVASCRIPTCORE_GC_END();
 
     (*m_activityCallback)();
diff --git a/Source/JavaScriptCore/heap/Heap.h b/Source/JavaScriptCore/heap/Heap.h
index bcacee6d5..09a95882b 100644
--- a/Source/JavaScriptCore/heap/Heap.h
+++ b/Source/JavaScriptCore/heap/Heap.h
@@ -99,6 +99,7 @@ namespace JSC {
         MarkedAllocator& firstAllocatorWithoutDestructors() { return m_objectSpace.firstAllocator(); }
         MarkedAllocator& allocatorForObjectWithoutDestructor(size_t bytes) { return m_objectSpace.allocatorFor(bytes); }
         MarkedAllocator& allocatorForObjectWithDestructor(size_t bytes) { return m_objectSpace.destructorAllocatorFor(bytes); }
+        CopiedAllocator& storageAllocator() { return m_storageSpace.allocator(); }
         CheckedBoolean tryAllocateStorage(size_t, void**);
         CheckedBoolean tryReallocateStorage(void**, size_t, size_t);
 
@@ -137,6 +138,8 @@ namespace JSC {
 
         void getConservativeRegisterRoots(HashSet<JSCell*>& roots);
 
+        double lastGCLength() { return m_lastGCLength; }
+
     private:
         friend class CodeBlock;
         friend class LLIntOffsetsExtractor;
@@ -235,6 +238,7 @@ namespace JSC {
         bool m_isSafeToCollect;
 
         JSGlobalData* m_globalData;
+        double m_lastGCLength;
     };
 
     bool Heap::isBusy()
diff --git a/Source/JavaScriptCore/heap/MarkedBlock.h b/Source/JavaScriptCore/heap/MarkedBlock.h
index 5f70b69d4..3d0182eb8 100644
--- a/Source/JavaScriptCore/heap/MarkedBlock.h
+++ b/Source/JavaScriptCore/heap/MarkedBlock.h
@@ -321,6 +321,8 @@ namespace JSC {
             return false;
         if ((atomNumber - firstAtom) % m_atomsPerCell) // Filters pointers into cell middles.
             return false;
+        if (atomNumber >= m_endAtom) // Filters pointers into invalid cells out of the range.
+            return false;
 
         return isLive(static_cast<const JSCell*>(p));
     }
diff --git a/Source/JavaScriptCore/heap/MarkedSpace.h b/Source/JavaScriptCore/heap/MarkedSpace.h
index cfcf3f8dc..b553eb1b1 100644
--- a/Source/JavaScriptCore/heap/MarkedSpace.h
+++ b/Source/JavaScriptCore/heap/MarkedSpace.h
@@ -26,7 +26,7 @@
 #include "MarkedAllocator.h"
 #include "MarkedBlock.h"
 #include "MarkedBlockSet.h"
-#include "PageAllocationAligned.h"
+#include <wtf/PageAllocationAligned.h>
 #include <wtf/Bitmap.h>
 #include <wtf/DoublyLinkedList.h>
 #include <wtf/FixedArray.h>
diff --git a/Source/JavaScriptCore/heap/PassWeak.h b/Source/JavaScriptCore/heap/PassWeak.h
index b7aa7b10d..0d86e6c65 100644
--- a/Source/JavaScriptCore/heap/PassWeak.h
+++ b/Source/JavaScriptCore/heap/PassWeak.h
@@ -26,10 +26,10 @@
 #ifndef PassWeak_h
 #define PassWeak_h
 
-#include "Assertions.h"
+#include <wtf/Assertions.h>
 #include "Handle.h"
-#include "NullPtr.h"
-#include "TypeTraits.h"
+#include <wtf/NullPtr.h>
+#include <wtf/TypeTraits.h>
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/heap/Strong.h b/Source/JavaScriptCore/heap/Strong.h
index a9389fa53..d2f2a2278 100644
--- a/Source/JavaScriptCore/heap/Strong.h
+++ b/Source/JavaScriptCore/heap/Strong.h
@@ -26,7 +26,7 @@
 #ifndef Strong_h
 #define Strong_h
 
-#include "Assertions.h"
+#include <wtf/Assertions.h>
 #include "Handle.h"
 #include "HandleHeap.h"
 
diff --git a/Source/JavaScriptCore/heap/Weak.h b/Source/JavaScriptCore/heap/Weak.h
index 96fe1b58c..8291e4440 100644
--- a/Source/JavaScriptCore/heap/Weak.h
+++ b/Source/JavaScriptCore/heap/Weak.h
@@ -26,7 +26,7 @@
 #ifndef Weak_h
 #define Weak_h
 
-#include "Assertions.h"
+#include <wtf/Assertions.h>
 #include "Handle.h"
 #include "HandleHeap.h"
 #include "JSGlobalData.h"
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index 336f109c0..a74d3de89 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -44,6 +44,7 @@
 #include "GetterSetter.h"
 #include "JSActivation.h"
 #include "JSArray.h"
+#include "JSBoundFunction.h"
 #include "JSByteArray.h"
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
@@ -559,31 +560,27 @@ void Interpreter::initialize(LLInt::Data* llintData, bool canUseJIT)
 {
     UNUSED_PARAM(llintData);
     UNUSED_PARAM(canUseJIT);
-#if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER) || ENABLE(LLINT)
-#if !ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
-    // Having LLInt enabled, but not being able to use the JIT, and not having
-    // a computed goto interpreter, is not supported. Not because we cannot
-    // support it, but because I decided to draw the line at the number of
-    // permutations of execution engines that I wanted this code to grok.
-    ASSERT(canUseJIT);
+
+    // If we have LLInt, then we shouldn't be building any kind of classic interpreter.
+#if ENABLE(LLINT) && ENABLE(CLASSIC_INTERPRETER)
+#error "Building both LLInt and the Classic Interpreter is not supported because it doesn't make sense."
 #endif
-    if (canUseJIT) {
+
 #if ENABLE(LLINT)
-        m_opcodeTable = llintData->opcodeMap();
-        for (int i = 0; i < numOpcodeIDs; ++i)
-            m_opcodeIDTable.add(m_opcodeTable[i], static_cast<OpcodeID>(i));
-#else
+    m_opcodeTable = llintData->opcodeMap();
+    for (int i = 0; i < numOpcodeIDs; ++i)
+        m_opcodeIDTable.add(m_opcodeTable[i], static_cast<OpcodeID>(i));
+    m_classicEnabled = false;
+#elif ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
+    if (canUseJIT) {
         // If the JIT is present, don't use jump destinations for opcodes.
         
         for (int i = 0; i < numOpcodeIDs; ++i) {
             Opcode opcode = bitwise_cast<void*>(static_cast<uintptr_t>(i));
             m_opcodeTable[i] = opcode;
         }
-#endif
+        m_classicEnabled = false;
     } else {
-#if ENABLE(LLINT)
-        m_opcodeTable = new Opcode[numOpcodeIDs];
-#endif
         privateExecute(InitializeAndReturn, 0, 0);
         
         for (int i = 0; i < numOpcodeIDs; ++i)
@@ -817,13 +814,14 @@ static void appendSourceToError(CallFrame* callFrame, ErrorInstance* exception,
     exception->putDirect(*globalData, globalData->propertyNames->message, jsString(globalData, message));
 }
 
-static int getLineNumberForCallFrame(CallFrame* callFrame)
+static int getLineNumberForCallFrame(JSGlobalData* globalData, CallFrame* callFrame)
 {
+    UNUSED_PARAM(globalData);
     callFrame = callFrame->removeHostCallFrameFlag();
     CodeBlock* codeBlock = callFrame->codeBlock();
     if (!codeBlock)
         return -1;
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     if (!globalData->canUseJIT())
         return codeBlock->lineNumberForBytecodeOffset(callFrame->bytecodeOffsetForNonDFGCode() - 1);
 #endif
@@ -833,6 +831,8 @@ static int getLineNumberForCallFrame(CallFrame* callFrame)
         return codeBlock->lineNumberForBytecodeOffset(codeBlock->codeOrigin(callFrame->codeOriginIndexForDFG()).bytecodeIndex);
 #endif
     return codeBlock->lineNumberForBytecodeOffset(callFrame->bytecodeOffsetForNonDFGCode());
+#else
+    return -1;
 #endif
 }
 
@@ -842,19 +842,28 @@ static CallFrame* getCallerInfo(JSGlobalData* globalData, CallFrame* callFrame,
     unsigned bytecodeOffset = 0;
     lineNumber = -1;
     ASSERT(!callFrame->hasHostCallFrameFlag());
-    CallFrame* callerFrame = callFrame->codeBlock() ? callFrame->trueCallerFrame() : 0;
+    CallFrame* callerFrame = callFrame->codeBlock() ? callFrame->trueCallerFrame() : callFrame->callerFrame()->removeHostCallFrameFlag();
     bool callframeIsHost = callerFrame->addHostCallFrameFlag() == callFrame->callerFrame();
     ASSERT(!callerFrame->hasHostCallFrameFlag());
 
     if (callerFrame == CallFrame::noCaller() || !callerFrame || !callerFrame->codeBlock())
         return callerFrame;
-
+    
     CodeBlock* callerCodeBlock = callerFrame->codeBlock();
+    
+#if ENABLE(JIT)
+    if (!callFrame->hasReturnPC())
+        callframeIsHost = true;
+#endif
+#if ENABLE(DFG_JIT)
+    if (callFrame->isInlineCallFrame())
+        callframeIsHost = false;
+#endif
 
     if (callframeIsHost) {
         // Don't need to deal with inline callframes here as by definition we haven't
         // inlined a call with an intervening native call frame.
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
         if (!globalData->canUseJIT()) {
             bytecodeOffset = callerFrame->bytecodeOffsetForNonDFGCode();
             lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(bytecodeOffset - 1);
@@ -863,14 +872,15 @@ static CallFrame* getCallerInfo(JSGlobalData* globalData, CallFrame* callFrame,
 #endif
 #if ENABLE(JIT)
 #if ENABLE(DFG_JIT)
-        if (callerCodeBlock && callerCodeBlock->getJITType() == JITCode::DFGJIT)
-            bytecodeOffset = callerCodeBlock->codeOrigin(callerFrame->codeOriginIndexForDFG()).bytecodeIndex;
-        else
+        if (callerCodeBlock && callerCodeBlock->getJITType() == JITCode::DFGJIT) {
+            unsigned codeOriginIndex = callerFrame->codeOriginIndexForDFG();
+            bytecodeOffset = callerCodeBlock->codeOrigin(codeOriginIndex).bytecodeIndex;
+        } else
 #endif
             bytecodeOffset = callerFrame->bytecodeOffsetForNonDFGCode();
 #endif
     } else {
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
         if (!globalData->canUseJIT()) {
             bytecodeOffset = callerCodeBlock->bytecodeOffset(callFrame->returnVPC());
             lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(bytecodeOffset - 1);
@@ -914,7 +924,7 @@ static CallFrame* getCallerInfo(JSGlobalData* globalData, CallFrame* callFrame,
 static ALWAYS_INLINE const UString getSourceURLFromCallFrame(CallFrame* callFrame) 
 {
     ASSERT(!callFrame->hasHostCallFrameFlag());
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
 #if ENABLE(JIT)
     if (callFrame->globalData().canUseJIT())
         return callFrame->codeBlock()->ownerExecutable()->sourceURL();
@@ -949,8 +959,8 @@ void Interpreter::getStackTrace(JSGlobalData* globalData, int line, Vector<Stack
         return;
 
     if (line == -1)
-        line = getLineNumberForCallFrame(callFrame);
-    
+        line = getLineNumberForCallFrame(globalData, callFrame);
+
     while (callFrame && callFrame != CallFrame::noCaller()) {
         UString sourceURL;
         if (callFrame->codeBlock()) {
@@ -1144,7 +1154,7 @@ JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, S
                 break;
             }
             case JSONPPathEntryTypeLookup: {
-                baseObject.put(callFrame, JSONPPath.last().m_pathIndex, JSONPValue);
+                baseObject.putByIndex(callFrame, JSONPPath.last().m_pathIndex, JSONPValue, slot.isStrictMode());
                 if (callFrame->hadException())
                     return jsUndefined();
                 break;
@@ -1184,7 +1194,7 @@ failedJSONP:
 
         m_reentryDepth++;  
 #if ENABLE(JIT)
-        if (callFrame->globalData().canUseJIT())
+        if (!classicEnabled())
             result = program->generatedJITCode().execute(&m_registerFile, newCallFrame, scopeChain->globalData);
         else
 #endif
@@ -1256,7 +1266,7 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
 
             m_reentryDepth++;  
 #if ENABLE(JIT)
-            if (callFrame->globalData().canUseJIT())
+            if (!classicEnabled())
                 result = callData.js.functionExecutable->generatedJITCodeForCall().execute(&m_registerFile, newCallFrame, callDataScopeChain->globalData);
             else
 #endif
@@ -1352,7 +1362,7 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
 
             m_reentryDepth++;  
 #if ENABLE(JIT)
-            if (callFrame->globalData().canUseJIT())
+            if (!classicEnabled())
                 result = constructData.js.functionExecutable->generatedJITCodeForConstruct().execute(&m_registerFile, newCallFrame, constructDataScopeChain->globalData);
             else
 #endif
@@ -2567,24 +2577,6 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_bitor);
         NEXT_INSTRUCTION();
     }
-    DEFINE_OPCODE(op_bitnot) {
-        /* bitnot dst(r) src(r)
-
-           Computes bitwise NOT of register src1 (converted to int32),
-           and puts the result in register dst.
-        */
-        int dst = vPC[1].u.operand;
-        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
-        if (src.isInt32())
-            callFrame->uncheckedR(dst) = jsNumber(~src.asInt32());
-        else {
-            JSValue result = jsNumber(~src.toInt32(callFrame));
-            CHECK_FOR_EXCEPTION();
-            callFrame->uncheckedR(dst) = result;
-        }
-        vPC += OPCODE_LENGTH(op_bitnot);
-        NEXT_INSTRUCTION();
-    }
     DEFINE_OPCODE(op_not) {
         /* not dst(r) src(r)
 
@@ -3785,7 +3777,7 @@ skip_id_custom_self:
                 if (jsArray->canSetIndex(i))
                     jsArray->setIndex(*globalData, i, callFrame->r(value).jsValue());
                 else
-                    jsArray->JSArray::putByIndex(jsArray, callFrame, i, callFrame->r(value).jsValue());
+                    jsArray->JSArray::putByIndex(jsArray, callFrame, i, callFrame->r(value).jsValue(), codeBlock->isStrictMode());
             } else if (isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
                 JSByteArray* jsByteArray = asByteArray(baseValue);
                 JSValue jsValue = callFrame->r(value).jsValue();
@@ -3794,9 +3786,9 @@ skip_id_custom_self:
                 else if (jsValue.isDouble())
                     jsByteArray->setIndex(i, jsValue.asDouble());
                 else
-                    baseValue.put(callFrame, i, jsValue);
+                    baseValue.putByIndex(callFrame, i, jsValue, codeBlock->isStrictMode());
             } else
-                baseValue.put(callFrame, i, callFrame->r(value).jsValue());
+                baseValue.putByIndex(callFrame, i, callFrame->r(value).jsValue(), codeBlock->isStrictMode());
         } else {
             Identifier property(callFrame, subscript.toString(callFrame)->value(callFrame));
             if (!globalData->exception) { // Don't put to an object if toString threw an exception.
@@ -3859,7 +3851,9 @@ skip_id_custom_self:
         unsigned property = vPC[2].u.operand;
         int value = vPC[3].u.operand;
 
-        callFrame->r(base).jsValue().put(callFrame, property, callFrame->r(value).jsValue());
+        JSValue arrayValue = callFrame->r(base).jsValue();
+        ASSERT(isJSArray(arrayValue));
+        asArray(arrayValue)->putDirectIndex(callFrame, property, callFrame->r(value).jsValue(), false);
 
         vPC += OPCODE_LENGTH(op_put_by_index);
         NEXT_INSTRUCTION();
@@ -5316,18 +5310,29 @@ JSValue Interpreter::retrieveArgumentsFromVMCode(CallFrame* callFrame, JSFunctio
 JSValue Interpreter::retrieveCallerFromVMCode(CallFrame* callFrame, JSFunction* function) const
 {
     CallFrame* functionCallFrame = findFunctionCallFrameFromVMCode(callFrame, function);
+
     if (!functionCallFrame)
         return jsNull();
     
-    if (functionCallFrame->callerFrame()->hasHostCallFrameFlag())
+    int lineNumber;
+    CallFrame* callerFrame = getCallerInfo(&callFrame->globalData(), functionCallFrame, lineNumber);
+    if (!callerFrame)
         return jsNull();
-
-    CallFrame* callerFrame = functionCallFrame->trueCallerFrame();
-
     JSValue caller = callerFrame->callee();
     if (!caller)
         return jsNull();
 
+    // Skip over function bindings.
+    ASSERT(caller.isObject());
+    while (asObject(caller)->inherits(&JSBoundFunction::s_info)) {
+        callerFrame = getCallerInfo(&callFrame->globalData(), callerFrame, lineNumber);
+        if (!callerFrame)
+            return jsNull();
+        caller = callerFrame->callee();
+        if (!caller)
+            return jsNull();
+    }
+
     return caller;
 }
 
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocator.cpp b/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
index 75137279e..5912f8652 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
+++ b/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
@@ -29,11 +29,22 @@
 
 #if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND)
 #include "CodeProfiling.h"
+#include <wtf/DataLog.h>
+#include <wtf/HashSet.h>
 #include <wtf/MetaAllocator.h>
 #include <wtf/PageReservation.h>
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+#include <wtf/PassOwnPtr.h>
+#endif
+#include <wtf/ThreadingPrimitives.h>
 #include <wtf/VMTags.h>
 #endif
 
+// Uncomment to create an artificial executable memory usage limit. This limit
+// is imperfect and is primarily useful for testing the VM's ability to handle
+// out-of-executable-memory situations.
+// #define EXECUTABLE_MEMORY_LIMIT 1000000
+
 #if ENABLE(ASSEMBLER)
 
 using namespace WTF;
@@ -47,15 +58,48 @@ public:
     DemandExecutableAllocator()
         : MetaAllocator(32) // round up all allocations to 32 bytes
     {
+        MutexLocker lock(allocatorsMutex());
+        allocators().add(this);
         // Don't preallocate any memory here.
     }
     
     virtual ~DemandExecutableAllocator()
     {
+        {
+            MutexLocker lock(allocatorsMutex());
+            allocators().remove(this);
+        }
         for (unsigned i = 0; i < reservations.size(); ++i)
             reservations.at(i).deallocate();
     }
 
+    static size_t bytesAllocatedByAllAllocators()
+    {
+        size_t total = 0;
+        MutexLocker lock(allocatorsMutex());
+        for (HashSet<DemandExecutableAllocator*>::const_iterator allocator = allocators().begin(); allocator != allocators().end(); ++allocator)
+            total += (*allocator)->bytesAllocated();
+        return total;
+    }
+
+    static size_t bytesCommittedByAllocactors()
+    {
+        size_t total = 0;
+        MutexLocker lock(allocatorsMutex());
+        for (HashSet<DemandExecutableAllocator*>::const_iterator allocator = allocators().begin(); allocator != allocators().end(); ++allocator)
+            total += (*allocator)->bytesCommitted();
+        return total;
+    }
+
+#if ENABLE(META_ALLOCATOR_PROFILE)
+    static void dumpProfileFromAllAllocators()
+    {
+        MutexLocker lock(allocatorsMutex());
+        for (HashSet<DemandExecutableAllocator*>::const_iterator allocator = allocators().begin(); allocator != allocators().end(); ++allocator)
+            (*allocator)->dumpProfile();
+    }
+#endif
+
 protected:
     virtual void* allocateNewSpace(size_t& numPages)
     {
@@ -65,6 +109,11 @@ protected:
         
         numPages = newNumPages;
         
+#ifdef EXECUTABLE_MEMORY_LIMIT
+        if (bytesAllocatedByAllAllocators() >= EXECUTABLE_MEMORY_LIMIT)
+            return 0;
+#endif
+        
         PageReservation reservation = PageReservation::reserve(numPages * pageSize(), OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
         if (!reservation)
             CRASH();
@@ -86,20 +135,50 @@ protected:
 
 private:
     Vector<PageReservation, 16> reservations;
+    static HashSet<DemandExecutableAllocator*>& allocators()
+    {
+        DEFINE_STATIC_LOCAL(HashSet<DemandExecutableAllocator*>, sAllocators, ());
+        return sAllocators;
+    }
+    static Mutex& allocatorsMutex()
+    {
+        DEFINE_STATIC_LOCAL(Mutex, mutex, ());
+        return mutex;
+    }
 };
 
-static DemandExecutableAllocator* allocator;
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+void ExecutableAllocator::initializeAllocator()
+{
+}
+#else
+static DemandExecutableAllocator* gAllocator;
+
+namespace {
+static inline DemandExecutableAllocator* allocator()
+{
+    return gAllocator;
+}
+}
 
 void ExecutableAllocator::initializeAllocator()
 {
-    ASSERT(!allocator);
-    allocator = new DemandExecutableAllocator();
-    CodeProfiling::notifyAllocator(allocator);
+    ASSERT(!gAllocator);
+    gAllocator = new DemandExecutableAllocator();
+    CodeProfiling::notifyAllocator(gAllocator);
 }
+#endif
 
 ExecutableAllocator::ExecutableAllocator(JSGlobalData&)
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+    : m_allocator(adoptPtr(new  DemandExecutableAllocator()))
+#endif
+{
+    ASSERT(allocator());
+}
+
+ExecutableAllocator::~ExecutableAllocator()
 {
-    ASSERT(allocator);
 }
 
 bool ExecutableAllocator::isValid() const
@@ -109,26 +188,44 @@ bool ExecutableAllocator::isValid() const
 
 bool ExecutableAllocator::underMemoryPressure()
 {
+#ifdef EXECUTABLE_MEMORY_LIMIT
+    return DemandExecutableAllocator::bytesAllocatedByAllAllocators() > EXECUTABLE_MEMORY_LIMIT / 2;
+#else
     return false;
+#endif
+}
+
+double ExecutableAllocator::memoryPressureMultiplier(size_t addedMemoryUsage)
+{
+#ifdef EXECUTABLE_MEMORY_LIMIT
+    size_t bytesAllocated = DemandExecutableAllocator::bytesAllocatedByAllAllocators() + addedMemoryUsage;
+    if (bytesAllocated >= EXECUTABLE_MEMORY_LIMIT)
+        bytesAllocated = EXECUTABLE_MEMORY_LIMIT;
+    return static_cast<double>(EXECUTABLE_MEMORY_LIMIT) /
+        (EXECUTABLE_MEMORY_LIMIT - bytesAllocated);
+#else
+    UNUSED_PARAM(addedMemoryUsage);
+    return 1.0;
+#endif
 }
 
-PassRefPtr<ExecutableMemoryHandle> ExecutableAllocator::allocate(JSGlobalData&, size_t sizeInBytes, void* ownerUID)
+PassRefPtr<ExecutableMemoryHandle> ExecutableAllocator::allocate(JSGlobalData&, size_t sizeInBytes, void* ownerUID, JITCompilationEffort effort)
 {
-    RefPtr<ExecutableMemoryHandle> result = allocator->allocate(sizeInBytes, ownerUID);
-    if (!result)
+    RefPtr<ExecutableMemoryHandle> result = allocator()->allocate(sizeInBytes, ownerUID);
+    if (!result && effort == JITCompilationMustSucceed)
         CRASH();
     return result.release();
 }
 
 size_t ExecutableAllocator::committedByteCount()
 {
-    return allocator->bytesCommitted();
+    return DemandExecutableAllocator::bytesCommittedByAllocactors();
 }
 
 #if ENABLE(META_ALLOCATOR_PROFILE)
 void ExecutableAllocator::dumpProfile()
 {
-    allocator->dumpProfile();
+    DemandExecutableAllocator::dumpProfileFromAllAllocators();
 }
 #endif
 
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocator.h b/Source/JavaScriptCore/jit/ExecutableAllocator.h
index 7520913d0..8a14ac67e 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/Source/JavaScriptCore/jit/ExecutableAllocator.h
@@ -25,6 +25,7 @@
 
 #ifndef ExecutableAllocator_h
 #define ExecutableAllocator_h
+#include "JITCompilationEffort.h"
 #include <stddef.h> // for ptrdiff_t
 #include <limits>
 #include <wtf/Assertions.h>
@@ -95,11 +96,16 @@ typedef WTF::MetaAllocatorHandle ExecutableMemoryHandle;
 
 #if ENABLE(JIT) && ENABLE(ASSEMBLER)
 
+#if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND)
+class DemandExecutableAllocator;
+#endif
+
 class ExecutableAllocator {
     enum ProtectionSetting { Writable, Executable };
 
 public:
     ExecutableAllocator(JSGlobalData&);
+    ~ExecutableAllocator();
     
     static void initializeAllocator();
 
@@ -107,13 +113,15 @@ public:
 
     static bool underMemoryPressure();
     
+    static double memoryPressureMultiplier(size_t addedMemoryUsage);
+    
 #if ENABLE(META_ALLOCATOR_PROFILE)
     static void dumpProfile();
 #else
     static void dumpProfile() { }
 #endif
 
-    PassRefPtr<ExecutableMemoryHandle> allocate(JSGlobalData&, size_t sizeInBytes, void* ownerUID);
+    PassRefPtr<ExecutableMemoryHandle> allocate(JSGlobalData&, size_t sizeInBytes, void* ownerUID, JITCompilationEffort);
 
 #if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
     static void makeWritable(void* start, size_t size)
@@ -232,7 +240,13 @@ private:
 
 #if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
     static void reprotectRegion(void*, size_t, ProtectionSetting);
+#if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND)
+    // We create a MetaAllocator for each JS global object.
+    OwnPtr<DemandExecutableAllocator> m_allocator;
+    DemandExecutableAllocator* allocator() { return m_allocator.get(); }
 #endif
+#endif
+
 };
 
 #endif // ENABLE(JIT) && ENABLE(ASSEMBLER)
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
index 37a57e8b7..959ea744b 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
+++ b/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -104,6 +104,10 @@ ExecutableAllocator::ExecutableAllocator(JSGlobalData&)
     ASSERT(allocator);
 }
 
+ExecutableAllocator::~ExecutableAllocator()
+{
+}
+
 bool ExecutableAllocator::isValid() const
 {
     return !!allocator->bytesReserved();
@@ -115,10 +119,23 @@ bool ExecutableAllocator::underMemoryPressure()
     return statistics.bytesAllocated > statistics.bytesReserved / 2;
 }
 
-PassRefPtr<ExecutableMemoryHandle> ExecutableAllocator::allocate(JSGlobalData& globalData, size_t sizeInBytes, void* ownerUID)
+double ExecutableAllocator::memoryPressureMultiplier(size_t addedMemoryUsage)
+{
+    MetaAllocator::Statistics statistics = allocator->currentStatistics();
+    ASSERT(statistics.bytesAllocated <= statistics.bytesReserved);
+    size_t bytesAllocated = statistics.bytesAllocated + addedMemoryUsage;
+    if (bytesAllocated >= statistics.bytesReserved)
+        bytesAllocated = statistics.bytesReserved;
+    return static_cast<double>(statistics.bytesReserved) /
+        (statistics.bytesReserved - bytesAllocated);
+}
+
+PassRefPtr<ExecutableMemoryHandle> ExecutableAllocator::allocate(JSGlobalData& globalData, size_t sizeInBytes, void* ownerUID, JITCompilationEffort effort)
 {
     RefPtr<ExecutableMemoryHandle> result = allocator->allocate(sizeInBytes, ownerUID);
     if (!result) {
+        if (effort == JITCompilationCanFail)
+            return result;
         releaseExecutableMemory(globalData);
         result = allocator->allocate(sizeInBytes, ownerUID);
         if (!result)
diff --git a/Source/JavaScriptCore/jit/HostCallReturnValue.cpp b/Source/JavaScriptCore/jit/HostCallReturnValue.cpp
index 924bc7671..9d449c374 100644
--- a/Source/JavaScriptCore/jit/HostCallReturnValue.cpp
+++ b/Source/JavaScriptCore/jit/HostCallReturnValue.cpp
@@ -27,7 +27,7 @@
 #include "HostCallReturnValue.h"
 
 #include "CallFrame.h"
-#include "InlineASM.h"
+#include <wtf/InlineASM.h>
 #include "JSObject.h"
 #include "JSValueInlineMethods.h"
 #include "ScopeChain.h"
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index 2adc596ce..541cc896a 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -35,7 +35,7 @@ JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse
 #endif
 
 #include "CodeBlock.h"
-#include "CryptographicallyRandomNumber.h"
+#include <wtf/CryptographicallyRandomNumber.h>
 #include "DFGNode.h" // for DFG_SUCCESS_STATS
 #include "Interpreter.h"
 #include "JITInlineMethods.h"
@@ -102,7 +102,7 @@ void JIT::emitOptimizationCheck(OptimizationCheckKind kind)
     Jump skipOptimize = branchAdd32(Signed, TrustedImm32(kind == LoopOptimizationCheck ? Options::executionCounterIncrementForLoop : Options::executionCounterIncrementForReturn), AbsoluteAddress(m_codeBlock->addressOfJITExecuteCounter()));
     JITStubCall stubCall(this, kind == LoopOptimizationCheck ? cti_optimize_from_loop : cti_optimize_from_ret);
     if (kind == LoopOptimizationCheck)
-        stubCall.addArgument(Imm32(m_bytecodeOffset));
+        stubCall.addArgument(TrustedImm32(m_bytecodeOffset));
     stubCall.call();
     skipOptimize.link(this);
 }
@@ -235,14 +235,10 @@ void JIT::privateCompileMainPass()
         DEFINE_UNARY_OP(op_is_object)
         DEFINE_UNARY_OP(op_is_string)
         DEFINE_UNARY_OP(op_is_undefined)
-#if USE(JSVALUE64)
-        DEFINE_UNARY_OP(op_negate)
-#endif
         DEFINE_UNARY_OP(op_typeof)
 
         DEFINE_OP(op_add)
         DEFINE_OP(op_bitand)
-        DEFINE_OP(op_bitnot)
         DEFINE_OP(op_bitor)
         DEFINE_OP(op_bitxor)
         DEFINE_OP(op_call)
@@ -302,9 +298,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_mod)
         DEFINE_OP(op_mov)
         DEFINE_OP(op_mul)
-#if USE(JSVALUE32_64)
         DEFINE_OP(op_negate)
-#endif
         DEFINE_OP(op_neq)
         DEFINE_OP(op_neq_null)
         DEFINE_OP(op_new_array)
@@ -437,7 +431,6 @@ void JIT::privateCompileSlowCases()
         switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
         DEFINE_SLOWCASE_OP(op_add)
         DEFINE_SLOWCASE_OP(op_bitand)
-        DEFINE_SLOWCASE_OP(op_bitnot)
         DEFINE_SLOWCASE_OP(op_bitor)
         DEFINE_SLOWCASE_OP(op_bitxor)
         DEFINE_SLOWCASE_OP(op_call)
@@ -475,10 +468,9 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_method_check)
         DEFINE_SLOWCASE_OP(op_mod)
         DEFINE_SLOWCASE_OP(op_mul)
-#if USE(JSVALUE32_64)
         DEFINE_SLOWCASE_OP(op_negate)
-#endif
         DEFINE_SLOWCASE_OP(op_neq)
+        DEFINE_SLOWCASE_OP(op_new_array)
         DEFINE_SLOWCASE_OP(op_new_object)
         DEFINE_SLOWCASE_OP(op_new_func)
         DEFINE_SLOWCASE_OP(op_new_func_exp)
@@ -509,7 +501,7 @@ void JIT::privateCompileSlowCases()
         
 #if ENABLE(VALUE_PROFILER)
         if (m_canBeOptimized)
-            add32(Imm32(1), AbsoluteAddress(&rareCaseProfile->m_counter));
+            add32(TrustedImm32(1), AbsoluteAddress(&rareCaseProfile->m_counter));
 #endif
 
         emitJumpSlowToHot(jump(), 0);
@@ -527,7 +519,7 @@ void JIT::privateCompileSlowCases()
 #endif
 }
 
-JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
+JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck, JITCompilationEffort effort)
 {
 #if ENABLE(JIT_VERBOSE_OSR)
     printf("Compiling JIT code!\n");
@@ -581,7 +573,7 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
         }
 #endif
 
-        addPtr(Imm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, regT1);
+        addPtr(TrustedImm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, regT1);
         registerFileCheck = branchPtr(Below, AbsoluteAddress(m_globalData->interpreter->registerFile().addressOfEnd()), regT1);
     }
 
@@ -589,7 +581,7 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
     
 #if ENABLE(VALUE_PROFILER)
     if (m_canBeOptimized)
-        add32(Imm32(1), AbsoluteAddress(&m_codeBlock->m_executionEntryCount));
+        add32(TrustedImm32(1), AbsoluteAddress(&m_codeBlock->m_executionEntryCount));
 #endif
 
     privateCompileMainPass();
@@ -625,7 +617,9 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
 
     ASSERT(m_jmpTable.isEmpty());
 
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock);
+    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock, effort);
+    if (patchBuffer.didFailToAllocate())
+        return JITCode();
 
     // Translate vPC offsets into addresses in JIT generated code, for switch tables.
     for (unsigned i = 0; i < m_switches.size(); ++i) {
@@ -702,7 +696,7 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
     }
 
 #if ENABLE(DFG_JIT) || ENABLE(LLINT)
-    if (m_canBeOptimized
+    if (canBeOptimized()
 #if ENABLE(LLINT)
         || true
 #endif
@@ -721,6 +715,10 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
     
     CodeRef result = patchBuffer.finalizeCode();
     
+    m_globalData->machineCodeBytesPerBytecodeWordForBaselineJIT.add(
+        static_cast<double>(result.size()) /
+        static_cast<double>(m_codeBlock->instructions().size()));
+    
 #if ENABLE(JIT_VERBOSE)
     dataLog("JIT generated code for %p at [%p, %p).\n", m_codeBlock, result.executableMemory()->start(), result.executableMemory()->end());
 #endif
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index a2bc4272a..2d2841baf 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -199,9 +199,9 @@ namespace JSC {
         static const int patchPutByIdDefaultOffset = 256;
 
     public:
-        static JITCode compile(JSGlobalData* globalData, CodeBlock* codeBlock, CodePtr* functionEntryArityCheck = 0)
+        static JITCode compile(JSGlobalData* globalData, CodeBlock* codeBlock, JITCompilationEffort effort, CodePtr* functionEntryArityCheck = 0)
         {
-            return JIT(globalData, codeBlock).privateCompile(functionEntryArityCheck);
+            return JIT(globalData, codeBlock).privateCompile(functionEntryArityCheck, effort);
         }
 
         static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress)
@@ -254,8 +254,13 @@ namespace JSC {
 
         static CodeRef compileCTINativeCall(JSGlobalData* globalData, NativeFunction func)
         {
-            if (!globalData->canUseJIT())
+            if (!globalData->canUseJIT()) {
+#if ENABLE(LLINT)
+                return CodeRef::createLLIntCodeRef(llint_native_call_trampoline);
+#else
                 return CodeRef();
+#endif
+            }
             JIT jit(globalData, 0);
             return jit.privateCompileCTINativeCall(globalData, func);
         }
@@ -291,7 +296,7 @@ namespace JSC {
         void privateCompileMainPass();
         void privateCompileLinkPass();
         void privateCompileSlowCases();
-        JITCode privateCompile(CodePtr* functionEntryArityCheck);
+        JITCode privateCompile(CodePtr* functionEntryArityCheck, JITCompilationEffort);
         void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
         void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, const Identifier&, const PropertySlot&, size_t cachedOffset);
         void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, size_t cachedOffset, CallFrame* callFrame);
@@ -336,8 +341,10 @@ namespace JSC {
         void emitWriteBarrier(JSCell* owner, RegisterID value, RegisterID scratch, WriteBarrierMode, WriteBarrierUseKind);
 
         template<typename ClassType, bool destructor, typename StructureType> void emitAllocateBasicJSObject(StructureType, RegisterID result, RegisterID storagePtr);
+        void emitAllocateBasicStorage(size_t, RegisterID result, RegisterID storagePtr);
         template<typename T> void emitAllocateJSFinalObject(T structure, RegisterID result, RegisterID storagePtr);
         void emitAllocateJSFunction(FunctionExecutable*, RegisterID scopeChain, RegisterID result, RegisterID storagePtr);
+        void emitAllocateJSArray(unsigned valuesRegister, unsigned length, RegisterID cellResult, RegisterID storageResult, RegisterID storagePtr);
         
 #if ENABLE(VALUE_PROFILER)
         // This assumes that the value to profile is in regT0 and that regT3 is available for
@@ -464,7 +471,7 @@ namespace JSC {
 #if ENABLE(OPCODE_SAMPLING)
         #error "OPCODE_SAMPLING is not yet supported"
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 48;
+        static const int patchOffsetGetByIdSlowCaseCall = 52;
 #endif
         static const int patchOffsetOpCallCompareToJump = 16;
 
@@ -500,7 +507,7 @@ namespace JSC {
 #if ENABLE(OPCODE_SAMPLING)
         #error "OPCODE_SAMPLING is not yet supported"
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 64;
+        static const int patchOffsetGetByIdSlowCaseCall = 68;
 #endif
         static const int patchOffsetOpCallCompareToJump = 32;
         static const int patchOffsetMethodCheckProtoObj = 32;
@@ -518,7 +525,7 @@ namespace JSC {
 #if ENABLE(OPCODE_SAMPLING)
         #error "OPCODE_SAMPLING is not yet supported"
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 64;
+        static const int patchOffsetGetByIdSlowCaseCall = 68;
 #endif
         static const int patchOffsetOpCallCompareToJump = 32;
         static const int patchOffsetMethodCheckProtoObj = 32;
@@ -778,7 +785,6 @@ namespace JSC {
 
         void emit_op_add(Instruction*);
         void emit_op_bitand(Instruction*);
-        void emit_op_bitnot(Instruction*);
         void emit_op_bitor(Instruction*);
         void emit_op_bitxor(Instruction*);
         void emit_op_call(Instruction*);
@@ -898,7 +904,6 @@ namespace JSC {
 
         void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_bitand(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_bitnot(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_bitor(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_bitxor(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_call(Instruction*, Vector<SlowCaseEntry>::iterator&);
@@ -957,7 +962,7 @@ namespace JSC {
         void emitSlow_op_urshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_new_func(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_new_func_exp(Instruction*, Vector<SlowCaseEntry>::iterator&);
-
+        void emitSlow_op_new_array(Instruction*, Vector<SlowCaseEntry>::iterator&);
         
         void emitRightShift(Instruction*, bool isUnsigned);
         void emitRightShiftSlowCase(Instruction*, Vector<SlowCaseEntry>::iterator&, bool isUnsigned);
diff --git a/Source/JavaScriptCore/jit/JITArithmetic.cpp b/Source/JavaScriptCore/jit/JITArithmetic.cpp
index 362cc6241..1b32e3bcf 100644
--- a/Source/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/Source/JavaScriptCore/jit/JITArithmetic.cpp
@@ -192,6 +192,42 @@ void JIT::emitSlow_op_jngreatereq(Instruction* currentInstruction, Vector<SlowCa
 
 #if USE(JSVALUE64)
 
+void JIT::emit_op_negate(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+
+    Jump srcNotInt = emitJumpIfNotImmediateInteger(regT0);
+    addSlowCase(branchTest32(Zero, regT0, TrustedImm32(0x7fffffff)));
+    neg32(regT0);
+    emitFastArithReTagImmediate(regT0, regT0);
+
+    Jump end = jump();
+
+    srcNotInt.link(this);
+    emitJumpSlowCaseIfNotImmediateNumber(regT0);
+
+    move(TrustedImmPtr(reinterpret_cast<void*>(0x8000000000000000ull)), regT1);
+    xorPtr(regT1, regT0);
+
+    end.link(this);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emitSlow_op_negate(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+
+    linkSlowCase(iter); // 0x7fffffff check
+    linkSlowCase(iter); // double check
+
+    JITStubCall stubCall(this, cti_op_negate);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.call(dst);
+}
+
 void JIT::emit_op_lshift(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
@@ -797,13 +833,13 @@ void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned, unsigned op1, unsign
             addSlowCase(branchMul32(Overflow, regT1, regT2));
             JumpList done;
             done.append(branchTest32(NonZero, regT2));
-            Jump negativeZero = branch32(LessThan, regT0, Imm32(0));
-            done.append(branch32(GreaterThanOrEqual, regT1, Imm32(0)));
+            Jump negativeZero = branch32(LessThan, regT0, TrustedImm32(0));
+            done.append(branch32(GreaterThanOrEqual, regT1, TrustedImm32(0)));
             negativeZero.link(this);
             // We only get here if we have a genuine negative zero. Record this,
             // so that the speculative JIT knows that we failed speculation
             // because of a negative zero.
-            add32(Imm32(1), AbsoluteAddress(&profile->m_counter));
+            add32(TrustedImm32(1), AbsoluteAddress(&profile->m_counter));
             addSlowCase(jump());
             done.link(this);
             move(regT2, regT0);
@@ -927,13 +963,13 @@ void JIT::emit_op_add(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op1)), regT0));
-        emitFastArithIntToImmNoCheck(regT0, regT0);
+        addSlowCase(branchAdd32(Overflow, regT0, Imm32(getConstantOperandImmediateInt(op1)), regT1));
+        emitFastArithIntToImmNoCheck(regT1, regT0);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op2)), regT0));
-        emitFastArithIntToImmNoCheck(regT0, regT0);
+        addSlowCase(branchAdd32(Overflow, regT0, Imm32(getConstantOperandImmediateInt(op2)), regT1));
+        emitFastArithIntToImmNoCheck(regT1, regT0);
     } else
         compileBinaryArithOp(op_add, result, op1, op2, types);
 
@@ -973,8 +1009,8 @@ void JIT::emit_op_mul(Instruction* currentInstruction)
 #endif
         emitGetVirtualRegister(op2, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
-        emitFastArithReTagImmediate(regT0, regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT1));
+        emitFastArithReTagImmediate(regT1, regT0);
     } else if (isOperandConstantImmediateInt(op2) && ((value = getConstantOperandImmediateInt(op2)) > 0)) {
 #if ENABLE(VALUE_PROFILER)
         // Add a special fast case profile because the DFG JIT will expect one.
@@ -982,8 +1018,8 @@ void JIT::emit_op_mul(Instruction* currentInstruction)
 #endif
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
-        emitFastArithReTagImmediate(regT0, regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT1));
+        emitFastArithReTagImmediate(regT1, regT0);
     } else
         compileBinaryArithOp(op_mul, result, op1, op2, types);
 
@@ -1069,7 +1105,7 @@ void JIT::emit_op_div(Instruction* currentInstruction)
     emitFastArithReTagImmediate(regT0, regT0);
     Jump isInteger = jump();
     notInteger.link(this);
-    add32(Imm32(1), AbsoluteAddress(&m_codeBlock->addSpecialFastCaseProfile(m_bytecodeOffset)->m_counter));
+    add32(TrustedImm32(1), AbsoluteAddress(&m_codeBlock->addSpecialFastCaseProfile(m_bytecodeOffset)->m_counter));
     moveDoubleToPtr(fpRegT0, regT0);
     subPtr(tagTypeNumberRegister, regT0);
     isInteger.link(this);
diff --git a/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp b/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp
index 4916261fe..11a758103 100644
--- a/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp
@@ -448,31 +448,6 @@ void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEnt
     stubCall.call(dst);
 }
 
-// BitNot (~)
-
-void JIT::emit_op_bitnot(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned src = currentInstruction[2].u.operand;
-
-    emitLoad(src, regT1, regT0);
-    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
-
-    not32(regT0);
-    emitStoreAndMapInt32(dst, regT1, regT0, dst == src, OPCODE_LENGTH(op_bitnot));
-}
-
-void JIT::emitSlow_op_bitnot(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-
-    linkSlowCase(iter); // int32 check
-
-    JITStubCall stubCall(this, cti_op_bitnot);
-    stubCall.addArgument(regT1, regT0);
-    stubCall.call(dst);
-}
-
 // PostInc (i++)
 
 void JIT::emit_op_post_inc(Instruction* currentInstruction)
@@ -504,7 +479,7 @@ void JIT::emitSlow_op_post_inc(Instruction* currentInstruction, Vector<SlowCaseE
 
     JITStubCall stubCall(this, cti_op_post_inc);
     stubCall.addArgument(srcDst);
-    stubCall.addArgument(Imm32(srcDst));
+    stubCall.addArgument(TrustedImm32(srcDst));
     stubCall.call(dst);
 }
 
@@ -644,9 +619,9 @@ void JIT::emit_op_add(Instruction* currentInstruction)
 void JIT::emitAdd32Constant(unsigned dst, unsigned op, int32_t constant, ResultType opType)
 {
     // Int32 case.
-    emitLoad(op, regT1, regT0);
+    emitLoad(op, regT1, regT2);
     Jump notInt32 = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
-    addSlowCase(branchAdd32(Overflow, Imm32(constant), regT0));
+    addSlowCase(branchAdd32(Overflow, regT2, Imm32(constant), regT0));
     emitStoreInt32(dst, regT0, (op == dst));
 
     // Double case.
@@ -757,8 +732,13 @@ void JIT::emitSub32Constant(unsigned dst, unsigned op, int32_t constant, ResultT
     // Int32 case.
     emitLoad(op, regT1, regT0);
     Jump notInt32 = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
-    addSlowCase(branchSub32(Overflow, Imm32(constant), regT0));
-    emitStoreInt32(dst, regT0, (op == dst));
+#if ENABLE(JIT_CONSTANT_BLINDING)
+    addSlowCase(branchSub32(Overflow, regT0, Imm32(constant), regT2, regT3));
+#else
+    addSlowCase(branchSub32(Overflow, regT0, Imm32(constant), regT2));
+#endif
+    
+    emitStoreInt32(dst, regT2, (op == dst));
 
     // Double case.
     if (!supportsFloatingPoint()) {
@@ -886,7 +866,7 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 emitStoreInt32(dst, regT2);
                 Jump isInteger = jump();
                 notInteger.link(this);
-                add32(Imm32(1), AbsoluteAddress(&m_codeBlock->specialFastCaseProfileForBytecodeOffset(m_bytecodeOffset)->m_counter));
+                add32(TrustedImm32(1), AbsoluteAddress(&m_codeBlock->specialFastCaseProfileForBytecodeOffset(m_bytecodeOffset)->m_counter));
                 emitStoreDouble(dst, fpRegT1);
                 isInteger.link(this);
 #else
@@ -990,7 +970,7 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 emitStoreInt32(dst, regT2);
                 Jump isInteger = jump();
                 notInteger.link(this);
-                add32(Imm32(1), AbsoluteAddress(&m_codeBlock->specialFastCaseProfileForBytecodeOffset(m_bytecodeOffset)->m_counter));
+                add32(TrustedImm32(1), AbsoluteAddress(&m_codeBlock->specialFastCaseProfileForBytecodeOffset(m_bytecodeOffset)->m_counter));
                 emitStoreDouble(dst, fpRegT0);
                 isInteger.link(this);
 #else
@@ -1096,7 +1076,7 @@ void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>
     // We only get here if we have a genuine negative zero. Record this,
     // so that the speculative JIT knows that we failed speculation
     // because of a negative zero.
-    add32(Imm32(1), AbsoluteAddress(&m_codeBlock->specialFastCaseProfileForBytecodeOffset(m_bytecodeOffset)->m_counter));
+    add32(TrustedImm32(1), AbsoluteAddress(&m_codeBlock->specialFastCaseProfileForBytecodeOffset(m_bytecodeOffset)->m_counter));
 #endif
     overflow.link(this);
 
@@ -1175,7 +1155,7 @@ void JIT::emit_op_div(Instruction* currentInstruction)
     emitStoreInt32(dst, regT2);
     end.append(jump());
     notInteger.link(this);
-    add32(Imm32(1), AbsoluteAddress(&m_codeBlock->specialFastCaseProfileForBytecodeOffset(m_bytecodeOffset)->m_counter));
+    add32(TrustedImm32(1), AbsoluteAddress(&m_codeBlock->specialFastCaseProfileForBytecodeOffset(m_bytecodeOffset)->m_counter));
     emitStoreDouble(dst, fpRegT0);
 #else
     emitStoreDouble(dst, fpRegT0);
diff --git a/Source/JavaScriptCore/jit/JITCall.cpp b/Source/JavaScriptCore/jit/JITCall.cpp
index 69dc9540e..73d017d05 100644
--- a/Source/JavaScriptCore/jit/JITCall.cpp
+++ b/Source/JavaScriptCore/jit/JITCall.cpp
@@ -83,8 +83,7 @@ void JIT::compileLoadVarargs(Instruction* instruction)
         slowCase.append(branchPtr(Below, AbsoluteAddress(m_globalData->interpreter->registerFile().addressOfEnd()), regT1));
 
         // Initialize ArgumentCount.
-        emitFastArithReTagImmediate(regT0, regT2);
-        storePtr(regT2, Address(regT1, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
+        store32(regT0, Address(regT1, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
 
         // Initialize 'this'.
         emitGetVirtualRegister(thisValue, regT2);
@@ -93,13 +92,13 @@ void JIT::compileLoadVarargs(Instruction* instruction)
         // Copy arguments.
         neg32(regT0);
         signExtend32ToPtr(regT0, regT0);
-        end.append(branchAddPtr(Zero, Imm32(1), regT0));
+        end.append(branchAddPtr(Zero, TrustedImm32(1), regT0));
         // regT0: -argumentCount
 
         Label copyLoop = label();
         loadPtr(BaseIndex(callFrameRegister, regT0, TimesEight, CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register))), regT2);
         storePtr(regT2, BaseIndex(regT1, regT0, TimesEight, CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register))));
-        branchAddPtr(NonZero, Imm32(1), regT0).linkTo(copyLoop, this);
+        branchAddPtr(NonZero, TrustedImm32(1), regT0).linkTo(copyLoop, this);
 
         end.append(jump());
     }
diff --git a/Source/JavaScriptCore/jit/JITCall32_64.cpp b/Source/JavaScriptCore/jit/JITCall32_64.cpp
index b84ad1a49..7fb6c78b9 100644
--- a/Source/JavaScriptCore/jit/JITCall32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITCall32_64.cpp
@@ -171,7 +171,7 @@ void JIT::compileLoadVarargs(Instruction* instruction)
 
         // Copy arguments.
         neg32(regT2);
-        end.append(branchAdd32(Zero, Imm32(1), regT2));
+        end.append(branchAdd32(Zero, TrustedImm32(1), regT2));
         // regT2: -argumentCount;
 
         Label copyLoop = label();
@@ -179,7 +179,7 @@ void JIT::compileLoadVarargs(Instruction* instruction)
         load32(BaseIndex(callFrameRegister, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag) +(CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register)))), regT1);
         store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload) +(CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register)))));
         store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag) +(CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register)))));
-        branchAdd32(NonZero, Imm32(1), regT2).linkTo(copyLoop, this);
+        branchAdd32(NonZero, TrustedImm32(1), regT2).linkTo(copyLoop, this);
 
         end.append(jump());
     }
diff --git a/Source/JavaScriptCore/jit/JITCompilationEffort.h b/Source/JavaScriptCore/jit/JITCompilationEffort.h
new file mode 100644
index 000000000..5eb680178
--- /dev/null
+++ b/Source/JavaScriptCore/jit/JITCompilationEffort.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JITCompilationEffort_h
+#define JITCompilationEffort_h
+
+namespace JSC {
+
+enum JITCompilationEffort {
+    JITCompilationCanFail,
+    JITCompilationMustSucceed
+};
+
+} // namespace JSC
+
+#endif // JITCompilationEffort_h
+
diff --git a/Source/JavaScriptCore/jit/JITDriver.h b/Source/JavaScriptCore/jit/JITDriver.h
index b204c7737..66cf51925 100644
--- a/Source/JavaScriptCore/jit/JITDriver.h
+++ b/Source/JavaScriptCore/jit/JITDriver.h
@@ -38,7 +38,7 @@
 namespace JSC {
 
 template<typename CodeBlockType>
-inline bool jitCompileIfAppropriate(JSGlobalData& globalData, OwnPtr<CodeBlockType>& codeBlock, JITCode& jitCode, JITCode::JITType jitType)
+inline bool jitCompileIfAppropriate(JSGlobalData& globalData, OwnPtr<CodeBlockType>& codeBlock, JITCode& jitCode, JITCode::JITType jitType, JITCompilationEffort effort)
 {
     if (jitType == codeBlock->getJITType())
         return true;
@@ -48,6 +48,8 @@ inline bool jitCompileIfAppropriate(JSGlobalData& globalData, OwnPtr<CodeBlockTy
     
     codeBlock->unlinkIncomingCalls();
     
+    JITCode oldJITCode = jitCode;
+    
     bool dfgCompiled = false;
     if (jitType == JITCode::DFGJIT)
         dfgCompiled = DFG::tryCompile(globalData, codeBlock.get(), jitCode);
@@ -57,16 +59,21 @@ inline bool jitCompileIfAppropriate(JSGlobalData& globalData, OwnPtr<CodeBlockTy
     } else {
         if (codeBlock->alternative()) {
             codeBlock = static_pointer_cast<CodeBlockType>(codeBlock->releaseAlternative());
+            jitCode = oldJITCode;
+            return false;
+        }
+        jitCode = JIT::compile(&globalData, codeBlock.get(), effort);
+        if (!jitCode) {
+            jitCode = oldJITCode;
             return false;
         }
-        jitCode = JIT::compile(&globalData, codeBlock.get());
     }
     codeBlock->setJITCode(jitCode, MacroAssemblerCodePtr());
     
     return true;
 }
 
-inline bool jitCompileFunctionIfAppropriate(JSGlobalData& globalData, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, SharedSymbolTable*& symbolTable, JITCode::JITType jitType)
+inline bool jitCompileFunctionIfAppropriate(JSGlobalData& globalData, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, SharedSymbolTable*& symbolTable, JITCode::JITType jitType, JITCompilationEffort effort)
 {
     if (jitType == codeBlock->getJITType())
         return true;
@@ -76,6 +83,9 @@ inline bool jitCompileFunctionIfAppropriate(JSGlobalData& globalData, OwnPtr<Fun
     
     codeBlock->unlinkIncomingCalls();
     
+    JITCode oldJITCode = jitCode;
+    MacroAssemblerCodePtr oldJITCodeWithArityCheck = jitCodeWithArityCheck;
+    
     bool dfgCompiled = false;
     if (jitType == JITCode::DFGJIT)
         dfgCompiled = DFG::tryCompileFunction(globalData, codeBlock.get(), jitCode, jitCodeWithArityCheck);
@@ -86,9 +96,16 @@ inline bool jitCompileFunctionIfAppropriate(JSGlobalData& globalData, OwnPtr<Fun
         if (codeBlock->alternative()) {
             codeBlock = static_pointer_cast<FunctionCodeBlock>(codeBlock->releaseAlternative());
             symbolTable = codeBlock->sharedSymbolTable();
+            jitCode = oldJITCode;
+            jitCodeWithArityCheck = oldJITCodeWithArityCheck;
+            return false;
+        }
+        jitCode = JIT::compile(&globalData, codeBlock.get(), effort, &jitCodeWithArityCheck);
+        if (!jitCode) {
+            jitCode = oldJITCode;
+            jitCodeWithArityCheck = oldJITCodeWithArityCheck;
             return false;
         }
-        jitCode = JIT::compile(&globalData, codeBlock.get(), &jitCodeWithArityCheck);
     }
     codeBlock->setJITCode(jitCode, jitCodeWithArityCheck);
     
diff --git a/Source/JavaScriptCore/jit/JITExceptions.cpp b/Source/JavaScriptCore/jit/JITExceptions.cpp
index 2edd3408f..ab1180716 100644
--- a/Source/JavaScriptCore/jit/JITExceptions.cpp
+++ b/Source/JavaScriptCore/jit/JITExceptions.cpp
@@ -48,8 +48,7 @@ ExceptionHandler genericThrow(JSGlobalData* globalData, ExecState* callFrame, JS
     Instruction* catchPCForInterpreter = 0;
     if (handler) {
         catchRoutine = handler->nativeCode.executableAddress();
-        if (callFrame->codeBlock()->hasInstructions())
-            catchPCForInterpreter = &callFrame->codeBlock()->instructions()[handler->target];
+        catchPCForInterpreter = &callFrame->codeBlock()->instructions()[handler->target];
     } else
         catchRoutine = FunctionPtr(ctiOpThrowNotCaught).value();
     
diff --git a/Source/JavaScriptCore/jit/JITInlineMethods.h b/Source/JavaScriptCore/jit/JITInlineMethods.h
index e0310569d..998d5ac18 100644
--- a/Source/JavaScriptCore/jit/JITInlineMethods.h
+++ b/Source/JavaScriptCore/jit/JITInlineMethods.h
@@ -269,7 +269,7 @@ ALWAYS_INLINE void JIT::updateTopCallFrame()
 #if USE(JSVALUE32_64)
         storePtr(TrustedImmPtr(m_codeBlock->instructions().begin() + m_bytecodeOffset + 1), intTagFor(RegisterFile::ArgumentCount));
 #else
-        store32(Imm32(m_bytecodeOffset + 1), intTagFor(RegisterFile::ArgumentCount));
+        store32(TrustedImm32(m_bytecodeOffset + 1), intTagFor(RegisterFile::ArgumentCount));
 #endif
     }
     storePtr(callFrameRegister, &m_globalData->topCallFrame);
@@ -459,6 +459,78 @@ inline void JIT::emitAllocateJSFunction(FunctionExecutable* executable, Register
 #endif
 }
 
+inline void JIT::emitAllocateBasicStorage(size_t size, RegisterID result, RegisterID storagePtr)
+{
+    CopiedAllocator* allocator = &m_globalData->heap.storageAllocator();
+
+    // FIXME: We need to check for wrap-around.
+    // Check to make sure that the allocation will fit in the current block.
+    loadPtr(&allocator->m_currentOffset, result);
+    addPtr(TrustedImm32(size), result);
+    loadPtr(&allocator->m_currentBlock, storagePtr);
+    addPtr(TrustedImm32(HeapBlock::s_blockSize), storagePtr);
+    addSlowCase(branchPtr(AboveOrEqual, result, storagePtr));
+
+    // Load the original offset.
+    loadPtr(&allocator->m_currentOffset, result);
+
+    // Bump the pointer forward.
+    move(result, storagePtr);
+    addPtr(TrustedImm32(size), storagePtr);
+    storePtr(storagePtr, &allocator->m_currentOffset);
+}
+
+inline void JIT::emitAllocateJSArray(unsigned valuesRegister, unsigned length, RegisterID cellResult, RegisterID storageResult, RegisterID storagePtr)
+{
+    unsigned initialLength = std::max(length, 4U);
+    size_t initialStorage = JSArray::storageSize(initialLength);
+
+    // Allocate the cell for the array.
+    emitAllocateBasicJSObject<JSArray, false>(TrustedImmPtr(m_codeBlock->globalObject()->arrayStructure()), cellResult, storagePtr);
+
+    // Allocate the backing store for the array.
+    emitAllocateBasicStorage(initialStorage, storageResult, storagePtr);
+
+    // Store all the necessary info in the ArrayStorage.
+    storePtr(storageResult, Address(storageResult, ArrayStorage::allocBaseOffset()));
+    store32(Imm32(length), Address(storageResult, ArrayStorage::lengthOffset()));
+    store32(Imm32(length), Address(storageResult, ArrayStorage::numValuesInVectorOffset()));
+
+    // Store the newly allocated ArrayStorage.
+    storePtr(storageResult, Address(cellResult, JSArray::storageOffset()));
+
+    // Store the vector length and index bias.
+    store32(Imm32(initialLength), Address(cellResult, JSArray::vectorLengthOffset()));
+    store32(TrustedImm32(0), Address(cellResult, JSArray::indexBiasOffset()));
+
+    // Initialize the subclass data and the sparse value map.
+    storePtr(TrustedImmPtr(0), Address(cellResult, JSArray::subclassDataOffset()));
+    storePtr(TrustedImmPtr(0), Address(cellResult, JSArray::sparseValueMapOffset()));
+
+        // Store the values we have.
+    for (unsigned i = 0; i < length; i++) {
+#if USE(JSVALUE64)
+        loadPtr(Address(callFrameRegister, (valuesRegister + i) * sizeof(Register)), storagePtr);
+        storePtr(storagePtr, Address(storageResult, ArrayStorage::vectorOffset() + sizeof(WriteBarrier<Unknown>) * i));
+#else
+        load32(Address(callFrameRegister, (valuesRegister + i) * sizeof(Register)), storagePtr);
+        store32(storagePtr, Address(storageResult, ArrayStorage::vectorOffset() + sizeof(WriteBarrier<Unknown>) * i));
+        load32(Address(callFrameRegister, (valuesRegister + i) * sizeof(Register) + sizeof(uint32_t)), storagePtr);
+        store32(storagePtr, Address(storageResult, ArrayStorage::vectorOffset() + sizeof(WriteBarrier<Unknown>) * i + sizeof(uint32_t)));
+#endif
+    }
+
+    // Zero out the remaining slots.
+    for (unsigned i = length; i < initialLength; i++) {
+#if USE(JSVALUE64)
+        storePtr(TrustedImmPtr(0), Address(storageResult, ArrayStorage::vectorOffset() + sizeof(WriteBarrier<Unknown>) * i));
+#else
+        store32(TrustedImm32(static_cast<int>(JSValue::EmptyValueTag)), Address(storageResult, ArrayStorage::vectorOffset() + sizeof(WriteBarrier<Unknown>) * i + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+        store32(TrustedImm32(0), Address(storageResult, ArrayStorage::vectorOffset() + sizeof(WriteBarrier<Unknown>) * i + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+#endif
+    }
+}
+
 #if ENABLE(VALUE_PROFILER)
 inline void JIT::emitValueProfilingSite(ValueProfile* valueProfile)
 {
@@ -485,11 +557,11 @@ inline void JIT::emitValueProfilingSite(ValueProfile* valueProfile)
     }
     
     if (m_randomGenerator.getUint32() & 1)
-        add32(Imm32(1), bucketCounterRegister);
+        add32(TrustedImm32(1), bucketCounterRegister);
     else
-        add32(Imm32(3), bucketCounterRegister);
-    and32(Imm32(ValueProfile::bucketIndexMask), bucketCounterRegister);
-    move(ImmPtr(valueProfile->m_buckets), scratch);
+        add32(TrustedImm32(3), bucketCounterRegister);
+    and32(TrustedImm32(ValueProfile::bucketIndexMask), bucketCounterRegister);
+    move(TrustedImmPtr(valueProfile->m_buckets), scratch);
 #if USE(JSVALUE64)
     storePtr(value, BaseIndex(scratch, bucketCounterRegister, TimesEight));
 #elif USE(JSVALUE32_64)
@@ -796,7 +868,10 @@ ALWAYS_INLINE void JIT::emitGetVirtualRegister(int src, RegisterID dst)
     // TODO: we want to reuse values that are already in registers if we can - add a register allocator!
     if (m_codeBlock->isConstantRegisterIndex(src)) {
         JSValue value = m_codeBlock->getConstant(src);
-        move(ImmPtr(JSValue::encode(value)), dst);
+        if (!value.isNumber())
+            move(TrustedImmPtr(JSValue::encode(value)), dst);
+        else
+            move(ImmPtr(JSValue::encode(value)), dst);
         killLastResultRegister();
         return;
     }
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index bc53d2cd8..2db82bf4a 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -29,6 +29,7 @@
 #include "JIT.h"
 
 #include "Arguments.h"
+#include "CopiedSpaceInlineMethods.h"
 #include "Heap.h"
 #include "JITInlineMethods.h"
 #include "JITStubCall.h"
@@ -357,7 +358,10 @@ void JIT::emit_op_mov(Instruction* currentInstruction)
         emitPutVirtualRegister(dst);
     } else {
         if (m_codeBlock->isConstantRegisterIndex(src)) {
-            storePtr(ImmPtr(JSValue::encode(getConstantOperand(src))), Address(callFrameRegister, dst * sizeof(Register)));
+            if (!getConstantOperand(src).isNumber())
+                storePtr(TrustedImmPtr(JSValue::encode(getConstantOperand(src))), Address(callFrameRegister, dst * sizeof(Register)));
+            else
+                storePtr(ImmPtr(JSValue::encode(getConstantOperand(src))), Address(callFrameRegister, dst * sizeof(Register)));
             if (dst == m_lastResultBytecodeRegister)
                 killLastResultRegister();
         } else if ((src == m_lastResultBytecodeRegister) || (dst == m_lastResultBytecodeRegister)) {
@@ -389,7 +393,7 @@ void JIT::emit_op_jmp(Instruction* currentInstruction)
 
 void JIT::emit_op_new_object(Instruction* currentInstruction)
 {
-    emitAllocateJSFinalObject(ImmPtr(m_codeBlock->globalObject()->emptyObjectStructure()), regT0, regT1);
+    emitAllocateJSFinalObject(TrustedImmPtr(m_codeBlock->globalObject()->emptyObjectStructure()), regT0, regT1);
     
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
@@ -594,8 +598,8 @@ void JIT::emit_op_to_primitive(Instruction* currentInstruction)
 void JIT::emit_op_strcat(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_strcat);
-    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
-    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[3].u.operand));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -609,7 +613,7 @@ void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 void JIT::emit_op_ensure_property_exists(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_ensure_property_exists);
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
     stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -618,7 +622,7 @@ void JIT::emit_op_resolve_skip(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_skip);
     stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
-    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[3].u.operand));
     stubCall.callWithValueProfiling(currentInstruction[1].u.operand);
 }
 
@@ -654,7 +658,7 @@ void JIT::emitSlow_op_resolve_global(Instruction* currentInstruction, Vector<Slo
     linkSlowCase(iter);
     JITStubCall stubCall(this, cti_op_resolve_global);
     stubCall.addArgument(TrustedImmPtr(ident));
-    stubCall.addArgument(Imm32(currentIndex));
+    stubCall.addArgument(TrustedImm32(currentIndex));
     stubCall.addArgument(regT0);
     stubCall.callWithValueProfiling(dst);
 }
@@ -763,20 +767,11 @@ void JIT::emit_op_eq(Instruction* currentInstruction)
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
-void JIT::emit_op_bitnot(Instruction* currentInstruction)
-{
-    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
-    emitJumpSlowCaseIfNotImmediateInteger(regT0);
-    not32(regT0);
-    emitFastArithIntToImmNoCheck(regT0, regT0);
-    emitPutVirtualRegister(currentInstruction[1].u.operand);
-}
-
 void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_with_base);
     stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
     stubCall.callWithValueProfiling(currentInstruction[2].u.operand);
 }
 
@@ -784,7 +779,7 @@ void JIT::emit_op_resolve_with_this(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_with_this);
     stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
     stubCall.callWithValueProfiling(currentInstruction[2].u.operand);
 }
 
@@ -971,17 +966,25 @@ void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqTy
     unsigned src2 = currentInstruction[3].u.operand;
 
     emitGetVirtualRegisters(src1, regT0, src2, regT1);
-
-    // Jump to a slow case if either operand is a number, or if both are JSCell*s.
+    
+    // Jump slow if both are cells (to cover strings).
     move(regT0, regT2);
     orPtr(regT1, regT2);
     addSlowCase(emitJumpIfJSCell(regT2));
-    addSlowCase(emitJumpIfImmediateNumber(regT2));
+    
+    // Jump slow if either is a double. First test if it's an integer, which is fine, and then test
+    // if it's a double.
+    Jump leftOK = emitJumpIfImmediateInteger(regT0);
+    addSlowCase(emitJumpIfImmediateNumber(regT0));
+    leftOK.link(this);
+    Jump rightOK = emitJumpIfImmediateInteger(regT1);
+    addSlowCase(emitJumpIfImmediateNumber(regT1));
+    rightOK.link(this);
 
     if (type == OpStrictEq)
-        compare32(Equal, regT1, regT0, regT0);
+        comparePtr(Equal, regT1, regT0, regT0);
     else
-        compare32(NotEqual, regT1, regT0, regT0);
+        comparePtr(NotEqual, regT1, regT0, regT0);
     emitTagAsBoolImmediate(regT0);
 
     emitPutVirtualRegister(dst);
@@ -1034,7 +1037,7 @@ void JIT::emit_op_catch(Instruction* currentInstruction)
 void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_jmp_scopes);
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
     stubCall.call();
     addJump(jump(), currentInstruction[2].u.operand);
 }
@@ -1052,7 +1055,7 @@ void JIT::emit_op_switch_imm(Instruction* currentInstruction)
 
     JITStubCall stubCall(this, cti_op_switch_imm);
     stubCall.addArgument(scrutinee, regT2);
-    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.addArgument(TrustedImm32(tableIndex));
     stubCall.call();
     jump(regT0);
 }
@@ -1070,7 +1073,7 @@ void JIT::emit_op_switch_char(Instruction* currentInstruction)
 
     JITStubCall stubCall(this, cti_op_switch_char);
     stubCall.addArgument(scrutinee, regT2);
-    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.addArgument(TrustedImm32(tableIndex));
     stubCall.call();
     jump(regT0);
 }
@@ -1087,7 +1090,7 @@ void JIT::emit_op_switch_string(Instruction* currentInstruction)
 
     JITStubCall stubCall(this, cti_op_switch_string);
     stubCall.addArgument(scrutinee, regT2);
-    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.addArgument(TrustedImm32(tableIndex));
     stubCall.call();
     jump(regT0);
 }
@@ -1095,7 +1098,10 @@ void JIT::emit_op_switch_string(Instruction* currentInstruction)
 void JIT::emit_op_throw_reference_error(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_throw_reference_error);
-    stubCall.addArgument(ImmPtr(JSValue::encode(m_codeBlock->getConstant(currentInstruction[1].u.operand))));
+    if (!m_codeBlock->getConstant(currentInstruction[1].u.operand).isNumber())
+        stubCall.addArgument(TrustedImmPtr(JSValue::encode(m_codeBlock->getConstant(currentInstruction[1].u.operand))));
+    else
+        stubCall.addArgument(ImmPtr(JSValue::encode(m_codeBlock->getConstant(currentInstruction[1].u.operand))));
     stubCall.call();
 }
 
@@ -1106,9 +1112,9 @@ void JIT::emit_op_debug(Instruction* currentInstruction)
     breakpoint();
 #else
     JITStubCall stubCall(this, cti_op_debug);
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
-    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
-    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[3].u.operand));
     stubCall.call();
 #endif
 }
@@ -1318,14 +1324,6 @@ void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEnt
     emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand); // inverted!
 }
 
-void JIT::emitSlow_op_bitnot(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    linkSlowCase(iter);
-    JITStubCall stubCall(this, cti_op_bitnot);
-    stubCall.addArgument(regT0);
-    stubCall.call(currentInstruction[1].u.operand);
-}
-
 void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
@@ -1380,6 +1378,7 @@ void JIT::emitSlow_op_stricteq(Instruction* currentInstruction, Vector<SlowCaseE
 {
     linkSlowCase(iter);
     linkSlowCase(iter);
+    linkSlowCase(iter);
     JITStubCall stubCall(this, cti_op_stricteq);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
@@ -1390,6 +1389,7 @@ void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCase
 {
     linkSlowCase(iter);
     linkSlowCase(iter);
+    linkSlowCase(iter);
     JITStubCall stubCall(this, cti_op_nstricteq);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
@@ -1565,7 +1565,7 @@ void JIT::emitSlow_op_resolve_global_dynamic(Instruction* currentInstruction, Ve
     linkSlowCase(iter); // We managed to skip all the nodes in the scope chain, but the cache missed.
     JITStubCall stubCall(this, cti_op_resolve_global);
     stubCall.addArgument(TrustedImmPtr(ident));
-    stubCall.addArgument(Imm32(currentIndex));
+    stubCall.addArgument(TrustedImm32(currentIndex));
     stubCall.addArgument(regT0);
     stubCall.callWithValueProfiling(dst);
 }
@@ -1645,17 +1645,39 @@ void JIT::emitSlow_op_new_func_exp(Instruction* currentInstruction, Vector<SlowC
 
 void JIT::emit_op_new_array(Instruction* currentInstruction)
 {
+    int length = currentInstruction[3].u.operand;
+    if (CopiedSpace::isOversize(JSArray::storageSize(length))) {
+        JITStubCall stubCall(this, cti_op_new_array);
+        stubCall.addArgument(TrustedImm32(currentInstruction[2].u.operand));
+        stubCall.addArgument(TrustedImm32(currentInstruction[3].u.operand));
+        stubCall.call(currentInstruction[1].u.operand);
+        return;
+    }
+    int dst = currentInstruction[1].u.operand;
+    int values = currentInstruction[2].u.operand;
+
+    emitAllocateJSArray(values, length, regT0, regT1, regT2);
+    emitStoreCell(dst, regT0); 
+}
+
+void JIT::emitSlow_op_new_array(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int length = currentInstruction[3].u.operand;
+    if (CopiedSpace::isOversize(JSArray::storageSize(length)))
+        return;
+    linkSlowCase(iter); // Not enough space in MarkedSpace for cell.
+    linkSlowCase(iter); // Not enough space in CopiedSpace for storage.
     JITStubCall stubCall(this, cti_op_new_array);
-    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
-    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[3].u.operand));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
 void JIT::emit_op_new_array_buffer(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_new_array_buffer);
-    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
-    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[3].u.operand));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
index 1a09302cf..b67696f35 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -536,7 +536,7 @@ void JIT::emit_op_jmp(Instruction* currentInstruction)
 
 void JIT::emit_op_new_object(Instruction* currentInstruction)
 {
-    emitAllocateJSFinalObject(ImmPtr(m_codeBlock->globalObject()->emptyObjectStructure()), regT0, regT1);
+    emitAllocateJSFinalObject(TrustedImmPtr(m_codeBlock->globalObject()->emptyObjectStructure()), regT0, regT1);
     
     emitStoreCell(currentInstruction[1].u.operand, regT0);
 }
@@ -701,8 +701,8 @@ void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowC
 void JIT::emit_op_strcat(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_strcat);
-    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
-    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[3].u.operand));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -716,7 +716,7 @@ void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 void JIT::emit_op_ensure_property_exists(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_ensure_property_exists);
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
     stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -725,7 +725,7 @@ void JIT::emit_op_resolve_skip(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_skip);
     stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
-    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[3].u.operand));
     stubCall.callWithValueProfiling(currentInstruction[1].u.operand);
 }
 
@@ -766,7 +766,7 @@ void JIT::emitSlow_op_resolve_global(Instruction* currentInstruction, Vector<Slo
     linkSlowCase(iter);
     JITStubCall stubCall(this, cti_op_resolve_global);
     stubCall.addArgument(TrustedImmPtr(ident));
-    stubCall.addArgument(Imm32(currentIndex));
+    stubCall.addArgument(TrustedImm32(currentIndex));
     stubCall.callWithValueProfiling(dst);
 }
 
@@ -817,7 +817,7 @@ void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEnt
 
     if (supportsFloatingPoint()) {
         // regT1 contains the tag from the hot path.
-        Jump notNumber = branch32(Above, regT1, Imm32(JSValue::LowestTag));
+        Jump notNumber = branch32(Above, regT1, TrustedImm32(JSValue::LowestTag));
 
         emitLoadDouble(cond, fpRegT0);
         emitJumpSlowToHot(branchDoubleZeroOrNaN(fpRegT0, fpRegT1), target);
@@ -853,7 +853,7 @@ void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntr
 
     if (supportsFloatingPoint()) {
         // regT1 contains the tag from the hot path.
-        Jump notNumber = branch32(Above, regT1, Imm32(JSValue::LowestTag));
+        Jump notNumber = branch32(Above, regT1, TrustedImm32(JSValue::LowestTag));
 
         emitLoadDouble(cond, fpRegT0);
         emitJumpSlowToHot(branchDoubleNonZero(fpRegT0, fpRegT1), target);
@@ -1164,7 +1164,7 @@ void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_with_base);
     stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
     stubCall.callWithValueProfiling(currentInstruction[2].u.operand);
 }
 
@@ -1172,7 +1172,7 @@ void JIT::emit_op_resolve_with_this(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_with_this);
     stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
     stubCall.callWithValueProfiling(currentInstruction[2].u.operand);
 }
 
@@ -1364,7 +1364,7 @@ void JIT::emit_op_catch(Instruction* currentInstruction)
 void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_jmp_scopes);
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
     stubCall.call();
     addJump(jump(), currentInstruction[2].u.operand);
 }
@@ -1382,7 +1382,7 @@ void JIT::emit_op_switch_imm(Instruction* currentInstruction)
 
     JITStubCall stubCall(this, cti_op_switch_imm);
     stubCall.addArgument(scrutinee);
-    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.addArgument(TrustedImm32(tableIndex));
     stubCall.call();
     jump(regT0);
 }
@@ -1400,7 +1400,7 @@ void JIT::emit_op_switch_char(Instruction* currentInstruction)
 
     JITStubCall stubCall(this, cti_op_switch_char);
     stubCall.addArgument(scrutinee);
-    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.addArgument(TrustedImm32(tableIndex));
     stubCall.call();
     jump(regT0);
 }
@@ -1417,7 +1417,7 @@ void JIT::emit_op_switch_string(Instruction* currentInstruction)
 
     JITStubCall stubCall(this, cti_op_switch_string);
     stubCall.addArgument(scrutinee);
-    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.addArgument(TrustedImm32(tableIndex));
     stubCall.call();
     jump(regT0);
 }
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index 1ee2915dc..19abdbd89 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -57,7 +57,7 @@ void JIT::emit_op_put_by_index(Instruction* currentInstruction)
     
     JITStubCall stubCall(this, cti_op_put_by_index);
     stubCall.addArgument(base);
-    stubCall.addArgument(Imm32(property));
+    stubCall.addArgument(TrustedImm32(property));
     stubCall.addArgument(value);
     stubCall.call();
 }
diff --git a/Source/JavaScriptCore/jit/JITStubCall.h b/Source/JavaScriptCore/jit/JITStubCall.h
index 51401a77f..a525ff227 100644
--- a/Source/JavaScriptCore/jit/JITStubCall.h
+++ b/Source/JavaScriptCore/jit/JITStubCall.h
@@ -104,12 +104,24 @@ namespace JSC {
             m_jit->poke(argument, m_stackIndex);
             m_stackIndex += stackIndexStep;
         }
+        
+        void addArgument(JIT::Imm32 argument)
+        {
+            m_jit->poke(argument, m_stackIndex);
+            m_stackIndex += stackIndexStep;
+        }
 
         void addArgument(JIT::TrustedImmPtr argument)
         {
             m_jit->poke(argument, m_stackIndex);
             m_stackIndex += stackIndexStep;
         }
+        
+        void addArgument(JIT::ImmPtr argument)
+        {
+            m_jit->poke(argument, m_stackIndex);
+            m_stackIndex += stackIndexStep;
+        }
 
         void addArgument(JIT::RegisterID argument)
         {
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index a0a816505..eebe90427 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -43,7 +43,7 @@
 #include "ExceptionHelpers.h"
 #include "GetterSetter.h"
 #include "Heap.h"
-#include "InlineASM.h"
+#include <wtf/InlineASM.h>
 #include "JIT.h"
 #include "JITExceptions.h"
 #include "JSActivation.h"
@@ -1929,12 +1929,16 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     
     CallFrame* callFrame = stackFrame.callFrame;
     CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned bytecodeIndex = stackFrame.args[0].int32();
 
+    unsigned bytecodeIndex = stackFrame.args[0].int32();
+    
 #if ENABLE(JIT_VERBOSE_OSR)
     dataLog("%p: Entered optimize_from_loop with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock, codeBlock->jitExecuteCounter(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
 #endif
 
+    if (!codeBlock->checkIfOptimizationThresholdReached())
+        return;
+
     if (codeBlock->hasOptimizedReplacement()) {
 #if ENABLE(JIT_VERBOSE_OSR)
         dataLog("Considering loop OSR into %p(%p) with success/fail %u/%u.\n", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
@@ -2033,6 +2037,9 @@ DEFINE_STUB_FUNCTION(void, optimize_from_ret)
     dataLog("Entered optimize_from_ret with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock->jitExecuteCounter(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
 #endif
 
+    if (!codeBlock->checkIfOptimizationThresholdReached())
+        return;
+
     if (codeBlock->hasOptimizedReplacement()) {
 #if ENABLE(JIT_VERBOSE_OSR)
         dataLog("Returning from old JIT call frame with optimized replacement %p(%p), with success/fail %u/%u", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
@@ -2546,7 +2553,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val)
             if (jsArray->canSetIndex(i))
                 jsArray->setIndex(*globalData, i, value);
             else
-                JSArray::putByIndex(jsArray, callFrame, i, value);
+                JSArray::putByIndex(jsArray, callFrame, i, value, callFrame->codeBlock()->isStrictMode());
         } else if (isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
             JSByteArray* jsByteArray = asByteArray(baseValue);
             ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_val_byte_array));
@@ -2561,9 +2568,9 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val)
                 }
             }
 
-            baseValue.put(callFrame, i, value);
+            baseValue.putByIndex(callFrame, i, value, callFrame->codeBlock()->isStrictMode());
         } else
-            baseValue.put(callFrame, i, value);
+            baseValue.putByIndex(callFrame, i, value, callFrame->codeBlock()->isStrictMode());
     } else {
         Identifier property(callFrame, subscript.toString(callFrame)->value(callFrame));
         if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
@@ -2604,7 +2611,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val_byte_array)
 
         if (!isJSByteArray(baseValue))
             ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_val));
-        baseValue.put(callFrame, i, value);
+        baseValue.putByIndex(callFrame, i, value, callFrame->codeBlock()->isStrictMode());
     } else {
         Identifier property(callFrame, subscript.toString(callFrame)->value(callFrame));
         if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
@@ -3036,19 +3043,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_rshift)
     return JSValue::encode(result);
 }
 
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitnot)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src = stackFrame.args[0].jsValue();
-
-    ASSERT(!src.isInt32());
-    CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(~src.toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValue::encode(result);
-}
-
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_with_base)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -3307,7 +3301,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_stricteq)
 
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
-
+    
     bool result = JSValue::strictEqual(stackFrame.callFrame, src1, src2);
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(jsBoolean(result));
@@ -3408,7 +3402,9 @@ DEFINE_STUB_FUNCTION(void, op_put_by_index)
     CallFrame* callFrame = stackFrame.callFrame;
     unsigned property = stackFrame.args[1].int32();
 
-    stackFrame.args[0].jsValue().put(callFrame, property, stackFrame.args[2].jsValue());
+    JSValue arrayValue = stackFrame.args[0].jsValue();
+    ASSERT(isJSArray(arrayValue));
+    asArray(arrayValue)->putDirectIndex(callFrame, property, stackFrame.args[2].jsValue(), false);
 }
 
 DEFINE_STUB_FUNCTION(void*, op_switch_imm)
diff --git a/Source/JavaScriptCore/jit/JITStubs.h b/Source/JavaScriptCore/jit/JITStubs.h
index 890d99747..49f666465 100644
--- a/Source/JavaScriptCore/jit/JITStubs.h
+++ b/Source/JavaScriptCore/jit/JITStubs.h
@@ -32,6 +32,7 @@
 
 #include "CallData.h"
 #include "Intrinsic.h"
+#include "LowLevelInterpreter.h"
 #include "MacroAssemblerCodeRef.h"
 #include "Register.h"
 #include "ThunkGenerators.h"
@@ -39,6 +40,8 @@
 
 namespace JSC {
 
+#if ENABLE(JIT)
+
     struct StructureStubInfo;
 
     class CodeBlock;
@@ -261,8 +264,6 @@ namespace JSC {
 
 #define JITSTACKFRAME_ARGS_INDEX (OBJECT_OFFSETOF(JITStackFrame, args) / sizeof(void*))
 
-#if ENABLE(JIT)
-
 #define STUB_ARGS_DECLARATION void** args
 #define STUB_ARGS (args)
 
@@ -306,8 +307,22 @@ namespace JSC {
         MacroAssemblerCodePtr ctiVirtualConstructLink() { return m_trampolineStructure.ctiVirtualConstructLink; }
         MacroAssemblerCodePtr ctiVirtualCall() { return m_trampolineStructure.ctiVirtualCall; }
         MacroAssemblerCodePtr ctiVirtualConstruct() { return m_trampolineStructure.ctiVirtualConstruct; }
-        MacroAssemblerCodePtr ctiNativeCall() { return m_trampolineStructure.ctiNativeCall; }
-        MacroAssemblerCodePtr ctiNativeConstruct() { return m_trampolineStructure.ctiNativeConstruct; }
+        MacroAssemblerCodePtr ctiNativeCall()
+        {
+#if ENABLE(LLINT)
+            if (!m_executableMemory)
+                return MacroAssemblerCodePtr::createLLIntCodePtr(llint_native_call_trampoline);
+#endif
+            return m_trampolineStructure.ctiNativeCall;
+        }
+        MacroAssemblerCodePtr ctiNativeConstruct()
+        {
+#if ENABLE(LLINT)
+            if (!m_executableMemory)
+                return MacroAssemblerCodePtr::createLLIntCodePtr(llint_native_construct_trampoline);
+#endif
+            return m_trampolineStructure.ctiNativeConstruct;
+        }
         MacroAssemblerCodePtr ctiSoftModulo() { return m_trampolineStructure.ctiSoftModulo; }
 
         MacroAssemblerCodeRef ctiStub(JSGlobalData*, ThunkGenerator);
@@ -330,7 +345,6 @@ namespace JSC {
 extern "C" {
     EncodedJSValue JIT_STUB cti_op_add(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_bitand(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_bitnot(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_bitor(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_bitxor(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_call_NotJSFunction(STUB_ARGS_DECLARATION);
diff --git a/Source/JavaScriptCore/jit/ThunkGenerators.cpp b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
index 099796986..371aff2f9 100644
--- a/Source/JavaScriptCore/jit/ThunkGenerators.cpp
+++ b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
@@ -27,7 +27,7 @@
 #include "ThunkGenerators.h"
 
 #include "CodeBlock.h"
-#include "InlineASM.h"
+#include <wtf/InlineASM.h>
 #include "SpecializedThunkJIT.h"
 #include <wtf/text/StringImpl.h>
 
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index 9f207c510..3d9d1d33e 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -206,9 +206,9 @@ protected:
         addConstructableFunction(globalData, "Float64Array", constructJSFloat64Array, 1);
 #endif
 
-        JSObject* array = constructEmptyArray(globalExec());
+        JSArray* array = constructEmptyArray(globalExec());
         for (size_t i = 0; i < arguments.size(); ++i)
-            array->methodTable()->putByIndex(array, globalExec(), i, jsString(globalExec(), arguments[i]));
+            array->putDirectIndex(globalExec(), i, jsString(globalExec(), arguments[i]), false);
         putDirect(globalData, Identifier(globalExec(), "arguments"), array);
     }
 
diff --git a/Source/JavaScriptCore/llint/LLIntData.cpp b/Source/JavaScriptCore/llint/LLIntData.cpp
index c0fe78142..983a7d706 100644
--- a/Source/JavaScriptCore/llint/LLIntData.cpp
+++ b/Source/JavaScriptCore/llint/LLIntData.cpp
@@ -72,6 +72,7 @@ void Data::performAssertions(JSGlobalData& globalData)
     ASSERT(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag) == 4);
     ASSERT(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload) == 0);
 #endif
+#if USE(JSVALUE32_64)
     ASSERT(JSValue::Int32Tag == -1);
     ASSERT(JSValue::BooleanTag == -2);
     ASSERT(JSValue::NullTag == -3);
@@ -80,12 +81,26 @@ void Data::performAssertions(JSGlobalData& globalData)
     ASSERT(JSValue::EmptyValueTag == -6);
     ASSERT(JSValue::DeletedValueTag == -7);
     ASSERT(JSValue::LowestTag == -7);
+#else
+    ASSERT(TagBitTypeOther == 0x2);
+    ASSERT(TagBitBool == 0x4);
+    ASSERT(TagBitUndefined == 0x8);
+    ASSERT(ValueEmpty == 0x0);
+    ASSERT(ValueFalse == (TagBitTypeOther | TagBitBool));
+    ASSERT(ValueTrue == (TagBitTypeOther | TagBitBool | 1));
+    ASSERT(ValueUndefined == (TagBitTypeOther | TagBitUndefined));
+    ASSERT(ValueNull == TagBitTypeOther);
+#endif
     ASSERT(StringType == 5);
     ASSERT(ObjectType == 13);
     ASSERT(MasqueradesAsUndefined == 1);
     ASSERT(ImplementsHasInstance == 2);
     ASSERT(ImplementsDefaultHasInstance == 8);
+#if USE(JSVALUE64)
+    ASSERT(&globalData.heap.allocatorForObjectWithoutDestructor(sizeof(JSFinalObject)) - &globalData.heap.firstAllocatorWithoutDestructors() == 1);
+#else
     ASSERT(&globalData.heap.allocatorForObjectWithoutDestructor(sizeof(JSFinalObject)) - &globalData.heap.firstAllocatorWithoutDestructors() == 3);
+#endif
     ASSERT(FirstConstantRegisterIndex == 0x40000000);
     ASSERT(GlobalCode == 0);
     ASSERT(EvalCode == 1);
diff --git a/Source/JavaScriptCore/llint/LLIntEntrypoints.cpp b/Source/JavaScriptCore/llint/LLIntEntrypoints.cpp
index f610f4b4c..dd7d9433d 100644
--- a/Source/JavaScriptCore/llint/LLIntEntrypoints.cpp
+++ b/Source/JavaScriptCore/llint/LLIntEntrypoints.cpp
@@ -30,8 +30,10 @@
 
 #include "JITCode.h"
 #include "JSGlobalData.h"
+#include "JSObject.h"
 #include "LLIntThunks.h"
 #include "LowLevelInterpreter.h"
+#include "ScopeChain.h"
 
 namespace JSC { namespace LLInt {
 
@@ -39,14 +41,14 @@ void getFunctionEntrypoint(JSGlobalData& globalData, CodeSpecializationKind kind
 {
     if (!globalData.canUseJIT()) {
         if (kind == CodeForCall) {
-            jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_call_prologue))));
-            arityCheck = MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_call_arity_check));
+            jitCode = JITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_call_prologue), JITCode::InterpreterThunk);
+            arityCheck = MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_call_arity_check);
             return;
         }
 
         ASSERT(kind == CodeForConstruct);
-        jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_construct_prologue))));
-        arityCheck = MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_construct_arity_check));
+        jitCode = JITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_construct_prologue), JITCode::InterpreterThunk);
+        arityCheck = MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_construct_arity_check);
         return;
     }
     
@@ -64,7 +66,7 @@ void getFunctionEntrypoint(JSGlobalData& globalData, CodeSpecializationKind kind
 void getEvalEntrypoint(JSGlobalData& globalData, JITCode& jitCode)
 {
     if (!globalData.canUseJIT()) {
-        jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_eval_prologue))));
+        jitCode = JITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_eval_prologue), JITCode::InterpreterThunk);
         return;
     }
     
@@ -74,7 +76,7 @@ void getEvalEntrypoint(JSGlobalData& globalData, JITCode& jitCode)
 void getProgramEntrypoint(JSGlobalData& globalData, JITCode& jitCode)
 {
     if (!globalData.canUseJIT()) {
-        jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_program_prologue))));
+        jitCode = JITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_program_prologue), JITCode::InterpreterThunk);
         return;
     }
     
diff --git a/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h b/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h
index 9fe86fac4..2539ee9b3 100644
--- a/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h
+++ b/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h
@@ -43,6 +43,18 @@
 #define OFFLINE_ASM_ARMv7 0
 #endif
 
+#if CPU(X86_64)
+#define OFFLINE_ASM_X86_64 1
+#else
+#define OFFLINE_ASM_X86_64 0
+#endif
+
+#if USE(JSVALUE64)
+#define OFFLINE_ASM_JSVALUE64 1
+#else
+#define OFFLINE_ASM_JSVALUE64 0
+#endif
+
 #if !ASSERT_DISABLED
 #define OFFLINE_ASM_ASSERT_ENABLED 1
 #else
@@ -73,6 +85,12 @@
 #define OFFLINE_ASM_ALWAYS_ALLOCATE_SLOW 0
 #endif
 
+#if ENABLE(VALUE_PROFILER)
+#define OFFLINE_ASM_VALUE_PROFILER 1
+#else
+#define OFFLINE_ASM_VALUE_PROFILER 0
+#endif
+
 #if CPU(ARM_THUMB2)
 #define OFFLINE_ASM_GLOBAL_LABEL(label)          \
     ".globl " SYMBOL_STRING(label) "\n"          \
diff --git a/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
index 5b76cd521..f863cb218 100644
--- a/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
+++ b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
@@ -61,6 +61,7 @@ public:
 
 const unsigned* LLIntOffsetsExtractor::dummy()
 {
+#if ENABLE(JIT)
 // This is a file generated by offlineasm/generate_offsets_extractor.rb, and contains code
 // to create a table of offsets, sizes, and a header identifying what combination of
 // Platform.h macros we have set. We include it inside of a method on LLIntOffsetsExtractor
@@ -69,6 +70,9 @@ const unsigned* LLIntOffsetsExtractor::dummy()
 // compiler to kindly step aside and yield to our best intentions.
 #include "LLIntDesiredOffsets.h"
     return extractorTable;
+#else
+    return 0;
+#endif
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index 3203d25d2..b6bb664bc 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -65,16 +65,7 @@ namespace JSC { namespace LLInt {
 #define LLINT_OP_C(index) (exec->r(pc[index].u.operand))
 
 #define LLINT_RETURN_TWO(first, second) do {       \
-        union {                                    \
-            struct {                               \
-                void* a;                           \
-                void* b;                           \
-            } pair;                                \
-            int64_t i;                             \
-        } __rt_u;                                  \
-        __rt_u.pair.a = first;                     \
-        __rt_u.pair.b = second;                    \
-        return __rt_u.i;                           \
+        return encodeResult(first, second);        \
     } while (false)
 
 #define LLINT_END_IMPL() LLINT_RETURN_TWO(pc, exec)
@@ -114,6 +105,7 @@ namespace JSC { namespace LLInt {
         LLINT_END_IMPL();                       \
     } while (false)
 
+#if ENABLE(VALUE_PROFILER)
 #define LLINT_RETURN_PROFILED(opcode, value) do {               \
         JSValue __rp_returnValue = (value);                     \
         LLINT_CHECK_EXCEPTION();                                \
@@ -122,6 +114,9 @@ namespace JSC { namespace LLInt {
             JSValue::encode(__rp_returnValue);                  \
         LLINT_END_IMPL();                                       \
     } while (false)
+#else // ENABLE(VALUE_PROFILER)
+#define LLINT_RETURN_PROFILED(opcode, value) LLINT_RETURN(value)
+#endif // ENABLE(VALUE_PROFILER)
 
 #define LLINT_CALL_END_IMPL(exec, callTarget) LLINT_RETURN_TWO((callTarget), (exec))
 
@@ -163,7 +158,6 @@ extern "C" SlowPathReturnType llint_trace_operand(ExecState* exec, Instruction*
 
 extern "C" SlowPathReturnType llint_trace_value(ExecState* exec, Instruction* pc, int fromWhere, int operand)
 {
-    LLINT_BEGIN();
     JSValue value = LLINT_OP_C(operand).jsValue();
     union {
         struct {
@@ -184,14 +178,13 @@ extern "C" SlowPathReturnType llint_trace_value(ExecState* exec, Instruction* pc
             u.bits.tag,
             u.bits.payload,
             value.description());
-    LLINT_END();
+    LLINT_END_IMPL();
 }
 
 LLINT_SLOW_PATH_DECL(trace_prologue)
 {
-    LLINT_BEGIN();
     dataLog("%p / %p: in prologue.\n", exec->codeBlock(), exec);
-    LLINT_END();
+    LLINT_END_IMPL();
 }
 
 static void traceFunctionPrologue(ExecState* exec, const char* comment, CodeSpecializationKind kind)
@@ -207,54 +200,52 @@ static void traceFunctionPrologue(ExecState* exec, const char* comment, CodeSpec
 
 LLINT_SLOW_PATH_DECL(trace_prologue_function_for_call)
 {
-    LLINT_BEGIN();
     traceFunctionPrologue(exec, "call prologue", CodeForCall);
-    LLINT_END();
+    LLINT_END_IMPL();
 }
 
 LLINT_SLOW_PATH_DECL(trace_prologue_function_for_construct)
 {
-    LLINT_BEGIN();
     traceFunctionPrologue(exec, "construct prologue", CodeForConstruct);
-    LLINT_END();
+    LLINT_END_IMPL();
 }
 
 LLINT_SLOW_PATH_DECL(trace_arityCheck_for_call)
 {
-    LLINT_BEGIN();
     traceFunctionPrologue(exec, "call arity check", CodeForCall);
-    LLINT_END();
+    LLINT_END_IMPL();
 }
 
 LLINT_SLOW_PATH_DECL(trace_arityCheck_for_construct)
 {
-    LLINT_BEGIN();
     traceFunctionPrologue(exec, "construct arity check", CodeForConstruct);
-    LLINT_END();
+    LLINT_END_IMPL();
 }
 
 LLINT_SLOW_PATH_DECL(trace)
 {
-    LLINT_BEGIN();
     dataLog("%p / %p: executing bc#%zu, %s, scope %p\n",
             exec->codeBlock(),
             exec,
             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
             opcodeNames[exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode)],
             exec->scopeChain());
-    LLINT_END();
+    if (exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode) == op_ret) {
+        dataLog("Will be returning to %p\n", exec->returnPC().value());
+        dataLog("The new cfr will be %p\n", exec->callerFrame());
+    }
+    LLINT_END_IMPL();
 }
 
 LLINT_SLOW_PATH_DECL(special_trace)
 {
-    LLINT_BEGIN();
     dataLog("%p / %p: executing special case bc#%zu, op#%u, return PC is %p\n",
             exec->codeBlock(),
             exec,
             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
             exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode),
             exec->returnPC().value());
-    LLINT_END();
+    LLINT_END_IMPL();
 }
 
 inline bool shouldJIT(ExecState* exec)
@@ -263,6 +254,41 @@ inline bool shouldJIT(ExecState* exec)
     return exec->globalData().canUseJIT();
 }
 
+// Returns true if we should try to OSR.
+inline bool jitCompileAndSetHeuristics(CodeBlock* codeBlock, ExecState* exec)
+{
+    if (!codeBlock->checkIfJITThresholdReached()) {
+#if ENABLE(JIT_VERBOSE_OSR)
+        dataLog("    JIT threshold should be lifted.\n");
+#endif
+        return false;
+    }
+        
+    CodeBlock::JITCompilationResult result = codeBlock->jitCompile(exec->globalData());
+    switch (result) {
+    case CodeBlock::AlreadyCompiled:
+#if ENABLE(JIT_VERBOSE_OSR)
+        dataLog("    Code was already compiled.\n");
+#endif
+        codeBlock->jitSoon();
+        return true;
+    case CodeBlock::CouldNotCompile:
+#if ENABLE(JIT_VERBOSE_OSR)
+        dataLog("    JIT compilation failed.\n");
+#endif
+        codeBlock->dontJITAnytimeSoon();
+        return false;
+    case CodeBlock::CompiledSuccessfully:
+#if ENABLE(JIT_VERBOSE_OSR)
+        dataLog("    JIT compilation successful.\n");
+#endif
+        codeBlock->jitSoon();
+        return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 enum EntryKind { Prologue, ArityCheck };
 static SlowPathReturnType entryOSR(ExecState* exec, Instruction* pc, CodeBlock* codeBlock, const char *name, EntryKind kind)
 {
@@ -274,12 +300,9 @@ static SlowPathReturnType entryOSR(ExecState* exec, Instruction* pc, CodeBlock*
         codeBlock->dontJITAnytimeSoon();
         LLINT_RETURN_TWO(0, exec);
     }
-    if (!codeBlock->jitCompile(exec->globalData())) {
-#if ENABLE(JIT_VERBOSE_OSR)
-        dataLog("    Code was already compiled.\n");
-#endif
-    }
-    codeBlock->jitSoon();
+    if (!jitCompileAndSetHeuristics(codeBlock, exec))
+        LLINT_RETURN_TWO(0, exec);
+    
     if (kind == Prologue)
         LLINT_RETURN_TWO(codeBlock->getJITCode().executableAddressAtOffset(0), exec);
     ASSERT(kind == ArityCheck);
@@ -324,12 +347,8 @@ LLINT_SLOW_PATH_DECL(loop_osr)
         LLINT_RETURN_TWO(0, exec);
     }
     
-    if (!codeBlock->jitCompile(exec->globalData())) {
-#if ENABLE(JIT_VERBOSE_OSR)
-        dataLog("    Code was already compiled.\n");
-#endif
-    }
-    codeBlock->jitSoon();
+    if (!jitCompileAndSetHeuristics(codeBlock, exec))
+        LLINT_RETURN_TWO(0, exec);
     
     ASSERT(codeBlock->getJITType() == JITCode::BaselineJIT);
     
@@ -353,14 +372,9 @@ LLINT_SLOW_PATH_DECL(replace)
     dataLog("%p: Entered replace with executeCounter = %d\n", codeBlock, codeBlock->llintExecuteCounter());
 #endif
     
-    if (shouldJIT(exec)) {
-        if (!codeBlock->jitCompile(exec->globalData())) {
-#if ENABLE(JIT_VERBOSE_OSR)
-            dataLog("    Code was already compiled.\n");
-#endif
-        }
-        codeBlock->jitSoon();
-    } else
+    if (shouldJIT(exec))
+        jitCompileAndSetHeuristics(codeBlock, exec);
+    else
         codeBlock->dontJITAnytimeSoon();
     LLINT_END_IMPL();
 }
@@ -664,12 +678,6 @@ LLINT_SLOW_PATH_DECL(slow_path_bitxor)
     LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toInt32(exec) ^ LLINT_OP_C(3).jsValue().toInt32(exec)));
 }
 
-LLINT_SLOW_PATH_DECL(slow_path_bitnot)
-{
-    LLINT_BEGIN();
-    LLINT_RETURN(jsNumber(~LLINT_OP_C(2).jsValue().toInt32(exec)));
-}
-
 LLINT_SLOW_PATH_DECL(slow_path_check_has_instance)
 {
     LLINT_BEGIN();
@@ -873,8 +881,10 @@ LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
             pc[5].u.operand = slot.cachedOffset() * sizeof(JSValue);
         }
     }
-    
+
+#if ENABLE(VALUE_PROFILER)    
     pc[OPCODE_LENGTH(op_get_by_id) - 1].u.profile->m_buckets[0] = JSValue::encode(result);
+#endif
     LLINT_END();
 }
 
@@ -1023,7 +1033,7 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_val)
             if (jsArray->canSetIndex(i))
                 jsArray->setIndex(globalData, i, value);
             else
-                JSArray::putByIndex(jsArray, exec, i, value);
+                JSArray::putByIndex(jsArray, exec, i, value, exec->codeBlock()->isStrictMode());
             LLINT_END();
         }
         if (isJSByteArray(baseValue)
@@ -1038,7 +1048,7 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_val)
                 LLINT_END();
             }
         }
-        baseValue.put(exec, i, value);
+        baseValue.putByIndex(exec, i, value, exec->codeBlock()->isStrictMode());
         LLINT_END();
     }
     
@@ -1078,7 +1088,9 @@ LLINT_SLOW_PATH_DECL(slow_path_del_by_val)
 LLINT_SLOW_PATH_DECL(slow_path_put_by_index)
 {
     LLINT_BEGIN();
-    LLINT_OP_C(1).jsValue().put(exec, pc[2].u.operand, LLINT_OP_C(3).jsValue());
+    JSValue arrayValue = LLINT_OP_C(1).jsValue();
+    ASSERT(isJSArray(arrayValue));
+    asArray(arrayValue)->putDirectIndex(exec, pc[2].u.operand, LLINT_OP_C(3).jsValue(), false);
     LLINT_END();
 }
 
@@ -1384,7 +1396,7 @@ LLINT_SLOW_PATH_DECL(slow_path_call_varargs)
     
     execCallee->uncheckedR(RegisterFile::Callee) = calleeAsValue;
     execCallee->setCallerFrame(exec);
-    exec->uncheckedR(RegisterFile::ArgumentCount).tag() = bitwise_cast<int32_t>(pc + OPCODE_LENGTH(op_call_varargs));
+    exec->setCurrentVPC(pc + OPCODE_LENGTH(op_call_varargs));
     
     return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
 }
@@ -1402,7 +1414,7 @@ LLINT_SLOW_PATH_DECL(slow_path_call_eval)
     execCallee->setScopeChain(exec->scopeChain());
     execCallee->setReturnPC(bitwise_cast<Instruction*>(&llint_generic_return_point));
     execCallee->setCodeBlock(0);
-    exec->uncheckedR(RegisterFile::ArgumentCount).tag() = bitwise_cast<int32_t>(pc + OPCODE_LENGTH(op_call_eval));
+    exec->setCurrentVPC(pc + OPCODE_LENGTH(op_call_eval));
     
     if (!isHostFunction(calleeAsValue, globalFuncEval))
         return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
@@ -1553,6 +1565,13 @@ LLINT_SLOW_PATH_DECL(slow_path_profile_did_call)
     LLINT_END();
 }
 
+LLINT_SLOW_PATH_DECL(throw_from_native_call)
+{
+    LLINT_BEGIN();
+    ASSERT(globalData.exception);
+    LLINT_END();
+}
+
 } } // namespace JSC::LLInt
 
 #endif // ENABLE(LLINT)
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.h b/Source/JavaScriptCore/llint/LLIntSlowPaths.h
index fe684d306..334070a07 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.h
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.h
@@ -38,8 +38,40 @@ struct Instruction;
 
 namespace LLInt {
 
+#if USE(JSVALUE64)
+struct SlowPathReturnType {
+    void* a;
+    void* b;
+    
+    SlowPathReturnType(void* a, void* b)
+        : a(a)
+        , b(b)
+    {
+    }
+};
+
+inline SlowPathReturnType encodeResult(void* a, void* b)
+{
+    return SlowPathReturnType(a, b);
+}
+#else
 typedef int64_t SlowPathReturnType;
 
+inline SlowPathReturnType encodeResult(void* a, void* b)
+{
+    union {
+        struct {
+            void* a;
+            void* b;
+        } pair;
+        int64_t i;
+    } u;
+    u.pair.a = a;
+    u.pair.b = b;
+    return u.i;
+}
+#endif
+
 extern "C" SlowPathReturnType llint_trace_operand(ExecState*, Instruction*, int fromWhere, int operand);
 extern "C" SlowPathReturnType llint_trace_value(ExecState*, Instruction*, int fromWhere, int operand);
 
@@ -97,7 +129,6 @@ LLINT_SLOW_PATH_DECL(slow_path_urshift);
 LLINT_SLOW_PATH_DECL(slow_path_bitand);
 LLINT_SLOW_PATH_DECL(slow_path_bitor);
 LLINT_SLOW_PATH_DECL(slow_path_bitxor);
-LLINT_SLOW_PATH_DECL(slow_path_bitnot);
 LLINT_SLOW_PATH_DECL(slow_path_check_has_instance);
 LLINT_SLOW_PATH_DECL(slow_path_instanceof);
 LLINT_SLOW_PATH_DECL(slow_path_typeof);
@@ -162,6 +193,7 @@ LLINT_SLOW_PATH_DECL(slow_path_throw_reference_error);
 LLINT_SLOW_PATH_DECL(slow_path_debug);
 LLINT_SLOW_PATH_DECL(slow_path_profile_will_call);
 LLINT_SLOW_PATH_DECL(slow_path_profile_did_call);
+LLINT_SLOW_PATH_DECL(throw_from_native_call);
 
 } } // namespace JSC::LLInt
 
diff --git a/Source/JavaScriptCore/llint/LLIntThunks.cpp b/Source/JavaScriptCore/llint/LLIntThunks.cpp
index ddb0c46c2..b4d026423 100644
--- a/Source/JavaScriptCore/llint/LLIntThunks.cpp
+++ b/Source/JavaScriptCore/llint/LLIntThunks.cpp
@@ -29,8 +29,10 @@
 #if ENABLE(LLINT)
 
 #include "JSInterfaceJIT.h"
+#include "JSObject.h"
 #include "LinkBuffer.h"
 #include "LowLevelInterpreter.h"
+#include "ScopeChain.h"
 
 namespace JSC { namespace LLInt {
 
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
index a9f83f680..9af91bef2 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -21,54 +21,8 @@
 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 # THE POSSIBILITY OF SUCH DAMAGE.
 
-
-# Crash course on the language that this is written in (which I just call
-# "assembly" even though it's more than that):
-#
-# - Mostly gas-style operand ordering. The last operand tends to be the
-#   destination. So "a := b" is written as "mov b, a". But unlike gas,
-#   comparisons are in-order, so "if (a < b)" is written as
-#   "bilt a, b, ...".
-#
-# - "b" = byte, "h" = 16-bit word, "i" = 32-bit word, "p" = pointer.
-#   Currently this is just 32-bit so "i" and "p" are interchangeable
-#   except when an op supports one but not the other.
-#
-# - In general, valid operands for macro invocations and instructions are
-#   registers (eg "t0"), addresses (eg "4[t0]"), base-index addresses
-#   (eg "7[t0, t1, 2]"), absolute addresses (eg "0xa0000000[]"), or labels
-#   (eg "_foo" or ".foo"). Macro invocations can also take anonymous
-#   macros as operands. Instructions cannot take anonymous macros.
-#
-# - Labels must have names that begin with either "_" or ".".  A "." label
-#   is local and gets renamed before code gen to minimize namespace
-#   pollution. A "_" label is an extern symbol (i.e. ".globl"). The "_"
-#   may or may not be removed during code gen depending on whether the asm
-#   conventions for C name mangling on the target platform mandate a "_"
-#   prefix.
-#
-# - A "macro" is a lambda expression, which may be either anonymous or
-#   named. But this has caveats. "macro" can take zero or more arguments,
-#   which may be macros or any valid operands, but it can only return
-#   code. But you can do Turing-complete things via continuation passing
-#   style: "macro foo (a, b) b(a) end foo(foo, foo)". Actually, don't do
-#   that, since you'll just crash the assembler.
-#
-# - An "if" is a conditional on settings. Any identifier supplied in the
-#   predicate of an "if" is assumed to be a #define that is available
-#   during code gen. So you can't use "if" for computation in a macro, but
-#   you can use it to select different pieces of code for different
-#   platforms.
-#
-# - Arguments to macros follow lexical scoping rather than dynamic scoping.
-#   Const's also follow lexical scoping and may override (hide) arguments
-#   or other consts. All variables (arguments and constants) can be bound
-#   to operands. Additionally, arguments (but not constants) can be bound
-#   to macros.
-
-
-# Below we have a bunch of constant declarations. Each constant must have
-# a corresponding ASSERT() in LLIntData.cpp.
+# First come the common protocols that both interpreters use. Note that each
+# of these must have an ASSERT() in LLIntData.cpp
 
 # These declarations must match interpreter/RegisterFile.h.
 const CallFrameHeaderSize = 48
@@ -81,10 +35,24 @@ const CodeBlock = -8
 
 const ThisArgumentOffset = -CallFrameHeaderSize - 8
 
-# Declare some aliases for the registers we will use.
-const PC = t4
+# Some register conventions.
+if JSVALUE64
+    # - Use a pair of registers to represent the PC: one register for the
+    #   base of the register file, and one register for the index.
+    # - The PC base (or PB for short) should be stored in the csr. It will
+    #   get clobbered on calls to other JS code, but will get saved on calls
+    #   to C functions.
+    # - C calls are still given the Instruction* rather than the PC index.
+    #   This requires an add before the call, and a sub after.
+    const PC = t4
+    const PB = t6
+    const tagTypeNumber = csr1
+    const tagMask = csr2
+else
+    const PC = t4
+end
 
-# Offsets needed for reasoning about value representation.
+# Constants for reasoning about value representation.
 if BIG_ENDIAN
     const TagOffset = 0
     const PayloadOffset = 4
@@ -93,16 +61,6 @@ else
     const PayloadOffset = 0
 end
 
-# Value representation constants.
-const Int32Tag = -1
-const BooleanTag = -2
-const NullTag = -3
-const UndefinedTag = -4
-const CellTag = -5
-const EmptyValueTag = -6
-const DeletedValueTag = -7
-const LowestTag = DeletedValueTag
-
 # Type constants.
 const StringType = 5
 const ObjectType = 13
@@ -112,9 +70,6 @@ const MasqueradesAsUndefined = 1
 const ImplementsHasInstance = 2
 const ImplementsDefaultHasInstance = 8
 
-# Heap allocation constants.
-const JSFinalObjectSizeClassIndex = 3
-
 # Bytecode operand constants.
 const FirstConstantRegisterIndex = 0x40000000
 
@@ -126,14 +81,27 @@ const FunctionCode = 2
 # The interpreter steals the tag word of the argument count.
 const LLIntReturnPC = ArgumentCount + TagOffset
 
-# This must match wtf/Vector.h.
-const VectorSizeOffset = 0
-const VectorBufferOffset = 4
-
 # String flags.
 const HashFlags8BitBuffer = 64
 
-# Utilities
+# Allocation constants
+if JSVALUE64
+    const JSFinalObjectSizeClassIndex = 1
+else
+    const JSFinalObjectSizeClassIndex = 3
+end
+
+# This must match wtf/Vector.h
+if JSVALUE64
+    const VectorSizeOffset = 0
+    const VectorBufferOffset = 8
+else
+    const VectorSizeOffset = 0
+    const VectorBufferOffset = 4
+end
+
+
+# Some common utilities.
 macro crash()
     storei 0, 0xbbadbeef[]
     move 0, t0
@@ -151,7 +119,7 @@ end
 macro preserveReturnAddressAfterCall(destinationRegister)
     if ARMv7
         move lr, destinationRegister
-    elsif X86
+    elsif X86 or X86_64
         pop destinationRegister
     else
         error
@@ -161,109 +129,23 @@ end
 macro restoreReturnAddressBeforeReturn(sourceRegister)
     if ARMv7
         move sourceRegister, lr
-    elsif X86
+    elsif X86 or X86_64
         push sourceRegister
     else
         error
     end
 end
 
-macro dispatch(advance)
-    addp advance * 4, PC
-    jmp [PC]
-end
-
-macro dispatchBranchWithOffset(pcOffset)
-    lshifti 2, pcOffset
-    addp pcOffset, PC
-    jmp [PC]
-end
-
-macro dispatchBranch(pcOffset)
-    loadi pcOffset, t0
-    dispatchBranchWithOffset(t0)
-end
-
-macro dispatchAfterCall()
-    loadi ArgumentCount + TagOffset[cfr], PC
-    jmp [PC]
-end
-
-macro cCall2(function, arg1, arg2)
-    if ARMv7
-        move arg1, t0
-        move arg2, t1
-    elsif X86
-        poke arg1, 0
-        poke arg2, 1
-    else
-        error
-    end
-    call function
-end
-
-# This barely works. arg3 and arg4 should probably be immediates.
-macro cCall4(function, arg1, arg2, arg3, arg4)
-    if ARMv7
-        move arg1, t0
-        move arg2, t1
-        move arg3, t2
-        move arg4, t3
-    elsif X86
-        poke arg1, 0
-        poke arg2, 1
-        poke arg3, 2
-        poke arg4, 3
-    else
-        error
-    end
-    call function
-end
-
-macro callSlowPath(slow_path)
-    cCall2(slow_path, cfr, PC)
-    move t0, PC
-    move t1, cfr
-end
-
-# Debugging operation if you'd like to print an operand in the instruction stream. fromWhere
-# should be an immediate integer - any integer you like; use it to identify the place you're
-# debugging from. operand should likewise be an immediate, and should identify the operand
-# in the instruction stream you'd like to print out.
-macro traceOperand(fromWhere, operand)
-    cCall4(_llint_trace_operand, cfr, PC, fromWhere, operand)
-    move t0, PC
-    move t1, cfr
-end
-
-# Debugging operation if you'd like to print the value of an operand in the instruction
-# stream. Same as traceOperand(), but assumes that the operand is a register, and prints its
-# value.
-macro traceValue(fromWhere, operand)
-    cCall4(_llint_trace_value, cfr, PC, fromWhere, operand)
-    move t0, PC
-    move t1, cfr
-end
-
 macro traceExecution()
     if EXECUTION_TRACING
         callSlowPath(_llint_trace)
     end
 end
 
-# Call a slow_path for call opcodes.
-macro callCallSlowPath(advance, slow_path, action)
-    addp advance * 4, PC, t0
-    storep t0, ArgumentCount + TagOffset[cfr]
-    cCall2(slow_path, cfr, PC)
-    move t1, cfr
-    action(t0)
-end
-
-macro slowPathForCall(advance, slow_path)
+macro slowPathForCall(advance, slowPath)
     callCallSlowPath(
         advance,
-        slow_path,
+        slowPath,
         macro (callee)
             call callee
             dispatchAfterCall()
@@ -273,26 +155,12 @@ end
 macro checkSwitchToJIT(increment, action)
     if JIT_ENABLED
         loadp CodeBlock[cfr], t0
-        baddis increment, CodeBlock::m_llintExecuteCounter[t0], .continue
+        baddis increment, CodeBlock::m_llintExecuteCounter + ExecutionCounter::m_counter[t0], .continue
         action()
     .continue:
     end
 end
 
-macro checkSwitchToJITForLoop()
-    checkSwitchToJIT(
-        1,
-        macro ()
-            storei PC, ArgumentCount + TagOffset[cfr]
-            cCall2(_llint_loop_osr, cfr, PC)
-            move t1, cfr
-            btpz t0, .recover
-            jmp t0
-        .recover:
-            loadi ArgumentCount + TagOffset[cfr], PC
-        end)
-end
-
 macro checkSwitchToJITForEpilogue()
     checkSwitchToJIT(
         10,
@@ -305,94 +173,6 @@ macro assertNotConstant(index)
     assert(macro (ok) bilt index, FirstConstantRegisterIndex, ok end)
 end
 
-# Index, tag, and payload must be different registers. Index is not
-# changed.
-macro loadConstantOrVariable(index, tag, payload)
-    bigteq index, FirstConstantRegisterIndex, .constant
-    loadi TagOffset[cfr, index, 8], tag
-    loadi PayloadOffset[cfr, index, 8], payload
-    jmp .done
-.constant:
-    loadp CodeBlock[cfr], payload
-    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[payload], payload
-    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
-    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
-    loadp TagOffset[payload, index, 8], tag
-    loadp PayloadOffset[payload, index, 8], payload
-.done:
-end
-
-# Index and payload may be the same register. Index may be clobbered.
-macro loadConstantOrVariable2Reg(index, tag, payload)
-    bigteq index, FirstConstantRegisterIndex, .constant
-    loadi TagOffset[cfr, index, 8], tag
-    loadi PayloadOffset[cfr, index, 8], payload
-    jmp .done
-.constant:
-    loadp CodeBlock[cfr], tag
-    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[tag], tag
-    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
-    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
-    lshifti 3, index
-    addp index, tag
-    loadp PayloadOffset[tag], payload
-    loadp TagOffset[tag], tag
-.done:
-end
-
-macro loadConstantOrVariablePayloadTagCustom(index, tagCheck, payload)
-    bigteq index, FirstConstantRegisterIndex, .constant
-    tagCheck(TagOffset[cfr, index, 8])
-    loadi PayloadOffset[cfr, index, 8], payload
-    jmp .done
-.constant:
-    loadp CodeBlock[cfr], payload
-    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[payload], payload
-    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
-    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
-    tagCheck(TagOffset[payload, index, 8])
-    loadp PayloadOffset[payload, index, 8], payload
-.done:
-end
-
-# Index and payload must be different registers. Index is not mutated. Use
-# this if you know what the tag of the variable should be. Doing the tag
-# test as part of loading the variable reduces register use, but may not
-# be faster than doing loadConstantOrVariable followed by a branch on the
-# tag.
-macro loadConstantOrVariablePayload(index, expectedTag, payload, slow)
-    loadConstantOrVariablePayloadTagCustom(
-        index,
-        macro (actualTag) bineq actualTag, expectedTag, slow end,
-        payload)
-end
-
-macro loadConstantOrVariablePayloadUnchecked(index, payload)
-    loadConstantOrVariablePayloadTagCustom(
-        index,
-        macro (actualTag) end,
-        payload)
-end
-
-macro writeBarrier(tag, payload)
-    # Nothing to do, since we don't have a generational or incremental collector.
-end
-
-macro valueProfile(tag, payload, profile)
-    if JIT_ENABLED
-        storei tag, ValueProfile::m_buckets + TagOffset[profile]
-        storei payload, ValueProfile::m_buckets + PayloadOffset[profile]
-    end
-end
-
-
-# Indicate the beginning of LLInt.
-_llint_begin:
-    crash()
-
-
-# Entrypoints into the interpreter
-
 macro functionForCallCodeBlockGetter(targetRegister)
     loadp Callee[cfr], targetRegister
     loadp JSFunction::m_executable[targetRegister], targetRegister
@@ -429,7 +209,7 @@ macro prologue(codeBlockGetter, codeBlockSetter, osrSlowPath, traceSlowPath)
     end
     codeBlockGetter(t1)
     if JIT_ENABLED
-        baddis 5, CodeBlock::m_llintExecuteCounter[t1], .continue
+        baddis 5, CodeBlock::m_llintExecuteCounter + ExecutionCounter::m_counter[t1], .continue
         cCall2(osrSlowPath, cfr, PC)
         move t1, cfr
         btpz t0, .recover
@@ -443,14 +223,18 @@ macro prologue(codeBlockGetter, codeBlockSetter, osrSlowPath, traceSlowPath)
     codeBlockSetter(t1)
     
     # Set up the PC.
-    loadp CodeBlock::m_instructions[t1], t0
-    loadp CodeBlock::Instructions::m_instructions + VectorBufferOffset[t0], PC
+    if JSVALUE64
+        loadp CodeBlock::m_instructions[t1], PB
+        move 0, PC
+    else
+        loadp CodeBlock::m_instructions[t1], PC
+    end
 end
 
 # Expects that CodeBlock is in t1, which is what prologue() leaves behind.
 # Must call dispatch(0) after calling this.
 macro functionInitialization(profileArgSkip)
-    if JIT_ENABLED
+    if VALUE_PROFILER
         # Profile the arguments. Unfortunately, we have no choice but to do this. This
         # code is pretty horrendous because of the difference in ordering between
         # arguments and value profiles, the desire to have a simple loop-down-to-zero
@@ -459,21 +243,27 @@ macro functionInitialization(profileArgSkip)
         # optimal way for architectures that have more than five registers available
         # for arbitrary use in the interpreter.
         loadi CodeBlock::m_numParameters[t1], t0
-        addi -profileArgSkip, t0 # Use addi because that's what has the peephole
-        assert(macro (ok) bigteq t0, 0, ok end)
-        btiz t0, .argumentProfileDone
+        addp -profileArgSkip, t0 # Use addi because that's what has the peephole
+        assert(macro (ok) bpgteq t0, 0, ok end)
+        btpz t0, .argumentProfileDone
         loadp CodeBlock::m_argumentValueProfiles + VectorBufferOffset[t1], t3
-        muli sizeof ValueProfile, t0, t2 # Aaaaahhhh! Need strength reduction!
-        negi t0
-        lshifti 3, t0
+        mulp sizeof ValueProfile, t0, t2 # Aaaaahhhh! Need strength reduction!
+        negp t0
+        lshiftp 3, t0
         addp t2, t3
     .argumentProfileLoop:
-        loadi ThisArgumentOffset + TagOffset + 8 - profileArgSkip * 8[cfr, t0], t2
-        subp sizeof ValueProfile, t3
-        storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + TagOffset[t3]
-        loadi ThisArgumentOffset + PayloadOffset + 8 - profileArgSkip * 8[cfr, t0], t2
-        storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + PayloadOffset[t3]
-        baddinz 8, t0, .argumentProfileLoop
+        if JSVALUE64
+            loadp ThisArgumentOffset + 8 - profileArgSkip * 8[cfr, t0], t2
+            subp sizeof ValueProfile, t3
+            storep t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets[t3]
+        else
+            loadi ThisArgumentOffset + TagOffset + 8 - profileArgSkip * 8[cfr, t0], t2
+            subp sizeof ValueProfile, t3
+            storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + TagOffset[t3]
+            loadi ThisArgumentOffset + PayloadOffset + 8 - profileArgSkip * 8[cfr, t0], t2
+            storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + PayloadOffset[t3]
+        end
+        baddpnz 8, t0, .argumentProfileLoop
     .argumentProfileDone:
     end
         
@@ -490,101 +280,6 @@ macro functionInitialization(profileArgSkip)
 .stackHeightOK:
 end
 
-# Expects that CodeBlock is in t1, which is what prologue() leaves behind.
-macro functionArityCheck(doneLabel, slow_path)
-    loadi PayloadOffset + ArgumentCount[cfr], t0
-    biaeq t0, CodeBlock::m_numParameters[t1], doneLabel
-    cCall2(slow_path, cfr, PC)   # This slow_path has a simple protocol: t0 = 0 => no error, t0 != 0 => error
-    move t1, cfr
-    btiz t0, .continue
-    loadp JITStackFrame::globalData[sp], t1
-    loadp JSGlobalData::callFrameForThrow[t1], t0
-    jmp JSGlobalData::targetMachinePCForThrow[t1]
-.continue:
-    # Reload CodeBlock and PC, since the slow_path clobbered it.
-    loadp CodeBlock[cfr], t1
-    loadp CodeBlock::m_instructions[t1], t0
-    loadp CodeBlock::Instructions::m_instructions + VectorBufferOffset[t0], PC
-    jmp doneLabel
-end
-
-_llint_program_prologue:
-    prologue(notFunctionCodeBlockGetter, notFunctionCodeBlockSetter, _llint_entry_osr, _llint_trace_prologue)
-    dispatch(0)
-
-
-_llint_eval_prologue:
-    prologue(notFunctionCodeBlockGetter, notFunctionCodeBlockSetter, _llint_entry_osr, _llint_trace_prologue)
-    dispatch(0)
-
-
-_llint_function_for_call_prologue:
-    prologue(functionForCallCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_call, _llint_trace_prologue_function_for_call)
-.functionForCallBegin:
-    functionInitialization(0)
-    dispatch(0)
-    
-
-_llint_function_for_construct_prologue:
-    prologue(functionForConstructCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_construct, _llint_trace_prologue_function_for_construct)
-.functionForConstructBegin:
-    functionInitialization(1)
-    dispatch(0)
-    
-
-_llint_function_for_call_arity_check:
-    prologue(functionForCallCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_call_arityCheck, _llint_trace_arityCheck_for_call)
-    functionArityCheck(.functionForCallBegin, _llint_slow_path_call_arityCheck)
-
-
-_llint_function_for_construct_arity_check:
-    prologue(functionForConstructCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_construct_arityCheck, _llint_trace_arityCheck_for_construct)
-    functionArityCheck(.functionForConstructBegin, _llint_slow_path_construct_arityCheck)
-
-# Instruction implementations
-
-_llint_op_enter:
-    traceExecution()
-    loadp CodeBlock[cfr], t2
-    loadi CodeBlock::m_numVars[t2], t2
-    btiz t2, .opEnterDone
-    move UndefinedTag, t0
-    move 0, t1
-.opEnterLoop:
-    subi 1, t2
-    storei t0, TagOffset[cfr, t2, 8]
-    storei t1, PayloadOffset[cfr, t2, 8]
-    btinz t2, .opEnterLoop
-.opEnterDone:
-    dispatch(1)
-
-
-_llint_op_create_activation:
-    traceExecution()
-    loadi 4[PC], t0
-    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opCreateActivationDone
-    callSlowPath(_llint_slow_path_create_activation)
-.opCreateActivationDone:
-    dispatch(2)
-
-
-_llint_op_init_lazy_reg:
-    traceExecution()
-    loadi 4[PC], t0
-    storei EmptyValueTag, TagOffset[cfr, t0, 8]
-    storei 0, PayloadOffset[cfr, t0, 8]
-    dispatch(2)
-
-
-_llint_op_create_arguments:
-    traceExecution()
-    loadi 4[PC], t0
-    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opCreateArgumentsDone
-    callSlowPath(_llint_slow_path_create_arguments)
-.opCreateArgumentsDone:
-    dispatch(2)
-
-
 macro allocateBasicJSObject(sizeClassIndex, classInfoOffset, structure, result, scratch1, scratch2, slowCase)
     if ALWAYS_ALLOCATE_SLOW
         jmp slowCase
@@ -618,66 +313,62 @@ macro allocateBasicJSObject(sizeClassIndex, classInfoOffset, structure, result,
     end
 end
 
-_llint_op_create_this:
-    traceExecution()
-    loadi 8[PC], t0
-    assertNotConstant(t0)
-    bineq TagOffset[cfr, t0, 8], CellTag, .opCreateThisSlow
-    loadi PayloadOffset[cfr, t0, 8], t0
-    loadp JSCell::m_structure[t0], t1
-    bbb Structure::m_typeInfo + TypeInfo::m_type[t1], ObjectType, .opCreateThisSlow
-    loadp JSObject::m_inheritorID[t0], t2
-    btpz t2, .opCreateThisSlow
-    allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo, t2, t0, t1, t3, .opCreateThisSlow)
-    loadi 4[PC], t1
-    storei CellTag, TagOffset[cfr, t1, 8]
-    storei t0, PayloadOffset[cfr, t1, 8]
-    dispatch(3)
+macro doReturn()
+    loadp ReturnPC[cfr], t2
+    loadp CallerFrame[cfr], cfr
+    restoreReturnAddressBeforeReturn(t2)
+    ret
+end
 
-.opCreateThisSlow:
-    callSlowPath(_llint_slow_path_create_this)
-    dispatch(3)
 
+# Indicate the beginning of LLInt.
+_llint_begin:
+    crash()
 
-_llint_op_get_callee:
-    traceExecution()
-    loadi 4[PC], t0
-    loadp PayloadOffset + Callee[cfr], t1
-    storei CellTag, TagOffset[cfr, t0, 8]
-    storei t1, PayloadOffset[cfr, t0, 8]
-    dispatch(2)
 
+_llint_program_prologue:
+    prologue(notFunctionCodeBlockGetter, notFunctionCodeBlockSetter, _llint_entry_osr, _llint_trace_prologue)
+    dispatch(0)
 
-_llint_op_convert_this:
-    traceExecution()
-    loadi 4[PC], t0
-    bineq TagOffset[cfr, t0, 8], CellTag, .opConvertThisSlow
-    loadi PayloadOffset[cfr, t0, 8], t0
-    loadp JSCell::m_structure[t0], t0
-    bbb Structure::m_typeInfo + TypeInfo::m_type[t0], ObjectType, .opConvertThisSlow
-    dispatch(2)
 
-.opConvertThisSlow:
-    callSlowPath(_llint_slow_path_convert_this)
-    dispatch(2)
+_llint_eval_prologue:
+    prologue(notFunctionCodeBlockGetter, notFunctionCodeBlockSetter, _llint_entry_osr, _llint_trace_prologue)
+    dispatch(0)
 
 
-_llint_op_new_object:
-    traceExecution()
-    loadp CodeBlock[cfr], t0
-    loadp CodeBlock::m_globalObject[t0], t0
-    loadp JSGlobalObject::m_emptyObjectStructure[t0], t1
-    allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo, t1, t0, t2, t3, .opNewObjectSlow)
-    loadi 4[PC], t1
-    storei CellTag, TagOffset[cfr, t1, 8]
-    storei t0, PayloadOffset[cfr, t1, 8]
-    dispatch(2)
+_llint_function_for_call_prologue:
+    prologue(functionForCallCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_call, _llint_trace_prologue_function_for_call)
+.functionForCallBegin:
+    functionInitialization(0)
+    dispatch(0)
+    
 
-.opNewObjectSlow:
-    callSlowPath(_llint_slow_path_new_object)
-    dispatch(2)
+_llint_function_for_construct_prologue:
+    prologue(functionForConstructCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_construct, _llint_trace_prologue_function_for_construct)
+.functionForConstructBegin:
+    functionInitialization(1)
+    dispatch(0)
+    
+
+_llint_function_for_call_arity_check:
+    prologue(functionForCallCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_call_arityCheck, _llint_trace_arityCheck_for_call)
+    functionArityCheck(.functionForCallBegin, _llint_slow_path_call_arityCheck)
+
+
+_llint_function_for_construct_arity_check:
+    prologue(functionForConstructCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_construct_arityCheck, _llint_trace_arityCheck_for_construct)
+    functionArityCheck(.functionForConstructBegin, _llint_slow_path_construct_arityCheck)
+
+
+# Value-representation-specific code.
+if JSVALUE64
+    include LowLevelInterpreter64
+else
+    include LowLevelInterpreter32_64
+end
 
 
+# Value-representation-agnostic code.
 _llint_op_new_array:
     traceExecution()
     callSlowPath(_llint_slow_path_new_array)
@@ -696,148 +387,6 @@ _llint_op_new_regexp:
     dispatch(3)
 
 
-_llint_op_mov:
-    traceExecution()
-    loadi 8[PC], t1
-    loadi 4[PC], t0
-    loadConstantOrVariable(t1, t2, t3)
-    storei t2, TagOffset[cfr, t0, 8]
-    storei t3, PayloadOffset[cfr, t0, 8]
-    dispatch(3)
-
-
-_llint_op_not:
-    traceExecution()
-    loadi 8[PC], t0
-    loadi 4[PC], t1
-    loadConstantOrVariable(t0, t2, t3)
-    bineq t2, BooleanTag, .opNotSlow
-    xori 1, t3
-    storei t2, TagOffset[cfr, t1, 8]
-    storei t3, PayloadOffset[cfr, t1, 8]
-    dispatch(3)
-
-.opNotSlow:
-    callSlowPath(_llint_slow_path_not)
-    dispatch(3)
-
-
-_llint_op_eq:
-    traceExecution()
-    loadi 12[PC], t2
-    loadi 8[PC], t0
-    loadConstantOrVariable(t2, t3, t1)
-    loadConstantOrVariable2Reg(t0, t2, t0)
-    bineq t2, t3, .opEqSlow
-    bieq t2, CellTag, .opEqSlow
-    bib t2, LowestTag, .opEqSlow
-    loadi 4[PC], t2
-    cieq t0, t1, t0
-    storei BooleanTag, TagOffset[cfr, t2, 8]
-    storei t0, PayloadOffset[cfr, t2, 8]
-    dispatch(4)
-
-.opEqSlow:
-    callSlowPath(_llint_slow_path_eq)
-    dispatch(4)
-
-
-_llint_op_eq_null:
-    traceExecution()
-    loadi 8[PC], t0
-    loadi 4[PC], t3
-    assertNotConstant(t0)
-    loadi TagOffset[cfr, t0, 8], t1
-    loadi PayloadOffset[cfr, t0, 8], t0
-    bineq t1, CellTag, .opEqNullImmediate
-    loadp JSCell::m_structure[t0], t1
-    tbnz Structure::m_typeInfo + TypeInfo::m_flags[t1], MasqueradesAsUndefined, t1
-    jmp .opEqNullNotImmediate
-.opEqNullImmediate:
-    cieq t1, NullTag, t2
-    cieq t1, UndefinedTag, t1
-    ori t2, t1
-.opEqNullNotImmediate:
-    storei BooleanTag, TagOffset[cfr, t3, 8]
-    storei t1, PayloadOffset[cfr, t3, 8]
-    dispatch(3)
-
-
-_llint_op_neq:
-    traceExecution()
-    loadi 12[PC], t2
-    loadi 8[PC], t0
-    loadConstantOrVariable(t2, t3, t1)
-    loadConstantOrVariable2Reg(t0, t2, t0)
-    bineq t2, t3, .opNeqSlow
-    bieq t2, CellTag, .opNeqSlow
-    bib t2, LowestTag, .opNeqSlow
-    loadi 4[PC], t2
-    cineq t0, t1, t0
-    storei BooleanTag, TagOffset[cfr, t2, 8]
-    storei t0, PayloadOffset[cfr, t2, 8]
-    dispatch(4)
-
-.opNeqSlow:
-    callSlowPath(_llint_slow_path_neq)
-    dispatch(4)
-    
-
-_llint_op_neq_null:
-    traceExecution()
-    loadi 8[PC], t0
-    loadi 4[PC], t3
-    assertNotConstant(t0)
-    loadi TagOffset[cfr, t0, 8], t1
-    loadi PayloadOffset[cfr, t0, 8], t0
-    bineq t1, CellTag, .opNeqNullImmediate
-    loadp JSCell::m_structure[t0], t1
-    tbz Structure::m_typeInfo + TypeInfo::m_flags[t1], MasqueradesAsUndefined, t1
-    jmp .opNeqNullNotImmediate
-.opNeqNullImmediate:
-    cineq t1, NullTag, t2
-    cineq t1, UndefinedTag, t1
-    andi t2, t1
-.opNeqNullNotImmediate:
-    storei BooleanTag, TagOffset[cfr, t3, 8]
-    storei t1, PayloadOffset[cfr, t3, 8]
-    dispatch(3)
-
-
-macro strictEq(equalityOperation, slow_path)
-    loadi 12[PC], t2
-    loadi 8[PC], t0
-    loadConstantOrVariable(t2, t3, t1)
-    loadConstantOrVariable2Reg(t0, t2, t0)
-    bineq t2, t3, .slow
-    bib t2, LowestTag, .slow
-    bineq t2, CellTag, .notString
-    loadp JSCell::m_structure[t0], t2
-    loadp JSCell::m_structure[t1], t3
-    bbneq Structure::m_typeInfo + TypeInfo::m_type[t2], StringType, .notString
-    bbeq Structure::m_typeInfo + TypeInfo::m_type[t3], StringType, .slow
-.notString:
-    loadi 4[PC], t2
-    equalityOperation(t0, t1, t0)
-    storei BooleanTag, TagOffset[cfr, t2, 8]
-    storei t0, PayloadOffset[cfr, t2, 8]
-    dispatch(4)
-
-.slow:
-    callSlowPath(slow_path)
-    dispatch(4)
-end
-
-_llint_op_stricteq:
-    traceExecution()
-    strictEq(macro (left, right, result) cieq left, right, result end, _llint_slow_path_stricteq)
-
-
-_llint_op_nstricteq:
-    traceExecution()
-    strictEq(macro (left, right, result) cineq left, right, result end, _llint_slow_path_nstricteq)
-
-
 _llint_op_less:
     traceExecution()
     callSlowPath(_llint_slow_path_less)
@@ -862,360 +411,12 @@ _llint_op_greatereq:
     dispatch(4)
 
 
-_llint_op_pre_inc:
-    traceExecution()
-    loadi 4[PC], t0
-    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPreIncSlow
-    loadi PayloadOffset[cfr, t0, 8], t1
-    baddio 1, t1, .opPreIncSlow
-    storei t1, PayloadOffset[cfr, t0, 8]
-    dispatch(2)
-
-.opPreIncSlow:
-    callSlowPath(_llint_slow_path_pre_inc)
-    dispatch(2)
-
-
-_llint_op_pre_dec:
-    traceExecution()
-    loadi 4[PC], t0
-    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPreDecSlow
-    loadi PayloadOffset[cfr, t0, 8], t1
-    bsubio 1, t1, .opPreDecSlow
-    storei t1, PayloadOffset[cfr, t0, 8]
-    dispatch(2)
-
-.opPreDecSlow:
-    callSlowPath(_llint_slow_path_pre_dec)
-    dispatch(2)
-
-
-_llint_op_post_inc:
-    traceExecution()
-    loadi 8[PC], t0
-    loadi 4[PC], t1
-    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPostIncSlow
-    bieq t0, t1, .opPostIncDone
-    loadi PayloadOffset[cfr, t0, 8], t2
-    move t2, t3
-    baddio 1, t3, .opPostIncSlow
-    storei Int32Tag, TagOffset[cfr, t1, 8]
-    storei t2, PayloadOffset[cfr, t1, 8]
-    storei t3, PayloadOffset[cfr, t0, 8]
-.opPostIncDone:
-    dispatch(3)
-
-.opPostIncSlow:
-    callSlowPath(_llint_slow_path_post_inc)
-    dispatch(3)
-
-
-_llint_op_post_dec:
-    traceExecution()
-    loadi 8[PC], t0
-    loadi 4[PC], t1
-    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPostDecSlow
-    bieq t0, t1, .opPostDecDone
-    loadi PayloadOffset[cfr, t0, 8], t2
-    move t2, t3
-    bsubio 1, t3, .opPostDecSlow
-    storei Int32Tag, TagOffset[cfr, t1, 8]
-    storei t2, PayloadOffset[cfr, t1, 8]
-    storei t3, PayloadOffset[cfr, t0, 8]
-.opPostDecDone:
-    dispatch(3)
-
-.opPostDecSlow:
-    callSlowPath(_llint_slow_path_post_dec)
-    dispatch(3)
-
-
-_llint_op_to_jsnumber:
-    traceExecution()
-    loadi 8[PC], t0
-    loadi 4[PC], t1
-    loadConstantOrVariable(t0, t2, t3)
-    bieq t2, Int32Tag, .opToJsnumberIsInt
-    biaeq t2, EmptyValueTag, .opToJsnumberSlow
-.opToJsnumberIsInt:
-    storei t2, TagOffset[cfr, t1, 8]
-    storei t3, PayloadOffset[cfr, t1, 8]
-    dispatch(3)
-
-.opToJsnumberSlow:
-    callSlowPath(_llint_slow_path_to_jsnumber)
-    dispatch(3)
-
-
-_llint_op_negate:
-    traceExecution()
-    loadi 8[PC], t0
-    loadi 4[PC], t3
-    loadConstantOrVariable(t0, t1, t2)
-    bineq t1, Int32Tag, .opNegateSrcNotInt
-    btiz t2, 0x7fffffff, .opNegateSlow
-    negi t2
-    storei Int32Tag, TagOffset[cfr, t3, 8]
-    storei t2, PayloadOffset[cfr, t3, 8]
-    dispatch(3)
-.opNegateSrcNotInt:
-    bia t1, LowestTag, .opNegateSlow
-    xori 0x80000000, t1
-    storei t1, TagOffset[cfr, t3, 8]
-    storei t2, PayloadOffset[cfr, t3, 8]
-    dispatch(3)
-
-.opNegateSlow:
-    callSlowPath(_llint_slow_path_negate)
-    dispatch(3)
-
-
-macro binaryOpCustomStore(integerOperationAndStore, doubleOperation, slow_path)
-    loadi 12[PC], t2
-    loadi 8[PC], t0
-    loadConstantOrVariable(t2, t3, t1)
-    loadConstantOrVariable2Reg(t0, t2, t0)
-    bineq t2, Int32Tag, .op1NotInt
-    bineq t3, Int32Tag, .op2NotInt
-    loadi 4[PC], t2
-    integerOperationAndStore(t3, t1, t0, .slow, t2)
-    dispatch(5)
-
-.op1NotInt:
-    # First operand is definitely not an int, the second operand could be anything.
-    bia t2, LowestTag, .slow
-    bib t3, LowestTag, .op1NotIntOp2Double
-    bineq t3, Int32Tag, .slow
-    ci2d t1, ft1
-    jmp .op1NotIntReady
-.op1NotIntOp2Double:
-    fii2d t1, t3, ft1
-.op1NotIntReady:
-    loadi 4[PC], t1
-    fii2d t0, t2, ft0
-    doubleOperation(ft1, ft0)
-    stored ft0, [cfr, t1, 8]
-    dispatch(5)
-
-.op2NotInt:
-    # First operand is definitely an int, the second operand is definitely not.
-    loadi 4[PC], t2
-    bia t3, LowestTag, .slow
-    ci2d t0, ft0
-    fii2d t1, t3, ft1
-    doubleOperation(ft1, ft0)
-    stored ft0, [cfr, t2, 8]
-    dispatch(5)
-
-.slow:
-    callSlowPath(slow_path)
-    dispatch(5)
-end
-
-macro binaryOp(integerOperation, doubleOperation, slow_path)
-    binaryOpCustomStore(
-        macro (int32Tag, left, right, slow, index)
-            integerOperation(left, right, slow)
-            storei int32Tag, TagOffset[cfr, index, 8]
-            storei right, PayloadOffset[cfr, index, 8]
-        end,
-        doubleOperation, slow_path)
-end
-
-_llint_op_add:
-    traceExecution()
-    binaryOp(
-        macro (left, right, slow) baddio left, right, slow end,
-        macro (left, right) addd left, right end,
-        _llint_slow_path_add)
-
-
-_llint_op_mul:
-    traceExecution()
-    binaryOpCustomStore(
-        macro (int32Tag, left, right, slow, index)
-            const scratch = int32Tag   # We know that we can reuse the int32Tag register since it has a constant.
-            move right, scratch
-            bmulio left, scratch, slow
-            btinz scratch, .done
-            bilt left, 0, slow
-            bilt right, 0, slow
-        .done:
-            storei Int32Tag, TagOffset[cfr, index, 8]
-            storei scratch, PayloadOffset[cfr, index, 8]
-        end,
-        macro (left, right) muld left, right end,
-        _llint_slow_path_mul)
-
-
-_llint_op_sub:
-    traceExecution()
-    binaryOp(
-        macro (left, right, slow) bsubio left, right, slow end,
-        macro (left, right) subd left, right end,
-        _llint_slow_path_sub)
-
-
-_llint_op_div:
-    traceExecution()
-    binaryOpCustomStore(
-        macro (int32Tag, left, right, slow, index)
-            ci2d left, ft0
-            ci2d right, ft1
-            divd ft0, ft1
-            bcd2i ft1, right, .notInt
-            storei int32Tag, TagOffset[cfr, index, 8]
-            storei right, PayloadOffset[cfr, index, 8]
-            jmp .done
-        .notInt:
-            stored ft1, [cfr, index, 8]
-        .done:
-        end,
-        macro (left, right) divd left, right end,
-        _llint_slow_path_div)
-
-
 _llint_op_mod:
     traceExecution()
     callSlowPath(_llint_slow_path_mod)
     dispatch(4)
 
 
-macro bitOp(operation, slow_path, advance)
-    loadi 12[PC], t2
-    loadi 8[PC], t0
-    loadConstantOrVariable(t2, t3, t1)
-    loadConstantOrVariable2Reg(t0, t2, t0)
-    bineq t3, Int32Tag, .slow
-    bineq t2, Int32Tag, .slow
-    loadi 4[PC], t2
-    operation(t1, t0, .slow)
-    storei t3, TagOffset[cfr, t2, 8]
-    storei t0, PayloadOffset[cfr, t2, 8]
-    dispatch(advance)
-
-.slow:
-    callSlowPath(slow_path)
-    dispatch(advance)
-end
-
-_llint_op_lshift:
-    traceExecution()
-    bitOp(
-        macro (left, right, slow) lshifti left, right end,
-        _llint_slow_path_lshift,
-        4)
-
-
-_llint_op_rshift:
-    traceExecution()
-    bitOp(
-        macro (left, right, slow) rshifti left, right end,
-        _llint_slow_path_rshift,
-        4)
-
-
-_llint_op_urshift:
-    traceExecution()
-    bitOp(
-        macro (left, right, slow)
-            urshifti left, right
-            bilt right, 0, slow
-        end,
-        _llint_slow_path_urshift,
-        4)
-
-
-_llint_op_bitand:
-    traceExecution()
-    bitOp(
-        macro (left, right, slow) andi left, right end,
-        _llint_slow_path_bitand,
-        5)
-
-
-_llint_op_bitxor:
-    traceExecution()
-    bitOp(
-        macro (left, right, slow) xori left, right end,
-        _llint_slow_path_bitxor,
-        5)
-
-
-_llint_op_bitor:
-    traceExecution()
-    bitOp(
-        macro (left, right, slow) ori left, right end,
-        _llint_slow_path_bitor,
-        5)
-
-
-_llint_op_bitnot:
-    traceExecution()
-    loadi 8[PC], t1
-    loadi 4[PC], t0
-    loadConstantOrVariable(t1, t2, t3)
-    bineq t2, Int32Tag, .opBitnotSlow
-    noti t3
-    storei t2, TagOffset[cfr, t0, 8]
-    storei t3, PayloadOffset[cfr, t0, 8]
-    dispatch(3)
-
-.opBitnotSlow:
-    callSlowPath(_llint_slow_path_bitnot)
-    dispatch(3)
-
-
-_llint_op_check_has_instance:
-    traceExecution()
-    loadi 4[PC], t1
-    loadConstantOrVariablePayload(t1, CellTag, t0, .opCheckHasInstanceSlow)
-    loadp JSCell::m_structure[t0], t0
-    btbz Structure::m_typeInfo + TypeInfo::m_flags[t0], ImplementsHasInstance, .opCheckHasInstanceSlow
-    dispatch(2)
-
-.opCheckHasInstanceSlow:
-    callSlowPath(_llint_slow_path_check_has_instance)
-    dispatch(2)
-
-
-_llint_op_instanceof:
-    traceExecution()
-    # Check that baseVal implements the default HasInstance behavior.
-    # FIXME: This should be deprecated.
-    loadi 12[PC], t1
-    loadConstantOrVariablePayloadUnchecked(t1, t0)
-    loadp JSCell::m_structure[t0], t0
-    btbz Structure::m_typeInfo + TypeInfo::m_flags[t0], ImplementsDefaultHasInstance, .opInstanceofSlow
-    
-    # Actually do the work.
-    loadi 16[PC], t0
-    loadi 4[PC], t3
-    loadConstantOrVariablePayload(t0, CellTag, t1, .opInstanceofSlow)
-    loadp JSCell::m_structure[t1], t2
-    bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opInstanceofSlow
-    loadi 8[PC], t0
-    loadConstantOrVariablePayload(t0, CellTag, t2, .opInstanceofSlow)
-    
-    # Register state: t1 = prototype, t2 = value
-    move 1, t0
-.opInstanceofLoop:
-    loadp JSCell::m_structure[t2], t2
-    loadi Structure::m_prototype + PayloadOffset[t2], t2
-    bpeq t2, t1, .opInstanceofDone
-    btinz t2, .opInstanceofLoop
-
-    move 0, t0
-.opInstanceofDone:
-    storei BooleanTag, TagOffset[cfr, t3, 8]
-    storei t0, PayloadOffset[cfr, t3, 8]
-    dispatch(5)
-
-.opInstanceofSlow:
-    callSlowPath(_llint_slow_path_instanceof)
-    dispatch(5)
-
-
 _llint_op_typeof:
     traceExecution()
     callSlowPath(_llint_slow_path_typeof)
@@ -1276,156 +477,6 @@ _llint_op_resolve_skip:
     dispatch(5)
 
 
-macro resolveGlobal(size, slow)
-    # Operands are as follows:
-    # 4[PC]   Destination for the load.
-    # 8[PC]   Property identifier index in the code block.
-    # 12[PC]  Structure pointer, initialized to 0 by bytecode generator.
-    # 16[PC]  Offset in global object, initialized to 0 by bytecode generator.
-    loadp CodeBlock[cfr], t0
-    loadp CodeBlock::m_globalObject[t0], t0
-    loadp JSCell::m_structure[t0], t1
-    bpneq t1, 12[PC], slow
-    loadi 16[PC], t1
-    loadp JSObject::m_propertyStorage[t0], t0
-    loadi TagOffset[t0, t1, 8], t2
-    loadi PayloadOffset[t0, t1, 8], t3
-    loadi 4[PC], t0
-    storei t2, TagOffset[cfr, t0, 8]
-    storei t3, PayloadOffset[cfr, t0, 8]
-    loadi (size - 1) * 4[PC], t0
-    valueProfile(t2, t3, t0)
-end
-
-_llint_op_resolve_global:
-    traceExecution()
-    resolveGlobal(6, .opResolveGlobalSlow)
-    dispatch(6)
-
-.opResolveGlobalSlow:
-    callSlowPath(_llint_slow_path_resolve_global)
-    dispatch(6)
-
-
-# Gives you the scope in t0, while allowing you to optionally perform additional checks on the
-# scopes as they are traversed. scopeCheck() is called with two arguments: the register
-# holding the scope, and a register that can be used for scratch. Note that this does not
-# use t3, so you can hold stuff in t3 if need be.
-macro getScope(deBruijinIndexOperand, scopeCheck)
-    loadp ScopeChain + PayloadOffset[cfr], t0
-    loadi deBruijinIndexOperand, t2
-    
-    btiz t2, .done
-    
-    loadp CodeBlock[cfr], t1
-    bineq CodeBlock::m_codeType[t1], FunctionCode, .loop
-    btbz CodeBlock::m_needsFullScopeChain[t1], .loop
-    
-    loadi CodeBlock::m_activationRegister[t1], t1
-
-    # Need to conditionally skip over one scope.
-    bieq TagOffset[cfr, t1, 8], EmptyValueTag, .noActivation
-    scopeCheck(t0, t1)
-    loadp ScopeChainNode::next[t0], t0
-.noActivation:
-    subi 1, t2
-    
-    btiz t2, .done
-.loop:
-    scopeCheck(t0, t1)
-    loadp ScopeChainNode::next[t0], t0
-    subi 1, t2
-    btinz t2, .loop
-
-.done:
-end
-
-_llint_op_resolve_global_dynamic:
-    traceExecution()
-    loadp JITStackFrame::globalData[sp], t3
-    loadp JSGlobalData::activationStructure[t3], t3
-    getScope(
-        20[PC],
-        macro (scope, scratch)
-            loadp ScopeChainNode::object[scope], scratch
-            bpneq JSCell::m_structure[scratch], t3, .opResolveGlobalDynamicSuperSlow
-        end)
-    resolveGlobal(7, .opResolveGlobalDynamicSlow)
-    dispatch(7)
-
-.opResolveGlobalDynamicSuperSlow:
-    callSlowPath(_llint_slow_path_resolve_for_resolve_global_dynamic)
-    dispatch(7)
-
-.opResolveGlobalDynamicSlow:
-    callSlowPath(_llint_slow_path_resolve_global_dynamic)
-    dispatch(7)
-
-
-_llint_op_get_scoped_var:
-    traceExecution()
-    # Operands are as follows:
-    # 4[PC]   Destination for the load.
-    # 8[PC]   Index of register in the scope.
-    # 12[PC]  De Bruijin index.
-    getScope(12[PC], macro (scope, scratch) end)
-    loadi 4[PC], t1
-    loadi 8[PC], t2
-    loadp ScopeChainNode::object[t0], t0
-    loadp JSVariableObject::m_registers[t0], t0
-    loadi TagOffset[t0, t2, 8], t3
-    loadi PayloadOffset[t0, t2, 8], t0
-    storei t3, TagOffset[cfr, t1, 8]
-    storei t0, PayloadOffset[cfr, t1, 8]
-    loadi 16[PC], t1
-    valueProfile(t3, t0, t1)
-    dispatch(5)
-
-
-_llint_op_put_scoped_var:
-    traceExecution()
-    getScope(8[PC], macro (scope, scratch) end)
-    loadi 12[PC], t1
-    loadConstantOrVariable(t1, t3, t2)
-    loadi 4[PC], t1
-    writeBarrier(t3, t2)
-    loadp ScopeChainNode::object[t0], t0
-    loadp JSVariableObject::m_registers[t0], t0
-    storei t3, TagOffset[t0, t1, 8]
-    storei t2, PayloadOffset[t0, t1, 8]
-    dispatch(4)
-
-
-_llint_op_get_global_var:
-    traceExecution()
-    loadi 8[PC], t1
-    loadi 4[PC], t3
-    loadp CodeBlock[cfr], t0
-    loadp CodeBlock::m_globalObject[t0], t0
-    loadp JSGlobalObject::m_registers[t0], t0
-    loadi TagOffset[t0, t1, 8], t2
-    loadi PayloadOffset[t0, t1, 8], t1
-    storei t2, TagOffset[cfr, t3, 8]
-    storei t1, PayloadOffset[cfr, t3, 8]
-    loadi 12[PC], t3
-    valueProfile(t2, t1, t3)
-    dispatch(4)
-
-
-_llint_op_put_global_var:
-    traceExecution()
-    loadi 8[PC], t1
-    loadp CodeBlock[cfr], t0
-    loadp CodeBlock::m_globalObject[t0], t0
-    loadp JSGlobalObject::m_registers[t0], t0
-    loadConstantOrVariable(t1, t2, t3)
-    loadi 4[PC], t1
-    writeBarrier(t2, t3)
-    storei t2, TagOffset[t0, t1, 8]
-    storei t3, PayloadOffset[t0, t1, 8]
-    dispatch(3)
-
-
 _llint_op_resolve_base:
     traceExecution()
     callSlowPath(_llint_slow_path_resolve_base)
@@ -1450,230 +501,12 @@ _llint_op_resolve_with_this:
     dispatch(5)
 
 
-_llint_op_get_by_id:
-    traceExecution()
-    # We only do monomorphic get_by_id caching for now, and we do not modify the
-    # opcode. We do, however, allow for the cache to change anytime if fails, since
-    # ping-ponging is free. At best we get lucky and the get_by_id will continue
-    # to take fast path on the new cache. At worst we take slow path, which is what
-    # we would have been doing anyway.
-    loadi 8[PC], t0
-    loadi 16[PC], t1
-    loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdSlow)
-    loadi 20[PC], t2
-    loadp JSObject::m_propertyStorage[t3], t0
-    bpneq JSCell::m_structure[t3], t1, .opGetByIdSlow
-    loadi 4[PC], t1
-    loadi TagOffset[t0, t2], t3
-    loadi PayloadOffset[t0, t2], t2
-    storei t3, TagOffset[cfr, t1, 8]
-    storei t2, PayloadOffset[cfr, t1, 8]
-    loadi 32[PC], t1
-    valueProfile(t3, t2, t1)
-    dispatch(9)
-
-.opGetByIdSlow:
-    callSlowPath(_llint_slow_path_get_by_id)
-    dispatch(9)
-
-
-_llint_op_get_arguments_length:
-    traceExecution()
-    loadi 8[PC], t0
-    loadi 4[PC], t1
-    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opGetArgumentsLengthSlow
-    loadi ArgumentCount + PayloadOffset[cfr], t2
-    subi 1, t2
-    storei Int32Tag, TagOffset[cfr, t1, 8]
-    storei t2, PayloadOffset[cfr, t1, 8]
-    dispatch(4)
-
-.opGetArgumentsLengthSlow:
-    callSlowPath(_llint_slow_path_get_arguments_length)
-    dispatch(4)
-
-
-_llint_op_put_by_id:
-    traceExecution()
-    loadi 4[PC], t3
-    loadi 16[PC], t1
-    loadConstantOrVariablePayload(t3, CellTag, t0, .opPutByIdSlow)
-    loadi 12[PC], t2
-    loadp JSObject::m_propertyStorage[t0], t3
-    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
-    loadi 20[PC], t1
-    loadConstantOrVariable2Reg(t2, t0, t2)
-    writeBarrier(t0, t2)
-    storei t0, TagOffset[t3, t1]
-    storei t2, PayloadOffset[t3, t1]
-    dispatch(9)
-
-.opPutByIdSlow:
-    callSlowPath(_llint_slow_path_put_by_id)
-    dispatch(9)
-
-
-macro putByIdTransition(additionalChecks)
-    traceExecution()
-    loadi 4[PC], t3
-    loadi 16[PC], t1
-    loadConstantOrVariablePayload(t3, CellTag, t0, .opPutByIdSlow)
-    loadi 12[PC], t2
-    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
-    additionalChecks(t1, t3, .opPutByIdSlow)
-    loadi 20[PC], t1
-    loadp JSObject::m_propertyStorage[t0], t3
-    addp t1, t3
-    loadConstantOrVariable2Reg(t2, t1, t2)
-    writeBarrier(t1, t2)
-    storei t1, TagOffset[t3]
-    loadi 24[PC], t1
-    storei t2, PayloadOffset[t3]
-    storep t1, JSCell::m_structure[t0]
-    dispatch(9)
-end
-
-_llint_op_put_by_id_transition_direct:
-    putByIdTransition(macro (oldStructure, scratch, slow) end)
-
-
-_llint_op_put_by_id_transition_normal:
-    putByIdTransition(
-        macro (oldStructure, scratch, slow)
-            const protoCell = oldStructure   # Reusing the oldStructure register for the proto
-        
-            loadp 28[PC], scratch
-            assert(macro (ok) btpnz scratch, ok end)
-            loadp StructureChain::m_vector[scratch], scratch
-            assert(macro (ok) btpnz scratch, ok end)
-            bieq Structure::m_prototype + TagOffset[oldStructure], NullTag, .done
-        .loop:
-            loadi Structure::m_prototype + PayloadOffset[oldStructure], protoCell
-            loadp JSCell::m_structure[protoCell], oldStructure
-            bpneq oldStructure, [scratch], slow
-            addp 4, scratch
-            bineq Structure::m_prototype + TagOffset[oldStructure], NullTag, .loop
-        .done:
-        end)
-
-
 _llint_op_del_by_id:
     traceExecution()
     callSlowPath(_llint_slow_path_del_by_id)
     dispatch(4)
 
 
-_llint_op_get_by_val:
-    traceExecution()
-    loadp CodeBlock[cfr], t1
-    loadi 8[PC], t2
-    loadi 12[PC], t3
-    loadp CodeBlock::m_globalData[t1], t1
-    loadConstantOrVariablePayload(t2, CellTag, t0, .opGetByValSlow)
-    loadp JSGlobalData::jsArrayClassInfo[t1], t2
-    loadConstantOrVariablePayload(t3, Int32Tag, t1, .opGetByValSlow)
-    bpneq [t0], t2, .opGetByValSlow
-    loadp JSArray::m_storage[t0], t3
-    biaeq t1, JSArray::m_vectorLength[t0], .opGetByValSlow
-    loadi 4[PC], t0
-    loadi ArrayStorage::m_vector + TagOffset[t3, t1, 8], t2
-    loadi ArrayStorage::m_vector + PayloadOffset[t3, t1, 8], t1
-    bieq t2, EmptyValueTag, .opGetByValSlow
-    storei t2, TagOffset[cfr, t0, 8]
-    storei t1, PayloadOffset[cfr, t0, 8]
-    loadi 16[PC], t0
-    valueProfile(t2, t1, t0)
-    dispatch(5)
-
-.opGetByValSlow:
-    callSlowPath(_llint_slow_path_get_by_val)
-    dispatch(5)
-
-
-_llint_op_get_argument_by_val:
-    traceExecution()
-    loadi 8[PC], t0
-    loadi 12[PC], t1
-    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opGetArgumentByValSlow
-    loadConstantOrVariablePayload(t1, Int32Tag, t2, .opGetArgumentByValSlow)
-    addi 1, t2
-    loadi ArgumentCount + PayloadOffset[cfr], t1
-    biaeq t2, t1, .opGetArgumentByValSlow
-    negi t2
-    loadi 4[PC], t3
-    loadi ThisArgumentOffset + TagOffset[cfr, t2, 8], t0
-    loadi ThisArgumentOffset + PayloadOffset[cfr, t2, 8], t1
-    storei t0, TagOffset[cfr, t3, 8]
-    storei t1, PayloadOffset[cfr, t3, 8]
-    dispatch(5)
-
-.opGetArgumentByValSlow:
-    callSlowPath(_llint_slow_path_get_argument_by_val)
-    dispatch(5)
-
-
-_llint_op_get_by_pname:
-    traceExecution()
-    loadi 12[PC], t0
-    loadConstantOrVariablePayload(t0, CellTag, t1, .opGetByPnameSlow)
-    loadi 16[PC], t0
-    bpneq t1, PayloadOffset[cfr, t0, 8], .opGetByPnameSlow
-    loadi 8[PC], t0
-    loadConstantOrVariablePayload(t0, CellTag, t2, .opGetByPnameSlow)
-    loadi 20[PC], t0
-    loadi PayloadOffset[cfr, t0, 8], t3
-    loadp JSCell::m_structure[t2], t0
-    bpneq t0, JSPropertyNameIterator::m_cachedStructure[t3], .opGetByPnameSlow
-    loadi 24[PC], t0
-    loadi [cfr, t0, 8], t0
-    subi 1, t0
-    biaeq t0, JSPropertyNameIterator::m_numCacheableSlots[t3], .opGetByPnameSlow
-    loadp JSObject::m_propertyStorage[t2], t2
-    loadi TagOffset[t2, t0, 8], t1
-    loadi PayloadOffset[t2, t0, 8], t3
-    loadi 4[PC], t0
-    storei t1, TagOffset[cfr, t0, 8]
-    storei t3, PayloadOffset[cfr, t0, 8]
-    dispatch(7)
-
-.opGetByPnameSlow:
-    callSlowPath(_llint_slow_path_get_by_pname)
-    dispatch(7)
-
-
-_llint_op_put_by_val:
-    traceExecution()
-    loadi 4[PC], t0
-    loadConstantOrVariablePayload(t0, CellTag, t1, .opPutByValSlow)
-    loadi 8[PC], t0
-    loadConstantOrVariablePayload(t0, Int32Tag, t2, .opPutByValSlow)
-    loadp CodeBlock[cfr], t0
-    loadp CodeBlock::m_globalData[t0], t0
-    loadp JSGlobalData::jsArrayClassInfo[t0], t0
-    bpneq [t1], t0, .opPutByValSlow
-    biaeq t2, JSArray::m_vectorLength[t1], .opPutByValSlow
-    loadp JSArray::m_storage[t1], t0
-    bieq ArrayStorage::m_vector + TagOffset[t0, t2, 8], EmptyValueTag, .opPutByValEmpty
-.opPutByValStoreResult:
-    loadi 12[PC], t3
-    loadConstantOrVariable2Reg(t3, t1, t3)
-    writeBarrier(t1, t3)
-    storei t1, ArrayStorage::m_vector + TagOffset[t0, t2, 8]
-    storei t3, ArrayStorage::m_vector + PayloadOffset[t0, t2, 8]
-    dispatch(4)
-
-.opPutByValEmpty:
-    addi 1, ArrayStorage::m_numValuesInVector[t0]
-    bib t2, ArrayStorage::m_length[t0], .opPutByValStoreResult
-    addi 1, t2, t1
-    storei t1, ArrayStorage::m_length[t0]
-    jmp .opPutByValStoreResult
-
-.opPutByValSlow:
-    callSlowPath(_llint_slow_path_put_by_val)
-    dispatch(4)
-
-
 _llint_op_del_by_val:
     traceExecution()
     callSlowPath(_llint_slow_path_del_by_val)
@@ -1692,33 +525,12 @@ _llint_op_put_getter_setter:
     dispatch(5)
 
 
-_llint_op_loop:
-    nop
-_llint_op_jmp:
-    traceExecution()
-    dispatchBranch(4[PC])
-
-
 _llint_op_jmp_scopes:
     traceExecution()
     callSlowPath(_llint_slow_path_jmp_scopes)
     dispatch(0)
 
 
-macro jumpTrueOrFalse(conditionOp, slow)
-    loadi 4[PC], t1
-    loadConstantOrVariablePayload(t1, BooleanTag, t0, .slow)
-    conditionOp(t0, .target)
-    dispatch(3)
-
-.target:
-    dispatchBranch(8[PC])
-
-.slow:
-    callSlowPath(slow)
-    dispatch(0)
-end
-
 _llint_op_loop_if_true:
     nop
 _llint_op_jtrue:
@@ -1737,88 +549,6 @@ _llint_op_jfalse:
         _llint_slow_path_jfalse)
 
 
-macro equalNull(cellHandler, immediateHandler)
-    loadi 4[PC], t0
-    loadi TagOffset[cfr, t0, 8], t1
-    loadi PayloadOffset[cfr, t0, 8], t0
-    bineq t1, CellTag, .immediate
-    loadp JSCell::m_structure[t0], t2
-    cellHandler(Structure::m_typeInfo + TypeInfo::m_flags[t2], .target)
-    dispatch(3)
-
-.target:
-    dispatchBranch(8[PC])
-
-.immediate:
-    ori 1, t1
-    immediateHandler(t1, .target)
-    dispatch(3)
-end
-
-_llint_op_jeq_null:
-    traceExecution()
-    equalNull(
-        macro (value, target) btbnz value, MasqueradesAsUndefined, target end,
-        macro (value, target) bieq value, NullTag, target end)
-    
-
-_llint_op_jneq_null:
-    traceExecution()
-    equalNull(
-        macro (value, target) btbz value, MasqueradesAsUndefined, target end,
-        macro (value, target) bineq value, NullTag, target end)
-
-
-_llint_op_jneq_ptr:
-    traceExecution()
-    loadi 4[PC], t0
-    loadi 8[PC], t1
-    bineq TagOffset[cfr, t0, 8], CellTag, .opJneqPtrBranch
-    bpeq PayloadOffset[cfr, t0, 8], t1, .opJneqPtrFallThrough
-.opJneqPtrBranch:
-    dispatchBranch(12[PC])
-.opJneqPtrFallThrough:
-    dispatch(4)
-
-
-macro compare(integerCompare, doubleCompare, slow_path)
-    loadi 4[PC], t2
-    loadi 8[PC], t3
-    loadConstantOrVariable(t2, t0, t1)
-    loadConstantOrVariable2Reg(t3, t2, t3)
-    bineq t0, Int32Tag, .op1NotInt
-    bineq t2, Int32Tag, .op2NotInt
-    integerCompare(t1, t3, .jumpTarget)
-    dispatch(4)
-
-.op1NotInt:
-    bia t0, LowestTag, .slow
-    bib t2, LowestTag, .op1NotIntOp2Double
-    bineq t2, Int32Tag, .slow
-    ci2d t3, ft1
-    jmp .op1NotIntReady
-.op1NotIntOp2Double:
-    fii2d t3, t2, ft1
-.op1NotIntReady:
-    fii2d t1, t0, ft0
-    doubleCompare(ft0, ft1, .jumpTarget)
-    dispatch(4)
-
-.op2NotInt:
-    ci2d t1, ft0
-    bia t2, LowestTag, .slow
-    fii2d t3, t2, ft1
-    doubleCompare(ft0, ft1, .jumpTarget)
-    dispatch(4)
-
-.jumpTarget:
-    dispatchBranch(12[PC])
-
-.slow:
-    callSlowPath(slow_path)
-    dispatch(0)
-end
-
 _llint_op_loop_if_less:
     nop
 _llint_op_jless:
@@ -1897,117 +627,18 @@ _llint_op_loop_hint:
     dispatch(1)
 
 
-_llint_op_switch_imm:
-    traceExecution()
-    loadi 12[PC], t2
-    loadi 4[PC], t3
-    loadConstantOrVariable(t2, t1, t0)
-    loadp CodeBlock[cfr], t2
-    loadp CodeBlock::m_rareData[t2], t2
-    muli sizeof SimpleJumpTable, t3   # FIXME: would be nice to peephole this!
-    loadp CodeBlock::RareData::m_immediateSwitchJumpTables + VectorBufferOffset[t2], t2
-    addp t3, t2
-    bineq t1, Int32Tag, .opSwitchImmNotInt
-    subi SimpleJumpTable::min[t2], t0
-    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchImmFallThrough
-    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t3
-    loadi [t3, t0, 4], t1
-    btiz t1, .opSwitchImmFallThrough
-    dispatchBranchWithOffset(t1)
-
-.opSwitchImmNotInt:
-    bib t1, LowestTag, .opSwitchImmSlow  # Go to slow path if it's a double.
-.opSwitchImmFallThrough:
-    dispatchBranch(8[PC])
-
-.opSwitchImmSlow:
-    callSlowPath(_llint_slow_path_switch_imm)
-    dispatch(0)
-
-
-_llint_op_switch_char:
-    traceExecution()
-    loadi 12[PC], t2
-    loadi 4[PC], t3
-    loadConstantOrVariable(t2, t1, t0)
-    loadp CodeBlock[cfr], t2
-    loadp CodeBlock::m_rareData[t2], t2
-    muli sizeof SimpleJumpTable, t3
-    loadp CodeBlock::RareData::m_characterSwitchJumpTables + VectorBufferOffset[t2], t2
-    addp t3, t2
-    bineq t1, CellTag, .opSwitchCharFallThrough
-    loadp JSCell::m_structure[t0], t1
-    bbneq Structure::m_typeInfo + TypeInfo::m_type[t1], StringType, .opSwitchCharFallThrough
-    loadp JSString::m_value[t0], t0
-    bineq StringImpl::m_length[t0], 1, .opSwitchCharFallThrough
-    loadp StringImpl::m_data8[t0], t1
-    btinz StringImpl::m_hashAndFlags[t0], HashFlags8BitBuffer, .opSwitchChar8Bit
-    loadh [t1], t0
-    jmp .opSwitchCharReady
-.opSwitchChar8Bit:
-    loadb [t1], t0
-.opSwitchCharReady:
-    subi SimpleJumpTable::min[t2], t0
-    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchCharFallThrough
-    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t2
-    loadi [t2, t0, 4], t1
-    btiz t1, .opSwitchImmFallThrough
-    dispatchBranchWithOffset(t1)
-
-.opSwitchCharFallThrough:
-    dispatchBranch(8[PC])
-
-
 _llint_op_switch_string:
     traceExecution()
     callSlowPath(_llint_slow_path_switch_string)
     dispatch(0)
 
 
-_llint_op_new_func:
-    traceExecution()
-    btiz 12[PC], .opNewFuncUnchecked
-    loadi 4[PC], t1
-    bineq TagOffset[cfr, t1, 8], EmptyValueTag, .opNewFuncDone
-.opNewFuncUnchecked:
-    callSlowPath(_llint_slow_path_new_func)
-.opNewFuncDone:
-    dispatch(4)
-
-
 _llint_op_new_func_exp:
     traceExecution()
     callSlowPath(_llint_slow_path_new_func_exp)
     dispatch(3)
 
 
-macro doCall(slow_path)
-    loadi 4[PC], t0
-    loadi 16[PC], t1
-    loadp LLIntCallLinkInfo::callee[t1], t2
-    loadConstantOrVariablePayload(t0, CellTag, t3, .opCallSlow)
-    bineq t3, t2, .opCallSlow
-    loadi 12[PC], t3
-    addp 24, PC
-    lshifti 3, t3
-    addp cfr, t3  # t3 contains the new value of cfr
-    loadp JSFunction::m_scopeChain[t2], t0
-    storei t2, Callee + PayloadOffset[t3]
-    storei t0, ScopeChain + PayloadOffset[t3]
-    loadi 8 - 24[PC], t2
-    storei PC, ArgumentCount + TagOffset[cfr]
-    storep cfr, CallerFrame[t3]
-    storei t2, ArgumentCount + PayloadOffset[t3]
-    storei CellTag, Callee + TagOffset[t3]
-    storei CellTag, ScopeChain + TagOffset[t3]
-    move t3, cfr
-    call LLIntCallLinkInfo::machineCodeTarget[t1]
-    dispatchAfterCall()
-
-.opCallSlow:
-    slowPathForCall(6, slow_path)
-end
-
 _llint_op_call:
     traceExecution()
     doCall(_llint_slow_path_call)
@@ -2066,97 +697,16 @@ _llint_generic_return_point:
     dispatchAfterCall()
 
 
-_llint_op_tear_off_activation:
-    traceExecution()
-    loadi 4[PC], t0
-    loadi 8[PC], t1
-    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opTearOffActivationCreated
-    bieq TagOffset[cfr, t1, 8], EmptyValueTag, .opTearOffActivationNotCreated
-.opTearOffActivationCreated:
-    callSlowPath(_llint_slow_path_tear_off_activation)
-.opTearOffActivationNotCreated:
-    dispatch(3)
-
-
-_llint_op_tear_off_arguments:
-    traceExecution()
-    loadi 4[PC], t0
-    subi 1, t0   # Get the unmodifiedArgumentsRegister
-    bieq TagOffset[cfr, t0, 8], EmptyValueTag, .opTearOffArgumentsNotCreated
-    callSlowPath(_llint_slow_path_tear_off_arguments)
-.opTearOffArgumentsNotCreated:
-    dispatch(2)
-
-
-macro doReturn()
-    loadp ReturnPC[cfr], t2
-    loadp CallerFrame[cfr], cfr
-    restoreReturnAddressBeforeReturn(t2)
-    ret
-end
-
-_llint_op_ret:
-    traceExecution()
-    checkSwitchToJITForEpilogue()
-    loadi 4[PC], t2
-    loadConstantOrVariable(t2, t1, t0)
-    doReturn()
-
-
-_llint_op_call_put_result:
-    loadi 4[PC], t2
-    loadi 8[PC], t3
-    storei t1, TagOffset[cfr, t2, 8]
-    storei t0, PayloadOffset[cfr, t2, 8]
-    valueProfile(t1, t0, t3)
-    traceExecution() # Needs to be here because it would clobber t1, t0
-    dispatch(3)
-
-
-_llint_op_ret_object_or_this:
-    traceExecution()
-    checkSwitchToJITForEpilogue()
-    loadi 4[PC], t2
-    loadConstantOrVariable(t2, t1, t0)
-    bineq t1, CellTag, .opRetObjectOrThisNotObject
-    loadp JSCell::m_structure[t0], t2
-    bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opRetObjectOrThisNotObject
-    doReturn()
-
-.opRetObjectOrThisNotObject:
-    loadi 8[PC], t2
-    loadConstantOrVariable(t2, t1, t0)
-    doReturn()
-
-
-_llint_op_method_check:
-    traceExecution()
-    # We ignore method checks and use normal get_by_id optimizations.
-    dispatch(1)
-
-
 _llint_op_strcat:
     traceExecution()
     callSlowPath(_llint_slow_path_strcat)
     dispatch(4)
 
 
-_llint_op_to_primitive:
+_llint_op_method_check:
     traceExecution()
-    loadi 8[PC], t2
-    loadi 4[PC], t3
-    loadConstantOrVariable(t2, t1, t0)
-    bineq t1, CellTag, .opToPrimitiveIsImm
-    loadp JSCell::m_structure[t0], t2
-    bbneq Structure::m_typeInfo + TypeInfo::m_type[t2], StringType, .opToPrimitiveSlowCase
-.opToPrimitiveIsImm:
-    storei t1, TagOffset[cfr, t3, 8]
-    storei t0, PayloadOffset[cfr, t3, 8]
-    dispatch(3)
-
-.opToPrimitiveSlowCase:
-    callSlowPath(_llint_slow_path_to_primitive)
-    dispatch(3)
+    # We ignore method checks and use normal get_by_id optimizations.
+    dispatch(1)
 
 
 _llint_op_get_pnames:
@@ -2165,46 +715,6 @@ _llint_op_get_pnames:
     dispatch(0) # The slow_path either advances the PC or jumps us to somewhere else.
 
 
-_llint_op_next_pname:
-    traceExecution()
-    loadi 12[PC], t1
-    loadi 16[PC], t2
-    loadi PayloadOffset[cfr, t1, 8], t0
-    bieq t0, PayloadOffset[cfr, t2, 8], .opNextPnameEnd
-    loadi 20[PC], t2
-    loadi PayloadOffset[cfr, t2, 8], t2
-    loadp JSPropertyNameIterator::m_jsStrings[t2], t3
-    loadi [t3, t0, 8], t3
-    addi 1, t0
-    storei t0, PayloadOffset[cfr, t1, 8]
-    loadi 4[PC], t1
-    storei CellTag, TagOffset[cfr, t1, 8]
-    storei t3, PayloadOffset[cfr, t1, 8]
-    loadi 8[PC], t3
-    loadi PayloadOffset[cfr, t3, 8], t3
-    loadp JSCell::m_structure[t3], t1
-    bpneq t1, JSPropertyNameIterator::m_cachedStructure[t2], .opNextPnameSlow
-    loadp JSPropertyNameIterator::m_cachedPrototypeChain[t2], t0
-    loadp StructureChain::m_vector[t0], t0
-    btpz [t0], .opNextPnameTarget
-.opNextPnameCheckPrototypeLoop:
-    bieq Structure::m_prototype + TagOffset[t1], NullTag, .opNextPnameSlow
-    loadp Structure::m_prototype + PayloadOffset[t1], t2
-    loadp JSCell::m_structure[t2], t1
-    bpneq t1, [t0], .opNextPnameSlow
-    addp 4, t0
-    btpnz [t0], .opNextPnameCheckPrototypeLoop
-.opNextPnameTarget:
-    dispatchBranch(24[PC])
-
-.opNextPnameEnd:
-    dispatch(7)
-
-.opNextPnameSlow:
-    callSlowPath(_llint_slow_path_next_pname) # This either keeps the PC where it was (causing us to loop) or sets it to target.
-    dispatch(0)
-
-
 _llint_op_push_scope:
     traceExecution()
     callSlowPath(_llint_slow_path_push_scope)
@@ -2223,27 +733,6 @@ _llint_op_push_new_scope:
     dispatch(4)
 
 
-_llint_op_catch:
-    # This is where we end up from the JIT's throw trampoline (because the
-    # machine code return address will be set to _llint_op_catch), and from
-    # the interpreter's throw trampoline (see _llint_throw_trampoline).
-    # The JIT throwing protocol calls for the cfr to be in t0. The throwing
-    # code must have known that we were throwing to the interpreter, and have
-    # set JSGlobalData::targetInterpreterPCForThrow.
-    move t0, cfr
-    loadp JITStackFrame::globalData[sp], t3
-    loadi JSGlobalData::targetInterpreterPCForThrow[t3], PC
-    loadi JSGlobalData::exception + PayloadOffset[t3], t0
-    loadi JSGlobalData::exception + TagOffset[t3], t1
-    storei 0, JSGlobalData::exception + PayloadOffset[t3]
-    storei EmptyValueTag, JSGlobalData::exception + TagOffset[t3]       
-    loadi 4[PC], t2
-    storei t0, PayloadOffset[cfr, t2, 8]
-    storei t1, TagOffset[cfr, t2, 8]
-    traceExecution()  # This needs to be here because we don't want to clobber t0, t1, t2, t3 above.
-    dispatch(2)
-
-
 _llint_op_throw:
     traceExecution()
     callSlowPath(_llint_slow_path_throw)
@@ -2256,27 +745,6 @@ _llint_op_throw_reference_error:
     dispatch(2)
 
 
-_llint_op_jsr:
-    traceExecution()
-    loadi 4[PC], t0
-    addi 3 * 4, PC, t1
-    storei t1, [cfr, t0, 8]
-    dispatchBranch(8[PC])
-
-
-_llint_op_sret:
-    traceExecution()
-    loadi 4[PC], t0
-    loadp [cfr, t0, 8], PC
-    dispatch(0)
-
-
-_llint_op_debug:
-    traceExecution()
-    callSlowPath(_llint_slow_path_debug)
-    dispatch(4)
-
-
 _llint_op_profile_will_call:
     traceExecution()
     loadp JITStackFrame::enabledProfilerReference[sp], t0
@@ -2295,29 +763,18 @@ _llint_op_profile_did_call:
     dispatch(2)
 
 
-_llint_op_end:
+_llint_op_debug:
     traceExecution()
-    checkSwitchToJITForEpilogue()
-    loadi 4[PC], t0
-    loadi TagOffset[cfr, t0, 8], t1
-    loadi PayloadOffset[cfr, t0, 8], t0
-    doReturn()
+    callSlowPath(_llint_slow_path_debug)
+    dispatch(4)
 
 
-_llint_throw_from_slow_path_trampoline:
-    # When throwing from the interpreter (i.e. throwing from LLIntSlowPaths), so
-    # the throw target is not necessarily interpreted code, we come to here.
-    # This essentially emulates the JIT's throwing protocol.
-    loadp JITStackFrame::globalData[sp], t1
-    loadp JSGlobalData::callFrameForThrow[t1], t0
-    jmp JSGlobalData::targetMachinePCForThrow[t1]
+_llint_native_call_trampoline:
+    nativeCallTrampoline(NativeExecutable::m_function)
 
 
-_llint_throw_during_call_trampoline:
-    preserveReturnAddressAfterCall(t2)
-    loadp JITStackFrame::globalData[sp], t1
-    loadp JSGlobalData::callFrameForThrow[t1], t0
-    jmp JSGlobalData::targetMachinePCForThrow[t1]
+_llint_native_construct_trampoline:
+    nativeCallTrampoline(NativeExecutable::m_constructor)
 
 
 # Lastly, make sure that we can link even though we don't support all opcodes.
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.h b/Source/JavaScriptCore/llint/LowLevelInterpreter.h
index e5a54a45d..6383757cf 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.h
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.h
@@ -48,6 +48,10 @@ extern "C" void llint_generic_return_point();
 extern "C" void llint_throw_from_slow_path_trampoline();
 extern "C" void llint_throw_during_call_trampoline();
 
+// Native call trampolines
+extern "C" void llint_native_call_trampoline();
+extern "C" void llint_native_construct_trampoline();
+
 #endif // ENABLE(LLINT)
 
 #endif // LowLevelInterpreter_h
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
new file mode 100644
index 000000000..46c6226e5
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -0,0 +1,1653 @@
+# Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+# Crash course on the language that this is written in (which I just call
+# "assembly" even though it's more than that):
+#
+# - Mostly gas-style operand ordering. The last operand tends to be the
+#   destination. So "a := b" is written as "mov b, a". But unlike gas,
+#   comparisons are in-order, so "if (a < b)" is written as
+#   "bilt a, b, ...".
+#
+# - "b" = byte, "h" = 16-bit word, "i" = 32-bit word, "p" = pointer.
+#   Currently this is just 32-bit so "i" and "p" are interchangeable
+#   except when an op supports one but not the other.
+#
+# - In general, valid operands for macro invocations and instructions are
+#   registers (eg "t0"), addresses (eg "4[t0]"), base-index addresses
+#   (eg "7[t0, t1, 2]"), absolute addresses (eg "0xa0000000[]"), or labels
+#   (eg "_foo" or ".foo"). Macro invocations can also take anonymous
+#   macros as operands. Instructions cannot take anonymous macros.
+#
+# - Labels must have names that begin with either "_" or ".".  A "." label
+#   is local and gets renamed before code gen to minimize namespace
+#   pollution. A "_" label is an extern symbol (i.e. ".globl"). The "_"
+#   may or may not be removed during code gen depending on whether the asm
+#   conventions for C name mangling on the target platform mandate a "_"
+#   prefix.
+#
+# - A "macro" is a lambda expression, which may be either anonymous or
+#   named. But this has caveats. "macro" can take zero or more arguments,
+#   which may be macros or any valid operands, but it can only return
+#   code. But you can do Turing-complete things via continuation passing
+#   style: "macro foo (a, b) b(a) end foo(foo, foo)". Actually, don't do
+#   that, since you'll just crash the assembler.
+#
+# - An "if" is a conditional on settings. Any identifier supplied in the
+#   predicate of an "if" is assumed to be a #define that is available
+#   during code gen. So you can't use "if" for computation in a macro, but
+#   you can use it to select different pieces of code for different
+#   platforms.
+#
+# - Arguments to macros follow lexical scoping rather than dynamic scoping.
+#   Const's also follow lexical scoping and may override (hide) arguments
+#   or other consts. All variables (arguments and constants) can be bound
+#   to operands. Additionally, arguments (but not constants) can be bound
+#   to macros.
+
+
+# Below we have a bunch of constant declarations. Each constant must have
+# a corresponding ASSERT() in LLIntData.cpp.
+
+
+# Value representation constants.
+const Int32Tag = -1
+const BooleanTag = -2
+const NullTag = -3
+const UndefinedTag = -4
+const CellTag = -5
+const EmptyValueTag = -6
+const DeletedValueTag = -7
+const LowestTag = DeletedValueTag
+
+
+# Utilities
+macro dispatch(advance)
+    addp advance * 4, PC
+    jmp [PC]
+end
+
+macro dispatchBranchWithOffset(pcOffset)
+    lshifti 2, pcOffset
+    addp pcOffset, PC
+    jmp [PC]
+end
+
+macro dispatchBranch(pcOffset)
+    loadi pcOffset, t0
+    dispatchBranchWithOffset(t0)
+end
+
+macro dispatchAfterCall()
+    loadi ArgumentCount + TagOffset[cfr], PC
+    jmp [PC]
+end
+
+macro cCall2(function, arg1, arg2)
+    if ARMv7
+        move arg1, t0
+        move arg2, t1
+    elsif X86
+        poke arg1, 0
+        poke arg2, 1
+    else
+        error
+    end
+    call function
+end
+
+# This barely works. arg3 and arg4 should probably be immediates.
+macro cCall4(function, arg1, arg2, arg3, arg4)
+    if ARMv7
+        move arg1, t0
+        move arg2, t1
+        move arg3, t2
+        move arg4, t3
+    elsif X86
+        poke arg1, 0
+        poke arg2, 1
+        poke arg3, 2
+        poke arg4, 3
+    else
+        error
+    end
+    call function
+end
+
+macro callSlowPath(slowPath)
+    cCall2(slowPath, cfr, PC)
+    move t0, PC
+    move t1, cfr
+end
+
+# Debugging operation if you'd like to print an operand in the instruction stream. fromWhere
+# should be an immediate integer - any integer you like; use it to identify the place you're
+# debugging from. operand should likewise be an immediate, and should identify the operand
+# in the instruction stream you'd like to print out.
+macro traceOperand(fromWhere, operand)
+    cCall4(_llint_trace_operand, cfr, PC, fromWhere, operand)
+    move t0, PC
+    move t1, cfr
+end
+
+# Debugging operation if you'd like to print the value of an operand in the instruction
+# stream. Same as traceOperand(), but assumes that the operand is a register, and prints its
+# value.
+macro traceValue(fromWhere, operand)
+    cCall4(_llint_trace_value, cfr, PC, fromWhere, operand)
+    move t0, PC
+    move t1, cfr
+end
+
+# Call a slowPath for call opcodes.
+macro callCallSlowPath(advance, slowPath, action)
+    addp advance * 4, PC, t0
+    storep t0, ArgumentCount + TagOffset[cfr]
+    cCall2(slowPath, cfr, PC)
+    move t1, cfr
+    action(t0)
+end
+
+macro checkSwitchToJITForLoop()
+    checkSwitchToJIT(
+        1,
+        macro ()
+            storei PC, ArgumentCount + TagOffset[cfr]
+            cCall2(_llint_loop_osr, cfr, PC)
+            move t1, cfr
+            btpz t0, .recover
+            jmp t0
+        .recover:
+            loadi ArgumentCount + TagOffset[cfr], PC
+        end)
+end
+
+# Index, tag, and payload must be different registers. Index is not
+# changed.
+macro loadConstantOrVariable(index, tag, payload)
+    bigteq index, FirstConstantRegisterIndex, .constant
+    loadi TagOffset[cfr, index, 8], tag
+    loadi PayloadOffset[cfr, index, 8], payload
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], payload
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[payload], payload
+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
+    loadp TagOffset[payload, index, 8], tag
+    loadp PayloadOffset[payload, index, 8], payload
+.done:
+end
+
+# Index and payload may be the same register. Index may be clobbered.
+macro loadConstantOrVariable2Reg(index, tag, payload)
+    bigteq index, FirstConstantRegisterIndex, .constant
+    loadi TagOffset[cfr, index, 8], tag
+    loadi PayloadOffset[cfr, index, 8], payload
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], tag
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[tag], tag
+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
+    lshifti 3, index
+    addp index, tag
+    loadp PayloadOffset[tag], payload
+    loadp TagOffset[tag], tag
+.done:
+end
+
+macro loadConstantOrVariablePayloadTagCustom(index, tagCheck, payload)
+    bigteq index, FirstConstantRegisterIndex, .constant
+    tagCheck(TagOffset[cfr, index, 8])
+    loadi PayloadOffset[cfr, index, 8], payload
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], payload
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[payload], payload
+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
+    tagCheck(TagOffset[payload, index, 8])
+    loadp PayloadOffset[payload, index, 8], payload
+.done:
+end
+
+# Index and payload must be different registers. Index is not mutated. Use
+# this if you know what the tag of the variable should be. Doing the tag
+# test as part of loading the variable reduces register use, but may not
+# be faster than doing loadConstantOrVariable followed by a branch on the
+# tag.
+macro loadConstantOrVariablePayload(index, expectedTag, payload, slow)
+    loadConstantOrVariablePayloadTagCustom(
+        index,
+        macro (actualTag) bineq actualTag, expectedTag, slow end,
+        payload)
+end
+
+macro loadConstantOrVariablePayloadUnchecked(index, payload)
+    loadConstantOrVariablePayloadTagCustom(
+        index,
+        macro (actualTag) end,
+        payload)
+end
+
+macro writeBarrier(tag, payload)
+    # Nothing to do, since we don't have a generational or incremental collector.
+end
+
+macro valueProfile(tag, payload, profile)
+    if VALUE_PROFILER
+        storei tag, ValueProfile::m_buckets + TagOffset[profile]
+        storei payload, ValueProfile::m_buckets + PayloadOffset[profile]
+    end
+end
+
+
+# Entrypoints into the interpreter
+
+# Expects that CodeBlock is in t1, which is what prologue() leaves behind.
+macro functionArityCheck(doneLabel, slow_path)
+    loadi PayloadOffset + ArgumentCount[cfr], t0
+    biaeq t0, CodeBlock::m_numParameters[t1], doneLabel
+    cCall2(slow_path, cfr, PC)   # This slow_path has a simple protocol: t0 = 0 => no error, t0 != 0 => error
+    move t1, cfr
+    btiz t0, .continue
+    loadp JITStackFrame::globalData[sp], t1
+    loadp JSGlobalData::callFrameForThrow[t1], t0
+    jmp JSGlobalData::targetMachinePCForThrow[t1]
+.continue:
+    # Reload CodeBlock and PC, since the slow_path clobbered it.
+    loadp CodeBlock[cfr], t1
+    loadp CodeBlock::m_instructions[t1], PC
+    jmp doneLabel
+end
+
+
+# Instruction implementations
+
+_llint_op_enter:
+    traceExecution()
+    loadp CodeBlock[cfr], t2
+    loadi CodeBlock::m_numVars[t2], t2
+    btiz t2, .opEnterDone
+    move UndefinedTag, t0
+    move 0, t1
+.opEnterLoop:
+    subi 1, t2
+    storei t0, TagOffset[cfr, t2, 8]
+    storei t1, PayloadOffset[cfr, t2, 8]
+    btinz t2, .opEnterLoop
+.opEnterDone:
+    dispatch(1)
+
+
+_llint_op_create_activation:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opCreateActivationDone
+    callSlowPath(_llint_slow_path_create_activation)
+.opCreateActivationDone:
+    dispatch(2)
+
+
+_llint_op_init_lazy_reg:
+    traceExecution()
+    loadi 4[PC], t0
+    storei EmptyValueTag, TagOffset[cfr, t0, 8]
+    storei 0, PayloadOffset[cfr, t0, 8]
+    dispatch(2)
+
+
+_llint_op_create_arguments:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opCreateArgumentsDone
+    callSlowPath(_llint_slow_path_create_arguments)
+.opCreateArgumentsDone:
+    dispatch(2)
+
+
+_llint_op_create_this:
+    traceExecution()
+    loadi 8[PC], t0
+    assertNotConstant(t0)
+    bineq TagOffset[cfr, t0, 8], CellTag, .opCreateThisSlow
+    loadi PayloadOffset[cfr, t0, 8], t0
+    loadp JSCell::m_structure[t0], t1
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t1], ObjectType, .opCreateThisSlow
+    loadp JSObject::m_inheritorID[t0], t2
+    btpz t2, .opCreateThisSlow
+    allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo, t2, t0, t1, t3, .opCreateThisSlow)
+    loadi 4[PC], t1
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+    dispatch(3)
+
+.opCreateThisSlow:
+    callSlowPath(_llint_slow_path_create_this)
+    dispatch(3)
+
+
+_llint_op_get_callee:
+    traceExecution()
+    loadi 4[PC], t0
+    loadp PayloadOffset + Callee[cfr], t1
+    storei CellTag, TagOffset[cfr, t0, 8]
+    storei t1, PayloadOffset[cfr, t0, 8]
+    dispatch(2)
+
+
+_llint_op_convert_this:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], CellTag, .opConvertThisSlow
+    loadi PayloadOffset[cfr, t0, 8], t0
+    loadp JSCell::m_structure[t0], t0
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t0], ObjectType, .opConvertThisSlow
+    dispatch(2)
+
+.opConvertThisSlow:
+    callSlowPath(_llint_slow_path_convert_this)
+    dispatch(2)
+
+
+_llint_op_new_object:
+    traceExecution()
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_emptyObjectStructure[t0], t1
+    allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo, t1, t0, t2, t3, .opNewObjectSlow)
+    loadi 4[PC], t1
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+    dispatch(2)
+
+.opNewObjectSlow:
+    callSlowPath(_llint_slow_path_new_object)
+    dispatch(2)
+
+
+_llint_op_mov:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t0
+    loadConstantOrVariable(t1, t2, t3)
+    storei t2, TagOffset[cfr, t0, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+    dispatch(3)
+
+
+_llint_op_not:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    loadConstantOrVariable(t0, t2, t3)
+    bineq t2, BooleanTag, .opNotSlow
+    xori 1, t3
+    storei t2, TagOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t1, 8]
+    dispatch(3)
+
+.opNotSlow:
+    callSlowPath(_llint_slow_path_not)
+    dispatch(3)
+
+
+_llint_op_eq:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, t3, .opEqSlow
+    bieq t2, CellTag, .opEqSlow
+    bib t2, LowestTag, .opEqSlow
+    loadi 4[PC], t2
+    cieq t0, t1, t0
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(4)
+
+.opEqSlow:
+    callSlowPath(_llint_slow_path_eq)
+    dispatch(4)
+
+
+_llint_op_eq_null:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t3
+    assertNotConstant(t0)
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    bineq t1, CellTag, .opEqNullImmediate
+    loadp JSCell::m_structure[t0], t1
+    tbnz Structure::m_typeInfo + TypeInfo::m_flags[t1], MasqueradesAsUndefined, t1
+    jmp .opEqNullNotImmediate
+.opEqNullImmediate:
+    cieq t1, NullTag, t2
+    cieq t1, UndefinedTag, t1
+    ori t2, t1
+.opEqNullNotImmediate:
+    storei BooleanTag, TagOffset[cfr, t3, 8]
+    storei t1, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+
+
+_llint_op_neq:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, t3, .opNeqSlow
+    bieq t2, CellTag, .opNeqSlow
+    bib t2, LowestTag, .opNeqSlow
+    loadi 4[PC], t2
+    cineq t0, t1, t0
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(4)
+
+.opNeqSlow:
+    callSlowPath(_llint_slow_path_neq)
+    dispatch(4)
+    
+
+_llint_op_neq_null:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t3
+    assertNotConstant(t0)
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    bineq t1, CellTag, .opNeqNullImmediate
+    loadp JSCell::m_structure[t0], t1
+    tbz Structure::m_typeInfo + TypeInfo::m_flags[t1], MasqueradesAsUndefined, t1
+    jmp .opNeqNullNotImmediate
+.opNeqNullImmediate:
+    cineq t1, NullTag, t2
+    cineq t1, UndefinedTag, t1
+    andi t2, t1
+.opNeqNullNotImmediate:
+    storei BooleanTag, TagOffset[cfr, t3, 8]
+    storei t1, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+
+
+macro strictEq(equalityOperation, slowPath)
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, t3, .slow
+    bib t2, LowestTag, .slow
+    bineq t2, CellTag, .notString
+    loadp JSCell::m_structure[t0], t2
+    loadp JSCell::m_structure[t1], t3
+    bbneq Structure::m_typeInfo + TypeInfo::m_type[t2], StringType, .notString
+    bbeq Structure::m_typeInfo + TypeInfo::m_type[t3], StringType, .slow
+.notString:
+    loadi 4[PC], t2
+    equalityOperation(t0, t1, t0)
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(4)
+
+.slow:
+    callSlowPath(slowPath)
+    dispatch(4)
+end
+
+_llint_op_stricteq:
+    traceExecution()
+    strictEq(macro (left, right, result) cieq left, right, result end, _llint_slow_path_stricteq)
+
+
+_llint_op_nstricteq:
+    traceExecution()
+    strictEq(macro (left, right, result) cineq left, right, result end, _llint_slow_path_nstricteq)
+
+
+_llint_op_pre_inc:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPreIncSlow
+    loadi PayloadOffset[cfr, t0, 8], t1
+    baddio 1, t1, .opPreIncSlow
+    storei t1, PayloadOffset[cfr, t0, 8]
+    dispatch(2)
+
+.opPreIncSlow:
+    callSlowPath(_llint_slow_path_pre_inc)
+    dispatch(2)
+
+
+_llint_op_pre_dec:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPreDecSlow
+    loadi PayloadOffset[cfr, t0, 8], t1
+    bsubio 1, t1, .opPreDecSlow
+    storei t1, PayloadOffset[cfr, t0, 8]
+    dispatch(2)
+
+.opPreDecSlow:
+    callSlowPath(_llint_slow_path_pre_dec)
+    dispatch(2)
+
+
+_llint_op_post_inc:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPostIncSlow
+    bieq t0, t1, .opPostIncDone
+    loadi PayloadOffset[cfr, t0, 8], t2
+    move t2, t3
+    baddio 1, t3, .opPostIncSlow
+    storei Int32Tag, TagOffset[cfr, t1, 8]
+    storei t2, PayloadOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+.opPostIncDone:
+    dispatch(3)
+
+.opPostIncSlow:
+    callSlowPath(_llint_slow_path_post_inc)
+    dispatch(3)
+
+
+_llint_op_post_dec:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPostDecSlow
+    bieq t0, t1, .opPostDecDone
+    loadi PayloadOffset[cfr, t0, 8], t2
+    move t2, t3
+    bsubio 1, t3, .opPostDecSlow
+    storei Int32Tag, TagOffset[cfr, t1, 8]
+    storei t2, PayloadOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+.opPostDecDone:
+    dispatch(3)
+
+.opPostDecSlow:
+    callSlowPath(_llint_slow_path_post_dec)
+    dispatch(3)
+
+
+_llint_op_to_jsnumber:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    loadConstantOrVariable(t0, t2, t3)
+    bieq t2, Int32Tag, .opToJsnumberIsInt
+    biaeq t2, EmptyValueTag, .opToJsnumberSlow
+.opToJsnumberIsInt:
+    storei t2, TagOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t1, 8]
+    dispatch(3)
+
+.opToJsnumberSlow:
+    callSlowPath(_llint_slow_path_to_jsnumber)
+    dispatch(3)
+
+
+_llint_op_negate:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t3
+    loadConstantOrVariable(t0, t1, t2)
+    bineq t1, Int32Tag, .opNegateSrcNotInt
+    btiz t2, 0x7fffffff, .opNegateSlow
+    negi t2
+    storei Int32Tag, TagOffset[cfr, t3, 8]
+    storei t2, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+.opNegateSrcNotInt:
+    bia t1, LowestTag, .opNegateSlow
+    xori 0x80000000, t1
+    storei t1, TagOffset[cfr, t3, 8]
+    storei t2, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+
+.opNegateSlow:
+    callSlowPath(_llint_slow_path_negate)
+    dispatch(3)
+
+
+macro binaryOpCustomStore(integerOperationAndStore, doubleOperation, slowPath)
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, Int32Tag, .op1NotInt
+    bineq t3, Int32Tag, .op2NotInt
+    loadi 4[PC], t2
+    integerOperationAndStore(t3, t1, t0, .slow, t2)
+    dispatch(5)
+
+.op1NotInt:
+    # First operand is definitely not an int, the second operand could be anything.
+    bia t2, LowestTag, .slow
+    bib t3, LowestTag, .op1NotIntOp2Double
+    bineq t3, Int32Tag, .slow
+    ci2d t1, ft1
+    jmp .op1NotIntReady
+.op1NotIntOp2Double:
+    fii2d t1, t3, ft1
+.op1NotIntReady:
+    loadi 4[PC], t1
+    fii2d t0, t2, ft0
+    doubleOperation(ft1, ft0)
+    stored ft0, [cfr, t1, 8]
+    dispatch(5)
+
+.op2NotInt:
+    # First operand is definitely an int, the second operand is definitely not.
+    loadi 4[PC], t2
+    bia t3, LowestTag, .slow
+    ci2d t0, ft0
+    fii2d t1, t3, ft1
+    doubleOperation(ft1, ft0)
+    stored ft0, [cfr, t2, 8]
+    dispatch(5)
+
+.slow:
+    callSlowPath(slowPath)
+    dispatch(5)
+end
+
+macro binaryOp(integerOperation, doubleOperation, slowPath)
+    binaryOpCustomStore(
+        macro (int32Tag, left, right, slow, index)
+            integerOperation(left, right, slow)
+            storei int32Tag, TagOffset[cfr, index, 8]
+            storei right, PayloadOffset[cfr, index, 8]
+        end,
+        doubleOperation, slowPath)
+end
+
+_llint_op_add:
+    traceExecution()
+    binaryOp(
+        macro (left, right, slow) baddio left, right, slow end,
+        macro (left, right) addd left, right end,
+        _llint_slow_path_add)
+
+
+_llint_op_mul:
+    traceExecution()
+    binaryOpCustomStore(
+        macro (int32Tag, left, right, slow, index)
+            const scratch = int32Tag   # We know that we can reuse the int32Tag register since it has a constant.
+            move right, scratch
+            bmulio left, scratch, slow
+            btinz scratch, .done
+            bilt left, 0, slow
+            bilt right, 0, slow
+        .done:
+            storei Int32Tag, TagOffset[cfr, index, 8]
+            storei scratch, PayloadOffset[cfr, index, 8]
+        end,
+        macro (left, right) muld left, right end,
+        _llint_slow_path_mul)
+
+
+_llint_op_sub:
+    traceExecution()
+    binaryOp(
+        macro (left, right, slow) bsubio left, right, slow end,
+        macro (left, right) subd left, right end,
+        _llint_slow_path_sub)
+
+
+_llint_op_div:
+    traceExecution()
+    binaryOpCustomStore(
+        macro (int32Tag, left, right, slow, index)
+            ci2d left, ft0
+            ci2d right, ft1
+            divd ft0, ft1
+            bcd2i ft1, right, .notInt
+            storei int32Tag, TagOffset[cfr, index, 8]
+            storei right, PayloadOffset[cfr, index, 8]
+            jmp .done
+        .notInt:
+            stored ft1, [cfr, index, 8]
+        .done:
+        end,
+        macro (left, right) divd left, right end,
+        _llint_slow_path_div)
+
+
+macro bitOp(operation, slowPath, advance)
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t3, Int32Tag, .slow
+    bineq t2, Int32Tag, .slow
+    loadi 4[PC], t2
+    operation(t1, t0, .slow)
+    storei t3, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(advance)
+
+.slow:
+    callSlowPath(slowPath)
+    dispatch(advance)
+end
+
+_llint_op_lshift:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) lshifti left, right end,
+        _llint_slow_path_lshift,
+        4)
+
+
+_llint_op_rshift:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) rshifti left, right end,
+        _llint_slow_path_rshift,
+        4)
+
+
+_llint_op_urshift:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow)
+            urshifti left, right
+            bilt right, 0, slow
+        end,
+        _llint_slow_path_urshift,
+        4)
+
+
+_llint_op_bitand:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) andi left, right end,
+        _llint_slow_path_bitand,
+        5)
+
+
+_llint_op_bitxor:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) xori left, right end,
+        _llint_slow_path_bitxor,
+        5)
+
+
+_llint_op_bitor:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) ori left, right end,
+        _llint_slow_path_bitor,
+        5)
+
+
+_llint_op_check_has_instance:
+    traceExecution()
+    loadi 4[PC], t1
+    loadConstantOrVariablePayload(t1, CellTag, t0, .opCheckHasInstanceSlow)
+    loadp JSCell::m_structure[t0], t0
+    btbz Structure::m_typeInfo + TypeInfo::m_flags[t0], ImplementsHasInstance, .opCheckHasInstanceSlow
+    dispatch(2)
+
+.opCheckHasInstanceSlow:
+    callSlowPath(_llint_slow_path_check_has_instance)
+    dispatch(2)
+
+
+_llint_op_instanceof:
+    traceExecution()
+    # Check that baseVal implements the default HasInstance behavior.
+    # FIXME: This should be deprecated.
+    loadi 12[PC], t1
+    loadConstantOrVariablePayloadUnchecked(t1, t0)
+    loadp JSCell::m_structure[t0], t0
+    btbz Structure::m_typeInfo + TypeInfo::m_flags[t0], ImplementsDefaultHasInstance, .opInstanceofSlow
+    
+    # Actually do the work.
+    loadi 16[PC], t0
+    loadi 4[PC], t3
+    loadConstantOrVariablePayload(t0, CellTag, t1, .opInstanceofSlow)
+    loadp JSCell::m_structure[t1], t2
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opInstanceofSlow
+    loadi 8[PC], t0
+    loadConstantOrVariablePayload(t0, CellTag, t2, .opInstanceofSlow)
+    
+    # Register state: t1 = prototype, t2 = value
+    move 1, t0
+.opInstanceofLoop:
+    loadp JSCell::m_structure[t2], t2
+    loadi Structure::m_prototype + PayloadOffset[t2], t2
+    bpeq t2, t1, .opInstanceofDone
+    btinz t2, .opInstanceofLoop
+
+    move 0, t0
+.opInstanceofDone:
+    storei BooleanTag, TagOffset[cfr, t3, 8]
+    storei t0, PayloadOffset[cfr, t3, 8]
+    dispatch(5)
+
+.opInstanceofSlow:
+    callSlowPath(_llint_slow_path_instanceof)
+    dispatch(5)
+
+
+macro resolveGlobal(size, slow)
+    # Operands are as follows:
+    # 4[PC]   Destination for the load.
+    # 8[PC]   Property identifier index in the code block.
+    # 12[PC]  Structure pointer, initialized to 0 by bytecode generator.
+    # 16[PC]  Offset in global object, initialized to 0 by bytecode generator.
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSCell::m_structure[t0], t1
+    bpneq t1, 12[PC], slow
+    loadi 16[PC], t1
+    loadp JSObject::m_propertyStorage[t0], t0
+    loadi TagOffset[t0, t1, 8], t2
+    loadi PayloadOffset[t0, t1, 8], t3
+    loadi 4[PC], t0
+    storei t2, TagOffset[cfr, t0, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+    loadi (size - 1) * 4[PC], t0
+    valueProfile(t2, t3, t0)
+end
+
+_llint_op_resolve_global:
+    traceExecution()
+    resolveGlobal(6, .opResolveGlobalSlow)
+    dispatch(6)
+
+.opResolveGlobalSlow:
+    callSlowPath(_llint_slow_path_resolve_global)
+    dispatch(6)
+
+
+# Gives you the scope in t0, while allowing you to optionally perform additional checks on the
+# scopes as they are traversed. scopeCheck() is called with two arguments: the register
+# holding the scope, and a register that can be used for scratch. Note that this does not
+# use t3, so you can hold stuff in t3 if need be.
+macro getScope(deBruijinIndexOperand, scopeCheck)
+    loadp ScopeChain + PayloadOffset[cfr], t0
+    loadi deBruijinIndexOperand, t2
+    
+    btiz t2, .done
+    
+    loadp CodeBlock[cfr], t1
+    bineq CodeBlock::m_codeType[t1], FunctionCode, .loop
+    btbz CodeBlock::m_needsFullScopeChain[t1], .loop
+    
+    loadi CodeBlock::m_activationRegister[t1], t1
+
+    # Need to conditionally skip over one scope.
+    bieq TagOffset[cfr, t1, 8], EmptyValueTag, .noActivation
+    scopeCheck(t0, t1)
+    loadp ScopeChainNode::next[t0], t0
+.noActivation:
+    subi 1, t2
+    
+    btiz t2, .done
+.loop:
+    scopeCheck(t0, t1)
+    loadp ScopeChainNode::next[t0], t0
+    subi 1, t2
+    btinz t2, .loop
+
+.done:
+end
+
+_llint_op_resolve_global_dynamic:
+    traceExecution()
+    loadp JITStackFrame::globalData[sp], t3
+    loadp JSGlobalData::activationStructure[t3], t3
+    getScope(
+        20[PC],
+        macro (scope, scratch)
+            loadp ScopeChainNode::object[scope], scratch
+            bpneq JSCell::m_structure[scratch], t3, .opResolveGlobalDynamicSuperSlow
+        end)
+    resolveGlobal(7, .opResolveGlobalDynamicSlow)
+    dispatch(7)
+
+.opResolveGlobalDynamicSuperSlow:
+    callSlowPath(_llint_slow_path_resolve_for_resolve_global_dynamic)
+    dispatch(7)
+
+.opResolveGlobalDynamicSlow:
+    callSlowPath(_llint_slow_path_resolve_global_dynamic)
+    dispatch(7)
+
+
+_llint_op_get_scoped_var:
+    traceExecution()
+    # Operands are as follows:
+    # 4[PC]   Destination for the load.
+    # 8[PC]   Index of register in the scope.
+    # 12[PC]  De Bruijin index.
+    getScope(12[PC], macro (scope, scratch) end)
+    loadi 4[PC], t1
+    loadi 8[PC], t2
+    loadp ScopeChainNode::object[t0], t0
+    loadp JSVariableObject::m_registers[t0], t0
+    loadi TagOffset[t0, t2, 8], t3
+    loadi PayloadOffset[t0, t2, 8], t0
+    storei t3, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+    loadi 16[PC], t1
+    valueProfile(t3, t0, t1)
+    dispatch(5)
+
+
+_llint_op_put_scoped_var:
+    traceExecution()
+    getScope(8[PC], macro (scope, scratch) end)
+    loadi 12[PC], t1
+    loadConstantOrVariable(t1, t3, t2)
+    loadi 4[PC], t1
+    writeBarrier(t3, t2)
+    loadp ScopeChainNode::object[t0], t0
+    loadp JSVariableObject::m_registers[t0], t0
+    storei t3, TagOffset[t0, t1, 8]
+    storei t2, PayloadOffset[t0, t1, 8]
+    dispatch(4)
+
+
+_llint_op_get_global_var:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t3
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_registers[t0], t0
+    loadi TagOffset[t0, t1, 8], t2
+    loadi PayloadOffset[t0, t1, 8], t1
+    storei t2, TagOffset[cfr, t3, 8]
+    storei t1, PayloadOffset[cfr, t3, 8]
+    loadi 12[PC], t3
+    valueProfile(t2, t1, t3)
+    dispatch(4)
+
+
+_llint_op_put_global_var:
+    traceExecution()
+    loadi 8[PC], t1
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_registers[t0], t0
+    loadConstantOrVariable(t1, t2, t3)
+    loadi 4[PC], t1
+    writeBarrier(t2, t3)
+    storei t2, TagOffset[t0, t1, 8]
+    storei t3, PayloadOffset[t0, t1, 8]
+    dispatch(3)
+
+
+_llint_op_get_by_id:
+    traceExecution()
+    # We only do monomorphic get_by_id caching for now, and we do not modify the
+    # opcode. We do, however, allow for the cache to change anytime if fails, since
+    # ping-ponging is free. At best we get lucky and the get_by_id will continue
+    # to take fast path on the new cache. At worst we take slow path, which is what
+    # we would have been doing anyway.
+    loadi 8[PC], t0
+    loadi 16[PC], t1
+    loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdSlow)
+    loadi 20[PC], t2
+    loadp JSObject::m_propertyStorage[t3], t0
+    bpneq JSCell::m_structure[t3], t1, .opGetByIdSlow
+    loadi 4[PC], t1
+    loadi TagOffset[t0, t2], t3
+    loadi PayloadOffset[t0, t2], t2
+    storei t3, TagOffset[cfr, t1, 8]
+    storei t2, PayloadOffset[cfr, t1, 8]
+    loadi 32[PC], t1
+    valueProfile(t3, t2, t1)
+    dispatch(9)
+
+.opGetByIdSlow:
+    callSlowPath(_llint_slow_path_get_by_id)
+    dispatch(9)
+
+
+_llint_op_get_arguments_length:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opGetArgumentsLengthSlow
+    loadi ArgumentCount + PayloadOffset[cfr], t2
+    subi 1, t2
+    storei Int32Tag, TagOffset[cfr, t1, 8]
+    storei t2, PayloadOffset[cfr, t1, 8]
+    dispatch(4)
+
+.opGetArgumentsLengthSlow:
+    callSlowPath(_llint_slow_path_get_arguments_length)
+    dispatch(4)
+
+
+_llint_op_put_by_id:
+    traceExecution()
+    loadi 4[PC], t3
+    loadi 16[PC], t1
+    loadConstantOrVariablePayload(t3, CellTag, t0, .opPutByIdSlow)
+    loadi 12[PC], t2
+    loadp JSObject::m_propertyStorage[t0], t3
+    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
+    loadi 20[PC], t1
+    loadConstantOrVariable2Reg(t2, t0, t2)
+    writeBarrier(t0, t2)
+    storei t0, TagOffset[t3, t1]
+    storei t2, PayloadOffset[t3, t1]
+    dispatch(9)
+
+.opPutByIdSlow:
+    callSlowPath(_llint_slow_path_put_by_id)
+    dispatch(9)
+
+
+macro putByIdTransition(additionalChecks)
+    traceExecution()
+    loadi 4[PC], t3
+    loadi 16[PC], t1
+    loadConstantOrVariablePayload(t3, CellTag, t0, .opPutByIdSlow)
+    loadi 12[PC], t2
+    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
+    additionalChecks(t1, t3, .opPutByIdSlow)
+    loadi 20[PC], t1
+    loadp JSObject::m_propertyStorage[t0], t3
+    addp t1, t3
+    loadConstantOrVariable2Reg(t2, t1, t2)
+    writeBarrier(t1, t2)
+    storei t1, TagOffset[t3]
+    loadi 24[PC], t1
+    storei t2, PayloadOffset[t3]
+    storep t1, JSCell::m_structure[t0]
+    dispatch(9)
+end
+
+_llint_op_put_by_id_transition_direct:
+    putByIdTransition(macro (oldStructure, scratch, slow) end)
+
+
+_llint_op_put_by_id_transition_normal:
+    putByIdTransition(
+        macro (oldStructure, scratch, slow)
+            const protoCell = oldStructure   # Reusing the oldStructure register for the proto
+        
+            loadp 28[PC], scratch
+            assert(macro (ok) btpnz scratch, ok end)
+            loadp StructureChain::m_vector[scratch], scratch
+            assert(macro (ok) btpnz scratch, ok end)
+            bieq Structure::m_prototype + TagOffset[oldStructure], NullTag, .done
+        .loop:
+            loadi Structure::m_prototype + PayloadOffset[oldStructure], protoCell
+            loadp JSCell::m_structure[protoCell], oldStructure
+            bpneq oldStructure, [scratch], slow
+            addp 4, scratch
+            bineq Structure::m_prototype + TagOffset[oldStructure], NullTag, .loop
+        .done:
+        end)
+
+
+_llint_op_get_by_val:
+    traceExecution()
+    loadp CodeBlock[cfr], t1
+    loadi 8[PC], t2
+    loadi 12[PC], t3
+    loadp CodeBlock::m_globalData[t1], t1
+    loadConstantOrVariablePayload(t2, CellTag, t0, .opGetByValSlow)
+    loadp JSGlobalData::jsArrayClassInfo[t1], t2
+    loadConstantOrVariablePayload(t3, Int32Tag, t1, .opGetByValSlow)
+    bpneq [t0], t2, .opGetByValSlow
+    loadp JSArray::m_storage[t0], t3
+    biaeq t1, JSArray::m_vectorLength[t0], .opGetByValSlow
+    loadi 4[PC], t0
+    loadi ArrayStorage::m_vector + TagOffset[t3, t1, 8], t2
+    loadi ArrayStorage::m_vector + PayloadOffset[t3, t1, 8], t1
+    bieq t2, EmptyValueTag, .opGetByValSlow
+    storei t2, TagOffset[cfr, t0, 8]
+    storei t1, PayloadOffset[cfr, t0, 8]
+    loadi 16[PC], t0
+    valueProfile(t2, t1, t0)
+    dispatch(5)
+
+.opGetByValSlow:
+    callSlowPath(_llint_slow_path_get_by_val)
+    dispatch(5)
+
+
+_llint_op_get_argument_by_val:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 12[PC], t1
+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opGetArgumentByValSlow
+    loadConstantOrVariablePayload(t1, Int32Tag, t2, .opGetArgumentByValSlow)
+    addi 1, t2
+    loadi ArgumentCount + PayloadOffset[cfr], t1
+    biaeq t2, t1, .opGetArgumentByValSlow
+    negi t2
+    loadi 4[PC], t3
+    loadi ThisArgumentOffset + TagOffset[cfr, t2, 8], t0
+    loadi ThisArgumentOffset + PayloadOffset[cfr, t2, 8], t1
+    storei t0, TagOffset[cfr, t3, 8]
+    storei t1, PayloadOffset[cfr, t3, 8]
+    dispatch(5)
+
+.opGetArgumentByValSlow:
+    callSlowPath(_llint_slow_path_get_argument_by_val)
+    dispatch(5)
+
+
+_llint_op_get_by_pname:
+    traceExecution()
+    loadi 12[PC], t0
+    loadConstantOrVariablePayload(t0, CellTag, t1, .opGetByPnameSlow)
+    loadi 16[PC], t0
+    bpneq t1, PayloadOffset[cfr, t0, 8], .opGetByPnameSlow
+    loadi 8[PC], t0
+    loadConstantOrVariablePayload(t0, CellTag, t2, .opGetByPnameSlow)
+    loadi 20[PC], t0
+    loadi PayloadOffset[cfr, t0, 8], t3
+    loadp JSCell::m_structure[t2], t0
+    bpneq t0, JSPropertyNameIterator::m_cachedStructure[t3], .opGetByPnameSlow
+    loadi 24[PC], t0
+    loadi [cfr, t0, 8], t0
+    subi 1, t0
+    biaeq t0, JSPropertyNameIterator::m_numCacheableSlots[t3], .opGetByPnameSlow
+    loadp JSObject::m_propertyStorage[t2], t2
+    loadi TagOffset[t2, t0, 8], t1
+    loadi PayloadOffset[t2, t0, 8], t3
+    loadi 4[PC], t0
+    storei t1, TagOffset[cfr, t0, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+    dispatch(7)
+
+.opGetByPnameSlow:
+    callSlowPath(_llint_slow_path_get_by_pname)
+    dispatch(7)
+
+
+_llint_op_put_by_val:
+    traceExecution()
+    loadi 4[PC], t0
+    loadConstantOrVariablePayload(t0, CellTag, t1, .opPutByValSlow)
+    loadi 8[PC], t0
+    loadConstantOrVariablePayload(t0, Int32Tag, t2, .opPutByValSlow)
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalData[t0], t0
+    loadp JSGlobalData::jsArrayClassInfo[t0], t0
+    bpneq [t1], t0, .opPutByValSlow
+    biaeq t2, JSArray::m_vectorLength[t1], .opPutByValSlow
+    loadp JSArray::m_storage[t1], t0
+    bieq ArrayStorage::m_vector + TagOffset[t0, t2, 8], EmptyValueTag, .opPutByValEmpty
+.opPutByValStoreResult:
+    loadi 12[PC], t3
+    loadConstantOrVariable2Reg(t3, t1, t3)
+    writeBarrier(t1, t3)
+    storei t1, ArrayStorage::m_vector + TagOffset[t0, t2, 8]
+    storei t3, ArrayStorage::m_vector + PayloadOffset[t0, t2, 8]
+    dispatch(4)
+
+.opPutByValEmpty:
+    addi 1, ArrayStorage::m_numValuesInVector[t0]
+    bib t2, ArrayStorage::m_length[t0], .opPutByValStoreResult
+    addi 1, t2, t1
+    storei t1, ArrayStorage::m_length[t0]
+    jmp .opPutByValStoreResult
+
+.opPutByValSlow:
+    callSlowPath(_llint_slow_path_put_by_val)
+    dispatch(4)
+
+
+_llint_op_loop:
+    nop
+_llint_op_jmp:
+    traceExecution()
+    dispatchBranch(4[PC])
+
+
+macro jumpTrueOrFalse(conditionOp, slow)
+    loadi 4[PC], t1
+    loadConstantOrVariablePayload(t1, BooleanTag, t0, .slow)
+    conditionOp(t0, .target)
+    dispatch(3)
+
+.target:
+    dispatchBranch(8[PC])
+
+.slow:
+    callSlowPath(slow)
+    dispatch(0)
+end
+
+
+macro equalNull(cellHandler, immediateHandler)
+    loadi 4[PC], t0
+    assertNotConstant(t0)
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    bineq t1, CellTag, .immediate
+    loadp JSCell::m_structure[t0], t2
+    cellHandler(Structure::m_typeInfo + TypeInfo::m_flags[t2], .target)
+    dispatch(3)
+
+.target:
+    dispatchBranch(8[PC])
+
+.immediate:
+    ori 1, t1
+    immediateHandler(t1, .target)
+    dispatch(3)
+end
+
+_llint_op_jeq_null:
+    traceExecution()
+    equalNull(
+        macro (value, target) btbnz value, MasqueradesAsUndefined, target end,
+        macro (value, target) bieq value, NullTag, target end)
+    
+
+_llint_op_jneq_null:
+    traceExecution()
+    equalNull(
+        macro (value, target) btbz value, MasqueradesAsUndefined, target end,
+        macro (value, target) bineq value, NullTag, target end)
+
+
+_llint_op_jneq_ptr:
+    traceExecution()
+    loadi 4[PC], t0
+    loadi 8[PC], t1
+    bineq TagOffset[cfr, t0, 8], CellTag, .opJneqPtrBranch
+    bpeq PayloadOffset[cfr, t0, 8], t1, .opJneqPtrFallThrough
+.opJneqPtrBranch:
+    dispatchBranch(12[PC])
+.opJneqPtrFallThrough:
+    dispatch(4)
+
+
+macro compare(integerCompare, doubleCompare, slowPath)
+    loadi 4[PC], t2
+    loadi 8[PC], t3
+    loadConstantOrVariable(t2, t0, t1)
+    loadConstantOrVariable2Reg(t3, t2, t3)
+    bineq t0, Int32Tag, .op1NotInt
+    bineq t2, Int32Tag, .op2NotInt
+    integerCompare(t1, t3, .jumpTarget)
+    dispatch(4)
+
+.op1NotInt:
+    bia t0, LowestTag, .slow
+    bib t2, LowestTag, .op1NotIntOp2Double
+    bineq t2, Int32Tag, .slow
+    ci2d t3, ft1
+    jmp .op1NotIntReady
+.op1NotIntOp2Double:
+    fii2d t3, t2, ft1
+.op1NotIntReady:
+    fii2d t1, t0, ft0
+    doubleCompare(ft0, ft1, .jumpTarget)
+    dispatch(4)
+
+.op2NotInt:
+    ci2d t1, ft0
+    bia t2, LowestTag, .slow
+    fii2d t3, t2, ft1
+    doubleCompare(ft0, ft1, .jumpTarget)
+    dispatch(4)
+
+.jumpTarget:
+    dispatchBranch(12[PC])
+
+.slow:
+    callSlowPath(slowPath)
+    dispatch(0)
+end
+
+
+_llint_op_switch_imm:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 4[PC], t3
+    loadConstantOrVariable(t2, t1, t0)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_rareData[t2], t2
+    muli sizeof SimpleJumpTable, t3   # FIXME: would be nice to peephole this!
+    loadp CodeBlock::RareData::m_immediateSwitchJumpTables + VectorBufferOffset[t2], t2
+    addp t3, t2
+    bineq t1, Int32Tag, .opSwitchImmNotInt
+    subi SimpleJumpTable::min[t2], t0
+    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchImmFallThrough
+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t3
+    loadi [t3, t0, 4], t1
+    btiz t1, .opSwitchImmFallThrough
+    dispatchBranchWithOffset(t1)
+
+.opSwitchImmNotInt:
+    bib t1, LowestTag, .opSwitchImmSlow  # Go to slow path if it's a double.
+.opSwitchImmFallThrough:
+    dispatchBranch(8[PC])
+
+.opSwitchImmSlow:
+    callSlowPath(_llint_slow_path_switch_imm)
+    dispatch(0)
+
+
+_llint_op_switch_char:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 4[PC], t3
+    loadConstantOrVariable(t2, t1, t0)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_rareData[t2], t2
+    muli sizeof SimpleJumpTable, t3
+    loadp CodeBlock::RareData::m_characterSwitchJumpTables + VectorBufferOffset[t2], t2
+    addp t3, t2
+    bineq t1, CellTag, .opSwitchCharFallThrough
+    loadp JSCell::m_structure[t0], t1
+    bbneq Structure::m_typeInfo + TypeInfo::m_type[t1], StringType, .opSwitchCharFallThrough
+    loadp JSString::m_value[t0], t0
+    bineq StringImpl::m_length[t0], 1, .opSwitchCharFallThrough
+    loadp StringImpl::m_data8[t0], t1
+    btinz StringImpl::m_hashAndFlags[t0], HashFlags8BitBuffer, .opSwitchChar8Bit
+    loadh [t1], t0
+    jmp .opSwitchCharReady
+.opSwitchChar8Bit:
+    loadb [t1], t0
+.opSwitchCharReady:
+    subi SimpleJumpTable::min[t2], t0
+    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchCharFallThrough
+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t2
+    loadi [t2, t0, 4], t1
+    btiz t1, .opSwitchCharFallThrough
+    dispatchBranchWithOffset(t1)
+
+.opSwitchCharFallThrough:
+    dispatchBranch(8[PC])
+
+
+_llint_op_new_func:
+    traceExecution()
+    btiz 12[PC], .opNewFuncUnchecked
+    loadi 4[PC], t1
+    bineq TagOffset[cfr, t1, 8], EmptyValueTag, .opNewFuncDone
+.opNewFuncUnchecked:
+    callSlowPath(_llint_slow_path_new_func)
+.opNewFuncDone:
+    dispatch(4)
+
+
+macro doCall(slowPath)
+    loadi 4[PC], t0
+    loadi 16[PC], t1
+    loadp LLIntCallLinkInfo::callee[t1], t2
+    loadConstantOrVariablePayload(t0, CellTag, t3, .opCallSlow)
+    bineq t3, t2, .opCallSlow
+    loadi 12[PC], t3
+    addp 24, PC
+    lshifti 3, t3
+    addp cfr, t3  # t3 contains the new value of cfr
+    loadp JSFunction::m_scopeChain[t2], t0
+    storei t2, Callee + PayloadOffset[t3]
+    storei t0, ScopeChain + PayloadOffset[t3]
+    loadi 8 - 24[PC], t2
+    storei PC, ArgumentCount + TagOffset[cfr]
+    storep cfr, CallerFrame[t3]
+    storei t2, ArgumentCount + PayloadOffset[t3]
+    storei CellTag, Callee + TagOffset[t3]
+    storei CellTag, ScopeChain + TagOffset[t3]
+    move t3, cfr
+    call LLIntCallLinkInfo::machineCodeTarget[t1]
+    dispatchAfterCall()
+
+.opCallSlow:
+    slowPathForCall(6, slowPath)
+end
+
+
+_llint_op_tear_off_activation:
+    traceExecution()
+    loadi 4[PC], t0
+    loadi 8[PC], t1
+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opTearOffActivationCreated
+    bieq TagOffset[cfr, t1, 8], EmptyValueTag, .opTearOffActivationNotCreated
+.opTearOffActivationCreated:
+    callSlowPath(_llint_slow_path_tear_off_activation)
+.opTearOffActivationNotCreated:
+    dispatch(3)
+
+
+_llint_op_tear_off_arguments:
+    traceExecution()
+    loadi 4[PC], t0
+    subi 1, t0   # Get the unmodifiedArgumentsRegister
+    bieq TagOffset[cfr, t0, 8], EmptyValueTag, .opTearOffArgumentsNotCreated
+    callSlowPath(_llint_slow_path_tear_off_arguments)
+.opTearOffArgumentsNotCreated:
+    dispatch(2)
+
+
+_llint_op_ret:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadi 4[PC], t2
+    loadConstantOrVariable(t2, t1, t0)
+    doReturn()
+
+
+_llint_op_call_put_result:
+    loadi 4[PC], t2
+    loadi 8[PC], t3
+    storei t1, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    valueProfile(t1, t0, t3)
+    traceExecution() # Needs to be here because it would clobber t1, t0
+    dispatch(3)
+
+
+_llint_op_ret_object_or_this:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadi 4[PC], t2
+    loadConstantOrVariable(t2, t1, t0)
+    bineq t1, CellTag, .opRetObjectOrThisNotObject
+    loadp JSCell::m_structure[t0], t2
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opRetObjectOrThisNotObject
+    doReturn()
+
+.opRetObjectOrThisNotObject:
+    loadi 8[PC], t2
+    loadConstantOrVariable(t2, t1, t0)
+    doReturn()
+
+
+_llint_op_to_primitive:
+    traceExecution()
+    loadi 8[PC], t2
+    loadi 4[PC], t3
+    loadConstantOrVariable(t2, t1, t0)
+    bineq t1, CellTag, .opToPrimitiveIsImm
+    loadp JSCell::m_structure[t0], t2
+    bbneq Structure::m_typeInfo + TypeInfo::m_type[t2], StringType, .opToPrimitiveSlowCase
+.opToPrimitiveIsImm:
+    storei t1, TagOffset[cfr, t3, 8]
+    storei t0, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+
+.opToPrimitiveSlowCase:
+    callSlowPath(_llint_slow_path_to_primitive)
+    dispatch(3)
+
+
+_llint_op_next_pname:
+    traceExecution()
+    loadi 12[PC], t1
+    loadi 16[PC], t2
+    loadi PayloadOffset[cfr, t1, 8], t0
+    bieq t0, PayloadOffset[cfr, t2, 8], .opNextPnameEnd
+    loadi 20[PC], t2
+    loadi PayloadOffset[cfr, t2, 8], t2
+    loadp JSPropertyNameIterator::m_jsStrings[t2], t3
+    loadi [t3, t0, 8], t3
+    addi 1, t0
+    storei t0, PayloadOffset[cfr, t1, 8]
+    loadi 4[PC], t1
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t1, 8]
+    loadi 8[PC], t3
+    loadi PayloadOffset[cfr, t3, 8], t3
+    loadp JSCell::m_structure[t3], t1
+    bpneq t1, JSPropertyNameIterator::m_cachedStructure[t2], .opNextPnameSlow
+    loadp JSPropertyNameIterator::m_cachedPrototypeChain[t2], t0
+    loadp StructureChain::m_vector[t0], t0
+    btpz [t0], .opNextPnameTarget
+.opNextPnameCheckPrototypeLoop:
+    bieq Structure::m_prototype + TagOffset[t1], NullTag, .opNextPnameSlow
+    loadp Structure::m_prototype + PayloadOffset[t1], t2
+    loadp JSCell::m_structure[t2], t1
+    bpneq t1, [t0], .opNextPnameSlow
+    addp 4, t0
+    btpnz [t0], .opNextPnameCheckPrototypeLoop
+.opNextPnameTarget:
+    dispatchBranch(24[PC])
+
+.opNextPnameEnd:
+    dispatch(7)
+
+.opNextPnameSlow:
+    callSlowPath(_llint_slow_path_next_pname) # This either keeps the PC where it was (causing us to loop) or sets it to target.
+    dispatch(0)
+
+
+_llint_op_catch:
+    # This is where we end up from the JIT's throw trampoline (because the
+    # machine code return address will be set to _llint_op_catch), and from
+    # the interpreter's throw trampoline (see _llint_throw_trampoline).
+    # The JIT throwing protocol calls for the cfr to be in t0. The throwing
+    # code must have known that we were throwing to the interpreter, and have
+    # set JSGlobalData::targetInterpreterPCForThrow.
+    move t0, cfr
+    loadp JITStackFrame::globalData[sp], t3
+    loadi JSGlobalData::targetInterpreterPCForThrow[t3], PC
+    loadi JSGlobalData::exception + PayloadOffset[t3], t0
+    loadi JSGlobalData::exception + TagOffset[t3], t1
+    storei 0, JSGlobalData::exception + PayloadOffset[t3]
+    storei EmptyValueTag, JSGlobalData::exception + TagOffset[t3]       
+    loadi 4[PC], t2
+    storei t0, PayloadOffset[cfr, t2, 8]
+    storei t1, TagOffset[cfr, t2, 8]
+    traceExecution()  # This needs to be here because we don't want to clobber t0, t1, t2, t3 above.
+    dispatch(2)
+
+
+_llint_op_jsr:
+    traceExecution()
+    loadi 4[PC], t0
+    addi 3 * 4, PC, t1
+    storei t1, [cfr, t0, 8]
+    dispatchBranch(8[PC])
+
+
+_llint_op_sret:
+    traceExecution()
+    loadi 4[PC], t0
+    loadp [cfr, t0, 8], PC
+    dispatch(0)
+
+
+_llint_op_end:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadi 4[PC], t0
+    assertNotConstant(t0)
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    doReturn()
+
+
+_llint_throw_from_slow_path_trampoline:
+    # When throwing from the interpreter (i.e. throwing from LLIntSlowPaths), so
+    # the throw target is not necessarily interpreted code, we come to here.
+    # This essentially emulates the JIT's throwing protocol.
+    loadp JITStackFrame::globalData[sp], t1
+    loadp JSGlobalData::callFrameForThrow[t1], t0
+    jmp JSGlobalData::targetMachinePCForThrow[t1]
+
+
+_llint_throw_during_call_trampoline:
+    preserveReturnAddressAfterCall(t2)
+    loadp JITStackFrame::globalData[sp], t1
+    loadp JSGlobalData::callFrameForThrow[t1], t0
+    jmp JSGlobalData::targetMachinePCForThrow[t1]
+
+
+macro nativeCallTrampoline(executableOffsetToFunction)
+    storep 0, CodeBlock[cfr]
+    loadp CallerFrame[cfr], t0
+    loadi ScopeChain + PayloadOffset[t0], t1
+    storei CellTag, ScopeChain + TagOffset[cfr]
+    storei t1, ScopeChain + PayloadOffset[cfr]
+    if X86
+        peek 0, t1
+        storep t1, ReturnPC[cfr]
+        move cfr, t2  # t2 = ecx
+        subp 16 - 4, sp
+        loadi Callee + PayloadOffset[cfr], t1
+        loadp JSFunction::m_executable[t1], t1
+        move t0, cfr
+        call executableOffsetToFunction[t1]
+        addp 16 - 4, sp
+        loadp JITStackFrame::globalData + 4[sp], t3
+    elsif ARMv7
+        move t0, t2
+        preserveReturnAddressAfterCall(t3)
+        storep t3, ReturnPC[cfr]
+        move cfr, t0
+        loadi Callee + PayloadOffset[cfr], t1
+        loadp JSFunction::m_executable[t1], t1
+        move t2, cfr
+        call executableOffsetToFunction[t1]
+        restoreReturnAddressBeforeReturn(t3)
+        loadp JITStackFrame::globalData[sp], t3
+    else  
+        error
+    end
+    bineq JSGlobalData::exception + TagOffset[t3], EmptyValueTag, .exception
+    ret
+.exception:
+    preserveReturnAddressAfterCall(t1) # This is really only needed on X86
+    callSlowPath(_llint_throw_from_native_call)
+    jmp _llint_throw_from_slow_path_trampoline
+end
+
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
new file mode 100644
index 000000000..d8c931fa0
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -0,0 +1,1490 @@
+# Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+# Some value representation constants.
+const TagBitTypeOther = 0x2
+const TagBitBool      = 0x4
+const TagBitUndefined = 0x8
+const ValueEmpty      = 0x0
+const ValueFalse      = TagBitTypeOther | TagBitBool
+const ValueTrue       = TagBitTypeOther | TagBitBool | 1
+const ValueUndefined  = TagBitTypeOther | TagBitUndefined
+const ValueNull       = TagBitTypeOther
+
+# Utilities.
+macro dispatch(advance)
+    addp advance, PC
+    jmp [PB, PC, 8]
+end
+
+macro dispatchInt(advance)
+    addi advance, PC
+    jmp [PB, PC, 8]
+end
+
+macro dispatchAfterCall()
+    loadi ArgumentCount + TagOffset[cfr], PC
+    loadp CodeBlock[cfr], PB
+    loadp CodeBlock::m_instructions[PB], PB
+    jmp [PB, PC, 8]
+end
+
+macro cCall2(function, arg1, arg2)
+    move arg1, t5
+    move arg2, t4
+    call function
+end
+
+# This barely works. arg3 and arg4 should probably be immediates.
+macro cCall4(function, arg1, arg2, arg3, arg4)
+    move arg1, t5
+    move arg2, t4
+    move arg3, t1
+    move arg4, t2
+    call function
+end
+
+macro prepareStateForCCall()
+    leap [PB, PC, 8], PC
+    move PB, t3
+end
+
+macro restoreStateAfterCCall()
+    move t0, PC
+    move t1, cfr
+    move t3, PB
+    subp PB, PC
+    urshiftp 3, PC
+end
+
+macro callSlowPath(slowPath)
+    prepareStateForCCall()
+    cCall2(slowPath, cfr, PC)
+    restoreStateAfterCCall()
+end
+
+macro traceOperand(fromWhere, operand)
+    prepareStateForCCall()
+    cCall4(_llint_trace_operand, cfr, PC, fromWhere, operand)
+    restoreStateAfterCCall()
+end
+
+macro traceValue(fromWhere, operand)
+    prepareStateForCCall()
+    cCall4(_llint_trace_value, cfr, PC, fromWhere, operand)
+    restoreStateAfterCCall()
+end
+
+# Call a slow path for call call opcodes.
+macro callCallSlowPath(advance, slowPath, action)
+    addi advance, PC, t0
+    storei t0, ArgumentCount + TagOffset[cfr]
+    prepareStateForCCall()
+    cCall2(slowPath, cfr, PC)
+    move t1, cfr
+    action(t0)
+end
+
+macro checkSwitchToJITForLoop()
+    checkSwitchToJIT(
+        1,
+        macro()
+            storei PC, ArgumentCount + TagOffset[cfr]
+            prepareStateForCCall()
+            cCall2(_llint_loop_osr, cfr, PC)
+            move t1, cfr
+            btpz t0, .recover
+            jmp t0
+        .recover:
+            loadp ArgumentCount + TagOffset[cfr], PC
+        end)
+end
+
+# Index and value must be different registers. Index may be clobbered.
+macro loadConstantOrVariable(index, value)
+    bpgteq index, FirstConstantRegisterIndex, .constant
+    loadp [cfr, index, 8], value
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], value
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[value], value
+    subp FirstConstantRegisterIndex, index
+    loadp [value, index, 8], value
+.done:
+end
+
+macro loadConstantOrVariableInt32(index, value, slow)
+    loadConstantOrVariable(index, value)
+    bpb value, tagTypeNumber, slow
+end
+
+macro loadConstantOrVariableCell(index, value, slow)
+    loadConstantOrVariable(index, value)
+    btpnz value, tagMask, slow
+end
+
+macro writeBarrier(value)
+    # Nothing to do, since we don't have a generational or incremental collector.
+end
+
+macro valueProfile(value, profile)
+    if VALUE_PROFILER
+        storep value, ValueProfile::m_buckets[profile]
+    end
+end
+
+
+# Entrypoints into the interpreter.
+
+# Expects that CodeBlock is in t1, which is what prologue() leaves behind.
+macro functionArityCheck(doneLabel, slow_path)
+    loadi PayloadOffset + ArgumentCount[cfr], t0
+    biaeq t0, CodeBlock::m_numParameters[t1], doneLabel
+    prepareStateForCCall()
+    cCall2(slow_path, cfr, PC)   # This slow_path has a simple protocol: t0 = 0 => no error, t0 != 0 => error
+    move t1, cfr
+    btiz t0, .continue
+    loadp JITStackFrame::globalData[sp], t1
+    loadp JSGlobalData::callFrameForThrow[t1], t0
+    jmp JSGlobalData::targetMachinePCForThrow[t1]
+.continue:
+    # Reload CodeBlock and reset PC, since the slow_path clobbered them.
+    loadp CodeBlock[cfr], t1
+    loadp CodeBlock::m_instructions[t1], PB
+    move 0, PC
+    jmp doneLabel
+end
+
+
+# Instruction implementations
+
+_llint_op_enter:
+    traceExecution()
+    loadp CodeBlock[cfr], t2
+    loadi CodeBlock::m_numVars[t2], t2
+    btiz t2, .opEnterDone
+    move ValueUndefined, t0
+.opEnterLoop:
+    subi 1, t2
+    storep t0, [cfr, t2, 8]
+    btinz t2, .opEnterLoop
+.opEnterDone:
+    dispatch(1)
+
+
+_llint_op_create_activation:
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    bpneq [cfr, t0, 8], ValueEmpty, .opCreateActivationDone
+    callSlowPath(_llint_slow_path_create_activation)
+.opCreateActivationDone:
+    dispatch(2)
+
+
+_llint_op_init_lazy_reg:
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    storep ValueEmpty, [cfr, t0, 8]
+    dispatch(2)
+
+
+_llint_op_create_arguments:
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    bpneq [cfr, t0, 8], ValueEmpty, .opCreateArgumentsDone
+    callSlowPath(_llint_slow_path_create_arguments)
+.opCreateArgumentsDone:
+    dispatch(2)
+
+
+_llint_op_create_this:
+    traceExecution()
+    loadis 16[PB, PC, 8], t0
+    assertNotConstant(t0)
+    loadp [cfr, t0, 8], t0
+    btpnz t0, tagMask, .opCreateThisSlow
+    loadp JSCell::m_structure[t0], t1
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t1], ObjectType, .opCreateThisSlow
+    loadp JSObject::m_inheritorID[t0], t2
+    btpz t2, .opCreateThisSlow
+    allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo, t2, t0, t1, t3, .opCreateThisSlow)
+    loadis 8[PB, PC, 8], t1
+    storep t0, [cfr, t1, 8]
+    dispatch(3)
+
+.opCreateThisSlow:
+    callSlowPath(_llint_slow_path_create_this)
+    dispatch(3)
+
+
+_llint_op_get_callee:
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    loadp Callee[cfr], t1
+    storep t1, [cfr, t0, 8]
+    dispatch(2)
+
+
+_llint_op_convert_this:
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    loadp [cfr, t0, 8], t0
+    btpnz t0, tagMask, .opConvertThisSlow
+    loadp JSCell::m_structure[t0], t0
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t0], ObjectType, .opConvertThisSlow
+    dispatch(2)
+
+.opConvertThisSlow:
+    callSlowPath(_llint_slow_path_convert_this)
+    dispatch(2)
+
+
+_llint_op_new_object:
+    traceExecution()
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_emptyObjectStructure[t0], t1
+    allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo, t1, t0, t2, t3, .opNewObjectSlow)
+    loadis 8[PB, PC, 8], t1
+    storep t0, [cfr, t1, 8]
+    dispatch(2)
+
+.opNewObjectSlow:
+    callSlowPath(_llint_slow_path_new_object)
+    dispatch(2)
+
+
+_llint_op_mov:
+    traceExecution()
+    loadis 16[PB, PC, 8], t1
+    loadis 8[PB, PC, 8], t0
+    loadConstantOrVariable(t1, t2)
+    storep t2, [cfr, t0, 8]
+    dispatch(3)
+
+
+_llint_op_not:
+    traceExecution()
+    loadis 16[PB, PC, 8], t0
+    loadis 8[PB, PC, 8], t1
+    loadConstantOrVariable(t0, t2)
+    xorp ValueFalse, t2
+    btpnz t2, ~1, .opNotSlow
+    xorp ValueTrue, t2
+    storep t2, [cfr, t1, 8]
+    dispatch(3)
+
+.opNotSlow:
+    callSlowPath(_llint_slow_path_not)
+    dispatch(3)
+
+
+macro equalityComparison(integerComparison, slowPath)
+    traceExecution()
+    loadis 24[PB, PC, 8], t0
+    loadis 16[PB, PC, 8], t2
+    loadis 8[PB, PC, 8], t3
+    loadConstantOrVariableInt32(t0, t1, .slow)
+    loadConstantOrVariableInt32(t2, t0, .slow)
+    integerComparison(t0, t1, t0)
+    orp ValueFalse, t0
+    storep t0, [cfr, t3, 8]
+    dispatch(4)
+
+.slow:
+    callSlowPath(slowPath)
+    dispatch(4)
+end
+
+_llint_op_eq:
+    equalityComparison(
+        macro (left, right, result) cieq left, right, result end,
+        _llint_slow_path_eq)
+
+
+_llint_op_neq:
+    equalityComparison(
+        macro (left, right, result) cineq left, right, result end,
+        _llint_slow_path_neq)
+
+
+macro equalNullComparison()
+    loadis 16[PB, PC, 8], t0
+    loadp [cfr, t0, 8], t0
+    btpnz t0, tagMask, .immediate
+    loadp JSCell::m_structure[t0], t2
+    tbnz Structure::m_typeInfo + TypeInfo::m_flags[t2], MasqueradesAsUndefined, t0
+    jmp .done
+.immediate:
+    andp ~TagBitUndefined, t0
+    cpeq t0, ValueNull, t0
+.done:
+end
+
+_llint_op_eq_null:
+    traceExecution()
+    equalNullComparison()
+    loadis 8[PB, PC, 8], t1
+    orp ValueFalse, t0
+    storep t0, [cfr, t1, 8]
+    dispatch(3)
+
+
+_llint_op_neq_null:
+    traceExecution()
+    equalNullComparison()
+    loadis 8[PB, PC, 8], t1
+    xorp ValueTrue, t0
+    storep t0, [cfr, t1, 8]
+    dispatch(3)
+
+
+macro strictEq(equalityOperation, slowPath)
+    traceExecution()
+    loadis 24[PB, PC, 8], t0
+    loadis 16[PB, PC, 8], t2
+    loadConstantOrVariable(t0, t1)
+    loadConstantOrVariable(t2, t0)
+    move t0, t2
+    orp t1, t2
+    btpz t2, tagMask, .slow
+    bpaeq t0, tagTypeNumber, .leftOK
+    btpnz t0, tagTypeNumber, .slow
+.leftOK:
+    bpaeq t1, tagTypeNumber, .rightOK
+    btpnz t1, tagTypeNumber, .slow
+.rightOK:
+    equalityOperation(t0, t1, t0)
+    loadis 8[PB, PC, 8], t1
+    orp ValueFalse, t0
+    storep t0, [cfr, t1, 8]
+    dispatch(4)
+
+.slow:
+    callSlowPath(slowPath)
+    dispatch(4)
+end
+
+_llint_op_stricteq:
+    strictEq(
+        macro (left, right, result) cpeq left, right, result end,
+        _llint_slow_path_stricteq)
+
+
+_llint_op_nstricteq:
+    strictEq(
+        macro (left, right, result) cpneq left, right, result end,
+        _llint_slow_path_nstricteq)
+
+
+macro preOp(arithmeticOperation, slowPath)
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    loadp [cfr, t0, 8], t1
+    bpb t1, tagTypeNumber, .slow
+    arithmeticOperation(t1, .slow)
+    orp tagTypeNumber, t1
+    storep t1, [cfr, t0, 8]
+    dispatch(2)
+
+.slow:
+    callSlowPath(slowPath)
+    dispatch(2)
+end
+
+_llint_op_pre_inc:
+    preOp(
+        macro (value, slow) baddio 1, value, slow end,
+        _llint_slow_path_pre_inc)
+
+
+_llint_op_pre_dec:
+    preOp(
+        macro (value, slow) bsubio 1, value, slow end,
+        _llint_slow_path_pre_dec)
+
+
+macro postOp(arithmeticOperation, slowPath)
+    traceExecution()
+    loadis 16[PB, PC, 8], t0
+    loadis 8[PB, PC, 8], t1
+    loadp [cfr, t0, 8], t2
+    bieq t0, t1, .done
+    bpb t2, tagTypeNumber, .slow
+    move t2, t3
+    arithmeticOperation(t3, .slow)
+    orp tagTypeNumber, t3
+    storep t2, [cfr, t1, 8]
+    storep t3, [cfr, t0, 8]
+.done:
+    dispatch(3)
+
+.slow:
+    callSlowPath(slowPath)
+    dispatch(3)
+end
+
+_llint_op_post_inc:
+    postOp(
+        macro (value, slow) baddio 1, value, slow end,
+        _llint_slow_path_post_inc)
+
+
+_llint_op_post_dec:
+    postOp(
+        macro (value, slow) bsubio 1, value, slow end,
+        _llint_slow_path_post_dec)
+
+
+_llint_op_to_jsnumber:
+    traceExecution()
+    loadis 16[PB, PC, 8], t0
+    loadis 8[PB, PC, 8], t1
+    loadConstantOrVariable(t0, t2)
+    bpaeq t2, tagTypeNumber, .opToJsnumberIsImmediate
+    btpz t2, tagTypeNumber, .opToJsnumberSlow
+.opToJsnumberIsImmediate:
+    storep t2, [cfr, t1, 8]
+    dispatch(3)
+
+.opToJsnumberSlow:
+    callSlowPath(_llint_slow_path_to_jsnumber)
+    dispatch(3)
+
+
+_llint_op_negate:
+    traceExecution()
+    loadis 16[PB, PC, 8], t0
+    loadis 8[PB, PC, 8], t1
+    loadConstantOrVariable(t0, t2)
+    bpb t2, tagTypeNumber, .opNegateNotInt
+    btiz t2, 0x7fffffff, .opNegateSlow
+    negi t2
+    orp tagTypeNumber, t2
+    storep t2, [cfr, t1, 8]
+    dispatch(3)
+.opNegateNotInt:
+    btpz t2, tagTypeNumber, .opNegateSlow
+    xorp 0x8000000000000000, t2
+    storep t2, [cfr, t1, 8]
+    dispatch(3)
+
+.opNegateSlow:
+    callSlowPath(_llint_slow_path_negate)
+    dispatch(3)
+
+
+macro binaryOpCustomStore(integerOperationAndStore, doubleOperation, slowPath)
+    loadis 24[PB, PC, 8], t0
+    loadis 16[PB, PC, 8], t2
+    loadConstantOrVariable(t0, t1)
+    loadConstantOrVariable(t2, t0)
+    bpb t0, tagTypeNumber, .op1NotInt
+    bpb t1, tagTypeNumber, .op2NotInt
+    loadis 8[PB, PC, 8], t2
+    integerOperationAndStore(t1, t0, .slow, t2)
+    dispatch(5)
+
+.op1NotInt:
+    # First operand is definitely not an int, the second operand could be anything.
+    btpz t0, tagTypeNumber, .slow
+    bpaeq t1, tagTypeNumber, .op1NotIntOp2Int
+    btpz t1, tagTypeNumber, .slow
+    addp tagTypeNumber, t1
+    fp2d t1, ft1
+    jmp .op1NotIntReady
+.op1NotIntOp2Int:
+    ci2d t1, ft1
+.op1NotIntReady:
+    loadis 8[PB, PC, 8], t2
+    addp tagTypeNumber, t0
+    fp2d t0, ft0
+    doubleOperation(ft1, ft0)
+    fd2p ft0, t0
+    subp tagTypeNumber, t0
+    storep t0, [cfr, t2, 8]
+    dispatch(5)
+
+.op2NotInt:
+    # First operand is definitely an int, the second is definitely not.
+    loadis 8[PB, PC, 8], t2
+    btpz t1, tagTypeNumber, .slow
+    ci2d t0, ft0
+    addp tagTypeNumber, t1
+    fp2d t1, ft1
+    doubleOperation(ft1, ft0)
+    fd2p ft0, t0
+    subp tagTypeNumber, t0
+    storep t0, [cfr, t2, 8]
+    dispatch(5)
+
+.slow:
+    callSlowPath(slowPath)
+    dispatch(5)
+end
+
+macro binaryOp(integerOperation, doubleOperation, slowPath)
+    binaryOpCustomStore(
+        macro (left, right, slow, index)
+            integerOperation(left, right, slow)
+            orp tagTypeNumber, right
+            storep right, [cfr, index, 8]
+        end,
+        doubleOperation, slowPath)
+end
+
+_llint_op_add:
+    traceExecution()
+    binaryOp(
+        macro (left, right, slow) baddio left, right, slow end,
+        macro (left, right) addd left, right end,
+        _llint_slow_path_add)
+
+
+_llint_op_mul:
+    traceExecution()
+    binaryOpCustomStore(
+        macro (left, right, slow, index)
+            # Assume t3 is scratchable.
+            move right, t3
+            bmulio left, t3, slow
+            btinz t3, .done
+            bilt left, 0, slow
+            bilt right, 0, slow
+        .done:
+            orp tagTypeNumber, t3
+            storep t3, [cfr, index, 8]
+        end,
+        macro (left, right) muld left, right end,
+        _llint_slow_path_mul)
+
+
+_llint_op_sub:
+    traceExecution()
+    binaryOp(
+        macro (left, right, slow) bsubio left, right, slow end,
+        macro (left, right) subd left, right end,
+        _llint_slow_path_sub)
+
+
+_llint_op_div:
+    traceExecution()
+    binaryOpCustomStore(
+        macro (left, right, slow, index)
+            # Assume t3 is scratchable.
+            btiz left, slow
+            btinz right, .intOK
+            bilt left, 0, slow
+        .intOK:
+            move left, t3
+            move right, t0
+            cdqi
+            idivi t3
+            btinz t1, slow
+            orp tagTypeNumber, t0
+            storep t0, [cfr, index, 8]
+        end,
+        macro (left, right) divd left, right end,
+        _llint_slow_path_div)
+
+
+macro bitOp(operation, slowPath, advance)
+    loadis 24[PB, PC, 8], t0
+    loadis 16[PB, PC, 8], t2
+    loadis 8[PB, PC, 8], t3
+    loadConstantOrVariable(t0, t1)
+    loadConstantOrVariable(t2, t0)
+    bpb t0, tagTypeNumber, .slow
+    bpb t1, tagTypeNumber, .slow
+    operation(t1, t0, .slow)
+    orp tagTypeNumber, t0
+    storep t0, [cfr, t3, 8]
+    dispatch(advance)
+
+.slow:
+    callSlowPath(slowPath)
+    dispatch(advance)
+end
+
+_llint_op_lshift:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) lshifti left, right end,
+        _llint_slow_path_lshift,
+        4)
+
+
+_llint_op_rshift:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) rshifti left, right end,
+        _llint_slow_path_rshift,
+        4)
+
+
+_llint_op_urshift:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow)
+            urshifti left, right
+            bilt right, 0, slow
+        end,
+        _llint_slow_path_urshift,
+        4)
+
+
+_llint_op_bitand:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) andi left, right end,
+        _llint_slow_path_bitand,
+        5)
+
+
+_llint_op_bitxor:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) xori left, right end,
+        _llint_slow_path_bitxor,
+        5)
+
+
+_llint_op_bitor:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) ori left, right end,
+        _llint_slow_path_bitor,
+        5)
+
+
+_llint_op_check_has_instance:
+    traceExecution()
+    loadis 8[PB, PC, 8], t1
+    loadConstantOrVariableCell(t1, t0, .opCheckHasInstanceSlow)
+    loadp JSCell::m_structure[t0], t0
+    btbz Structure::m_typeInfo + TypeInfo::m_flags[t0], ImplementsHasInstance, .opCheckHasInstanceSlow
+    dispatch(2)
+
+.opCheckHasInstanceSlow:
+    callSlowPath(_llint_slow_path_check_has_instance)
+    dispatch(2)
+
+
+_llint_op_instanceof:
+    traceExecution()
+    # Check that baseVal implements the default HasInstance behavior.
+    # FIXME: This should be deprecated.
+    loadis 24[PB, PC, 8], t1
+    loadConstantOrVariable(t1, t0)
+    loadp JSCell::m_structure[t0], t0
+    btbz Structure::m_typeInfo + TypeInfo::m_flags[t0], ImplementsDefaultHasInstance, .opInstanceofSlow
+    
+    # Actually do the work.
+    loadis 32[PB, PC, 8], t0
+    loadis 8[PB, PC, 8], t3
+    loadConstantOrVariableCell(t0, t1, .opInstanceofSlow)
+    loadp JSCell::m_structure[t1], t2
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opInstanceofSlow
+    loadis 16[PB, PC, 8], t0
+    loadConstantOrVariableCell(t0, t2, .opInstanceofSlow)
+    
+    # Register state: t1 = prototype, t2 = value
+    move 1, t0
+.opInstanceofLoop:
+    loadp JSCell::m_structure[t2], t2
+    loadp Structure::m_prototype[t2], t2
+    bpeq t2, t1, .opInstanceofDone
+    btpz t2, tagMask, .opInstanceofLoop
+
+    move 0, t0
+.opInstanceofDone:
+    orp ValueFalse, t0
+    storep t0, [cfr, t3, 8]
+    dispatch(5)
+
+.opInstanceofSlow:
+    callSlowPath(_llint_slow_path_instanceof)
+    dispatch(5)
+
+
+macro resolveGlobal(size, slow)
+    # Operands are as follows:
+    # 8[PB, PC, 8]   Destination for the load.
+    # 16[PB, PC, 8]  Property identifier index in the code block.
+    # 24[PB, PC, 8]  Structure pointer, initialized to 0 by bytecode generator.
+    # 32[PB, PC, 8]  Offset in global object, initialized to 0 by bytecode generator.
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSCell::m_structure[t0], t1
+    bpneq t1, 24[PB, PC, 8], slow
+    loadis 32[PB, PC, 8], t1
+    loadp JSObject::m_propertyStorage[t0], t0
+    loadp [t0, t1, 8], t2
+    loadis 8[PB, PC, 8], t0
+    storep t2, [cfr, t0, 8]
+    loadp (size - 1) * 8[PB, PC, 8], t0
+    valueProfile(t2, t0)
+end
+
+_llint_op_resolve_global:
+    traceExecution()
+    resolveGlobal(6, .opResolveGlobalSlow)
+    dispatch(6)
+
+.opResolveGlobalSlow:
+    callSlowPath(_llint_slow_path_resolve_global)
+    dispatch(6)
+
+
+# Gives you the scope in t0, while allowing you to optionally perform additional checks on the
+# scopes as they are traversed. scopeCheck() is called with two arguments: the register
+# holding the scope, and a register that can be used for scratch. Note that this does not
+# use t3, so you can hold stuff in t3 if need be.
+macro getScope(deBruijinIndexOperand, scopeCheck)
+    loadp ScopeChain[cfr], t0
+    loadis deBruijinIndexOperand, t2
+    
+    btiz t2, .done
+    
+    loadp CodeBlock[cfr], t1
+    bineq CodeBlock::m_codeType[t1], FunctionCode, .loop
+    btbz CodeBlock::m_needsFullScopeChain[t1], .loop
+    
+    loadis CodeBlock::m_activationRegister[t1], t1
+
+    # Need to conditionally skip over one scope.
+    btpz [cfr, t1, 8], .noActivation
+    scopeCheck(t0, t1)
+    loadp ScopeChainNode::next[t0], t0
+.noActivation:
+    subi 1, t2
+    
+    btiz t2, .done
+.loop:
+    scopeCheck(t0, t1)
+    loadp ScopeChainNode::next[t0], t0
+    subi 1, t2
+    btinz t2, .loop
+
+.done:
+end
+
+_llint_op_resolve_global_dynamic:
+    traceExecution()
+    loadp JITStackFrame::globalData[sp], t3
+    loadp JSGlobalData::activationStructure[t3], t3
+    getScope(
+        40[PB, PC, 8],
+        macro (scope, scratch)
+            loadp ScopeChainNode::object[scope], scratch
+            bpneq JSCell::m_structure[scratch], t3, .opResolveGlobalDynamicSuperSlow
+        end)
+    resolveGlobal(7, .opResolveGlobalDynamicSlow)
+    dispatch(7)
+
+.opResolveGlobalDynamicSuperSlow:
+    callSlowPath(_llint_slow_path_resolve_for_resolve_global_dynamic)
+    dispatch(7)
+
+.opResolveGlobalDynamicSlow:
+    callSlowPath(_llint_slow_path_resolve_global_dynamic)
+    dispatch(7)
+
+
+_llint_op_get_scoped_var:
+    traceExecution()
+    # Operands are as follows:
+    # 8[PB, PC, 8]   Destination for the load
+    # 16[PB, PC, 8]  Index of register in the scope
+    # 24[PB, PC, 8]  De Bruijin index.
+    getScope(24[PB, PC, 8], macro (scope, scratch) end)
+    loadis 8[PB, PC, 8], t1
+    loadis 16[PB, PC, 8], t2
+    loadp ScopeChainNode::object[t0], t0
+    loadp JSVariableObject::m_registers[t0], t0
+    loadp [t0, t2, 8], t3
+    storep t3, [cfr, t1, 8]
+    loadp 32[PB, PC, 8], t1
+    valueProfile(t3, t1)
+    dispatch(5)
+
+
+_llint_op_put_scoped_var:
+    traceExecution()
+    getScope(16[PB, PC, 8], macro (scope, scratch) end)
+    loadis 24[PB, PC, 8], t1
+    loadConstantOrVariable(t1, t3)
+    loadis 8[PB, PC, 8], t1
+    writeBarrier(t3)
+    loadp ScopeChainNode::object[t0], t0
+    loadp JSVariableObject::m_registers[t0], t0
+    storep t3, [t0, t1, 8]
+    dispatch(4)
+
+
+_llint_op_get_global_var:
+    traceExecution()
+    loadis 16[PB, PC, 8], t1
+    loadis 8[PB, PC, 8], t3
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_registers[t0], t0
+    loadp [t0, t1, 8], t2
+    storep t2, [cfr, t3, 8]
+    loadp 24[PB, PC, 8], t3
+    valueProfile(t2, t3)
+    dispatch(4)
+
+
+_llint_op_put_global_var:
+    traceExecution()
+    loadis 16[PB, PC, 8], t1
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_registers[t0], t0
+    loadConstantOrVariable(t1, t2)
+    loadis 8[PB, PC, 8], t1
+    writeBarrier(t2)
+    storep t2, [t0, t1, 8]
+    dispatch(3)
+
+
+_llint_op_get_by_id:
+    traceExecution()
+    # We only do monomorphic get_by_id caching for now, and we do not modify the
+    # opcode. We do, however, allow for the cache to change anytime if fails, since
+    # ping-ponging is free. At best we get lucky and the get_by_id will continue
+    # to take fast path on the new cache. At worst we take slow path, which is what
+    # we would have been doing anyway.
+    loadis 16[PB, PC, 8], t0
+    loadp 32[PB, PC, 8], t1
+    loadConstantOrVariableCell(t0, t3, .opGetByIdSlow)
+    loadis 40[PB, PC, 8], t2
+    loadp JSObject::m_propertyStorage[t3], t0
+    bpneq JSCell::m_structure[t3], t1, .opGetByIdSlow
+    loadis 8[PB, PC, 8], t1
+    loadp [t0, t2], t3
+    storep t3, [cfr, t1, 8]
+    loadp 64[PB, PC, 8], t1
+    valueProfile(t3, t1)
+    dispatch(9)
+
+.opGetByIdSlow:
+    callSlowPath(_llint_slow_path_get_by_id)
+    dispatch(9)
+
+
+_llint_op_get_arguments_length:
+    traceExecution()
+    loadis 16[PB, PC, 8], t0
+    loadis 8[PB, PC, 8], t1
+    btpnz [cfr, t0, 8], .opGetArgumentsLengthSlow
+    loadi ArgumentCount + PayloadOffset[cfr], t2
+    subi 1, t2
+    orp tagTypeNumber, t2
+    storep t2, [cfr, t1, 8]
+    dispatch(4)
+
+.opGetArgumentsLengthSlow:
+    callSlowPath(_llint_slow_path_get_arguments_length)
+    dispatch(4)
+
+
+_llint_op_put_by_id:
+    traceExecution()
+    loadis 8[PB, PC, 8], t3
+    loadp 32[PB, PC, 8], t1
+    loadConstantOrVariableCell(t3, t0, .opPutByIdSlow)
+    loadis 24[PB, PC, 8], t2
+    loadp JSObject::m_propertyStorage[t0], t3
+    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
+    loadis 40[PB, PC, 8], t1
+    loadConstantOrVariable(t2, t0)
+    writeBarrier(t0)
+    storep t0, [t3, t1]
+    dispatch(9)
+
+.opPutByIdSlow:
+    callSlowPath(_llint_slow_path_put_by_id)
+    dispatch(9)
+
+
+macro putByIdTransition(additionalChecks)
+    traceExecution()
+    loadis 8[PB, PC, 8], t3
+    loadp 32[PB, PC, 8], t1
+    loadConstantOrVariableCell(t3, t0, .opPutByIdSlow)
+    loadis 24[PB, PC, 8], t2
+    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
+    additionalChecks(t1, t3, .opPutByIdSlow)
+    loadis 40[PB, PC, 8], t1
+    loadp JSObject::m_propertyStorage[t0], t3
+    addp t1, t3
+    loadConstantOrVariable(t2, t1)
+    writeBarrier(t1)
+    storep t1, [t3]
+    loadp 48[PB, PC, 8], t1
+    storep t1, JSCell::m_structure[t0]
+    dispatch(9)
+end
+
+_llint_op_put_by_id_transition_direct:
+    putByIdTransition(macro (oldStructure, scratch, slow) end)
+
+
+_llint_op_put_by_id_transition_normal:
+    putByIdTransition(
+        macro (oldStructure, scratch, slow)
+            const protoCell = oldStructure    # Reusing the oldStructure register for the proto
+            loadp 56[PB, PC, 8], scratch
+            assert(macro (ok) btpnz scratch, ok end)
+            loadp StructureChain::m_vector[scratch], scratch
+            assert(macro (ok) btpnz scratch, ok end)
+            bpeq Structure::m_prototype[oldStructure], ValueNull, .done
+        .loop:
+            loadp Structure::m_prototype[oldStructure], protoCell
+            loadp JSCell::m_structure[protoCell], oldStructure
+            bpneq oldStructure, [scratch], slow
+            addp 8, scratch
+            bpneq Structure::m_prototype[oldStructure], ValueNull, .loop
+        .done:
+        end)
+
+
+_llint_op_get_by_val:
+    traceExecution()
+    loadp CodeBlock[cfr], t1
+    loadis 16[PB, PC, 8], t2
+    loadis 24[PB, PC, 8], t3
+    loadp CodeBlock::m_globalData[t1], t1
+    loadConstantOrVariableCell(t2, t0, .opGetByValSlow)
+    loadp JSGlobalData::jsArrayClassInfo[t1], t2
+    loadConstantOrVariableInt32(t3, t1, .opGetByValSlow)
+    sxi2p t1, t1
+    bpneq [t0], t2, .opGetByValSlow
+    loadp JSArray::m_storage[t0], t3
+    biaeq t1, JSArray::m_vectorLength[t0], .opGetByValSlow
+    loadis 8[PB, PC, 8], t0
+    loadp ArrayStorage::m_vector[t3, t1, 8], t2
+    btpz t2, .opGetByValSlow
+    storep t2, [cfr, t0, 8]
+    loadp 32[PB, PC, 8], t0
+    valueProfile(t2, t0)
+    dispatch(5)
+
+.opGetByValSlow:
+    callSlowPath(_llint_slow_path_get_by_val)
+    dispatch(5)
+
+
+_llint_op_get_argument_by_val:
+    traceExecution()
+    loadis 16[PB, PC, 8], t0
+    loadis 24[PB, PC, 8], t1
+    btpnz [cfr, t0, 8], .opGetArgumentByValSlow
+    loadConstantOrVariableInt32(t1, t2, .opGetArgumentByValSlow)
+    addi 1, t2
+    loadi ArgumentCount + PayloadOffset[cfr], t1
+    biaeq t2, t1, .opGetArgumentByValSlow
+    negi t2
+    sxi2p t2, t2
+    loadis 8[PB, PC, 8], t3
+    loadp ThisArgumentOffset[cfr, t2, 8], t0
+    storep t0, [cfr, t3, 8]
+    dispatch(5)
+
+.opGetArgumentByValSlow:
+    callSlowPath(_llint_slow_path_get_argument_by_val)
+    dispatch(5)
+
+
+_llint_op_get_by_pname:
+    traceExecution()
+    loadis 24[PB, PC, 8], t1
+    loadConstantOrVariable(t1, t0)
+    loadis 32[PB, PC, 8], t1
+    assertNotConstant(t1)
+    bpneq t0, [cfr, t1, 8], .opGetByPnameSlow
+    loadis 16[PB, PC, 8], t2
+    loadis 40[PB, PC, 8], t3
+    loadConstantOrVariableCell(t2, t0, .opGetByPnameSlow)
+    assertNotConstant(t3)
+    loadp [cfr, t3, 8], t1
+    loadp JSCell::m_structure[t0], t2
+    bpneq t2, JSPropertyNameIterator::m_cachedStructure[t1], .opGetByPnameSlow
+    loadis 48[PB, PC, 8], t3
+    loadi PayloadOffset[cfr, t3, 8], t3
+    subi 1, t3
+    biaeq t3, JSPropertyNameIterator::m_numCacheableSlots[t1], .opGetByPnameSlow
+    loadp JSObject::m_propertyStorage[t0], t0
+    loadp [t0, t3, 8], t0
+    loadis 8[PB, PC, 8], t1
+    storep t0, [cfr, t1, 8]
+    dispatch(7)
+
+.opGetByPnameSlow:
+    callSlowPath(_llint_slow_path_get_by_pname)
+    dispatch(7)
+
+
+_llint_op_put_by_val:
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    loadConstantOrVariableCell(t0, t1, .opPutByValSlow)
+    loadis 16[PB, PC, 8], t0
+    loadConstantOrVariableInt32(t0, t2, .opPutByValSlow)
+    sxi2p t2, t2
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalData[t0], t0
+    loadp JSGlobalData::jsArrayClassInfo[t0], t0
+    bpneq [t1], t0, .opPutByValSlow
+    biaeq t2, JSArray::m_vectorLength[t1], .opPutByValSlow
+    loadp JSArray::m_storage[t1], t0
+    btpz ArrayStorage::m_vector[t0, t2, 8], .opPutByValEmpty
+.opPutByValStoreResult:
+    loadis 24[PB, PC, 8], t3
+    loadConstantOrVariable(t3, t1)
+    writeBarrier(t1)
+    storep t1, ArrayStorage::m_vector[t0, t2, 8]
+    dispatch(4)
+
+.opPutByValEmpty:
+    addi 1, ArrayStorage::m_numValuesInVector[t0]
+    bib t2, ArrayStorage::m_length[t0], .opPutByValStoreResult
+    addi 1, t2, t1
+    storei t1, ArrayStorage::m_length[t0]
+    jmp .opPutByValStoreResult
+
+.opPutByValSlow:
+    callSlowPath(_llint_slow_path_put_by_val)
+    dispatch(4)
+
+
+_llint_op_loop:
+    nop
+_llint_op_jmp:
+    traceExecution()
+    dispatchInt(8[PB, PC, 8])
+
+
+macro jumpTrueOrFalse(conditionOp, slow)
+    loadis 8[PB, PC, 8], t1
+    loadConstantOrVariable(t1, t0)
+    xorp ValueFalse, t0
+    btpnz t0, -1, .slow
+    conditionOp(t0, .target)
+    dispatch(3)
+
+.target:
+    dispatchInt(16[PB, PC, 8])
+
+.slow:
+    callSlowPath(slow)
+    dispatch(0)
+end
+
+
+macro equalNull(cellHandler, immediateHandler)
+    loadis 8[PB, PC, 8], t0
+    assertNotConstant(t0)
+    loadp [cfr, t0, 8], t0
+    btpnz t0, tagMask, .immediate
+    loadp JSCell::m_structure[t0], t2
+    cellHandler(Structure::m_typeInfo + TypeInfo::m_flags[t2], .target)
+    dispatch(3)
+
+.target:
+    dispatch(16[PB, PC, 8])
+
+.immediate:
+    andp ~TagBitUndefined, t0
+    immediateHandler(t0, .target)
+    dispatch(3)
+end
+
+_llint_op_jeq_null:
+    traceExecution()
+    equalNull(
+        macro (value, target) btbnz value, MasqueradesAsUndefined, target end,
+        macro (value, target) bpeq value, ValueNull, target end)
+
+
+_llint_op_jneq_null:
+    traceExecution()
+    equalNull(
+        macro (value, target) btbz value, MasqueradesAsUndefined, target end,
+        macro (value, target) bpneq value, ValueNull, target end)
+
+
+_llint_op_jneq_ptr:
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    loadp 16[PB, PC, 8], t1
+    bpneq t1, [cfr, t0, 8], .opJneqPtrTarget
+    dispatch(4)
+
+.opJneqPtrTarget:
+    dispatchInt(24[PB, PC, 8])
+
+
+macro compare(integerCompare, doubleCompare, slowPath)
+    loadis 8[PB, PC, 8], t2
+    loadis 16[PB, PC, 8], t3
+    loadConstantOrVariable(t2, t0)
+    loadConstantOrVariable(t3, t1)
+    bpb t0, tagTypeNumber, .op1NotInt
+    bpb t1, tagTypeNumber, .op2NotInt
+    integerCompare(t0, t1, .jumpTarget)
+    dispatch(4)
+
+.op1NotInt:
+    btpz t0, tagTypeNumber, .slow
+    bpb t1, tagTypeNumber, .op1NotIntOp2NotInt
+    ci2d t1, ft1
+    jmp .op1NotIntReady
+.op1NotIntOp2NotInt:
+    btpz t1, tagTypeNumber, .slow
+    addp tagTypeNumber, t1
+    fp2d t1, ft1
+.op1NotIntReady:
+    addp tagTypeNumber, t0
+    fp2d t0, ft0
+    doubleCompare(ft0, ft1, .jumpTarget)
+    dispatch(4)
+
+.op2NotInt:
+    ci2d t0, ft0
+    btpz t1, tagTypeNumber, .slow
+    addp tagTypeNumber, t1
+    fp2d t1, ft1
+    doubleCompare(ft0, ft1, .jumpTarget)
+    dispatch(4)
+
+.jumpTarget:
+    dispatchInt(24[PB, PC, 8])
+
+.slow:
+    callSlowPath(slowPath)
+    dispatch(0)
+end
+
+
+_llint_op_switch_imm:
+    traceExecution()
+    loadis 24[PB, PC, 8], t2
+    loadis 8[PB, PC, 8], t3
+    loadConstantOrVariable(t2, t1)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_rareData[t2], t2
+    muli sizeof SimpleJumpTable, t3    # FIXME: would be nice to peephole this!
+    loadp CodeBlock::RareData::m_immediateSwitchJumpTables + VectorBufferOffset[t2], t2
+    addp t3, t2
+    bpb t1, tagTypeNumber, .opSwitchImmNotInt
+    subi SimpleJumpTable::min[t2], t1
+    biaeq t1, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchImmFallThrough
+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t3
+    loadis [t3, t1, 4], t1
+    btiz t1, .opSwitchImmFallThrough
+    dispatch(t1)
+
+.opSwitchImmNotInt:
+    btpnz t1, tagTypeNumber, .opSwitchImmSlow   # Go slow if it's a double.
+.opSwitchImmFallThrough:
+    dispatchInt(16[PB, PC, 8])
+
+.opSwitchImmSlow:
+    callSlowPath(_llint_slow_path_switch_imm)
+    dispatch(0)
+
+
+_llint_op_switch_char:
+    traceExecution()
+    loadis 24[PB, PC, 8], t2
+    loadis 8[PB, PC, 8], t3
+    loadConstantOrVariable(t2, t1)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_rareData[t2], t2
+    muli sizeof SimpleJumpTable, t3
+    loadp CodeBlock::RareData::m_characterSwitchJumpTables + VectorBufferOffset[t2], t2
+    addp t3, t2
+    btpnz t1, tagMask, .opSwitchCharFallThrough
+    loadp JSCell::m_structure[t1], t0
+    bbneq Structure::m_typeInfo + TypeInfo::m_type[t0], StringType, .opSwitchCharFallThrough
+    loadp JSString::m_value[t1], t0
+    bineq StringImpl::m_length[t0], 1, .opSwitchCharFallThrough
+    loadp StringImpl::m_data8[t0], t1
+    btinz StringImpl::m_hashAndFlags[t0], HashFlags8BitBuffer, .opSwitchChar8Bit
+    loadh [t1], t0
+    jmp .opSwitchCharReady
+.opSwitchChar8Bit:
+    loadb [t1], t0
+.opSwitchCharReady:
+    subi SimpleJumpTable::min[t2], t0
+    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchCharFallThrough
+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t2
+    loadis [t2, t0, 4], t1
+    btiz t1, .opSwitchCharFallThrough
+    dispatch(t1)
+
+.opSwitchCharFallThrough:
+    dispatchInt(16[PB, PC, 8])
+
+
+_llint_op_new_func:
+    traceExecution()
+    btiz 24[PB, PC, 8], .opNewFuncUnchecked
+    loadis 8[PB, PC, 8], t1
+    btpnz [cfr, t1, 8], .opNewFuncDone
+.opNewFuncUnchecked:
+    callSlowPath(_llint_slow_path_new_func)
+.opNewFuncDone:
+    dispatch(4)
+
+
+macro doCall(slowPath)
+    loadis 8[PB, PC, 8], t0
+    loadp 32[PB, PC, 8], t1
+    loadp LLIntCallLinkInfo::callee[t1], t2
+    loadConstantOrVariable(t0, t3)
+    bpneq t3, t2, .opCallSlow
+    loadis 24[PB, PC, 8], t3
+    addi 6, PC
+    lshifti 3, t3
+    addp cfr, t3
+    loadp JSFunction::m_scopeChain[t2], t0
+    storep t2, Callee[t3]
+    storep t0, ScopeChain[t3]
+    loadis 16 - 48[PB, PC, 8], t2
+    storei PC, ArgumentCount + TagOffset[cfr]
+    storep cfr, CallerFrame[t3]
+    storei t2, ArgumentCount + PayloadOffset[t3]
+    move t3, cfr
+    call LLIntCallLinkInfo::machineCodeTarget[t1]
+    dispatchAfterCall()
+
+.opCallSlow:
+    slowPathForCall(6, slowPath)
+end
+
+
+_llint_op_tear_off_activation:
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    loadis 16[PB, PC, 8], t1
+    btpnz [cfr, t0, 8], .opTearOffActivationCreated
+    btpz [cfr, t1, 8], .opTearOffActivationNotCreated
+.opTearOffActivationCreated:
+    callSlowPath(_llint_slow_path_tear_off_activation)
+.opTearOffActivationNotCreated:
+    dispatch(3)
+
+
+_llint_op_tear_off_arguments:
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    subi 1, t0   # Get the unmodifiedArgumentsRegister
+    btpz [cfr, t0, 8], .opTearOffArgumentsNotCreated
+    callSlowPath(_llint_slow_path_tear_off_arguments)
+.opTearOffArgumentsNotCreated:
+    dispatch(2)
+
+
+_llint_op_ret:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadis 8[PB, PC, 8], t2
+    loadConstantOrVariable(t2, t0)
+    doReturn()
+
+
+_llint_op_call_put_result:
+    loadis 8[PB, PC, 8], t2
+    loadp 16[PB, PC, 8], t3
+    storep t0, [cfr, t2, 8]
+    valueProfile(t0, t3)
+    traceExecution()
+    dispatch(3)
+
+
+_llint_op_ret_object_or_this:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadis 8[PB, PC, 8], t2
+    loadConstantOrVariable(t2, t0)
+    btpnz t0, tagMask, .opRetObjectOrThisNotObject
+    loadp JSCell::m_structure[t0], t2
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opRetObjectOrThisNotObject
+    doReturn()
+
+.opRetObjectOrThisNotObject:
+    loadis 16[PB, PC, 8], t2
+    loadConstantOrVariable(t2, t0)
+    doReturn()
+
+
+_llint_op_to_primitive:
+    traceExecution()
+    loadis 16[PB, PC, 8], t2
+    loadis 8[PB, PC, 8], t3
+    loadConstantOrVariable(t2, t0)
+    btpnz t0, tagMask, .opToPrimitiveIsImm
+    loadp JSCell::m_structure[t0], t2
+    bbneq Structure::m_typeInfo + TypeInfo::m_type[t2], StringType, .opToPrimitiveSlowCase
+.opToPrimitiveIsImm:
+    storep t0, [cfr, t3, 8]
+    dispatch(3)
+
+.opToPrimitiveSlowCase:
+    callSlowPath(_llint_slow_path_to_primitive)
+    dispatch(3)
+
+
+_llint_op_next_pname:
+    traceExecution()
+    loadis 24[PB, PC, 8], t1
+    loadis 32[PB, PC, 8], t2
+    assertNotConstant(t1)
+    assertNotConstant(t2)
+    loadi PayloadOffset[cfr, t1, 8], t0
+    bieq t0, PayloadOffset[cfr, t2, 8], .opNextPnameEnd
+    loadis 40[PB, PC, 8], t2
+    assertNotConstant(t2)
+    loadp [cfr, t2, 8], t2
+    loadp JSPropertyNameIterator::m_jsStrings[t2], t3
+    loadp [t3, t0, 8], t3
+    addi 1, t0
+    storei t0, PayloadOffset[cfr, t1, 8]
+    loadis 8[PB, PC, 8], t1
+    storep t3, [cfr, t1, 8]
+    loadis 16[PB, PC, 8], t3
+    assertNotConstant(t3)
+    loadp [cfr, t3, 8], t3
+    loadp JSCell::m_structure[t3], t1
+    bpneq t1, JSPropertyNameIterator::m_cachedStructure[t2], .opNextPnameSlow
+    loadp JSPropertyNameIterator::m_cachedPrototypeChain[t2], t0
+    loadp StructureChain::m_vector[t0], t0
+    btpz [t0], .opNextPnameTarget
+.opNextPnameCheckPrototypeLoop:
+    bpeq Structure::m_prototype[t1], ValueNull, .opNextPnameSlow
+    loadp Structure::m_prototype[t1], t2
+    loadp JSCell::m_structure[t2], t1
+    bpneq t1, [t0], .opNextPnameSlow
+    addp 8, t0
+    btpnz [t0], .opNextPnameCheckPrototypeLoop
+.opNextPnameTarget:
+    dispatchInt(48[PB, PC, 8])
+
+.opNextPnameEnd:
+    dispatch(7)
+
+.opNextPnameSlow:
+    callSlowPath(_llint_slow_path_next_pname) # This either keeps the PC where it was (causing us to loop) or sets it to target.
+    dispatch(0)
+
+
+_llint_op_catch:
+    # This is where we end up from the JIT's throw trampoline (because the
+    # machine code return address will be set to _llint_op_catch), and from
+    # the interpreter's throw trampoline (see _llint_throw_trampoline).
+    # The JIT throwing protocol calls for the cfr to be in t0. The throwing
+    # code must have known that we were throwing to the interpreter, and have
+    # set JSGlobalData::targetInterpreterPCForThrow.
+    move t0, cfr
+    loadp CodeBlock[cfr], PB
+    loadp CodeBlock::m_instructions[PB], PB
+    loadp JITStackFrame::globalData[sp], t3
+    loadp JSGlobalData::targetInterpreterPCForThrow[t3], PC
+    subp PB, PC
+    urshiftp 3, PC
+    loadp JSGlobalData::exception[t3], t0
+    storep 0, JSGlobalData::exception[t3]
+    loadis 8[PB, PC, 8], t2
+    storep t0, [cfr, t2, 8]
+    traceExecution()
+    dispatch(2)
+
+
+_llint_op_jsr:
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    addi 3, PC, t1
+    storei t1, [cfr, t0, 8]
+    dispatchInt(16[PB, PC, 8])
+
+
+_llint_op_sret:
+    traceExecution()
+    loadis 8[PB, PC, 8], t0
+    loadi [cfr, t0, 8], PC
+    dispatch(0)
+
+
+_llint_op_end:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadis 8[PB, PC, 8], t0
+    assertNotConstant(t0)
+    loadp [cfr, t0, 8], t0
+    doReturn()
+
+
+_llint_throw_from_slow_path_trampoline:
+    # When throwing from the interpreter (i.e. throwing from LLIntSlowPaths), so
+    # the throw target is not necessarily interpreted code, we come to here.
+    # This essentially emulates the JIT's throwing protocol.
+    loadp JITStackFrame::globalData[sp], t1
+    loadp JSGlobalData::callFrameForThrow[t1], t0
+    jmp JSGlobalData::targetMachinePCForThrow[t1]
+
+
+_llint_throw_during_call_trampoline:
+    preserveReturnAddressAfterCall(t2)
+    loadp JITStackFrame::globalData[sp], t1
+    loadp JSGlobalData::callFrameForThrow[t1], t0
+    jmp JSGlobalData::targetMachinePCForThrow[t1]
+
+
+macro nativeCallTrampoline(executableOffsetToFunction)
+    storep 0, CodeBlock[cfr]
+    loadp CallerFrame[cfr], t0
+    loadp ScopeChain[t0], t1
+    storep t1, ScopeChain[cfr]
+    peek 0, t1
+    storep t1, ReturnPC[cfr]
+    move cfr, t5  # t5 = rdi
+    subp 16 - 8, sp
+    loadp Callee[cfr], t4 # t4 = rsi
+    loadp JSFunction::m_executable[t4], t1
+    move t0, cfr # Restore cfr to avoid loading from stack
+    call executableOffsetToFunction[t1]
+    addp 16 - 8, sp
+    loadp JITStackFrame::globalData + 8[sp], t3
+    btpnz JSGlobalData::exception[t3], .exception
+    ret
+.exception:
+    preserveReturnAddressAfterCall(t1)
+    callSlowPath(_llint_throw_from_native_call)
+    jmp _llint_throw_from_slow_path_trampoline
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/armv7.rb b/Source/JavaScriptCore/offlineasm/armv7.rb
index eb8df6869..ed7db5618 100644
--- a/Source/JavaScriptCore/offlineasm/armv7.rb
+++ b/Source/JavaScriptCore/offlineasm/armv7.rb
@@ -33,29 +33,9 @@ class Node
 end
 
 class SpecialRegister < NoChildren
-    def initialize(name)
-        @name = name
-    end
-    
     def armV7Operand
         @name
     end
-    
-    def address?
-        false
-    end
-    
-    def label?
-        false
-    end
-    
-    def immediate?
-        false
-    end
-    
-    def register?
-        true
-    end
 end
 
 ARMv7_EXTRA_GPRS = [SpecialRegister.new("r9"), SpecialRegister.new("r8"), SpecialRegister.new("r3")]
@@ -228,7 +208,7 @@ def armV7LowerShiftOps(list)
         | node |
         if node.is_a? Instruction
             case node.opcode
-            when "lshifti", "rshifti", "urshifti"
+            when "lshifti", "rshifti", "urshifti", "lshiftp", "rshiftp", "urshiftp"
                 if node.operands.size == 2
                     newList << Instruction.new(node.codeOrigin, node.opcode, [armV7SanitizeShift(node.operands[0], newList), node.operands[1]])
                 else
@@ -469,7 +449,7 @@ def armV7LowerMalformedImmediates(list)
                 else
                     newList << node.armV7LowerMalformedImmediatesRecurse(newList)
                 end
-            when "muli"
+            when "muli", "mulp"
                 if node.operands[0].is_a? Immediate
                     tmp = Tmp.new(codeOrigin, :gpr)
                     newList << Instruction.new(node.codeOrigin, "move", [node.operands[0], tmp])
@@ -535,9 +515,9 @@ def armV7LowerMisplacedAddresses(list)
         if node.is_a? Instruction
             postInstructions = []
             case node.opcode
-            when "addi", "addp", "addis", "andi", "andp", "lshifti", "muli", "negi", "noti", "ori", "oris",
-                "orp", "rshifti", "urshifti", "subi", "subp", "subis", "xori", "xorp", /^bi/, /^bp/, /^bti/,
-                /^btp/, /^ci/, /^cp/, /^ti/
+            when "addi", "addp", "addis", "andi", "andp", "lshifti", "lshiftp", "muli", "mulp", "negi",
+                "negp", "noti", "ori", "oris", "orp", "rshifti", "urshifti", "rshiftp", "urshiftp", "subi",
+                "subp", "subis", "xori", "xorp", /^bi/, /^bp/, /^bti/, /^btp/, /^ci/, /^cp/, /^ti/
                 newList << Instruction.new(node.codeOrigin,
                                            node.opcode,
                                            armV7AsRegisters(newList, postInstructions, node.operands, "i"))
@@ -649,7 +629,7 @@ end
 #
 
 class Sequence
-    def lowerARMv7
+    def getModifiedListARMv7
         myList = @list
         
         # Verify that we will only see instructions and labels.
@@ -673,10 +653,8 @@ class Sequence
         myList = armV7LowerRegisterReuse(myList)
         myList = assignRegistersToTemporaries(myList, :gpr, ARMv7_EXTRA_GPRS)
         myList = assignRegistersToTemporaries(myList, :fpr, ARMv7_EXTRA_FPRS)
-        myList.each {
-            | node |
-            node.lower("ARMv7")
-        }
+        
+        return myList
     end
 end
 
@@ -792,13 +770,13 @@ class Instruction
             emitArmV7Compact("orrs", "orrs", operands)
         when "xori", "xorp"
             emitArmV7Compact("eors", "eor", operands)
-        when "lshifti"
+        when "lshifti", "lshiftp"
             emitArmV7Compact("lsls", "lsls", operands)
-        when "rshifti"
+        when "rshifti", "rshiftp"
             emitArmV7Compact("asrs", "asrs", operands)
-        when "urshifti"
+        when "urshifti", "urshiftp"
             emitArmV7Compact("lsrs", "lsrs", operands)
-        when "muli"
+        when "muli", "mulp"
             if operands.size == 2 or operands[0] == operands[2] or operands[1] == operands[2]
                 emitArmV7("muls", operands)
             else
@@ -807,11 +785,11 @@ class Instruction
             end
         when "subi", "subp", "subis"
             emitArmV7Compact("subs", "subs", operands)
-        when "negi"
+        when "negi", "negp"
             $asm.puts "rsbs #{operands[0].armV7Operand}, #{operands[0].armV7Operand}, \#0"
         when "noti"
             $asm.puts "mvns #{operands[0].armV7Operand}, #{operands[0].armV7Operand}"
-        when "loadi", "loadp"
+        when "loadi", "loadis", "loadp"
             $asm.puts "ldr #{armV7FlippedOperands(operands)}"
         when "storei", "storep"
             $asm.puts "str #{armV7Operands(operands)}"
diff --git a/Source/JavaScriptCore/offlineasm/asm.rb b/Source/JavaScriptCore/offlineasm/asm.rb
index a93a8c5dd..12bade022 100644
--- a/Source/JavaScriptCore/offlineasm/asm.rb
+++ b/Source/JavaScriptCore/offlineasm/asm.rb
@@ -128,11 +128,15 @@ outputFlnm = ARGV.shift
 
 $stderr.puts "offlineasm: Parsing #{asmFile} and #{offsetsFile} and creating assembly file #{outputFlnm}."
 
-configurationList = offsetsAndConfigurationIndex(offsetsFile)
-inputData = IO::read(asmFile)
+begin
+    configurationList = offsetsAndConfigurationIndex(offsetsFile)
+rescue MissingMagicValuesException
+    $stderr.puts "offlineasm: No magic values found. Skipping assembly file generation assuming the classic interpreter is enabled."
+    exit 0
+end
 
 inputHash =
-    "// offlineasm input hash: " + Digest::SHA1.hexdigest(inputData) +
+    "// offlineasm input hash: " + parseHash(asmFile) +
     " " + Digest::SHA1.hexdigest(configurationList.map{|v| (v[0] + [v[1]]).join(' ')}.join(' ')) +
     " " + selfHash
 
@@ -154,7 +158,7 @@ File.open(outputFlnm, "w") {
     
     $asm = Assembler.new($output)
     
-    ast = parse(lex(inputData))
+    ast = parse(asmFile)
     
     configurationList.each {
         | configuration |
@@ -163,6 +167,7 @@ File.open(outputFlnm, "w") {
         forSettings(computeSettingsCombinations(ast)[configIndex], ast) {
             | concreteSettings, lowLevelAST, backend |
             lowLevelAST = lowLevelAST.resolve(*buildOffsetsMap(lowLevelAST, offsetsList))
+            lowLevelAST.validate
             emitCodeInConfiguration(concreteSettings, lowLevelAST, backend) {
                 $asm.inAsm {
                     lowLevelAST.lower(backend)
diff --git a/Source/JavaScriptCore/offlineasm/ast.rb b/Source/JavaScriptCore/offlineasm/ast.rb
index f67b0fc60..e555b5d98 100644
--- a/Source/JavaScriptCore/offlineasm/ast.rb
+++ b/Source/JavaScriptCore/offlineasm/ast.rb
@@ -57,7 +57,7 @@ class Node
     end
     
     def codeOriginString
-        "line number #{@codeOrigin}"
+        @codeOrigin.to_s
     end
     
     def descendants
@@ -383,6 +383,157 @@ class NegImmediate < Node
     end
 end
 
+class OrImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        OrImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} | #{right.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class AndImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        AndImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} & #{right.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class XorImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        XorImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} ^ #{right.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class BitnotImmediate < Node
+    attr_reader :child
+    
+    def initialize(codeOrigin, child)
+        super(codeOrigin)
+        @child = child
+    end
+    
+    def children
+        [@child]
+    end
+    
+    def mapChildren
+        BitnotImmediate.new(codeOrigin, (yield @child))
+    end
+    
+    def dump
+        "(~#{@child.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
 class RegisterID < NoChildren
     attr_reader :name
     
@@ -459,6 +610,28 @@ class FPRegisterID < NoChildren
     end
 end
 
+class SpecialRegister < NoChildren
+    def initialize(name)
+        @name = name
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        true
+    end
+end
+
 class Variable < NoChildren
     attr_reader :name
     
@@ -479,6 +652,10 @@ class Variable < NoChildren
     def dump
         name
     end
+    
+    def inspect
+        "<variable #{name} at #{codeOriginString}>"
+    end
 end
 
 class Address < Node
@@ -757,6 +934,10 @@ class LabelReference < Node
     def label?
         true
     end
+    
+    def immediate?
+        false
+    end
 end
 
 class LocalLabelReference < NoChildren
@@ -790,6 +971,10 @@ class LocalLabelReference < NoChildren
     def label?
         true
     end
+    
+    def immediate?
+        false
+    end
 end
 
 class Sequence < Node
diff --git a/Source/JavaScriptCore/offlineasm/backends.rb b/Source/JavaScriptCore/offlineasm/backends.rb
index 2c65b517d..db7a1e218 100644
--- a/Source/JavaScriptCore/offlineasm/backends.rb
+++ b/Source/JavaScriptCore/offlineasm/backends.rb
@@ -28,6 +28,7 @@ require "x86"
 BACKENDS =
     [
      "X86",
+     "X86_64",
      "ARMv7"
     ]
 
@@ -39,6 +40,7 @@ BACKENDS =
 WORKING_BACKENDS =
     [
      "X86",
+     "X86_64",
      "ARMv7"
     ]
 
@@ -46,7 +48,12 @@ BACKEND_PATTERN = Regexp.new('\\A(' + BACKENDS.join(')|(') + ')\\Z')
 
 class Node
     def lower(name)
-        send("lower" + name)
+        begin
+            $activeBackend = name
+            send("lower" + name)
+        rescue => e
+            raise "Got error #{e} at #{codeOriginString}"
+        end
     end
 end
 
@@ -83,7 +90,14 @@ end
 
 class Sequence
     def lower(name)
-        if respond_to? "lower#{name}"
+        $activeBackend = name
+        if respond_to? "getModifiedList#{name}"
+            newList = send("getModifiedList#{name}")
+            newList.each {
+                | node |
+                node.lower(name)
+            }
+        elsif respond_to? "lower#{name}"
             send("lower#{name}")
         else
             @list.each {
diff --git a/Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb b/Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb
index 8bdf4505d..b2a8c2c83 100644
--- a/Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb
+++ b/Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb
@@ -45,8 +45,7 @@ def emitMagicNumber
     }
 end
 
-inputData = IO::read(inputFlnm)
-inputHash = "// offlineasm input hash: #{Digest::SHA1.hexdigest(inputData)} #{selfHash}"
+inputHash = "// offlineasm input hash: #{parseHash(inputFlnm)} #{selfHash}"
 
 if FileTest.exist? outputFlnm
     File.open(outputFlnm, "r") {
@@ -59,7 +58,7 @@ if FileTest.exist? outputFlnm
     }
 end
 
-originalAST = parse(lex(inputData))
+originalAST = parse(inputFlnm)
 
 #
 # Optimize the AST to make configuration extraction faster. This reduces the AST to a form
diff --git a/Source/JavaScriptCore/offlineasm/instructions.rb b/Source/JavaScriptCore/offlineasm/instructions.rb
index 497b47371..cc7e0c6a5 100644
--- a/Source/JavaScriptCore/offlineasm/instructions.rb
+++ b/Source/JavaScriptCore/offlineasm/instructions.rb
@@ -30,15 +30,20 @@ MACRO_INSTRUCTIONS =
      "addi",
      "andi",
      "lshifti",
+     "lshiftp",
      "muli",
      "negi",
+     "negp",
      "noti",
      "ori",
      "rshifti",
      "urshifti",
+     "rshiftp",
+     "urshiftp",
      "subi",
      "xori",
      "loadi",
+     "loadis",
      "loadb",
      "loadbs",
      "loadh",
@@ -56,6 +61,8 @@ MACRO_INSTRUCTIONS =
      "ci2d",
      "fii2d", # usage: fii2d <gpr with least significant bits>, <gpr with most significant bits>, <fpr>
      "fd2ii", # usage: fd2ii <fpr>, <gpr with least significant bits>, <gpr with most significant bits>
+     "fp2d",
+     "fd2p",
      "bdeq",
      "bdneq",
      "bdgt",
@@ -157,6 +164,7 @@ MACRO_INSTRUCTIONS =
      "bplt",
      "bplteq",
      "addp",
+     "mulp",
      "andp",
      "orp",
      "subp",
diff --git a/Source/JavaScriptCore/offlineasm/offsets.rb b/Source/JavaScriptCore/offlineasm/offsets.rb
index 21e1706d2..63af014bb 100644
--- a/Source/JavaScriptCore/offlineasm/offsets.rb
+++ b/Source/JavaScriptCore/offlineasm/offsets.rb
@@ -27,6 +27,16 @@ OFFSET_HEADER_MAGIC_NUMBERS = [ 0x9e43fd66, 0x4379bfba ]
 OFFSET_MAGIC_NUMBERS = [ 0xec577ac7, 0x0ff5e755 ]
 
 #
+# MissingMagicValuesException
+#
+# Thrown when magic values are missing from the binary.
+# This is usually an indication that the classic interpreter is enabled.
+#
+
+class MissingMagicValuesException < Exception
+end
+
+#
 # offsetsList(ast)
 # sizesList(ast)
 #
@@ -142,7 +152,7 @@ def offsetsAndConfigurationIndex(file)
         end
     }
     
-    raise unless result.length >= 1
+    raise MissingMagicValuesException unless result.length >= 1
     raise if result.map{|v| v[1]}.uniq.size < result.map{|v| v[1]}.size
     
     result
diff --git a/Source/JavaScriptCore/offlineasm/parser.rb b/Source/JavaScriptCore/offlineasm/parser.rb
index f0e4b0045..11863c724 100644
--- a/Source/JavaScriptCore/offlineasm/parser.rb
+++ b/Source/JavaScriptCore/offlineasm/parser.rb
@@ -23,7 +23,22 @@
 
 require "ast"
 require "instructions"
+require "pathname"
 require "registers"
+require "self_hash"
+
+class CodeOrigin
+    attr_reader :fileName, :lineNumber
+    
+    def initialize(fileName, lineNumber)
+        @fileName = fileName
+        @lineNumber = lineNumber
+    end
+    
+    def to_s
+        "#{fileName}:#{lineNumber}"
+    end
+end
 
 class Token
     attr_reader :codeOrigin, :string
@@ -46,7 +61,7 @@ class Token
     end
     
     def to_s
-        "#{@string.inspect} at line #{codeOrigin}"
+        "#{@string.inspect} at #{codeOrigin}"
     end
     
     def parseError(*comment)
@@ -62,7 +77,8 @@ end
 # The lexer. Takes a string and returns an array of tokens.
 #
 
-def lex(str)
+def lex(str, fileName)
+    fileName = Pathname.new(fileName)
     result = []
     lineNumber = 1
     while not str.empty?
@@ -70,28 +86,28 @@ def lex(str)
         when /\A\#([^\n]*)/
             # comment, ignore
         when /\A\n/
-            result << Token.new(lineNumber, $&)
+            result << Token.new(CodeOrigin.new(fileName, lineNumber), $&)
             lineNumber += 1
         when /\A[a-zA-Z]([a-zA-Z0-9_]*)/
-            result << Token.new(lineNumber, $&)
+            result << Token.new(CodeOrigin.new(fileName, lineNumber), $&)
         when /\A\.([a-zA-Z0-9_]*)/
-            result << Token.new(lineNumber, $&)
+            result << Token.new(CodeOrigin.new(fileName, lineNumber), $&)
         when /\A_([a-zA-Z0-9_]*)/
-            result << Token.new(lineNumber, $&)
+            result << Token.new(CodeOrigin.new(fileName, lineNumber), $&)
         when /\A([ \t]+)/
             # whitespace, ignore
         when /\A0x([0-9a-fA-F]+)/
-            result << Token.new(lineNumber, $&.hex.to_s)
+            result << Token.new(CodeOrigin.new(fileName, lineNumber), $&.hex.to_s)
         when /\A0([0-7]+)/
-            result << Token.new(lineNumber, $&.oct.to_s)
+            result << Token.new(CodeOrigin.new(fileName, lineNumber), $&.oct.to_s)
         when /\A([0-9]+)/
-            result << Token.new(lineNumber, $&)
+            result << Token.new(CodeOrigin.new(fileName, lineNumber), $&)
         when /\A::/
-            result << Token.new(lineNumber, $&)
-        when /\A[:,\(\)\[\]=\+\-*]/
-            result << Token.new(lineNumber, $&)
+            result << Token.new(CodeOrigin.new(fileName, lineNumber), $&)
+        when /\A[:,\(\)\[\]=\+\-~\|&^*]/
+            result << Token.new(CodeOrigin.new(fileName, lineNumber), $&)
         else
-            raise "Lexer error at line number #{lineNumber}, unexpected sequence #{str[0..20].inspect}"
+            raise "Lexer error at #{CodeOrigin.new(fileName, lineNumber).to_s}, unexpected sequence #{str[0..20].inspect}"
         end
         str = $~.post_match
     end
@@ -111,7 +127,7 @@ def isInstruction(token)
 end
 
 def isKeyword(token)
-    token =~ /\A((true)|(false)|(if)|(then)|(else)|(elsif)|(end)|(and)|(or)|(not)|(macro)|(const)|(sizeof)|(error))\Z/ or
+    token =~ /\A((true)|(false)|(if)|(then)|(else)|(elsif)|(end)|(and)|(or)|(not)|(macro)|(const)|(sizeof)|(error)|(include))\Z/ or
         token =~ REGISTER_PATTERN or
         token =~ INSTRUCTION_PATTERN
 end
@@ -142,8 +158,8 @@ end
 #
 
 class Parser
-    def initialize(tokens)
-        @tokens = tokens
+    def initialize(data, fileName)
+        @tokens = lex(data, fileName)
         @idx = 0
     end
     
@@ -306,6 +322,9 @@ class Parser
         if @tokens[@idx] == "-"
             @idx += 1
             NegImmediate.new(@tokens[@idx - 1].codeOrigin, parseExpressionAtom)
+        elsif @tokens[@idx] == "~"
+            @idx += 1
+            BitnotImmediate.new(@tokens[@idx - 1].codeOrigin, parseExpressionAtom)
         elsif @tokens[@idx] == "("
             @idx += 1
             result = parseExpression
@@ -349,10 +368,10 @@ class Parser
     end
     
     def couldBeExpression
-        @tokens[@idx] == "-" or @tokens[@idx] == "sizeof" or isInteger(@tokens[@idx]) or isVariable(@tokens[@idx]) or @tokens[@idx] == "("
+        @tokens[@idx] == "-" or @tokens[@idx] == "~" or @tokens[@idx] == "sizeof" or isInteger(@tokens[@idx]) or isVariable(@tokens[@idx]) or @tokens[@idx] == "("
     end
     
-    def parseExpression
+    def parseExpressionAdd
         skipNewLine
         result = parseExpressionMul
         while @tokens[@idx] == "+" or @tokens[@idx] == "-"
@@ -369,6 +388,33 @@ class Parser
         result
     end
     
+    def parseExpressionAnd
+        skipNewLine
+        result = parseExpressionAdd
+        while @tokens[@idx] == "&"
+            @idx += 1
+            result = AndImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionAdd)
+        end
+        result
+    end
+    
+    def parseExpression
+        skipNewLine
+        result = parseExpressionAnd
+        while @tokens[@idx] == "|" or @tokens[@idx] == "^"
+            if @tokens[@idx] == "|"
+                @idx += 1
+                result = OrImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionAnd)
+            elsif @tokens[@idx] == "^"
+                @idx += 1
+                result = XorImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionAnd)
+            else
+                raise
+            end
+        end
+        result
+    end
+    
     def parseOperand(comment)
         skipNewLine
         if couldBeExpression
@@ -571,6 +617,14 @@ class Parser
                     list << LocalLabel.forName(codeOrigin, name)
                 end
                 @idx += 1
+            elsif @tokens[@idx] == "include"
+                @idx += 1
+                parseError unless isIdentifier(@tokens[@idx])
+                moduleName = @tokens[@idx].string
+                fileName = @tokens[@idx].codeOrigin.fileName.dirname + (moduleName + ".asm")
+                @idx += 1
+                $stderr.puts "offlineasm: Including file #{fileName}"
+                list << parse(fileName)
             else
                 parseError "Expecting terminal #{final} #{comment}"
             end
@@ -579,8 +633,16 @@ class Parser
     end
 end
 
-def parse(tokens)
-    parser = Parser.new(tokens)
+def parseData(data, fileName)
+    parser = Parser.new(data, fileName)
     parser.parseSequence(nil, "")
 end
 
+def parse(fileName)
+    parseData(IO::read(fileName), fileName)
+end
+
+def parseHash(fileName)
+    dirHash(Pathname.new(fileName).dirname, /\.asm$/)
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/registers.rb b/Source/JavaScriptCore/offlineasm/registers.rb
index 75fae4192..2c5a4ebf6 100644
--- a/Source/JavaScriptCore/offlineasm/registers.rb
+++ b/Source/JavaScriptCore/offlineasm/registers.rb
@@ -34,7 +34,13 @@ GPRS =
      "r0",
      "r1",
      "sp",
-     "lr"
+     "lr",
+     
+     # 64-bit only registers:
+     "t5",
+     "t6",  # r10
+     "csr1",  # r14, tag type number register
+     "csr2"   # r15, tag mask register
     ]
 
 FPRS =
diff --git a/Source/JavaScriptCore/offlineasm/self_hash.rb b/Source/JavaScriptCore/offlineasm/self_hash.rb
index a7b51e112..2c300fccc 100644
--- a/Source/JavaScriptCore/offlineasm/self_hash.rb
+++ b/Source/JavaScriptCore/offlineasm/self_hash.rb
@@ -25,22 +25,33 @@ require "digest/sha1"
 require "pathname"
 
 #
-# selfHash -> SHA1 hexdigest
+# dirHash(directory, regexp) -> SHA1 hexdigest
 #
-# Returns a hash of the offlineasm source code. This allows dependency
-# tracking for not just changes in input, but also changes in the assembler
-# itself.
+# Returns a hash of all files in the given directory that fit the given
+# pattern.
 #
 
-def selfHash
+def dirHash(directory, regexp)
+    directory = Pathname.new(directory)
     contents = ""
-    myPath = Pathname.new(__FILE__).dirname
-    Dir.foreach(myPath) {
+    Dir.foreach(directory) {
         | entry |
-        if entry =~ /\.rb$/
-            contents += IO::read(myPath + entry)
+        if entry =~ regexp
+            contents += IO::read(directory + entry)
         end
     }
     return Digest::SHA1.hexdigest(contents)
 end
 
+#
+# selfHash -> SHA1 hexdigest
+#
+# Returns a hash of the offlineasm source code. This allows dependency
+# tracking for not just changes in input, but also changes in the assembler
+# itself.
+#
+
+def selfHash
+    dirHash(Pathname.new(__FILE__).dirname, /\.rb$/)
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/settings.rb b/Source/JavaScriptCore/offlineasm/settings.rb
index 34598181c..b7daa7492 100644
--- a/Source/JavaScriptCore/offlineasm/settings.rb
+++ b/Source/JavaScriptCore/offlineasm/settings.rb
@@ -53,7 +53,7 @@ def computeSettingsCombinations(ast)
         settingsCombinator(settingsCombinations, newMap, remaining[1..-1])
     end
     
-    settingsCombinator(settingsCombinations, {}, (ast.filter(Setting).uniq.collect{|v| v.name} + ["X86", "ARMv7"]).uniq)
+    settingsCombinator(settingsCombinations, {}, (ast.filter(Setting).uniq.collect{|v| v.name} + BACKENDS).uniq)
     
     settingsCombinations
 end
diff --git a/Source/JavaScriptCore/offlineasm/transform.rb b/Source/JavaScriptCore/offlineasm/transform.rb
index 5f5024d9e..86c72be67 100644
--- a/Source/JavaScriptCore/offlineasm/transform.rb
+++ b/Source/JavaScriptCore/offlineasm/transform.rb
@@ -328,6 +328,44 @@ class NegImmediate
     end
 end
 
+class OrImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value | @right.value)
+    end
+end
+
+class AndImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value & @right.value)
+    end
+end
+
+class XorImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value ^ @right.value)
+    end
+end
+
+class BitnotImmediate
+    def fold
+        @child = @child.fold
+        return self unless @child.is_a? Immediate
+        Immediate.new(codeOrigin, ~@child.value)
+    end
+end
+
 #
 # node.resolveAfterSettings(offsets, sizes)
 #
@@ -340,3 +378,97 @@ class Node
     end
 end
 
+#
+# node.validate
+#
+# Checks that the node is ready for backend compilation.
+#
+
+class Node
+    def validate
+        raise "Unresolved #{dump} at #{codeOriginString}"
+    end
+    
+    def validateChildren
+        children.each {
+            | node |
+            node.validate
+        }
+    end
+end
+
+class Sequence
+    def validate
+        validateChildren
+    end
+end
+
+class Immediate
+    def validate
+    end
+end
+
+class RegisterID
+    def validate
+    end
+end
+
+class FPRegisterID
+    def validate
+    end
+end
+
+class Address
+    def validate
+        validateChildren
+    end
+end
+
+class BaseIndex
+    def validate
+        validateChildren
+    end
+end
+
+class AbsoluteAddress
+    def validate
+        validateChildren
+    end
+end
+
+class Instruction
+    def validate
+        validateChildren
+    end
+end
+
+class Error
+    def validate
+    end
+end
+
+class Label
+    def validate
+    end
+end
+
+class LocalLabel
+    def validate
+    end
+end
+
+class LabelReference
+    def validate
+    end
+end
+
+class LocalLabelReference
+    def validate
+    end
+end
+
+class Skip
+    def validate
+    end
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/x86.rb b/Source/JavaScriptCore/offlineasm/x86.rb
index b89f2d90c..4416ec909 100644
--- a/Source/JavaScriptCore/offlineasm/x86.rb
+++ b/Source/JavaScriptCore/offlineasm/x86.rb
@@ -1,4 +1,4 @@
-# Copyright (C) 2011 Apple Inc. All rights reserved.
+# Copyright (C) 2012 Apple Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -21,13 +21,48 @@
 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 # THE POSSIBILITY OF SUCH DAMAGE.
 
+def isX64
+    case $activeBackend
+    when "X86"
+        false
+    when "X86_64"
+        true
+    else
+        raise "bad value for $activeBackend: #{$activeBackend}"
+    end
+end
+
+class SpecialRegister < NoChildren
+    def x86Operand(kind)
+        raise unless @name =~ /^r/
+        raise unless isX64
+        case kind
+        when :half
+            "%" + @name + "w"
+        when :int
+            "%" + @name + "d"
+        when :ptr
+            "%" + @name
+        else
+            raise
+        end
+    end
+    def x86CallOperand(kind)
+        "*#{x86Operand(kind)}"
+    end
+end
+
+X64_SCRATCH_REGISTER = SpecialRegister.new("r11")
+
 class RegisterID
     def supports8BitOnX86
         case name
         when "t0", "a0", "r0", "t1", "a1", "r1", "t2", "t3"
             true
-        when "t4", "cfr"
+        when "cfr", "ttnr", "tmr"
             false
+        when "t4", "t5"
+            isX64
         else
             raise
         end
@@ -43,6 +78,8 @@ class RegisterID
                 "%ax"
             when :int
                 "%eax"
+            when :ptr
+                isX64 ? "%rax" : "%eax"
             else
                 raise
             end
@@ -54,6 +91,8 @@ class RegisterID
                 "%dx"
             when :int
                 "%edx"
+            when :ptr
+                isX64 ? "%rdx" : "%edx"
             else
                 raise
             end
@@ -65,6 +104,8 @@ class RegisterID
                 "%cx"
             when :int
                 "%ecx"
+            when :ptr
+                isX64 ? "%rcx" : "%ecx"
             else
                 raise
             end
@@ -76,6 +117,8 @@ class RegisterID
                 "%bx"
             when :int
                 "%ebx"
+            when :ptr
+                isX64 ? "%rbx" : "%ebx"
             else
                 raise
             end
@@ -87,19 +130,36 @@ class RegisterID
                 "%si"
             when :int
                 "%esi"
+            when :ptr
+                isX64 ? "%rsi" : "%esi"
             else
                 raise
             end
         when "cfr"
-            case kind
-            when :byte
-                "%dil"
-            when :half
-                "%di"
-            when :int
-                "%edi"
+            if isX64
+                case kind
+                when :half
+                    "%r13w"
+                when :int
+                    "%r13d"
+                when :ptr
+                    "%r13"
+                else
+                    raise
+                end
             else
-                raise
+                case kind
+                when :byte
+                    "%dil"
+                when :half
+                    "%di"
+                when :int
+                    "%edi"
+                when :ptr
+                    "%edi"
+                else
+                    raise
+                end
             end
         when "sp"
             case kind
@@ -109,9 +169,53 @@ class RegisterID
                 "%sp"
             when :int
                 "%esp"
+            when :ptr
+                isX64 ? "%rsp" : "%esp"
             else
                 raise
             end
+        when "t5"
+            raise "Cannot use #{name} in 32-bit X86 at #{codeOriginString}" unless isX64
+            case kind
+            when :byte
+                "%dil"
+            when :half
+                "%di"
+            when :int
+                "%edi"
+            when :ptr
+                "%rdi"
+            end
+        when "t6"
+            raise "Cannot use #{name} in 32-bit X86 at #{codeOriginString}" unless isX64
+            case kind
+            when :half
+                "%r10w"
+            when :int
+                "%r10d"
+            when :ptr
+                "%r10"
+            end
+        when "csr1"
+            raise "Cannot use #{name} in 32-bit X86 at #{codeOriginString}" unless isX64
+            case kind
+            when :half
+                "%r14w"
+            when :int
+                "%r14d"
+            when :ptr
+                "%r14"
+            end
+        when "csr2"
+            raise "Cannot use #{name} in 32-bit X86 at #{codeOriginString}" unless isX64
+            case kind
+            when :half
+                "%r15w"
+            when :int
+                "%r15d"
+            when :ptr
+                "%r15"
+            end
         else
             raise "Bad register #{name} for X86 at #{codeOriginString}"
         end
@@ -147,6 +251,13 @@ class FPRegisterID
 end
 
 class Immediate
+    def validX86Immediate?
+        if isX64
+            value >= -0x80000000 and value <= 0x7fffffff
+        else
+            true
+        end
+    end
     def x86Operand(kind)
         "$#{value}"
     end
@@ -160,8 +271,11 @@ class Address
         true
     end
     
+    def x86AddressOperand(addressKind)
+        "#{offset.value}(#{base.x86Operand(addressKind)})"
+    end
     def x86Operand(kind)
-        "#{offset.value}(#{base.x86Operand(:int)})"
+        x86AddressOperand(:ptr)
     end
     def x86CallOperand(kind)
         "*#{x86Operand(kind)}"
@@ -173,12 +287,16 @@ class BaseIndex
         true
     end
     
+    def x86AddressOperand(addressKind)
+        "#{offset.value}(#{base.x86Operand(addressKind)}, #{index.x86Operand(addressKind)}, #{scale})"
+    end
+    
     def x86Operand(kind)
-        "#{offset.value}(#{base.x86Operand(:int)}, #{index.x86Operand(:int)}, #{scale})"
+        x86AddressOperand(:ptr)
     end
 
     def x86CallOperand(kind)
-        "*#{x86operand(kind)}"
+        "*#{x86Operand(kind)}"
     end
 end
 
@@ -187,6 +305,10 @@ class AbsoluteAddress
         true
     end
     
+    def x86AddressOperand(addressKind)
+        "#{address.value}"
+    end
+    
     def x86Operand(kind)
         "#{address.value}"
     end
@@ -208,6 +330,47 @@ class LocalLabelReference
     end
 end
 
+class Sequence
+    def getModifiedListX86_64
+        newList = []
+        
+        @list.each {
+            | node |
+            newNode = node
+            if node.is_a? Instruction
+                unless node.opcode == "move"
+                    usedScratch = false
+                    newOperands = node.operands.map {
+                        | operand |
+                        if operand.immediate? and not operand.validX86Immediate?
+                            if usedScratch
+                                raise "Attempt to use scratch register twice at #{operand.codeOriginString}"
+                            end
+                            newList << Instruction.new(operand.codeOrigin, "move", [operand, X64_SCRATCH_REGISTER])
+                            usedScratch = true
+                            X64_SCRATCH_REGISTER
+                        else
+                            operand
+                        end
+                    }
+                    newNode = Instruction.new(node.codeOrigin, node.opcode, newOperands)
+                end
+            else
+                unless node.is_a? Label or
+                        node.is_a? LocalLabel or
+                        node.is_a? Skip
+                    raise "Unexpected #{node.inspect} at #{node.codeOrigin}" 
+                end
+            end
+            if newNode
+                newList << newNode
+            end
+        }
+        
+        return newList
+    end
+end
+
 class Instruction
     def x86Operands(*kinds)
         raise unless kinds.size == operands.size
@@ -227,6 +390,8 @@ class Instruction
             "w"
         when :int
             "l"
+        when :ptr
+            isX64 ? "q" : "l"
         when :double
             "sd"
         else
@@ -234,6 +399,23 @@ class Instruction
         end
     end
     
+    def x86Bytes(kind)
+        case kind
+        when :byte
+            1
+        when :half
+            2
+        when :int
+            4
+        when :ptr
+            isX64 ? 8 : 4
+        when :double
+            8
+        else
+            raise
+        end
+    end
+    
     def handleX86OpWithNumOperands(opcode, kind, numOperands)
         if numOperands == 3
             if operands[0] == operands[2]
@@ -257,9 +439,10 @@ class Instruction
         if operands[0].is_a? Immediate or operands[0] == RegisterID.forName(nil, "t2")
             $asm.puts "#{opcode} #{operands[0].x86Operand(:byte)}, #{operands[1].x86Operand(kind)}"
         else
-            $asm.puts "xchgl #{operands[0].x86Operand(:int)}, %ecx"
+            cx = RegisterID.forName(nil, "t2")
+            $asm.puts "xchg#{x86Suffix(:ptr)} #{operands[0].x86Operand(:ptr)}, #{cx.x86Operand(:ptr)}"
             $asm.puts "#{opcode} %cl, #{operands[1].x86Operand(kind)}"
-            $asm.puts "xchgl #{operands[0].x86Operand(:int)}, %ecx"
+            $asm.puts "xchg#{x86Suffix(:ptr)} #{operands[0].x86Operand(:ptr)}, #{cx.x86Operand(:ptr)}"
         end
     end
     
@@ -295,10 +478,11 @@ class Instruction
             $asm.puts "#{setOpcode} #{operand.x86Operand(:byte)}"
             $asm.puts "movzbl #{operand.x86Operand(:byte)}, #{operand.x86Operand(:int)}"
         else
-            $asm.puts "xchgl #{operand.x86Operand(:int)}, %eax"
+            ax = RegisterID.new(nil, "t0")
+            $asm.puts "xchg#{x86Suffix(:ptr)} #{operand.x86Operand(:ptr)}, #{ax.x86Operand(:ptr)}"
             $asm.puts "#{setOpcode} %al"
             $asm.puts "movzbl %al, %eax"
-            $asm.puts "xchgl #{operand.x86Operand(:int)}, %eax"
+            $asm.puts "xchg#{x86Suffix(:ptr)} #{operand.x86Operand(:ptr)}, #{ax.x86Operand(:ptr)}"
         end
     end
     
@@ -354,8 +538,8 @@ class Instruction
     
     def handleX86SubBranch(branchOpcode, kind)
         if operands.size == 4 and operands[1] == operands[2]
-            $asm.puts "negl #{operands[2].x86Operand(:int)}"
-            $asm.puts "addl #{operands[0].x86Operand(:int)}, #{operands[2].x86Operand(:int)}"
+            $asm.puts "neg#{x86Suffix(kind)} #{operands[2].x86Operand(kind)}"
+            $asm.puts "add#{x86Suffix(kind)} #{operands[0].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
         else
             handleX86OpWithNumOperands("sub#{x86Suffix(kind)}", kind, operands.size - 1)
         end
@@ -370,62 +554,120 @@ class Instruction
         $asm.puts "#{branchOpcode} #{jumpTarget.asmLabel}"
     end
     
-    def lowerX86
-        $asm.comment codeOriginString
-        case opcode
-        when "addi", "addp"
-            if operands.size == 3 and operands[0].is_a? Immediate
-                raise unless operands[1].is_a? RegisterID
-                raise unless operands[2].is_a? RegisterID
-                if operands[0].value == 0
-                    unless operands[1] == operands[2]
-                        $asm.puts "movl #{operands[1].x86Operand(:int)}, #{operands[2].x86Operand(:int)}"
-                    end
-                else
-                    $asm.puts "leal #{operands[0].value}(#{operands[1].x86Operand(:int)}), #{operands[2].x86Operand(:int)}"
+    def handleX86Add(kind)
+        if operands.size == 3 and operands[0].is_a? Immediate
+            raise unless operands[1].is_a? RegisterID
+            raise unless operands[2].is_a? RegisterID
+            if operands[0].value == 0
+                unless operands[1] == operands[2]
+                    $asm.puts "mov#{x86Suffix(kind)} #{operands[1].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
                 end
-            elsif operands.size == 3 and operands[0].is_a? RegisterID
-                raise unless operands[1].is_a? RegisterID
-                raise unless operands[2].is_a? RegisterID
-                $asm.puts "leal (#{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:int)}), #{operands[2].x86Operand(:int)}"
             else
-                unless Immediate.new(nil, 0) == operands[0]
-                    $asm.puts "addl #{x86Operands(:int, :int)}"
-                end
+                $asm.puts "lea#{x86Suffix(kind)} #{operands[0].value}(#{operands[1].x86Operand(kind)}), #{operands[2].x86Operand(kind)}"
             end
-        when "andi", "andp"
+        elsif operands.size == 3 and operands[0].is_a? RegisterID
+            raise unless operands[1].is_a? RegisterID
+            raise unless operands[2].is_a? RegisterID
+            $asm.puts "lea#{x86Suffix(kind)} (#{operands[0].x86Operand(kind)}, #{operands[1].x86Operand(kind)}), #{operands[2].x86Operand(kind)}"
+        else
+            unless Immediate.new(nil, 0) == operands[0]
+                $asm.puts "add#{x86Suffix(kind)} #{x86Operands(kind, kind)}"
+            end
+        end
+    end
+    
+    def handleX86Sub(kind)
+        if operands.size == 3 and operands[1] == operands[2]
+            $asm.puts "neg#{x86Suffix(kind)} #{operands[2].x86Operand(kind)}"
+            $asm.puts "add#{x86Suffix(kind)} #{operands[0].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
+        else
+            handleX86Op("sub#{x86Suffix(kind)}", kind)
+        end
+    end
+    
+    def handleX86Mul(kind)
+        if operands.size == 3 and operands[0].is_a? Immediate
+            $asm.puts "imul#{x86Suffix(kind)} #{x86Operands(kind, kind, kind)}"
+        else
+            # FIXME: could do some peephole in case the left operand is immediate and it's
+            # a power of two.
+            handleX86Op("imul#{x86Suffix(kind)}", kind)
+        end
+    end
+    
+    def handleMove
+        if Immediate.new(nil, 0) == operands[0] and operands[1].is_a? RegisterID
+            $asm.puts "xor#{x86Suffix(:ptr)} #{operands[1].x86Operand(:ptr)}, #{operands[1].x86Operand(:ptr)}"
+        elsif operands[0] != operands[1]
+            $asm.puts "mov#{x86Suffix(:ptr)} #{x86Operands(:ptr, :ptr)}"
+        end
+    end
+    
+    def lowerX86
+        raise unless $activeBackend == "X86"
+        lowerX86Common
+    end
+    
+    def lowerX86_64
+        raise unless $activeBackend == "X86_64"
+        lowerX86Common
+    end
+    
+    def lowerX86Common
+        $asm.comment codeOriginString
+        case opcode
+        when "addi"
+            handleX86Add(:int)
+        when "addp"
+            handleX86Add(:ptr)
+        when "andi"
             handleX86Op("andl", :int)
+        when "andp"
+            handleX86Op("and#{x86Suffix(:ptr)}", :ptr)
         when "lshifti"
             handleX86Shift("sall", :int)
+        when "lshiftp"
+            handleX86Shift("sal#{x86Suffix(:ptr)}", :ptr)
         when "muli"
-            if operands.size == 3 and operands[0].is_a? Immediate
-                $asm.puts "imull #{x86Operands(:int, :int, :int)}"
-            else
-                # FIXME: could do some peephole in case the left operand is immediate and it's
-                # a power of two.
-                handleX86Op("imull", :int)
-            end
+            handleX86Mul(:int)
+        when "mulp"
+            handleX86Mul(:ptr)
         when "negi"
             $asm.puts "negl #{x86Operands(:int)}"
+        when "negp"
+            $asm.puts "neg#{x86Suffix(:ptr)} #{x86Operands(:ptr)}"
         when "noti"
             $asm.puts "notl #{x86Operands(:int)}"
-        when "ori", "orp"
+        when "ori"
             handleX86Op("orl", :int)
+        when "orp"
+            handleX86Op("or#{x86Suffix(:ptr)}", :ptr)
         when "rshifti"
             handleX86Shift("sarl", :int)
+        when "rshiftp"
+            handleX86Shift("sar#{x86Suffix(:ptr)}", :ptr)
         when "urshifti"
             handleX86Shift("shrl", :int)
-        when "subi", "subp"
-            if operands.size == 3 and operands[1] == operands[2]
-                $asm.puts "negl #{operands[2].x86Operand(:int)}"
-                $asm.puts "addl #{operands[0].x86Operand(:int)}, #{operands[2].x86Operand(:int)}"
-            else
-                handleX86Op("subl", :int)
-            end
-        when "xori", "xorp"
+        when "urshiftp"
+            handleX86Shift("shr#{x86Suffix(:ptr)}", :ptr)
+        when "subi"
+            handleX86Sub(:int)
+        when "subp"
+            handleX86Sub(:ptr)
+        when "xori"
             handleX86Op("xorl", :int)
-        when "loadi", "storei", "loadp", "storep"
+        when "xorp"
+            handleX86Op("xor#{x86Suffix(:ptr)}", :ptr)
+        when "loadi", "storei"
             $asm.puts "movl #{x86Operands(:int, :int)}"
+        when "loadis"
+            if isX64
+                $asm.puts "movslq #{x86Operands(:int, :ptr)}"
+            else
+                $asm.puts "movl #{x86Operands(:int, :int)}"
+            end
+        when "loadp", "storep"
+            $asm.puts "mov#{x86Suffix(:ptr)} #{x86Operands(:ptr, :ptr)}"
         when "loadb"
             $asm.puts "movzbl #{operands[0].x86Operand(:byte)}, #{operands[1].x86Operand(:int)}"
         when "loadbs"
@@ -502,37 +744,65 @@ class Instruction
         when "movdz"
             $asm.puts "xorpd #{operands[0].x86Operand(:double)}, #{operands[0].x86Operand(:double)}"
         when "pop"
-            $asm.puts "pop #{operands[0].x86Operand(:int)}"
+            $asm.puts "pop #{operands[0].x86Operand(:ptr)}"
         when "push"
-            $asm.puts "push #{operands[0].x86Operand(:int)}"
-        when "move", "sxi2p", "zxi2p"
-            if Immediate.new(nil, 0) == operands[0] and operands[1].is_a? RegisterID
-                $asm.puts "xorl #{operands[1].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
-            elsif operands[0] != operands[1]
-                $asm.puts "movl #{x86Operands(:int, :int)}"
+            $asm.puts "push #{operands[0].x86Operand(:ptr)}"
+        when "move"
+            handleMove
+        when "sxi2p"
+            if isX64
+                $asm.puts "movslq #{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:ptr)}"
+            else
+                handleMove
+            end
+        when "zxi2p"
+            if isX64
+                $asm.puts "movl #{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
+            else
+                handleMove
             end
         when "nop"
             $asm.puts "nop"
-        when "bieq", "bpeq"
+        when "bieq"
             handleX86IntBranch("je", :int)
-        when "bineq", "bpneq"
+        when "bpeq"
+            handleX86IntBranch("je", :ptr)
+        when "bineq"
             handleX86IntBranch("jne", :int)
-        when "bia", "bpa"
+        when "bpneq"
+            handleX86IntBranch("jne", :ptr)
+        when "bia"
             handleX86IntBranch("ja", :int)
-        when "biaeq", "bpaeq"
+        when "bpa"
+            handleX86IntBranch("ja", :ptr)
+        when "biaeq"
             handleX86IntBranch("jae", :int)
-        when "bib", "bpb"
+        when "bpaeq"
+            handleX86IntBranch("jae", :ptr)
+        when "bib"
             handleX86IntBranch("jb", :int)
-        when "bibeq", "bpbeq"
+        when "bpb"
+            handleX86IntBranch("jb", :ptr)
+        when "bibeq"
             handleX86IntBranch("jbe", :int)
-        when "bigt", "bpgt"
+        when "bpbeq"
+            handleX86IntBranch("jbe", :ptr)
+        when "bigt"
             handleX86IntBranch("jg", :int)
-        when "bigteq", "bpgteq"
+        when "bpgt"
+            handleX86IntBranch("jg", :ptr)
+        when "bigteq"
             handleX86IntBranch("jge", :int)
-        when "bilt", "bplt"
+        when "bpgteq"
+            handleX86IntBranch("jge", :ptr)
+        when "bilt"
             handleX86IntBranch("jl", :int)
-        when "bilteq", "bplteq"
+        when "bplt"
+            handleX86IntBranch("jl", :ptr)
+        when "bilteq"
             handleX86IntBranch("jle", :int)
+        when "bplteq"
+            handleX86IntBranch("jle", :ptr)
         when "bbeq"
             handleX86IntBranch("je", :byte)
         when "bbneq"
@@ -553,14 +823,22 @@ class Instruction
             handleX86IntBranch("jl", :byte)
         when "bblteq"
             handleX86IntBranch("jlteq", :byte)
-        when "btio", "btpo"
+        when "btio"
             handleX86BranchTest("jo", :int)
-        when "btis", "btps"
+        when "btpo"
+            handleX86BranchTest("jo", :ptr)
+        when "btis"
             handleX86BranchTest("js", :int)
-        when "btiz", "btpz"
+        when "btps"
+            handleX86BranchTest("js", :ptr)
+        when "btiz"
             handleX86BranchTest("jz", :int)
-        when "btinz", "btpnz"
+        when "btpz"
+            handleX86BranchTest("jz", :ptr)
+        when "btinz"
             handleX86BranchTest("jnz", :int)
+        when "btpnz"
+            handleX86BranchTest("jnz", :ptr)
         when "btbo"
             handleX86BranchTest("jo", :byte)
         when "btbs"
@@ -570,15 +848,23 @@ class Instruction
         when "btbnz"
             handleX86BranchTest("jnz", :byte)
         when "jmp"
-            $asm.puts "jmp #{operands[0].x86CallOperand(:int)}"
-        when "baddio", "baddpo"
+            $asm.puts "jmp #{operands[0].x86CallOperand(:ptr)}"
+        when "baddio"
             handleX86OpBranch("addl", "jo", :int)
-        when "baddis", "baddps"
+        when "baddpo"
+            handleX86OpBranch("add#{x86Suffix(:ptr)}", "jo", :ptr)
+        when "baddis"
             handleX86OpBranch("addl", "js", :int)
-        when "baddiz", "baddpz"
+        when "baddps"
+            handleX86OpBranch("add#{x86Suffix(:ptr)}", "js", :ptr)
+        when "baddiz"
             handleX86OpBranch("addl", "jz", :int)
-        when "baddinz", "baddpnz"
+        when "baddpz"
+            handleX86OpBranch("add#{x86Suffix(:ptr)}", "jz", :ptr)
+        when "baddinz"
             handleX86OpBranch("addl", "jnz", :int)
+        when "baddpnz"
+            handleX86OpBranch("add#{x86Suffix(:ptr)}", "jnz", :ptr)
         when "bsubio"
             handleX86SubBranch("jo", :int)
         when "bsubis"
@@ -606,29 +892,49 @@ class Instruction
         when "break"
             $asm.puts "int $3"
         when "call"
-            $asm.puts "call #{operands[0].x86CallOperand(:int)}"
+            $asm.puts "call #{operands[0].x86CallOperand(:ptr)}"
         when "ret"
             $asm.puts "ret"
-        when "cieq", "cpeq"
+        when "cieq"
             handleX86IntCompareSet("sete", :int)
-        when "cineq", "cpneq"
+        when "cpeq"
+            handleX86IntCompareSet("sete", :ptr)
+        when "cineq"
             handleX86IntCompareSet("setne", :int)
-        when "cia", "cpa"
+        when "cpneq"
+            handleX86IntCompareSet("setne", :ptr)
+        when "cia"
             handleX86IntCompareSet("seta", :int)
-        when "ciaeq", "cpaeq"
+        when "cpa"
+            handleX86IntCompareSet("seta", :ptr)
+        when "ciaeq"
             handleX86IntCompareSet("setae", :int)
-        when "cib", "cpb"
+        when "cpaeq"
+            handleX86IntCompareSet("setae", :ptr)
+        when "cib"
             handleX86IntCompareSet("setb", :int)
-        when "cibeq", "cpbeq"
+        when "cpb"
+            handleX86IntCompareSet("setb", :ptr)
+        when "cibeq"
             handleX86IntCompareSet("setbe", :int)
-        when "cigt", "cpgt"
+        when "cpbeq"
+            handleX86IntCompareSet("setbe", :ptr)
+        when "cigt"
             handleX86IntCompareSet("setg", :int)
-        when "cigteq", "cpgteq"
+        when "cpgt"
+            handleX86IntCompareSet("setg", :ptr)
+        when "cigteq"
             handleX86IntCompareSet("setge", :int)
-        when "cilt", "cplt"
+        when "cpgteq"
+            handleX86IntCompareSet("setge", :ptr)
+        when "cilt"
             handleX86IntCompareSet("setl", :int)
-        when "cilteq", "cplteq"
+        when "cplt"
+            handleX86IntCompareSet("setl", :ptr)
+        when "cilteq"
             handleX86IntCompareSet("setle", :int)
+        when "cplteq"
+            handleX86IntCompareSet("setle", :ptr)
         when "tio"
             handleX86SetTest("seto", :int)
         when "tis"
@@ -646,9 +952,11 @@ class Instruction
         when "tbnz"
             handleX86SetTest("setnz", :byte)
         when "peek"
-            $asm.puts "movl #{operands[0].value * 4}(%esp), #{operands[1].x86Operand(:int)}"
+            sp = RegisterID.new(nil, "sp")
+            $asm.puts "mov#{x86Suffix(:ptr)} #{operands[0].value * x86Bytes(:ptr)}(#{sp.x86Operand(:ptr)}), #{operands[1].x86Operand(:ptr)}"
         when "poke"
-            $asm.puts "movl #{operands[0].x86Operand(:int)}, #{operands[1].value * 4}(%esp)"
+            sp = RegisterID.new(nil, "sp")
+            $asm.puts "mov#{x86Suffix(:ptr)} #{operands[0].x86Operand(:ptr)}, #{operands[1].value * x86Bytes(:ptr)}(#{sp.x86Operand(:ptr)})"
         when "cdqi"
             $asm.puts "cdq"
         when "idivi"
@@ -663,6 +971,10 @@ class Instruction
             $asm.puts "movsd #{operands[0].x86Operand(:double)}, %xmm7"
             $asm.puts "psrlq $32, %xmm7"
             $asm.puts "movsd %xmm7, #{operands[2].x86Operand(:int)}"
+        when "fp2d"
+            $asm.puts "movd #{operands[0].x86Operand(:ptr)}, #{operands[1].x86Operand(:double)}"
+        when "fd2p"
+            $asm.puts "movd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:ptr)}"
         when "bo"
             $asm.puts "jo #{operands[0].asmLabel}"
         when "bs"
@@ -671,8 +983,10 @@ class Instruction
             $asm.puts "jz #{operands[0].asmLabel}"
         when "bnz"
             $asm.puts "jnz #{operands[0].asmLabel}"
-        when "leai", "leap"
-            $asm.puts "leal #{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
+        when "leai"
+            $asm.puts "leal #{operands[0].x86AddressOperand(:int)}, #{operands[1].x86Operand(:int)}"
+        when "leap"
+            $asm.puts "lea#{x86Suffix(:ptr)} #{operands[0].x86AddressOperand(:ptr)}, #{operands[1].x86Operand(:ptr)}"
         else
             raise "Bad opcode: #{opcode}"
         end
diff --git a/Source/JavaScriptCore/parser/ASTBuilder.h b/Source/JavaScriptCore/parser/ASTBuilder.h
index b8718709b..a173cc10f 100644
--- a/Source/JavaScriptCore/parser/ASTBuilder.h
+++ b/Source/JavaScriptCore/parser/ASTBuilder.h
@@ -77,7 +77,6 @@ public:
         : m_globalData(globalData)
         , m_sourceCode(sourceCode)
         , m_scope(globalData)
-        , m_evalCount(0)
     {
     }
     
@@ -119,7 +118,6 @@ public:
 
     ParserArenaData<DeclarationStacks::VarStack>* varDeclarations() { return m_scope.m_varDeclarations; }
     ParserArenaData<DeclarationStacks::FunctionStack>* funcDeclarations() { return m_scope.m_funcDeclarations; }
-    int features() const { return m_scope.m_features; }
     int numConstants() const { return m_scope.m_numConstants; }
 
     void appendToComma(CommaNode* commaNode, ExpressionNode* expr) { commaNode->append(expr); }
@@ -152,17 +150,8 @@ public:
         incConstants();
         return new (m_globalData) VoidNode(lineNumber, expr);
     }
-    ExpressionNode* thisExpr(int lineNumber)
-    {
-        usesThis();
-        return new (m_globalData) ThisNode(lineNumber);
-    }
-    ExpressionNode* createResolve(int lineNumber, const Identifier* ident, int start)
-    {
-        if (m_globalData->propertyNames->arguments == *ident)
-            usesArguments();
-        return new (m_globalData) ResolveNode(lineNumber, *ident, start);
-    }
+    ExpressionNode* thisExpr(int lineNumber) { return new (m_globalData) ThisNode(lineNumber); }
+    ExpressionNode* createResolve(int lineNumber, const Identifier* ident, int start) { return new (m_globalData) ResolveNode(lineNumber, *ident, start); }
     ExpressionNode* createObjectLiteral(int lineNumber) { return new (m_globalData) ObjectLiteralNode(lineNumber); }
     ExpressionNode* createObjectLiteral(int lineNumber, PropertyListNode* properties) { return new (m_globalData) ObjectLiteralNode(lineNumber, properties); }
 
@@ -263,9 +252,9 @@ public:
         return result;
     }
 
-    FunctionBodyNode* createFunctionBody(int lineNumber, bool inStrictContext)
+    FunctionBodyNode* createFunctionBody(int lineNumber, ScopeFlags scopeFlags)
     {
-        return FunctionBodyNode::create(m_globalData, lineNumber, inStrictContext);
+        return FunctionBodyNode::create(m_globalData, lineNumber, scopeFlags);
     }
     
     template <bool> PropertyNode* createGetterOrSetterProperty(int lineNumber, PropertyNode::Type type, const Identifier* name, ParameterNode* params, FunctionBodyNode* body, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
@@ -276,6 +265,11 @@ public:
         return new (m_globalData) PropertyNode(m_globalData, *name, new (m_globalData) FuncExprNode(lineNumber, m_globalData->propertyNames->nullIdentifier, body, m_sourceCode->subExpression(openBracePos, closeBracePos, bodyStartLine), params), type);
     }
     
+    template <bool> PropertyNode* createGetterOrSetterProperty(JSGlobalData*, int lineNumber, PropertyNode::Type type, double name, ParameterNode* params, FunctionBodyNode* body, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
+    {
+        body->setLoc(bodyStartLine, bodyEndLine);
+        return new (m_globalData) PropertyNode(m_globalData, name, new (m_globalData) FuncExprNode(lineNumber, m_globalData->propertyNames->nullIdentifier, body, m_sourceCode->subExpression(openBracePos, closeBracePos, bodyStartLine), params), type);
+    }
 
     ArgumentsNode* createArguments() { return new (m_globalData) ArgumentsNode(); }
     ArgumentsNode* createArguments(ArgumentListNode* args) { return new (m_globalData) ArgumentsNode(args); }
@@ -307,8 +301,6 @@ public:
     StatementNode* createFuncDeclStatement(int lineNumber, const Identifier* name, FunctionBodyNode* body, ParameterNode* parameters, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
     {
         FuncDeclNode* decl = new (m_globalData) FuncDeclNode(lineNumber, *name, body, m_sourceCode->subExpression(openBracePos, closeBracePos, bodyStartLine), parameters);
-        if (*name == m_globalData->propertyNames->arguments)
-            usesArguments();
         m_scope.m_funcDeclarations->data.append(decl->body());
         body->setLoc(bodyStartLine, bodyEndLine);
         return decl;
@@ -421,8 +413,6 @@ public:
     StatementNode* createTryStatement(int lineNumber, StatementNode* tryBlock, const Identifier* ident, StatementNode* catchBlock, StatementNode* finallyBlock, int startLine, int endLine)
     {
         TryNode* result = new (m_globalData) TryNode(lineNumber, tryBlock, *ident, catchBlock, finallyBlock);
-        if (catchBlock)
-            usesCatch();
         result->setLoc(startLine, endLine);
         return result;
     }
@@ -458,7 +448,6 @@ public:
 
     StatementNode* createWithStatement(int lineNumber, ExpressionNode* expr, StatementNode* statement, int start, int end, int startLine, int endLine)
     {
-        usesWith();
         WithNode* result = new (m_globalData) WithNode(lineNumber, expr, statement, end, end - start);
         result->setLoc(startLine, endLine);
         return result;
@@ -501,8 +490,6 @@ public:
 
     void addVar(const Identifier* ident, int attrs)
     {
-        if (m_globalData->propertyNames->arguments == *ident)
-            usesArguments();
         m_scope.m_varDeclarations->data.append(std::make_pair(ident, attrs));
     }
 
@@ -517,8 +504,6 @@ public:
         return new (m_globalData) CommaNode(lineNumber, list, init);
     }
 
-    int evalCount() const { return m_evalCount; }
-
     void appendBinaryExpressionInfo(int& operandStackDepth, ExpressionNode* current, int exprStart, int lhs, int rhs, bool hasAssignments)
     {
         operandStackDepth++;
@@ -605,13 +590,11 @@ private:
         Scope(JSGlobalData* globalData)
             : m_varDeclarations(new (globalData) ParserArenaData<DeclarationStacks::VarStack>)
             , m_funcDeclarations(new (globalData) ParserArenaData<DeclarationStacks::FunctionStack>)
-            , m_features(0)
             , m_numConstants(0)
         {
         }
         ParserArenaData<DeclarationStacks::VarStack>* m_varDeclarations;
         ParserArenaData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
-        int m_features;
         int m_numConstants;
     };
 
@@ -621,15 +604,6 @@ private:
     }
 
     void incConstants() { m_scope.m_numConstants++; }
-    void usesThis() { m_scope.m_features |= ThisFeature; }
-    void usesCatch() { m_scope.m_features |= CatchFeature; }
-    void usesArguments() { m_scope.m_features |= ArgumentsFeature; }
-    void usesWith() { m_scope.m_features |= WithFeature; }
-    void usesEval() 
-    {
-        m_evalCount++;
-        m_scope.m_features |= EvalFeature;
-    }
     ExpressionNode* createNumber(int lineNumber, double d)
     {
         return new (m_globalData) NumberNode(lineNumber, d);
@@ -642,7 +616,6 @@ private:
     Vector<AssignmentInfo, 10> m_assignmentInfoStack;
     Vector<pair<int, int>, 10> m_binaryOperatorStack;
     Vector<pair<int, int>, 10> m_unaryTokenStack;
-    int m_evalCount;
 };
 
 ExpressionNode* ASTBuilder::makeTypeOfNode(int lineNumber, ExpressionNode* expr)
@@ -792,10 +765,8 @@ ExpressionNode* ASTBuilder::makeFunctionCallNode(int lineNumber, ExpressionNode*
     if (func->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func);
         const Identifier& identifier = resolve->identifier();
-        if (identifier == m_globalData->propertyNames->eval) {
-            usesEval();
+        if (identifier == m_globalData->propertyNames->eval)
             return new (m_globalData) EvalFunctionCallNode(lineNumber, args, divot, divot - start, end - divot);
-        }
         return new (m_globalData) FunctionCallResolveNode(lineNumber, identifier, args, divot, divot - start, end - divot);
     }
     if (func->isBracketAccessorNode()) {
diff --git a/Source/JavaScriptCore/parser/Lexer.cpp b/Source/JavaScriptCore/parser/Lexer.cpp
index 015c1509d..8d50afc54 100644
--- a/Source/JavaScriptCore/parser/Lexer.cpp
+++ b/Source/JavaScriptCore/parser/Lexer.cpp
@@ -31,7 +31,7 @@
 #include "Identifier.h"
 #include "NodeInfo.h"
 #include "Nodes.h"
-#include "dtoa.h"
+#include <wtf/dtoa.h>
 #include <ctype.h>
 #include <limits.h>
 #include <string.h>
@@ -95,8 +95,8 @@ enum CharacterType {
     CharacterWhiteSpace,
 };
 
-// 128 ASCII codes
-static const unsigned short typesOfASCIICharacters[128] = {
+// 256 Latin-1 codes
+static const unsigned short typesOfLatin1Characters[256] = {
 /*   0 - Null               */ CharacterInvalid,
 /*   1 - Start of Heading   */ CharacterInvalid,
 /*   2 - Start of Text      */ CharacterInvalid,
@@ -225,6 +225,134 @@ static const unsigned short typesOfASCIICharacters[128] = {
 /* 125 - }                  */ CharacterCloseBrace,
 /* 126 - ~                  */ CharacterTilde,
 /* 127 - Delete             */ CharacterInvalid,
+/* 128 - Cc category        */ CharacterInvalid,
+/* 129 - Cc category        */ CharacterInvalid,
+/* 130 - Cc category        */ CharacterInvalid,
+/* 131 - Cc category        */ CharacterInvalid,
+/* 132 - Cc category        */ CharacterInvalid,
+/* 133 - Cc category        */ CharacterInvalid,
+/* 134 - Cc category        */ CharacterInvalid,
+/* 135 - Cc category        */ CharacterInvalid,
+/* 136 - Cc category        */ CharacterInvalid,
+/* 137 - Cc category        */ CharacterInvalid,
+/* 138 - Cc category        */ CharacterInvalid,
+/* 139 - Cc category        */ CharacterInvalid,
+/* 140 - Cc category        */ CharacterInvalid,
+/* 141 - Cc category        */ CharacterInvalid,
+/* 142 - Cc category        */ CharacterInvalid,
+/* 143 - Cc category        */ CharacterInvalid,
+/* 144 - Cc category        */ CharacterInvalid,
+/* 145 - Cc category        */ CharacterInvalid,
+/* 146 - Cc category        */ CharacterInvalid,
+/* 147 - Cc category        */ CharacterInvalid,
+/* 148 - Cc category        */ CharacterInvalid,
+/* 149 - Cc category        */ CharacterInvalid,
+/* 150 - Cc category        */ CharacterInvalid,
+/* 151 - Cc category        */ CharacterInvalid,
+/* 152 - Cc category        */ CharacterInvalid,
+/* 153 - Cc category        */ CharacterInvalid,
+/* 154 - Cc category        */ CharacterInvalid,
+/* 155 - Cc category        */ CharacterInvalid,
+/* 156 - Cc category        */ CharacterInvalid,
+/* 157 - Cc category        */ CharacterInvalid,
+/* 158 - Cc category        */ CharacterInvalid,
+/* 159 - Cc category        */ CharacterInvalid,
+/* 160 - Zs category (nbsp) */ CharacterWhiteSpace,
+/* 161 - Po category        */ CharacterInvalid,
+/* 162 - Sc category        */ CharacterInvalid,
+/* 163 - Sc category        */ CharacterInvalid,
+/* 164 - Sc category        */ CharacterInvalid,
+/* 165 - Sc category        */ CharacterInvalid,
+/* 166 - So category        */ CharacterInvalid,
+/* 167 - So category        */ CharacterInvalid,
+/* 168 - Sk category        */ CharacterInvalid,
+/* 169 - So category        */ CharacterInvalid,
+/* 170 - Ll category        */ CharacterIdentifierStart,
+/* 171 - Pi category        */ CharacterInvalid,
+/* 172 - Sm category        */ CharacterInvalid,
+/* 173 - Cf category        */ CharacterInvalid,
+/* 174 - So category        */ CharacterInvalid,
+/* 175 - Sk category        */ CharacterInvalid,
+/* 176 - So category        */ CharacterInvalid,
+/* 177 - Sm category        */ CharacterInvalid,
+/* 178 - No category        */ CharacterInvalid,
+/* 179 - No category        */ CharacterInvalid,
+/* 180 - Sk category        */ CharacterInvalid,
+/* 181 - Ll category        */ CharacterIdentifierStart,
+/* 182 - So category        */ CharacterInvalid,
+/* 183 - Po category        */ CharacterInvalid,
+/* 184 - Sk category        */ CharacterInvalid,
+/* 185 - No category        */ CharacterInvalid,
+/* 186 - Ll category        */ CharacterIdentifierStart,
+/* 187 - Pf category        */ CharacterInvalid,
+/* 188 - No category        */ CharacterInvalid,
+/* 189 - No category        */ CharacterInvalid,
+/* 190 - No category        */ CharacterInvalid,
+/* 191 - Po category        */ CharacterInvalid,
+/* 192 - Lu category        */ CharacterIdentifierStart,
+/* 193 - Lu category        */ CharacterIdentifierStart,
+/* 194 - Lu category        */ CharacterIdentifierStart,
+/* 195 - Lu category        */ CharacterIdentifierStart,
+/* 196 - Lu category        */ CharacterIdentifierStart,
+/* 197 - Lu category        */ CharacterIdentifierStart,
+/* 198 - Lu category        */ CharacterIdentifierStart,
+/* 199 - Lu category        */ CharacterIdentifierStart,
+/* 200 - Lu category        */ CharacterIdentifierStart,
+/* 201 - Lu category        */ CharacterIdentifierStart,
+/* 202 - Lu category        */ CharacterIdentifierStart,
+/* 203 - Lu category        */ CharacterIdentifierStart,
+/* 204 - Lu category        */ CharacterIdentifierStart,
+/* 205 - Lu category        */ CharacterIdentifierStart,
+/* 206 - Lu category        */ CharacterIdentifierStart,
+/* 207 - Lu category        */ CharacterIdentifierStart,
+/* 208 - Lu category        */ CharacterIdentifierStart,
+/* 209 - Lu category        */ CharacterIdentifierStart,
+/* 210 - Lu category        */ CharacterIdentifierStart,
+/* 211 - Lu category        */ CharacterIdentifierStart,
+/* 212 - Lu category        */ CharacterIdentifierStart,
+/* 213 - Lu category        */ CharacterIdentifierStart,
+/* 214 - Lu category        */ CharacterIdentifierStart,
+/* 215 - Sm category        */ CharacterInvalid,
+/* 216 - Lu category        */ CharacterIdentifierStart,
+/* 217 - Lu category        */ CharacterIdentifierStart,
+/* 218 - Lu category        */ CharacterIdentifierStart,
+/* 219 - Lu category        */ CharacterIdentifierStart,
+/* 220 - Lu category        */ CharacterIdentifierStart,
+/* 221 - Lu category        */ CharacterIdentifierStart,
+/* 222 - Lu category        */ CharacterIdentifierStart,
+/* 223 - Ll category        */ CharacterIdentifierStart,
+/* 224 - Ll category        */ CharacterIdentifierStart,
+/* 225 - Ll category        */ CharacterIdentifierStart,
+/* 226 - Ll category        */ CharacterIdentifierStart,
+/* 227 - Ll category        */ CharacterIdentifierStart,
+/* 228 - Ll category        */ CharacterIdentifierStart,
+/* 229 - Ll category        */ CharacterIdentifierStart,
+/* 230 - Ll category        */ CharacterIdentifierStart,
+/* 231 - Ll category        */ CharacterIdentifierStart,
+/* 232 - Ll category        */ CharacterIdentifierStart,
+/* 233 - Ll category        */ CharacterIdentifierStart,
+/* 234 - Ll category        */ CharacterIdentifierStart,
+/* 235 - Ll category        */ CharacterIdentifierStart,
+/* 236 - Ll category        */ CharacterIdentifierStart,
+/* 237 - Ll category        */ CharacterIdentifierStart,
+/* 238 - Ll category        */ CharacterIdentifierStart,
+/* 239 - Ll category        */ CharacterIdentifierStart,
+/* 240 - Ll category        */ CharacterIdentifierStart,
+/* 241 - Ll category        */ CharacterIdentifierStart,
+/* 242 - Ll category        */ CharacterIdentifierStart,
+/* 243 - Ll category        */ CharacterIdentifierStart,
+/* 244 - Ll category        */ CharacterIdentifierStart,
+/* 245 - Ll category        */ CharacterIdentifierStart,
+/* 246 - Ll category        */ CharacterIdentifierStart,
+/* 247 - Sm category        */ CharacterInvalid,
+/* 248 - Ll category        */ CharacterIdentifierStart,
+/* 249 - Ll category        */ CharacterIdentifierStart,
+/* 250 - Ll category        */ CharacterIdentifierStart,
+/* 251 - Ll category        */ CharacterIdentifierStart,
+/* 252 - Ll category        */ CharacterIdentifierStart,
+/* 253 - Ll category        */ CharacterIdentifierStart,
+/* 254 - Ll category        */ CharacterIdentifierStart,
+/* 255 - Ll category        */ CharacterIdentifierStart
 };
 
 template <typename T>
@@ -350,7 +478,7 @@ int Lexer<T>::getUnicodeCharacter()
 template <typename T>
 void Lexer<T>::shiftLineTerminator()
 {
-    ASSERT(isLineTerminator(m_current));
+    ASSERT(isLineTerminator(static_cast<T>(m_current)));
 
     int m_prev = m_current;
     shift();
@@ -368,28 +496,48 @@ ALWAYS_INLINE bool Lexer<T>::lastTokenWasRestrKeyword() const
     return m_lastToken == CONTINUE || m_lastToken == BREAK || m_lastToken == RETURN || m_lastToken == THROW;
 }
 
-static NEVER_INLINE bool isNonASCIIIdentStart(int c)
+static NEVER_INLINE bool isNonLatin1IdentStart(int c)
 {
     return category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other);
 }
 
-static inline bool isIdentStart(int c)
+static ALWAYS_INLINE bool isLatin1(LChar)
 {
-    return isASCII(c) ? typesOfASCIICharacters[c] == CharacterIdentifierStart : isNonASCIIIdentStart(c);
+    return true;
+}
+
+static ALWAYS_INLINE bool isLatin1(UChar c)
+{
+    return c < 256;
 }
 
-static NEVER_INLINE bool isNonASCIIIdentPart(int c)
+static inline bool isIdentStart(LChar c)
+{
+    return typesOfLatin1Characters[c] == CharacterIdentifierStart;
+}
+
+static inline bool isIdentStart(UChar c)
+{
+    return isLatin1(c) ? isIdentStart(static_cast<LChar>(c)) : isNonLatin1IdentStart(c);
+}
+
+static NEVER_INLINE bool isNonLatin1IdentPart(int c)
 {
     return (category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other
         | Mark_NonSpacing | Mark_SpacingCombining | Number_DecimalDigit | Punctuation_Connector)) || c == 0x200C || c == 0x200D;
 }
 
-static ALWAYS_INLINE bool isIdentPart(int c)
+static ALWAYS_INLINE bool isIdentPart(LChar c)
 {
     // Character types are divided into two groups depending on whether they can be part of an
     // identifier or not. Those whose type value is less or equal than CharacterNumber can be
     // part of an identifier. (See the CharacterType definition for more details.)
-    return isASCII(c) ? typesOfASCIICharacters[c] <= CharacterNumber : isNonASCIIIdentPart(c);
+    return typesOfLatin1Characters[c] <= CharacterNumber;
+}
+
+static ALWAYS_INLINE bool isIdentPart(UChar c)
+{
+    return isLatin1(c) ? isIdentPart(static_cast<LChar>(c)) : isNonLatin1IdentPart(c);
 }
 
 static inline int singleEscape(int c)
@@ -499,7 +647,7 @@ template <>
 
     const LChar* identifierStart = currentCharacter();
     
-    while (isIdentPart(m_current))
+    while (m_current != -1 && isIdentPart(static_cast<LChar>(m_current)))
         shift();
     
     if (UNLIKELY(m_current == '\\')) {
@@ -550,7 +698,7 @@ template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType Lexer<UChar>::p
 
     UChar orAllChars = 0;
     
-    while (isIdentPart(m_current)) {
+    while (m_current != -1 && isIdentPart(static_cast<UChar>(m_current))) {
         orAllChars |= m_current;
         shift();
     }
@@ -604,7 +752,7 @@ template <bool shouldCreateIdentifier> JSTokenType Lexer<T>::parseIdentifierSlow
     bool bufferRequired = false;
 
     while (true) {
-        if (LIKELY(isIdentPart(m_current))) {
+        if (LIKELY(m_current != -1 && isIdentPart(static_cast<T>(m_current)))) {
             shift();
             continue;
         }
@@ -622,10 +770,11 @@ template <bool shouldCreateIdentifier> JSTokenType Lexer<T>::parseIdentifierSlow
         int character = getUnicodeCharacter();
         if (UNLIKELY(character == -1))
             return ERRORTOK;
-        if (UNLIKELY(m_buffer16.size() ? !isIdentPart(character) : !isIdentStart(character)))
+        UChar ucharacter = static_cast<UChar>(character);
+        if (UNLIKELY(m_buffer16.size() ? !isIdentPart(ucharacter) : !isIdentStart(ucharacter)))
             return ERRORTOK;
         if (shouldCreateIdentifier)
-            record16(character);
+            record16(ucharacter);
         identifierStart = currentCharacter();
     }
 
@@ -692,14 +841,15 @@ template <bool shouldBuildStrings> ALWAYS_INLINE bool Lexer<T>::parseString(JSTo
                 shiftLineTerminator();
             else if (m_current == 'x') {
                 shift();
-                if (isASCIIHexDigit(m_current) && isASCIIHexDigit(peek(1))) {
-                    int prev = m_current;
-                    shift();
-                    if (shouldBuildStrings)
-                        record8(convertHex(prev, m_current));
-                    shift();
-                } else if (shouldBuildStrings)
-                    record8('x');
+                if (!isASCIIHexDigit(m_current) || !isASCIIHexDigit(peek(1))) {
+                    m_lexErrorMessage = "\\x can only be followed by a hex character sequence";
+                    return false;
+                }
+                int prev = m_current;
+                shift();
+                if (shouldBuildStrings)
+                    record8(convertHex(prev, m_current));
+                shift();
             } else {
                 setOffset(startingOffset);
                 setLineNumber(startingLineNumber);
@@ -752,18 +902,19 @@ template <bool shouldBuildStrings> bool Lexer<T>::parseStringSlowCase(JSTokenDat
                 if (shouldBuildStrings)
                     record16(escape);
                 shift();
-            } else if (UNLIKELY(isLineTerminator(m_current)))
+            } else if (UNLIKELY(isLineTerminator(static_cast<T>(m_current))))
                 shiftLineTerminator();
             else if (m_current == 'x') {
                 shift();
-                if (isASCIIHexDigit(m_current) && isASCIIHexDigit(peek(1))) {
-                    int prev = m_current;
-                    shift();
-                    if (shouldBuildStrings)
-                        record16(convertHex(prev, m_current));
-                    shift();
-                } else if (shouldBuildStrings)
-                    record16('x');
+                if (!isASCIIHexDigit(m_current) || !isASCIIHexDigit(peek(1))) {
+                    m_lexErrorMessage = "\\x can only be followed by a hex character sequence";
+                    return false;
+                }
+                int prev = m_current;
+                shift();
+                if (shouldBuildStrings)
+                    record16(convertHex(prev, m_current));
+                shift();
             } else if (m_current == 'u') {
                 shift();
                 int character = getUnicodeCharacter();
@@ -824,7 +975,7 @@ template <bool shouldBuildStrings> bool Lexer<T>::parseStringSlowCase(JSTokenDat
         // as possible, and lets through all common ASCII characters.
         if (UNLIKELY(((static_cast<unsigned>(m_current) - 0xE) & 0x2000))) {
             // New-line or end of input is not allowed
-            if (UNLIKELY(isLineTerminator(m_current)) || UNLIKELY(m_current == -1)) {
+            if (UNLIKELY(m_current == -1) || UNLIKELY(isLineTerminator(static_cast<T>(m_current)))) {
                 m_lexErrorMessage = "Unexpected EOF";
                 return false;
             }
@@ -1004,7 +1155,7 @@ ALWAYS_INLINE bool Lexer<T>::parseMultilineComment()
         if (UNLIKELY(m_current == -1))
             return false;
 
-        if (isLineTerminator(m_current)) {
+        if (isLineTerminator(static_cast<T>(m_current))) {
             shiftLineTerminator();
             m_terminator = true;
         } else
@@ -1033,7 +1184,7 @@ JSTokenType Lexer<T>::lex(JSTokenData* tokenData, JSTokenInfo* tokenInfo, unsign
     m_terminator = false;
 
 start:
-    while (isWhiteSpace(m_current))
+    while (m_current != -1 && isWhiteSpace(static_cast<T>(m_current)))
         shift();
 
     int startOffset = currentOffset();
@@ -1044,11 +1195,11 @@ start:
     m_delimited = false;
 
     CharacterType type;
-    if (LIKELY(isASCII(m_current)))
-        type = static_cast<CharacterType>(typesOfASCIICharacters[m_current]);
-    else if (isNonASCIIIdentStart(m_current))
+    if (LIKELY(isLatin1(static_cast<T>(m_current))))
+        type = static_cast<CharacterType>(typesOfLatin1Characters[m_current]);
+    else if (isNonLatin1IdentStart(m_current))
         type = CharacterIdentifierStart;
-    else if (isLineTerminator(m_current))
+    else if (isLineTerminator(static_cast<T>(m_current)))
         type = CharacterLineTerminator;
     else
         type = CharacterInvalid;
@@ -1335,7 +1486,7 @@ inNumberAfterDecimalPoint:
         }
 
         // No identifiers allowed directly after numeric literal, e.g. "3in" is bad.
-        if (UNLIKELY(isIdentStart(m_current))) {
+        if (UNLIKELY(m_current != -1 && isIdentStart(static_cast<T>(m_current)))) {
             m_lexErrorMessage = "At least one digit must occur after a decimal point";
             goto returnError;
         }
@@ -1355,7 +1506,7 @@ inNumberAfterDecimalPoint:
         token = STRING;
         break;
     case CharacterIdentifierStart:
-        ASSERT(isIdentStart(m_current));
+        ASSERT(isIdentStart(static_cast<T>(m_current)));
         // Fall through into CharacterBackSlash.
     case CharacterBackSlash:
         if (lexerFlags & LexexFlagsDontBuildKeywords)
@@ -1364,7 +1515,7 @@ inNumberAfterDecimalPoint:
             token = parseIdentifier<true>(tokenData, lexerFlags, strictMode);
         break;
     case CharacterLineTerminator:
-        ASSERT(isLineTerminator(m_current));
+        ASSERT(isLineTerminator(static_cast<T>(m_current)));
         shiftLineTerminator();
         m_atLineStart = true;
         m_terminator = true;
@@ -1382,7 +1533,7 @@ inNumberAfterDecimalPoint:
     goto returnToken;
 
 inSingleLineComment:
-    while (!isLineTerminator(m_current)) {
+    while (!isLineTerminator(static_cast<T>(m_current))) {
         if (UNLIKELY(m_current == -1))
             return EOFTOK;
         shift();
@@ -1430,7 +1581,7 @@ bool Lexer<T>::scanRegExp(const Identifier*& pattern, const Identifier*& flags,
     while (true) {
         int current = m_current;
 
-        if (isLineTerminator(current) || current == -1) {
+        if (isLineTerminator(static_cast<T>(current)) || current == -1) {
             m_buffer16.resize(0);
             return false;
         }
@@ -1463,7 +1614,7 @@ bool Lexer<T>::scanRegExp(const Identifier*& pattern, const Identifier*& flags,
     pattern = makeIdentifier(m_buffer16.data(), m_buffer16.size());
     m_buffer16.resize(0);
 
-    while (isIdentPart(m_current)) {
+    while (m_current != -1 && isIdentPart(static_cast<T>(m_current))) {
         record16(m_current);
         shift();
     }
@@ -1483,7 +1634,7 @@ bool Lexer<T>::skipRegExp()
     while (true) {
         int current = m_current;
 
-        if (isLineTerminator(current) || current == -1)
+        if (isLineTerminator(static_cast<T>(current)) || current == -1)
             return false;
 
         shift();
@@ -1509,7 +1660,7 @@ bool Lexer<T>::skipRegExp()
         }
     }
 
-    while (isIdentPart(m_current))
+    while (m_current != -1 && isIdentPart(static_cast<T>(m_current)))
         shift();
 
     return true;
diff --git a/Source/JavaScriptCore/parser/Lexer.h b/Source/JavaScriptCore/parser/Lexer.h
index 6fe0c9a1c..81558fa96 100644
--- a/Source/JavaScriptCore/parser/Lexer.h
+++ b/Source/JavaScriptCore/parser/Lexer.h
@@ -79,8 +79,8 @@ public:
     ~Lexer();
 
     // Character manipulation functions.
-    static bool isWhiteSpace(int character);
-    static bool isLineTerminator(int character);
+    static bool isWhiteSpace(T character);
+    static bool isLineTerminator(T character);
     static unsigned char convertHex(int c1, int c2);
     static UChar convertUnicode(int c1, int c2, int c3, int c4);
 
@@ -191,14 +191,26 @@ private:
     JSGlobalData* m_globalData;
 };
 
-template <typename T>
-ALWAYS_INLINE bool Lexer<T>::isWhiteSpace(int ch)
+template <>
+ALWAYS_INLINE bool Lexer<LChar>::isWhiteSpace(LChar ch)
 {
-    return isASCII(ch) ? (ch == ' ' || ch == '\t' || ch == 0xB || ch == 0xC) : (WTF::Unicode::isSeparatorSpace(ch) || ch == 0xFEFF);
+    return ch == ' ' || ch == '\t' || ch == 0xB || ch == 0xC || ch == 0xA0;
 }
 
-template <typename T>
-ALWAYS_INLINE bool Lexer<T>::isLineTerminator(int ch)
+template <>
+ALWAYS_INLINE bool Lexer<UChar>::isWhiteSpace(UChar ch)
+{
+    return (ch < 256) ? Lexer<LChar>::isWhiteSpace(static_cast<LChar>(ch)) : (WTF::Unicode::isSeparatorSpace(ch) || ch == 0xFEFF);
+}
+
+template <>
+ALWAYS_INLINE bool Lexer<LChar>::isLineTerminator(LChar ch)
+{
+    return ch == '\r' || ch == '\n';
+}
+
+template <>
+ALWAYS_INLINE bool Lexer<UChar>::isLineTerminator(UChar ch)
 {
     return ch == '\r' || ch == '\n' || (ch & ~1) == 0x2028;
 }
diff --git a/Source/JavaScriptCore/parser/NodeConstructors.h b/Source/JavaScriptCore/parser/NodeConstructors.h
index eea3f575c..e496d2342 100644
--- a/Source/JavaScriptCore/parser/NodeConstructors.h
+++ b/Source/JavaScriptCore/parser/NodeConstructors.h
@@ -417,12 +417,13 @@ namespace JSC {
     }
 
     inline NegateNode::NegateNode(int lineNumber, ExpressionNode* expr)
-        : UnaryOpNode(lineNumber, ResultType::numberTypeCanReuse(), expr, op_negate)
+        : UnaryOpNode(lineNumber, ResultType::numberType(), expr, op_negate)
     {
     }
 
     inline BitwiseNotNode::BitwiseNotNode(int lineNumber, ExpressionNode* expr)
-        : UnaryOpNode(lineNumber, ResultType::forBitOp(), expr, op_bitnot)
+        : ExpressionNode(lineNumber, ResultType::forBitOp())
+        , m_expr(expr)
     {
     }
 
@@ -450,18 +451,18 @@ namespace JSC {
     }
 
     inline MultNode::MultNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::numberTypeCanReuse(), expr1, expr2, op_mul, rightHasAssignments)
+        : BinaryOpNode(lineNumber, ResultType::numberType(), expr1, expr2, op_mul, rightHasAssignments)
     {
     }
 
     inline DivNode::DivNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::numberTypeCanReuse(), expr1, expr2, op_div, rightHasAssignments)
+        : BinaryOpNode(lineNumber, ResultType::numberType(), expr1, expr2, op_div, rightHasAssignments)
     {
     }
 
 
     inline ModNode::ModNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::numberTypeCanReuse(), expr1, expr2, op_mod, rightHasAssignments)
+        : BinaryOpNode(lineNumber, ResultType::numberType(), expr1, expr2, op_mod, rightHasAssignments)
     {
     }
 
@@ -471,7 +472,7 @@ namespace JSC {
     }
 
     inline SubNode::SubNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::numberTypeCanReuse(), expr1, expr2, op_sub, rightHasAssignments)
+        : BinaryOpNode(lineNumber, ResultType::numberType(), expr1, expr2, op_sub, rightHasAssignments)
     {
     }
 
@@ -486,7 +487,7 @@ namespace JSC {
     }
 
     inline UnsignedRightShiftNode::UnsignedRightShiftNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-        : BinaryOpNode(lineNumber, ResultType::numberTypeCanReuse(), expr1, expr2, op_urshift, rightHasAssignments)
+        : BinaryOpNode(lineNumber, ResultType::numberType(), expr1, expr2, op_urshift, rightHasAssignments)
     {
     }
 
diff --git a/Source/JavaScriptCore/parser/NodeInfo.h b/Source/JavaScriptCore/parser/NodeInfo.h
index 4853aec42..e0d4ffec4 100644
--- a/Source/JavaScriptCore/parser/NodeInfo.h
+++ b/Source/JavaScriptCore/parser/NodeInfo.h
@@ -26,7 +26,7 @@ namespace JSC {
 
     template <typename T> struct NodeInfo {
         T m_node;
-        CodeFeatures m_features;
+        ScopeFlags m_scopeFlags;
         int m_numConstants;
     };
 
@@ -44,7 +44,7 @@ namespace JSC {
         T m_node;
         ParserArenaData<DeclarationStacks::VarStack>* m_varDeclarations;
         ParserArenaData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
-        CodeFeatures m_features;
+        ScopeFlags m_scopeFlags;
         int m_numConstants;
     };
     
diff --git a/Source/JavaScriptCore/parser/Nodes.cpp b/Source/JavaScriptCore/parser/Nodes.cpp
index 8ad474e54..75c848bce 100644
--- a/Source/JavaScriptCore/parser/Nodes.cpp
+++ b/Source/JavaScriptCore/parser/Nodes.cpp
@@ -73,75 +73,70 @@ StatementNode* SourceElements::singleStatement() const
     return size == 1 ? m_statements[0] : 0;
 }
 
-// -----------------------------ScopeNodeData ---------------------------
-
-ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* statements, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, int numConstants)
-    : m_numConstants(numConstants)
-    , m_statements(statements)
-{
-    m_arena.swap(arena);
-    if (varStack)
-        m_varStack.swap(*varStack);
-    if (funcStack)
-        m_functionStack.swap(*funcStack);
-    m_capturedVariables.swap(capturedVariables);
-}
-
 // ------------------------------ ScopeNode -----------------------------
 
-ScopeNode::ScopeNode(JSGlobalData* globalData, int lineNumber, bool inStrictContext)
+ScopeNode::ScopeNode(JSGlobalData* globalData, int lineNumber, ScopeFlags scopeFlags)
     : StatementNode(lineNumber)
     , ParserArenaRefCounted(globalData)
-    , m_features(inStrictContext ? StrictModeFeature : NoFeatures)
+    , m_scopeFlags(scopeFlags)
+    , m_numConstants(0)
+    , m_statements(0)
 {
 }
 
-ScopeNode::ScopeNode(JSGlobalData* globalData, int lineNumber, const SourceCode& source, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, CodeFeatures features, int numConstants)
+ScopeNode::ScopeNode(JSGlobalData* globalData, int lineNumber, const SourceCode& source, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, ScopeFlags scopeFlags, int numConstants)
     : StatementNode(lineNumber)
     , ParserArenaRefCounted(globalData)
-    , m_data(adoptPtr(new ScopeNodeData(*globalData->parserArena, children, varStack, funcStack, capturedVariables, numConstants)))
-    , m_features(features)
+    , m_scopeFlags(scopeFlags)
     , m_source(source)
+    , m_numConstants(numConstants)
+    , m_statements(children)
 {
+    m_arena.swap(*globalData->parserArena);
+    if (varStack)
+        m_varStack.swap(*varStack);
+    if (funcStack)
+        m_functionStack.swap(*funcStack);
+    m_capturedVariables.swap(capturedVariables);
 }
 
 StatementNode* ScopeNode::singleStatement() const
 {
-    return m_data->m_statements ? m_data->m_statements->singleStatement() : 0;
+    return m_statements ? m_statements->singleStatement() : 0;
 }
 
 // ------------------------------ ProgramNode -----------------------------
 
-inline ProgramNode::ProgramNode(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
-    : ScopeNode(globalData, lineNumber, source, children, varStack, funcStack, capturedVariables, features, numConstants)
+inline ProgramNode::ProgramNode(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, ScopeFlags scopeFlags, int numConstants)
+    : ScopeNode(globalData, lineNumber, source, children, varStack, funcStack, capturedVariables, scopeFlags, numConstants)
 {
 }
 
-PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
+PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, ScopeFlags scopeFlags, int numConstants)
 {
-    RefPtr<ProgramNode> node = new ProgramNode(globalData, lineNumber, children, varStack, funcStack,  capturedVariables, source, features, numConstants);
+    RefPtr<ProgramNode> node = new ProgramNode(globalData, lineNumber, children, varStack, funcStack,  capturedVariables, source, scopeFlags, numConstants);
 
-    ASSERT(node->data()->m_arena.last() == node);
-    node->data()->m_arena.removeLast();
-    ASSERT(!node->data()->m_arena.contains(node.get()));
+    ASSERT(node->m_arena.last() == node);
+    node->m_arena.removeLast();
+    ASSERT(!node->m_arena.contains(node.get()));
 
     return node.release();
 }
 
 // ------------------------------ EvalNode -----------------------------
 
-inline EvalNode::EvalNode(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
-    : ScopeNode(globalData, lineNumber, source, children, varStack, funcStack, capturedVariables, features, numConstants)
+inline EvalNode::EvalNode(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, ScopeFlags scopeFlags, int numConstants)
+    : ScopeNode(globalData, lineNumber, source, children, varStack, funcStack, capturedVariables, scopeFlags, numConstants)
 {
 }
 
-PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
+PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& source, ScopeFlags scopeFlags, int numConstants)
 {
-    RefPtr<EvalNode> node = new EvalNode(globalData, lineNumber, children, varStack, funcStack, capturedVariables, source, features, numConstants);
+    RefPtr<EvalNode> node = new EvalNode(globalData, lineNumber, children, varStack, funcStack, capturedVariables, source, scopeFlags, numConstants);
 
-    ASSERT(node->data()->m_arena.last() == node);
-    node->data()->m_arena.removeLast();
-    ASSERT(!node->data()->m_arena.contains(node.get()));
+    ASSERT(node->m_arena.last() == node);
+    node->m_arena.removeLast();
+    ASSERT(!node->m_arena.contains(node.get()));
 
     return node.release();
 }
@@ -154,13 +149,13 @@ FunctionParameters::FunctionParameters(ParameterNode* firstParameter)
         append(parameter->ident());
 }
 
-inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, int lineNumber, bool inStrictContext)
-    : ScopeNode(globalData, lineNumber, inStrictContext)
+inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, int lineNumber, ScopeFlags scopeFlags)
+    : ScopeNode(globalData, lineNumber, scopeFlags)
 {
 }
 
-inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
-    : ScopeNode(globalData, lineNumber, sourceCode, children, varStack, funcStack, capturedVariables, features, numConstants)
+inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, ScopeFlags scopeFlags, int numConstants)
+    : ScopeNode(globalData, lineNumber, sourceCode, children, varStack, funcStack, capturedVariables, scopeFlags, numConstants)
 {
 }
 
@@ -177,18 +172,18 @@ void FunctionBodyNode::finishParsing(PassRefPtr<FunctionParameters> parameters,
     m_ident = ident;
 }
 
-FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData, int lineNumber, bool inStrictContext)
+FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData, int lineNumber, ScopeFlags scopeFlags)
 {
-    return new FunctionBodyNode(globalData, lineNumber, inStrictContext);
+    return new FunctionBodyNode(globalData, lineNumber, scopeFlags);
 }
 
-PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
+PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData, int lineNumber, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, ScopeFlags scopeFlags, int numConstants)
 {
-    RefPtr<FunctionBodyNode> node = new FunctionBodyNode(globalData, lineNumber, children, varStack, funcStack, capturedVariables, sourceCode, features, numConstants);
+    RefPtr<FunctionBodyNode> node = new FunctionBodyNode(globalData, lineNumber, children, varStack, funcStack, capturedVariables, sourceCode, scopeFlags, numConstants);
 
-    ASSERT(node->data()->m_arena.last() == node);
-    node->data()->m_arena.removeLast();
-    ASSERT(!node->data()->m_arena.contains(node.get()));
+    ASSERT(node->m_arena.last() == node);
+    node->m_arena.removeLast();
+    ASSERT(!node->m_arena.contains(node.get()));
 
     return node.release();
 }
diff --git a/Source/JavaScriptCore/parser/Nodes.h b/Source/JavaScriptCore/parser/Nodes.h
index 0373766b5..f752b91e9 100644
--- a/Source/JavaScriptCore/parser/Nodes.h
+++ b/Source/JavaScriptCore/parser/Nodes.h
@@ -47,19 +47,31 @@ namespace JSC {
     class ScopeChainNode;
     class ScopeNode;
 
-    typedef unsigned CodeFeatures;
-
-    const CodeFeatures NoFeatures = 0;
-    const CodeFeatures EvalFeature = 1 << 0;
-    const CodeFeatures ArgumentsFeature = 1 << 1;
-    const CodeFeatures WithFeature = 1 << 2;
-    const CodeFeatures CatchFeature = 1 << 3;
-    const CodeFeatures ThisFeature = 1 << 4;
-    const CodeFeatures StrictModeFeature = 1 << 5;
-    const CodeFeatures ShadowsArgumentsFeature = 1 << 6;
+    typedef unsigned short ScopeFlags;
+
+    const ScopeFlags NoScopeFlags = 0;
+
+    // Some scope flags propagate down the parse tree from parent scopes, like
+    // strict mode. They are modal to an entire set of nested scopes.
+    const ScopeFlags StrictModeFlag = 1 << 0;
+    const ScopeFlags FunctionModeFlag = 1 << 1;
+    const ScopeFlags AllScopeModeFlags = StrictModeFlag | FunctionModeFlag;
+
+    // Some scope flags refer only to a specific scope, and don't propagate down
+    // or up.
+    const ScopeFlags BlockScopeFlag = 1 << 4;
+    const ScopeFlags AllScopeKindFlags = BlockScopeFlag;
+
+    // Other flags reflect uses within nested scopes, and so propagate up
+    // from the leaves.
+    const ScopeFlags UsesEvalFlag = 1 << 8;
+    const ScopeFlags UsesArgumentsFlag = 1 << 9;
+    const ScopeFlags UsesWithFlag = 1 << 10;
+    const ScopeFlags UsesCatchFlag = 1 << 11;
+    const ScopeFlags UsesThisFlag = 1 << 12;
+    const ScopeFlags ShadowsArgumentsFlag = 1 << 13;
+    const ScopeFlags AllScopeUsesFlags = UsesEvalFlag | UsesArgumentsFlag | UsesWithFlag | UsesCatchFlag | UsesThisFlag | ShadowsArgumentsFlag;
     
-    const CodeFeatures AllFeatures = EvalFeature | ArgumentsFeature | WithFeature | CatchFeature | ThisFeature | StrictModeFeature | ShadowsArgumentsFeature;
-
     enum Operator {
         OpEqual,
         OpPlusEq,
@@ -793,11 +805,20 @@ namespace JSC {
         NegateNode(int, ExpressionNode*);
     };
 
-    class BitwiseNotNode : public UnaryOpNode {
+    class BitwiseNotNode : public ExpressionNode {
     public:
         BitwiseNotNode(int, ExpressionNode*);
-    };
 
+    protected:
+        ExpressionNode* expr() { return m_expr; }
+        const ExpressionNode* expr() const { return m_expr; }
+
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+    };
+ 
     class LogicalNotNode : public UnaryOpNode {
     public:
         LogicalNotNode(int, ExpressionNode*);
@@ -1369,62 +1390,53 @@ namespace JSC {
         ParameterNode* m_next;
     };
 
-    struct ScopeNodeData {
-        WTF_MAKE_FAST_ALLOCATED;
+    class ScopeNode : public StatementNode, public ParserArenaRefCounted {
     public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
 
-        ScopeNodeData(ParserArena&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, int numConstants);
+        ScopeNode(JSGlobalData*, int, ScopeFlags);
+        ScopeNode(JSGlobalData*, int, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, ScopeFlags, int numConstants);
 
-        ParserArena m_arena;
-        VarStack m_varStack;
-        FunctionStack m_functionStack;
-        int m_numConstants;
-        SourceElements* m_statements;
-        IdentifierSet m_capturedVariables;
-    };
+        using ParserArenaRefCounted::operator new;
 
-    class ScopeNode : public StatementNode, public ParserArenaRefCounted {
-    public:
-        typedef DeclarationStacks::VarStack VarStack;
-        typedef DeclarationStacks::FunctionStack FunctionStack;
+        void destroyData()
+        {
+            m_arena.reset();
+            m_varStack.clear();
+            m_functionStack.clear();
+            m_statements = 0;
+            m_capturedVariables.clear();
+        }
 
-        ScopeNode(JSGlobalData*, int, bool inStrictContext);
-        ScopeNode(JSGlobalData*, int, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, CodeFeatures, int numConstants);
+        bool hasCapturedVariables() const { return !!m_capturedVariables.size(); }
+        size_t capturedVariableCount() const { return m_capturedVariables.size(); }
+        bool captures(const Identifier& ident) { return m_capturedVariables.contains(ident.impl()); }
 
-        using ParserArenaRefCounted::operator new;
+        void addScopeFlags(ScopeFlags scopeFlags) { m_scopeFlags |= scopeFlags; }
+        ScopeFlags scopeFlags() const { return m_scopeFlags; }
 
-        ScopeNodeData* data() const { return m_data.get(); }
-        void destroyData() { m_data.clear(); }
+        bool isStrictMode() const { return m_scopeFlags & StrictModeFlag; }
+        bool usesEval() const { return m_scopeFlags & UsesEvalFlag; }
+        bool usesArguments() const { return (m_scopeFlags & UsesArgumentsFlag) && !(m_scopeFlags & ShadowsArgumentsFlag); }
+        void setUsesArguments() { m_scopeFlags |= UsesArgumentsFlag; }
+        bool usesThis() const { return m_scopeFlags & UsesThisFlag; }
+
+        bool needsActivationForMoreThanVariables() const { return m_scopeFlags & (UsesEvalFlag | UsesWithFlag | UsesCatchFlag); }
+        bool needsActivation() const { return hasCapturedVariables() || needsActivationForMoreThanVariables(); }
 
         const SourceCode& source() const { return m_source; }
         const UString& sourceURL() const { return m_source.provider()->url(); }
         intptr_t sourceID() const { return m_source.provider()->asID(); }
 
-        void setFeatures(CodeFeatures features) { m_features = features; }
-        CodeFeatures features() { return m_features; }
-
-        bool usesEval() const { return m_features & EvalFeature; }
-        bool usesArguments() const { return (m_features & ArgumentsFeature) && !(m_features & ShadowsArgumentsFeature); }
-        bool isStrictMode() const { return m_features & StrictModeFeature; }
-        void setUsesArguments() { m_features |= ArgumentsFeature; }
-        bool usesThis() const { return m_features & ThisFeature; }
-        bool needsActivationForMoreThanVariables() const { ASSERT(m_data); return m_features & (EvalFeature | WithFeature | CatchFeature); }
-        bool needsActivation() const { ASSERT(m_data); return (hasCapturedVariables()) || (m_features & (EvalFeature | WithFeature | CatchFeature)); }
-        bool hasCapturedVariables() const { return !!m_data->m_capturedVariables.size(); }
-        size_t capturedVariableCount() const { return m_data->m_capturedVariables.size(); }
-        bool captures(const Identifier& ident) { return m_data->m_capturedVariables.contains(ident.impl()); }
-
-        VarStack& varStack() { ASSERT(m_data); return m_data->m_varStack; }
-        FunctionStack& functionStack() { ASSERT(m_data); return m_data->m_functionStack; }
+        VarStack& varStack() { return m_varStack; }
+        FunctionStack& functionStack() { return m_functionStack; }
 
         int neededConstants()
         {
-            ASSERT(m_data);
             // We may need 2 more constants than the count given by the parser,
             // because of the various uses of jsUndefined() and jsNull().
-            return m_data->m_numConstants + 2;
+            return m_numConstants + 2;
         }
 
         StatementNode* singleStatement() const;
@@ -1433,22 +1445,27 @@ namespace JSC {
 
     protected:
         void setSource(const SourceCode& source) { m_source = source; }
+        ParserArena m_arena;
 
     private:
-        OwnPtr<ScopeNodeData> m_data;
-        CodeFeatures m_features;
+        ScopeFlags m_scopeFlags;
         SourceCode m_source;
+        VarStack m_varStack;
+        FunctionStack m_functionStack;
+        int m_numConstants;
+        SourceElements* m_statements;
+        IdentifierSet m_capturedVariables;
     };
 
     class ProgramNode : public ScopeNode {
     public:
         static const bool isFunctionNode = false;
-        static PassRefPtr<ProgramNode> create(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        static PassRefPtr<ProgramNode> create(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, ScopeFlags, int numConstants);
 
         static const bool scopeIsFunction = false;
 
     private:
-        ProgramNode(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        ProgramNode(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, ScopeFlags, int numConstants);
 
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
@@ -1456,12 +1473,12 @@ namespace JSC {
     class EvalNode : public ScopeNode {
     public:
         static const bool isFunctionNode = false;
-        static PassRefPtr<EvalNode> create(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        static PassRefPtr<EvalNode> create(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, ScopeFlags, int numConstants);
 
         static const bool scopeIsFunction = false;
 
     private:
-        EvalNode(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        EvalNode(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, ScopeFlags, int numConstants);
 
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
@@ -1478,8 +1495,8 @@ namespace JSC {
     class FunctionBodyNode : public ScopeNode {
     public:
         static const bool isFunctionNode = true;
-        static FunctionBodyNode* create(JSGlobalData*, int, bool isStrictMode);
-        static PassRefPtr<FunctionBodyNode> create(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        static FunctionBodyNode* create(JSGlobalData*, int, ScopeFlags);
+        static PassRefPtr<FunctionBodyNode> create(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, ScopeFlags, int numConstants);
 
         FunctionParameters* parameters() const { return m_parameters.get(); }
         size_t parameterCount() const { return m_parameters->size(); }
@@ -1496,8 +1513,8 @@ namespace JSC {
         static const bool scopeIsFunction = true;
 
     private:
-        FunctionBodyNode(JSGlobalData*, int, bool inStrictContext);
-        FunctionBodyNode(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
+        FunctionBodyNode(JSGlobalData*, int, ScopeFlags);
+        FunctionBodyNode(JSGlobalData*, int, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, ScopeFlags, int numConstants);
 
         Identifier m_ident;
         Identifier m_inferredName;
diff --git a/Source/JavaScriptCore/parser/Parser.cpp b/Source/JavaScriptCore/parser/Parser.cpp
index 939d2696c..f58847fd2 100644
--- a/Source/JavaScriptCore/parser/Parser.cpp
+++ b/Source/JavaScriptCore/parser/Parser.cpp
@@ -62,11 +62,12 @@ Parser<LexerType>::Parser(JSGlobalData* globalData, const SourceCode& source, Fu
     m_lexer->setCode(source, m_arena);
 
     m_functionCache = source.provider()->cache();
-    ScopeRef scope = pushScope();
-    if (parserMode == JSParseFunctionCode)
-        scope->setIsFunction();
+    ScopeFlags scopeFlags = NoScopeFlags;
     if (strictness == JSParseStrict)
-        scope->setStrictMode();
+        scopeFlags |= StrictModeFlag;
+    if (parserMode == JSParseFunctionCode)
+        scopeFlags |= FunctionModeFlag;
+    ScopeRef scope = pushScope(scopeFlags);
     if (parameters) {
         for (unsigned i = 0; i < parameters->size(); i++)
             scope->declareParameter(&parameters->at(i));
@@ -96,16 +97,12 @@ UString Parser<LexerType>::parseInner()
 
     IdentifierSet capturedVariables;
     scope->getCapturedVariables(capturedVariables);
-    CodeFeatures features = context.features();
-    if (scope->strictMode())
-        features |= StrictModeFeature;
-    if (scope->shadowsArguments())
-        features |= ShadowsArgumentsFeature;
+    ScopeFlags scopeFlags = scope->modeFlags() | scope->usesFlags();
     unsigned functionCacheSize = m_functionCache ? m_functionCache->byteSize() : 0;
     if (functionCacheSize != oldFunctionCacheSize)
         m_lexer->sourceProvider()->notifyCacheSizeChanged(functionCacheSize - oldFunctionCacheSize);
 
-    didFinishParsing(sourceElements, context.varDeclarations(), context.funcDeclarations(), features,
+    didFinishParsing(sourceElements, context.varDeclarations(), context.funcDeclarations(), scopeFlags,
                      m_lastLine, context.numConstants(), capturedVariables);
 
     return parseError;
@@ -113,13 +110,13 @@ UString Parser<LexerType>::parseInner()
 
 template <typename LexerType>
 void Parser<LexerType>::didFinishParsing(SourceElements* sourceElements, ParserArenaData<DeclarationStacks::VarStack>* varStack, 
-                              ParserArenaData<DeclarationStacks::FunctionStack>* funcStack, CodeFeatures features, int lastLine, int numConstants, IdentifierSet& capturedVars)
+                              ParserArenaData<DeclarationStacks::FunctionStack>* funcStack, ScopeFlags scopeFlags, int lastLine, int numConstants, IdentifierSet& capturedVars)
 {
     m_sourceElements = sourceElements;
     m_varDeclarations = varStack;
     m_funcDeclarations = funcStack;
     m_capturedVariables.swap(capturedVars);
-    m_features = features;
+    m_scopeFlags = scopeFlags;
     m_lastLine = lastLine;
     m_numConstants = numConstants;
 }
@@ -147,7 +144,7 @@ template <SourceElementsMode mode, class TreeBuilder> TreeSourceElements Parser<
             if (directive) {
                 // "use strict" must be the exact literal without escape sequences or line continuation.
                 if (!hasSetStrict && directiveLiteralLength == lengthOfUseStrictLiteral && m_globalData->propertyNames->useStrictIdentifier == *directive) {
-                    setStrictMode();
+                    currentScope()->setFlags(StrictModeFlag);
                     hasSetStrict = true;
                     failIfFalse(isValidStrictMode());
                     m_lexer->setOffset(startOffset);
@@ -255,6 +252,8 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarati
         next();
         bool hasInitializer = match(EQUAL);
         failIfFalseIfStrictWithNameAndMessage(declareVariable(name), "Cannot declare a variable named", name->impl(), "in strict mode.");
+        if (m_globalData->propertyNames->arguments == *name)
+            currentScope()->setFlags(UsesArgumentsFlag);
         context.addVar(name, (hasInitializer || (!m_allowsIn && match(INTOKEN))) ? DeclarationStacks::HasInitializer : 0);
         if (hasInitializer) {
             int varDivot = tokenStart() + 1;
@@ -289,6 +288,8 @@ template <class TreeBuilder> TreeConstDeclList Parser<LexerType>::parseConstDecl
         next();
         bool hasInitializer = match(EQUAL);
         declareVariable(name);
+        if (m_globalData->propertyNames->arguments == *name)
+            currentScope()->setFlags(UsesArgumentsFlag);
         context.addVar(name, DeclarationStacks::IsConstant | (hasInitializer ? DeclarationStacks::HasInitializer : 0));
         TreeExpression initializer = 0;
         if (hasInitializer) {
@@ -511,7 +512,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseWithStatement
 {
     ASSERT(match(WITH));
     failIfTrueWithMessage(strictMode(), "'with' statements are not valid in strict mode");
-    currentScope()->setNeedsFullActivation();
+    currentScope()->setFlags(UsesWithFlag);
     int startLine = tokenLine();
     next();
     consumeOrFail(OPENPAREN);
@@ -526,6 +527,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseWithStatement
     TreeStatement statement = parseStatement(context, unused);
     failIfFalse(statement);
     
+    currentScope()->setFlags(UsesWithFlag);
     return context.createWithStatement(m_lexer->lastLineNumber(), expr, statement, start, end, startLine, endLine);
 }
 
@@ -614,15 +616,15 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseTryStatement(
     int lastLine = m_lastLine;
     
     if (match(CATCH)) {
-        currentScope()->setNeedsFullActivation();
+        currentScope()->setFlags(UsesCatchFlag);
         next();
         consumeOrFail(OPENPAREN);
         matchOrFail(IDENT);
         ident = m_token.m_data.ident;
         next();
-        AutoPopScopeRef catchScope(this, pushScope());
+        AutoPopScopeRef catchScope(this, pushScope(currentScope()->modeFlags()));
         failIfFalseIfStrictWithNameAndMessage(declareVariable(ident), "Cannot declare a variable named", ident->impl(), "in strict mode");
-        catchScope->preventNewDecls();
+        currentScope()->setFlags(BlockScopeFlag | UsesCatchFlag);
         consumeOrFail(CLOSEPAREN);
         matchOrFail(OPENBRACE);
         catchBlock = parseBlockStatement(context);
@@ -759,7 +761,7 @@ template <typename LexerType>
 template <class TreeBuilder> TreeFunctionBody Parser<LexerType>::parseFunctionBody(TreeBuilder& context)
 {
     if (match(CLOSEBRACE))
-        return context.createFunctionBody(m_lexer->lastLineNumber(), strictMode());
+        return context.createFunctionBody(m_lexer->lastLineNumber(), currentScope()->modeFlags());
     DepthManager statementDepth(&m_statementDepth);
     m_statementDepth = 0;
     typename TreeBuilder::FunctionBodyBuilder bodyBuilder(const_cast<JSGlobalData*>(m_globalData), m_lexer.get());
@@ -770,8 +772,7 @@ template <class TreeBuilder> TreeFunctionBody Parser<LexerType>::parseFunctionBo
 template <typename LexerType>
 template <FunctionRequirements requirements, bool nameIsInContainingScope, class TreeBuilder> bool Parser<LexerType>::parseFunctionInfo(TreeBuilder& context, const Identifier*& name, TreeFormalParameterList& parameters, TreeFunctionBody& body, int& openBracePos, int& closeBracePos, int& bodyStartLine)
 {
-    AutoPopScopeRef functionScope(this, pushScope());
-    functionScope->setIsFunction();
+    AutoPopScopeRef functionScope(this, pushScope(currentScope()->modeFlags() | FunctionModeFlag));
     if (match(IDENT)) {
         name = m_token.m_data.ident;
         next();
@@ -793,8 +794,8 @@ template <FunctionRequirements requirements, bool nameIsInContainingScope, class
     // If we know about this function already, we can use the cached info and skip the parser to the end of the function.
     if (const SourceProviderCacheItem* cachedInfo = TreeBuilder::CanUseFunctionCache ? findCachedFunctionInfo(openBracePos) : 0) {
         // If we're in a strict context, the cached function info must say it was strict too.
-        ASSERT(!strictMode() || cachedInfo->strictMode);
-        body = context.createFunctionBody(m_lexer->lastLineNumber(), cachedInfo->strictMode);
+        ASSERT(!strictMode() || (cachedInfo->scopeFlags & StrictModeFlag));
+        body = context.createFunctionBody(m_lexer->lastLineNumber(), cachedInfo->scopeFlags);
         
         functionScope->restoreFunctionInfo(cachedInfo);
         failIfFalse(popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo));
@@ -854,6 +855,8 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseFunctionDecla
     failIfFalse((parseFunctionInfo<FunctionNeedsName, true>(context, name, parameters, body, openBracePos, closeBracePos, bodyStartLine)));
     failIfFalse(name);
     failIfFalseIfStrict(declareVariable(name));
+    if (*name == m_globalData->propertyNames->arguments)
+        currentScope()->setFlags(UsesArgumentsFlag);
     return context.createFuncDeclStatement(m_lexer->lastLineNumber(), name, body, parameters, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
 }
 
@@ -1204,7 +1207,6 @@ template <bool complete, class TreeBuilder> TreeProperty Parser<LexerType>::pars
             return context.template createProperty<complete>(ident, node, PropertyNode::Constant);
         }
         failIfFalse(wasIdent);
-        matchOrFail(IDENT);
         const Identifier* accessorName = 0;
         TreeFormalParameterList parameters = 0;
         TreeFunctionBody body = 0;
@@ -1218,8 +1220,19 @@ template <bool complete, class TreeBuilder> TreeProperty Parser<LexerType>::pars
             type = PropertyNode::Setter;
         else
             fail();
-        failIfFalse((parseFunctionInfo<FunctionNeedsName, false>(context, accessorName, parameters, body, openBracePos, closeBracePos, bodyStartLine)));
-        return context.template createGetterOrSetterProperty<complete>(m_lexer->lastLineNumber(), type, accessorName, parameters, body, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
+        const Identifier* stringPropertyName = 0;
+        double numericPropertyName = 0;
+        if (m_token.m_type == IDENT || m_token.m_type == STRING)
+            stringPropertyName = m_token.m_data.ident;
+        else if (m_token.m_type == NUMBER)
+            numericPropertyName = m_token.m_data.doubleValue;
+        else
+            fail();
+        next();
+        failIfFalse((parseFunctionInfo<FunctionNoRequirements, false>(context, accessorName, parameters, body, openBracePos, closeBracePos, bodyStartLine)));
+        if (stringPropertyName)
+            return context.template createGetterOrSetterProperty<complete>(m_lexer->lastLineNumber(), type, stringPropertyName, parameters, body, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
+        return context.template createGetterOrSetterProperty<complete>(const_cast<JSGlobalData*>(m_globalData), m_lexer->lastLineNumber(), type, numericPropertyName, parameters, body, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
     }
     case NUMBER: {
         double propertyName = m_token.m_data.doubleValue;
@@ -1391,13 +1404,18 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parsePrimaryExpre
     }
     case THISTOKEN: {
         next();
+        currentScope()->setFlags(UsesThisFlag);
         return context.thisExpr(m_lexer->lastLineNumber());
     }
     case IDENT: {
         int start = tokenStart();
         const Identifier* ident = m_token.m_data.ident;
         next();
-        currentScope()->useVariable(ident, m_globalData->propertyNames->eval == *ident);
+        if (m_globalData->propertyNames->eval == *ident)
+            currentScope()->setFlags(UsesEvalFlag);
+        else if (m_globalData->propertyNames->arguments == *ident)
+            currentScope()->setFlags(UsesArgumentsFlag);
+        currentScope()->useVariable(ident);
         m_lastIdentifier = ident;
         return context.createResolve(m_lexer->lastLineNumber(), ident, start);
     }
diff --git a/Source/JavaScriptCore/parser/Parser.h b/Source/JavaScriptCore/parser/Parser.h
index 9b76242d4..7513d1f11 100644
--- a/Source/JavaScriptCore/parser/Parser.h
+++ b/Source/JavaScriptCore/parser/Parser.h
@@ -130,30 +130,19 @@ struct ScopeLabelInfo {
 };
 
 struct Scope {
-    Scope(const JSGlobalData* globalData, bool isFunction, bool strictMode)
+    Scope(const JSGlobalData* globalData, ScopeFlags scopeFlags)
         : m_globalData(globalData)
-        , m_shadowsArguments(false)
-        , m_usesEval(false)
-        , m_needsFullActivation(false)
-        , m_allowsNewDecls(true)
-        , m_strictMode(strictMode)
-        , m_isFunction(isFunction)
-        , m_isFunctionBoundary(false)
+        , m_scopeFlags(scopeFlags)
         , m_isValidStrictMode(true)
         , m_loopDepth(0)
         , m_switchDepth(0)
     {
+        ASSERT(!(scopeFlags & ~AllScopeModeFlags));
     }
 
     Scope(const Scope& rhs)
         : m_globalData(rhs.m_globalData)
-        , m_shadowsArguments(rhs.m_shadowsArguments)
-        , m_usesEval(rhs.m_usesEval)
-        , m_needsFullActivation(rhs.m_needsFullActivation)
-        , m_allowsNewDecls(rhs.m_allowsNewDecls)
-        , m_strictMode(rhs.m_strictMode)
-        , m_isFunction(rhs.m_isFunction)
-        , m_isFunctionBoundary(rhs.m_isFunctionBoundary)
+        , m_scopeFlags(rhs.m_scopeFlags)
         , m_isValidStrictMode(rhs.m_isValidStrictMode)
         , m_loopDepth(rhs.m_loopDepth)
         , m_switchDepth(rhs.m_switchDepth)
@@ -168,6 +157,22 @@ struct Scope {
         }
     }
 
+    ALWAYS_INLINE ScopeFlags scopeFlags() const { return m_scopeFlags; }
+    ALWAYS_INLINE ScopeFlags modeFlags() const { return m_scopeFlags & AllScopeModeFlags; }
+    ALWAYS_INLINE ScopeFlags usesFlags() const { return m_scopeFlags & AllScopeUsesFlags; }
+    ALWAYS_INLINE void setFlags(ScopeFlags scopeFlags) { m_scopeFlags |= scopeFlags; }
+
+    ALWAYS_INLINE bool needsFullActivation() const { return m_scopeFlags & (UsesEvalFlag | UsesWithFlag | UsesCatchFlag); }
+    ALWAYS_INLINE bool strictMode() const { return m_scopeFlags & StrictModeFlag; }
+    ALWAYS_INLINE bool shadowsArguments() const { return m_scopeFlags & ShadowsArgumentsFlag; }
+    ALWAYS_INLINE bool isFunction() const { return m_scopeFlags & FunctionModeFlag; }
+    ALWAYS_INLINE bool isBlockScope() const { return m_scopeFlags & BlockScopeFlag; }
+    ALWAYS_INLINE bool isFunctionBoundary() const { return isFunction() && !isBlockScope(); }
+
+    ALWAYS_INLINE bool allowsNewDecls() const { return !isBlockScope(); }
+
+    ALWAYS_INLINE bool isValidStrictMode() const { return m_isValidStrictMode; }
+
     void startSwitch() { m_switchDepth++; }
     void endSwitch() { m_switchDepth--; }
     void startLoop() { m_loopDepth++; }
@@ -201,14 +206,6 @@ struct Scope {
         return 0;
     }
 
-    void setIsFunction()
-    {
-        m_isFunction = true;
-        m_isFunctionBoundary = true;
-    }
-    bool isFunction() { return m_isFunction; }
-    bool isFunctionBoundary() { return m_isFunctionBoundary; }
-
     bool declareVariable(const Identifier* ident)
     {
         bool isValidStrictMode = m_globalData->propertyNames->eval != *ident && m_globalData->propertyNames->arguments != *ident;
@@ -219,35 +216,28 @@ struct Scope {
 
     void declareWrite(const Identifier* ident)
     {
-        ASSERT(m_strictMode);
+        ASSERT(strictMode());
         m_writtenVariables.add(ident->impl());
     }
 
-    void preventNewDecls() { m_allowsNewDecls = false; }
-    bool allowsNewDecls() const { return m_allowsNewDecls; }
-
     bool declareParameter(const Identifier* ident)
     {
         bool isArguments = m_globalData->propertyNames->arguments == *ident;
         bool isValidStrictMode = m_declaredVariables.add(ident->ustring().impl()).second && m_globalData->propertyNames->eval != *ident && !isArguments;
         m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
         if (isArguments)
-            m_shadowsArguments = true;
+            setFlags(ShadowsArgumentsFlag);
         return isValidStrictMode;
     }
 
-    void useVariable(const Identifier* ident, bool isEval)
+    void useVariable(const Identifier* ident)
     {
-        m_usesEval |= isEval;
         m_usedVariables.add(ident->ustring().impl());
     }
 
-    void setNeedsFullActivation() { m_needsFullActivation = true; }
-
     bool collectFreeVariables(Scope* nestedScope, bool shouldTrackClosedVariables)
     {
-        if (nestedScope->m_usesEval)
-            m_usesEval = true;
+        setFlags(nestedScope->usesFlags());
         IdentifierSet::iterator end = nestedScope->m_usedVariables.end();
         for (IdentifierSet::iterator ptr = nestedScope->m_usedVariables.begin(); ptr != end; ++ptr) {
             if (nestedScope->m_declaredVariables.contains(*ptr))
@@ -279,7 +269,7 @@ struct Scope {
 
     void getCapturedVariables(IdentifierSet& capturedVariables)
     {
-        if (m_needsFullActivation || m_usesEval) {
+        if (needsFullActivation()) {
             capturedVariables.swap(m_declaredVariables);
             return;
         }
@@ -289,11 +279,6 @@ struct Scope {
             capturedVariables.add(*ptr);
         }
     }
-    void setStrictMode() { m_strictMode = true; }
-    bool strictMode() const { return m_strictMode; }
-    bool isValidStrictMode() const { return m_isValidStrictMode; }
-    bool shadowsArguments() const { return m_shadowsArguments; }
-
     void copyCapturedVariablesToVector(const IdentifierSet& capturedVariables, Vector<RefPtr<StringImpl> >& vector)
     {
         IdentifierSet::iterator end = capturedVariables.end();
@@ -307,20 +292,16 @@ struct Scope {
 
     void saveFunctionInfo(SourceProviderCacheItem* info)
     {
-        ASSERT(m_isFunction);
-        info->usesEval = m_usesEval;
-        info->strictMode = m_strictMode;
-        info->needsFullActivation = m_needsFullActivation;
+        ASSERT(isFunction());
+        info->scopeFlags = m_scopeFlags;
         copyCapturedVariablesToVector(m_writtenVariables, info->writtenVariables);
         copyCapturedVariablesToVector(m_usedVariables, info->usedVariables);
     }
 
     void restoreFunctionInfo(const SourceProviderCacheItem* info)
     {
-        ASSERT(m_isFunction);
-        m_usesEval = info->usesEval;
-        m_strictMode = info->strictMode;
-        m_needsFullActivation = info->needsFullActivation;
+        ASSERT(isFunction());
+        m_scopeFlags |= info->scopeFlags;
         unsigned size = info->usedVariables.size();
         for (unsigned i = 0; i < size; ++i)
             m_usedVariables.add(info->usedVariables[i]);
@@ -331,13 +312,7 @@ struct Scope {
 
 private:
     const JSGlobalData* m_globalData;
-    bool m_shadowsArguments : 1;
-    bool m_usesEval : 1;
-    bool m_needsFullActivation : 1;
-    bool m_allowsNewDecls : 1;
-    bool m_strictMode : 1;
-    bool m_isFunction : 1;
-    bool m_isFunctionBoundary : 1;
+    ScopeFlags m_scopeFlags;
     bool m_isValidStrictMode : 1;
     int m_loopDepth;
     int m_switchDepth;
@@ -427,20 +402,14 @@ private:
         Parser* m_parser;
     };
 
-    ScopeRef currentScope()
+    ALWAYS_INLINE ScopeRef currentScope()
     {
         return ScopeRef(&m_scopeStack, m_scopeStack.size() - 1);
     }
     
-    ScopeRef pushScope()
+    ScopeRef pushScope(ScopeFlags scopeFlags)
     {
-        bool isFunction = false;
-        bool isStrict = false;
-        if (!m_scopeStack.isEmpty()) {
-            isStrict = m_scopeStack.last().strictMode();
-            isFunction = m_scopeStack.last().isFunction();
-        }
-        m_scopeStack.append(Scope(m_globalData, isFunction, isStrict));
+        m_scopeStack.append(Scope(m_globalData, scopeFlags));
         return currentScope();
     }
     
@@ -492,7 +461,7 @@ private:
     UString parseInner();
 
     void didFinishParsing(SourceElements*, ParserArenaData<DeclarationStacks::VarStack>*, 
-                          ParserArenaData<DeclarationStacks::FunctionStack>*, CodeFeatures,
+                          ParserArenaData<DeclarationStacks::FunctionStack>*, ScopeFlags,
                           int, int, IdentifierSet&);
 
     // Used to determine type of error to report.
@@ -823,14 +792,13 @@ private:
         m_errorMessage = UString(msg);
     }
     
-    void startLoop() { currentScope()->startLoop(); }
-    void endLoop() { currentScope()->endLoop(); }
-    void startSwitch() { currentScope()->startSwitch(); }
-    void endSwitch() { currentScope()->endSwitch(); }
-    void setStrictMode() { currentScope()->setStrictMode(); }
-    bool strictMode() { return currentScope()->strictMode(); }
-    bool isValidStrictMode() { return currentScope()->isValidStrictMode(); }
-    bool declareParameter(const Identifier* ident) { return currentScope()->declareParameter(ident); }
+    ALWAYS_INLINE void startLoop() { currentScope()->startLoop(); }
+    ALWAYS_INLINE void endLoop() { currentScope()->endLoop(); }
+    ALWAYS_INLINE void startSwitch() { currentScope()->startSwitch(); }
+    ALWAYS_INLINE void endSwitch() { currentScope()->endSwitch(); }
+    ALWAYS_INLINE bool strictMode() { return currentScope()->strictMode(); }
+    ALWAYS_INLINE bool isValidStrictMode() { return currentScope()->isValidStrictMode(); }
+    ALWAYS_INLINE bool declareParameter(const Identifier* ident) { return currentScope()->declareParameter(ident); }
     bool breakIsValid()
     {
         ScopeRef current = currentScope();
@@ -949,7 +917,7 @@ private:
     ParserArenaData<DeclarationStacks::VarStack>* m_varDeclarations;
     ParserArenaData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
     IdentifierSet m_capturedVariables;
-    CodeFeatures m_features;
+    ScopeFlags m_scopeFlags;
     int m_numConstants;
     
     struct DepthManager {
@@ -1010,7 +978,7 @@ PassRefPtr<ParsedNode> Parser<LexerType>::parse(JSGlobalObject* lexicalGlobalObj
                                     m_funcDeclarations ? &m_funcDeclarations->data : 0,
                                     m_capturedVariables,
                                     *m_source,
-                                    m_features,
+                                    m_scopeFlags,
                                     m_numConstants);
         result->setLoc(m_source->firstLine(), m_lastLine);
     } else if (lexicalGlobalObject) {
diff --git a/Source/JavaScriptCore/parser/ParserArena.cpp b/Source/JavaScriptCore/parser/ParserArena.cpp
index 56c58dacf..c53f30753 100644
--- a/Source/JavaScriptCore/parser/ParserArena.cpp
+++ b/Source/JavaScriptCore/parser/ParserArena.cpp
@@ -34,7 +34,6 @@ namespace JSC {
 ParserArena::ParserArena()
     : m_freeableMemory(0)
     , m_freeablePoolEnd(0)
-    , m_identifierArena(adoptPtr(new IdentifierArena))
 {
 }
 
@@ -88,7 +87,8 @@ void ParserArena::reset()
 
     m_freeableMemory = 0;
     m_freeablePoolEnd = 0;
-    m_identifierArena->clear();
+    if (m_identifierArena)
+        m_identifierArena->clear();
     m_freeablePools.clear();
     m_deletableObjects.clear();
     m_refCountedObjects.clear();
@@ -108,7 +108,7 @@ void ParserArena::allocateFreeablePool()
 bool ParserArena::isEmpty() const
 {
     return !m_freeablePoolEnd
-        && m_identifierArena->isEmpty()
+        && (!m_identifierArena || m_identifierArena->isEmpty())
         && m_freeablePools.isEmpty()
         && m_deletableObjects.isEmpty()
         && m_refCountedObjects.isEmpty();
diff --git a/Source/JavaScriptCore/parser/ParserArena.h b/Source/JavaScriptCore/parser/ParserArena.h
index 49f0ab6bf..067b83a26 100644
--- a/Source/JavaScriptCore/parser/ParserArena.h
+++ b/Source/JavaScriptCore/parser/ParserArena.h
@@ -161,7 +161,12 @@ namespace JSC {
         bool isEmpty() const;
         JS_EXPORT_PRIVATE void reset();
 
-        IdentifierArena& identifierArena() { return *m_identifierArena; }
+        IdentifierArena& identifierArena()
+        {
+            if (UNLIKELY (!m_identifierArena))
+                m_identifierArena = adoptPtr(new IdentifierArena);
+            return *m_identifierArena;
+        }
 
     private:
         static const size_t freeablePoolSize = 8000;
diff --git a/Source/JavaScriptCore/parser/ResultType.h b/Source/JavaScriptCore/parser/ResultType.h
index 27b8112a0..8f30e5b64 100644
--- a/Source/JavaScriptCore/parser/ResultType.h
+++ b/Source/JavaScriptCore/parser/ResultType.h
@@ -32,8 +32,7 @@ namespace JSC {
         friend struct OperandTypes;
 
         typedef char Type;
-        static const Type TypeReusable = 1;
-        static const Type TypeInt32    = 2;
+        static const Type TypeInt32 = 1;
         
         static const Type TypeMaybeNumber = 0x04;
         static const Type TypeMaybeString = 0x08;
@@ -48,11 +47,6 @@ namespace JSC {
         {
         }
         
-        bool isReusable()
-        {
-            return m_type & TypeReusable;
-        }
-
         bool isInt32()
         {
             return m_type & TypeInt32;
@@ -93,19 +87,14 @@ namespace JSC {
             return ResultType(TypeMaybeNumber);
         }
         
-        static ResultType numberTypeCanReuse()
-        {
-            return ResultType(TypeReusable | TypeMaybeNumber);
-        }
-        
-        static ResultType numberTypeCanReuseIsInt32()
+        static ResultType numberTypeIsInt32()
         {
-            return ResultType(TypeReusable | TypeInt32 | TypeMaybeNumber);
+            return ResultType(TypeInt32 | TypeMaybeNumber);
         }
         
-        static ResultType stringOrNumberTypeCanReuse()
+        static ResultType stringOrNumberType()
         {
-            return ResultType(TypeReusable | TypeMaybeNumber | TypeMaybeString);
+            return ResultType(TypeMaybeNumber | TypeMaybeString);
         }
         
         static ResultType stringType()
@@ -121,15 +110,15 @@ namespace JSC {
         static ResultType forAdd(ResultType op1, ResultType op2)
         {
             if (op1.definitelyIsNumber() && op2.definitelyIsNumber())
-                return numberTypeCanReuse();
+                return numberType();
             if (op1.definitelyIsString() || op2.definitelyIsString())
                 return stringType();
-            return stringOrNumberTypeCanReuse();
+            return stringOrNumberType();
         }
         
         static ResultType forBitOp()
         {
-            return numberTypeCanReuseIsInt32();
+            return numberTypeIsInt32();
         }
 
     private:
diff --git a/Source/JavaScriptCore/parser/SourceProvider.h b/Source/JavaScriptCore/parser/SourceProvider.h
index dfc8d88e2..f66a921f5 100644
--- a/Source/JavaScriptCore/parser/SourceProvider.h
+++ b/Source/JavaScriptCore/parser/SourceProvider.h
@@ -47,7 +47,7 @@ namespace JSC {
             , m_cache(cache ? cache : new SourceProviderCache)
             , m_cacheOwned(!cache)
         {
-            deprecatedTurnOffVerifier();
+            turnOffVerifier();
         }
         virtual ~SourceProvider()
         {
diff --git a/Source/JavaScriptCore/parser/SourceProviderCacheItem.h b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
index 3662367a0..ad7a759ce 100644
--- a/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
+++ b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
@@ -61,9 +61,7 @@ public:
     
     int closeBraceLine;
     int closeBracePos;
-    bool usesEval;
-    bool strictMode;
-    bool needsFullActivation;
+    unsigned short scopeFlags;
     Vector<RefPtr<StringImpl> > usedVariables;
     Vector<RefPtr<StringImpl> > writtenVariables;
 };
diff --git a/Source/JavaScriptCore/parser/SyntaxChecker.h b/Source/JavaScriptCore/parser/SyntaxChecker.h
index 32cbf7d6c..2acb5097d 100644
--- a/Source/JavaScriptCore/parser/SyntaxChecker.h
+++ b/Source/JavaScriptCore/parser/SyntaxChecker.h
@@ -210,11 +210,16 @@ public:
             return Property(type);
         return Property(name, type);
     }
+    template <bool strict> Property createGetterOrSetterProperty(JSGlobalData* globalData, int, PropertyNode::Type type, double name, int, int, int, int, int, int)
+    {
+        if (!strict)
+            return Property(type);
+        return Property(&globalData->parserArena->identifierArena().makeNumericIdentifier(globalData, name), type);
+    }
 
     void appendStatement(int, int) { }
     void addVar(const Identifier*, bool) { }
     int combineCommaNodes(int, int, int) { return 1; }
-    int evalCount() const { return 0; }
     void appendBinaryExpressionInfo(int& operandStackDepth, int expr, int, int, int, bool)
     {
         if (!m_topBinaryExpr)
diff --git a/Source/JavaScriptCore/runtime/Arguments.cpp b/Source/JavaScriptCore/runtime/Arguments.cpp
index a099adb75..7a53ec1a4 100644
--- a/Source/JavaScriptCore/runtime/Arguments.cpp
+++ b/Source/JavaScriptCore/runtime/Arguments.cpp
@@ -196,7 +196,7 @@ void Arguments::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyN
     JSObject::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
 }
 
-void Arguments::putByIndex(JSCell* cell, ExecState* exec, unsigned i, JSValue value)
+void Arguments::putByIndex(JSCell* cell, ExecState* exec, unsigned i, JSValue value, bool shouldThrow)
 {
     Arguments* thisObject = jsCast<Arguments*>(cell);
     if (i < static_cast<unsigned>(thisObject->d->numArguments) && (!thisObject->d->deletedArguments || !thisObject->d->deletedArguments[i])) {
@@ -204,7 +204,7 @@ void Arguments::putByIndex(JSCell* cell, ExecState* exec, unsigned i, JSValue va
         return;
     }
 
-    PutPropertySlot slot;
+    PutPropertySlot slot(shouldThrow);
     JSObject::put(thisObject, exec, Identifier(exec, UString::number(i)), value, slot);
 }
 
@@ -320,12 +320,15 @@ bool Arguments::defineOwnProperty(JSObject* object, ExecState* exec, const Ident
             if (descriptor.isAccessorDescriptor()) {
                 // i. Call the [[Delete]] internal method of map passing P, and false as the arguments.
                 thisObject->d->deletedArguments[i] = true;
-            } else if (descriptor.value()) { // b. Else i. If Desc.[[Value]] is present, then
+            } else { // b. Else
+                // i. If Desc.[[Value]] is present, then
                 // 1. Call the [[Put]] internal method of map passing P, Desc.[[Value]], and Throw as the arguments.
+                if (descriptor.value())
+                    thisObject->argument(i).set(exec->globalData(), thisObject, descriptor.value());
                 // ii. If Desc.[[Writable]] is present and its value is false, then
-                thisObject->argument(i).set(exec->globalData(), thisObject, descriptor.value());
+                // 1. Call the [[Delete]] internal method of map passing P and false as arguments.
                 if (descriptor.writablePresent() && !descriptor.writable())
-                    thisObject->d->deletedArguments[i] = true; // 1. Call the [[Delete]] internal method of map passing P and false as arguments.
+                    thisObject->d->deletedArguments[i] = true;
             }
         }
 
diff --git a/Source/JavaScriptCore/runtime/Arguments.h b/Source/JavaScriptCore/runtime/Arguments.h
index ee54a49eb..8e7af1844 100644
--- a/Source/JavaScriptCore/runtime/Arguments.h
+++ b/Source/JavaScriptCore/runtime/Arguments.h
@@ -114,7 +114,7 @@ namespace JSC {
         static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
         static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
         static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-        static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue);
+        static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
         static bool deleteProperty(JSCell*, ExecState*, const Identifier& propertyName);
         static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
         static bool defineOwnProperty(JSObject*, ExecState*, const Identifier& propertyName, PropertyDescriptor&, bool shouldThrow);
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index cb9b12a59..2f000fc74 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -166,6 +166,90 @@ static unsigned argumentClampedIndexFromStartOrEnd(ExecState* exec, int argument
     return indexDouble > length ? length : static_cast<unsigned>(indexDouble);
 }
 
+
+// The shift/unshift function implement the shift/unshift behaviour required
+// by the corresponding array prototype methods, and by splice. In both cases,
+// the methods are operating an an array or array like object.
+//
+//  header  currentCount  (remainder)
+// [------][------------][-----------]
+//  header  resultCount  (remainder)
+// [------][-----------][-----------]
+//
+// The set of properties in the range 'header' must be unchanged. The set of
+// properties in the range 'remainder' (where remainder = length - header -
+// currentCount) will be shifted to the left or right as appropriate; in the
+// case of shift this must be removing values, in the case of unshift this
+// must be introducing new values.
+static inline void shift(ExecState* exec, JSObject* thisObj, unsigned header, unsigned currentCount, unsigned resultCount, unsigned length)
+{
+    ASSERT(currentCount > resultCount);
+    unsigned count = currentCount - resultCount;
+
+    ASSERT(header <= length);
+    ASSERT(currentCount <= (length - header));
+
+    if (!header && isJSArray(thisObj) && asArray(thisObj)->shiftCount(exec, count))
+        return;
+
+    for (unsigned k = header; k < length - currentCount; ++k) {
+        unsigned from = k + currentCount;
+        unsigned to = k + resultCount;
+        PropertySlot slot(thisObj);
+        if (thisObj->getPropertySlot(exec, from, slot)) {
+            JSValue value = slot.getValue(exec, from);
+            if (exec->hadException())
+                return;
+            thisObj->methodTable()->putByIndex(thisObj, exec, to, value, true);
+            if (exec->hadException())
+                return;
+        } else if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, to)) {
+            throwTypeError(exec, "Unable to delete property.");
+            return;
+        }
+    }
+    for (unsigned k = length; k > length - count; --k) {
+        if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, k - 1)) {
+            throwTypeError(exec, "Unable to delete property.");
+            return;
+        }
+    }
+}
+static inline void unshift(ExecState* exec, JSObject* thisObj, unsigned header, unsigned currentCount, unsigned resultCount, unsigned length)
+{
+    ASSERT(resultCount > currentCount);
+    unsigned count = resultCount - currentCount;
+
+    ASSERT(header <= length);
+    ASSERT(currentCount <= (length - header));
+
+    // Guard against overflow.
+    if (count > (UINT_MAX - length)) {
+        throwOutOfMemoryError(exec);
+        return;
+    }
+
+    if (!header && isJSArray(thisObj) && asArray(thisObj)->unshiftCount(exec, count))
+        return;
+
+    for (unsigned k = length - currentCount; k > header; --k) {
+        unsigned from = k + currentCount - 1;
+        unsigned to = k + resultCount - 1;
+        PropertySlot slot(thisObj);
+        if (thisObj->getPropertySlot(exec, from, slot)) {
+            JSValue value = slot.getValue(exec, from);
+            if (exec->hadException())
+                return;
+            thisObj->methodTable()->putByIndex(thisObj, exec, to, value, true);
+        } else if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, to)) {
+            throwTypeError(exec, "Unable to delete property.");
+            return;
+        }
+        if (exec->hadException())
+            return;
+    }
+}
+
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
@@ -265,9 +349,13 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
             strBuffer.append(',');
 
         JSValue element = thisObj->get(exec, k);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
         if (!element.isUndefinedOrNull()) {
             JSObject* o = element.toObject(exec);
             JSValue conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
+            if (exec->hadException())
+                return JSValue::encode(jsUndefined());
             UString str;
             CallData callData;
             CallType callType = getCallData(conversionFunction, callData);
@@ -275,6 +363,8 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
                 str = call(exec, conversionFunction, callType, callData, element, exec->emptyList()).toString(exec)->value(exec);
             else
                 str = element.toString(exec)->value(exec);
+            if (exec->hadException())
+                return JSValue::encode(jsUndefined());
             strBuffer.append(str);
         }
     }
@@ -368,11 +458,11 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec)
                 if (exec->hadException())
                     return JSValue::encode(jsUndefined());
                 if (v)
-                    arr->methodTable()->putByIndex(arr, exec, n, v);
+                    arr->putDirectIndex(exec, n, v);
                 n++;
             }
         } else {
-            arr->methodTable()->putByIndex(arr, exec, n, curArg);
+            arr->putDirectIndex(exec, n, curArg);
             n++;
         }
         if (i == argCount)
@@ -402,7 +492,12 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec)
         result = jsUndefined();
     } else {
         result = thisObj->get(exec, length - 1);
-        thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, length - 1);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
+        if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, length - 1)) {
+            throwTypeError(exec, "Unable to delete property.");
+            return JSValue::encode(jsUndefined());
+        }
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length - 1));
     }
     return JSValue::encode(result);
@@ -426,12 +521,14 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec)
     for (unsigned n = 0; n < exec->argumentCount(); n++) {
         // Check for integer overflow; where safe we can do a fast put by index.
         if (length + n >= length)
-            thisObj->methodTable()->putByIndex(thisObj, exec, length + n, exec->argument(n));
+            thisObj->methodTable()->putByIndex(thisObj, exec, length + n, exec->argument(n), true);
         else {
             PutPropertySlot slot;
             Identifier propertyName(exec, JSValue(static_cast<int64_t>(length) + static_cast<int64_t>(n)).toString(exec)->value(exec));
             thisObj->methodTable()->put(thisObj, exec, propertyName, exec->argument(n), slot);
         }
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
     }
     JSValue newLength(static_cast<int64_t>(length) + static_cast<int64_t>(exec->argumentCount()));
     putProperty(exec, thisObj, exec->propertyNames().length, newLength);
@@ -455,15 +552,23 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
         if (exec->hadException())
             return JSValue::encode(jsUndefined());
 
-        if (obj2)
-            thisObj->methodTable()->putByIndex(thisObj, exec, k, obj2);
-        else
-            thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, k);
+        if (obj2) {
+            thisObj->methodTable()->putByIndex(thisObj, exec, k, obj2, true);
+            if (exec->hadException())
+                return JSValue::encode(jsUndefined());
+        } else if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, k)) {
+            throwTypeError(exec, "Unable to delete property.");
+            return JSValue::encode(jsUndefined());
+        }
 
-        if (obj)
-            thisObj->methodTable()->putByIndex(thisObj, exec, lk1, obj);
-        else
-            thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, lk1);
+        if (obj) {
+            thisObj->methodTable()->putByIndex(thisObj, exec, lk1, obj, true);
+            if (exec->hadException())
+                return JSValue::encode(jsUndefined());
+        } else if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, lk1)) {
+            throwTypeError(exec, "Unable to delete property.");
+            return JSValue::encode(jsUndefined());
+        }
     }
     return JSValue::encode(thisObj);
 }
@@ -481,20 +586,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec)
         result = jsUndefined();
     } else {
         result = thisObj->get(exec, 0);
-        if (isJSArray(thisObj))
-            ((JSArray *)thisObj)->shiftCount(exec, 1);
-        else {
-            for (unsigned k = 1; k < length; k++) {
-                JSValue obj = getProperty(exec, thisObj, k);
-                if (exec->hadException())
-                    return JSValue::encode(jsUndefined());
-                if (obj)
-                    thisObj->methodTable()->putByIndex(thisObj, exec, k - 1, obj);
-                else
-                    thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, k - 1);
-            }
-            thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, length - 1);
-        }
+        shift(exec, thisObj, 0, 1, 0, length);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length - 1));
     }
     return JSValue::encode(result);
@@ -521,7 +615,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec)
         if (exec->hadException())
             return JSValue::encode(jsUndefined());
         if (v)
-            resObj->methodTable()->putByIndex(resObj, exec, n, v);
+            resObj->putDirectIndex(exec, n, v);
     }
     resObj->setLength(exec, n);
     return JSValue::encode(result);
@@ -580,8 +674,12 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
         }
         // Swap themin and i
         if (themin > i) {
-            thisObj->methodTable()->putByIndex(thisObj, exec, i, minObj);
-            thisObj->methodTable()->putByIndex(thisObj, exec, themin, iObj);
+            thisObj->methodTable()->putByIndex(thisObj, exec, i, minObj, true);
+            if (exec->hadException())
+                return JSValue::encode(jsUndefined());
+            thisObj->methodTable()->putByIndex(thisObj, exec, themin, iObj, true);
+            if (exec->hadException())
+                return JSValue::encode(jsUndefined());
         }
     }
     return JSValue::encode(thisObj);
@@ -627,41 +725,20 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
     resObj->completeInitialization(deleteCount);
 
     unsigned additionalArgs = std::max<int>(exec->argumentCount() - 2, 0);
-    if (additionalArgs != deleteCount) {
-        if (additionalArgs < deleteCount) {
-            if ((!begin) && (isJSArray(thisObj)))
-                ((JSArray *)thisObj)->shiftCount(exec, deleteCount - additionalArgs);
-            else {
-                for (unsigned k = begin; k < length - deleteCount; ++k) {
-                    JSValue v = getProperty(exec, thisObj, k + deleteCount);
-                    if (exec->hadException())
-                        return JSValue::encode(jsUndefined());
-                    if (v)
-                        thisObj->methodTable()->putByIndex(thisObj, exec, k + additionalArgs, v);
-                    else
-                        thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, k + additionalArgs);
-                }
-                for (unsigned k = length; k > length - deleteCount + additionalArgs; --k)
-                    thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, k - 1);
-            }
-        } else {
-            if ((!begin) && (isJSArray(thisObj)))
-                ((JSArray *)thisObj)->unshiftCount(exec, additionalArgs - deleteCount);
-            else {
-                for (unsigned k = length - deleteCount; k > begin; --k) {
-                    JSValue obj = getProperty(exec, thisObj, k + deleteCount - 1);
-                    if (exec->hadException())
-                        return JSValue::encode(jsUndefined());
-                    if (obj)
-                        thisObj->methodTable()->putByIndex(thisObj, exec, k + additionalArgs - 1, obj);
-                    else
-                        thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, k + additionalArgs - 1);
-                }
-            }
-        }
+    if (additionalArgs < deleteCount) {
+        shift(exec, thisObj, begin, deleteCount, additionalArgs, length);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
+    } else if (additionalArgs > deleteCount) {
+        unshift(exec, thisObj, begin, deleteCount, additionalArgs, length);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
+    }
+    for (unsigned k = 0; k < additionalArgs; ++k) {
+        thisObj->methodTable()->putByIndex(thisObj, exec, k + begin, exec->argument(k + 2), true);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
     }
-    for (unsigned k = 0; k < additionalArgs; ++k)
-        thisObj->methodTable()->putByIndex(thisObj, exec, k + begin, exec->argument(k + 2));
 
     putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length - deleteCount + additionalArgs));
     return JSValue::encode(result);
@@ -677,23 +754,16 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec)
         return JSValue::encode(jsUndefined());
 
     unsigned nrArgs = exec->argumentCount();
-    if ((nrArgs) && (length)) {
-        if (isJSArray(thisObj))
-            ((JSArray *)thisObj)->unshiftCount(exec, nrArgs);
-        else {
-            for (unsigned k = length; k > 0; --k) {
-                JSValue v = getProperty(exec, thisObj, k - 1);
-                if (exec->hadException())
-                    return JSValue::encode(jsUndefined());
-                if (v)
-                    thisObj->methodTable()->putByIndex(thisObj, exec, k + nrArgs - 1, v);
-                else
-                    thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, k + nrArgs - 1);
-            }
-        }
+    if (nrArgs) {
+        unshift(exec, thisObj, 0, 0, nrArgs, length);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
+    }
+    for (unsigned k = 0; k < nrArgs; ++k) {
+        thisObj->methodTable()->putByIndex(thisObj, exec, k, exec->argument(k), true);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
     }
-    for (unsigned k = 0; k < nrArgs; ++k)
-        thisObj->methodTable()->putByIndex(thisObj, exec, k, exec->argument(k));
     JSValue result = jsNumber(length + nrArgs);
     putProperty(exec, thisObj, exec->propertyNames().length, result);
     return JSValue::encode(result);
@@ -732,7 +802,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
             
             JSValue result = cachedCall.call();
             if (result.toBoolean(exec))
-                resultArray->methodTable()->putByIndex(resultArray, exec, filterIndex++, v);
+                resultArray->putDirectIndex(exec, filterIndex++, v);
         }
         if (k == length)
             return JSValue::encode(resultArray);
@@ -753,7 +823,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
 
         JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
         if (result.toBoolean(exec))
-            resultArray->methodTable()->putByIndex(resultArray, exec, filterIndex++, v);
+            resultArray->putDirectIndex(exec, filterIndex++, v);
     }
     return JSValue::encode(resultArray);
 }
@@ -788,7 +858,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
             cachedCall.setArgument(1, jsNumber(k));
             cachedCall.setArgument(2, thisObj);
 
-            JSArray::putByIndex(resultArray, exec, k, cachedCall.call());
+            resultArray->putDirectIndex(exec, k, cachedCall.call());
         }
     }
     for (; k < length && !exec->hadException(); ++k) {
@@ -809,7 +879,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
             return JSValue::encode(jsUndefined());
 
         JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
-        resultArray->methodTable()->putByIndex(resultArray, exec, k, result);
+        resultArray->putDirectIndex(exec, k, result);
     }
 
     return JSValue::encode(resultArray);
diff --git a/Source/JavaScriptCore/runtime/ClassInfo.h b/Source/JavaScriptCore/runtime/ClassInfo.h
index 9ebb33a74..214258cc6 100644
--- a/Source/JavaScriptCore/runtime/ClassInfo.h
+++ b/Source/JavaScriptCore/runtime/ClassInfo.h
@@ -48,7 +48,7 @@ namespace JSC {
         typedef void (*PutFunctionPtr)(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         PutFunctionPtr put;
 
-        typedef void (*PutByIndexFunctionPtr)(JSCell*, ExecState*, unsigned propertyName, JSValue);
+        typedef void (*PutByIndexFunctionPtr)(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
         PutByIndexFunctionPtr putByIndex;
 
         typedef bool (*DeletePropertyFunctionPtr)(JSCell*, ExecState*, const Identifier&);
diff --git a/Source/JavaScriptCore/runtime/CommonIdentifiers.h b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
index d79e5c783..0d9580197 100644
--- a/Source/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -27,10 +27,6 @@
 // MarkedArgumentBuffer of property names, passed to a macro so we can do set them up various
 // ways without repeating the list.
 #define JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(macro) \
-    macro(__defineGetter__) \
-    macro(__defineSetter__) \
-    macro(__lookupGetter__) \
-    macro(__lookupSetter__) \
     macro(apply) \
     macro(arguments) \
     macro(bind) \
@@ -52,6 +48,7 @@
     macro(input) \
     macro(isArray) \
     macro(isPrototypeOf) \
+    macro(lastIndex) \
     macro(length) \
     macro(message) \
     macro(multiline) \
diff --git a/Source/JavaScriptCore/runtime/Completion.cpp b/Source/JavaScriptCore/runtime/Completion.cpp
index 98a66589a..ce620245b 100644
--- a/Source/JavaScriptCore/runtime/Completion.cpp
+++ b/Source/JavaScriptCore/runtime/Completion.cpp
@@ -30,7 +30,7 @@
 #include "Interpreter.h"
 #include "Parser.h"
 #include "Debugger.h"
-#include "WTFThreadData.h"
+#include <wtf/WTFThreadData.h>
 #include <stdio.h>
 
 namespace JSC {
diff --git a/Source/JavaScriptCore/runtime/Error.cpp b/Source/JavaScriptCore/runtime/Error.cpp
index 243dc8856..5266c1ebe 100644
--- a/Source/JavaScriptCore/runtime/Error.cpp
+++ b/Source/JavaScriptCore/runtime/Error.cpp
@@ -36,6 +36,8 @@
 #include "NativeErrorConstructor.h"
 #include "SourceCode.h"
 
+#include <wtf/text/StringBuilder.h>
+
 namespace JSC {
 
 static const char* linePropertyName = "line";
@@ -132,20 +134,14 @@ JSObject* addErrorInfo(JSGlobalData* globalData, JSObject* error, int line, cons
             globalObject = globalData->dynamicGlobalObject;
         else
             globalObject = error->globalObject();
-        // We use the tryCreateUninitialized creation mechanism and related initialization
-        // functions as they're the only mechanism we currently have that will guarantee we
-        // don't call setters on the prototype. Technically it's faster than the alternative,
-        // but the numerous allocations that take place in this loop makes that last bit
-        // somewhat moot.
-        JSArray* stackTraceArray = JSArray::tryCreateUninitialized(*globalData, globalObject->arrayStructure(), stackTrace.size());
-        if (!stackTraceArray)
-            return error;
+        StringBuilder builder;
         for (unsigned i = 0; i < stackTrace.size(); i++) {
-            UString stackLevel = stackTrace[i].toString(globalObject->globalExec());
-            stackTraceArray->initializeIndex(*globalData, i, jsString(globalData, stackLevel));
+            builder.append(String(stackTrace[i].toString(globalObject->globalExec()).impl()));
+            if (i != stackTrace.size() - 1)
+                builder.append('\n');
         }
-        stackTraceArray->completeInitialization(stackTrace.size());
-        error->putDirect(*globalData, globalData->propertyNames->stack, stackTraceArray, ReadOnly | DontDelete);
+
+        error->putDirect(*globalData, globalData->propertyNames->stack, jsString(globalData, UString(builder.toString().impl())), ReadOnly | DontDelete);
     }
 
     return error;
diff --git a/Source/JavaScriptCore/runtime/Executable.cpp b/Source/JavaScriptCore/runtime/Executable.cpp
index 25ddf764a..ea40447e4 100644
--- a/Source/JavaScriptCore/runtime/Executable.cpp
+++ b/Source/JavaScriptCore/runtime/Executable.cpp
@@ -34,7 +34,7 @@
 #include "JITDriver.h"
 #include "Parser.h"
 #include "UStringBuilder.h"
-#include "Vector.h"
+#include <wtf/Vector.h>
 
 namespace JSC {
 
@@ -177,10 +177,9 @@ JSObject* EvalExecutable::compileOptimized(ExecState* exec, ScopeChainNode* scop
 }
 
 #if ENABLE(JIT)
-void EvalExecutable::jitCompile(JSGlobalData& globalData)
+bool EvalExecutable::jitCompile(JSGlobalData& globalData)
 {
-    bool result = jitCompileIfAppropriate(globalData, m_evalCodeBlock, m_jitCodeForCall, JITCode::bottomTierJIT());
-    ASSERT_UNUSED(result, result);
+    return jitCompileIfAppropriate(globalData, m_evalCodeBlock, m_jitCodeForCall, JITCode::bottomTierJIT(), JITCompilationCanFail);
 }
 #endif
 
@@ -210,8 +209,7 @@ JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scope
     JSGlobalData* globalData = &exec->globalData();
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
     
-    if (!!m_evalCodeBlock && m_evalCodeBlock->canProduceCopyWithBytecode()) {
-        BytecodeDestructionBlocker blocker(m_evalCodeBlock.get());
+    if (!!m_evalCodeBlock) {
         OwnPtr<EvalCodeBlock> newCodeBlock = adoptPtr(new EvalCodeBlock(CodeBlock::CopyParsedBlock, *m_evalCodeBlock));
         newCodeBlock->setAlternative(static_pointer_cast<CodeBlock>(m_evalCodeBlock.release()));
         m_evalCodeBlock = newCodeBlock.release();
@@ -223,7 +221,7 @@ JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scope
             ASSERT(exception);
             return exception;
         }
-        recordParse(evalNode->features(), evalNode->hasCapturedVariables(), evalNode->lineNo(), evalNode->lastLine());
+        recordParse(evalNode->scopeFlags(), evalNode->hasCapturedVariables(), evalNode->lineNo(), evalNode->lastLine());
         
         JSGlobalObject* globalObject = scopeChainNode->globalObject.get();
         
@@ -328,10 +326,9 @@ JSObject* ProgramExecutable::compileOptimized(ExecState* exec, ScopeChainNode* s
 }
 
 #if ENABLE(JIT)
-void ProgramExecutable::jitCompile(JSGlobalData& globalData)
+bool ProgramExecutable::jitCompile(JSGlobalData& globalData)
 {
-    bool result = jitCompileIfAppropriate(globalData, m_programCodeBlock, m_jitCodeForCall, JITCode::bottomTierJIT());
-    ASSERT_UNUSED(result, result);
+    return jitCompileIfAppropriate(globalData, m_programCodeBlock, m_jitCodeForCall, JITCode::bottomTierJIT(), JITCompilationCanFail);
 }
 #endif
 
@@ -346,8 +343,7 @@ JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* sc
     JSGlobalData* globalData = &exec->globalData();
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
     
-    if (!!m_programCodeBlock && m_programCodeBlock->canProduceCopyWithBytecode()) {
-        BytecodeDestructionBlocker blocker(m_programCodeBlock.get());
+    if (!!m_programCodeBlock) {
         OwnPtr<ProgramCodeBlock> newCodeBlock = adoptPtr(new ProgramCodeBlock(CodeBlock::CopyParsedBlock, *m_programCodeBlock));
         newCodeBlock->setAlternative(static_pointer_cast<CodeBlock>(m_programCodeBlock.release()));
         m_programCodeBlock = newCodeBlock.release();
@@ -357,7 +353,7 @@ JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* sc
             ASSERT(exception);
             return exception;
         }
-        recordParse(programNode->features(), programNode->hasCapturedVariables(), programNode->lineNo(), programNode->lastLine());
+        recordParse(programNode->scopeFlags(), programNode->hasCapturedVariables(), programNode->lineNo(), programNode->lastLine());
 
         JSGlobalObject* globalObject = scopeChainNode->globalObject.get();
     
@@ -479,33 +475,26 @@ JSObject* FunctionExecutable::compileOptimizedForConstruct(ExecState* exec, Scop
 }
 
 #if ENABLE(JIT)
-void FunctionExecutable::jitCompileForCall(JSGlobalData& globalData)
+bool FunctionExecutable::jitCompileForCall(JSGlobalData& globalData)
 {
-    bool result = jitCompileFunctionIfAppropriate(globalData, m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, m_symbolTable, JITCode::bottomTierJIT());
-    ASSERT_UNUSED(result, result);
+    return jitCompileFunctionIfAppropriate(globalData, m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, m_symbolTable, JITCode::bottomTierJIT(), JITCompilationCanFail);
 }
 
-void FunctionExecutable::jitCompileForConstruct(JSGlobalData& globalData)
+bool FunctionExecutable::jitCompileForConstruct(JSGlobalData& globalData)
 {
-    bool result = jitCompileFunctionIfAppropriate(globalData, m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, m_symbolTable, JITCode::bottomTierJIT());
-    ASSERT_UNUSED(result, result);
+    return jitCompileFunctionIfAppropriate(globalData, m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, m_symbolTable, JITCode::bottomTierJIT(), JITCompilationCanFail);
 }
 #endif
 
 FunctionCodeBlock* FunctionExecutable::codeBlockWithBytecodeFor(CodeSpecializationKind kind)
 {
-    FunctionCodeBlock* codeBlock = baselineCodeBlockFor(kind);
-    if (codeBlock->canProduceCopyWithBytecode())
-        return codeBlock;
-    return 0;
+    return baselineCodeBlockFor(kind);
 }
 
 PassOwnPtr<FunctionCodeBlock> FunctionExecutable::produceCodeBlockFor(ScopeChainNode* scopeChainNode, CompilationKind compilationKind, CodeSpecializationKind specializationKind, JSObject*& exception)
 {
-    if (!!codeBlockFor(specializationKind) && codeBlockFor(specializationKind)->canProduceCopyWithBytecode()) {
-        BytecodeDestructionBlocker blocker(codeBlockFor(specializationKind).get());
+    if (!!codeBlockFor(specializationKind))
         return adoptPtr(new FunctionCodeBlock(CodeBlock::CopyParsedBlock, *codeBlockFor(specializationKind)));
-    }
     
     exception = 0;
     JSGlobalData* globalData = scopeChainNode->globalData;
@@ -519,7 +508,7 @@ PassOwnPtr<FunctionCodeBlock> FunctionExecutable::produceCodeBlockFor(ScopeChain
     if (m_forceUsesArguments)
         body->setUsesArguments();
     body->finishParsing(m_parameters, m_name);
-    recordParse(body->features(), body->hasCapturedVariables(), body->lineNo(), body->lastLine());
+    recordParse(body->scopeFlags(), body->hasCapturedVariables(), body->lineNo(), body->lastLine());
 
     OwnPtr<FunctionCodeBlock> result;
     ASSERT((compilationKind == FirstCompilation) == !codeBlockFor(specializationKind));
diff --git a/Source/JavaScriptCore/runtime/Executable.h b/Source/JavaScriptCore/runtime/Executable.h
index 69e80b28e..08b39fcf0 100644
--- a/Source/JavaScriptCore/runtime/Executable.h
+++ b/Source/JavaScriptCore/runtime/Executable.h
@@ -180,13 +180,14 @@ namespace JSC {
 
     class NativeExecutable : public ExecutableBase {
         friend class JIT;
+        friend class LLIntOffsetsExtractor;
     public:
         typedef ExecutableBase Base;
 
 #if ENABLE(JIT)
         static NativeExecutable* create(JSGlobalData& globalData, MacroAssemblerCodeRef callThunk, NativeFunction function, MacroAssemblerCodeRef constructThunk, NativeFunction constructor, Intrinsic intrinsic)
         {
-            ASSERT(globalData.canUseJIT());
+            ASSERT(!globalData.interpreter->classicEnabled());
             NativeExecutable* executable;
             if (!callThunk) {
                 executable = new (NotNull, allocateCell<NativeExecutable>(globalData.heap)) NativeExecutable(globalData, function, constructor);
@@ -228,7 +229,7 @@ namespace JSC {
 #if ENABLE(JIT)
         void finishCreation(JSGlobalData& globalData, JITCode callThunk, JITCode constructThunk, Intrinsic intrinsic)
         {
-            ASSERT(globalData.canUseJIT());
+            ASSERT(!globalData.interpreter->classicEnabled());
             Base::finishCreation(globalData);
             m_jitCodeForCall = callThunk;
             m_jitCodeForConstruct = constructThunk;
@@ -270,14 +271,14 @@ namespace JSC {
         ScriptExecutable(Structure* structure, JSGlobalData& globalData, const SourceCode& source, bool isInStrictContext)
             : ExecutableBase(globalData, structure, NUM_PARAMETERS_NOT_COMPILED)
             , m_source(source)
-            , m_features(isInStrictContext ? StrictModeFeature : 0)
+            , m_scopeFlags(isInStrictContext ? StrictModeFlag : NoScopeFlags)
         {
         }
 
         ScriptExecutable(Structure* structure, ExecState* exec, const SourceCode& source, bool isInStrictContext)
             : ExecutableBase(exec->globalData(), structure, NUM_PARAMETERS_NOT_COMPILED)
             , m_source(source)
-            , m_features(isInStrictContext ? StrictModeFeature : 0)
+            , m_scopeFlags(isInStrictContext ? StrictModeFlag : NoScopeFlags)
         {
         }
 
@@ -291,10 +292,10 @@ namespace JSC {
         int lineNo() const { return m_firstLine; }
         int lastLine() const { return m_lastLine; }
 
-        bool usesEval() const { return m_features & EvalFeature; }
-        bool usesArguments() const { return m_features & ArgumentsFeature; }
-        bool needsActivation() const { return m_hasCapturedVariables || m_features & (EvalFeature | WithFeature | CatchFeature); }
-        bool isStrictMode() const { return m_features & StrictModeFeature; }
+        bool usesEval() const { return m_scopeFlags & UsesEvalFlag; }
+        bool usesArguments() const { return m_scopeFlags & UsesArgumentsFlag; }
+        bool needsActivation() const { return m_hasCapturedVariables || m_scopeFlags & (UsesEvalFlag | UsesWithFlag | UsesCatchFlag); }
+        bool isStrictMode() const { return m_scopeFlags & StrictModeFlag; }
 
         void unlinkCalls();
         
@@ -310,16 +311,16 @@ namespace JSC {
 #endif
         }
 
-        void recordParse(CodeFeatures features, bool hasCapturedVariables, int firstLine, int lastLine)
+        void recordParse(ScopeFlags scopeFlags, bool hasCapturedVariables, int firstLine, int lastLine)
         {
-            m_features = features;
+            m_scopeFlags = scopeFlags;
             m_hasCapturedVariables = hasCapturedVariables;
             m_firstLine = firstLine;
             m_lastLine = lastLine;
         }
 
         SourceCode m_source;
-        CodeFeatures m_features;
+        ScopeFlags m_scopeFlags;
         bool m_hasCapturedVariables;
         int m_firstLine;
         int m_lastLine;
@@ -346,7 +347,7 @@ namespace JSC {
         
 #if ENABLE(JIT)
         void jettisonOptimizedCode(JSGlobalData&);
-        void jitCompile(JSGlobalData&);
+        bool jitCompile(JSGlobalData&);
 #endif
 
         EvalCodeBlock& generatedBytecode()
@@ -421,7 +422,7 @@ namespace JSC {
         
 #if ENABLE(JIT)
         void jettisonOptimizedCode(JSGlobalData&);
-        void jitCompile(JSGlobalData&);
+        bool jitCompile(JSGlobalData&);
 #endif
 
         ProgramCodeBlock& generatedBytecode()
@@ -520,7 +521,7 @@ namespace JSC {
         
 #if ENABLE(JIT)
         void jettisonOptimizedCodeForCall(JSGlobalData&);
-        void jitCompileForCall(JSGlobalData&);
+        bool jitCompileForCall(JSGlobalData&);
 #endif
 
         bool isGeneratedForCall() const
@@ -548,7 +549,7 @@ namespace JSC {
         
 #if ENABLE(JIT)
         void jettisonOptimizedCodeForConstruct(JSGlobalData&);
-        void jitCompileForConstruct(JSGlobalData&);
+        bool jitCompileForConstruct(JSGlobalData&);
 #endif
 
         bool isGeneratedForConstruct() const
@@ -597,14 +598,12 @@ namespace JSC {
             }
         }
         
-        void jitCompileFor(JSGlobalData& globalData, CodeSpecializationKind kind)
+        bool jitCompileFor(JSGlobalData& globalData, CodeSpecializationKind kind)
         {
-            if (kind == CodeForCall) {
-                jitCompileForCall(globalData);
-                return;
-            }
+            if (kind == CodeForCall)
+                return jitCompileForCall(globalData);
             ASSERT(kind == CodeForConstruct);
-            jitCompileForConstruct(globalData);
+            return jitCompileForConstruct(globalData);
         }
 #endif
         
diff --git a/Source/JavaScriptCore/runtime/ExecutionHarness.h b/Source/JavaScriptCore/runtime/ExecutionHarness.h
index 774c5bf6b..e58e6fc74 100644
--- a/Source/JavaScriptCore/runtime/ExecutionHarness.h
+++ b/Source/JavaScriptCore/runtime/ExecutionHarness.h
@@ -46,7 +46,7 @@ inline bool prepareForExecution(JSGlobalData& globalData, OwnPtr<CodeBlockType>&
         return true;
     }
 #endif // ENABLE(LLINT)
-    return jitCompileIfAppropriate(globalData, codeBlock, jitCode, jitType);
+    return jitCompileIfAppropriate(globalData, codeBlock, jitCode, jitType, JITCode::isBaselineCode(jitType) ? JITCompilationMustSucceed : JITCompilationCanFail);
 }
 
 inline bool prepareFunctionForExecution(JSGlobalData& globalData, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, SharedSymbolTable*& symbolTable, JITCode::JITType jitType, CodeSpecializationKind kind)
@@ -61,7 +61,7 @@ inline bool prepareFunctionForExecution(JSGlobalData& globalData, OwnPtr<Functio
 #else
     UNUSED_PARAM(kind);
 #endif // ENABLE(LLINT)
-    return jitCompileFunctionIfAppropriate(globalData, codeBlock, jitCode, jitCodeWithArityCheck, symbolTable, jitType);
+    return jitCompileFunctionIfAppropriate(globalData, codeBlock, jitCode, jitCodeWithArityCheck, symbolTable, jitType, JITCode::isBaselineCode(jitType) ? JITCompilationMustSucceed : JITCompilationCanFail);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp b/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
index 2e878bfe3..7f45f0746 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
+++ b/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
@@ -53,7 +53,6 @@ struct DefaultGCActivityCallbackPlatformData {
 };
 
 const CFTimeInterval decade = 60 * 60 * 24 * 365 * 10;
-const CFTimeInterval triggerInterval = 2; // seconds
 
 void DefaultGCActivityCallbackPlatformData::trigger(CFRunLoopTimerRef timer, void *info)
 {
@@ -95,6 +94,7 @@ void DefaultGCActivityCallback::commonConstructor(Heap* heap, CFRunLoopRef runLo
 
 void DefaultGCActivityCallback::operator()()
 {
+    CFTimeInterval triggerInterval = static_cast<Heap*>(d->context.info)->lastGCLength() * 100.0; 
     CFRunLoopTimerSetNextFireDate(d->timer.get(), CFAbsoluteTimeGetCurrent() + triggerInterval);
 }
 
diff --git a/Source/JavaScriptCore/runtime/Identifier.cpp b/Source/JavaScriptCore/runtime/Identifier.cpp
index 0d233e355..fbc5787ce 100644
--- a/Source/JavaScriptCore/runtime/Identifier.cpp
+++ b/Source/JavaScriptCore/runtime/Identifier.cpp
@@ -36,20 +36,6 @@ using WTF::ThreadSpecific;
 
 namespace JSC {
 
-IdentifierTable::~IdentifierTable()
-{
-    HashSet<StringImpl*>::iterator end = m_table.end();
-    for (HashSet<StringImpl*>::iterator iter = m_table.begin(); iter != end; ++iter)
-        (*iter)->setIsIdentifier(false);
-}
-
-std::pair<HashSet<StringImpl*>::iterator, bool> IdentifierTable::add(StringImpl* value)
-{
-    std::pair<HashSet<StringImpl*>::iterator, bool> result = m_table.add(value);
-    (*result.first)->setIsIdentifier(true);
-    return result;
-}
-
 IdentifierTable* createIdentifierTable()
 {
     return new IdentifierTable;
diff --git a/Source/JavaScriptCore/runtime/Identifier.h b/Source/JavaScriptCore/runtime/Identifier.h
index 947c95b33..b9e5a1854 100644
--- a/Source/JavaScriptCore/runtime/Identifier.h
+++ b/Source/JavaScriptCore/runtime/Identifier.h
@@ -22,7 +22,7 @@
 #define Identifier_h
 
 #include "JSGlobalData.h"
-#include "ThreadSpecific.h"
+#include <wtf/ThreadSpecific.h>
 #include "UString.h"
 #include <wtf/WTFThreadData.h>
 #include <wtf/text/CString.h>
diff --git a/Source/JavaScriptCore/runtime/InitializeThreading.cpp b/Source/JavaScriptCore/runtime/InitializeThreading.cpp
index 2b874c708..b6fd6ce1f 100644
--- a/Source/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/Source/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -37,7 +37,7 @@
 #include "JSGlobalObject.h"
 #include "UString.h"
 #include "WriteBarrier.h"
-#include "dtoa.h"
+#include <wtf/dtoa.h>
 #include <wtf/Threading.h>
 #include <wtf/dtoa/cached-powers.h>
 
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index 71d520018..4244bc31c 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -41,6 +41,7 @@ using namespace WTF;
 
 namespace JSC {
 
+
 ASSERT_CLASS_FITS_IN_CELL(JSArray);
 ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSArray);
 
@@ -104,23 +105,16 @@ const ClassInfo JSArray::s_info = {"Array", &JSNonFinalObject::s_info, 0, 0, CRE
 // This value is capped by the constant FIRST_VECTOR_GROW defined above.
 static unsigned lastArraySize = 0;
 
-static inline size_t storageSize(unsigned vectorLength)
+static inline bool isDenseEnoughForVector(unsigned length, unsigned numValues)
 {
-    ASSERT(vectorLength <= MAX_STORAGE_VECTOR_LENGTH);
-
-    // MAX_STORAGE_VECTOR_LENGTH is defined such that provided (vectorLength <= MAX_STORAGE_VECTOR_LENGTH)
-    // - as asserted above - the following calculation cannot overflow.
-    size_t size = (sizeof(ArrayStorage) - sizeof(WriteBarrier<Unknown>)) + (vectorLength * sizeof(WriteBarrier<Unknown>));
-    // Assertion to detect integer overflow in previous calculation (should not be possible, provided that
-    // MAX_STORAGE_VECTOR_LENGTH is correctly defined).
-    ASSERT(((size - (sizeof(ArrayStorage) - sizeof(WriteBarrier<Unknown>))) / sizeof(WriteBarrier<Unknown>) == vectorLength) && (size >= (sizeof(ArrayStorage) - sizeof(WriteBarrier<Unknown>))));
-
-    return size;
+    return length <= MIN_SPARSE_ARRAY_INDEX || length / minDensityMultiplier <= numValues;
 }
 
-static inline bool isDenseEnoughForVector(unsigned length, unsigned numValues)
+static bool reject(ExecState* exec, bool throwException, const char* message)
 {
-    return length <= MIN_SPARSE_ARRAY_INDEX || length / minDensityMultiplier <= numValues;
+    if (throwException)
+        throwTypeError(exec, message);
+    return false;
 }
 
 #if !CHECK_ARRAY_CONSISTENCY
@@ -213,7 +207,7 @@ inline std::pair<SparseArrayValueMap::iterator, bool> SparseArrayValueMap::add(J
     return result;
 }
 
-inline void SparseArrayValueMap::put(ExecState* exec, JSArray* array, unsigned i, JSValue value)
+inline void SparseArrayValueMap::put(ExecState* exec, JSArray* array, unsigned i, JSValue value, bool shouldThrow)
 {
     std::pair<SparseArrayValueMap::iterator, bool> result = add(array, i);
     SparseArrayEntry& entry = result.first->second;
@@ -223,14 +217,15 @@ inline void SparseArrayValueMap::put(ExecState* exec, JSArray* array, unsigned i
     // extensible, this is not the right thing to have done - so remove again.
     if (result.second && !array->isExtensible()) {
         remove(result.first);
-        // FIXME: should throw in strict mode.
+        if (shouldThrow)
+            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
         return;
     }
 
     if (!(entry.attributes & Accessor)) {
         if (entry.attributes & ReadOnly) {
-            // FIXME: should throw if being called from strict mode.
-            // throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            if (shouldThrow)
+                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
             return;
         }
 
@@ -243,8 +238,8 @@ inline void SparseArrayValueMap::put(ExecState* exec, JSArray* array, unsigned i
     JSObject* setter = asGetterSetter(accessor)->setter();
     
     if (!setter) {
-        // FIXME: should throw if being called from strict mode.
-        // throwTypeError(exec, "setting a property that has only a getter");
+        if (shouldThrow)
+            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
         return;
     }
 
@@ -255,6 +250,24 @@ inline void SparseArrayValueMap::put(ExecState* exec, JSArray* array, unsigned i
     call(exec, setter, callType, callData, array, args);
 }
 
+inline bool SparseArrayValueMap::putDirect(ExecState* exec, JSArray* array, unsigned i, JSValue value, bool shouldThrow)
+{
+    std::pair<SparseArrayValueMap::iterator, bool> result = add(array, i);
+    SparseArrayEntry& entry = result.first->second;
+
+    // To save a separate find & add, we first always add to the sparse map.
+    // In the uncommon case that this is a new property, and the array is not
+    // extensible, this is not the right thing to have done - so remove again.
+    if (result.second && !array->isExtensible()) {
+        remove(result.first);
+        return reject(exec, shouldThrow, "Attempting to define property on object that is not extensible.");
+    }
+
+    entry.attributes = 0;
+    entry.set(exec->globalData(), array, value);
+    return true;
+}
+
 inline void SparseArrayEntry::get(PropertySlot& slot) const
 {
     JSValue value = Base::get();
@@ -395,13 +408,6 @@ void JSArray::putDescriptor(ExecState* exec, SparseArrayEntry* entryInMap, Prope
     entryInMap->attributes = descriptor.attributesOverridingCurrent(oldDescriptor);
 }
 
-static bool reject(ExecState* exec, bool throwException, const char* message)
-{
-    if (throwException)
-        throwTypeError(exec, message);
-    return false;
-}
-
 // Defined in ES5.1 8.12.9
 bool JSArray::defineOwnNumericProperty(ExecState* exec, unsigned index, PropertyDescriptor& descriptor, bool throwException)
 {
@@ -414,8 +420,7 @@ bool JSArray::defineOwnNumericProperty(ExecState* exec, unsigned index, Property
         // state (i.e. defineOwnProperty could be used to set a value without needing to entering 'SparseMode').
         if (!descriptor.attributes()) {
             ASSERT(!descriptor.isAccessorDescriptor());
-            putByIndex(this, exec, index, descriptor.value());
-            return true;
+            return putDirectIndex(exec, index, descriptor.value(), throwException);
         }
 
         enterDictionaryMode(exec->globalData());
@@ -721,7 +726,7 @@ void JSArray::put(JSCell* cell, ExecState* exec, const Identifier& propertyName,
     bool isArrayIndex;
     unsigned i = propertyName.toArrayIndex(isArrayIndex);
     if (isArrayIndex) {
-        putByIndex(thisObject, exec, i, value);
+        putByIndex(thisObject, exec, i, value, slot.isStrictMode());
         return;
     }
 
@@ -738,7 +743,7 @@ void JSArray::put(JSCell* cell, ExecState* exec, const Identifier& propertyName,
     JSObject::put(thisObject, exec, propertyName, value, slot);
 }
 
-void JSArray::putByIndex(JSCell* cell, ExecState* exec, unsigned i, JSValue value)
+void JSArray::putByIndex(JSCell* cell, ExecState* exec, unsigned i, JSValue value, bool shouldThrow)
 {
     JSArray* thisObject = jsCast<JSArray*>(cell);
     thisObject->checkConsistency();
@@ -765,17 +770,17 @@ void JSArray::putByIndex(JSCell* cell, ExecState* exec, unsigned i, JSValue valu
 
     // Handle 2^32-1 - this is not an array index (see ES5.1 15.4), and is treated as a regular property.
     if (UNLIKELY(i > MAX_ARRAY_INDEX)) {
-        PutPropertySlot slot;
+        PutPropertySlot slot(shouldThrow);
         thisObject->methodTable()->put(thisObject, exec, Identifier::from(exec, i), value, slot);
         return;
     }
 
     // For all other cases, call putByIndexBeyondVectorLength.
-    thisObject->putByIndexBeyondVectorLength(exec, i, value);
+    thisObject->putByIndexBeyondVectorLength(exec, i, value, shouldThrow);
     thisObject->checkConsistency();
 }
 
-NEVER_INLINE void JSArray::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue value)
+void JSArray::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue value, bool shouldThrow)
 {
     JSGlobalData& globalData = exec->globalData();
 
@@ -806,7 +811,7 @@ NEVER_INLINE void JSArray::putByIndexBeyondVectorLength(ExecState* exec, unsigne
         // We don't want to, or can't use a vector to hold this property - allocate a sparse map & add the value.
         allocateSparseMap(exec->globalData());
         map = m_sparseValueMap;
-        map->put(exec, this, i, value);
+        map->put(exec, this, i, value, shouldThrow);
         return;
     }
 
@@ -815,7 +820,8 @@ NEVER_INLINE void JSArray::putByIndexBeyondVectorLength(ExecState* exec, unsigne
     if (i >= length) {
         // Prohibit growing the array if length is not writable.
         if (map->lengthIsReadOnly() || !isExtensible()) {
-            // FIXME: should throw in strict mode.
+            if (shouldThrow)
+                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
             return;
         }
         length = i + 1;
@@ -826,7 +832,7 @@ NEVER_INLINE void JSArray::putByIndexBeyondVectorLength(ExecState* exec, unsigne
     // We will continue  to use a sparse map if SparseMode is set, a vector would be too sparse, or if allocation fails.
     unsigned numValuesInArray = storage->m_numValuesInVector + map->size();
     if (map->sparseMode() || !isDenseEnoughForVector(length, numValuesInArray) || !increaseVectorLength(exec->globalData(), length)) {
-        map->put(exec, this, i, value);
+        map->put(exec, this, i, value, shouldThrow);
         return;
     }
 
@@ -848,6 +854,77 @@ NEVER_INLINE void JSArray::putByIndexBeyondVectorLength(ExecState* exec, unsigne
     valueSlot.set(globalData, this, value);
 }
 
+bool JSArray::putDirectIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue value, bool shouldThrow)
+{
+    JSGlobalData& globalData = exec->globalData();
+
+    // i should be a valid array index that is outside of the current vector.
+    ASSERT(i >= m_vectorLength);
+    ASSERT(i <= MAX_ARRAY_INDEX);
+
+    ArrayStorage* storage = m_storage;
+    SparseArrayValueMap* map = m_sparseValueMap;
+
+    // First, handle cases where we don't currently have a sparse map.
+    if (LIKELY(!map)) {
+        // If the array is not extensible, we should have entered dictionary mode, and created the spare map.
+        ASSERT(isExtensible());
+    
+        // Update m_length if necessary.
+        if (i >= storage->m_length)
+            storage->m_length = i + 1;
+
+        // Check that it is sensible to still be using a vector, and then try to grow the vector.
+        if (LIKELY((isDenseEnoughForVector(i, storage->m_numValuesInVector)) && increaseVectorLength(globalData, i + 1))) {
+            // success! - reread m_storage since it has likely been reallocated, and store to the vector.
+            storage = m_storage;
+            storage->m_vector[i].set(globalData, this, value);
+            ++storage->m_numValuesInVector;
+            return true;
+        }
+        // We don't want to, or can't use a vector to hold this property - allocate a sparse map & add the value.
+        allocateSparseMap(exec->globalData());
+        map = m_sparseValueMap;
+        return map->putDirect(exec, this, i, value, shouldThrow);
+    }
+
+    // Update m_length if necessary.
+    unsigned length = storage->m_length;
+    if (i >= length) {
+        // Prohibit growing the array if length is not writable.
+        if (map->lengthIsReadOnly())
+            return reject(exec, shouldThrow, StrictModeReadonlyPropertyWriteError);
+        if (!isExtensible())
+            return reject(exec, shouldThrow, "Attempting to define property on object that is not extensible.");
+        length = i + 1;
+        storage->m_length = length;
+    }
+
+    // We are currently using a map - check whether we still want to be doing so.
+    // We will continue  to use a sparse map if SparseMode is set, a vector would be too sparse, or if allocation fails.
+    unsigned numValuesInArray = storage->m_numValuesInVector + map->size();
+    if (map->sparseMode() || !isDenseEnoughForVector(length, numValuesInArray) || !increaseVectorLength(exec->globalData(), length))
+        return map->putDirect(exec, this, i, value, shouldThrow);
+
+    // Reread m_storage afterincreaseVectorLength, update m_numValuesInVector.
+    storage = m_storage;
+    storage->m_numValuesInVector = numValuesInArray;
+
+    // Copy all values from the map into the vector, and delete the map.
+    WriteBarrier<Unknown>* vector = storage->m_vector;
+    SparseArrayValueMap::const_iterator end = map->end();
+    for (SparseArrayValueMap::const_iterator it = map->begin(); it != end; ++it)
+        vector[it->first].set(globalData, this, it->second.getNonSparseMode());
+    deallocateSparseMap();
+
+    // Store the new property into the vector.
+    WriteBarrier<Unknown>& valueSlot = vector[i];
+    if (!valueSlot)
+        ++storage->m_numValuesInVector;
+    valueSlot.set(globalData, this, value);
+    return true;
+}
+
 bool JSArray::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName)
 {
     JSArray* thisObject = jsCast<JSArray*>(cell);
@@ -1220,18 +1297,19 @@ void JSArray::push(ExecState* exec, JSValue value)
 
     // Pushing to an array of length 2^32-1 stores the property, but throws a range error.
     if (UNLIKELY(storage->m_length == 0xFFFFFFFFu)) {
-        methodTable()->putByIndex(this, exec, storage->m_length, value);
+        methodTable()->putByIndex(this, exec, storage->m_length, value, true);
         // Per ES5.1 15.4.4.7 step 6 & 15.4.5.1 step 3.d.
-        throwError(exec, createRangeError(exec, "Invalid array length"));
+        if (!exec->hadException())
+            throwError(exec, createRangeError(exec, "Invalid array length"));
         return;
     }
 
     // Handled the same as putIndex.
-    putByIndexBeyondVectorLength(exec, storage->m_length, value);
+    putByIndexBeyondVectorLength(exec, storage->m_length, value, true);
     checkConsistency();
 }
 
-void JSArray::shiftCount(ExecState* exec, unsigned count)
+bool JSArray::shiftCount(ExecState*, unsigned count)
 {
     ASSERT(count > 0);
     
@@ -1239,32 +1317,15 @@ void JSArray::shiftCount(ExecState* exec, unsigned count)
     
     unsigned oldLength = storage->m_length;
     
-    if (!oldLength)
-        return;
-    
-    if (oldLength != storage->m_numValuesInVector) {
-        // If m_length and m_numValuesInVector aren't the same, we have a sparse vector
-        // which means we need to go through each entry looking for the the "empty"
-        // slots and then fill them with possible properties.  See ECMA spec.
-        // 15.4.4.9 steps 11 through 13.
-        for (unsigned i = count; i < oldLength; ++i) {
-            if ((i >= m_vectorLength) || (!m_storage->m_vector[i])) {
-                PropertySlot slot(this);
-                JSValue p = prototype();
-                if ((!p.isNull()) && (asObject(p)->getPropertySlot(exec, i, slot)))
-                    methodTable()->putByIndex(this, exec, i, slot.getValue(exec, i));
-            }
-        }
-
-        storage = m_storage; // The put() above could have grown the vector and realloc'ed storage.
+    // If the array contains holes or is otherwise in an abnormal state,
+    // use the generic algorithm in ArrayPrototype.
+    if (oldLength != storage->m_numValuesInVector || inSparseMode())
+        return false;
 
-        // Need to decrement numValuesInvector based on number of real entries
-        for (unsigned i = 0; i < (unsigned)count; ++i)
-            if ((i < m_vectorLength) && (storage->m_vector[i]))
-                --storage->m_numValuesInVector;
-    } else
-        storage->m_numValuesInVector -= count;
+    if (!oldLength)
+        return true;
     
+    storage->m_numValuesInVector -= count;
     storage->m_length -= count;
     
     if (m_vectorLength) {
@@ -1280,30 +1341,20 @@ void JSArray::shiftCount(ExecState* exec, unsigned count)
             m_indexBias += count;
         }
     }
+    return true;
 }
-    
-void JSArray::unshiftCount(ExecState* exec, unsigned count)
+
+// Returns true if the unshift can be handled, false to fallback.    
+bool JSArray::unshiftCount(ExecState* exec, unsigned count)
 {
     ArrayStorage* storage = m_storage;
     unsigned length = storage->m_length;
 
-    if (length != storage->m_numValuesInVector) {
-        // If m_length and m_numValuesInVector aren't the same, we have a sparse vector
-        // which means we need to go through each entry looking for the the "empty"
-        // slots and then fill them with possible properties.  See ECMA spec.
-        // 15.4.4.13 steps 8 through 10.
-        for (unsigned i = 0; i < length; ++i) {
-            if ((i >= m_vectorLength) || (!m_storage->m_vector[i])) {
-                PropertySlot slot(this);
-                JSValue p = prototype();
-                if ((!p.isNull()) && (asObject(p)->getPropertySlot(exec, i, slot)))
-                    methodTable()->putByIndex(this, exec, i, slot.getValue(exec, i));
-            }
-        }
-    }
-    
-    storage = m_storage; // The put() above could have grown the vector and realloc'ed storage.
-    
+    // If the array contains holes or is otherwise in an abnormal state,
+    // use the generic algorithm in ArrayPrototype.
+    if (length != storage->m_numValuesInVector || inSparseMode())
+        return false;
+
     if (m_indexBias >= count) {
         m_indexBias -= count;
         char* newBaseStorage = reinterpret_cast<char*>(storage) - count * sizeof(WriteBarrier<Unknown>);
@@ -1312,12 +1363,13 @@ void JSArray::unshiftCount(ExecState* exec, unsigned count)
         m_vectorLength += count;
     } else if (!unshiftCountSlowCase(exec->globalData(), count)) {
         throwOutOfMemoryError(exec);
-        return;
+        return true;
     }
 
     WriteBarrier<Unknown>* vector = m_storage->m_vector;
     for (unsigned i = 0; i < count; i++)
         vector[i].clear();
+    return true;
 }
 
 void JSArray::visitChildren(JSCell* cell, SlotVisitor& visitor)
diff --git a/Source/JavaScriptCore/runtime/JSArray.h b/Source/JavaScriptCore/runtime/JSArray.h
index 3bb4c6320..ad98d6619 100644
--- a/Source/JavaScriptCore/runtime/JSArray.h
+++ b/Source/JavaScriptCore/runtime/JSArray.h
@@ -85,7 +85,8 @@ namespace JSC {
         }
 
         // These methods may mutate the contents of the map
-        void put(ExecState*, JSArray*, unsigned, JSValue);
+        void put(ExecState*, JSArray*, unsigned, JSValue, bool shouldThrow);
+        bool putDirect(ExecState*, JSArray*, unsigned, JSValue, bool shouldThrow);
         std::pair<iterator, bool> add(JSArray*, unsigned);
         iterator find(unsigned i) { return m_map.find(i); }
         // This should ASSERT the remove is valid (check the result of the find).
@@ -122,11 +123,17 @@ namespace JSC {
         uintptr_t m_padding;
 #endif
         WriteBarrier<Unknown> m_vector[1];
+
+        static ptrdiff_t lengthOffset() { return OBJECT_OFFSETOF(ArrayStorage, m_length); }
+        static ptrdiff_t numValuesInVectorOffset() { return OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector); }
+        static ptrdiff_t allocBaseOffset() { return OBJECT_OFFSETOF(ArrayStorage, m_allocBase); }
+        static ptrdiff_t vectorOffset() { return OBJECT_OFFSETOF(ArrayStorage, m_vector); }
     };
 
     class JSArray : public JSNonFinalObject {
         friend class LLIntOffsetsExtractor;
         friend class Walker;
+        friend class JIT;
 
     protected:
         JS_EXPORT_PRIVATE explicit JSArray(JSGlobalData&, Structure*);
@@ -153,7 +160,19 @@ namespace JSC {
         static bool getOwnPropertySlot(JSCell*, ExecState*, const Identifier&, PropertySlot&);
         JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned propertyName, PropertySlot&);
         static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
-        static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue);
+        static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+        // This is similar to the JSObject::putDirect* methods:
+        //  - the prototype chain is not consulted
+        //  - accessors are not called.
+        // This method creates a property with attributes writable, enumerable and configurable all set to true.
+        bool putDirectIndex(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow = true)
+        {
+            if (canSetIndex(propertyName)) {
+                setIndex(exec->globalData(), propertyName, value);
+                return true;
+            }
+            return putDirectIndexBeyondVectorLength(exec, propertyName, value, shouldThrow);
+        }
 
         static JS_EXPORTDATA const ClassInfo s_info;
         
@@ -168,8 +187,8 @@ namespace JSC {
         void push(ExecState*, JSValue);
         JSValue pop(ExecState*);
 
-        void shiftCount(ExecState*, unsigned count);
-        void unshiftCount(ExecState*, unsigned count);
+        bool shiftCount(ExecState*, unsigned count);
+        bool unshiftCount(ExecState*, unsigned count);
 
         bool canGetIndex(unsigned i) { return i < m_vectorLength && m_storage->m_vector[i]; }
         JSValue getIndex(unsigned i)
@@ -262,6 +281,7 @@ namespace JSC {
         JS_EXPORT_PRIVATE void setSubclassData(void*);
 
     private:
+        static size_t storageSize(unsigned vectorLength);
         bool isLengthWritable()
         {
             SparseArrayValueMap* map = m_sparseValueMap;
@@ -275,7 +295,8 @@ namespace JSC {
         void deallocateSparseMap();
 
         bool getOwnPropertySlotSlowCase(ExecState*, unsigned propertyName, PropertySlot&);
-        void putByIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue);
+        void putByIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+        JS_EXPORT_PRIVATE bool putDirectIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
 
         unsigned getNewVectorLength(unsigned desiredLength);
         bool increaseVectorLength(JSGlobalData&, unsigned newLength);
@@ -293,6 +314,10 @@ namespace JSC {
         // FIXME: Maybe SparseArrayValueMap should be put into its own JSCell?
         SparseArrayValueMap* m_sparseValueMap;
         void* m_subclassData; // A JSArray subclass can use this to fill the vector lazily.
+
+        static ptrdiff_t sparseValueMapOffset() { return OBJECT_OFFSETOF(JSArray, m_sparseValueMap); }
+        static ptrdiff_t subclassDataOffset() { return OBJECT_OFFSETOF(JSArray, m_subclassData); }
+        static ptrdiff_t indexBiasOffset() { return OBJECT_OFFSETOF(JSArray, m_indexBias); }
     };
 
     inline JSArray* JSArray::create(JSGlobalData& globalData, Structure* structure, unsigned initialLength)
@@ -334,6 +359,30 @@ namespace JSC {
         return i;
     }
 
-} // namespace JSC
+// The definition of MAX_STORAGE_VECTOR_LENGTH is dependant on the definition storageSize
+// function below - the MAX_STORAGE_VECTOR_LENGTH limit is defined such that the storage
+// size calculation cannot overflow.  (sizeof(ArrayStorage) - sizeof(WriteBarrier<Unknown>)) +
+// (vectorLength * sizeof(WriteBarrier<Unknown>)) must be <= 0xFFFFFFFFU (which is maximum value of size_t).
+#define MAX_STORAGE_VECTOR_LENGTH static_cast<unsigned>((0xFFFFFFFFU - (sizeof(ArrayStorage) - sizeof(WriteBarrier<Unknown>))) / sizeof(WriteBarrier<Unknown>))
+
+// These values have to be macros to be used in max() and min() without introducing
+// a PIC branch in Mach-O binaries, see <rdar://problem/5971391>.
+#define MIN_SPARSE_ARRAY_INDEX 10000U
+#define MAX_STORAGE_VECTOR_INDEX (MAX_STORAGE_VECTOR_LENGTH - 1)
+    inline size_t JSArray::storageSize(unsigned vectorLength)
+    {
+        ASSERT(vectorLength <= MAX_STORAGE_VECTOR_LENGTH);
+    
+        // MAX_STORAGE_VECTOR_LENGTH is defined such that provided (vectorLength <= MAX_STORAGE_VECTOR_LENGTH)
+        // - as asserted above - the following calculation cannot overflow.
+        size_t size = (sizeof(ArrayStorage) - sizeof(WriteBarrier<Unknown>)) + (vectorLength * sizeof(WriteBarrier<Unknown>));
+        // Assertion to detect integer overflow in previous calculation (should not be possible, provided that
+        // MAX_STORAGE_VECTOR_LENGTH is correctly defined).
+        ASSERT(((size - (sizeof(ArrayStorage) - sizeof(WriteBarrier<Unknown>))) / sizeof(WriteBarrier<Unknown>) == vectorLength) && (size >= (sizeof(ArrayStorage) - sizeof(WriteBarrier<Unknown>))));
+    
+        return size;
+    }
+    
+    } // namespace JSC
 
 #endif // JSArray_h
diff --git a/Source/JavaScriptCore/runtime/JSByteArray.cpp b/Source/JavaScriptCore/runtime/JSByteArray.cpp
index 3df21e6f5..39ea4d0b9 100644
--- a/Source/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSByteArray.cpp
@@ -102,7 +102,7 @@ void JSByteArray::put(JSCell* cell, ExecState* exec, const Identifier& propertyN
     JSObject::put(thisObject, exec, propertyName, value, slot);
 }
 
-void JSByteArray::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value)
+void JSByteArray::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool)
 {
     jsCast<JSByteArray*>(cell)->setIndex(exec, propertyName, value);
 }
diff --git a/Source/JavaScriptCore/runtime/JSByteArray.h b/Source/JavaScriptCore/runtime/JSByteArray.h
index d1f4ad630..06181d901 100644
--- a/Source/JavaScriptCore/runtime/JSByteArray.h
+++ b/Source/JavaScriptCore/runtime/JSByteArray.h
@@ -92,7 +92,7 @@ namespace JSC {
         JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
         JS_EXPORT_PRIVATE static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
         JS_EXPORT_PRIVATE static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-        JS_EXPORT_PRIVATE static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+        JS_EXPORT_PRIVATE static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue, bool shouldThrow);
 
         JS_EXPORT_PRIVATE static void getOwnPropertyNames(JSC::JSObject*, JSC::ExecState*, JSC::PropertyNameArray&, EnumerationMode);
 
diff --git a/Source/JavaScriptCore/runtime/JSCell.cpp b/Source/JavaScriptCore/runtime/JSCell.cpp
index 4703b681b..f08d0260a 100644
--- a/Source/JavaScriptCore/runtime/JSCell.cpp
+++ b/Source/JavaScriptCore/runtime/JSCell.cpp
@@ -97,14 +97,23 @@ bool JSCell::getOwnPropertySlotByIndex(JSCell* cell, ExecState* exec, unsigned i
 
 void JSCell::put(JSCell* cell, ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
+    if (cell->isString()) {
+        JSValue(cell).putToPrimitive(exec, identifier, value, slot);
+        return;
+    }
     JSObject* thisObject = cell->toObject(exec, exec->lexicalGlobalObject());
     thisObject->methodTable()->put(thisObject, exec, identifier, value, slot);
 }
 
-void JSCell::putByIndex(JSCell* cell, ExecState* exec, unsigned identifier, JSValue value)
+void JSCell::putByIndex(JSCell* cell, ExecState* exec, unsigned identifier, JSValue value, bool shouldThrow)
 {
+    if (cell->isString()) {
+        PutPropertySlot slot(shouldThrow);
+        JSValue(cell).putToPrimitive(exec, Identifier::from(exec, identifier), value, slot);
+        return;
+    }
     JSObject* thisObject = cell->toObject(exec, exec->lexicalGlobalObject());
-    thisObject->methodTable()->putByIndex(thisObject, exec, identifier, value);
+    thisObject->methodTable()->putByIndex(thisObject, exec, identifier, value, shouldThrow);
 }
 
 bool JSCell::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& identifier)
diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index 78d2d0801..2ef359b76 100644
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -107,7 +107,7 @@ namespace JSC {
         const ClassInfo* validatedClassInfo() const;
         const MethodTable* methodTable() const;
         static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-        static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue);
+        static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
         
         static bool deleteProperty(JSCell*, ExecState*, const Identifier& propertyName);
         static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
diff --git a/Source/JavaScriptCore/runtime/JSDateMath.cpp b/Source/JavaScriptCore/runtime/JSDateMath.cpp
index 863073338..882f86fa0 100644
--- a/Source/JavaScriptCore/runtime/JSDateMath.cpp
+++ b/Source/JavaScriptCore/runtime/JSDateMath.cpp
@@ -72,8 +72,6 @@
 #include "config.h"
 #include "JSDateMath.h"
 
-#include "Assertions.h"
-#include "ASCIICType.h"
 #include "CurrentTime.h"
 #include "JSObject.h"
 #include "MathExtras.h"
@@ -86,6 +84,8 @@
 #include <limits>
 #include <stdint.h>
 #include <time.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/Assertions.h>
 #include <wtf/text/StringBuilder.h>
 
 #if HAVE(ERRNO_H)
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index 253128279..fa798f41a 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -181,7 +181,15 @@ JSValue JSFunction::callerGetter(ExecState* exec, JSValue slotBase, const Identi
 {
     JSFunction* thisObj = asFunction(slotBase);
     ASSERT(!thisObj->isHostFunction());
-    return exec->interpreter()->retrieveCallerFromVMCode(exec, thisObj);
+    JSValue caller = exec->interpreter()->retrieveCallerFromVMCode(exec, thisObj);
+
+    // See ES5.1 15.3.5.4 - Function.caller may not be used to retrieve a strict caller.
+    if (!caller.isObject() || !asObject(caller)->inherits(&JSFunction::s_info))
+        return caller;
+    JSFunction* function = asFunction(caller);
+    if (function->isHostFunction() || !function->jsExecutable()->isStrictMode())
+        return caller;
+    return throwTypeError(exec, "Function.caller used to retrieve strict caller");
 }
 
 JSValue JSFunction::lengthGetter(ExecState*, JSValue slotBase, const Identifier&)
@@ -329,21 +337,80 @@ void JSFunction::put(JSCell* cell, ExecState* exec, const Identifier& propertyNa
         Base::put(thisObject, exec, propertyName, value, slot);
         return;
     }
-    if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length)
+    if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length || propertyName == exec->propertyNames().caller) {
+        if (slot.isStrictMode())
+            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
         return;
+    }
     Base::put(thisObject, exec, propertyName, value, slot);
 }
 
 bool JSFunction::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName)
 {
     JSFunction* thisObject = jsCast<JSFunction*>(cell);
-    if (thisObject->isHostFunction())
-        return Base::deleteProperty(thisObject, exec, propertyName);
-    if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length)
+    // For non-host functions, don't let these properties by deleted - except by DefineOwnProperty.
+    if (!thisObject->isHostFunction() && !exec->globalData().isInDefineOwnProperty()
+        && (propertyName == exec->propertyNames().arguments
+            || propertyName == exec->propertyNames().length
+            || propertyName == exec->propertyNames().prototype
+            || propertyName == exec->propertyNames().caller))
         return false;
     return Base::deleteProperty(thisObject, exec, propertyName);
 }
 
+bool JSFunction::defineOwnProperty(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool throwException)
+{
+    JSFunction* thisObject = jsCast<JSFunction*>(object);
+    if (thisObject->isHostFunction())
+        return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+
+    if (propertyName == exec->propertyNames().prototype) {
+        // Make sure prototype has been reified, such that it can only be overwritten
+        // following the rules set out in ECMA-262 8.12.9.
+        PropertySlot slot;
+        thisObject->methodTable()->getOwnPropertySlot(thisObject, exec, propertyName, slot);
+    } else if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length || propertyName == exec->propertyNames().caller) {
+        if (!object->isExtensible()) {
+            if (throwException)
+                throwError(exec, createTypeError(exec, "Attempting to define property on object that is not extensible."));
+            return false;
+        }
+        if (descriptor.configurablePresent() && descriptor.configurable()) {
+            if (throwException)
+                throwError(exec, createTypeError(exec, "Attempting to configurable attribute of unconfigurable property."));
+            return false;
+        }
+        if (descriptor.enumerablePresent() && descriptor.enumerable()) {
+            if (throwException)
+                throwError(exec, createTypeError(exec, "Attempting to change enumerable attribute of unconfigurable property."));
+            return false;
+        }
+        if (descriptor.isAccessorDescriptor()) {
+            if (throwException)
+                throwError(exec, createTypeError(exec, "Attempting to change access mechanism for an unconfigurable property."));
+            return false;
+        }
+        if (descriptor.writablePresent() && descriptor.writable()) {
+            if (throwException)
+                throwError(exec, createTypeError(exec, "Attempting to change writable attribute of unconfigurable property."));
+            return false;
+        }
+        if (!descriptor.value())
+            return true;
+        if (propertyName == exec->propertyNames().arguments && sameValue(exec, descriptor.value(), exec->interpreter()->retrieveArgumentsFromVMCode(exec, thisObject)))
+            return true;
+        if (propertyName == exec->propertyNames().length && sameValue(exec, descriptor.value(), jsNumber(thisObject->jsExecutable()->parameterCount())))
+            return true;
+        if (propertyName == exec->propertyNames().caller && sameValue(exec, descriptor.value(), exec->interpreter()->retrieveCallerFromVMCode(exec, thisObject)))
+            return true;
+        if (throwException)
+            throwError(exec, createTypeError(exec, "Attempting to change value of a readonly property."));
+        return false;
+    }
+
+    return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+}
+
 // ECMA 13.2.2 [[Construct]]
 ConstructType JSFunction::getConstructData(JSCell* cell, ConstructData& constructData)
 {
diff --git a/Source/JavaScriptCore/runtime/JSFunction.h b/Source/JavaScriptCore/runtime/JSFunction.h
index 6e8557f59..288181060 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.h
+++ b/Source/JavaScriptCore/runtime/JSFunction.h
@@ -133,6 +133,7 @@ namespace JSC {
         static bool getOwnPropertySlot(JSCell*, ExecState*, const Identifier&, PropertySlot&);
         static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
         static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode = ExcludeDontEnumProperties);
+        static bool defineOwnProperty(JSObject*, ExecState*, const Identifier& propertyName, PropertyDescriptor&, bool shouldThrow);
 
         static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.cpp b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
index 2bdc28ab7..f138e75fb 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -193,7 +193,7 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
 
     wtfThreadData().setCurrentIdentifierTable(existingEntryIdentifierTable);
 
-#if ENABLE(JIT) && ENABLE(CLASSIC_INTERPRETER)
+#if ENABLE(JIT) && (ENABLE(CLASSIC_INTERPRETER) || ENABLE(LLINT))
 #if USE(CF)
     CFStringRef canUseJITKey = CFStringCreateWithCString(0 , "JavaScriptCoreUseJIT", kCFStringEncodingMacRoman);
     CFBooleanRef canUseJIT = (CFBooleanRef)CFPreferencesCopyAppValue(canUseJITKey, kCFPreferencesCurrentApplication);
@@ -213,13 +213,16 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
 #endif
 #endif
 #if ENABLE(JIT)
-#if ENABLE(CLASSIC_INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER) || ENABLE(LLINT)
     if (m_canUseJIT)
         m_canUseJIT = executableAllocator.isValid();
+    
+    if (!Options::useJIT)
+        m_canUseJIT = false;
 #endif
     jitStubs = adoptPtr(new JITThunks(this));
 #endif
-
+    
     interpreter->initialize(&llintData, this->canUseJIT());
     
     initializeHostCallReturnValue(); // This is needed to convince the linker not to drop host call return support.
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.h b/Source/JavaScriptCore/runtime/JSGlobalData.h
index 7e54c00db..acbcee816 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.h
@@ -47,6 +47,7 @@
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
+#include <wtf/SimpleStats.h>
 #include <wtf/ThreadSpecific.h>
 #include <wtf/WTFThreadData.h>
 #if ENABLE(REGEXP_TRACING)
@@ -201,6 +202,7 @@ namespace JSC {
         SmallStrings smallStrings;
         NumericStrings numericStrings;
         DateInstanceCache dateInstanceCache;
+        WTF::SimpleStats machineCodeBytesPerBytecodeWordForBaselineJIT;
         Vector<CodeBlock*> codeBlocksBeingCompiled;
         void startedCompiling(CodeBlock* codeBlock)
         {
@@ -229,7 +231,7 @@ namespace JSC {
 
 #if !ENABLE(JIT)
         bool canUseJIT() { return false; } // interpreter only
-#elif !ENABLE(CLASSIC_INTERPRETER)
+#elif !ENABLE(CLASSIC_INTERPRETER) && !ENABLE(LLINT)
         bool canUseJIT() { return true; } // jit only
 #else
         bool canUseJIT() { return m_canUseJIT; }
@@ -367,7 +369,7 @@ namespace JSC {
         JSGlobalData(GlobalDataType, ThreadStackType, HeapSize);
         static JSGlobalData*& sharedInstanceInternal();
         void createNativeThunk();
-#if ENABLE(JIT) && ENABLE(CLASSIC_INTERPRETER)
+#if ENABLE(JIT) && (ENABLE(CLASSIC_INTERPRETER) || ENABLE(LLINT))
         bool m_canUseJIT;
 #endif
 #if ENABLE(GC_VALIDATION)
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index db8ee1d85..75789e602 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -35,7 +35,7 @@
 #include "Nodes.h"
 #include "Parser.h"
 #include "UStringBuilder.h"
-#include "dtoa.h"
+#include <wtf/dtoa.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <wtf/ASCIICType.h>
diff --git a/Source/JavaScriptCore/runtime/JSNotAnObject.cpp b/Source/JavaScriptCore/runtime/JSNotAnObject.cpp
index 682400292..337e3a70c 100644
--- a/Source/JavaScriptCore/runtime/JSNotAnObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSNotAnObject.cpp
@@ -70,7 +70,7 @@ void JSNotAnObject::put(JSCell*, ExecState* exec, const Identifier& , JSValue, P
     ASSERT_UNUSED(exec, exec->hadException());
 }
 
-void JSNotAnObject::putByIndex(JSCell*, ExecState* exec, unsigned, JSValue)
+void JSNotAnObject::putByIndex(JSCell*, ExecState* exec, unsigned, JSValue, bool)
 {
     ASSERT_UNUSED(exec, exec->hadException());
 }
diff --git a/Source/JavaScriptCore/runtime/JSNotAnObject.h b/Source/JavaScriptCore/runtime/JSNotAnObject.h
index 51ba456e1..5f80688b0 100644
--- a/Source/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/Source/JavaScriptCore/runtime/JSNotAnObject.h
@@ -73,7 +73,7 @@ namespace JSC {
         static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
 
         static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-        static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue);
+        static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
 
         static bool deleteProperty(JSCell*, ExecState*, const Identifier& propertyName);
         static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
index 83b118429..436e78353 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -704,12 +704,8 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 JSValue filteredValue = callReviver(array, jsString(m_exec, UString::number(indexStack.last())), outValue);
                 if (filteredValue.isUndefined())
                     array->methodTable()->deletePropertyByIndex(array, m_exec, indexStack.last());
-                else {
-                    if (isJSArray(array) && array->canSetIndex(indexStack.last()))
-                        array->setIndex(m_exec->globalData(), indexStack.last(), filteredValue);
-                    else
-                        array->methodTable()->putByIndex(array, m_exec, indexStack.last(), filteredValue);
-                }
+                else
+                    array->putDirectIndex(m_exec, indexStack.last(), filteredValue, false);
                 if (m_exec->hadException())
                     return jsNull();
                 indexStack.last()++;
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index acc4a181e..1bdb90ff6 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -119,11 +119,6 @@ bool JSObject::getOwnPropertySlotByIndex(JSCell* cell, ExecState* exec, unsigned
     return thisObject->methodTable()->getOwnPropertySlot(thisObject, exec, Identifier::from(exec, propertyName), slot);
 }
 
-static void throwSetterError(ExecState* exec)
-{
-    throwError(exec, createTypeError(exec, "setting a property that has only a getter"));
-}
-
 // ECMA 8.6.2.2
 void JSObject::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
@@ -161,7 +156,7 @@ void JSObject::put(JSCell* cell, ExecState* exec, const Identifier& propertyName
                 JSObject* setterFunc = asGetterSetter(gs)->setter();        
                 if (!setterFunc) {
                     if (slot.isStrictMode())
-                        throwSetterError(exec);
+                        throwError(exec, createTypeError(exec, "setting a property that has only a getter"));
                     return;
                 }
                 
@@ -190,9 +185,9 @@ void JSObject::put(JSCell* cell, ExecState* exec, const Identifier& propertyName
     return;
 }
 
-void JSObject::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value)
+void JSObject::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
 {
-    PutPropertySlot slot;
+    PutPropertySlot slot(shouldThrow);
     JSObject* thisObject = jsCast<JSObject*>(cell);
     thisObject->methodTable()->put(thisObject, exec, Identifier::from(exec, propertyName), value, slot);
 }
@@ -707,7 +702,7 @@ bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, const Identi
     if (descriptor.isGenericDescriptor()) {
         if (!current.attributesEqual(descriptor)) {
             object->methodTable()->deleteProperty(object, exec, propertyName);
-            return putDescriptor(exec, object, propertyName, descriptor, current.attributesWithOverride(descriptor), current);
+            return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
         }
         return true;
     }
@@ -720,7 +715,7 @@ bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, const Identi
             return false;
         }
         object->methodTable()->deleteProperty(object, exec, propertyName);
-        return putDescriptor(exec, object, propertyName, descriptor, current.attributesWithOverride(descriptor), current);
+        return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
     }
 
     // Changing the value and attributes of an existing property
@@ -742,7 +737,7 @@ bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, const Identi
         if (current.attributesEqual(descriptor) && !descriptor.value())
             return true;
         object->methodTable()->deleteProperty(object, exec, propertyName);
-        return putDescriptor(exec, object, propertyName, descriptor, current.attributesWithOverride(descriptor), current);
+        return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
     }
 
     // Changing the accessor functions of an existing accessor property
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index c117cffaf..3f3d281cf 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -109,7 +109,7 @@ namespace JSC {
         bool allowsAccessFrom(ExecState*);
 
         JS_EXPORT_PRIVATE static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-        JS_EXPORT_PRIVATE static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue);
+        JS_EXPORT_PRIVATE static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
 
         // putDirect is effectively an unchecked vesion of 'defineOwnProperty':
         //  - the prototype chain is not consulted
@@ -834,21 +834,20 @@ inline JSValue JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot
 inline void JSValue::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (UNLIKELY(!isCell())) {
-        JSObject* thisObject = synthesizeObject(exec);
-        thisObject->methodTable()->put(thisObject, exec, propertyName, value, slot);
+        putToPrimitive(exec, propertyName, value, slot);
         return;
     }
     asCell()->methodTable()->put(asCell(), exec, propertyName, value, slot);
 }
 
-inline void JSValue::put(ExecState* exec, unsigned propertyName, JSValue value)
+inline void JSValue::putByIndex(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
 {
     if (UNLIKELY(!isCell())) {
-        JSObject* thisObject = synthesizeObject(exec);
-        thisObject->methodTable()->putByIndex(thisObject, exec, propertyName, value);
+        PutPropertySlot slot(shouldThrow);
+        putToPrimitive(exec, Identifier::from(exec, propertyName), value, slot);
         return;
     }
-    asCell()->methodTable()->putByIndex(asCell(), exec, propertyName, value);
+    asCell()->methodTable()->putByIndex(asCell(), exec, propertyName, value, shouldThrow);
 }
 
 // --- JSValue inlines ----------------------------
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index cfa7d03b4..e84ce3620 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -65,9 +65,10 @@ void JSString::resolveRope(ExecState* exec) const
 
     if (is8Bit()) {
         LChar* buffer;
-        if (RefPtr<StringImpl> newImpl = StringImpl::tryCreateUninitialized(m_length, buffer))
+        if (RefPtr<StringImpl> newImpl = StringImpl::tryCreateUninitialized(m_length, buffer)) {
+            Heap::heap(this)->reportExtraMemoryCost(newImpl->cost());
             m_value = newImpl.release();
-        else {
+        } else {
             outOfMemory(exec);
             return;
         }
@@ -92,9 +93,10 @@ void JSString::resolveRope(ExecState* exec) const
     }
 
     UChar* buffer;
-    if (RefPtr<StringImpl> newImpl = StringImpl::tryCreateUninitialized(m_length, buffer))
+    if (RefPtr<StringImpl> newImpl = StringImpl::tryCreateUninitialized(m_length, buffer)) {
+        Heap::heap(this)->reportExtraMemoryCost(newImpl->cost());
         m_value = newImpl.release();
-    else {
+    } else {
         outOfMemory(exec);
         return;
     }
diff --git a/Source/JavaScriptCore/runtime/JSStringBuilder.h b/Source/JavaScriptCore/runtime/JSStringBuilder.h
index b7e7e781e..1a2b812f0 100644
--- a/Source/JavaScriptCore/runtime/JSStringBuilder.h
+++ b/Source/JavaScriptCore/runtime/JSStringBuilder.h
@@ -29,7 +29,7 @@
 #include "ExceptionHelpers.h"
 #include "JSString.h"
 #include "UStringConcatenate.h"
-#include "Vector.h"
+#include <wtf/Vector.h>
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/runtime/JSValue.cpp b/Source/JavaScriptCore/runtime/JSValue.cpp
index e3843f02b..36697c60c 100644
--- a/Source/JavaScriptCore/runtime/JSValue.cpp
+++ b/Source/JavaScriptCore/runtime/JSValue.cpp
@@ -27,6 +27,7 @@
 #include "BooleanPrototype.h"
 #include "Error.h"
 #include "ExceptionHelpers.h"
+#include "GetterSetter.h"
 #include "JSGlobalObject.h"
 #include "JSFunction.h"
 #include "JSNotAnObject.h"
@@ -90,30 +91,85 @@ JSObject* JSValue::toThisObjectSlowCase(ExecState* exec) const
     return exec->globalThisValue();
 }
 
-JSObject* JSValue::synthesizeObject(ExecState* exec) const
+JSObject* JSValue::synthesizePrototype(ExecState* exec) const
 {
-    ASSERT(!isCell());
+    if (isCell()) {
+        ASSERT(isString());
+        return exec->lexicalGlobalObject()->stringPrototype();
+    }
+
     if (isNumber())
-        return constructNumber(exec, exec->lexicalGlobalObject(), asValue());
+        return exec->lexicalGlobalObject()->numberPrototype();
     if (isBoolean())
-        return constructBooleanFromImmediateBoolean(exec, exec->lexicalGlobalObject(), asValue());
+        return exec->lexicalGlobalObject()->booleanPrototype();
 
     ASSERT(isUndefinedOrNull());
     throwError(exec, createNotAnObjectError(exec, *this));
     return JSNotAnObject::create(exec);
 }
 
-JSObject* JSValue::synthesizePrototype(ExecState* exec) const
+// ECMA 8.7.2
+void JSValue::putToPrimitive(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    ASSERT(!isCell());
-    if (isNumber())
-        return exec->lexicalGlobalObject()->numberPrototype();
-    if (isBoolean())
-        return exec->lexicalGlobalObject()->booleanPrototype();
+    JSGlobalData& globalData = exec->globalData();
 
-    ASSERT(isUndefinedOrNull());
-    throwError(exec, createNotAnObjectError(exec, *this));
-    return JSNotAnObject::create(exec);
+    // Check if there are any setters or getters in the prototype chain
+    JSObject* obj = synthesizePrototype(exec);
+    JSValue prototype;
+    if (propertyName != exec->propertyNames().underscoreProto) {
+        for (; !obj->structure()->hasReadOnlyOrGetterSetterPropertiesExcludingProto(); obj = asObject(prototype)) {
+            prototype = obj->prototype();
+            if (prototype.isNull()) {
+                if (slot.isStrictMode())
+                    throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+                return;
+            }
+        }
+    }
+
+    for (; ; obj = asObject(prototype)) {
+        unsigned attributes;
+        JSCell* specificValue;
+        size_t offset = obj->structure()->get(globalData, propertyName, attributes, specificValue);
+        if (offset != WTF::notFound) {
+            if (attributes & ReadOnly) {
+                if (slot.isStrictMode())
+                    throwError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
+                return;
+            }
+
+            JSValue gs = obj->getDirectOffset(offset);
+            if (gs.isGetterSetter()) {
+                JSObject* setterFunc = asGetterSetter(gs)->setter();        
+                if (!setterFunc) {
+                    if (slot.isStrictMode())
+                        throwError(exec, createTypeError(exec, "setting a property that has only a getter"));
+                    return;
+                }
+                
+                CallData callData;
+                CallType callType = setterFunc->methodTable()->getCallData(setterFunc, callData);
+                MarkedArgumentBuffer args;
+                args.append(value);
+
+                // If this is WebCore's global object then we need to substitute the shell.
+                call(exec, setterFunc, callType, callData, *this, args);
+                return;
+            }
+
+            // If there's an existing property on the object or one of its 
+            // prototypes it should be replaced, so break here.
+            break;
+        }
+
+        prototype = obj->prototype();
+        if (prototype.isNull())
+            break;
+    }
+    
+    if (slot.isStrictMode())
+        throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+    return;
 }
 
 char* JSValue::description()
diff --git a/Source/JavaScriptCore/runtime/JSValue.h b/Source/JavaScriptCore/runtime/JSValue.h
index 9f797e05d..a6f359360 100644
--- a/Source/JavaScriptCore/runtime/JSValue.h
+++ b/Source/JavaScriptCore/runtime/JSValue.h
@@ -221,7 +221,8 @@ namespace JSC {
         JSValue get(ExecState*, unsigned propertyName) const;
         JSValue get(ExecState*, unsigned propertyName, PropertySlot&) const;
         void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-        void put(ExecState*, unsigned propertyName, JSValue);
+        void putToPrimitive(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        void putByIndex(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
 
         JSObject* toThisObject(ExecState*) const;
 
@@ -252,8 +253,6 @@ namespace JSC {
         JS_EXPORT_PRIVATE JSObject* toObjectSlowCase(ExecState*, JSGlobalObject*) const;
         JS_EXPORT_PRIVATE JSObject* toThisObjectSlowCase(ExecState*) const;
 
-        JSObject* synthesizeObject(ExecState*) const;
-
 #if USE(JSVALUE32_64)
         /*
          * On 32-bit platforms USE(JSVALUE32_64) should be defined, and we use a NaN-encoded
diff --git a/Source/JavaScriptCore/runtime/JSVariableObject.h b/Source/JavaScriptCore/runtime/JSVariableObject.h
index 8d058f1fc..bcfe4ab89 100644
--- a/Source/JavaScriptCore/runtime/JSVariableObject.h
+++ b/Source/JavaScriptCore/runtime/JSVariableObject.h
@@ -32,7 +32,7 @@
 #include "JSObject.h"
 #include "Register.h"
 #include "SymbolTable.h"
-#include "UnusedParam.h"
+#include <wtf/UnusedParam.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/UnusedParam.h>
 
diff --git a/Source/JavaScriptCore/runtime/NumberPrototype.cpp b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
index fb90bcd17..8f8c3c00f 100644
--- a/Source/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -29,7 +29,7 @@
 #include "JSString.h"
 #include "Operations.h"
 #include "Uint16WithFraction.h"
-#include "dtoa.h"
+#include <wtf/dtoa.h>
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
diff --git a/Source/JavaScriptCore/runtime/Options.cpp b/Source/JavaScriptCore/runtime/Options.cpp
index 5500508cf..c4bf39db4 100644
--- a/Source/JavaScriptCore/runtime/Options.cpp
+++ b/Source/JavaScriptCore/runtime/Options.cpp
@@ -45,6 +45,8 @@
 
 namespace JSC { namespace Options {
 
+bool useJIT;
+
 unsigned maximumOptimizationCandidateInstructionCount;
 
 unsigned maximumFunctionForCallInlineCandidateInstructionCount;
@@ -52,15 +54,12 @@ unsigned maximumFunctionForConstructInlineCandidateInstructionCount;
 
 unsigned maximumInliningDepth;
 
-int32_t executionCounterValueForJITAfterWarmUp;
-int32_t executionCounterValueForDontJITAnytimeSoon;
-int32_t executionCounterValueForJITSoon;
+int32_t thresholdForJITAfterWarmUp;
+int32_t thresholdForJITSoon;
 
-int32_t executionCounterValueForOptimizeAfterWarmUp;
-int32_t executionCounterValueForOptimizeAfterLongWarmUp;
-int32_t executionCounterValueForDontOptimizeAnytimeSoon;
-int32_t executionCounterValueForOptimizeSoon;
-int32_t executionCounterValueForOptimizeNextInvocation;
+int32_t thresholdForOptimizeAfterWarmUp;
+int32_t thresholdForOptimizeAfterLongWarmUp;
+int32_t thresholdForOptimizeSoon;
 
 int32_t executionCounterIncrementForLoop;
 int32_t executionCounterIncrementForReturn;
@@ -96,6 +95,19 @@ unsigned numberOfGCMarkers;
 unsigned opaqueRootMergeThreshold;
 
 #if ENABLE(RUN_TIME_HEURISTICS)
+static bool parse(const char* string, bool& value)
+{
+    if (!strcasecmp(string, "true") || !strcasecmp(string, "yes") || !strcmp(string, "1")) {
+        value = true;
+        return true;
+    }
+    if (!strcasecmp(string, "false") || !strcasecmp(string, "no") || !strcmp(string, "0")) {
+        value = false;
+        return true;
+    }
+    return false;
+}
+
 static bool parse(const char* string, int32_t& value)
 {
     return sscanf(string, "%d", &value) == 1;
@@ -134,22 +146,21 @@ void setHeuristic(T& variable, const char* name, U value)
 
 void initializeOptions()
 {
-    SET(maximumOptimizationCandidateInstructionCount, 1100);
+    SET(useJIT, true);
+    
+    SET(maximumOptimizationCandidateInstructionCount, 10000);
     
     SET(maximumFunctionForCallInlineCandidateInstructionCount, 180);
     SET(maximumFunctionForConstructInlineCandidateInstructionCount, 100);
     
     SET(maximumInliningDepth, 5);
 
-    SET(executionCounterValueForJITAfterWarmUp,     -100);
-    SET(executionCounterValueForDontJITAnytimeSoon, std::numeric_limits<int32_t>::min());
-    SET(executionCounterValueForJITSoon,            -100);
+    SET(thresholdForJITAfterWarmUp,     100);
+    SET(thresholdForJITSoon,            100);
 
-    SET(executionCounterValueForOptimizeAfterWarmUp,     -1000);
-    SET(executionCounterValueForOptimizeAfterLongWarmUp, -5000);
-    SET(executionCounterValueForDontOptimizeAnytimeSoon, std::numeric_limits<int32_t>::min());
-    SET(executionCounterValueForOptimizeSoon,            -1000);
-    SET(executionCounterValueForOptimizeNextInvocation,  0);
+    SET(thresholdForOptimizeAfterWarmUp,     1000);
+    SET(thresholdForOptimizeAfterLongWarmUp, 5000);
+    SET(thresholdForOptimizeSoon,            1000);
 
     SET(executionCounterIncrementForLoop,   1);
     SET(executionCounterIncrementForReturn, 15);
@@ -193,15 +204,11 @@ void initializeOptions()
     if (cpusToUse < 1)
         cpusToUse = 1;
     
-    cpusToUse = 1;
-    
     SET(numberOfGCMarkers, cpusToUse);
 
-    ASSERT(executionCounterValueForDontOptimizeAnytimeSoon <= executionCounterValueForOptimizeAfterLongWarmUp);
-    ASSERT(executionCounterValueForOptimizeAfterLongWarmUp <= executionCounterValueForOptimizeAfterWarmUp);
-    ASSERT(executionCounterValueForOptimizeAfterWarmUp <= executionCounterValueForOptimizeSoon);
-    ASSERT(executionCounterValueForOptimizeAfterWarmUp < 0);
-    ASSERT(executionCounterValueForOptimizeSoon <= executionCounterValueForOptimizeNextInvocation);
+    ASSERT(thresholdForOptimizeAfterLongWarmUp >= thresholdForOptimizeAfterWarmUp);
+    ASSERT(thresholdForOptimizeAfterWarmUp >= thresholdForOptimizeSoon);
+    ASSERT(thresholdForOptimizeAfterWarmUp >= 0);
     
     // Compute the maximum value of the reoptimization retry counter. This is simply
     // the largest value at which we don't overflow the execute counter, when using it
@@ -209,11 +216,11 @@ void initializeOptions()
     // up being 18, so this loop is not so terrible; it probably takes up ~100 cycles
     // total on a 32-bit processor.
     reoptimizationRetryCounterMax = 0;
-    while ((static_cast<int64_t>(executionCounterValueForOptimizeAfterLongWarmUp) << (reoptimizationRetryCounterMax + 1)) >= static_cast<int64_t>(std::numeric_limits<int32_t>::min()))
+    while ((static_cast<int64_t>(thresholdForOptimizeAfterLongWarmUp) << (reoptimizationRetryCounterMax + 1)) <= static_cast<int64_t>(std::numeric_limits<int32_t>::max()))
         reoptimizationRetryCounterMax++;
     
-    ASSERT((static_cast<int64_t>(executionCounterValueForOptimizeAfterLongWarmUp) << reoptimizationRetryCounterMax) < 0);
-    ASSERT((static_cast<int64_t>(executionCounterValueForOptimizeAfterLongWarmUp) << reoptimizationRetryCounterMax) >= static_cast<int64_t>(std::numeric_limits<int32_t>::min()));
+    ASSERT((static_cast<int64_t>(thresholdForOptimizeAfterLongWarmUp) << reoptimizationRetryCounterMax) > 0);
+    ASSERT((static_cast<int64_t>(thresholdForOptimizeAfterLongWarmUp) << reoptimizationRetryCounterMax) <= static_cast<int64_t>(std::numeric_limits<int32_t>::max()));
 }
 
 } } // namespace JSC::Options
diff --git a/Source/JavaScriptCore/runtime/Options.h b/Source/JavaScriptCore/runtime/Options.h
index b9e68f90c..fae6a7376 100644
--- a/Source/JavaScriptCore/runtime/Options.h
+++ b/Source/JavaScriptCore/runtime/Options.h
@@ -30,6 +30,8 @@
 
 namespace JSC { namespace Options {
 
+extern bool useJIT;
+
 extern unsigned maximumOptimizationCandidateInstructionCount;
 
 extern unsigned maximumFunctionForCallInlineCandidateInstructionCount;
@@ -37,15 +39,13 @@ extern unsigned maximumFunctionForConstructInlineCandidateInstructionCount;
 
 extern unsigned maximumInliningDepth; // Depth of inline stack, so 1 = no inlining, 2 = one level, etc.
 
-extern int32_t executionCounterValueForJITAfterWarmUp;
-extern int32_t executionCounterValueForDontJITAnytimeSoon;
-extern int32_t executionCounterValueForJITSoon;
+extern int32_t thresholdForJITAfterWarmUp;
+extern int32_t thresholdForJITSoon;
 
-extern int32_t executionCounterValueForOptimizeAfterWarmUp;
-extern int32_t executionCounterValueForOptimizeAfterLongWarmUp;
-extern int32_t executionCounterValueForDontOptimizeAnytimeSoon;
-extern int32_t executionCounterValueForOptimizeSoon;
-extern int32_t executionCounterValueForOptimizeNextInvocation;
+extern int32_t thresholdForOptimizeAfterWarmUp;
+extern int32_t thresholdForOptimizeAfterLongWarmUp;
+extern int32_t thresholdForOptimizeSoon;
+extern int32_t thresholdForOptimizeNextInvocation;
 
 extern int32_t executionCounterIncrementForLoop;
 extern int32_t executionCounterIncrementForReturn;
diff --git a/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp b/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
index 0cb629584..236a8e5ae 100644
--- a/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
+++ b/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
@@ -206,22 +206,6 @@ bool PropertyDescriptor::attributesEqual(const PropertyDescriptor& other) const
     return true;
 }
 
-unsigned PropertyDescriptor::attributesWithOverride(const PropertyDescriptor& other) const
-{
-    unsigned mismatch = other.m_attributes ^ m_attributes;
-    unsigned sharedSeen = other.m_seenAttributes & m_seenAttributes;
-    unsigned newAttributes = m_attributes & defaultAttributes;
-    if (sharedSeen & WritablePresent && mismatch & ReadOnly)
-        newAttributes ^= ReadOnly;
-    if (sharedSeen & ConfigurablePresent && mismatch & DontDelete)
-        newAttributes ^= DontDelete;
-    if (sharedSeen & EnumerablePresent && mismatch & DontEnum)
-        newAttributes ^= DontEnum;
-    if (isAccessorDescriptor() && other.isDataDescriptor())
-        newAttributes |= ReadOnly;
-    return newAttributes;
-}
-
 unsigned PropertyDescriptor::attributesOverridingCurrent(const PropertyDescriptor& current) const
 {
     unsigned currentAttributes = current.m_attributes;
diff --git a/Source/JavaScriptCore/runtime/PropertyDescriptor.h b/Source/JavaScriptCore/runtime/PropertyDescriptor.h
index 98af02e66..2c3878f57 100644
--- a/Source/JavaScriptCore/runtime/PropertyDescriptor.h
+++ b/Source/JavaScriptCore/runtime/PropertyDescriptor.h
@@ -70,7 +70,6 @@ namespace JSC {
         bool getterPresent() const { return m_getter; }
         bool equalTo(ExecState* exec, const PropertyDescriptor& other) const;
         bool attributesEqual(const PropertyDescriptor& other) const;
-        unsigned attributesWithOverride(const PropertyDescriptor& other) const;
         unsigned attributesOverridingCurrent(const PropertyDescriptor& current) const;
 
     private:
diff --git a/Source/JavaScriptCore/runtime/PropertySlot.cpp b/Source/JavaScriptCore/runtime/PropertySlot.cpp
index edabd7a6e..8ac874115 100644
--- a/Source/JavaScriptCore/runtime/PropertySlot.cpp
+++ b/Source/JavaScriptCore/runtime/PropertySlot.cpp
@@ -34,11 +34,7 @@ JSValue PropertySlot::functionGetter(ExecState* exec) const
 
     CallData callData;
     CallType callType = m_data.getterFunc->methodTable()->getCallData(m_data.getterFunc, callData);
-    
-    // Only objects can have accessor properties.
-    // If the base is WebCore's global object then we need to substitute the shell.
-    ASSERT(m_slotBase.isObject());
-    return call(exec, m_data.getterFunc, callType, callData, m_thisValue.toThisObject(exec), exec->emptyList());
+    return call(exec, m_data.getterFunc, callType, callData, m_thisValue.isObject() ? m_thisValue.toThisObject(exec) : m_thisValue, exec->emptyList());
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/RegExp.cpp b/Source/JavaScriptCore/runtime/RegExp.cpp
index 2b7feb4b5..1a3362b2d 100644
--- a/Source/JavaScriptCore/runtime/RegExp.cpp
+++ b/Source/JavaScriptCore/runtime/RegExp.cpp
@@ -363,7 +363,33 @@ int RegExp::match(JSGlobalData& globalData, const UString& s, unsigned startOffs
 #endif
     } else
 #endif
-        result = Yarr::interpret(m_representation->m_regExpBytecode.get(), s, startOffset, s.length(), offsetVector);
+        result = Yarr::interpret(m_representation->m_regExpBytecode.get(), s, startOffset, s.length(), reinterpret_cast<unsigned*>(offsetVector));
+
+    // FIXME: The YARR engine should handle unsigned or size_t length matches.
+    // The YARR Interpreter is "unsigned" clean, while the YARR JIT hasn't been addressed.
+    // The offset vector handling needs to change as well.
+    // Right now we convert a match where the offsets overflowed into match failure.
+    // There are two places in WebCore that call the interpreter directly that need to
+    // have their offsets changed to int as well. They are platform/text/RegularExpression.cpp
+    // and inspector/ContentSearchUtils.cpp.
+    if (s.length() > INT_MAX) {
+        bool overflowed = false;
+
+        if (result < -1)
+            overflowed = true;
+
+        for (unsigned i = 0; i <= m_numSubpatterns; i++) {
+            if ((offsetVector[i*2] < -1) || ((offsetVector[i*2] >= 0) && (offsetVector[i*2+1] < -1))) {
+                overflowed = true;
+                offsetVector[i*2] = -1;
+                offsetVector[i*2+1] = -1;
+            }
+        }
+
+        if (overflowed)
+            result = -1;
+    }
+
     ASSERT(result >= -1);
 
 #if REGEXP_FUNC_TEST_DATA_GEN
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
index 53e880e70..90082f07e 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -153,9 +153,9 @@ void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
     for (unsigned i = 0; i <= lastNumSubpatterns; ++i) {
         int start = m_regExpResult.ovector[2 * i];
         if (start >= 0)
-            JSArray::putByIndex(this, exec, i, jsSubstring(exec, m_regExpResult.input, start, m_regExpResult.ovector[2 * i + 1] - start));
+            putDirectIndex(exec, i, jsSubstring(exec, m_regExpResult.input, start, m_regExpResult.ovector[2 * i + 1] - start), false);
         else
-            JSArray::putByIndex(this, exec, i, jsUndefined());
+            putDirectIndex(exec, i, jsUndefined(), false);
     }
 
     PutPropertySlot slot;
diff --git a/Source/JavaScriptCore/runtime/RegExpMatchesArray.h b/Source/JavaScriptCore/runtime/RegExpMatchesArray.h
index c34920d8d..a3c4497fc 100644
--- a/Source/JavaScriptCore/runtime/RegExpMatchesArray.h
+++ b/Source/JavaScriptCore/runtime/RegExpMatchesArray.h
@@ -82,12 +82,12 @@ namespace JSC {
             JSArray::put(thisObject, exec, propertyName, v, slot);
         }
         
-        static void putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue v)
+        static void putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue v, bool shouldThrow)
         {
             RegExpMatchesArray* thisObject = jsCast<RegExpMatchesArray*>(cell);
             if (!thisObject->m_didFillArrayInstance)
                 thisObject->fillArrayInstance(exec);
-            JSArray::putByIndex(thisObject, exec, propertyName, v);
+            JSArray::putByIndex(thisObject, exec, propertyName, v, shouldThrow);
         }
 
         static bool deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName)
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.cpp b/Source/JavaScriptCore/runtime/RegExpObject.cpp
index 4c192ff90..a81799c46 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpObject.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2003, 2007, 2008, 2012 Apple Inc. All Rights Reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -40,8 +40,6 @@ static JSValue regExpObjectGlobal(ExecState*, JSValue, const Identifier&);
 static JSValue regExpObjectIgnoreCase(ExecState*, JSValue, const Identifier&);
 static JSValue regExpObjectMultiline(ExecState*, JSValue, const Identifier&);
 static JSValue regExpObjectSource(ExecState*, JSValue, const Identifier&);
-static JSValue regExpObjectLastIndex(ExecState*, JSValue, const Identifier&);
-static void setRegExpObjectLastIndex(ExecState*, JSObject*, JSValue);
 
 } // namespace JSC
 
@@ -59,14 +57,15 @@ const ClassInfo RegExpObject::s_info = { "RegExp", &JSNonFinalObject::s_info, 0,
     ignoreCase    regExpObjectIgnoreCase   DontDelete|ReadOnly|DontEnum
     multiline     regExpObjectMultiline    DontDelete|ReadOnly|DontEnum
     source        regExpObjectSource       DontDelete|ReadOnly|DontEnum
-    lastIndex     regExpObjectLastIndex    DontDelete|DontEnum
 @end
 */
 
 RegExpObject::RegExpObject(JSGlobalObject* globalObject, Structure* structure, RegExp* regExp)
     : JSNonFinalObject(globalObject->globalData(), structure)
-    , d(adoptPtr(new RegExpObjectData(globalObject->globalData(), this, regExp)))
+    , m_regExp(globalObject->globalData(), this, regExp)
+    , m_lastIndexIsWritable(true)
 {
+    m_lastIndex.setWithoutWriteBarrier(jsNumber(0));
 }
 
 void RegExpObject::finishCreation(JSGlobalObject* globalObject)
@@ -75,11 +74,6 @@ void RegExpObject::finishCreation(JSGlobalObject* globalObject)
     ASSERT(inherits(&s_info));
 }
 
-void RegExpObject::destroy(JSCell* cell)
-{
-    jsCast<RegExpObject*>(cell)->RegExpObject::~RegExpObject();
-}
-
 void RegExpObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
 {
     RegExpObject* thisObject = jsCast<RegExpObject*>(cell);
@@ -87,22 +81,87 @@ void RegExpObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
     COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
     Base::visitChildren(thisObject, visitor);
-    if (thisObject->d->regExp)
-        visitor.append(&thisObject->d->regExp);
-    if (UNLIKELY(!thisObject->d->lastIndex.get().isInt32()))
-        visitor.append(&thisObject->d->lastIndex);
+    if (thisObject->m_regExp)
+        visitor.append(&thisObject->m_regExp);
+    if (UNLIKELY(!thisObject->m_lastIndex.get().isInt32()))
+        visitor.append(&thisObject->m_lastIndex);
 }
 
 bool RegExpObject::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
+    if (propertyName == exec->propertyNames().lastIndex) {
+        RegExpObject* regExp = asRegExpObject(cell);
+        slot.setValue(regExp, regExp->getLastIndex());
+        return true;
+    }
     return getStaticValueSlot<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), jsCast<RegExpObject*>(cell), propertyName, slot);
 }
 
 bool RegExpObject::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
+    if (propertyName == exec->propertyNames().lastIndex) {
+        RegExpObject* regExp = asRegExpObject(object);
+        descriptor.setDescriptor(regExp->getLastIndex(), regExp->m_lastIndexIsWritable ? DontDelete | DontEnum : DontDelete | DontEnum | ReadOnly);
+        return true;
+    }
     return getStaticValueDescriptor<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), jsCast<RegExpObject*>(object), propertyName, descriptor);
 }
 
+bool RegExpObject::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName)
+{
+    if (propertyName == exec->propertyNames().lastIndex)
+        return false;
+    return Base::deleteProperty(cell, exec, propertyName);
+}
+
+void RegExpObject::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().lastIndex);
+    Base::getOwnPropertyNames(object, exec, propertyNames, mode);
+}
+
+void RegExpObject::getPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().lastIndex);
+    Base::getPropertyNames(object, exec, propertyNames, mode);
+}
+
+static bool reject(ExecState* exec, bool throwException, const char* message)
+{
+    if (throwException)
+        throwTypeError(exec, message);
+    return false;
+}
+
+bool RegExpObject::defineOwnProperty(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    if (propertyName == exec->propertyNames().lastIndex) {
+        RegExpObject* regExp = asRegExpObject(object);
+        if (descriptor.configurablePresent() && descriptor.configurable())
+            return reject(exec, shouldThrow, "Attempting to change configurable attribute of unconfigurable property.");
+        if (descriptor.enumerablePresent() && descriptor.enumerable())
+            return reject(exec, shouldThrow, "Attempting to change enumerable attribute of unconfigurable property.");
+        if (descriptor.isAccessorDescriptor())
+            return reject(exec, shouldThrow, "Attempting to change access mechanism for an unconfigurable property.");
+        if (!regExp->m_lastIndexIsWritable) {
+            if (descriptor.writablePresent() && descriptor.writable())
+                return reject(exec, shouldThrow, "Attempting to change writable attribute of unconfigurable property.");
+            if (!sameValue(exec, regExp->getLastIndex(), descriptor.value()))
+                return reject(exec, shouldThrow, "Attempting to change value of a readonly property.");
+            return true;
+        }
+        if (descriptor.writablePresent() && !descriptor.writable())
+            regExp->m_lastIndexIsWritable = false;
+        if (descriptor.value())
+            regExp->setLastIndex(exec, descriptor.value(), false);
+        return true;
+    }
+
+    return Base::defineOwnProperty(object, exec, propertyName, descriptor, shouldThrow);
+}
+
 JSValue regExpObjectGlobal(ExecState*, JSValue slotBase, const Identifier&)
 {
     return jsBoolean(asRegExpObject(slotBase)->regExp()->global());
@@ -127,6 +186,14 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, const Identifier&)
     bool inBrackets = false;
     bool shouldEscape = false;
 
+    // 15.10.6.4 specifies that RegExp.prototype.toString must return '/' + source + '/',
+    // and also states that the result must be a valid RegularExpressionLiteral. '//' is
+    // not a valid RegularExpressionLiteral (since it is a single line comment), and hence
+    // source cannot ever validly be "". If the source is empty, return a different Pattern
+    // that would match the same thing.
+    if (!length)
+        return jsString(exec, "(?:)");
+
     // early return for strings that don't contain a forwards slash and LineTerminator
     for (unsigned i = 0; i < length; ++i) {
         UChar ch = characters[i];
@@ -200,21 +267,15 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, const Identifier&)
     return jsString(exec, result.toUString());
 }
 
-JSValue regExpObjectLastIndex(ExecState*, JSValue slotBase, const Identifier&)
-{
-    return asRegExpObject(slotBase)->getLastIndex();
-}
-
 void RegExpObject::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
+    if (propertyName == exec->propertyNames().lastIndex) {
+        asRegExpObject(cell)->setLastIndex(exec, value, slot.isStrictMode());
+        return;
+    }
     lookupPut<RegExpObject, JSObject>(exec, propertyName, value, ExecState::regExpTable(exec), jsCast<RegExpObject*>(cell), slot);
 }
 
-void setRegExpObjectLastIndex(ExecState* exec, JSObject* baseObject, JSValue value)
-{
-    asRegExpObject(baseObject)->setLastIndex(exec->globalData(), value);
-}
-
 JSValue RegExpObject::test(ExecState* exec)
 {
     return jsBoolean(match(exec));
@@ -236,7 +297,7 @@ bool RegExpObject::match(ExecState* exec)
     if (!regExp()->global()) {
         int position;
         int length;
-        regExpConstructor->performMatch(*globalData, d->regExp.get(), input, 0, position, length);
+        regExpConstructor->performMatch(*globalData, m_regExp.get(), input, 0, position, length);
         return position >= 0;
     }
 
@@ -245,13 +306,13 @@ bool RegExpObject::match(ExecState* exec)
     if (LIKELY(jsLastIndex.isUInt32())) {
         lastIndex = jsLastIndex.asUInt32();
         if (lastIndex > input.length()) {
-            setLastIndex(0);
+            setLastIndex(exec, 0);
             return false;
         }
     } else {
         double doubleLastIndex = jsLastIndex.toInteger(exec);
         if (doubleLastIndex < 0 || doubleLastIndex > input.length()) {
-            setLastIndex(0);
+            setLastIndex(exec, 0);
             return false;
         }
         lastIndex = static_cast<unsigned>(doubleLastIndex);
@@ -259,13 +320,13 @@ bool RegExpObject::match(ExecState* exec)
 
     int position;
     int length = 0;
-    regExpConstructor->performMatch(*globalData, d->regExp.get(), input, lastIndex, position, length);
+    regExpConstructor->performMatch(*globalData, m_regExp.get(), input, lastIndex, position, length);
     if (position < 0) {
-        setLastIndex(0);
+        setLastIndex(exec, 0);
         return false;
     }
 
-    setLastIndex(position + length);
+    setLastIndex(exec, position + length);
     return true;
 }
 
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.h b/Source/JavaScriptCore/runtime/RegExpObject.h
index 081a7f111..456cfa683 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.h
+++ b/Source/JavaScriptCore/runtime/RegExpObject.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2003, 2007, 2008, 2012 Apple Inc. All Rights Reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -44,20 +44,27 @@ namespace JSC {
             return object;
         }
 
-        void setRegExp(JSGlobalData& globalData, RegExp* r) { d->regExp.set(globalData, this, r); }
-        RegExp* regExp() const { return d->regExp.get(); }
+        void setRegExp(JSGlobalData& globalData, RegExp* r) { m_regExp.set(globalData, this, r); }
+        RegExp* regExp() const { return m_regExp.get(); }
 
-        void setLastIndex(size_t lastIndex)
+        void setLastIndex(ExecState* exec, size_t lastIndex)
         {
-            d->lastIndex.setWithoutWriteBarrier(jsNumber(lastIndex));
+            m_lastIndex.setWithoutWriteBarrier(jsNumber(lastIndex));
+            if (LIKELY(m_lastIndexIsWritable))
+                m_lastIndex.setWithoutWriteBarrier(jsNumber(lastIndex));
+            else
+                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
         }
-        void setLastIndex(JSGlobalData& globalData, JSValue lastIndex)
+        void setLastIndex(ExecState* exec, JSValue lastIndex, bool shouldThrow)
         {
-            d->lastIndex.set(globalData, this, lastIndex);
+            if (LIKELY(m_lastIndexIsWritable))
+                m_lastIndex.set(exec->globalData(), this, lastIndex);
+            else if (shouldThrow)
+                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
         }
         JSValue getLastIndex() const
         {
-            return d->lastIndex.get();
+            return m_lastIndex.get();
         }
 
         JSValue test(ExecState*);
@@ -77,31 +84,22 @@ namespace JSC {
     protected:
         JS_EXPORT_PRIVATE RegExpObject(JSGlobalObject*, Structure*, RegExp*);
         JS_EXPORT_PRIVATE void finishCreation(JSGlobalObject*);
-        static void destroy(JSCell*);
 
         static const unsigned StructureFlags = OverridesVisitChildren | OverridesGetOwnPropertySlot | Base::StructureFlags;
 
         static void visitChildren(JSCell*, SlotVisitor&);
 
+        JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, ExecState*, const Identifier& propertyName);
+        JS_EXPORT_PRIVATE static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+        JS_EXPORT_PRIVATE static void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+        JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, const Identifier& propertyName, PropertyDescriptor&, bool shouldThrow);
+
     private:
         bool match(ExecState*);
 
-        struct RegExpObjectData {
-            WTF_MAKE_FAST_ALLOCATED;
-        public:
-            RegExpObjectData(JSGlobalData& globalData, RegExpObject* owner, RegExp* regExp)
-                : regExp(globalData, owner, regExp)
-            {
-                lastIndex.setWithoutWriteBarrier(jsNumber(0));
-            }
-
-            WriteBarrier<RegExp> regExp;
-            WriteBarrier<Unknown> lastIndex;
-        };
-#if COMPILER(MSVC)
-        friend void WTF::deleteOwnedPtr<RegExpObjectData>(RegExpObjectData*);
-#endif
-        OwnPtr<RegExpObjectData> d;
+        WriteBarrier<RegExp> m_regExp;
+        WriteBarrier<Unknown> m_lastIndex;
+        bool m_lastIndexIsWritable;
     };
 
     RegExpObject* asRegExpObject(JSValue);
diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
index 9074e97c3..8e4b5a9d5 100644
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -129,7 +129,7 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec)
         return throwVMError(exec, createSyntaxError(exec, regExp->errorMessage()));
 
     asRegExpObject(thisValue)->setRegExp(exec->globalData(), regExp);
-    asRegExpObject(thisValue)->setLastIndex(0);
+    asRegExpObject(thisValue)->setLastIndex(exec, 0);
     return JSValue::encode(jsUndefined());
 }
 
@@ -155,7 +155,7 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec)
         postfix[index] = 'm';
     UString source = thisObject->get(exec, exec->propertyNames().source).toString(exec)->value(exec);
     // If source is empty, use "/(?:)/" to avoid colliding with comment syntax
-    return JSValue::encode(jsMakeNontrivialString(exec, "/", source.length() ? source : UString("(?:)"), postfix));
+    return JSValue::encode(jsMakeNontrivialString(exec, "/", source, postfix));
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/StringObject.cpp b/Source/JavaScriptCore/runtime/StringObject.cpp
index 4a24698fb..d7e1c8a17 100644
--- a/Source/JavaScriptCore/runtime/StringObject.cpp
+++ b/Source/JavaScriptCore/runtime/StringObject.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "StringObject.h"
 
+#include "Error.h"
 #include "PropertyNameArray.h"
 
 namespace JSC {
@@ -68,11 +69,56 @@ bool StringObject::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, c
 
 void StringObject::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (propertyName == exec->propertyNames().length)
+    if (propertyName == exec->propertyNames().length) {
+        if (slot.isStrictMode())
+            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
         return;
+    }
     JSObject::put(cell, exec, propertyName, value, slot);
 }
 
+bool StringObject::defineOwnProperty(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool throwException)
+{
+    StringObject* thisObject = jsCast<StringObject*>(object);
+
+    if (propertyName == exec->propertyNames().length) {
+        if (!object->isExtensible()) {
+            if (throwException)
+                throwError(exec, createTypeError(exec, "Attempting to define property on object that is not extensible."));
+            return false;
+        }
+        if (descriptor.configurablePresent() && descriptor.configurable()) {
+            if (throwException)
+                throwError(exec, createTypeError(exec, "Attempting to configurable attribute of unconfigurable property."));
+            return false;
+        }
+        if (descriptor.enumerablePresent() && descriptor.enumerable()) {
+            if (throwException)
+                throwError(exec, createTypeError(exec, "Attempting to change enumerable attribute of unconfigurable property."));
+            return false;
+        }
+        if (descriptor.isAccessorDescriptor()) {
+            if (throwException)
+                throwError(exec, createTypeError(exec, "Attempting to change access mechanism for an unconfigurable property."));
+            return false;
+        }
+        if (descriptor.writablePresent() && descriptor.writable()) {
+            if (throwException)
+                throwError(exec, createTypeError(exec, "Attempting to change writable attribute of unconfigurable property."));
+            return false;
+        }
+        if (!descriptor.value())
+            return true;
+        if (propertyName == exec->propertyNames().length && sameValue(exec, descriptor.value(), jsNumber(thisObject->internalValue()->length())))
+            return true;
+        if (throwException)
+            throwError(exec, createTypeError(exec, "Attempting to change value of a readonly property."));
+        return false;
+    }
+
+    return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+}
+
 bool StringObject::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName)
 {
     StringObject* thisObject = jsCast<StringObject*>(cell);
diff --git a/Source/JavaScriptCore/runtime/StringObject.h b/Source/JavaScriptCore/runtime/StringObject.h
index 248c71601..bad5595c3 100644
--- a/Source/JavaScriptCore/runtime/StringObject.h
+++ b/Source/JavaScriptCore/runtime/StringObject.h
@@ -53,6 +53,7 @@ namespace JSC {
 
         static bool deleteProperty(JSCell*, ExecState*, const Identifier& propertyName);
         static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+        static bool defineOwnProperty(JSObject*, ExecState*, const Identifier& propertyName, PropertyDescriptor&, bool shouldThrow);
 
         static const JS_EXPORTDATA ClassInfo s_info;
 
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index 63c00e27e..708c1fb77 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -455,11 +455,19 @@ static NEVER_INLINE EncodedJSValue replaceUsingRegExpSearch(ExecState* exec, JSS
     unsigned sourceLen = source.length();
     if (exec->hadException())
         return JSValue::encode(JSValue());
-    RegExp* regExp = asRegExpObject(searchValue)->regExp();
+    RegExpObject* regExpObject = asRegExpObject(searchValue);
+    RegExp* regExp = regExpObject->regExp();
     bool global = regExp->global();
 
-    if (global && callType == CallTypeNone && !replacementString.length())
-        return removeUsingRegExpSearch(exec, string, source, regExp);
+    if (global) {
+        // ES5.1 15.5.4.10 step 8.a.
+        regExpObject->setLastIndex(exec, 0);
+        if (exec->hadException())
+            return JSValue::encode(JSValue());
+
+        if (callType == CallTypeNone && !replacementString.length())
+            return removeUsingRegExpSearch(exec, string, source, regExp);
+    }
 
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
 
@@ -808,9 +816,17 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec)
     JSValue a0 = exec->argument(0);
 
     RegExp* reg;
-    if (a0.inherits(&RegExpObject::s_info))
-        reg = asRegExpObject(a0)->regExp();
-    else {
+    bool global = false;
+    if (a0.inherits(&RegExpObject::s_info)) {
+        RegExpObject* regExpObject = asRegExpObject(a0);
+        reg = regExpObject->regExp();
+        if ((global = reg->global())) {
+            // ES5.1 15.5.4.10 step 8.a.
+            regExpObject->setLastIndex(exec, 0);
+            if (exec->hadException())
+                return JSValue::encode(JSValue());
+        }
+    } else {
         /*
          *  ECMA 15.5.4.12 String.prototype.search (regexp)
          *  If regexp is not an object whose [[Class]] property is "RegExp", it is
@@ -825,7 +841,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec)
     int pos;
     int matchLength = 0;
     regExpConstructor->performMatch(*globalData, reg, s, 0, pos, matchLength);
-    if (!(reg->global())) {
+    if (!global) {
         // case without 'g' flag is handled like RegExp.prototype.exec
         if (pos < 0)
             return JSValue::encode(jsNull());
@@ -948,7 +964,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
         if (separatorValue.isUndefined()) {
             // a. Call the [[DefineOwnProperty]] internal method of A with arguments "0",
             //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            result->methodTable()->putByIndex(result, exec, 0, jsStringWithReuse(exec, thisValue, input));
+            result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input), false);
             // b. Return A.
             return JSValue::encode(result);
         }
@@ -961,7 +977,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
             //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
             // d. Return A.
             if (reg->match(*globalData, input, 0) < 0)
-                result->methodTable()->putByIndex(result, exec, 0, jsStringWithReuse(exec, thisValue, input));
+                result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input), false);
             return JSValue::encode(result);
         }
 
@@ -992,7 +1008,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
             //    through q (exclusive).
             // 2. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA),
             //    Property Descriptor {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            result->methodTable()->putByIndex(result, exec, resultLength, jsSubstring(exec, input, position, matchPosition - position));
+            result->putDirectIndex(exec, resultLength, jsSubstring(exec, input, position, matchPosition - position), false);
             // 3. Increment lengthA by 1.
             // 4. If lengthA == lim, return A.
             if (++resultLength == limit)
@@ -1011,7 +1027,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
                 //   ToString(lengthA), Property Descriptor {[[Value]]: cap[i], [[Writable]]:
                 //   true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
                 int sub = ovector[i * 2];
-                result->methodTable()->putByIndex(result, exec, resultLength, sub < 0 ? jsUndefined() : jsSubstring(exec, input, sub, ovector[i * 2 + 1] - sub));
+                result->putDirectIndex(exec, resultLength, sub < 0 ? jsUndefined() : jsSubstring(exec, input, sub, ovector[i * 2 + 1] - sub), false);
                 // c Increment lengthA by 1.
                 // d If lengthA == lim, return A.
                 if (++resultLength == limit)
@@ -1030,7 +1046,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
         if (separatorValue.isUndefined()) {
             // a.  Call the [[DefineOwnProperty]] internal method of A with arguments "0",
             //     Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            result->methodTable()->putByIndex(result, exec, 0, jsStringWithReuse(exec, thisValue, input));
+            result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input), false);
             // b.  Return A.
             return JSValue::encode(result);
         }
@@ -1043,7 +1059,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
             //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
             // d. Return A.
             if (!separator.isEmpty())
-                result->methodTable()->putByIndex(result, exec, 0, jsStringWithReuse(exec, thisValue, input));
+                result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input), false);
             return JSValue::encode(result);
         }
 
@@ -1054,7 +1070,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
             ASSERT(limit);
 
             do {
-                result->methodTable()->putByIndex(result, exec, position, jsSingleCharacterSubstring(exec, input, position));
+                result->putDirectIndex(exec, position, jsSingleCharacterSubstring(exec, input, position), false);
             } while (++position < limit);
 
             return JSValue::encode(result);
@@ -1071,7 +1087,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
             //    through q (exclusive).
             // 2. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA),
             //    Property Descriptor {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            result->methodTable()->putByIndex(result, exec, resultLength, jsSubstring(exec, input, position, matchPosition - position));
+            result->putDirectIndex(exec, resultLength, jsSubstring(exec, input, position, matchPosition - position), false);
             // 3. Increment lengthA by 1.
             // 4. If lengthA == lim, return A.
             if (++resultLength == limit)
@@ -1087,7 +1103,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
     //     through s (exclusive).
     // 15. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA), Property Descriptor
     //     {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-    result->methodTable()->putByIndex(result, exec, resultLength++, jsSubstring(exec, input, position, input.length() - position));
+    result->putDirectIndex(exec, resultLength++, jsSubstring(exec, input, position, input.length() - position), false);
 
     // 16. Return A.
     return JSValue::encode(result);
diff --git a/Source/JavaScriptCore/runtime/SymbolTable.h b/Source/JavaScriptCore/runtime/SymbolTable.h
index 81731222b..f540a12c7 100644
--- a/Source/JavaScriptCore/runtime/SymbolTable.h
+++ b/Source/JavaScriptCore/runtime/SymbolTable.h
@@ -125,7 +125,7 @@ namespace JSC {
     public:
         static PassRefPtr<SharedSymbolTable> create() { return adoptRef(new SharedSymbolTable); }
     private:
-        SharedSymbolTable() { deprecatedTurnOffVerifier(); }
+        SharedSymbolTable() { turnOffVerifier(); }
     };
     
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/WriteBarrier.h b/Source/JavaScriptCore/runtime/WriteBarrier.h
index 7e9db12fb..05f3bc5bb 100644
--- a/Source/JavaScriptCore/runtime/WriteBarrier.h
+++ b/Source/JavaScriptCore/runtime/WriteBarrier.h
@@ -30,7 +30,7 @@
 #include "HandleTypes.h"
 #include "Heap.h"
 #include "SamplingCounter.h"
-#include "TypeTraits.h"
+#include <wtf/TypeTraits.h>
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/tests/mozilla/ecma/Array/15.4.5.1-1.js b/Source/JavaScriptCore/tests/mozilla/ecma/Array/15.4.5.1-1.js
index e57408b03..71a45e66e 100644
--- a/Source/JavaScriptCore/tests/mozilla/ecma/Array/15.4.5.1-1.js
+++ b/Source/JavaScriptCore/tests/mozilla/ecma/Array/15.4.5.1-1.js
@@ -104,6 +104,8 @@ function getTestCases() {
 
 
     for ( var i = 0X0020, TEST_STRING = "var A = new Array( " ; i < 0x00ff; i++ ) {
+        if ( i === 0x58 || i === 0x78 ) // x or X - skip testing invalid hex escapes.
+            continue;
         TEST_STRING += "\'\\"+ String.fromCharCode( i ) +"\'";
         if ( i < 0x00FF - 1   ) {
             TEST_STRING += ",";
@@ -112,7 +114,7 @@ function getTestCases() {
         }
     }
 
-    var LENGTH = 0x00ff - 0x0020;
+    var LENGTH = 0x00ff - 0x0020 - 2; // x & X
 
     array[item++] = new TestCase(   SECTION,
                                     TEST_STRING +" A[150] = 'hello'; A[150]",
diff --git a/Source/JavaScriptCore/tests/mozilla/ecma/LexicalConventions/7.7.4.js b/Source/JavaScriptCore/tests/mozilla/ecma/LexicalConventions/7.7.4.js
index 769b81989..d8e26afd5 100644
--- a/Source/JavaScriptCore/tests/mozilla/ecma/LexicalConventions/7.7.4.js
+++ b/Source/JavaScriptCore/tests/mozilla/ecma/LexicalConventions/7.7.4.js
@@ -170,9 +170,9 @@ function getTestCases() {
     array[item++] = new TestCase( SECTION, "\\x0F0",      String.fromCharCode(15)+"0",         "\x0F0" );
 
     // G is out of hex range
-
-    array[item++] = new TestCase( SECTION, "\\xG",        "xG",                                 "\xG" );
-    array[item++] = new TestCase( SECTION, "\\xCG",       "xCG",      				"\xCG" );
+// Invalid hex escapes are syntax error; these are covered in the sputnik test suite.
+//    array[item++] = new TestCase( SECTION, "\\xG",        "xG",                                 "\xG" );
+//    array[item++] = new TestCase( SECTION, "\\xCG",       "xCG",      				"\xCG" );
 
     // DoubleStringCharacter::EscapeSequence::CharacterEscapeSequence::\ NonEscapeCharacter
     array[item++] = new TestCase( SECTION, "\\a",    "a",        "\a" );
@@ -193,7 +193,8 @@ function getTestCases() {
     array[item++] = new TestCase( SECTION, "\\u",    "u",        "\u" );
 
     array[item++] = new TestCase( SECTION, "\\w",    "w",        "\w" );
-    array[item++] = new TestCase( SECTION, "\\x",    "x",        "\x" );
+// Invalid hex escapes are syntax error; these are covered in the sputnik test suite.
+//    array[item++] = new TestCase( SECTION, "\\x",    "x",        "\x" );
     array[item++] = new TestCase( SECTION, "\\y",    "y",        "\y" );
     array[item++] = new TestCase( SECTION, "\\z",    "z",        "\z" );
     array[item++] = new TestCase( SECTION, "\\9",    "9",        "\9" );
diff --git a/Source/JavaScriptCore/tests/mozilla/ecma/TypeConversion/9.3.1-3.js b/Source/JavaScriptCore/tests/mozilla/ecma/TypeConversion/9.3.1-3.js
index 69407fb5f..083226e5d 100644
--- a/Source/JavaScriptCore/tests/mozilla/ecma/TypeConversion/9.3.1-3.js
+++ b/Source/JavaScriptCore/tests/mozilla/ecma/TypeConversion/9.3.1-3.js
@@ -82,7 +82,7 @@ testcases[tc++] = new TestCase( SECTION,
 
 testcases[tc++] = new TestCase( SECTION,
     '- "-0x123456789abcde8"',
-    81985529216486880,
+    NaN,
     - "-0x123456789abcde8" );
 
 // Convert some large numbers to string
@@ -474,7 +474,7 @@ testcases[tc++] = new TestCase( SECTION,
 
 testcases[tc++] = new TestCase( SECTION,
                                 "parseInt(\"0022\")",
-                                18,
+                                22,
                                 parseInt("0022") );
 
 testcases[tc++] = new TestCase( SECTION,
@@ -664,7 +664,7 @@ testcases[tc++] = new TestCase( SECTION,
 
 testcases[tc++] = new TestCase( SECTION,
                                 "- \"-0x123456789abcde8\"",
-                                81985529216486880,
+                                NaN,
                                 - "-0x123456789abcde8" );
 
 // the following two tests are not strictly ECMA 1.0
diff --git a/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/constructor-001.js b/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/constructor-001.js
index be904e576..ceaa39d3d 100644
--- a/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/constructor-001.js
+++ b/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/constructor-001.js
@@ -40,7 +40,7 @@
 
     AddTestCase(
         "(new RegExp()).source",
-        "",
+        "(?:)",
         re.source );
 
     AddTestCase(
diff --git a/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/function-001.js b/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/function-001.js
index 67c4f21d4..96c3ccfdc 100644
--- a/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/function-001.js
+++ b/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/function-001.js
@@ -40,7 +40,7 @@
 
     AddTestCase(
         "(new RegExp()).source",
-        "",
+        "(?:)",
         re.source );
 
     AddTestCase(
diff --git a/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/hex-001.js b/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/hex-001.js
index 122d59cd3..4a04e944d 100644
--- a/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/hex-001.js
+++ b/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/hex-001.js
@@ -16,7 +16,8 @@
 
     AddRegExpCases( new RegExp("\x41"),  "new RegExp('\\x41')",  "A",  "A", 1, 0, ["A"] );
     AddRegExpCases( new RegExp("\x412"),"new RegExp('\\x412')", "A2", "A2", 1, 0, ["A2"] );
-    AddRegExpCases( new RegExp("\x1g"), "new RegExp('\\x1g')",  "x1g","x1g", 1, 0, ["x1g"] );
+// Invalid hex escapes are syntax error; these are covered in the sputnik test suite.
+//    AddRegExpCases( new RegExp("\x1g"), "new RegExp('\\x1g')",  "x1g","x1g", 1, 0, ["x1g"] );
 
     AddRegExpCases( new RegExp("A"),  "new RegExp('A')",  "\x41",  "\\x41",  1, 0, ["A"] );
     AddRegExpCases( new RegExp("A"),  "new RegExp('A')",  "\x412", "\\x412", 1, 0, ["A"] );
diff --git a/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/properties-001.js b/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/properties-001.js
index 3eb51cbcd..122b94171 100644
--- a/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/properties-001.js
+++ b/Source/JavaScriptCore/tests/mozilla/ecma_2/RegExp/properties-001.js
@@ -52,10 +52,6 @@ function AddRegExpCases( re, s, g, i, m, l ) {
 
     // properties
 
-    AddTestCase( re + ".source",
-                 s,
-                 re.source );
-
 /*
  * http://bugzilla.mozilla.org/show_bug.cgi?id=225550 changed
  * the behavior of toString() and toSource() on empty regexps.
@@ -63,6 +59,10 @@ function AddRegExpCases( re, s, g, i, m, l ) {
  */
     var S = s? s : '(?:)';
 
+    AddTestCase( re + ".source",
+                 S,
+                 re.source );
+
     AddTestCase( re + ".toString()",
                  "/" + S +"/" + (g?"g":"") + (i?"i":"") +(m?"m":""),
                  re.toString() );
diff --git a/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/hexadecimal.js b/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/hexadecimal.js
index 8f68c9ab9..14e555869 100644
--- a/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/hexadecimal.js
+++ b/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/hexadecimal.js
@@ -30,7 +30,7 @@
 	var SECTION = 'As described in Netscape doc "Whats new in JavaScript 1.2"';
 	var VERSION = 'no version';
     startTest();
-	var TITLE   = 'RegExp: \x# (hex) ';
+	var TITLE   = 'RegExp: \\x# (hex) ';
 
 	writeHeaderToLog('Executing script: hexadecimal.js');
 	writeHeaderToLog( SECTION + " "+ TITLE);
diff --git a/Source/JavaScriptCore/tests/mozilla/js1_6/Array/regress-304828.js b/Source/JavaScriptCore/tests/mozilla/js1_6/Array/regress-304828.js
index 5cab4a75d..fb751e555 100644
--- a/Source/JavaScriptCore/tests/mozilla/js1_6/Array/regress-304828.js
+++ b/Source/JavaScriptCore/tests/mozilla/js1_6/Array/regress-304828.js
@@ -100,7 +100,7 @@ reportCompare('abc', value, summary + ': push');
 
 // pop
 value  = 'abc';
-expect = 'c';
+expect = 'TypeError: Unable to delete property.';
 try
 {
   actual = Array.prototype.pop.call(value);
@@ -128,7 +128,7 @@ reportCompare('def', value, summary + ': unshift');
 
 // shift
 value  = 'abc';
-expect = 'a';
+expect = 'TypeError: Unable to delete property.';
 try
 {
   actual = Array.prototype.shift.call(value);
@@ -142,7 +142,7 @@ reportCompare('abc', value, summary + ': shift');
 
 // splice
 value  = 'abc';
-expect = 'b';
+expect = 'TypeError: Unable to delete property.';
 try
 {
   actual = Array.prototype.splice.call(value, 1, 1) + '';
diff --git a/Source/JavaScriptCore/tools/CodeProfile.cpp b/Source/JavaScriptCore/tools/CodeProfile.cpp
index 349353eb2..beed4b2d5 100644
--- a/Source/JavaScriptCore/tools/CodeProfile.cpp
+++ b/Source/JavaScriptCore/tools/CodeProfile.cpp
@@ -30,7 +30,7 @@
 #include "CodeProfiling.h"
 #include "LinkBuffer.h"
 #include "ProfileTreeNode.h"
-#include "Vector.h"
+#include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
 
 #if PLATFORM(MAC)
diff --git a/Source/JavaScriptCore/tools/TieredMMapArray.h b/Source/JavaScriptCore/tools/TieredMMapArray.h
index fa6e5ae1f..03d9df2b7 100644
--- a/Source/JavaScriptCore/tools/TieredMMapArray.h
+++ b/Source/JavaScriptCore/tools/TieredMMapArray.h
@@ -26,7 +26,7 @@
 #ifndef TieredMMapArray_h
 #define TieredMMapArray_h
 
-#include "OSAllocator.h"
+#include <wtf/OSAllocator.h>
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/wscript b/Source/JavaScriptCore/wscript
index d6f1ae899..2093601df 100644
--- a/Source/JavaScriptCore/wscript
+++ b/Source/JavaScriptCore/wscript
@@ -33,7 +33,7 @@ def build(bld):
 
     import Options
 
-    jscore_excludes = ['jsc.cpp', 'ExecutableAllocatorPosix.cpp']
+    jscore_excludes = ['jsc.cpp', 'ExecutableAllocatorPosix.cpp', 'LLIntOffsetsExtractor.cpp']
     jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp', '*Symbian.cpp']))
     jscore_excludes.extend(get_excludes(jscore_dir, ['*None.cpp']))
 
diff --git a/Source/JavaScriptCore/wtf/AVLTree.h b/Source/JavaScriptCore/wtf/AVLTree.h
index ec8a63951..f2f82e170 100644
--- a/Source/JavaScriptCore/wtf/AVLTree.h
+++ b/Source/JavaScriptCore/wtf/AVLTree.h
@@ -32,7 +32,7 @@
 #ifndef AVL_TREE_H_
 #define AVL_TREE_H_
 
-#include "Assertions.h"
+#include <wtf/Assertions.h>
 #include <wtf/FixedArray.h>
 
 namespace WTF {
diff --git a/Source/JavaScriptCore/wtf/Alignment.h b/Source/JavaScriptCore/wtf/Alignment.h
index 9b443efc6..ac780b96e 100644
--- a/Source/JavaScriptCore/wtf/Alignment.h
+++ b/Source/JavaScriptCore/wtf/Alignment.h
@@ -21,7 +21,7 @@
 #ifndef WTF_Alignment_h
 #define WTF_Alignment_h
 
-#include "Platform.h"
+#include <wtf/Platform.h>
 #include <algorithm>
 
 namespace WTF {
diff --git a/Source/JavaScriptCore/wtf/AlwaysInline.h b/Source/JavaScriptCore/wtf/AlwaysInline.h
index de12ddd90..68b7ae1a8 100644
--- a/Source/JavaScriptCore/wtf/AlwaysInline.h
+++ b/Source/JavaScriptCore/wtf/AlwaysInline.h
@@ -20,4 +20,4 @@
 
 /* This file is no longer necessary, since all the functionality has been moved to Compiler.h. */
 
-#include "Platform.h"
+#include <wtf/Platform.h>
diff --git a/Source/JavaScriptCore/wtf/ArrayBuffer.h b/Source/JavaScriptCore/wtf/ArrayBuffer.h
index ee95f5bc6..3257df3d0 100644
--- a/Source/JavaScriptCore/wtf/ArrayBuffer.h
+++ b/Source/JavaScriptCore/wtf/ArrayBuffer.h
@@ -88,7 +88,7 @@ public:
     void addView(ArrayBufferView*);
     void removeView(ArrayBufferView*);
 
-    bool transfer(ArrayBufferContents&, Vector<RefPtr<ArrayBufferView> >& neuteredViews);
+    WTF_EXPORT_PRIVATE bool transfer(ArrayBufferContents&, Vector<RefPtr<ArrayBufferView> >& neuteredViews);
     bool isNeutered() { return !m_contents.m_data; }
 
     ~ArrayBuffer() { }
diff --git a/Source/JavaScriptCore/wtf/ArrayBufferView.h b/Source/JavaScriptCore/wtf/ArrayBufferView.h
index 24ce25a5e..f314dd56c 100644
--- a/Source/JavaScriptCore/wtf/ArrayBufferView.h
+++ b/Source/JavaScriptCore/wtf/ArrayBufferView.h
@@ -26,7 +26,7 @@
 #ifndef ArrayBufferView_h
 #define ArrayBufferView_h
 
-#include "ArrayBuffer.h"
+#include <wtf/ArrayBuffer.h>
 
 #include <algorithm>
 #include <limits.h>
@@ -36,7 +36,7 @@
 
 namespace WTF {
 
-class ArrayBufferView : public RefCounted<ArrayBufferView> {
+class WTF_EXPORT_PRIVATE_RTTI ArrayBufferView : public RefCounted<ArrayBufferView> {
   public:
     virtual bool isByteArray() const { return false; }
     virtual bool isUnsignedByteArray() const { return false; }
@@ -186,6 +186,8 @@ void ArrayBufferView::calculateOffsetAndLength(int start, int end, unsigned arra
         end += arraySize;
     if (end < 0)
         end = 0;
+    if (static_cast<unsigned>(end) > arraySize)
+        end = arraySize;
     if (end < start)
         end = start;
     *offset = static_cast<unsigned>(start);
diff --git a/Source/JavaScriptCore/wtf/Assertions.cpp b/Source/JavaScriptCore/wtf/Assertions.cpp
index 80afcf414..9e744d387 100644
--- a/Source/JavaScriptCore/wtf/Assertions.cpp
+++ b/Source/JavaScriptCore/wtf/Assertions.cpp
@@ -70,8 +70,15 @@ static void vprintf_stderr_common(const char* format, va_list args)
 #if PLATFORM(MAC)
     if (strstr(format, "%@")) {
         CFStringRef cfFormat = CFStringCreateWithCString(NULL, format, kCFStringEncodingUTF8);
-        CFStringRef str = CFStringCreateWithFormatAndArguments(NULL, NULL, cfFormat, args);
 
+#if COMPILER(CLANG)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wformat-nonliteral"
+#endif
+        CFStringRef str = CFStringCreateWithFormatAndArguments(NULL, NULL, cfFormat, args);
+#if COMPILER(CLANG)
+#pragma clang diagnostic pop
+#endif
         int length = CFStringGetMaximumSizeForEncoding(CFStringGetLength(str), kCFStringEncodingUTF8);
         char* buffer = (char*)malloc(length + 1);
 
diff --git a/Source/JavaScriptCore/wtf/Assertions.h b/Source/JavaScriptCore/wtf/Assertions.h
index e7358dccb..14b9091fd 100644
--- a/Source/JavaScriptCore/wtf/Assertions.h
+++ b/Source/JavaScriptCore/wtf/Assertions.h
@@ -42,7 +42,7 @@
    http://msdn2.microsoft.com/en-us/library/ms177415(VS.80).aspx
 */
 
-#include "Platform.h"
+#include <wtf/Platform.h>
 
 #include <stddef.h>
 
diff --git a/Source/JavaScriptCore/wtf/Atomics.h b/Source/JavaScriptCore/wtf/Atomics.h
index 5e10460c6..d30926897 100644
--- a/Source/JavaScriptCore/wtf/Atomics.h
+++ b/Source/JavaScriptCore/wtf/Atomics.h
@@ -59,9 +59,9 @@
 #ifndef Atomics_h
 #define Atomics_h
 
-#include "Platform.h"
-#include "StdLibExtras.h"
-#include "UnusedParam.h"
+#include <wtf/Platform.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/UnusedParam.h>
 
 #if OS(WINDOWS)
 #include <windows.h>
@@ -118,7 +118,11 @@ inline int atomicDecrement(int volatile* addend) { return __gnu_cxx::__exchange_
 
 #endif
 
+#if COMPILER(GCC) && !COMPILER(CLANG) // Work around a gcc bug 
+inline bool weakCompareAndSwap(volatile unsigned* location, unsigned expected, unsigned newValue) 
+#else
 inline bool weakCompareAndSwap(unsigned* location, unsigned expected, unsigned newValue)
+#endif
 {
 #if ENABLE(COMPARE_AND_SWAP)
     bool result;
@@ -181,7 +185,7 @@ inline bool weakCompareAndSwap(void*volatile* location, void* expected, void* ne
 #endif // ENABLE(COMPARE_AND_SWAP)
 }
 
-inline bool weakCompareAndSwap(volatile uintptr_t* location, uintptr_t expected, uintptr_t newValue)
+inline bool weakCompareAndSwapUIntPtr(volatile uintptr_t* location, uintptr_t expected, uintptr_t newValue)
 {
     return weakCompareAndSwap(reinterpret_cast<void*volatile*>(location), reinterpret_cast<void*>(expected), reinterpret_cast<void*>(newValue));
 }
diff --git a/Source/JavaScriptCore/wtf/Bitmap.h b/Source/JavaScriptCore/wtf/Bitmap.h
index d7e2528a3..76a2ca4b3 100644
--- a/Source/JavaScriptCore/wtf/Bitmap.h
+++ b/Source/JavaScriptCore/wtf/Bitmap.h
@@ -19,9 +19,9 @@
 #ifndef Bitmap_h
 #define Bitmap_h
 
-#include "Atomics.h"
-#include "FixedArray.h"
-#include "StdLibExtras.h"
+#include <wtf/Atomics.h>
+#include <wtf/FixedArray.h>
+#include <wtf/StdLibExtras.h>
 #include <stdint.h>
 #include <string.h>
 
diff --git a/Source/JavaScriptCore/wtf/BoundsCheckedPointer.h b/Source/JavaScriptCore/wtf/BoundsCheckedPointer.h
index d5d42fc1c..1f7caab63 100644
--- a/Source/JavaScriptCore/wtf/BoundsCheckedPointer.h
+++ b/Source/JavaScriptCore/wtf/BoundsCheckedPointer.h
@@ -29,8 +29,8 @@
 #ifndef WTF_BoundsCheckedPointer_h
 #define WTF_BoundsCheckedPointer_h
 
-#include "Assertions.h"
-#include "UnusedParam.h"
+#include <wtf/Assertions.h>
+#include <wtf/UnusedParam.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/CMakeLists.txt b/Source/JavaScriptCore/wtf/CMakeLists.txt
index 63fc59c73..72420128a 100644
--- a/Source/JavaScriptCore/wtf/CMakeLists.txt
+++ b/Source/JavaScriptCore/wtf/CMakeLists.txt
@@ -206,14 +206,9 @@ WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 WEBKIT_WRAP_SOURCELIST(${WTF_SOURCES})
 INCLUDE_DIRECTORIES(${WTF_INCLUDE_DIRECTORIES})
 ADD_DEFINITIONS(-DBUILDING_WTF)
-ADD_LIBRARY(${WTF_LIBRARY_NAME} ${WTF_LIBRARY_TYPE} ${WTF_HEADERS} ${WTF_SOURCES})
+ADD_LIBRARY(${WTF_LIBRARY_NAME} STATIC ${WTF_HEADERS} ${WTF_SOURCES})
 TARGET_LINK_LIBRARIES(${WTF_LIBRARY_NAME} ${WTF_LIBRARIES})
 
 IF (WTF_LINK_FLAGS)
     ADD_TARGET_PROPERTIES(${WTF_LIBRARY_NAME} LINK_FLAGS "${WTF_LINK_FLAGS}")
 ENDIF ()
-
-IF (SHARED_CORE)
-    SET_TARGET_PROPERTIES(${WTF_LIBRARY_NAME} PROPERTIES VERSION ${PROJECT_VERSION} SOVERSION ${PROJECT_VERSION_MAJOR})
-    INSTALL(TARGETS ${WTF_LIBRARY_NAME} DESTINATION lib)
-ENDIF ()
diff --git a/Source/JavaScriptCore/wtf/CheckedArithmetic.h b/Source/JavaScriptCore/wtf/CheckedArithmetic.h
index f90efae41..b18916538 100644
--- a/Source/JavaScriptCore/wtf/CheckedArithmetic.h
+++ b/Source/JavaScriptCore/wtf/CheckedArithmetic.h
@@ -26,8 +26,8 @@
 #ifndef CheckedArithmetic_h
 #define CheckedArithmetic_h
 
-#include "Assertions.h"
-#include "TypeTraits.h"
+#include <wtf/Assertions.h>
+#include <wtf/TypeTraits.h>
 
 #include <limits>
 #include <stdint.h>
diff --git a/Source/JavaScriptCore/wtf/DateMath.cpp b/Source/JavaScriptCore/wtf/DateMath.cpp
index dc503ca2a..cf601a5ec 100644
--- a/Source/JavaScriptCore/wtf/DateMath.cpp
+++ b/Source/JavaScriptCore/wtf/DateMath.cpp
@@ -935,6 +935,14 @@ double parseDateFromNullTerminatedCharacters(const char* dateString, bool& haveT
             }
         }
     }
+    
+    // The year may be after the time but before the time zone.
+    if (isASCIIDigit(*dateString) && year == -1) {
+        if (!parseLong(dateString, &newPosStr, 10, &year))
+            return std::numeric_limits<double>::quiet_NaN();
+        dateString = newPosStr;
+        skipSpacesAndComments(dateString);
+    }
 
     // Don't fail if the time zone is missing. 
     // Some websites omit the time zone (4275206).
@@ -987,10 +995,9 @@ double parseDateFromNullTerminatedCharacters(const char* dateString, bool& haveT
         if (!parseLong(dateString, &newPosStr, 10, &year))
             return std::numeric_limits<double>::quiet_NaN();
         dateString = newPosStr;
+        skipSpacesAndComments(dateString);
     }
 
-    skipSpacesAndComments(dateString);
-
     // Trailing garbage
     if (*dateString)
         return std::numeric_limits<double>::quiet_NaN();
diff --git a/Source/JavaScriptCore/wtf/Deque.h b/Source/JavaScriptCore/wtf/Deque.h
index 18eb10582..47c0dfffa 100644
--- a/Source/JavaScriptCore/wtf/Deque.h
+++ b/Source/JavaScriptCore/wtf/Deque.h
@@ -33,8 +33,8 @@
 // FIXME: Could move what Vector and Deque share into a separate file.
 // Deque doesn't actually use Vector.
 
-#include "PassTraits.h"
-#include "Vector.h"
+#include <wtf/PassTraits.h>
+#include <wtf/Vector.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/ExportMacros.h b/Source/JavaScriptCore/wtf/ExportMacros.h
index a6b3bce5a..4d3219329 100644
--- a/Source/JavaScriptCore/wtf/ExportMacros.h
+++ b/Source/JavaScriptCore/wtf/ExportMacros.h
@@ -30,7 +30,7 @@
 #ifndef ExportMacros_h
 #define ExportMacros_h
 
-#include "Platform.h"
+#include <wtf/Platform.h>
 
 // See note in wtf/Platform.h for more info on EXPORT_MACROS.
 #if USE(EXPORT_MACROS)
@@ -83,6 +83,14 @@
 #define WTF_EXPORT_PRIVATE WTF_IMPORT
 #endif
 
+// wxWebKit uses RTTI because wx itself does, so use a special macro for
+// extra exports it needs.
+#if PLATFORM(WX)
+#define WTF_EXPORT_PRIVATE_RTTI WTF_EXPORT_PRIVATE
+#else
+#define WTF_EXPORT_PRIVATE_RTTI
+#endif
+
 #define WTF_EXPORT_HIDDEN WTF_HIDDEN
 
 #define HIDDEN_INLINE WTF_EXPORT_HIDDEN inline
diff --git a/Source/JavaScriptCore/wtf/FastAllocBase.h b/Source/JavaScriptCore/wtf/FastAllocBase.h
index b9ab0cab1..a0804ad3d 100644
--- a/Source/JavaScriptCore/wtf/FastAllocBase.h
+++ b/Source/JavaScriptCore/wtf/FastAllocBase.h
@@ -88,10 +88,10 @@
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
-#include "Assertions.h"
-#include "FastMalloc.h"
-#include "StdLibExtras.h"
-#include "TypeTraits.h"
+#include <wtf/Assertions.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/TypeTraits.h>
 
 #define WTF_MAKE_FAST_ALLOCATED \
 public: \
diff --git a/Source/JavaScriptCore/wtf/FastMalloc.h b/Source/JavaScriptCore/wtf/FastMalloc.h
index b115908ba..871be3756 100644
--- a/Source/JavaScriptCore/wtf/FastMalloc.h
+++ b/Source/JavaScriptCore/wtf/FastMalloc.h
@@ -21,8 +21,8 @@
 #ifndef WTF_FastMalloc_h
 #define WTF_FastMalloc_h
 
-#include "Platform.h"
-#include "PossiblyNull.h"
+#include <wtf/Platform.h>
+#include <wtf/PossiblyNull.h>
 #include <stdlib.h>
 #include <new>
 
diff --git a/Source/JavaScriptCore/wtf/Float32Array.h b/Source/JavaScriptCore/wtf/Float32Array.h
index 230a768aa..55e61e006 100644
--- a/Source/JavaScriptCore/wtf/Float32Array.h
+++ b/Source/JavaScriptCore/wtf/Float32Array.h
@@ -27,7 +27,7 @@
 #ifndef Float32Array_h
 #define Float32Array_h
 
-#include "TypedArrayBase.h"
+#include <wtf/TypedArrayBase.h>
 #include <wtf/MathExtras.h>
 
 namespace WTF {
diff --git a/Source/JavaScriptCore/wtf/Float64Array.h b/Source/JavaScriptCore/wtf/Float64Array.h
index 46713556c..30633dbec 100644
--- a/Source/JavaScriptCore/wtf/Float64Array.h
+++ b/Source/JavaScriptCore/wtf/Float64Array.h
@@ -27,7 +27,7 @@
 #ifndef Float64Array_h
 #define Float64Array_h
 
-#include "TypedArrayBase.h"
+#include <wtf/TypedArrayBase.h>
 #include <wtf/MathExtras.h>
 
 namespace WTF {
diff --git a/Source/JavaScriptCore/wtf/Functional.h b/Source/JavaScriptCore/wtf/Functional.h
index bd0f3e282..bfc813b2a 100644
--- a/Source/JavaScriptCore/wtf/Functional.h
+++ b/Source/JavaScriptCore/wtf/Functional.h
@@ -26,10 +26,10 @@
 #ifndef WTF_Functional_h
 #define WTF_Functional_h
 
-#include "Assertions.h"
-#include "PassRefPtr.h"
-#include "RefPtr.h"
-#include "ThreadSafeRefCounted.h"
+#include <wtf/Assertions.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 #if PLATFORM(MAC) && COMPILER_SUPPORTS(BLOCKS)
 #include <objc/objc-runtime.h>
diff --git a/Source/JavaScriptCore/wtf/HashCountedSet.h b/Source/JavaScriptCore/wtf/HashCountedSet.h
index b97d8c8fd..cafb2649e 100644
--- a/Source/JavaScriptCore/wtf/HashCountedSet.h
+++ b/Source/JavaScriptCore/wtf/HashCountedSet.h
@@ -21,9 +21,9 @@
 #ifndef WTF_HashCountedSet_h
 #define WTF_HashCountedSet_h
 
-#include "Assertions.h"
-#include "HashMap.h"
-#include "Vector.h"
+#include <wtf/Assertions.h>
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/HashFunctions.h b/Source/JavaScriptCore/wtf/HashFunctions.h
index 2c66a2d9f..808b2b1e5 100644
--- a/Source/JavaScriptCore/wtf/HashFunctions.h
+++ b/Source/JavaScriptCore/wtf/HashFunctions.h
@@ -21,7 +21,7 @@
 #ifndef WTF_HashFunctions_h
 #define WTF_HashFunctions_h
 
-#include "RefPtr.h"
+#include <wtf/RefPtr.h>
 #include <stdint.h>
 
 namespace WTF {
diff --git a/Source/JavaScriptCore/wtf/HashMap.h b/Source/JavaScriptCore/wtf/HashMap.h
index 13e6d496d..be7e9ebed 100644
--- a/Source/JavaScriptCore/wtf/HashMap.h
+++ b/Source/JavaScriptCore/wtf/HashMap.h
@@ -21,7 +21,7 @@
 #ifndef WTF_HashMap_h
 #define WTF_HashMap_h
 
-#include "HashTable.h"
+#include <wtf/HashTable.h>
 
 namespace WTF {
 
@@ -486,6 +486,6 @@ namespace WTF {
 
 using WTF::HashMap;
 
-#include "RefPtrHashMap.h"
+#include <wtf/RefPtrHashMap.h>
 
 #endif /* WTF_HashMap_h */
diff --git a/Source/JavaScriptCore/wtf/HashSet.h b/Source/JavaScriptCore/wtf/HashSet.h
index 7fce19348..33cb14daa 100644
--- a/Source/JavaScriptCore/wtf/HashSet.h
+++ b/Source/JavaScriptCore/wtf/HashSet.h
@@ -21,8 +21,8 @@
 #ifndef WTF_HashSet_h
 #define WTF_HashSet_h
 
-#include "FastAllocBase.h"
-#include "HashTable.h"
+#include <wtf/FastAllocBase.h>
+#include <wtf/HashTable.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/HashTable.h b/Source/JavaScriptCore/wtf/HashTable.h
index cbcc09817..05722d9c5 100644
--- a/Source/JavaScriptCore/wtf/HashTable.h
+++ b/Source/JavaScriptCore/wtf/HashTable.h
@@ -22,13 +22,13 @@
 #ifndef WTF_HashTable_h
 #define WTF_HashTable_h
 
-#include "Alignment.h"
-#include "Assertions.h"
-#include "FastMalloc.h"
-#include "HashTraits.h"
-#include "StdLibExtras.h"
-#include "Threading.h"
-#include "ValueCheck.h"
+#include <wtf/Alignment.h>
+#include <wtf/Assertions.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/HashTraits.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Threading.h>
+#include <wtf/ValueCheck.h>
 
 namespace WTF {
 
@@ -310,7 +310,8 @@ namespace WTF {
         ~HashTable() 
         {
             invalidateIterators(); 
-            deallocateTable(m_table, m_tableSize); 
+            if (m_table)
+                deallocateTable(m_table, m_tableSize);
 #if CHECK_HASHTABLE_USE_AFTER_DESTRUCTION
             m_table = (ValueType*)(uintptr_t)0xbbadbeef;
 #endif
@@ -979,6 +980,9 @@ namespace WTF {
     void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::clear()
     {
         invalidateIterators();
+        if (!m_table)
+            return;
+
         deallocateTable(m_table, m_tableSize);
         m_table = 0;
         m_tableSize = 0;
@@ -1240,6 +1244,6 @@ namespace WTF {
 
 } // namespace WTF
 
-#include "HashIterators.h"
+#include <wtf/HashIterators.h>
 
 #endif // WTF_HashTable_h
diff --git a/Source/JavaScriptCore/wtf/HashTraits.h b/Source/JavaScriptCore/wtf/HashTraits.h
index e3783ed42..10f14d1af 100644
--- a/Source/JavaScriptCore/wtf/HashTraits.h
+++ b/Source/JavaScriptCore/wtf/HashTraits.h
@@ -21,9 +21,9 @@
 #ifndef WTF_HashTraits_h
 #define WTF_HashTraits_h
 
-#include "HashFunctions.h"
-#include "StdLibExtras.h"
-#include "TypeTraits.h"
+#include <wtf/HashFunctions.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/TypeTraits.h>
 #include <utility>
 #include <limits>
 
diff --git a/Source/JavaScriptCore/wtf/Int16Array.h b/Source/JavaScriptCore/wtf/Int16Array.h
index 34a52de90..df3dcc265 100644
--- a/Source/JavaScriptCore/wtf/Int16Array.h
+++ b/Source/JavaScriptCore/wtf/Int16Array.h
@@ -26,7 +26,7 @@
 #ifndef Int16Array_h
 #define Int16Array_h
 
-#include "IntegralTypedArrayBase.h"
+#include <wtf/IntegralTypedArrayBase.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/Int32Array.h b/Source/JavaScriptCore/wtf/Int32Array.h
index 0b61457b3..f3148c7bc 100644
--- a/Source/JavaScriptCore/wtf/Int32Array.h
+++ b/Source/JavaScriptCore/wtf/Int32Array.h
@@ -27,7 +27,7 @@
 #ifndef Int32Array_h
 #define Int32Array_h
 
-#include "IntegralTypedArrayBase.h"
+#include <wtf/IntegralTypedArrayBase.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/Int8Array.h b/Source/JavaScriptCore/wtf/Int8Array.h
index 6db7b6899..cb5d343e4 100644
--- a/Source/JavaScriptCore/wtf/Int8Array.h
+++ b/Source/JavaScriptCore/wtf/Int8Array.h
@@ -27,7 +27,7 @@
 #ifndef Int8Array_h
 #define Int8Array_h
 
-#include "IntegralTypedArrayBase.h"
+#include <wtf/IntegralTypedArrayBase.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/IntegralTypedArrayBase.h b/Source/JavaScriptCore/wtf/IntegralTypedArrayBase.h
index 48f82a361..f276400f8 100644
--- a/Source/JavaScriptCore/wtf/IntegralTypedArrayBase.h
+++ b/Source/JavaScriptCore/wtf/IntegralTypedArrayBase.h
@@ -27,7 +27,7 @@
 #ifndef IntegralTypedArrayBase_h
 #define IntegralTypedArrayBase_h
 
-#include "TypedArrayBase.h"
+#include <wtf/TypedArrayBase.h>
 #include <limits>
 #include <wtf/MathExtras.h>
 
diff --git a/Source/JavaScriptCore/wtf/ListHashSet.h b/Source/JavaScriptCore/wtf/ListHashSet.h
index 32bd23832..799466fa9 100644
--- a/Source/JavaScriptCore/wtf/ListHashSet.h
+++ b/Source/JavaScriptCore/wtf/ListHashSet.h
@@ -22,9 +22,9 @@
 #ifndef WTF_ListHashSet_h
 #define WTF_ListHashSet_h
 
-#include "HashSet.h"
-#include "OwnPtr.h"
-#include "PassOwnPtr.h"
+#include <wtf/HashSet.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/MainThread.h b/Source/JavaScriptCore/wtf/MainThread.h
index 4839c8117..24200779a 100644
--- a/Source/JavaScriptCore/wtf/MainThread.h
+++ b/Source/JavaScriptCore/wtf/MainThread.h
@@ -30,7 +30,7 @@
 #ifndef MainThread_h
 #define MainThread_h
 
-#include "Platform.h"
+#include <wtf/Platform.h>
 
 #include <stdint.h>
 
diff --git a/Source/JavaScriptCore/wtf/MetaAllocator.cpp b/Source/JavaScriptCore/wtf/MetaAllocator.cpp
index ac6cba8d1..649fbf2bc 100644
--- a/Source/JavaScriptCore/wtf/MetaAllocator.cpp
+++ b/Source/JavaScriptCore/wtf/MetaAllocator.cpp
@@ -64,6 +64,7 @@ MetaAllocatorHandle::MetaAllocatorHandle(MetaAllocator* allocator, void* start,
     ASSERT(allocator);
     ASSERT(start);
     ASSERT(sizeInBytes);
+    turnOffVerifier();
 }
 
 MetaAllocatorHandle::~MetaAllocatorHandle()
@@ -169,8 +170,6 @@ PassRefPtr<MetaAllocatorHandle> MetaAllocator::allocate(size_t sizeInBytes, void
 #endif
 
     MetaAllocatorHandle* handle = new MetaAllocatorHandle(this, start, sizeInBytes, ownerUID);
-    // FIXME: Implement a verifier scheme that groks MetaAllocatorHandles
-    handle->deprecatedTurnOffVerifier();
 
     if (UNLIKELY(!!m_tracker))
         m_tracker->notify(handle);
diff --git a/Source/JavaScriptCore/wtf/MetaAllocator.h b/Source/JavaScriptCore/wtf/MetaAllocator.h
index ffd55667e..8a73a3b03 100644
--- a/Source/JavaScriptCore/wtf/MetaAllocator.h
+++ b/Source/JavaScriptCore/wtf/MetaAllocator.h
@@ -29,15 +29,15 @@
 #ifndef WTF_MetaAllocator_h
 #define WTF_MetaAllocator_h
 
-#include "Assertions.h"
-#include "HashMap.h"
-#include "MetaAllocatorHandle.h"
-#include "Noncopyable.h"
-#include "PageBlock.h"
-#include "RedBlackTree.h"
-#include "RefCounted.h"
-#include "RefPtr.h"
-#include "TCSpinLock.h"
+#include <wtf/Assertions.h>
+#include <wtf/HashMap.h>
+#include <wtf/MetaAllocatorHandle.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PageBlock.h>
+#include <wtf/RedBlackTree.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/TCSpinLock.h>
 
 namespace WTF {
 
@@ -204,6 +204,7 @@ inline MetaAllocator::~MetaAllocator()
         freeFreeSpaceNode(node);
         node = next;
     }
+    m_lock.Finalize();
 #ifndef NDEBUG
     ASSERT(!m_mallocBalance);
 #endif
diff --git a/Source/JavaScriptCore/wtf/Noncopyable.h b/Source/JavaScriptCore/wtf/Noncopyable.h
index 9f93f173b..1e95cbb92 100644
--- a/Source/JavaScriptCore/wtf/Noncopyable.h
+++ b/Source/JavaScriptCore/wtf/Noncopyable.h
@@ -21,7 +21,7 @@
 #ifndef WTF_Noncopyable_h
 #define WTF_Noncopyable_h
 
-#include "Compiler.h"
+#include <wtf/Compiler.h>
 
 #if COMPILER_SUPPORTS(CXX_DELETED_FUNCTIONS)
     #define WTF_MAKE_NONCOPYABLE(ClassName) \
diff --git a/Source/JavaScriptCore/wtf/OwnArrayPtr.h b/Source/JavaScriptCore/wtf/OwnArrayPtr.h
index 0fc8e71b3..b3d72dfdb 100644
--- a/Source/JavaScriptCore/wtf/OwnArrayPtr.h
+++ b/Source/JavaScriptCore/wtf/OwnArrayPtr.h
@@ -21,10 +21,10 @@
 #ifndef WTF_OwnArrayPtr_h
 #define WTF_OwnArrayPtr_h
 
-#include "Assertions.h"
-#include "Noncopyable.h"
-#include "NullPtr.h"
-#include "PassOwnArrayPtr.h"
+#include <wtf/Assertions.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/NullPtr.h>
+#include <wtf/PassOwnArrayPtr.h>
 #include <algorithm>
 
 namespace WTF {
diff --git a/Source/JavaScriptCore/wtf/OwnPtr.h b/Source/JavaScriptCore/wtf/OwnPtr.h
index 097967964..326e3fd61 100644
--- a/Source/JavaScriptCore/wtf/OwnPtr.h
+++ b/Source/JavaScriptCore/wtf/OwnPtr.h
@@ -21,10 +21,10 @@
 #ifndef WTF_OwnPtr_h
 #define WTF_OwnPtr_h
 
-#include "Assertions.h"
-#include "NullPtr.h"
-#include "OwnPtrCommon.h"
-#include "TypeTraits.h"
+#include <wtf/Assertions.h>
+#include <wtf/NullPtr.h>
+#include <wtf/OwnPtrCommon.h>
+#include <wtf/TypeTraits.h>
 #include <algorithm>
 #include <memory>
 
diff --git a/Source/JavaScriptCore/wtf/PackedIntVector.h b/Source/JavaScriptCore/wtf/PackedIntVector.h
index 76fa48a1d..9289eb6b3 100644
--- a/Source/JavaScriptCore/wtf/PackedIntVector.h
+++ b/Source/JavaScriptCore/wtf/PackedIntVector.h
@@ -26,7 +26,7 @@
 #ifndef PackedIntVector_h
 #define PackedIntVector_h
 
-#include "BitVector.h"
+#include <wtf/BitVector.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/ParallelJobs.h b/Source/JavaScriptCore/wtf/ParallelJobs.h
index 92b9c5b5b..0923886ad 100644
--- a/Source/JavaScriptCore/wtf/ParallelJobs.h
+++ b/Source/JavaScriptCore/wtf/ParallelJobs.h
@@ -28,9 +28,9 @@
 #ifndef ParallelJobs_h
 #define ParallelJobs_h
 
-#include "Assertions.h"
-#include "Noncopyable.h"
-#include "RefPtr.h"
+#include <wtf/Assertions.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
 // Usage:
@@ -50,13 +50,13 @@
 //
 
 #if ENABLE(THREADING_GENERIC)
-#include "ParallelJobsGeneric.h"
+#include <wtf/ParallelJobsGeneric.h>
 
 #elif ENABLE(THREADING_OPENMP)
-#include "ParallelJobsOpenMP.h"
+#include <wtf/ParallelJobsOpenMP.h>
 
 #elif ENABLE(THREADING_LIBDISPATCH)
-#include "ParallelJobsLibdispatch.h"
+#include <wtf/ParallelJobsLibdispatch.h>
 
 #else
 #error "No parallel processing API for ParallelJobs"
diff --git a/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h b/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
index 3748f18c6..1db7343de 100644
--- a/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
+++ b/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
@@ -26,9 +26,9 @@
 #ifndef WTF_PassOwnArrayPtr_h
 #define WTF_PassOwnArrayPtr_h
 
-#include "Assertions.h"
-#include "NullPtr.h"
-#include "TypeTraits.h"
+#include <wtf/Assertions.h>
+#include <wtf/NullPtr.h>
+#include <wtf/TypeTraits.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/PassOwnPtr.h b/Source/JavaScriptCore/wtf/PassOwnPtr.h
index 262ac3bfe..5ebf83d65 100644
--- a/Source/JavaScriptCore/wtf/PassOwnPtr.h
+++ b/Source/JavaScriptCore/wtf/PassOwnPtr.h
@@ -26,10 +26,10 @@
 #ifndef WTF_PassOwnPtr_h
 #define WTF_PassOwnPtr_h
 
-#include "Assertions.h"
-#include "NullPtr.h"
-#include "OwnPtrCommon.h"
-#include "TypeTraits.h"
+#include <wtf/Assertions.h>
+#include <wtf/NullPtr.h>
+#include <wtf/OwnPtrCommon.h>
+#include <wtf/TypeTraits.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/PassRefPtr.h b/Source/JavaScriptCore/wtf/PassRefPtr.h
index a13dee794..207721c96 100644
--- a/Source/JavaScriptCore/wtf/PassRefPtr.h
+++ b/Source/JavaScriptCore/wtf/PassRefPtr.h
@@ -21,8 +21,8 @@
 #ifndef WTF_PassRefPtr_h
 #define WTF_PassRefPtr_h
 
-#include "AlwaysInline.h"
-#include "NullPtr.h"
+#include <wtf/AlwaysInline.h>
+#include <wtf/NullPtr.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/PassTraits.h b/Source/JavaScriptCore/wtf/PassTraits.h
index 346273486..9564e3ad3 100644
--- a/Source/JavaScriptCore/wtf/PassTraits.h
+++ b/Source/JavaScriptCore/wtf/PassTraits.h
@@ -29,8 +29,8 @@
 #ifndef WTF_PassTraits_h
 #define WTF_PassTraits_h
 
-#include "OwnPtr.h"
-#include "RefPtr.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/RefPtr.h>
 
 // The PassTraits template exists to help optimize (or make possible) use
 // of WTF data structures with WTF smart pointers that have a Pass
diff --git a/Source/JavaScriptCore/wtf/Platform.h b/Source/JavaScriptCore/wtf/Platform.h
index 76b11fe88..c374b03c9 100644
--- a/Source/JavaScriptCore/wtf/Platform.h
+++ b/Source/JavaScriptCore/wtf/Platform.h
@@ -29,7 +29,7 @@
 #define WTF_Platform_h
 
 /* Include compiler specific macros */
-#include "Compiler.h"
+#include <wtf/Compiler.h>
 
 /* ==== PLATFORM handles OS, operating environment, graphics API, and
    CPU. This macro will be phased out in favor of platform adaptation
@@ -295,7 +295,7 @@
 
 #endif /* ARM */
 
-#if CPU(ARM) || CPU(MIPS) || CPU(SH4)
+#if CPU(ARM) || CPU(MIPS) || CPU(SH4) || CPU(SPARC)
 #define WTF_CPU_NEEDS_ALIGNED_ACCESS 1
 #endif
 
@@ -558,6 +558,9 @@
 #if defined(ENABLE_VIDEO)
 #define ENABLE_VIDEO_TRACK 1
 #endif
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+#define HAVE_LAYER_HOSTING_IN_WINDOW_SERVER 1
+#endif
 #endif /* PLATFORM(MAC) && !PLATFORM(IOS) */
 
 #if PLATFORM(CHROMIUM) && OS(DARWIN)
@@ -607,8 +610,9 @@
     #define ENABLE_JIT 0
     #define ENABLE_YARR_JIT 0
 #else
-    #define ENABLE_CLASSIC_INTERPRETER 1
+    #define ENABLE_CLASSIC_INTERPRETER 0
     #define ENABLE_JIT 1
+    #define ENABLE_LLINT 1
     #define ENABLE_YARR_JIT 1
 #endif
 
@@ -920,7 +924,7 @@
 #define ENABLE_JIT 0
 #endif
 
-/* The JIT is enabled by default on all x86, x64-64, ARM & MIPS platforms. */
+/* The JIT is enabled by default on all x86, x86-64, ARM & MIPS platforms. */
 #if !defined(ENABLE_JIT) \
     && (CPU(X86) || CPU(X86_64) || CPU(ARM) || CPU(MIPS)) \
     && (OS(DARWIN) || !COMPILER(GCC) || GCC_VERSION_AT_LEAST(4, 1, 0)) \
@@ -931,7 +935,7 @@
 
 /* On some of the platforms where we have a JIT, we want to also have the 
    low-level interpreter. */
-#if !defined(ENABLE_LLINT) && ENABLE(JIT) && OS(DARWIN) && (CPU(X86) || CPU(ARM_THUMB2)) && USE(JSVALUE32_64)
+#if !defined(ENABLE_LLINT) && ENABLE(JIT) && OS(DARWIN) && (CPU(X86) || CPU(X86_64) || CPU(ARM_THUMB2))
 #define ENABLE_LLINT 1
 #endif
 
@@ -1074,6 +1078,11 @@
 #define WTF_USE_ACCELERATED_COMPOSITING 1
 #endif
 
+/* Compositing on the UI-process in WebKit2 */
+#if PLATFORM(QT)
+#define WTF_USE_UI_SIDE_COMPOSITING 1
+#endif
+
 #if (PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD)) || PLATFORM(IOS)
 #define WTF_USE_PROTECTION_SPACE_AUTH_CALLBACK 1
 #endif
@@ -1098,6 +1107,10 @@
 #define WTF_USE_CROSS_PLATFORM_CONTEXT_MENUS 1
 #endif
 
+#if PLATFORM(MAC) && HAVE(ACCESSIBILITY)
+#define WTF_USE_ACCESSIBILITY_CONTEXT_MENUS 1
+#endif
+
 /* Geolocation request policy. pre-emptive policy is to acquire user permission before acquiring location.
    Client based implementations will have option to choose between pre-emptive and nonpre-emptive permission policy.
    pre-emptive permission policy is enabled by default for all client-based implementations. */
@@ -1118,7 +1131,7 @@
 #endif
 
 #if ENABLE(GLIB_SUPPORT)
-#include "GTypedefs.h"
+#include <wtf/gobject/GTypedefs.h>
 #endif
 
 /* FIXME: This define won't be needed once #27551 is fully landed. However, 
@@ -1194,4 +1207,8 @@
 #define WTF_USE_WTFURL 0
 #endif
 
+#if !PLATFORM(QT) && !PLATFORM(EFL)
+#define WTF_USE_ZLIB 1
+#endif
+
 #endif /* WTF_Platform_h */
diff --git a/Source/JavaScriptCore/wtf/PossiblyNull.h b/Source/JavaScriptCore/wtf/PossiblyNull.h
index 79c4d8200..46a7d713b 100644
--- a/Source/JavaScriptCore/wtf/PossiblyNull.h
+++ b/Source/JavaScriptCore/wtf/PossiblyNull.h
@@ -26,7 +26,7 @@
 #ifndef PossiblyNull_h
 #define PossiblyNull_h
 
-#include "Assertions.h"
+#include <wtf/Assertions.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/RefCounted.h b/Source/JavaScriptCore/wtf/RefCounted.h
index 51c5dc26e..cea1434e1 100644
--- a/Source/JavaScriptCore/wtf/RefCounted.h
+++ b/Source/JavaScriptCore/wtf/RefCounted.h
@@ -21,12 +21,12 @@
 #ifndef RefCounted_h
 #define RefCounted_h
 
-#include "Assertions.h"
-#include "FastAllocBase.h"
-#include "ThreadRestrictionVerifier.h"
-#include "Noncopyable.h"
-#include "OwnPtr.h"
-#include "UnusedParam.h"
+#include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/ThreadRestrictionVerifier.h>
+#include <wtf/UnusedParam.h>
 
 namespace WTF {
 
@@ -77,8 +77,15 @@ public:
 
     // Turns off verification. Use of this method is discouraged (instead extend
     // ThreadRestrictionVerifier to verify your case).
-    // FIXME: remove this method.
-    void deprecatedTurnOffVerifier()
+    // NB. It is necessary to call this in the constructor of many objects in
+    // JavaScriptCore, because JavaScriptCore objects may be used from multiple
+    // threads even if the reference counting is done in a racy manner. This is
+    // because a JSC instance may be used from multiple threads so long as all
+    // accesses into that instance are protected by a per-instance lock. It would
+    // be absolutely wrong to prohibit this pattern, and it would be a disastrous
+    // regression to require that the objects within that instance use a thread-
+    // safe version of reference counting.
+    void turnOffVerifier()
     {
 #ifndef NDEBUG
         m_verifier.turnOffVerification();
diff --git a/Source/JavaScriptCore/wtf/RefCountedArray.h b/Source/JavaScriptCore/wtf/RefCountedArray.h
new file mode 100644
index 000000000..2610a69b8
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/RefCountedArray.h
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RefCountedArray_h
+#define RefCountedArray_h
+
+#include <wtf/FastMalloc.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Vector.h>
+
+// This implements a reference counted array for POD** values, which is optimized for:
+// - An empty array only uses one word.
+// - A copy of the array only uses one word (i.e. assignment means aliasing).
+// - The vector can't grow beyond 2^32-1 elements.
+// - In all other regards this has similar space usage to a Vector.
+//
+// ** This could be modified to support non-POD values quite easily. It just
+//    hasn't been, so far, because there has been no need. Moreover, even now,
+//    it's used for things that aren't quite POD according to the official
+//    defintion, such as JSC::Instruction.
+
+namespace WTF {
+
+template<typename T>
+class RefCountedArray {
+public:
+    RefCountedArray()
+        : m_data(0)
+    {
+    }
+    
+    RefCountedArray(const RefCountedArray& other)
+        : m_data(other.m_data)
+    {
+        if (m_data)
+            Header::fromPayload(m_data)->refCount++;
+    }
+    
+    explicit RefCountedArray(const Vector<T>& other)
+    {
+        if (other.isEmpty()) {
+            m_data = 0;
+            return;
+        }
+        
+        m_data = (static_cast<Header*>(fastMalloc(Header::size() + sizeof(T) * other.size())))->payload();
+        Header::fromPayload(m_data)->refCount = 1;
+        Header::fromPayload(m_data)->length = other.size();
+        ASSERT(Header::fromPayload(m_data)->length == other.size());
+        memcpy(m_data, other.begin(), sizeof(T) * other.size());
+    }
+    
+    RefCountedArray& operator=(const RefCountedArray& other)
+    {
+        T* oldData = m_data;
+        m_data = other.m_data;
+        if (m_data)
+            Header::fromPayload(m_data)->refCount++;
+        
+        if (!oldData)
+            return *this;
+        if (--Header::fromPayload(oldData)->refCount)
+            return *this;
+        fastFree(Header::fromPayload(oldData));
+        return *this;
+    }
+    
+    ~RefCountedArray()
+    {
+        if (!m_data)
+            return;
+        if (--Header::fromPayload(m_data)->refCount)
+            return;
+        fastFree(Header::fromPayload(m_data));
+    }
+    
+    size_t size() const
+    {
+        if (!m_data)
+            return 0;
+        return Header::fromPayload(m_data)->length;
+    }
+    
+    T* data() { return m_data; }
+    T* begin() { return m_data; }
+    T* end()
+    {
+        if (!m_data)
+            return 0;
+        return m_data + Header::fromPayload(m_data)->length;
+    }
+    
+    const T* data() const { return m_data; }
+    const T* begin() const { return m_data; }
+    const T* end() const { return const_cast<RefCountedArray*>(this)->end(); }
+    
+    T& at(size_t i)
+    {
+        ASSERT(i < size());
+        return begin()[i];
+    }
+    
+    const T& at(size_t i) const
+    {
+        ASSERT(i < size());
+        return begin()[i];
+    }
+    
+    T& operator[](size_t i) { return at(i); }
+    const T& operator[](size_t i) const { return at(i); }
+    
+private:
+    struct Header {
+        unsigned refCount;
+        unsigned length;
+        
+        static size_t size()
+        {
+            return (sizeof(Header) + 7) & ~7;
+        }
+        
+        T* payload()
+        {
+            char* result = reinterpret_cast<char*>(this) + size();
+            ASSERT(!(bitwise_cast<uintptr_t>(result) & 7));
+            return reinterpret_cast<T*>(result);
+        }
+        
+        static Header* fromPayload(T* payload)
+        {
+            return reinterpret_cast_ptr<Header*>(reinterpret_cast<char*>(payload) - size());
+        }
+    };
+    
+    T* m_data;
+};
+
+} // namespace WTF
+
+using WTF::RefCountedArray;
+
+#endif // RefCountedArray_h
+
diff --git a/Source/JavaScriptCore/wtf/RefCountedLeakCounter.h b/Source/JavaScriptCore/wtf/RefCountedLeakCounter.h
index 476b1735a..8d894dd91 100644
--- a/Source/JavaScriptCore/wtf/RefCountedLeakCounter.h
+++ b/Source/JavaScriptCore/wtf/RefCountedLeakCounter.h
@@ -21,8 +21,8 @@
 #ifndef RefCountedLeakCounter_h
 #define RefCountedLeakCounter_h
  
-#include "Assertions.h"
-#include "Threading.h"
+#include <wtf/Assertions.h>
+#include <wtf/Threading.h>
 
 namespace WTF {
     
diff --git a/Source/JavaScriptCore/wtf/RefPtr.h b/Source/JavaScriptCore/wtf/RefPtr.h
index ac94993e3..70ab60003 100644
--- a/Source/JavaScriptCore/wtf/RefPtr.h
+++ b/Source/JavaScriptCore/wtf/RefPtr.h
@@ -24,8 +24,8 @@
 #define WTF_RefPtr_h
 
 #include <algorithm>
-#include "FastAllocBase.h"
-#include "PassRefPtr.h"
+#include <wtf/FastAllocBase.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/RetainPtr.h b/Source/JavaScriptCore/wtf/RetainPtr.h
index 3d4b0c3f9..a3489577a 100644
--- a/Source/JavaScriptCore/wtf/RetainPtr.h
+++ b/Source/JavaScriptCore/wtf/RetainPtr.h
@@ -21,9 +21,9 @@
 #ifndef RetainPtr_h
 #define RetainPtr_h
 
-#include "HashTraits.h"
-#include "NullPtr.h"
-#include "TypeTraits.h"
+#include <wtf/HashTraits.h>
+#include <wtf/NullPtr.h>
+#include <wtf/TypeTraits.h>
 #include <algorithm>
 
 #if USE(CF)
diff --git a/Source/JavaScriptCore/wtf/SimpleStats.h b/Source/JavaScriptCore/wtf/SimpleStats.h
new file mode 100644
index 000000000..f1fd7e10a
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/SimpleStats.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef SimpleStats_h
+#define SimpleStats_h
+
+#include <wtf/MathExtras.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WTF {
+
+// Simple and cheap way of tracking statistics if you're not worried about chopping on
+// the sum of squares (i.e. the sum of squares is unlikely to exceed 2^52).
+class SimpleStats {
+public:
+    SimpleStats()
+        : m_count(0)
+        , m_sum(0)
+        , m_sumOfSquares(0)
+    {
+    }
+    
+    void add(double value)
+    {
+        m_count++;
+        m_sum += value;
+        m_sumOfSquares += value * value;
+    }
+    
+    bool operator!() const
+    {
+        return !m_count;
+    }
+    
+    double count() const
+    {
+        return m_count;
+    }
+    
+    double sum() const
+    {
+        return m_sum;
+    }
+    
+    double sumOfSquares() const
+    {
+        return m_sumOfSquares;
+    }
+    
+    double mean() const
+    {
+        return m_sum / m_count;
+    }
+    
+    // NB. This gives a biased variance as it divides by the number of samples rather
+    // than the degrees of freedom. This is fine once the count grows large, which in
+    // our case will happen rather quickly.
+    double variance() const
+    {
+        if (m_count < 2)
+            return 0;
+        
+        // Compute <x^2> - <x>^2
+        double secondMoment = m_sumOfSquares / m_count;
+        double firstMoment = m_sum / m_count;
+        
+        return secondMoment - firstMoment * firstMoment;
+    }
+    
+    // NB. This gives a biased standard deviation. See above.
+    double standardDeviation() const
+    {
+        return sqrt(variance());
+    }
+    
+private:
+    double m_count;
+    double m_sum;
+    double m_sumOfSquares;
+};
+
+} // namespace WTF
+
+#endif // SimpleStats_h
+
diff --git a/Source/JavaScriptCore/wtf/Spectrum.h b/Source/JavaScriptCore/wtf/Spectrum.h
index c403eda18..59bc4a29a 100644
--- a/Source/JavaScriptCore/wtf/Spectrum.h
+++ b/Source/JavaScriptCore/wtf/Spectrum.h
@@ -26,8 +26,8 @@
 #ifndef Spectrum_h
 #define Spectrum_h
 
-#include "HashMap.h"
-#include "Vector.h"
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
 #include <algorithm>
 
 namespace WTF {
diff --git a/Source/JavaScriptCore/wtf/StdLibExtras.h b/Source/JavaScriptCore/wtf/StdLibExtras.h
index 2a0a9f950..0387e5b05 100644
--- a/Source/JavaScriptCore/wtf/StdLibExtras.h
+++ b/Source/JavaScriptCore/wtf/StdLibExtras.h
@@ -26,8 +26,8 @@
 #ifndef WTF_StdLibExtras_h
 #define WTF_StdLibExtras_h
 
-#include "CheckedArithmetic.h"
-#include "Assertions.h"
+#include <wtf/Assertions.h>
+#include <wtf/CheckedArithmetic.h>
 
 // Use these to declare and define a static local variable (static T;) so that
 //  it is leaked so that its destructors are not called at exit. Using this
diff --git a/Source/JavaScriptCore/wtf/TCPageMap.h b/Source/JavaScriptCore/wtf/TCPageMap.h
index 99bdc400e..92fe0b065 100644
--- a/Source/JavaScriptCore/wtf/TCPageMap.h
+++ b/Source/JavaScriptCore/wtf/TCPageMap.h
@@ -54,7 +54,7 @@
 #endif
 
 #include <string.h>
-#include "Assertions.h"
+#include <wtf/Assertions.h>
 
 // Single-level array
 template <int BITS>
diff --git a/Source/JavaScriptCore/wtf/TCSpinLock.h b/Source/JavaScriptCore/wtf/TCSpinLock.h
index 81b7d0cae..7f19b6c25 100644
--- a/Source/JavaScriptCore/wtf/TCSpinLock.h
+++ b/Source/JavaScriptCore/wtf/TCSpinLock.h
@@ -128,6 +128,7 @@ struct TCMalloc_SpinLock {
     }
 
     inline void Init() { lockword_ = 0; }
+    inline void Finalize() { }
 
     volatile unsigned int lockword_;
 };
@@ -221,6 +222,7 @@ struct TCMalloc_SpinLock {
     }
 
     inline void Init() { m_lockword = 0; }
+    inline void Finalize() { }
 
     LONG m_lockword;
 };
diff --git a/Source/JavaScriptCore/wtf/TemporaryChange.h b/Source/JavaScriptCore/wtf/TemporaryChange.h
index fe374b194..95df1728b 100644
--- a/Source/JavaScriptCore/wtf/TemporaryChange.h
+++ b/Source/JavaScriptCore/wtf/TemporaryChange.h
@@ -26,7 +26,7 @@
 #ifndef TemporaryChange_h
 #define TemporaryChange_h
 
-#include "Noncopyable.h"
+#include <wtf/Noncopyable.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h b/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h
index 8497b3bc2..44035e547 100644
--- a/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h
+++ b/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h
@@ -59,7 +59,7 @@
 #ifndef ThreadSafeRefCounted_h
 #define ThreadSafeRefCounted_h
 
-#include "Platform.h"
+#include <wtf/Platform.h>
 
 #include <wtf/Atomics.h>
 #include <wtf/DynamicAnnotations.h>
diff --git a/Source/JavaScriptCore/wtf/Threading.h b/Source/JavaScriptCore/wtf/Threading.h
index b5d432681..3e558fc68 100644
--- a/Source/JavaScriptCore/wtf/Threading.h
+++ b/Source/JavaScriptCore/wtf/Threading.h
@@ -59,7 +59,7 @@
 #ifndef Threading_h
 #define Threading_h
 
-#include "Platform.h"
+#include <wtf/Platform.h>
 
 #include <stdint.h>
 #include <wtf/Assertions.h>
diff --git a/Source/JavaScriptCore/wtf/ThreadingPrimitives.h b/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
index 2ac42c8f1..9ed38bc9f 100644
--- a/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
+++ b/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
@@ -31,7 +31,7 @@
 #ifndef ThreadingPrimitives_h
 #define ThreadingPrimitives_h
 
-#include "Platform.h"
+#include <wtf/Platform.h>
 
 #include <wtf/Assertions.h>
 #include <wtf/FastAllocBase.h>
diff --git a/Source/JavaScriptCore/wtf/TypeTraits.h b/Source/JavaScriptCore/wtf/TypeTraits.h
index 34e8b79a3..bfed2aa7b 100644
--- a/Source/JavaScriptCore/wtf/TypeTraits.h
+++ b/Source/JavaScriptCore/wtf/TypeTraits.h
@@ -22,7 +22,7 @@
 #ifndef TypeTraits_h
 #define TypeTraits_h
 
-#include "Platform.h"
+#include <wtf/Platform.h>
 
 #if (defined(__GLIBCXX__) && (__GLIBCXX__ >= 20070724) && defined(__GXX_EXPERIMENTAL_CXX0X__)) || (defined(_MSC_VER) && (_MSC_VER >= 1600))
 #include <type_traits>
diff --git a/Source/JavaScriptCore/wtf/TypedArrayBase.h b/Source/JavaScriptCore/wtf/TypedArrayBase.h
index dba95d55f..7f989198a 100644
--- a/Source/JavaScriptCore/wtf/TypedArrayBase.h
+++ b/Source/JavaScriptCore/wtf/TypedArrayBase.h
@@ -27,8 +27,8 @@
 #ifndef TypedArrayBase_h
 #define TypedArrayBase_h
 
-#include "ArrayBuffer.h"
-#include "ArrayBufferView.h"
+#include <wtf/ArrayBuffer.h>
+#include <wtf/ArrayBufferView.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/Uint16Array.h b/Source/JavaScriptCore/wtf/Uint16Array.h
index 2d0765051..e73c8ddff 100644
--- a/Source/JavaScriptCore/wtf/Uint16Array.h
+++ b/Source/JavaScriptCore/wtf/Uint16Array.h
@@ -27,7 +27,7 @@
 #ifndef Uint16Array_h
 #define Uint16Array_h
 
-#include "IntegralTypedArrayBase.h"
+#include <wtf/IntegralTypedArrayBase.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/Uint32Array.h b/Source/JavaScriptCore/wtf/Uint32Array.h
index 3765f8077..b2a391267 100644
--- a/Source/JavaScriptCore/wtf/Uint32Array.h
+++ b/Source/JavaScriptCore/wtf/Uint32Array.h
@@ -27,7 +27,7 @@
 #ifndef Uint32Array_h
 #define Uint32Array_h
 
-#include "IntegralTypedArrayBase.h"
+#include <wtf/IntegralTypedArrayBase.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/Uint8Array.h b/Source/JavaScriptCore/wtf/Uint8Array.h
index a0959706c..f46ef0fc0 100644
--- a/Source/JavaScriptCore/wtf/Uint8Array.h
+++ b/Source/JavaScriptCore/wtf/Uint8Array.h
@@ -27,7 +27,7 @@
 #ifndef Uint8Array_h
 #define Uint8Array_h
 
-#include "IntegralTypedArrayBase.h"
+#include <wtf/IntegralTypedArrayBase.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/Uint8ClampedArray.h b/Source/JavaScriptCore/wtf/Uint8ClampedArray.h
index f1044091b..2b77dacc3 100644
--- a/Source/JavaScriptCore/wtf/Uint8ClampedArray.h
+++ b/Source/JavaScriptCore/wtf/Uint8ClampedArray.h
@@ -28,7 +28,7 @@
 #ifndef Uint8ClampedArray_h
 #define Uint8ClampedArray_h
 
-#include "Uint8Array.h"
+#include <wtf/Uint8Array.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/UnusedParam.h b/Source/JavaScriptCore/wtf/UnusedParam.h
index 6ff6fd895..4b7234b8d 100644
--- a/Source/JavaScriptCore/wtf/UnusedParam.h
+++ b/Source/JavaScriptCore/wtf/UnusedParam.h
@@ -24,7 +24,7 @@
 /* don't use this for C++, it should only be used in plain C files or
    ObjC methods, where leaving off the parameter name is not allowed. */
 
-#include "Platform.h"
+#include <wtf/Platform.h>
 
 #if COMPILER(INTEL) && !OS(WINDOWS) || COMPILER(RVCT)
 template<typename T>
diff --git a/Source/JavaScriptCore/wtf/Vector.h b/Source/JavaScriptCore/wtf/Vector.h
index 29bbd37d9..19e6ffb8c 100644
--- a/Source/JavaScriptCore/wtf/Vector.h
+++ b/Source/JavaScriptCore/wtf/Vector.h
@@ -21,13 +21,13 @@
 #ifndef WTF_Vector_h
 #define WTF_Vector_h
 
-#include "Alignment.h"
-#include "FastAllocBase.h"
-#include "Noncopyable.h"
-#include "NotFound.h"
-#include "StdLibExtras.h"
-#include "ValueCheck.h"
-#include "VectorTraits.h"
+#include <wtf/Alignment.h>
+#include <wtf/FastAllocBase.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/NotFound.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/ValueCheck.h>
+#include <wtf/VectorTraits.h>
 #include <limits>
 #include <utility>
 
@@ -281,10 +281,14 @@ namespace WTF {
 
         void deallocateBuffer(T* bufferToDeallocate)
         {
+            if (!bufferToDeallocate)
+                return;
+            
             if (m_buffer == bufferToDeallocate) {
                 m_buffer = 0;
                 m_capacity = 0;
             }
+
             fastFree(bufferToDeallocate);
         }
 
diff --git a/Source/JavaScriptCore/wtf/VectorTraits.h b/Source/JavaScriptCore/wtf/VectorTraits.h
index 6777c9ebf..4041217ab 100644
--- a/Source/JavaScriptCore/wtf/VectorTraits.h
+++ b/Source/JavaScriptCore/wtf/VectorTraits.h
@@ -21,9 +21,9 @@
 #ifndef WTF_VectorTraits_h
 #define WTF_VectorTraits_h
 
-#include "OwnPtr.h"
-#include "RefPtr.h"
-#include "TypeTraits.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/TypeTraits.h>
 #include <utility>
 #include <memory>
 
diff --git a/Source/JavaScriptCore/wtf/WTFThreadData.cpp b/Source/JavaScriptCore/wtf/WTFThreadData.cpp
index 241fbe449..ec5de7220 100644
--- a/Source/JavaScriptCore/wtf/WTFThreadData.cpp
+++ b/Source/JavaScriptCore/wtf/WTFThreadData.cpp
@@ -51,4 +51,25 @@ WTFThreadData::~WTFThreadData()
 #endif
 }
 
+} // namespace WTF
+
+#if USE(JSC)
+namespace JSC {
+
+IdentifierTable::~IdentifierTable()
+{
+    HashSet<StringImpl*>::iterator end = m_table.end();
+    for (HashSet<StringImpl*>::iterator iter = m_table.begin(); iter != end; ++iter)
+        (*iter)->setIsIdentifier(false);
+}
+
+std::pair<HashSet<StringImpl*>::iterator, bool> IdentifierTable::add(StringImpl* value)
+{
+    std::pair<HashSet<StringImpl*>::iterator, bool> result = m_table.add(value);
+    (*result.first)->setIsIdentifier(true);
+    return result;
 }
+
+} // namespace JSC
+#endif
+
diff --git a/Source/JavaScriptCore/wtf/dtoa/double-conversion.h b/Source/JavaScriptCore/wtf/dtoa/double-conversion.h
index 4d6fc2f57..eec956a21 100644
--- a/Source/JavaScriptCore/wtf/dtoa/double-conversion.h
+++ b/Source/JavaScriptCore/wtf/dtoa/double-conversion.h
@@ -28,7 +28,7 @@
 #ifndef DOUBLE_CONVERSION_DOUBLE_CONVERSION_H_
 #define DOUBLE_CONVERSION_DOUBLE_CONVERSION_H_
 
-#include "utils.h"
+#include <wtf/dtoa/utils.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/dtoa/utils.h b/Source/JavaScriptCore/wtf/dtoa/utils.h
index 64e5ad42f..da6e13226 100644
--- a/Source/JavaScriptCore/wtf/dtoa/utils.h
+++ b/Source/JavaScriptCore/wtf/dtoa/utils.h
@@ -28,7 +28,7 @@
 #ifndef DOUBLE_CONVERSION_UTILS_H_
 #define DOUBLE_CONVERSION_UTILS_H_
 
-#include "Assertions.h"
+#include <wtf/Assertions.h>
 #include <stdlib.h>
 #include <string.h>
 
diff --git a/Source/JavaScriptCore/wtf/gobject/GRefPtr.cpp b/Source/JavaScriptCore/wtf/gobject/GRefPtr.cpp
index 1cd22c532..30df2c9a6 100644
--- a/Source/JavaScriptCore/wtf/gobject/GRefPtr.cpp
+++ b/Source/JavaScriptCore/wtf/gobject/GRefPtr.cpp
@@ -37,6 +37,32 @@ template <> void derefGPtr(GHashTable* ptr)
     g_hash_table_unref(ptr);
 }
 
+template <> GMainContext* refGPtr(GMainContext* ptr)
+{
+    if (ptr)
+        g_main_context_ref(ptr);
+    return ptr;
+}
+
+template <> void derefGPtr(GMainContext* ptr)
+{
+    if (ptr)
+        g_main_context_unref(ptr);
+}
+
+template <> GMainLoop* refGPtr(GMainLoop* ptr)
+{
+    if (ptr)
+        g_main_loop_ref(ptr);
+    return ptr;
+}
+
+template <> void derefGPtr(GMainLoop* ptr)
+{
+    if (ptr)
+        g_main_loop_unref(ptr);
+}
+
 #if GLIB_CHECK_VERSION(2, 24, 0)
 template <> GVariant* refGPtr(GVariant* ptr)
 {
diff --git a/Source/JavaScriptCore/wtf/gobject/GRefPtr.h b/Source/JavaScriptCore/wtf/gobject/GRefPtr.h
index 10ebf0753..92acffc0c 100644
--- a/Source/JavaScriptCore/wtf/gobject/GRefPtr.h
+++ b/Source/JavaScriptCore/wtf/gobject/GRefPtr.h
@@ -25,9 +25,8 @@
 
 #if ENABLE(GLIB_SUPPORT)
 
-#include "AlwaysInline.h"
-#include "GRefPtr.h"
-#include "RefPtr.h"
+#include <wtf/AlwaysInline.h>
+#include <wtf/RefPtr.h>
 #include <algorithm>
 
 extern "C" void g_object_unref(gpointer);
@@ -201,6 +200,10 @@ template <typename T> GRefPtr<T> adoptGRef(T* p)
 
 template <> GHashTable* refGPtr(GHashTable* ptr);
 template <> void derefGPtr(GHashTable* ptr);
+template <> GMainContext* refGPtr(GMainContext* ptr);
+template <> void derefGPtr(GMainContext* ptr);
+template <> GMainLoop* refGPtr(GMainLoop* ptr);
+template <> void derefGPtr(GMainLoop* ptr);
 template <> GVariant* refGPtr(GVariant* ptr);
 template <> void derefGPtr(GVariant* ptr);
 template <> GSource* refGPtr(GSource* ptr);
diff --git a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
index cb3842b78..e29250bef 100644
--- a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
+++ b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
@@ -51,6 +51,8 @@ typedef struct _GFile GFile;
 typedef struct _GHashTable GHashTable;
 typedef struct _GInputStream GInputStream;
 typedef struct _GList GList;
+typedef struct _GMainContext GMainContext;
+typedef struct _GMainLoop GMainLoop;
 typedef struct _GPatternSpec GPatternSpec;
 typedef struct _GPollableOutputStream GPollableOutputStream;
 typedef struct _GSList GSList;
diff --git a/Source/JavaScriptCore/wtf/gobject/GlibUtilities.h b/Source/JavaScriptCore/wtf/gobject/GlibUtilities.h
index 5577bf58e..ce10a05c8 100644
--- a/Source/JavaScriptCore/wtf/gobject/GlibUtilities.h
+++ b/Source/JavaScriptCore/wtf/gobject/GlibUtilities.h
@@ -20,8 +20,8 @@
 #ifndef GlibUtilities_h
 #define GlibUtilities_h
 
-#include "Assertions.h"
-#include "CString.h"
+#include <wtf/Assertions.h>
+#include <wtf/text/CString.h>
 
 CString getCurrentExecutablePath();
 
diff --git a/Source/JavaScriptCore/wtf/text/AtomicString.h b/Source/JavaScriptCore/wtf/text/AtomicString.h
index b135845fe..e7323f94a 100644
--- a/Source/JavaScriptCore/wtf/text/AtomicString.h
+++ b/Source/JavaScriptCore/wtf/text/AtomicString.h
@@ -21,8 +21,8 @@
 #ifndef AtomicString_h
 #define AtomicString_h
 
-#include "AtomicStringImpl.h"
-#include "WTFString.h"
+#include <wtf/text/AtomicStringImpl.h>
+#include <wtf/text/WTFString.h>
 
 // Define 'NO_IMPLICIT_ATOMICSTRING' before including this header,
 // to disallow (expensive) implicit String-->AtomicString conversions.
@@ -213,5 +213,5 @@ using WTF::xmlAtom;
 using WTF::xmlnsAtom;
 #endif
 
-#include "StringConcatenate.h"
+#include <wtf/text/StringConcatenate.h>
 #endif // AtomicString_h
diff --git a/Source/JavaScriptCore/wtf/text/AtomicStringImpl.h b/Source/JavaScriptCore/wtf/text/AtomicStringImpl.h
index 3f0c37606..0716275a8 100644
--- a/Source/JavaScriptCore/wtf/text/AtomicStringImpl.h
+++ b/Source/JavaScriptCore/wtf/text/AtomicStringImpl.h
@@ -21,7 +21,7 @@
 #ifndef AtomicStringImpl_h
 #define AtomicStringImpl_h
 
-#include "StringImpl.h"
+#include <wtf/text/StringImpl.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/text/CString.h b/Source/JavaScriptCore/wtf/text/CString.h
index d43ad4bd7..9abfa70f7 100644
--- a/Source/JavaScriptCore/wtf/text/CString.h
+++ b/Source/JavaScriptCore/wtf/text/CString.h
@@ -26,9 +26,9 @@
 #ifndef CString_h
 #define CString_h
 
-#include "PassRefPtr.h"
-#include "RefCounted.h"
-#include "Vector.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/text/StringConcatenate.h b/Source/JavaScriptCore/wtf/text/StringConcatenate.h
index 08d67dcf0..479ed8ca2 100644
--- a/Source/JavaScriptCore/wtf/text/StringConcatenate.h
+++ b/Source/JavaScriptCore/wtf/text/StringConcatenate.h
@@ -27,7 +27,7 @@
 #define StringConcatenate_h
 
 #ifndef WTFString_h
-#include "AtomicString.h"
+#include <wtf/text/AtomicString.h>
 #endif
 
 // This macro is helpful for testing how many intermediate Strings are created while evaluating an
@@ -960,5 +960,5 @@ String makeString(StringType1 string1, StringType2 string2, StringType3 string3,
 
 using WTF::makeString;
 
-#include "StringOperators.h"
+#include <wtf/text/StringOperators.h>
 #endif
diff --git a/Source/JavaScriptCore/wtf/text/StringHash.h b/Source/JavaScriptCore/wtf/text/StringHash.h
index 1b7a2ee2c..acc97b995 100644
--- a/Source/JavaScriptCore/wtf/text/StringHash.h
+++ b/Source/JavaScriptCore/wtf/text/StringHash.h
@@ -22,8 +22,8 @@
 #ifndef StringHash_h
 #define StringHash_h
 
-#include "AtomicString.h"
-#include "WTFString.h"
+#include <wtf/text/AtomicString.h>
+#include <wtf/text/WTFString.h>
 #include <wtf/Forward.h>
 #include <wtf/HashTraits.h>
 #include <wtf/StringHasher.h>
diff --git a/Source/JavaScriptCore/wtf/text/WTFString.h b/Source/JavaScriptCore/wtf/text/WTFString.h
index edc842154..85e223f9e 100644
--- a/Source/JavaScriptCore/wtf/text/WTFString.h
+++ b/Source/JavaScriptCore/wtf/text/WTFString.h
@@ -25,8 +25,8 @@
 // This file would be called String.h, but that conflicts with <string.h>
 // on systems without case-sensitive file systems.
 
-#include "ASCIIFastPath.h"
-#include "StringImpl.h"
+#include <wtf/text/ASCIIFastPath.h>
+#include <wtf/text/StringImpl.h>
 
 #ifdef __OBJC__
 #include <objc/objc.h>
@@ -646,5 +646,5 @@ using WTF::isSpaceOrNewline;
 using WTF::reverseFind;
 using WTF::ShouldRoundDecimalPlaces;
 
-#include "AtomicString.h"
+#include <wtf/text/AtomicString.h>
 #endif
diff --git a/Source/JavaScriptCore/wtf/unicode/CharacterNames.h b/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
index 4acb5f0b1..78b7bf7b9 100644
--- a/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
+++ b/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
@@ -26,7 +26,7 @@
 #ifndef CharacterNames_h
 #define CharacterNames_h
 
-#include "Unicode.h"
+#include <wtf/unicode/Unicode.h>
 
 namespace WTF {
 namespace Unicode {
diff --git a/Source/JavaScriptCore/wtf/unicode/UTF8.h b/Source/JavaScriptCore/wtf/unicode/UTF8.h
index bc2497b72..59f6994be 100644
--- a/Source/JavaScriptCore/wtf/unicode/UTF8.h
+++ b/Source/JavaScriptCore/wtf/unicode/UTF8.h
@@ -26,7 +26,7 @@
 #ifndef WTF_UTF8_h
 #define WTF_UTF8_h
 
-#include "Unicode.h"
+#include <wtf/unicode/Unicode.h>
 
 namespace WTF {
 namespace Unicode {
diff --git a/Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h b/Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
index 7bff934ba..8ad532917 100644
--- a/Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
+++ b/Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
@@ -25,9 +25,9 @@
 #ifndef UnicodeGLib_h
 #define UnicodeGLib_h
 
-#include "GOwnPtr.h"
-#include "ScriptCodesFromICU.h"
-#include "UnicodeMacrosFromICU.h"
+#include <wtf/gobject/GOwnPtr.h>
+#include <wtf/unicode/ScriptCodesFromICU.h>
+#include <wtf/unicode/UnicodeMacrosFromICU.h>
 
 #include <glib.h>
 #include <pango/pango.h>
diff --git a/Source/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/Source/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index e4f39b292..a2d1ad4c1 100644
--- a/Source/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/Source/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -23,8 +23,8 @@
 #ifndef WTF_UNICODE_QT4_H
 #define WTF_UNICODE_QT4_H
 
-#include "ScriptCodesFromICU.h"
-#include "UnicodeMacrosFromICU.h"
+#include <wtf/unicode/ScriptCodesFromICU.h>
+#include <wtf/unicode/UnicodeMacrosFromICU.h>
 
 #include <QChar>
 #include <QString>
diff --git a/Source/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.h b/Source/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.h
index af6ff0748..1663fc969 100644
--- a/Source/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.h
+++ b/Source/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.h
@@ -24,8 +24,8 @@
 #ifndef WTF_UnicodeWinCE_h
 #define WTF_UnicodeWinCE_h
 
-#include "ScriptCodesFromICU.h"
-#include "UnicodeMacrosFromICU.h"
+#include <wtf/unicode/ScriptCodesFromICU.h>
+#include <wtf/unicode/UnicodeMacrosFromICU.h>
 
 #include "ce_unicode.h"
 
diff --git a/Source/JavaScriptCore/wtf/url/api/ParsedURL.cpp b/Source/JavaScriptCore/wtf/url/api/ParsedURL.cpp
index 3c1519136..f69162a67 100644
--- a/Source/JavaScriptCore/wtf/url/api/ParsedURL.cpp
+++ b/Source/JavaScriptCore/wtf/url/api/ParsedURL.cpp
@@ -33,13 +33,21 @@
 
 namespace WTF {
 
-ParsedURL::ParsedURL(const URLString& spec)
-    : m_spec(spec)
+ParsedURL::ParsedURL(const String& urlString)
+    : m_spec(urlString)
 {
     // FIXME: Handle non-standard URLs.
-    if (spec.string().isEmpty())
+    if (urlString.isEmpty())
         return;
-    URLParser<UChar>::parseStandardURL(spec.string().characters(), spec.string().length(), m_segments);
+    URLParser<UChar>::parseStandardURL(urlString.characters(), urlString.length(), m_segments);
+}
+
+ParsedURL ParsedURL::isolatedCopy() const
+{
+    ParsedURL copy;
+    copy.m_segments = this->m_segments;
+    copy.m_spec = URLString(this->m_spec.string().isolatedCopy());
+    return copy;
 }
 
 String ParsedURL::scheme() const
@@ -82,11 +90,22 @@ String ParsedURL::fragment() const
     return segment(m_segments.fragment);
 }
 
+String ParsedURL::baseAsString() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return String();
+}
+
 String ParsedURL::segment(const URLComponent& component) const
 {
+    ASSERT(isValid());
+
     if (!component.isValid())
         return String();
-    return m_spec.string().substring(component.begin(), component.length());
+
+    String segment = m_spec.string().substring(component.begin(), component.length());
+    ASSERT_WITH_MESSAGE(!segment.isEmpty(), "A valid URL component should not be empty.");
+    return segment;
 }
 
 }
diff --git a/Source/JavaScriptCore/wtf/url/api/ParsedURL.h b/Source/JavaScriptCore/wtf/url/api/ParsedURL.h
index 023589564..2bb3330cf 100644
--- a/Source/JavaScriptCore/wtf/url/api/ParsedURL.h
+++ b/Source/JavaScriptCore/wtf/url/api/ParsedURL.h
@@ -28,27 +28,35 @@
 
 #if USE(WTFURL)
 
-#include "URLSegments.h"
-#include "URLString.h"
+#include <wtf/url/api/URLString.h>
+#include <wtf/url/src/URLSegments.h>
 
 namespace WTF {
 
 class URLComponent;
 
+// ParsedURL represents a valid URL decomposed by components.
 class ParsedURL {
 public:
-    explicit ParsedURL(const URLString&);
-
     // FIXME: Add a method for parsing non-canonicalized URLs.
+    ParsedURL() { };
+    WTF_EXPORT_PRIVATE explicit ParsedURL(const String&);
+
+    WTF_EXPORT_PRIVATE ParsedURL isolatedCopy() const;
+
+    bool isValid() const { return !m_spec.string().isEmpty(); }
+
+    // Return a URL component or a null String if the component is undefined for the URL.
+    WTF_EXPORT_PRIVATE String scheme() const;
+    WTF_EXPORT_PRIVATE String username() const;
+    WTF_EXPORT_PRIVATE String password() const;
+    WTF_EXPORT_PRIVATE String host() const;
+    WTF_EXPORT_PRIVATE String port() const;
+    WTF_EXPORT_PRIVATE String path() const;
+    WTF_EXPORT_PRIVATE String query() const;
+    WTF_EXPORT_PRIVATE String fragment() const;
 
-    String scheme() const;
-    String username() const;
-    String password() const;
-    String host() const;
-    String port() const;
-    String path() const;
-    String query() const;
-    String fragment() const;
+    WTF_EXPORT_PRIVATE String baseAsString() const;
 
     URLString spec() { return m_spec; }
 
diff --git a/Source/JavaScriptCore/wtf/url/api/URLString.h b/Source/JavaScriptCore/wtf/url/api/URLString.h
index 329f51e2f..9ae30d7a9 100644
--- a/Source/JavaScriptCore/wtf/url/api/URLString.h
+++ b/Source/JavaScriptCore/wtf/url/api/URLString.h
@@ -28,7 +28,7 @@
 
 #if USE(WTFURL)
 
-#include "WTFString.h"
+#include <wtf/text/WTFString.h>
 
 namespace WTF {
 
diff --git a/Source/JavaScriptCore/wtf/wince/FastMallocWinCE.h b/Source/JavaScriptCore/wtf/wince/FastMallocWinCE.h
index d91a5f2c9..3601249cf 100644
--- a/Source/JavaScriptCore/wtf/wince/FastMallocWinCE.h
+++ b/Source/JavaScriptCore/wtf/wince/FastMallocWinCE.h
@@ -26,7 +26,7 @@
 
 #ifdef __cplusplus
 #include <new>
-#include "MemoryManager.h"
+#include <wtf/wince/MemoryManager.h>
 extern "C" {
 #endif
 
diff --git a/Source/JavaScriptCore/yarr/Yarr.h b/Source/JavaScriptCore/yarr/Yarr.h
index 3495fc7e4..57a3846c0 100644
--- a/Source/JavaScriptCore/yarr/Yarr.h
+++ b/Source/JavaScriptCore/yarr/Yarr.h
@@ -43,6 +43,7 @@ namespace JSC { namespace Yarr {
 #define YarrStackSpaceForBackTrackInfoParentheses 2
 
 static const unsigned quantifyInfinite = UINT_MAX;
+static const unsigned offsetNoMatch = (unsigned)-1;
 
 // The below limit restricts the number of "recursive" match calls in order to
 // avoid spending exponential time on complex regular expressions.
@@ -63,7 +64,7 @@ enum YarrCharSize {
 };
 
 JS_EXPORT_PRIVATE PassOwnPtr<BytecodePattern> byteCompile(YarrPattern&, BumpPointerAllocator*);
-JS_EXPORT_PRIVATE int interpret(BytecodePattern*, const UString& input, unsigned start, unsigned length, int* output);
+JS_EXPORT_PRIVATE unsigned interpret(BytecodePattern*, const UString& input, unsigned start, unsigned length, unsigned* output);
 
 } } // namespace JSC::Yarr
 
diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
index 4472538e9..743f16048 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
@@ -121,7 +121,7 @@ public:
 
     struct ParenthesesDisjunctionContext
     {
-        ParenthesesDisjunctionContext(int* output, ByteTerm& term)
+        ParenthesesDisjunctionContext(unsigned* output, ByteTerm& term)
             : next(0)
         {
             unsigned firstSubpatternId = term.atom.subpatternId;
@@ -129,7 +129,7 @@ public:
 
             for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i) {
                 subpatternBackup[i] = output[(firstSubpatternId << 1) + i];
-                output[(firstSubpatternId << 1) + i] = -1;
+                output[(firstSubpatternId << 1) + i] = offsetNoMatch;
             }
 
             new (getDisjunctionContext(term)) DisjunctionContext();
@@ -140,7 +140,7 @@ public:
             return where;
         }
 
-        void restoreOutput(int* output, unsigned firstSubpatternId, unsigned numNestedSubpatterns)
+        void restoreOutput(unsigned* output, unsigned firstSubpatternId, unsigned numNestedSubpatterns)
         {
             for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i)
                 output[(firstSubpatternId << 1) + i] = subpatternBackup[i];
@@ -152,12 +152,12 @@ public:
         }
 
         ParenthesesDisjunctionContext* next;
-        int subpatternBackup[1];
+        unsigned subpatternBackup[1];
     };
 
-    ParenthesesDisjunctionContext* allocParenthesesDisjunctionContext(ByteDisjunction* disjunction, int* output, ByteTerm& term)
+    ParenthesesDisjunctionContext* allocParenthesesDisjunctionContext(ByteDisjunction* disjunction, unsigned* output, ByteTerm& term)
     {
-        size_t size = sizeof(ParenthesesDisjunctionContext) - sizeof(int) + (term.atom.parenthesesDisjunction->m_numSubpatterns << 1) * sizeof(int) + sizeof(DisjunctionContext) - sizeof(uintptr_t) + disjunction->m_frameSize * sizeof(uintptr_t);
+        size_t size = sizeof(ParenthesesDisjunctionContext) - sizeof(unsigned) + (term.atom.parenthesesDisjunction->m_numSubpatterns << 1) * sizeof(unsigned) + sizeof(DisjunctionContext) - sizeof(uintptr_t) + disjunction->m_frameSize * sizeof(uintptr_t);
         allocatorPool = allocatorPool->ensureCapacity(size);
         if (!allocatorPool)
             CRASH();
@@ -249,11 +249,11 @@ public:
             return input[pos] | input[pos + 1] << 16;
         }
 
-        int readChecked(int position)
+        int readChecked(unsigned negativePositionOffest)
         {
-            ASSERT(position < 0);
-            ASSERT(static_cast<unsigned>(-position) <= pos);
-            unsigned p = pos + position;
+            if (pos < negativePositionOffest)
+                CRASH();
+            unsigned p = pos - negativePositionOffest;
             ASSERT(p < length);
             return input[p];
         }
@@ -297,33 +297,37 @@ public:
             return length;
         }
 
-        bool checkInput(int count)
+        bool checkInput(unsigned count)
         {
-            if ((pos + count) <= length) {
+            if (((pos + count) <= length) && ((pos + count) >= pos)) {
                 pos += count;
                 return true;
             }
             return false;
         }
 
-        void uncheckInput(int count)
+        void uncheckInput(unsigned count)
         {
+            if (pos < count)
+                CRASH();
             pos -= count;
         }
 
-        bool atStart(int position)
+        bool atStart(unsigned negativePositionOffest)
         {
-            return (pos + position) == 0;
+            return pos == negativePositionOffest;
         }
 
-        bool atEnd(int position)
+        bool atEnd(unsigned negativePositionOffest)
         {
-            return (pos + position) == length;
+            if (pos < negativePositionOffest)
+                CRASH();
+            return (pos - negativePositionOffest) == length;
         }
 
-        bool isNotAvailableInput(int position)
+        bool isAvailableInput(unsigned offset)
         {
-            return (pos + position) > length;
+            return (((pos + offset) <= length) && ((pos + offset) >= pos));
         }
 
     private:
@@ -353,45 +357,45 @@ public:
         return false;
     }
 
-    bool checkCharacter(int testChar, int inputPosition)
+    bool checkCharacter(int testChar, unsigned negativeInputOffset)
     {
-        return testChar == input.readChecked(inputPosition);
+        return testChar == input.readChecked(negativeInputOffset);
     }
 
-    bool checkCasedCharacter(int loChar, int hiChar, int inputPosition)
+    bool checkCasedCharacter(int loChar, int hiChar, unsigned negativeInputOffset)
     {
-        int ch = input.readChecked(inputPosition);
+        int ch = input.readChecked(negativeInputOffset);
         return (loChar == ch) || (hiChar == ch);
     }
 
-    bool checkCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition)
+    bool checkCharacterClass(CharacterClass* characterClass, bool invert, unsigned negativeInputOffset)
     {
-        bool match = testCharacterClass(characterClass, input.readChecked(inputPosition));
+        bool match = testCharacterClass(characterClass, input.readChecked(negativeInputOffset));
         return invert ? !match : match;
     }
 
-    bool tryConsumeBackReference(int matchBegin, int matchEnd, int inputOffset)
+    bool tryConsumeBackReference(int matchBegin, int matchEnd, unsigned negativeInputOffset)
     {
-        int matchSize = matchEnd - matchBegin;
+        unsigned matchSize = (unsigned)(matchEnd - matchBegin);
 
         if (!input.checkInput(matchSize))
             return false;
 
         if (pattern->m_ignoreCase) {
-            for (int i = 0; i < matchSize; ++i) {
+            for (unsigned i = 0; i < matchSize; ++i) {
                 int ch = input.reread(matchBegin + i);
 
                 int lo = Unicode::toLower(ch);
                 int hi = Unicode::toUpper(ch);
 
-                if ((lo != hi) ? (!checkCasedCharacter(lo, hi, inputOffset - matchSize + i)) : (!checkCharacter(ch, inputOffset - matchSize + i))) {
+                if ((lo != hi) ? (!checkCasedCharacter(lo, hi, negativeInputOffset + matchSize - i)) : (!checkCharacter(ch, negativeInputOffset + matchSize - i))) {
                     input.uncheckInput(matchSize);
                     return false;
                 }
             }
         } else {
-            for (int i = 0; i < matchSize; ++i) {
-                if (!checkCharacter(input.reread(matchBegin + i), inputOffset - matchSize + i)) {
+            for (unsigned i = 0; i < matchSize; ++i) {
+                if (!checkCharacter(input.reread(matchBegin + i), negativeInputOffset + matchSize - i)) {
                     input.uncheckInput(matchSize);
                     return false;
                 }
@@ -403,7 +407,7 @@ public:
 
     bool matchAssertionBOL(ByteTerm& term)
     {
-        return (input.atStart(term.inputPosition)) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition - 1)));
+        return (input.atStart(term.inputPosition)) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition + 1)));
     }
 
     bool matchAssertionEOL(ByteTerm& term)
@@ -416,7 +420,7 @@ public:
 
     bool matchAssertionWordBoundary(ByteTerm& term)
     {
-        bool prevIsWordchar = !input.atStart(term.inputPosition) && testCharacterClass(pattern->wordcharCharacterClass, input.readChecked(term.inputPosition - 1));
+        bool prevIsWordchar = !input.atStart(term.inputPosition) && testCharacterClass(pattern->wordcharCharacterClass, input.readChecked(term.inputPosition + 1));
         bool readIsWordchar;
         if (term.inputPosition)
             readIsWordchar = !input.atEnd(term.inputPosition) && testCharacterClass(pattern->wordcharCharacterClass, input.readChecked(term.inputPosition));
@@ -446,7 +450,7 @@ public:
         case QuantifierNonGreedy:
             if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
                 ++backTrack->matchAmount;
-                if (checkCharacter(term.atom.patternCharacter, term.inputPosition - 1))
+                if (checkCharacter(term.atom.patternCharacter, term.inputPosition + 1))
                     return true;
             }
             input.uncheckInput(backTrack->matchAmount);
@@ -475,7 +479,7 @@ public:
         case QuantifierNonGreedy:
             if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
                 ++backTrack->matchAmount;
-                if (checkCasedCharacter(term.atom.casedCharacter.lo, term.atom.casedCharacter.hi, term.inputPosition - 1))
+                if (checkCasedCharacter(term.atom.casedCharacter.lo, term.atom.casedCharacter.hi, term.inputPosition + 1))
                     return true;
             }
             input.uncheckInput(backTrack->matchAmount);
@@ -493,7 +497,7 @@ public:
         switch (term.atom.quantityType) {
         case QuantifierFixedCount: {
             for (unsigned matchAmount = 0; matchAmount < term.atom.quantityCount; ++matchAmount) {
-                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition + matchAmount))
+                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition - matchAmount))
                     return false;
             }
             return true;
@@ -502,7 +506,7 @@ public:
         case QuantifierGreedy: {
             unsigned matchAmount = 0;
             while ((matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
-                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition - 1)) {
+                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition + 1)) {
                     input.uncheckInput(1);
                     break;
                 }
@@ -542,7 +546,7 @@ public:
         case QuantifierNonGreedy:
             if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
                 ++backTrack->matchAmount;
-                if (checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition - 1))
+                if (checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition + 1))
                     return true;
             }
             input.uncheckInput(backTrack->matchAmount);
@@ -557,16 +561,16 @@ public:
         ASSERT(term.type == ByteTerm::TypeBackReference);
         BackTrackInfoBackReference* backTrack = reinterpret_cast<BackTrackInfoBackReference*>(context->frame + term.frameLocation);
 
-        int matchBegin = output[(term.atom.subpatternId << 1)];
-        int matchEnd = output[(term.atom.subpatternId << 1) + 1];
+        unsigned matchBegin = output[(term.atom.subpatternId << 1)];
+        unsigned matchEnd = output[(term.atom.subpatternId << 1) + 1];
 
         // If the end position of the referenced match hasn't set yet then the backreference in the same parentheses where it references to that.
         // In this case the result of match is empty string like when it references to a parentheses with zero-width match.
         // Eg.: /(a\1)/
-        if (matchEnd == -1)
+        if (matchEnd == offsetNoMatch)
             return true;
 
-        if (matchBegin == -1)
+        if (matchBegin == offsetNoMatch)
             return true;
 
         ASSERT(matchBegin <= matchEnd);
@@ -609,10 +613,10 @@ public:
         ASSERT(term.type == ByteTerm::TypeBackReference);
         BackTrackInfoBackReference* backTrack = reinterpret_cast<BackTrackInfoBackReference*>(context->frame + term.frameLocation);
 
-        int matchBegin = output[(term.atom.subpatternId << 1)];
-        int matchEnd = output[(term.atom.subpatternId << 1) + 1];
+        unsigned matchBegin = output[(term.atom.subpatternId << 1)];
+        unsigned matchEnd = output[(term.atom.subpatternId << 1) + 1];
 
-        if (matchBegin == -1)
+        if (matchBegin == offsetNoMatch)
             return false;
 
         ASSERT(matchBegin <= matchEnd);
@@ -704,7 +708,7 @@ public:
 
         if (term.capture()) {
             unsigned subpatternId = term.atom.subpatternId;
-            output[(subpatternId << 1)] = input.getPos() + term.inputPosition;
+            output[(subpatternId << 1)] = input.getPos() - term.inputPosition;
         }
 
         return true;
@@ -736,8 +740,8 @@ public:
 
         if (term.capture()) {
             unsigned subpatternId = term.atom.subpatternId;
-            output[(subpatternId << 1)] = -1;
-            output[(subpatternId << 1) + 1] = -1;
+            output[(subpatternId << 1)] = offsetNoMatch;
+            output[(subpatternId << 1) + 1] = offsetNoMatch;
         }
 
         switch (term.atom.quantityType) {
@@ -1194,7 +1198,7 @@ public:
         case ByteTerm::TypePatternCharacterOnce:
         case ByteTerm::TypePatternCharacterFixed: {
             for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityCount; ++matchAmount) {
-                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition + matchAmount))
+                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition - matchAmount))
                     BACKTRACK();
             }
             MATCH_NEXT();
@@ -1203,7 +1207,7 @@ public:
             BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
             unsigned matchAmount = 0;
             while ((matchAmount < currentTerm().atom.quantityCount) && input.checkInput(1)) {
-                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition - 1)) {
+                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition + 1)) {
                     input.uncheckInput(1);
                     break;
                 }
@@ -1222,7 +1226,7 @@ public:
         case ByteTerm::TypePatternCasedCharacterOnce:
         case ByteTerm::TypePatternCasedCharacterFixed: {
             for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityCount; ++matchAmount) {
-                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition + matchAmount))
+                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition - matchAmount))
                     BACKTRACK();
             }
             MATCH_NEXT();
@@ -1231,7 +1235,7 @@ public:
             BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
             unsigned matchAmount = 0;
             while ((matchAmount < currentTerm().atom.quantityCount) && input.checkInput(1)) {
-                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition - 1)) {
+                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition + 1)) {
                     input.uncheckInput(1);
                     break;
                 }
@@ -1449,13 +1453,13 @@ public:
         return result;
     }
 
-    int interpret()
+    unsigned interpret()
     {
-        if (input.isNotAvailableInput(0))
-            return -1;
+        if (!input.isAvailableInput(0))
+            return offsetNoMatch;
 
         for (unsigned i = 0; i < pattern->m_body->m_numSubpatterns + 1; ++i)
-            output[i << 1] = -1;
+            output[i << 1] = offsetNoMatch;
 
         allocatorPool = pattern->m_allocator->startAllocator();
         if (!allocatorPool)
@@ -1473,11 +1477,11 @@ public:
 
         pattern->m_allocator->stopAllocator();
 
-        ASSERT((result == JSRegExpMatch) == (output[0] != -1));
+        ASSERT((result == JSRegExpMatch) == (output[0] != offsetNoMatch));
         return output[0];
     }
 
-    Interpreter(BytecodePattern* pattern, int* output, const UString input, unsigned start, unsigned length)
+    Interpreter(BytecodePattern* pattern, unsigned* output, const UString input, unsigned start, unsigned length)
         : pattern(pattern)
         , output(output)
         , input(input, start, length)
@@ -1488,7 +1492,7 @@ public:
 
 private:
     BytecodePattern* pattern;
-    int* output;
+    unsigned* output;
     InputStream input;
     BumpPointerPool* allocatorPool;
     unsigned remainingMatchCount;
@@ -1533,22 +1537,22 @@ public:
         m_bodyDisjunction->terms.append(ByteTerm::UncheckInput(count));
     }
     
-    void assertionBOL(int inputPosition)
+    void assertionBOL(unsigned inputPosition)
     {
         m_bodyDisjunction->terms.append(ByteTerm::BOL(inputPosition));
     }
 
-    void assertionEOL(int inputPosition)
+    void assertionEOL(unsigned inputPosition)
     {
         m_bodyDisjunction->terms.append(ByteTerm::EOL(inputPosition));
     }
 
-    void assertionWordBoundary(bool invert, int inputPosition)
+    void assertionWordBoundary(bool invert, unsigned inputPosition)
     {
         m_bodyDisjunction->terms.append(ByteTerm::WordBoundary(invert, inputPosition));
     }
 
-    void atomPatternCharacter(UChar ch, int inputPosition, unsigned frameLocation, Checked<unsigned> quantityCount, QuantifierType quantityType)
+    void atomPatternCharacter(UChar ch, unsigned inputPosition, unsigned frameLocation, Checked<unsigned> quantityCount, QuantifierType quantityType)
     {
         if (m_pattern.m_ignoreCase) {
             UChar lo = Unicode::toLower(ch);
@@ -1563,7 +1567,7 @@ public:
         m_bodyDisjunction->terms.append(ByteTerm(ch, inputPosition, frameLocation, quantityCount, quantityType));
     }
 
-    void atomCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition, unsigned frameLocation, Checked<unsigned> quantityCount, QuantifierType quantityType)
+    void atomCharacterClass(CharacterClass* characterClass, bool invert, unsigned inputPosition, unsigned frameLocation, Checked<unsigned> quantityCount, QuantifierType quantityType)
     {
         m_bodyDisjunction->terms.append(ByteTerm(characterClass, invert, inputPosition));
 
@@ -1572,7 +1576,7 @@ public:
         m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
     }
 
-    void atomBackReference(unsigned subpatternId, int inputPosition, unsigned frameLocation, Checked<unsigned> quantityCount, QuantifierType quantityType)
+    void atomBackReference(unsigned subpatternId, unsigned inputPosition, unsigned frameLocation, Checked<unsigned> quantityCount, QuantifierType quantityType)
     {
         ASSERT(subpatternId);
 
@@ -1583,7 +1587,7 @@ public:
         m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
     }
 
-    void atomParenthesesOnceBegin(unsigned subpatternId, bool capture, int inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
+    void atomParenthesesOnceBegin(unsigned subpatternId, bool capture, unsigned inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
     {
         int beginTerm = m_bodyDisjunction->terms.size();
 
@@ -1596,7 +1600,7 @@ public:
         m_currentAlternativeIndex = beginTerm + 1;
     }
 
-    void atomParenthesesTerminalBegin(unsigned subpatternId, bool capture, int inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
+    void atomParenthesesTerminalBegin(unsigned subpatternId, bool capture, unsigned inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
     {
         int beginTerm = m_bodyDisjunction->terms.size();
 
@@ -1609,7 +1613,7 @@ public:
         m_currentAlternativeIndex = beginTerm + 1;
     }
 
-    void atomParenthesesSubpatternBegin(unsigned subpatternId, bool capture, int inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
+    void atomParenthesesSubpatternBegin(unsigned subpatternId, bool capture, unsigned inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
     {
         // Errrk! - this is a little crazy, we initially generate as a TypeParenthesesSubpatternOnceBegin,
         // then fix this up at the end! - simplifying this should make it much clearer.
@@ -1639,7 +1643,7 @@ public:
         m_currentAlternativeIndex = beginTerm + 1;
     }
 
-    void atomParentheticalAssertionEnd(int inputPosition, unsigned frameLocation, Checked<unsigned> quantityCount, QuantifierType quantityType)
+    void atomParentheticalAssertionEnd(unsigned inputPosition, unsigned frameLocation, Checked<unsigned> quantityCount, QuantifierType quantityType)
     {
         unsigned beginTerm = popParenthesesStack();
         closeAlternative(beginTerm + 1);
@@ -1871,27 +1875,27 @@ public:
 
                 switch (term.type) {
                 case PatternTerm::TypeAssertionBOL:
-                    assertionBOL(term.inputPosition - currentCountAlreadyChecked);
+                    assertionBOL(currentCountAlreadyChecked - term.inputPosition);
                     break;
 
                 case PatternTerm::TypeAssertionEOL:
-                    assertionEOL(term.inputPosition - currentCountAlreadyChecked);
+                    assertionEOL(currentCountAlreadyChecked - term.inputPosition);
                     break;
 
                 case PatternTerm::TypeAssertionWordBoundary:
-                    assertionWordBoundary(term.invert(), term.inputPosition - currentCountAlreadyChecked);
+                    assertionWordBoundary(term.invert(), currentCountAlreadyChecked - term.inputPosition);
                     break;
 
                 case PatternTerm::TypePatternCharacter:
-                    atomPatternCharacter(term.patternCharacter, term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                    atomPatternCharacter(term.patternCharacter, currentCountAlreadyChecked - term.inputPosition, term.frameLocation, term.quantityCount, term.quantityType);
                     break;
 
                 case PatternTerm::TypeCharacterClass:
-                    atomCharacterClass(term.characterClass, term.invert(), term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                    atomCharacterClass(term.characterClass, term.invert(), currentCountAlreadyChecked- term.inputPosition, term.frameLocation, term.quantityCount, term.quantityType);
                     break;
 
                 case PatternTerm::TypeBackReference:
-                    atomBackReference(term.backReferenceSubpatternId, term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                    atomBackReference(term.backReferenceSubpatternId, currentCountAlreadyChecked - term.inputPosition, term.frameLocation, term.quantityCount, term.quantityType);
                         break;
 
                 case PatternTerm::TypeForwardReference:
@@ -1907,17 +1911,17 @@ public:
                         else
                             alternativeFrameLocation += YarrStackSpaceForBackTrackInfoParenthesesOnce;
                         unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
-                        atomParenthesesOnceBegin(term.parentheses.subpatternId, term.capture(), delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, alternativeFrameLocation);
+                        atomParenthesesOnceBegin(term.parentheses.subpatternId, term.capture(), disjunctionAlreadyCheckedCount - delegateEndInputOffset, term.frameLocation, alternativeFrameLocation);
                         emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, disjunctionAlreadyCheckedCount);
                         atomParenthesesOnceEnd(delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType);
                     } else if (term.parentheses.isTerminal) {
                         unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
-                        atomParenthesesTerminalBegin(term.parentheses.subpatternId, term.capture(), delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, term.frameLocation + YarrStackSpaceForBackTrackInfoParenthesesOnce);
+                        atomParenthesesTerminalBegin(term.parentheses.subpatternId, term.capture(), disjunctionAlreadyCheckedCount - delegateEndInputOffset, term.frameLocation, term.frameLocation + YarrStackSpaceForBackTrackInfoParenthesesOnce);
                         emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, disjunctionAlreadyCheckedCount);
                         atomParenthesesTerminalEnd(delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType);
                     } else {
                         unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
-                        atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.capture(), delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, 0);
+                        atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.capture(), disjunctionAlreadyCheckedCount - delegateEndInputOffset, term.frameLocation, 0);
                         emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
                         atomParenthesesSubpatternEnd(term.parentheses.lastSubpatternId, delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType, term.parentheses.disjunction->m_callFrameSize);
                     }
@@ -1967,7 +1971,7 @@ PassOwnPtr<BytecodePattern> byteCompile(YarrPattern& pattern, BumpPointerAllocat
     return ByteCompiler(pattern).compile(allocator);
 }
 
-int interpret(BytecodePattern* bytecode, const UString& input, unsigned start, unsigned length, int* output)
+unsigned interpret(BytecodePattern* bytecode, const UString& input, unsigned start, unsigned length, unsigned* output)
 {
     return Interpreter(bytecode, output, input, start, length).interpret();
 }
diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.h b/Source/JavaScriptCore/yarr/YarrInterpreter.h
index eb5fdc6dc..4bb1efc50 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.h
+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.h
@@ -105,7 +105,7 @@ struct ByteTerm {
     unsigned frameLocation;
     bool m_capture : 1;
     bool m_invert : 1;
-    int inputPosition;
+    unsigned inputPosition;
 
     ByteTerm(UChar ch, int inputPos, unsigned frameLocation, Checked<unsigned> quantityCount, QuantifierType quantityType)
         : frameLocation(frameLocation)
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.cpp b/Source/JavaScriptCore/yarr/YarrJIT.cpp
index cd861ecf3..2269792ec 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.cpp
+++ b/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "YarrJIT.h"
 
-#include "ASCIICType.h"
+#include <wtf/ASCIICType.h>
 #include "LinkBuffer.h"
 #include "Yarr.h"
 
@@ -1748,7 +1748,7 @@ class YarrGenerator : private MacroAssembler {
                                 if (alternative->m_minimumSize)
                                     sub32(Imm32(alternative->m_minimumSize - 1), regT0);
                                 else
-                                    add32(Imm32(1), regT0);
+                                    add32(TrustedImm32(1), regT0);
                                 store32(regT0, Address(output));
                             }
                         }
@@ -1847,7 +1847,7 @@ class YarrGenerator : private MacroAssembler {
                 if (alternative->m_minimumSize == m_pattern.m_body->m_minimumSize) {
                     // If the last alternative had the same minimum size as the disjunction,
                     // just simply increment input pos by 1, no adjustment based on minimum size.
-                    add32(Imm32(1), index);
+                    add32(TrustedImm32(1), index);
                 } else {
                     // If the minumum for the last alternative was one greater than than that
                     // for the disjunction, we're already progressed by 1, nothing to do!
diff --git a/Source/JavaScriptCore/yarr/YarrParser.h b/Source/JavaScriptCore/yarr/YarrParser.h
index e6694560a..1182d7907 100644
--- a/Source/JavaScriptCore/yarr/YarrParser.h
+++ b/Source/JavaScriptCore/yarr/YarrParser.h
@@ -54,6 +54,7 @@ private:
         PatternTooLarge,
         QuantifierOutOfOrder,
         QuantifierWithoutAtom,
+        QuantifierTooLarge,
         MissingParentheses,
         ParenthesesUnmatched,
         ParenthesesTypeInvalid,
@@ -546,6 +547,11 @@ private:
         ASSERT(!m_err);
         ASSERT(min <= max);
 
+        if (min == UINT_MAX) {
+            m_err = QuantifierTooLarge;
+            return;
+        }
+
         if (lastTokenWasAnAtom)
             m_delegate.quantifyAtom(min, max, !tryConsume('?'));
         else
@@ -685,6 +691,7 @@ private:
             REGEXP_ERROR_PREFIX "regular expression too large",
             REGEXP_ERROR_PREFIX "numbers out of order in {} quantifier",
             REGEXP_ERROR_PREFIX "nothing to repeat",
+            REGEXP_ERROR_PREFIX "number too large in {} quantifier",
             REGEXP_ERROR_PREFIX "missing )",
             REGEXP_ERROR_PREFIX "unmatched parentheses",
             REGEXP_ERROR_PREFIX "unrecognized character after (?",
@@ -696,7 +703,6 @@ private:
         return errorMessages[m_err];
     }
 
-
     // Misc helper functions:
 
     typedef unsigned ParseState;
diff --git a/Source/Makefile b/Source/Makefile
index 522739330..258c2f2e7 100644
--- a/Source/Makefile
+++ b/Source/Makefile
@@ -1,4 +1,4 @@
-MODULES = JavaScriptCore ThirdParty/ANGLE WebCore WebKit WebKit2
+MODULES = WTF JavaScriptCore ThirdParty/ANGLE WebCore WebKit WebKit2
 
 all:
 	@for dir in $(MODULES); do ${MAKE} $@ -C $$dir; exit_status=$$?; \
diff --git a/Source/Platform/ChangeLog b/Source/Platform/ChangeLog
index 45c8504ed..8eb711aaf 100644
--- a/Source/Platform/ChangeLog
+++ b/Source/Platform/ChangeLog
@@ -1,3 +1,171 @@
+2012-03-08  James Robinson  <jamesr@chromium.org>
+
+        Use an explicit attribute to signal that a context prefers to use a discrete GPU
+        https://bugs.webkit.org/show_bug.cgi?id=80639
+
+        Reviewed by Stephen White.
+
+        Adds preferDiscreteGPU attribute to WebGraphicsContext3D::Attributes. Also remove the forUseOnAnotherThread
+        attribute, this has been dead code for a while now.
+
+        * chromium/public/WebGraphicsContext3D.h:
+        (WebKit::WebGraphicsContext3D::Attributes::Attributes):
+        (Attributes):
+
+2012-02-24  James Robinson  <jamesr@chromium.org>
+
+        [chromium] WebKit::setColorNames is a client API
+        https://bugs.webkit.org/show_bug.cgi?id=79539
+
+        Reviewed by Darin Fisher.
+
+        * Platform.gypi:
+        * chromium/public/WebColor.h:
+        (WebKit):
+
+2012-02-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108860.
+        http://trac.webkit.org/changeset/108860
+        https://bugs.webkit.org/show_bug.cgi?id=79544
+
+        "Breaks Linux compile" (Requested by enne on #webkit).
+
+        * Platform.gypi:
+        * chromium/public/WebColor.h:
+        (WebKit):
+        * chromium/public/WebColorName.h: Renamed from Source/WebKit/chromium/public/WebColorName.h.
+        (WebKit):
+
+2012-02-24  James Robinson  <jamesr@chromium.org>
+
+        [chromium] WebKit::setColorNames is a client API
+        https://bugs.webkit.org/show_bug.cgi?id=79539
+
+        Reviewed by Darin Fisher.
+
+        * Platform.gypi:
+        * chromium/public/WebColor.h:
+        (WebKit):
+
+2012-02-22  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move WebGraphicsContext3D header into the Platform directory
+        https://bugs.webkit.org/show_bug.cgi?id=79301
+
+        Reviewed by Adam Barth.
+
+        Moves WebGraphicsContext3D and WebNonCopyable (which WGC3D depends on).
+
+        * Platform.gypi:
+        * chromium/public/WebGraphicsContext3D.h: Copied from Source/WebKit/chromium/public/platform/WebGraphicsContext3D.h.
+        (WebKit):
+        (WebGraphicsContext3D):
+        (ActiveInfo):
+        (WebKit::WebGraphicsContext3D::Attributes::Attributes):
+        (Attributes):
+        (WebGraphicsContextLostCallback):
+        (WebKit::WebGraphicsContext3D::WebGraphicsContextLostCallback::~WebGraphicsContextLostCallback):
+        (WebGraphicsErrorMessageCallback):
+        (WebKit::WebGraphicsContext3D::WebGraphicsErrorMessageCallback::~WebGraphicsErrorMessageCallback):
+        (WebGraphicsSwapBuffersCompleteCallbackCHROMIUM):
+        (WebKit::WebGraphicsContext3D::WebGraphicsSwapBuffersCompleteCallbackCHROMIUM::~WebGraphicsSwapBuffersCompleteCallbackCHROMIUM):
+        (WebGraphicsMemoryAllocationChangedCallbackCHROMIUM):
+        (WebKit::WebGraphicsContext3D::WebGraphicsMemoryAllocationChangedCallbackCHROMIUM::~WebGraphicsMemoryAllocationChangedCallbackCHROMIUM):
+        (WebKit::WebGraphicsContext3D::~WebGraphicsContext3D):
+        (WebKit::WebGraphicsContext3D::setMemoryAllocationChangedCallbackCHROMIUM):
+        (WebKit::WebGraphicsContext3D::setParentContext):
+        (WebKit::WebGraphicsContext3D::setSwapBuffersCompleteCallbackCHROMIUM):
+        (WebKit::WebGraphicsContext3D::rateLimitOffscreenContextCHROMIUM):
+        (WebKit::WebGraphicsContext3D::setContextLostCallback):
+        (WebKit::WebGraphicsContext3D::setErrorMessageCallback):
+        (WebKit::WebGraphicsContext3D::getGraphicsResetStatusARB):
+        (WebKit::WebGraphicsContext3D::getTranslatedShaderSourceANGLE):
+        (WebKit::WebGraphicsContext3D::texImageIOSurface2DCHROMIUM):
+        (WebKit::WebGraphicsContext3D::texStorage2DEXT):
+        (WebKit::WebGraphicsContext3D::onCreateGrGLInterface):
+        * chromium/public/WebNonCopyable.h: Copied from Source/WebKit/chromium/public/platform/WebNonCopyable.h.
+        (WebKit):
+        (WebNonCopyable):
+        (WebKit::WebNonCopyable::WebNonCopyable):
+        (WebKit::WebNonCopyable::~WebNonCopyable):
+
+2012-02-23  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move Web*Layer* headers into Platform
+        https://bugs.webkit.org/show_bug.cgi?id=79425
+
+        Reviewed by Adam Barth.
+
+        This moves the Web*Layer* headers and their dependencies from WebKit/chromium/public/platform/ into
+        Platform/chromium/public.
+
+        * Platform.gypi:
+        * chromium/public/WebCanvas.h: Copied from Source/WebKit/chromium/public/platform/WebCanvas.h.
+        (WebKit):
+        * chromium/public/WebColor.h: Copied from Source/WebKit/chromium/public/platform/WebColor.h.
+        (WebKit):
+        * chromium/public/WebColorName.h: Copied from Source/WebKit/chromium/public/platform/WebColorName.h.
+        (WebKit):
+        * chromium/public/WebContentLayer.h: Copied from Source/WebKit/chromium/public/platform/WebContentLayer.h.
+        (WebKit):
+        (WebContentLayer):
+        (WebKit::WebContentLayer::WebContentLayer):
+        (WebKit::WebContentLayer::~WebContentLayer):
+        (WebKit::WebContentLayer::operator=):
+        * chromium/public/WebContentLayerClient.h: Copied from Source/WebKit/chromium/public/platform/WebContentLayerClient.h.
+        (WebKit):
+        (WebContentLayerClient):
+        (WebKit::WebContentLayerClient::~WebContentLayerClient):
+        * chromium/public/WebExternalTextureLayer.h: Copied from Source/WebKit/chromium/public/platform/WebExternalTextureLayer.h.
+        (WebKit):
+        (WebExternalTextureLayer):
+        (WebKit::WebExternalTextureLayer::WebExternalTextureLayer):
+        (WebKit::WebExternalTextureLayer::~WebExternalTextureLayer):
+        (WebKit::WebExternalTextureLayer::operator=):
+        * chromium/public/WebLayer.h: Copied from Source/WebKit/chromium/public/platform/WebLayer.h.
+        (WebKit):
+        (WebLayer):
+        (WebKit::WebLayer::WebLayer):
+        (WebKit::WebLayer::~WebLayer):
+        (WebKit::WebLayer::operator=):
+        (WebKit::WebLayer::isNull):
+        (WebKit::WebLayer::to):
+        (WebKit::WebLayer::toConst):
+        (WebKit::WebLayer::unwrap):
+        (WebKit::WebLayer::constUnwrap):
+        (WebKit::operator==):
+        (WebKit::operator!=):
+        * chromium/public/WebLayerTreeView.h: Copied from Source/WebKit/chromium/public/platform/WebLayerTreeView.h.
+        (WebCore):
+        (WebKit):
+        (WebLayerTreeView):
+        (WebKit::WebLayerTreeView::Settings::Settings):
+        (Settings):
+        (WebKit::WebLayerTreeView::WebLayerTreeView):
+        (WebKit::WebLayerTreeView::~WebLayerTreeView):
+        (WebKit::WebLayerTreeView::operator=):
+        (WebKit::operator==):
+        (WebKit::operator!=):
+        * chromium/public/WebLayerTreeViewClient.h: Copied from Source/WebKit/chromium/public/platform/WebLayerTreeViewClient.h.
+        (WebKit):
+        (WebLayerTreeViewClient):
+        (WebKit::WebLayerTreeViewClient::~WebLayerTreeViewClient):
+        * chromium/public/WebPrivatePtr.h: Copied from Source/WebKit/chromium/public/platform/WebPrivatePtr.h.
+        (WebKit):
+        (WebPrivatePtr):
+        (WebKit::WebPrivatePtr::WebPrivatePtr):
+        (WebKit::WebPrivatePtr::~WebPrivatePtr):
+        (WebKit::WebPrivatePtr::isNull):
+        (WebKit::WebPrivatePtr::reset):
+        (WebKit::WebPrivatePtr::operator=):
+        (WebKit::WebPrivatePtr::get):
+        (WebKit::WebPrivatePtr::operator->):
+        (WebKit::WebPrivatePtr::assign):
+        * chromium/public/WebSolidColorLayer.h: Copied from Source/WebKit/chromium/public/platform/WebSolidColorLayer.h.
+        (WebKit):
+        (WebSolidColorLayer):
+
 2012-02-08  James Robinson  <jamesr@chromium.org>
 
         r107042 caused compile breakages on chromium try bots
diff --git a/Source/Platform/Platform.gypi b/Source/Platform/Platform.gypi
index c4da4d9dc..afa14713f 100644
--- a/Source/Platform/Platform.gypi
+++ b/Source/Platform/Platform.gypi
@@ -32,14 +32,26 @@
     'variables': {
         'platform_files': [
             'chromium/public/WebCString.h',
+            'chromium/public/WebCanvas.h',
+            'chromium/public/WebColor.h',
             'chromium/public/WebCommon.h',
+            'chromium/public/WebContentLayer.h',
+            'chromium/public/WebContentLayerClient.h',
+            'chromium/public/WebExternalTextureLayer.h',
             'chromium/public/WebFloatPoint.h',
             'chromium/public/WebFloatQuad.h',
             'chromium/public/WebFloatRect.h',
+            'chromium/public/WebGraphicsContext3D.h',
+            'chromium/public/WebLayer.h',
+            'chromium/public/WebLayerTreeView.h',
+            'chromium/public/WebLayerTreeViewClient.h',
             'chromium/public/WebMimeRegistry.h',
+            'chromium/public/WebNonCopyable.h',
             'chromium/public/WebPoint.h',
+            'chromium/public/WebPrivatePtr.h',
             'chromium/public/WebRect.h',
             'chromium/public/WebSize.h',
+            'chromium/public/WebSolidColorLayer.h',
             'chromium/public/WebString.h',
             'chromium/src/WebCString.cpp',
             'chromium/src/WebFloatQuad.cpp',
diff --git a/Source/Platform/chromium/public/WebCanvas.h b/Source/Platform/chromium/public/WebCanvas.h
new file mode 100644
index 000000000..4cf729ee1
--- /dev/null
+++ b/Source/Platform/chromium/public/WebCanvas.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCanvas_h
+#define WebCanvas_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_USING_SKIA
+class SkCanvas;
+#elif WEBKIT_USING_CG
+struct CGContext;
+#endif
+
+namespace WebKit {
+
+#if WEBKIT_USING_SKIA
+typedef SkCanvas WebCanvas;
+#elif WEBKIT_USING_CG
+typedef struct CGContext WebCanvas;
+#else
+#error "Need to define WebCanvas"
+#endif
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/Platform/chromium/public/WebColor.h b/Source/Platform/chromium/public/WebColor.h
new file mode 100644
index 000000000..d449e36c1
--- /dev/null
+++ b/Source/Platform/chromium/public/WebColor.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebColor_h
+#define WebColor_h
+
+namespace WebKit {
+
+typedef unsigned WebColor;  // RGBA quad. Equivalent to SkColor.
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/Platform/chromium/public/WebContentLayer.h b/Source/Platform/chromium/public/WebContentLayer.h
new file mode 100644
index 000000000..6d7f91483
--- /dev/null
+++ b/Source/Platform/chromium/public/WebContentLayer.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebContentLayer_h
+#define WebContentLayer_h
+
+#include "WebCommon.h"
+#include "WebLayer.h"
+
+namespace WebKit {
+class WebContentLayerClient;
+class WebContentLayerImpl;
+struct WebFloatRect;
+
+class WebContentLayer : public WebLayer {
+public:
+    WEBKIT_EXPORT static WebContentLayer create(WebContentLayerClient*);
+
+    WebContentLayer() { }
+    WebContentLayer(const WebContentLayer& layer) : WebLayer(layer) { }
+    virtual ~WebContentLayer() { }
+    WebContentLayer& operator=(const WebContentLayer& layer)
+    {
+        WebLayer::assign(layer);
+        return *this;
+    }
+
+    // Sets whether the layer draws its content when compositing.
+    WEBKIT_EXPORT void setDrawsContent(bool);
+    WEBKIT_EXPORT bool drawsContent() const;
+
+    // Sets a region of the layer as invalid, i.e. needs to update its content.
+    // The visible area of the dirty rect will be passed to one or more calls to
+    // WebContentLayerClient::paintContents before the compositing pass occurs.
+    WEBKIT_EXPORT void invalidateRect(const WebFloatRect&);
+
+    // Sets the entire layer as invalid, i.e. needs to update its content.
+    WEBKIT_EXPORT void invalidate();
+
+#if WEBKIT_IMPLEMENTATION
+    WebContentLayer(const WTF::PassRefPtr<WebContentLayerImpl>&);
+    WebContentLayer& operator=(const WTF::PassRefPtr<WebContentLayerImpl>&);
+    operator WTF::PassRefPtr<WebContentLayerImpl>() const;
+#endif
+};
+
+} // namespace WebKit
+
+#endif // WebContentLayer_h
diff --git a/Source/Platform/chromium/public/WebContentLayerClient.h b/Source/Platform/chromium/public/WebContentLayerClient.h
new file mode 100644
index 000000000..deb36e077
--- /dev/null
+++ b/Source/Platform/chromium/public/WebContentLayerClient.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebContentLayerClient_h
+#define WebContentLayerClient_h
+
+#include "WebCanvas.h"
+
+namespace WebKit {
+struct WebRect;
+
+class WebContentLayerClient {
+public:
+    // Paints the content area for the layer, typically dirty rects submitted
+    // through WebContentLayer::setNeedsDisplay, submitting drawing commands
+    // through the WebCanvas.
+    // The canvas is already clipped to the |clip| rect.
+    virtual void paintContents(WebCanvas*, const WebRect& clip) = 0;
+
+protected:
+    virtual ~WebContentLayerClient() { }
+};
+
+} // namespace WebKit
+
+#endif // WebContentLayerClient_h
diff --git a/Source/Platform/chromium/public/WebExternalTextureLayer.h b/Source/Platform/chromium/public/WebExternalTextureLayer.h
new file mode 100644
index 000000000..ce87bb238
--- /dev/null
+++ b/Source/Platform/chromium/public/WebExternalTextureLayer.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebExternalTextureLayer_h
+#define WebExternalTextureLayer_h
+
+#include "WebCommon.h"
+#include "WebFloatRect.h"
+#include "WebLayer.h"
+
+namespace WebKit {
+class WebExternalTextureLayerImpl;
+
+// This class represents a layer that renders a texture that is generated
+// externally (not managed by the WebLayerTreeView).
+// The texture will be used by the WebLayerTreeView during compositing passes.
+// When in single-thread mode, this means during WebLayerTreeView::composite().
+// When using the threaded compositor, this can mean at an arbitrary time until
+// the WebLayerTreeView is destroyed.
+class WebExternalTextureLayer : public WebLayer {
+public:
+    WEBKIT_EXPORT static WebExternalTextureLayer create();
+
+    WebExternalTextureLayer() { }
+    WebExternalTextureLayer(const WebExternalTextureLayer& layer) : WebLayer(layer) { }
+    virtual ~WebExternalTextureLayer() { }
+    WebExternalTextureLayer& operator=(const WebExternalTextureLayer& layer)
+    {
+        WebLayer::assign(layer);
+        return *this;
+    }
+
+    // Sets the texture id that represents the layer, in the namespace of the
+    // compositor context.
+    WEBKIT_EXPORT void setTextureId(unsigned);
+    WEBKIT_EXPORT unsigned textureId() const;
+
+    // Sets whether or not the texture should be flipped in the Y direction when
+    // rendered.
+    WEBKIT_EXPORT void setFlipped(bool);
+    WEBKIT_EXPORT bool flipped() const;
+
+    // Sets the rect in UV space of the texture that is mapped to the layer
+    // bounds.
+    WEBKIT_EXPORT void setUVRect(const WebFloatRect&);
+    WEBKIT_EXPORT WebFloatRect uvRect() const;
+
+    // Marks a region of the layer as needing a display. These regions are
+    // collected in a union until the display occurs.
+    WEBKIT_EXPORT void invalidateRect(const WebFloatRect&);
+
+#if WEBKIT_IMPLEMENTATION
+    WebExternalTextureLayer(const WTF::PassRefPtr<WebExternalTextureLayerImpl>&);
+    WebExternalTextureLayer& operator=(const WTF::PassRefPtr<WebExternalTextureLayerImpl>&);
+    operator WTF::PassRefPtr<WebExternalTextureLayerImpl>() const;
+#endif
+};
+
+} // namespace WebKit
+
+#endif // WebExternalTextureLayer_h
diff --git a/Source/Platform/chromium/public/WebGraphicsContext3D.h b/Source/Platform/chromium/public/WebGraphicsContext3D.h
new file mode 100644
index 000000000..274c2794c
--- /dev/null
+++ b/Source/Platform/chromium/public/WebGraphicsContext3D.h
@@ -0,0 +1,415 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebGraphicsContext3D_h
+#define WebGraphicsContext3D_h
+
+#include "WebCommon.h"
+#include "WebNonCopyable.h"
+#include "WebString.h"
+
+#define USE_WGC3D_TYPES
+
+#if WEBKIT_USING_SKIA
+struct GrGLInterface;
+#endif
+
+namespace WebKit {
+
+// WGC3D types match the corresponding GL types as defined in OpenGL ES 2.0
+// header file gl2.h from khronos.org.
+typedef char WGC3Dchar;
+typedef unsigned int WGC3Denum;
+typedef unsigned char WGC3Dboolean;
+typedef unsigned int WGC3Dbitfield;
+typedef signed char WGC3Dbyte;
+typedef unsigned char WGC3Dubyte;
+typedef short WGC3Dshort;
+typedef unsigned short WGC3Dushort;
+typedef int WGC3Dint;
+typedef int WGC3Dsizei;
+typedef unsigned int WGC3Duint;
+typedef float WGC3Dfloat;
+typedef float WGC3Dclampf;
+typedef signed long int WGC3Dintptr;
+typedef signed long int WGC3Dsizeiptr;
+
+// Typedef for server-side objects like OpenGL textures and program objects.
+typedef WGC3Duint WebGLId;
+
+// This interface abstracts the operations performed by the
+// GraphicsContext3D in order to implement WebGL. Nearly all of the
+// methods exposed on this interface map directly to entry points in
+// the OpenGL ES 2.0 API.
+//
+// Creating a WebGraphicsContext does not make it current, or guarantee
+// that the context has been created successfully. Use
+// makeContextCurrent() to complete initialization of the context, treating
+// a false return value as indication that the context could not be created
+// successfully.
+class WebGraphicsContext3D : public WebNonCopyable {
+public:
+    // Return value from getActiveUniform and getActiveAttrib.
+    struct ActiveInfo {
+        WebString name;
+        WGC3Denum type;
+        WGC3Dint size;
+    };
+
+    // Context creation attributes.
+    struct Attributes {
+        Attributes()
+            : alpha(true)
+            , depth(true)
+            , stencil(true)
+            , antialias(true)
+            , premultipliedAlpha(true)
+            , canRecoverFromContextLoss(true)
+            , noExtensions(false)
+            , shareResources(true)
+            , preferDiscreteGPU(false)
+        {
+        }
+
+        bool alpha;
+        bool depth;
+        bool stencil;
+        bool antialias;
+        bool premultipliedAlpha;
+        bool canRecoverFromContextLoss;
+        bool noExtensions;
+        bool shareResources;
+        bool preferDiscreteGPU;
+    };
+
+    class WebGraphicsContextLostCallback {
+    public:
+        virtual void onContextLost() = 0;
+        virtual ~WebGraphicsContextLostCallback() { }
+    };
+
+    class WebGraphicsErrorMessageCallback {
+    public:
+        virtual void onErrorMessage(const WebString&, WGC3Dint) = 0;
+        virtual ~WebGraphicsErrorMessageCallback() { }
+    };
+
+    class WebGraphicsSwapBuffersCompleteCallbackCHROMIUM {
+    public:
+        virtual void onSwapBuffersComplete() = 0;
+        virtual ~WebGraphicsSwapBuffersCompleteCallbackCHROMIUM() { }
+    };
+
+    class WebGraphicsMemoryAllocationChangedCallbackCHROMIUM {
+    public:
+        virtual void onMemoryAllocationChanged(size_t gpuResourceSizeInBytes) = 0;
+
+    protected:
+        virtual ~WebGraphicsMemoryAllocationChangedCallbackCHROMIUM() { }
+    };
+
+    // This destructor needs to be public so that using classes can destroy instances if initialization fails.
+    virtual ~WebGraphicsContext3D() { }
+
+    // Makes the OpenGL context current on the current thread. Returns true on
+    // success.
+    virtual bool makeContextCurrent() = 0;
+
+    // The size of the region into which this WebGraphicsContext3D is rendering.
+    // Returns the last values passed to reshape().
+    virtual int width() = 0;
+    virtual int height() = 0;
+
+    // Resizes the region into which this WebGraphicsContext3D is drawing.
+    virtual void reshape(int width, int height) = 0;
+
+    // GL_CHROMIUM_setVisibility - Changes the visibility of the backbuffer
+    virtual void setVisibilityCHROMIUM(bool visible) = 0;
+
+    // GL_CHROMIUM_gpu_memory_manager - sets callback to observe changes to memory allocation limits.
+    virtual void setMemoryAllocationChangedCallbackCHROMIUM(WebGraphicsMemoryAllocationChangedCallbackCHROMIUM* callback) { }
+
+    // Query whether it is built on top of compliant GLES2 implementation.
+    virtual bool isGLES2Compliant() = 0;
+
+    virtual bool setParentContext(WebGraphicsContext3D* parentContext) { return false; }
+
+    // Helper for software compositing path. Reads back the frame buffer into
+    // the memory region pointed to by "pixels" with size "bufferSize". It is
+    // expected that the storage for "pixels" covers (4 * width * height) bytes.
+    // Returns true on success.
+    virtual bool readBackFramebuffer(unsigned char* pixels, size_t bufferSize, WebGLId framebuffer, int width, int height) = 0;
+
+    // Returns the id of the texture which is used for storing the contents of
+    // the framebuffer associated with this context. This texture is accessible
+    // by the gpu-based page compositor.
+    virtual WebGLId getPlatformTextureId() = 0;
+
+    // Copies the contents of the off-screen render target used by the WebGL
+    // context to the corresponding texture used by the compositor.
+    virtual void prepareTexture() = 0;
+
+    // GL_CHROMIUM_post_sub_buffer - Copies part of the back buffer to the front buffer.
+    virtual void postSubBufferCHROMIUM(int x, int y, int width, int height) = 0;
+
+    // Synthesizes an OpenGL error which will be returned from a
+    // later call to getError. This is used to emulate OpenGL ES
+    // 2.0 behavior on the desktop and to enforce additional error
+    // checking mandated by WebGL.
+    //
+    // Per the behavior of glGetError, this stores at most one
+    // instance of any given error, and returns them from calls to
+    // getError in the order they were added.
+    virtual void synthesizeGLError(WGC3Denum) = 0;
+
+    virtual bool isContextLost() = 0;
+
+    // GL_CHROMIUM_map_sub
+    virtual void* mapBufferSubDataCHROMIUM(WGC3Denum target, WGC3Dintptr offset, WGC3Dsizeiptr size, WGC3Denum access) = 0;
+    virtual void unmapBufferSubDataCHROMIUM(const void*) = 0;
+    virtual void* mapTexSubImage2DCHROMIUM(WGC3Denum target, WGC3Dint level, WGC3Dint xoffset, WGC3Dint yoffset, WGC3Dsizei width, WGC3Dsizei height, WGC3Denum format, WGC3Denum type, WGC3Denum access) = 0;
+    virtual void unmapTexSubImage2DCHROMIUM(const void*) = 0;
+
+    // GL_CHROMIUM_request_extension
+    virtual WebString getRequestableExtensionsCHROMIUM() = 0;
+    virtual void requestExtensionCHROMIUM(const char*) = 0;
+
+    // GL_CHROMIUM_framebuffer_multisample
+    virtual void blitFramebufferCHROMIUM(WGC3Dint srcX0, WGC3Dint srcY0, WGC3Dint srcX1, WGC3Dint srcY1, WGC3Dint dstX0, WGC3Dint dstY0, WGC3Dint dstX1, WGC3Dint dstY1, WGC3Dbitfield mask, WGC3Denum filter) = 0;
+    virtual void renderbufferStorageMultisampleCHROMIUM(WGC3Denum target, WGC3Dsizei samples, WGC3Denum internalformat, WGC3Dsizei width, WGC3Dsizei height) = 0;
+
+    // GL_CHROMIUM_swapbuffers_complete_callback
+    virtual void setSwapBuffersCompleteCallbackCHROMIUM(WebGraphicsSwapBuffersCompleteCallbackCHROMIUM* callback) { }
+
+    // GL_CHROMIUM_rate_limit_offscreen_context
+    virtual void rateLimitOffscreenContextCHROMIUM() { }
+
+    // The entry points below map directly to the OpenGL ES 2.0 API.
+    // See: http://www.khronos.org/registry/gles/
+    // and: http://www.khronos.org/opengles/sdk/docs/man/
+    virtual void activeTexture(WGC3Denum texture) = 0;
+    virtual void attachShader(WebGLId program, WebGLId shader) = 0;
+    virtual void bindAttribLocation(WebGLId program, WGC3Duint index, const WGC3Dchar* name) = 0;
+    virtual void bindBuffer(WGC3Denum target, WebGLId buffer) = 0;
+    virtual void bindFramebuffer(WGC3Denum target, WebGLId framebuffer) = 0;
+    virtual void bindRenderbuffer(WGC3Denum target, WebGLId renderbuffer) = 0;
+    virtual void bindTexture(WGC3Denum target, WebGLId texture) = 0;
+    virtual void blendColor(WGC3Dclampf red, WGC3Dclampf green, WGC3Dclampf blue, WGC3Dclampf alpha) = 0;
+    virtual void blendEquation(WGC3Denum mode) = 0;
+    virtual void blendEquationSeparate(WGC3Denum modeRGB, WGC3Denum modeAlpha) = 0;
+    virtual void blendFunc(WGC3Denum sfactor, WGC3Denum dfactor) = 0;
+    virtual void blendFuncSeparate(WGC3Denum srcRGB, WGC3Denum dstRGB, WGC3Denum srcAlpha, WGC3Denum dstAlpha) = 0;
+
+    virtual void bufferData(WGC3Denum target, WGC3Dsizeiptr size, const void* data, WGC3Denum usage) = 0;
+    virtual void bufferSubData(WGC3Denum target, WGC3Dintptr offset, WGC3Dsizeiptr size, const void* data) = 0;
+
+    virtual WGC3Denum checkFramebufferStatus(WGC3Denum target) = 0;
+    virtual void clear(WGC3Dbitfield mask) = 0;
+    virtual void clearColor(WGC3Dclampf red, WGC3Dclampf green, WGC3Dclampf blue, WGC3Dclampf alpha) = 0;
+    virtual void clearDepth(WGC3Dclampf depth) = 0;
+    virtual void clearStencil(WGC3Dint s) = 0;
+    virtual void colorMask(WGC3Dboolean red, WGC3Dboolean green, WGC3Dboolean blue, WGC3Dboolean alpha) = 0;
+    virtual void compileShader(WebGLId shader) = 0;
+
+    virtual void compressedTexImage2D(WGC3Denum target, WGC3Dint level, WGC3Denum internalformat, WGC3Dsizei width, WGC3Dsizei height, WGC3Dint border, WGC3Dsizei imageSize, const void* data) = 0;
+    virtual void compressedTexSubImage2D(WGC3Denum target, WGC3Dint level, WGC3Dint xoffset, WGC3Dint yoffset, WGC3Dsizei width, WGC3Dsizei height, WGC3Denum format, WGC3Dsizei imageSize, const void* data) = 0;
+    virtual void copyTexImage2D(WGC3Denum target, WGC3Dint level, WGC3Denum internalformat, WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height, WGC3Dint border) = 0;
+    virtual void copyTexSubImage2D(WGC3Denum target, WGC3Dint level, WGC3Dint xoffset, WGC3Dint yoffset, WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height) = 0;
+    virtual void cullFace(WGC3Denum mode) = 0;
+    virtual void depthFunc(WGC3Denum func) = 0;
+    virtual void depthMask(WGC3Dboolean flag) = 0;
+    virtual void depthRange(WGC3Dclampf zNear, WGC3Dclampf zFar) = 0;
+    virtual void detachShader(WebGLId program, WebGLId shader) = 0;
+    virtual void disable(WGC3Denum cap) = 0;
+    virtual void disableVertexAttribArray(WGC3Duint index) = 0;
+    virtual void drawArrays(WGC3Denum mode, WGC3Dint first, WGC3Dsizei count) = 0;
+    virtual void drawElements(WGC3Denum mode, WGC3Dsizei count, WGC3Denum type, WGC3Dintptr offset) = 0;
+
+    virtual void enable(WGC3Denum cap) = 0;
+    virtual void enableVertexAttribArray(WGC3Duint index) = 0;
+    virtual void finish() = 0;
+    virtual void flush() = 0;
+    virtual void framebufferRenderbuffer(WGC3Denum target, WGC3Denum attachment, WGC3Denum renderbuffertarget, WebGLId renderbuffer) = 0;
+    virtual void framebufferTexture2D(WGC3Denum target, WGC3Denum attachment, WGC3Denum textarget, WebGLId texture, WGC3Dint level) = 0;
+    virtual void frontFace(WGC3Denum mode) = 0;
+    virtual void generateMipmap(WGC3Denum target) = 0;
+
+    virtual bool getActiveAttrib(WebGLId program, WGC3Duint index, ActiveInfo&) = 0;
+    virtual bool getActiveUniform(WebGLId program, WGC3Duint index, ActiveInfo&) = 0;
+    virtual void getAttachedShaders(WebGLId program, WGC3Dsizei maxCount, WGC3Dsizei* count, WebGLId* shaders) = 0;
+    virtual WGC3Dint getAttribLocation(WebGLId program, const WGC3Dchar* name) = 0;
+    virtual void getBooleanv(WGC3Denum pname, WGC3Dboolean* value) = 0;
+    virtual void getBufferParameteriv(WGC3Denum target, WGC3Denum pname, WGC3Dint* value) = 0;
+    virtual Attributes getContextAttributes() = 0;
+    virtual WGC3Denum getError() = 0;
+    virtual void getFloatv(WGC3Denum pname, WGC3Dfloat* value) = 0;
+    virtual void getFramebufferAttachmentParameteriv(WGC3Denum target, WGC3Denum attachment, WGC3Denum pname, WGC3Dint* value) = 0;
+    virtual void getIntegerv(WGC3Denum pname, WGC3Dint* value) = 0;
+    virtual void getProgramiv(WebGLId program, WGC3Denum pname, WGC3Dint* value) = 0;
+    virtual WebString getProgramInfoLog(WebGLId program) = 0;
+    virtual void getRenderbufferParameteriv(WGC3Denum target, WGC3Denum pname, WGC3Dint* value) = 0;
+    virtual void getShaderiv(WebGLId shader, WGC3Denum pname, WGC3Dint* value) = 0;
+    virtual WebString getShaderInfoLog(WebGLId shader) = 0;
+
+    // TBD
+    // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+    virtual WebString getShaderSource(WebGLId shader) = 0;
+    virtual WebString getString(WGC3Denum name) = 0;
+    virtual void getTexParameterfv(WGC3Denum target, WGC3Denum pname, WGC3Dfloat* value) = 0;
+    virtual void getTexParameteriv(WGC3Denum target, WGC3Denum pname, WGC3Dint* value) = 0;
+    virtual void getUniformfv(WebGLId program, WGC3Dint location, WGC3Dfloat* value) = 0;
+    virtual void getUniformiv(WebGLId program, WGC3Dint location, WGC3Dint* value) = 0;
+    virtual WGC3Dint getUniformLocation(WebGLId program, const WGC3Dchar* name) = 0;
+    virtual void getVertexAttribfv(WGC3Duint index, WGC3Denum pname, WGC3Dfloat* value) = 0;
+    virtual void getVertexAttribiv(WGC3Duint index, WGC3Denum pname, WGC3Dint* value) = 0;
+    virtual WGC3Dsizeiptr getVertexAttribOffset(WGC3Duint index, WGC3Denum pname) = 0;
+
+    virtual void hint(WGC3Denum target, WGC3Denum mode) = 0;
+    virtual WGC3Dboolean isBuffer(WebGLId buffer) = 0;
+    virtual WGC3Dboolean isEnabled(WGC3Denum cap) = 0;
+    virtual WGC3Dboolean isFramebuffer(WebGLId framebuffer) = 0;
+    virtual WGC3Dboolean isProgram(WebGLId program) = 0;
+    virtual WGC3Dboolean isRenderbuffer(WebGLId renderbuffer) = 0;
+    virtual WGC3Dboolean isShader(WebGLId shader) = 0;
+    virtual WGC3Dboolean isTexture(WebGLId texture) = 0;
+    virtual void lineWidth(WGC3Dfloat) = 0;
+    virtual void linkProgram(WebGLId program) = 0;
+    virtual void pixelStorei(WGC3Denum pname, WGC3Dint param) = 0;
+    virtual void polygonOffset(WGC3Dfloat factor, WGC3Dfloat units) = 0;
+
+    virtual void readPixels(WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height, WGC3Denum format, WGC3Denum type, void* pixels) = 0;
+
+    virtual void releaseShaderCompiler() = 0;
+
+    virtual void renderbufferStorage(WGC3Denum target, WGC3Denum internalformat, WGC3Dsizei width, WGC3Dsizei height) = 0;
+    virtual void sampleCoverage(WGC3Dclampf value, WGC3Dboolean invert) = 0;
+    virtual void scissor(WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height) = 0;
+    virtual void shaderSource(WebGLId shader, const WGC3Dchar* string) = 0;
+    virtual void stencilFunc(WGC3Denum func, WGC3Dint ref, WGC3Duint mask) = 0;
+    virtual void stencilFuncSeparate(WGC3Denum face, WGC3Denum func, WGC3Dint ref, WGC3Duint mask) = 0;
+    virtual void stencilMask(WGC3Duint mask) = 0;
+    virtual void stencilMaskSeparate(WGC3Denum face, WGC3Duint mask) = 0;
+    virtual void stencilOp(WGC3Denum fail, WGC3Denum zfail, WGC3Denum zpass) = 0;
+    virtual void stencilOpSeparate(WGC3Denum face, WGC3Denum fail, WGC3Denum zfail, WGC3Denum zpass) = 0;
+
+    virtual void texImage2D(WGC3Denum target, WGC3Dint level, WGC3Denum internalformat, WGC3Dsizei width, WGC3Dsizei height, WGC3Dint border, WGC3Denum format, WGC3Denum type, const void* pixels) = 0;
+
+    virtual void texParameterf(WGC3Denum target, WGC3Denum pname, WGC3Dfloat param) = 0;
+    virtual void texParameteri(WGC3Denum target, WGC3Denum pname, WGC3Dint param) = 0;
+
+    virtual void texSubImage2D(WGC3Denum target, WGC3Dint level, WGC3Dint xoffset, WGC3Dint yoffset, WGC3Dsizei width, WGC3Dsizei height, WGC3Denum format, WGC3Denum type, const void* pixels) = 0;
+
+    virtual void uniform1f(WGC3Dint location, WGC3Dfloat x) = 0;
+    virtual void uniform1fv(WGC3Dint location, WGC3Dsizei count, const WGC3Dfloat* v) = 0;
+    virtual void uniform1i(WGC3Dint location, WGC3Dint x) = 0;
+    virtual void uniform1iv(WGC3Dint location, WGC3Dsizei count, const WGC3Dint* v) = 0;
+    virtual void uniform2f(WGC3Dint location, WGC3Dfloat x, WGC3Dfloat y) = 0;
+    virtual void uniform2fv(WGC3Dint location, WGC3Dsizei count, const WGC3Dfloat* v) = 0;
+    virtual void uniform2i(WGC3Dint location, WGC3Dint x, WGC3Dint y) = 0;
+    virtual void uniform2iv(WGC3Dint location, WGC3Dsizei count, const WGC3Dint* v) = 0;
+    virtual void uniform3f(WGC3Dint location, WGC3Dfloat x, WGC3Dfloat y, WGC3Dfloat z) = 0;
+    virtual void uniform3fv(WGC3Dint location, WGC3Dsizei count, const WGC3Dfloat* v) = 0;
+    virtual void uniform3i(WGC3Dint location, WGC3Dint x, WGC3Dint y, WGC3Dint z) = 0;
+    virtual void uniform3iv(WGC3Dint location, WGC3Dsizei count, const WGC3Dint* v) = 0;
+    virtual void uniform4f(WGC3Dint location, WGC3Dfloat x, WGC3Dfloat y, WGC3Dfloat z, WGC3Dfloat w) = 0;
+    virtual void uniform4fv(WGC3Dint location, WGC3Dsizei count, const WGC3Dfloat* v) = 0;
+    virtual void uniform4i(WGC3Dint location, WGC3Dint x, WGC3Dint y, WGC3Dint z, WGC3Dint w) = 0;
+    virtual void uniform4iv(WGC3Dint location, WGC3Dsizei count, const WGC3Dint* v) = 0;
+    virtual void uniformMatrix2fv(WGC3Dint location, WGC3Dsizei count, WGC3Dboolean transpose, const WGC3Dfloat* value) = 0;
+    virtual void uniformMatrix3fv(WGC3Dint location, WGC3Dsizei count, WGC3Dboolean transpose, const WGC3Dfloat* value) = 0;
+    virtual void uniformMatrix4fv(WGC3Dint location, WGC3Dsizei count, WGC3Dboolean transpose, const WGC3Dfloat* value) = 0;
+
+    virtual void useProgram(WebGLId program) = 0;
+    virtual void validateProgram(WebGLId program) = 0;
+
+    virtual void vertexAttrib1f(WGC3Duint index, WGC3Dfloat x) = 0;
+    virtual void vertexAttrib1fv(WGC3Duint index, const WGC3Dfloat* values) = 0;
+    virtual void vertexAttrib2f(WGC3Duint index, WGC3Dfloat x, WGC3Dfloat y) = 0;
+    virtual void vertexAttrib2fv(WGC3Duint index, const WGC3Dfloat* values) = 0;
+    virtual void vertexAttrib3f(WGC3Duint index, WGC3Dfloat x, WGC3Dfloat y, WGC3Dfloat z) = 0;
+    virtual void vertexAttrib3fv(WGC3Duint index, const WGC3Dfloat* values) = 0;
+    virtual void vertexAttrib4f(WGC3Duint index, WGC3Dfloat x, WGC3Dfloat y, WGC3Dfloat z, WGC3Dfloat w) = 0;
+    virtual void vertexAttrib4fv(WGC3Duint index, const WGC3Dfloat* values) = 0;
+    virtual void vertexAttribPointer(WGC3Duint index, WGC3Dint size, WGC3Denum type, WGC3Dboolean normalized,
+                                     WGC3Dsizei stride, WGC3Dintptr offset) = 0;
+
+    virtual void viewport(WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height) = 0;
+
+    // Support for buffer creation and deletion.
+    virtual WebGLId createBuffer() = 0;
+    virtual WebGLId createFramebuffer() = 0;
+    virtual WebGLId createProgram() = 0;
+    virtual WebGLId createRenderbuffer() = 0;
+    virtual WebGLId createShader(WGC3Denum) = 0;
+    virtual WebGLId createTexture() = 0;
+
+    virtual void deleteBuffer(WebGLId) = 0;
+    virtual void deleteFramebuffer(WebGLId) = 0;
+    virtual void deleteProgram(WebGLId) = 0;
+    virtual void deleteRenderbuffer(WebGLId) = 0;
+    virtual void deleteShader(WebGLId) = 0;
+    virtual void deleteTexture(WebGLId) = 0;
+
+    virtual void setContextLostCallback(WebGraphicsContextLostCallback* callback) { }
+    virtual void setErrorMessageCallback(WebGraphicsErrorMessageCallback* callback) { }
+    // GL_ARB_robustness
+    //
+    // This entry point must provide slightly different semantics than
+    // the GL_ARB_robustness extension; specifically, the lost context
+    // state is sticky, rather than reported only once.
+    virtual WGC3Denum getGraphicsResetStatusARB() { return 0; /* GL_NO_ERROR */ }
+
+    // FIXME: make this function pure virtual once it is implemented in
+    // both command buffer port and in-process port.
+    virtual WebString getTranslatedShaderSourceANGLE(WebGLId shader) { return WebString(); }
+
+    // GL_CHROMIUM_iosurface
+    virtual void texImageIOSurface2DCHROMIUM(WGC3Denum target, WGC3Dint width, WGC3Dint height, WGC3Duint ioSurfaceId, WGC3Duint plane) { }
+
+    // GL_EXT_texture_storage
+    virtual void texStorage2DEXT(WGC3Denum target, WGC3Dint levels, WGC3Duint internalformat,
+                                 WGC3Dint width, WGC3Dint height) { }
+
+
+#if WEBKIT_USING_SKIA
+    GrGLInterface* createGrGLInterface();
+#endif
+
+protected:
+#if WEBKIT_USING_SKIA
+    virtual GrGLInterface* onCreateGrGLInterface() { return 0; }
+#endif
+
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/Platform/chromium/public/WebLayer.h b/Source/Platform/chromium/public/WebLayer.h
new file mode 100644
index 000000000..3d919fa46
--- /dev/null
+++ b/Source/Platform/chromium/public/WebLayer.h
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebLayer_h
+#define WebLayer_h
+
+#include "WebColor.h"
+#include "WebCommon.h"
+#include "WebPrivatePtr.h"
+
+class SkMatrix44;
+namespace WebCore { class LayerChromium; }
+
+namespace WebKit {
+struct WebFloatPoint;
+struct WebSize;
+
+class WebLayer {
+public:
+    WEBKIT_EXPORT static WebLayer create();
+
+    WebLayer() { }
+    WebLayer(const WebLayer& layer) { assign(layer); }
+    virtual ~WebLayer() { reset(); }
+    WebLayer& operator=(const WebLayer& layer)
+    {
+        assign(layer);
+        return *this;
+    }
+    bool isNull() { return m_private.isNull(); }
+    WEBKIT_EXPORT void reset();
+    WEBKIT_EXPORT void assign(const WebLayer&);
+    WEBKIT_EXPORT bool equals(const WebLayer&) const;
+
+    WEBKIT_EXPORT WebLayer rootLayer() const;
+    WEBKIT_EXPORT WebLayer parent() const;
+    WEBKIT_EXPORT void addChild(const WebLayer&);
+    WEBKIT_EXPORT void insertChild(const WebLayer&, size_t index);
+    WEBKIT_EXPORT void replaceChild(const WebLayer& reference, const WebLayer& newLayer);
+    WEBKIT_EXPORT void removeFromParent();
+    WEBKIT_EXPORT void removeAllChildren();
+
+    WEBKIT_EXPORT void setAnchorPoint(const WebFloatPoint&);
+    WEBKIT_EXPORT WebFloatPoint anchorPoint() const;
+
+    WEBKIT_EXPORT void setAnchorPointZ(float);
+    WEBKIT_EXPORT float anchorPointZ() const;
+
+    WEBKIT_EXPORT void setBounds(const WebSize&);
+    WEBKIT_EXPORT WebSize bounds() const;
+
+    WEBKIT_EXPORT void setMasksToBounds(bool);
+    WEBKIT_EXPORT bool masksToBounds() const;
+
+    WEBKIT_EXPORT void setMaskLayer(const WebLayer&);
+    WEBKIT_EXPORT WebLayer maskLayer() const;
+
+    WEBKIT_EXPORT void setOpacity(float);
+    WEBKIT_EXPORT float opacity() const;
+
+    WEBKIT_EXPORT void setOpaque(bool);
+    WEBKIT_EXPORT bool opaque() const;
+
+    WEBKIT_EXPORT void setPosition(const WebFloatPoint&);
+    WEBKIT_EXPORT WebFloatPoint position() const;
+
+    WEBKIT_EXPORT void setSublayerTransform(const SkMatrix44&);
+    WEBKIT_EXPORT SkMatrix44 sublayerTransform() const;
+
+    WEBKIT_EXPORT void setTransform(const SkMatrix44&);
+    WEBKIT_EXPORT SkMatrix44 transform() const;
+
+    WEBKIT_EXPORT void setDebugBorderColor(const WebColor&);
+    WEBKIT_EXPORT void setDebugBorderWidth(float);
+
+    template<typename T> T to()
+    {
+        T res;
+        res.WebLayer::assign(*this);
+        return res;
+    }
+
+    template<typename T> const T toConst() const
+    {
+        T res;
+        res.WebLayer::assign(*this);
+        return res;
+    }
+
+#if WEBKIT_IMPLEMENTATION
+    WebLayer(const WTF::PassRefPtr<WebCore::LayerChromium>&);
+    WebLayer& operator=(const WTF::PassRefPtr<WebCore::LayerChromium>&);
+    operator WTF::PassRefPtr<WebCore::LayerChromium>() const;
+    template<typename T> T* unwrap()
+    {
+        return static_cast<T*>(m_private.get());
+    }
+
+    template<typename T> const T* constUnwrap() const
+    {
+        return static_cast<const T*>(m_private.get());
+    }
+#endif
+
+protected:
+    WebPrivatePtr<WebCore::LayerChromium> m_private;
+};
+
+inline bool operator==(const WebLayer& a, const WebLayer& b)
+{
+    return a.equals(b);
+}
+
+inline bool operator!=(const WebLayer& a, const WebLayer& b)
+{
+    return !(a == b);
+}
+
+} // namespace WebKit
+
+#endif // WebLayer_h
diff --git a/Source/Platform/chromium/public/WebLayerTreeView.h b/Source/Platform/chromium/public/WebLayerTreeView.h
new file mode 100644
index 000000000..3ef295d94
--- /dev/null
+++ b/Source/Platform/chromium/public/WebLayerTreeView.h
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebLayerTreeView_h
+#define WebLayerTreeView_h
+
+#include "WebCommon.h"
+#include "WebPrivatePtr.h"
+
+namespace WebCore {
+class CCLayerTreeHost;
+struct CCSettings;
+}
+
+namespace WebKit {
+class WebGraphicsContext3D;
+class WebLayer;
+class WebLayerTreeViewClient;
+struct WebPoint;
+struct WebRect;
+struct WebSize;
+
+class WebLayerTreeView {
+public:
+    struct Settings {
+        Settings()
+            : acceleratePainting(false)
+            , compositeOffscreen(false)
+            , showFPSCounter(false)
+            , showPlatformLayerTree(false)
+            , refreshRate(0)
+            , perTilePainting(false)
+            , partialSwapEnabled(false)
+            , threadedAnimationEnabled(false)
+        {
+        }
+
+        bool acceleratePainting;
+        bool compositeOffscreen;
+        bool showFPSCounter;
+        bool showPlatformLayerTree;
+        double refreshRate;
+        bool perTilePainting;
+        bool partialSwapEnabled;
+        bool threadedAnimationEnabled;
+#if WEBKIT_IMPLEMENTATION
+        operator WebCore::CCSettings() const;
+#endif
+    };
+
+    WebLayerTreeView() { }
+    WebLayerTreeView(const WebLayerTreeView& layer) { assign(layer); }
+    ~WebLayerTreeView() { reset(); }
+    WebLayerTreeView& operator=(const WebLayerTreeView& layer)
+    {
+        assign(layer);
+        return *this;
+    }
+
+    WEBKIT_EXPORT void reset();
+    WEBKIT_EXPORT void assign(const WebLayerTreeView&);
+    WEBKIT_EXPORT bool equals(const WebLayerTreeView&) const;
+
+    bool isNull() const { return m_private.isNull(); }
+
+#define WEBLAYERTREEVIEW_HAS_INITIALIZE
+    // Initialization and lifecycle --------------------------------------
+
+    // Attempts to initialize this WebLayerTreeView with the given client, root layer, and settings.
+    // If initialization fails, this will return false and .isNull() will return true.
+    // Must be called before any methods below.
+    WEBKIT_EXPORT bool initialize(WebLayerTreeViewClient*, const WebLayer& root, const Settings&);
+
+    // Sets the root of the tree. The root is set by way of the constructor.
+    // This is typically used to explicitly set the root to null to break
+    // cycles.
+    WEBKIT_EXPORT void setRootLayer(WebLayer*);
+
+    // Returns a unique identifier that can be used on the compositor thread to request a
+    // WebCompositorInputHandler instance.
+    WEBKIT_EXPORT int compositorIdentifier();
+
+
+    // View properties ---------------------------------------------------
+
+    WEBKIT_EXPORT void setViewportSize(const WebSize&);
+    WEBKIT_EXPORT WebSize viewportSize() const;
+
+    // Sets whether this view is visible. In threaded mode, a view that is not visible will not
+    // composite or trigger updateAnimations() or layout() calls until it becomes visible.
+    WEBKIT_EXPORT void setVisible(bool);
+
+    // Sets the current page scale factor and minimum / maximum limits. Both limits are initially 1 (no page scale allowed).
+    WEBKIT_EXPORT void setPageScaleFactorAndLimits(float pageScaleFactor, float minimum, float maximum);
+
+    // Starts an animation of the page scale to a target scale factor and scroll offset.
+    // If useAnchor is true, destination is a point on the screen that will remain fixed for the duration of the animation.
+    // If useAnchor is false, destination is the final top-left scroll position.
+    WEBKIT_EXPORT void startPageScaleAnimation(const WebPoint& destination, bool useAnchor, float newPageScale, double durationSec);
+
+
+    // Flow control and scheduling ---------------------------------------
+
+    // Requests an updateAnimations() call.
+    WEBKIT_EXPORT void setNeedsAnimate();
+
+    // Indicates that the view needs to be redrawn. This is typically used when the frontbuffer is damaged.
+    WEBKIT_EXPORT void setNeedsRedraw();
+
+    // Triggers a compositing pass. If the compositor thread was not
+    // enabled via WebCompositor::initialize, the compositing pass happens
+    // immediately. If it is enabled, the compositing pass will happen at a
+    // later time. Before the compositing pass happens (i.e. before composite()
+    // returns when the compositor thread is disabled), WebContentLayers will be
+    // asked to paint their dirty region, through
+    // WebContentLayerClient::paintContents.
+    WEBKIT_EXPORT void composite();
+
+    // Immediately update animations. This should only be used when frame scheduling is handled by
+    // the WebLayerTreeView user and not internally by the compositor, meaning only in single-threaded
+    // mode.
+    WEBKIT_EXPORT void updateAnimations(double frameBeginTime);
+
+    // Composites and attempts to read back the result into the provided
+    // buffer. If it wasn't possible, e.g. due to context lost, will return
+    // false. Pixel format is 32bit (RGBA), and the provided buffer must be
+    // large enough contain viewportSize().width() * viewportSize().height()
+    // pixels. The WebLayerTreeView does not assume ownership of the buffer.
+    // The buffer is not modified if the false is returned.
+    WEBKIT_EXPORT bool compositeAndReadback(void *pixels, const WebRect&);
+
+    // Blocks until the most recently composited frame has finished rendering on the GPU.
+    // This can have a significant performance impact and should be used with care.
+    WEBKIT_EXPORT void finishAllRendering();
+
+    // Returns the context being used for rendering this view. In threaded compositing mode, it is
+    // not safe to use this context for anything on the main thread, other than passing the pointer to
+    // the compositor thread.
+    WEBKIT_EXPORT WebGraphicsContext3D* context();
+
+    // Debugging / dangerous ---------------------------------------------
+
+    // Simulates a lost context. For testing only.
+    WEBKIT_EXPORT void loseCompositorContext(int numTimes);
+
+protected:
+    WebPrivatePtr<WebCore::CCLayerTreeHost> m_private;
+};
+
+inline bool operator==(const WebLayerTreeView& a, const WebLayerTreeView& b)
+{
+    return a.equals(b);
+}
+
+inline bool operator!=(const WebLayerTreeView& a, const WebLayerTreeView& b)
+{
+    return !(a == b);
+}
+
+} // namespace WebKit
+
+#endif // WebLayerTreeView_h
diff --git a/Source/Platform/chromium/public/WebLayerTreeViewClient.h b/Source/Platform/chromium/public/WebLayerTreeViewClient.h
new file mode 100644
index 000000000..5c0b9ef9a
--- /dev/null
+++ b/Source/Platform/chromium/public/WebLayerTreeViewClient.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebLayerTreeViewClient_h
+#define WebLayerTreeViewClient_h
+
+namespace WebKit {
+class WebGraphicsContext3D;
+struct WebSize;
+class WebThread;
+
+class WebLayerTreeViewClient {
+public:
+    // Updates animation and layout. These are called before the compositing
+    // pass so that layers can be updated at the given frame time.
+    virtual void updateAnimations(double frameBeginTime) = 0;
+    virtual void layout() = 0;
+
+    // Applies a scroll delta to the root layer, which is bundled with a page
+    // scale factor that may apply a CSS transform on the whole document (used
+    // for mobile-device pinch zooming). This is triggered by events sent to the
+    // compositor thread through the WebCompositor interface.
+    virtual void applyScrollAndScale(const WebSize& scrollDelta, float scaleFactor) = 0;
+
+    // Creates a 3D context suitable for the compositing. This may be called
+    // more than once if the context gets lost.
+    virtual WebGraphicsContext3D* createContext3D() = 0;
+
+    // Signals a successful rebinding of the 3D context (e.g. after a lost
+    // context event).
+    virtual void didRebindGraphicsContext(bool success) = 0;
+
+    virtual void didCommitAndDrawFrame() = 0;
+    virtual void didCompleteSwapBuffers() = 0;
+
+    // Schedules a compositing pass, meaning the client should call
+    // WebLayerTreeView::composite at a later time. This is only called if the
+    // compositor thread is disabled; when enabled, the compositor will
+    // internally schedule a compositing pass when needed.
+    virtual void scheduleComposite() = 0;
+
+protected:
+    virtual ~WebLayerTreeViewClient() { }
+};
+
+} // namespace WebKit
+
+#endif // WebLayerTreeViewClient_h
diff --git a/Source/Platform/chromium/public/WebNonCopyable.h b/Source/Platform/chromium/public/WebNonCopyable.h
new file mode 100644
index 000000000..b0bd4565c
--- /dev/null
+++ b/Source/Platform/chromium/public/WebNonCopyable.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNonCopyable_h
+#define WebNonCopyable_h
+
+namespace WebKit {
+
+// A base class to extend from if you do not support copying.
+class WebNonCopyable {
+protected:
+    WebNonCopyable() { }
+    ~WebNonCopyable() { }
+
+private:
+    WebNonCopyable(const WebNonCopyable&);
+    WebNonCopyable& operator=(const WebNonCopyable&);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/Platform/chromium/public/WebPrivatePtr.h b/Source/Platform/chromium/public/WebPrivatePtr.h
new file mode 100644
index 000000000..31d09a90b
--- /dev/null
+++ b/Source/Platform/chromium/public/WebPrivatePtr.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPrivatePtr_h
+#define WebPrivatePtr_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+#include <wtf/PassRefPtr.h>
+#endif
+
+namespace WebKit {
+
+// This class is an implementation detail of the WebKit API.  It exists
+// to help simplify the implementation of WebKit interfaces that merely
+// wrap a reference counted WebCore class.
+template <typename T>
+class WebPrivatePtr {
+public:
+    WebPrivatePtr() : m_ptr(0) { }
+    ~WebPrivatePtr() { WEBKIT_ASSERT(!m_ptr); }
+
+    bool isNull() const { return !m_ptr; }
+
+#if WEBKIT_IMPLEMENTATION
+    WebPrivatePtr(const PassRefPtr<T>& prp)
+        : m_ptr(prp.leakRef())
+    {
+    }
+
+    void reset()
+    {
+        assign(0);
+    }
+
+    WebPrivatePtr<T>& operator=(const WebPrivatePtr<T>& other)
+    {
+        T* p = other.m_ptr;
+        if (p)
+            p->ref();
+        assign(p);
+        return *this;
+    }
+
+    WebPrivatePtr<T>& operator=(const PassRefPtr<T>& prp)
+    {
+        assign(prp.leakRef());
+        return *this;
+    }
+
+    T* get() const
+    {
+        return m_ptr;
+    }
+
+    T* operator->() const
+    {
+        ASSERT(m_ptr);
+        return m_ptr;
+    }
+#endif
+
+private:
+#if WEBKIT_IMPLEMENTATION
+    void assign(T* p)
+    {
+        // p is already ref'd for us by the caller
+        if (m_ptr)
+            m_ptr->deref();
+        m_ptr = p;
+    }
+#endif
+
+    T* m_ptr;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/Platform/chromium/public/WebSolidColorLayer.h b/Source/Platform/chromium/public/WebSolidColorLayer.h
new file mode 100644
index 000000000..ad9123d96
--- /dev/null
+++ b/Source/Platform/chromium/public/WebSolidColorLayer.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSolidColorLayer_h
+#define WebSolidColorLayer_h
+
+#include "WebCommon.h"
+#include "WebFloatRect.h"
+#include "WebLayer.h"
+
+namespace WebKit {
+class WebSolidColorLayerImpl;
+
+class WebSolidColorLayer : public WebLayer {
+public:
+    WEBKIT_EXPORT static WebSolidColorLayer create();
+    WEBKIT_EXPORT void setBackgroundColor(const WebColor&);
+
+#if WEBKIT_IMPLEMENTATION
+    WebSolidColorLayer(const WTF::PassRefPtr<WebSolidColorLayerImpl>&);
+#endif
+};
+
+} // namespace WebKit
+
+#endif // WebSolidColorLayer_h
diff --git a/Source/ThirdParty/ANGLE/ChangeLog b/Source/ThirdParty/ANGLE/ChangeLog
index db1a8388b..c8948179f 100644
--- a/Source/ThirdParty/ANGLE/ChangeLog
+++ b/Source/ThirdParty/ANGLE/ChangeLog
@@ -1,3 +1,12 @@
+2012-03-09  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        Bash scripts should support LF endings only
+        https://bugs.webkit.org/show_bug.cgi?id=79509
+
+        Reviewed by David Kilzer.
+
+        * src/compiler/generate_parser.sh: Added property svn:eol-style.
+
 2012-02-21  Sam Weinig  <sam@webkit.org>
 
         Attempt to fix the Snow Leopard build.
diff --git a/Source/ThirdParty/ChangeLog b/Source/ThirdParty/ChangeLog
index 3e2010833..e19eb3704 100644
--- a/Source/ThirdParty/ChangeLog
+++ b/Source/ThirdParty/ChangeLog
@@ -1,3 +1,29 @@
+2012-03-09  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        Bash scripts should support LF endings only
+        https://bugs.webkit.org/show_bug.cgi?id=79509
+
+        Reviewed by David Kilzer.
+
+        * gtest/xcode/Samples/FrameworkSample/runtests.sh: Added property svn:executable.
+        * gtest/xcode/Scripts/runtests.sh: Added property svn:executable.
+
+2012-03-08  Jessie Berlin  <jberlin@apple.com>
+
+        More Windows build fixing.
+
+        * gtest/msvc/gtest-md.vcproj:
+
+2012-03-07  Jessie Berlin  <jberlin@apple.com>
+
+        Clean Windows build fails after r110033
+        https://bugs.webkit.org/show_bug.cgi?id=80553
+
+        Rubber-stamped by Jon Honeycutt and Eric Seidel.
+
+        * gtest/msvc/gtest-md.vcproj:
+        Add the new JavaScriptCore include directory to the include path.
+
 2012-02-21  Sam Weinig  <sam@webkit.org>
 
         Attempt to fix the Snow Leopard build.
diff --git a/Source/ThirdParty/gtest/msvc/gtest-md.vcproj b/Source/ThirdParty/gtest/msvc/gtest-md.vcproj
index 6c987e9c3..0d09469e5 100644
--- a/Source/ThirdParty/gtest/msvc/gtest-md.vcproj
+++ b/Source/ThirdParty/gtest/msvc/gtest-md.vcproj
@@ -40,8 +40,8 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;"
 				Optimization="0"
+				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;"
 				PreprocessorDefinitions="WIN32;_DEBUG;_LIB"
 				MinimalRebuild="true"
 				BasicRuntimeChecks="3"
@@ -104,7 +104,7 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;"
+				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;"
 				PreprocessorDefinitions="WIN32;NDEBUG;_LIB"
 				RuntimeLibrary="2"
 				UsePrecompiledHeader="0"
@@ -166,8 +166,8 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;"
 				Optimization="0"
+				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;"
 				PreprocessorDefinitions="WIN32;_DEBUG;_LIB"
 				MinimalRebuild="true"
 				BasicRuntimeChecks="3"
@@ -231,7 +231,7 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;"
+				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;"
 				PreprocessorDefinitions="WIN32;NDEBUG;_LIB"
 				RuntimeLibrary="2"
 				UsePrecompiledHeader="0"
@@ -293,7 +293,7 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;"
+				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;"
 				PreprocessorDefinitions="WIN32;NDEBUG;_LIB"
 				RuntimeLibrary="2"
 				UsePrecompiledHeader="0"
@@ -355,8 +355,8 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;"
 				Optimization="0"
+				AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;"
 				PreprocessorDefinitions="WIN32;_DEBUG;_LIB"
 				MinimalRebuild="true"
 				BasicRuntimeChecks="3"
diff --git a/Source/ThirdParty/gtest/xcode/Config/General.xcconfig b/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
index 93307b687..5a085ede9 100644
--- a/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
+++ b/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
@@ -12,7 +12,7 @@
 // Not building PowerPC any more
 ARCHS = i386 x86_64
 
-HEADER_SEARCH_PATHS = $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders ../ ../include/
+HEADER_SEARCH_PATHS = $(BUILT_PRODUCTS_DIR)/usr/local/include $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders ../ ../include/
 
 // Zerolink prevents link warnings so turn it off
 ZERO_LINK = NO
diff --git a/Source/ThirdParty/gtest/xcode/Samples/FrameworkSample/runtests.sh b/Source/ThirdParty/gtest/xcode/Samples/FrameworkSample/runtests.sh
index 4a0d413e5..4a0d413e5 100644..100755
--- a/Source/ThirdParty/gtest/xcode/Samples/FrameworkSample/runtests.sh
+++ b/Source/ThirdParty/gtest/xcode/Samples/FrameworkSample/runtests.sh
diff --git a/Source/ThirdParty/gtest/xcode/Scripts/runtests.sh b/Source/ThirdParty/gtest/xcode/Scripts/runtests.sh
index 3fc229f1d..3fc229f1d 100644..100755
--- a/Source/ThirdParty/gtest/xcode/Scripts/runtests.sh
+++ b/Source/ThirdParty/gtest/xcode/Scripts/runtests.sh
diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
index 3004dd46a..74baacc8b 100644
--- a/Source/WTF/ChangeLog
+++ b/Source/WTF/ChangeLog
@@ -1,3 +1,9 @@
+2012-03-07  Mark Rowe  <mrowe@apple.com>
+
+        Teach make to build WTF.
+
+        * Makefile: Added.
+
 2012-02-11  Filip Pizlo  <fpizlo@apple.com>
 
         It should be possible to send all JSC debug logging to a file
diff --git a/Source/WTF/Makefile b/Source/WTF/Makefile
new file mode 100644
index 000000000..cb4c11a57
--- /dev/null
+++ b/Source/WTF/Makefile
@@ -0,0 +1 @@
+include ../Makefile.shared
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index 90efc6dba..2fcc26557 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -1,6 +1,9 @@
 SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}"
     "${WEBCORE_DIR}/Modules/geolocation"
+    "${WEBCORE_DIR}/Modules/indexeddb"
+    "${WEBCORE_DIR}/Modules/webdatabase"
+    "${WEBCORE_DIR}/Modules/websockets"
     "${WEBCORE_DIR}/accessibility"
     "${WEBCORE_DIR}/bindings"
     "${WEBCORE_DIR}/bindings/generic"
@@ -90,6 +93,9 @@ SET(WebCore_INCLUDE_DIRECTORIES
 
 SET(WebCore_IDL_INCLUDES
     Modules/geolocation
+    Modules/indexeddb
+    Modules/webdatabase
+    Modules/websockets
     bindings/generic
     css
     dom
@@ -115,6 +121,9 @@ SET(WebCore_IDL_FILES
     Modules/geolocation/PositionError.idl
     Modules/geolocation/PositionErrorCallback.idl
 
+    Modules/websockets/CloseEvent.idl
+    Modules/websockets/DOMWindowWebSocket.idl
+
     css/Counter.idl
     css/CSSCharsetRule.idl
     css/CSSFontFaceRule.idl
@@ -216,7 +225,6 @@ SET(WebCore_IDL_FILES
     html/DOMSettableTokenList.idl
     html/DOMTokenList.idl
     html/DOMURL.idl
-    html/DOMWindowHTML.idl
     html/HTMLAllCollection.idl
     html/HTMLAnchorElement.idl
     html/HTMLAppletElement.idl
@@ -388,10 +396,6 @@ SET(WebCore_IDL_FILES
     webaudio/LowPass2FilterNode.idl
     webaudio/RealtimeAnalyserNode.idl
 
-    websockets/CloseEvent.idl
-    websockets/DOMWindowWebSocket.idl
-
-    xml/DOMWindowXML.idl
     xml/DOMParser.idl
     xml/XMLHttpRequest.idl
     xml/XMLHttpRequestException.idl
@@ -506,6 +510,7 @@ SET(WebCore_SOURCES
     css/ShadowValue.cpp
     css/StyleMedia.cpp
     css/StylePropertySet.cpp
+    css/StyleRule.cpp
     css/StyleSheet.cpp
     css/StyleSheetList.cpp
     css/WebKitCSSFilterValue.cpp
@@ -533,6 +538,7 @@ SET(WebCore_SOURCES
     dom/Comment.cpp
     dom/CompositionEvent.cpp
     dom/ContainerNode.cpp
+    dom/ContextDestructionObserver.cpp
     dom/CustomEvent.cpp
     dom/DatasetDOMStringMap.cpp
     dom/DecodedDataDocumentParser.cpp
@@ -603,6 +609,7 @@ SET(WebCore_SOURCES
     dom/QualifiedName.cpp
     dom/Range.cpp
     dom/RangeException.cpp
+    dom/RegionNodeList.cpp
     dom/RegisteredEventListener.cpp
     dom/ScopedEventQueue.cpp
     dom/ScriptableDocumentParser.cpp
@@ -612,7 +619,7 @@ SET(WebCore_SOURCES
     dom/SecurityContext.cpp
     dom/SelectorQuery.cpp
     dom/ShadowRoot.cpp
-    dom/ShadowRootList.cpp
+    dom/ShadowTree.cpp
     dom/SpaceSplitString.cpp
     dom/StaticHashSetNodeList.cpp
     dom/StaticNodeList.cpp
@@ -716,6 +723,7 @@ SET(WebCore_SOURCES
 
     html/BaseButtonInputType.cpp
     html/BaseCheckableInputType.cpp
+    html/BaseClickableWithKeyInputType.cpp
     html/BaseDateAndTimeInputType.cpp
     html/BaseTextInputType.cpp
     html/ButtonInputType.cpp
@@ -821,6 +829,7 @@ SET(WebCore_SOURCES
     html/ImageDocument.cpp
     html/ImageInputType.cpp
     html/InputType.cpp
+    html/LabelableElement.cpp
     html/LabelsNodeList.cpp
     html/LinkRelAttribute.cpp
     html/MediaController.cpp
@@ -1034,13 +1043,11 @@ SET(WebCore_SOURCES
     page/Navigator.cpp
     page/NavigatorBase.cpp
     page/NavigatorRegisterProtocolHandler.cpp
-    page/NavigatorSupplement.cpp
     page/OriginAccessEntry.cpp
     page/Page.cpp
     page/PageGroup.cpp
     page/PageGroupLoadDeferrer.cpp
     page/PageSerializer.cpp
-    page/PageSupplement.cpp
     page/PageVisibilityState.cpp
     page/Performance.cpp
     page/PerformanceNavigation.cpp
@@ -1091,6 +1098,7 @@ SET(WebCore_SOURCES
     platform/MIMETypeRegistry.cpp
     platform/MemoryPressureHandler.cpp
     platform/PlatformEvent.cpp
+    platform/RunLoop.cpp
     platform/RuntimeApplicationChecks.cpp
     platform/ScrollAnimator.cpp
     platform/ScrollableArea.cpp
@@ -1113,7 +1121,6 @@ SET(WebCore_SOURCES
     platform/graphics/BitmapImage.cpp
     platform/graphics/Color.cpp
     platform/graphics/CrossfadeGeneratedImage.cpp
-    platform/graphics/FractionalLayoutSize.cpp
     platform/graphics/FloatPoint.cpp
     platform/graphics/FloatPoint3D.cpp
     platform/graphics/FloatQuad.cpp
@@ -1127,6 +1134,8 @@ SET(WebCore_SOURCES
     platform/graphics/FontFamily.cpp
     platform/graphics/FontFastPath.cpp
     platform/graphics/FontFeatureSettings.cpp
+    platform/graphics/FractionalLayoutRect.cpp
+    platform/graphics/FractionalLayoutSize.cpp  
     platform/graphics/GeneratorGeneratedImage.cpp
     platform/graphics/GlyphPageTreeNode.cpp
     platform/graphics/Gradient.cpp
@@ -1289,7 +1298,6 @@ SET(WebCore_SOURCES
     rendering/RenderCombineText.cpp
     rendering/RenderCounter.cpp
     rendering/RenderDeprecatedFlexibleBox.cpp
-    rendering/RenderDetails.cpp
     rendering/RenderDetailsMarker.cpp
     rendering/RenderEmbeddedObject.cpp
     rendering/RenderFieldset.cpp
@@ -1332,7 +1340,6 @@ SET(WebCore_SOURCES
     rendering/RenderScrollbarPart.cpp
     rendering/RenderScrollbarTheme.cpp
     rendering/RenderSlider.cpp
-    rendering/RenderSummary.cpp
     rendering/RenderTable.cpp
     rendering/RenderTableCaption.cpp
     rendering/RenderTableCell.cpp
@@ -1369,6 +1376,7 @@ SET(WebCore_SOURCES
     rendering/style/StyleFlexibleBoxData.cpp
     rendering/style/StyleGeneratedImage.cpp
     rendering/style/StyleGridData.cpp
+    rendering/style/StyleGridItemData.cpp
     rendering/style/StyleInheritedData.cpp
     rendering/style/StyleMarqueeData.cpp
     rendering/style/StyleMultiColData.cpp
@@ -1378,45 +1386,8 @@ SET(WebCore_SOURCES
     rendering/style/StyleTransformData.cpp
     rendering/style/StyleVisualData.cpp
 
-    storage/AbstractDatabase.cpp
-    storage/ChangeVersionWrapper.cpp
-    storage/DOMWindowSQLDatabase.cpp
-    storage/Database.cpp
-    storage/DatabaseAuthorizer.cpp
-    storage/DatabaseSync.cpp
-    storage/DatabaseTask.cpp
-    storage/DatabaseThread.cpp
-    storage/DatabaseTracker.cpp
-    storage/IDBAny.cpp
-    storage/IDBDatabase.cpp
-    storage/IDBDatabaseBackendImpl.cpp
-    storage/IDBCursor.cpp
-    storage/IDBCursorBackendImpl.cpp
-    storage/IDBDatabaseException.cpp
-    storage/IDBEventDispatcher.cpp
-    storage/IDBIndex.cpp
-    storage/IDBIndexBackendImpl.cpp
-    storage/IDBKey.cpp
-    storage/IDBKeyRange.cpp
-    storage/IDBRequest.cpp
-    storage/IDBObjectStore.cpp
-    storage/IDBObjectStoreBackendImpl.cpp
-    storage/IDBFactory.cpp
-    storage/IDBFactoryBackendInterface.cpp
-    storage/IDBFactoryBackendImpl.cpp
     storage/StorageTask.cpp
     storage/StorageThread.cpp
-    storage/OriginQuotaManager.cpp
-    storage/OriginUsageRecord.cpp
-    storage/SQLException.cpp
-    storage/SQLResultSet.cpp
-    storage/SQLResultSetRowList.cpp
-    storage/SQLStatement.cpp
-    storage/SQLStatementSync.cpp
-    storage/SQLTransaction.cpp
-    storage/SQLTransactionClient.cpp
-    storage/SQLTransactionCoordinator.cpp
-    storage/SQLTransactionSync.cpp
     storage/Storage.cpp
     storage/StorageAreaImpl.cpp
     storage/StorageAreaSync.cpp
@@ -1485,36 +1456,72 @@ SET(WebCore_USER_AGENT_STYLE_SHEETS
 
 IF (ENABLE_BLOB)
     LIST(APPEND WebCore_SOURCES
+        fileapi/AsyncFileStream.cpp
         fileapi/FileReader.cpp
         fileapi/FileReaderLoader.cpp
         fileapi/FileReaderSync.cpp
         fileapi/FileThread.cpp
-        fileapi/FileStreamProxy.cpp
         platform/FileStream.cpp
     )
 
     LIST(APPEND WebCore_IDL_FILES
+        fileapi/FileException.idl
         fileapi/FileReaderSync.idl
+        fileapi/OperationNotAllowedException.idl
     )
 ENDIF ()
 
 IF (ENABLE_SQL_DATABASE)
+    LIST(APPEND WebCore_SOURCES
+        Modules/webdatabase/AbstractDatabase.cpp
+        Modules/webdatabase/ChangeVersionWrapper.cpp
+        Modules/webdatabase/DOMWindowSQLDatabase.cpp
+        Modules/webdatabase/Database.cpp
+        Modules/webdatabase/DatabaseAuthorizer.cpp
+        Modules/webdatabase/DatabaseContext.cpp
+        Modules/webdatabase/DatabaseSync.cpp
+        Modules/webdatabase/DatabaseTask.cpp
+        Modules/webdatabase/DatabaseThread.cpp
+        Modules/webdatabase/DatabaseTracker.cpp
+        Modules/webdatabase/OriginQuotaManager.cpp
+        Modules/webdatabase/OriginUsageRecord.cpp
+        Modules/webdatabase/SQLException.cpp
+        Modules/webdatabase/SQLResultSet.cpp
+        Modules/webdatabase/SQLResultSetRowList.cpp
+        Modules/webdatabase/SQLStatement.cpp
+        Modules/webdatabase/SQLStatementSync.cpp
+        Modules/webdatabase/SQLTransaction.cpp
+        Modules/webdatabase/SQLTransactionClient.cpp
+        Modules/webdatabase/SQLTransactionCoordinator.cpp
+        Modules/webdatabase/SQLTransactionSync.cpp
+    )
+
     LIST(APPEND WebCore_IDL_FILES
-        storage/DOMWindowSQLDatabase.idl
-        storage/Database.idl
-        storage/DatabaseCallback.idl
-        storage/DatabaseSync.idl
-        storage/SQLError.idl
-        storage/SQLException.idl
-        storage/SQLResultSet.idl
-        storage/SQLResultSetRowList.idl
-        storage/SQLStatementCallback.idl
-        storage/SQLStatementErrorCallback.idl
-        storage/SQLTransaction.idl
-        storage/SQLTransactionCallback.idl
-        storage/SQLTransactionErrorCallback.idl
-        storage/SQLTransactionSync.idl
-        storage/SQLTransactionSyncCallback.idl
+        Modules/webdatabase/DOMWindowSQLDatabase.idl
+        Modules/webdatabase/Database.idl
+        Modules/webdatabase/DatabaseCallback.idl
+        Modules/webdatabase/DatabaseSync.idl
+        Modules/webdatabase/SQLError.idl
+        Modules/webdatabase/SQLException.idl
+        Modules/webdatabase/SQLResultSet.idl
+        Modules/webdatabase/SQLResultSetRowList.idl
+        Modules/webdatabase/SQLStatementCallback.idl
+        Modules/webdatabase/SQLStatementErrorCallback.idl
+        Modules/webdatabase/SQLTransaction.idl
+        Modules/webdatabase/SQLTransactionCallback.idl
+        Modules/webdatabase/SQLTransactionErrorCallback.idl
+        Modules/webdatabase/SQLTransactionSync.idl
+        Modules/webdatabase/SQLTransactionSyncCallback.idl
+    )
+ENDIF ()
+
+IF (ENABLE_SQL_DATABASE AND ENABLE_WORKERS)
+    LIST(APPEND WebCore_SOURCES
+        Modules/webdatabase/WorkerContextSQLDatabase.cpp
+    )
+
+    LIST(APPEND WebCore_IDL_FILES
+        Modules/webdatabase/WorkerContextSQLDatabase.idl
     )
 ENDIF ()
 
@@ -1530,19 +1537,52 @@ IF (ENABLE_DATA_TRANSFER_ITEMS)
 ENDIF ()
 
 IF (ENABLE_INDEXED_DATABASE)
+    LIST(APPEND WebCore_SOURCES
+        Modules/indexeddb/DOMWindowIndexedDatabase.cpp
+        Modules/indexeddb/IDBAny.cpp
+        Modules/indexeddb/IDBDatabase.cpp
+        Modules/indexeddb/IDBDatabaseBackendImpl.cpp
+        Modules/indexeddb/IDBCursor.cpp
+        Modules/indexeddb/IDBCursorBackendImpl.cpp
+        Modules/indexeddb/IDBDatabaseException.cpp
+        Modules/indexeddb/IDBEventDispatcher.cpp
+        Modules/indexeddb/IDBIndex.cpp
+        Modules/indexeddb/IDBIndexBackendImpl.cpp
+        Modules/indexeddb/IDBKey.cpp
+        Modules/indexeddb/IDBKeyRange.cpp
+        Modules/indexeddb/IDBRequest.cpp
+        Modules/indexeddb/IDBObjectStore.cpp
+        Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
+        Modules/indexeddb/IDBFactory.cpp
+        Modules/indexeddb/IDBFactoryBackendInterface.cpp
+        Modules/indexeddb/IDBFactoryBackendImpl.cpp
+        Modules/indexeddb/PageGroupIndexedDatabase.cpp
+    )
+
+    LIST(APPEND WebCore_IDL_FILES
+        Modules/indexeddb/DOMWindowIndexedDatabase.idl
+        Modules/indexeddb/IDBAny.idl
+        Modules/indexeddb/IDBCursor.idl
+        Modules/indexeddb/IDBDatabaseError.idl
+        Modules/indexeddb/IDBDatabaseException.idl
+        Modules/indexeddb/IDBDatabase.idl
+        Modules/indexeddb/IDBFactory.idl
+        Modules/indexeddb/IDBIndex.idl
+        Modules/indexeddb/IDBKey.idl
+        Modules/indexeddb/IDBKeyRange.idl
+        Modules/indexeddb/IDBObjectStore.idl
+        Modules/indexeddb/IDBRequest.idl
+        Modules/indexeddb/IDBTransaction.idl
+    )
+ENDIF ()
+
+IF (ENABLE_INDEXED_DATABASE AND ENABLE_WORKERS)
+    LIST(APPEND WebCore_SOURCES
+        Modules/indexeddb/WorkerContextIndexedDatabase.cpp
+    )
+
     LIST(APPEND WebCore_IDL_FILES
-        storage/IDBAny.idl
-        storage/IDBCursor.idl
-        storage/IDBDatabaseError.idl
-        storage/IDBDatabaseException.idl
-        storage/IDBDatabase.idl
-        storage/IDBFactory.idl
-        storage/IDBIndex.idl
-        storage/IDBKey.idl
-        storage/IDBKeyRange.idl
-        storage/IDBObjectStore.idl
-        storage/IDBRequest.idl
-        storage/IDBTransaction.idl
+        Modules/indexeddb/WorkerContextIndexedDatabase.idl
     )
 ENDIF ()
 
@@ -1617,6 +1657,7 @@ if (ENABLE_FILE_SYSTEM)
         fileapi/FileWriterBase.cpp
         fileapi/FileWriterSync.cpp
         fileapi/LocalFileSystem.cpp
+        fileapi/WorkerContextFileSystem.cpp
         platform/AsyncFileSystem.cpp
     )
     LIST(APPEND WebCore_IDL_FILES
@@ -1643,13 +1684,7 @@ if (ENABLE_FILE_SYSTEM)
         fileapi/FileWriterSync.idl
         fileapi/Metadata.idl
         fileapi/MetadataCallback.idl
-    )
-ENDIF ()
-
-IF (ENABLE_BLOB OR ENABLE_FILE_SYSTEM)
-    LIST(APPEND WebCore_IDL_FILES
-        fileapi/FileException.idl
-        fileapi/OperationNotAllowedException.idl
+        fileapi/WorkerContextFileSystem.idl
     )
 ENDIF ()
 
@@ -1686,7 +1721,6 @@ IF (ENABLE_SVG)
         rendering/svg/RenderSVGResourceRadialGradient.cpp
         rendering/svg/RenderSVGResourceSolidColor.cpp
         rendering/svg/RenderSVGRoot.cpp
-        rendering/svg/RenderSVGShadowTreeRootContainer.cpp
         rendering/svg/RenderSVGShape.cpp
         rendering/svg/RenderSVGTSpan.cpp
         rendering/svg/RenderSVGText.cpp
@@ -1700,11 +1734,11 @@ IF (ENABLE_SVG)
         rendering/svg/SVGPathData.cpp
         rendering/svg/SVGRenderSupport.cpp
         rendering/svg/SVGRenderTreeAsText.cpp
+        rendering/svg/SVGRenderingContext.cpp
         rendering/svg/SVGResources.cpp
         rendering/svg/SVGResourcesCache.cpp
         rendering/svg/SVGResourcesCycleSolver.cpp
         rendering/svg/SVGRootInlineBox.cpp
-        rendering/svg/SVGShadowTreeElements.cpp
         rendering/svg/SVGTextChunk.cpp
         rendering/svg/SVGTextChunkBuilder.cpp
         rendering/svg/SVGTextLayoutAttributes.cpp
@@ -1717,7 +1751,6 @@ IF (ENABLE_SVG)
         rendering/svg/SVGTextMetricsBuilder.cpp
         rendering/svg/SVGTextQuery.cpp
         svg/ColorDistance.cpp
-        svg/DOMWindowSVG.idl
         svg/SVGAElement.cpp
         svg/SVGAltGlyphDefElement.cpp
         svg/SVGAltGlyphElement.cpp
@@ -2058,24 +2091,26 @@ ENDIF()
 
 IF (ENABLE_WEB_SOCKETS)
     LIST(APPEND WebCore_SOURCES
-        websockets/ThreadableWebSocketChannel.cpp
-        websockets/ThreadableWebSocketChannelClientWrapper.cpp
-        websockets/WebSocket.cpp
-        websockets/WebSocketChannel.cpp
-        websockets/WebSocketExtensionDispatcher.cpp
-        websockets/WebSocketHandshake.cpp
-        websockets/WebSocketHandshakeRequest.cpp
-        websockets/WebSocketHandshakeResponse.cpp
+        Modules/websockets/ThreadableWebSocketChannel.cpp
+        Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
+        Modules/websockets/WebSocket.cpp
+        Modules/websockets/WebSocketChannel.cpp
+        Modules/websockets/WebSocketDeflater.cpp
+        Modules/websockets/WebSocketDeflateFramer.cpp
+        Modules/websockets/WebSocketExtensionDispatcher.cpp
+        Modules/websockets/WebSocketHandshake.cpp
+        Modules/websockets/WebSocketHandshakeRequest.cpp
+        Modules/websockets/WebSocketHandshakeResponse.cpp
     )
 
     LIST(APPEND WebCore_IDL_FILES
-        websockets/WebSocket.idl
+        Modules/websockets/WebSocket.idl
     )
 ENDIF ()
 
 IF (ENABLE_WEB_SOCKETS AND ENABLE_WORKERS)
     LIST(APPEND WebCore_SOURCES
-         websockets/WorkerThreadableWebSocketChannel.cpp
+        Modules/websockets/WorkerThreadableWebSocketChannel.cpp
     )
 ENDIF ()
 
@@ -2123,12 +2158,6 @@ IF (ENABLE_SHARED_WORKERS)
     )
 ENDIF ()
 
-IF (ENABLE_WORKERS OR ENABLE_SHARED_WORKERS)
-    LIST(APPEND WebCore_IDL_FILES
-        workers/DOMWindowWorker.idl
-    )
-ENDIF ()
-
 IF (ENABLE_VIDEO_TRACK)
     LIST(APPEND WebCore_SOURCES
         html/HTMLTrackElement.cpp
@@ -2232,6 +2261,7 @@ IF (ENABLE_WEBGL)
         html/canvas/WebGLUniformLocation.cpp
         html/canvas/WebGLVertexArrayObjectOES.cpp
         html/canvas/WebGLExtension.cpp
+        html/canvas/EXTTextureFilterAnisotropic.cpp
         html/canvas/OESStandardDerivatives.cpp
         html/canvas/OESTextureFloat.cpp
         html/canvas/OESVertexArrayObject.cpp
@@ -2240,6 +2270,7 @@ IF (ENABLE_WEBGL)
         platform/graphics/gpu/DrawingBuffer.cpp
     )
     LIST(APPEND WebCore_IDL_FILES
+        html/canvas/EXTTextureFilterAnisotropic.idl
         html/canvas/OESStandardDerivatives.idl
         html/canvas/OESTextureFloat.idl
         html/canvas/OESVertexArrayObject.idl
@@ -2284,6 +2315,25 @@ IF (ENABLE_VIBRATION)
     )
 ENDIF ()
 
+SET(WebCoreTestSupport_INCLUDE_DIRECTORIES
+    "${WebCore_INCLUDE_DIRECTORIES}"
+    "${WEBCORE_DIR}/testing"
+)
+
+SET(WebCoreTestSupport_IDL_INCLUDES
+    testing
+)
+
+SET(WebCoreTestSupport_IDL_FILES
+    testing/Internals.idl
+    testing/InternalSettings.idl
+)
+
+SET(WebCoreTestSupport_SOURCES
+    testing/Internals.cpp
+    testing/InternalSettings.cpp
+)
+
 # Modules that the bindings generator scripts may use
 SET(SCRIPTS_RESOLVE_SUPPLEMENTAL
     ${WEBCORE_DIR}/bindings/scripts/IDLParser.pm
@@ -2300,7 +2350,7 @@ SET(IDL_ATTRIBUTES_FILE ${WEBCORE_DIR}/bindings/scripts/IDLAttributes.txt)
 
 INCLUDE(${WEBCORE_DIR}/UseJSC.cmake)
 
-SET(WebCore_LIBRARIES ${JavaScriptCore_LIBRARY_NAME})
+SET(WebCore_LIBRARIES ${WTF_LIBRARY_NAME} ${JavaScriptCore_LIBRARY_NAME})
 SET(WebCore_LINK_FLAGS "")
 WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
@@ -2443,7 +2493,7 @@ GENERATE_DOM_NAMES(HTML ${WEBCORE_DIR}/html/HTMLAttributeNames.in ${WEBCORE_DIR}
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/HTMLNames.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/HTMLElementFactory.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/JSHTMLElementWrapperFactory.cpp)
 
 
-GENERATE_EVENT_FACTORY(${WEBCORE_DIR}/dom/EventFactory.in EventFactory.cpp)
+GENERATE_EVENT_FACTORY(${WEBCORE_DIR}/dom/EventNames.in EventFactory.cpp)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/EventFactory.cpp)
 
 
@@ -2492,20 +2542,28 @@ ADD_CUSTOM_COMMAND(
     VERBATIM)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/WebKitVersion.h)
 
-
-
 WEBKIT_WRAP_SOURCELIST(${WebCore_IDL_FILES} ${WebCore_SOURCES})
+WEBKIT_WRAP_SOURCELIST(${WebCoreTestSupport_IDL_FILES} ${WebCoreTestSupport_SOURCES})
+
 ADD_DEFINITIONS(-DBUILDING_WebCore)
-INCLUDE_DIRECTORIES(${WebCore_INCLUDE_DIRECTORIES})
+INCLUDE_DIRECTORIES(${WebCore_INCLUDE_DIRECTORIES} ${WebCoreTestSupport_INCLUDE_DIRECTORIES})
+
 ADD_LIBRARY(${WebCore_LIBRARY_NAME} ${WebCore_LIBRARY_TYPE} ${WebCore_SOURCES})
+SET_TARGET_PROPERTIES(${WebCore_LIBRARY_NAME} PROPERTIES LINK_INTERFACE_LIBRARIES "")
+
+ADD_LIBRARY(${WebCoreTestSupport_LIBRARY_NAME} ${WebCoreTestSupport_LIBRARY_TYPE} ${WebCoreTestSupport_SOURCES})
+
 ADD_DEPENDENCIES(${WebCore_LIBRARY_NAME} ${JavaScriptCore_LIBRARY_NAME})
+ADD_DEPENDENCIES(${WebCoreTestSupport_LIBRARY_NAME} ${WebCore_LIBRARY_NAME})
+
 TARGET_LINK_LIBRARIES(${WebCore_LIBRARY_NAME} ${WebCore_LIBRARIES})
 
 IF (WebCore_LINK_FLAGS)
     ADD_TARGET_PROPERTIES(${WebCore_LIBRARY_NAME} LINK_FLAGS "${WebCore_LINK_FLAGS}")
+    ADD_TARGET_PROPERTIES(${WebCoreTestSupport_LIBRARY_NAME} LINK_FLAGS "${WebCore_LINK_FLAGS}")
 ENDIF ()
 
 IF (SHARED_CORE)
     SET_TARGET_PROPERTIES(${WebCore_LIBRARY_NAME} PROPERTIES VERSION ${PROJECT_VERSION} SOVERSION ${PROJECT_VERSION_MAJOR})
-    INSTALL(TARGETS ${WebCore_LIBRARY_NAME} DESTINATION lib)
+    INSTALL(TARGETS ${WebCore_LIBRARY_NAME} DESTINATION "${LIB_INSTALL_DIR}")
 ENDIF ()
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index b0b5bdf70..d6dd04c4a 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18636 @@
+2012-03-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix build with newer Qt 5.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::fileListNameForWidth): Use DefaultCodec instead of the
+        deprecated CodecForTR.
+
+2012-03-12  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: SpeechRecognitionEvent
+        https://bugs.webkit.org/show_bug.cgi?id=80513
+
+        Reviewed by Adam Barth.
+
+        Implement SpeechRecognitionEvent.
+        (Spec: http://speech-javascript-api-spec.googlecode.com/git/speechapi.html)
+
+        Test: fast/events/constructors/speech-recognition-event-constructor.html
+
+        * Modules/speech/DOMWindowSpeech.idl:
+        * Modules/speech/SpeechRecognitionEvent.cpp: Added.
+        (WebCore):
+        (WebCore::SpeechRecognitionEventInit::SpeechRecognitionEventInit):
+        (WebCore::SpeechRecognitionEvent::create):
+        (WebCore::SpeechRecognitionEvent::createResult):
+        (WebCore::SpeechRecognitionEvent::createNoMatch):
+        (WebCore::SpeechRecognitionEvent::createResultDeleted):
+        (WebCore::SpeechRecognitionEvent::createError):
+        (WebCore::SpeechRecognitionEvent::interfaceName):
+        (WebCore::SpeechRecognitionEvent::SpeechRecognitionEvent):
+        * Modules/speech/SpeechRecognitionEvent.h: Added.
+        (WebCore):
+        (SpeechRecognitionEventInit):
+        (SpeechRecognitionEvent):
+        (WebCore::SpeechRecognitionEvent::result):
+        (WebCore::SpeechRecognitionEvent::error):
+        (WebCore::SpeechRecognitionEvent::resultIndex):
+        (WebCore::SpeechRecognitionEvent::resultHistory):
+        * Modules/speech/SpeechRecognitionEvent.idl:
+        * WebCore.gypi:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::webkitSpeechRecognitionEventEnabled):
+        * bindings/v8/OptionsObject.cpp:
+        (WebCore::OptionsObject::get):
+        (WebCore):
+        * bindings/v8/OptionsObject.h:
+        (WebCore):
+        (OptionsObject):
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/EventNames.in:
+
+2012-03-12  Kent Tamura  <tkent@chromium.org>
+
+        Use ICU C API instead of C++ API in LocalizedNumberICU
+        https://bugs.webkit.org/show_bug.cgi?id=80815
+        https://bugs.gentoo.org/show_bug.cgi?id=407401
+
+        Reviewed by Hajime Morita.
+
+        ICU 4.8 doesn't have kNumberStyle. We had better to use ICU C API in
+        general to avoid such issues.
+
+        This patch should not make any behavior change.
+
+        * platform/text/LocalizedNumberICU.cpp:
+        (WebCore::ICULocale::ICULocale):
+        Change the argument type: icu::Locale -> const char*
+        (WebCore::ICULocale::~ICULocale): Delete m_numberFormat with unum_close().
+        (WebCore::ICULocale::create): Do not create icu::Locale.
+        (WebCore::ICULocale::createForCurrentLocale): ditto.
+        (WebCore::ICULocale::setDecimalSymbol):
+        Use unum_getSymbol() instead of DecimalFormatSymbols::getSymbol().
+        (WebCore::ICULocale::setDecimalTextAttribute):
+        Added. A utility function to store prefixes and suffixes.
+        (WebCore::ICULocale::initializeDecimalFormat):
+        - unum_open(), instead of NumberFormat::createInstance().
+        - Use C API symbols.
+        - Cache positive/negative prefixes/suffixes.
+        (WebCore::ICULocale::convertToLocalizedNumber): Use cached prefixes and suffixes.
+        (WebCore::matches): Stop using template because we don't use UString anymore.
+        (WebCore::ICULocale::detectSignAndGetDigitRange):
+        - Use cached prefixes and suffixes.
+        - Use String::startsWith() and endsWith().
+        (WebCore::ICULocale::convertFromLocalizedNumber):
+        * platform/text/LocalizedNumberICU.h:
+        (ICULocale):
+
+2012-03-11  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: decouple LiveLocation from RawSourceCode.
+        https://bugs.webkit.org/show_bug.cgi?id=80785
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.createPlacard):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerPaused):
+        (WebInspector.PresentationCallFrame):
+        (WebInspector.PresentationCallFrame.prototype.uiLocation):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard):
+        * inspector/front-end/RawSourceCode.js:
+        * inspector/front-end/ScriptMapping.js:
+        (WebInspector.MainScriptMapping):
+        (WebInspector.MainScriptMapping.prototype.createLiveLocation):
+        (WebInspector.MainScriptMapping.prototype._registerLiveLocation):
+        (WebInspector.MainScriptMapping.prototype._unregisterLiveLocation):
+        (WebInspector.MainScriptMapping.prototype._updateLiveLocations):
+        (WebInspector.MainScriptMapping.prototype._uiSourceCodeListChanged):
+        (WebInspector.MainScriptMapping.prototype.reset):
+        (WebInspector.LiveLocation):
+        (WebInspector.LiveLocation.prototype.init):
+        (WebInspector.LiveLocation.prototype.dispose):
+        (WebInspector.LiveLocation.prototype._update):
+
+2012-03-11  Victor Carbune  <vcarbune@adobe.com>
+
+        The main code structure for placing future text track cue rendering
+        code and main outer rendering steps.
+        https://bugs.webkit.org/show_bug.cgi?id=79746
+
+        Reviewed by Eric Carlson.
+
+        No new tests. Only refactoring, but some chromium tests require rebaselining
+        and have been marked accordingly.
+
+        * css/mediaControls.css:
+        (::-webkit-media-controls): Changed the default display to -webkit-box, as
+        captions need to always be rendered on top of the controls, if they are visible.
+        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
+        Default position attribute is now relative, handled by the parent -webkit-box
+        (video::-webkit-media-text-track-container): The position of the container is
+        now relative, handled by -webkit-box.
+        (video::-webkit-media-text-track-display): Adjusted text color to match
+        the color required in the WebVTT spec (section 3.5.1 'color' property)
+        * css/mediaControlsChromium.css:
+        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
+        Default position attribute is now relative, handled by the parent -webkit-box
+
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlPanelElement::MediaControlPanelElement): Added a timer
+        for the webkit fade out transition event. This timer is required for setting
+        the display property to 'none', when the fade out transition is over. Otherwise,
+        captions would not be displayed at the bottom of the video.
+        (WebCore::MediaControlPanelElement::startTimer): Added.
+        (WebCore):
+        (WebCore::MediaControlPanelElement::stopTimer): Added.
+        (WebCore::MediaControlPanelElement::transitionTimerFired): Added. If the current
+        state of the controls is transparent, the display property is set to 'none'.
+        (WebCore::MediaControlPanelElement::makeOpaque): The inline display:'none' property
+        is removed before the fade in transition.
+        (WebCore::MediaControlPanelElement::makeTransparent): Added the timer start.
+        (WebCore::MediaControlTextTrackContainerElement::MediaControlTextTrackContainerElement):
+        Removed m_bottom as it is not needed anymore.
+        (WebCore::MediaControlTextTrackContainerElement::updateDisplay): Added. Main
+        function for the rendering rules.
+        (WebCore::MediaControlTextTrackContainerElement::updateSizes): The bottom position
+        needs not to be set anymore.
+        * html/shadow/MediaControlElements.h:
+        (MediaControlPanelElement): Added timer internals.
+        (MediaControlTextTrackContainerElement): Added updateDisplay() and removed unused
+        variables.
+
+        (WebCore):
+        * html/shadow/MediaControlRootElement.cpp: Removed m_textTrackDisplay
+        and duplicated code with MediaControlRootElementChromium (only minimum
+        function calls to the main text track container)
+        (WebCore::MediaControlRootElement::MediaControlRootElement):
+        (WebCore::MediaControlRootElement::setMediaController):
+        (WebCore::MediaControlRootElement::createTextTrackDisplay):
+        (WebCore::MediaControlRootElement::updateTextTrackDisplay):
+
+        * html/shadow/MediaControlRootElementChromium.cpp: Removed m_textTrackDisplay
+        and duplicate code with MediaControlRootElement (only minimum function calls
+        to the main text track container remained)
+        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
+        (WebCore::MediaControlRootElementChromium::setMediaController):
+        (WebCore::MediaControlRootElementChromium::createTextTrackDisplay):
+        (WebCore::MediaControlRootElementChromium::updateTextTrackDisplay):
+
+        (WebCore):
+        * html/track/TextTrackCue.cpp: Enhanced structure for supporting more complex
+        rendering required by the WebVTT spec.
+        (WebCore::TextTrackCue::TextTrackCue):
+        (WebCore::TextTrackCue::cueDidChange): Mark the display tree as obsolete, so that
+        it needs to be re-computed.
+        (WebCore::TextTrackCue::setIsActive): The display tree needs to be removed as
+        soon as the cue becomes inactive. Adjusted this method to support the functionality.
+        (WebCore):
+        (WebCore::TextTrackCue::determineDisplayParameters): Added. This method will hold
+        main positioning parameter computations for a TextTrackCue
+        (WebCore):
+        (WebCore::TextTrackCue::getDisplayTree): Added. This method returns the root node
+        of the CSS boxes that need to be displayed on top of the video, for the current
+        instance.
+        * html/track/TextTrackCue.h:
+        (WebCore):
+        (TextTrackCue):
+
+2012-03-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110359.
+        http://trac.webkit.org/changeset/110359
+        https://bugs.webkit.org/show_bug.cgi?id=80799
+
+        SelectPopupMenuTest.ClickItem failure (Requested by ukai on
+        #webkit).
+
+        * platform/chromium/PopupListBox.cpp:
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        (WebCore::PopupListBox::getRowHeight):
+        * platform/chromium/PopupListBox.h:
+        (PopupContainerSettings):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore):
+        (WebCore::PopupMenuChromium::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (PopupMenuChromium):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::showPopup):
+
+2012-03-11  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a crash opening the Web Inspector in WebKit1 clients.
+
+        The call to InspectorFrontendClientLocal::setAttachedWindow is preformed really early in the process,
+        causing it to crash almost every time. It should use evaluateOnLoad instead of evaluateAsBoolean.
+
+        <rdar://problem/10951109> Crash when bringing up Web Inspector in WebKit1 client
+        https://bugs.webkit.org/show_bug.cgi?id=80796
+
+        Reviewed by Brian Weinstein.
+
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::setAttachedWindow): Use evaluateOnLoad instead of evaluateAsBoolean.
+
+2012-03-11  Shawn Singh  <shawnsingh@chromium.org>
+
+        REGRESSION (r93614): scrolling div does not repaint
+        https://bugs.webkit.org/show_bug.cgi?id=80641
+
+        Reviewed by Simon Fraser.
+
+        Test: compositing/repaint/newly-composited-repaint-rect.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking): When a layer
+        becomes newly composited and creates its backing, the repaintRect
+        may become invalid. This patch recomputes repaintRects in this
+        case.
+
+2012-03-11  George Staikos  <staikos@webkit.org>
+
+        Enable JPEG encoding for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=80792
+
+        Reviewed by Antonio Gomes.
+
+        * PlatformBlackBerry.cmake:
+
+2012-03-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: console.log attempts to substitute any "%" character in the message.
+        https://bugs.webkit.org/show_bug.cgi?id=80504
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: inspector/console/console-string-format.html
+
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback.selectorsCallback):
+        * inspector/front-end/ProfileDataGridTree.js:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._reportHeapSnapshotProgress):
+        * inspector/front-end/utilities.js:
+
+2012-03-11  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: use monotonically increasing time in timeline agent
+        https://bugs.webkit.org/show_bug.cgi?id=80786
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/v8/ScriptGCEvent.cpp:
+        (WebCore::ScriptGCEvent::gcPrologueCallback):
+        (WebCore::ScriptGCEvent::gcEpilogueCallback):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::pushGCEventRecords):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::appendRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        (WebCore::InspectorTimelineAgent::timestamp):
+        (WebCore):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::timestamp):
+
+2012-03-11  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Network panel does not show responses for application/json data
+        https://bugs.webkit.org/show_bug.cgi?id=80684
+
+        Reviewed by Pavel Feldman.
+
+        Test: http/tests/inspector/network/async-xhr-json-mime-type.html
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::createXHRTextDecoder):
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+        * inspector/InspectorPageAgent.h:
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::createOtherResourceTextDecoder):
+        (WebCore):
+        (WebCore::NetworkResourcesData::responseReceived):
+
+2012-03-11  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: CSS content is not shown when stylesheet is loaded with invalid mime type in quirks mode.
+        https://bugs.webkit.org/show_bug.cgi?id=80528
+
+        Reviewed by Pavel Feldman.
+
+        Test: http/tests/inspector/resource-tree/resource-tree-invalid-mime-type-css-content.html
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+
+2012-03-11  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        [Qt] [WK2] Support threaded renderer in WK2
+        https://bugs.webkit.org/show_bug.cgi?id=76661
+
+        Reviewed by Noam Rosenthal.
+
+        Add TransformationMatrix conversions from/to Qt QMatrix4x4. Used by Qt WebKit2
+        rendering and tested by Qt WebKit2 API tests.
+
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::TransformationMatrix::operator QMatrix4x4):
+        (WebCore):
+        (WebCore::TransformationMatrix::TransformationMatrix):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (TransformationMatrix):
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Rename NotificationPresenter to NotificationClient
+        https://bugs.webkit.org/show_bug.cgi?id=80488
+        <rdar://problem/10965558>
+
+        Reviewed by Kentaro Hara.
+
+        * notifications/NotificationCenter.h: Renamed from notifications/NotificationPresenter.h.
+
+        Refactor to use renamed WebCore::NotificationClient.
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        (WebCore::Notification::show):
+        (WebCore::Notification::cancel):
+        (WebCore::Notification::contextDestroyed):
+        (WebCore::Notification::finishLoading):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::create):
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        (WebCore::NotificationCenter::disconnectFrame):
+        * notifications/NotificationController.cpp:
+        (WebCore::NotificationController::NotificationController):
+        (WebCore::NotificationController::create):
+        (WebCore::NotificationController::clientFrom):
+        (WebCore::provideNotification):
+        * notifications/NotificationController.h:
+        (WebCore):
+        (NotificationController):
+        (WebCore::NotificationController::client):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitNotifications):
+        * page/DOMWindow.h:
+        (DOMWindow):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::webkitNotifications):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        * workers/WorkerThread.h:
+        (WebCore):
+        (WebCore::WorkerThread::getNotificationClient):
+        (WebCore::WorkerThread::setNotificationClient):
+        (WorkerThread):
+
+2012-03-10  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        RenderObject with 'resize' different from 'none' should have a RenderLayer
+        https://bugs.webkit.org/show_bug.cgi?id=80738
+
+        Reviewed by James Robinson.
+
+        Covered by fast/css/resize-single-axis.html.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::requiresLayerForOverflowClip):
+        The resizer logic is tied to RenderLayer so force a RenderLayer to be allocated if resize() != RESIZE_NONE.
+
+2012-03-10  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r110358.
+        http://trac.webkit.org/changeset/110358
+        https://bugs.webkit.org/show_bug.cgi?id=80706
+
+        No improvement on specified benchmarks.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::collectNodes):
+        (WebCore::collectTargetNodes):
+
+2012-03-10  MORITA Hajime  <morrita@google.com>
+
+        ShadowTree uses weak iteration patterns
+        https://bugs.webkit.org/show_bug.cgi?id=80572
+
+        Reviewed by Dimitri Glazkov.
+
+        Patch by Adam Barth.
+
+        This patch moves various ShadowTree to using a better iteration pattern
+        in which we collect all the ShadowRoots we're planning to iterate into
+        a vector and then iterate over them.
+
+        * dom/ShadowTree.cpp:
+        (ShadowRootVector):
+        (WebCore::ShadowRootVector::ShadowRootVector):
+        (WebCore):
+        (WebCore::ShadowTree::removeAllShadowRoots):
+        (WebCore::ShadowTree::insertedIntoDocument):
+        (WebCore::ShadowTree::removedFromDocument):
+        (WebCore::ShadowTree::insertedIntoTree):
+        (WebCore::ShadowTree::removedFromTree):
+        (WebCore::ShadowTree::willRemove):
+
+2012-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110363.
+        http://trac.webkit.org/changeset/110363
+        https://bugs.webkit.org/show_bug.cgi?id=80757
+
+        link error in chromium: unresolved external symbol
+        webkit_support::CreateScopedTempDirectory(void) (Requested by
+        ukai_home on #webkit).
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::open):
+        * platform/leveldb/LevelDBDatabase.cpp:
+        * platform/leveldb/LevelDBDatabase.h:
+        (LevelDBDatabase):
+
+2012-03-09  Robert Kroeger  <rjkroege@chromium.org>
+
+        Handle more Gesture* events by performing scrolls on the correct target ScrollableArea 
+        https://bugs.webkit.org/show_bug.cgi?id=80311
+
+        Implement GestureScroll* events via re-use of WheelEvent dispatch.
+
+        Reviewed by James Robinson.
+
+        Layout tests previously submited as https://bugs.webkit.org/show_bug.cgi?id=80201 and unit
+        test added as part of this patch.
+
+        * page/EventHandler.cpp:
+        (WebCore::wheelGranularityToScrollGranularity): Refactoring.
+        (WebCore):
+        (WebCore::scrollNode):
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::defaultWheelEventHandler):
+        (WebCore::EventHandler::handleGestureEvent): Added GestureScrollBegin & End.
+        (WebCore::EventHandler::handleGestureTap):
+        (WebCore::EventHandler::handleGestureScrollUpdate):
+        (WebCore::EventHandler::handleGestureScrollCore): Refactoring.
+        * page/EventHandler.h:
+        (EventHandler):
+        * platform/PlatformWheelEvent.h: Added additional scroll type.
+        * platform/ScrollAnimator.cpp:
+        (WebCore::ScrollAnimator::handleWheelEvent): Forward additional scroll type.
+        * platform/ScrollAnimator.h:
+        (WebCore):
+        * platform/ScrollAnimatorNone.cpp:
+        (WebCore::ScrollAnimatorNone::ScrollAnimatorNone): Handle additional scroll type.
+        (WebCore::ScrollAnimatorNone::fireUpAnAnimation): 
+        (WebCore):
+        (WebCore::ScrollAnimatorNone::scroll):
+        * platform/ScrollAnimatorNone.h:
+        (ScrollAnimatorNone):
+        * platform/ScrollTypes.h: Added an additional scroll type.
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::scroll):
+
+2012-03-09  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Fix a fixme in v8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=80734
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. Covered by existing tests.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toInt32):
+        (WebCore::toUInt32):
+
+2012-03-09  Lauro Neto  <lauro.neto@openbossa.org>
+
+        [Qt] WebCore/Target.pri contains obsolete FileStreamProxy.h reference.
+        https://bugs.webkit.org/show_bug.cgi?id=80730
+
+        Reviewed by Tor Arne Vestbø.
+
+        Build fix. Target.pri was still including old FileStreamProxy.h.
+
+        * Target.pri:
+
+2012-03-05 Cem Kocagil  <cem.kocagil@gmail.com>
+
+        Pan scroll icon is painted at incorrect coordinates in frames
+        https://bugs.webkit.org/show_bug.cgi?id=79378
+
+        Convert client coordinates to parent ScrollView coordinates
+
+        Reviewed by Antonio Gomes
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paintPanScrollIcon):
+
+2012-03-09  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Handle LevelDB database corruption
+        https://bugs.webkit.org/show_bug.cgi?id=79413
+
+        Add LevelDBDatabase::destroy() method so that clients can retry if open() fails.
+
+        Reviewed by Tony Chang.
+
+        Test: webkit_unit_tests --gtest_filter='LevelDBDatabaseTest.CorruptionTest'
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp: Implement open/destroy/open strategy.
+        (WebCore::IDBLevelDBBackingStore::open):
+        * platform/leveldb/LevelDBDatabase.cpp:
+        (WebCore::LevelDBDatabase::destroy):
+        (WebCore):
+        * platform/leveldb/LevelDBDatabase.h:
+        (LevelDBDatabase):
+
+2012-03-09  Jessie Berlin  <jberlin@apple.com>
+
+        Fix one of the Windows build warnings.
+
+        * html/track/TextTrackCueList.idl:
+        Add a newline to the end of the file.
+
+2012-03-09  Tyler Abbott  <tabbott@rim.com>
+
+        BlackBerry PlayBook doesn't sniff mime types
+        https://bugs.webkit.org/show_bug.cgi?id=73869
+
+        Reviewed by Rob Buis.
+
+        Hook up MIMESniffing for BlackBerry. Override Content-Types will
+        not be overriden. File extensions will be trusted when content
+        is loaded from disk.
+
+        No tests, BlackBerry tests are not yet present in webkit.org codebase.
+
+        * PlatformBlackBerry.cmake:
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::NetworkJob):
+        (WebCore::NetworkJob::initialize):
+        (WebCore::NetworkJob::handleNotifyDataReceived):
+        (WebCore::NetworkJob::sendResponseIfNeeded):
+        * platform/network/blackberry/NetworkJob.h:
+        (NetworkJob):
+
+2012-03-09  Enrica Casucci  <enrica@apple.com>
+
+        Move WebNSURLExtras code down to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=80611
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCore.exp.in: Added new exported functions.
+        * WebCore.xcodeproj/project.pbxproj: Added WebCoreNSURLExtras.*
+        * platform/FileSystem.h: Added setMetadataURL.
+        * platform/mac/FileSystemMac.mm:
+        (WebCore::setMetaData): Added.
+        (WebCore::setMetadataURL): Added.
+        * platform/mac/WebCoreNSStringExtras.h:
+        * platform/mac/WebCoreNSStringExtras.mm:
+        (hasCaseInsensitivePrefix): Added.
+        * platform/mac/WebCoreNSURLExtras.h: Added.
+        * platform/mac/WebCoreNSURLExtras.mm: Added.
+        * platform/mac/WebCoreObjCExtras.h:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2012-03-09  Tim Dresser  <tdresser@chromium.org>
+
+        [chromium] Increase size of Combo Box Options for touch and high DPI devices
+        https://bugs.webkit.org/show_bug.cgi?id=80027
+
+        Reviewed by Darin Fisher.
+
+        Scale Combo box popups by defaultDeviceScaleFactor, and add padding to
+        <option> elements when touch is enabled.
+
+        Manually tested with --default-device-scale-factor=1,2 and unset.
+        Each of these were tested with RuntimeEnabledFeatures::touchEnabled
+        set to true and false.
+
+        * platform/chromium/PopupListBox.cpp:
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        (WebCore::PopupListBox::getRowHeight):
+        * platform/chromium/PopupListBox.h:
+        (PopupContainerSettings):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore):
+        (WebCore::PopupMenuChromium::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (WebCore::PopupMenuChromium::optionPaddingForTouch):
+        (WebCore::PopupMenuChromium::setOptionPaddingForTouch):
+        (PopupMenuChromium):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::showPopup):
+
+2012-03-09  Stephen White  <senorblanco@chromium.org>
+
+        Improve ContainerNode collectNode() performance by reserving vector
+        capacity up front.
+        https://bugs.webkit.org/show_bug.cgi?id=80706
+
+        Reviewed by Ryosuke Niwa.
+
+        Covered by existing tests.  Performance will be evaluated based on
+        Chromium's page_cycler_bloat-http, page_cycler_intl1, and
+        dromaeo_domcore suites.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::collectNodes):
+
+2012-03-09  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11018851> Crash in DisplayRefreshMonitor::notifyClients()
+        https://bugs.webkit.org/show_bug.cgi?id=80740
+
+        Reviewed by Sam Weinig.
+
+        No test, since this race condition cannot be reproduced reliably.
+
+        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
+        (WebCore::DisplayRefreshMonitor::~DisplayRefreshMonitor): Changed to stop the display link
+        first, then cancel any outstanding calls to refreshDisplayOnMainThread(). When doing things
+        the other way around, the display link can fire after outstanding calls have been canceled,
+        and enqueue new calls on the main thread, which will be dispatched after monitor destruction.
+
+2012-03-09  Pratik Solanki  <psolanki@apple.com>
+
+        Assertion failure in ResourceHandle::setDefersLoading(): d->m_defersLoading != defers
+        https://bugs.webkit.org/show_bug.cgi?id=80543
+
+        Reviewed by Geoffrey Garen.
+
+        Reset m_defersLoading flag to the value from Page::defersCallbacks() in
+        ResourceLoader::init(). This is because the resource could have been in the pending requests
+        queue in ResourceLoadScheduler and would have missed out on state changes to this flag
+        happening from DocumentLoader::setDefersCallbacks().
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::init):
+
+2012-03-09  Emil A Eklund  <eae@chromium.org>
+
+        Add roundedPoint to HitTestResult and change platform code to use it
+        https://bugs.webkit.org/show_bug.cgi?id=80715
+
+        Reviewed by James Robinson.
+
+        Change ports to use roundedPoint to avoid exposing subpixel types to
+        platform code.
+
+        No new tests.
+
+        * rendering/HitTestResult.h:
+        (WebCore::HitTestResult::roundedPoint):
+
+2012-03-09  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Performance] Inline hot methods in V8Bindings.h
+        https://bugs.webkit.org/show_bug.cgi?id=80685
+
+        Reviewed by Adam Barth.
+
+        This patch slightly improves DOM binding performance by inlining hot
+        methods in V8Binding.cpp, e.g. isUndefinedOrNull(), v8StringOrNull(), v8Boolean().
+        For example, this patch improves div.nodeName by 5.0%, and div.nodeValue by 4.1%.
+
+        Performance tests: https://bugs.webkit.org/attachment.cgi?id=131006
+
+        The performance test results in my Mac environment are as follows:
+
+        Chromium/V8 without this patch:
+        div.nodeName : 3417.4 ms
+        div.nodeValue : 2069.6 ms
+
+        Chromium/V8 with this patch:
+        div.nodeName : 3245.6 ms
+        div.nodeValue : 1983.1 ms
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore::toWebCoreString):
+        (WebCore::isUndefinedOrNull):
+        (WebCore::isHostObject):
+        (WebCore::v8Boolean):
+        (WebCore::toWebCoreStringWithNullCheck):
+        (WebCore::toAtomicWebCoreStringWithNullCheck):
+        (WebCore::toWebCoreStringWithNullOrUndefinedCheck):
+        (WebCore::v8UndetectableString):
+        (WebCore::v8StringOrNull):
+        (WebCore::v8StringOrUndefined):
+        (WebCore::v8StringOrFalse):
+        (WebCore::toWebCoreDate):
+        (WebCore::v8DateOrNull):
+
+2012-03-09  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Implement scroll physics architecture for impl/main thread
+        https://bugs.webkit.org/show_bug.cgi?id=79827
+
+        Reviewed by James Robinson.
+
+        Unittests added, plus follow-on patch from rjkroege will add layout tests.
+
+        PlatformGestureCurve is a framework to separate the physical simulation from for gesture
+        animation from control concerns. This allows the physics to be reused in alternate places.
+        At present, the framework will be applied in ScrollAnimatorNone and the Chrome Compositor.
+
+        * WebCore.gypi:
+        * platform/ActivePlatformGestureAnimation.cpp: Added.
+        (WebCore):
+        (WebCore::ActivePlatformGestureAnimation::create):
+        (WebCore::ActivePlatformGestureAnimation::~ActivePlatformGestureAnimation):
+        (WebCore::ActivePlatformGestureAnimation::ActivePlatformGestureAnimation):
+        (WebCore::ActivePlatformGestureAnimation::animate):
+        * platform/ActivePlatformGestureAnimation.h: Added.
+        (WebCore):
+        (ActivePlatformGestureAnimation):
+        * platform/PlatformGestureCurve.h: Added.
+        (WebCore):
+        (PlatformGestureCurve):
+        (WebCore::PlatformGestureCurve::~PlatformGestureCurve):
+        * platform/PlatformGestureCurveTarget.h: Added.
+        (WebCore):
+        (PlatformGestureCurveTarget):
+        (WebCore::PlatformGestureCurveTarget::~PlatformGestureCurveTarget):
+        * platform/TouchFlingPlatformGestureCurve.cpp: Added.
+        (WebCore):
+        (WebCore::TouchFlingPlatformGestureCurve::create):
+        (WebCore::TouchFlingPlatformGestureCurve::TouchFlingPlatformGestureCurve):
+        (WebCore::TouchFlingPlatformGestureCurve::~TouchFlingPlatformGestureCurve):
+        (WebCore::TouchFlingPlatformGestureCurve::apply):
+        * platform/TouchFlingPlatformGestureCurve.h: Added.
+        (WebCore):
+        (TouchFlingPlatformGestureCurve):
+        * platform/WheelFlingPlatformGestureCurve.cpp: Added.
+        (WebCore):
+        (WebCore::WheelFlingPlatformGestureCurve::create):
+        (WebCore::WheelFlingPlatformGestureCurve::WheelFlingPlatformGestureCurve):
+        (WebCore::WheelFlingPlatformGestureCurve::~WheelFlingPlatformGestureCurve):
+        (WebCore::WheelFlingPlatformGestureCurve::apply):
+        * platform/WheelFlingPlatformGestureCurve.h: Added.
+        (WebCore):
+        (WheelFlingPlatformGestureCurve):
+        * platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp: Added.
+        (WebCore):
+        (WebCore::CCActiveGestureAnimation::create):
+        (WebCore::CCActiveGestureAnimation::CCActiveGestureAnimation):
+        (WebCore::CCActiveGestureAnimation::~CCActiveGestureAnimation):
+        (WebCore::CCActiveGestureAnimation::animate):
+        * platform/graphics/chromium/cc/CCActiveGestureAnimation.h: Added.
+        (WebCore):
+        (CCActiveGestureAnimation):
+        * platform/graphics/chromium/cc/CCGestureCurve.h: Added.
+        (WebCore):
+        (CCGestureCurveTarget):
+        (WebCore::CCGestureCurveTarget::~CCGestureCurveTarget):
+        (CCGestureCurve):
+        (WebCore::CCGestureCurve::~CCGestureCurve):
+
+2012-03-09  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Implement selectedOptions attribute of <select>.
+        https://bugs.webkit.org/show_bug.cgi?id=80631
+
+        Reviewed by Benjamin Poulain.
+
+        Add a new collection as a member of HTMLSelectElement which is
+        used to store the selected elements. Extend HTMLCollection to
+        support the new collection type needed by this feature.
+
+        Reference : http://www.whatwg.org/specs/web-apps/current-work/multipage/the-button-element.html#dom-select-selectedoptions
+
+        Test: fast/dom/select-selectedOptions.html
+
+        * html/CollectionType.h:
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::shouldIncludeChildren):
+        (WebCore::HTMLCollection::isAcceptableElement):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::selectedOptions):
+        (WebCore):
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):
+        * html/HTMLSelectElement.idl:
+
+2012-03-09  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] ScrollbarLayerChromium/CCScrollbarLayerImpl for CC-side scrollbar painting
+        https://bugs.webkit.org/show_bug.cgi?id=78872
+
+        Reviewed by James Robinson.
+
+        New test ScrollbarLayerChromiumTest.resolveScrollLayerPointer
+
+        * WebCore.gypi:
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::scrollLayerForFrameView):
+        (WebCore::scrollbarLayerDidChange):
+        (WebCore):
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::invalidateScrollbar):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (WebCore::GraphicsLayerChromium::hasContentsLayer):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore):
+        (WebCore::LayerChromium::toScrollbarLayerChromium):
+        (LayerChromium):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp: Added.
+        (WebCore):
+        (WebCore::ScrollbarLayerChromium::createCCLayerImpl):
+        (WebCore::ScrollbarLayerChromium::create):
+        (WebCore::ScrollbarLayerChromium::ScrollbarLayerChromium):
+        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/ScrollbarLayerChromium.h: Added.
+        (WebCore):
+        (ScrollbarLayerChromium):
+        (WebCore::ScrollbarLayerChromium::scrollLayerId):
+        (WebCore::ScrollbarLayerChromium::toScrollbarLayerChromium):
+        * platform/graphics/chromium/TreeSynchronizer.cpp:
+        (WebCore::TreeSynchronizer::synchronizeTrees):
+        (WebCore::TreeSynchronizer::collectExistingCCLayerImplRecursive):
+        (WebCore::TreeSynchronizer::reuseOrCreateCCLayerImpl):
+        (WebCore::TreeSynchronizer::synchronizeTreeRecursive):
+        (WebCore::TreeSynchronizer::updateScrollbarLayerPointersRecursive):
+        (WebCore):
+        * platform/graphics/chromium/TreeSynchronizer.h:
+        (TreeSynchronizer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::updateMaxScrollPosition):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp: Added.
+        (WebCore):
+        (WebCore::CCScrollbarLayerImpl::create):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbarLayerImpl):
+        (WebCore::CCScrollbarLayerImpl::willDraw):
+        (WebCore::CCScrollbarLayerImpl::appendQuads):
+        (WebCore::CCScrollbarLayerImpl::didDraw):
+        (WebCore::CCScrollbarLayerImpl::paint):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::x):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::y):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::width):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::height):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::size):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::location):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::parent):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::root):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::setFrameRect):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::frameRect):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::invalidate):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::invalidateRect):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::scrollbarOverlayStyle):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::getTickmarks):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isScrollableAreaActive):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isScrollViewScrollbar):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::convertFromContainingWindow):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isCustomScrollbar):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::orientation):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::value):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::currentPos):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::visibleSize):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::totalSize):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::maximum):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::controlSize):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::lineStep):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::pageStep):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::pressedPart):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::hoveredPart):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::styleChanged):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::enabled):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::setEnabled):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h: Added.
+        (WebCore):
+        (CCScrollbarLayerImpl):
+        (WebCore::CCScrollbarLayerImpl::setScrollbarOverlayStyle):
+        (WebCore::CCScrollbarLayerImpl::setTickmarks):
+        (WebCore::CCScrollbarLayerImpl::setIsScrollableAreaActive):
+        (WebCore::CCScrollbarLayerImpl::setIsScrollViewScrollbar):
+        (WebCore::CCScrollbarLayerImpl::setOrientation):
+        (WebCore::CCScrollbarLayerImpl::setControlSize):
+        (WebCore::CCScrollbarLayerImpl::setPressedPart):
+        (WebCore::CCScrollbarLayerImpl::setHoveredPart):
+        (WebCore::CCScrollbarLayerImpl::setEnabled):
+        (WebCore::CCScrollbarLayerImpl::scrollLayer):
+        (WebCore::CCScrollbarLayerImpl::setScrollLayer):
+        (CCScrollbar):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::CCScrollbar):
+
+2012-03-09  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Split the extra logical height distribution logic out of RenderTableSection::layoutRows
+        https://bugs.webkit.org/show_bug.cgi?id=80671
+
+        Reviewed by Adrienne Walker.
+
+        Refactoring only, no change in behavior expected.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        Split the logic from here...
+
+        (WebCore::RenderTableSection::distributeExtraLogicalHeightToPercentRows):
+        (WebCore::RenderTableSection::distributeExtraLogicalHeightToAutoRows):
+        (WebCore::RenderTableSection::distributeRemainingExtraLogicalHeight):
+        (WebCore::RenderTableSection::distributeExtraLogicalHeightToRows):
+        ... to those functions. Cleaned up the variable naming while at it and
+        made them follow the same signature as this may be useful to fix another
+        bug I have.
+
+        * rendering/RenderTableSection.h:
+        (RenderTableSection):
+        Added the previous 4 new functions.
+
+2012-03-09  Rob Buis  <rbuis@rim.com>
+
+        Remove unused file FrameBlackBerry.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80731
+
+        Reviewed by Antonio Gomes.
+
+        This is not needed anymore since there is an implementation elsewhere.
+
+        * PlatformBlackBerry.cmake:
+        * page/blackberry/FrameBlackBerry.cpp: Removed.
+
+2012-03-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110309.
+        http://trac.webkit.org/changeset/110309
+        https://bugs.webkit.org/show_bug.cgi?id=80732
+
+        Seems to have caused a number of SVG crashes (thorton will
+        investigate further) (Requested by abarth|gardener on
+        #webkit).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::deferredRepaintTimerFired):
+        * page/FrameView.h:
+        (FrameView):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::shouldRepaint):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::drawSVGToImageBuffer):
+        (WebCore::SVGImage::draw):
+        * svg/graphics/SVGImage.h:
+        * svg/graphics/SVGImageCache.cpp:
+        (WebCore::SVGImageCache::imageContentChanged):
+        (WebCore::SVGImageCache::redrawTimerFired):
+        * svg/graphics/SVGImageCache.h:
+        (SVGImageCache):
+
+2012-03-09  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash due to inserting letter into div with first-letter
+        https://bugs.webkit.org/show_bug.cgi?id=78534
+
+        Reviewed by David Hyatt.
+
+        This fixes an issue in RenderTextFragment with setTextInternal
+        getting called with different intents. While most calls to it
+        are intended to change the underlying DOM node string, it can
+        also be called as a result of styleDidChange just for transforms
+        on the substring text fragment. This adds a mechanism for internal
+        callers to specify if the internal text is being updated without
+        a DOM node text change.
+
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::styleDidChange)
+        (WebCore::RenderTextFragment::setTextInternal)
+        * rendering/RenderTextFragment.h:
+        (WebCore::RenderTextFragment)
+
+2012-03-09  Chris Rogers  <crogers@google.com>
+
+        Fix uninitialized variable in DynamicsCompressor
+        https://bugs.webkit.org/show_bug.cgi?id=80724
+
+        Reviewed by James Robinson.
+
+        * platform/audio/DynamicsCompressor.cpp:
+        (WebCore::DynamicsCompressor::DynamicsCompressor):
+
+2012-03-09  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Undo text position adjustment for attribute event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=80725
+
+        Reviewed by Adam Barth.
+
+        No new tests. Needs rebaseline.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+
+2012-03-09  Tom Sepez  <tsepez@chromium.org>
+
+        Hold cached images with a CachedResourceHandle rather than a raw pointer for CSSCrossfadeValue
+        https://bugs.webkit.org/show_bug.cgi?id=80186
+
+        Reviewed by Simon Fraser.
+
+        Test: http/tests/css/cross-fade-reload.html
+
+        * css/CSSCrossfadeValue.h:
+        (CSSCrossfadeValue):
+
+2012-03-09  Abhishek Arya  <inferno@chromium.org>
+
+        Crash when splitting an anonymous block in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=80432
+
+        Reviewed by David Hyatt.
+
+        Calculating currChild->nextSibling() is risky after destroying :after content
+        because it can blow away currChild if it is a left over empty anonymous block.
+        We need to calculate next sibling upfront, using the same trick, we do in
+        RenderBlock::addChildIgnoringAnonymousColumnBlock to reset beforeChild (check
+        out the line before splitFlow call).
+
+        Test: fast/multicol/anonymous-block-split-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::splitBlocks):
+
+2012-03-09  Abhishek Arya  <inferno@chromium.org>
+
+        Crash due to accessing removed parent lineboxes when clearing selection.
+        https://bugs.webkit.org/show_bug.cgi?id=79264
+
+        Reviewed by Dave Hyatt.
+
+        Test: editing/selection/first-letter-selection-crash.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::setSelectionState):
+        1. No need of checking if we are being set to same selection state.
+        Now tested by setSelectionStateIfNeeded. Rename 's' with 'state' and
+        'cb' with 'containingBlock'.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::setSelectionState):
+        1. Add check to canUpdateSelectionOnRootLineBoxes to make sure our
+        root line boxes are still valid before setting them.
+        2. No need of calling setSelectionState on containing block since our base
+        class call to RenderBox::setSelectionState covers it. Added a comment to indicate that.
+        3. Use m_inlineBoxWrapper variable directly to simplify the ifs.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::canUpdateSelectionOnRootLineBoxes):
+        (WebCore): helper function to tell if we can update selection information
+        on our root line boxes. This returns false if our containing block is pending layout.
+        * rendering/RenderObject.h:
+        (RenderObject):
+        (WebCore::RenderObject::setSelectionStateIfNeeded):
+        (WebCore): helper to set selection state only if it is different from our
+        current selection state.
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::setSelectionState):
+        1. Rename 's' to 'state', 'line' to 'root' and use m_inlineBoxWrapper directly
+        to simplify ifs.
+        2. Add check to canUpdateSelectionOnRootLineBoxes to make sure our
+        root line boxes are still valid before setting them.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setSelectionState):
+        1. Add check to canUpdateSelectionOnRootLineBoxes to make sure our
+        root line boxes are still valid before setting them.
+        2. Rename 'cb' to 'containingBlock', 'line' to 'root', move InlineTextBox
+        declaration to local.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Replace all calls to setSelectionState
+        with setSelectionStateIfNeeded.
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setSelectionState):
+        1. No need of checking if we are being set to same selection state.
+        Now tested by setSelectionStateIfNeeded.
+
+2012-03-09  Levi Weintraub  <leviw@chromium.org>
+
+        Move TransformationMatrix and TransformState to LayoutUnits.
+        https://bugs.webkit.org/show_bug.cgi?id=80632
+
+        Reviewed by Simon Fraser.
+
+        When we move layout to sub-pixel precision, we want to preserve that precision through
+        transformations. This change readies TransformState and TransformationMatrix to make
+        use of this additional precision in accumulating transforms, and in returning rects that
+        preserve it.
+
+        No new tests. No change in behavior.
+
+        * platform/graphics/transforms/TransformState.cpp:
+        (WebCore::TransformState::move): Changed to pass along LayoutUnits to the contained
+        TransformationMatrix. The values of the LayoutUnits will be implicitly converted to
+        floats to be applied.
+        * platform/graphics/transforms/TransformState.h:
+        (WebCore::TransformState::move): Ditto.
+        (TransformState):
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::clampEdgeValue): Limiting edges to the maximum LayoutUnit value to prevent
+        overflow..
+        (WebCore::TransformationMatrix::clampedBoundsOfProjectedQuad): Same as above, but also
+        returning a LayoutRect which preserves additional precision than the previous IntRect.
+        (WebCore::TransformationMatrix::mapRect): Adding a version of this method that operates
+        specifically on FractionalLayoutRects.
+        (WebCore):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore):
+        (TransformationMatrix):
+        * rendering/LayoutTypes.h:
+        (WebCore::clampToLayoutUnit):
+        (WebCore):
+
+2012-03-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove a bogus assertion. This condition is no longer true for non-document tree scopes.
+
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::activeElement):
+
+2012-03-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Cleanup incDOMTreeVersion callers
+        https://bugs.webkit.org/show_bug.cgi?id=80452
+
+        Reviewed by Andreas Kling.
+
+        Unify various calls to incDOMTreeVersion and namely remove the call inside dispatchSubtreeModifiedEvent.
+        There should be no behavioral change and therefore there is no new test.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::parserAppendData):
+        (WebCore::CharacterData::setDataAndUpdate):
+        * dom/ContainerNode.cpp:
+        (WebCore::willRemoveChild):
+        (WebCore::willRemoveChildren):
+        (WebCore::ContainerNode::removeChild):
+        (WebCore::ContainerNode::removeChildren):
+        (WebCore::ContainerNode::childrenChanged):
+        (WebCore::notifyChildInserted):
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        (WebCore::Element::parserSetAttributes):
+        (WebCore::Element::willModifyAttribute):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        * html/HTMLOutputElement.cpp:
+        (WebCore::HTMLOutputElement::childrenChanged):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::childrenChanged):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::childrenChanged):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::childrenChanged):
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::childrenChanged):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::childrenChanged):
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::childrenChanged):
+
+2012-03-09  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for !ENABLE(FILTERS) after r110285.
+
+        * rendering/svg/SVGRenderingContext.h:
+        (WebCore::SVGRenderingContext::SVGRenderingContext):
+
+2012-03-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Use opaque paints in CCOcclusionTracker
+        https://bugs.webkit.org/show_bug.cgi?id=80173
+
+        Reviewed by Adrienne Walker.
+
+        Use tracked opaque paints in the tiles when tracking occlusion in
+        CCOcclusionTracker. Moves the Tile::m_opaqueRect up to the super-
+        class in CCLayerTilingData rather than having it declared in both
+        TiledLayerChromium and CCTiledLayerImpl. This lets the CCLayerTilingData
+        class compute the opaque region for its tiles, sharing code between the
+        two tiled layer implementations.
+
+        Use of this feature is guarded behind a runtime flag and turned off for
+        paint culling. We will enable it in the future once we're comfortable
+        with the paint culling.
+
+        Unit test: CCOcclusionTrackerTest.opaqueContentsRegionEmpty
+                   CCOcclusionTrackerTest.opaqueContentsRegionNonEmpty
+                   TiledLayerChromiumTest.opaqueContentsRegion
+
+        All existing CCOcclusionTrackerTest.* duplicated with opaque painted
+        rects.
+
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::opaqueContentsRegion):
+        (LayerChromium):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (UpdatableTile):
+        (WebCore::TiledLayerChromium::pushPropertiesTo):
+        (WebCore::TiledLayerChromium::prepareToUpdateTiles):
+        (WebCore::TiledLayerChromium::addSelfToOccludedScreenSpace):
+        (WebCore::TiledLayerChromium::opaqueContentsRegion):
+        (WebCore):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::opaqueContentsRegion):
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
+        (WebCore::CCLayerTilingData::opaqueRegionInLayerRect):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTilingData.h:
+        (WebCore):
+        (Tile):
+        (WebCore::CCLayerTilingData::Tile::opaqueRect):
+        (WebCore::CCLayerTilingData::Tile::setOpaqueRect):
+        (CCLayerTilingData):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::CCOcclusionTrackerBase):
+        (WebCore::computeOcclusionBehindLayer):
+        (WebCore::::markOccludedBehindLayer):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
+        (CCOcclusionTrackerBase):
+        (WebCore::CCOcclusionTrackerBase::setUsePaintTracking):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        (DrawableTile):
+        (WebCore::CCTiledLayerImpl::opaqueContentsRegion):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+        (CCTiledLayerImpl):
+
+2012-03-09  Antti Koivisto  <antti@apple.com>
+
+        Presentation attribute cache
+        https://bugs.webkit.org/show_bug.cgi?id=80707
+        
+        Reviewed by Andreas Kling.
+
+        It is common for the same presentation attribute values repeat. We should introduce a cache that uses 
+        presentation attribute names and values as key. This will help to avoid repeated parsing of the 
+        same attribute values, reduce memory consumption and speed up the style resolve.
+        
+        This patch introduces a simple and small (128 entries) global cache. In general web browsing it seems
+        to give sharing rate of >75% (an average presentation attribute property set is shared between >4 elements).
+
+        * dom/StyledElement.cpp:
+        (WebCore::PresentationAttributeCacheKey::PresentationAttributeCacheKey):
+        (PresentationAttributeCacheKey):
+        (WebCore):
+        (WebCore::operator!=):
+        (PresentationAttributeCacheEntry):
+        (WebCore::presentationAttributeCache):
+        (WebCore::attributeNameSort):
+        (WebCore::StyledElement::makePresentationAttributeCacheKey):
+        (WebCore::computePresentationAttributeCacheHash):
+        (WebCore::StyledElement::updateAttributeStyle):
+        * dom/StyledElement.h:
+        (WebCore):
+        (StyledElement):
+
+2012-03-08  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Fix object scope for inline event attribute handlers
+        https://bugs.webkit.org/show_bug.cgi?id=80329
+
+        Reviewed by Ojan Vafai.
+
+        We now create the funciton inside the with-statements with the current scope objects.
+        This is important for a few reasons:
+
+        - We need to use the real objects and not just lookup the JS properties because these might have been overridden.
+        - We need to use the node, form and document at the time of the preparation and not at the time of calling.
+        - We need to ensure that event/evt is bound closer than a property with the same name in the object environment
+          created by the with-statements.
+
+        Tests: fast/dom/inline-event-attributes-lookup-removed-form.html
+               fast/dom/inline-event-attributes-lookup-removed.html
+               fast/dom/inline-event-attributes-lookup.html
+
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::eventParameterName):
+        (WebCore):
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore):
+        (WebCore::toObjectWrapper):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore):
+        (WebCore::V8LazyEventListener::create):
+        (V8LazyEventListener):
+
+2012-03-09  Stephen Chenney  <schenney@chromium.org>
+
+        Crash in WebCore::SVGUseElement::instanceForShadowTreeElement
+        https://bugs.webkit.org/show_bug.cgi?id=80406
+
+        Reviewed by Nikolas Zimmermann.
+
+        Code assumes that an object that is an SVG Element and in a shadow
+        tree must be in an SVG use shadow tree, and casts the shadow host with
+        a static_cast. It may be that an SVG element appears in a non-use
+        shadow tree, in which case bad things happen. While it appears that
+        the current code prevents such a situation from arising (checks are
+        made within the shadow tree code to prevent it) there are also
+        indications that the situation may change.
+
+        No new tests. I believe that the problem here cannot currently be
+        reproduced. That is, other code prevents SVG elements from appearing
+        in non-svg shadow trees.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::eventTargetRespectingSVGTargetRules):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::title):
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Add support for ENABLE(LEGACY_NOTIFICATIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=80497
+
+        Reviewed by Adam Barth.
+
+        Prep for b80472: Update API for Web Notifications
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+
+2012-03-09  Kaustubh Atrawalkar  <kaustubh@motorola.com>
+
+        ShadowRoot should implement activeElement.
+        https://bugs.webkit.org/show_bug.cgi?id=79886
+
+        Reviewed by Ryosuke Niwa.
+
+        Implement the activeElement attribute for ShadowRoot to return the
+        currently focused element in the shadow DOM subtree.
+
+        Test: fast/dom/shadow/shadow-root-activeElement.html
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::activeElement):
+        (WebCore):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/ShadowRoot.idl:
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::adoptIfNeeded):
+        (WebCore):
+        (WebCore::focusedFrameOwnerElement):
+        (WebCore::TreeScope::activeElement):
+        * dom/TreeScope.h:
+        (TreeScope):
+        * html/HTMLDocument.cpp:
+        (WebCore):
+        (WebCore::HTMLDocument::activeElement):
+
+2012-03-09  Tim Horton  <timothy_horton@apple.com>
+
+        Infinite repaint loop with SVGImageCache and deferred repaint timers
+        https://bugs.webkit.org/show_bug.cgi?id=78315
+        <rdar://problem/10651634>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Only defer image redraw on a timer if we're in layout. This breaks
+        the repaint loop while still preventing us from drawing inside layout.
+
+        Completely disable repaint during relayout inside SVGImage::drawSVGToImageBuffer,
+        preventing deferred repaint timers from being started during that process.
+
+        No new tests, as the problem only occurs in a nonstandard configuration.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+        (WebCore::SVGImage::frameView):
+        (WebCore):
+        * svg/graphics/SVGImage.h:
+        (WebCore):
+        * svg/graphics/SVGImageCache.cpp:
+        (WebCore::SVGImageCache::imageContentChanged):
+        (WebCore::SVGImageCache::redraw):
+        (WebCore::SVGImageCache::redrawTimerFired):
+        (WebCore):
+        * svg/graphics/SVGImageCache.h:
+        (SVGImageCache):
+
+2012-03-09  Victor Carbune  <vcarbune@adobe.com>
+
+        The method TextTrackCue::getCueAsHTML() should return different
+        fragments on different calls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=80701
+
+        Reviewed by Eric Carlson.
+
+        Test: media/track/track-cue-mutable-fragment.html
+
+        * html/track/TextTrackCue.cpp: Removed setCueHTML(), since it is sufficient
+        to create apply the DOM rules only when the fragment is first requested.
+        (WebCore::TextTrackCue::getCueAsHTML): Changed the method such that a
+        a clone of the cached document fragment is returned.
+        * html/track/TextTrackCue.h: Removed setCueHTML() as the document fragment
+        of the cue should be created only within the class, from the cue text.
+        (TextTrackCue):
+        * html/track/WebVTTParser.cpp:
+        (WebCore::WebVTTParser::createNewCue): removed usage of setCueHTML()
+
+2012-03-09  Tim Horton  <timothy_horton@apple.com>
+
+        Crash in SVGTextLayoutAttributesBuilder::fillCharacterDataMap
+        https://bugs.webkit.org/show_bug.cgi?id=78949
+        <rdar://problem/10889440>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Invalidate the text positioning cache when the children of an SVGAElement change,
+        so that we regenerate the list the next time it's needed instead of using stale values.
+
+        Test: svg/text/text-positioning-remove-child-crash.svg
+
+        * rendering/svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::childrenChanged):
+
+2012-03-09  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        Bash scripts should support LF endings only
+        https://bugs.webkit.org/show_bug.cgi?id=79509
+
+        Reviewed by David Kilzer.
+
+        * WebCore.gyp/mac/adjust_visibility.sh: Added property svn:eol-style.
+        * WebCore.vcproj/build-generated-files.sh: Added property svn:executable.
+        * WebCore.vcproj/migrate-scripts.sh: Added property svn:executable.
+        * gyp/copy-forwarding-and-icu-headers.sh: Added property svn:eol-style.
+        * gyp/copy-inspector-resources.sh: Added property svn:eol-style.
+        * gyp/generate-derived-sources.sh: Added property svn:eol-style.
+        * gyp/generate-webcore-export-file-generator.sh: Added property svn:eol-style.
+        * gyp/run-if-exists.sh: Added property svn:eol-style.
+        * gyp/streamline-inspector-source.sh: Added property svn:eol-style.
+        * gyp/update-info-plist.sh: Added property svn:eol-style.
+
+2012-03-09  Andreas Kling  <awesomekling@apple.com>
+
+        CSSParser: Use Vector for intermediate property storage.
+        <http://webkit.org/b/80653>
+
+        Reviewed by Antti Koivisto.
+
+        Remove the custom memory management for intermediate CSSProperties in CSSParser
+        and replace it by a Vector<CSSProperty, 256>.
+        This avoids heap allocations and removes a bunch of unnecessary complexity.
+
+        Remove WTF_MAKE_FAST_ALLOCATED from CSSProperty since they are only created on
+        the stack now.
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::~CSSParser):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseColor):
+        (WebCore::CSSParser::parseDeclaration):
+        (WebCore::CSSParser::addProperty):
+        (WebCore::CSSParser::rollbackLastProperties):
+        (WebCore::CSSParser::clearProperties):
+        (WebCore::CSSParser::parse4Values):
+        (WebCore::CSSParser::parseFlowThread):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::createPageRule):
+        (WebCore::CSSParser::createMarginAtRule):
+        (WebCore::CSSParser::startDeclarationsForMarginBox):
+        (WebCore::CSSParser::endDeclarationsForMarginBox):
+        (WebCore::CSSParser::deleteFontFaceOnlyValues):
+        (WebCore::CSSParser::createKeyframeRule):
+        * css/CSSParser.h:
+        (WebCore::CSSParser::hasProperties):
+        (CSSParser):
+        * css/CSSProperty.h:
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::StylePropertySet):
+        (WebCore::StylePropertySet::addParsedProperties):
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::create):
+        (StylePropertySet):
+
+2012-03-09  Nate Chapin  <japhet@chromium.org>
+
+        CachedRawResource breaks when trying to load
+        a resource with an empty response body from cache.
+
+        Reviewed by Alexey Proskuryakov.
+
+        Test: http/tests/cache/zero-length-xhr.html
+
+        * loader/cache/CachedRawResource.cpp:
+        (WebCore::CachedRawResource::didAddClient): Don't exit early
+            if m_data is empty, we may still need to notifyFinished().
+
+2012-03-09  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream classes that handle layer tiling
+        https://bugs.webkit.org/show_bug.cgi?id=79875
+
+        Reviewed by Rob Buis.
+
+        Initial upstreaming, no new tests.
+
+        * platform/graphics/blackberry/LayerTile.cpp: Added.
+        (WebCore):
+        (WebCore::LayerTile::LayerTile):
+        (WebCore::LayerTile::~LayerTile):
+        (WebCore::LayerTile::setContents):
+        (WebCore::LayerTile::setContentsToColor):
+        (WebCore::LayerTile::updateContents):
+        (WebCore::LayerTile::discardContents):
+        (WebCore::LayerTile::setVisible):
+        (WebCore::LayerTile::setTexture):
+        * platform/graphics/blackberry/LayerTile.h: Added.
+        (WebCore):
+        (LayerTileData):
+        (WebCore::LayerTileData::LayerTileData):
+        (WebCore::LayerTileData::isVisible):
+        (LayerTile):
+        (WebCore::LayerTile::texture):
+        (WebCore::LayerTile::isVisible):
+        (WebCore::LayerTile::isDirty):
+        (WebCore::LayerTile::hasTexture):
+        (WebCore::LayerTile::setContentsDirty):
+        * platform/graphics/blackberry/LayerTileIndex.h: Added.
+        (WebCore):
+        (TileIndex):
+        (WebCore::TileIndex::TileIndex):
+        (WebCore::TileIndex::~TileIndex):
+        (WebCore::TileIndex::i):
+        (WebCore::TileIndex::j):
+        (WebCore::TileIndex::setIndex):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WTF):
+        * platform/graphics/blackberry/LayerTiler.cpp: Added.
+        (WebCore):
+        (WebCore::transformPoint):
+        (WebCore::defaultTileSize):
+        (WebCore::LayerTiler::LayerTiler):
+        (WebCore::LayerTiler::~LayerTiler):
+        (WebCore::LayerTiler::layerWebKitThreadDestroyed):
+        (WebCore::LayerTiler::layerCompositingThreadDestroyed):
+        (WebCore::LayerTiler::setNeedsDisplay):
+        (WebCore::LayerTiler::updateTextureContentsIfNeeded):
+        (WebCore::LayerTiler::shouldPerformRenderJob):
+        (WebCore::LayerTiler::addTextureJob):
+        (WebCore::LayerTiler::clearTextureJobs):
+        (WebCore::LayerTiler::commitPendingTextureUploads):
+        (WebCore::LayerTiler::layerVisibilityChanged):
+        (WebCore::LayerTiler::uploadTexturesIfNeeded):
+        (WebCore::LayerTiler::processTextureJob):
+        (WebCore::LayerTiler::addTileJob):
+        (WebCore::LayerTiler::performTileJob):
+        (WebCore::LayerTiler::drawTextures):
+        (WebCore::LayerTiler::drawMissingTextures):
+        (WebCore::LayerTiler::drawTexturesInternal):
+        (WebCore::LayerTiler::addRenderJob):
+        (WebCore::LayerTiler::removeRenderJob):
+        (WebCore::LayerTiler::deleteTextures):
+        (WebCore::LayerTiler::pruneTextures):
+        (WebCore::LayerTiler::updateTileSize):
+        (WebCore::LayerTiler::disableTiling):
+        (WebCore::LayerTiler::shouldPrefillTile):
+        (WebCore::LayerTiler::indexOfTile):
+        (WebCore::LayerTiler::originOfTile):
+        (WebCore::LayerTiler::rectForTile):
+        (WebCore::LayerTiler::hasDirtyTiles):
+        (WebCore::LayerTiler::bindContentsTexture):
+        * platform/graphics/blackberry/LayerTiler.h: Added.
+        (WebCore):
+        (LayerTiler):
+        (WebCore::LayerTiler::create):
+        (WebCore::LayerTiler::layer):
+        (WebCore::LayerTiler::hasMissingTextures):
+        (WebCore::LayerTiler::TextureJob::TextureJob):
+        (TextureJob):
+        (WebCore::LayerTiler::TextureJob::setContents):
+        (WebCore::LayerTiler::TextureJob::setContentsToColor):
+        (WebCore::LayerTiler::TextureJob::updateContents):
+        (WebCore::LayerTiler::TextureJob::discardContents):
+        (WebCore::LayerTiler::TextureJob::resizeContents):
+        (WebCore::LayerTiler::TextureJob::dirtyContents):
+        (WebCore::LayerTiler::TextureJob::isNull):
+        (WebCore::LayerTiler::tileSize):
+        (WebCore::LayerTiler::removeUpdateContentsJobs):
+
+2012-03-09  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Ensure we use the correct time when notifying animation started
+        https://bugs.webkit.org/show_bug.cgi?id=79537
+
+        Reviewed by James Robinson
+
+        Tested in CCLayerTreeHostTestAddAnimation
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setAnimationEvent):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCAnimationEvents.cpp:
+        (WebCore::CCAnimationStartedEvent::create):
+        (WebCore::CCAnimationStartedEvent::CCAnimationStartedEvent):
+        * platform/graphics/chromium/cc/CCAnimationEvents.h:
+        (CCAnimationEvent):
+        (CCAnimationStartedEvent):
+        * platform/graphics/chromium/cc/CCInputHandler.h:
+        (CCInputHandler):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp:
+        (WebCore::CCLayerAnimationControllerImpl::animate):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability):
+        (WebCore::CCLayerAnimationControllerImpl::resolveConflicts):
+        (WebCore::CCLayerAnimationControllerImpl::tickAnimations):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h:
+        (CCLayerAnimationControllerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::setAnimationEvents):
+        (WebCore::CCLayerTreeHost::setAnimationEventsRecursive):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::animate):
+        (WebCore::CCLayerTreeHostImpl::startPageScaleAnimation):
+        (WebCore::CCLayerTreeHostImpl::animateLayersRecursive):
+        (WebCore::CCLayerTreeHostImpl::animatePageScale):
+        (WebCore::CCLayerTreeHostImpl::animateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCPageScaleAnimation.cpp:
+        (WebCore::CCPageScaleAnimation::create):
+        (WebCore::CCPageScaleAnimation::CCPageScaleAnimation):
+        (WebCore::CCPageScaleAnimation::zoomTo):
+        (WebCore::CCPageScaleAnimation::zoomWithAnchor):
+        (WebCore::CCPageScaleAnimation::scrollOffsetAtTime):
+        (WebCore::CCPageScaleAnimation::pageScaleAtTime):
+        (WebCore::CCPageScaleAnimation::isAnimationCompleteAtTime):
+        (WebCore::CCPageScaleAnimation::progressRatioForTime):
+        * platform/graphics/chromium/cc/CCPageScaleAnimation.h:
+        (CCPageScaleAnimation):
+        (WebCore::CCPageScaleAnimation::startTime):
+        (WebCore::CCPageScaleAnimation::duration):
+        (WebCore::CCPageScaleAnimation::endTime):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::startPageScaleAnimation):
+        (WebCore::CCSingleThreadProxy::postAnimationEventsToMainThreadOnImplThread):
+        (WebCore::CCSingleThreadProxy::doComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::startPageScaleAnimation):
+        (WebCore::CCThreadProxy::requestStartPageScaleAnimationOnImplThread):
+        (WebCore::CCThreadProxy::postAnimationEventsToMainThreadOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwap):
+        (WebCore::CCThreadProxy::setAnimationEvents):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-03-09  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Add SVGRenderingContext and move there the context related code from SVGRenderSupport
+        https://bugs.webkit.org/show_bug.cgi?id=80413
+
+        Reviewed by Nikolas Zimmermann.
+
+        This is the first step of refactoring the rendering context for SVG. The
+        previous context was stateless before, which means the cleanup phase
+        needed to do a lot of checks to revert the initialization part and
+        was unaware of failed inititalization. Future code can also add
+        new local variables to the context.
+
+        This patch add a new SVGRenderingContext class, and moves there the context
+        initialization / cleanup code from SVGRenderSupport. All build systems were
+        updated.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/svg/RenderSVGAllInOne.cpp:
+        * rendering/svg/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        * rendering/svg/RenderSVGForeignObject.cpp:
+        (WebCore::RenderSVGForeignObject::paint):
+        * rendering/svg/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paintReplaced):
+        * rendering/svg/RenderSVGShape.cpp:
+        (WebCore::RenderSVGShape::paint):
+        * rendering/svg/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::paint):
+        * rendering/svg/SVGRenderSupport.cpp:
+        * rendering/svg/SVGRenderSupport.h:
+        * rendering/svg/SVGRenderingContext.cpp: Added.
+        (WebCore):
+        (WebCore::isRenderingMaskImage):
+        (WebCore::SVGRenderingContext::~SVGRenderingContext):
+        (WebCore::SVGRenderingContext::prepareToRenderSVGContent):
+        * rendering/svg/SVGRenderingContext.h: Added.
+        (WebCore):
+        (SVGRenderingContext):
+        (WebCore::SVGRenderingContext::SVGRenderingContext):
+        (WebCore::SVGRenderingContext::isRenderingPrepared):
+        * rendering/svg/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::paint):
+
+2012-03-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110191, r110202, and r110279.
+        http://trac.webkit.org/changeset/110191
+        http://trac.webkit.org/changeset/110202
+        http://trac.webkit.org/changeset/110279
+        https://bugs.webkit.org/show_bug.cgi?id=80694
+
+        They broke !ENABLE(INSPECTOR) builds (Requested by Ossy on
+        #webkit).
+
+        * WebCore.exp.in:
+        * testing/Internals.cpp:
+        * testing/Internals.h:
+        (WebCore):
+        (Internals):
+        * testing/Internals.idl:
+
+2012-03-09  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: add SpeechGrammar and SpeechGrammarList
+        https://bugs.webkit.org/show_bug.cgi?id=80417
+
+        Reviewed by Adam Barth.
+
+        Implement SpeechGrammar and SpeechGrammarList.
+        (Spec: http://speech-javascript-api-spec.googlecode.com/git/speechapi.html)
+
+        Test: fast/speech/scripted/speechgrammar-basics.html
+
+        * Modules/speech/DOMWindowSpeech.idl:
+        * Modules/speech/SpeechGrammar.cpp:
+        (WebCore):
+        (WebCore::SpeechGrammar::create):
+        (WebCore::SpeechGrammar::SpeechGrammar):
+        * Modules/speech/SpeechGrammar.h:
+        (WebCore):
+        (SpeechGrammar):
+        (WebCore::SpeechGrammar::src):
+        (WebCore::SpeechGrammar::setSrc):
+        (WebCore::SpeechGrammar::weight):
+        (WebCore::SpeechGrammar::setWeight):
+        * Modules/speech/SpeechGrammar.idl:
+        * Modules/speech/SpeechGrammarList.cpp:
+        (WebCore):
+        (WebCore::SpeechGrammarList::create):
+        (WebCore::SpeechGrammarList::item):
+        (WebCore::SpeechGrammarList::addFromUri):
+        (WebCore::SpeechGrammarList::addFromString):
+        (WebCore::SpeechGrammarList::SpeechGrammarList):
+        * Modules/speech/SpeechGrammarList.h:
+        (WebCore):
+        (SpeechGrammarList):
+        (WebCore::SpeechGrammarList::length):
+        * Modules/speech/SpeechGrammarList.idl:
+        * WebCore.gypi:
+
+2012-03-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110269.
+        http://trac.webkit.org/changeset/110269
+        https://bugs.webkit.org/show_bug.cgi?id=80688
+
+        It made inspector/elements/highlight-node.html fail everywhere
+        (Requested by Ossy on #webkit).
+
+        * testing/Internals.idl:
+
+2012-03-07  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Click in the first line of rule while editing property starts a new property
+        https://bugs.webkit.org/show_bug.cgi?id=80507
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype._checkWillCancelEditing):
+        (WebInspector.StylePropertiesSection.prototype._handleSelectorContainerClick):
+        (WebInspector.StylePropertiesSection.prototype._handleEmptySpaceClick):
+        (WebInspector.StylePropertyTreeElement.prototype.onattach):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-03-09  Mark Rowe  <mrowe@apple.com>
+
+        <rdar://problem/11012024> Fix the build by working around <rdar://problem/10710970>.
+
+        * platform/mac/RunLoopMac.mm:
+        (WebCore::RunLoop::stop):
+
+2012-03-09  Marja Hölttä  <marja@google.com>
+
+        FileInputType doesn't support (save|restore)FormControlState
+        https://bugs.webkit.org/show_bug.cgi?id=80145
+
+        Reviewed by Kent Tamura.
+
+        This enables saving and restoring the state of file upload elements in
+        unsubmitted forms.
+
+        Test: fast/forms/file/recover-file-input-in-unposted-form.html
+
+        * html/BaseCheckableInputType.cpp:
+        (WebCore::BaseCheckableInputType::restoreFormControlState): non-const
+        * html/BaseCheckableInputType.h:
+        (BaseCheckableInputType): restoreFormControlState non-const
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::saveFormControlState): save chosen files
+        (WebCore):
+        (WebCore::FileInputType::restoreFormControlState): restore chosen files
+        * html/FileInputType.h:
+        (FileInputType): overwrite (save|restore)FormControlState
+        * html/HiddenInputType.cpp:
+        (WebCore::HiddenInputType::restoreFormControlState): non-const
+        * html/HiddenInputType.h:
+        (HiddenInputType): restoreFormControlState non-const
+        * html/InputType.cpp:
+        (WebCore::InputType::restoreFormControlState): non-const
+        * html/InputType.h:
+        (InputType): restoreFormControlState non-const
+        * html/PasswordInputType.cpp:
+        (WebCore::PasswordInputType::restoreFormControlState): non-const
+        * html/PasswordInputType.h:
+        (PasswordInputType): restoreFormControlState non-const
+
+2012-03-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Base the access to CSSStyleDeclaration on the CSSPropertyID instead of the PropertyName
+        https://bugs.webkit.org/show_bug.cgi?id=80461
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, the acces to CSS Style properties was done through a NamedGetter. This caused
+        the (slow) mapping between CSSPropertyName and CSSPropertyID to be done twice for every acess:
+        1) canGetItemsForName() prior to the definition of the slot.
+        2) nameGetter() called from the slot with CSSPropertyName to get the actual value.
+
+        This patch changes the access to be based on CSSPropertyID. The slot is defined with the
+        CSSPropertyID as the customIndex, and the value can be accessed directly when the slot is
+        called.
+
+        To handle the differences create by hadPixelOrPosPrefix, two nearly identical callback are defined,
+        one for hadPixelOrPosPrefix, the other for !hadPixelOrPosPrefix.
+
+        The performance gain is about 19% when accessing CSS properties.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::getPropertyValueFallback):
+        (WebCore::cssPropertyGetterPixelOrPosPrefix):
+        (WebCore):
+        (WebCore::cssPropertyGetterPixelOrPosPrefixCallback):
+        (WebCore::cssPropertyGetter):
+        (WebCore::cssPropertyGetterCallback):
+        (WebCore::JSCSSStyleDeclaration::getOwnPropertySlotDelegate):
+        (WebCore::JSCSSStyleDeclaration::getOwnPropertyDescriptorDelegate):
+        * css/CSSStyleDeclaration.idl:
+
+2012-03-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Fix Qt minimal build
+
+        * testing/Internals.idl:
+
+2012-03-08  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove dead CoreGraphics code from chromium compositor implementation
+        https://bugs.webkit.org/show_bug.cgi?id=80470
+
+        Reviewed by Adam Barth.
+
+        We haven't supported CoreGraphics as a raster backend in chromium for a few months and do not plan to do so, so
+        it's time to remove the USE(CG) #ifdefs from our compositor and just rely on USE(SKIA) being set.  This also
+        slightly simplifies how PlatformCanvas works.
+
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::createTextureUpdaterIfNeeded):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::initialize):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/PlatformCanvas.cpp:
+        (WebCore::PlatformCanvas::createBackingCanvas):
+        (WebCore::PlatformCanvas::AutoLocker::AutoLocker):
+        (WebCore::PlatformCanvas::AutoLocker::~AutoLocker):
+        (WebCore):
+        (WebCore::PlatformCanvas::AutoLocker::pixels):
+        (WebCore::PlatformCanvas::Painter::Painter):
+        * platform/graphics/chromium/PlatformCanvas.h:
+        (WebCore):
+        (AutoLocker):
+        (Painter):
+        (PlatformCanvas):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h:
+
+2012-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Get rid of itemTypeAttributeChanged
+        https://bugs.webkit.org/show_bug.cgi?id=80666
+
+        Reviewed by Adam Barth.
+
+        This function is unnecessay as we can invalidate m_microDataItemListCaches
+        in invalidateCachesThatDependOnAttributes as done for other node lists.
+
+        * dom/Node.cpp:
+        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged):
+        (WebCore::NodeListsNodeData::invalidateCachesThatDependOnAttributes):
+        * dom/Node.h:
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseAttribute):
+
+2012-03-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108616.
+        http://trac.webkit.org/changeset/108616
+        https://bugs.webkit.org/show_bug.cgi?id=80676
+
+        breaks animation on Safari welcome page (Requested by smfr on
+        #webkit).
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationController::updateAnimations):
+        * page/animation/AnimationControllerPrivate.h:
+        (AnimationControllerPrivate):
+
+2012-03-08  Benjamin Poulain  <benjamin@webkit.org>
+
+        Fix the build of WebKit with WTFURL following the removal of ForwardingHeaders/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=80652
+
+        Reviewed by Eric Seidel.
+
+        The fowarding headers have been removed, we must now use the full path to the header.
+
+        * platform/KURLWTFURLImpl.h:
+
+2012-03-08  Emil A Eklund  <eae@chromium.org>
+
+        Change calcRadiiFor to IntSize
+        https://bugs.webkit.org/show_bug.cgi?id=80655
+
+        Reviewed by Simon Fraser.
+
+        Borders and RoundedRect are both represented with pixel precision. As
+        such it doesn't make sense for calcRadiiFor to use subpixel units, it
+        just adds unnecessary type conversions.
+
+        No new tests, no new functionality.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::calcRadiiFor):
+
+2012-03-08  Adrienne Walker  <enne@google.com>
+
+        [chromium] Encapsulate mask layer settings in LayerChromium
+        https://bugs.webkit.org/show_bug.cgi?id=80646
+
+        Reviewed by James Robinson.
+
+        If a WebLayer sets a mask layer, the setIsMask flag will not get set
+        properly and the mask layer will not turn off tiling. This was only
+        being set through GraphicsLayerChromium. Move this flag into
+        LayerChromium so that it always gets set.
+
+        Test: LayoutTests/compositing/
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setMaskLayer):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setMaskLayer):
+
+2012-03-08  Tony Chang  <tony@chromium.org>
+
+        margins on flex-align: baseline are double counted
+        https://bugs.webkit.org/show_bug.cgi?id=80645
+
+        Reviewed by Ojan Vafai.
+
+        Fix a bug where we're counting the margins on baseline aligned
+        children twice. Also add some test cases to make sure we handle
+        wrap-reverse baseline alignment properly.
+
+        Tests: css3/flexbox/multiline-reverse-wrap-baseline-expected.html
+               css3/flexbox/multiline-reverse-wrap-baseline.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
+
+2012-03-08  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Pass setVisibility to CCLayerTreeHostImpl regardless of LRC initialization status
+        https://bugs.webkit.org/show_bug.cgi?id=80584
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::setVisible):
+        (WebCore::CCLayerTreeHost::didBecomeInvisibleOnImplThread):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::setVisible):
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+
+2012-03-08  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Ensure that the cc thread animation framework continues to tick when the tab is backgrounded
+        https://bugs.webkit.org/show_bug.cgi?id=77668
+
+        Reviewed by James Robinson.
+
+        Tested in CCLayerTreeHostTestTickAnimationWhileBackgrounded
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (CCLayerTreeHostImplTimeSourceAdapter):
+        (WebCore::CCLayerTreeHostImplTimeSourceAdapter::create):
+        (WebCore::CCLayerTreeHostImplTimeSourceAdapter::~CCLayerTreeHostImplTimeSourceAdapter):
+        (WebCore::CCLayerTreeHostImplTimeSourceAdapter::onTimerTick):
+        (WebCore::CCLayerTreeHostImplTimeSourceAdapter::setActive):
+        (WebCore::CCLayerTreeHostImplTimeSourceAdapter::CCLayerTreeHostImplTimeSourceAdapter):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::setVisible):
+        (WebCore::CCLayerTreeHostImpl::animateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (WebCore):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.cpp:
+        (WebCore::CCProxy::currentThread):
+        (WebCore):
+        (WebCore::CCProxy::isMainThread):
+        (WebCore::CCProxy::isImplThread):
+        (WebCore::CCProxy::setCurrentThreadIsImplThread):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+
+2012-03-08  Nico Weber  <thakis@chromium.org>
+
+        [chromium] Only build NEON files if target_arch=="arm"
+        https://bugs.webkit.org/show_bug.cgi?id=80626
+
+        Currently, webcore_arm_neon will compile a bunch of files
+        whose contents are completely ifdef'd away on non-arm, and
+        then bundle all the generated empty .o files into a useless
+        libwebcore_arm_neon.a. Don't do this.
+
+        Reviewed by Tony Chang.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2012-03-08 Nima Ghanavatian <nghanavatian@rim.com>
+
+        [BlackBerry] Fix warning in PlatformTouchEventBlackBerry.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80621
+
+        Fixes a warning seen when control reaches the end of a
+        non-void function.  Return TouchCancel in the 'default' case.
+
+        Reviewed by Rob Buis.
+
+        * platform/blackberry/PlatformTouchEventBlackBerry.cpp:
+        (WebCore::touchEventType):
+
+2012-03-08  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Using wrong scissor rect for draw culling
+        https://bugs.webkit.org/show_bug.cgi?id=80624
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::optimizeRenderPasses):
+
+2012-03-08  Andy Estes  <aestes@apple.com>
+
+        REGRESSION (r105396): Dragging an iWork document into icloud.com opens it in the Mac app instead of uploading it to icloud.com
+        https://bugs.webkit.org/show_bug.cgi?id=79443
+
+        Reviewed by Ryosuke Niwa.
+
+        icloud.com registers a drop event handler that sets display:none on the
+        file input element receiving the drop. After dispatching the drop event,
+        DragController hit tests the position under the mouse to see if it is a
+        file input element in need of receiving files. Since the file input
+        element has lost its renderer, it cannot be found by hit testing, so
+        the dropped file is never attached to the file input element, no change
+        event fires, and no upload commences. We want these things to happen
+        even if the element is no longer visible.
+
+        Since we already keep track of the file input element under the mouse
+        via m_fileInputElementUnderMouse, this additional hit test is
+        unnecessary. Use m_fileInputElementUnderMouse in concludeEditDrag()
+        when dropping files.
+
+        Test: fast/events/file-input-hidden-in-ondrop.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag): Use
+        m_fileInputElementUnderMouse instead of the element returned by hit
+        testing. Assert that m_fileInputElementUnderMouse equals the hit tested
+        element unless m_fileInputElementUnderMouse doesn't have a renderer.
+
+2012-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix for micro data API.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::removeCachedMicroDataItemList):
+        * html/HTMLElement.idl:
+
+2012-03-07  Jon Lee  <jonlee@apple.com>
+
+        Support [Custom] for static functions
+        https://bugs.webkit.org/show_bug.cgi?id=80573
+
+        Reviewed by Kentaro Hara.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader): If the function is static, add static qualifier to cpp function.
+        (GenerateImplementation): Reorganize the function to split out based on the static
+        attribute, instead of checking for it at every line we output.
+            If the function is static and not custom, the listed code should be the code in
+        the rest of the function that did not have the static check. If it is custom, then
+        we check the number of arguments, and then call the static impl function directly.
+            If the function is not static, all of the "unless ($function->isStatic)" checks
+        are removed since it is not necessary.
+
+        * bindings/scripts/test/TestObj.idl: Added new test case.
+
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjConstructorFunctionClassMethod2):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (JSTestObj):
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj classMethod2]):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::ConfigureV8TestObjTemplate):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (V8TestObj):
+
+2012-03-08  Mark Pilgrim  <pilgrim@chromium.org>
+
+        Collapse ENABLE(BLOB)|ENABLE(FILE_SYSTEM) to just ENABLE(BLOB)
+        https://bugs.webkit.org/show_bug.cgi?id=80592
+
+        Reviewed by Adam Barth.
+
+        In anticipation of moving FILE_SYSTEM-related code to Modules/, we
+        are collapsing combination BLOB/FILE_SYSTEM ifdefs to just
+        BLOB. In other words, it is assumed from now on that you can not
+        have FILE_SYSTEM support without BLOB support.
+        
+        No new tests, all existing tests pass.
+
+        * CMakeLists.txt:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore):
+        (WebCore::ScriptExecutionContext::fileThread):
+        * dom/ScriptExecutionContext.h:
+        (WebCore):
+        (ScriptExecutionContext):
+        * fileapi/AsyncFileStream.cpp:
+        * fileapi/AsyncFileStream.h:
+        * fileapi/FileError.h:
+        * fileapi/FileException.cpp:
+        * fileapi/FileException.h:
+        * fileapi/FileThread.cpp:
+        * fileapi/FileThread.h:
+        * fileapi/OperationNotAllowedException.cpp:
+        * fileapi/OperationNotAllowedException.h:
+        * platform/FileStream.cpp:
+        * platform/FileStream.h:
+        * platform/FileStreamClient.h:
+        * platform/SchemeRegistry.cpp:
+        (WebCore::canDisplayOnlyIfCanRequestSchemes):
+        (WebCore::CORSEnabledSchemes):
+        (WebCore::SchemeRegistry::registerURLSchemeAsNotAllowingJavascriptURLs):
+
+2012-03-08  James Robinson  <jamesr@chromium.org>
+
+        Use an explicit attribute to signal that a context prefers to use a discrete GPU
+        https://bugs.webkit.org/show_bug.cgi?id=80639
+
+        Reviewed by Stephen White.
+
+        On platforms that support both integrated and discrete GPUs and can dynamically switch between the two, we
+        sometimes have a specific preference for a given context. Specifically, contexts used for WebGL and canvas 2d
+        acceleration should use the discrete GPU if available, but compositor contexts can run fine on an integrated
+        GPU. Instead of attempting to infer the intent from examining other context attributes, this adds an explicit
+        attribute to control this behavior.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::create):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::Attributes::Attributes):
+        (Attributes):
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::get):
+
+2012-03-08  Andy Estes  <aestes@apple.com>
+
+        NULL renderer possible in WebCore::HTMLInputElement::setCanReceiveDroppedFiles()
+        https://bugs.webkit.org/show_bug.cgi?id=80648
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/events/input-element-display-none-in-dragleave-crash.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setCanReceiveDroppedFiles): NULL-check renderer().
+
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Yet another unreviewed build fix.
+
+        Remove an unneeded and Lion-defined window constant from WebCoreFullScreenWindow.
+
+        * platform/mac/WebCoreFullScreenWindow.mm:
+        (-[WebCoreFullScreenWindow initWithContentRect:styleMask:backing:defer:]):
+
+2012-03-08  Levi Weintraub  <leviw@chromium.org>
+
+        Switch absoluteRects, culledInlineAbsoluteRects, absoluteBoundingBoxRect, and addFocusRingRects back to integers
+        https://bugs.webkit.org/show_bug.cgi?id=80545
+
+        Reviewed by Simon Fraser.
+
+        Converting the above functions, all of which return rects that represent on-screen rects, to IntRects from
+        LayoutRects.
+
+        addFocusRingsRects generates a vector of rects that is handed off directly to the GraphicsContext to be
+        drawn. Snapping the rects before adding them to the vector saves an extra pass through the vector.
+
+        absoluteRects and culledInlineAbsoluteRects are only used by addFocusRingRects, hasNonEmptyBoundingBox (only
+        to check if they're empty), and absoluteBoundingBoxRect, which is exposed from WebCore and thus should be an
+        IntRect anyways.
+
+        No new tests. No change in behavior.
+
+        * dom/Node.cpp:
+        (WebCore::Node::hasNonEmptyBoundingBox):
+        * dom/Range.cpp:
+        (WebCore::Range::boundingBox):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::absoluteRects):
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::culledInlineAbsoluteRects):
+        (WebCore::RenderInline::addFocusRingRects):
+        * rendering/RenderInline.h:
+        (RenderInline):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::addFocusRingRects):
+        * rendering/RenderListBox.h:
+        (RenderListBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintFocusRing):
+        (WebCore::RenderObject::absoluteBoundingBoxRect):
+        (WebCore::RenderObject::absoluteFocusRingQuads):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::absoluteRects):
+        (RenderObject):
+        (WebCore::RenderObject::absoluteBoundingBoxRectIgnoringTransforms):
+        (WebCore::RenderObject::addFocusRingRects):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteRects):
+        (WebCore::RenderText::absoluteRectsForRange):
+        * rendering/RenderText.h:
+        (RenderText):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::addFocusRingRects):
+        * rendering/RenderTextControl.h:
+        (RenderTextControl):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::absoluteRects):
+        * rendering/RenderView.h:
+        (RenderView):
+        * rendering/svg/RenderSVGBlock.cpp:
+        (WebCore::RenderSVGBlock::absoluteRects):
+        * rendering/svg/RenderSVGBlock.h:
+        (RenderSVGBlock):
+        * rendering/svg/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::addFocusRingRects):
+        * rendering/svg/RenderSVGContainer.h:
+        (RenderSVGContainer):
+        * rendering/svg/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::addFocusRingRects):
+        * rendering/svg/RenderSVGImage.h:
+        (RenderSVGImage):
+        * rendering/svg/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::absoluteRects):
+        * rendering/svg/RenderSVGModelObject.h:
+        (RenderSVGModelObject):
+        * rendering/svg/RenderSVGShape.cpp:
+        (WebCore::RenderSVGShape::addFocusRingRects):
+        * rendering/svg/RenderSVGShape.h:
+        (RenderSVGShape):
+
+2012-03-08  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Use EventNames instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=80649
+
+        Reviewed by Ojan Vafai.
+
+        No new tests. Covered by existing tests.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+
+2012-03-08  Tim Horton  <timothy_horton@apple.com>
+
+        No-op filter changes color output because of colorspace issues
+        https://bugs.webkit.org/show_bug.cgi?id=72411
+        <rdar://problem/10588374>
+
+        Reviewed by Dean Jackson.
+
+        Redefine "linear RGB" color space on Mac to mean linearized sRGB, instead of linear
+        Generic RGB. This makes existing CG color matching equivalent to what other ports do via
+        ImageBuffer::transformColorSpace (which only adjusts gamma, as we will now). Previously,
+        we were also causing actual (non-gamma) color adjustments which were not reversible.
+
+        No new tests, covered by all existing SVG and CSS filter tests.
+
+        * Resources/linearSRGB.icc: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::linearRGBColorSpaceRef):
+
+2012-03-08  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80463
+        RenderImage is using the wrong origin when calling addRelevantRepaintedObject
+        -and corresponding-
+        <rdar://problem/10970221>
+
+        Reviewed by Dan Bernstein.
+
+        Use the exact same rect that we paint with instead of the 
+        visualOverflowRect() which does not always have a correct x and y.
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::paintReplaced):
+
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Full Screen Refactor Part 3: Animate into Full Screen mode using new animation classes.
+        https://bugs.webkit.org/show_bug.cgi?id=78928
+
+        Reviewed by Anders Carlsson.
+
+        Move WKFullScreenWindow from WebKit2 into WebCore to be shared by WebKit2 and WebKit.
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/WebCoreFullScreenWindow.h:
+        * platform/mac/WebCoreFullScreenWindow.mm:
+
+        Add symbols for the following classes and functions to the export list:
+            WebCoreFullScreenWindow
+            WebWindowScaleAnimation
+            WebWindowFadeAnimation
+            ScrollView::contentsToScreen()
+            RenderObject::localToContainerQuad()
+            Document::setAnimatingFullScreen()
+        * WebCore.exp.in:
+
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Full Screen Refactor Part 1: Remove special-case rendering code for Full Screen animation.
+        https://bugs.webkit.org/show_bug.cgi?id=78925
+
+        Reviewed by John Sullivan.
+
+        No new tests; no net change in functionality so covered by existing tests.
+
+        The following functions had special case code for rendering full-screen elements removed:
+        * dom/Document.cpp:
+        (WebCore::Document::webkitWillEnterFullScreenForElement):
+        (WebCore::Document::webkitDidEnterFullScreenForElement):
+        (WebCore::Document::webkitWillExitFullScreenForElement):
+        (WebCore::Document::webkitDidExitFullScreenForElement):
+        (WebCore::Document::setAnimatingFullScreen):
+        * page/FrameView.cpp:
+        (WebCore):
+        (WebCore::FrameView::updateCompositingLayers):
+        (WebCore::FrameView::syncCompositingStateForThisFrame):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::layerOrAncestorIsTransformed):
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        * rendering/RenderLayerCompositor.h:
+
+2012-03-08  Matt Lilek  <mrl@apple.com>
+
+        Don't enable VIDEO_TRACK on all OS X platforms
+        https://bugs.webkit.org/show_bug.cgi?id=80635
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-08  Tony Chang  <tony@chromium.org>
+
+        implement flexbox wrap-reverse
+        https://bugs.webkit.org/show_bug.cgi?id=80552
+
+        Reviewed by Ojan Vafai.
+
+        No new tests, but additional coverage in:
+            css3/flexbox/multiline-align.html
+            css3/flexbox/multiline-pack.html
+            css3/flexbox/multiline.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::WrapReverseContext::WrapReverseContext): Helper struct to hold information needed for reversing
+        the order of lines.
+        (RenderFlexibleBox::WrapReverseContext):
+        (WebCore::RenderFlexibleBox::WrapReverseContext::addCrossAxisOffset):
+        (WebCore::RenderFlexibleBox::WrapReverseContext::addNumberOfChildrenOnLine):
+        (WebCore::RenderFlexibleBox::WrapReverseContext::lineCrossAxisDelta): Computes the number of pixels to move a line.
+        (WebCore):
+        (WebCore::RenderFlexibleBox::layoutFlexItems): Call flipForWrapReverse if needed. This happens
+        before flipForRightToLeftColumn because otherwise the crossAxisOffsets will be wrong.
+        (WebCore::flexAlignForChild):
+        (WebCore::RenderFlexibleBox::alignChildren): Flip alignment in wrap-reverse because the cross directions are flipped.
+        (WebCore::RenderFlexibleBox::flipForWrapReverse): Flip each line.
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-03-08  Adam Klein  <adamk@chromium.org>
+
+        Remove InDocumentFlag manipulation methods from Node interface
+        https://bugs.webkit.org/show_bug.cgi?id=80612
+
+        Reviewed by Ryosuke Niwa.
+
+        This is a first step towards tightening up Node::inDocument() to match
+        the actual in-document-tree state (see r108152 for the sort of bug
+        resulting from those not matching).
+
+        No new tests, refactoring only.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removedFromDocument): Remove duplicate call to clearInDocument:
+        the call to Node::removedFromDocument three lines above will clear the flag.
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Call ContainerNode constructor with InDocumentFlag always set
+        instead of calling setInDocument.
+        * dom/Node.cpp:
+        (WebCore::Node::insertedIntoDocument): Inline setInDocument (now the only caller).
+        (WebCore::Node::removedFromDocument): Inline clearInDocument (now the only caller).
+        * dom/Node.h: Remove setInDocument & clearInDocument, add new CreateDocument ConstructionType.
+
+2012-03-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Try to fix the Snow Leopard build
+
+        If the build is running under sh, echo -n does not empty the file.
+
+        * DerivedSources.pri:
+
+2012-03-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Prospective build fix for Qt minimal after r110191
+
+        https://bugs.webkit.org/show_bug.cgi?id=80338
+
+        * testing/Internals.cpp:
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+
+2012-03-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Prospective Windows build fix
+
+        Don't assume that windows-builds will always run inside a cmd.exe shell.
+
+        * DerivedSources.pri:
+
+2012-03-08  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Web Inspector: Creating a selector for class names with trailing spaces results with two dots instead of one
+        https://bugs.webkit.org/show_bug.cgi?id=80529
+
+        Trim the className before replacing the whitespaces with dot "."
+
+        Reviewed by Pavel Feldman.
+
+        No new tests.
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.appropriateSelectorFor):
+
+2012-03-08  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10981173> Dashboard regions should not be in device space
+
+        Reviewed by John Sullivan.
+
+        Test: TestWebKitAPI/Tests/mac/DeviceScaleFactorInDashboardRegions.mm
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addDashboardRegions): Stop applying the device scale factor to
+        Dashboard regions.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addDashboardRegions): Ditto.
+
+2012-03-08  Cem Kocagil  <cem.kocagil@gmail.com>
+
+        Web Inspector: Cannot insert right curly bracket on some keyboards
+        https://bugs.webkit.org/show_bug.cgi?id=80474
+
+        Make sure other modifiers are not pressed
+
+        Reviewed by Pavel Feldman
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2012-03-08  Max Vujovic  <mvujovic@adobe.com>
+
+        Add a method to window.internals to enable testing of inspector highlight rects
+        https://bugs.webkit.org/show_bug.cgi?id=80338
+
+        Reviewed by Pavel Feldman.
+
+        Add window.internals.inspectorHighlightRects, a method which makes it possible to test the
+        positions and sizes of inspector highlight rects.
+
+        Test: inspector/elements/highlight-node.html
+
+        * WebCore.exp.in: Export symbols.
+        * testing/Internals.cpp:
+        (WebCore::Internals::inspectorHighlightRects): Call InspectorController::getHighlight and
+        return the highlight's quads as a ClientRectList.
+        (WebCore):
+        * testing/Internals.h:
+        (WebCore):
+        (Internals):
+        * testing/Internals.idl:
+
+            Add inspectorHighlightRects to the window.internals interface.
+
+2012-03-08  Antti Koivisto  <antti@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80370
+        Enable matched declaration caching for elements with a style attribute
+
+        Reviewed by Andreas Kling
+
+        Make the property set for style attribute immutable as long as there is no CSSOM
+        wrapper for it. If the style attribute changes we create a new property set instead
+        of recycling the old one. This way the property sets can be made cacheable as long
+        as there is no CSSOM wrapper that would allow uncontrolled modifications. Constructing
+        the wrapper disables caching.
+        
+        Made StyledElement::inlineStyle() and StyledElement::ensureInlineStyle() return a const
+        StylePropertySet so making accidental modifications difficult. Also dropped *Decl from
+        the names.
+        
+        Fixed two unrelated bugs that this exposed.
+
+        * css/CSSStyleSelector.cpp:
+        
+            Don't allow caching of document element style if writingModeSetOnDocumentElement() bit is set.
+            Tested by fast/multicol/vertical-rl/break-properties.html.
+        
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+        (WebCore::StylePropertySet::hasCSSOMWrapper):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        
+            Invalidate the matched properties cache if the document has rem units and the root font changes.
+            Tested by fast/css/rem-dynamic-scaling.html.
+        
+        * dom/ElementAttributeData.cpp:
+        (WebCore):
+        (WebCore::ElementAttributeData::ensureInlineStyle):
+        (WebCore::ElementAttributeData::ensureMutableInlineStyle):
+        (WebCore::ElementAttributeData::updateInlineStyleAvoidingMutation):
+        (WebCore::ElementAttributeData::destroyInlineStyle):
+        * dom/ElementAttributeData.h:
+        (WebCore::ElementAttributeData::inlineStyle):
+        (ElementAttributeData):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateStyleAttribute):
+        (WebCore::StyledElement::~StyledElement):
+        (WebCore):
+        (WebCore::StyledElement::style):
+        (WebCore::StyledElement::parseAttribute):
+        (WebCore::StyledElement::setInlineStyleProperty):
+        (WebCore::StyledElement::removeInlineStyleProperty):
+        (WebCore::StyledElement::addSubresourceAttributeURLs):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::inlineStyle):
+        (WebCore::StyledElement::ensureInlineStyle):
+        (StyledElement):
+        (WebCore::StyledElement::destroyInlineStyle):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::hasNoAttributeOrOnlyStyleAttribute):
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
+        (WebCore::ApplyStyleCommand::removeCSSStyle):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToPushDown):
+        (WebCore::ApplyStyleCommand::addBlockStyle):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/EditingStyle.cpp:
+        (WebCore::HTMLElementEquivalent::propertyExistsInStyle):
+        (HTMLTextDecorationEquivalent):
+        (WebCore::HTMLTextDecorationEquivalent::propertyExistsInStyle):
+        (WebCore::EditingStyle::conflictsWithInlineStyleOfElement):
+        (WebCore::EditingStyle::elementIsStyledSpanOrHTMLEquivalent):
+        (WebCore::EditingStyle::mergeInlineStyleOfElement):
+        (WebCore::elementMatchesAndPropertyIsNotInInlineStyleDecl):
+        (WebCore::EditingStyle::mergeStyle):
+        * editing/EditingStyle.h:
+        (EditingStyle):
+        * editing/RemoveCSSPropertyCommand.cpp:
+        (WebCore::RemoveCSSPropertyCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline):
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+        * editing/markup.cpp:
+        (WebCore::StyledMarkupAccumulator::appendElement):
+        (WebCore::styleFromMatchedRulesAndInlineDecl):
+        * html/HTMLElement.cpp:
+        (WebCore::StyledElement::copyNonAttributeProperties):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::currentColor):
+        * page/PageSerializer.cpp:
+        (WebCore::PageSerializer::serializeFrame):
+        (WebCore::PageSerializer::retrieveResourcesForProperties):
+        * page/PageSerializer.h:
+        (PageSerializer):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::isEmptyOrUnstyledAppleStyleSpan):
+
+2012-03-08  Scott Byer  <scottbyer@chromium.org>
+
+        Have ScrollAnimatorNone use requestAnimationFrame
+        https://bugs.webkit.org/show_bug.cgi?id=78938
+
+        Reviewed by James Robinson.
+
+        No new tests. Passes Chromium webkit_unit_tests.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::serviceScriptedAnimations):
+        * platform/ScrollAnimator.h:
+        (WebCore::ScrollAnimator::serviceScrollAnimations):
+        * platform/ScrollAnimatorNone.cpp:
+        (WebCore::ScrollAnimatorNone::ScrollAnimatorNone):
+        (WebCore::ScrollAnimatorNone::scroll):
+        (WebCore::ScrollAnimatorNone::cancelAnimations):
+        (WebCore):
+        (WebCore::ScrollAnimatorNone::serviceScrollAnimations):
+        (WebCore::ScrollAnimatorNone::animationTimerFired):
+        (WebCore::ScrollAnimatorNone::startNextTimer):
+        (WebCore::ScrollAnimatorNone::animationTimerActive):
+        (WebCore::ScrollAnimatorNone::stopAnimationTimerIfNeeded):
+        * platform/ScrollAnimatorNone.h:
+        (ScrollAnimatorNone):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::serviceScrollAnimations):
+        (WebCore):
+        * platform/ScrollableArea.h:
+        (WebCore):
+        (ScrollableArea):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hostWindow):
+        (RenderLayer):
+        * rendering/RenderListBox.h:
+        (WebCore::RenderListBox::hostWindow):
+        (RenderListBox):
+
+2012-03-08  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r109964): Assertion failure (!isUndefined()) in Length::getIntValue() when a Dashboard region is specified without offsets
+        https://bugs.webkit.org/show_bug.cgi?id=80614
+
+        Reviewed by Beth Dakin.
+
+        Test: fast/css/dashboard-regions-undefined-length-assertion.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList): Reverted to setting zero lengths,
+        rather than Undefined ones, in the RenderStyle when offsets are not given.
+
+2012-03-08  Mikkel Kruse Johnsen  <mikkel@linet.dk>
+
+        WebKitGtk+ fails to build on win32 against GTK3
+        https://bugs.webkit.org/show_bug.cgi?id=63919
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * plugins/gtk/PluginViewGtk.cpp: Don't use gtk_socket_new with GTK3 on Win32
+        (WebCore::PluginView::platformStart):
+
+2012-03-08  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry]New feature: support about:cookie for internal build.
+        https://bugs.webkit.org/show_bug.cgi?id=80367
+
+        Reviewed by Antonio Gomes.
+
+        No new tests.
+
+        * platform/blackberry/CookieManager.cpp:
+        (WebCore::CookieManager::generateHtmlFragmentForCookies):
+        (WebCore):
+        * platform/blackberry/CookieManager.h:
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::handleAbout):
+
+2012-03-08  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Make elements with attributes smaller by eliminating the m_element back pointer in NamedNodeMap
+        https://bugs.webkit.org/show_bug.cgi?id=75069
+
+        Reviewed by Ryosuke Niwa.
+
+        NamedNodeMap is an exposed DOM representation of an element's attribute storage. As part of
+        its implementation it keeps a pointer to its associated Element plus all the attribute
+        storage.
+
+        This commit separate the two things: NamedNodeMap is now a wrapper to Element, containing
+        only the pointer, and the attribute storage is now owned by Element directly. Since usage
+        of NamedNodeMap is not very common, it can be stored in ElementRareData. As a result, most
+        elements with attributes now don't need to allocate memory for that extra pointer in
+        NamedNodeMap.
+
+        One consequence of this implementation is that now we explicitly don't support
+        DocumentType.notations and DocumentType.entities. They weren't supported before, a
+        NamedNodeMap was never created for those attributes -- and some NamedNodeMap functions
+        wouldn't work correctly without an associated Element.
+
+        NamedNodeMap itself was cleaned up, as well as unnecessary references to it removed in the
+        code and comments.
+
+        No new tests and should not change results for existing tests.
+
+        * dom/Attribute.h:
+        (WebCore):
+        * dom/DocumentType.h:
+        (DocumentType): Point out that we don't support does attributes yet.
+        * dom/Element.cpp:
+        (WebCore::Element::~Element): Detaching the NamedNodeMap is no longer necessary because it
+        will be destroyed. We still detach the potential Attrs inside our Attributes by using
+        clearAttributes().
+        (WebCore::Element::attributes): Looks in ElementRareData now. Note we ensure the creation
+        of the attribute storage.
+        (WebCore):
+        (WebCore::Element::getAttribute):
+        (WebCore::Element::setAttributeInternal):
+        (WebCore::Element::parserSetAttributes):
+        (WebCore::Element::hasAttributes):
+        (WebCore::Element::createAttributeData):
+        (WebCore::Element::insertedIntoDocument):
+        (WebCore::Element::removedFromDocument):
+        (WebCore::Element::getURLAttribute):
+        (WebCore::Element::getNonEmptyURLAttribute):
+        (WebCore::Element::hasNamedNodeMap): Helper function for Node::dumpStatistics().
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::attributeData):
+        (WebCore::Element::ensureAttributeData):
+        (WebCore::Element::fastHasAttribute):
+        (WebCore::Element::fastGetAttribute):
+        (WebCore::Element::hasAttributesWithoutUpdate):
+        (WebCore::Element::idForStyleResolution):
+        (WebCore::Element::attributeCount):
+        (WebCore::Element::attributeItem):
+        (WebCore::Element::getAttributeItem):
+        * dom/ElementAttributeData.h:
+        (WebCore::ElementAttributeData::create):
+        (ElementAttributeData):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+        * dom/NamedNodeMap.cpp: Rewriting now that m_attributeData is not a member, using m_element
+        methods when possible.
+        (WebCore::NamedNodeMap::ref):
+        (WebCore::NamedNodeMap::deref):
+        (WebCore::NamedNodeMap::getNamedItem):
+        (WebCore::NamedNodeMap::getNamedItemNS):
+        (WebCore::NamedNodeMap::removeNamedItem):
+        (WebCore::NamedNodeMap::removeNamedItemNS):
+        (WebCore::NamedNodeMap::setNamedItem):
+        (WebCore::NamedNodeMap::item):
+        (WebCore::NamedNodeMap::length):
+        * dom/NamedNodeMap.h:
+        (WebCore):
+        (WebCore::NamedNodeMap::create):
+        (NamedNodeMap):
+        (WebCore::NamedNodeMap::NamedNodeMap): Instead of asserting m_element in every function, we
+        now assert only in the constructor.
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics): Add a counter for elements with rare data, this allows us
+        compare more clearly the impact of moving NamedNodeMap there.
+        (WebCore::Node::isEqualNode): Remove use of mapsEquivalent(). It was dead code, because
+        both entities and notations were always NULL.
+        (WebCore::Node::compareDocumentPosition):
+        * inspector/DOMPatchSupport.h:
+        (WebCore):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::attributeChanged):
+
+2012-03-08  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream WebGL related files from platform/graphics
+        https://bugs.webkit.org/show_bug.cgi?id=79876
+
+        Reviewed by Rob Buis.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/DrawingBufferBlackBerry.cpp: Added.
+        (WebCore):
+        (DrawingBufferInternal):
+        (WebCore::generateColorTexture):
+        (WebCore::DrawingBuffer::DrawingBuffer):
+        (WebCore::DrawingBuffer::~DrawingBuffer):
+        (WebCore::DrawingBuffer::publishToPlatformLayer):
+        (WebCore::DrawingBuffer::reset):
+        (WebCore::DrawingBuffer::platformLayer):
+        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::paintsIntoCanvasBuffer):
+        (WebCore::GraphicsContext3D::makeContextCurrent):
+        (WebCore::GraphicsContext3D::isGLES2Compliant):
+        (WebCore::GraphicsContext3D::isGLES2NPOTStrict):
+        (WebCore::GraphicsContext3D::isErrorGeneratedOnOutOfBoundsAccesses):
+        (WebCore::GraphicsContext3D::platformTexture):
+        (WebCore::GraphicsContext3D::platformLayer):
+        (WebCore::GraphicsContext3D::paintToCanvas):
+        (WebCore::GraphicsContext3D::setContextLostCallback):
+        * platform/graphics/blackberry/WebGLLayerWebKitThread.cpp: Added.
+        (WebCore):
+        (WebCore::WebGLLayerWebKitThread::WebGLLayerWebKitThread):
+        (WebCore::WebGLLayerWebKitThread::~WebGLLayerWebKitThread):
+        (WebCore::WebGLLayerWebKitThread::setNeedsDisplay):
+        (WebCore::WebGLLayerWebKitThread::updateTextureContentsIfNeeded):
+        * platform/graphics/blackberry/WebGLLayerWebKitThread.h: Added.
+        (WebCore):
+        (WebGLLayerWebKitThread):
+        (WebCore::WebGLLayerWebKitThread::create):
+        (WebCore::WebGLLayerWebKitThread::setWebGLContext):
+
+2012-03-08  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] LayerRender should turn off stencil/scissor after drawing layers
+        https://bugs.webkit.org/show_bug.cgi?id=80598
+
+        Reviewed by Rob Buis.
+
+        Turn off stencil/scissor after using them to avoid affecting later GL operation
+        accidentally.
+
+        * platform/graphics/blackberry/LayerRenderer.cpp:
+        (WebCore::LayerRenderer::drawLayers):
+
+2012-03-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Windows build fix.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * DerivedSources.pri: Replace commandline that is too long for Windows with
+        separate lines to be executed in the Makefile for the IDL preprocessing.
+
+2012-03-08  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: The function had to return a hash but it returned just address.
+        https://bugs.webkit.org/show_bug.cgi?id=80591
+
+        Reviewed by Yury Semikhatsky.
+
+        * bindings/v8/RetainedDOMInfo.cpp:
+        (WebCore::RetainedDOMInfo::GetHash):
+
+2012-03-08  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed single line fix. The function had to return a hash but it returned just address.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::UnspecifiedGroup::GetHash):
+
+2012-03-08  Shinya Kawanaka  <shinyak@chromium.org>
+
+        <shadow> should be rendered correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=78596
+
+        Reviewed by Hajime Morita.
+
+        This patch supports <shadow> element rendering.
+
+        When attaching <shadow> element, if it is in the oldest shadow tree, it runs a part of
+        distribution algorithm. If it is in non-oldest shadow tree, it runs tree a part of
+        tree composition algorithm to assign a older shadow root. In this patch, InsertionPonit
+        try to treat the distributed host children and the assigned shadow children similarly.
+
+        NodeRenderingContext supports rendering <shadow> element. Since the assigned shadow children
+        are treated like distributed host children, that change is to consider non-youngest shadow
+        tree basically also.
+
+        Tests: fast/dom/shadow/shadow-element-rendering-multiple.html
+               fast/dom/shadow/shadow-element-rendering-single.html
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore):
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+          Does not ignore non-youngest shadow tree.
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::ShadowRoot::assignedTo):
+        (WebCore):
+        (WebCore::ShadowRoot::setAssignedTo):
+        (WebCore::ShadowRoot::isUsedForRendering):
+          Returns true if ShadowRoot is youngest or assigned to some InsertionPoint.
+        (WebCore::toShadowRoot):
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::insertionPointFor):
+          Returns InsertionPoint to which node is distributed.
+        * dom/ShadowTree.h:
+        (ShadowTree):
+        * html/shadow/HTMLContentElement.h:
+        (WebCore::HTMLContentElement::doesSelectFromHostChildren):
+        (HTMLContentElement):
+        * html/shadow/HTMLShadowElement.cpp:
+        (WebCore::HTMLShadowElement::HTMLShadowElement):
+        (WebCore::HTMLShadowElement::select):
+        (WebCore::HTMLShadowElement::doesSelectFromHostChildren):
+        (WebCore):
+        * html/shadow/HTMLShadowElement.h:
+        (HTMLShadowElement):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::attach):
+        (WebCore::InsertionPoint::detach):
+        (WebCore::InsertionPoint::assignedFrom):
+        (WebCore):
+        (WebCore::InsertionPoint::assignShadowRoot):
+        (WebCore::InsertionPoint::clearAssignment):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+
+2012-03-06  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: SpeechRecognitionAlternative, Result and ResultList
+        https://bugs.webkit.org/show_bug.cgi?id=80424
+
+        Reviewed by Adam Barth.
+
+        Implement the SpeechRecognitionAlternative,
+        SpeechRecognitionResult and SpeechRecognitionResultList.
+        (Spec: http://speech-javascript-api-spec.googlecode.com/git/speechapi.html)
+
+        No new tests because these interfaces don't have constructors.
+        They will be tested as more of the API gets implemented.
+
+        * Modules/speech/SpeechRecognitionAlternative.cpp: Added.
+        (WebCore):
+        (WebCore::SpeechRecognitionAlternative::create):
+        (WebCore::SpeechRecognitionAlternative::SpeechRecognitionAlternative):
+        * Modules/speech/SpeechRecognitionAlternative.h: Added.
+        (WebCore):
+        (SpeechRecognitionAlternative):
+        (WebCore::SpeechRecognitionAlternative::transcript):
+        (WebCore::SpeechRecognitionAlternative::confidence):
+        * Modules/speech/SpeechRecognitionAlternative.idl: Added.
+        * Modules/speech/SpeechRecognitionResult.cpp: Added.
+        (WebCore):
+        (WebCore::SpeechRecognitionResult::create):
+        (WebCore::SpeechRecognitionResult::item):
+        (WebCore::SpeechRecognitionResult::SpeechRecognitionResult):
+        * Modules/speech/SpeechRecognitionResult.h: Added.
+        (WebCore):
+        (SpeechRecognitionResult):
+        (WebCore::SpeechRecognitionResult::length):
+        (WebCore::SpeechRecognitionResult::final):
+        * Modules/speech/SpeechRecognitionResult.idl: Added.
+        * Modules/speech/SpeechRecognitionResultList.cpp: Added.
+        (WebCore):
+        (WebCore::SpeechRecognitionResultList::create):
+        (WebCore::SpeechRecognitionResultList::item):
+        (WebCore::SpeechRecognitionResultList::SpeechRecognitionResultList):
+        * Modules/speech/SpeechRecognitionResultList.h: Added.
+        (WebCore):
+        (SpeechRecognitionResultList):
+        (WebCore::SpeechRecognitionResultList::length):
+        * Modules/speech/SpeechRecognitionResultList.idl: Added.
+        * WebCore.gypi:
+
+2012-03-08  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream GraphicsLayerBlackBerry.{h, cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=79867
+
+        Reviewed by Rob Buis.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::setLayerBorderColor):
+        (WebCore::clearBorderColor):
+        (WebCore::setLayerBackgroundColor):
+        (WebCore::clearLayerBackgroundColor):
+        (WebCore::GraphicsLayer::create):
+        (WebCore::GraphicsLayerBlackBerry::GraphicsLayerBlackBerry):
+        (WebCore::GraphicsLayerBlackBerry::~GraphicsLayerBlackBerry):
+        (WebCore::GraphicsLayerBlackBerry::setName):
+        (WebCore::GraphicsLayerBlackBerry::setChildren):
+        (WebCore::GraphicsLayerBlackBerry::addChild):
+        (WebCore::GraphicsLayerBlackBerry::addChildAtIndex):
+        (WebCore::GraphicsLayerBlackBerry::addChildBelow):
+        (WebCore::GraphicsLayerBlackBerry::addChildAbove):
+        (WebCore::GraphicsLayerBlackBerry::replaceChild):
+        (WebCore::GraphicsLayerBlackBerry::removeFromParent):
+        (WebCore::GraphicsLayerBlackBerry::setPosition):
+        (WebCore::GraphicsLayerBlackBerry::setAnchorPoint):
+        (WebCore::GraphicsLayerBlackBerry::setSize):
+        (WebCore::GraphicsLayerBlackBerry::setTransform):
+        (WebCore::GraphicsLayerBlackBerry::setChildrenTransform):
+        (WebCore::GraphicsLayerBlackBerry::setPreserves3D):
+        (WebCore::GraphicsLayerBlackBerry::setMasksToBounds):
+        (WebCore::GraphicsLayerBlackBerry::setDrawsContent):
+        (WebCore::GraphicsLayerBlackBerry::setContentsVisible):
+        (WebCore::GraphicsLayerBlackBerry::setMaskLayer):
+        (WebCore::GraphicsLayerBlackBerry::setReplicatedByLayer):
+        (WebCore::GraphicsLayerBlackBerry::setFixedPosition):
+        (WebCore::GraphicsLayerBlackBerry::setHasFixedContainer):
+        (WebCore::GraphicsLayerBlackBerry::setHasFixedAncestorInDOMTree):
+        (WebCore::GraphicsLayerBlackBerry::setBackgroundColor):
+        (WebCore::GraphicsLayerBlackBerry::clearBackgroundColor):
+        (WebCore::GraphicsLayerBlackBerry::setContentsOpaque):
+        (WebCore::GraphicsLayerBlackBerry::setBackfaceVisibility):
+        (WebCore::GraphicsLayerBlackBerry::setOpacity):
+        (WebCore::GraphicsLayerBlackBerry::setContentsNeedsDisplay):
+        (WebCore::GraphicsLayerBlackBerry::setNeedsDisplay):
+        (WebCore::GraphicsLayerBlackBerry::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerBlackBerry::setContentsRect):
+        (WebCore::removeAnimationByIdAndProperty):
+        (WebCore::removeAnimationByName):
+        (WebCore::GraphicsLayerBlackBerry::addAnimation):
+        (WebCore::GraphicsLayerBlackBerry::pauseAnimation):
+        (WebCore::GraphicsLayerBlackBerry::removeAnimation):
+        (WebCore::GraphicsLayerBlackBerry::suspendAnimations):
+        (WebCore::GraphicsLayerBlackBerry::resumeAnimations):
+        (WebCore::GraphicsLayerBlackBerry::setContentsToImage):
+        (WebCore::GraphicsLayerBlackBerry::updateContentsImage):
+        (WebCore::GraphicsLayerBlackBerry::setContentsToCanvas):
+        (WebCore::GraphicsLayerBlackBerry::setContentsToMedia):
+        (WebCore::GraphicsLayerBlackBerry::hostLayerForSublayers):
+        (WebCore::GraphicsLayerBlackBerry::layerForSuperlayer):
+        (WebCore::GraphicsLayerBlackBerry::platformLayer):
+        (WebCore::GraphicsLayerBlackBerry::setDebugBackgroundColor):
+        (WebCore::GraphicsLayerBlackBerry::setDebugBorder):
+        (WebCore::GraphicsLayerBlackBerry::updateSublayerList):
+        (WebCore::GraphicsLayerBlackBerry::updateLayerPosition):
+        (WebCore::GraphicsLayerBlackBerry::updateLayerSize):
+        (WebCore::GraphicsLayerBlackBerry::updateAnchorPoint):
+        (WebCore::GraphicsLayerBlackBerry::updateTransform):
+        (WebCore::GraphicsLayerBlackBerry::updateChildrenTransform):
+        (WebCore::GraphicsLayerBlackBerry::updateMasksToBounds):
+        (WebCore::GraphicsLayerBlackBerry::updateContentsOpaque):
+        (WebCore::GraphicsLayerBlackBerry::updateBackfaceVisibility):
+        (WebCore::GraphicsLayerBlackBerry::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerBlackBerry::updateLayerIsDrawable):
+        (WebCore::GraphicsLayerBlackBerry::updateFixedPosition):
+        (WebCore::GraphicsLayerBlackBerry::updateHasFixedContainer):
+        (WebCore::GraphicsLayerBlackBerry::updateHasFixedAncestorInDOMTree):
+        (WebCore::GraphicsLayerBlackBerry::updateLayerBackgroundColor):
+        (WebCore::GraphicsLayerBlackBerry::updateAnimations):
+        (WebCore::GraphicsLayerBlackBerry::updateContentsVideo):
+        (WebCore::GraphicsLayerBlackBerry::updateContentsRect):
+        (WebCore::GraphicsLayerBlackBerry::setupContentsLayer):
+        (WebCore::GraphicsLayerBlackBerry::updateOpacityOnLayer):
+        (WebCore::GraphicsLayerBlackBerry::contentsVisible):
+        * platform/graphics/blackberry/GraphicsLayerBlackBerry.h: Added.
+        (WebCore):
+        (GraphicsLayerBlackBerry):
+        (WebCore::GraphicsLayerBlackBerry::notifySyncRequired):
+        (WebCore::GraphicsLayerBlackBerry::notifyAnimationStarted):
+        (WebCore::GraphicsLayerBlackBerry::primaryLayer):
+        (WebCore::GraphicsLayerBlackBerry::contentsLayer):
+
+2012-03-07  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Refactoring: Remove Node::isContentElement and Node::isShadowElement.
+        https://bugs.webkit.org/show_bug.cgi?id=80501
+
+        Reviewed by Hajime Morita.
+
+        Removes Node::isContentElement and Node::isShadowElement. These methods are replaced
+        by hasTagName. However the tag name of HTMLContentElement was not consistent,
+        this patch make them consistent.
+
+        No new tests. Should be covered by existing tests.
+
+        * dom/Node.h:
+        * html/HTMLElement.h:
+        (WebCore::HTMLElement::isInsertionPoint):
+        (HTMLElement):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::SummaryContentElement::SummaryContentElement):
+          It uses HTMLNames::divTag as tagname. It should use HTMLNames::webkitShadowTagName.
+        * html/shadow/HTMLContentElement.h:
+        (HTMLContentElement):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+        (WebCore::InsertionPoint::isInsertionPoint):
+        (WebCore::isInsertionPoint):
+        * testing/Internals.cpp:
+        (WebCore::Internals::isValidContentSelect):
+        * testing/Internals.h:
+        (Internals):
+
+2012-03-07  Adam Barth  <abarth@webkit.org>
+
+        ContainerNode::insertedIntoDocument and removedFromDocument use weak iteration patterns
+        https://bugs.webkit.org/show_bug.cgi?id=80569
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch moves ContainerNode::insertedIntoDocument and
+        removedFromDocument to using a better iteration pattern in which we
+        collect all the nodes we're planning to iterate into a vector and then
+        iterate over them.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertedIntoDocument):
+        (WebCore::ContainerNode::removedFromDocument):
+
+2012-03-07  Ami Fischman  <fischman@chromium.org>
+
+        [Chromium] Allow CCLayerTreeHost::context() to be called even with the threaded compositor enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=80565
+
+        Reviewed by James Robinson.
+
+        This gets triggered by the video HW decode+render path when threaded compositor is enabled
+        (https://chromiumcodereview.appspot.com/9639005/)
+
+        No new tests.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::context):
+
+2012-03-07  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: mixed absolute/percentages work for width, height, margin and padding
+        https://bugs.webkit.org/show_bug.cgi?id=79621
+
+        Reviewed by Andreas Kling.
+
+        ApplyPropertyLength in CSSStyleApplyPropery now handles mixed absolute/percentage
+        length expressions. All property handlers using this template now work with
+        mixed expressions.
+
+        This patch adds a new expression evaluator in CalculationValue.cpp. This is because
+        Length.[cpp|h] (in platform) cannot refer to CSSCalculationValue.[cpp|h] (in css) 
+        due to layering restrictions.
+
+        Lengths can be copied, and so the expressions are stored in a hashmap, and only their
+        ids are copied along with Length. The expressions are RefCounted, and will get 
+        cleaned up when the last referring Length is destructed.
+
+        * WebCore.exp.in:
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcPrimitiveValue::toCalcValue):
+        (CSSCalcPrimitiveValue):
+        (WebCore::CSSCalcBinaryOperation::toCalcValue):
+        (CSSCalcBinaryOperation):
+        * css/CSSCalculationValue.h:
+        (WebCore):
+        (CSSCalcExpressionNode):
+        (CSSCalcValue):
+        (WebCore::CSSCalcValue::toCalcValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyLength::applyValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+        * platform/CalculationValue.cpp:
+        (WebCore::CalcExpressionBinaryOperation::evaluate):
+        (WebCore):
+        (WebCore::CalculationValue::create):
+        (WebCore::CalculationValue::evaluate):
+        * platform/CalculationValue.h:
+        (CalcExpressionNode):
+        (WebCore::CalcExpressionNode::~CalcExpressionNode):
+        (WebCore):
+        (CalculationValue):
+        (WebCore::CalculationValue::CalculationValue):
+        (CalcExpressionNumber):
+        (WebCore::CalcExpressionNumber::CalcExpressionNumber):
+        (WebCore::CalcExpressionNumber::evaluate):
+        (CalcExpressionLength):
+        (WebCore::CalcExpressionLength::CalcExpressionLength):
+        (WebCore::CalcExpressionLength::evaluate):
+        (CalcExpressionBinaryOperation):
+        (WebCore::CalcExpressionBinaryOperation::CalcExpressionBinaryOperation):
+        * platform/Length.cpp:
+        (WebCore):
+        (WebCore::Length::~Length):
+        (CalculationValueHandleMap):
+        (WebCore::CalculationValueHandleMap::CalculationValueHandleMap):
+        (WebCore::CalculationValueHandleMap::insert):
+        (WebCore::CalculationValueHandleMap::remove):
+        (WebCore::CalculationValueHandleMap::get):
+        (WebCore::calcHandles):
+        (WebCore::Length::Length):
+        (WebCore::Length::calculationValue):
+        (WebCore::Length::calculatedValue):
+        (WebCore::Length::calculatedMinValue):
+        (WebCore::Length::calculatedFloatValue):
+        (WebCore::Length::incrementCalculatedRef):
+        (WebCore::Length::decrementCalculatedRef):
+        (WebCore::Length::nonNanCalculatedValue):
+        * platform/Length.h:
+        (Length):
+        (WebCore::Length::Length):
+        (WebCore::Length::operator=):
+        (WebCore::Length::operator*=):
+        (WebCore::Length::value):
+        (WebCore::Length::setValue):
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::calcFloatValue):
+        (WebCore::Length::isZero):
+        (WebCore::Length::isPositive):
+        (WebCore::Length::isNegative):
+        (WebCore::Length::isPercent):
+        (WebCore::Length::isSpecified):
+        (WebCore::Length::isCalculated):
+        (WebCore::Length::initFromLength):
+        (WebCore::Length::calculationHandle):
+
+2012-03-07  Kent Tamura  <tkent@chromium.org>
+
+        Do not refer to resutlsButtonElement and cancelButtonElement to compute paddings of search popups
+        https://bugs.webkit.org/show_bug.cgi?id=80564
+
+        Reviewed by Hajime Morita.
+
+        We'd like to reduce dependency of resultsButtonElement and
+        cancelButtonElement from RenderTextControlSingleLine.
+
+        No behavior change.
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
+        Use the left position of innerBlockElement, instead of the width of resultsButtonElement.
+        They are equivalent.
+        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
+        Use <the container width - right position of innerBlockElement>,
+        instead of the width of the cancelButtonElement. They are
+        equivalent.
+
+2012-03-07  Mike Lawther  <mikelawther@chromium.org>
+
+        use DEFINE_STATIC_LOCAL on Lengths to avoid exit time destructors
+        https://bugs.webkit.org/show_bug.cgi?id=80561
+
+        Reviewed by Eric Seidel.
+
+        This is in preparation for http://wkb.ug/79621 where a destructor is added to Length.
+
+        No new tests as this is not a behaviour change.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyPageSize::getPageSizeFromName):
+
+2012-03-07  Adam Barth  <abarth@webkit.org>
+
+        ContainerNode::willRemove uses a weak iteration pattern
+        https://bugs.webkit.org/show_bug.cgi?id=80530
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch moves ContainerNode::willRemove to using a better iteration
+        pattern in which we collect all the nodes we're planning to iterate
+        into a vector and then iterate over them.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::willRemove):
+
+2012-03-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Performance] Optimize V8 bindings for HTMLElement.classList,
+        Element.dataset and Node.attributes
+        https://bugs.webkit.org/show_bug.cgi?id=80376
+
+        Reviewed by Adam Barth.
+
+        This patch improves the performance of HTMLElement.classList, Element.dataset
+        and Node.attributes by 6.4 times, 7.1 times and 10.9 times, respectively.
+
+        Previously, a 'hiddenReferenceName' string was allocated on v8::Handle and
+        created every time the DOM attribute is accessed, in spite of the fact that
+        the 'hiddenReferenceName' string is static.
+
+        This patch moves the 'hiddenReferenceName' string to v8::Persistent and makes it static.
+        Also, this patch removes 'if (!elementValue.IsEmpty() && elementValue->IsObject())',
+        since if 'element' exists, it is guaranteed that 'elementValue' is not empty
+        and is an Object.
+
+        Performance tests: https://bugs.webkit.org/attachment.cgi?id=130283
+
+        AppleWebKit/JavaScriptCore:
+        div.classList : 382ms
+        div.classList.foo = 123 : 335ms
+        div.dataset : 403ms
+        div.dataset.foo = 123 : 5250ms
+        div.attributes : 183ms
+
+        Chromium/V8 (without this patch):
+        div.classList : 9140ms
+        div.classList.foo = 123 : 9086ms
+        div.dataset : 9930ms
+        div.dataset.foo = 123 : 49698ms
+        div.attributes : 13489ms
+
+        Chromium/V8 (with this patch):
+        div.classList : 1435ms
+        div.classList.foo = 123 : 1470ms
+        div.dataset : 1400ms
+        div.dataset.foo = 123 : 30396ms
+        div.attributes : 1242ms
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp: Modified as described above.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Ditto.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp: Ditto.
+        (WebCore::toV8):
+
+        * bindings/v8/V8HiddenPropertyName.cpp: Defined a hidden property name string statically
+        to optimize the macro.
+        (WebCore):
+        (WebCore::V8HiddenPropertyName::hiddenReferenceName):
+        * bindings/v8/V8HiddenPropertyName.h: Modified to switch two prefixes "WebCore::HiddenProperty::"
+        and "WebCore::HiddenReference::", depending on whether a given name represents a hidden property
+        or a hidden reference.
+        (WebCore):
+        (V8HiddenPropertyName):
+
+2012-03-07  Kent Tamura  <tkent@chromium.org>
+
+        Add RenderBoxModelObject::marginWidth() and marginHeight()
+        https://bugs.webkit.org/show_bug.cgi?id=80556
+
+        Reviewed by Kentaro Hara.
+
+        They make some code shorter.
+
+        No behavior change.
+
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::marginHeight): Added.
+        (WebCore::RenderBoxModelObject::marginWidth): Added.
+        * inspector/DOMNodeHighlighter.cpp: Use marginHeight() and/or marginWidth().
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatWithRect::FloatWithRect): ditto.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::checkFloatsInCleanLine): ditto.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::repaintLayerRectsForImage): ditto.
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox): ditto.
+        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox): ditto.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::crossAxisMarginExtentForChild): ditto.
+        (WebCore::RenderFlexibleBox::computeNextFlexLine): ditto.
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::culledInlineAbsoluteRects): ditto.
+        (WebCore::RenderInline::culledInlineAbsoluteQuads): ditto.
+        (WebCore::RenderInline::culledInlineBoundingBox): ditto.
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::trackPieceRectWithMargins): ditto.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::computeLogicalHeight): ditto.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::computeControlHeight): ditto.
+
+2012-03-07  Jessie Berlin  <jberlin@apple.com>
+
+        Clean Windows build fails after r110033
+        https://bugs.webkit.org/show_bug.cgi?id=80553
+
+        Rubber-stamped by Jon Honeycutt and Eric Seidel.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Update the expected location of the copied JSC WTF string implementation files.
+
+2012-03-07  Michael Nordman  <michaeln@google.com>
+
+        [Chromium] Don't be so CRASH() happy in the bindings layer.
+        https://bugs.webkit.org/show_bug.cgi?id=75111
+        - change the v8 bindings generated code to check for the 'worker is terminating'
+          condition prior to committing a suicidal CRASH()
+        - fixup custom v8 bindings accordingly
+        - simplify bindings/generic/ActiveDOMCallback, there is no need for it to support
+          destruction on a different thread
+
+        Reviewed by David Levin.
+
+        No new tests, existing tests apply.
+
+        * bindings/generic/ActiveDOMCallback.cpp: Simplified in general.
+        (WebCore):
+        (WebCore::ActiveDOMCallback::ActiveDOMCallback):
+        (WebCore::ActiveDOMCallback::~ActiveDOMCallback):
+        (WebCore::ActiveDOMCallback::canInvokeCallback):
+        (WebCore::ActiveDOMCallback::isScriptControllerTerminating): New method to avoid CRASH()ing in exceptional conditions in v8 bindings.
+        * bindings/generic/ActiveDOMCallback.h: Derive from ContextDestructionObserver.
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::scheduleExecutionTermination): Use a mutex to provide a memory barrier.
+        (WebCore::WorkerScriptController::isExecutionTerminating): New supporting method to avoid CRASH()ing in exceptional conditions.
+        * bindings/js/WorkerScriptController.h:
+        (WorkerScriptController):
+        * bindings/scripts/CodeGeneratorV8.pm: Generates v8 bindding code that uses isScriptControllerTerminating to avoid CRASH()ing.
+        (GenerateCallbackImplementation):
+        * bindings/scripts/test/V8/V8TestCallback.cpp: Fixup expected outputs of the modified CodeGeneratorV8.pm script.
+        (WebCore::V8TestCallback::callbackWithClass1Param):
+        (WebCore::V8TestCallback::callbackWithClass2Param):
+        (WebCore::V8TestCallback::callbackWithStringList):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::WorkerScriptController): Initialize a new data member.
+        (WebCore::WorkerScriptController::scheduleExecutionTermination): Use a mutex to provide a memory barrier.
+        (WebCore::WorkerScriptController::isExecutionTerminating): New supporting method to avoid CRASH()ing in exceptional conditions.
+        * bindings/v8/WorkerScriptController.h: Add a pair of new data members, bool + mutex.
+        (WorkerScriptController):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8SQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8MutationCallbackCustom.cpp:
+        (WebCore::V8MutationCallback::handleEvent):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::ScriptExecutionContext): Initilaize data members.
+        (WebCore::ScriptExecutionContext::stopActiveDOMObjects): Set m_activeDOMObjectsAreStopped.
+        * dom/ScriptExecutionContext.h: Add m_activeDOMObjectsAreStopped data member.
+        (WebCore::ScriptExecutionContext::activeDOMObjectsAreStopped): Simple getter.
+        (ScriptExecutionContext):
+
+2012-03-07  Kent Tamura  <tkent@chromium.org>
+
+        Remove meaningless code in RenderTextControlSingleLine::preferredContentWidth()
+        https://bugs.webkit.org/show_bug.cgi?id=80493
+
+        Reviewed by Hajime Morita.
+
+        preferredContentWidth() added border+padding widths of the search result
+        button, search cancel button, and speech input button. It makes no sense
+        to make the intrinsic width wider by only their border+padding width,
+        not their content width.
+
+        The default borders and paddings of these buttons are 0 in all
+        platforms, and adding border or padding to these elements by page
+        authors made unreasonable behavior. So we had better remove this
+        code.
+
+        Tests: fast/forms/search/intrinsic-search-width-with-decoration-border-padding.html
+               fast/speech/intrinsic-input-width-with-speech-border-padding.html
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+         Remove the meaningless code.
+        * rendering/RenderTextControlSingleLine.h:
+        (RenderTextControlSingleLine): Remove speechButtonElement(). It's unnecessary.
+
+2012-03-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110126.
+        http://trac.webkit.org/changeset/110126
+        https://bugs.webkit.org/show_bug.cgi?id=80558
+
+        compile failed on AppleMac (Requested by ukai on #webkit).
+
+        * WebCore.exp.in:
+        * css/CSSCalculationValue.cpp:
+        * css/CSSCalculationValue.h:
+        (WebCore):
+        (CSSCalcExpressionNode):
+        (CSSCalcValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyLength::applyValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        * platform/CalculationValue.cpp:
+        * platform/CalculationValue.h:
+        * platform/Length.cpp:
+        (WebCore::newLengthArray):
+        * platform/Length.h:
+        (WebCore::Length::operator*=):
+        (WebCore::Length::value):
+        (WebCore::Length::setValue):
+        (Length):
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::calcFloatValue):
+        (WebCore::Length::isZero):
+        (WebCore::Length::isPositive):
+        (WebCore::Length::isNegative):
+        (WebCore::Length::isPercent):
+        (WebCore::Length::isSpecified):
+
+2012-03-05  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Make Node::dumpStatistics() work again
+        https://bugs.webkit.org/show_bug.cgi?id=80327
+
+        Reviewed by Ryosuke Niwa.
+
+        Update the code in dumpStatistics() to the latest attribute storage changes. Also
+        move the DUMP_NODE_STATISTICS define here from the Node.cpp, since its also used
+        by Document.h.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics): Use more self-describing variable names.
+        * dom/Node.h:
+
+2012-03-07  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: mixed absolute/percentages work for width, height, margin and padding
+        https://bugs.webkit.org/show_bug.cgi?id=79621
+
+        Reviewed by Andreas Kling.
+
+        ApplyPropertyLength in CSSStyleApplyPropery now handles mixed absolute/percentage
+        length expressions. All property handlers using this template now work with
+        mixed expressions.
+
+        This patch adds a new expression evaluator in CalculationValue.cpp. This is because
+        Length.[cpp|h] (in platform) cannot refer to CSSCalculationValue.[cpp|h] (in css) 
+        due to layering restrictions.
+
+        Lengths can be copied, and so the expressions are stored in a hashmap, and only their
+        ids are copied along with Length. The expressions are RefCounted, and will get 
+        cleaned up when the last referring Length is destructed.
+
+        * WebCore.exp.in:
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcPrimitiveValue::toCalcValue):
+        (CSSCalcPrimitiveValue):
+        (WebCore::CSSCalcBinaryOperation::toCalcValue):
+        (CSSCalcBinaryOperation):
+        * css/CSSCalculationValue.h:
+        (WebCore):
+        (CSSCalcExpressionNode):
+        (CSSCalcValue):
+        (WebCore::CSSCalcValue::toCalcValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyLength::applyValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+        * platform/CalculationValue.cpp:
+        (WebCore::CalcExpressionBinaryOperation::evaluate):
+        (WebCore):
+        (WebCore::CalculationValue::create):
+        (WebCore::CalculationValue::evaluate):
+        * platform/CalculationValue.h:
+        (CalcExpressionNode):
+        (WebCore::CalcExpressionNode::~CalcExpressionNode):
+        (WebCore):
+        (CalculationValue):
+        (WebCore::CalculationValue::CalculationValue):
+        (CalcExpressionNumber):
+        (WebCore::CalcExpressionNumber::CalcExpressionNumber):
+        (WebCore::CalcExpressionNumber::evaluate):
+        (CalcExpressionLength):
+        (WebCore::CalcExpressionLength::CalcExpressionLength):
+        (WebCore::CalcExpressionLength::evaluate):
+        (CalcExpressionBinaryOperation):
+        (WebCore::CalcExpressionBinaryOperation::CalcExpressionBinaryOperation):
+        * platform/Length.cpp:
+        (WebCore):
+        (WebCore::Length::~Length):
+        (CalculationValueHandleMap):
+        (WebCore::CalculationValueHandleMap::CalculationValueHandleMap):
+        (WebCore::CalculationValueHandleMap::insert):
+        (WebCore::CalculationValueHandleMap::remove):
+        (WebCore::CalculationValueHandleMap::get):
+        (WebCore::calcHandles):
+        (WebCore::Length::Length):
+        (WebCore::Length::calculationValue):
+        (WebCore::Length::calculatedValue):
+        (WebCore::Length::calculatedMinValue):
+        (WebCore::Length::calculatedFloatValue):
+        (WebCore::Length::incrementCalculatedRef):
+        (WebCore::Length::decrementCalculatedRef):
+        (WebCore::Length::nonNanCalculatedValue):
+        * platform/Length.h:
+        (Length):
+        (WebCore::Length::Length):
+        (WebCore::Length::operator=):
+        (WebCore::Length::operator*=):
+        (WebCore::Length::value):
+        (WebCore::Length::setValue):
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::calcFloatValue):
+        (WebCore::Length::isZero):
+        (WebCore::Length::isPositive):
+        (WebCore::Length::isNegative):
+        (WebCore::Length::isPercent):
+        (WebCore::Length::isSpecified):
+        (WebCore::Length::isCalculated):
+        (WebCore::Length::initFromLength):
+        (WebCore::Length::calculationHandle):
+
+2012-03-07  Emil A Eklund  <eae@chromium.org>
+
+        Change remaining scroll methods to integers
+        https://bugs.webkit.org/show_bug.cgi?id=80539
+
+        Reviewed by Eric Seidel.
+
+        No new tests, no new functionality.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::scrollToXOffset):
+        (WebCore::RenderLayer::scrollToYOffset):
+        Change scrollTo methods to take integer x and y values as the actual
+        scrolling is done in increments of full pixels.
+        
+        (WebCore::cornerStart):
+        (WebCore::RenderLayer::scrollWidth):
+        (WebCore::RenderLayer::scrollHeight):
+        Change scrollWidth/Height to return pixel snapped values and remove
+        pixelSnapped versions of same as all callers either used snapped the
+        values or used the pixelSnapped versions of these methods.
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scrollWidth):
+        Change scrollWidth to return snapped client width.
+        
+        * rendering/RenderListBox.h:
+        Change scrollSize, scrollPosition and setScrollOffset methods to use
+        integers in accordance with the interface defined by ScrollableArea.
+        
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+
+2012-03-07  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Implement getAttributeNode() in terms of ElementAttributeData instead of NamedNodeMap
+        https://bugs.webkit.org/show_bug.cgi?id=80541
+
+        Reviewed by Ryosuke Niwa.
+
+        DOM methods exposed in Element and NamedNodeMap are now implemented in terms of
+        ElementAttributeData. The difference between them is that Element methods can early
+        return if there's no attribute storage.
+
+        * dom/Element.cpp:
+        (WebCore::Element::getAttributeNode):
+        Removed the manual lowercasing letting our existing mechanism in
+        ElementAttributeData::getAttributeItemIndex() take care of it. I considered that
+        this could be an optimization, but testing a few Dromaeo tests (dom-attr,
+        jslib-attr-jquery, jslib-attr-prototype) the difference isn't significant. It
+        shouldn't affect correctness either.
+
+        (WebCore::Element::getAttributeNodeNS):
+        * dom/ElementAttributeData.cpp:
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        (WebCore::ElementAttributeData::getAttributeNode):
+        (WebCore):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::getNamedItem):
+        (WebCore::NamedNodeMap::getNamedItemNS):
+        * dom/NamedNodeMap.h:
+        (NamedNodeMap):
+
+2012-03-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Support printing WebGL content in threaded compositor
+        https://bugs.webkit.org/show_bug.cgi?id=80464
+
+        Reviewed by Kenneth Russell.
+
+        Do the readback on the WebGL context instead of the compositor's context since we cannot use the latter from the
+        main thread. Since we're on the WebGL context, we have to be careful to restore any state we change.
+
+        Tested printing manually with threaded compositing enabled.
+
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::paintRenderedResultsToCanvas):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        (WebGLLayerChromium):
+
+2012-03-07  Adam Barth  <abarth@webkit.org>
+
+        Remove #define private public from WebCache.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80520
+
+        Reviewed by Eric Seidel.
+
+        Add some accessors for state used by WebCache.cpp.
+
+        * loader/cache/MemoryCache.h:
+        (WebCore::MemoryCache::minDeadCapacity):
+        (WebCore::MemoryCache::maxDeadCapacity):
+        (WebCore::MemoryCache::capacity):
+        (WebCore::MemoryCache::liveSize):
+        (WebCore::MemoryCache::deadSize):
+        (MemoryCache):
+
+2012-03-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Performance] Optimize Element.firstElementChild, Element.lastElementChild,
+        Element.previousElementSibling, Element.nextElementSibling, Node.parentElement
+        https://bugs.webkit.org/show_bug.cgi?id=80506
+
+        Reviewed by Adam Barth.
+
+        This patch improves the performance of Element.firstElementChild by 5.8 times,
+        Element.lastElementChild by 6.2 times, Element.previousElementSibling by 7.1 times,
+        Element.nextElementSibling by 7.1 times, and Node.parentElement by 6.7 times.
+
+        Previously, while toV8(Node*) caches a wrapper object on a node object
+        (i.e. node->wrapper(), node->setWrapper()), toV8(Element*) does not
+        cache a wrapper object.
+
+        This patch removes toV8(Element*), so that DOM attribute getters that return
+        Element* use toV8(Node*). This change makes these DOM attribute getters
+        cache the wrapper object on a node object. This optimization is already
+        implemented in JavaScriptCore.
+
+        Performance tests: https://bugs.webkit.org/attachment.cgi?id=130594
+
+        The test results in my local Mac environment are as follows:
+
+        AppleWebKit/JavaScriptCore:
+        div.firstElementChild : 1162ms
+        div.lastElementChild : 1016ms
+        div.previousElementSibling : 918ms
+        div.nextElementSibling : 900ms
+        div.parentElement : 901ms
+
+        Chromium/V8 (without this patch):
+        div.firstElementChild : 9515ms
+        div.lastElementChild : 9449ms
+        div.previousElementSibling : 9254ms
+        div.nextElementSibling : 9315ms
+        div.parentElement : 9380ms
+
+        Chromium/V8 (with this patch):
+        div.firstElementChild : 1628ms
+        div.lastElementChild : 1527ms
+        div.previousElementSibling : 1310ms
+        div.nextElementSibling : 1310ms
+        div.parentElement : 1410ms
+
+        No tests. No change in behavior.
+
+        * dom/Element.idl: Removed toV8(Element*)
+        * bindings/v8/custom/V8NodeCustom.cpp: Ditto.
+        (WebCore::toV8Slow):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateHeader):
+
+        * bindings/v8/custom/V8ElementCustom.cpp: Removed.
+        * Target.pri: Removed V8ElementCustom.cpp.
+        * UseV8.cmake: Ditto.
+        * WebCore.gypi: Ditto.
+
+2012-03-07  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: V8LocalContext creation in IDBKey extraction/injection is slow
+        https://bugs.webkit.org/show_bug.cgi?id=80358
+
+        Cache a re-usable context (per isolate) for cases like IDB's key/SSV extraction/injection,
+        where no user script is run. This yields a 3x-4x performance improvement in basic IDB
+        operations.
+
+        Reviewed by Tony Chang.
+
+        No new tests - no behavior changes.
+
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromSerializedValueAndKeyPath):
+        (WebCore::injectIDBKeyIntoSerializedValue):
+        * bindings/v8/V8Binding.h:
+        (WebCore::V8BindingPerIsolateData::auxiliaryContext):
+        (V8BindingPerIsolateData):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::V8AuxiliaryContext::V8AuxiliaryContext):
+        (WebCore::V8AuxiliaryContext::~V8AuxiliaryContext):
+        (WebCore::V8AuxiliaryContext::auxiliaryContext):
+        * bindings/v8/V8Utilities.h:
+        (V8AuxiliaryContext):
+
+2012-03-07  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Remove unused wasRecreate variable
+        https://bugs.webkit.org/show_bug.cgi?id=80533
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+
+2012-03-07  Ryan Sleevi  <rsleevi@chromium.org>
+
+        [chromium] Update GYP files to reflect file deletes/renames
+        https://bugs.webkit.org/show_bug.cgi?id=80525
+
+        Reviewed by Ryosuke Niwa.
+
+        No change in functionality, so no tests.
+
+        * WebCore.gypi:
+        Updated AppleMac private headers due to r109877
+        Updated platform/qt references due to r109542
+        Updated platform/mac references due to r109147
+        Updated platform/mac references due to r108956
+
+2012-03-07  Eric Carlson  <eric.carlson@apple.com>
+
+        Html5 video element Useragent string is Quicktime
+        https://bugs.webkit.org/show_bug.cgi?id=46241
+
+        Reviewed by Daniel Bates.
+
+        Test: http/tests/media/video-useragent.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerUserAgent): Return the UA string for the current source.
+        * html/HTMLMediaElement.h:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::userAgent):  New, return the client's mediaPlayerUserAgent.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerUserAgent):
+
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Tell AVFoundation to set
+            the UA header.
+
+2012-03-07  Scott Byer  <scottbyer@chromium.org>
+
+        Get ScrollAnimatorNone to handle the stop and reverse cases.
+        https://bugs.webkit.org/show_bug.cgi?id=80455
+
+        Reviewed by James Robinson.
+
+        Chromium webkit_unit_tests ScrollAnimatorNoneTest.ScrollStopInMiddle and
+        ScrollAnimatorNoneTest.ReverseInMiddle.
+
+        * platform/ScrollAnimatorNone.cpp:
+        (WebCore::ScrollAnimatorNone::PerAxisData::updateDataFromParameters):
+
+2012-03-07  Yong Li  <yoli@rim.com>
+
+        RenderImage ignores its percent width/height when setContainerSizeForRenderer
+        https://bugs.webkit.org/show_bug.cgi?id=80431
+
+        Reviewed by George Staikos.
+
+        Not only respect fixed width/height explicitly specified in img element, but also
+        respect percent width/height when determining container size for images.
+
+        No new tests because there is no functional change but only internal buffer sizes.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::computeReplacedLogicalWidth):
+
+2012-03-06  Benjamin Poulain  <bpoulain@apple.com>
+
+        [Mac] Update the configuration files for iOS
+        https://bugs.webkit.org/show_bug.cgi?id=80435
+
+        Reviewed by David Kilzer.
+
+        * Configurations/WebCore.xcconfig:
+
+2012-03-07  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Cull occluded tiles during paint
+        https://bugs.webkit.org/show_bug.cgi?id=76838
+
+        Reviewed by Adrienne Walker.
+
+        Using CCOcclusionTracker instead of the old custom paint occlusion
+        tracking. Stops painting tiles when the tile is not visible.
+
+        CCOcclusionTracker only uses Layer::opaque() for determining
+        occlusion so far. The Layer::addSelfToOccludedRegion is being
+        replaced by a superior method in CCOcclusionTracker that will
+        work for both threads, so removing that support here.
+
+        Unit test: TiledLayerChromiumTest.cpp
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::paintContentsIfDirty):
+        (WebCore::ContentLayerChromium::idlePaintContentsIfDirty):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (ContentLayerChromium):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::paintContentsIfDirty):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::idlePaintContentsIfDirty):
+        (LayerChromium):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore):
+        (WebCore::contentToLayerTransform):
+        (WebCore::TiledLayerChromium::prepareToUpdateTiles):
+        (WebCore::TiledLayerChromium::prepareToUpdate):
+        (WebCore::TiledLayerChromium::prepareToUpdateIdle):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::paintContentsIfDirty):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+
+2012-03-07  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Implement removeAttributeNode() in terms of ElementAttributeData instead of NamedNodeMap
+        https://bugs.webkit.org/show_bug.cgi?id=80522
+
+        Reviewed by Andreas Kling.
+
+        DOM methods exposed in Element and NamedNodeMap are now implemented in terms of
+        ElementAttributeData. A helper function takeAttribute() was added to increase
+        code sharing. Also removed some unneeded methods.
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttribute): Use ElementAttributeData function directly.
+        (WebCore::Element::removeAttributeNode): Get the index manually and use new
+        takeAttribute() directly.
+        * dom/Element.h:
+        (Element): Remove unused removeAttribute(unsigned index).
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::takeAttribute): Like removeAttribute() but
+        returns a reference to old Attr.
+        (WebCore):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::removeNamedItem): Avoid looking up the property twice by
+        getting the index directly from the name, instead of going through the qualified name.
+        * dom/NamedNodeMap.h: Remove now unused internal methods for removing attributes.
+
+2012-03-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Merge AsyncFileStream with FileStreamProxy
+        https://bugs.webkit.org/show_bug.cgi?id=80325
+
+        Build fix.
+
+        * WebCore.xcodeproj/project.pbxproj: Removed files that got mysteriously added to the project
+        with a merge.
+
+2012-03-07  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Unreviewed ASSERT failure fix.
+        https://bugs.webkit.org/show_bug.cgi?id=75568
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        Fix a bad merge of the patch, we should call updateCachedSizeForOverflowClip if we lose
+        our layer.
+
+2012-03-07  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [EFL] Revise PlatformKeyboardEventEfl and EflKeyboardUtilities
+        https://bugs.webkit.org/show_bug.cgi?id=80511
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Added 'const' keyword in front of argument of keyIdentifiersForEvasKeyName/windowsKeyCodeForEvasKeyName.
+        Since they should not be changed while processing each function.
+        And initialized missing member variables of PlatformKeyboardEventEfl.
+
+        No new tests, since no new feature.
+
+        * platform/efl/EflKeyboardUtilities.cpp:
+        (WebCore::keyIdentifierForEvasKeyName): Added const keyword
+        (WebCore::windowsKeyCodeForEvasKeyName): Added const keyword
+        * platform/efl/EflKeyboardUtilities.h:
+        (WebCore):
+        * platform/efl/PlatformKeyboardEventEfl.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+
+2012-03-07  Hironori Bono  <hbono@chromium.org>
+
+        [Chromium] Mirror the resizer image of an RTL element when WTF_USE_RTL_SCROLLBAR is 1
+        https://bugs.webkit.org/show_bug.cgi?id=9223
+
+        Reviewed by Tony Chang.
+
+        This change mirrors a resizer image of an RTL element horizontall as Firefox
+        does. This change also mirrors its dragging behavior, i.e. draging the resizer
+        of an RTL element to the left side increases its width. (This feature is enabled
+        only when WTF_USE_RTL_SCROLLBAR is 1.)
+
+        Test: platform/chromium/scrollbars/drag-rtl-resizer.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize): Mirrored the x coordinate of mouse positions
+        when mirroring a resizer.
+        (WebCore::RenderLayer::offsetFromResizeCorner): Returned the offset from the
+        bottom-left corner when rendering a resizer there.
+        (WebCore::RenderLayer::drawPlatformResizerImage): Mirrored the resizer bitmap
+        horizontally when rendering a resizer to the bottom-left corner.
+
+2012-03-07  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Lazily allocate overflow: hidden layers if we have overflowing content
+        https://bugs.webkit.org/show_bug.cgi?id=75568
+
+        Reviewed by David Hyatt.
+
+        Change covered by the existing tests and the tons of rebaselines.
+
+        This change makes us lazily allocate our RenderLayer for overflow: hidden layers only.
+
+        Apart from saving some memory, it will also speed up the rendering as we don't need to
+        go through the layer's machinery when painting and hit testing.
+
+        On http://dglazkov.github.com/performance-tests/biggrid.html benchmark, this puts the
+        overflow: hidden case in par with the overflow: visible case when scrolling that is a
+        very-smooth scrolling vs a jerky one currently (mostly due to the painting speedup).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        Changed this method to update our size cache if needed.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::isPointInOverflowControl):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::willBeDestroyed):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::layout):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::scrollLeft):
+        (WebCore::RenderBox::scrollTop):
+        (WebCore::RenderBox::setScrollLeft):
+        (WebCore::RenderBox::setScrollTop):
+        (WebCore::RenderBox::includeVerticalScrollbarSize):
+        (WebCore::RenderBox::includeHorizontalScrollbarSize):
+        (WebCore::RenderBox::scrolledContentOffset):
+        (WebCore::RenderBox::pushContentsClip):
+        (WebCore::RenderBox::popContentsClip):
+        (WebCore::RenderBox::addLayoutOverflow):
+        Added layer() check to the previous call sites.
+
+        (WebCore::cachedSizeForOverflowClipMap):
+        (WebCore::RenderBox::cachedSizeForOverflowClip):
+        (WebCore::RenderBox::updateCachedSizeForOverflowClip):
+        (WebCore::RenderBox::clearCachedSizeForOverflowClip):
+        This logic stores the size information for later repainting.
+        It is in practice replicating what RenderLayer is doing.
+        I had to disable an ASSERT here as it would trigger in NRWT but
+        not under DRT. I haven't found by code inspection what was wrong.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::hasOverflowClipWithLayer):
+        Helper function.
+
+        (WebCore::RenderBox::requiresLayerForOverflowClip):
+        This determines if we can survive without a RenderLayer. For the moment,
+        it is very conservative.
+
+        (WebCore::RenderBox::requiresLayer):
+        Updated to call requiresLayerForOverflowClip.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::ensureLayer):
+        Added this function to create and add a new layer.
+
+        (WebCore::RenderBoxModelObject::willBeDestroyed):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        Patched those method to handle updating / removing
+        cached size entries.
+
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::requiresLayer):
+        Pushed the overflowClip check down to RenderBox as only RenderBoxes can have
+        overflow clips.
+
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::requiresLayer):
+        Added a comment about why we need a layout for table rows.
+
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layout):
+        Updated those call sites to use RenderBlock::updateScrollInfoAfterLayout
+        or RenderBox::updateCachedSizeForOverflowClip. The current logic is really
+        not tight proof and would need to be rethought to not avoid cases.
+
+2012-03-07  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Fix warnings in CookieMap
+        https://bugs.webkit.org/show_bug.cgi?id=80512
+
+        Reviewed by Rob Buis.
+
+        No new tests. No behavioural changes.
+
+        * platform/blackberry/CookieMap.cpp:
+        (WebCore::CookieMap::addOrReplaceCookie):
+        (WebCore::CookieMap::removeCookie):
+        (WebCore::CookieMap::getAllCookies):
+        (WebCore::CookieMap::updateOldestCookie):
+
+2012-03-07  Levi Weintraub  <leviw@chromium.org>
+
+        Update usage of LayoutUnits in InlineBox and InlineFlowBox
+        https://bugs.webkit.org/show_bug.cgi?id=80051
+
+        Reviewed by Eric Seidel.
+
+        Updating LayoutUnit vs Integer usage in InlineBox and InlineFlowBox. While the
+        line box tree remains floating point, margins are now subpixel, and rects from
+        the render tree use LayoutUnits. For more information, see the LayoutUnit wiki
+        page: https://trac.webkit.org/wiki/LayoutUnit
+
+        No new tests. No change in behavior.
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::flipForWritingMode): Changing over to LayoutUnits.
+        * rendering/InlineBox.h:
+        (InlineBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::getFlowSpacingLogicalWidth): Returning a LayoutUnit
+        instead of an integer, as it uses margin which is a LayoutUnit.
+        (WebCore::InlineFlowBox::placeBoxesInInlineDirection): Using a LayoutUnit for
+        margin.
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection): Build fixes for when
+        LayoutUnits are subpixel.
+        (WebCore::InlineFlowBox::paintFillLayer): Ditto.
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::marginBorderPaddingLogicalLeft): Returning a LayoutUnit
+        instead of an integer since margin is a LayoutUnit.
+        (WebCore::InlineFlowBox::marginBorderPaddingLogicalRight): Ditto.
+        (InlineFlowBox):
+        (WebCore::InlineFlowBox::logicalLeftLayoutOverflow): Adding a static_cast that's
+        redundant now, but required when we switch to subpixel LayoutUnits.
+        (WebCore::InlineFlowBox::logicalRightLayoutOverflow): Ditto.
+        (WebCore::InlineFlowBox::logicalLeftVisualOverflow): Ditto.
+        (WebCore::InlineFlowBox::logicalRightVisualOverflow): Ditto.
+
+2012-03-07  Qi Zhang  <qi.2.zhang@nokia.com>
+
+        [Qt] Unskip http/tests/websocket/tests/hixie76/long-invalid-header.html
+        https://bugs.webkit.org/show_bug.cgi?id=80516
+
+        Reviewed by Csaba Osztrogonác.
+
+        Missed some files related to websocket, take them in.
+
+        * Target.pri:
+
+2012-03-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Merge AsyncFileStream with FileStreamProxy
+        https://bugs.webkit.org/show_bug.cgi?id=80325
+
+        Reviewed by Filip Pizlo.
+
+        AsyncFileStream sounds like a platform concept, but the implementation is web specific.
+        Better to just keep it in one place.
+
+        This is a step toward decoupling blob scheme support from ResourceHandle, which is supposed
+        to be an interface to platform networking APIs only, and definitely shouldn't know about
+        Web concepts.
+
+        No change in functionality, so no tests.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Updated for moved and removed files. Namely, platform/AsyncFileStream is dead, and
+        fileapi/FileStreamProxy is now fileapi/AsyncFileStream.
+
+        * fileapi/AsyncFileStream.cpp: Copied from Source/WebCore/fileapi/FileStreamProxy.cpp.
+        (WebCore::AsyncFileStream::AsyncFileStream):
+        (WebCore::AsyncFileStream::create):
+        (WebCore::AsyncFileStream::~AsyncFileStream):
+        (WebCore::AsyncFileStream::fileThread):
+        (WebCore::didStart):
+        (WebCore::AsyncFileStream::startOnFileThread):
+        (WebCore::AsyncFileStream::stop):
+        (WebCore::derefProxyOnContext):
+        (WebCore::AsyncFileStream::stopOnFileThread):
+        (WebCore::didGetSize):
+        (WebCore::AsyncFileStream::getSize):
+        (WebCore::AsyncFileStream::getSizeOnFileThread):
+        (WebCore::didOpen):
+        (WebCore::AsyncFileStream::openForRead):
+        (WebCore::AsyncFileStream::openForReadOnFileThread):
+        (WebCore::AsyncFileStream::openForWrite):
+        (WebCore::AsyncFileStream::openForWriteOnFileThread):
+        (WebCore::AsyncFileStream::close):
+        (WebCore::AsyncFileStream::closeOnFileThread):
+        (WebCore::didRead):
+        (WebCore::AsyncFileStream::read):
+        (WebCore::AsyncFileStream::readOnFileThread):
+        (WebCore::didWrite):
+        (WebCore::AsyncFileStream::write):
+        (WebCore::AsyncFileStream::writeOnFileThread):
+        (WebCore::didTruncate):
+        (WebCore::AsyncFileStream::truncate):
+        (WebCore::AsyncFileStream::truncateOnFileThread):
+        * fileapi/AsyncFileStream.h: Copied from Source/WebCore/fileapi/FileStreamProxy.h.
+        (WebCore):
+        (AsyncFileStream):
+        (WebCore::AsyncFileStream::client):
+        (WebCore::AsyncFileStream::setClient):
+        * fileapi/FileStreamProxy.cpp: Removed.
+        * fileapi/FileStreamProxy.h: Removed.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::createAsyncFileStream):
+        * platform/AsyncFileStream.h: Removed.
+        Fewer files!
+
+        * platform/network/BlobRegistry.h: Removed createResourceHandle(). It's logically a method
+        on in-process BlobRegistryImpl only, and we no longer need to call this from platform code.
+
+        * platform/network/BlobRegistryImpl.cpp:
+        (WebCore::createResourceHandle):
+        (WebCore::registerBlobResourceHandleConstructor):
+        (WebCore::BlobRegistryImpl::registerBlobURL):
+        * platform/network/BlobRegistryImpl.h:
+        Except for chromium, "blob" is a scheme that's handled internally. Added hooks for that.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::builtinResourceHandleConstructorMap):
+        (WebCore::ResourceHandle::registerBuiltinConstructor):
+        (WebCore::ResourceHandle::create):
+        * platform/network/ResourceHandle.h:
+        Added a way for other code to register handlers for URL schemes. Non-Chromium platforms
+        use this for blob: now.
+
+2012-03-07  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10923294> REGRESSION (r100847): Entries are clipped out in Day One
+        https://bugs.webkit.org/show_bug.cgi?id=80494
+
+        Reviewed by Sam Weinig.
+
+        Test: fast/dom/HTMLDocument/width-and-height.html
+
+        * html/HTMLDocument.idl: Reverted r100847 by re-enabling the width and height properties
+        in the JavaScript bindings.
+
+2012-03-07  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] media/audio-garbage-collect.html is flaky
+        https://bugs.webkit.org/show_bug.cgi?id=72698
+
+        Reviewed by Xan Lopez.
+
+        Call ::hasPendingActivity() instead of ::paused() when checking if
+        the audio element is still active. This is similar to what the
+        image element (another ActiveDOMObject implementation) does just
+        above. This contributes to fixing the audio-garbage-collect.html
+        test.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::isReachableFromDOM):
+
+2012-03-07  Adele Peterson  <adele@apple.com>
+
+        REGRESSION(r96566): Cursor is I-beam upon dragging an attachment in mail
+        https://bugs.webkit.org/show_bug.cgi?id=80458
+        <rdar://problem/10873195>
+
+        Reviewed by Dan Bernstein.
+
+        No tests because we currently don't have any test machinery for cursors.
+
+        Make sure the shortcut to always use an iBeam cursor during selection isn't used during dragging.
+        Before r96566, we handled plugin cursors as a special case before calling into selectCursor, so we never hit this code path.
+
+        * page/EventHandler.cpp: (WebCore::EventHandler::selectCursor):
+
+2012-03-07  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [EFL] Key press event is not processed properly.
+        https://bugs.webkit.org/show_bug.cgi?id=80491
+
+        Reviewed by Gustavo Noronha Silva.
+
+        This issue is related with mutation observer feature.
+        If enter key is pressed, then a keyboard event should be processed
+        and reach to the mutation observer, but it doesn't.
+        Some special keys like Enter, Backspace and Tab key should be processed
+        and change to a single character code, but EFL port hasn't handled like that.
+
+        At least we can verify this with following two tests as I know. but they require another
+        functionality for bug79601. I'm going to submit the patch for it after this one.
+
+        Test: fast/mutation/end-of-task-delivery.html
+              fast/mutation/inline-event-listener.html
+
+        * platform/efl/EflKeyboardUtilities.cpp:
+        (WebCore::singleCharacterString):
+        (WebCore):
+        * platform/efl/EflKeyboardUtilities.h:
+        (WebCore):
+        * platform/efl/PlatformKeyboardEventEfl.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+
+2012-03-07  Gavin Peters  <gavinp@chromium.org>
+
+        Add Histograms for reporting on PageCache reject reasons
+        https://bugs.webkit.org/show_bug.cgi?id=80187
+
+        Enhance the PageCache debug mode so that it uses Histograms to
+        report on causes of failure.  Turn on the debug printing path
+        even in non-debug Chromium builds, so these histograms will
+        update.
+
+        Reviewed by Brady Eidson.
+
+        No new tests, does not change behaviour.
+
+        * history/PageCache.cpp:
+        (WebCore):
+        (WebCore::logCanCacheFrameDecision):
+        (WebCore::logCanCachePageDecision):
+        (WebCore::PageCache::canCache):
+
+2012-03-07  Elliot Poger  <epoger@google.com>
+
+        [Chromium] Remove use_skia option from GYP
+        https://bugs.webkit.org/show_bug.cgi?id=75811
+
+        Reviewed by Tony Chang.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-03-07  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Introduce LabelableElement to share "labels" attribute implementation
+        https://bugs.webkit.org/show_bug.cgi?id=80392
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces new class LabelableElement as base class of
+        HTMLFormControlElement for sharing implementation of "labels" 
+        attribute among form-associate elements, "meter" element, and 
+        "progress" element.
+
+        This patch allows us to change base class of HTMLMeterElement and
+        HTMLProgressElement dervied from HTMLFormControlElement to 
+        HTMLElement for remove them from HTMLFormElement::m_associatedFormElements
+        where we don't need to put "meter" and "progress" elements(bug 80381.)
+
+        This patch also changes implementation of isLabelable using virtual
+        method rather than sequence of hasTagName for execution speed and
+        better readability.
+
+        No new tests are required. No behavior changes.
+
+        * CMakeLists.txt: Add LabelableElement.cpp and .h
+        * GNUmakefile.list.am:  Add LabelableElement.cpp and .h
+        * Target.pri: Add LabelableElement.cpp and .h
+        * WebCore.gypi: Add LabelableElement.cpp and .h
+        * WebCore.vcproj/WebCore.vcproj: Add LabelableElement.cpp and .h
+        * WebCore.xcodeproj/project.pbxproj: Add LabelableElement.cpp and .h
+        * html/HTMLButtonElement.h: Implement isLabelable.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement): Change direct base class.
+        * html/HTMLFormControlElement.h:
+        (HTMLFormControlElement): Change direct base class.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isLabelable): Removed to use virtual method instead of hasTagName.
+        (WebCore):
+        * html/HTMLInputElement.h: Declaration of isLabelable.
+        * html/HTMLKeygenElement.h: Implement isLabelable.
+        * html/HTMLMeterElement.h: Implement isLabelable.
+        * html/HTMLProgressElement.h: Implement isLabelable.
+        * html/HTMLSelectElement.h: Implement isLabelable.
+        * html/HTMLTextAreaElement.h: Implement isLabelable.
+        * html/LabelableElement.cpp: Added.
+        (WebCore):
+        (WebCore::LabelableElement::LabelableElement):
+        (WebCore::LabelableElement::~LabelableElement):
+        (WebCore::LabelableElement::labels): Moved from HTMLFormControlElement.
+        * html/LabelableElement.h: Added.
+        (WebCore):
+        (LabelableElement):
+
+2012-03-07  Arun Patole  <bmf834@motorola.com>
+
+        HTMLTrackElement.idl doesn't have default attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=80116
+
+        Reviewed by Kentaro Hara.
+
+        Renamed isDefault to 'default' so that in JS, it will be track.default instead of track.isDefault.
+        * html/HTMLTrackElement.idl:
+
+2012-03-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        [Qt] Add qmake config tests for JPEG and PNG library
+        https://bugs.webkit.org/show_bug.cgi?id=80398
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add JPEG and PNG library tests to config.tests and
+        add error() abort to WebCore.pri if tests don't work.
+
+        * WebCore.pri:
+
+2012-03-06  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: extract source mapping logic from DebuggerPresentationModel to ScriptMappingImpl.
+        https://bugs.webkit.org/show_bug.cgi?id=80412
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/ScriptMapping.js:
+        (WebInspector.ScriptMappingImpl):
+        (WebInspector.ScriptMappingImpl.prototype.rawLocationToUILocation):
+        (WebInspector.ScriptMappingImpl.prototype.createLiveLocation):
+        (WebInspector.ScriptMappingImpl.prototype.uiSourceCodeList):
+        (WebInspector.ScriptMappingImpl.prototype._handleUISourceCodeListChanged):
+        (WebInspector.ScriptMappingImpl.prototype._uiSourceCodeListChanged):
+        (WebInspector.ScriptMappingImpl.prototype._bindScriptToRawSourceCode):
+        (WebInspector.ScriptMappingImpl.prototype.setFormatSource):
+        (WebInspector.ScriptMappingImpl.prototype.forceUpdateSourceMapping):
+        (WebInspector.ScriptMappingImpl.prototype.reset):
+
+2012-03-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix DerivedSources.make to not assume that WTF and WebCore build in to the same build directory.
+
+        We can't assume that wtf/Platform.h can be found inside BUILT_PRODUCTS_DIR as
+        that won't be the case if WTF and WebCore are building in to different build
+        directories. We should instead look for wtf/Platform.h in the header search path.
+        
+        Unreviewed due to being a build fix.
+
+        * DerivedSources.make: Set up the header search path, and invoke the compiler in
+        such a manner that it looks for wtf/Platform.h in that search path.
+
+2012-03-07  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream Texture and TextureCache
+        https://bugs.webkit.org/show_bug.cgi?id=80121
+
+        Reviewed by Rob Buis.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/Texture.cpp: Added.
+        (WebCore):
+        (WebCore::copyImageData):
+        (WebCore::Texture::Texture):
+        (WebCore::Texture::~Texture):
+        (WebCore::Texture::updateContents):
+        (WebCore::Texture::setContentsToColor):
+        (WebCore::Texture::protect):
+        * platform/graphics/blackberry/Texture.h: Added.
+        (WebCore):
+        (Texture):
+        (WebCore::Texture::create):
+        (WebCore::Texture::textureId):
+        (WebCore::Texture::isDirty):
+        (WebCore::Texture::hasTexture):
+        (WebCore::Texture::isColor):
+        (WebCore::Texture::isOpaque):
+        (WebCore::Texture::isProtected):
+        (WebCore::Texture::protect):
+        (WebCore::Texture::unprotect):
+        (WebCore::Texture::size):
+        (WebCore::Texture::width):
+        (WebCore::Texture::height):
+        (WebCore::Texture::bytesPerPixel):
+        (WebCore::Texture::setTextureId):
+        * platform/graphics/blackberry/TextureCacheCompositingThread.cpp: Added.
+        (WebCore):
+        (TextureProtector):
+        (WebCore::TextureProtector::TextureProtector):
+        (WebCore::TextureProtector::~TextureProtector):
+        (WebCore::TextureCacheCompositingThread::TextureCacheCompositingThread):
+        (WebCore::TextureCacheCompositingThread::allocateTextureId):
+        (WebCore::TextureCacheCompositingThread::freeTextureId):
+        (WebCore::TextureCacheCompositingThread::collectGarbage):
+        (WebCore::TextureCacheCompositingThread::textureResized):
+        (WebCore::TextureCacheCompositingThread::textureDestroyed):
+        (WebCore::TextureCacheCompositingThread::install):
+        (WebCore::TextureCacheCompositingThread::evict):
+        (WebCore::TextureCacheCompositingThread::textureAccessed):
+        (WebCore::textureCacheCompositingThread):
+        (WebCore::TextureCacheCompositingThread::prune):
+        (WebCore::TextureCacheCompositingThread::clear):
+        (WebCore::TextureCacheCompositingThread::setMemoryUsage):
+        (WebCore::TextureCacheCompositingThread::textureForTiledContents):
+        (WebCore::TextureCacheCompositingThread::textureForColor):
+        (WebCore::TextureCacheCompositingThread::updateContents):
+        (WebCore::TextureCacheCompositingThread::key):
+        * platform/graphics/blackberry/TextureCacheCompositingThread.h: Added.
+        (WebCore):
+        (TextureCacheCompositingThread):
+        (WebCore::TextureCacheCompositingThread::createTexture):
+        (WebCore::TextureCacheCompositingThread::memoryUsage):
+        (WebCore::TextureCacheCompositingThread::memoryLimit):
+        (WebCore::TextureCacheCompositingThread::setMemoryLimit):
+        (WebCore::TextureCacheCompositingThread::prune):
+        (WebCore::TextureCacheCompositingThread::ZombieTexture::ZombieTexture):
+        (ZombieTexture):
+        (WebCore::TextureCacheCompositingThread::incMemoryUsage):
+        (WebCore::TextureCacheCompositingThread::decMemoryUsage):
+        (WebCore::TextureCacheCompositingThread::ColorHash::hash):
+        (WebCore::TextureCacheCompositingThread::ColorHash::equal):
+        (ColorHash):
+        (ColorHashTraits):
+        (WebCore::TextureCacheCompositingThread::ColorHashTraits::constructDeletedValue):
+        (WebCore::TextureCacheCompositingThread::ColorHashTraits::isDeletedValue):
+
+2012-03-07  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Should raise SYNTAX_ERR when message contains unpaired surrogates
+        https://bugs.webkit.org/show_bug.cgi?id=80103
+
+        Reviewed by Kent Tamura.
+
+        Add UTF8 validation checks for WebSocket message and close reason.
+
+        Tests: http/tests/websocket/tests/hybi/unpaired-surrogates-in-close-reason.html
+               http/tests/websocket/tests/hybi/unpaired-surrogates-in-message.html
+
+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::send): Raise SYNTAX_ERR if the message is invalid.
+        (WebCore::WebSocket::close):Raise SYNTAX_ERR if the reason is invalid.
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send): Check whether message is a valid UTF8 string.
+
+2012-03-07  Byungwoo Lee  <bw80.lee@samsung.com>
+
+        [EFL] Build warning: Fix warn_unused_result warnings.
+        https://bugs.webkit.org/show_bug.cgi?id=79194
+
+        Reviewed by Filip Pizlo.
+
+        Fixed build warning which is getting generated when not using return
+        value of a fuction, especially declared with warn_unused_result
+        attribute.
+
+        * platform/efl/SharedBufferEfl.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
+2012-03-07  Kent Tamura  <tkent@chromium.org>
+
+        Cleanup of RenderTextControl::adjustControlHeightBasedOnLineHeight()
+        https://bugs.webkit.org/show_bug.cgi?id=80480
+
+        Reviewed by Hajime Morita.
+
+        The callsite of adjustControlHeightBasedOnLineHeight() stored
+        padding+border+margin height of the inner text in height(), and
+        adjustControlHeightBasedOnLineHeight() implementations refered it. It
+        was unreasonable and hard to understand.
+
+        The purpose of adjustControlHeightBasedOnLineHeight() is to compute
+        - the maximum height of line-heights of the inner text and decorations
+        - the maximum height of padding+border+margin heights of the inner text and decorations,
+        and to sum them up. This patch rewrites the code to make it understood easily.
+
+        adjustControlHeightBasedOnLineHeight() is renamed to
+        computeControlheight(), it takes additional parameter of
+        padding+boder+margin height, and returns the sum of them.
+
+        No behavior change.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::computeLogicalHeight):
+        * rendering/RenderTextControl.h:
+        (RenderTextControl):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::computeControlHeight):
+        * rendering/RenderTextControlMultiLine.h:
+        (RenderTextControlMultiLine):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::computeControlHeight):
+        * rendering/RenderTextControlSingleLine.h:
+        (RenderTextControlSingleLine):
+
+2012-03-06  Eric Seidel  <eric@webkit.org>
+
+        Make WTF public headers use fully-qualified include paths and remove ForwardingHeaders/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=80363
+
+        Reviewed by Mark Rowe.
+
+        ForwardingHeaders/wtf is no longer needed (or functional) now that
+        JavaScriptCore no longer includes the WTF headers as private headers.
+
+        * DerivedSources.make:
+        * ForwardingHeaders/wtf/ASCIICType.h: Removed.
+        * ForwardingHeaders/wtf/AVLTree.h: Removed.
+        * ForwardingHeaders/wtf/Alignment.h: Removed.
+        * ForwardingHeaders/wtf/AlwaysInline.h: Removed.
+        * ForwardingHeaders/wtf/ArrayBuffer.h: Removed.
+        * ForwardingHeaders/wtf/ArrayBufferView.h: Removed.
+        * ForwardingHeaders/wtf/Assertions.h: Removed.
+        * ForwardingHeaders/wtf/Atomics.h: Removed.
+        * ForwardingHeaders/wtf/Bitmap.h: Removed.
+        * ForwardingHeaders/wtf/BloomFilter.h: Removed.
+        * ForwardingHeaders/wtf/BumpPointerAllocator.h: Removed.
+        * ForwardingHeaders/wtf/ByteArray.h: Removed.
+        * ForwardingHeaders/wtf/CheckedArithmetic.h: Removed.
+        * ForwardingHeaders/wtf/CheckedBoolean.h: Removed.
+        * ForwardingHeaders/wtf/Compiler.h: Removed.
+        * ForwardingHeaders/wtf/Complex.h: Removed.
+        * ForwardingHeaders/wtf/CryptographicallyRandomNumber.h: Removed.
+        * ForwardingHeaders/wtf/CurrentTime.h: Removed.
+        * ForwardingHeaders/wtf/DataLog.h: Removed.
+        * ForwardingHeaders/wtf/DateInstanceCache.h: Removed.
+        * ForwardingHeaders/wtf/DateMath.h: Removed.
+        * ForwardingHeaders/wtf/DecimalNumber.h: Removed.
+        * ForwardingHeaders/wtf/Decoder.h: Removed.
+        * ForwardingHeaders/wtf/Deque.h: Removed.
+        * ForwardingHeaders/wtf/DisallowCType.h: Removed.
+        * ForwardingHeaders/wtf/DoublyLinkedList.h: Removed.
+        * ForwardingHeaders/wtf/DynamicAnnotations.h: Removed.
+        * ForwardingHeaders/wtf/Encoder.h: Removed.
+        * ForwardingHeaders/wtf/ExportMacros.h: Removed.
+        * ForwardingHeaders/wtf/FastAllocBase.h: Removed.
+        * ForwardingHeaders/wtf/FastMalloc.h: Removed.
+        * ForwardingHeaders/wtf/FixedArray.h: Removed.
+        * ForwardingHeaders/wtf/Float32Array.h: Removed.
+        * ForwardingHeaders/wtf/Float64Array.h: Removed.
+        * ForwardingHeaders/wtf/Forward.h: Removed.
+        * ForwardingHeaders/wtf/Functional.h: Removed.
+        * ForwardingHeaders/wtf/GetPtr.h: Removed.
+        * ForwardingHeaders/wtf/HashCountedSet.h: Removed.
+        * ForwardingHeaders/wtf/HashFunctions.h: Removed.
+        * ForwardingHeaders/wtf/HashMap.h: Removed.
+        * ForwardingHeaders/wtf/HashSet.h: Removed.
+        * ForwardingHeaders/wtf/HashTable.h: Removed.
+        * ForwardingHeaders/wtf/HashTraits.h: Removed.
+        * ForwardingHeaders/wtf/HexNumber.h: Removed.
+        * ForwardingHeaders/wtf/Int16Array.h: Removed.
+        * ForwardingHeaders/wtf/Int32Array.h: Removed.
+        * ForwardingHeaders/wtf/Int8Array.h: Removed.
+        * ForwardingHeaders/wtf/ListHashSet.h: Removed.
+        * ForwardingHeaders/wtf/ListRefPtr.h: Removed.
+        * ForwardingHeaders/wtf/Locker.h: Removed.
+        * ForwardingHeaders/wtf/MD5.h: Removed.
+        * ForwardingHeaders/wtf/MainThread.h: Removed.
+        * ForwardingHeaders/wtf/MathExtras.h: Removed.
+        * ForwardingHeaders/wtf/MessageQueue.h: Removed.
+        * ForwardingHeaders/wtf/MetaAllocator.h: Removed.
+        * ForwardingHeaders/wtf/MetaAllocatorHandle.h: Removed.
+        * ForwardingHeaders/wtf/NonCopyingSort.h: Removed.
+        * ForwardingHeaders/wtf/Noncopyable.h: Removed.
+        * ForwardingHeaders/wtf/NotFound.h: Removed.
+        * ForwardingHeaders/wtf/OSAllocator.h: Removed.
+        * ForwardingHeaders/wtf/OwnArrayPtr.h: Removed.
+        * ForwardingHeaders/wtf/OwnPtr.h: Removed.
+        * ForwardingHeaders/wtf/OwnPtrCommon.h: Removed.
+        * ForwardingHeaders/wtf/PageAllocation.h: Removed.
+        * ForwardingHeaders/wtf/PageAllocationAligned.h: Removed.
+        * ForwardingHeaders/wtf/PageBlock.h: Removed.
+        * ForwardingHeaders/wtf/PageReservation.h: Removed.
+        * ForwardingHeaders/wtf/ParallelJobs.h: Removed.
+        * ForwardingHeaders/wtf/PassOwnArrayPtr.h: Removed.
+        * ForwardingHeaders/wtf/PassOwnPtr.h: Removed.
+        * ForwardingHeaders/wtf/PassRefPtr.h: Removed.
+        * ForwardingHeaders/wtf/Platform.h: Removed.
+        * ForwardingHeaders/wtf/PossiblyNull.h: Removed.
+        * ForwardingHeaders/wtf/RandomNumber.h: Removed.
+        * ForwardingHeaders/wtf/RedBlackTree.h: Removed.
+        * ForwardingHeaders/wtf/RefCounted.h: Removed.
+        * ForwardingHeaders/wtf/RefCountedLeakCounter.h: Removed.
+        * ForwardingHeaders/wtf/RefPtr.h: Removed.
+        * ForwardingHeaders/wtf/RetainPtr.h: Removed.
+        * ForwardingHeaders/wtf/SHA1.h: Removed.
+        * ForwardingHeaders/wtf/SegmentedVector.h: Removed.
+        * ForwardingHeaders/wtf/SimpleStats.h: Removed.
+        * ForwardingHeaders/wtf/Spectrum.h: Removed.
+        * ForwardingHeaders/wtf/StackBounds.h: Removed.
+        * ForwardingHeaders/wtf/StaticConstructors.h: Removed.
+        * ForwardingHeaders/wtf/StdLibExtras.h: Removed.
+        * ForwardingHeaders/wtf/StringExtras.h: Removed.
+        * ForwardingHeaders/wtf/StringHasher.h: Removed.
+        * ForwardingHeaders/wtf/TemporaryChange.h: Removed.
+        * ForwardingHeaders/wtf/ThreadRestrictionVerifier.h: Removed.
+        * ForwardingHeaders/wtf/ThreadSafeRefCounted.h: Removed.
+        * ForwardingHeaders/wtf/ThreadSpecific.h: Removed.
+        * ForwardingHeaders/wtf/Threading.h: Removed.
+        * ForwardingHeaders/wtf/ThreadingPrimitives.h: Removed.
+        * ForwardingHeaders/wtf/TypeTraits.h: Removed.
+        * ForwardingHeaders/wtf/Uint16Array.h: Removed.
+        * ForwardingHeaders/wtf/Uint32Array.h: Removed.
+        * ForwardingHeaders/wtf/Uint8Array.h: Removed.
+        * ForwardingHeaders/wtf/Uint8ClampedArray.h: Removed.
+        * ForwardingHeaders/wtf/UnusedParam.h: Removed.
+        * ForwardingHeaders/wtf/VMTags.h: Removed.
+        * ForwardingHeaders/wtf/ValueCheck.h: Removed.
+        * ForwardingHeaders/wtf/Vector.h: Removed.
+        * ForwardingHeaders/wtf/VectorTraits.h: Removed.
+        * ForwardingHeaders/wtf/WTFThreadData.h: Removed.
+        * ForwardingHeaders/wtf/dtoa.h: Removed.
+        * ForwardingHeaders/wtf/dtoa/double-conversion.h: Removed.
+        * ForwardingHeaders/wtf/text/ASCIIFastPath.h: Removed.
+        * ForwardingHeaders/wtf/text/AtomicString.h: Removed.
+        * ForwardingHeaders/wtf/text/AtomicStringHash.h: Removed.
+        * ForwardingHeaders/wtf/text/AtomicStringImpl.h: Removed.
+        * ForwardingHeaders/wtf/text/CString.h: Removed.
+        * ForwardingHeaders/wtf/text/StringBuffer.h: Removed.
+        * ForwardingHeaders/wtf/text/StringBuilder.h: Removed.
+        * ForwardingHeaders/wtf/text/StringConcatenate.h: Removed.
+        * ForwardingHeaders/wtf/text/StringHash.h: Removed.
+        * ForwardingHeaders/wtf/text/StringImpl.h: Removed.
+        * ForwardingHeaders/wtf/text/TextPosition.h: Removed.
+        * ForwardingHeaders/wtf/text/WTFString.h: Removed.
+        * ForwardingHeaders/wtf/unicode/CharacterNames.h: Removed.
+        * ForwardingHeaders/wtf/unicode/Collator.h: Removed.
+        * ForwardingHeaders/wtf/unicode/UTF8.h: Removed.
+        * ForwardingHeaders/wtf/unicode/Unicode.h: Removed.
+        * ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h: Removed.
+        * ForwardingHeaders/wtf/unicode/wince/UnicodeWince.h: Removed.
+        * ForwardingHeaders/wtf/url/ParsedURL.h: Removed.
+
+2012-03-07  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] The "legend" element should not be a form-associated element.
+        https://bugs.webkit.org/show_bug.cgi?id=80239
+
+        Reviewed by Kent Tamura.
+
+        This patch changes base class of HTMLLegendElement to HTMLElement from
+        HTMLFormControlElement for saving memory space and iteration time of
+        extra "legend" elements in HTMLFormElement::m_formAssociatedElements
+        and matching the HTML5 specification for ease of maintenance.
+
+        Changes of TextIterator is lead by usage of isFormControlElement. This
+        changes will be replaced with more meaningful predicate as part of
+        https://bugs.webkit.org/show_bug.cgi?id=80381
+
+        No new tests are required. No behavior changes.
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::advance): Check HTMLLegendElement in addition to isFormControlElement. This change is for text dump in LayoutTests implemented by document.innerText attribute.
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::HTMLLegendElement): Remove form parameter.
+        (WebCore::HTMLLegendElement::create): Remove form parameter.
+        (WebCore::HTMLLegendElement::associatedControl): Stop checking legend element, because HTMLLegendElement is no longer HTMLFormControlElement.
+        (WebCore::HTMLLegendElement::supportFocus): Removed. It called HTMLElement::supportFocus.
+        (WebCore::HTMLLegendElement::formControlType): Remove implementation of virtual method declared in HTMLFormControlElement.
+        * html/HTMLLegendElement.h:
+        (HTMLLegendElement): Change base class to HTMLElement.
+        * html/HTMLTagNames.in: Remove "constructorNeedsFormElement" for not passing "form" parameter in HTMLElementFactory.
+
+2012-03-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Make the removal of transitive library dependencies work with CMake < 2.8.7.
+        https://bugs.webkit.org/show_bug.cgi?id=80469
+
+        Reviewed by Antonio Gomes.
+
+        No new tests, this is a buildsystem change.
+
+        * CMakeLists.txt: Manually set the LINK_INTERFACE_LIBRARIES target
+        property on the library being created.
+
+2012-03-06  Lianghui Chen  <liachen@rim.com>
+
+        [BlackBerry] Set correct ResourceRequest target type.
+        https://bugs.webkit.org/show_bug.cgi?id=80430
+
+        Reviewed by Rob Buis.
+
+        For loads started by AppCache, they are based on the manifest file,
+        it is not definitely sure what target it is for, so we just guess
+        based on its mimetype or file extension.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::createResourceHandle):
+        * loader/cache/CachedResource.cpp:
+        (WebCore):
+        (WebCore::CachedResource::load):
+        * platform/network/blackberry/ResourceRequest.h:
+        (ResourceRequest):
+        * platform/network/blackberry/ResourceRequestBlackBerry.cpp:
+        (WebCore):
+        (WebCore::mimeTypeRequestTypeMap):
+        (WebCore::ResourceRequest::targetTypeFromMimeType):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::load):
+        * workers/Worker.cpp:
+        (WebCore::Worker::create):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::createResourceRequest):
+        * workers/WorkerScriptLoader.h:
+        (WorkerScriptLoader):
+
+2012-03-06  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Add clipping to scissor rect to CCOcclusionTracker
+        https://bugs.webkit.org/show_bug.cgi?id=79927
+
+        Reviewed by Adrienne Walker.
+
+        Adds logic to CCOcclusionTracker to occlude anything outside of the
+        current screen and target surface scissor rects. When tracking
+        damage for partial swaps, the scissor rects are bounded by the
+        tracked damage rects.
+
+        Unit tests: CCOcclusionTrackerTest.cpp
+
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::CCOcclusionTrackerBase):
+        (WebCore):
+        (WebCore::::markOccludedBehindLayer):
+        (WebCore::testContentRectOccluded):
+        (WebCore::::occluded):
+        (WebCore::computeUnoccludedContentRect):
+        (WebCore::::unoccludedContentRect):
+        (WebCore::::layerScissorRect):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
+        (WebCore):
+        (CCOcclusionTrackerDamageClientBase):
+        (CCOcclusionTrackerBase):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r110011.
+        http://trac.webkit.org/changeset/110011
+        https://bugs.webkit.org/show_bug.cgi?id=80376
+
+        layout tests crash
+
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore):
+        (WebCore::V8HiddenPropertyName::hiddenReferenceName):
+        * bindings/v8/V8HiddenPropertyName.h:
+        (WebCore):
+        (V8HiddenPropertyName):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r110016.
+        http://trac.webkit.org/changeset/110016
+
+        layout tests crash
+
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, fixed test crashes.
+
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  Hajime Morrita  <morrita@chromium.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79935
+        REGRESSION: <content> element is not HTMLUnknownElement when Shadow DOM API is disabled
+
+        Reviewed by Adam Barth.
+
+        This change introduced "runtimeConditional" keyword to make_name.pl sources,
+        which allows HTMLElementFactory and HTMLElementWrapperFactory to check RuntimeEnabledFeatures
+        and treat any tag name as HTMLUnknownElement if its definition has runtimeConditional and
+        the flag given is turned off.
+
+        Test: fast/dom/shadow/content-shadow-unknown.html
+
+        * WebCore.exp.in:
+        * dom/make_names.pl:
+        (defaultTagPropertyHash):
+        (printConstructorInterior):
+        (printFactoryCppFile):
+        (printWrapperFunctions):
+        (printWrapperFactoryCppFile):
+        * html/HTMLTagNames.in:
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::contentTagName):
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::InternalSettings):
+        (WebCore::InternalSettings::restoreTo):
+        (WebCore::InternalSettings::setShadowDOMEnabled):
+        (WebCore):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-03-06  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Introduce ThreadableWebSocketChannel::SendResult
+        https://bugs.webkit.org/show_bug.cgi?id=80356
+
+        Reviewed by Kent Tamura.
+
+        Introduced ThreadableWebSocketChannel::SendResult type so that
+        WebSocketChannel can pass the validation result.
+
+        No new test. No changes in behavior.
+
+        * Modules/websockets/ThreadableWebSocketChannel.h: Added SendResult.
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::sendRequestResult): Use ThreadableWebSocketChannel::SendResult instead of bool.
+        (WebCore::ThreadableWebSocketChannelClientWrapper::setSendRequestResult): Ditto.
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (ThreadableWebSocketChannelClientWrapper):
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send): Use ThreadableWebSocketChannel::SendResult instead of bool. Pass Cstring to enqueTextFrame instead of String.
+        (WebCore::WebSocketChannel::enqueueTextFrame): Ditto.
+        (WebCore::WebSocketChannel::processOutgoingFrameQueue): Ditto.
+        * Modules/websockets/WebSocketChannel.h:
+        (WebSocketChannel):
+        (QueuedFrame): Changed the type of stringData from String to CString.
+        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::send): Use ThreadableWebSocketChannel::SendResult instead of bool.
+        (WebCore::workerContextDidSend): Ditto.
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::send): Ditto.
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send): Ditto.
+        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
+        (WorkerThreadableWebSocketChannel): ditto.
+        (Bridge): Ditto.
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Performance] Optimize V8 bindings for HTMLElement.classList,
+        Element.dataset and Node.attributes
+        https://bugs.webkit.org/show_bug.cgi?id=80376
+
+        Reviewed by Adam Barth.
+
+        This patch improves the performance of HTMLElement.classList, Element.dataset
+        and Node.attributes by 6.4 times, 7.1 times and 10.9 times, respectively.
+
+        Previously, a 'hiddenReferenceName' string was allocated on v8::Handle and
+        created every time the DOM attribute is accessed, in spite of the fact that
+        the 'hiddenReferenceName' string is static.
+
+        This patch moves the 'hiddenReferenceName' string to v8::Persistent and makes it static.
+        Also, this patch removes 'if (!elementValue.IsEmpty() && elementValue->IsObject())',
+        since if 'element' exists, it is guaranteed that 'elementValue' is not empty
+        and is an Object.
+
+        Performance tests: https://bugs.webkit.org/attachment.cgi?id=130283
+
+        AppleWebKit/JavaScriptCore:
+        div.classList : 382ms
+        div.classList.foo = 123 : 335ms
+        div.dataset : 403ms
+        div.dataset.foo = 123 : 5250ms
+        div.attributes : 183ms
+
+        Chromium/V8 (without this patch):
+        div.classList : 9140ms
+        div.classList.foo = 123 : 9086ms
+        div.dataset : 9930ms
+        div.dataset.foo = 123 : 49698ms
+        div.attributes : 13489ms
+
+        Chromium/V8 (with this patch):
+        div.classList : 1435ms
+        div.classList.foo = 123 : 1470ms
+        div.dataset : 1400ms
+        div.dataset.foo = 123 : 30396ms
+        div.attributes : 1242ms
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp: Modified as described above.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Ditto.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp: Ditto.
+        (WebCore::toV8):
+
+        * bindings/v8/V8HiddenPropertyName.cpp: Defined a hidden property name string statically
+        to optimize the macro.
+        (WebCore):
+        (WebCore::V8HiddenPropertyName::hiddenReferenceName):
+        * bindings/v8/V8HiddenPropertyName.h: Modified to switch two prefixes "WebCore::HiddenProperty::"
+        and "WebCore::HiddenReference::", depending on whether a given name represents a hidden property
+        or a hidden reference.
+        (WebCore):
+        (V8HiddenPropertyName):
+
+2012-03-06  Nat Duca  <nduca@chromium.org>
+
+        [chromium] CCThreadProxy context lost support
+        https://bugs.webkit.org/show_bug.cgi?id=80100
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCScheduler.cpp:
+        (WebCore::CCScheduler::didLoseContext):
+        (WebCore):
+        (WebCore::CCScheduler::didRecreateContext):
+        (WebCore::CCScheduler::processScheduledActions):
+        * platform/graphics/chromium/cc/CCScheduler.h:
+        (CCSchedulerClient):
+        (CCScheduler):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        (WebCore::CCSchedulerStateMachine::CCSchedulerStateMachine):
+        (WebCore::CCSchedulerStateMachine::nextAction):
+        (WebCore::CCSchedulerStateMachine::updateState):
+        (WebCore::CCSchedulerStateMachine::vsyncCallbackNeeded):
+        (WebCore::CCSchedulerStateMachine::didLoseContext):
+        (WebCore):
+        (WebCore::CCSchedulerStateMachine::didRecreateContext):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+        (CCSchedulerStateMachine):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::recreateContext):
+        (WebCore::CCThreadProxy::loseContext):
+        (WebCore::CCThreadProxy::scheduledActionBeginContextRecreation):
+        (WebCore):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwap):
+        (WebCore::CCThreadProxy::setAnimationEvents):
+        (WebCore::CCThreadProxy::beginContextRecreation):
+        (WebCore::CCThreadProxy::recreateContextOnImplThread):
+        (WebCore::CCThreadProxy::loseContextOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-03-06  Tony Chang  <tony@chromium.org>
+
+        refactor method names in RenderFlexibleBox to make them more consistent
+        https://bugs.webkit.org/show_bug.cgi?id=80446
+
+        Reviewed by Ojan Vafai.
+
+        No new tests, just renaming internal methods.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::flowAwareBorderAfter): New, used by layoutAndPlaceChildren
+        (WebCore::RenderFlexibleBox::flowAwarePaddingAfter): New, used by layoutAndPlaceChildren
+        (WebCore::RenderFlexibleBox::marginBoxAscentForChild): Add ForChild for consistency.
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): We were adding the before padding+border twice (it's in the offset and
+        crossAxisBorderAndPaddingExtent() and subtracting it once.  Instead, just add the after padding+border.
+        (WebCore::RenderFlexibleBox::alignChildren):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox): Reorder methods to match the .cpp file.
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r109969.
+        http://trac.webkit.org/changeset/109969
+        https://bugs.webkit.org/show_bug.cgi?id=80376
+
+        layout tests crash
+
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore):
+        (WebCore::V8HiddenPropertyName::hiddenReferenceName):
+        * bindings/v8/V8HiddenPropertyName.h:
+        (WebCore):
+        (V8HiddenPropertyName):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r109999.
+        http://trac.webkit.org/changeset/109999
+
+        layout tests crash
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, fix crashes.
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Fix threaded compositing issues in WebGLLayerChromium (except for printing)
+        https://bugs.webkit.org/show_bug.cgi?id=80459
+
+        Reviewed by Kenneth Russell.
+
+        This fixes a few wrong-thread issues in WebGLLayerChromium for threaded compositing.  The key requirements that
+        threaded compositing imposes on LayerChromium subclasses are that the compositor's context can only be used from
+        the compositor thread, meaning inside of updateCompositorResources() and pushPropertiesTo(), and that
+        non-compositor contexts can only be used from the main thread. This means specifically that we can't use the
+        DrawingBuffer's context in either of these two functions.
+
+        Summary of changes:
+        *) Move the publishToPlatformLayer() call and related logic inside of paintContentsIfDirty(), which is called
+        on the main thread.
+        *) Move lost context tracking outside of drawsContent(), since that function is called from both threads, to a
+        separate bool that is updated after each WebGL composite and setDrawingBuffer call.
+
+        Printing still doesn't work in threaded mode with this patch, I'll address that separately. Printing and lost
+        context recovery still work as they did in the single-threaded path.
+
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::WebGLLayerChromium):
+        (WebCore::WebGLLayerChromium::drawsContent):
+        (WebCore::WebGLLayerChromium::paintContentsIfDirty):
+        (WebCore::WebGLLayerChromium::updateCompositorResources):
+        (WebCore::WebGLLayerChromium::setDrawingBuffer):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        (WebGLLayerChromium):
+
+2012-03-06  Anders Carlsson  <andersca@apple.com>
+
+        Cracks between tiles when zoomed in
+        https://bugs.webkit.org/show_bug.cgi?id=80460
+        <rdar://problem/10996688>
+
+        Use enclosingIntRect instead of enclosedIntRect when converting from FloatRect to IntRect.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (drawLayerContents):
+
+2012-03-06  Anders Carlsson  <andersca@apple.com>
+
+        Tile cache layers should always be clipped to the view's bounds
+        https://bugs.webkit.org/show_bug.cgi?id=80456
+        <rdar://problem/10996174>
+
+        Reviewed by Simon Fraser.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::shouldClipCompositedBounds):
+        Factor this code out into a separate function for better clarity. Always return true if we have a tile cache layer.
+
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        Call shouldClipCompositedBounds directly.
+
+2012-03-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Null-check m_layerRenderer in CCLayerTreeHostImpl::finishAllRendering()
+        https://bugs.webkit.org/show_bug.cgi?id=80445
+
+        Reviewed by Adrienne Walker.
+
+        Null-check CCLayerTreeHostImpl::m_layerRenderer since it won't be set if context initialiation failed for any
+        reason.
+
+        Covered by new unit test in CCLayerTreeHostImplTest.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::finishAllRendering):
+
+2012-03-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Can't select a line of RTL text on Facebook
+        https://bugs.webkit.org/show_bug.cgi?id=59435
+
+        Reviewed by Eric Seidel.
+
+        Deploy prevLeafChildIgnoringLineBreak and nextLeafChildIgnoringLineBreak
+        in RenderedPosition::leftBoundaryOfBidiRun and RenderedPosition::rightBoundaryOfBidiRun.
+
+        Without this patch, WebKit extends selection from right to left when the user selects
+        <span dir="rtl">ABC<br></span> from left to right by a mouse drag.
+
+        Test: editing/selection/select-bidi-run.html
+
+        * editing/RenderedPosition.cpp:
+        (WebCore::RenderedPosition::leftBoundaryOfBidiRun):
+        (WebCore::RenderedPosition::rightBoundaryOfBidiRun):
+
+2012-03-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        undefined reference to JSC::IdentifierTable::~IdentifierTable() on EFL port
+        https://bugs.webkit.org/show_bug.cgi?id=80282
+
+        Reviewed by Antonio Gomes.
+
+        No new tests, this is a buildsystem change.
+
+        Remove transitive library dependencies; they are especially
+        dangerous when one ends up linking against WTF, JSC and then WTF
+        again, since some symbols will not be defined.
+
+        Passing --no-copy-dt-needed-entries and --as-needed to the linker
+        (which some recent Linux distros do by default) makes the issue
+        even more evident.
+
+        * CMakeLists.txt: Explicitly link to WTF as WebCore uses symbols
+        from it.
+        * PlatformEfl.cmake: Explicitly link against libjpeg and libpng.
+
+2012-03-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] REGRESSION(109469): WebGL printing busted
+        https://bugs.webkit.org/show_bug.cgi?id=80450
+
+        Reviewed by Kenneth Russell.
+
+        Avoid marking layers as needing display in setContentsTo...() since this breaks WebGL's damage tracking and is
+        unnecessary.
+
+        Tested WebGL printing manually.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
+        (WebCore::GraphicsLayerChromium::setContentsToMedia):
+
+2012-03-06  Adrienne Walker  <enne@google.com>
+
+        Overlap map for compositing should ignore empty layers
+        https://bugs.webkit.org/show_bug.cgi?id=63499
+
+        Reviewed by Simon Fraser.
+
+        Test: compositing/layer-creation/overlap-empty-layer.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::addToOverlapMap):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2012-03-06  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        [chromium] Increase the accelerated canvas min size to 256 * 256
+        https://bugs.webkit.org/show_bug.cgi?id=80451
+
+        Reviewed by Stephen White.
+
+        Test: Manually
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Performance] Optimize V8 bindings for HTMLElement.classList,
+        Element.dataset and Node.attributes
+        https://bugs.webkit.org/show_bug.cgi?id=80376
+
+        Reviewed by Adam Barth.
+
+        This patch improves the performance of HTMLElement.classList, Element.dataset
+        and Node.attributes by 6.4 times, 7.1 times and 10.9 times, respectively.
+
+        Previously, a 'hiddenReferenceName' string was allocated on v8::Handle and
+        created every time the DOM attribute is accessed, in spite of the fact that
+        the 'hiddenReferenceName' string is static.
+
+        This patch moves the 'hiddenReferenceName' string to v8::Persistent and makes it static.
+        Also, this patch removes 'if (!elementValue.IsEmpty() && elementValue->IsObject())',
+        since if 'element' exists, it is guaranteed that 'elementValue' is not empty
+        and is an Object.
+
+        Performance tests: https://bugs.webkit.org/attachment.cgi?id=130283
+
+        AppleWebKit/JavaScriptCore:
+        div.classList : 382ms
+        div.classList.foo = 123 : 335ms
+        div.dataset : 403ms
+        div.dataset.foo = 123 : 5250ms
+        div.attributes : 183ms
+
+        Chromium/V8 (without this patch):
+        div.classList : 9140ms
+        div.classList.foo = 123 : 9086ms
+        div.dataset : 9930ms
+        div.dataset.foo = 123 : 49698ms
+        div.attributes : 13489ms
+
+        Chromium/V8 (with this patch):
+        div.classList : 1435ms
+        div.classList.foo = 123 : 1470ms
+        div.dataset : 1400ms
+        div.dataset.foo = 123 : 30396ms
+        div.attributes : 1242ms
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp: Modified as described above.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Ditto.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp: Ditto.
+        (WebCore::toV8):
+
+        * bindings/v8/V8HiddenPropertyName.cpp: Defined a hidden property name string statically
+        to optimize the macro.
+        (WebCore):
+        (WebCore::V8HiddenPropertyName::hiddenReferenceName):
+        * bindings/v8/V8HiddenPropertyName.h: Modified to switch two prefixes "WebCore::HiddenProperty::"
+        and "WebCore::HiddenReference::", depending on whether a given name represents a hidden property
+        or a hidden reference.
+        (WebCore):
+        (V8HiddenPropertyName):
+
+2012-03-06  Alexis Menard  <alexis.menard@openbossa.org>
+
+        getComputedStyle returns incorrect values for the width and height of pseudo-elements
+        https://bugs.webkit.org/show_bug.cgi?id=37835
+
+        Reviewed by Tony Chang.
+
+        In case we are querying the computed style of an element with a pseudo-element we can't use
+        the renderer of the element as this one is not the one used to render the pseudo-element. We need
+        to use the one created to render the pseudo-element.
+
+        No new tests : Extend the existing getComputedStyle-with-pseudo-element.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2012-03-06  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Make compositeAndReadback and damage tracking play nicely together
+        https://bugs.webkit.org/show_bug.cgi?id=80199
+
+        Reviewed by James Robinson.
+
+        Requires system-level testing (pixels on front-buffer should be
+        observed for correct behavior) that cannot be done by layout tests
+        or unit tests, have to rely on manual testing.
+
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::compositeAndReadback):
+
+2012-03-06  Luke Macpherson   <macpherson@chromium.org>
+
+        Make CSSStyleSelector::convertToLength() behave more like CSSPrimitiveValue::convertToLength().
+        https://bugs.webkit.org/show_bug.cgi?id=80375
+
+        Reviewed by Eric Seidel.
+
+        No new tests / cleanup only.
+
+        This patch removes the bool* ok parameter from CSSStyleSelector's convertToLength,
+        and instead uses the recently added Length(Undefined) value to indicate failure.
+        This paves the way for a future patch that will call primitiveValue->convertToLength directly.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-06  Raymes Khoury  <raymes@chromium.org>
+
+        Add state variable and ASSERTs to DocumentWriter to help track down
+        https://bugs.webkit.org/show_bug.cgi?id=80427 and prevent illegal usage
+        of DocumentWriter. This also makes endIfNotLoadingMainResource() private
+        as there is no external usage.
+
+        Reviewed by Adam Barth.
+
+        This only adds ASSERT/CRASH and does not change existing behaviour.
+
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::DocumentWriter):
+        (WebCore::DocumentWriter::begin):
+        (WebCore::DocumentWriter::addData):
+        (WebCore::DocumentWriter::endIfNotLoadingMainResource):
+        (WebCore::DocumentWriter::setDocumentWasLoadedAsPartOfNavigation):
+        * loader/DocumentWriter.h:
+        (DocumentWriter):
+
+2012-03-06  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions][CSSOM]Restrict parsing of named flow name
+        https://bugs.webkit.org/show_bug.cgi?id=80359
+
+        Reviewed by Andreas Kling.
+
+        The function that does the parsing for flow thread name should restrict the
+        number of parsed properties to 1, otherwise it would allow parsing of
+        "-webkit-flow-into: flow; color: red;" constructions.
+
+        Modified fast/regions/webkit-named-flow-invalid-name.html to include the above case.
+
+        * css/CSSParser.cpp:
+        (WebCore::validFlowName):
+        (WebCore::CSSParser::parseFlowThread):
+
+2012-03-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed build fix for minimal build after r109939.
+
+        Guard access to page->inspectorController with ENABLE(INSPECTOR).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::performPostLayoutTasks):
+
+2012-03-05  Dean Jackson  <dino@apple.com>
+
+        Enable compositing when a CSS filter is animating
+        https://bugs.webkit.org/show_bug.cgi?id=79048
+
+        Reviewed by Simon Fraser.
+
+        Now that some systems (e.g. OS X) have both hardware accelerated
+        CSS filters, and the ability to animate them via the hardware
+        compositor, all CSS filters should be composited when animating.
+
+        Tests: css3/filters/composited-during-animation-layertree.html
+               css3/filters/composited-during-animation.html
+               css3/filters/composited-during-transition-layertree.html
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore):
+        (WebCore::supportsAcceleratedFilterAnimations):
+            new method that returns true if the platform supports
+            hardware animations of filters.
+        (WebCore::GraphicsLayerCA::addAnimation):
+        (WebCore::GraphicsLayerCA::createAnimationFromKeyframes):
+            only create layer-animations if the platform supports it.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
+            create a compositing layer if animating a filter on a
+            supported platform.
+
+2012-03-06  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r109825.
+        http://trac.webkit.org/changeset/109825
+        https://bugs.webkit.org/show_bug.cgi?id=79413
+
+        Broke webkit_unit_tests on Chromium Win
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::open):
+        * platform/leveldb/LevelDBDatabase.cpp:
+        (WebCore):
+        * platform/leveldb/LevelDBDatabase.h:
+        (LevelDBDatabase):
+
+2012-03-06  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80351
+        InlineTextBox is using the wrong origin when calling 
+        addRelevantRepaintedObject
+        -and corresponding-
+        <rdar://problem/10970221>
+
+        Reviewed by Sam Weinig.
+
+        boxOrigin represents the actual location of the text. The adjustedPaintOffset 
+        (which I was using previously) will only correspond to the first line in a 
+        block of lines.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+
+2012-03-06  Filip Spacek  <fspacek@rim.com>
+
+        [BlackBerry] Disable border radius clips (r95239) for BlackBerry
+        https://bugs.webkit.org/show_bug.cgi?id=80416
+
+        Reviewed by Antonio Gomes
+
+        The BlackBerry port suffers from the same performance
+        degradation when border radius clip is enabled as Chromium.
+
+        * rendering/RenderLayer.cpp:
+
+2012-03-06  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r109832.
+        http://trac.webkit.org/changeset/109832
+        https://bugs.webkit.org/show_bug.cgi?id=80356
+
+        Broke WebSocket tests on Chrome Mac and Linux
+
+        * Modules/websockets/ThreadableWebSocketChannel.h:
+        (ThreadableWebSocketChannel):
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::sendRequestResult):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::setSendRequestResult):
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (ThreadableWebSocketChannelClientWrapper):
+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::send):
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::enqueueTextFrame):
+        (WebCore::WebSocketChannel::processOutgoingFrameQueue):
+        * Modules/websockets/WebSocketChannel.h:
+        (WebSocketChannel):
+        (QueuedFrame):
+        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::send):
+        (WebCore::workerContextDidSend):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::send):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
+        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
+        (WorkerThreadableWebSocketChannel):
+        (Bridge):
+
+2012-03-06  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r109840.
+        http://trac.webkit.org/changeset/109840
+        https://bugs.webkit.org/show_bug.cgi?id=80103
+
+        Broke WebSocket tests on Chrome Mac and Linux
+
+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send):
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        <http://webkit.org/b/78575> Web Inspector: Disable dock button when not allowed to dock
+
+        There are times when an undocked inspector frontend is not allowed to
+        attach to the main window. We can disable the dock button in those cases.
+
+        Reviewed by Pavel Feldman.
+
+        No new tests. This functionality is port specific right now.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::performPostLayoutTasks):
+        When the main frame is resized we let the inspector client know,
+        so that it can react to it as needed.
+
+        * WebCore.exp.in:
+        * inspector/InspectorClient.h:
+        (WebCore::InspectorClient::didResizeMainFrame):
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorClient):
+        Call up to the port though to the InspectorClient.
+
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::frontendLoaded):
+        (WebCore::InspectorFrontendClientLocal::setDockingUnavailable):
+        * inspector/InspectorFrontendClientLocal.h:
+        On ports where the inspector frontend client is local, provide a 
+        setDockingUnavailable InspectorFrontendAPI to update the docking state.
+        Automatically update availability when the frontend completes loading.
+
+        * inspector/front-end/InspectorFrontendAPI.js:
+        (InspectorFrontendAPI.setDockingUnavailable):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createGlobalStatusBarItems):
+        (WebInspector.setAttachedWindow):
+        (WebInspector.setDockingUnavailable):
+        (WebInspector.updateDockToggleButton):
+        Update the dock button's enabled/disabled state when its created,
+        when the attached state changes, when get a frontend API notification
+        that we cannot attach.
+
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        Remove unused canAttachWindow method.
+
+2012-03-06  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: add SpeechRecognitionError
+        https://bugs.webkit.org/show_bug.cgi?id=80410
+
+        Reviewed by Adam Barth.
+
+        Add SpeechRecognitionError.
+
+        Test: fast/speech/scripted/speechrecognitionerror-basics.html
+
+        * Modules/speech/DOMWindowSpeech.idl: Added.
+        * Modules/speech/SpeechRecognitionError.cpp: Added.
+        (WebCore):
+        (WebCore::SpeechRecognitionError::create):
+        (WebCore::SpeechRecognitionError::SpeechRecognitionError):
+        * Modules/speech/SpeechRecognitionError.h: Added.
+        (WebCore):
+        (SpeechRecognitionError):
+        (WebCore::SpeechRecognitionError::code):
+        (WebCore::SpeechRecognitionError::message):
+        * Modules/speech/SpeechRecognitionError.idl: Added.
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2012-03-06  David Corvoysier  <david.corvoysier@orange.com>
+
+        Unreleased gst_object_reference to audio sink in MediaPlayerPrivateGStreamer
+        https://bugs.webkit.org/show_bug.cgi?id=79795
+
+        Bug fix: Used a GRefPtr to hold the reference to the audio sink instead of a GstElement*.
+        Code cleanup: Used the same pattern for webkit web source and removed explicit gst_unref in destructor.
+
+        Reviewed by Philippe Normand.
+
+        No new tests. No change in behavior.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
+
+2012-03-06  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Build fix for !ENABLE(WORKERS) after r109556 and r109833.
+
+        * CMakeLists.txt:
+
+2012-03-06  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt][WK2] Crash in Frame.cpp when loading index.hu
+        https://bugs.webkit.org/show_bug.cgi?id=80165
+
+        Guard against possible null document, which can happen
+        when unsetting a document in a frame.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setDocument):
+
+2012-03-06  Lucas Forschler  <lforschler@apple.com>
+
+        WebCore build exceeds address space on 32-bit Windows builds.
+        https://bugs.webkit.org/show_bug.cgi?id=80346
+
+        Reviewed by Jessie Berlin.
+
+        Patch by Lucas Forschler, landed by Jessie Berlin.
+
+        Add AllInOne.cpp files for a few projects.
+        This will only affect Production and Release builds.
+        Let VS rebuild the project file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * css/MediaAllInOne.cpp: Added.
+        * loader/appcache/ApplicationCacheAllInOne.cpp: Added.
+        * mathml/MathMLAllInOne.cpp: Added.
+        * platform/text/TextAllInOne.cpp: Added.
+
+2012-03-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: add support for inspection of huge (1M elements) arrays.
+        https://bugs.webkit.org/show_bug.cgi?id=80421
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completionsForExpression.evaluated):
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ArrayGroupingTreeElement):
+        (WebInspector.ArrayGroupingTreeElement._populateArray):
+        (WebInspector.ArrayGroupingTreeElement._populateRanges):
+        (WebInspector.ArrayGroupingTreeElement._populateRanges.callback):
+        (WebInspector.ArrayGroupingTreeElement._populateAsFragment):
+        (WebInspector.ArrayGroupingTreeElement._populateAsFragment.processArrayFragment):
+        (WebInspector.ArrayGroupingTreeElement._populateAsFragment.processProperties):
+        (WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties.buildObjectFragment):
+        (WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties.processObjectFragment):
+        (WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties.processProperties):
+        (WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties):
+        (WebInspector.ArrayGroupingTreeElement.prototype.onpopulate):
+        (WebInspector.ArrayGroupingTreeElement.prototype.onattach):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.nodeResolved):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.prototype.callFunction):
+        (WebInspector.RemoteObject.prototype.callFunctionJSON):
+
+2012-03-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Open link in resources panel only works the second time
+        https://bugs.webkit.org/show_bug.cgi?id=80407
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.openResource):
+
+2012-03-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: InspectorCounters mechanism should be thread-safe
+        https://bugs.webkit.org/show_bug.cgi?id=80166
+
+        Make InspectorCounters instance thread local so that it can be safely accessed
+        in workers.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Node::Node):
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        * inspector/InspectorCounters.cpp:
+        (WebCore::InspectorCounters::InspectorCounters):
+        (WebCore::InspectorCounters::counterValue):
+        (WebCore):
+        (WebCore::InspectorCounters::current):
+        * inspector/InspectorCounters.h:
+        (WebCore::InspectorCounters::incrementCounter):
+        (WebCore::InspectorCounters::decrementCounter):
+        (InspectorCounters):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::destroy):
+        * platform/ThreadGlobalData.h:
+        (WebCore):
+        (ThreadGlobalData):
+        (WebCore::ThreadGlobalData::inspectorCounters):
+
+2012-03-06  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream typedef of NativeImageSourcePtr and NativeImagePtr
+        https://bugs.webkit.org/show_bug.cgi?id=80388
+
+        Reviewed by Antonio Gomes.
+
+        These are the BlackBerry typdefs of NativeImageSourcePtr and NativeImagePtr.
+
+        * platform/graphics/ImageSource.h:
+        (WebCore):
+
+2012-03-06  Hans Muller  <hmuller@adobe.com>
+
+        SVG transform-origin presentation attribute
+        https://bugs.webkit.org/show_bug.cgi?id=79678
+
+        Reviewed by Nikolas Zimmermann.
+
+        Added the SVG transform-origin presentation attribute.  Currently WebCore::mapAttributeToCSSProperty()
+        just maps it to -webkit-transform-origin.  When the transform-origin CSS property is supported, this
+        part of the change can be removed.
+
+        Test: svg/transforms/transform-origin-presentation-attribute.xhtml
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::mapAttributeToCSSProperty):
+        (WebCore::SVGStyledElement::cssPropertyIdForSVGAttributeName):
+        * svg/svgattrs.in:
+
+2012-01-26  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] disable GStreamerGWorld when building against 0.11
+        https://bugs.webkit.org/show_bug.cgi?id=77088
+
+        Reviewed by Martin Robinson.
+
+        Don't build GStreamerGWorld and PlatformVideoWindow under
+        GStreamer 0.11. It's supposed to be removed soon anyway.
+
+        * platform/graphics/gstreamer/GStreamerGWorld.cpp:
+        * platform/graphics/gstreamer/GStreamerGWorld.h:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::totalBytes):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
+        * platform/graphics/gstreamer/PlatformVideoWindow.h:
+        * platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp:
+        * platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp:
+        * platform/graphics/gstreamer/PlatformVideoWindowMac.mm:
+        * platform/graphics/gstreamer/PlatformVideoWindowQt.cpp:
+
+2012-03-06  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Rename m_tileCreationTimer in the tiled backing store
+        https://bugs.webkit.org/show_bug.cgi?id=80414
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Tor Arne Vestbø.
+
+        The m_tileCreationTimer member is currently being used to represent a
+        timer that is fired when the backing store has been updated which is
+        confusing with its current name.  This patch fixes this by renaming
+        the m_tileCreationTimer to m_backingStoreUpdateTimer.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::setTileSize):
+        (WebCore::TiledBackingStore::coverWithTilesIfNeeded):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::startBackingStoreUpdateTimer):
+        (WebCore::TiledBackingStore::backingStoreUpdateTimerFired):
+        (WebCore::TiledBackingStore::setContentsFrozen):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-03-06  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Remove TileTimer typedef from the tiled backing store
+        https://bugs.webkit.org/show_bug.cgi?id=80408
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::tileBufferUpdateTimerFired):
+        (WebCore::TiledBackingStore::tileCreationTimerFired):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-03-06  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream LayerRenderer.{h, cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=79874
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/LayerRenderer.cpp: Added.
+        (WebCore):
+        (WebCore::checkGLError):
+        (WebCore::loadShader):
+        (WebCore::loadShaderProgram):
+        (WebCore::orthoMatrix):
+        (WebCore::rawPtrVectorFromRefPtrVector):
+        (WebCore::LayerRenderer::create):
+        (WebCore::LayerRenderer::LayerRenderer):
+        (WebCore::LayerRenderer::~LayerRenderer):
+        (WebCore::LayerRenderer::releaseLayerResources):
+        (WebCore::compareLayerZ):
+        (WebCore::LayerRenderer::drawLayers):
+        (WebCore::LayerRenderer::useSurface):
+        (WebCore::LayerRenderer::drawLayersOnSurfaces):
+        (WebCore::LayerRenderer::setRootLayer):
+        (WebCore::LayerRenderer::addLayer):
+        (WebCore::LayerRenderer::removeLayer):
+        (WebCore::LayerRenderer::addLayerToReleaseTextureResourcesList):
+        (WebCore::LayerRenderer::toOpenGLWindowCoordinates):
+        (WebCore::LayerRenderer::toWebKitWindowCoordinates):
+        (WebCore::LayerRenderer::toWebKitDocumentCoordinates):
+        (WebCore::LayerRenderer::drawDebugBorder):
+        (WebCore::LayerRenderer::drawHolePunchRect):
+        (WebCore::LayerRenderer::updateLayersRecursive):
+        (WebCore::hasRotationalComponent):
+        (WebCore::LayerRenderer::layerAlreadyOnSurface):
+        (WebCore::collect3DPreservingLayers):
+        (WebCore::LayerRenderer::compositeLayersRecursive):
+        (WebCore::LayerRenderer::updateScissorIfNeeded):
+        (WebCore::LayerRenderer::makeContextCurrent):
+        (WebCore::LayerRenderer::bindCommonAttribLocation):
+        (WebCore::LayerRenderer::initializeSharedGLObjects):
+        (WebCore::LayerRenderingResults::holePunchRect):
+        (WebCore::LayerRenderingResults::addHolePunchRect):
+        (WebCore::LayerRenderingResults::addDirtyRect):
+        (WebCore::LayerRenderingResults::isEmpty):
+        * platform/graphics/blackberry/LayerRenderer.h: Added.
+        (WebCore):
+        (LayerRenderingResults):
+        (WebCore::LayerRenderingResults::LayerRenderingResults):
+        (WebCore::LayerRenderingResults::holePunchRectSize):
+        (WebCore::LayerRenderingResults::dirtyRect):
+        (LayerRenderer):
+        (WebCore::LayerRenderer::rootLayer):
+        (WebCore::LayerRenderer::hardwareCompositing):
+        (WebCore::LayerRenderer::setClearSurfaceOnDrawLayers):
+        (WebCore::LayerRenderer::clearSurfaceOnDrawLayers):
+        (WebCore::LayerRenderer::context):
+        (WebCore::LayerRenderer::lastRenderingResults):
+        (WebCore::LayerRenderer::setNeedsCommit):
+
+2012-03-06  Roland Steiner  <rolandsteiner@chromium.org>
+
+        r109563 caused perf regression
+        https://bugs.webkit.org/show_bug.cgi?id=80404
+
+        Add test for Element or ShadowRoot.
+
+        Reviewed by Antti Koivisto.
+
+        No new tests. (fix)
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::pushParentElement):
+
+2012-03-06  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: prepare for extracting ScriptMapping implementation from DebuggerPresentationModel.
+        https://bugs.webkit.org/show_bug.cgi?id=80396
+
+        Limit RawSourceCode usages to a subset of methods. This subset will be moved to ScriptMapping implementation in a separate change.
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.createPlacard):
+        (WebInspector.DebuggerPresentationModel.prototype.createLiveLocation):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.setScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.setScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._forceUpdateSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype._addConsoleMessageToScript):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerPaused):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.PresentationCallFrame):
+        (WebInspector.PresentationCallFrame.prototype.uiLocation):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.canSetContent):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.setContent):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype._uiSourceCodeForResource):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyRawLocation):
+
+2012-03-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Regression] Execution line is not revealed when debugger is stopped if scripts panel was not yet shown.
+        https://bugs.webkit.org/show_bug.cgi?id=80306
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/debugger/reveal-execution-line.html
+
+        * inspector/front-end/ConsoleView.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerPaused):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._executionLineChanged):
+        (WebInspector.ScriptsPanel.prototype._revealExecutionLine):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.willHide):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype._clearLineToReveal):
+        (WebInspector.SourceFrame.prototype.setContent):
+
+2012-03-06  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: remove reference to RawSourceCode from UISourceCode.
+        https://bugs.webkit.org/show_bug.cgi?id=80395
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._handleUISourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._uiSourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.setScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.setScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype._createUISourceCode):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode):
+
+2012-03-06  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: move timeline panel overview mode toggle buttons to overview sidebar tree
+        https://bugs.webkit.org/show_bug.cgi?id=80304
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Images/statusbarButtonGlyphs.png:
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._showTimelines):
+        (WebInspector.TimelineOverviewPane.prototype._showMemoryGraph):
+        (WebInspector.TimelineOverviewPane.prototype._setVerticalOverview):
+        (WebInspector.TimelineOverviewPane.prototype._onOverviewModeChanged):
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
+        (WebInspector.TimelineVerticalOverview):
+        (WebInspector.TimelineOverviewModeSelector):
+        (WebInspector.TimelineOverviewModeSelector.prototype.addButton):
+        (WebInspector.TimelineOverviewModeSelector.prototype.get value):
+        (WebInspector.TimelineOverviewModeSelector.prototype._createButton):
+        (WebInspector.TimelineOverviewModeSelector.prototype._select):
+        (WebInspector.TimelineOverviewModeSelector.prototype._onClick):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._updateEventDividers):
+        (WebInspector.TimelinePanel.prototype._glueParentButtonClicked):
+        (WebInspector.TimelinePanel.prototype.revealRecordAt):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/timelinePanel.css:
+        (.timeline-vertical-overview #timeline-overview-grid):
+        (.timeline-vertical-overview .timeline-overview-window):
+        (.timeline-vertical-overview .timeline-overview-dividers-background):
+        (.timeline-vertical-overview #timeline-overview-memory):
+        (.timeline-vertical-overview-status-bar-item.toggled-on .glyph):
+        (.timeline-vertical-overview-bars):
+        (.timeline-vertical-overview-bars .padding):
+        (.timeline-vertical-overview-bars .timeline-bar-vertical):
+        (.timeline.timeline-vertical-overview .resources-divider):
+        (.sidebar-tree-item .timeline-vertical-overview-status-bar-item):
+        (.timeline-overview-mode-selector):
+        (.timeline-overview-mode-selector .glyph):
+        (.timeline-overview-mode-selector button):
+        (.timeline-overview-mode-selector button.toggled):
+        (.timeline-overview-mode-selector button:active):
+        (.sidebar-tree-item:not(.selected) .timeline-overview-mode-selector button):
+        (.sidebar-tree-item:not(.selected) .timeline-overview-mode-selector button.toggled):
+        (.timeline-overview-mode-selector button:first-of-type):
+        (.timeline-overview-mode-selector button:last-of-type):
+        (.timeline-mode-vertical-bars .glyph):
+        (.timeline-mode-horizontal-bars .glyph):
+
+2012-03-05  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Make it explicit when we are allowing updates to the actual backing store or the tile buffers
+        https://bugs.webkit.org/show_bug.cgi?id=80288
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::isBackingStoreUpdatesSuspended):
+        (WebCore):
+        (WebCore::TiledBackingStore::isTileBufferUpdatesSuspended):
+        (WebCore::TiledBackingStore::startTileBufferUpdateTimer):
+        (WebCore::TiledBackingStore::startTileCreationTimer):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-03-06  Mark Rowe  <mrowe@apple.com>
+
+        Build fix after r109877.
+
+        * WebCore.xcodeproj/project.pbxproj: Ensure that headers are copied in to WebCore.framework so that
+        WebKit can still find them.
+
+2012-03-06  Andreas Kling  <awesomekling@apple.com>
+
+        Remove incorrect WTF::Vector traits for CSSProperty.
+        <http://webkit.org/b/53285>
+        <rdar://problem/10161286>
+
+        Reviewed by Antti Koivisto.
+
+        We shouldn't allow copying Vector<CSSProperty> contents around with memcpy()
+        as CSSProperty has a RefPtr member and this would muck up the refcount.
+        This was added to facilitate fast comparison of property vectors, and we no
+        longer use that, so there shouldn't be any performance concerns here.
+
+        * css/CSSProperty.h:
+
+2012-03-06  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Qt minimal build.
+
+        * Target.pri:
+
+2012-03-06  Roland Steiner  <rolandsteiner@chromium.org>
+
+        :scope should behave as :root outside scoped style sheet
+        https://bugs.webkit.org/show_bug.cgi?id=80389
+
+        Fall through to :root implementation if no scope is used.
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/css/style-scoped/scope-pseudo.html
+
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector):
+
+2012-03-05  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Regression] Message bubbles are not removed from scripts panel source frames after console was cleared.
+        https://bugs.webkit.org/show_bug.cgi?id=80275
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._consoleMessagesCleared):
+        * inspector/front-end/utilities.js:
+
+2012-03-06  Adam Barth  <abarth@webkit.org>
+
+        Move SQLDatabase code into Modules/webdatabase
+        https://bugs.webkit.org/show_bug.cgi?id=80393
+
+        Reviewed by Kentaro Hara.
+
+        There are still a couple (minor) SQLDatabase references from WebCore
+        proper, but we've gotten this code to the point where it makes sense to
+        move it into the Modules directory.  (This patch just moves code---no
+        behavior change.)
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Modules/webdatabase: Added.
+        * Modules/webdatabase/AbstractDatabase.cpp: Copied from Source/WebCore/storage/AbstractDatabase.cpp.
+        * Modules/webdatabase/AbstractDatabase.h: Copied from Source/WebCore/storage/AbstractDatabase.h.
+        * Modules/webdatabase/ChangeVersionWrapper.cpp: Copied from Source/WebCore/storage/ChangeVersionWrapper.cpp.
+        * Modules/webdatabase/ChangeVersionWrapper.h: Copied from Source/WebCore/storage/ChangeVersionWrapper.h.
+        * Modules/webdatabase/DOMWindowSQLDatabase.cpp: Copied from Source/WebCore/storage/DOMWindowSQLDatabase.cpp.
+        * Modules/webdatabase/DOMWindowSQLDatabase.h: Copied from Source/WebCore/storage/DOMWindowSQLDatabase.h.
+        * Modules/webdatabase/DOMWindowSQLDatabase.idl: Copied from Source/WebCore/storage/DOMWindowSQLDatabase.idl.
+        * Modules/webdatabase/Database.cpp: Copied from Source/WebCore/storage/Database.cpp.
+        * Modules/webdatabase/Database.h: Copied from Source/WebCore/storage/Database.h.
+        * Modules/webdatabase/Database.idl: Copied from Source/WebCore/storage/Database.idl.
+        * Modules/webdatabase/DatabaseAuthorizer.cpp: Copied from Source/WebCore/storage/DatabaseAuthorizer.cpp.
+        * Modules/webdatabase/DatabaseAuthorizer.h: Copied from Source/WebCore/storage/DatabaseAuthorizer.h.
+        * Modules/webdatabase/DatabaseCallback.h: Copied from Source/WebCore/storage/DatabaseCallback.h.
+        * Modules/webdatabase/DatabaseCallback.idl: Copied from Source/WebCore/storage/DatabaseCallback.idl.
+        * Modules/webdatabase/DatabaseContext.cpp: Copied from Source/WebCore/storage/DatabaseContext.cpp.
+        * Modules/webdatabase/DatabaseContext.h: Copied from Source/WebCore/storage/DatabaseContext.h.
+        * Modules/webdatabase/DatabaseDetails.h: Copied from Source/WebCore/storage/DatabaseDetails.h.
+        * Modules/webdatabase/DatabaseSync.cpp: Copied from Source/WebCore/storage/DatabaseSync.cpp.
+        * Modules/webdatabase/DatabaseSync.h: Copied from Source/WebCore/storage/DatabaseSync.h.
+        * Modules/webdatabase/DatabaseSync.idl: Copied from Source/WebCore/storage/DatabaseSync.idl.
+        * Modules/webdatabase/DatabaseTask.cpp: Copied from Source/WebCore/storage/DatabaseTask.cpp.
+        * Modules/webdatabase/DatabaseTask.h: Copied from Source/WebCore/storage/DatabaseTask.h.
+        * Modules/webdatabase/DatabaseThread.cpp: Copied from Source/WebCore/storage/DatabaseThread.cpp.
+        * Modules/webdatabase/DatabaseThread.h: Copied from Source/WebCore/storage/DatabaseThread.h.
+        * Modules/webdatabase/DatabaseTracker.cpp: Copied from Source/WebCore/storage/DatabaseTracker.cpp.
+        * Modules/webdatabase/DatabaseTracker.h: Copied from Source/WebCore/storage/DatabaseTracker.h.
+        * Modules/webdatabase/DatabaseTrackerClient.h: Copied from Source/WebCore/storage/DatabaseTrackerClient.h.
+        * Modules/webdatabase/OriginQuotaManager.cpp: Copied from Source/WebCore/storage/OriginQuotaManager.cpp.
+        * Modules/webdatabase/OriginQuotaManager.h: Copied from Source/WebCore/storage/OriginQuotaManager.h.
+        * Modules/webdatabase/OriginUsageRecord.cpp: Copied from Source/WebCore/storage/OriginUsageRecord.cpp.
+        * Modules/webdatabase/OriginUsageRecord.h: Copied from Source/WebCore/storage/OriginUsageRecord.h.
+        * Modules/webdatabase/SQLCallbackWrapper.h: Copied from Source/WebCore/storage/SQLCallbackWrapper.h.
+        * Modules/webdatabase/SQLError.h: Copied from Source/WebCore/storage/SQLError.h.
+        * Modules/webdatabase/SQLError.idl: Copied from Source/WebCore/storage/SQLError.idl.
+        * Modules/webdatabase/SQLException.cpp: Copied from Source/WebCore/storage/SQLException.cpp.
+        * Modules/webdatabase/SQLException.h: Copied from Source/WebCore/storage/SQLException.h.
+        * Modules/webdatabase/SQLException.idl: Copied from Source/WebCore/storage/SQLException.idl.
+        * Modules/webdatabase/SQLResultSet.cpp: Copied from Source/WebCore/storage/SQLResultSet.cpp.
+        * Modules/webdatabase/SQLResultSet.h: Copied from Source/WebCore/storage/SQLResultSet.h.
+        * Modules/webdatabase/SQLResultSet.idl: Copied from Source/WebCore/storage/SQLResultSet.idl.
+        * Modules/webdatabase/SQLResultSetRowList.cpp: Copied from Source/WebCore/storage/SQLResultSetRowList.cpp.
+        * Modules/webdatabase/SQLResultSetRowList.h: Copied from Source/WebCore/storage/SQLResultSetRowList.h.
+        * Modules/webdatabase/SQLResultSetRowList.idl: Copied from Source/WebCore/storage/SQLResultSetRowList.idl.
+        * Modules/webdatabase/SQLStatement.cpp: Copied from Source/WebCore/storage/SQLStatement.cpp.
+        * Modules/webdatabase/SQLStatement.h: Copied from Source/WebCore/storage/SQLStatement.h.
+        * Modules/webdatabase/SQLStatementCallback.h: Copied from Source/WebCore/storage/SQLStatementCallback.h.
+        * Modules/webdatabase/SQLStatementCallback.idl: Copied from Source/WebCore/storage/SQLStatementCallback.idl.
+        * Modules/webdatabase/SQLStatementErrorCallback.h: Copied from Source/WebCore/storage/SQLStatementErrorCallback.h.
+        * Modules/webdatabase/SQLStatementErrorCallback.idl: Copied from Source/WebCore/storage/SQLStatementErrorCallback.idl.
+        * Modules/webdatabase/SQLStatementSync.cpp: Copied from Source/WebCore/storage/SQLStatementSync.cpp.
+        * Modules/webdatabase/SQLStatementSync.h: Copied from Source/WebCore/storage/SQLStatementSync.h.
+        * Modules/webdatabase/SQLTransaction.cpp: Copied from Source/WebCore/storage/SQLTransaction.cpp.
+        * Modules/webdatabase/SQLTransaction.h: Copied from Source/WebCore/storage/SQLTransaction.h.
+        * Modules/webdatabase/SQLTransaction.idl: Copied from Source/WebCore/storage/SQLTransaction.idl.
+        * Modules/webdatabase/SQLTransactionCallback.h: Copied from Source/WebCore/storage/SQLTransactionCallback.h.
+        * Modules/webdatabase/SQLTransactionCallback.idl: Copied from Source/WebCore/storage/SQLTransactionCallback.idl.
+        * Modules/webdatabase/SQLTransactionClient.cpp: Copied from Source/WebCore/storage/SQLTransactionClient.cpp.
+        * Modules/webdatabase/SQLTransactionClient.h: Copied from Source/WebCore/storage/SQLTransactionClient.h.
+        * Modules/webdatabase/SQLTransactionCoordinator.cpp: Copied from Source/WebCore/storage/SQLTransactionCoordinator.cpp.
+        * Modules/webdatabase/SQLTransactionCoordinator.h: Copied from Source/WebCore/storage/SQLTransactionCoordinator.h.
+        * Modules/webdatabase/SQLTransactionErrorCallback.h: Copied from Source/WebCore/storage/SQLTransactionErrorCallback.h.
+        * Modules/webdatabase/SQLTransactionErrorCallback.idl: Copied from Source/WebCore/storage/SQLTransactionErrorCallback.idl.
+        * Modules/webdatabase/SQLTransactionSync.cpp: Copied from Source/WebCore/storage/SQLTransactionSync.cpp.
+        * Modules/webdatabase/SQLTransactionSync.h: Copied from Source/WebCore/storage/SQLTransactionSync.h.
+        * Modules/webdatabase/SQLTransactionSync.idl: Copied from Source/WebCore/storage/SQLTransactionSync.idl.
+        * Modules/webdatabase/SQLTransactionSyncCallback.h: Copied from Source/WebCore/storage/SQLTransactionSyncCallback.h.
+        * Modules/webdatabase/SQLTransactionSyncCallback.idl: Copied from Source/WebCore/storage/SQLTransactionSyncCallback.idl.
+        * Modules/webdatabase/WorkerContextSQLDatabase.cpp: Copied from Source/WebCore/storage/WorkerContextSQLDatabase.cpp.
+        * Modules/webdatabase/WorkerContextSQLDatabase.h: Copied from Source/WebCore/storage/WorkerContextSQLDatabase.h.
+        * Modules/webdatabase/WorkerContextSQLDatabase.idl: Copied from Source/WebCore/storage/WorkerContextSQLDatabase.idl.
+        * Modules/webdatabase/chromium: Added.
+        * Modules/webdatabase/chromium/DatabaseObserver.h: Copied from Source/WebCore/storage/chromium/DatabaseObserver.h.
+        * Modules/webdatabase/chromium/DatabaseTrackerChromium.cpp: Copied from Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp.
+        * Modules/webdatabase/chromium/QuotaTracker.cpp: Copied from Source/WebCore/storage/chromium/QuotaTracker.cpp.
+        * Modules/webdatabase/chromium/QuotaTracker.h: Copied from Source/WebCore/storage/chromium/QuotaTracker.h.
+        * Modules/webdatabase/chromium/SQLTransactionClientChromium.cpp: Copied from Source/WebCore/storage/chromium/SQLTransactionClientChromium.cpp.
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/AbstractDatabase.cpp: Removed.
+        * storage/AbstractDatabase.h: Removed.
+        * storage/ChangeVersionWrapper.cpp: Removed.
+        * storage/ChangeVersionWrapper.h: Removed.
+        * storage/DOMWindowSQLDatabase.cpp: Removed.
+        * storage/DOMWindowSQLDatabase.h: Removed.
+        * storage/DOMWindowSQLDatabase.idl: Removed.
+        * storage/Database.cpp: Removed.
+        * storage/Database.h: Removed.
+        * storage/Database.idl: Removed.
+        * storage/DatabaseAuthorizer.cpp: Removed.
+        * storage/DatabaseAuthorizer.h: Removed.
+        * storage/DatabaseCallback.h: Removed.
+        * storage/DatabaseCallback.idl: Removed.
+        * storage/DatabaseContext.cpp: Removed.
+        * storage/DatabaseContext.h: Removed.
+        * storage/DatabaseDetails.h: Removed.
+        * storage/DatabaseSync.cpp: Removed.
+        * storage/DatabaseSync.h: Removed.
+        * storage/DatabaseSync.idl: Removed.
+        * storage/DatabaseTask.cpp: Removed.
+        * storage/DatabaseTask.h: Removed.
+        * storage/DatabaseThread.cpp: Removed.
+        * storage/DatabaseThread.h: Removed.
+        * storage/DatabaseTracker.cpp: Removed.
+        * storage/DatabaseTracker.h: Removed.
+        * storage/DatabaseTrackerClient.h: Removed.
+        * storage/OriginQuotaManager.cpp: Removed.
+        * storage/OriginQuotaManager.h: Removed.
+        * storage/OriginUsageRecord.cpp: Removed.
+        * storage/OriginUsageRecord.h: Removed.
+        * storage/SQLCallbackWrapper.h: Removed.
+        * storage/SQLError.h: Removed.
+        * storage/SQLError.idl: Removed.
+        * storage/SQLException.cpp: Removed.
+        * storage/SQLException.h: Removed.
+        * storage/SQLException.idl: Removed.
+        * storage/SQLResultSet.cpp: Removed.
+        * storage/SQLResultSet.h: Removed.
+        * storage/SQLResultSet.idl: Removed.
+        * storage/SQLResultSetRowList.cpp: Removed.
+        * storage/SQLResultSetRowList.h: Removed.
+        * storage/SQLResultSetRowList.idl: Removed.
+        * storage/SQLStatement.cpp: Removed.
+        * storage/SQLStatement.h: Removed.
+        * storage/SQLStatementCallback.h: Removed.
+        * storage/SQLStatementCallback.idl: Removed.
+        * storage/SQLStatementErrorCallback.h: Removed.
+        * storage/SQLStatementErrorCallback.idl: Removed.
+        * storage/SQLStatementSync.cpp: Removed.
+        * storage/SQLStatementSync.h: Removed.
+        * storage/SQLTransaction.cpp: Removed.
+        * storage/SQLTransaction.h: Removed.
+        * storage/SQLTransaction.idl: Removed.
+        * storage/SQLTransactionCallback.h: Removed.
+        * storage/SQLTransactionCallback.idl: Removed.
+        * storage/SQLTransactionClient.cpp: Removed.
+        * storage/SQLTransactionClient.h: Removed.
+        * storage/SQLTransactionCoordinator.cpp: Removed.
+        * storage/SQLTransactionCoordinator.h: Removed.
+        * storage/SQLTransactionErrorCallback.h: Removed.
+        * storage/SQLTransactionErrorCallback.idl: Removed.
+        * storage/SQLTransactionSync.cpp: Removed.
+        * storage/SQLTransactionSync.h: Removed.
+        * storage/SQLTransactionSync.idl: Removed.
+        * storage/SQLTransactionSyncCallback.h: Removed.
+        * storage/SQLTransactionSyncCallback.idl: Removed.
+        * storage/WorkerContextSQLDatabase.cpp: Removed.
+        * storage/WorkerContextSQLDatabase.h: Removed.
+        * storage/WorkerContextSQLDatabase.idl: Removed.
+        * storage/chromium/DatabaseObserver.h: Removed.
+        * storage/chromium/DatabaseTrackerChromium.cpp: Removed.
+        * storage/chromium/QuotaTracker.cpp: Removed.
+        * storage/chromium/QuotaTracker.h: Removed.
+        * storage/chromium/SQLTransactionClientChromium.cpp: Removed.
+
+2012-03-05  Kent Tamura  <tkent@chromium.org>
+
+        Do not reformat strings in <input type=number> on platforms using LocalizedNumberICU.
+        https://bugs.webkit.org/show_bug.cgi?id=78326
+
+        Reviewed by Hajime Morita.
+
+        We had bugs such as stripping leading zeros, dropping lower digits
+        of large numbers because we parse a user-input string to a double
+        value, and generate a string from the double value.
+
+        In order to avoid such reformatting, we converts number strings by
+        replacing standard digits to corresponding localized digits.
+
+        * WebCore.gypi: Added LocalizedNumberICU.h
+        * platform/text/LocalizedNumberICU.cpp:
+        (WebCore::ICULocale::ICULocale): Added.
+        (WebCore::ICULocale::create): A testing factory function.
+        (WebCore::ICULocale::createForCurrentLocale): A practical factory function.
+        (WebCore::ICULocale::setDecimalSymbol): Initialize a symbol table.
+        (WebCore::ICULocale::initializeDecimalFormat): Initialize ICU DecimalFormat.
+        (WebCore::ICULocale::convertToLocalizedNumber):
+         Replace characters to corresponding localized characters.
+        (WebCore::matches): A helper function for convertFromLocalizedNumber.
+        (WebCore::endsWith): ditto.
+        (WebCore::ICULocale::determineStartPosition): ditto.
+        (WebCore::ICULocale::matchedDecimalSymbolIndex): ditto.
+        (WebCore::ICULocale::convertFromLocalizedNumber):
+         Replace characters to corresponding standard characters.
+        (WebCore::currentLocale): Added.
+        (WebCore::convertToLocalizedNumber): Uses ICULocale::convertToLocalizedNumber.
+        (WebCore::convertFromLocalizedNumber): Uses ICULocale::convertFromLocalizedNumber.
+        * platform/text/LocalizedNumberICU.h: Added.
+        (ICULocale): Added. This is exposed to WebKit/chromium/tests/LocalizedNumberICUTest.cpp.
+
+2012-03-06  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the GTK minimal build
+        https://bugs.webkit.org/show_bug.cgi?id=80390
+
+        Reviewed by Csaba Osztrogonác.
+
+        Add some missing ifdefs.
+
+        * Modules/geolocation/NavigatorGeolocation.cpp:
+        * Modules/geolocation/NavigatorGeolocation.h:
+
+2012-03-05  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: stop using RawSourceCode in BreakpointManager.
+        https://bugs.webkit.org/show_bug.cgi?id=80286
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.uiSourceCodeAdded):
+        (WebInspector.BreakpointManager.prototype.setBreakpoint):
+        (WebInspector.BreakpointManager.prototype._materializeBreakpoint):
+        (WebInspector.BreakpointManager.prototype._breakpointDebuggerLocationChanged):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        * inspector/front-end/ScriptMapping.js: Added.
+        (WebInspector.ScriptMapping):
+        (WebInspector.ScriptMapping.prototype.rawLocationToUILocation):
+        (WebInspector.ScriptMapping.prototype.uiLocationToRawLocation):
+        (WebInspector.ScriptMapping.prototype.createLiveLocation):
+        (WebInspector.ScriptMapping.prototype.uiSourceCodeList):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-03-05  Philippe Normand  <pnormand@igalia.com>
+
+        WebAudio JSC-related fixes
+        https://bugs.webkit.org/show_bug.cgi?id=80299
+
+        Reviewed by Adam Barth.
+
+        * bindings/js/JSAudioContextCustom.cpp:
+        (WebCore::JSAudioContextConstructor::constructJSAudioContext):
+        Wrap the audio context in a DOM wrapper.
+        * webaudio/AudioContext.idl: No need to protect EventTarget by V8
+        guards, I think.
+        * webaudio/JavaScriptAudioNode.idl: Ditto.
+
+2012-03-05  Kishore Bolisetty  <kbolisetty@innominds.com>
+
+        Element not fully repainted after application and removal of transform
+        https://bugs.webkit.org/show_bug.cgi?id=61338
+
+        Reviewed by Simon Fraser.
+        RenderLayer is created and removed when a transform is applied and removed to element.
+        To render the element properly after removal of transform on it, preferred widths and dimensions of
+        the element and its containing block needs to be recalculated.
+
+        Test: fast/repaint/transform-rotate-and-remove.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore):
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        * rendering/RenderBoxModelObject.h:
+        (RenderBoxModelObject):
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        putByIndex should throw in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=80335
+
+        Reviewed by Filip Pizlo.
+
+        Make the MethodTable PutByIndex trap take a boolean 'shouldThrow' parameter.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::putProperty):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_SetProperty):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::setSlot):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::putByIndex):
+        * bridge/runtime_array.h:
+        (RuntimeArray):
+
+2012-03-05  Shinya Kawanaka  <shinyak@chromium.org>
+
+        InsertionPoint::attach should be consistent with Element.
+        https://bugs.webkit.org/show_bug.cgi?id=80373
+
+        Reviewed by Hajime Morita.
+
+        This patch is preparation for coming <shadow> patches.
+
+        InsertionPoint used to attach fallback elements before attaching distributed elements.
+        To be consistent with Element::attach behavior, attaching distributed elements first is
+        natural, because Element attaches a shadow tree first.
+
+        Also, this patch extracts a few methods form InsretionPoint::attach() and detach()
+        to keep code clean. They will become messy without this refactoring when adding
+        <shadow> patch.
+
+        No new tests. Should be covered by existing tests.
+
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::attach):
+        (WebCore::InsertionPoint::detach):
+        (WebCore::InsertionPoint::distributeHostChildren):
+        (WebCore):
+        (WebCore::InsertionPoint::clearDistribution):
+        (WebCore::InsertionPoint::attachDistributedNode):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+
+2012-03-05  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix a number of GTK tests.
+
+        * GNUmakefile.list.am:
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed rollout of r109858 for restructuring.
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        <http://webkit.org/b/78575> Web Inspector: Hide dock button when not allowed to dock
+
+        There are times when an undocked inspector frontend is not allowed to
+        attach to the main window. We can remove the dock button in those cases.
+
+        Reviewed by Timothy Hatcher.
+
+        No new tests. This functionality is port specific right now.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::performPostLayoutTasks):
+        When the main frame is resized we let the inspector frontend client
+        update its docked availablility.
+
+        * WebCore.exp.in:
+        * inspector/InspectorInstrumentation.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didResizeMainFrameImpl):
+        (WebCore::InspectorInstrumentation::didResizeMainFrame):
+        * inspector/InspectorClient.h:
+        (WebCore::InspectorClient::updateDockingAvailability):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::resume):
+        (WebCore::InspectorController::updateDockingAvailability):
+        When the main frame is resized call up to the InspectorClient to let
+        it update docking availability of the inspector frontend.
+
+        * inspector/InspectorFrontendClient.h:
+        * inspector/InspectorFrontendClientLocal.h:
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::frontendLoaded):
+        (WebCore::InspectorFrontendClientLocal::setDockingUnavailable):
+        On ports where the inspector frontend client is local, provide a 
+        setDockingUnavailable InspectorFrontendAPI to update the docking state.
+        Automatically update availablity when the frontend completes loading.
+
+        * inspector/front-end/InspectorFrontendAPI.js:
+        (InspectorFrontendAPI.setDockingUnavailable):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createGlobalStatusBarItems):
+        (WebInspector.setAttachedWindow):
+        (WebInspector.setDockingUnavailable):
+        (WebInspector.updateDockToggleButtonVisibility):
+        Update the dock button's visibility when its created, when the attached
+        state changes, when get a frontend API notification that we cannot attach.
+
+2012-03-05  Adrienne Walker  <enne@google.com>
+
+        Compositing overlap testing can throw layers into compositing when they should not be.
+        https://bugs.webkit.org/show_bug.cgi?id=50192
+
+        Reviewed by Simon Fraser.
+
+        The previous overlap map behavior was that a non-composited query
+        layer would become composited due to overlap if and only if the query
+        layer's absolute bounds overlapped the absolute bounds of some other
+        layer which:
+            - draws before the query layer
+            - is or has a compositing ancestor
+
+        This behavior, while correct, was too permissive in throwing layers
+        into compositing, causing many layers to get their own backing when
+        they could have just gone into their compositing ancestor's backing.
+
+        The correct logic is that non-composited query layer needs to be
+        composited due to overlap if and only if the query layer's absolute
+        bounds overlap the absolute bounds of some other layer which:
+            - draws before the query layer
+            - has a different compositing ancestor than the query layer
+            - is or has a compositing ancestor that is a descendent of the
+              query layer's compositing ancestor
+
+        This patch changes the semantics of the overlap map to enable this
+        behavior.
+
+        Rather than having one global overlap map, there is now a stack of
+        overlap maps. New (empty) overlap maps are pushed onto the stack
+        whenever a layer becomes a compositing ancestor and popped after all
+        of the compositing requirements for that layer's children have been
+        computed.
+
+        The compositing ancestor and all of its non-composited children of a
+        compositing ancestor do not get considered for overlap until their
+        composited ancestor has been popped off the stack. If a compositing
+        ancestor has a compositing subtree, then any descendents of that
+        compositing ancestor that draw after that subtree will consider
+        everything in the compositing subtree for overlap.
+
+        Test: compositing/layer-creation/stacking-context-overlap.html
+
+        * platform/graphics/Region.cpp:
+        (WebCore::Region::intersects):
+        (WebCore):
+        * platform/graphics/Region.h:
+        (Region):
+        * rendering/RenderLayerCompositor.cpp:
+        (RenderLayerCompositor::OverlapMap):
+        (WebCore::RenderLayerCompositor::OverlapMap::OverlapMap):
+        (WebCore::RenderLayerCompositor::OverlapMap::add):
+        (WebCore::RenderLayerCompositor::OverlapMap::contains):
+        (WebCore::RenderLayerCompositor::OverlapMap::overlapsLayers):
+        (WebCore::RenderLayerCompositor::OverlapMap::isEmpty):
+        (WebCore::RenderLayerCompositor::OverlapMap::popCompositingContainer):
+        (WebCore::RenderLayerCompositor::OverlapMap::pushCompositingContainer):
+        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        * rendering/RenderLayerCompositor.h:
+        (RenderLayerCompositor):
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Address review comments from https://bugs.webkit.org/show_bug.cgi?id=80368
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setNeedsDisplayInRect):
+
+2012-03-05  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] HTMLFieldSetForms.idl doesn't have type attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=80109
+
+        Reviewed by Hajime Morita.
+
+        Test: fast/forms/fieldset/fieldset-type.html
+
+        * html/HTMLFieldSetElement.idl: Add attribute "type"
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setScale):
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        pinch-to-zoom and double-tap flicker when using the new scrolling model
+        https://bugs.webkit.org/show_bug.cgi?id=80368
+        <rdar://problem/10866221>
+
+        Reviewed by Sam Weinig.
+
+        In order to work better with zooming, make the tile cache undo the scale transformation
+        and handle the scaling manually. This avoids creating huge tile backing stores when zoomed in.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::TileCache):
+        Initialize m_scale to 1.
+
+        (WebCore::TileCache::setNeedsDisplayInRect):
+        Scale the given rect appropriately.
+
+        (WebCore::TileCache::drawLayer):
+        Apply a scale context transform.
+
+        (WebCore::TileCache::setScale):
+        No longer set the contents scale. Instead, update the scale and revalidate the tiles.
+
+        (WebCore::TileCache::revalidateTiles):
+        Return early if the bounds are empty. This avoids showing a single tile if that happens due to a race condition.
+
+        (WebCore::TileCache::getTileIndexRangeForRect):
+        Apply the scale to the bounds.
+
+        (WebCore::TileCache::createTileLayer):
+        Don't set the contents scale.
+
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer setContentsScale:]):
+        Call TileCache::setScale.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        Make sure to give the tile cache layer sane composited bounds, even if the page has absolutely positioned
+        elements that are outside of the page.
+
+2012-03-05  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        GraphicsContext3D.h should include RefCounted.h explicitly
+        https://bugs.webkit.org/show_bug.cgi?id=80251
+
+        Reviewed by Rob Buis.
+
+        GraphicsContext3D.h was using RefCounted but including RefCounted.h indirectly
+        through GraphicsLayer.h through Animation.h. However Animation.h is included
+        by GraphicsLayer.h only when ACCELERATED_COMPOSITING is on. For some configurations
+        that don't use ACCELERATED_COMPOSITING but use GraphicsContext3D, like the
+        BlackBerry x86 configuration, the indirect inclusion will fail.
+
+        This patch is adding explicit inclusion of RefCounted.h to avoid that kind of
+        problem.
+
+        * platform/graphics/GraphicsContext3D.h:
+
+2012-03-05  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Should raise SYNTAX_ERR when message contains unpaired surrogates
+        https://bugs.webkit.org/show_bug.cgi?id=80103
+
+        Reviewed by Kent Tamura.
+
+        Add UTF8 validation checks for WebSocket message and close reason.
+
+        Tests: http/tests/websocket/tests/hybi/unpaired-surrogates-in-close-reason.html
+               http/tests/websocket/tests/hybi/unpaired-surrogates-in-message.html
+
+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::send): Raise SYNTAX_ERR if the message is invalid.
+        (WebCore::WebSocket::close):Raise SYNTAX_ERR if the reason is invalid.
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send): Check whether message is a valid UTF8 string.
+
+2012-03-05  Kenneth Russell  <kbr@google.com>
+
+        [chromium] Notify CCLayerImpl tree of context loss and restoration
+        https://bugs.webkit.org/show_bug.cgi?id=80339
+
+        Reviewed by James Robinson.
+
+        Tested by manually killing GPU process while playing Flash video.
+        Video continues to play after compositor restores its context.
+
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::didLoseAndRecreateGraphicsContext):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::sendContextLostAndRestoredNotification):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::sendContextLostAndRestoredNotificationRecursive):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.cpp:
+        (WebCore::CCPluginLayerImpl::didLoseAndRecreateGraphicsContext):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.h:
+        (CCPluginLayerImpl):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::recreateContext):
+
+2012-03-05  Changhun Kang  <temoochin@company100.net>
+
+        Change the argument orders to match OpenGL's in GraphicsContext3D functions
+        https://bugs.webkit.org/show_bug.cgi?id=80120
+
+        Reviewed by Kenneth Russell.
+
+        No new tests because this patch just change the order of arguments.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawDebugBorderQuad):
+        (WebCore::LayerRendererChromium::drawTileQuad):
+        (WebCore::LayerRendererChromium::drawYUV):
+        (WebCore::LayerRendererChromium::drawStreamTexture):
+        (WebCore::LayerRendererChromium::drawTexturedQuad):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::drawSurface):
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::bindProgramAndBuffers):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+
+2012-03-05  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] HTMLFieldSetForms.idl doesn't have name attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=80108
+
+        Reviewed by Hajime Morita.
+
+        Test: fast/forms/fieldset/fieldset-name.html
+
+        * html/HTMLFieldSetElement.idl: Add "name" attribute.
+
+2012-03-05  Levi Weintraub  <leviw@chromium.org>
+
+        Update usage of LayoutUnits in RenderBox
+        https://bugs.webkit.org/show_bug.cgi?id=80039
+
+        Reviewed by Julien Chaffraix.
+
+        Updating the usage of integers versus LayoutUnits in RenderBox to mirror the
+        subpixellayout branch. This reverts absoluteRects, intrinsicSize, and focusRingRects
+        methods to use integers, and flipForWritingMode functions to LayoutUnits.
+
+        No new tests. No change in behavior.
+
+        * platform/graphics/FractionalLayoutRect.h:
+        (WebCore::FractionalLayoutRect::pixelSnappedX): Convenience methods that only calculate
+        the needed values. This requires less computation than pixelSnappedIntRect(r).x().
+        (WebCore::FractionalLayoutRect::pixelSnappedY): Ditto.
+        (WebCore::FractionalLayoutRect::pixelSnappedWidth): Ditto.
+        (WebCore::FractionalLayoutRect::pixelSnappedHeight): Ditto.
+        (WebCore::FractionalLayoutRect::pixelSnappedMaxX): Ditto.
+        (WebCore::FractionalLayoutRect::pixelSnappedMaxY): Ditto.
+        (FractionalLayoutRect):
+        * platform/graphics/IntRect.h:
+        (IntRect):
+        (WebCore::IntRect::pixelSnappedX): Stub methods to allow us to use IntRects like we do
+        FractionalLayoutRects.
+        (WebCore::IntRect::pixelSnappedY): Ditto.
+        (WebCore::IntRect::pixelSnappedMaxX): Ditto.
+        (WebCore::IntRect::pixelSnappedMaxY): Ditto.
+        (WebCore::IntRect::pixelSnappedWidth): Ditto.
+        (WebCore::IntRect::pixelSnappedHeight): Ditto.
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRect): Convenience method for building a pixelSnappedIntRect from
+        a LayoutPoint and LayoutSize without constructing an intermediate LayoutRect.
+        (WebCore):
+        (WebCore::snapSizeToPixel): Stub method for snapping a LayoutUnit representing a size to
+        its pixel value using its location.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::pixelSnappedClientWidth): Changing to actually call snapSizeToPixel.
+        (WebCore::RenderBox::pixelSnappedClientHeight): Ditto.
+        (WebCore::RenderBox::absoluteRects): Switching to return IntRects that represent the actual
+        rendered location on screen.
+        (WebCore::RenderBox::addFocusRingRects): Ditto.
+        (WebCore::RenderBox::paintFillLayer): One-liner switching an IntSize() to LayoutSize() to
+        avoid unnecessary conversion.
+        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats): Preparing for the conversion by
+        replacing 0 with zeroLayoutUnit.
+        (WebCore::RenderBox::positionLineBox): Preparing for conversion by replacing lroundf
+        with roundedLayoutUnit.
+        (WebCore::RenderBox::flipForWritingMode): Switching to use LayoutUnits.
+        * rendering/RenderBox.h:
+        (RenderBox):
+        (WebCore::RenderBox::pixelSnappedBorderBoxRect): Convenience method.
+        (WebCore::RenderBox::borderBoundingBox): Converting to a pixelSnappedIntRect.
+        (WebCore::RenderBox::intrinsicSize): Intrinsic sizes should always be integers.
+
+2012-03-05  Adam Barth  <abarth@webkit.org>
+
+        WorkerContext shouldn't need to know about SQLDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=80352
+
+        Reviewed by Eric Seidel.
+
+        This patch removes the SQLDatabase functions from WorkerContext in
+        preparation for moving the SQLDatabase code into a module.  These
+        functions don't interact with the rest of WorkerContext.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/DOMWindowSQLDatabase.cpp:
+        * storage/WorkerContextSQLDatabase.cpp: Added.
+        (WebCore):
+        (WebCore::WorkerContextSQLDatabase::openDatabase):
+        (WebCore::WorkerContextSQLDatabase::openDatabaseSync):
+        * storage/WorkerContextSQLDatabase.h: Added.
+        (WebCore):
+        (WorkerContextSQLDatabase):
+        (WebCore::WorkerContextSQLDatabase::WorkerContextSQLDatabase):
+        (WebCore::WorkerContextSQLDatabase::~WorkerContextSQLDatabase):
+        * storage/WorkerContextSQLDatabase.idl: Added.
+        * workers/WorkerContext.cpp:
+        (WebCore):
+        * workers/WorkerContext.h:
+        (WebCore):
+        (WorkerContext):
+        * workers/WorkerContext.idl:
+
+2012-03-05  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Introduce ThreadableWebSocketChannel::SendResult
+        https://bugs.webkit.org/show_bug.cgi?id=80356
+
+        Reviewed by Kent Tamura.
+
+        Introduced ThreadableWebSocketChannel::SendResult type so that
+        WebSocketChannel can pass the validation result.
+
+        No new test. No changes in behavior.
+
+        * Modules/websockets/ThreadableWebSocketChannel.h: Added SendResult.
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::sendRequestResult): Use ThreadableWebSocketChannel::SendResult instead of bool.
+        (WebCore::ThreadableWebSocketChannelClientWrapper::setSendRequestResult): Ditto.
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (ThreadableWebSocketChannelClientWrapper):
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send): Use ThreadableWebSocketChannel::SendResult instead of bool. Pass Cstring to enqueTextFrame instead of String.
+        (WebCore::WebSocketChannel::enqueueTextFrame): Ditto.
+        (WebCore::WebSocketChannel::processOutgoingFrameQueue): Ditto.
+        * Modules/websockets/WebSocketChannel.h:
+        (WebSocketChannel):
+        (QueuedFrame): Changed the type of stringData from String to CString.
+        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::send): Use ThreadableWebSocketChannel::SendResult instead of bool.
+        (WebCore::workerContextDidSend): Ditto.
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::send): Ditto.
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send): Ditto.
+        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
+        (WorkerThreadableWebSocketChannel): ditto.
+        (Bridge): Ditto.
+
+2012-03-05  Kentaro Hara  <haraken@chromium.org>
+
+        [JSC] Cache the CSSPropertyID in JSCSSStyleDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=80250
+
+        Reviewed by Benjamin Poulain.
+
+        V8CSSStyleDeclaration caches the calculated CSSPropertyID.
+        Similarly, we can implement the cache in JSCSSStyleDeclaration.
+
+        In my local Mac environment, this optimization improves the performance
+        of CSS property getters by 35%, and the performance of CSS property setters
+        by 8%.
+
+        CSS property getter: for (var i = 0; i < 1000000; i++) span.style.fontWeight;
+        CSS property setter: for (var i = 0; i < 1000000; i++) span.style.fontWeight = "bold";
+
+        Tests: fast/dom/CSSStyleDeclaration/* (No change in test results)
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (CSSPropertyInfo):
+        (WebCore):
+        (WebCore::cssPropertyIDForJSCSSPropertyName):
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        (WebCore::JSCSSStyleDeclaration::putDelegate):
+
+2012-03-05  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Handle LevelDB database corruption
+        https://bugs.webkit.org/show_bug.cgi?id=79413
+
+        Add LevelDBDatabase::destroy() method so that clients can retry if open() fails.
+
+        Reviewed by Tony Chang.
+
+        Test: webkit_unit_tests --gtest_filter='LevelDBDatabaseTest.CorruptionTest'
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp: Implement open/destroy/open strategy.
+        (WebCore::IDBLevelDBBackingStore::open):
+        * platform/leveldb/LevelDBDatabase.cpp:
+        (WebCore::LevelDBDatabase::destroy):
+        (WebCore):
+        * platform/leveldb/LevelDBDatabase.h:
+        (LevelDBDatabase):
+
+2012-03-05  Stephen Chenney  <schenney@chromium.org>
+
+        [Chromium] SVG Composite of Offset crashes
+        https://bugs.webkit.org/show_bug.cgi?id=77245
+
+        Reviewed by Stephen White.
+
+        The feComposite arithmetic mode filter could readily be made to
+        generate invalid pre-multiplied pixel values which would then go on to
+        pollute other filters and cause invalid final output pixels. This
+        patch checks for filters that require valid inputs, and checks that a
+        result is valid, and corrects the result if necessary. This matches
+        the behavior of FF and Opera while preventing crashes or other
+        undesirable behavior.
+
+        Test: svg/filters/feComposite-arithmetic-invalid-rgba.svg
+
+        * platform/graphics/filters/FEComposite.h: Override the default validity checks and image cleanup methods.
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::correctFilterResultIfNeeded): Force valid pixels if this is an arithmetic filter
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::apply): Check for validity status and correct
+        (WebCore::FilterEffect::forceValidPremultipliedPixels): Make an image valid
+        (WebCore):
+        * platform/graphics/filters/FilterEffect.h: New virtual methods for image validity.
+        (FilterEffect):
+        (WebCore::FilterEffect::requiresValidPreMulultipliedPixels):
+        (WebCore::FilterEffect::forceValidPremultipliedPixels):
+        (WebCore::FilterEffect::correctFilterResultIfNeeded):
+        * rendering/svg/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::postApplyResource): Check that the final filter result is valid
+
+2012-03-05  Alexis Menard  <alexis.menard@openbossa.org>
+
+        getComputedStyle gives incorrect information for 'height' property
+        https://bugs.webkit.org/show_bug.cgi?id=33593
+
+        Reviewed by David Hyatt.
+
+        Make sure that the contentBoxRect doesn't take into account the
+        intrinsic padding when querying it. As stated by http://www.w3.org/TR/css3-box/#the-lsquo0
+        the height is the content area which doesn't include the intrinsic padding, the border, and
+        the padding.
+
+        Test: fast/css/getComputedStyle/getComputedStyle-height.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::contentBoxRect):
+        (WebCore::RenderBox::contentWidth):
+        (WebCore::RenderBox::contentHeight):
+        (WebCore::RenderBox::contentLogicalWidth):
+        (WebCore::RenderBox::contentLogicalHeight):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paddingTop):
+        (WebCore::RenderBoxModelObject::paddingBottom):
+        (WebCore::RenderBoxModelObject::paddingLeft):
+        (WebCore::RenderBoxModelObject::paddingRight):
+        (WebCore::RenderBoxModelObject::paddingBefore):
+        (WebCore::RenderBoxModelObject::paddingAfter):
+        (WebCore::RenderBoxModelObject::paddingStart):
+        (WebCore::RenderBoxModelObject::paddingEnd):
+        * rendering/RenderBoxModelObject.h:
+        (RenderBoxModelObject):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paddingTop):
+        (WebCore::RenderTableCell::paddingBottom):
+        (WebCore::RenderTableCell::paddingLeft):
+        (WebCore::RenderTableCell::paddingRight):
+        (WebCore::RenderTableCell::paddingBefore):
+        (WebCore::RenderTableCell::paddingAfter):
+        (WebCore::RenderTableCell::cellBaselinePosition):
+        * rendering/RenderTableCell.h:
+        (RenderTableCell):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::firstLineBoxBaseline):
+
+2012-03-05  MORITA Hajime  <morrita@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80257
+        Lifecycle of InternalSettings should be simplified.
+
+        Reviewed by Ryosuke Niwa.
+
+        - Moved settings update code to separate restoreTo() method.
+        - Eliminated flags which indidate the changed field.
+          Now these modifiable parameters are backed up at the initialization.
+
+        No new tests. Refactoring.
+
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::create):
+        (WebCore::InternalSettings::InternalSettings):
+        (WebCore):
+        (WebCore::InternalSettings::restoreTo):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/Internals.cpp:
+        (WebCore::Internals::reset):
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Be more aggressive about repainting page overlays
+        https://bugs.webkit.org/show_bug.cgi?id=80336
+        <rdar://problem/10965943>
+
+        Reviewed by Simon Fraser.
+
+        Add a way to find out if a given GraphicsLayer is going to be repainted.
+
+        * WebCore.exp.in:
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::needsDisplay):
+        (GraphicsLayer):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+
+2012-03-05  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream LayerRendererSurface.{cpp, h}
+        https://bugs.webkit.org/show_bug.cgi?id=80122
+
+        Reviewed by Rob Buis.
+
+        Initial upstream, no new tests.
+
+        * PlatformBlackBerry.cmake:
+        * platform/graphics/blackberry/LayerRendererSurface.cpp: Added.
+        (WebCore):
+        (WebCore::LayerRendererSurface::LayerRendererSurface):
+        (WebCore::LayerRendererSurface::~LayerRendererSurface):
+        (WebCore::LayerRendererSurface::setContentRect):
+        (WebCore::LayerRendererSurface::drawRect):
+        (WebCore::LayerRendererSurface::ensureTexture):
+        (WebCore::LayerRendererSurface::releaseTexture):
+        * platform/graphics/blackberry/LayerRendererSurface.h: Added.
+        (WebCore):
+        (LayerRendererSurface):
+        (WebCore::LayerRendererSurface::size):
+        (WebCore::LayerRendererSurface::contentRect):
+        (WebCore::LayerRendererSurface::clipRect):
+        (WebCore::LayerRendererSurface::setClipRect):
+        (WebCore::LayerRendererSurface::setDrawTransform):
+        (WebCore::LayerRendererSurface::drawTransform):
+        (WebCore::LayerRendererSurface::setReplicaDrawTransform):
+        (WebCore::LayerRendererSurface::replicaDrawTransform):
+        (WebCore::LayerRendererSurface::texture):
+        (WebCore::LayerRendererSurface::drawOpacity):
+        (WebCore::LayerRendererSurface::setDrawOpacity):
+
+2012-03-05  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions][CSSOM]Prevent creation of NamedFlow object for invalid flow name
+        https://bugs.webkit.org/show_bug.cgi?id=79685
+
+        Reviewed by David Hyatt.
+
+        Asking for a named flow with an invalid flow name should return a null object.
+
+        Test: fast/regions/webkit-named-flow-invalid-name.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFlowThread):
+        (WebCore):
+        * css/CSSParser.h:
+        * dom/Document.cpp:
+        (WebCore::validFlowName):
+        (WebCore):
+        (WebCore::Document::webkitGetFlowByName):
+
+2012-03-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+        unicode-bidi should support isolate override and override isolate
+        https://bugs.webkit.org/show_bug.cgi?id=73164
+
+        Reviewed by Eric Seidel.
+
+        Updated CSS parser and CSS style selector to support the union of bidi-override and isolate in
+        unicode-bidi property. Added OverrideIsolate to EUnicodeBidi instead of turning Override and Isolate
+        into bit flags to avoid increasing the number of bits required to store the unicodeBidi flag.
+
+        Also fixed a bug in RenderBlock::constructTextRun to actually check whether an isolated run's direction
+        is overridden or not when constructing one.
+
+        Tests: fast/css/unicode-bidi-computed-value.html
+               fast/text/bidi-override-isolate.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::renderUnicodeBidiFlagsToCSSValue): Added; Create a CSSValueList when unicode-bidi has both
+        isolate and bidi-override specified.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):  Calls renderUnicodeBidiFlagsToCSSValue.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Support parsing combinations of -webkit-isolate and bidi-override;
+        Create a CSSValueList in such cases.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore):
+        * css/CSSStyleApplyProperty.cpp:
+        (ApplyPropertyUnicodeBidi):
+        (WebCore::ApplyPropertyUnicodeBidi::applyValue): Support combinations of -webkit-isolate and
+        bidi-override. Set the unicodeBidi flag to OverrideIsolate in such cases.
+        (WebCore::ApplyPropertyUnicodeBidi::createHandler):
+        (WebCore):
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * platform/text/UnicodeBidi.h: Added OverrideIsolate. We don't use bit flags to avoid increasing the
+        number of bits required to store flags especially because isolate and bidi-override are only values
+        that can be combined.
+        (WebCore::isIsolated):
+        (WebCore):
+        (WebCore::isOverride):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::constructTextRun):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::statusWithDirection): Takes isOverride; we used to assume it's always false.
+        (WebCore::constructBidiRuns): Instantiate isolatedResolver with a proper value of isOverride.
+        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):
+        (WebCore::RenderBlock::determineStartPosition):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemStyle):
+        (WebCore::RenderMenuList::menuStyle):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::menuStyle):
+        * rendering/svg/SVGTextMetrics.cpp:
+        (WebCore::SVGTextMetrics::constructTextRun):
+
+2012-03-05  Emil A Eklund  <eae@chromium.org>
+
+        Replace uses of x(), y() and width(), height() pairs with locationOffset and size()
+        https://bugs.webkit.org/show_bug.cgi?id=80196
+
+        Reviewed by Julien Chaffraix.
+
+        Replace IntSize(x(), y()) with locationOffset()
+        Replace IntSize(width(), height()) with size()
+        Replace IntRect(0, 0, width(), height()) with IntRect(IntPoint(), size())
+        Replace IntRect::move(x(), y()) with IntRect::move(locationOffset())
+
+        No new tests.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        (WebCore::HTMLCanvasElement::baseTransform):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::simplifiedLayout):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::borderBoxRect):
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::localSelectionRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::localSelectionRect):
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::updateScrollbarParts):
+        (WebCore::RenderScrollbar::buttonRect):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::setCellLogicalWidths):
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::viewRect):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Always update the scroll layer position on the main thread when we have an overlay
+        https://bugs.webkit.org/show_bug.cgi?id=80324
+
+        Reviewed by Sam Weinig.
+
+        Add a way to ensure that scroll layer position updates happen on the main thread.
+
+        * WebCore.exp.in:
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::ScrollingCoordinator):
+        (WebCore::ScrollingCoordinator::updateShouldUpdateScrollLayerPositionOnMainThread):
+        (WebCore):
+        (WebCore::ScrollingCoordinator::setForceMainThreadScrollLayerPositionUpdates):
+        * page/scrolling/ScrollingCoordinator.h:
+        (ScrollingCoordinator):
+
+2012-03-05  Tony Chang  <tony@chromium.org>
+
+        Implement flex-wrap: wrap
+        https://bugs.webkit.org/show_bug.cgi?id=79930
+
+        Reviewed by David Hyatt.
+
+        Tests: css3/flexbox/multiline-align.html
+               css3/flexbox/multiline.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::sizesToIntrinsicLogicalWidth): Don't apply column+stretch optimization to multiline.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::FlexOrderIterator::FlexOrderIterator):
+        (WebCore::RenderFlexibleBox::FlexOrderIterator::currentChild): Expose the current child so we can pause
+        in the middle of iteration and resume later.
+        (RenderFlexibleBox::FlexOrderIterator):
+        (WebCore::RenderFlexibleBox::isMultiline):
+        (WebCore):
+        (WebCore::RenderFlexibleBox::layoutFlexItems): Loop per line.
+        (WebCore::RenderFlexibleBox::availableAlignmentSpaceForChild): Use the line space, not the whole container space.
+        (WebCore::RenderFlexibleBox::computeFlexOrder): Return true for each line.
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): Use the line offset. Also compute the line height as we go.
+        (WebCore::RenderFlexibleBox::layoutColumnReverse): Use the line offset.
+        (WebCore::RenderFlexibleBox::alignChildren): Align based on the line height. For multiline + column, we have to relayout
+        since the width may change (same as the row case above). We'll have to do something smarter when we implement flex-line-pack.
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-03-05  Ben Vanik  <benvanik@google.com>
+
+        Implement WebGL extension EXT_texture_filter_anisotropic
+        https://bugs.webkit.org/show_bug.cgi?id=79541
+
+        This exports the EXT_texture_filter_anisotropic extension with the WEBKIT_ prefix as defined at
+        https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/extensions/proposals/EXT_texture_filter_anisotropic/index.html
+
+        Reviewed by Kenneth Russell.
+
+        Tested with the Khronos conformance test for the extension, available at https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/conformance/extensions/ext-texture-filter-anisotropic.html
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8Object):
+        * html/canvas/EXTTextureFilterAnisotropic.cpp: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
+        (WebCore):
+        (WebCore::EXTTextureFilterAnisotropic::EXTTextureFilterAnisotropic):
+        (WebCore::EXTTextureFilterAnisotropic::~EXTTextureFilterAnisotropic):
+        (WebCore::EXTTextureFilterAnisotropic::getName):
+        (WebCore::EXTTextureFilterAnisotropic::create):
+        * html/canvas/EXTTextureFilterAnisotropic.h: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
+        (WebCore):
+        (EXTTextureFilterAnisotropic):
+        * html/canvas/EXTTextureFilterAnisotropic.idl: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
+        * html/canvas/WebGLExtension.h:
+        * html/canvas/WebGLObject.cpp:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::getExtension):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getSupportedExtensions):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::texParameter):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore):
+        (WebGLRenderingContext):
+        * platform/graphics/Extensions3D.h:
+        (Extensions3D):
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
+        (WebCore::Extensions3DOpenGL::supports):
+
+2012-03-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r109760.
+        http://trac.webkit.org/changeset/109760
+        https://bugs.webkit.org/show_bug.cgi?id=80320
+
+        Caused many GTK+ tests to crash (Requested by mrobinson on
+        #webkit).
+
+        * platform/network/ResourceHandleClient.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore):
+        (WebCore::WebCoreSynchronousLoader::~WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::run):
+        (WebCore::closeCallback):
+        (WebCore::readCallback):
+        (WebCore::ResourceHandle::defaultSession):
+
+2012-03-05  Adam Klein  <adamk@chromium.org>
+
+        Never dispatch mutation events in shadow DOM
+        https://bugs.webkit.org/show_bug.cgi?id=79278
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: fast/dom/shadow/suppress-mutation-events-in-shadow.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren): Move allowEventDispatch() call later,
+        now that childrenChanged won't trigger mutation events in shadow dom.
+        (WebCore::dispatchChildInsertionEvents): Bail out if in shadow tree.
+        (WebCore::dispatchChildRemovalEvents): ditto.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchSubtreeModifiedEvent): ditto.
+
+2012-03-05  Alexey Proskuryakov  <ap@apple.com>
+
+        BlobResourceHandle should keep a reference to itself when calling client code.
+        https://bugs.webkit.org/show_bug.cgi?id=80318
+
+        Reviewed by Brady Eidson.
+
+        * platform/network/BlobResourceHandle.cpp:
+        (WebCore::BlobResourceHandle::doStart):
+        (WebCore::BlobResourceHandle::getSizeForNext):
+        (WebCore::BlobResourceHandle::readSync):
+        (WebCore::BlobResourceHandle::readDataAsync):
+        (WebCore::BlobResourceHandle::consumeData):
+        (WebCore::BlobResourceHandle::failed):
+        Added RefPtrs in functions that can result in calling client code, and use "this" object afterwards.
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Let RenderLayerCompositor set the tile cache visible rect
+        https://bugs.webkit.org/show_bug.cgi?id=80317
+
+        Reviewed by Simon Fraser.
+
+        We can't compute the visible rect from CALayers, because that breaks when we're updating
+        the scroll layer position on the main thread (since by the time visibleRectChanged() is called,
+        the CALayers won't yet have been updated).
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::visibleRectChanged):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::visibleRectChanged):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (GraphicsLayerCA):
+        * platform/graphics/ca/PlatformCALayer.h:
+        (PlatformCALayer):
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (PlatformCALayer::visibleRectChanged):
+        * platform/graphics/ca/mac/TileCache.h:
+        (TileCache):
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::visibleRectChanged):
+        (WebCore::TileCache::revalidateTiles):
+        * platform/graphics/ca/mac/WebTileCacheLayer.h:
+        (WebCore):
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer visibleRectChanged:]):
+        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+        (PlatformCALayer::visibleRectChanged):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::frameViewDidScroll):
+
+2012-03-05  Kangil Han  <kangil.han@samsung.com>
+
+        [CMake][DRT] Add WebCoreTestSupport.
+        https://bugs.webkit.org/show_bug.cgi?id=79896
+
+        Reviewed by Daniel Bates.
+
+        Add WebCoreTestSupport library for DRT in CMake.
+        We will use internals object by linking this library on DRT.
+
+        * CMakeLists.txt:
+        * UseJSC.cmake:
+        * UseV8.cmake:
+
+2012-03-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r109656.
+        http://trac.webkit.org/changeset/109656
+        https://bugs.webkit.org/show_bug.cgi?id=80316
+
+        This seems to have regressed Parser/html5-full-render by about
+        10% (Requested by anttik on #webkit).
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::getPositionOffsetValue):
+        (WebCore::getBorderRadiusCornerValues):
+        (WebCore::getBorderRadiusCornerValue):
+        (WebCore::getBorderRadiusShorthandValue):
+        (WebCore::lineHeightFromStyle):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+        (WebCore::CSSParser::createPrimitiveNumericValue):
+        (WebCore::unitFromString):
+        (WebCore::CSSParser::parseValidPrimitive):
+        (WebCore::CSSParser::detectNumberToken):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::isValidCSSUnitTypeForDoubleConversion):
+        (WebCore::unitCategory):
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::canonicalUnitTypeForCategory):
+        (WebCore::CSSPrimitiveValue::customCssText):
+        * css/CSSPrimitiveValue.h:
+        (CSSPrimitiveValue):
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyLength::applyValue):
+        (WebCore::ApplyPropertyBorderRadius::applyValue):
+        (WebCore::ApplyPropertyFontSize::applyValue):
+        (WebCore::ApplyPropertyLineHeight::applyValue):
+        (WebCore::ApplyPropertyVerticalAlign::applyValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * dom/Document.cpp:
+        (WebCore::Document::pageSizeAndMarginsInPixels):
+        (WebCore):
+        * dom/Document.h:
+        (Document):
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::getRegion):
+        * platform/Length.h:
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::calcFloatValue):
+        (WebCore::Length::blend):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lineHeight):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::reflectionOffset):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::clipRect):
+        (WebCore::RenderBox::computeLogicalWidthInRegion):
+        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
+        (WebCore::RenderBox::computeInlineDirectionMargins):
+        (WebCore::RenderBox::computeLogicalHeightUsing):
+        (WebCore::RenderBox::computePercentageLogicalHeight):
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
+        (WebCore::RenderBox::computeBlockDirectionMargins):
+        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
+        (WebCore::RenderBox::computePositionedLogicalHeightUsing):
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY):
+        (WebCore::RenderBoxModelObject::paddingTop):
+        (WebCore::RenderBoxModelObject::paddingBottom):
+        (WebCore::RenderBoxModelObject::paddingLeft):
+        (WebCore::RenderBoxModelObject::paddingRight):
+        (WebCore::RenderBoxModelObject::paddingBefore):
+        (WebCore::RenderBoxModelObject::paddingAfter):
+        (WebCore::RenderBoxModelObject::paddingStart):
+        (WebCore::RenderBoxModelObject::paddingEnd):
+        (WebCore::RenderBoxModelObject::getBackgroundRoundedRect):
+        (WebCore::RenderBoxModelObject::calculateFillTileSize):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        (WebCore::computeBorderImageSide):
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        (WebCore::RenderBoxModelObject::paintBorder):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild):
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
+        (WebCore::RenderFlexibleBox::runFreeSpaceAllocationAlgorithm):
+        * rendering/RenderInline.cpp:
+        (WebCore::computeMargin):
+        (WebCore::RenderInline::lineHeight):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::calcScrollbarThicknessUsing):
+        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
+        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::computeLogicalWidth):
+        (WebCore::RenderTable::convertStyleLogicalWidthToComputedWidth):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::logicalHeightForRowSizing):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::marginLeft):
+        (WebCore::RenderText::marginRight):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::verticalPositionForBox):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::calcRadiiFor):
+        (WebCore::RenderStyle::getRoundedBorderFor):
+        * rendering/style/RenderStyle.h:
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::resolveLengthAttributeForSVG):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight):
+
+2012-03-05  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Add missing method to PasteboardBlackBerry.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80326
+
+        Reviewed by Antonio Gomes.
+
+        Add missing method.
+
+        * platform/blackberry/PasteboardBlackBerry.cpp:
+        (WebCore::Pasteboard::writeClipboard):
+        (WebCore):
+
+2012-03-05  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] UTF chars printed back from cookie through php shows as ???
+        https://bugs.webkit.org/show_bug.cgi?id=80307
+
+        Reviewed by Antonio Gomes.
+
+        PR: 130055
+
+        we need to check the cookies encoding first and encode the cookie header data
+        to pass to the request.
+
+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob):
+
+2012-03-05  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Remove old cleanupResources() code
+        https://bugs.webkit.org/show_bug.cgi?id=80290
+
+        Reviewed by Adrienne Walker.
+
+        cleanupResources() is only called by destructors, and adds no
+        value, any more, beyond the destructors themselves, but complicates
+        the code path.
+
+        Covered by existing tests.
+
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.cpp:
+        (WebCore::CCPluginLayerImpl::~CCPluginLayerImpl):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.h:
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::~CCRenderSurface):
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (CCRenderSurface):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+
+2012-03-05  Sami Kyostila  <skyostil@chromium.org>
+
+        Partially loaded JPEGs should have alpha channel
+        https://bugs.webkit.org/show_bug.cgi?id=78239
+
+        Reviewed by Kenneth Russell.
+
+        While a JPEG image is loading, the area outside the decoded region
+        should be fully transparent. Since currently all JPEG frames are marked
+        as opaque, a renderer respecting this flag will draw the partially
+        loaded image with garbage outside the valid image region.
+
+        Hence, a partially loaded JPEG image should be marked as having an alpha
+        channel while decoding is in progress. For performance reasons we mark
+        the image opaque after decoding has finished.
+
+        Graphics corruption caused by this bug was recently observed on
+        Chromium (http://code.google.com/p/chromium/issues/detail?id=113171). A
+        recent Skia change (r3036) changed SkBitmap::extractSubset() to produce
+        a bitmap with the same opaqueness flag as the parent. This meant that
+        the renderer was now seeing an opaque image from the JPEG decoder, and
+        drawing it appropriately resulted in garbage outside the decoded region.
+
+        Test: http/tests/incremental/partial-jpeg.html
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        (WebCore::JPEGImageDecoder::jpegComplete):
+
+2012-03-05  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Initialize CCOverdrawCounts struct to zero
+        https://bugs.webkit.org/show_bug.cgi?id=80204
+
+        Reviewed by Adrienne Walker.
+
+        CCOverdrawCounts is stack allocated but not explicitly initialized, so the values are garbage. This adds a c'tor
+        to zero out the fields, which is the desired behavior.  Bug was initially caught by valgrind, see
+        http://crbug.com/116475
+
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (WebCore::CCOverdrawCounts::CCOverdrawCounts):
+
+2012-03-05  Min Qin  <qinmin@google.com>
+
+        Add media control css for chromium on android
+        https://bugs.webkit.org/show_bug.cgi?id=79550
+
+        Reviewed by Adam Barth.
+
+        This should not change the any test results as it does not affect the any current bots. New test expectations will be added if we have a android bot on webkit.
+
+        * WebCore.gyp/WebCore.gyp:
+        * css/mediaControlsChromiumAndroid.css: Added.
+        (body:-webkit-full-page-media):
+        (audio):
+        (audio:-webkit-full-page-media, video:-webkit-full-page-media):
+        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
+        (video:-webkit-full-page-media::-webkit-media-controls-panel):
+        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
+        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
+        (audio::-webkit-media-controls-timeline-container):
+        (video::-webkit-media-controls-timeline-container):
+        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
+        (audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline):
+        (video::-webkit-media-controls-fullscreen-button):
+        (audio::-webkit-media-controls-fullscreen-button):
+        (audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container):
+        (audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaFullscreenButton):
+        (WebCore):
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):
+        * rendering/RenderThemeChromiumAndroid.cpp:
+        (WebCore::RenderThemeChromiumAndroid::extraMediaControlsStyleSheet):
+        (WebCore):
+        (WebCore::RenderThemeChromiumAndroid::paintMediaFullscreenButton):
+        * rendering/RenderThemeChromiumAndroid.h:
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Fix crash in ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition
+        https://bugs.webkit.org/show_bug.cgi?id=80303
+        <rdar://problem/10953682>
+
+        Reviewed by Beth Dakin.
+
+        Add the same null checks that already exist in updateMainFrameScrollPosition.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+
+2012-03-05  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: CSS inactive property check should account for vendor prefixes
+        https://bugs.webkit.org/show_bug.cgi?id=80225
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/styles/vendor-prefixes.html
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::populateObjectWithStyleProperties):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.alteredHexNumber):
+        (WebInspector.StylesSidebarPane.canonicalPropertyName):
+        (WebInspector.StylesSidebarPane.prototype._markUsedProperties):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
+
+2012-03-05  Adam Barth  <abarth@webkit.org>
+
+        Geolocation should use a ScriptExecutionContext as its context object
+        https://bugs.webkit.org/show_bug.cgi?id=80248
+
+        Reviewed by Kentaro Hara.
+
+        This patch updates Geolocation to use some more modern WebCore
+        mechanisms.  Previously, Geolocation used a Frame as a context object,
+        which required a bunch of manual integration with the PageCache as well
+        as custom signaling for Geolocation::reset().  After this patch,
+        Geolocation subclasses ActiveDOMObject, which does all this work
+        automatically.
+
+        * Modules/geolocation/Geolocation.cpp:
+        (WebCore::Geolocation::create):
+        (WebCore):
+        (WebCore::Geolocation::Geolocation):
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::document):
+        (WebCore::Geolocation::frame):
+        (WebCore::Geolocation::page):
+        (WebCore::Geolocation::stop):
+        (WebCore::Geolocation::getCurrentPosition):
+        (WebCore::Geolocation::watchPosition):
+        (WebCore::Geolocation::requestPermission):
+        (WebCore::Geolocation::clearWatch):
+        (WebCore::Geolocation::setIsAllowed):
+        * Modules/geolocation/Geolocation.h:
+        (WebCore):
+        (Geolocation):
+        * Modules/geolocation/NavigatorGeolocation.cpp:
+        (WebCore):
+        (WebCore::NavigatorGeolocation::geolocation):
+        * Modules/geolocation/NavigatorGeolocation.h:
+        (NavigatorGeolocation):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (Document):
+        * history/PageCache.cpp:
+        (WebCore::logCanCacheFrameDecision):
+        (WebCore::PageCache::canCachePageContainingThisFrame):
+
+2012-03-05  Martin Robinson  <mrobinson@igalia.com>
+
+        [soup] Crash while loading http://www.jusco.cn
+        https://bugs.webkit.org/show_bug.cgi?id=68238
+
+        Reviewed by Philippe Normand.
+
+        Test: http/tests/xmlhttprequest/xmlhttprequest-sync-no-timers.html
+
+        When running synchronous XMLHttpRequests, push a new inner thread default
+        context, so that other sources from timers and network activity do not run.
+        This will make synchronous requests truly synchronous with the rest of
+        WebCore.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCoreSynchronousLoader): Clean up the method definitions a bit by writing them inline.
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader): Push a new thread default
+        context to prevent other sources from running.
+        (WebCore::WebCoreSynchronousLoader::~WebCoreSynchronousLoader): Pop the inner thread default context.
+        (WebCore::closeCallback): If the client is synchronous call didFinishLoading now.
+        (WebCore::readCallback): Only call didFinishLoading if the client isn't synchronous.
+        (WebCore::ResourceHandle::defaultSession): Activate use-thread-context so that the soup session
+        respects the inner thread context.
+        (ResourceHandleClient):
+        (WebCore::ResourceHandleClient::isSynchronousClient): Added this virtual method.
+
+2012-03-05  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Remove pointer to timer and use the timers directly in the tiled backing store
+        https://bugs.webkit.org/show_bug.cgi?id=80283
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::~TiledBackingStore):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::startTileBufferUpdateTimer):
+        (WebCore::TiledBackingStore::startTileCreationTimer):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-03-05  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Tabbing an empty new property in the middle of style moves the editor to the next section
+        https://bugs.webkit.org/show_bug.cgi?id=80264
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.element.userInput.previousContent.context.moveDirection.alreadyNew):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-03-05  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Update LocalizedStringsBlackBerry.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80278
+
+        Reviewed by Antonio Gomes.
+
+        Update LocalizedStringsBlackBerry.cpp to current HEAD.
+
+        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
+        (WebCore::inputElementAltText): fall back to "Submit".
+        (WebCore::imageTitle): choose the format "filename(widthxheight)" like Chrome does.
+        (WebCore::fileButtonNoFilesSelectedLabel): fall back to "No File Chosen" translation like Chrome does.
+        (WebCore):
+
+2012-03-05  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: [chromium] introduce HeapSnapshot performance test.
+        https://bugs.webkit.org/show_bug.cgi?id=80280
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/HeapSnapshotProxy.js:
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading.updateStaticData):
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading):
+        (WebInspector.HeapSnapshotLoaderProxy.prototype._callLoadCallbacks):
+
+2012-03-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: cannot be launched when localStorage is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=80252
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Settings.js:
+
+2012-03-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: check for the number of parsed css properties.
+        https://bugs.webkit.org/show_bug.cgi?id=80268
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: inspector/styles/set-property-boundaries.html
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::didRemoveDOMNode):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::setPropertyText):
+
+2012-03-05  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Tabbed pane should redraw tab elements when tab is closed.
+        https://bugs.webkit.org/show_bug.cgi?id=80273
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPane.prototype.closeTab):
+
+2012-03-05  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Improve comments in the tiled backing store
+        https://bugs.webkit.org/show_bug.cgi?id=80279
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::createTiles):
+
+2012-03-05  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        TiledBackingStore.{h,cpp} contains unclear variable names
+        https://bugs.webkit.org/show_bug.cgi?id=80276
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Simon Hausmann.
+
+        This patch renames some of the variables in TiledBackingStore.cpp to
+        enhance the clearity and for consistence.
+
+        The visibleContentsRect is renamed to visibleRect as it is not in
+        contents coordinates.
+
+        The panningTrajectoryVector and m_visibleRectTrajectoryVector are
+        renamed to just *[m_]trajectoryVector, as that is descriptive enough.
+
+        The previous prefix has also been removed, as it is being used as the
+        current one in the code. This avoids confusion.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::coverWithTilesIfNeeded):
+        (WebCore::TiledBackingStore::visibleRect):
+        (WebCore::TiledBackingStore::visibleAreaIsCovered):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::computeCoverAndKeepRect):
+        (WebCore::TiledBackingStore::removeAllNonVisibleTiles):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-03-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix build with Qt 5 and OpenGL ES 2.0
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/texmap/TextureMapper.h: Since we don't do QT += opengl with Qt 5 anymore
+        here in WebCore, we cannot check for QT_OPENGL_LIB. But since this is Qt5, we know that the
+        GLES setting comes qconfig.h and we can rely on it.
+
+2012-03-05  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Whitespace clean-up of TiledBackingStore.cpp.
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        Already covered by existing tests.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore):
+        (WebCore::TiledBackingStore::updateTileBuffers):
+        (WebCore::TiledBackingStore::paint):
+
+2012-03-05  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
+2012-03-05  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Incorrect appropriateSelectorFor() suggestion for when a DOMNode has more than 2 CSS classes
+        https://bugs.webkit.org/show_bug.cgi?id=80258
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.appropriateSelectorFor):
+
+2012-03-02  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] [CRASH] Handle rule addition and inline style editing failure due to Content-Security-Policy in the page
+        https://bugs.webkit.org/show_bug.cgi?id=80024
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/styles/add-new-rule-inline-style-csp.html
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
+        * inspector/InspectorCSSAgent.h:
+        (InlineStyleOverrideScope):
+        (WebCore::InspectorCSSAgent::InlineStyleOverrideScope::InlineStyleOverrideScope):
+        (WebCore::InspectorCSSAgent::InlineStyleOverrideScope::~InlineStyleOverrideScope):
+        (InspectorCSSAgent):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheetForInlineStyle::setStyleText):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy):
+        (WebCore::ContentSecurityPolicy::allowInlineStyle):
+        (WebCore::ContentSecurityPolicy::setOverrideAllowInlineStyle):
+        (WebCore):
+        * page/ContentSecurityPolicy.h:
+        (ContentSecurityPolicy):
+
+2012-03-05  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] The "optgroup" element should not be a form-associated element
+        https://bugs.webkit.org/show_bug.cgi?id=80234
+
+        Reviewed by Kent Tamura.
+
+        This patch changes base class of HTMLOptGroup to HTMLElement from
+        HTMLFormControlElement to avoid the "optgroup" element in form-associate
+        elements collection.
+
+        This patch doesn't affect HTMLOptionElement::disabled's static_cast. However,
+        it doesn't good at coding style. This patch also fix it.
+
+
+        No new tests. No behavior changes.
+
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::HTMLOptGroupElement): Remove "form" parameter.
+        (WebCore::HTMLOptGroupElement::create): Remove "form" parameter.
+        (WebCore::HTMLOptGroupElement::childrenChanged): Replace base method call.
+        (WebCore::HTMLOptGroupElement::parseAttribute): Replace base method call.
+        (WebCore::HTMLOptGroupElement::attach): Replace base method call.
+        (WebCore::HTMLOptGroupElement::detach): Replace base method call.
+        * html/HTMLOptGroupElement.h:
+        (HTMLOptGroupElement): Change base class to HTMLElement.
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::disabled): Replace static_cast<HTMLFormControlElement*> to static_cast<HTMLElement*> with checking isHTMLElement.
+        * html/HTMLTagNames.in: Remove "constructorNeedsFormElement" for not passing "form" parameter in HTMLElementFactory.
+
+2012-03-05  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: fix extensions-resource.html test.
+        https://bugs.webkit.org/show_bug.cgi?id=80183
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype._updateAnchor):
+
+2012-03-02  Andrey Kosyakov  <caseq@chromium.org>
+
+        Add instrumentation for frame start/end on timeline.
+
+        Web Inspector: add timeline instrumentation for frame events
+        https://bugs.webkit.org/show_bug.cgi?id=80127
+
+        Reviewed by Pavel Feldman.
+
+        - display frame boundaries when vertical overview mode is on
+        - aggregate by frame in vertical overview mode
+        - switched event filtering criteria from index to time in vertical overview mode
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didBeginFrameImpl):
+        (WebCore):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::didBeginFrame):
+        (WebCore):
+        * inspector/InspectorTimelineAgent.cpp:
+        (TimelineRecordType):
+        (WebCore::InspectorTimelineAgent::didBeginFrame):
+        (WebCore):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/front-end/TimelineModel.js:
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._showMemoryGraph):
+        (WebInspector.TimelineOverviewPane.prototype.setStartAtZero):
+        (WebInspector.TimelineOverviewPane.prototype.updateEventDividers):
+        (WebInspector.TimelineOverviewPane.prototype.sidebarResized):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewPane.prototype.accept):
+        (WebInspector.TimelineOverviewPane.prototype.windowStartTime):
+        (WebInspector.TimelineOverviewPane.prototype.windowEndTime):
+        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
+        (WebInspector.TimelineStartAtZeroOverview):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.reset):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.update):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._aggregateFrames):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._aggregateFrameStatistics):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._aggregateRecords):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._buildBar):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.getWindowTimes):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._updateEventDividers):
+        (WebInspector.TimelinePanel.prototype._createEventDivider):
+        (WebInspector.TimelinePanel.prototype._toggleStartAtZeroButtonClicked):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline.addTimestampRecords):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineCategoryFilter.prototype.accept):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.prototype.get _recordStyles):
+        * inspector/front-end/inspectorCommon.css:
+        * inspector/front-end/timelinePanel.css:
+        (#timeline-container):
+        (.timeline .resources-event-divider):
+        (.timeline.timeline-start-at-zero .resources-divider):
+        (.timeline .resources-event-divider.timeline-frame-divider):
+
+2012-03-05  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed build fix for !ENABLE(SHADOW_DOM).
+
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::contentTagName):
+
+2012-03-04  MORITA Hajime  <morrita@google.com>
+
+        Internally used HTMLContentElement subclasses should have correct wrapper.
+        https://bugs.webkit.org/show_bug.cgi?id=80237
+
+        Reviewed by Kent Tamura.
+
+        DetailsContentElement and DetailsSummaryElement used to use
+        <div> as their tag name. But this means they are wrapped by
+        wrapper objects for HTMLDivElement, which is wrong. This happened
+        to work though because HTMLDivElement has no extra state or API.
+
+        This change introduces "noConstructor" keyword for make_name.pl
+        sources.  This keyword allows a tag name to specify its own
+        wrapper without making the tag name visible from the parser, or
+        HTMLElementFactory in precise.
+
+        Following this addition, this change also adds a new tag name
+        "webkitShadowContent" for DetailsContentElement and DetailsSummaryElement,
+        which has no constructor, and whose wrapper type is HTMLElement.
+
+        This change isn't visible from the page author and only matters for testing.
+
+        Test: fast/dom/shadow/content-element-user-agent-shadow.html
+
+        * dom/make_names.pl:
+        (defaultTagPropertyHash):
+        (buildConstructorMap):
+        (printConstructors):
+        (printFunctionInits):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::DetailsContentElement::DetailsContentElement):
+        (WebCore::DetailsSummaryElement::DetailsSummaryElement):
+        * html/HTMLTagNames.in:
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::contentTagName):
+
+2012-03-05  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Refactoring: Move HTMLContentElement::attach to InsertionPoint::attach.
+        https://bugs.webkit.org/show_bug.cgi?id=80243
+
+        Reviewed by Hajime Morita.
+
+        Since the current code in HTMLContentElement::attach() will be used for coming <shadow>
+        elements, it is natural that InsertionPoint::attach() has such code.
+
+        No new tests, no change in behavior.
+
+        * html/shadow/HTMLContentElement.cpp:
+        * html/shadow/HTMLContentElement.h:
+        (HTMLContentElement):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::attach):
+        (WebCore):
+        (WebCore::InsertionPoint::detach):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+
+2012-03-05  Adam Barth  <abarth@webkit.org>
+
+        allowDatabaseAccess and databaseExceededQuota should be part of DatabaseContext not ScriptExecutionContext
+        https://bugs.webkit.org/show_bug.cgi?id=80178
+
+        Reviewed by Eric Seidel.
+
+        These functions are only used by SQLDatabase, which means we can move
+        them to DatabaseContext, removing one more tendril of the SQLDatabase
+        code.
+
+        * dom/Document.cpp:
+        (WebCore):
+        * dom/Document.h:
+        (Document):
+        * dom/ScriptExecutionContext.h:
+        (ScriptExecutionContext):
+        * storage/DatabaseContext.cpp:
+        (WebCore::DatabaseContext::DatabaseContext):
+        (WebCore::DatabaseContext::from):
+        (WebCore::DatabaseContext::allowDatabaseAccess):
+        (WebCore):
+        (WebCore::DatabaseContext::databaseExceededQuota):
+        * storage/DatabaseContext.h:
+        (DatabaseContext):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL):
+        * storage/SQLTransactionClient.cpp:
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * storage/SQLTransactionSync.cpp:
+        (WebCore::SQLTransactionSync::executeSQL):
+        * workers/WorkerContext.cpp:
+        (WebCore):
+        * workers/WorkerContext.h:
+        (WorkerContext):
+
+2012-03-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107551.
+        http://trac.webkit.org/changeset/107551
+        https://bugs.webkit.org/show_bug.cgi?id=80245
+
+        caused incorrect style sharing (Requested by kling on
+        #webkit).
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-04  Luke Macpherson   <macpherson@chromium.org>
+
+        Remove unused macro HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE.
+        https://bugs.webkit.org/show_bug.cgi?id=80236
+
+        Reviewed by Eric Seidel.
+
+        No new tests / unused code deletion only.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore):
+
+2012-03-04  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT heuristics should be hyperbolic
+        https://bugs.webkit.org/show_bug.cgi?id=80055
+        <rdar://problem/10922260>
+
+        Reviewed by Oliver Hunt.
+
+        No new tests, since there's no new functionality.
+
+        * ForwardingHeaders/wtf/SimpleStats.h: Added.
+
+2012-03-04  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Methods like firstRendererOf of NodeRenderingContext should be extracted.
+        https://bugs.webkit.org/show_bug.cgi?id=79902
+
+        Reviewed by Hajime Morita.
+
+        firstRendererOfInsertionPoint should return the first renderer of its child, however
+        it returns next renderer of parent. The same thing happens lastRendererOfInsertionPoint.
+
+        Test: content-element-move.html has another test case.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore):
+        (WebCore::nextRendererOfInsertionPoint):
+        (WebCore::previousRendererOfInsertionPoint):
+        (WebCore::firstRendererOfInsertionPoint):
+        (WebCore::lastRendererOfInsertionPoint):
+        (WebCore::firstRendererOf):
+        (WebCore::lastRendererOf):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+
+2012-03-04  MORITA Hajime <morrita@google.com>
+
+        Unreviewed build fix for ENABLE(MATHML).
+
+        * mathml/MathMLElement.h:
+        (WebCore):
+
+2012-03-04  MORITA Hajime  <morrita@google.com>
+
+        WebKit needs toHTMLUnknownElement() and isUnknown() for sanity check.
+        https://bugs.webkit.org/show_bug.cgi?id=80229
+
+        Reviewed by Kent Tamura.
+
+        The code generator has naked static_cast<> which could be unsafe.
+        We can turn it into toHTMLUnknownElement() and the like.
+
+        No new tests. Just added a sanity check.
+
+        * dom/make_names.pl:
+        (printWrapperFactoryCppFile):
+        * html/HTMLElement.h:
+        (HTMLElement):
+        (WebCore::HTMLElement::isHTMLUnknownElement):
+        * html/HTMLUnknownElement.h:
+        (HTMLUnknownElement):
+        (WebCore::toHTMLUnknownElement):
+        (WebCore):
+        * mathml/MathMLElement.h:
+        (toMathMLElement):
+        * svg/SVGElement.h:
+        (WebCore::toSVGElement):
+        (WebCore):
+
+2012-03-04  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitColumnBreakAfter, CSSPropertyWebkitColumnBreakBefore and CSSPropertyWebkitColumnBreakInside in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80226
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-04  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>
+
+        [BlackBerry] Credential backing store implementation
+        https://bugs.webkit.org/show_bug.cgi?id=79650
+
+        Reviewed by Antonio Gomes.
+
+        Opened Credential database in CedentialBackingStore::instance().
+        Added never_remember table and associated sql statment
+        members to store the never remember sites.
+        Removed CredentialStorage initialize codes because that
+        won't give users a chance to re-enter the new credential
+        information for an already stored site.
+        Changed login update and has statement to support
+        autofill feature of multiple credential forms in the
+        same page; Also added url as a parameter of hasLogin() function.
+        Added calling reset() after each statement calls step(),
+        to make it work correctly next time.
+        Also fixed a macro typo in HANDLE_SQL_EXEC_FAILURE.
+
+        No new tests.
+
+        * platform/network/blackberry/CredentialBackingStore.cpp:
+        (WebCore::CredentialBackingStore::instance):
+        (WebCore::CredentialBackingStore::CredentialBackingStore):
+        (WebCore::CredentialBackingStore::open):
+        (WebCore::CredentialBackingStore::close):
+        (WebCore::CredentialBackingStore::addLogin):
+        (WebCore::CredentialBackingStore::updateLogin):
+        (WebCore::CredentialBackingStore::hasLogin):
+        (WebCore::CredentialBackingStore::getLogin):
+        (WebCore):
+        (WebCore::CredentialBackingStore::removeLogin):
+        (WebCore::CredentialBackingStore::addNeverRemember):
+        (WebCore::CredentialBackingStore::hasNeverRemember):
+        (WebCore::CredentialBackingStore::getNeverRemember):
+        (WebCore::CredentialBackingStore::removeNeverRemember):
+        (WebCore::CredentialBackingStore::clearLogins):
+        (WebCore::CredentialBackingStore::clearNeverRemember):
+        * platform/network/blackberry/CredentialBackingStore.h:
+        (CredentialBackingStore):
+
+2012-03-04  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [EFL] Evas_GL initialization and destruction in GraphicsContext3DPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=80211
+
+        Reviewed by Noam Rosenthal.
+
+        This patch adds initialization and destruction codes using Evas_GL APIs to GC3DPrivate.
+
+        No new tests. No behavior change.
+
+        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
+        (WebCore::GraphicsContext3DPrivate::create):
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::initialize):
+        (WebCore::GraphicsContext3DPrivate::createSurface):
+        (WebCore::GraphicsContext3DPrivate::makeContextCurrent):
+        * platform/graphics/efl/GraphicsContext3DPrivate.h:
+        (GraphicsContext3DPrivate):
+
+2012-03-04  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Libraries are installed to /usr/lib and not /usr/lib64 on x86_64
+        https://bugs.webkit.org/show_bug.cgi?id=71507
+
+        Reviewed by Antonio Gomes.
+
+        No new tests, buildsystem change.
+
+        * CMakeLists.txt: Use ${LIB_INSTALL_DIR} instead of hardcoding "lib".
+
+2012-03-04  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [EFL] Implementation of missing functions in GraphicsContext3DPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=79759
+
+        Reviewed by Noam Rosenthal.
+
+        The initial patch (Bug 62961) only contains implementations for simple functions
+        which call GL functions through Evas_GL_API.
+        This patch implements a little complicated functions such as getActiveAttrib(),
+        getShaderSource() and so on.
+
+        No new tests. No behavior change.
+
+        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
+        (WebCore::GraphicsContext3DPrivate::getActiveAttrib):
+        (WebCore::GraphicsContext3DPrivate::getActiveUniform):
+        (WebCore::GraphicsContext3DPrivate::getError):
+        (WebCore::GraphicsContext3DPrivate::getIntegerv):
+        (WebCore::GraphicsContext3DPrivate::getProgramInfoLog):
+        (WebCore::GraphicsContext3DPrivate::getShaderInfoLog):
+        (WebCore::GraphicsContext3DPrivate::getShaderSource):
+
+2012-03-04  Kentaro Hara  <haraken@chromium.org>
+
+        Revert SVG-related APIs from DOMWindowSVG.idl back to DOMWindow.idl
+        https://bugs.webkit.org/show_bug.cgi?id=80139
+
+        Reviewed by Adam Barth.
+
+        Based on the discussion on webkit-dev@
+        (http://markmail.org/message/kagvswmah67zmrry#query:+page:1+mid:h34vzbiu5suub3ld+state:results),
+        this patch reverts SVG-related APIs from DOMWindowSVG.idl back to DOMWindow.idl.
+
+        No tests. No change in behavior.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/DOMWindow.idl:
+        * svg/DOMWindowSVG.idl: Removed.
+
+2012-03-04  Kentaro Hara  <haraken@chromium.org>
+
+        Revert WebGL-related APIs from DOMWindowWebGL.idl back to DOMWindow.idl
+        https://bugs.webkit.org/show_bug.cgi?id=80144
+
+        Reviewed by Adam Barth.
+
+        Based on the discussion on webkit-dev@
+        (http://markmail.org/message/kagvswmah67zmrry#query:+page:1+mid:h34vzbiu5suub3ld+state:results),
+        this patch reverts WebGL-related APIs from DOMWindowWebGL.idl back to DOMWindow.idl.
+
+        No tests. No change in behavior.
+
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/canvas/DOMWindowWebGL.idl: Removed.
+        * page/DOMWindow.idl:
+
+2012-03-04  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed build fix.
+
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::canHaveGeneratedChildren):
+
+2012-03-01  MORITA Hajime  <morrita@google.com>
+
+        REGRESSION(r108758): Assertion failure in WebCore::RenderMenuList::addChild
+        https://bugs.webkit.org/show_bug.cgi?id=80096
+
+        Reviewed by Dimitri Glazkov.
+
+        After r108758 RenderBlock allowed <select> to have generated
+        contents. But it shouldn't. This change stops allowing it again by
+        replacing some canHaveChildren() invocations with
+        less permissive canHaveGeneratedChildren().
+
+        This change also pulls back original canHaveChildren() logic to
+        RenderButton to allow <button> to have generated contents.
+
+        Then RenderDeprecatedFlexibleBox::buttonText() is morphed to
+        more intention revealing canHaveGeneratedChildren().
+
+        Test: fast/forms/select-generated-content.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore):
+        (WebCore::canHaveGeneratedChildren):
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::findFirstLetterBlock):
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        (RenderButton):
+        * rendering/RenderDeprecatedFlexibleBox.h:
+        (WebCore::RenderDeprecatedFlexibleBox::canHaveGeneratedChildren):
+        * rendering/RenderMenuList.h:
+
+2012-03-04  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream two helper files from platform/graphics/blackberry
+        https://bugs.webkit.org/show_bug.cgi?id=80125
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/InstrumentedPlatformCanvas.h: Added.
+        (WebCore):
+        (InstrumentedPlatformCanvas):
+        (WebCore::InstrumentedPlatformCanvas::InstrumentedPlatformCanvas):
+        (WebCore::InstrumentedPlatformCanvas::~InstrumentedPlatformCanvas):
+        (WebCore::InstrumentedPlatformCanvas::isSolidColor):
+        (WebCore::InstrumentedPlatformCanvas::solidColor):
+        (WebCore::InstrumentedPlatformCanvas::save):
+        (WebCore::InstrumentedPlatformCanvas::saveLayer):
+        (WebCore::InstrumentedPlatformCanvas::restore):
+        (WebCore::InstrumentedPlatformCanvas::translate):
+        (WebCore::InstrumentedPlatformCanvas::scale):
+        (WebCore::InstrumentedPlatformCanvas::rotate):
+        (WebCore::InstrumentedPlatformCanvas::skew):
+        (WebCore::InstrumentedPlatformCanvas::concat):
+        (WebCore::InstrumentedPlatformCanvas::setMatrix):
+        (WebCore::InstrumentedPlatformCanvas::clipRect):
+        (WebCore::InstrumentedPlatformCanvas::clipPath):
+        (WebCore::InstrumentedPlatformCanvas::clipRegion):
+        (WebCore::InstrumentedPlatformCanvas::clear):
+        (WebCore::InstrumentedPlatformCanvas::drawPaint):
+        (WebCore::InstrumentedPlatformCanvas::drawPoints):
+        (WebCore::InstrumentedPlatformCanvas::drawRect):
+        (WebCore::InstrumentedPlatformCanvas::drawPath):
+        (WebCore::InstrumentedPlatformCanvas::drawBitmap):
+        (WebCore::InstrumentedPlatformCanvas::drawBitmapRect):
+        (WebCore::InstrumentedPlatformCanvas::drawBitmapMatrix):
+        (WebCore::InstrumentedPlatformCanvas::drawSprite):
+        (WebCore::InstrumentedPlatformCanvas::drawText):
+        (WebCore::InstrumentedPlatformCanvas::drawPosText):
+        (WebCore::InstrumentedPlatformCanvas::drawPosTextH):
+        (WebCore::InstrumentedPlatformCanvas::drawTextOnPath):
+        (WebCore::InstrumentedPlatformCanvas::drawPicture):
+        (WebCore::InstrumentedPlatformCanvas::drawVertices):
+        (WebCore::InstrumentedPlatformCanvas::drawData):
+        * platform/graphics/blackberry/LayerMessage.h: Added.
+        (WebCore):
+        (WebCore::isCompositingThread):
+        (WebCore::compositingThread):
+        (WebCore::isWebKitThread):
+        (WebCore::webKitThread):
+        (WebCore::dispatchCompositingMessage):
+        (WebCore::dispatchSyncCompositingMessage):
+        (WebCore::dispatchWebKitMessage):
+
+2012-03-04  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Introduce SMIL overrideStyle, to make SVG stop mutating CSS styles directly
+        https://bugs.webkit.org/show_bug.cgi?id=79790
+
+        Reviewed by Dirk Schulze.
+
+        Restore SMIL animation behavior back to pre-r109342.
+        1) Always animate presentation attributes as CSS properties, regardless of the
+        attributeTypes value. Matches Opera/FF, and makes the attribute optional again
+        as specified in both SMIL & SVG.
+
+        Extend existing svg/animations/attributesTypes.html to verify this.
+
+        2) Switch setInstancesUpdatesBlocked calls to the right locations again, to
+        avoid chromium assertions (and/or extra work being done). Fixing that reveals another
+        problem: in the instance updating code path, we always called setTargetAttributeAnimatedCSSValue
+        even for XML animations.
+
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::shouldApplyAnimation): Restore old logic.
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue): Fix typo, move setInstancesUpdatesBlocked calls.
+
+2012-03-04  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>
+
+        [BlackBerry] upstream MediaPlayerPrivateBlackBerry.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=79729
+
+        Reviewed by Rob Buis and Antonio Gomes.
+
+        Implementation of MediaPlayerPrivate for BlackBerry porting.
+        Initial upstream, No new tests.
+
+        * PlatformBlackBerry.cmake:
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::registerMediaEngine):
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::notifyAppActivatedEvent):
+        (WebCore::MediaPlayerPrivate::setCertificatePath):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+        (WebCore::MediaPlayerPrivate::prepareToPlay):
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::userDrivenSeekTimerFired):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::networkState):
+        (WebCore::MediaPlayerPrivate::readyState):
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivate::buffered):
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::MediaPlayerPrivate::hasAvailableVideoFrame):
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayerPrivate::movieLoadType):
+        (WebCore::MediaPlayerPrivate::userAgent):
+        (WebCore::MediaPlayerPrivate::resizeSourceDimensions):
+        (WebCore::MediaPlayerPrivate::setFullscreenWebPageClient):
+        (WebCore::MediaPlayerPrivate::getWindow):
+        (WebCore::MediaPlayerPrivate::getPeerWindow):
+        (WebCore::MediaPlayerPrivate::getWindowPosition):
+        (WebCore::MediaPlayerPrivate::mmrContextName):
+        (WebCore::MediaPlayerPrivate::percentLoaded):
+        (WebCore::MediaPlayerPrivate::sourceWidth):
+        (WebCore::MediaPlayerPrivate::sourceHeight):
+        (WebCore::MediaPlayerPrivate::setAllowPPSVolumeUpdates):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::onStateChanged):
+        (WebCore::MediaPlayerPrivate::onMediaStatusChanged):
+        (WebCore::MediaPlayerPrivate::onError):
+        (WebCore::MediaPlayerPrivate::onDurationChanged):
+        (WebCore::MediaPlayerPrivate::onTimeChanged):
+        (WebCore::MediaPlayerPrivate::onPauseStateChanged):
+        (WebCore::MediaPlayerPrivate::onRateChanged):
+        (WebCore::MediaPlayerPrivate::onVolumeChanged):
+        (WebCore::MediaPlayerPrivate::onRepaint):
+        (WebCore::MediaPlayerPrivate::onSizeChanged):
+        (WebCore::MediaPlayerPrivate::onPlayNotified):
+        (WebCore::MediaPlayerPrivate::onPauseNotified):
+        (WebCore::MediaPlayerPrivate::onBuffering):
+        (WebCore::MediaPlayerPrivate::showErrorDialog):
+        (WebCore::MediaPlayerPrivate::frameView):
+        (WebCore::MediaPlayerPrivate::platformWindow):
+        (WebCore::MediaPlayerPrivate::isFullscreen):
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayerPrivate::platformLayer):
+        (WebCore::loadBufferingImageData):
+        (WebCore::MediaPlayerPrivate::bufferingTimerFired):
+        (WebCore::MediaPlayerPrivate::setBuffering):
+        (WebCore::allocateTextureId):
+        (WebCore::MediaPlayerPrivate::drawBufferingAnimation):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h: Added.
+        (WebKit):
+        (WebCore):
+        (MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+
+2012-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove the unused function WebCore::protocolIsInHTTPFamily()
+        https://bugs.webkit.org/show_bug.cgi?id=80218
+
+        Reviewed by Anders Carlsson.
+
+        * WebCore.order:
+        * platform/KURL.cpp:
+        * platform/KURL.h:
+        (WebCore):
+
+2012-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        Implement the basis of KURLWTFURL
+        https://bugs.webkit.org/show_bug.cgi?id=79600
+
+        Reviewed by Adam Barth.
+
+        Add a simple, non-optimized, implementation for the main methods of KURL based
+        on ParsedURL.
+
+        * platform/KURLWTFURL.cpp:
+        (WebCore):
+        (WebCore::detach):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::copy):
+        (WebCore::KURL::isEmpty):
+        (WebCore::KURL::isValid):
+        (WebCore::KURL::string):
+        (WebCore::KURL::protocol):
+        (WebCore::KURL::host):
+        (WebCore::KURL::hasPort):
+        (WebCore::KURL::port):
+        (WebCore::KURL::user):
+        (WebCore::KURL::pass):
+        (WebCore::KURL::hasPath):
+        (WebCore::KURL::path):
+        (WebCore::KURL::lastPathComponent):
+        (WebCore::KURL::query):
+        (WebCore::KURL::hasFragmentIdentifier):
+        (WebCore::KURL::fragmentIdentifier):
+        (WebCore::KURL::baseAsString):
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::KURL::protocolIs):
+        (WebCore::KURL::protocolIsInHTTPFamily):
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::setHost):
+        (WebCore::KURL::removePort):
+        (WebCore::KURL::setPort):
+        (WebCore::KURL::setHostAndPort):
+        (WebCore::KURL::setUser):
+        (WebCore::KURL::setPass):
+        (WebCore::KURL::setPath):
+        (WebCore::KURL::setQuery):
+        (WebCore::KURL::setFragmentIdentifier):
+        (WebCore::KURL::removeFragmentIdentifier):
+        (WebCore::protocolHostAndPortAreEqual):
+        * platform/KURLWTFURLImpl.h:
+        (KURLWTFURLImpl):
+        (WebCore::KURLWTFURLImpl::copy):
+        (WebCore):
+
+2012-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove the redundant method KURL::protocolInHTTPFamily()
+        https://bugs.webkit.org/show_bug.cgi?id=80216
+
+        Reviewed by Anders Carlsson.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        * loader/ResourceLoadScheduler.cpp:
+        (WebCore::ResourceLoadScheduler::hostForURL):
+        (WebCore::ResourceLoadScheduler::scheduleLoad):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::requestIsHTTPOrHTTPSGet):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::freshnessLifetime):
+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::removeFragmentIdentifierIfNeeded):
+        * loader/icon/IconController.cpp:
+        (WebCore::IconController::defaultURL):
+        * platform/KURL.h:
+        (KURL):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::CredentialStorage::set):
+        (WebCore::findDefaultProtectionSpaceForURL):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::setCachePolicy):
+        (WebCore::ResourceRequestBase::setTimeoutInterval):
+        (WebCore::ResourceRequestBase::setHTTPMethod):
+        (WebCore::ResourceRequestBase::setHTTPHeaderField):
+        (WebCore::ResourceRequestBase::clearHTTPAuthorization):
+        (WebCore::ResourceRequestBase::clearHTTPReferrer):
+        (WebCore::ResourceRequestBase::clearHTTPOrigin):
+        (WebCore::ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray):
+        (WebCore::ResourceRequestBase::setHTTPBody):
+        (WebCore::ResourceRequestBase::setAllowCookies):
+        (WebCore::ResourceRequestBase::setPriority):
+        (WebCore::ResourceRequestBase::addHTTPHeaderField):
+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::createCFURLConnection):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::createNSURLConnection):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+
+2012-03-03  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream LayerWebKitThread and its derived classes
+        https://bugs.webkit.org/show_bug.cgi?id=79871
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/CanvasLayerWebKitThread.cpp: Added.
+        (WebCore):
+        (WebCore::CanvasLayerWebKitThread::CanvasLayerWebKitThread):
+        (WebCore::CanvasLayerWebKitThread::~CanvasLayerWebKitThread):
+        (WebCore::CanvasLayerWebKitThread::setCanvas):
+        (WebCore::CanvasLayerWebKitThread::setNeedsDisplay):
+        (WebCore::CanvasLayerWebKitThread::updateTextureContentsIfNeeded):
+        * platform/graphics/blackberry/CanvasLayerWebKitThread.h: Added.
+        (WebCore):
+        (CanvasLayerWebKitThread):
+        (WebCore::CanvasLayerWebKitThread::create):
+        * platform/graphics/blackberry/LayerData.h: Added.
+        (WebCore):
+        (LayerData):
+        (WebCore::LayerData::LayerData):
+        (WebCore::LayerData::~LayerData):
+        (WebCore::LayerData::anchorPoint):
+        (WebCore::LayerData::anchorPointZ):
+        (WebCore::LayerData::backgroundColor):
+        (WebCore::LayerData::borderColor):
+        (WebCore::LayerData::borderWidth):
+        (WebCore::LayerData::bounds):
+        (WebCore::LayerData::doubleSided):
+        (WebCore::LayerData::frame):
+        (WebCore::LayerData::masksToBounds):
+        (WebCore::LayerData::opacity):
+        (WebCore::LayerData::opaque):
+        (WebCore::LayerData::position):
+        (WebCore::LayerData::sublayerTransform):
+        (WebCore::LayerData::transform):
+        (WebCore::LayerData::preserves3D):
+        (WebCore::LayerData::getTextureID):
+        (WebCore::LayerData::setTextureID):
+        (WebCore::LayerData::needsTexture):
+        (WebCore::LayerData::layerProgramShader):
+        (WebCore::LayerData::isFixedPosition):
+        (WebCore::LayerData::hasFixedContainer):
+        (WebCore::LayerData::hasFixedAncestorInDOMTree):
+        (WebCore::LayerData::pluginView):
+        (WebCore::LayerData::holePunchRect):
+        (WebCore::LayerData::hasHolePunchRect):
+        (WebCore::LayerData::mediaPlayer):
+        (WebCore::LayerData::canvas):
+        (WebCore::LayerData::replicate):
+        (WebCore::LayerData::layerType):
+        (WebCore::LayerData::includeVisibility):
+        * platform/graphics/blackberry/LayerWebKitThread.cpp: Added.
+        (WebCore):
+        (WebCore::LayerWebKitThread::create):
+        (WebCore::LayerWebKitThread::LayerWebKitThread):
+        (WebCore::LayerWebKitThread::~LayerWebKitThread):
+        (WebCore::LayerWebKitThread::paintContents):
+        (WebCore::LayerWebKitThread::contentsVisible):
+        (WebCore::LayerWebKitThread::createFrontBufferLock):
+        (WebCore::LayerWebKitThread::updateTextureContentsIfNeeded):
+        (WebCore::LayerWebKitThread::setContents):
+        (WebCore::LayerWebKitThread::setDrawable):
+        (WebCore::LayerWebKitThread::setNeedsCommit):
+        (WebCore::LayerWebKitThread::notifyAnimationStarted):
+        (WebCore::LayerWebKitThread::commitOnWebKitThread):
+        (WebCore::LayerWebKitThread::startAnimations):
+        (WebCore::LayerWebKitThread::updateTextureContents):
+        (WebCore::LayerWebKitThread::commitOnCompositingThread):
+        (WebCore::LayerWebKitThread::addSublayer):
+        (WebCore::LayerWebKitThread::insertSublayer):
+        (WebCore::LayerWebKitThread::removeFromSuperlayer):
+        (WebCore::LayerWebKitThread::removeSublayer):
+        (WebCore::LayerWebKitThread::replaceSublayer):
+        (WebCore::LayerWebKitThread::indexOfSublayer):
+        (WebCore::LayerWebKitThread::setBounds):
+        (WebCore::LayerWebKitThread::setFrame):
+        (WebCore::LayerWebKitThread::rootLayer):
+        (WebCore::LayerWebKitThread::removeAllSublayers):
+        (WebCore::LayerWebKitThread::setSublayers):
+        (WebCore::LayerWebKitThread::setNeedsDisplayInRect):
+        (WebCore::LayerWebKitThread::setNeedsDisplay):
+        (WebCore::LayerWebKitThread::updateLayerHierarchy):
+        (WebCore::LayerWebKitThread::setIsMask):
+        * platform/graphics/blackberry/LayerWebKitThread.h: Added.
+        (WebCore):
+        (LayerWebKitThread):
+        (WebCore::LayerWebKitThread::setAnchorPoint):
+        (WebCore::LayerWebKitThread::setAnchorPointZ):
+        (WebCore::LayerWebKitThread::setBackgroundColor):
+        (WebCore::LayerWebKitThread::setBorderColor):
+        (WebCore::LayerWebKitThread::setBorderWidth):
+        (WebCore::LayerWebKitThread::setDoubleSided):
+        (WebCore::LayerWebKitThread::setMasksToBounds):
+        (WebCore::LayerWebKitThread::setMaskLayer):
+        (WebCore::LayerWebKitThread::maskLayer):
+        (WebCore::LayerWebKitThread::setReplicaLayer):
+        (WebCore::LayerWebKitThread::replicaLayer):
+        (WebCore::LayerWebKitThread::setNeedsDisplayOnBoundsChange):
+        (WebCore::LayerWebKitThread::setOpacity):
+        (WebCore::LayerWebKitThread::setOpaque):
+        (WebCore::LayerWebKitThread::setPosition):
+        (WebCore::LayerWebKitThread::getSublayers):
+        (WebCore::LayerWebKitThread::setSublayerTransform):
+        (WebCore::LayerWebKitThread::superlayer):
+        (WebCore::LayerWebKitThread::setTransform):
+        (WebCore::LayerWebKitThread::setPreserves3D):
+        (WebCore::LayerWebKitThread::setFixedPosition):
+        (WebCore::LayerWebKitThread::setHasFixedContainer):
+        (WebCore::LayerWebKitThread::setHasFixedAncestorInDOMTree):
+        (WebCore::LayerWebKitThread::contents):
+        (WebCore::LayerWebKitThread::setOwner):
+        (WebCore::LayerWebKitThread::drawsContent):
+        (WebCore::LayerWebKitThread::layerCompositingThread):
+        (WebCore::LayerWebKitThread::setAbsoluteOffset):
+        (WebCore::LayerWebKitThread::contentsScale):
+        (WebCore::LayerWebKitThread::setRunningAnimations):
+        (WebCore::LayerWebKitThread::setSuspendedAnimations):
+        (WebCore::LayerWebKitThread::setNeedsTexture):
+        (WebCore::LayerWebKitThread::setLayerProgramShader):
+        (WebCore::LayerWebKitThread::isDrawable):
+        (WebCore::LayerWebKitThread::boundsChanged):
+        (WebCore::LayerWebKitThread::setSuperlayer):
+        (WebCore::LayerWebKitThread::numSublayers):
+        * platform/graphics/blackberry/PluginLayerWebKitThread.cpp: Added.
+        (WebCore):
+        (WebCore::PluginLayerWebKitThread::PluginLayerWebKitThread):
+        (WebCore::PluginLayerWebKitThread::~PluginLayerWebKitThread):
+        (WebCore::PluginLayerWebKitThread::setPluginView):
+        (WebCore::PluginLayerWebKitThread::setHolePunchRect):
+        (WebCore::PluginLayerWebKitThread::setNeedsDisplay):
+        (WebCore::PluginLayerWebKitThread::updateTextureContentsIfNeeded):
+        * platform/graphics/blackberry/PluginLayerWebKitThread.h: Added.
+        (WebCore):
+        (PluginLayerWebKitThread):
+        (WebCore::PluginLayerWebKitThread::create):
+        * platform/graphics/blackberry/VideoLayerWebKitThread.cpp: Added.
+        (WebCore):
+        (WebCore::VideoLayerWebKitThread::VideoLayerWebKitThread):
+        (WebCore::VideoLayerWebKitThread::~VideoLayerWebKitThread):
+        (WebCore::VideoLayerWebKitThread::setMediaPlayer):
+        (WebCore::VideoLayerWebKitThread::setHolePunchRect):
+        (WebCore::VideoLayerWebKitThread::setNeedsDisplay):
+        (WebCore::VideoLayerWebKitThread::boundsChanged):
+        (WebCore::VideoLayerWebKitThread::updateTextureContentsIfNeeded):
+        * platform/graphics/blackberry/VideoLayerWebKitThread.h: Added.
+        (WebCore):
+        (VideoLayerWebKitThread):
+        (WebCore::VideoLayerWebKitThread::create):
+
+2012-03-03  Hans Wennborg  <hans@chromium.org>
+
+        Implement Speech JavaScript API
+        https://bugs.webkit.org/show_bug.cgi?id=80019
+
+        Reviewed by Adam Barth.
+
+        Add ENABLE_SCRIPTED_SPEECH and runtime flag.
+
+        No functionality yet, so no new tests.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * Target.pri:
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::setScriptedSpeechEnabled):
+        (WebCore::RuntimeEnabledFeatures::scriptedSpeechEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitSpeechRecognitionEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitSpeechRecognitionErrorEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitSpeechGrammarEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitSpeechGrammarListEnabled):
+
+2012-03-03  Raymond Toy  <rtoy@google.com>
+
+        DelayNode has a fixed one second max delay time
+        https://bugs.webkit.org/show_bug.cgi?id=78758
+
+        Change DelayNode to accept an optional parameter to specify the
+        maximum delay allowed. If not specified, the default is 1 sec.
+        
+        Reviewed by Chris Rogers.
+
+        Test: webaudio/delaynode-maxdelay.html
+              webaudio/delaynode-maxdelay-expected.txt
+
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::createDelayNode): Allow maxDelayTime
+        parameter to specify max delay.
+        * webaudio/AudioContext.h: Allow maxDelayTime
+        parameter to specify max delay but default to 1.
+        (AudioContext):
+        * webaudio/AudioContext.idl: createDelayNode takes optional max
+        delay time parameter.
+        * webaudio/DelayDSPKernel.cpp:
+        (WebCore::DelayDSPKernel::DelayDSPKernel): Remove unused
+        DefaultMaxDelayTime. Set m_maxDelayTime from processor
+        maxDelayTime. 
+        * webaudio/DelayNode.cpp:
+        (WebCore::DelayNode::DelayNode): Add maxDelayTime parameter. 
+        * webaudio/DelayNode.h:
+        (WebCore::DelayNode::create): Add maxDelayTime parameter. 
+        (DelayNode): Add maxDelayTime parameter. 
+        * webaudio/DelayProcessor.cpp:
+        (WebCore::DelayProcessor::DelayProcessor): Add maxDelayTime
+        parameter.  
+        * webaudio/DelayProcessor.h:
+        (DelayProcessor): Add maxDelayTime parameter. 
+        (WebCore::DelayProcessor::maxDelayTime): New slot to hold
+        maxDelayTime. 
+
+2012-03-03  Raymond Toy  <rtoy@google.com>
+
+        Simplified discreteTimeConstantForSampleRate
+        https://bugs.webkit.org/show_bug.cgi?id=78051
+
+        Remove hardcoded constant and simplify computation of discrete
+        time constant.
+        
+        Reviewed by Chris Rogers.
+
+        No new tests needed.  Covered by existing AudioParam tests.
+
+        * platform/audio/AudioUtilities.cpp:
+        (WebCore::AudioUtilities::discreteTimeConstantForSampleRate):
+        Simplify formula.
+        * platform/audio/AudioUtilities.h:
+        (AudioUtilities): Update function signature.
+        * platform/audio/DynamicsCompressorKernel.cpp:
+        (WebCore::DynamicsCompressorKernel::DynamicsCompressorKernel):
+        cast to float to avoid warnings.
+        * webaudio/AudioParamTimeline.cpp:
+        (WebCore::AudioParamTimeline::valuesForTimeRangeImpl): cast to
+        float to avoid warnings.
+
+2012-03-03  Anders Carlsson  <andersca@apple.com>
+
+        Fix build with newer versions of clang.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode description]):
+        Remove an unused parameter.
+
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::getClass):
+        Use object_getClass instead of accessing isa directly.
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore::formatLocalizedString):
+        Disable the -Wformat-nonliteral warning around the call to CFStringCreateWithFormatAndArguments.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (-[CALayer _descriptionWithPrefix:]):
+        Use %p for the CALayer pointer, and use %lu for the number of sublayers.
+
+        * platform/mac/HTMLConverter.mm:
+        (-[WebHTMLConverter _addAttachmentForElement:URL:needsParagraph:usePlaceholder:]):
+        Cast the NSAttachmentCharacte enum to unichar.
+
+2012-03-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r109343.
+        http://trac.webkit.org/changeset/109343
+        https://bugs.webkit.org/show_bug.cgi?id=80212
+
+        Int32array can't handle values for native nodes because they
+        have int64 ids (Requested by loislo1 on #webkit).
+
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotLoader.prototype._parseNodes):
+        (WebInspector.HeapSnapshotLoader.prototype.pushJSONChunk):
+        (WebInspector.HeapSnapshot):
+        (WebInspector.HeapSnapshot.prototype._init):
+
+2012-03-03  Andreas Kling  <awesomekling@apple.com>
+
+        Free up a bit in RenderObject.
+        http://webkit.org/b/80208
+
+        Reviewed by Anders Carlsson.
+
+        Move m_hasMarkupTruncation to RenderBlock, stealing one bit from m_lineHeight.
+        This flag is only used by RenderBlock.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::setHasMarkupTruncation):
+        (WebCore::RenderBlock::hasMarkupTruncation):
+        (RenderBlock):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        (WebCore::RenderObject::RenderObjectBitfields::RenderObjectBitfields):
+        (RenderObjectBitfields):
+
+2012-03-03  Joe Thomas  <joethomas@motorola.com>
+
+        Implement vw/vh/vmin (viewport sizes) from CSS 3 Values and Units
+        https://bugs.webkit.org/show_bug.cgi?id=27160
+
+        The specification related to this implementation is located at http://dev.w3.org/csswg/css3-values/#viewport-relative-lengths.
+        vw/vh/vmin are implemented as primitive length units. Added the parsing logic for these new units and creation of primitive values.
+
+        Added new Length types such as ViewportRelativeWidth, ViewportRelativeHeight and ViewportRelativeMin for viewport-relative lengths
+        and included the support for fetching the value of these relative length units based on the current viewport size.
+
+        Reviewed by Antti Koivisto.
+
+        Tests: css3/viewport-relative-lengths/css3-viewport-relative-lengths-getStyle.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vh-absolute.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vh.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vmin-absolute.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vmin.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vw-absolute.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vw.html
+
+        * css/CSSComputedStyleDeclaration.cpp: Modified to support viewport relative Length types.
+        (WebCore::getPositionOffsetValue): Ditto.
+        (WebCore::getBorderRadiusCornerValues): Ditto.
+        (WebCore::getBorderRadiusCornerValue): Ditto.
+        (WebCore::getBorderRadiusShorthandValue): Ditto.
+        (WebCore::lineHeightFromStyle): Ditto.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
+        * css/CSSGrammar.y: Added vw/vh/vmin support.
+        * css/CSSParser.cpp: Parsing of relative units and creation of CSSPrimitiveValue.
+        (WebCore::CSSParser::validUnit): Added vw/vh/vmin to the valid units.
+        (WebCore::CSSParser::createPrimitiveNumericValue): Added vw/vh/vmin as valid primitive units.
+        (WebCore::unitFromString):
+        (WebCore::CSSParser::parseValidPrimitive): Creation of CSSPrimitiveValue for vw/vh/vmin.
+        (WebCore::CSSParser::detectNumberToken): Parsing the vw/vh/vmin tokens.
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::isValidCSSUnitTypeForDoubleConversion): Added support for vw/vh/vmin.
+        (WebCore::unitCategory): Ditto.
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::canonicalUnitTypeForCategory): Added support for vw/vh/vmin.
+        (WebCore::CSSPrimitiveValue::customCssText): Ditto.
+        (WebCore::CSSPrimitiveValue::viewportRelativeLength): Function to create the Length structure for the viewport-relative unit types.
+        (WebCore):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::isViewportRelativeLength): Checks whether the primitive value is ViewportRelative Lengths.
+        (CSSPrimitiveValue):
+        * css/CSSPrimitiveValue.idl: Added support for vw/vh/vmin.
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyLength::applyValue): Applying relative viewport length units to the specific CSS property.
+        (WebCore::ApplyPropertyBorderRadius::applyValue): Ditto.
+        (WebCore::ApplyPropertyFontSize::applyValue): Ditto.
+        (WebCore::ApplyPropertyLineHeight::applyValue): Ditto.
+        (WebCore::ApplyPropertyVerticalAlign::applyValue): Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::convertToLength): Added support for viewport relative units.
+        (WebCore::createGridTrackBreadth): Ditto.
+        (WebCore::CSSStyleSelector::mapFillSize): Ditto.
+        (WebCore::CSSStyleSelector::mapFillXPosition): Ditto.
+        (WebCore::CSSStyleSelector::mapFillYPosition): Ditto.
+        * dom/Document.cpp:
+        (WebCore::Document::pageSizeAndMarginsInPixels): Modified to support viewport relative Length types.
+        (WebCore::Document::viewportSize): New function to fetch the current viewport size.
+        (WebCore):
+        * dom/Document.h: Ditto.
+        (Document):
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::getRegion): Modified to support viewport relative Length types.
+        * platform/Length.h: New LengthTypes such as ViewportRelativeWidth, ViewportRelativeHeight and ViewportRelativeMin added.
+        (WebCore::Length::calcValue): Modified to support viewport relative Length types.
+        (WebCore::Length::calcMinValue): Ditto.
+        (WebCore::Length::calcFloatValue): Ditto.
+        (Length):
+        (WebCore::Length::isViewportRelative): To check the Length is of type ViewportRelative.
+        (WebCore::Length::viewportRelativeLength): To get the relative value.
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight): Modified to support viewport relative Length types.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lineHeight): Ditto.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::reflectionOffset): Ditto.
+        (WebCore::RenderBox::paintBoxDecorations): Ditto.
+        (WebCore::RenderBox::clipRect): Ditto.
+        (WebCore::RenderBox::computeLogicalWidthInRegion): Ditto.
+        (WebCore::RenderBox::computeLogicalWidthInRegionUsing): Ditto.
+        (WebCore::RenderBox::computeInlineDirectionMargins): Ditto.
+        (WebCore::RenderBox::computeLogicalHeightUsing): Ditto.
+        (WebCore::RenderBox::computePercentageLogicalHeight): Ditto.
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing): Ditto.
+        (WebCore::RenderBox::computeBlockDirectionMargins): Ditto.
+        (WebCore::RenderBox::computePositionedLogicalWidthUsing): Ditto.
+        (WebCore::RenderBox::computePositionedLogicalHeightUsing): Ditto.
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced): Ditto.
+        (WebCore::RenderBox::computePositionedLogicalHeightReplaced): Ditto.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX): Ditto.
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY): Ditto.
+        (WebCore::RenderBoxModelObject::paddingTop): Ditto.
+        (WebCore::RenderBoxModelObject::paddingBottom): Ditto.
+        (WebCore::RenderBoxModelObject::paddingLeft): Ditto.
+        (WebCore::RenderBoxModelObject::paddingRight): Ditto.
+        (WebCore::RenderBoxModelObject::paddingBefore): Ditto.
+        (WebCore::RenderBoxModelObject::paddingAfter): Ditto.
+        (WebCore::RenderBoxModelObject::paddingStart): Ditto.
+        (WebCore::RenderBoxModelObject::paddingEnd): Ditto.
+        (WebCore::RenderBoxModelObject::getBackgroundRoundedRect): Ditto.
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Ditto.
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Ditto.
+        (WebCore::computeBorderImageSide): Ditto.
+        (WebCore::RenderBoxModelObject::paintNinePieceImage): Ditto.
+        (WebCore::RenderBoxModelObject::paintBorder): Ditto.
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Ditto.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild): Ditto.
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Ditto.
+        (WebCore::RenderFlexibleBox::runFreeSpaceAllocationAlgorithm): Ditto.
+        * rendering/RenderInline.cpp:
+        (WebCore::computeMargin): Ditto.
+        (WebCore::RenderInline::lineHeight): Ditto.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth): Ditto.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Ditto.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::viewportSize): New function to fetch the current viewport size.
+        (RenderObject):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint): Modified to support viewport relative Length types.
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::calcScrollbarThicknessUsing): Ditto.
+        (WebCore::RenderScrollbarPart::computeScrollbarWidth): Ditto.
+        (WebCore::RenderScrollbarPart::computeScrollbarHeight): Ditto.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::computeLogicalWidth): Ditto.
+        (WebCore::RenderTable::convertStyleLogicalWidthToComputedWidth): Ditto.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::logicalHeightForRowSizing): Ditto.
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight): Ditto.
+        * rendering/RenderText.h:
+        (WebCore::RenderText::marginLeft): Ditto.
+        (WebCore::RenderText::marginRight): Ditto.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Ditto.
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): Ditto.
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::verticalPositionForBox): Ditto.
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::calcRadiiFor): Ditto.
+        (WebCore::RenderStyle::getRoundedBorderFor): Ditto.
+        * rendering/style/RenderStyle.h: Ditto.
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::resolveLengthAttributeForSVG): Ditto.
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth): Ditto.
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight): Ditto.
+
+2012-03-02  Pablo Flouret  <pablof@motorola.com>
+
+        Editor's default paragraph separator is not reset when a frame's document is changed
+        https://bugs.webkit.org/show_bug.cgi?id=80065
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: editing/execCommand/reset-values-after-navigation.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::clear):
+
+2012-03-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Have a copy of plug-in sandboxing API header in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=80185
+        <rdar://problem/8242128>
+
+        Reviewed by Anders Carlsson.
+
+        * plugins/npapi-sandbox.h: Added.
+
+        * WebCore.xcodeproj/project.pbxproj: Added as unused file.
+
+2012-03-02  Emil A Eklund  <eae@chromium.org>
+
+        Revert borders to integers for subpixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=80175
+
+        Reviewed by Eric Seidel.
+
+        Change border representation and calculation back to integers to ensure
+        that borders given the same width are rendered with the same actual width.
+
+        This will also avoid unnecessary type conversions when we switch over
+        to subpixel precision.
+
+        No new tests.
+
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRect):
+        (WebCore):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::borderTop):
+        (WebCore::RenderBoxModelObject::borderBottom):
+        (WebCore::RenderBoxModelObject::borderLeft):
+        (WebCore::RenderBoxModelObject::borderRight):
+        (WebCore::RenderBoxModelObject::borderBefore):
+        (WebCore::RenderBoxModelObject::borderAfter):
+        (WebCore::RenderBoxModelObject::borderStart):
+        (WebCore::RenderBoxModelObject::borderEnd):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::convertStyleLogicalWidthToComputedWidth):
+        (WebCore::RenderTable::calcBorderStart):
+        (WebCore::RenderTable::calcBorderEnd):
+        (WebCore::RenderTable::borderBefore):
+        (WebCore::RenderTable::borderAfter):
+        (WebCore::RenderTable::outerBorderBefore):
+        (WebCore::RenderTable::outerBorderAfter):
+        (WebCore::RenderTable::outerBorderStart):
+        (WebCore::RenderTable::outerBorderEnd):
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::borderStart):
+        (WebCore::RenderTable::borderEnd):
+        (RenderTable):
+        (WebCore::RenderTable::borderLeft):
+        (WebCore::RenderTable::borderRight):
+        (WebCore::RenderTable::borderTop):
+        (WebCore::RenderTable::borderBottom):
+        (WebCore::RenderTable::outerBorderLeft):
+        (WebCore::RenderTable::outerBorderRight):
+        (WebCore::RenderTable::outerBorderTop):
+        (WebCore::RenderTable::outerBorderBottom):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        (WebCore::RenderTableCell::borderLeft):
+        (WebCore::RenderTableCell::borderRight):
+        (WebCore::RenderTableCell::borderTop):
+        (WebCore::RenderTableCell::borderBottom):
+        (WebCore::RenderTableCell::borderStart):
+        (WebCore::RenderTableCell::borderEnd):
+        (WebCore::RenderTableCell::borderBefore):
+        (WebCore::RenderTableCell::borderAfter):
+        (WebCore::RenderTableCell::borderHalfLeft):
+        (WebCore::RenderTableCell::borderHalfRight):
+        (WebCore::RenderTableCell::borderHalfTop):
+        (WebCore::RenderTableCell::borderHalfBottom):
+        (WebCore::RenderTableCell::borderHalfStart):
+        (WebCore::RenderTableCell::borderHalfEnd):
+        (WebCore::RenderTableCell::borderHalfBefore):
+        (WebCore::RenderTableCell::borderHalfAfter):
+        (WebCore::RenderTableCell::paintCollapsedBorders):
+        * rendering/RenderTableCell.h:
+        (RenderTableCell):
+
+2012-03-01  Eric Seidel  <eric@webkit.org>
+
+        Chrome 18 fails html5test.com XHR Blob response test
+        https://bugs.webkit.org/show_bug.cgi?id=76760
+
+        Reviewed by Adam Barth.
+
+        Most of the code was already there, this just fixes the FIXME
+        which was causing this feature not to work.  Chromium already
+        had this #ifdef enabled, but other ports (at least Mac) do not.
+
+        Test: fast/files/xhr-response-blob.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didFinishLoading):
+
+2012-03-02  Kentaro Hara  <haraken@chromium.org>
+
+        Revert Worker-related APIs from DOMWindowWorker.idl back to DOMWindow.idl
+        https://bugs.webkit.org/show_bug.cgi?id=80151
+
+        Reviewed by Adam Barth.
+
+        Based on the discussion on webkit-dev@
+        (http://markmail.org/message/kagvswmah67zmrry#query:+page:1+mid:h34vzbiu5suub3ld+state:results),
+        this patch reverts Worker-related APIs from DOMWindowWorker.idl back to DOMWindow.idl.
+
+        No tests. No change in behavior.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * page/DOMWindow.idl:
+        * workers/DOMWindowWorker.idl: Removed.
+
+2012-03-02  Kentaro Hara  <haraken@chromium.org>
+
+        Revert HTML-related APIs from DOMWindowHTML.idl back to DOMWindow.idl
+        https://bugs.webkit.org/show_bug.cgi?id=80140
+
+        Reviewed by Adam Barth.
+
+        Based on the discussion on webkit-dev@
+        (http://markmail.org/message/kagvswmah67zmrry#query:+page:1+mid:h34vzbiu5suub3ld+state:results),
+        we should revert HTML-related APIs from DOMWindowHTML.idl back to DOMWindow.idl.
+
+        No tests. No change in behavior.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/DOMWindowHTML.idl: Removed.
+        * page/DOMWindow.idl:
+
+2012-03-02  Kentaro Hara  <haraken@chromium.org>
+
+        Revert XML-related APIs from DOMWindowXML.idl back to DOMWindow.idl
+        https://bugs.webkit.org/show_bug.cgi?id=80148
+
+        Reviewed by Adam Barth.
+
+        Based on the discussion on webkit-dev@
+        (http://markmail.org/message/kagvswmah67zmrry#query:+page:1+mid:h34vzbiu5suub3ld+state:results),
+        this patch reverts XML-related APIs from DOMWindowXML.idl back to DOMWindow.idl.
+
+        No tests. No change in behavior.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/DOMWindow.idl:
+        * xml/DOMWindowXML.idl: Removed.
+
+2012-03-02  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Implement NamedNodeMap::setNamedItem() in terms of Element::setAttributeNode() instead of the other way round
+        https://bugs.webkit.org/show_bug.cgi?id=80188
+
+        Reviewed by Ryosuke Niwa.
+
+        Using setNamedItem() in setAttributeNode() implementation made us do unnecessary
+        checks like whether the element existed or whether the given node was an
+        attribute. So now setAttributeNode() do less work.
+
+        No new tests were added, functionality should be unchanged.
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeNode):
+        (WebCore::Element::setAttributeNodeNS):
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::attributes): We got rid of ensureUpdatedAttributes(), next in
+        line will be updatedAttributes().
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::setNamedItem):
+
+2012-03-02  SravanKumar Sandela  <ssandela@innominds.com>
+
+        Layout issue with fieldset legend element
+        https://bugs.webkit.org/show_bug.cgi?id=78684
+
+        Reviewed by Dirk Pranke.
+
+        The clipping logic for legend element was incorrect and now it has been corrected by taking correct offset in to consideration. 
+
+        Test: fast/forms/fieldset-legend-padding-unclipped-fieldset-border.html
+
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+
+2012-03-02  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Bindings for node always check if they are a Document.
+        https://bugs.webkit.org/show_bug.cgi?id=79947
+
+        Reviewed by Adam Barth.
+
+        This changes the generated bindings code to only generate the Document code for the Document wrappers.
+
+        No new tests. Covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateToV8Converters):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore::V8Float64Array::wrapSlow):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::V8TestActiveDOMObject::wrapSlow):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore::V8TestCustomNamedGetter::wrapSlow):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore::V8TestEventConstructor::wrapSlow):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore::V8TestEventTarget::wrapSlow):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::wrapSlow):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore::V8TestMediaQueryListListener::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructor::wrapSlow):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::V8TestObj::wrapSlow):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::V8TestSerializedScriptValueInterface::wrapSlow):
+
+2012-03-02  Igor Oliveira  <igor.o@sisa.samsung.com>
+
+        animation-timing-function falls back to ease when overriding animation-name
+        https://bugs.webkit.org/show_bug.cgi?id=71623
+
+        In this patch the animation name needs to be the first value declared, if
+        a different value is found, we do not check for the animation name again.  
+
+        Reviewed by Dean Jackson.
+
+        Test: animations/animation-shorthand-overriding.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAnimationShorthand):
+
+2012-03-02  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [AC] Connect WebGL to the TextureMapperGL code
+        https://bugs.webkit.org/show_bug.cgi?id=78968
+
+        Reviewed by Gustavo Noronha Silva.
+
+        No new tests. This is covered by existing accelerated compositing and
+        WebGL tests.
+
+        Rely on the shared version of GL acquisition from GLContext. This reduces
+        a lot of code and now allows us to connect WebGL into the accelerated compositing
+        rendering path.
+
+        * GNUmakefile.list.am: GLContext should be included for all X11 builds now.
+        There are no longer GTK+ specific versions of GraphicsContext3D.
+        * platform/graphics/GraphicsContext3D.h: Add a default argument for
+        resolveMultisamplingIfNecessary. This will resolve the entire texture.
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp: GraphicsContext3D is
+        now responsible for creating GraphicsContext3DPrivate in the constructor.
+        (WebCore::GraphicsContext3D::platformLayer): Now return m_private.
+        * platform/graphics/cairo/GraphicsContext3DPrivate.cpp: Added.
+        * platform/graphics/cairo/GraphicsContext3DPrivate.h: Renamed from Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.h.
+        * platform/graphics/glx/GraphicsContext3DPrivate.cpp: Removed.
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::resolveMultisamplingIfNecessary): Properly
+        handle the default argument.
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::prepareTexture): Use the new default argument now.
+        (WebCore::GraphicsContext3D::readRenderingResults): Ditto.
+
+2012-02-18  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [AC] Generalize WindowContextGL
+        https://bugs.webkit.org/show_bug.cgi?id=78969
+
+        Reviewed by Gustavo Noronha Silva.
+
+        No new tests. This should not change functionality.
+
+        * GNUmakefile.list.am: Added new files to source list.
+        * platform/graphics/cairo/GLContext.h: Added. An abstraction for all GL contexts.
+        * platform/graphics/glx/GLContextGLX.cpp: Added. This file is composed of very little
+        new code, as the logic for instantiating offscreen GL contexts is copied from
+        GraphicsContext3DPrivate. The code duplication will be removed in a followup patch.
+        (WebCore::GLContext::platformContext):
+        * platform/graphics/gtk/GLContextGtk.cpp: Added. This includes some helper factories
+        for creating and caching GL contexts for GTK+ widgets.
+
+2012-03-02  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Remove TRACE_EVENT from CCQuadCuller::cullOccludedQuads.
+        https://bugs.webkit.org/show_bug.cgi?id=80174
+
+        Reviewed by James Robinson.
+
+        Covered by existing chromium unit tests.
+
+        Firing TRACE_EVENT once per draw quad is overwhelming.
+
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        (WebCore::CCQuadCuller::cullOccludedQuads):
+
+2012-03-02  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Make inline event attributes use evt for SVG and event otherwise
+        https://bugs.webkit.org/show_bug.cgi?id=80167
+
+        Reviewed by Ojan Vafai.
+
+        Test: fast/dom/inline-event-attributes-event-param-name.html
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+
+2012-03-02  Gavin Peters  <gavinp@chromium.org>
+
+        Sync PageCache debugging with PageCache behaviour
+        https://bugs.webkit.org/show_bug.cgi?id=79943
+
+        Sync up the debug printing code in PageCache with the actual logic,
+        and clean up the debug printing at the same time.
+
+        Reviewed by Brady Eidson.
+
+        No new tests, as this is a refactor of debug only code.
+
+        * history/PageCache.cpp:
+        (WebCore):
+        (WebCore::logCanCacheFrameDecision):
+        (WebCore::logCanCachePageDecision):
+
+2012-03-02  Maciej Stachowiak  <mjs@apple.com>
+
+        REGRESSION(r97353): Crash when accessing location or history properties inside a navigated window
+        https://bugs.webkit.org/show_bug.cgi?id=80133
+        <rdar://problem/10432233>
+        
+        Reviewed by Antti Koivisto.
+
+        Test: fast/dom/Window/navigated-window-properties.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore): Remove custom getters for window.location and window.history; they
+        were unnecessary and did the wrong thing when DOMWindow returned null values 
+        for these.
+        * page/DOMWindow.idl: ditto
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException): Remove assert about null values and update comment,
+        since this is now an expected state for navigated inner windows.
+
+2012-03-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r74971): Can't select a line of RTL text on Facebook
+        https://bugs.webkit.org/show_bug.cgi?id=59435
+
+        Reviewed by Eric Seidel.
+
+        The bug was caused by inline text boxes created by BRs being placed at the end of the line
+        according to the block's direction regardless of its unicode bidi-level. e.g. if we have
+        <div dir="rtl"><span dir="ltr">hello<br>world</span></div>
+        the inline box generated by the br has the bidi-level of 2 like the rest of text in the span.
+        This inline text box gives an illusion of having text on the left of "hello" to hit testing
+        and editing code and causes all sorts of problems.
+
+        Fixed the bug by replacing calls to nextLeafChild and prevLeafChild by newly introduced
+        nextLeafChildIgnoringLineBreak and prevLeafChildIgnoringLineBreak. These two functions will
+        return 0 when they hit the end of a line or inline text box that's a line break. In effect,
+        hit testing and editing code can ignore inline boxes generated by br's.
+
+        In the long term, we should move these two functions into RenderedPosition along with the rest
+        of code that converts a Position and an inline box, offset pair.
+
+        Test: editing/selection/select-line-break-with-opposite-directionality.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+        * editing/RenderedPosition.cpp:
+        (WebCore::RenderedPosition::prevLeafChild):
+        (WebCore::RenderedPosition::nextLeafChild):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::nextLeafChildIgnoringLineBreak):
+        (WebCore::InlineBox::prevLeafChildIgnoringLineBreak):
+        * rendering/InlineBox.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+        * rendering/RenderText.cpp:
+        (WebCore::lineDirectionPointFitsInBox): If we're on the left of a RTL line, we should stay at
+        upstream position since we're at the end of a line.
+        (WebCore::createVisiblePositionAfterAdjustingOffsetForBiDi): Merge the two special cases into
+        the general loop as the comment suggests. Skip an inline text box for a line break at the left
+        edge when there are more line boxes on the line.
+        (WebCore::RenderText::positionForPoint):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::closestLeafChildForLogicalLeftPosition): Ignore line boxes created for
+        line boxes when there are other boxes on the line.
+
+2012-03-02  Adam Treat  <atreat@rim.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80161
+        PR: 141157
+
+        BlackBerryPlatformScreen.h API has been updated.  Reflect those
+        changes in our usage.
+
+        Reviewed by Antonio Gomes.
+        Internally reviewed by Jakob Petsovits
+
+        * platform/blackberry/PlatformScreenBlackBerry.cpp:
+        (WebCore::screenAvailableRect):
+        (WebCore::screenRect):
+
+2012-03-02  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Move the 'overflow' event dispatching logic out of RenderLayer
+        https://bugs.webkit.org/show_bug.cgi?id=80090
+
+        Unreviewed build fix.
+
+        * rendering/RenderBlock.cpp:
+        (OverflowEventDispatcher): Removed the unused function.
+
+2012-03-02  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Move the 'overflow' event dispatching logic out of RenderLayer
+        https://bugs.webkit.org/show_bug.cgi?id=80090
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/events/overflow-events-writing-mode.html
+
+        This moves the 'overflow' event dispatch from RenderLayer to an helper class
+        OverflowEventDispatcher. For now, the class lives in RenderBlock as it matches
+        the existing code but it may be moved later to its own class as FrameView could
+        benefit from it too or if we need to support 'overflow' events on RenderBoxes.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore):
+        (OverflowEventDispatcher):
+        (WebCore::OverflowEventDispatcher::OverflowEventDispatcher):
+        (WebCore::OverflowEventDispatcher::~OverflowEventDispatcher):
+        (WebCore::OverflowEventDispatcher::computeOverflowStatus):
+        RAII dispatcher class that stores the information before layout and compare
+        them after to dispatch the right information.
+
+        (WebCore::RenderBlock::layout): Added an instance of OverflowEventDispatcher.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::hasHorizontalLayoutOverflow):
+        (WebCore::RenderBox::hasVerticalLayoutOverflow):
+        Helper method to know if we have an horizontal / vertical layout overflow.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        * rendering/RenderLayer.h:
+        Removed the scroll tracking logic as we don't need it anymore. This removes
+        3 booleans from RenderLayer.
+
+2012-03-02  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Create a method in Element to compare attributes with other Element
+        https://bugs.webkit.org/show_bug.cgi?id=80169
+
+        Reviewed by Ryosuke Niwa.
+
+        Avoid manually peeking at attribute storage to get this information. This
+        simplify the callsites. The actual implementation of comparison was moved to
+        ElementAttributeData. The mapsEquivalent() function still exists for the sake
+        of DocumentType nodes.
+
+        * dom/Element.cpp:
+        (WebCore::Element::hasEquivalentAttributes):
+        (WebCore):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::isEquivalent):
+        (WebCore):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::mapsEquivalent):
+        * dom/Node.cpp:
+        (WebCore::Node::isEqualNode):
+        * editing/htmlediting.cpp:
+        (WebCore::areIdenticalElements): Use Element::hasTagName() instead of matching
+        directly to make code a bit clearer.
+
+2012-03-02  Zan Dobersek  <zandobersek@gmail.com>
+
+        [GTK] Smooth scrolling support
+        https://bugs.webkit.org/show_bug.cgi?id=16123
+
+        Reviewed by Martin Robinson.
+
+        No new tests - no new functionality.
+
+        Add the ScrollAnimatorNone class to compilation and enable
+        the smooth scrolling feature by default at compilation time.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+
+2012-03-02  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] media/media-can-play-flac-audio.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=80124
+
+        Reviewed by Martin Robinson.
+
+        Handle audio/x-flac in the mimeTypeCache() function so that we
+        advertize both audio/flac and audio/x-flac.
+
+        No new tests, this is covered already by media/media-can-play-flac-audio.html.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+
+2012-03-02  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: fix fronted compilation.
+        https://bugs.webkit.org/show_bug.cgi?id=80154
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.scriptForSourceID):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyLocation):
+        * inspector/front-end/ScriptsSearchScope.js:
+        (WebInspector.ScriptsSearchResultsPane.prototype.createAnchor):
+
+2012-03-02  Kaustubh Atrawalkar  <kaustubh@motorola.com>
+
+        Rename DOMURL to URL in the bindings
+        https://bugs.webkit.org/show_bug.cgi?id=78214
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. Interface name change.
+
+        * html/DOMURL.idl: Added InterfaceName attribute to DOMURL.
+
+2012-03-02  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Add :scope pseudo-class
+        https://bugs.webkit.org/show_bug.cgi?id=79077
+
+        Add :scope pseudo class name & pseudoId
+        Add selector check for the new pseudo-class
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/css/style-scoped/scope-pseudo.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector):
+
+2012-03-01  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Make parser code not depend on NamedNodeMap
+        https://bugs.webkit.org/show_bug.cgi?id=79963
+
+        Reviewed by Adam Barth.
+
+        Instead of creating Element-less NamedNodeMaps, the parsing code now creates
+        AttributeVectors, that are used to fill Element via the parserSetAttributes()
+        method. This allows us to remove even more methods from the NamedNodeMap.
+
+        The AttributeVector class contains convenience methods that take the attribute's
+        QualifiedName as parameter. This class is also used inside ElementAttributeData.
+
+        * dom/Attr.h:
+        (Attr):
+        * dom/Element.cpp:
+        (WebCore::Element::getAttribute):
+        (WebCore::Element::parserSetAttributes): Now we have to create the attribute
+        storage, and fill it (by Vector::swap()) with the passed attributes. Also use an
+        early return to reduce indentation.
+        (WebCore::Element::insertedIntoDocument):
+        (WebCore::Element::removedFromDocument):
+        (WebCore::Element::getURLAttribute):
+        (WebCore::Element::getNonEmptyURLAttribute):
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::fastHasAttribute):
+        (WebCore::Element::fastGetAttribute):
+        (WebCore::Element::hasAttributesWithoutUpdate):
+        (WebCore::Element::attributeItem):
+        (WebCore::Element::getAttributeItem):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::AttributeVector::removeAttribute):
+        (WebCore):
+        * dom/ElementAttributeData.h:
+        (AttributeVector):
+        (WebCore::AttributeVector::create):
+        (WebCore::AttributeVector::attributeItem):
+        (WebCore::AttributeVector::AttributeVector):
+        (WebCore):
+        (WebCore::AttributeVector::getAttributeItem):
+        (WebCore::AttributeVector::getAttributeItemIndex):
+        (WebCore::AttributeVector::insertAttribute): Boolean parameter isn't necessary
+        since all the callers used 'false', indicating that duplicates were not allowed.
+        (WebCore::ElementAttributeData::attributeItem):
+        (WebCore::ElementAttributeData::getAttributeItem):
+        (WebCore::ElementAttributeData::getAttributeItemIndex):
+        (ElementAttributeData):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::getNamedItem):
+        (WebCore::NamedNodeMap::setNamedItem):
+        (WebCore::NamedNodeMap::removeNamedItem):
+        (WebCore::NamedNodeMap::mapsEquivalent):
+        * dom/NamedNodeMap.h:
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
+        (WebCore::HTMLConstructionSite::mergeAttributesFromTokenIntoElement):
+        (WebCore::HTMLConstructionSite::insertScriptElement):
+        (WebCore::HTMLConstructionSite::createElement):
+        (WebCore::HTMLConstructionSite::createHTMLElement):
+        (WebCore):
+        * html/parser/HTMLToken.h:
+        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processFakeStartTag):
+        (WebCore::HTMLTreeBuilder::attributesForIsindexInput):
+        (WebCore):
+        * html/parser/HTMLTreeBuilder.h:
+        * html/parser/TextDocumentParser.cpp:
+        (WebCore::TextDocumentParser::insertFakePreElement):
+        * xml/parser/MarkupTokenBase.h:
+        (WebCore::AtomicMarkupTokenBase::AtomicMarkupTokenBase):
+        (WebCore::AtomicMarkupTokenBase::attributes):
+        (WebCore::AtomicMarkupTokenBase::takeAttributes):
+        (AtomicMarkupTokenBase):
+        (WebCore::::initializeAttributes):
+        * xml/parser/XMLToken.h:
+        (WebCore::AtomicXMLToken::AtomicXMLToken):
+        * xml/parser/XMLTreeBuilder.cpp:
+        (WebCore::XMLTreeBuilder::processNamespaces):
+        (WebCore::XMLTreeBuilder::processAttributes):
+
+2012-03-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: assertion failure in JSMainThreadExecState::instrumentedCall
+        https://bugs.webkit.org/show_bug.cgi?id=80152
+
+        Extracted common code of JS call instrumentation into instrumentFunctionCall method
+        and call it directly where the instrumentation is needed instead of calling
+        JSMainThreadExecState::instrumentedCall which works on the main thread only.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSMainThreadExecState.h:
+        (WebCore::JSMainThreadExecState::instrumentFunctionCall):
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLTextAreaElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80101
+
+        Reviewed by Kent Tamura.
+
+        No new tests. No behavior changes.
+
+        * html/HTMLTextAreaElement.idl: Reorder attribute/method position.
+
+2012-03-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix after r109538.
+
+        * CMakeLists.txt:
+        * Modules/websockets/WebSocketDeflater.cpp:
+
+2012-03-02  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Scoped stylesheets don't appear to work in Shadow DOM
+        https://bugs.webkit.org/show_bug.cgi?id=79549
+
+        Make the scope stack in CSSStyleSelector use ContainerNode* instead of Element*.
+        Adapt using sites accordingly.
+        Push the ShadowRoot to the scope stack in the same way that elements are pushed.
+        Fix an issue with removedFromDocument() on destruction.
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/css/style-scoped/style-scoped-in-shadow.html
+
+        * css/CSSStyleSelector.cpp:
+        (RuleSet):
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::CSSStyleSelector::determineScope):
+        (WebCore::CSSStyleSelector::ruleSetForScope):
+        (WebCore::CSSStyleSelector::appendAuthorStylesheets):
+        (WebCore::CSSStyleSelector::setupScopeStack):
+        (WebCore::CSSStyleSelector::pushScope):
+        (WebCore):
+        (WebCore::CSSStyleSelector::popScope):
+        (WebCore::CSSStyleSelector::pushParentElement):
+        (WebCore::CSSStyleSelector::popParentElement):
+        (WebCore::CSSStyleSelector::pushParentShadowRoot):
+        (WebCore::CSSStyleSelector::popParentShadowRoot):
+        (WebCore::CSSStyleSelector::matchScopedAuthorRules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+        (WebCore::CSSStyleSelector::pushScope):
+        (WebCore::CSSStyleSelector::popScope):
+        (WebCore::CSSStyleSelector::MatchOptions::MatchOptions):
+        (MatchOptions):
+        (WebCore::CSSStyleSelector::scopeStackIsConsistent):
+        (WebCore::CSSStyleSelector::ScopeStackFrame::ScopeStackFrame):
+        (ScopeStackFrame):
+        * css/SelectorChecker.h:
+        (SelectorCheckingContext):
+        * dom/Element.cpp:
+        (WebCore::StyleSelectorParentPusher::push):
+        (WebCore::StyleSelectorParentPusher::~StyleSelectorParentPusher):
+        (WebCore::Element::beginParsingChildren):
+        (WebCore::Element::finishParsingChildren):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::attach):
+        (WebCore):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::recalcShadowTreeStyle):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::removedFromDocument):
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLSelectElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80097
+
+        Reviewed by Kent Tamura.
+
+        No new tests. No behavior changes.
+
+        * html/HTMLSelectElement.idl: Reorder attribute/method position.
+
+2012-03-02  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: limit RawSourceCode usages to DebuggerPresentationModel.
+        https://bugs.webkit.org/show_bug.cgi?id=80146
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.uiLocationToRawLocation):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyLocation):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyRawLocation):
+        * inspector/front-end/ObjectPopoverHelper.js:
+        (WebInspector.ObjectPopoverHelper.prototype._showObjectPopover.showObjectPopover.):
+        (WebInspector.ObjectPopoverHelper.prototype._showObjectPopover):
+        * inspector/front-end/ScriptsSearchScope.js:
+        (WebInspector.ScriptsSearchResultsPane.prototype.createAnchor):
+
+2012-03-02  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: update execution line using LiveLocation.
+        https://bugs.webkit.org/show_bug.cgi?id=80143
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype._uiSourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerResumed):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame.updateExecutionLine):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+
+2012-03-02  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Build fix for LocalizedStringsBlackBerry.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80099
+
+        Unreviewed build fix.
+
+        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
+
+2012-03-02  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Fix build on AppleWebKit after 109548.
+
+        * WebCore.exp.in:
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLOptionElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80095
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. No behavior changes.
+
+        * html/HTMLOptionElement.idl: Reorder attribute/method position.
+
+2012-03-02  Adam Barth  <abarth@webkit.org>
+
+        WorkerContext shouldn't know about IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=80094
+
+        Reviewed by Kentaro Hara.
+
+        There are still a couple IndexedDB stragglers we should clean up in
+        WebCore proper.  This patch moves some IndexedDB logic from
+        WorkerContext into the indexeddb module.
+
+        In the process of writing this patch, I noticed that some IndexedDB
+        files were missing from various build systems, so I added them.  I
+        suspect that means IndexedDB is only enabled by default on Chromium.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Modules/indexeddb/WorkerContextIndexedDatabase.cpp: Added.
+        (WebCore):
+        (WebCore::WorkerContextIndexedDatabase::WorkerContextIndexedDatabase):
+        (WebCore::WorkerContextIndexedDatabase::~WorkerContextIndexedDatabase):
+        (WebCore::WorkerContextIndexedDatabase::from):
+        (WebCore::WorkerContextIndexedDatabase::webkitIndexedDB):
+        * Modules/indexeddb/WorkerContextIndexedDatabase.h: Added.
+        (WebCore):
+        (WorkerContextIndexedDatabase):
+        * Modules/indexeddb/WorkerContextIndexedDatabase.idl: Added.
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * workers/WorkerContext.cpp:
+        (WebCore):
+        * workers/WorkerContext.h:
+        (WebCore):
+        (WorkerContext):
+        * workers/WorkerContext.idl:
+
+2012-03-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Compile WebCore without QtWidgets
+        https://bugs.webkit.org/show_bug.cgi?id=80141
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Target.pri: Don't add widgets to QT.
+        * WebCore.pri: Use QT += opengl only with Qt 4, because it has an implicit QtWidgets
+        dependency. With Qt 5 all necessary OpenGL API is part of QtGui (with a QOpenGL* prefix).
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLFormElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80093
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. No behavior changes
+
+        * html/HTMLFormElement.idl: Reorder attribute/method position.
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLButtonElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80091
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. No behavior changes.
+
+        * html/HTMLButtonElement.idl: Reorder attribute/method position.
+
+2012-03-02  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Suspend/Resume API for pausing timers and animations.
+        https://bugs.webkit.org/show_bug.cgi?id=76063
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * dom/ActiveDOMObject.h:
+            New ReasonForSuspension: PageWillBePaused.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::suspend): Handle new ReasonForSuspension.
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::setDocument):
+        (WebCore::Frame::suspendActiveDOMObjectsAndAnimations):
+        (WebCore::Frame::resumeActiveDOMObjectsAndAnimations):
+        * page/Frame.h:
+        (WebCore::Frame::activeDOMObjectsAndAnimationsSuspended):
+            Frame now maintains a state of suspending animation and ActiveDOMObjects,
+            which is inherited to all child-frames.
+        * page/Page.cpp:
+        (WebCore::Page::suspendActiveDOMObjectsAndAnimations):
+        (WebCore::Page::resumeActiveDOMObjectsAndAnimations):
+        * page/Page.h:
+            Functions for suspending and resuming active DOM objects and animations in all frames.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::willRenderImage):
+            WillRenderImage now checks for suspension. This causes animated images to pause
+            together with all other types of animations.
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLFieldSetElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80092
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. No behavior changes.
+
+        * html/HTMLFieldSetElement.idl: Reorder attribute/method position.
+
+2012-03-02  Antti Koivisto  <antti@apple.com>
+
+        possible regression: r104060 maybe causing crashes
+        https://bugs.webkit.org/show_bug.cgi?id=75676
+
+        Rubber-stamped by Simon Hausmann.
+
+        Remove the speculative fix (the problem was elsewhere, http://trac.webkit.org/changeset/104845).
+
+        Also remove the debugging code added for this bug.
+    
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::clearStyleSelector):
+        (WebCore::Document::updateActiveStylesheets):
+        * dom/Document.h:
+        (Document):
+
+2012-03-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Implement suggestions in Watch Expressions
+        https://bugs.webkit.org/show_bug.cgi?id=79912
+
+        Drive-by: make subproperties in ObjectPropertySections editable
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype.completionsForTextPrompt):
+        * inspector/front-end/DatabaseQueryView.js:
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.ondblclick):
+        (WebInspector.ObjectPropertyTreeElement.prototype.renderPromptAsBlock):
+        (WebInspector.ObjectPropertyTreeElement.prototype.elementAndValueToEdit):
+        (WebInspector.ObjectPropertyTreeElement.prototype.startEditing.blurListener):
+        (WebInspector.ObjectPropertyTreeElement.prototype.startEditing):
+        (WebInspector.ObjectPropertyTreeElement.prototype.editingEnded):
+        (WebInspector.ObjectPropertyTreeElement.prototype.editingCancelled):
+        (WebInspector.ObjectPropertyTreeElement.prototype.editingCommitted):
+        (WebInspector.ObjectPropertyTreeElement.prototype._promptKeyDown):
+        (WebInspector.ObjectPropertyPrompt):
+        * inspector/front-end/StylesSidebarPane.js:
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.complete):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionTreeElement.prototype.renderPromptAsBlock):
+        (WebInspector.WatchExpressionTreeElement.prototype.elementAndValueToEdit):
+        (WebInspector.WatchExpressionTreeElement.prototype.editingCancelled):
+        * inspector/front-end/inspector.css:
+        (.watch-expressions > li.editing-sub-part .text-prompt):
+
+2012-03-02  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION (r104060): Page contents not painted if inserting a new stylesheet and temporary body node
+        https://bugs.webkit.org/show_bug.cgi?id=76590
+
+        Reviewed by Maciej Stachowiak.
+
+        Test: fast/css/pending-stylesheet-repaint.html
+        
+        If there has been a style recalc with a pending stylesheet, the forced repaint will need to be triggered even
+        if the stylesheet doesn't affect the rendering. Otherwise we may end up never painting at all.
+
+        * dom/Document.cpp:
+        (WebCore::Document::styleSelectorChanged):
+
+2012-03-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move QStyle theming code out of WebCore into WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=80128
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moved QStyle dependant code into WebKit1, where it's okay to depend on
+        QtWidgets/QStyle. Added factory hooks into RenderThemeQt to allow changing
+        the default "mobile" style to QStyle on start-up.
+
+        * Target.pri:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore):
+        (WebCore::RenderThemeQt::setCustomTheme):
+        (WebCore::RenderThemeQt::customScrollbarTheme):
+        (WebCore::createTheme):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
+        * platform/qt/RenderThemeQt.h:
+        (WebCore):
+        (RenderThemeQt):
+        * platform/qt/RenderThemeQtMobile.cpp:
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarTheme::nativeTheme):
+
+2012-03-02  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitColumnRuleStyle in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80085
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: enable Timeline panel for workers
+        https://bugs.webkit.org/show_bug.cgi?id=80130
+
+        Enabled Timeline panel for worker inspector. Refactored
+        JS function calls instrumentation to work for both
+        worker contexts and documents.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSMainThreadExecState.h:
+        (WebCore):
+        (WebCore::JSMainThreadExecState::instrumentedCall):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptExecutionContextFromScriptState):
+        (WebCore):
+        * bindings/js/ScriptState.h:
+        (WebCore):
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::scriptExecutionContext):
+        (WebCore):
+        (WebCore::scriptExecutionContextFromScriptState):
+        * bindings/v8/ScriptState.h:
+        (WebCore):
+        (ScriptState):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::instrumentedCallFunction):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::callListenerFunction):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::callFunctionWithEvalEnabled):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::instrumentingAgentsForNonDocumentContext):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willCallFunction):
+        (WebCore):
+        (WebCore::InspectorInstrumentation::instrumentingAgentsForContext):
+        * inspector/WorkerInspectorController.cpp:
+        (WebCore::WorkerInspectorController::WorkerInspectorController):
+        (WebCore::WorkerInspectorController::connectFrontend):
+        (WebCore::WorkerInspectorController::disconnectFrontend):
+        (WebCore::WorkerInspectorController::restoreInspectorStateFromCookie):
+        * inspector/WorkerInspectorController.h:
+        (WebCore):
+        (WorkerInspectorController):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2012-03-02  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Add WebSocketDeflateFramer class which handles deflate-frame extension.
+        This class encapsulates WebSocketDeflater and WebSocketInflater classes,
+        which depend on zlib, so that WebSocketChannel is not necessary to aware
+        zlib dependency.
+
+        Reviewed by Kent Tamura.
+
+        Tests: http/tests/websocket/tests/hybi/compressed-control-frame.html
+               http/tests/websocket/tests/hybi/deflate-frame-comp-bit-onoff.html
+               http/tests/websocket/tests/hybi/deflate-frame-invalid-parameter.html
+               http/tests/websocket/tests/hybi/deflate-frame-parameter.html
+
+        * CMakeLists.txt: Added WebSocketDeflateFramer.(cpp|h)
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.gyp/WebCore.gyp: Added zlib dependency.
+        * WebCore.vcproj/WebCore.vcproj: Added WebSocketDeflateFramer.(cpp|h)
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect): Set m_extensions.
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect): Add deflate-frame extension processor to WebSocketHanshake if deflate can use.
+        (WebCore::WebSocketChannel::fail): Call m_deflateFramer.didFail().
+        (WebCore::WebSocketChannel::processFrame): Decompress frames if needed.
+        (WebCore::WebSocketChannel::sendFrame): Compress frames if possible.
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketDeflateFramer.cpp: Added.
+        (WebCore):
+        (WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::create):
+        (WebCore::WebSocketExtensionDeflateFrame::~WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::handshakeString):
+        (WebCore::WebSocketExtensionDeflateFrame::processResponse):
+        (WebCore::DeflateResultHolder::DeflateResultHolder):
+        (WebCore::DeflateResultHolder::~DeflateResultHolder):
+        (WebCore::DeflateResultHolder::fail):
+        (WebCore::InflateResultHolder::InflateResultHolder):
+        (WebCore::InflateResultHolder::~InflateResultHolder):
+        (WebCore::InflateResultHolder::fail):
+        (WebCore::WebSocketDeflateFramer::WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::createExtensionProcessor):
+        (WebCore::WebSocketDeflateFramer::canDeflate):
+        (WebCore::WebSocketDeflateFramer::enableDeflate):
+        (WebCore::WebSocketDeflateFramer::deflate):
+        (WebCore::WebSocketDeflateFramer::resetDeflateContext):
+        (WebCore::WebSocketDeflateFramer::inflate):
+        (WebCore::WebSocketDeflateFramer::resetInflateContext):
+        (WebCore::WebSocketDeflateFramer::didFail):
+        * websockets/WebSocketDeflateFramer.h: Added.
+        (WebCore):
+        (DeflateResultHolder):
+        (WebCore::DeflateResultHolder::succeeded):
+        (WebCore::DeflateResultHolder::failureReason):
+        (InflateResultHolder):
+        (WebCore::InflateResultHolder::succeeded):
+        (WebCore::InflateResultHolder::failureReason):
+        (WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::enabled):
+
+2012-03-01  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Show meaningful description for object store items values.
+        https://bugs.webkit.org/show_bug.cgi?id=79691
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/IndexedDBModel.js:
+        (WebInspector.IndexedDBModel.idbKeyFromKey):
+        * inspector/front-end/IndexedDBViews.js:
+        (WebInspector.IDBDataView.prototype._updateData.callback):
+        (WebInspector.IDBDataView.prototype._updateData):
+        (WebInspector.IDBDataGridNode.prototype.createCell):
+        (WebInspector.IDBDataGridNode.prototype._formatValue):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.LocalJSONObject.prototype.get subtype):
+        * inspector/front-end/indexedDBViews.css:
+        (.indexed-db-data-view .data-grid .data-container td):
+        (.indexed-db-data-view .data-grid .data-container td.primaryKey-column):
+        (.indexed-db-data-view .data-grid .data-container td.primaryKey-column div.primitive-value):
+        (.indexed-db-data-view .data-grid .data-container td .section .header .title):
+
+2012-03-02  Wei James  <james.wei@intel.com>
+
+        [Chromium] Layout Test webaudio/audiobuffersource-channels.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=79765
+
+        Reviewed by Chris Rogers.
+
+        * webaudio/AudioBuffer.cpp:
+        (WebCore::AudioBuffer::create):
+        * webaudio/AudioBufferSourceNode.cpp:
+        (WebCore::AudioBufferSourceNode::setBuffer):
+        * webaudio/AudioContext.h:
+        (WebCore):
+        (AudioContext):
+        (WebCore::AudioContext::maxNumberOfChannels):
+        * webaudio/AudioNodeOutput.cpp:
+        (WebCore::AudioNodeOutput::AudioNodeOutput):
+        (WebCore::AudioNodeOutput::setNumberOfChannels):
+
+2012-03-02  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitRegionBreakAfter, CSSPropertyWebkitRegionBreakBefore and CSSPropertyWebkitRegionBreakInside in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80066
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-02  Pablo Flouret  <pablof@motorola.com>
+
+        Implement DefaultParagraphSeparator execCommand, to let authors choose the default block element
+        https://bugs.webkit.org/show_bug.cgi?id=59961
+
+        Reviewed by Ryosuke Niwa.
+
+        http://dvcs.w3.org/hg/editing/raw-file/tip/editing.html#the-defaultparagraphseparator-command
+
+        Test: editing/execCommand/default-paragraph-separator.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::Editor):
+        * editing/Editor.h:
+        (WebCore::Editor::defaultParagraphSeparator):
+        (WebCore::Editor::setDefaultParagraphSeparator):
+        (Editor):
+        * editing/EditorCommand.cpp:
+        (WebCore::executeDefaultParagraphSeparator):
+        (WebCore):
+        (WebCore::valueDefaultParagraphSeparator):
+        (WebCore::createCommandMap):
+        * editing/htmlediting.cpp:
+        (WebCore::createDefaultParagraphElement):
+
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::create):
+        (WebCore):
+        * html/HTMLParagraphElement.h:
+        (HTMLParagraphElement):
+            Added create(Document*) method that defaults to pTag as the QualifiedName.
+
+2012-03-02  Kenneth Russell  <kbr@google.com>
+
+        [chromium] Fix errors in LayerRendererChromium cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=80064
+
+        Reviewed by James Robinson.
+
+        Tested manually by forcing lost context while rendering Flash on
+        Mac OS in a Debug build.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+
+2012-03-02  Andy Estes  <aestes@apple.com>
+
+        Fix errors found when building the Mac port with ICONDATABASE disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=80059
+
+        Reviewed by Brady Eidson.
+
+        * WebCore.exp.in: Only export IconDatabase symbols when the feature is
+        enabled.
+        * loader/icon/IconDatabase.h:
+        (WebCore::IconDatabase::create): WebKit calls this static method, so it
+        should be defined on the stub class.
+        (WebCore::IconDatabase::allowDatabaseCleanup): Ditto.
+        (WebCore::IconDatabase::checkIntegrityBeforeOpening): Ditto.
+
+2012-03-02  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitColorCorrection in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80056
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-02  John Bauman  <jbauman@chromium.org>
+
+        [chromium] Send didCommitAndDrawFrame after swap
+        https://bugs.webkit.org/show_bug.cgi?id=80052
+
+        Reviewed by James Robinson.
+
+        Sending didCommitAndDrawFrame before the swap was causing plugins to
+        redraw themselves between compositing and the swap, which reduces
+        opportunities for optimization.
+
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::compositeAndReadback):
+        (WebCore::CCSingleThreadProxy::compositeImmediately):
+        (WebCore::CCSingleThreadProxy::doComposite):
+        (WebCore):
+        (WebCore::CCSingleThreadProxy::didSwapFrame):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+
+2012-03-02  Raymond Toy  <rtoy@google.com>
+
+        AudioParam needs tests for the parameter automation routines.
+        https://bugs.webkit.org/show_bug.cgi?id=77666
+
+        Reviewed by Chris Rogers.
+
+        Tests: webaudio/audioparam-linearRampToValueAtTime.html
+               webaudio/audioparam-setTargetValueAtTime.html
+               webaudio/audioparam-setValueAtTime.html
+               webaudio/audioparam-setValueCurveAtTime.html
+
+        * webaudio/AudioParamTimeline.cpp:
+        (WebCore::AudioParamTimeline::valuesForTimeRangeImpl): Round the
+        curveIndex to fix timing issue in setValueCurveAtTime.
+
+2012-03-01  Pablo Flouret  <pablof@motorola.com>
+
+        Fix code generators to correctly guard header declarations that have a [Conditional] attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=79375
+
+        Reviewed by Kentaro Hara.
+
+        In most cases code generators weren't checking the Conditional attribute
+        when generating code in headers for function/attribute/constants, they
+        were just guarding against the Conditional for the whole interface.
+
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (GenerateHeader):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (GenerateHeader):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        * bindings/scripts/test/CPP/WebDOMTestInterface.h:
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        (JSTestInterface):
+        (WebCore):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestInterface.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+
+
+2012-03-01  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Make opaque paint tracker aware of SkCanvas layers
+        https://bugs.webkit.org/show_bug.cgi?id=79145
+
+        Reviewed by Stephen White.
+
+        The current opaque paint tracker ignored SkCanvas layers entirely. But
+        SkCanvas layers can be used to apply things like alpha. So we make it
+        know about layers, and apply any clipping and SkPaint objects for layers
+        when tracking a paint.
+
+        Image clipping is done via a layer, so we can now also remove the
+        special-case code around image clipping in PlatformContextSkia and
+        OpaqueRegionSkia.
+
+        Unit test: PlatformContextSkiaTest.contextTransparencyLayerTest
+
+        Test: compositing/culling/clear-fixed-iframe.html
+
+        * platform/graphics/skia/OpaqueRegionSkia.cpp:
+        (WebCore::OpaqueRegionSkia::didDrawRect):
+        (WebCore::OpaqueRegionSkia::didDrawPath):
+        (WebCore::OpaqueRegionSkia::didDrawPoints):
+        (WebCore::OpaqueRegionSkia::didDrawBounded):
+        (WebCore::OpaqueRegionSkia::didDraw):
+        (WebCore):
+        * platform/graphics/skia/OpaqueRegionSkia.h:
+        (OpaqueRegionSkia):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        * platform/graphics/skia/PlatformContextSkia.h:
+        (PlatformContextSkia):
+
+2012-03-02  Kent Tamura  <tkent@chromium.org>
+
+        Add HTML-capable popup API to ChromeClient
+        https://bugs.webkit.org/show_bug.cgi?id=79078
+
+        Reviewed by Dimitri Glazkov.
+
+        This API will be used to implement a calendar picker of <input type=date>.
+        The code is enclosed with ENABLE_PAGE_POPUP, and doesn't change any
+        behavior for now.
+
+        * page/ChromeClient.h: Added declarations of openPagePopup() and closePagePopup().
+        * loader/EmptyClients.h:
+        (EmptyChromeClient): Add empty implementations of new ChromeClient functions.
+        * page/PagePopup.h: Added.
+        (PagePopup): Define an empty interface
+        * page/PagePopupClient.h: Added.
+        (PagePopupClient): Define an interface to provide various information to HTMLPopup.
+
+2012-03-01  Hironori Bono  <hbono@chromium.org>
+
+        Render overflow controls of an RTL element to its left-side.
+        https://bugs.webkit.org/show_bug.cgi?id=54623
+
+        This change adds a new flag WTF_USE_RTL_SCROLLBAR and render the
+        vertical scrollbars and resizers of RTL elements to their left side if
+        this new flag is enabled.
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: platform/chromium/fast/events/rtl-scrollbar.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverflowFromPositionedObjects): Move child elements right.
+        (WebCore::RenderBlock::determineLogicalLeftPositionForChild): ditto.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::overflowClipRect): Move the content rectangle right.
+        * rendering/RenderLayer.cpp:
+        (WebCore::cornerStart): Added a function that calculates the X position of a resizer.
+        (WebCore):
+        (WebCore::cornerRect): Use cornerStart to move a resizer.
+        (WebCore::RenderLayer::verticalScrollbarStart): Added a function that calculates
+        the X position of a vertical scrollbar.
+        (WebCore::RenderLayer::horizontalScrollbarStart): Added a function that calculates
+        the X position of a horizontal scrollbar.
+        (WebCore::RenderLayer::scrollbarOffset): Render a vertical scrollbar to the left side
+        and move a horizontal scrollbar right by the width of the vertical scrollbar.
+        (WebCore::RenderLayer::invalidateScrollbarRect): ditto.
+        (WebCore::RenderLayer::positionOverflowControls): ditto.
+        (WebCore::RenderLayer::hitTestOverflowControls): ditto.
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+        * rendering/style/RenderStyle.h: Added shouldPlaceBlockDirectionScrollbarOnLogicalLeft,
+        which returns if we need to move a left scrollbar to its right side.
+
+2012-03-01  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(90089): Input type='search' text shakes up and down when the style is changed.
+        https://bugs.webkit.org/show_bug.cgi?id=79445
+
+        Reviewed by Dimitri Glazkov.
+
+        If the inner text height of a search field is smaller than the
+        content box height of the <input>, the height of the container
+        element should be same as the content box height.
+
+        When the element style is changed, the RenderStyle height of the
+        container element is cleared, but the renderer height of the
+        container element remains. We had a bug that layout() didn't set
+        the RenderStyle height in a case that the renderer height was the
+        desired height. It shrunk the renderer height as the result of
+        layout for children.
+
+        Tests: fast/forms/search/search-shaking-text.html
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::layout):
+        Always set the RenderStyle height explicitly.
+
+2012-03-01  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rebaselined run-bindings-tests results.
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+
+2012-03-01  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10942540> REGRESSION (r108956): Safari Webpage Preview Fetcher crashes in WebCore::localizedString() when using a WebKit nightly build
+        https://bugs.webkit.org/show_bug.cgi?id=80034
+
+        Reviewed by Benjamin Poulain.
+
+        Safari Webpage Preview Fetcher can’t access the WebCore framework when launched from a WebKit
+        nightly build. After r108956, this causes it to crash.
+
+        * platform/mac/LocalizedStringsMac.cpp:
+        (WebCore::localizedString): Added a null-check for the value returned from
+        CFBundleGetBundleWithIdentifier(CFSTR("com.apple.WebCore")).
+
+2012-03-01  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry]Array of Cookies in HTTP request header are not in order.
+        https://bugs.webkit.org/show_bug.cgi?id=79870
+
+        Std::sort and HashMap are not stable. So cookies with the same creating
+        time sometimes are sent disorder.
+        Change std::sort with std::stable-sort.
+        We don't need using HashMap to save so few cookies for one domain.
+        It is a wast of time to create HashMap, too.
+        So change it with vector.
+
+        Reviewed by George Staikos.
+
+        Test: http/tests/cookies/resources/setArraycookies.php
+
+        * platform/blackberry/CookieManager.cpp:
+        (WebCore::cookieSorter):
+        (WebCore::CookieManager::getRawCookies):
+        (WebCore::CookieManager::checkAndTreatCookie):
+        (WebCore::CookieManager::addCookieToMap):
+        * platform/blackberry/CookieManager.h:
+        * platform/blackberry/CookieMap.cpp:
+        (WebCore::CookieMap::addOrReplaceCookie):
+        (WebCore::CookieMap::removeCookieAtIndex):
+        (WebCore::CookieMap::removeCookie):
+        (WebCore):
+        (WebCore::CookieMap::getAllCookies):
+        (WebCore::CookieMap::updateOldestCookie):
+        (WebCore::CookieMap::deleteAllCookiesAndDomains):
+        * platform/blackberry/CookieMap.h:
+        (WebCore::CookieMap::count):
+        (CookieMap):
+
+2012-03-01  Adam Barth  <abarth@webkit.org>
+
+        Move WebCore/storage/IDB* files into WebCore/Modules/indexeddb
+        https://bugs.webkit.org/show_bug.cgi?id=80071
+
+        Reviewed by Kentaro Hara.
+
+        Now that we've removed all the ENABLE(INDEXED_DATABASE) ifdefs from
+        WebCore proper, we can move IndexedDB into its own module.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Modules/indexeddb/IDBAny.cpp: Copied from Source/WebCore/storage/IDBAny.cpp.
+        * Modules/indexeddb/IDBAny.h: Copied from Source/WebCore/storage/IDBAny.h.
+        * Modules/indexeddb/IDBAny.idl: Copied from Source/WebCore/storage/IDBAny.idl.
+        * Modules/indexeddb/IDBBackingStore.h: Copied from Source/WebCore/storage/IDBBackingStore.h.
+        * Modules/indexeddb/IDBCallbacks.h: Copied from Source/WebCore/storage/IDBCallbacks.h.
+        * Modules/indexeddb/IDBCursor.cpp: Copied from Source/WebCore/storage/IDBCursor.cpp.
+        * Modules/indexeddb/IDBCursor.h: Copied from Source/WebCore/storage/IDBCursor.h.
+        * Modules/indexeddb/IDBCursor.idl: Copied from Source/WebCore/storage/IDBCursor.idl.
+        * Modules/indexeddb/IDBCursorBackendImpl.cpp: Copied from Source/WebCore/storage/IDBCursorBackendImpl.cpp.
+        * Modules/indexeddb/IDBCursorBackendImpl.h: Copied from Source/WebCore/storage/IDBCursorBackendImpl.h.
+        * Modules/indexeddb/IDBCursorBackendInterface.h: Copied from Source/WebCore/storage/IDBCursorBackendInterface.h.
+        * Modules/indexeddb/IDBCursorWithValue.cpp: Copied from Source/WebCore/storage/IDBCursorWithValue.cpp.
+        * Modules/indexeddb/IDBCursorWithValue.h: Copied from Source/WebCore/storage/IDBCursorWithValue.h.
+        * Modules/indexeddb/IDBCursorWithValue.idl: Copied from Source/WebCore/storage/IDBCursorWithValue.idl.
+        * Modules/indexeddb/IDBDatabase.cpp: Copied from Source/WebCore/storage/IDBDatabase.cpp.
+        * Modules/indexeddb/IDBDatabase.h: Copied from Source/WebCore/storage/IDBDatabase.h.
+        * Modules/indexeddb/IDBDatabase.idl: Copied from Source/WebCore/storage/IDBDatabase.idl.
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp: Copied from Source/WebCore/storage/IDBDatabaseBackendImpl.cpp.
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h: Copied from Source/WebCore/storage/IDBDatabaseBackendImpl.h.
+        * Modules/indexeddb/IDBDatabaseBackendInterface.h: Copied from Source/WebCore/storage/IDBDatabaseBackendInterface.h.
+        * Modules/indexeddb/IDBDatabaseCallbacks.h: Copied from Source/WebCore/storage/IDBDatabaseCallbacks.h.
+        * Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp: Copied from Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp.
+        * Modules/indexeddb/IDBDatabaseCallbacksImpl.h: Copied from Source/WebCore/storage/IDBDatabaseCallbacksImpl.h.
+        * Modules/indexeddb/IDBDatabaseError.h: Copied from Source/WebCore/storage/IDBDatabaseError.h.
+        * Modules/indexeddb/IDBDatabaseError.idl: Copied from Source/WebCore/storage/IDBDatabaseError.idl.
+        * Modules/indexeddb/IDBDatabaseException.cpp: Copied from Source/WebCore/storage/IDBDatabaseException.cpp.
+        * Modules/indexeddb/IDBDatabaseException.h: Copied from Source/WebCore/storage/IDBDatabaseException.h.
+        * Modules/indexeddb/IDBDatabaseException.idl: Copied from Source/WebCore/storage/IDBDatabaseException.idl.
+        * Modules/indexeddb/IDBEventDispatcher.cpp: Copied from Source/WebCore/storage/IDBEventDispatcher.cpp.
+        * Modules/indexeddb/IDBEventDispatcher.h: Copied from Source/WebCore/storage/IDBEventDispatcher.h.
+        * Modules/indexeddb/IDBFactory.cpp: Copied from Source/WebCore/storage/IDBFactory.cpp.
+        * Modules/indexeddb/IDBFactory.h: Copied from Source/WebCore/storage/IDBFactory.h.
+        * Modules/indexeddb/IDBFactory.idl: Copied from Source/WebCore/storage/IDBFactory.idl.
+        * Modules/indexeddb/IDBFactoryBackendImpl.cpp: Copied from Source/WebCore/storage/IDBFactoryBackendImpl.cpp.
+        * Modules/indexeddb/IDBFactoryBackendImpl.h: Copied from Source/WebCore/storage/IDBFactoryBackendImpl.h.
+        * Modules/indexeddb/IDBFactoryBackendInterface.cpp: Copied from Source/WebCore/storage/IDBFactoryBackendInterface.cpp.
+        * Modules/indexeddb/IDBFactoryBackendInterface.h: Copied from Source/WebCore/storage/IDBFactoryBackendInterface.h.
+        * Modules/indexeddb/IDBIndex.cpp: Copied from Source/WebCore/storage/IDBIndex.cpp.
+        * Modules/indexeddb/IDBIndex.h: Copied from Source/WebCore/storage/IDBIndex.h.
+        * Modules/indexeddb/IDBIndex.idl: Copied from Source/WebCore/storage/IDBIndex.idl.
+        * Modules/indexeddb/IDBIndexBackendImpl.cpp: Copied from Source/WebCore/storage/IDBIndexBackendImpl.cpp.
+        * Modules/indexeddb/IDBIndexBackendImpl.h: Copied from Source/WebCore/storage/IDBIndexBackendImpl.h.
+        * Modules/indexeddb/IDBIndexBackendInterface.h: Copied from Source/WebCore/storage/IDBIndexBackendInterface.h.
+        * Modules/indexeddb/IDBKey.cpp: Copied from Source/WebCore/storage/IDBKey.cpp.
+        * Modules/indexeddb/IDBKey.h: Copied from Source/WebCore/storage/IDBKey.h.
+        * Modules/indexeddb/IDBKey.idl: Copied from Source/WebCore/storage/IDBKey.idl.
+        * Modules/indexeddb/IDBKeyPath.cpp: Copied from Source/WebCore/storage/IDBKeyPath.cpp.
+        * Modules/indexeddb/IDBKeyPath.h: Copied from Source/WebCore/storage/IDBKeyPath.h.
+        * Modules/indexeddb/IDBKeyPathBackendImpl.cpp: Copied from Source/WebCore/storage/IDBKeyPathBackendImpl.cpp.
+        * Modules/indexeddb/IDBKeyPathBackendImpl.h: Copied from Source/WebCore/storage/IDBKeyPathBackendImpl.h.
+        * Modules/indexeddb/IDBKeyRange.cpp: Copied from Source/WebCore/storage/IDBKeyRange.cpp.
+        * Modules/indexeddb/IDBKeyRange.h: Copied from Source/WebCore/storage/IDBKeyRange.h.
+        * Modules/indexeddb/IDBKeyRange.idl: Copied from Source/WebCore/storage/IDBKeyRange.idl.
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp: Copied from Source/WebCore/storage/IDBLevelDBBackingStore.cpp.
+        * Modules/indexeddb/IDBLevelDBBackingStore.h: Copied from Source/WebCore/storage/IDBLevelDBBackingStore.h.
+        * Modules/indexeddb/IDBLevelDBCoding.cpp: Copied from Source/WebCore/storage/IDBLevelDBCoding.cpp.
+        * Modules/indexeddb/IDBLevelDBCoding.h: Copied from Source/WebCore/storage/IDBLevelDBCoding.h.
+        * Modules/indexeddb/IDBObjectStore.cpp: Copied from Source/WebCore/storage/IDBObjectStore.cpp.
+        * Modules/indexeddb/IDBObjectStore.h: Copied from Source/WebCore/storage/IDBObjectStore.h.
+        * Modules/indexeddb/IDBObjectStore.idl: Copied from Source/WebCore/storage/IDBObjectStore.idl.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp: Copied from Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h: Copied from Source/WebCore/storage/IDBObjectStoreBackendImpl.h.
+        * Modules/indexeddb/IDBObjectStoreBackendInterface.h: Copied from Source/WebCore/storage/IDBObjectStoreBackendInterface.h.
+        * Modules/indexeddb/IDBPendingTransactionMonitor.cpp: Copied from Source/WebCore/storage/IDBPendingTransactionMonitor.cpp.
+        * Modules/indexeddb/IDBPendingTransactionMonitor.h: Copied from Source/WebCore/storage/IDBPendingTransactionMonitor.h.
+        * Modules/indexeddb/IDBRequest.cpp: Copied from Source/WebCore/storage/IDBRequest.cpp.
+        * Modules/indexeddb/IDBRequest.h: Copied from Source/WebCore/storage/IDBRequest.h.
+        * Modules/indexeddb/IDBRequest.idl: Copied from Source/WebCore/storage/IDBRequest.idl.
+        * Modules/indexeddb/IDBTracing.h: Copied from Source/WebCore/storage/IDBTracing.h.
+        * Modules/indexeddb/IDBTransaction.cpp: Copied from Source/WebCore/storage/IDBTransaction.cpp.
+        * Modules/indexeddb/IDBTransaction.h: Copied from Source/WebCore/storage/IDBTransaction.h.
+        * Modules/indexeddb/IDBTransaction.idl: Copied from Source/WebCore/storage/IDBTransaction.idl.
+        * Modules/indexeddb/IDBTransactionBackendImpl.cpp: Copied from Source/WebCore/storage/IDBTransactionBackendImpl.cpp.
+        * Modules/indexeddb/IDBTransactionBackendImpl.h: Copied from Source/WebCore/storage/IDBTransactionBackendImpl.h.
+        * Modules/indexeddb/IDBTransactionBackendInterface.h: Copied from Source/WebCore/storage/IDBTransactionBackendInterface.h.
+        * Modules/indexeddb/IDBTransactionCallbacks.h: Copied from Source/WebCore/storage/IDBTransactionCallbacks.h.
+        * Modules/indexeddb/IDBTransactionCoordinator.cpp: Copied from Source/WebCore/storage/IDBTransactionCoordinator.cpp.
+        * Modules/indexeddb/IDBTransactionCoordinator.h: Copied from Source/WebCore/storage/IDBTransactionCoordinator.h.
+        * Modules/indexeddb/IDBVersionChangeEvent.cpp: Copied from Source/WebCore/storage/IDBVersionChangeEvent.cpp.
+        * Modules/indexeddb/IDBVersionChangeEvent.h: Copied from Source/WebCore/storage/IDBVersionChangeEvent.h.
+        * Modules/indexeddb/IDBVersionChangeEvent.idl: Copied from Source/WebCore/storage/IDBVersionChangeEvent.idl.
+        * Modules/indexeddb/IDBVersionChangeRequest.cpp: Copied from Source/WebCore/storage/IDBVersionChangeRequest.cpp.
+        * Modules/indexeddb/IDBVersionChangeRequest.h: Copied from Source/WebCore/storage/IDBVersionChangeRequest.h.
+        * Modules/indexeddb/IDBVersionChangeRequest.idl: Copied from Source/WebCore/storage/IDBVersionChangeRequest.idl.
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/IDBAny.cpp: Removed.
+        * storage/IDBAny.h: Removed.
+        * storage/IDBAny.idl: Removed.
+        * storage/IDBBackingStore.h: Removed.
+        * storage/IDBCallbacks.h: Removed.
+        * storage/IDBCursor.cpp: Removed.
+        * storage/IDBCursor.h: Removed.
+        * storage/IDBCursor.idl: Removed.
+        * storage/IDBCursorBackendImpl.cpp: Removed.
+        * storage/IDBCursorBackendImpl.h: Removed.
+        * storage/IDBCursorBackendInterface.h: Removed.
+        * storage/IDBCursorWithValue.cpp: Removed.
+        * storage/IDBCursorWithValue.h: Removed.
+        * storage/IDBCursorWithValue.idl: Removed.
+        * storage/IDBDatabase.cpp: Removed.
+        * storage/IDBDatabase.h: Removed.
+        * storage/IDBDatabase.idl: Removed.
+        * storage/IDBDatabaseBackendImpl.cpp: Removed.
+        * storage/IDBDatabaseBackendImpl.h: Removed.
+        * storage/IDBDatabaseBackendInterface.h: Removed.
+        * storage/IDBDatabaseCallbacks.h: Removed.
+        * storage/IDBDatabaseCallbacksImpl.cpp: Removed.
+        * storage/IDBDatabaseCallbacksImpl.h: Removed.
+        * storage/IDBDatabaseError.h: Removed.
+        * storage/IDBDatabaseError.idl: Removed.
+        * storage/IDBDatabaseException.cpp: Removed.
+        * storage/IDBDatabaseException.h: Removed.
+        * storage/IDBDatabaseException.idl: Removed.
+        * storage/IDBEventDispatcher.cpp: Removed.
+        * storage/IDBEventDispatcher.h: Removed.
+        * storage/IDBFactory.cpp: Removed.
+        * storage/IDBFactory.h: Removed.
+        * storage/IDBFactory.idl: Removed.
+        * storage/IDBFactoryBackendImpl.cpp: Removed.
+        * storage/IDBFactoryBackendImpl.h: Removed.
+        * storage/IDBFactoryBackendInterface.cpp: Removed.
+        * storage/IDBFactoryBackendInterface.h: Removed.
+        * storage/IDBIndex.cpp: Removed.
+        * storage/IDBIndex.h: Removed.
+        * storage/IDBIndex.idl: Removed.
+        * storage/IDBIndexBackendImpl.cpp: Removed.
+        * storage/IDBIndexBackendImpl.h: Removed.
+        * storage/IDBIndexBackendInterface.h: Removed.
+        * storage/IDBKey.cpp: Removed.
+        * storage/IDBKey.h: Removed.
+        * storage/IDBKey.idl: Removed.
+        * storage/IDBKeyPath.cpp: Removed.
+        * storage/IDBKeyPath.h: Removed.
+        * storage/IDBKeyPathBackendImpl.cpp: Removed.
+        * storage/IDBKeyPathBackendImpl.h: Removed.
+        * storage/IDBKeyRange.cpp: Removed.
+        * storage/IDBKeyRange.h: Removed.
+        * storage/IDBKeyRange.idl: Removed.
+        * storage/IDBLevelDBBackingStore.cpp: Removed.
+        * storage/IDBLevelDBBackingStore.h: Removed.
+        * storage/IDBLevelDBCoding.cpp: Removed.
+        * storage/IDBLevelDBCoding.h: Removed.
+        * storage/IDBObjectStore.cpp: Removed.
+        * storage/IDBObjectStore.h: Removed.
+        * storage/IDBObjectStore.idl: Removed.
+        * storage/IDBObjectStoreBackendImpl.cpp: Removed.
+        * storage/IDBObjectStoreBackendImpl.h: Removed.
+        * storage/IDBObjectStoreBackendInterface.h: Removed.
+        * storage/IDBPendingTransactionMonitor.cpp: Removed.
+        * storage/IDBPendingTransactionMonitor.h: Removed.
+        * storage/IDBRequest.cpp: Removed.
+        * storage/IDBRequest.h: Removed.
+        * storage/IDBRequest.idl: Removed.
+        * storage/IDBTracing.h: Removed.
+        * storage/IDBTransaction.cpp: Removed.
+        * storage/IDBTransaction.h: Removed.
+        * storage/IDBTransaction.idl: Removed.
+        * storage/IDBTransactionBackendImpl.cpp: Removed.
+        * storage/IDBTransactionBackendImpl.h: Removed.
+        * storage/IDBTransactionBackendInterface.h: Removed.
+        * storage/IDBTransactionCallbacks.h: Removed.
+        * storage/IDBTransactionCoordinator.cpp: Removed.
+        * storage/IDBTransactionCoordinator.h: Removed.
+        * storage/IDBVersionChangeEvent.cpp: Removed.
+        * storage/IDBVersionChangeEvent.h: Removed.
+        * storage/IDBVersionChangeEvent.idl: Removed.
+        * storage/IDBVersionChangeRequest.cpp: Removed.
+        * storage/IDBVersionChangeRequest.h: Removed.
+        * storage/IDBVersionChangeRequest.idl: Removed.
+
+2012-03-01  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitBorderFit in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79998
+
+        Reviewed by Andreas Kling.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-01  Anders Carlsson  <andersca@apple.com>
+
+        Crash when doing repeated double-tap-to-zoom gesture on apple startpage
+        https://bugs.webkit.org/show_bug.cgi?id=80081
+        <rdar://problem/10966391>
+
+        Reviewed by Sam Weinig.
+
+        Setting the contents scale on the tile cache layer was creating a WebTileCacheLayer presentation layer copy with a null _tileCache.
+
+        Implement -[WebTileCacheLayer actionForKey:] and have it always return nil so we'll avoid implicit animations, and thus creating presentation layers.
+
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer initWithLayer:]):
+        Implement this and assert that it's never reached. We should never create presentation layers since we don't animate this layer.
+
+        (-[WebTileCacheLayer actionForKey:]):
+        Implement this and always return nil.
+
+2012-03-01  Hajime Morrita  <morrita@chromium.org>
+
+        Custom scrollbars do not support transparency
+        https://bugs.webkit.org/show_bug.cgi?id=50547
+
+        Reviewed by James Robinson.
+
+        RenderScrollbar, which is used even for outermost frame when
+        -webkit-scrollbar is specified, assumes that its background is
+        painted by the enclosing container. But there is no such container
+        for outermost frame. This causes visual glitches when the
+        scrollbar has transparency.
+
+        This change clears background region for custom
+        outermostscrollbars to erase such glitches.
+
+        Test: fast/frames/transparent-scrollbar.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintScrollbar): The background is cleared here.
+        (WebCore):
+        * page/FrameView.h:
+        (FrameView):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paintScrollbar): Added to hook in FrameView
+        (WebCore):
+        (WebCore::ScrollView::paintScrollbars):
+        * platform/ScrollView.h:
+        (ScrollView):
+
+2012-03-01  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r106388): Form state is restored to a wrong document.
+        https://bugs.webkit.org/show_bug.cgi?id=79206
+
+        Reviewed by Brady Eidson.
+
+        In some cases, the URL of the current HistoryItem and the document
+        URL are mismatched.
+        A form state should be restored only if the document was loaded
+        with a HistoryItem and the document is not loaded as a
+        redirection.
+
+        Test: fast/loader/form-state-restore-with-locked-back-forward-list.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkCompleted): Clear m_requestedHistoryItem.
+        (WebCore::FrameLoader::loadItem):
+        Save the requested HistoryItem for didLoadWithLodItem().
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::requestedHistoryItem):
+        Added. Accessor for m_requestedHistoryItem.
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::restoreDocumentState):
+        Restore a form state only if the current document was loaded with
+        FrameLoader::loadItem() and not redirection.
+
+2012-03-01  Xingnan Wang  <xingnan.wang@intel.com>
+
+        SSE optimization for vsvesq and vmaxmgv
+        https://bugs.webkit.org/show_bug.cgi?id=77950
+
+        Reviewed by Chris Rogers.
+
+        Achieved the performance of 3.7x on vsvesq and 4.1x on vmaxmgv.
+
+        * platform/audio/VectorMath.cpp:
+        (WebCore::VectorMath::vsvesq):
+        (WebCore::VectorMath::vmaxmgv):
+
+2012-03-01  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyBoxSizing in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80001
+
+        Reviewed by Andreas Kling.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] LayerChromium::contentChanged is redundant with setNeedsDisplay
+        https://bugs.webkit.org/show_bug.cgi?id=79708
+
+        Reviewed by Adrienne Walker.
+
+        Some layer types need special handling when they receive damage. WebGL layers need to know if their texture is
+        updated for clear-on-swap behavior and both WebGL and canvas 2d layers have rate limiting mechanisms tied to
+        receiving invalidations. This mechanism was implemented by LayerChromium::contentChanged(), but this is
+        redundant with setNeedsDisplay().
+
+        Covered by existing tests.
+
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::setNeedsDisplay):
+        * platform/graphics/chromium/Canvas2DLayerChromium.h:
+        (Canvas2DLayerChromium):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsNeedsDisplay):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setNeedsDisplay):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::setNeedsDisplay):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        (VideoLayerChromium):
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::setNeedsDisplay):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        (WebGLLayerChromium):
+
+2012-03-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Rename LayerChromium::name to debugName to be more consistent with other debug properties, make threadsafe
+        https://bugs.webkit.org/show_bug.cgi?id=79723
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::updateNames):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::pushPropertiesTo):
+        (WebCore::LayerChromium::setDebugName):
+        (WebCore):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::dumpLayer):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        (WebCore::CCLayerImpl::setDebugName):
+        (WebCore::CCLayerImpl::debugName):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::name):
+
+2012-03-01  Adam Barth  <abarth@webkit.org>
+
+        Remove last ENABLED(INDEXED_DATABASE) ifdef from WebCore proper
+        https://bugs.webkit.org/show_bug.cgi?id=80061
+
+        Reviewed by Dimitri Glazkov.
+
+        This patch removes the last ENABLED(INDEXED_DATABASE) ifdef from
+        WebCore proper by moving the backend factory out of PageGroup and into
+        a supplement for PageGroup.  After this patch, we're ready to move the
+        IDB code into Modules.
+
+        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
+        (WebCore::DOMWindowIndexedDatabase::webkitIndexedDB):
+        * WebCore.gypi:
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore::assertIDBFactory):
+        * page/PageGroup.cpp:
+        (WebCore):
+        * page/PageGroup.h:
+        (PageGroup):
+
+2012-03-01  Dale Curtis  <dalecurtis@chromium.org>
+
+        Remove deprecated FFmpeg build directories.
+        https://bugs.webkit.org/show_bug.cgi?id=79282
+
+        We've switched the layout of the FFmpeg repo in Chrome and these paths
+        are no longer needed or valid.
+
+        Reviewed by Dirk Pranke.
+
+        No new tests. It either compiles or not.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-03-01  Xingnan Wang  <xingnan.wang@intel.com>
+
+        Enable IPP for Biquad filter
+        https://bugs.webkit.org/show_bug.cgi?id=77509
+
+        Reviewed by Chris Rogers.
+
+        Use IIR filter in IPP and improve ~27% performance in linux.
+        Changes are covered by current tests.
+
+        * platform/audio/Biquad.cpp:
+        (WebCore::Biquad::Biquad):
+        (WebCore::Biquad::~Biquad):
+        (WebCore):
+        (WebCore::Biquad::process):
+        (WebCore::Biquad::reset):
+        (WebCore::Biquad::setLowpassParams):
+        (WebCore::Biquad::setHighpassParams):
+        (WebCore::Biquad::setNormalizedCoefficients):
+        (WebCore::Biquad::setZeroPolePairs):
+        * platform/audio/Biquad.h:
+        (Biquad):
+
+2012-03-01  Peter Kotwicz  <pkotwicz@google.com>
+
+        Decouple scrollbar painting from Scrollbar object
+        https://bugs.webkit.org/show_bug.cgi?id=78028
+
+        Reviewed by James Robinson.
+
+        Added interface ScrollbarThemeClient which Scrollbar inherits from.
+        This allows painting via ScrollbarTheme with a proxy to a Scrollbar
+        object.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::scrollbarOverlayStyle):
+        (WebCore):
+        (WebCore::Scrollbar::getTickmarks):
+        (WebCore::Scrollbar::isScrollableAreaActive):
+        (WebCore::Scrollbar::isScrollViewScrollbar):
+        (WebCore::Scrollbar::setFrameRect):
+        * platform/Scrollbar.h:
+        (Scrollbar):
+        (WebCore::Scrollbar::x):
+        (WebCore::Scrollbar::y):
+        (WebCore::Scrollbar::width):
+        (WebCore::Scrollbar::height):
+        (WebCore::Scrollbar::size):
+        (WebCore::Scrollbar::location):
+        (WebCore::Scrollbar::parent):
+        (WebCore::Scrollbar::root):
+        (WebCore::Scrollbar::frameRect):
+        (WebCore::Scrollbar::invalidate):
+        (WebCore::Scrollbar::convertFromContainingWindow):
+        (WebCore::Scrollbar::isCustomScrollbar):
+        (WebCore::Scrollbar::orientation):
+        (WebCore::Scrollbar::value):
+        (WebCore::Scrollbar::currentPos):
+        (WebCore::Scrollbar::visibleSize):
+        (WebCore::Scrollbar::totalSize):
+        (WebCore::Scrollbar::maximum):
+        (WebCore::Scrollbar::controlSize):
+        (WebCore::Scrollbar::lineStep):
+        (WebCore::Scrollbar::pageStep):
+        (WebCore::Scrollbar::pressedPart):
+        (WebCore::Scrollbar::hoveredPart):
+        (WebCore::Scrollbar::styleChanged):
+        (WebCore::Scrollbar::enabled):
+        * platform/ScrollbarTheme.h:
+        (WebCore):
+        (WebCore::ScrollbarTheme::updateEnabledState):
+        (WebCore::ScrollbarTheme::paint):
+        (WebCore::ScrollbarTheme::hitTest):
+        (WebCore::ScrollbarTheme::updateScrollbarOverlayStyle):
+        (WebCore::ScrollbarTheme::invalidateParts):
+        (WebCore::ScrollbarTheme::invalidatePart):
+        (WebCore::ScrollbarTheme::shouldCenterOnThumb):
+        (WebCore::ScrollbarTheme::shouldSnapBackToDragOrigin):
+        (WebCore::ScrollbarTheme::shouldDragDocumentInsteadOfThumb):
+        (WebCore::ScrollbarTheme::thumbPosition):
+        (WebCore::ScrollbarTheme::thumbLength):
+        (WebCore::ScrollbarTheme::trackPosition):
+        (WebCore::ScrollbarTheme::trackLength):
+        (WebCore::ScrollbarTheme::registerScrollbar):
+        (WebCore::ScrollbarTheme::unregisterScrollbar):
+        * platform/ScrollbarThemeClient.h: Added.
+        (WebCore):
+        (ScrollbarThemeClient):
+        (WebCore::ScrollbarThemeClient::~ScrollbarThemeClient):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        (WebCore::ScrollbarThemeComposite::hitTest):
+        (WebCore::ScrollbarThemeComposite::invalidatePart):
+        (WebCore::ScrollbarThemeComposite::splitTrack):
+        (WebCore::usedTotalSize):
+        (WebCore::ScrollbarThemeComposite::thumbPosition):
+        (WebCore::ScrollbarThemeComposite::thumbLength):
+        (WebCore::ScrollbarThemeComposite::minimumThumbLength):
+        (WebCore::ScrollbarThemeComposite::trackPosition):
+        (WebCore::ScrollbarThemeComposite::trackLength):
+        * platform/ScrollbarThemeComposite.h:
+        (ScrollbarThemeComposite):
+        (WebCore::ScrollbarThemeComposite::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeComposite::paintTrackBackground):
+        (WebCore::ScrollbarThemeComposite::paintTrackPiece):
+        (WebCore::ScrollbarThemeComposite::paintButton):
+        (WebCore::ScrollbarThemeComposite::paintThumb):
+        (WebCore::ScrollbarThemeComposite::paintTickmarks):
+        (WebCore::ScrollbarThemeComposite::constrainTrackRectToTrackPieces):
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::hasThumb):
+        (WebCore::ScrollbarThemeChromium::backButtonRect):
+        (WebCore::ScrollbarThemeChromium::forwardButtonRect):
+        (WebCore::ScrollbarThemeChromium::trackRect):
+        (WebCore::ScrollbarThemeChromium::paintTrackBackground):
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        * platform/chromium/ScrollbarThemeChromium.h:
+        (WebCore::ScrollbarThemeChromium::hasButtons):
+        (ScrollbarThemeChromium):
+        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:
+        (WebCore::ScrollbarThemeChromiumAndroid::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeChromiumAndroid::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeChromiumAndroid::buttonSize):
+        (WebCore::ScrollbarThemeChromiumAndroid::minimumThumbLength):
+        * platform/chromium/ScrollbarThemeChromiumAndroid.h:
+        (ScrollbarThemeChromiumAndroid):
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumLinux::paintButton):
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+        (WebCore::ScrollbarThemeChromiumLinux::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeChromiumLinux::buttonSize):
+        (WebCore::ScrollbarThemeChromiumLinux::minimumThumbLength):
+        * platform/chromium/ScrollbarThemeChromiumLinux.h:
+        (ScrollbarThemeChromiumLinux):
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
+        (ScrollbarThemeChromiumMac):
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::scrollbarStateToThemeState):
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+        (WebCore::ScrollbarThemeChromiumMac::paintGivenTickmarks):
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin):
+        (WebCore::ScrollbarThemeChromiumWin::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumWin::paintButton):
+        (WebCore::ScrollbarThemeChromiumWin::paintThumb):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeArrowState):
+        (WebCore::ScrollbarThemeChromiumWin::getClassicThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeChromiumWin::buttonSize):
+        * platform/chromium/ScrollbarThemeChromiumWin.h:
+        (ScrollbarThemeChromiumWin):
+        * platform/efl/ScrollbarThemeEfl.cpp:
+        (WebCore::ScrollbarThemeEfl::registerScrollbar):
+        (WebCore::ScrollbarThemeEfl::unregisterScrollbar):
+        * platform/efl/ScrollbarThemeEfl.h:
+        (ScrollbarThemeEfl):
+        * platform/gtk/ScrollbarThemeGtk.cpp:
+        (WebCore):
+        (WebCore::ScrollbarThemeGtk::registerScrollbar):
+        (WebCore::ScrollbarThemeGtk::unregisterScrollbar):
+        (WebCore::ScrollbarThemeGtk::updateScrollbarsFrameThickness):
+        (WebCore::ScrollbarThemeGtk::hasThumb):
+        (WebCore::ScrollbarThemeGtk::backButtonRect):
+        (WebCore::ScrollbarThemeGtk::forwardButtonRect):
+        (WebCore::ScrollbarThemeGtk::trackRect):
+        (WebCore::ScrollbarThemeGtk::thumbRect):
+        (WebCore::ScrollbarThemeGtk::paint):
+        (WebCore::ScrollbarThemeGtk::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeGtk::buttonSize):
+        (WebCore::ScrollbarThemeGtk::minimumThumbLength):
+        * platform/gtk/ScrollbarThemeGtk.h:
+        (WebCore::ScrollbarThemeGtk::hasButtons):
+        (ScrollbarThemeGtk):
+        * platform/gtk/ScrollbarThemeGtk2.cpp:
+        (WebCore::getWidgetForScrollbar):
+        (WebCore::ScrollbarThemeGtk::paintTrackBackground):
+        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeGtk::paintThumb):
+        (WebCore::ScrollbarThemeGtk::paintButton):
+        * platform/gtk/ScrollbarThemeGtk3.cpp:
+        (WebCore::ScrollbarThemeGtk::paintTrackBackground):
+        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeGtk::paintThumb):
+        (WebCore::ScrollbarThemeGtk::paintButton):
+        * platform/mac/ScrollbarThemeMac.h:
+        (ScrollbarThemeMac):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore):
+        (WebCore::ScrollbarThemeMac::registerScrollbar):
+        (WebCore::ScrollbarThemeMac::unregisterScrollbar):
+        (WebCore::ScrollbarThemeMac::setNewPainterForScrollbar):
+        (WebCore::ScrollbarThemeMac::painterForScrollbar):
+        (WebCore::ScrollbarThemeMac::updateScrollbarOverlayStyle):
+        (WebCore::ScrollbarThemeMac::hasButtons):
+        (WebCore::ScrollbarThemeMac::hasThumb):
+        (WebCore::ScrollbarThemeMac::backButtonRect):
+        (WebCore::ScrollbarThemeMac::forwardButtonRect):
+        (WebCore::ScrollbarThemeMac::trackRect):
+        (WebCore::ScrollbarThemeMac::minimumThumbLength):
+        (WebCore::ScrollbarThemeMac::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeMac::shouldDragDocumentInsteadOfThumb):
+        (WebCore::ScrollbarThemeMac::updateEnabledState):
+        (WebCore::ScrollbarThemeMac::paint):
+        * platform/mock/ScrollbarThemeMock.cpp:
+        (WebCore::ScrollbarThemeMock::trackRect):
+        (WebCore::ScrollbarThemeMock::paintTrackBackground):
+        (WebCore::ScrollbarThemeMock::paintThumb):
+        * platform/mock/ScrollbarThemeMock.h:
+        (WebCore::ScrollbarThemeMock::hasButtons):
+        (WebCore::ScrollbarThemeMock::hasThumb):
+        (WebCore::ScrollbarThemeMock::backButtonRect):
+        (WebCore::ScrollbarThemeMock::forwardButtonRect):
+        (ScrollbarThemeMock):
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::styleOptionSlider):
+        (WebCore::ScrollbarThemeQt::paint):
+        (WebCore::ScrollbarThemeQt::hitTest):
+        (WebCore::ScrollbarThemeQt::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeQt::invalidatePart):
+        (WebCore::ScrollbarThemeQt::thumbPosition):
+        (WebCore::ScrollbarThemeQt::thumbLength):
+        (WebCore::ScrollbarThemeQt::trackPosition):
+        (WebCore::ScrollbarThemeQt::trackLength):
+        * platform/qt/ScrollbarThemeQt.h:
+        (ScrollbarThemeQt):
+        * platform/win/ScrollbarThemeSafari.cpp:
+        (WebCore::ScrollbarThemeSafari::hasButtons):
+        (WebCore::ScrollbarThemeSafari::hasThumb):
+        (WebCore::ScrollbarThemeSafari::backButtonRect):
+        (WebCore::ScrollbarThemeSafari::forwardButtonRect):
+        (WebCore::ScrollbarThemeSafari::trackRect):
+        (WebCore::ScrollbarThemeSafari::minimumThumbLength):
+        (WebCore::ScrollbarThemeSafari::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeSafari::paintTrackBackground):
+        (WebCore::ScrollbarThemeSafari::paintButton):
+        (WebCore::ScrollbarThemeSafari::paintThumb):
+        * platform/win/ScrollbarThemeSafari.h:
+        (ScrollbarThemeSafari):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::hasThumb):
+        (WebCore::ScrollbarThemeWin::backButtonRect):
+        (WebCore::ScrollbarThemeWin::forwardButtonRect):
+        (WebCore::ScrollbarThemeWin::trackRect):
+        (WebCore::ScrollbarThemeWin::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeWin::shouldSnapBackToDragOrigin):
+        (WebCore::ScrollbarThemeWin::paintTrackBackground):
+        (WebCore::ScrollbarThemeWin::paintTrackPiece):
+        (WebCore::ScrollbarThemeWin::paintButton):
+        (WebCore::paintGripper):
+        (WebCore::ScrollbarThemeWin::paintThumb):
+        * platform/win/ScrollbarThemeWin.h:
+        (WebCore::ScrollbarThemeWin::hasButtons):
+        (ScrollbarThemeWin):
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::hasThumb):
+        (WebCore::ScrollbarThemeWx::minimumThumbLength):
+        (WebCore::ScrollbarThemeWx::buttonSize):
+        (WebCore::ScrollbarThemeWx::splitTrack):
+        (WebCore::ScrollbarThemeWx::backButtonRect):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        (WebCore::ScrollbarThemeWx::trackRect):
+        (WebCore::ScrollbarThemeWx::paint):
+        * platform/wx/ScrollbarThemeWx.h:
+        (ScrollbarThemeWx):
+        (WebCore::ScrollbarThemeWx::hasButtons):
+        * rendering/RenderScrollbar.h:
+        (WebCore::toRenderScrollbar):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::buttonSizesAlongTrackAxis):
+        (WebCore::RenderScrollbarTheme::hasButtons):
+        (WebCore::RenderScrollbarTheme::hasThumb):
+        (WebCore::RenderScrollbarTheme::minimumThumbLength):
+        (WebCore::RenderScrollbarTheme::backButtonRect):
+        (WebCore::RenderScrollbarTheme::forwardButtonRect):
+        (WebCore::RenderScrollbarTheme::trackRect):
+        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
+        (WebCore::RenderScrollbarTheme::paintScrollbarBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackPiece):
+        (WebCore::RenderScrollbarTheme::paintButton):
+        (WebCore::RenderScrollbarTheme::paintThumb):
+        * rendering/RenderScrollbarTheme.h:
+        (WebCore::RenderScrollbarTheme::shouldCenterOnThumb):
+        (WebCore::RenderScrollbarTheme::registerScrollbar):
+        (WebCore::RenderScrollbarTheme::unregisterScrollbar):
+        (RenderScrollbarTheme):
+
+2012-03-01  Luke Macpherson   <macpherson@chromium.org>
+
+        Implement CSSPropertyImageRendering in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79855
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-01  Alok Priyadarshi  <alokp@chromium.org>
+
+        [chromium] Partial texture updates not happening with accelerated painting path
+        https://bugs.webkit.org/show_bug.cgi?id=80040
+
+        Reviewed by James Robinson.
+
+        The order of y-flip and clip-rect was opposite of what it should be.
+        The clip rect was not properly transformed to account for y-flip and hence clipping everything.  
+
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
+
+2012-03-01  Alexey Proskuryakov  <ap@apple.com>
+
+        FileReader read speed is way too low
+        https://bugs.webkit.org/show_bug.cgi?id=77272
+
+        Reviewed by Oliver Hunt.
+
+        This brings performance to reasonable range, but certainly doesn't exhaust improvement opportunities.
+
+        * platform/network/BlobResourceHandle.cpp: Use a more appropriate block size. Performing
+        cross-thread messaging for every 1024 bytes is slow.
+
+2012-03-01  Dan Bernstein  <mitz@apple.com>
+
+        ScrollView::setFrameRect() calls contentsResized() even when the frame size is unchanged
+        https://bugs.webkit.org/show_bug.cgi?id=80047
+
+        Reviewed by Anders Carlsson.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setFrameRect): Added a check that the new frame size differs from the
+        old one before calling contentsResized().
+
+2012-03-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move pageScaleDirty logic from LayerChromium to GraphicsLayerChromium
+        https://bugs.webkit.org/show_bug.cgi?id=79714
+
+        Reviewed by Adrienne Walker.
+
+        When the page scale changes on a composited layer we need to invalidate all of the contents on the layer in
+        order to repaint them at the new scale. The sequence of calls we get make this a bit tricky, since we first
+        receive a page scale changed notification and then receive the new layer bounds. The solution is to defer the
+        invalidation until we have the new layer bounds, which landed in r99774.
+
+        This moves that logic from LayerChromium into GraphicsLayerChromium since IMO this is pretty particular to the
+        way WebCore is passing us invalidations and not something fundamental to the compositor.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::setSize):
+        (WebCore::GraphicsLayerChromium::deviceOrPageScaleFactorChanged):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::setBounds):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+
+2012-03-01  Joe Thomas  <joethomas@motorola.com>
+
+        :empty still applies to elements made non-empty via page dynamics.
+        https://bugs.webkit.org/show_bug.cgi?id=79734
+
+        Check for :empty style change should be made even if the RenderStyle for the element is NULL
+        as changes to the element's children can trigger a change in :empty state of the parent element.
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/selectors/empty-element-made-non-empty.html
+
+        * dom/Element.cpp:
+        (WebCore::checkForSiblingStyleChanges):
+
+2012-02-29  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Move context lost control code from CCSingleThreadProxy to CCLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=79964
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::recreateContext):
+        (WebCore::CCLayerTreeHost::createContext):
+        (WebCore::CCLayerTreeHost::didLoseContext):
+        (WebCore::CCLayerTreeHost::compositeAndReadback):
+        (WebCore::CCLayerTreeHost::loseContext):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHostClient):
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
+        (WebCore::CCSingleThreadProxy::compositeAndReadback):
+        (WebCore::CCSingleThreadProxy::initializeContext):
+        (WebCore::CCSingleThreadProxy::recreateContext):
+        (WebCore):
+        (WebCore::CCSingleThreadProxy::loseContext):
+        (WebCore::CCSingleThreadProxy::compositeImmediately):
+        (WebCore::CCSingleThreadProxy::doComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::initializeContext):
+        (WebCore::CCThreadProxy::recreateContext):
+        (WebCore):
+        (WebCore::CCThreadProxy::loseContext):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-03-01  Abhishek Arya  <inferno@chromium.org>
+
+        Prevent layout root to remain set on renderers getting destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=79953
+
+        Reviewed by Eric Seidel.
+
+        Implement Julien Chaffraix's idea.
+
+        * page/FrameView.h:
+        (WebCore::FrameView::clearLayoutRoot): helper to clear layout root.
+        * rendering/RenderObject.cpp:
+        (WebCore::clearLayoutRootIfNeeded): if we know we are going
+        away and we are the view's layout root, then we need to reset the layout
+        root to prevent being used.
+        (WebCore):
+        (WebCore::RenderObject::willBeDestroyed): call clearLayoutRootIfNeeded at end.
+
+2012-03-01  Kangil Han  <kangil.han@samsung.com>
+
+        [DRT] Remove all PlainTextController usages in existing tests by adding internal API
+        https://bugs.webkit.org/show_bug.cgi?id=78570
+
+        Reviewed by Hajime Morita.
+
+        This patch will remove all PlainTextController usages
+        in existing DRT tests by adding internal API to WebCore/testing/Internals
+
+        Changed editing/text-iterator/script-tests/basic-iteration.js to use internals.rangeAsText
+
+        * testing/Internals.cpp:
+        (WebCore::Internals::rangeAsText):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-03-01  Adam Barth  <abarth@webkit.org>
+
+        DOMWindow shouldn't have any INDEXED_DATABASE ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=80013
+
+        Reviewed by Kentaro Hara.
+
+        Before this patch, DOMWindow still knew about IDB because of the
+        database factory.  This patch moves the factory to
+        DOMWindowIndexedDatabase.
+
+        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
+        (WebCore::DOMWindowIndexedDatabase::DOMWindowIndexedDatabase):
+        (WebCore::DOMWindowIndexedDatabase::from):
+        (WebCore):
+        (WebCore::DOMWindowIndexedDatabase::disconnectFrame):
+        (WebCore::DOMWindowIndexedDatabase::webkitIndexedDB):
+        * Modules/indexeddb/DOMWindowIndexedDatabase.h:
+        (DOMWindowIndexedDatabase):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::clear):
+        (WebCore):
+        * page/DOMWindow.h:
+        (DOMWindow):
+
+2012-03-01  Anders Carlsson  <andersca@apple.com>
+
+        Glitchy scrolling on pages where the scroll layer needs to be updated on the main thread
+        https://bugs.webkit.org/show_bug.cgi?id=80038
+        <rdar://problem/10933831>
+
+        Reviewed by Simon Fraser.
+
+        When we need to update the scroll layer position on the main thread, we need to cache the
+        scroll position we sent to the main thread and assume that that's the correct scroll position.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        (ScrollingTreeNodeMac):
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::update):
+        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
+        (WebCore::ScrollingTreeNodeMac::scrollPosition):
+
+2012-03-01  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Unreviewed, rolling out r109367.
+        http://trac.webkit.org/changeset/109367
+        https://bugs.webkit.org/show_bug.cgi?id=75568
+
+        Some tests started to fail in a non obvious way.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::isPointInOverflowControl):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::willBeDestroyed):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::scrollLeft):
+        (WebCore::RenderBox::scrollTop):
+        (WebCore::RenderBox::setScrollLeft):
+        (WebCore::RenderBox::setScrollTop):
+        (WebCore::RenderBox::includeVerticalScrollbarSize):
+        (WebCore::RenderBox::includeHorizontalScrollbarSize):
+        (WebCore::RenderBox::scrolledContentOffset):
+        (WebCore::RenderBox::cachedSizeForOverflowClip):
+        (WebCore::RenderBox::pushContentsClip):
+        (WebCore::RenderBox::popContentsClip):
+        (WebCore::RenderBox::addLayoutOverflow):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        (WebCore):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::requiresLayer):
+        (RenderBoxModelObject):
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::requiresLayer):
+
+2012-03-01  Kenichi Ishibashi  <bashi@chromium.org>
+
+        REGRESSION: Outlook 2007 doesn't display fonts correctly on emails composed by WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=79448
+
+        Reviewed by Ryosuke Niwa.
+
+        Don't produce single quotes around face attribute of font elements.
+
+        Test: editing/style/font-face-unquote.html
+
+        * editing/EditingStyle.cpp:
+        (WebCore::StyleChange::extractTextStyles): Remove single quotes from m_applyFontFace.
+
+2012-03-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Part of https://bugs.webkit.org/show_bug.cgi?id=79705
+
+        Here's some of that tweaking promised in the comment. Adjusting 
+        gMaximumUnpaintedAreaRatio down a bit.
+        * page/Page.cpp:
+        (WebCore):
+
+2012-03-01  Levi Weintraub  <leviw@chromium.org>
+
+        Add roundToInt method for LayoutUnits
+        https://bugs.webkit.org/show_bug.cgi?id=79283
+
+        Reviewed by Eric Seidel.
+
+        Adding a roundToInt method that rounds a LayoutUnit to the nearest integer. This
+        only has an effect once we switch to sub-pixel positioning. Points and offsets
+        are rounded for painting and hit testing.
+
+        No new tests. No change in behavior.
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::offsetX):
+        (WebCore::MouseRelatedEvent::offsetY):
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlTextTrackContainerElement::updateSizes):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::computeLineGridPaginationOrigin):
+        * rendering/LayoutTypes.h:
+        (WebCore::roundToInt): Stub until we switch to sub-pixel LayoutUnits.
+        (WebCore):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::pageLogicalTopForOffset):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::pixelSnappedLogicalLeftOffsetForLine): Correcting to use the
+        pixel snapped methods on FloatingObjects and removing the fixme.
+        (WebCore::RenderBlock::pixelSnappedLogicalTopForFloat): Ditto.
+        (WebCore::RenderBlock::pixelSnappedLogicalBottomForFloat): Ditto.
+        (WebCore::RenderBlock::pixelSnappedLogicalLeftForFloat): Ditto.
+        (WebCore::RenderBlock::pixelSnappedLogicalRightForFloat): Ditto.
+        (WebCore::RenderBlock::pixelSnappedLogicalWidthForFloat): Ditto.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineWidth::updateAvailableWidth):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Using
+        pixelSnappedLogicalLeft/RightOffsetForLine convenience methods for line layout. When
+        we switch to sub-pixel positioning, we still pixel snap blocks before painting them,
+        but text is rendered using floats. We need to ensure the text is laid out using the
+        actual pixel width of the containing block to avoid bleeding out of the block.
+        * rendering/RenderBoxModelObject.h: Moving the fixme to pixelSnappedWidth/Height and
+        adding the necessary rounding for Left/Top.
+        (WebCore::RenderBoxModelObject::pixelSnappedOffsetLeft):
+        (WebCore::RenderBoxModelObject::pixelSnappedOffsetTop):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollRectToVisible):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scrollHeight): Rounding the height for scrollHeight. Scrolling
+        always uses rounded values.
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToParentTransform): Similar to the line box tree, since
+        SVG renders using floats, we need to start with pixel snapped values from the render
+        tree or we'll end up with the contents not properly aligned to the rest of the page.
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::prepareToRenderSVGContent):
+
+2012-03-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: arrays in object properties sections do not scale.
+        https://bugs.webkit.org/show_bug.cgi?id=64596
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: inspector/console/console-big-array.html
+
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArray):
+        (WebInspector.ConsoleMessageImpl.prototype._printArray):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.startEditing):
+        (WebInspector.ArrayGroupingTreeElement):
+        (WebInspector.ArrayGroupingTreeElement.populateAsArray):
+        (WebInspector.ArrayGroupingTreeElement._populate.appendElement):
+        (WebInspector.ArrayGroupingTreeElement._populate):
+        (WebInspector.ArrayGroupingTreeElement.prototype.onpopulate):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.prototype.release):
+        (WebInspector.RemoteObject.prototype.arrayLength):
+        (WebInspector.LocalJSONObject.prototype.isError):
+        (WebInspector.LocalJSONObject.prototype.arrayLength):
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeVariableTreeElement.prototype.get propertyPath):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype._mouseDown):
+        * inspector/front-end/inspector.css:
+        (.console-formatted-object, .console-formatted-node, .console-formatted-array):
+        (.console-formatted-object .section, .console-formatted-node .section, .console-formatted-array .section):
+
+2012-03-01  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed, rolling out r109336.
+        http://trac.webkit.org/changeset/109336
+        https://bugs.webkit.org/show_bug.cgi?id=80013
+
+        It's causing some crashes
+
+        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
+        (WebCore::DOMWindowIndexedDatabase::DOMWindowIndexedDatabase):
+        (WebCore::DOMWindowIndexedDatabase::webkitIndexedDB):
+        * Modules/indexeddb/DOMWindowIndexedDatabase.h:
+        (DOMWindowIndexedDatabase):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::clear):
+        (WebCore):
+        (WebCore::DOMWindow::setIDBFactory):
+        * page/DOMWindow.h:
+        (DOMWindow):
+        (WebCore::DOMWindow::idbFactory):
+
+2012-03-01  Tom Sepez  <tsepez@chromium.org>
+
+        Move m_frame protector from FrameLoader::changeLocation to FrameLoader::urlSelected
+        https://bugs.webkit.org/show_bug.cgi?id=79882
+
+        Reviewed by Adam Barth.
+
+        Test: fast/frames/url-selected-crash.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected):
+
+2012-03-01  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Lazily allocate overflow: hidden layers if we have overflowing content
+        https://bugs.webkit.org/show_bug.cgi?id=75568
+
+        Reviewed by David Hyatt.
+
+        Change covered by the existing tests and the tons of rebaselines.
+
+        This change makes us lazily allocate our RenderLayer for overflow: hidden layers only.
+
+        Apart from saving some memory, it will also speed up the rendering as we don't need to
+        go through the layer's machinery when painting and hit testing.
+
+        On http://dglazkov.github.com/performance-tests/biggrid.html benchmark, this puts the
+        overflow: hidden case in par with the overflow: visible case when scrolling that is a
+        very-smooth scrolling vs a jerky one currently (mostly due to the painting speedup).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        Changed this method to update our size cache if needed.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::isPointInOverflowControl):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::scrollLeft):
+        (WebCore::RenderBox::scrollTop):
+        (WebCore::RenderBox::setScrollLeft):
+        (WebCore::RenderBox::setScrollTop):
+        (WebCore::RenderBox::includeVerticalScrollbarSize):
+        (WebCore::RenderBox::includeHorizontalScrollbarSize):
+        (WebCore::RenderBox::pushContentsClip):
+        (WebCore::RenderBox::popContentsClip):
+        (WebCore::RenderBox::addLayoutOverflow):
+        Added layer() check to the previous call sites.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::ensureLayer):
+        Added this function to create and add a new layer.
+
+        (WebCore::RenderBoxModelObject::willBeDestroyed):
+        (WebCore):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        Patched those method to handle updating / removing
+        cached size entries.
+
+        (WebCore::cachedSizeForOverflowClipMap):
+        (WebCore::RenderBoxModelObject::cachedSizeForOverflowClip):
+        (WebCore::RenderBoxModelObject::updateCachedSizeForOverflowClip):
+        (WebCore::RenderBoxModelObject::clearCachedSizeForOverflowClip):
+        This logic stores the size information for later repainting.
+        It is in practice replicating what RenderLayer is doing.
+
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::requiresLayer):
+        Updated to call requiresLayerForOverflowClip.
+
+        (WebCore::RenderBoxModelObject::requiresLayerForOverflowClip):
+        Added this method to check if we can lazily allocate the layer.
+
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        Removed some checks as they are part of updateScrollInfoAfterLayout.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::scrolledContentOffset):
+        Added a layer() check.
+
+        * rendering/RenderTableRow.h:
+        (RenderTableRow):
+        Added a comment about why we need a layout for table rows.
+
+2012-03-01  Abhishek Arya  <inferno@chromium.org>
+
+        Protect functions using two container node function, each of which can fire mutation events.
+        https://bugs.webkit.org/show_bug.cgi?id=78397
+
+        Reviewed by Ryosuke Niwa.
+
+        Tests: fast/dom/document-set-title-mutation-crash.html
+               fast/dom/option-text-mutation-crash.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::setTextContent):
+        * dom/Text.cpp:
+        (WebCore::Text::replaceWholeText):
+        * editing/markup.cpp:
+        (WebCore::trimFragment):
+        (WebCore::replaceChildrenWithFragment):
+        (WebCore::replaceChildrenWithText):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setText):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::setText):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::insertRow):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setDefaultValue):
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::setText):
+
+2012-03-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Some trivial file stream cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=79955
+
+        Reviewed by Sam Weinig.
+
+        No change in functionality.
+
+        * fileapi/FileStreamProxy.cpp: Tweaked comment, and added copyright for earlier changes.
+
+        * fileapi/FileStreamProxy.h: Added a FIXME telling that this should be in platform.
+
+        * platform/AsyncFileStream.h: Tweaked includes and added a FIXME about this to stop being
+        a subclass.
+
+        * platform/FileStreamClient.h: Removed obvious comments, and added ones explaing in-band
+        error signals.
+
+        * platform/network/BlobResourceHandle.cpp: Removed an include outside of platform, and an
+        unused constant.
+
+2012-03-01  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Appending ShadowRoot into an element should not cause crash.
+        https://bugs.webkit.org/show_bug.cgi?id=79620
+
+        Reviewed by Dimitri Glazkov.
+
+        We should treat ShadowRoot as a document fragment.
+
+        Test: fast/dom/shadow/shadow-root-append.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::collectTargetNodes):
+
+2012-03-01  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: use live location to update console message bubbles.
+        https://bugs.webkit.org/show_bug.cgi?id=80023
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._uiSourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._consoleMessageAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._addConsoleMessageToScript.updateLocation):
+        (WebInspector.DebuggerPresentationModel.prototype._addConsoleMessageToScript):
+        (WebInspector.DebuggerPresentationModel.prototype._addPendingConsoleMessage):
+        (WebInspector.DebuggerPresentationModel.prototype._addPendingConsoleMessagesToScript):
+        (WebInspector.DebuggerPresentationModel.prototype._consoleCleared):
+        (WebInspector.DebuggerPresentationModel.prototype.messagesForUISourceCode):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptForURLAndLocation):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode):
+
+2012-03-01  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Show tooltips with IndexedDB objects meta information
+        https://bugs.webkit.org/show_bug.cgi?id=80022
+
+        Reviewed by Pavel Feldman.
+
+        Added tooltips with meta information for IndexedDB databases, object stores and indexes.
+        Added keyPath: prefix to key columns in IndexedDB data grid.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/IndexedDBViews.js:
+        (WebInspector.IDBDataView.prototype._createDataGrid):
+        (WebInspector.IDBDataView.prototype._keyPathHeader):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.IDBDatabaseTreeElement.prototype.update):
+        (WebInspector.IDBDatabaseTreeElement.prototype._updateTooltip):
+        (WebInspector.IDBObjectStoreTreeElement.prototype.update):
+        (WebInspector.IDBObjectStoreTreeElement.prototype._updateTooltip):
+        (WebInspector.IDBIndexTreeElement.prototype.update):
+        (WebInspector.IDBIndexTreeElement.prototype._updateTooltip):
+
+2012-03-01  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: hide color picker on Esc and Enter.
+        https://bugs.webkit.org/show_bug.cgi?id=79915
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Spectrum.js:
+        (WebInspector.Spectrum.prototype.reposition):
+        (WebInspector.Spectrum.prototype.hide):
+        (WebInspector.Spectrum.prototype._onKeyDown):
+
+2012-03-01  Huang Dongsung  <luxtella@company100.net>
+
+        [Qt] Fixed incorrect size pixmap creation for a new transparency layer.
+        https://bugs.webkit.org/show_bug.cgi?id=79658
+
+        If QPainter does not have clipping, beginPlatformTransparencyLayer can create
+        wrong size pixmap, so it causes incorrect rendering.
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::beginPlatformTransparencyLayer):
+
+2012-03-01  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove dead style option code.
+        https://bugs.webkit.org/show_bug.cgi?id=80017
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        QtStyleOptionWebComboBox provides functionality (bool multiple()) that
+        is not called from anywhere (and the base class does not have it as a
+        virtual function).
+
+        * Target.pri:
+        * platform/qt/QtStyleOptionWebComboBox.h: Removed.
+        * platform/qt/RenderThemeQStyle.cpp:
+        (WebCore::RenderThemeQStyle::paintMenuList):
+        (WebCore::RenderThemeQStyle::paintMenuListButton):
+
+2012-03-01  Stephen Chenney  <schenney@chromium.org>
+
+        Crash in WebCore::SVGDocumentExtensions::removeAnimationElementFromTarget
+        https://bugs.webkit.org/show_bug.cgi?id=79831
+
+        Reviewed by Eric Seidel.
+
+        Out-of-order operations in the SVGSMILElement::removedFromDocument
+        method caused its target to be removed and then re-added due to a
+        later call. This led to the target being set on the animation while
+        the target element itself was unaware. At deletion time, this caused a
+        crash (or assert in debug builds). Thanks to Abhishek Arya for help
+        with the layout test.
+
+        Test: svg/animations/smil-element-target-crash-main.html
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::removedFromDocument):
+
+2012-03-01  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: move heap snapshot nodes data to external array.
+        https://bugs.webkit.org/show_bug.cgi?id=79911
+
+        Reviewed by Vsevolod Vlasov.
+
+        Tests:
+        heap-shapshot.html
+        heap-shapshot-loader.html
+
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.Int32Array):
+        (WebInspector.Int32Array.prototype.get array):
+        (WebInspector.HeapSnapshotLoader.prototype._parseNodes):
+        (WebInspector.HeapSnapshotLoader.prototype.pushJSONChunk):
+        (WebInspector.HeapSnapshot):
+        (WebInspector.HeapSnapshot.prototype._init):
+
+2012-03-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Introduce SMIL overrideStyle, to make SVG stop mutating CSS styles directly
+        https://bugs.webkit.org/show_bug.cgi?id=79790
+
+        Reviewed by Zoltan Herczeg.
+
+        Next step towards enabling animVal support for XML attribute animations.
+        When SVG CSS properties are animated using SMIL, we currently mutate
+        the target elements style, and have to keep a baseValue around as String
+        to be able to recover from the DOM mutations at the end, if fill!="freeze".
+
+        The approach required by SMIL is to keep around an override style declaration
+        set and apply it right after the inline style declarations. Implement that
+        finally, to avoid mutating styles directly.
+
+        Test: svg/animations/attributeTypes.html
+
+        * css/CSSStyleSelector.cpp: Model "SMIL animation style" applying just like "inline style" declarations.
+        (WebCore::CSSStyleSelector::addElementStyleProperties): Refactored common code from matchAllRules().
+        (WebCore::CSSStyleSelector::matchAllRules): Apply "SMIL animation style" after "inline style" declarations, as specified in SMIL2.
+        * css/CSSStyleSelector.h: Add new addElementStyleProperties() helper.
+        * svg/SVGAnimateElement.cpp: Keep track of animation state, if it's about to end, clear "SMIL animation style" upon next applyResultToTarget() call.
+        (WebCore::SVGAnimateElement::SVGAnimateElement):
+        (WebCore::SVGAnimateElement::applyResultsToTarget): Reset the CSS property we're animating int the "SMIL animation style", after animation ends.
+                                                            (Instead of resetting target->style() properties to the old baseValue, as we used to do).
+        (WebCore::SVGAnimateElement::endedActiveInterval): Set m_aboutToStopAnimation to true, so next call to applyResultsToTarget() knows the animation ends.
+        * svg/SVGAnimateElement.h: Store bool m_aboutToSTopAnimation;
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::setTargetAttributeAnimatedCSSValue):
+        (WebCore::setTargetAttributeAnimatedXMLValue):
+            Refactored both of these methods from setTargetAttributeAnimatedValue().
+            Changed the CSS part, to apply property changes to the "SMIL animation style" instead of the regular StylePropertySet.
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue): Refactored code, use shouldApplyAnimation() to determine whether this animation should run.
+        (WebCore::SVGAnimationElement::resetAnimationState): New helper calling setTargetAttributeAnimatedValue with a null-string for CSS attributes, when the animation ends.
+                                                             This is used to detect that the CSS property should be removed from the "SMIL animation style".
+        (WebCore::SVGAnimationElement::shouldApplyAnimation): Refactored from existing code, and make it more obvious how attributeType influences the animation, all according to SVG 1.1/SMIL2.
+        * svg/SVGAnimationElement.h:
+        * svg/SVGElement.cpp: Manage the "SMIL animation style", in SVGElementRareData, if needed. Only gets created if SMIL animations on CSS properties run.
+        (WebCore::SVGElement::~SVGElement): Destroy SMIL animation style, upon destruction.
+        (WebCore::SVGElement::animatedSMILStyleProperties): Returns the StylePropertySet for the "SMIL animation style", if it's available.
+        (WebCore::SVGElement::ensureAnimatedSMILStyleProperties): Enforces creating the StylePropertySet for the "SMIL animation style".
+        * svg/SVGElement.h: Expose new methods.
+        * svg/SVGElementRareData.h: Stores the "SMIL animation style", actual managment is done by SVGElement, if needed.
+        (WebCore::SVGElementRareData::animatedSMILStyleProperties): Retrieve it.
+        (WebCore::SVGElementRareData::ensureAnimatedSMILStyleProperties): Create it.
+        (WebCore::SVGElementRareData::destroyAnimatedSMILStyleProperties): Destroy it.
+        * svg/animation/SVGSMILElement.h: Make endedActiveInterval() virtual again, its needed by SVGAnimateElement now.
+
+2012-03-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Unreviewed, rolling out r109255.
+        http://trac.webkit.org/changeset/109255
+        https://bugs.webkit.org/show_bug.cgi?id=79932
+
+        Breaks rounded rects with dashed strokes in SVG
+
+        * WebCore.exp.in:
+        * platform/graphics/Path.cpp:
+        (WebCore::Path::addRoundedRect):
+        * platform/graphics/Path.h:
+        (Path):
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2012-03-01  Adam Barth  <abarth@webkit.org>
+
+        DOMWindow shouldn't have any INDEXED_DATABASE ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=80013
+
+        Reviewed by Kentaro Hara.
+
+        Before this patch, DOMWindow still knew about IDB because of the
+        database factory.  This patch moves the factory to
+        DOMWindowIndexedDatabase.
+
+        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
+        (WebCore::DOMWindowIndexedDatabase::DOMWindowIndexedDatabase):
+        (WebCore::DOMWindowIndexedDatabase::from):
+        (WebCore):
+        (WebCore::DOMWindowIndexedDatabase::disconnectFrame):
+        (WebCore::DOMWindowIndexedDatabase::webkitIndexedDB):
+        * Modules/indexeddb/DOMWindowIndexedDatabase.h:
+        (DOMWindowIndexedDatabase):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::clear):
+        (WebCore):
+        * page/DOMWindow.h:
+        (DOMWindow):
+
+2012-03-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        SVG <use> element allows invalid contents
+        https://bugs.webkit.org/show_bug.cgi?id=77764
+
+        Reviewed by Zoltan Herczeg.
+
+        Unbreak the world after r109299 - dozens of SVGUseElement tests fail in trunk because:
+        - text nodes weren't allowed in SVG shadow subtrees
+        - tagName matching ignores any prefixes, thus svg:circle fails to identify as SVGCircleElement
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::isDisallowedElement):
+
+2012-03-01  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitHyphens in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80004
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-02-29  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: abstract out the common pattern of creating auto-updated locations.
+        https://bugs.webkit.org/show_bug.cgi?id=79906
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.PresentationCallFrame.prototype.uiLocation):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype.discard):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype._update):
+        (WebInspector.DebuggerPresentationModel.LinkifierFormatter.prototype.formatRawSourceCodeAnchor):
+        (WebInspector.DebuggerPresentationModel.DefaultLinkifierFormatter.prototype.formatRawSourceCodeAnchor):
+        (WebInspector.DebuggerPresentationModel.Linkifier):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyRawSourceCode):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.reset):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype._updateAnchor):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype.createLiveLocation):
+        (WebInspector.RawSourceCode.LiveLocation):
+        (WebInspector.RawSourceCode.LiveLocation.prototype.init):
+        (WebInspector.RawSourceCode.LiveLocation.prototype.dispose):
+        (WebInspector.RawSourceCode.LiveLocation.prototype._update):
+
+2012-03-01  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Make the tiling code slightly smarter
+        https://bugs.webkit.org/show_bug.cgi?id=80015
+
+        Reviewed by Simon Hausmann.
+
+        Avoid doing the same tranformations all over in each call to
+        tileRectForCoordinate.
+
+        Do not resize tiles and then drop them because they are not out of
+        the keep rect; instead drop before resizing.
+
+        Rename dropTilesOutsideRect to setKeepRect as it now stored the keep
+        rect. This is used to avoid unneeded iteration of all tiles for
+        invalidates outside the keep rect.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::invalidate):
+        (WebCore):
+        (WebCore::TiledBackingStore::commitScaleChange):
+        (WebCore::TiledBackingStore::coverageRatio):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::adjustForContentsRect):
+        (WebCore::TiledBackingStore::resizeEdgeTiles):
+        (WebCore::TiledBackingStore::setKeepRect):
+        (WebCore::TiledBackingStore::removeAllNonVisibleTiles):
+        (WebCore::TiledBackingStore::tileRectForCoordinate):
+        (WebCore::TiledBackingStore::setSupportsAlpha):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-02-29  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Use the new createSnapshotFileAndReadMetadata API for FileEntry.file()
+        https://bugs.webkit.org/show_bug.cgi?id=79928
+
+        Reviewed by David Levin.
+
+        No new tests: no functionality changes.
+        fast/filesystem/ tests should use the new code (they should pass once
+        the corresponding chromium change is rolled in).
+
+        * fileapi/DOMFileSystem.cpp:
+        (WebCore::DOMFileSystem::createFile): Updated to use the new API.
+        * fileapi/DOMFileSystemSync.cpp:
+        (WebCore::DOMFileSystemSync::createFile): Updated to use the new API.
+        * fileapi/FileSystemCallbacks.cpp:
+        * fileapi/FileSystemCallbacks.h:
+        (FileSystemCallbacksBase):
+        * platform/AsyncFileSystem.h:
+        (AsyncFileSystem):
+        * platform/AsyncFileSystemCallbacks.h: Added default implementation (which just calls ASSERT_NOTREACHED()) so that subclasses can focus only on the callback methods that they're interested in.
+
+2012-02-29  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: add UISourceCode.isEditable property.
+        https://bugs.webkit.org/show_bug.cgi?id=79909
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.canEditScriptSource):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype._createUISourceCode):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode):
+
+2012-02-29  Shinya Kawanaka  <shinyak@chromium.org> 
+
+        Fallback elements in non-youngest shadow tree should not be rendered.
+        https://bugs.webkit.org/show_bug.cgi?id=80002
+
+        Reviewed by Hajime Morita.
+
+        Fallback elements in non-youngest shadow tree should not be rendered, so its phase should be
+        AttachingNotDistributed instead of AttachingFallbacked.
+
+        Tests: multiple-shadowroot-rendering.html covers this patch.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+
+2012-02-29  Adam Barth  <abarth@webkit.org>
+
+        ScriptExecutionContext has too many ifdef ENABLE(SQL_DATABASE)
+        https://bugs.webkit.org/show_bug.cgi?id=79633
+
+        Reviewed by Eric Seidel.
+
+        This class creates a DatabaseContext object to supplement the
+        ScriptExecutionContext with database-specific information.  This new
+        object lets us remove a bunch of database-specific (and ifdefed) logic
+        from ScriptExecutionContext.(cpp|h).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore):
+        * dom/ScriptExecutionContext.h:
+        (WebCore):
+        (ScriptExecutionContext):
+        * history/PageCache.cpp:
+        (WebCore::logCanCacheFrameDecision):
+        (WebCore::PageCache::canCachePageContainingThisFrame):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        * platform/Supplementable.h:
+        (WebCore::Supplementable::provideSupplement):
+        (WebCore::Supplementable::requireSupplement):
+        (Supplementable):
+        * storage/AbstractDatabase.cpp:
+        (WebCore::AbstractDatabase::AbstractDatabase):
+        * storage/AbstractDatabase.h:
+        (WebCore):
+        (WebCore::AbstractDatabase::databaseContext):
+        (AbstractDatabase):
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::close):
+        (WebCore::Database::closeImmediately):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::scheduleTransaction):
+        (WebCore::Database::scheduleTransactionStep):
+        (WebCore::Database::transactionClient):
+        (WebCore::Database::transactionCoordinator):
+        (WebCore::Database::tableNames):
+        (WebCore::Database::securityOrigin):
+        * storage/DatabaseContext.cpp: Added.
+        (WebCore):
+        (WebCore::existingDatabaseContextFrom):
+        (WebCore::DatabaseContext::DatabaseContext):
+        (WebCore::DatabaseContext::~DatabaseContext):
+        (WebCore::DatabaseContext::from):
+        (WebCore::DatabaseContext::databaseThread):
+        (WebCore::DatabaseContext::hasOpenDatabases):
+        (WebCore::DatabaseContext::stopDatabases):
+        * storage/DatabaseContext.h: Added.
+        (WebCore):
+        (DatabaseContext):
+        (WebCore::DatabaseContext::setHasOpenDatabases):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::checkAndHandleClosedOrInterruptedDatabase):
+        (WebCore::SQLTransaction::notifyDatabaseThreadIsShuttingDown):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadShutdownStartTask::performTask):
+
+2012-02-29  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Refactoring: HTMLContentSelector should be InsertionPoint-aware.
+        https://bugs.webkit.org/show_bug.cgi?id=79901
+
+        Reviewed by Hajime Morita.
+
+        ContentSelectorQuery took HTMLContentElement as argument, but patch changes it to take InsertionPoint instead.
+        If InsertionPoint is not HTMLContentElement, ContentSelectorQuery will selects the rest of light children.
+
+        Now InsertionPoint has pure virtual method 'select'. <shadow> will implement this as a method returning empty string.
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::hasInsertionPoint):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::needsReattachHostChildrenAndShadow):
+        (WebCore::ShadowTree::hostChildrenChanged):
+        * html/shadow/ContentSelectorQuery.cpp:
+        (WebCore::ContentSelectorQuery::ContentSelectorQuery):
+        (WebCore::ContentSelectorQuery::matches):
+        * html/shadow/ContentSelectorQuery.h:
+        (WebCore):
+        (ContentSelectorQuery):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::detach):
+        * html/shadow/HTMLContentElement.h:
+        (WebCore::toHTMLContentElement):
+        (WebCore):
+        * html/shadow/HTMLContentSelector.cpp:
+        (WebCore::HTMLContentSelector::select):
+        * html/shadow/HTMLContentSelector.h:
+        (HTMLContentSelector):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+
+2012-02-29  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertySpeak in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79879
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * rendering/style/RenderStyle.h:
+
+2012-02-29  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitColumnAxis in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79869
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-02-29  Erik Arvidsson  <arv@chromium.org>
+
+        Rename DOMSelection to Selection
+        https://bugs.webkit.org/show_bug.cgi?id=79688
+
+        Reviewed by Adam Barth.
+
+        No new tests. Existing tests have been updated to cover this.
+
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+
+2012-02-29  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: IDBDatabase.objectStoreNames and IDObjectStore.indexNames results should be sorted
+        https://bugs.webkit.org/show_bug.cgi?id=79950
+
+        Reviewed by Tony Chang.
+
+        Test: storage/indexeddb/list-ordering.html
+
+        * dom/DOMStringList.cpp: Added sort method, not exposed via IDL.
+        (WebCore::DOMStringList::sort):
+        (WebCore):
+        * dom/DOMStringList.h:
+        (DOMStringList):
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::objectStoreNames):
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::indexNames):
+
+2012-02-29  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Estimate pixel count for frame rate control
+        https://bugs.webkit.org/show_bug.cgi?id=74982
+
+        Reviewed by James Robinson.
+
+        Value checks added to unit tests.
+
+        Adds mechanism to compute and collect statistics on pixel overdraw for selected frames.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::optimizeRenderPasses):
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        (WebCore::wedgeProduct):
+        (WebCore):
+        (WebCore::quadArea):
+        (WebCore::CCQuadCuller::cullOccludedQuads):
+        * platform/graphics/chromium/cc/CCQuadCuller.h:
+        (CCQuadCuller):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::optimizeQuads):
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (CCOverdrawCounts):
+        (WebCore):
+        (CCRenderPass):
+
+2012-02-29  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry]Make about:cache feature available in release version.
+        https://bugs.webkit.org/show_bug.cgi?id=79866
+
+        Reviewed by Antonio Gomes.
+
+        No tests.
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::handleAbout):
+
+2012-02-29  James Simonsen  <simonjam@chromium.org>
+
+        [chromium] Fix navigation start time on cross-renderer navigation
+        https://bugs.webkit.org/show_bug.cgi?id=75922
+
+        Reviewed by Darin Fisher.
+
+        * loader/DocumentLoadTiming.cpp:
+        (WebCore::DocumentLoadTiming::setNavigationStart): Added.
+        * loader/DocumentLoadTiming.h:
+
+2012-02-29  Stephen Chenney  <schenney@chromium.org>
+
+        SVG <use> element allows invalid contents
+        https://bugs.webkit.org/show_bug.cgi?id=77764
+
+        Reviewed by Nikolas Zimmermann.
+
+        Modify the isDisallowedElement method to disallow all of the
+        disallowed elements, instead of just a few. It is now a whitelist
+        implementation.
+
+        This also fixes bugs 78807, 78838 and 79798 related to memory
+        corruption issues.
+
+        Tests: svg/custom/bug78807.svg
+               svg/custom/bug78838.html
+               svg/custom/bug79798.html
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::isDisallowedElement):
+
+2012-02-29  Ami Fischman  <fischman@chromium.org>
+
+        Continue the search for playable mime types among <source> children of <video> even when using data: URLs
+        https://bugs.webkit.org/show_bug.cgi?id=79934
+
+        Reviewed by Eric Carlson.
+
+        Test: media/sources-fallback-codecs.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectNextSourceChild):
+
+2012-02-29  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Add impl-thread support for animation-timing-function
+        https://bugs.webkit.org/show_bug.cgi?id=79819
+
+        Reviewed by James Robinson.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp:
+        (WebCore::CCKeyframe::CCKeyframe):
+        (WebCore):
+        (WebCore::CCKeyframe::~CCKeyframe):
+        (WebCore::CCKeyframe::time):
+        (WebCore::CCKeyframe::timingFunction):
+        (WebCore::CCFloatKeyframe::create):
+        (WebCore::CCFloatKeyframe::CCFloatKeyframe):
+        (WebCore::CCFloatKeyframe::~CCFloatKeyframe):
+        (WebCore::CCFloatKeyframe::value):
+        (WebCore::CCFloatKeyframe::clone):
+        (WebCore::CCTransformKeyframe::create):
+        (WebCore::CCTransformKeyframe::CCTransformKeyframe):
+        (WebCore::CCTransformKeyframe::~CCTransformKeyframe):
+        (WebCore::CCTransformKeyframe::value):
+        (WebCore::CCTransformKeyframe::clone):
+        (WebCore::CCKeyframedFloatAnimationCurve::create):
+        (WebCore::CCKeyframedFloatAnimationCurve::CCKeyframedFloatAnimationCurve):
+        (WebCore::CCKeyframedFloatAnimationCurve::addKeyframe):
+        (WebCore::CCKeyframedFloatAnimationCurve::duration):
+        (WebCore::CCKeyframedFloatAnimationCurve::clone):
+        (WebCore::CCKeyframedFloatAnimationCurve::getValue):
+        (WebCore::CCKeyframedTransformAnimationCurve::create):
+        (WebCore::CCKeyframedTransformAnimationCurve::CCKeyframedTransformAnimationCurve):
+        (WebCore::CCKeyframedTransformAnimationCurve::~CCKeyframedTransformAnimationCurve):
+        (WebCore::CCKeyframedTransformAnimationCurve::addKeyframe):
+        (WebCore::CCKeyframedTransformAnimationCurve::duration):
+        (WebCore::CCKeyframedTransformAnimationCurve::clone):
+        (WebCore::CCKeyframedTransformAnimationCurve::getValue):
+        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h:
+        (CCKeyframe):
+        (CCFloatKeyframe):
+        (WebCore):
+        (CCTransformKeyframe):
+        (CCKeyframedFloatAnimationCurve):
+        (CCKeyframedTransformAnimationCurve):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
+        * platform/graphics/chromium/cc/CCTimingFunction.cpp: Added.
+        (WebCore):
+        (WebCore::CCTimingFunction::CCTimingFunction):
+        (WebCore::CCTimingFunction::~CCTimingFunction):
+        (WebCore::CCTimingFunction::duration):
+        (WebCore::CCCubicBezierTimingFunction::create):
+        (WebCore::CCCubicBezierTimingFunction::CCCubicBezierTimingFunction):
+        (WebCore::CCCubicBezierTimingFunction::~CCCubicBezierTimingFunction):
+        (WebCore::CCCubicBezierTimingFunction::getValue):
+        (WebCore::CCCubicBezierTimingFunction::clone):
+        (WebCore::CCEaseTimingFunction::create):
+        (WebCore::CCEaseInTimingFunction::create):
+        (WebCore::CCEaseOutTimingFunction::create):
+        (WebCore::CCEaseInOutTimingFunction::create):
+        * platform/graphics/chromium/cc/CCTimingFunction.h: Added.
+        (WebCore):
+        (CCTimingFunction):
+        (CCCubicBezierTimingFunction):
+        (CCEaseTimingFunction):
+        (CCEaseInTimingFunction):
+        (CCEaseOutTimingFunction):
+        (CCEaseInOutTimingFunction):
+
+2012-02-29  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Methods in ShadowTree and TreeScopeAdopter should be multiple shadow roots aware.
+        https://bugs.webkit.org/show_bug.cgi?id=79768
+
+        Reviewed by Hajime Morita.
+
+        Some methods in ShadowTree and TreeScopeAdopter were not multiple shadow roots aware.
+        They should consider multiple shadow roots.
+
+        Test: fast/dom/shadow/multiple-shadowroot-adopt.html
+
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::setParentTreeScope):
+        (WebCore):
+        (WebCore::ShadowTree::childNeedsStyleRecalc):
+        (WebCore::ShadowTree::needsStyleRecalc):
+        * dom/ShadowTree.h:
+        (WebCore):
+        (ShadowTree):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::shadowTreeFor):
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        (WebCore::TreeScopeAdopter::moveTreeToNewDocument):
+        (WebCore::TreeScopeAdopter::moveShadowTreeToNewDocument):
+        (WebCore):
+        * dom/TreeScopeAdopter.h:
+        (TreeScopeAdopter):
+
+2012-02-29  David Levin  <levin@chromium.org>
+
+        [chromium] Add the ability to turn off autoresize.
+        https://bugs.webkit.org/show_bug.cgi?id=77452
+
+        Reviewed by Darin Fisher.
+
+        Test: fast/autoresize/turn-off-autoresize.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::enableAutoSizeMode): Fix the code
+        path for turning off autoresize to set the scrollbars to auto.
+
+2012-02-29  David Barton  <dbarton@mathscribe.com>
+
+        <msubsup> setNeedsLayout() correction
+        https://bugs.webkit.org/show_bug.cgi?id=79856
+
+        Reviewed by Julien Chaffraix.
+
+        m_scripts->setNeedsLayout(true, false); needs to be added to the fix for bug 79274.
+
+        No new tests. It's actually difficult to test the need for this with the current code,
+        because there are a lot of extra setNeedsLayout() calls right now. I caught this after
+        removing some of those calls that should be redundant, for a future patch. Actually
+        removing those calls now changes other behavior, due to other bugs, so I'll save all
+        that for future patches. We should land this fix now though I think, as it could
+        possibly matter in some cases.
+
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::layout):
+
+2012-02-29  Andreas Kling  <awesomekling@apple.com>
+
+        IsSynchronizingStyleAttributeFlag could be purged.
+        <http://webkit.org/b/79313>
+
+        Reviewed by Anders Carlsson.
+
+        We were using IsSynchronizingStyleAttributeFlag to prevent various things from
+        happening below setAttribute() when serializing the "style" attribute based on
+        an element's inline style.
+
+        Simplify the whole thing by adding a way to set an attribute without triggering
+        any callbacks (a 'notifyChanged' argument to Element::setAttribute().)
+        This removes the need for IsSynchronizingStyleAttributeFlag in the first place
+        and makes StyledElement::updateStyleAttribute() a bit cheaper to boot.
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::setAttributeInternal):
+        (WebCore::Element::willModifyAttribute):
+        (WebCore::Element::didModifyAttribute):
+        (WebCore::Element::didRemoveAttribute):
+        * dom/Element.h:
+        * dom/Node.h:
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateStyleAttribute):
+        (WebCore::StyledElement::attributeChanged):
+        * html/HTMLElement.cpp:
+        (WebCore::StyledElement::copyNonAttributeProperties):
+
+2012-02-29  Daniel Cheng  <dcheng@chromium.org>
+
+        [chromium] REGRESSION: Cannot drag a file out
+        https://bugs.webkit.org/show_bug.cgi?id=79817
+
+        Reviewed by Ryosuke Niwa.
+
+        Temporary fix for file drag out. This change won't be needed once DataTransferItemList
+        support is better implemented.
+
+        Test: platform/chromium/fast/events/drag-downloadURL.html
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::types):
+
+2012-02-29  Luke Macpherson   <macpherson@chromium.org>
+
+        Clean up CSSPrimitiveValue::computeLengthDouble().
+        https://bugs.webkit.org/show_bug.cgi?id=77065
+
+        Reviewed by Eric Seidel.
+
+        Refactoring only / no behavioral change.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+
+2012-02-29  Beth Dakin  <bdakin@apple.com>
+
+        Speculative build-fix.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+
+2012-02-29  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79705
+        didNewFirstVisuallyNonEmptyLayout should be enhanced to look at size instead 
+        of a raw tally
+        -and corresponding-
+        <rdar://problem/10821314>
+
+        Reviewed by Dave Hyatt.
+
+        Instead of firing didNewFirstVisuallyNonEmptyLayout() when a raw tally of 
+        relevant painted objects has reached a port-defined threshold, this patch 
+        looks at the size of those objects with respect to the view area. The patch 
+        also looks at relevant objects that cannot yet be fully painted, such as 
+        incrementally loading images. 
+
+        We no longer need a HashSet for the relevant painted objects since Region can 
+        do all of the heavy lifting. We now have a Region for the painted and 
+        unpainted regions. We do need a HashSet for the unpainted objects though, 
+        because we need to know if a painted object needs to be subtracted from the 
+        unpainted region before being added to the painted region.
+        * page/Page.cpp:
+        (WebCore):
+        (WebCore::Page::isCountingRelevantRepaintedObjects):
+        (WebCore::Page::startCountingRelevantRepaintedObjects):
+        (WebCore::Page::resetRelevantPaintedObjectCounter):
+        (WebCore::Page::addRelevantRepaintedObject):
+        (WebCore::Page::addRelevantUnpaintedObject):
+        * page/Page.h:
+        (Page):
+
+        New function on Region iterates through the rects and calculates the total 
+        area.
+        * platform/graphics/Region.cpp:
+        (WebCore::Region::totalArea):
+        (WebCore):
+        * platform/graphics/Region.h:
+        (Region):
+
+        Remove code from these classes since they are not actually relevant objects.
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::paint):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::paintReplaced):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+
+        All of these other callers send a rect that actually represents their size 
+        (usually the visualOverflowRect) instead of the paintInfo's paintRect, and 
+        they call addRelevantUnpaintedObject when appropriate.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::paint):
+        (WebCore::RenderEmbeddedObject::paintReplaced):
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::paintReplaced):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::paintReplaced):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paintReplaced):
+
+2012-02-29  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Resource leak with IDBObjectStore.openCursor
+        https://bugs.webkit.org/show_bug.cgi?id=79835
+
+        IDBCursor object that were never continue()'d to the end would leak due to a 
+        reference cycle with IDBRequest. In addition, the IDBRequest would never be
+        marked "finished" which would prevent GC from reclaiming it. IDBTransactions
+        now track and notify IDBCursors to break these references when the transaction
+        can no longer not process requests.
+
+        Reviewed by Tony Chang.
+
+        Tests: storage/indexeddb/cursor-continue.html
+
+        * storage/IDBCursor.cpp:
+        (WebCore::IDBCursor::IDBCursor): Register with IDBTransaction bookkeeping.
+        (WebCore::IDBCursor::continueFunction): Early error if transaction has finished.
+        (WebCore::IDBCursor::close): Break the reference cycle with IDBRequest, and notify it
+        that the cursor is finished.
+        (WebCore):
+        * storage/IDBCursor.h:
+        (WebCore):
+        (IDBCursor):
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::finishCursor): If there is no request in flight, mark itself as
+        finished to allow GC.
+        (WebCore):
+        (WebCore::IDBRequest::dispatchEvent): Once an in-flight request has been processed,
+        mark the request as finished if the cursor is finished, to allow GC.
+        * storage/IDBRequest.h:
+        (IDBRequest):
+        * storage/IDBTransaction.cpp: Track open cursors, close them when finished.
+        (WebCore::IDBTransaction::OpenCursorNotifier::OpenCursorNotifier):
+        (WebCore):
+        (WebCore::IDBTransaction::OpenCursorNotifier::~OpenCursorNotifier):
+        (WebCore::IDBTransaction::registerOpenCursor):
+        (WebCore::IDBTransaction::unregisterOpenCursor):
+        (WebCore::IDBTransaction::closeOpenCursors):
+        (WebCore::IDBTransaction::onAbort):
+        (WebCore::IDBTransaction::onComplete):
+        * storage/IDBTransaction.h:
+        (WebCore):
+        (OpenCursorNotifier):
+        (IDBTransaction):
+
+2012-02-29  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79940
+        <rdar://problem/10080189>
+        
+        Add support in WebKit for an intra-line character grid for Japanese text layout.
+        
+        Patch logicalLeftOffsetForLine and logicalRightOffsetForLine in order to get the
+        basic edge snapping grid functionality up and running. See all the FIXMEs in the function for
+        some of the issues that still have to be dealt with for it to really work well.
+
+        Reviewed by Dan Bernstein.
+
+        Added new tests in fast/line-grid.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+
+2012-02-29  Anders Carlsson  <andersca@apple.com>
+
+        [Chromium] Some Layout Tests in platform/chromium/rubberbanding and platform/chromium/compositing/rubberbanding are failing
+        https://bugs.webkit.org/show_bug.cgi?id=79878
+
+        Reviewed by James Robinson.
+
+        Make sure that ScrollableArea::setScrollOffsetFromAnimation doesn't end up
+        setting the ScrollAnimator's current scroll position by making a new function, scrollPositionChanged,
+        that both notifyScrollPositionChanged and setScrollOffsetFromAnimation call and move the call to update
+        the position to notifyScrollPositionChanged.
+
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::notifyScrollPositionChanged):
+        (WebCore):
+        (WebCore::ScrollableArea::scrollPositionChanged):
+        (WebCore::ScrollableArea::setScrollOffsetFromAnimation):
+        * platform/ScrollableArea.h:
+        (ScrollableArea):
+
+2012-02-29  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Don't let invalidation for next frame prevent tile upload
+        https://bugs.webkit.org/show_bug.cgi?id=79841
+
+        Reviewed by James Robinson.
+
+        We currently don't push dirty tiles to the impl thread so there are no
+        tiles with garbage data on the impl thread. However, this judgement is
+        overzealous and blocks tiles that get invalidated by WebKit for the
+        next frame during the paint of the current frame.
+
+        Instead, check if a tile is dirty and was not painted for the current
+        frame when deciding to push the tile to the impl thread. This requires
+        that we know if a tile was painted during the current frame, which we
+        can do if we always reset m_updateRect to be empty each frame.
+
+        New unit tests: TiledLayerChromiumTest.pushTilesMarkedDirtyDuringPaint
+                        TiledLayerChromiumTest.pushTilesLayerMarkedDirtyDuringPaintOnNextLayer
+                        TiledLayerChromiumTest.pushTilesLayerMarkedDirtyDuringPaintOnPreviousLayer
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::UpdatableTile::isDirtyForCurrentFrame):
+        (WebCore::TiledLayerChromium::pushPropertiesTo):
+        (WebCore::TiledLayerChromium::prepareToUpdateTiles):
+        (WebCore::TiledLayerChromium::resetUpdateState):
+        (WebCore):
+        (WebCore::TiledLayerChromium::prepareToUpdate):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+
+2012-02-29  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: MediaStreamTrackList out-of-bounds access fix
+        https://bugs.webkit.org/show_bug.cgi?id=79889
+
+        Reviewed by Adam Barth.
+
+        Out-of-bounds access to MediaStreamTrackList ASSERTS instead of returning 0,
+        this is not according to ecmascript standard. Also fixed a similar issue in MediaStreamList.
+
+        Test: fast/mediastream/peerconnection-mediastreamlist.html
+
+        * Modules/mediastream/MediaStreamList.cpp:
+        (WebCore::MediaStreamList::item):
+        * Modules/mediastream/MediaStreamTrackList.cpp:
+        (WebCore::MediaStreamTrackList::item):
+
+2012-02-29  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/FloatSize.h
+        https://bugs.webkit.org/show_bug.cgi?id=79893
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::FloatSize and BlackBerry::Platform::FloatSize.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/FloatSize.h:
+        (Platform):
+        (FloatSize):
+
+2012-02-29  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/FloatRect.h
+        https://bugs.webkit.org/show_bug.cgi?id=79891
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::FloatRect and BlackBerry::Platform::FloatRect.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/FloatRect.h:
+        (Platform):
+        (FloatRect):
+
+2012-02-29  Tim Horton  <timothy_horton@apple.com>
+
+        Make use of CG rounded-rect primitives
+        https://bugs.webkit.org/show_bug.cgi?id=79932
+        <rdar://problem/9274953>
+
+        Reviewed by Simon Fraser.
+
+        Dispatch to potentially platform-specific rounded rectangle path
+        construction from addPathForRoundedRect. Make use of this to call
+        wkCGPathAddRoundedRect on Lion and above, as long as the rounded
+        corners are all equivalent.
+
+        No new tests, as this is covered by many that use rounded corners,
+        and is only a performance improvement.
+
+        * WebCore.exp.in:
+        * platform/graphics/Path.cpp:
+        (WebCore::Path::addRoundedRect):
+        (WebCore):
+        (WebCore::Path::addPathForRoundedRect):
+        * platform/graphics/Path.h:
+        (Path):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::addPathForRoundedRect):
+        (WebCore):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2012-02-29  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/FloatPoint.h
+        https://bugs.webkit.org/show_bug.cgi?id=79887
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::FloatPoint and BlackBerry::Platform::FloatPoint.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/FloatPoint.h:
+        (Platform):
+        (FloatPoint):
+
+2012-02-29  Kaustubh Atrawalkar  <kaustubh@motorola.com>
+
+        ShadowRoot need innerHTML
+        https://bugs.webkit.org/show_bug.cgi?id=78473
+
+        Reviewed by Hajime Morita.
+
+        Refactor code for sharing common code between HTMLElement & ShadowRoot.
+        Implement innerHTML attribute for ShadowRoot.
+
+        Test: fast/dom/shadow/shadow-root-innerHTML.html
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::cloneNode):
+        (WebCore):
+        (WebCore::ShadowRoot::innerHTML):
+        (WebCore::ShadowRoot::setInnerHTML):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/ShadowRoot.idl:
+        * editing/markup.cpp:
+        (WebCore::urlToMarkup):
+        (WebCore):
+        (WebCore::createFragmentFromSource):
+        (WebCore::hasOneChild):
+        (WebCore::hasOneTextChild):
+        (WebCore::replaceChildrenWithFragment):
+        (WebCore::replaceChildrenWithText):
+        * editing/markup.h:
+        * html/HTMLElement.cpp:
+        (WebCore):
+
+2012-02-29  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Stop doubling maximalOutlineSize during painting
+        https://bugs.webkit.org/show_bug.cgi?id=79724
+
+        Reviewed by Tony Chang.
+
+        Refactoring only, covered by existing tests (mostly repaint ones).
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintCollapsedBorders):
+        Introduce a local repaint rectangle that we inflate by the maximalOutlineSize
+        to simplify the comparison logic. Also tried to make it clearer what's going on
+        by tweaking the existing code.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paintObject):
+        Remove the doubling.
+
+2012-02-29  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash when changing list marker locations
+        https://bugs.webkit.org/show_bug.cgi?id=79681
+
+        Reviewed by David Hyatt.
+
+        This fixes a regression crash from r108548.
+
+        There are some conditions where removing the anonymous block
+        parent at that point can cause problems. One is when there is
+        a continuation from it, and another when it is a sibling of
+        lineBoxParent and it causes lineBoxParent to be deleted
+        incidentally. This patch delays the destruction until after
+        lineBoxParent has been used and makes an exception for
+        continuations.
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::updateMarkerLocation)
+
+2012-02-29  Max Feil  <mfeil@rim.com>
+
+        [BlackBerry] Add support for FLAC audio and OGG/Vorbis audio
+        https://bugs.webkit.org/show_bug.cgi?id=79519
+
+        Reviewed by Antonio Gomes.
+
+        A layout test already exists for OGG. We do not support OGG
+        video at this time, only audio.
+
+        Test: media/media-can-play-flac-audio.html
+
+        * platform/blackberry/MIMETypeRegistryBlackBerry.cpp:
+        (WebCore):
+
+2012-02-28  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79868
+        Overlay scrollbars should respond to AppKit's NSEventPhaseMayBegin
+        -and corresponding-
+        <rdar://problem/10688637>
+
+        Reviewed by Anders Carlsson.
+
+        Scrollbars are currently drawn on the main thread even when scrolling happens 
+        on the scrolling thread, so we have to call back to the main thread for the 
+        time being to make the right drawing calls for NSEventPhaseMayBegin.
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::handleWheelEventPhase):
+        (WebCore):
+        * page/scrolling/ScrollingCoordinator.h:
+        (ScrollingCoordinator):
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::handleWheelEventPhase):
+        (WebCore):
+        * page/scrolling/ScrollingTree.h:
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::handleWheelEvent):
+        * platform/ScrollAnimator.h:
+        (WebCore::ScrollAnimator::handleWheelEventPhase):
+        (ScrollAnimator):
+
+        Call into AppKit on NSEventPhaseMayBegin.
+        * platform/mac/ScrollAnimatorMac.h:
+        (ScrollAnimatorMac):
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::mayBeginScrollGesture):
+        (WebCore):
+        (WebCore::ScrollAnimatorMac::handleWheelEventPhase):
+        (WebCore::ScrollAnimatorMac::handleWheelEvent):
+
+2012-02-28  Jer Noble  <jer.noble@apple.com>
+
+        Full screen video volume slider has "progress bar"
+        https://bugs.webkit.org/show_bug.cgi?id=79812
+
+        Reviewed by Eric Carlson.
+
+        No new tests; strictly a platform-specific look-and-feel change.
+
+        The full-screen volume slider has a "media-slider"" appearance, which is rendering as if
+        the volume slider has a "progress".  Make a concrete "media-fullscreen-volume-slider" appearance
+        which has the correct look-and-feel.
+
+        Add two new appearance keywords, media-fullscreen-volume-slider and thumb, and their associated
+        types and CSS keywords:
+        * css/CSSValueKeywords.in:
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * html/shadow/MediaControlElements.h:
+        * platform/ThemeTypes.h:
+
+        Handle the new slider and thumb types when rendering:
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::adjustMediaSliderThumbSize):
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaFullScreenVolumeSliderTrack):
+        (WebCore::RenderTheme::paintMediaFullScreenVolumeSliderThumb):
+        * rendering/RenderThemeMac.h:
+        (RenderThemeMac):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustMediaSliderThumbSize):
+        (WebCore::RenderThemeMac::paintMediaFullScreenVolumeSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaFullScreenVolumeSliderThumb):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):
+
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation): Mark the fullscreen volume slider as horizontal.
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::RenderSliderThumb::updateAppearance): Give MediaFullScreenVolumeSliderParts 
+            MediaFullScreenVolumeSliderThumbParts.
+        * css/fullscreenQuickTime.css: Change the styles for the fullscreen slider, min, and max buttons.
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-min-button):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-slider):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-max-button):
+        * html/shadow/MediaControlRootElement.cpp:
+        (WebCore::MediaControlRootElement::reset): Set the value of the fullscreen volume slider
+            when resetting.
+
+2012-02-29  Antti Koivisto  <antti@apple.com>
+
+        Applying region style should not need to access parent rules
+        https://bugs.webkit.org/show_bug.cgi?id=79910 
+         
+        Reviewed by Andreas Kling.
+
+        Currently CSSStyleSelector::applyProperties looks into parent rules to see if a rule is
+        part of region style. The plan is to eliminate the rule parent pointer so this needs to be refactored.
+        
+        Add a bit to RuleData to indicate if the StyleRule is part of a region style.
+
+        * css/CSSStyleSelector.cpp:
+        (RuleData):
+        (WebCore::RuleData::isInRegionRule):
+        (RuleSet):
+        (WebCore::CSSStyleSelector::addMatchedProperties):
+        (WebCore::CSSStyleSelector::sortAndTransferMatchedRules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+
+2012-02-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Add refresh to IndexedDB support.
+        https://bugs.webkit.org/show_bug.cgi?id=79695
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/IndexedDBViews.js:
+        (WebInspector.IDBDataView):
+        (WebInspector.IDBDataView.prototype._refreshButtonClicked):
+        (WebInspector.IDBDataView.prototype.get statusBarItems):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.IndexedDBTreeElement):
+        (WebInspector.IndexedDBTreeElement.prototype.onattach):
+        (WebInspector.IndexedDBTreeElement.prototype._handleContextMenuEvent):
+        (WebInspector.IDBDatabaseTreeElement.prototype.onattach):
+        (WebInspector.IDBDatabaseTreeElement.prototype._handleContextMenuEvent):
+        (WebInspector.IDBDatabaseTreeElement.prototype._refreshIndexedDB):
+
+2012-02-29  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: timeline markers are not shown on the timeline panel
+        https://bugs.webkit.org/show_bug.cgi?id=79921
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline.addTimestampRecords):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+
+2012-02-29  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Align InlineBox::m_expansion to a byte boundary
+        https://bugs.webkit.org/show_bug.cgi?id=79761
+
+        Add a bit to m_expansion to align a byte boundary.
+        This will make valgrind memcheck happy.
+        I confirmed sizeof(InlineBox) is unchanged.
+
+        Reviewed by Hajime Morita.
+
+        No new tests. No behavior changes.
+
+        * rendering/InlineBox.h:
+        (InlineBox): Aligned m_expansion to a byte boundary.
+
+2012-02-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Do not iterate all tiles for resizing when the content didn't change
+        https://bugs.webkit.org/show_bug.cgi?id=79787
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::createTiles):
+
+2012-02-29  Parag Radke  <parag@motorola.com>
+
+        Crash in WebCore::CompositeEditCommand::insertNodeAt
+        https://bugs.webkit.org/show_bug.cgi?id=67764
+
+        Reviewed by Ryosuke Niwa.
+
+        If caret position after deletion and destination position coincides then
+        removing the node will result in removing the destination node also. Hence crash.
+
+        Test: editing/deleting/delete-block-merge-contents-025.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cleanupAfterDeletion):
+        If the caret position after delete and the destination position
+        renderes at the same place, pruning the node and making an early exit.
+
+2012-02-29  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: remove calculator's updateBoundaries in the timeline panel.
+        https://bugs.webkit.org/show_bug.cgi?id=79907
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkBaseCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.NetworkBaseCalculator.prototype.formatTime):
+        (WebInspector.NetworkTimeCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.NetworkTimeCalculator.prototype.formatTime):
+        (WebInspector.NetworkTransferTimeCalculator.prototype.formatTime):
+        (WebInspector.NetworkTransferDurationCalculator.prototype.formatTime):
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewCalculator.prototype.formatTime):
+        (WebInspector.TimelineStartAtZeroOverview):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.update):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._toggleStartAtZeroButtonClicked):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype.get timelinePaddingLeft):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.setWindow):
+        (WebInspector.TimelineCalculator.prototype.setRecords):
+        (WebInspector.TimelineCalculator.prototype.formatTime):
+        (WebInspector.TimelineFitInWindowCalculator):
+        (WebInspector.TimelineFitInWindowCalculator.prototype.setWindow):
+        (WebInspector.TimelineFitInWindowCalculator.prototype.setRecords):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+
+2012-02-29  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: enable Profiles panel for workers
+        https://bugs.webkit.org/show_bug.cgi?id=79908
+
+        Introduced worker profiler agent. Enabled script profiling for
+        workers.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/js/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::startForPage):
+        (WebCore):
+        (WebCore::ScriptProfiler::startForWorkerContext):
+        (WebCore::ScriptProfiler::stopForPage):
+        (WebCore::ScriptProfiler::stopForWorkerContext):
+        * bindings/js/ScriptProfiler.h:
+        (WebCore):
+        (ScriptProfiler):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::startForPage):
+        (WebCore):
+        (WebCore::ScriptProfiler::startForWorkerContext):
+        (WebCore::ScriptProfiler::stopForPage):
+        (WebCore::ScriptProfiler::stopForWorkerContext):
+        * bindings/v8/ScriptProfiler.h:
+        (WebCore):
+        (ScriptProfiler):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore):
+        (PageProfilerAgent):
+        (WebCore::PageProfilerAgent::PageProfilerAgent):
+        (WebCore::PageProfilerAgent::~PageProfilerAgent):
+        (WebCore::PageProfilerAgent::startProfiling):
+        (WebCore::PageProfilerAgent::stopProfiling):
+        (WebCore::InspectorProfilerAgent::create):
+        (WorkerProfilerAgent):
+        (WebCore::WorkerProfilerAgent::WorkerProfilerAgent):
+        (WebCore::WorkerProfilerAgent::~WorkerProfilerAgent):
+        (WebCore::WorkerProfilerAgent::startProfiling):
+        (WebCore::WorkerProfilerAgent::stopProfiling):
+        (WebCore::InspectorProfilerAgent::InspectorProfilerAgent):
+        (WebCore::InspectorProfilerAgent::start):
+        (WebCore::InspectorProfilerAgent::stop):
+        * inspector/InspectorProfilerAgent.h:
+        (WebCore):
+        (InspectorProfilerAgent):
+        * inspector/WorkerInspectorController.cpp:
+        (WebCore::WorkerInspectorController::WorkerInspectorController):
+        (WebCore::WorkerInspectorController::connectFrontend):
+        (WebCore::WorkerInspectorController::disconnectFrontend):
+        (WebCore::WorkerInspectorController::restoreInspectorStateFromCookie):
+        * inspector/WorkerInspectorController.h:
+        (WebCore):
+        (WorkerInspectorController):
+        * inspector/front-end/ProfilesPanel.js:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2012-02-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Clicking relative links fails when query string contains a slash
+        https://bugs.webkit.org/show_bug.cgi?id=79905
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ResourceUtils.js:
+        (WebInspector.completeURL):
+
+2012-02-29  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: Ctrl R should reload page from the console panel as well.
+        https://bugs.webkit.org/show_bug.cgi?id=79883
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2012-02-28  Pavel Podivilov  <podivilov@chromium.org>
+
+        Extended attributes list should go before 'static' and 'const' modifiers in IDLs.
+        https://bugs.webkit.org/show_bug.cgi?id=79807
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. Generated code isn't changed.
+
+        * bindings/scripts/IDLParser.pm:
+        (ParseInterface):
+        * bindings/scripts/IDLStructure.pm:
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/TestSupplemental.idl:
+        * html/DOMURL.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLTrackElement.idl:
+
+2012-02-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: move DOM counter graphs out of experimental
+        https://bugs.webkit.org/show_bug.cgi?id=79802
+
+        Enable DOM counter graphs by default.
+
+        Reveal nearest record from the left hand side when there is no
+        record containing the point where the user clicked.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._endSplitterDragging):
+        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype.revealRecordAt):
+
+2012-02-28  MORITA Hajime  <morrita@google.com>
+
+        [Refactoring] Shadow related attach paths should be in ShadowTree.
+        https://bugs.webkit.org/show_bug.cgi?id=79854
+
+        Reviewed by Ryosuke Niwa.
+
+        No new tests. No behavior change.
+
+        This change introduces ShadowTree::attachHost() and ShadowTree::detachHost()
+        and moves shadow-enabled attachment code from Element to ShadowRoot.
+        This also factored out small ContainerNode method to use it from ShadowTree.
+
+        Even after this change, the traveral order in ShadowTree
+        attachment has some unclear part. Coming changes will clarify
+        these. This change is aimed to be purely textural.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::attach):
+        (WebCore::ContainerNode::detach):
+        * dom/ContainerNode.h:
+        (ContainerNode):
+        (WebCore::ContainerNode::attachAsNode): Added.
+        (WebCore::ContainerNode::attachChildren): Added.
+        (WebCore::ContainerNode::attachChildrenIfNeeded): Added.
+        (WebCore::ContainerNode::attachChildrenLazily): Added.
+        (WebCore::ContainerNode::detachAsNode): Added.
+        (WebCore::ContainerNode::detachChildrenIfNeeded): Added.
+        (WebCore::ContainerNode::detachChildren): Added.
+        * dom/Element.cpp:
+        (WebCore::Element::attach):
+        (WebCore::Element::detach):
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::addShadowRoot):
+        (WebCore::ShadowTree::removeAllShadowRoots):
+        (WebCore::ShadowTree::detachHost):
+        (WebCore):
+        (WebCore::ShadowTree::attachHost):
+        (WebCore::ShadowTree::reattachHostChildrenAndShadow):
+        * dom/ShadowTree.h:
+        (ShadowTree):
+
+2012-02-28  Arko Saha  <arko@motorola.com>
+
+        Microdata: Implement HTMLPropertiesCollection collection.namedItem().
+        https://bugs.webkit.org/show_bug.cgi?id=73156
+
+        Reviewed by Kentaro Hara.
+
+        Tests: fast/dom/MicroData/nameditem-must-be-case-sensitive.html
+               fast/dom/MicroData/nameditem-must-return-correct-item-properties.html
+               fast/dom/MicroData/properties-collection-nameditem-test.html
+
+        * bindings/scripts/CodeGeneratorJS.pm: Modified code generator to generate
+        JS bindings code for HTMLPropertiesCollection [NamedGetter] property.
+        (GenerateImplementation):
+        * html/HTMLPropertiesCollection.cpp:
+        (WebCore::HTMLPropertiesCollection::names):
+        (WebCore):
+        (WebCore::HTMLPropertiesCollection::namedItem): Returns a NodeList object
+        containing any elements that add a property named name.
+        (WebCore::HTMLPropertiesCollection::hasNamedItem): Checks if the items can
+        be retrieved or not based on the property named name.
+        * html/HTMLPropertiesCollection.h: Added namedItem(), hasProperty(),
+        hasNamedItem() methods.
+        (HTMLPropertiesCollection):
+        * html/HTMLPropertiesCollection.idl: Added namedItem() IDL method.
+
+2012-02-28  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Add size field to Metadata in FileSystem API
+        https://bugs.webkit.org/show_bug.cgi?id=79813
+
+        Reviewed by David Levin.
+
+        Test: fast/filesystem/op-get-metadata.html
+
+        * fileapi/FileSystemCallbacks.cpp:
+        (WebCore::MetadataCallbacks::didReadMetadata):
+        * fileapi/Metadata.h:
+        (WebCore::Metadata::create):
+        (WebCore::Metadata::modificationTime):
+        (WebCore::Metadata::size): Added.
+        (WebCore::Metadata::Metadata):
+        * fileapi/Metadata.idl:
+
+2012-02-28  Dmitry Lomov  <dslomov@google.com>
+
+        [JSC] Implement ArrayBuffer transfer
+        https://bugs.webkit.org/show_bug.cgi?id=73493.
+        Implement ArrayBuffer transfer, per Khronos spec:  http://www.khronos.org/registry/typedarray/specs/latest/#9.
+        This brings parity with V8 implementation of transferable typed arrays.
+
+        Reviewed by Oliver Hunt.
+
+        Covered by existing tests.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::handlePostMessage):
+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::convertValue):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::pushState):
+        (WebCore::JSHistory::replaceState):
+        * bindings/js/JSMessageEventCustom.cpp:
+        (WebCore::handleInitMessageEvent):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::fillMessagePortArray):
+        * bindings/js/JSMessagePortCustom.h:
+        (WebCore):
+        (WebCore::handlePostMessage):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::serialize):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore):
+        (WebCore::CloneSerializer::serialize):
+        (CloneSerializer):
+        (WebCore::CloneSerializer::CloneSerializer):
+        (WebCore::CloneSerializer::fillTransferMap):
+        (WebCore::CloneSerializer::dumpArrayBufferView):
+        (WebCore::CloneSerializer::dumpIfTerminal):
+        (WebCore::CloneDeserializer::deserialize):
+        (WebCore::CloneDeserializer::CloneDeserializer):
+        (WebCore::CloneDeserializer::readTerminal):
+        (CloneDeserializer):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        (WebCore::SerializedScriptValue::transferArrayBuffers):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore):
+        (SerializedScriptValue):
+
+2012-02-28  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed. Build fixes after recent bindings changes.
+
+        * bindings/scripts/CodeGeneratorCPP.pm: 
+        (ShouldSkipType):
+        * testing/Internals.idl:
+
+2012-02-28  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Spin button sometimes ignores Indeterminate of m_upDownState
+        https://bugs.webkit.org/show_bug.cgi?id=79754
+
+        Reviewed by Kent Tamura.
+
+        This patch checks enum value Indeterminate before using m_upDownState. This make
+        sure Indeterminate state doesn't act like Down state.
+
+        m_upDownState can be Indeterminate at mousedown event if mouse pointer is on
+        spin button when it is displayed.
+
+        Test: fast/forms/number/spin-button-state.html
+
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::SpinButtonElement::defaultEventHandler):
+        (WebCore::SpinButtonElement::repeatingTimerFired):
+
+2012-02-27  MORITA Hajime  <morrita@google.com>
+
+        [Refactoring] RenderSummary and RenderDetail is no longer needed.
+        https://bugs.webkit.org/show_bug.cgi?id=79641
+
+        Reviewed by Kent Tamura.
+
+        Removed RenderDetails and RenderSummary because its only
+        modification they had is already handled by RenderBlock::styleWillChange().
+        These are just a historical artifact. We could have removed these
+        classes when they were switched to shadow-based implementations.
+
+        Tests: fast/html/details-inline-expected.html
+               fast/html/details-inline.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::createRenderer):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::createRenderer):
+        (WebCore::HTMLSummaryElement::defaultEventHandler):
+        * rendering/RenderDetails.cpp: Removed.
+        * rendering/RenderDetails.h: Removed.
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::RenderDetailsMarker::isOpen):
+        * rendering/RenderDetailsMarker.h:
+        (RenderDetailsMarker):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        * rendering/RenderSummary.cpp: Removed.
+        * rendering/RenderSummary.h: Removed.
+        * rendering/RenderingAllInOne.cpp:
+
+2012-02-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Optimize the rects being drawn into compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=79852
+
+        Reviewed by Dan Bernstein.
+
+        Use the newly added WebKitSystemInterface method
+        to limit the area being painted in a CALayer
+        -drawInContext callback. This avoids redundant drawing,
+        for performance.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (drawLayerContents):
+
+2012-02-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the SnowLeopard build.
+
+        * WebCore.exp.in:
+
+2012-02-28  Anders Carlsson  <andersca@apple.com>
+
+        With tiled drawing enabled, pressing Down arrow after scrolling via mouse gesture causes page to jump back up to top
+        https://bugs.webkit.org/show_bug.cgi?id=79249
+        <rdar://problem/10866273>
+
+        Reviewed by Sam Weinig.
+
+        ScrollableArea::notifyScrollPositionChanged must make sure that the scroll animator position is kept up to date.
+
+        * platform/ScrollAnimator.cpp:
+        (WebCore::ScrollAnimator::setCurrentPosition):
+        (WebCore):
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::notifyScrollPositionChanged):
+
+2012-02-28  Daniel Cheng  <dcheng@chromium.org>
+
+        Unreviewed, rolling out r107894.
+        http://trac.webkit.org/changeset/107894
+        https://bugs.webkit.org/show_bug.cgi?id=30416
+
+        dataTransfer.types should be an Array since DOMStringList is deprecated.
+
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::types):
+        (WebCore):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::V8Clipboard::typesAccessorGetter):
+        (WebCore):
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::hasStringOfType):
+        * dom/Clipboard.h:
+        (Clipboard):
+        * dom/Clipboard.idl:
+        * platform/blackberry/ClipboardBlackBerry.cpp:
+        (WebCore::ClipboardBlackBerry::types):
+        * platform/blackberry/ClipboardBlackBerry.h:
+        (ClipboardBlackBerry):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::types):
+        * platform/chromium/ChromiumDataObject.h:
+        (ChromiumDataObject):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::types):
+        (WebCore::ClipboardChromium::mayUpdateItems):
+        * platform/chromium/ClipboardChromium.h:
+        (ClipboardChromium):
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::containsHTML):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::asFragment):
+        * platform/efl/ClipboardEfl.cpp:
+        (WebCore::ClipboardEfl::types):
+        * platform/efl/ClipboardEfl.h:
+        (ClipboardEfl):
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::types):
+        * platform/gtk/ClipboardGtk.h:
+        (ClipboardGtk):
+        * platform/mac/ClipboardMac.h:
+        (ClipboardMac):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::types):
+        * platform/qt/ClipboardQt.h:
+        (ClipboardQt):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::addMimeTypesForFormat):
+        (WebCore::ClipboardWin::types):
+        * platform/win/ClipboardWin.h:
+        (ClipboardWin):
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::types):
+        * platform/wx/ClipboardWx.h:
+        (ClipboardWx):
+
+2012-02-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Update WebKitSystemInterface.
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.exp.in:
+        (drawLayerContents):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2012-02-27  MORITA Hajime  <morrita@google.com>
+
+        <content> element should behave as HTMLUnknownElement outside of a shadow DOM subtree
+        https://bugs.webkit.org/show_bug.cgi?id=79551
+
+        Reviewed by Dimitri Glazkov.
+
+        The problem happened because HTMLContentElement doesn't create renderer anytime.
+        
+        This change allows it to create a renderer unless the HTMLContentElement is shadowed.
+        Since this could happen not only on <content> but also on upcoming <shadow>,
+        the corresponding part of the code is pulled up to InsertionPoint.
+
+        Tests: fast/dom/shadow/content-element-outside-shadow-style-expected.html
+               fast/dom/shadow/content-element-outside-shadow-style.html
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        (WebCore::TreeScope::isShadowRoot):
+        * dom/TreeScope.h:
+        (TreeScope):
+        * html/shadow/HTMLContentElement.h:
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::isShadowBoundary):
+        (WebCore):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+        (WebCore::isShadowBoundary):
+        (WebCore):
+
+2012-02-28  Daniel Cheng  <dcheng@chromium.org>
+
+        Clipboard::getData should return an empty string instead of undefined
+        https://bugs.webkit.org/show_bug.cgi?id=79712
+
+        Reviewed by Tony Chang.
+
+        Per the spec, an empty string should be returned when there is no data for the given typestring.
+
+        Test: fast/events/dataTransfer-getData-returns-empty-string.html
+
+        * bindings/js/JSClipboardCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * dom/Clipboard.h:
+        (Clipboard):
+        * dom/Clipboard.idl:
+        * platform/blackberry/ClipboardBlackBerry.cpp:
+        (WebCore::ClipboardBlackBerry::getData):
+        * platform/blackberry/ClipboardBlackBerry.h:
+        (ClipboardBlackBerry):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/ClipboardChromium.h:
+        (ClipboardChromium):
+        * platform/efl/ClipboardEfl.cpp:
+        (WebCore::ClipboardEfl::getData):
+        * platform/efl/ClipboardEfl.h:
+        (ClipboardEfl):
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::getData):
+        * platform/gtk/ClipboardGtk.h:
+        (ClipboardGtk):
+        * platform/mac/ClipboardMac.h:
+        (ClipboardMac):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::getData):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::getData):
+        * platform/qt/ClipboardQt.h:
+        (ClipboardQt):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::getFullCFHTML):
+        (WebCore::getURL):
+        (WebCore::getPlainText):
+        (WebCore::getTextHTML):
+        (WebCore::getCFHTML):
+        (WebCore::fragmentFromHTML):
+        * platform/win/ClipboardUtilitiesWin.h:
+        (WebCore):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::getData):
+        * platform/win/ClipboardWin.h:
+        (ClipboardWin):
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::getData):
+        * platform/wx/ClipboardWx.h:
+        (ClipboardWx):
+
+2012-02-28  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Uninitialized value in LocaleToScriptCodeForFontSelection
+        https://bugs.webkit.org/show_bug.cgi?id=79779
+
+        Set USCRIPT_COMMON to scriptCode as the initial value.
+
+        Reviewed by Kent Tamura.
+
+        No new tests. No behavior change.
+
+        * platform/text/LocaleToScriptMappingICU.cpp:
+        (WebCore::localeToScriptCodeForFontSelection):
+
+2012-02-28  Kenneth Russell  <kbr@google.com>
+
+        [chromium] Work around IOSurface-related corruption during readback
+        https://bugs.webkit.org/show_bug.cgi?id=79735
+
+        Reviewed by James Robinson.
+
+        Copy the compositor's IOSurface-backed output into a temporary
+        texture and perform the ReadPixels operation against that texture.
+
+        It is infeasible to write an automated test for this issue.
+        Tested manually by performing print preview multiple times against
+        pages containing WebGL content on 10.7 and observing that the
+        corruption in the output is no longer present.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+
+2012-02-28  Adrienne Walker  <enne@google.com>
+
+        [chromium] Inform v8 about extra memory used for PatternSkia clamp mode
+        https://bugs.webkit.org/show_bug.cgi?id=79846
+
+        Reviewed by James Robinson.
+
+        For large images, creating a non-repeating Pattern in Skia can
+        allocate a lot of memory. Inform v8 about this so that it can
+        potentially garbage collect any Pattern objects that aren't being used
+        and that are holding onto large image copies.
+
+        * platform/graphics/Pattern.cpp:
+        (WebCore::Pattern::Pattern):
+        * platform/graphics/Pattern.h:
+        (Pattern):
+        * platform/graphics/skia/PatternSkia.cpp:
+        (WebCore::Pattern::platformDestroy):
+        (WebCore::Pattern::platformPattern):
+
+2012-02-28  Jonathan Backer  <backer@chromium.org>
+
+        [chromium] Reset damage tracker on visibility change.
+        https://bugs.webkit.org/show_bug.cgi?id=79267
+
+        Reviewed by James Robinson.
+
+        Unit tests: CCLayerTreeHostImplTest.cpp
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::setVisible):
+
+2012-02-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108834.
+        http://trac.webkit.org/changeset/108834
+        https://bugs.webkit.org/show_bug.cgi?id=79840
+
+        Seems to cause a number of crashes under
+        FrameView::doDeferredRepaints (Requested by jamesr__ on
+        #webkit).
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+        * svg/graphics/SVGImage.h:
+        * svg/graphics/SVGImageCache.cpp:
+        (WebCore::SVGImageCache::imageContentChanged):
+        (WebCore::SVGImageCache::redrawTimerFired):
+        * svg/graphics/SVGImageCache.h:
+        (SVGImageCache):
+
+2012-02-29  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add support for nested event loops in RunLoop
+        https://bugs.webkit.org/show_bug.cgi?id=79499
+
+        Reviewed by Martin Robinson.
+
+        Run a new nested mainloop if the main event loop is already
+        running when calling to RunLoop::run(), and take care of stopping
+        the right main loop too when RunLoop::stop() is invoked.
+
+        * platform/RunLoop.h:
+        (RunLoop):
+        * platform/gtk/RunLoopGtk.cpp:
+        (WebCore::RunLoop::RunLoop):
+        (WebCore::RunLoop::~RunLoop):
+        (WebCore::RunLoop::run):
+        (WebCore::RunLoop::innermostLoop):
+        (WebCore::RunLoop::pushNestedMainLoop):
+        (WebCore::RunLoop::popNestedMainLoop):
+        (WebCore):
+        (WebCore::RunLoop::stop):
+
+2012-02-28  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Move RenderLayer::size() calls to a common function
+        https://bugs.webkit.org/show_bug.cgi?id=76972
+
+        Reviewed by Simon Fraser.
+
+        Refactoring only.
+
+        This change introduces RenderBox::cachedSizeForOverflowClip() that handles all the cached size
+        requests that currently goes through the RenderLayer. This indirection helps to decouple the need
+        for a RenderLayer so that we can lazily allocate RenderLayers as part of bug 75568.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::cachedSizeForOverflowClip):
+        Added this function to handle the calls to RenderLayer's size(). Unfortunately a lot of the
+        code calls RenderLayer::size() directly so I could not make it private.
+
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        (WebCore::RenderInline::computeRectForRepaint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::computeRectForRepaint):
+        Fixed the call sites above.
+
+2012-02-28  Tim Dresser  <tdresser@chromium.org>
+
+        Provide DefaultDeviceScaleFactor though WebSettings
+        https://bugs.webkit.org/show_bug.cgi?id=79534
+
+        Reviewed by Darin Fisher.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setDefaultDeviceScaleFactor):
+        (WebCore):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::defaultDeviceScaleFactor):
+
+2012-02-28  Oliver Hunt  <oliver@apple.com>
+
+        Fix build.
+
+        * mathml/MathMLElement.cpp:
+        (WebCore::MathMLElement::collectStyleForAttribute):
+
+2012-02-28  Dean Jackson  <dino@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79824
+
+        Unreviewed build fix for when ENABLE(CSS_FILTERS) is on
+        but ENABLE(CSS_SHADERS) is off.
+
+        * css/WebKitCSSFilterValue.cpp:
+        (WebCore::WebKitCSSFilterValue::typeUsesSpaceSeparator):
+
+2012-02-28  Dave Moore  <davemoore@chromium.org>
+
+        Slow content causes choppy scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=79403
+
+        Reviewed by James Robinson.
+
+        This code helps make scrolling (via wheel or pad) less choppy
+        when the content takes a long time to respond to the fake mouse moves
+        generated during scrolls.
+
+
+ * page/EventHandler.cpp:
+        (WebCore):
+        (MaximumDurationTracker):
+        (WebCore::MaximumDurationTracker::MaximumDurationTracker):
+        (WebCore::MaximumDurationTracker::~MaximumDurationTracker):
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoon):
+        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoonInQuad):
+        * page/EventHandler.h:
+
+2012-02-28  Andreas Kling  <awesomekling@apple.com>
+
+        StyledElement::isPresentationAttribute() only needs the attribute name.
+        <http://webkit.org/b/79828>
+
+        Reviewed by Anders Carlsson.
+
+        Pass the QualifiedName to isPresentationAttribute instead of the whole
+        Attribute. We only need the name to know what kind of attribute it is.
+
+        This makes the code a little less ugly and makes it possible to use
+        the function without having an Attribute object.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::isPresentationAttribute):
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::isPresentationAttribute):
+        * html/HTMLBRElement.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::isPresentationAttribute):
+        * html/HTMLBodyElement.h:
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::isPresentationAttribute):
+        * html/HTMLButtonElement.h:
+        * html/HTMLDivElement.cpp:
+        (WebCore::HTMLDivElement::isPresentationAttribute):
+        * html/HTMLDivElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::isPresentationAttribute):
+        * html/HTMLElement.h:
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::isPresentationAttribute):
+        * html/HTMLEmbedElement.h:
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::isPresentationAttribute):
+        * html/HTMLFontElement.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::isPresentationAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::isPresentationAttribute):
+        * html/HTMLHRElement.h:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::isPresentationAttribute):
+        * html/HTMLIFrameElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::isPresentationAttribute):
+        * html/HTMLImageElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isPresentationAttribute):
+        * html/HTMLInputElement.h:
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::isPresentationAttribute):
+        * html/HTMLLIElement.h:
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::isPresentationAttribute):
+        * html/HTMLMarqueeElement.h:
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::isPresentationAttribute):
+        * html/HTMLOListElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::isPresentationAttribute):
+        * html/HTMLObjectElement.h:
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::isPresentationAttribute):
+        * html/HTMLParagraphElement.h:
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::isPresentationAttribute):
+        * html/HTMLPlugInElement.h:
+        * html/HTMLPreElement.cpp:
+        (WebCore::HTMLPreElement::isPresentationAttribute):
+        * html/HTMLPreElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::isPresentationAttribute):
+        * html/HTMLSelectElement.h:
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::isPresentationAttribute):
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::isPresentationAttribute):
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::isPresentationAttribute):
+        * html/HTMLTableColElement.h:
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::isPresentationAttribute):
+        * html/HTMLTableElement.h:
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::isPresentationAttribute):
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::isPresentationAttribute):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLUListElement.cpp:
+        (WebCore::HTMLUListElement::isPresentationAttribute):
+        * html/HTMLUListElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::isPresentationAttribute):
+        * html/HTMLVideoElement.h:
+        * mathml/MathMLElement.cpp:
+        (WebCore::MathMLElement::isPresentationAttribute):
+        * mathml/MathMLElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::isPresentationAttribute):
+        * svg/SVGImageElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::isPresentationAttribute):
+        * svg/SVGStyledElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::isPresentationAttribute):
+        * svg/SVGTextContentElement.h:
+
+2012-02-28  Enrica Casucci  <enrica@apple.com>
+
+        More Pasteboard code cleanup.
+        https://bugs.webkit.org/show_bug.cgi?id=79816
+
+        Removing the last references to NSPasteboard.
+
+        Reviewed by Alexey Proskuryakov.
+
+        No new tests. No change in functionality.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::pasteWithPasteboard):
+        (WebCore::Editor::takeFindStringFromSelection):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::setInsertionPasteboard):
+        * page/DragClient.h:
+        * page/EditorClient.h:
+        * platform/DragData.h:
+        * platform/Pasteboard.h:
+        * platform/mac/ClipboardMac.h:
+        * platform/mac/PasteboardHelper.h: Removed.
+
+2012-02-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r109137.
+        http://trac.webkit.org/changeset/109137
+        https://bugs.webkit.org/show_bug.cgi?id=79833
+
+        Broke cr-mac build (Requested by aklein on #webkit).
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore):
+        (WebCore::pathFromFont):
+
+2012-02-28  Jungshik Shin  <jshin@chromium.org>
+
+        Add a fallback path to LineBreakIteratorPoolICU when the locale
+        name from a web page is invalid and ICU fails to get a line break
+        iterator instance. Also add a null check to 
+        TextBreakIteratorICU::acquireLineBreakIterator.
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=67640
+
+        Test: fast/text/invalid-locale.html
+
+        * platform/text/LineBreakIteratorPoolICU.h:
+        (WebCore::LineBreakIteratorPool::take):
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::acquireLineBreakIterator):
+
+2012-02-28  Abhishek Arya  <inferno@chromium.org>
+
+        Crash due to accessing removed continuation in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78417
+
+        Reviewed by David Hyatt.
+
+        This patch addresses two problems:
+        1. Run-in block got split due to addition of a column-span child.
+        The clone part was incorrectly intruding into the sibling block,
+        even when it was part of the continuation chain.
+        2. Like r73296, we don't need to set continuation on an
+        anonymous block since we haven't split a real element.
+
+        Test: fast/multicol/span/runin-continuation-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
+        (WebCore::RenderBlock::handleRunInChild):
+
+2012-02-28  Abhishek Arya  <inferno@chromium.org>
+
+        Incorrect before child parent calculation when adding new children
+        to anonymous column blocks.
+        https://bugs.webkit.org/show_bug.cgi?id=79755
+
+        Reviewed by David Hyatt.
+
+        before child can be wrapped in anonymous containers, so need to
+        take care of that in before child parent calculation.
+
+        Test: fast/multicol/span/before-child-anonymous-column-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChildToAnonymousColumnBlocks):
+
+2012-02-28  Ned Holbrook  <nholbrook@apple.com>
+
+        Reimplement pathFromFont() in SimpleFontDataMac.mm
+        https://bugs.webkit.org/show_bug.cgi?id=79811
+
+        Reviewed by Dan Bernstein.
+
+        Debug-only function, so no new tests.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::pathFromFont): Reimplemented.
+
+2012-02-28  Alexis Menard  <alexis.menard@openbossa.org>
+
+        getComputedStyle fails for 'first-line' pseudo-element
+        https://bugs.webkit.org/show_bug.cgi?id=57505
+
+        Reviewed by Tony Chang.
+
+        Querying the selector with a pseudo-element using getComputedStyle should work
+        even if the selector was not declared in the stylesheet. When not declared, we need
+        to use the RenderStyle created to do the rendering as there is no pseudo-style.
+        This match the behavior of Firefox.
+
+        No new tests : Updated expectation and extended getComputedStyle-with-pseudo-element.html.
+
+        * dom/Element.cpp:
+        (WebCore::Element::computedStyle):
+
+2012-02-28  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        Move FILE_SYSTEM code out of WorkerContext and into the fileapi folder
+        https://bugs.webkit.org/show_bug.cgi?id=79449
+
+        Reviewed by Adam Barth.
+
+        This moves FILE_SYSTEM code out of WorkerContext and into the fileapi/WorkerContextFileSystem.
+        None-functional changes, no new tests necessary.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * fileapi/WorkerContextFileSystem.cpp: Added.
+        (WebCore):
+        (WebCore::WorkerContextFileSystem::webkitRequestFileSystem):
+        (WebCore::WorkerContextFileSystem::webkitRequestFileSystemSync):
+        (WebCore::WorkerContextFileSystem::webkitResolveLocalFileSystemURL):
+        (WebCore::WorkerContextFileSystem::webkitResolveLocalFileSystemSyncURL):
+        * fileapi/WorkerContextFileSystem.h: Added.
+        (WebCore):
+        (WorkerContextFileSystem):
+        * fileapi/WorkerContextFileSystem.idl: Added.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::ensureEventTargetData):
+        * workers/WorkerContext.h:
+        (WebCore):
+        (WorkerContext):
+        * workers/WorkerContext.idl:
+
+2012-02-28  Alexey Proskuryakov  <ap@apple.com>
+
+        FileReader crashes when file is not readable
+        https://bugs.webkit.org/show_bug.cgi?id=79715
+
+        Reviewed by Jian Li.
+
+        Test: fast/files/file-reader-directory-crash.html
+
+        * platform/SharedBuffer.cpp: (WebCore::SharedBuffer::SharedBuffer): Crash early if a caller
+        mixed up in-band error signal with length again.
+
+        * platform/network/BlobResourceHandle.cpp:
+        (WebCore): Changed errors into an enum. Added a proper domain for blob errors.
+        (WebCore::BlobResourceHandle::didReceiveResponse): There is already a constant for INT_MAX
+        in C/C++.
+        (WebCore::BlobResourceHandle::didRead): Don't send "-1" for failure down the success path.
+        (WebCore::BlobResourceHandle::notifyFail): Use a proper domain for blob errors, and a non-
+        empty message.
+
+2012-02-28  Adam Klein  <adamk@chromium.org>
+
+        Unreviewed, fix cr-win build after r109119.
+
+        * platform/graphics/chromium/TransparencyWin.h:
+        (TransparencyWin):
+
+2012-02-28  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add GMainLoop and GMainContext to be handled by GRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=79496
+
+        Reviewed by Martin Robinson.
+
+        Updated places where raw pointers to GMainLoop and GMainContext
+        were being used, replacing them with GRefPtr-based code.
+
+        * platform/RunLoop.h:
+        (RunLoop):
+        * platform/gtk/RunLoopGtk.cpp:
+        (WebCore::RunLoop::RunLoop):
+        (WebCore::RunLoop::~RunLoop):
+        (WebCore::RunLoop::mainLoop):
+        (WebCore::RunLoop::stop):
+        (WebCore::RunLoop::wakeUp):
+        (WebCore::RunLoop::TimerBase::start):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::~WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::run):
+
+2012-02-28  Alok Priyadarshi  <alokp@chromium.org>
+
+        Heap-use-after-free in WebCore::RenderLayer::addChild
+        https://bugs.webkit.org/show_bug.cgi?id=79698
+
+        Reviewed by Simon Fraser.
+
+        This patch fixes a regression introduced in r108659.
+        The reflection layer was moved to the parent by mistake. It was then
+        deleted and the parent was left holding on to a deleted pointer. This
+        patch restores the location where reflection layer is removed - before
+        moving the child layers.
+
+        Test: fast/reflections/toggle-reflection-crash.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+
+2012-02-28  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash from list marker having inline and block children
+        https://bugs.webkit.org/show_bug.cgi?id=79793
+
+        Reviewed by Julien Chaffraix.
+
+        Crashing condition in which an anonymous block was being collapsed
+        even though it had a block sibling. removeChild() was not checking
+        for siblings that might precede :before content renderers, such
+        as list items. This patch corrects that.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild)
+
+2012-02-28  Adam Klein  <adamk@chromium.org>
+
+        Unreviewed, speculative test fix after r109016.
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers): Explicitly pass a scale of 1 to ImageBuffer::create.
+        * platform/graphics/chromium/TransparencyWin.h:
+        (WebCore): Update names of re-enabled tests.
+
+2012-02-28  Antti Koivisto  <antti@apple.com>
+
+        Give StyleRule files of its own
+        https://bugs.webkit.org/show_bug.cgi?id=79778
+
+        Totally rubber-stamped by Andreas Kling.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSParser.cpp:
+        * css/CSSStyleRule.cpp:
+        (WebCore):
+        (WebCore::CSSStyleRule::style):
+        * css/CSSStyleRule.h:
+        (WebCore):
+        (CSSStyleRule):
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSheet.cpp:
+        * css/StyleRule.cpp: Copied from Source/WebCore/css/CSSStyleRule.cpp.
+        (WebCore):
+        * css/StyleRule.h: Copied from Source/WebCore/css/CSSStyleRule.h.
+        (WebCore):
+        * editing/EditingStyle.cpp:
+        * inspector/InspectorCSSAgent.cpp:
+        * inspector/InspectorInstrumentation.cpp:
+        * inspector/InspectorStyleSheet.cpp:
+        * page/PageSerializer.cpp:
+
+2012-02-28  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: remove window aspects from the timeline presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=79803
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype.accept):
+        (WebInspector.TimelineOverviewPane.prototype._setWindowIndices):
+        (WebInspector.TimelineOverviewPane.prototype.windowLeft):
+        (WebInspector.TimelineOverviewPane.prototype.windowRight):
+        (WebInspector.TimelineOverviewPane.prototype._fireWindowChanged):
+        (WebInspector.TimelineOverviewWindow.prototype._dragWindow):
+        (WebInspector.TimelineOverviewPane.WindowSelector):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._onCategoryCheckboxClicked):
+        (WebInspector.TimelinePanel.prototype._updateBoundaries):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelineCategory):
+        (WebInspector.TimelineCategory.prototype.get hidden):
+        (WebInspector.TimelineCategory.prototype.set hidden):
+
+2012-02-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Improve the visual of the tiling
+        https://bugs.webkit.org/show_bug.cgi?id=79648
+
+        Reviewed by Noam Rosenthal.
+
+        When we cover the view with tiles[1], we do so from the center
+        and out, in bigger and bigger cicles by finding the current minimum
+        covered distance.
+
+        This looks like painting a rect, then a cross, then a rect, ...
+        and can be noticed when a page blocks during tiling.
+
+        We can do this better by only covering with tiles in rects at a time.
+
+        The original code was done so that it gave preference to tiles in
+        vertical direction due to that being the most common scrolling
+        direction. This is not needed anymore as we are now using the
+        trajectory vector when panning, which always gives preference for
+        creating tiles in the panned direction.
+
+        [1] It should be noted that we always cover the visibleRect in one go,
+            and that we here are talking about covering the coverRect beyond
+            the visibleRect
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::tileDistance):
+
+2012-02-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: preserve memory counters size after frontend reopening
+        https://bugs.webkit.org/show_bug.cgi?id=79792
+
+        Clear collected counter values when timeline panel is reset. Persist
+        timeline grid/counters splitter position to restore it when front-end
+        is opened next time.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype.reset):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._setSplitterPosition):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        * inspector/front-end/timelinePanel.css:
+        (#counter-values-bar):
+
+2012-02-28  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: move filtering of the timeline records into the presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=79789
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/TimelineModel.js:
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype.setStartAtZero):
+        (WebInspector.TimelineOverviewPane.prototype.scrollWindow):
+        (WebInspector.TimelineOverviewPane.prototype.accept):
+        (WebInspector.TimelineOverviewPane.prototype._setWindowIndices):
+        (WebInspector.TimelineStartAtZeroOverview):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._onWindowChanged):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._updateRecordsCounter):
+        (WebInspector.TimelinePanel.prototype._glueParentButtonClicked):
+        (WebInspector.TimelinePanel.prototype._toggleStartAtZeroButtonClicked):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype.revealRecordAt):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineExpandableElement.prototype._update):
+        (WebInspector.TimelineCategoryFilter):
+        (WebInspector.TimelineCategoryFilter.prototype.accept):
+        (WebInspector.TimelineIsLongFilter):
+        (WebInspector.TimelineIsLongFilter.prototype.accept):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel):
+        (WebInspector.TimelinePresentationModel.prototype.addFilter):
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.prototype.minimumRecordTime):
+        (WebInspector.TimelinePresentationModel.prototype.maximumRecordTime):
+        (WebInspector.TimelinePresentationModel.prototype.addRecord):
+        (WebInspector.TimelinePresentationModel.prototype._updateBoundaries):
+        (WebInspector.TimelinePresentationModel.prototype._findParentRecord):
+        (WebInspector.TimelinePresentationModel.prototype.setGlueRecords):
+        (WebInspector.TimelinePresentationModel.prototype.fireWindowChanged):
+        (WebInspector.TimelinePresentationModel.prototype.get _recordStyles):
+        (WebInspector.TimelinePresentationModel.prototype.filteredRecords):
+        (WebInspector.TimelinePresentationModel.prototype._filterRecords):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get visibleChildrenCount):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get invisibleChildrenCount):
+        (WebInspector.TimelinePresentationModel.Filter):
+        (WebInspector.TimelinePresentationModel.Filter.prototype.accept):
+
+2012-02-28  Florin Malita  <fmalita@google.com>
+
+        Percent width/height SVG not always scaled on window resize
+        https://bugs.webkit.org/show_bug.cgi?id=79490
+
+        Reviewed by Nikolas Zimmermann.
+
+        Tests: fast/repaint/percent-minheight-resize-expected.html
+               fast/repaint/percent-minheight-resize.html
+               svg/custom/svg-percent-scale-expected.html
+               svg/custom/svg-percent-scale-vonly-expected.html
+               svg/custom/svg-percent-scale-vonly.html
+               svg/custom/svg-percent-scale.html
+
+        Fix a couple of problems preventing correct SVG scaling on window resize:
+
+        - RenderReplaced::computePreferredLogicalWidths is not SVG attribute aware and computes
+        a non-zero m_minPreferredLogicalWidth even when the SVG widh/height are percentages.
+
+        - RenderBlock::layoutInlineChildren is also not SVG attribute aware and does not trigger
+        percent height child layouts on vertical-only resizes.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        Use hasRelativeDimensions() instead of direct width/height->isPercent tests. This also fixes
+        an HTML issue where percent {min,max}Height inline elements are not updated on vertical-only resizes.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::hasRelativeDimensions):
+        (WebCore):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        Add virtual hasRelativeDimensions() method.
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::computePreferredLogicalWidths):
+        Use hasRelativeDimensions() instead of direct width/height->isPercent tests.
+
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight):
+        (WebCore::RenderSVGRoot::willBeDestroyed):
+        Register percent-height SVG elements with the gPercentHeightDescendantsMap, and clean-up on destruction
+        or height unit change.
+
+        (WebCore::RenderSVGRoot::hasRelativeDimensions):
+        (WebCore):
+        * rendering/svg/RenderSVGRoot.h:
+        (RenderSVGRoot):
+        SVG-aware hasRelativeDimensions() override.
+
+2012-02-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: show resource dividers on memory counter graphs
+        https://bugs.webkit.org/show_bug.cgi?id=79782
+
+        Resource dividers are drawn on the memory counter graphs.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype.updateDividers):
+        (WebInspector.MemoryStatistics.prototype.setMainTimelineGrid):
+        (WebInspector.MemoryStatistics.prototype._updateSize):
+        (WebInspector.MemoryStatistics.prototype.show):
+        (WebInspector.MemoryStatistics.prototype.refresh):
+        (WebInspector.MemoryStatistics.prototype._refreshDividers):
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid.prototype.get dividersElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._timelinesOverviewModeChanged):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype.get timlinePaddingLeft):
+        * inspector/front-end/timelinePanel.css:
+        (#memory-graphs-canvas-container):
+        (#memory-graphs-canvas-container .resources-dividers):
+
+2012-02-28  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Integrate SVGUseElement within the new shadow root concept
+        https://bugs.webkit.org/show_bug.cgi?id=78902
+
+        Reviewed by Zoltan Herczeg.
+
+        Replace SVG shadow tree implementation with the new, modern #shadow-root implementation.
+
+        Current situation in trunk:
+        SVGUseElement doesn't create/hold the shadow tree, unlike its expected in
+        the modern #shadow-root concept, but its renderer RenderSVGShadowTreeRootContainer.
+        That creates a cycle, as the actual DOM tree is stored as RefPtr<SVGGElement> inside
+        a renderer - that's weak conceptually, and has lead to sublte security bugs in the past.
+
+        Whenever a target element of a <use> element changed, invalidateShadowTree() is called
+        which calls setNeedsStyleRecalc(), and sets m_needsShadodwTreeRecreation to true.
+        Once style recalculation happens, the RenderSVGShadowTreeRootContainer then eventually
+        built the shadow tree, by cloning the target node, building the SVGElementInstance tree
+        etc, -- all within the render tree.
+
+        To easy reviewing, here's a dump of the current render tree for a simple <use> example:
+        <defs><rect id="rect"/></defs><use xlink:href="#rect"/>
+
+        Dump of render tree:
+        RenderSVGHiddenContainer {defs}        // <defs> (SVGDefsElement)
+            RenderSVGRect {rect}               // <rect> (SVGRectElement)
+        RenderSVGShadowTreeRootContainer {use} // <use> (SVGUseElement)
+            RenderSVGContainer {g}             // <g> (SVGShadowTreeRootElement)
+                RenderSVGRect {rect}           // <rect> (SVGRectElement, clone of <rect> in <defs>)
+
+        The SVGShadowTreeRootElement is created & stored by RenderSVGShadowTreeRootContainer,
+        the renderer of the <use> element. The RenderSVGTransformableContainer renderer created
+        for the SVGShadowTreeRootElement stores the x/y translation induced by the <use> attributes.
+
+        There are lots of places all over WebCore that assume the existance of a <g> renderer
+        as first child of the <use> element, representing the "SVG shadow tree root".
+
+        Summary of this patch:
+        Let SVGUseElement create&maintain a #shadow-root, and append the cloned target elements
+        into this shadow root. We no longer have to take care of attachment/detachment, style
+        recalculation, etc. - that's handled transparenly by ShadowRoot(List) now.
+
+        This makes SVGShadowTreeElements & RenderSVGShadowTreeRootContainer obsolete. Switch
+        SVGUseElement to create a RenderSVGTransformableContainer as its renderer, and make
+        it respect the translation induced by the x/y attributes, given for a <use> element.
+
+        Remove all occourences of SVGShadowRoot, remove all special cases it induced.
+
+        It's all covered by existing tests, took a while to make them all pass again.
+
+        * CMakeLists.txt: Remove SVGShadowTreeElements/RenderSVGShadowTreeRootContainer from build.
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList): Enable fast path for selector checking, now that special shadow tree rules are gone.
+        * css/SelectorChecker.cpp:
+        (WebCore::linkAttribute): No need to guard this code with ENABLE(SVG).
+        (WebCore::SelectorChecker::checkSelector): Remove obsolete SVG shadow root special case.
+        * dom/EventDispatcher.cpp:
+        (WebCore::eventTargetRespectingSVGTargetRules): Remove loop, simplify & cleanup this code.
+        (WebCore::EventDispatcher::adjustToShadowBoundaries): s/isShadowRootOrSVGShadowRoot/isShadowRoot/.
+        (WebCore::EventDispatcher::adjustRelatedTarget): Ditto.
+        (WebCore::EventDispatcher::ensureEventAncestors): Simplify logic for SVG, fixed a FIXME.
+        * dom/Node.cpp: Remove obsolete svgShadowHost().
+        (WebCore::Node::shadowTreeRootNode): Remove obsolete isSVGShadowRoot() checks.
+        (WebCore::Node::nonBoundaryShadowTreeRootNode): Ditto.
+        (WebCore::Node::isInShadowTree): Make it const.
+        * dom/Node.h: Remove isSVGShadowRoot/svgShadowHost.
+        (WebCore::Node::isShadowRoot): s/IsShadowRootOrSVGShadowRootFlag/isShadowRoot/.
+        (WebCore::Node::parentNode): Augment comments.
+        (WebCore::Node::parentNodeGuaranteedHostFree): Ditto.
+        * dom/Range.cpp:
+        (WebCore::Range::checkNodeBA): Remove obsolete SVG shadow root special case.
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::prepareScript): Ditto.
+        * rendering/RenderObject.h: Remove isSVGShadowTreeRootContainer.
+        (WebCore::RenderObject::isSVGTransformableContainer): Added.
+        * rendering/svg/RenderSVGAllInOne.cpp: Remove SVGShadowTreeElements/RenderSVGShadowTreeRootContainer from build.
+        * rendering/svg/RenderSVGModelObject.cpp:
+        (WebCore::isGraphicsElement): To check for <use>, a tag name comparision is needed now, as it no longer has a special renderer.
+        * rendering/svg/RenderSVGResourceClipper.cpp:
+        (WebCore::RenderSVGResourceClipper::drawContentIntoMaskImage): Ditto.
+        (WebCore::RenderSVGResourceClipper::calculateClipContentRepaintRect): Ditto.
+        (WebCore::RenderSVGResourceClipper::hitTestClipContent): Ditto.
+        * rendering/svg/RenderSVGResourceContainer.cpp: Remove RenderSVGShadowTreeRootContainer.h include.
+        * rendering/svg/RenderSVGShadowTreeRootContainer.cpp: Removed.
+        * rendering/svg/RenderSVGShadowTreeRootContainer.h: Removed.
+        * rendering/svg/RenderSVGTransformableContainer.cpp: Keep track of last used additional x/y translation.
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform): Handle x/y translation for <use> contains here, instead of storing it in the SVGShadowTreeRootElement.
+        * rendering/svg/RenderSVGTransformableContainer.h: Store last used x/y translation.
+        (WebCore::RenderSVGTransformableContainer::isSVGTransformableContainer): Return true.
+        (WebCore::toRenderSVGTransformableContainer): Add conversion helpers.
+        * rendering/svg/RenderSVGViewportContainer.cpp: Ditto.
+        (WebCore::RenderSVGViewportContainer::calcViewport): Handle width/height attributes inheritance from the <use> element, if we're a <svg> or <symbol> replacement in the shadow tree.
+        * rendering/svg/RenderSVGViewportContainer.h: Remove isSVGContainer() override which is not needed here (already present in RenderSVGContainer).
+        * rendering/svg/SVGShadowTreeElements.cpp: Removed.
+        * rendering/svg/SVGShadowTreeElements.h: Removed.
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::createRenderer): Check if parentNode is really a SVGElement, before casting.
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::isOutermostSVGSVGElement): Early exit if tag name isn't <svg>, or if we're in a shadow tree (can't be an outermost <svg> element then).
+        (WebCore::hasLoadListener): Deploy parentOrHostElement() usage to remove any special cases, related to shadow boundaries.
+        (WebCore::SVGElement::sendSVGLoadEventIfPossible): Ditto.
+        (WebCore::SVGElement::customStyleForRenderer): Ditto.
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement): Call updateStyleIfNeeded() instead of updateLayoutIgnorePendingStylesheets().
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::rendererIsNeeded): s/parentNode/parentOrHostElement/ - we need to cross shadow boundaries now.
+        * svg/SVGGElement.h: Remove obsolete isShadowTreeContainerElement().
+        * svg/SVGLocatable.cpp:
+        (WebCore::SVGLocatable::nearestViewportElement): s/parentNode/parentOrHostElement/ - we need to cross shadow boundaries now.
+        (WebCore::SVGLocatable::farthestViewportElement): Ditto.
+        (WebCore::SVGLocatable::computeCTM): Ditto.
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::title): Ditto. (+ simplify code a lot, no need to walk the shadow tree to find its root anymore, use isInShadowTree() helper.)
+        (WebCore::SVGStyledElement::rendererIsNeeded): Ditto.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement): Remove no longer needed m_updatesBlocked.
+        (WebCore::SVGUseElement::create): Always call ensureShadowRoot(), to create a #shadow-root, upon creating a SVGUseElement.
+        (WebCore::SVGUseElement::insertedIntoDocument): Align with SVGFEImageElement/SVGTRefElement - call buildPendingResource() from insertedIntoDocument(), finally! (no renderer needed anymore to update the SVG shadow subtree).
+        (WebCore::SVGUseElement::removedFromDocument): Align with SVGFEImageElement/SVGTRefElement - immediately release the SVGElementInstance & shadow tree, once we're removed from the document.
+        (WebCore::SVGUseElement::svgAttributeChanged): Simplify code a lot, no longer need to deal with x/y/width/height attributes, the renderes in the shadow tree grab these values from their corresponding <use> elements automatically now.
+        (WebCore::SVGUseElement::willRecalcStyle):
+            New main part of the logic. invalidateShadowTree() calls setNeedsStyleRecalc, and sets m_needsShadowTreeRecreation=true. If we encounter this case, force rebuilding the SVG shadow tree
+            and the SVGElementInstance tree, immediately, before executing the actual style recalc. This allows us to lazily rebuild the SVG shadow tree for the <use> element. Consider:
+            <defs><rect id="rect"></defs> <use xlink:href="#rect"/>. Now from a script we change the rect x/y/width/height attributes:
+            rect.setAttribute("x", "10"); rect.setAttribute("y", "10")... each call will lead to a SVGUseElement::invalidateShadowTree() call by SVGElementInstance::invalidateAllInstancesOfElement, invoked after the <rect> element got parsed.
+            This won't update the shadow tree four times, but only once upon the next style recalculation - otherwise performance is a nightmare.
+            This will serve as future starting point, to explore partial SVG subtree re-clones, which should easily be doable now.
+        (WebCore::dumpInstanceTree): Add a 'static' to allow DUMP_INSTANCE_TREE to be used in clang builds.
+        (WebCore::SVGUseElement::clearResourceReferences): Added helper to release instance & shadow tree.
+        (WebCore::SVGUseElement::buildPendingResource): Modeled exactly like SVGFEImageElement/SVGTRefElement. It's possible to share more code between these in future.
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree): Cleanup code, adapt to new shadow-root concept.
+        (WebCore::SVGUseElement::createRenderer): Create a RenderSVGTransformableContainer, no longer a <use> specific renderer.
+        (WebCore::removeDisallowedElementsFromSubtree): Use new replacedChild/appendChild variants, that don't require a ExceptionCode to be passed in.
+        (WebCore::SVGUseElement::buildShadowTree): Ditto.
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree): Ditto.
+        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree): Ditto.
+        (WebCore::SVGUseElement::invalidateShadowTree): Only trigger style recalculations if needed.
+        * svg/SVGUseElement.h: Remove lots of now unnecessary overrides: attach/detach/didRecalcStyle/updateContainerOffset/updateContainerSizes/etc..
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::insertedIntoDocument): No need to walk the shadow tree to find its root anymore, use isInShadowTree() helper.
+
+2012-02-28  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Element should be able to have multiple shadow roots.
+        https://bugs.webkit.org/show_bug.cgi?id=77931
+
+        Reviewed by Hajime Morita.
+
+        This patch enables us to add multiple shadow subtrees into elements.
+        Note that multiple shadow subtrees are enabled
+        only if RuntimeEnabledFeatures::multipleShadowSubtrees is enabled.
+
+        Since we don't have <shadow> element yet, only the youngest shadow tree
+        will be rendered. This patch includes tests to confirm adding a new shadow
+        tree dynamically to confirm only the youngest shadow tree is renderered.
+
+        Tests: fast/dom/shadow/multiple-shadowroot-rendering.html
+               fast/dom/shadow/multiple-shadowroot.html
+
+        * WebCore.exp.in:
+        * dom/Element.cpp:
+          Uses ShadowRootList interfaces directly instead of ShadowRootList emulation methods.
+        (WebCore::Element::~Element):
+        (WebCore::Element::attach):
+        (WebCore::Element::addShadowRoot):
+        (WebCore::Element::removeShadowRootList):
+        * dom/Element.h:
+        (Element):
+        * dom/NodeRenderingContext.cpp:
+          Makes non-youngest shadow subtrees hidden.
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::hostChildrenChanged):
+          Since non-youngest children may be changed, make sure host children are changed.
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowRoot.h:
+          Utility methods to make code intention clear are added.
+        (WebCore::ShadowRoot::youngerShadowRoot):
+        (WebCore::ShadowRoot::olderShadowRoot):
+        (ShadowRoot):
+        (WebCore::ShadowRoot::isYoungest):
+        (WebCore::ShadowRoot::isOldest):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::popShadowRoot):
+        (WebCore::ShadowRootList::attach):
+        (WebCore::ShadowRootList::detach):
+          Detaches shadow subtrees.
+        * testing/Internals.cpp:
+        (WebCore::Internals::address):
+        (WebCore):
+        (WebCore::Internals::youngerShadowRoot):
+        (WebCore::Internals::olderShadowRoot):
+        (WebCore::Internals::removeShadowRoot):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-28  Antti Koivisto  <antti@apple.com>
+
+        Split CSSStyleRule into internal and CSSOM type
+        https://bugs.webkit.org/show_bug.cgi?id=79763
+
+        Reviewed by Andreas Kling.
+
+        - Split the data out as StyleRule
+        - Make CSSStyleSelector operate on StyleRule instead of CSSStyleRule
+        
+        This is an intermediate step. Both CSSStyleRule and StyleRule are still always constructed so
+        the patch increases memory consumption by a few pointers per css rule. Upcoming
+        patches will make CSSStyleRules to be constructed on demand.
+        
+        The patch does not yet move StyleRule to a file of its own.
+
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::CSSPageRule):
+        * css/CSSPageRule.h:
+        (WebCore::CSSPageRule::create):
+        (CSSPageRule):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createPageRule):
+        * css/CSSRule.h:
+        (WebCore::CSSRule::CSSRule):
+        (CSSRule):
+        * css/CSSStyleRule.cpp:
+        (WebCore::StyleRule::StyleRule):
+        (WebCore):
+        (WebCore::StyleRule::~StyleRule):
+        (WebCore::StyleRule::addSubresourceStyleURLs):
+        (WebCore::StyleRule::ensureCSSStyleRule):
+        (WebCore::CSSStyleRule::CSSStyleRule):
+        (WebCore::CSSStyleRule::~CSSStyleRule):
+        (WebCore::CSSStyleRule::generateSelectorText):
+        (WebCore::CSSStyleRule::setSelectorText):
+        (WebCore::CSSStyleRule::cssText):
+        * css/CSSStyleRule.h:
+        (WebCore):
+        (StyleRule):
+        (WebCore::StyleRule::selectorList):
+        (WebCore::StyleRule::properties):
+        (WebCore::StyleRule::sourceLine):
+        (WebCore::StyleRule::adoptSelectorVector):
+        (WebCore::StyleRule::adoptSelectorList):
+        (WebCore::StyleRule::setProperties):
+        (WebCore::CSSStyleRule::create):
+        (WebCore::CSSStyleRule::style):
+        (CSSStyleRule):
+        (WebCore::CSSStyleRule::styleRule):
+        * css/CSSStyleSelector.cpp:
+        (RuleData):
+        (WebCore::RuleData::rule):
+        (RuleSet):
+        (WebCore::CSSStyleSelector::addMatchedProperties):
+        (WebCore::CSSStyleSelector::sortAndTransferMatchedRules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSStyleSelector::RuleSelectorPair::RuleSelectorPair):
+        (RuleSelectorPair):
+        (MatchResult):
+        (CSSStyleSelector):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs):
+        * editing/EditingStyle.cpp:
+        (WebCore::styleFromMatchedRulesForElement):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::SelectorProfile::startSelector):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willMatchRuleImpl):
+        (WebCore::InspectorInstrumentation::willProcessRuleImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore):
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willMatchRule):
+        (WebCore::InspectorInstrumentation::willProcessRule):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForRule):
+        (WebCore::InspectorStyleSheet::revalidateStyle):
+        * page/PageSerializer.cpp:
+        (WebCore::PageSerializer::serializeFrame):
+        (WebCore::PageSerializer::serializeCSSStyleSheet):
+        (WebCore::PageSerializer::retrieveResourcesForRule):
+        (WebCore::PageSerializer::retrieveResourcesForProperties):
+        * page/PageSerializer.h:
+        (WebCore):
+        (PageSerializer):
+
+2012-02-28  Roland Steiner  <rolandsteiner@chromium.org>
+
+        RuntimeEnabledFeatures::setMultipleShadowSubtreesEnabled should not be inline
+        https://bugs.webkit.org/show_bug.cgi?id=79753
+
+        Moved the function implementation to the .cpp file.
+
+        Reviewed by Hajime Morita.
+
+        No new tests. (no functional change)
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore::RuntimeEnabledFeatures::setMultipleShadowSubtreesEnabled):
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+
+2012-02-28  Noel Gordon  <noel.gordon@gmail.com>
+
+        Fix comment about RGB swizzle decoding and Adobe transform=0 images
+        https://bugs.webkit.org/show_bug.cgi?id=79457
+
+        Unreviewed. No new tests, comment change only.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+
+2012-02-27  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Element::removeShadowRoot() and setShadowRoot() should be moved into ShadowTree.
+        https://bugs.webkit.org/show_bug.cgi?id=78313
+
+        Reviewed by Hajime Morita.
+
+        This patch is for refactoring ShadowTree related code.
+          (1) Element::removeShadowRoot() and Element::setShadowRoot() are moved into ShadowTree.
+          (2) ShadowTree is now put on its own heap.
+
+        No new tests, no change in behavior.
+
+        * WebCore.exp.in:
+        * dom/Element.cpp:
+        (WebCore::Element::~Element):
+        (WebCore::Element::shadowTree):
+        (WebCore::Element::ensureShadowTree):
+          Ensure the existence of ShadowTree. This does not ensure ShadowRoot exists.
+        * dom/Element.h:
+        (Element):
+        * dom/ElementRareData.h:
+          Makes ShadowTree on Heap.
+        (ElementRareData):
+        (WebCore::ElementRareData::~ElementRareData):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowTree.cpp:
+        (WebCore::validateShadowRoot):
+        (WebCore):
+        (WebCore::ShadowTree::addShadowRoot):
+        (WebCore::ShadowTree::removeAllShadowRoots):
+        * dom/ShadowTree.h:
+        (ShadowTree):
+        * testing/Internals.cpp:
+        (WebCore::Internals::removeShadowRoot):
+
+2012-02-27  David Barton  <dbarton@mathscribe.com>
+
+        Fix <msubsup> formatting, especially for a tall base, subscript, or superscript
+        https://bugs.webkit.org/show_bug.cgi?id=79274
+
+        Reviewed by Julien Chaffraix.
+
+        Move the <msubsup> formatting code in stretchToHeight() to layout(). Then revise the
+        combined code to produce more vertically accurate results, and without extra white
+        space. Finally, don't multiply msub/msup/msubsup operator stretching by 1.2.
+
+        Test: Added the bug report's attached test case to mathml/presentation/subsup.xhtml, and
+        it and 5 other test files in mathml/presentation now produce improved results. The
+        integral sign in mo-stretch.html is no longer scaled up by an extra 1.2, and baselines
+        are more accurate so the base is higher in msubsup-sub-changed.png. Several examples are
+        slightly tighter vertically, because their (somewhat) anonymous blocks wrapping
+        subscripts and superscripts now have the correct font size.
+
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore):
+        (WebCore::RenderMathMLSubSup::addChild):
+        (WebCore::RenderMathMLSubSup::stretchToHeight):
+        (WebCore::RenderMathMLSubSup::layout):
+        * rendering/mathml/RenderMathMLSubSup.h:
+        (RenderMathMLSubSup):
+        * rendering/style/RenderStyle.h:
+
+2012-02-27  Ned Holbrook  <nholbrook@apple.com>
+
+        kCTFontTableOptionExcludeSynthetic is unneeded
+        https://bugs.webkit.org/show_bug.cgi?id=79744
+
+        Reviewed by Dan Bernstein.
+
+        The aforementioned option is a no-op, so no new tests.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::fontHasVerticalGlyphs): Specify no options.
+
+2012-02-27  Wei James  <james.wei@intel.com>
+
+        Multi-Channel support in AudioBufferSourceNode
+        https://bugs.webkit.org/show_bug.cgi?id=79202
+
+        Reviewed by Chris Rogers.
+
+        Test: webaudio/audiobuffersource-multi-channels.html
+
+        * webaudio/AudioBufferSourceNode.cpp:
+        (WebCore::AudioBufferSourceNode::renderSilenceAndFinishIfNotLooping):
+        (WebCore::AudioBufferSourceNode::renderFromBuffer):
+        (WebCore::AudioBufferSourceNode::setBuffer):
+        * webaudio/AudioBufferSourceNode.h:
+        (AudioBufferSourceNode):
+
+2012-02-27  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/IntRect.h
+        https://bugs.webkit.org/show_bug.cgi?id=79732
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::IntRect and BlackBerry::Platform::IntRect.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/IntRect.h:
+        (Platform):
+        (IntRect):
+
+2012-02-27  Emil A Eklund  <eae@chromium.org>
+
+        Printed font-size should not be dependant on zoom level
+        https://bugs.webkit.org/show_bug.cgi?id=79717
+
+        Reviewed by Adam Barth.
+
+        Ignore full page zoom level when printing a document.
+
+        Test: printing/zoomed-document.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-02-27  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Unreviewed gardening, further compile fixes for
+        TransparencyWinTest.
+
+        * platform/graphics/chromium/TransparencyWin.h:
+        (WebCore):
+
+2012-02-27  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Unreviewed gardening, fix compile error after r109043
+
+        * platform/graphics/chromium/TransparencyWin.h:
+        (TransparencyWin):
+
+2012-02-27  Adam Barth  <abarth@webkit.org>
+
+        EventFactory.in should be named EventNames.in
+        https://bugs.webkit.org/show_bug.cgi?id=79727
+
+        Reviewed by Kentaro Hara.
+
+        Originally EventFactory.in was just used to generate EventFactory.cpp,
+        but now we're able to generate a bunch of other Event-related code from
+        this "in" file.
+
+        In writing some documentation about how to use these mechanisms, the
+        name EventFactory.in didn't seem like the right name.  This patch
+        renames EventFactory.in to EventNames.in, which more accurately
+        describes the role of this file (and matches the naming convention of
+        HTMLTagNames.in).
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/action_makenames.py:
+        (main):
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/EventNames.in: Copied from Source/WebCore/dom/EventFactory.in.
+        * dom/EventFactory.in: Removed.
+
+2012-02-27  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLInputElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=79622
+
+        For ease of maintainability, this patch reorders attributes and methods declaration
+        matching with specification.
+
+        Reviewed by Adam Barth.
+
+        No new tests. No behavior change.
+
+        * html/HTMLInputElement.idl: Reorder and remove obsolete comments.
+
+2012-02-27  Luke Macpherson   <macpherson@chromium.org>
+
+        Sort CSSStyleSelector property handler constructors by CSS property name.
+        https://bugs.webkit.org/show_bug.cgi?id=79713
+
+        Reviewed by Andreas Kling.
+
+        No new tests / refactoring only.
+
+        This patch is simply an automated sort of the property constructors.
+        Presently they are all over the place and it is difficult to know where to insert new rules.
+        This patch provides a clear pattern and should reduce future conflicts when adding properties.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+
+2012-02-27  James Kozianski  <koz@chromium.org>
+
+        [chromium] Plumb extensionGroup into didCreateScriptContext().
+        https://bugs.webkit.org/show_bug.cgi?id=79072
+
+        Reviewed by Darin Fisher.
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
+        * loader/FrameLoaderClient.h:
+        (FrameLoaderClient):
+
+2012-02-27  Huang Dongsung  <luxtella@company100.net>
+
+        Fixed a typo in CanvasRenderingContext2D::drawImage(HTMLCanvasElement);
+        incorrect source and destination rect used.
+        https://bugs.webkit.org/show_bug.cgi?id=79566
+
+        Pass dstRect and bufferSrcRect to
+        CanvasRenderingContext2D::fullCanvasCompositedDrawImage() for the destination
+        and source rect, respectively.
+
+        Reviewed by Daniel Bates.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2012-02-27  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [EFL] Initial implementation of GraphicsContext3DPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=62961
+
+        Reviewed by Noam Rosenthal.
+
+        This patch adds the GraphicsContext3DPrivate class using Evas_GL.
+        GraphicsContext3DPrivate delegates all GL function calls to Evas_GL_API.
+
+        * platform/graphics/efl/GraphicsContext3DPrivate.cpp: Added.
+        (WebCore):
+        (WebCore::GraphicsContext3DPrivate::create):
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::initialize):
+        (WebCore::GraphicsContext3DPrivate::createSurface):
+        (WebCore::GraphicsContext3DPrivate::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3DPrivate::makeContextCurrent):
+        (WebCore::GraphicsContext3DPrivate::isGLES2Compliant):
+        (WebCore::GraphicsContext3DPrivate::activeTexture):
+        (WebCore::GraphicsContext3DPrivate::attachShader):
+        (WebCore::GraphicsContext3DPrivate::bindAttribLocation):
+        (WebCore::GraphicsContext3DPrivate::bindBuffer):
+        (WebCore::GraphicsContext3DPrivate::bindFramebuffer):
+        (WebCore::GraphicsContext3DPrivate::bindRenderbuffer):
+        (WebCore::GraphicsContext3DPrivate::bindTexture):
+        (WebCore::GraphicsContext3DPrivate::blendColor):
+        (WebCore::GraphicsContext3DPrivate::blendEquation):
+        (WebCore::GraphicsContext3DPrivate::blendEquationSeparate):
+        (WebCore::GraphicsContext3DPrivate::blendFunc):
+        (WebCore::GraphicsContext3DPrivate::blendFuncSeparate):
+        (WebCore::GraphicsContext3DPrivate::bufferData):
+        (WebCore::GraphicsContext3DPrivate::bufferSubData):
+        (WebCore::GraphicsContext3DPrivate::checkFramebufferStatus):
+        (WebCore::GraphicsContext3DPrivate::clear):
+        (WebCore::GraphicsContext3DPrivate::clearColor):
+        (WebCore::GraphicsContext3DPrivate::clearDepth):
+        (WebCore::GraphicsContext3DPrivate::clearStencil):
+        (WebCore::GraphicsContext3DPrivate::colorMask):
+        (WebCore::GraphicsContext3DPrivate::compileShader):
+        (WebCore::GraphicsContext3DPrivate::copyTexImage2D):
+        (WebCore::GraphicsContext3DPrivate::copyTexSubImage2D):
+        (WebCore::GraphicsContext3DPrivate::cullFace):
+        (WebCore::GraphicsContext3DPrivate::depthFunc):
+        (WebCore::GraphicsContext3DPrivate::depthMask):
+        (WebCore::GraphicsContext3DPrivate::depthRange):
+        (WebCore::GraphicsContext3DPrivate::detachShader):
+        (WebCore::GraphicsContext3DPrivate::disable):
+        (WebCore::GraphicsContext3DPrivate::disableVertexAttribArray):
+        (WebCore::GraphicsContext3DPrivate::drawArrays):
+        (WebCore::GraphicsContext3DPrivate::drawElements):
+        (WebCore::GraphicsContext3DPrivate::enable):
+        (WebCore::GraphicsContext3DPrivate::enableVertexAttribArray):
+        (WebCore::GraphicsContext3DPrivate::finish):
+        (WebCore::GraphicsContext3DPrivate::flush):
+        (WebCore::GraphicsContext3DPrivate::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3DPrivate::framebufferTexture2D):
+        (WebCore::GraphicsContext3DPrivate::frontFace):
+        (WebCore::GraphicsContext3DPrivate::generateMipmap):
+        (WebCore::GraphicsContext3DPrivate::getActiveAttrib):
+        (WebCore::GraphicsContext3DPrivate::getActiveUniform):
+        (WebCore::GraphicsContext3DPrivate::getAttachedShaders):
+        (WebCore::GraphicsContext3DPrivate::getAttribLocation):
+        (WebCore::GraphicsContext3DPrivate::getBooleanv):
+        (WebCore::GraphicsContext3DPrivate::getBufferParameteriv):
+        (WebCore::GraphicsContext3DPrivate::getContextAttributes):
+        (WebCore::GraphicsContext3DPrivate::getError):
+        (WebCore::GraphicsContext3DPrivate::getFloatv):
+        (WebCore::GraphicsContext3DPrivate::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3DPrivate::getIntegerv):
+        (WebCore::GraphicsContext3DPrivate::getProgramiv):
+        (WebCore::GraphicsContext3DPrivate::getProgramInfoLog):
+        (WebCore::GraphicsContext3DPrivate::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3DPrivate::getShaderiv):
+        (WebCore::GraphicsContext3DPrivate::getShaderInfoLog):
+        (WebCore::GraphicsContext3DPrivate::getShaderSource):
+        (WebCore::GraphicsContext3DPrivate::getString):
+        (WebCore::GraphicsContext3DPrivate::getTexParameterfv):
+        (WebCore::GraphicsContext3DPrivate::getTexParameteriv):
+        (WebCore::GraphicsContext3DPrivate::getUniformfv):
+        (WebCore::GraphicsContext3DPrivate::getUniformiv):
+        (WebCore::GraphicsContext3DPrivate::getUniformLocation):
+        (WebCore::GraphicsContext3DPrivate::getVertexAttribfv):
+        (WebCore::GraphicsContext3DPrivate::getVertexAttribiv):
+        (WebCore::GraphicsContext3DPrivate::getVertexAttribOffset):
+        (WebCore::GraphicsContext3DPrivate::hint):
+        (WebCore::GraphicsContext3DPrivate::isBuffer):
+        (WebCore::GraphicsContext3DPrivate::isEnabled):
+        (WebCore::GraphicsContext3DPrivate::isFramebuffer):
+        (WebCore::GraphicsContext3DPrivate::isProgram):
+        (WebCore::GraphicsContext3DPrivate::isRenderbuffer):
+        (WebCore::GraphicsContext3DPrivate::isShader):
+        (WebCore::GraphicsContext3DPrivate::isTexture):
+        (WebCore::GraphicsContext3DPrivate::lineWidth):
+        (WebCore::GraphicsContext3DPrivate::linkProgram):
+        (WebCore::GraphicsContext3DPrivate::pixelStorei):
+        (WebCore::GraphicsContext3DPrivate::polygonOffset):
+        (WebCore::GraphicsContext3DPrivate::readPixels):
+        (WebCore::GraphicsContext3DPrivate::renderbufferStorage):
+        (WebCore::GraphicsContext3DPrivate::sampleCoverage):
+        (WebCore::GraphicsContext3DPrivate::scissor):
+        (WebCore::GraphicsContext3DPrivate::shaderSource):
+        (WebCore::GraphicsContext3DPrivate::stencilFunc):
+        (WebCore::GraphicsContext3DPrivate::stencilFuncSeparate):
+        (WebCore::GraphicsContext3DPrivate::stencilMask):
+        (WebCore::GraphicsContext3DPrivate::stencilMaskSeparate):
+        (WebCore::GraphicsContext3DPrivate::stencilOp):
+        (WebCore::GraphicsContext3DPrivate::stencilOpSeparate):
+        (WebCore::GraphicsContext3DPrivate::texImage2D):
+        (WebCore::GraphicsContext3DPrivate::texParameterf):
+        (WebCore::GraphicsContext3DPrivate::texParameteri):
+        (WebCore::GraphicsContext3DPrivate::texSubImage2D):
+        (WebCore::GraphicsContext3DPrivate::uniform1f):
+        (WebCore::GraphicsContext3DPrivate::uniform1fv):
+        (WebCore::GraphicsContext3DPrivate::uniform1i):
+        (WebCore::GraphicsContext3DPrivate::uniform1iv):
+        (WebCore::GraphicsContext3DPrivate::uniform2f):
+        (WebCore::GraphicsContext3DPrivate::uniform2fv):
+        (WebCore::GraphicsContext3DPrivate::uniform2i):
+        (WebCore::GraphicsContext3DPrivate::uniform2iv):
+        (WebCore::GraphicsContext3DPrivate::uniform3f):
+        (WebCore::GraphicsContext3DPrivate::uniform3fv):
+        (WebCore::GraphicsContext3DPrivate::uniform3i):
+        (WebCore::GraphicsContext3DPrivate::uniform3iv):
+        (WebCore::GraphicsContext3DPrivate::uniform4f):
+        (WebCore::GraphicsContext3DPrivate::uniform4fv):
+        (WebCore::GraphicsContext3DPrivate::uniform4i):
+        (WebCore::GraphicsContext3DPrivate::uniform4iv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix2fv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix3fv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix4fv):
+        (WebCore::GraphicsContext3DPrivate::useProgram):
+        (WebCore::GraphicsContext3DPrivate::validateProgram):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib1f):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib1fv):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib2f):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib2fv):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib3f):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib3fv):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib4f):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib4fv):
+        (WebCore::GraphicsContext3DPrivate::vertexAttribPointer):
+        (WebCore::GraphicsContext3DPrivate::viewport):
+        (WebCore::GraphicsContext3DPrivate::createBuffer):
+        (WebCore::GraphicsContext3DPrivate::createFramebuffer):
+        (WebCore::GraphicsContext3DPrivate::createProgram):
+        (WebCore::GraphicsContext3DPrivate::createRenderbuffer):
+        (WebCore::GraphicsContext3DPrivate::createShader):
+        (WebCore::GraphicsContext3DPrivate::createTexture):
+        (WebCore::GraphicsContext3DPrivate::deleteBuffer):
+        (WebCore::GraphicsContext3DPrivate::deleteFramebuffer):
+        (WebCore::GraphicsContext3DPrivate::deleteProgram):
+        (WebCore::GraphicsContext3DPrivate::deleteRenderbuffer):
+        (WebCore::GraphicsContext3DPrivate::deleteShader):
+        (WebCore::GraphicsContext3DPrivate::deleteTexture):
+        (WebCore::GraphicsContext3DPrivate::synthesizeGLError):
+        (WebCore::GraphicsContext3DPrivate::getExtensions):
+        * platform/graphics/efl/GraphicsContext3DPrivate.h: Added.
+        (WebCore):
+        (GraphicsContext3DPrivate):
+
+2012-02-27  Shawn Singh  <shawnsingh@chromium.org>
+
+        RenderLayer ClipRect not accounting for transforms
+        https://bugs.webkit.org/show_bug.cgi?id=76486
+
+        Reviewed by Simon Fraser.
+
+        Test: compositing/layer-creation/overlap-transformed-and-clipped.html
+
+        This patch changes calculateClipRects() so that the clipRect
+        offset is allowed to be converted across layers with
+        transforms. This is necessary because the RenderLayerCompositor
+        needs clipRects in document space, rather than with respect to
+        some local clipping layer.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateClipRects):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToContainerPoint):
+        (WebCore):
+        * rendering/RenderObject.h:
+        (RenderObject):
+
+2012-02-27  Adam Klein  <adamk@chromium.org>
+
+        [MutationObservers] Clear pending mutation records on disconnect()
+        https://bugs.webkit.org/show_bug.cgi?id=78639
+
+        Reviewed by Ojan Vafai.
+
+        Test: fast/mutation/disconnect-cancel-pending.html
+
+        * dom/WebKitMutationObserver.cpp:
+        (WebCore::WebKitMutationObserver::disconnect): Clear pending records.
+        (WebCore::WebKitMutationObserver::deliver): Avoid calling the callback if no records are pending delivery.
+
+2012-02-27  Adam Klein  <adamk@chromium.org>
+
+        Always notify subtree of removal in ContainerNode::removeChildren
+        https://bugs.webkit.org/show_bug.cgi?id=79316
+
+        Reviewed by Ryosuke Niwa.
+
+        In the inDocument case, Node::removedFromDocument is called.
+        In the out-of-document case, call ContainerNode::removedFromTree to ensure,
+        e.g., form-associated elements are properly disconnected.
+
+        Test: fast/forms/form-associated-element-removal.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren):
+
+2012-02-27  Adam Barth  <abarth@webkit.org>
+
+        Repair license blocks for files created during modularization
+        https://bugs.webkit.org/show_bug.cgi?id=79721
+
+        Reviewed by Eric Seidel.
+
+        We failed to copy the license blocks correctly when moving code into
+        these files.  This patch restores the correct license blocks.
+
+        * Modules/geolocation/NavigatorGeolocation.cpp:
+        * Modules/geolocation/NavigatorGeolocation.h:
+        * Modules/mediastream/NavigatorMediaStream.cpp:
+        * Modules/mediastream/NavigatorMediaStream.h:
+        * bindings/js/JSDOMWindowWebAudioCustom.cpp:
+        * bindings/js/JSDOMWindowWebSocketCustom.cpp:
+        * storage/DOMWindowSQLDatabase.cpp:
+        * storage/DOMWindowSQLDatabase.h:
+
+2012-02-27  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Extract the logic for computing the dirty rows / columns out of RenderTableSection::paintObject
+        https://bugs.webkit.org/show_bug.cgi?id=79580
+
+        Reviewed by Eric Seidel.
+
+        Refactoring only.
+
+        * rendering/RenderTableSection.h:
+        (CellSpan):
+        (WebCore::CellSpan::CellSpan):
+        (WebCore::CellSpan::start):
+        (WebCore::CellSpan::end):
+        Added this class to hold the span information.
+
+        (WebCore::RenderTableSection::fullTableRowSpan):
+        (WebCore::RenderTableSection::fullTableColumnSpan):
+        Those functions return the span corresponding to the full table.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::dirtiedRows):
+        (WebCore::RenderTableSection::dirtiedColumns):
+        Those functions compute the rows / columns impacted by a |damageRect|. On the slow painting path, they
+        return the full table span.
+
+        (WebCore::RenderTableSection::paintObject):
+        Updated this function to call the new ones. Also we now inflate the local rectangle with the outlineSize.
+        This wasn't done previously and we had to manually patch some size comparison to account for the outline.
+
+2012-02-27  Kentaro Hara  <haraken@chromium.org>
+
+        Rename resolve-supplemental.pl to preprocess-idls.pl
+        https://bugs.webkit.org/show_bug.cgi?id=79660
+
+        Reviewed by Adam Barth.
+
+        Due to r108322, resolve-supplemental.pl not only resolves supplemental
+        dependencies but also runs IDL attribute checker. For clarification,
+        this patch renames resolve-supplemental.pl to preprocess-idls.pl.
+
+        No tests. Confirm that all builds pass.
+
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * UseJSC.cmake:
+        * UseV8.cmake:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.vcproj/MigrateScripts:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/scripts/preprocess-idls.pl: Renamed from Source/WebCore/bindings/scripts/resolve-supplemental.pl.
+
+2012-02-27  Kentaro Hara  <haraken@chromium.org>
+
+        [JSC] Add [ConstructorParameters=] to all custom constructors
+        https://bugs.webkit.org/show_bug.cgi?id=78221
+
+        Reviewed by Adam Barth.
+
+        This patch adds [ConstructorParameters=X] to IDL files that have
+        custom constructors, where X is the maximum number of arguments
+        of the constructor. [ConstructorParameters=X] is needed for custom
+        constructors, because custom constructors do not have a signature
+        in IDL files and thus CodeGeneratorJS.pm cannot know the number of
+        constructor arguments.
+
+        Test: fast/js/constructor-length.html
+
+        * dom/WebKitMutationObserver.idl:
+        * html/DOMFormData.idl:
+        * html/canvas/ArrayBuffer.idl:
+        * html/canvas/DataView.idl:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Float64Array.idl:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.idl:
+        * html/canvas/Uint8ClampedArray.idl:
+        * webaudio/AudioContext.idl:
+
+        * bindings/scripts/test/TestTypedArray.idl:
+
+        * bindings/scripts/test/JS/JSFloat64Array.cpp: Updated run-bindings-tests results.
+        (WebCore::JSFloat64ArrayConstructor::finishCreation):
+
+2012-02-23  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [BlackBerry][EFL] Provide dummy RunLoop implementations.
+        https://bugs.webkit.org/show_bug.cgi?id=79398
+
+        Reviewed by Antonio Gomes.
+
+        r108067 fixed the EFL build by not building RunLoop.cpp on EFL and
+        BlackBerry, as both platforms lack an implementation that provides the
+        missing methods for the RunLoop class.
+
+        However, RunLoop.cpp is a generic file which should not be included
+        directly in PlatformWinCE.cmake (plus it helps in converting the
+        AppleWin port to CMake).
+
+        Fix this by providing a dummy implementation of the missing RunLoop
+        methods for both EFL and BlackBerry.
+
+        * CMakeLists.txt:
+        * PlatformBlackBerry.cmake:
+        * PlatformEfl.cmake:
+        * PlatformWinCE.cmake:
+        * platform/blackberry/RunLoopBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::RunLoop::RunLoop):
+        (WebCore::RunLoop::~RunLoop):
+        (WebCore::RunLoop::wakeUp):
+        * platform/efl/RunLoopEfl.cpp: Added.
+        (WebCore):
+        (WebCore::RunLoop::RunLoop):
+        (WebCore::RunLoop::~RunLoop):
+        (WebCore::RunLoop::wakeUp):
+
+2012-02-27  John Sullivan  <sullivan@apple.com>
+
+        Build fix (on Lion at least).
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::childrenChanged):
+        Removed names of unused parameters.
+        
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::childrenChanged):
+        Ditto.
+
+2012-02-27  Kentaro Hara  <haraken@chromium.org>
+
+        Remove [ConstructorParameters] from IDL files that have [Constructor]
+        https://bugs.webkit.org/show_bug.cgi?id=79643
+
+        Reviewed by Adam Barth.
+
+        This patch removes [ConstructorParameters] from IDL files that have [Constructor],
+        since CodeGeneratorJS.pm can automatically detect the number of constructor
+        arguments by the [Constructor(...)] signature.
+
+        Test: fast/js/constructor-length.html
+
+        * Modules/mediastream/PeerConnection.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorDefinition):
+        * css/WebKitCSSMatrix.idl:
+        * page/EventSource.idl:
+        * workers/SharedWorker.idl:
+        * workers/Worker.idl:
+
+2012-02-27  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Avoid doing 2 hash lookups if we override RenderBox's logical width / height
+        https://bugs.webkit.org/show_bug.cgi?id=79591
+
+        Reviewed by Antonio Gomes.
+
+        Refactoring only.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clearOverrideSize):
+        Instead of doing one hash lookup as part of hasOverride{Height|Width}, let's
+        just directly call HashMap::remove that will do the lookup instead.
+
+2012-02-27  Adam Klein  <adamk@chromium.org>
+
+        Move WebCore-internal DOM notification methods from Node to ContainerNode where appropriate
+        https://bugs.webkit.org/show_bug.cgi?id=79697
+
+        Reviewed by Ryosuke Niwa.
+
+        insertedIntoTree/removedFromTree are only used by subclasses of
+        ContainerNode. Moreover, attempting to make use of these notifications
+        in a non-container Node would currently not work, because
+        Node::removedFromDocument/insertedIntoDocument do not dispatch to these methods.
+        Rather than adding useless calls to an always-empty virtual method,
+        this patch moves these methods to ContainerNode.
+
+        Meanwhile, childrenChanged moves to ContainerNode for an obvious reason:
+        non-container Nodes have no children to change.
+
+        No new tests, refactoring only.
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::childrenChanged): Remove call to now-nonexistent Node::childrenChanged.
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChild): Check that the removed child is a container node before notifying it of removal.
+        (WebCore::ContainerNode::parserRemoveChild): ditto.
+        (WebCore::ContainerNode::insertedIntoTree): Remove call to now-nonexistent Node::insertedIntoTree.
+        (WebCore::ContainerNode::removedFromTree): Remove call to now-nonexistent Node::removedFromTree.
+        (WebCore::ContainerNode::childrenChanged): Remove call to now-nonexistent Node::childrenChanged.
+        (WebCore::notifyChildInserted): Check that the inserted child is a container node before notifying it of insertion.
+        * dom/ContainerNode.h:
+        (ContainerNode): Migrate comments from Node.h, point back at it for more notification methods.
+        * dom/Node.h:
+        (Node): Move methods, update comments to point at ContainerNode.h.
+
+2012-02-27  Chris Rogers  <crogers@google.com>
+
+        Implement static compression curve parameters for DynamicsCompressorNode
+        https://bugs.webkit.org/show_bug.cgi?id=78937
+
+        Reviewed by Kenneth Russell.
+
+        Test: webaudio/dynamicscompressor-basic.html
+
+        * platform/audio/DynamicsCompressor.cpp:
+        (WebCore::DynamicsCompressor::setParameterValue):
+        (WebCore):
+        (WebCore::DynamicsCompressor::initializeParameters):
+        (WebCore::DynamicsCompressor::process):
+        * platform/audio/DynamicsCompressor.h:
+        * platform/audio/DynamicsCompressorKernel.cpp:
+        (WebCore):
+        (WebCore::DynamicsCompressorKernel::DynamicsCompressorKernel):
+        (WebCore::DynamicsCompressorKernel::setPreDelayTime):
+        (WebCore::DynamicsCompressorKernel::kneeCurve):
+        (WebCore::DynamicsCompressorKernel::saturate):
+        (WebCore::DynamicsCompressorKernel::slopeAt):
+        (WebCore::DynamicsCompressorKernel::kAtSlope):
+        (WebCore::DynamicsCompressorKernel::updateStaticCurveParameters):
+        (WebCore::DynamicsCompressorKernel::process):
+        * platform/audio/DynamicsCompressorKernel.h:
+        (DynamicsCompressorKernel):
+        (WebCore::DynamicsCompressorKernel::meteringGain):
+        * webaudio/DynamicsCompressorNode.cpp:
+        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
+        (WebCore::DynamicsCompressorNode::process):
+        * webaudio/DynamicsCompressorNode.h:
+        (WebCore):
+        (WebCore::DynamicsCompressorNode::create):
+        (DynamicsCompressorNode):
+        (WebCore::DynamicsCompressorNode::threshold):
+        (WebCore::DynamicsCompressorNode::knee):
+        (WebCore::DynamicsCompressorNode::ratio):
+        (WebCore::DynamicsCompressorNode::reduction):
+        * webaudio/DynamicsCompressorNode.idl:
+
+2012-02-27  Enrica Casucci  <enrica@apple.com>
+
+        WebKit2: implement platform strategy to access Pasteboard in the UI process.
+        https://bugs.webkit.org/show_bug.cgi?id=79253
+        <rdar://problem/9971876>
+
+        Reviewed by Alexey Proskuryakov.
+
+        No new tests. No behavior change.
+
+        * platform/mac/PlatformPasteboardMac.mm:
+        (WebCore::PlatformPasteboard::bufferForType): There is no need
+        to create a SharedBuffer object if there is no NSData in the pasteboard
+        for the given pasteboard type.
+
+2012-02-27  Adrienne Walker  <enne@google.com>
+
+        [chromium] Unreviewed speculative Chromium win build fix.
+
+        mdelaney's http://trac.webkit.org/changeset/109016 changed the
+        interface on ImageBuffer, but didn't update TransparencyWin.
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::OwnedBuffers::canHandleSize):
+
+2012-02-27  Matthew Delaney  <mdelaney@apple.com>
+
+        Add ImageBuffer support for having a hi-res backing store. This allows
+        ImageBuffer clients to specify a scale factor upon creation so that they
+        don't have to maintain that info themselves as they use/pass around the ImageBuffer.
+        https://bugs.webkit.org/show_bug.cgi?id=79395
+
+        Reviewed by Dan Bernstein.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::create): Scale the backing store by the resolution scale.
+        (WebCore::ImageBuffer::logicalSize): Differentiate the logical size from the backing store's size.
+        (WebCore::ImageBuffer::internalSize): The backing store's size.
+
+        * platform/graphics/cg/ImageBufferCG.cpp: Prefer the explicit use of logicalSize and internalSize.
+
+        Explicitly state a 1x scale for all ImageBuffer creation sites
+        since this is what they currently assume.
+        * html/HTMLCanvasElement.cpp:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/WebGLRenderingContext.cpp:
+        * page/Frame.cpp:
+        * platform/graphics/CrossfadeGeneratedImage.cpp:
+        * platform/graphics/ShadowBlur.cpp:
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        * platform/graphics/filters/FEDropShadow.cpp:
+        * platform/graphics/filters/FilterEffect.cpp:
+        * platform/mac/ScrollbarThemeMac.mm:
+        * rendering/FilterEffectRenderer.cpp:
+        * rendering/RenderThemeMac.mm:
+        * rendering/svg/SVGImageBufferTools.cpp:
+        * svg/graphics/SVGImage.cpp:
+        * svg/graphics/SVGImageCache.cpp:
+
+        Update ImageBuffer::size() calls to new versions.
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/ImageBuffer.cpp:
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+
+2012-02-27  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions]-webkit-flow-into initial value should be none instead of auto
+        https://bugs.webkit.org/show_bug.cgi?id=79670
+
+        Reviewed by Simon Fraser.
+
+        No new tests, modified expectations for existing tests.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFlowThread):
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+
+2012-02-27  Ojan Vafai  <ojan@chromium.org>
+
+        implement display: -webkit-inline-flexbox
+        https://bugs.webkit.org/show_bug.cgi?id=77772
+
+        Reviewed by David Hyatt.
+
+        Tests: css3/flexbox/inline-flexbox-expected.html
+               css3/flexbox/inline-flexbox.html
+
+        * rendering/style/RenderStyle.h:
+        -Add INLINE_FLEXBOX to the list of replaced display types.
+        -Restructure the isDisplayInline methods to avoid code duplication.
+
+2012-02-27  Ken Buchanan  <kenrb@chromium.org>
+
+        Absolute positioned elements with Inline Relative Positioned Container are not layout correctly
+        https://bugs.webkit.org/show_bug.cgi?id=78713
+
+        Reviewed by David Hyatt.
+
+        Test: fast/css/positioned-in-relative-position-inline-crash.html
+
+        Patch originally by Robin Cao.
+
+        This is a regression. r104183 changes containingBlock() so that it returns the container
+        of an anonymous block for positioned objects, not the anonymous block itself. We should
+        change markContainingBlocksForLayout() to match the change in containingBlock().
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+
+2012-02-27  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: move record formatting into the timeline presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=79684
+
+        Drive-by: fix for stop recording in reset; cpu time restored.
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/TimelineModel.js:
+        (WebInspector.TimelineModel.prototype.reset):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.update.updateBoundaries):
+        (WebInspector.TimelineOverviewCalculator.prototype.updateBoundaries):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._rootRecord):
+        (WebInspector.TimelinePanel.prototype._updateRecordsCounter):
+        (WebInspector.TimelinePanel.prototype._repopulateRecords):
+        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._updateBoundaries):
+        (WebInspector.TimelinePanel.prototype._filterRecords):
+        (WebInspector.TimelinePanel.prototype.revealRecordAt):
+        (WebInspector.TimelinePanel.prototype._showPopover):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphWindowPosition):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel):
+        (WebInspector.TimelinePresentationModel.prototype.createFormattedRecord):
+        (WebInspector.TimelinePresentationModel.prototype._createRootRecord):
+        (WebInspector.TimelinePresentationModel.prototype.rootRecord):
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.prototype._findParentRecord):
+        (WebInspector.TimelinePresentationModel.prototype._resetWindow):
+        (WebInspector.TimelinePresentationModel.prototype._addCategory):
+        (WebInspector.TimelinePresentationModel.prototype.setCategoryVisibility):
+        (WebInspector.TimelinePresentationModel.prototype.get _recordStyles):
+        (WebInspector.TimelinePresentationModel.Record):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get lastChildEndTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype.set lastChildEndTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get selfTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype.set selfTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get cpuTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype.isLong):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get children):
+        (WebInspector.TimelinePresentationModel.Record.prototype.containsTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype._generateAggregatedInfo):
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+        (WebInspector.TimelinePresentationModel.Record.prototype._refreshDetails):
+        (WebInspector.TimelinePresentationModel.Record.prototype._getRecordDetails):
+        (WebInspector.TimelinePresentationModel.Record.prototype._linkifyLocation):
+        (WebInspector.TimelinePresentationModel.Record.prototype._linkifyCallFrame):
+        (WebInspector.TimelinePresentationModel.Record.prototype._linkifyTopCallFrame):
+        (WebInspector.TimelinePresentationModel.Record.prototype._linkifyScriptLocation):
+        (WebInspector.TimelinePresentationModel.Record.prototype.calculateAggregatedStats):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get aggregatedStats):
+        (WebInspector.TimelinePresentationModel.PopupContentHelper):
+        (WebInspector.TimelinePresentationModel.PopupContentHelper.prototype._createCell):
+        (WebInspector.TimelinePresentationModel.PopupContentHelper.prototype._appendTextRow):
+        (WebInspector.TimelinePresentationModel.PopupContentHelper.prototype._appendElementRow):
+        (WebInspector.TimelinePresentationModel.PopupContentHelper.prototype._appendStackTrace):
+        * inspector/front-end/timelinePanel.css:
+        (.timeline-graph-bar.cpu):
+
+2012-02-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Scripts navigator overlay should not consume mouse actions.
+        https://bugs.webkit.org/show_bug.cgi?id=79674
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.registerShortcut):
+        (WebInspector.Panel.prototype.unregisterShortcut):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._editorClosed):
+        (WebInspector.ScriptsPanel.prototype._editorSelected):
+        (WebInspector.ScriptsPanel.prototype._fileSelected):
+        (WebInspector.ScriptsPanel.prototype._escDownWhileNavigatorOverlayOpen):
+        (WebInspector.ScriptsPanel.prototype.set _showNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._hideNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._navigatorOverlayWasShown):
+        * inspector/front-end/SidebarOverlay.js:
+        (WebInspector.SidebarOverlay):
+        (WebInspector.SidebarOverlay.prototype.show):
+        (WebInspector.SidebarOverlay.prototype._containingElementFocused):
+        (WebInspector.SidebarOverlay.prototype.position):
+        (WebInspector.SidebarOverlay.prototype.hide):
+        (WebInspector.SidebarOverlay.prototype._setWidth):
+        * inspector/front-end/dialog.css:
+        (.go-to-line-dialog button:active):
+        * inspector/front-end/scriptsPanel.css:
+        (#scripts-editor-view .sidebar-overlay):
+        * inspector/front-end/splitView.css:
+        (.split-view-resizer):
+        (.sidebar-overlay):
+        (.sidebar-overlay-resizer):
+
+2012-02-27  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] 0.11 support in MediaPlayerPrivateGStreamer
+        https://bugs.webkit.org/show_bug.cgi?id=77089
+
+        Reviewed by Martin Robinson.
+
+        Basic port to GStreamer 0.11 APIs. This patch excludes the video
+        painting changes and the GStreamerGWorld changes which are handled
+        in two other patches (bugs 77087 and 77088).
+
+        * GNUmakefile.list.am: Add GStreamerVersioning files to the build.
+        * Source/WebCore/PlatformEfl.cmake: Ditto.
+        * Source/WebCore/Target.pri: Ditto.
+        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
+        (WTF::GstElement):
+        (WTF::GstPad):
+        (WTF::GstPadTemplate):
+        (WTF::GstTask):
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp: Added.
+        (webkit_gst_object_ref_sink):
+        (webkit_gst_element_get_pad_caps):
+        * platform/graphics/gstreamer/GStreamerVersioning.h: Added.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::isAvailable):
+        (WebCore::MediaPlayerPrivateGStreamer::duration):
+        (WebCore::MediaPlayerPrivateGStreamer::naturalSize):
+
+2012-02-27  Philip Rogers  <pdr@google.com>
+
+        Stop recomputing SVG path data twice during layout
+        https://bugs.webkit.org/show_bug.cgi?id=79672
+
+        Reviewed by Nikolas Zimmermann.
+
+        * rendering/svg/RenderSVGShape.cpp:
+        (WebCore::RenderSVGShape::layout):
+
+2012-02-27  Timothy Hatcher  <timothy@apple.com>
+
+        Updated for WebKit2 string changes.
+
+        https://webkit.org/b/79649
+
+        Reviewed by John Sullivan.
+
+        * English.lproj/Localizable.strings: Updated.
+
+2012-02-27  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: Ctrl+K should not zoom in
+        https://bugs.webkit.org/show_bug.cgi?id=79676
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2012-02-27  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: extract TimelineModel and TimelinePresentationModel into their own files.
+        https://bugs.webkit.org/show_bug.cgi?id=79675
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/TimelineAgent.js: Removed.
+        * inspector/front-end/TimelineModel.js: Added.
+        (WebInspector.TimelineModel):
+        (WebInspector.TimelineModel.prototype.startRecord):
+        (WebInspector.TimelineModel.prototype.stopRecord):
+        (WebInspector.TimelineModel.prototype.get records):
+        (WebInspector.TimelineModel.prototype._onRecordAdded):
+        (WebInspector.TimelineModel.prototype._addRecord):
+        (WebInspector.TimelineModel.prototype._loadNextChunk):
+        (WebInspector.TimelineModel.prototype._loadFromFile):
+        (WebInspector.TimelineModel.prototype._loadFromFile.onError):
+        (WebInspector.TimelineModel.prototype._saveToFile):
+        (WebInspector.TimelineModel.prototype._reset):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get _recordStyles):
+        (WebInspector.TimelinePanel.prototype._createEventDivider):
+        (WebInspector.TimelinePanel.prototype._findParentRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+        * inspector/front-end/TimelinePresentationModel.js: Added.
+        (WebInspector.TimelinePresentationModel):
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.prototype.get categories):
+        (WebInspector.TimelinePresentationModel.prototype.addCategory):
+        (WebInspector.TimelinePresentationModel.prototype.setWindowPosition):
+        (WebInspector.TimelinePresentationModel.prototype.setWindowIndices):
+        (WebInspector.TimelinePresentationModel.prototype.setCategoryVisibility):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-02-27  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Allow adding CSS properties anywhere in the style declaration, not only at the end
+        https://bugs.webkit.org/show_bug.cgi?id=79662
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleDeclaration.prototype.newBlankProperty):
+        (WebInspector.CSSProperty.prototype.setText):
+        (WebInspector.CSSProperty.prototype.setValue):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype._applyUserInput):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype._handleSelectorContainerClick):
+        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.element.userInput.previousContent.context.moveDirection):
+        (WebInspector.StylePropertyTreeElement.prototype.styleText.updateInterface.majorChange.isRevert):
+
+2012-02-27  Pavel Feldman  <pfeldman@google.com>
+
+        [Shadow]: Expose one ShadowRoot in the Elements panel (under experiment flag)
+        https://bugs.webkit.org/show_bug.cgi?id=78202
+
+        Reviewed by Yury Semikhatsky.
+
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::pushShadowRoot):
+        (WebCore::ShadowTree::popShadowRoot):
+        * inspector/Inspector.json:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::assertEditableNode):
+        (WebCore::InspectorDOMAgent::assertEditableElement):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::setAttributeValue):
+        (WebCore::InspectorDOMAgent::setAttributesAsText):
+        (WebCore::InspectorDOMAgent::removeAttribute):
+        (WebCore::InspectorDOMAgent::removeNode):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        (WebCore::InspectorDOMAgent::moveTo):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::didPushShadowRoot):
+        (WebCore):
+        (WebCore::InspectorDOMAgent::willPopShadowRoot):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore):
+        (InspectorDOMAgent):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didPushShadowRootImpl):
+        (WebCore):
+        (WebCore::InspectorInstrumentation::willPopShadowRootImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore):
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::didPushShadowRoot):
+        (WebCore::InspectorInstrumentation::willPopShadowRoot):
+        * inspector/PageConsoleAgent.cpp:
+        (WebCore::PageConsoleAgent::addInspectedNode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMNode.prototype.hasChildNodes):
+        (WebInspector.DOMNode.prototype.isInShadowTree):
+        (WebInspector.DOMNode.prototype._insertChild):
+        (WebInspector.DOMNode.prototype._setChildrenPayload):
+        (WebInspector.DOMDocument):
+        (WebInspector.DOMAgent.prototype._setDetachedRoot):
+        (WebInspector.DOMAgent.prototype._shadowRootPopped):
+        (WebInspector.DOMDispatcher.prototype.childNodeRemoved):
+        (WebInspector.DOMDispatcher.prototype.shadowRootPushed):
+        (WebInspector.DOMDispatcher.prototype.shadowRootPopped):
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/MemoryStatistics.js:
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/inspector.css:
+        (.webkit-html-tag.shadow, .webkit-html-fragment.shadow):
+
+2012-02-27  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] remove dependencies from TimelinePanel from most of FormattedRecord
+        https://bugs.webkit.org/show_bug.cgi?id=79665
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._linkifyLocation):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._linkifyCallFrame):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._linkifyTopCallFrame):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._linkifyScriptLocation):
+        (WebInspector.TimelinePanel.PopupContentHelper):
+        (WebInspector.TimelinePanel.PopupContentHelper.prototype._appendStackTrace):
+
+2012-02-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: reveal corresponding timeline record when user clicks on memory graph
+        https://bugs.webkit.org/show_bug.cgi?id=79669
+
+        When user clicks on DOM counter graph corresponding timeline record is
+        revealed in timelime grid and all its ancestors are expanded.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype._onClick):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.HeapGraph.prototype.update):
+        (WebInspector.HeapGraph.prototype._clear):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.revealRecordAt.recordFinder):
+        (WebInspector.TimelinePanel.prototype.revealRecordAt):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.forAllRecords):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype.containsTime):
+
+2012-02-27  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed single line fix for r108983.
+
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype.willHide):
+
+2012-02-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: repaint counter graphs when timeline splitter moves
+        https://bugs.webkit.org/show_bug.cgi?id=79644
+
+        Immediately refresh timeline panel on splitter move.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._splitterDragging):
+
+2012-02-27  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.am: Add missing files.
+        * GNUmakefile.list.am: Ditto.
+
+2012-02-27  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Build fix after r108709.
+
+        * CMakeLists.txt: Move DOMWindowSVG.idl to the other IDL files.
+
+2012-02-27  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: [chromium] Profiles - Tooltip with object/property types stays on screen when another tab selected
+        https://bugs.webkit.org/show_bug.cgi?id=79654
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype.willHide):
+
+2012-02-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Remove page/PageSupplement.h from WebCore's Target.pri
+
+        The file itself was removed in r108958.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Target.pri:
+
+2012-02-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Use USE() macro instead of ENABLE() for using the Qt image decoder
+
+        Reviewed by Kenneth Rohde Christiansen..
+
+        * Target.pri:
+        * WebCore.pri:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageFrame::getAddr):
+        (ImageFrame):
+        * platform/image-decoders/qt/ImageFrameQt.cpp:
+        (WebCore):
+        (WebCore::ImageFrame::asNewNativeImage):
+
+2012-02-27  MORITA Hajime  <morrita@google.com>
+
+        Removing <ul>, <li> inside shadow DOM triggers assertion in updateListMarkerNumbers
+        https://bugs.webkit.org/show_bug.cgi?id=72440
+
+        Reviewed by Ryosuke Niwa.
+
+        This problem was caused by the inconsistent detach order of DOM tree where
+        Element::detach() called ContainerNode::detach() before shadow tree is detached.
+        This resulted the renderer of the element being destroyed even if its children,
+        each of which came from an element in the shadow tree, are alive.
+        In principle, child renderers should be destroyed before its parent.
+
+        This change aligns the detach order with the attach order. The shadow tree is
+        now deatched before parent's ContainerNode::detach() is called.
+
+        Test: fast/dom/shadow/shadow-ul-li.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::detach):
+
+2012-02-27  Keishi Hattori  <keishi@webkit.org>
+
+        Color input type should be clickable through keyboard
+        https://bugs.webkit.org/show_bug.cgi?id=79629
+
+        Reviewed by Kent Tamura.
+
+        Introduced BaseClickableWithKeyInputType that represents an input type
+        that can be clicked by pressing space/return keys.
+        ColorInputType, FileInputType directly inherit it because it doesn't
+        want the other methods(like appendFormData) in BaseButtonInputType.
+
+        * CMakeLists.txt: Added BaseClickableWithKeyInputType.cpp
+        * GNUmakefile.list.am: Added BaseClickableWithKeyInputType.{cpp,h}
+        * Target.pri: Added BaseClickableWithKeyInputType.{cpp,h}
+        * WebCore.gypi: Added BaseClickableWithKeyInputType.{cpp,h}
+        * WebCore.vcproj/WebCore.vcproj: Added BaseClickableWithKeyInputType.{cpp,h}
+        * WebCore.xcodeproj/project.pbxproj: Added BaseClickableWithKeyInputType.{cpp,h}
+        * html/BaseButtonInputType.cpp:
+        * html/BaseButtonInputType.h:
+        (WebCore::BaseButtonInputType::BaseButtonInputType): Inherits BaseClickableWithKeyInputType now.
+        (BaseButtonInputType):
+        * html/BaseCheckableInputType.cpp: Changed comment.
+        * html/BaseClickableWithKeyInputType.cpp:
+        (WebCore):
+        (WebCore::BaseClickableWithKeyInputType::handleKeydownEvent): Moved from BaseButtonInputType
+        (WebCore::BaseClickableWithKeyInputType::handleKeypressEvent): Moved from BaseButtonInputType
+        (WebCore::BaseClickableWithKeyInputType::handleKeyupEvent): Moved from BaseButtonInputType
+        (WebCore::BaseClickableWithKeyInputType::accessKeyAction): Moved from BaseButtonInputType
+        * html/BaseClickableWithKeyInputType.h:
+        (WebCore):
+        (BaseClickableWithKeyInputType): Input type that can be clicked by pressing space/return keys.
+        (WebCore::BaseClickableWithKeyInputType::BaseClickableWithKeyInputType):
+        * html/ColorInputType.h:
+        (WebCore::ColorInputType::ColorInputType): Inherits BaseClickableWithKeyInputType now.
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::FileInputType):
+        * html/FileInputType.h:
+        (FileInputType): Inherits BaseClickableWithKeyInputType now.
+        * html/RangeInputType.cpp: Changed comment.
+        (WebCore):
+
+2012-02-27  Keishi Hattori  <keishi@webkit.org>
+
+        Add missing include to ColorInputType.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79632
+
+        Reviewed by Kent Tamura.
+
+        * html/ColorInputType.cpp: Include ShadowTree.h
+
+2012-02-27  Andrey Kosyakov  <caseq@chromium.org>
+
+        Use built-in bind in ExtensionAPI.js
+
+        Web Inspector: [Extensions API] get rid of custom bind() in favor of built-in
+        https://bugs.webkit.org/show_bug.cgi?id=79570
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ExtensionAPI.js:
+        (injectedExtensionAPI.EventSinkImpl.prototype.addListener):
+        (injectedExtensionAPI):
+        (injectedExtensionAPI.Panels.prototype.create):
+        (injectedExtensionAPI.AuditResultImpl):
+        (injectedExtensionAPI.ExtensionServerClient):
+
+2012-02-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: get rid of RawSourceCode.sourceMapping getter.
+        https://bugs.webkit.org/show_bug.cgi?id=79461
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.uiSourceCodeAdded):
+        (WebInspector.BreakpointManager.prototype.setBreakpoint):
+        (WebInspector.BreakpointManager.prototype._materializeBreakpoint):
+        (WebInspector.BreakpointManager.prototype._breakpointDebuggerLocationChanged):
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype.get location):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.rawLocationToUILocation):
+        (WebInspector.DebuggerPresentationModel.prototype.uiSourceCodes):
+        (WebInspector.DebuggerPresentationModel.prototype._handleUISourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._uiSourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreConsoleMessages):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreExecutionLine):
+        (WebInspector.DebuggerPresentationModel.prototype._consoleMessageAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
+        (WebInspector.PresentationCallFrame.prototype.uiLocation):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype.discard):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype._update):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.canSetContent):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.setContent):
+        (WebInspector.DebuggerPresentationModel.DefaultLinkifierFormatter.prototype.formatRawSourceCodeAnchor):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyRawSourceCode):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.reset):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype._updateAnchor):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype.rawLocationToUILocation):
+        (WebInspector.RawSourceCode.prototype.uiLocationToRawLocation):
+        (WebInspector.RawSourceCode.prototype.uiSourceCodeList):
+        (WebInspector.RawSourceCode.prototype._saveSourceMapping):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._updateCallFrame):
+        * inspector/front-end/ScriptsSearchScope.js:
+        (WebInspector.ScriptsSearchResultsPane.prototype.createAnchor):
+
+2012-02-27  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions]Implement NamedFlow::getRegionsByContentNode
+        https://bugs.webkit.org/show_bug.cgi?id=77746
+
+        Reviewed by David Hyatt.
+
+        Tests: fast/regions/get-regions-by-content-node-horiz-bt.html
+               fast/regions/get-regions-by-content-node-horiz-tb.html
+               fast/regions/get-regions-by-content-node-vert-lr.html
+               fast/regions/get-regions-by-content-node-vert-rl.html
+               fast/regions/get-regions-by-content-node.html
+               fast/regions/get-regions-by-content-node2.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Node.cpp:
+        (WebCore::Node::removeCachedRegionNodeList):
+        (WebCore):
+        (WebCore::Node::getRegionsByContentNode):
+        (WebCore::NodeListsNodeData::invalidateCaches):
+        (WebCore::NodeListsNodeData::isEmpty):
+        * dom/Node.h:
+        (WebCore):
+        (Node):
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        * dom/RegionNodeList.cpp:
+        (WebCore):
+        (WebCore::RegionNodeList::RegionNodeList):
+        (WebCore::RegionNodeList::~RegionNodeList):
+        (WebCore::RegionNodeList::nodeMatches):
+        * dom/RegionNodeList.h:
+        (WebCore):
+        (RegionNodeList):
+        (WebCore::RegionNodeList::create):
+        * dom/WebKitNamedFlow.cpp:
+        (WebCore::WebKitNamedFlow::getRegionsByContentNode):
+        (WebCore):
+        * dom/WebKitNamedFlow.h:
+        (WebCore):
+        (WebKitNamedFlow):
+        * dom/WebKitNamedFlow.idl:
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::regionInRange):
+        (WebCore):
+        (WebCore::RenderFlowThread::objectInFlowRegion):
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderRegion.h:
+        (WebCore::RenderRegion::flowThread):
+
+2012-02-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: counter graphs should resize after console showing
+        https://bugs.webkit.org/show_bug.cgi?id=79640
+
+        Invoke Panel.doResize after showing drawer.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+
+2012-02-27  Dan Beam  <dbeam@chromium.org>
+
+        Web Inspector: Close TabbedPanes on middle click of tab handle
+        https://bugs.webkit.org/show_bug.cgi?id=79518
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPaneTab.prototype._createTabElement):
+        (WebInspector.TabbedPaneTab.prototype._tabClicked):
+
+2012-02-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: crash in fake workers
+        https://bugs.webkit.org/show_bug.cgi?id=79637
+
+        Notify front-end about worker creation/destruction synchronously instead of
+        posting a task.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorAgent::didCreateWorker):
+        (WebCore::InspectorAgent::didDestroyWorker):
+        * inspector/InspectorAgent.h:
+        (InspectorAgent):
+
+2012-02-26  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Fix some warnings in the build from referencing the non-existent
+        websockets directory.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-02-26  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Rename ShadowRootList to ShadowTree.
+        https://bugs.webkit.org/show_bug.cgi?id=79342
+
+        Reviewed by Hajime Morita.
+
+        This patch renames ShadowRootList ot ShadowTree.
+
+        No new tests, no change in behavior.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+        * dom/Document.cpp:
+        (WebCore::Document::buildAccessKeyMap):
+        * dom/Element.cpp:
+        (WebCore::Element::willRemove):
+        (WebCore::Element::insertedIntoDocument):
+        (WebCore::Element::removedFromDocument):
+        (WebCore::Element::insertedIntoTree):
+        (WebCore::Element::removedFromTree):
+        (WebCore::Element::attach):
+        (WebCore::Element::detach):
+        (WebCore::Element::recalcStyle):
+        (WebCore::Element::hasShadowRoot):
+        (WebCore::Element::shadowTree):
+        (WebCore::Element::setShadowRoot):
+        (WebCore::Element::ensureShadowRoot):
+        (WebCore::Element::removeShadowRoot):
+        (WebCore::Element::childrenChanged):
+        * dom/Element.h:
+        (WebCore):
+        (Element):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+        (WebCore::ElementRareData::~ElementRareData):
+        * dom/Node.cpp:
+        (WebCore::oldestShadowRoot):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::hostChildrenChanged):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (WebCore):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::tree):
+        (WebCore::ShadowRoot::attach):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        (ShadowRoot):
+        * dom/ShadowTree.cpp: Renamed from Source/WebCore/dom/ShadowRootList.cpp.
+        (WebCore):
+        (WebCore::ShadowTree::ShadowTree):
+        (WebCore::ShadowTree::~ShadowTree):
+        (WebCore::ShadowTree::pushShadowRoot):
+        (WebCore::ShadowTree::popShadowRoot):
+        (WebCore::ShadowTree::insertedIntoDocument):
+        (WebCore::ShadowTree::removedFromDocument):
+        (WebCore::ShadowTree::insertedIntoTree):
+        (WebCore::ShadowTree::removedFromTree):
+        (WebCore::ShadowTree::willRemove):
+        (WebCore::ShadowTree::attach):
+        (WebCore::ShadowTree::detach):
+        (WebCore::ShadowTree::insertionPointFor):
+        (WebCore::ShadowTree::isSelectorActive):
+        (WebCore::ShadowTree::reattach):
+        (WebCore::ShadowTree::childNeedsStyleRecalc):
+        (WebCore::ShadowTree::needsStyleRecalc):
+        (WebCore::ShadowTree::recalcShadowTreeStyle):
+        (WebCore::ShadowTree::needsReattachHostChildrenAndShadow):
+        (WebCore::ShadowTree::hostChildrenChanged):
+        (WebCore::ShadowTree::setNeedsReattachHostChildrenAndShadow):
+        (WebCore::ShadowTree::reattachHostChildrenAndShadow):
+        (WebCore::ShadowTree::ensureSelector):
+        * dom/ShadowTree.h: Renamed from Source/WebCore/dom/ShadowRootList.h.
+        (WebCore):
+        (ShadowTree):
+        (WebCore::ShadowTree::hasShadowRoot):
+        (WebCore::ShadowTree::youngestShadowRoot):
+        (WebCore::ShadowTree::oldestShadowRoot):
+        (WebCore::ShadowTree::selector):
+        (WebCore::ShadowTree::clearNeedsReattachHostChildrenAndShadow):
+        (WebCore::ShadowTree::host):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::shadowRootFor):
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::createShadowSubtree):
+        (WebCore::ColorInputType::shadowColorSwatch):
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::createShadowSubtree):
+        (WebCore::FileInputType::multipleAttributeChanged):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::findMainSummary):
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::shadowSelect):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaControls):
+        (WebCore::HTMLMediaElement::hasMediaControls):
+        * html/HTMLSummaryElement.cpp:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::innerTextElement):
+        (WebCore::HTMLTextAreaElement::updatePlaceholderText):
+        * html/InputType.cpp:
+        (WebCore::InputType::destroyShadowSubtree):
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::handleMouseDownEvent):
+        (WebCore::RangeInputType::createShadowSubtree):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::createShadowSubtree):
+        (WebCore::TextFieldInputType::updatePlaceholderText):
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::deleteBubbleTree):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        (WebCore::HTMLContentElement::parseAttribute):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::sliderThumbElementOf):
+        (WebCore::RenderSliderContainer::layout):
+        (WebCore::trackLimiterElementOf):
+        * page/FocusController.cpp:
+        (WebCore::shadowRoot):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::uploadButton):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::updateReferencedText):
+        (WebCore::SVGTRefElement::detachTarget):
+        * testing/Internals.cpp:
+        (WebCore::Internals::ensureShadowRoot):
+        (WebCore::Internals::youngestShadowRoot):
+        (WebCore::Internals::oldestShadowRoot):
+
+2012-02-26  Adam Barth  <abarth@webkit.org>
+
+        Extract Supplementable base class from Page and Navigator
+        https://bugs.webkit.org/show_bug.cgi?id=79624
+
+        Reviewed by Hajime Morita.
+
+        We'll use this pattern again soon for ScriptExecutionContext.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/gamepad/NavigatorGamepad.cpp:
+        (WebCore::NavigatorGamepad::from):
+        * Modules/gamepad/NavigatorGamepad.h:
+        * Modules/geolocation/NavigatorGeolocation.cpp:
+        (WebCore::NavigatorGeolocation::from):
+        * Modules/geolocation/NavigatorGeolocation.h:
+        * Modules/mediastream/NavigatorMediaStream.cpp:
+        (WebCore::NavigatorMediaStream::webkitGetUserMedia):
+        * Modules/mediastream/UserMediaController.cpp:
+        (WebCore::provideUserMediaTo):
+        * Modules/mediastream/UserMediaController.h:
+        (WebCore::UserMediaController::from):
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DeviceMotionController.cpp:
+        (WebCore::provideDeviceMotionTo):
+        * dom/DeviceMotionController.h:
+        (WebCore::DeviceMotionController::from):
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::provideDeviceOrientationTo):
+        * dom/DeviceOrientationController.h:
+        (WebCore):
+        (WebCore::DeviceOrientationController::from):
+        * notifications/NotificationController.cpp:
+        (WebCore::provideNotification):
+        * notifications/NotificationController.h:
+        (WebCore):
+        (WebCore::NotificationController::from):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::page):
+        (WebCore):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        * page/DOMWindow.h:
+        (WebCore):
+        (DOMWindow):
+        * page/Navigator.cpp:
+        (WebCore):
+        * page/Navigator.h:
+        (Navigator):
+        * page/NavigatorSupplement.cpp: Removed.
+        * page/NavigatorSupplement.h: Removed.
+        * page/Page.cpp:
+        (WebCore):
+        * page/Page.h:
+        (Page):
+        * page/PageSupplement.cpp: Removed.
+        * page/PageSupplement.h: Removed.
+        * page/SpeechInput.cpp:
+        (WebCore::provideSpeechInputTo):
+        * page/SpeechInput.h:
+        (WebCore::SpeechInput::from):
+        * platform/Supplementable.h: Added.
+        (WebCore):
+        (Supplement):
+        (WebCore::Supplement::~Supplement):
+        (WebCore::Supplement::provideTo):
+        (WebCore::Supplement::from):
+        (Supplementable):
+        (WebCore::Supplementable::provideSupplement):
+        (WebCore::Supplementable::requireSupplement):
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        - Removed ChromeClient::showContextMenu(), Chrome::showContextMenu()
+        - Added ContextMenuController::showContextMenuAt(), ContextMenuClient::showContextMenu()
+        - Hided showContextMenu() behind ACCESSIBILITY_CONTEXT_MENUS
+
+        This change localizes context menu related code and will make it easy to
+        modularize CONTEXT_MENUS code.
+
+        Refactoring. No new tests.
+
+        * WebCore.exp.in:
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (-[WebAccessibilityObjectWrapper accessibilityShowContextMenu]):
+        * loader/EmptyClients.h:
+        (EmptyContextMenuClient):
+        (WebCore::EmptyContextMenuClient::showContextMenu):
+        * page/ContextMenuClient.h:
+        (ContextMenuClient):
+        * page/ContextMenuController.cpp:
+        (WebCore):
+        (WebCore::ContextMenuController::showContextMenuAt):
+        * page/ContextMenuController.h:
+        (ContextMenuController):
+        * page/Chrome.cpp:
+        * page/Chrome.h:
+        (Chrome):
+        * page/ChromeClient.h:
+        (ChromeClient):
+
+2012-02-26  Benjamin Poulain  <bpoulain@apple.com>
+
+        [Mac] Release localized Strings instead of AutoRelease
+        https://bugs.webkit.org/show_bug.cgi?id=79552
+
+        Reviewed by Sam Weinig.
+
+        By using the CoreFoundation API, we can release the memory as soon as
+        the WTF::String is created.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/LocalizedStringsMac.cpp: Renamed from Source/WebCore/platform/mac/LocalizedStringsMac.mm.
+        (WebCore):
+        (WebCore::localizedString):
+
+2012-02-26  Adam Barth  <abarth@webkit.org>
+
+        ContextDestructionObserver should live in its own file
+        https://bugs.webkit.org/show_bug.cgi?id=79619
+
+        Reviewed by Hajime Morita.
+
+        WebKit prefers to have one class per file.  (This patch is paying a
+        build system hacking debt I incurred earlier.)
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ActiveDOMObject.cpp:
+        (WebCore):
+        * dom/ActiveDOMObject.h:
+        (ActiveDOMObject):
+        (WebCore::ActiveDOMObject::suspendIfNeededCalled):
+        (WebCore::ActiveDOMObject::setPendingActivity):
+        (WebCore::ActiveDOMObject::unsetPendingActivity):
+        * dom/ContextDestructionObserver.cpp: Added.
+        (WebCore):
+        (WebCore::ContextDestructionObserver::ContextDestructionObserver):
+        (WebCore::ContextDestructionObserver::~ContextDestructionObserver):
+        (WebCore::ContextDestructionObserver::contextDestroyed):
+        * dom/ContextDestructionObserver.h: Added.
+        (WebCore):
+        (ContextDestructionObserver):
+        (WebCore::ContextDestructionObserver::scriptExecutionContext):
+        * dom/DOMAllInOne.cpp:
+
+2012-02-26  Dirk Schulze  <krit@webkit.org>
+
+        Cleanup of Adobes copyright text. The text got harmonized with copyright texts of other companies. 
+
+        Rubber stamped by.
+
+        * css/CSSWrapShapes.cpp:
+        * css/CSSWrapShapes.h:
+        * css/WebKitCSSRegionRule.cpp:
+        * css/WebKitCSSRegionRule.h:
+        * css/WebKitCSSRegionRule.idl:
+        * css/WebKitCSSShaderValue.cpp:
+        * css/WebKitCSSShaderValue.h:
+        * dom/WebKitNamedFlow.cpp:
+        * dom/WebKitNamedFlow.h:
+        * dom/WebKitNamedFlow.idl:
+        * loader/cache/CachedShader.cpp:
+        * loader/cache/CachedShader.h:
+        * platform/graphics/filters/CustomFilterMesh.cpp:
+        * platform/graphics/filters/CustomFilterMesh.h:
+        * platform/graphics/filters/CustomFilterNumberParameter.h:
+        * platform/graphics/filters/CustomFilterOperation.cpp:
+        * platform/graphics/filters/CustomFilterOperation.h:
+        * platform/graphics/filters/CustomFilterParameter.h:
+        * platform/graphics/filters/CustomFilterProgram.cpp:
+        * platform/graphics/filters/CustomFilterProgram.h:
+        * platform/graphics/filters/CustomFilterProgramClient.h:
+        * platform/graphics/filters/CustomFilterShader.cpp:
+        * platform/graphics/filters/CustomFilterShader.h:
+        * platform/graphics/filters/FECustomFilter.cpp:
+        * platform/graphics/filters/FECustomFilter.h:
+        * rendering/FilterEffectObserver.h:
+        * rendering/RenderFlowThread.cpp:
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderRegion.cpp:
+        * rendering/RenderRegion.h:
+        * rendering/style/StyleCachedShader.cpp:
+        * rendering/style/StyleCachedShader.h:
+        * rendering/style/StyleCustomFilterProgram.h:
+        * rendering/style/StylePendingShader.h:
+        * rendering/style/StyleShader.h:
+
+2012-02-26  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [EFL] Implementation of GraphicsContext3D for EFL port
+        https://bugs.webkit.org/show_bug.cgi?id=79452
+
+        Reviewed by Noam Rosenthal.
+
+        Evas_GL is used to do OpenGL rendering on Evas, in which
+        a structure 'Evas_GL_API' contains all the OpenGL functions.
+
+        GraphicsContext3D in EFL port should call OpenGL functions indirectly
+        through the Evas_GL_API, and not use GraphicsContext3DOpenGL(Common).
+
+        So, we use the GraphicsContext3DPrivate to delegate all OpenGL function calls,
+        and it will be implemented to use Evas_GL (bug 62961).
+
+        No new tests. No behavior change.
+
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp: Added.
+        (WebCore):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformLayer):
+        (WebCore::GraphicsContext3D::makeContextCurrent):
+        (WebCore::GraphicsContext3D::isGLES2Compliant):
+        (WebCore::GraphicsContext3D::activeTexture):
+        (WebCore::GraphicsContext3D::attachShader):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::bindBuffer):
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+        (WebCore::GraphicsContext3D::bindRenderbuffer):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::blendColor):
+        (WebCore::GraphicsContext3D::blendEquation):
+        (WebCore::GraphicsContext3D::blendEquationSeparate):
+        (WebCore::GraphicsContext3D::blendFunc):
+        (WebCore::GraphicsContext3D::blendFuncSeparate):
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+        (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::clear):
+        (WebCore::GraphicsContext3D::clearColor):
+        (WebCore::GraphicsContext3D::clearDepth):
+        (WebCore::GraphicsContext3D::clearStencil):
+        (WebCore::GraphicsContext3D::colorMask):
+        (WebCore::GraphicsContext3D::compileShader):
+        (WebCore::GraphicsContext3D::copyTexImage2D):
+        (WebCore::GraphicsContext3D::copyTexSubImage2D):
+        (WebCore::GraphicsContext3D::cullFace):
+        (WebCore::GraphicsContext3D::depthFunc):
+        (WebCore::GraphicsContext3D::depthMask):
+        (WebCore::GraphicsContext3D::depthRange):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::disable):
+        (WebCore::GraphicsContext3D::disableVertexAttribArray):
+        (WebCore::GraphicsContext3D::drawArrays):
+        (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::enable):
+        (WebCore::GraphicsContext3D::enableVertexAttribArray):
+        (WebCore::GraphicsContext3D::finish):
+        (WebCore::GraphicsContext3D::flush):
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+        (WebCore::GraphicsContext3D::frontFace):
+        (WebCore::GraphicsContext3D::generateMipmap):
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getAttachedShaders):
+        (WebCore::GraphicsContext3D::getAttribLocation):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getContextAttributes):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::GraphicsContext3D::getString):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getUniformLocation):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::getVertexAttribOffset):
+        (WebCore::GraphicsContext3D::hint):
+        (WebCore::GraphicsContext3D::isBuffer):
+        (WebCore::GraphicsContext3D::isEnabled):
+        (WebCore::GraphicsContext3D::isFramebuffer):
+        (WebCore::GraphicsContext3D::isProgram):
+        (WebCore::GraphicsContext3D::isRenderbuffer):
+        (WebCore::GraphicsContext3D::isShader):
+        (WebCore::GraphicsContext3D::isTexture):
+        (WebCore::GraphicsContext3D::lineWidth):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::pixelStorei):
+        (WebCore::GraphicsContext3D::polygonOffset):
+        (WebCore::GraphicsContext3D::readPixels):
+        (WebCore::GraphicsContext3D::releaseShaderCompiler):
+        (WebCore::GraphicsContext3D::renderbufferStorage):
+        (WebCore::GraphicsContext3D::sampleCoverage):
+        (WebCore::GraphicsContext3D::scissor):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::stencilFunc):
+        (WebCore::GraphicsContext3D::stencilFuncSeparate):
+        (WebCore::GraphicsContext3D::stencilMask):
+        (WebCore::GraphicsContext3D::stencilMaskSeparate):
+        (WebCore::GraphicsContext3D::stencilOp):
+        (WebCore::GraphicsContext3D::stencilOpSeparate):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texParameterf):
+        (WebCore::GraphicsContext3D::texParameteri):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::uniform1f):
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform1i):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2f):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform2i):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3f):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform3i):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4f):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform4i):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::useProgram):
+        (WebCore::GraphicsContext3D::validateProgram):
+        (WebCore::GraphicsContext3D::vertexAttrib1f):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2f):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3f):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4f):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+        (WebCore::GraphicsContext3D::vertexAttribPointer):
+        (WebCore::GraphicsContext3D::viewport):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::markContextChanged):
+        (WebCore::GraphicsContext3D::markLayerComposited):
+        (WebCore::GraphicsContext3D::layerComposited):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToImageData):
+        (WebCore::GraphicsContext3D::paintCompositedResultsToCanvas):
+        (WebCore::GraphicsContext3D::createBuffer):
+        (WebCore::GraphicsContext3D::createFramebuffer):
+        (WebCore::GraphicsContext3D::createProgram):
+        (WebCore::GraphicsContext3D::createRenderbuffer):
+        (WebCore::GraphicsContext3D::createShader):
+        (WebCore::GraphicsContext3D::createTexture):
+        (WebCore::GraphicsContext3D::deleteBuffer):
+        (WebCore::GraphicsContext3D::deleteFramebuffer):
+        (WebCore::GraphicsContext3D::deleteProgram):
+        (WebCore::GraphicsContext3D::deleteRenderbuffer):
+        (WebCore::GraphicsContext3D::deleteShader):
+        (WebCore::GraphicsContext3D::deleteTexture):
+        (WebCore::GraphicsContext3D::synthesizeGLError):
+        (WebCore::GraphicsContext3D::getExtensions):
+        (WebCore::GraphicsContext3D::getInternalFramebufferSize):
+        (WebCore::GraphicsContext3D::setContextLostCallback):
+        (WebCore::GraphicsContext3D::getImageData):
+        (WebCore::GraphicsContext3D::validateAttributes):
+        (WebCore::GraphicsContext3D::readRenderingResults):
+        (WebCore::GraphicsContext3D::reshapeFBOs):
+        (WebCore::GraphicsContext3D::resolveMultisamplingIfNecessary):
+        (WebCore::GraphicsContext3D::isResourceSafe):
+
+2012-02-26  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Wire up shouldUpdateScrollPositionOnMainThread and nonFastScrollableRegion to compositor
+        https://bugs.webkit.org/show_bug.cgi?id=79155
+
+        Reviewed by Adam Barth.
+
+        This hooks up ScrollingCoordinator::setNonFastScrollableRegion() and
+        ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread() to the chromium compositor
+        implementation and implements them on the impl thread.
+
+        New compositor behavior is covered by unit tests in LayerChromiumTests and CCLayerTreeHostImplTests. The rest is
+        just glue code.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::setShouldScrollOnMainThread):
+        (WebCore):
+        (WebCore::LayerChromium::setNonFastScrollableRegion):
+        (WebCore::LayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore):
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::shouldScrollOnMainThread):
+        (WebCore::CCLayerImpl::setShouldScrollOnMainThread):
+        (CCLayerImpl):
+        (WebCore::CCLayerImpl::nonFastScrollableRegion):
+        (WebCore::CCLayerImpl::setNonFastScrollableRegion):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::scrollBegin):
+
+2012-02-26  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Rebaselined run-bindings-tests results.
+
+        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp:
+        (webkit_dom_test_interface_supplemental_method4):
+
+2012-02-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108547.
+        http://trac.webkit.org/changeset/108547
+        https://bugs.webkit.org/show_bug.cgi?id=79606
+
+        Crashes on ClusterFuzz (Requested by inferno-sec on #webkit).
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2012-02-25  Adam Barth  <abarth@webkit.org>
+
+        Move websockets to Modules/websockets
+        https://bugs.webkit.org/show_bug.cgi?id=79598
+
+        Reviewed by Eric Seidel.
+
+        Nowadays, the only ENABLE(WEB_SOCKETS) ifdef in WebCore proper is in
+        WebCore::Settings, and that will be removed (soon?) once Apple drops
+        support for the old WebSockets protocol.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Modules/websockets: Copied from Source/WebCore/websockets.
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * WebCore.xcodeproj/project.pbxproj:
+        * websockets: Removed.
+        * websockets/CloseEvent.h: Removed.
+        * websockets/CloseEvent.idl: Removed.
+        * websockets/DOMWindowWebSocket.idl: Removed.
+        * websockets/ThreadableWebSocketChannel.cpp: Removed.
+        * websockets/ThreadableWebSocketChannel.h: Removed.
+        * websockets/ThreadableWebSocketChannelClientWrapper.cpp: Removed.
+        * websockets/ThreadableWebSocketChannelClientWrapper.h: Removed.
+        * websockets/WebSocket.cpp: Removed.
+        * websockets/WebSocket.h: Removed.
+        * websockets/WebSocket.idl: Removed.
+        * websockets/WebSocketChannel.cpp: Removed.
+        * websockets/WebSocketChannel.h: Removed.
+        * websockets/WebSocketChannelClient.h: Removed.
+        * websockets/WebSocketDeflater.cpp: Removed.
+        * websockets/WebSocketDeflater.h: Removed.
+        * websockets/WebSocketExtensionDispatcher.cpp: Removed.
+        * websockets/WebSocketExtensionDispatcher.h: Removed.
+        * websockets/WebSocketExtensionProcessor.h: Removed.
+        * websockets/WebSocketFrame.h: Removed.
+        * websockets/WebSocketHandshake.cpp: Removed.
+        * websockets/WebSocketHandshake.h: Removed.
+        * websockets/WebSocketHandshakeRequest.cpp: Removed.
+        * websockets/WebSocketHandshakeRequest.h: Removed.
+        * websockets/WebSocketHandshakeResponse.cpp: Removed.
+        * websockets/WebSocketHandshakeResponse.h: Removed.
+        * websockets/WorkerThreadableWebSocketChannel.cpp: Removed.
+        * websockets/WorkerThreadableWebSocketChannel.h: Removed.
+
+2012-02-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        Get rid of KURL::deprecatedString()
+        https://bugs.webkit.org/show_bug.cgi?id=79594
+
+        Reviewed by Andreas Kling.
+
+        The method KURL::deprecatedString() is unused, remove it from WebCore.
+
+        The last reference to the method was removed in r96779.
+
+        * platform/KURL.cpp:
+        (WebCore):
+        * platform/KURL.h:
+        (KURL):
+        * platform/KURLGoogle.cpp:
+        (WebCore):
+        * platform/KURLWTFURL.cpp:
+        (WebCore):
+
+2012-02-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        Get rid of copyParsedQueryTo()
+        https://bugs.webkit.org/show_bug.cgi?id=79590
+
+        Reviewed by Andreas Kling.
+
+        The function KURL::copyParsedQueryTo() is unused. Remove it from WebCore.
+
+        The function was used by HTMLAnchorElement::getParameter() but that feature
+        was removed in r100164.
+
+        * WebCore.order:
+        * platform/KURL.cpp:
+        (WebCore):
+        * platform/KURL.h:
+        (WebCore):
+        (KURL):
+        * platform/KURLGoogle.cpp:
+        (WebCore):
+        * platform/KURLWTFURL.cpp:
+        (WebCore):
+
+2012-02-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108924.
+        http://trac.webkit.org/changeset/108924
+        https://bugs.webkit.org/show_bug.cgi?id=79597
+
+        broke 4 inspector tests (Requested by kling on #webkit).
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::parseAttribute):
+
+2012-02-25  Adam Barth  <abarth@webkit.org>
+
+        Fix typo in comment.  This #endif is for a different ENABLE macro.
+
+        * page/NavigatorRegisterProtocolHandler.cpp:
+
+2012-02-25  Anders Carlsson  <andersca@apple.com>
+
+        Move an ASSERT to avoid it firing due to a race condition
+        https://bugs.webkit.org/show_bug.cgi?id=79596
+
+        Reviewed by Andreas Kling.
+
+        ScrollingThread::isCurrentThread() can return false if called too early.
+        Move it into ScrollingThread::initializeRunLoop where we know that the thread has
+        been set up correctly.
+
+        * page/scrolling/ScrollingThread.cpp:
+        (WebCore::ScrollingThread::threadBody):
+        * page/scrolling/mac/ScrollingThreadMac.mm:
+        (WebCore::ScrollingThread::initializeRunLoop):
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        Setting style="" should destroy the element's inline style.
+        <http://webkit.org/b/79595>
+
+        Reviewed by Anders Carlsson.
+
+        There's no reason for an element with style="" to have an inline style object.
+        Remove the inline style in that case, just like we do when removing the style
+        attribute altogether.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::parseAttribute):
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        Allow matched property cache for elements with additional attribute style.
+        <http://webkit.org/b/79583>
+
+        Reviewed by Antti Koivisto.
+
+        There's no reason to disallow the matched style property cache for elements
+        that return something from additionalAttributeStyle(). The only requirement
+        for a property set to be cached is that it either doesn't mutate OR that it
+        invalidates the document's CSSStyleSelector when doing so.
+
+        This allows some more match caching for table-related elements, though we
+        are still held back by explicitly 'inherited' properties in html.css.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-02-25  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Clean-up RenderTableSection::calcRowLogicalHeight
+        https://bugs.webkit.org/show_bug.cgi?id=77705
+
+        Reviewed by Nikolas Zimmermann.
+
+        Refactoring / simplication of the code.
+
+        This change removes some variables that were unneeded and were
+        hiding what the code was really doing. Also some of the code was
+        split and moved down to RenderTableCell.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::logicalHeightForRowSizing):
+        * rendering/RenderTableCell.h:
+        (RenderTableCell):
+        Added the previous helper function to calculate the cell's
+        adjusted logical height.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        Removed some variables, simplified the rowspan logic to be clearer
+        (and added a comment about how we handle rowspans).
+
+2012-02-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add an empty skeleton of KURL for WTFURL
+        https://bugs.webkit.org/show_bug.cgi?id=78990
+
+        Reviewed by Adam Barth.
+
+        Add an empty skeleton of KURL based on WTFURL.
+
+        With WTFURL, the data of KURL is in an implicitely shared object
+        named KURLWTFURLImpl.
+
+        In KURLWTFURLImpl, KURL created with invalid URL would be stored
+        as a String. A valid URL would be stored as a ParsedURL.
+
+        * ForwardingHeaders/wtf/url/ParsedURL.h: Added.
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/KURL.cpp:
+        (WebCore):
+        * platform/KURL.h:
+        (KURL):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::isHashTableDeletedValue):
+        (WebCore):
+        * platform/KURLWTFURL.cpp: Added.
+        (WebCore):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::copy):
+        (WebCore::KURL::isNull):
+        (WebCore::KURL::isEmpty):
+        (WebCore::KURL::isValid):
+        (WebCore::KURL::hasPath):
+        (WebCore::KURL::string):
+        (WebCore::KURL::protocol):
+        (WebCore::KURL::host):
+        (WebCore::KURL::port):
+        (WebCore::KURL::hasPort):
+        (WebCore::KURL::user):
+        (WebCore::KURL::pass):
+        (WebCore::KURL::path):
+        (WebCore::KURL::lastPathComponent):
+        (WebCore::KURL::query):
+        (WebCore::KURL::fragmentIdentifier):
+        (WebCore::KURL::hasFragmentIdentifier):
+        (WebCore::KURL::copyParsedQueryTo):
+        (WebCore::KURL::baseAsString):
+        (WebCore::KURL::deprecatedString):
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::KURL::protocolIs):
+        (WebCore::KURL::protocolIsInHTTPFamily):
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::setHost):
+        (WebCore::KURL::removePort):
+        (WebCore::KURL::setPort):
+        (WebCore::KURL::setHostAndPort):
+        (WebCore::KURL::setUser):
+        (WebCore::KURL::setPass):
+        (WebCore::KURL::setPath):
+        (WebCore::KURL::setQuery):
+        (WebCore::KURL::setFragmentIdentifier):
+        (WebCore::KURL::removeFragmentIdentifier):
+        (WebCore::KURL::hostStart):
+        (WebCore::KURL::hostEnd):
+        (WebCore::KURL::pathStart):
+        (WebCore::KURL::pathEnd):
+        (WebCore::KURL::pathAfterLastSlash):
+        (WebCore::KURL::invalidate):
+        (WebCore::KURL::isHierarchical):
+        (WebCore::protocolIs):
+        (WebCore::equalIgnoringFragmentIdentifier):
+        (WebCore::protocolHostAndPortAreEqual):
+        (WebCore::encodeWithURLEscapeSequences):
+        (WebCore::decodeURLEscapeSequences):
+        * platform/KURLWTFURLImpl.h: Copied from Source/WebCore/platform/mac/KURLMac.mm.
+        (WebCore):
+        (KURLWTFURLImpl):
+        * platform/cf/KURLCFNet.cpp:
+        (WebCore):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::createCFURL):
+        * platform/mac/KURLMac.mm:
+        (WebCore):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::operator NSURL *):
+
+2012-02-25  Anders Carlsson  <andersca@apple.com>
+
+        Make the libc++ workaround more targeted
+        https://bugs.webkit.org/show_bug.cgi?id=79578
+        <rdar://problem/10933150>
+
+        Reviewed by Sam Weinig.
+
+        Change the std::move implementation to take a WebCore::TimerHeapReference directly so 
+        WebCore still builds with a version of libc++ that has the right std::move function template.
+
+        * WebCorePrefix.h:
+        (WebCore):
+        (move):
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        Remove HTMLEmbedElement::insertedIntoDocument().
+        <http://webkit.org/b/79576>
+
+        Reviewed by Anders Carlsson.
+
+        * html/HTMLEmbedElement.cpp:
+        * html/HTMLEmbedElement.h:
+
+2012-02-25  Adrienne Walker  <enne@google.com>
+
+        Fix unused variable warnings in HarfBuzzShaperBase
+        https://bugs.webkit.org/show_bug.cgi?id=79575
+
+        Reviewed by Andreas Kling.
+
+        In builds where asserts are not enabled, the error variable is unused.
+
+        * platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp:
+        (WebCore::normalizeSpacesAndMirrorChars):
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        Remove HTMLTableElement::attach().
+        <http://webkit.org/b/79574>
+
+        Reviewed by Anders Carlsson.
+
+        Remove this attach() override since it was only used to assert that
+        we're not already attached, and this is already done by Node::attach().
+
+        * html/HTMLTableElement.cpp:
+        * html/HTMLTableElement.h:
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        HTMLTableElement: Avoid CSSParser in createSharedCellStyle().
+        <http://webkit.org/b/79573>
+
+        Reviewed by Anders Carlsson.
+
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::createSharedCellStyle):
+
+2012-02-25  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Unreviewed, rolling out r108557.
+        http://trac.webkit.org/changeset/108557
+        https://bugs.webkit.org/show_bug.cgi?id=77705
+
+        Broke svg/zoom/page/zoom-replated-intrinsic-ratio-001.htm.
+
+        * rendering/RenderTableCell.cpp:
+        * rendering/RenderTableCell.h:
+        (RenderTableCell):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        HTMLParamElement: Clean up name/value attribute handling.
+        <http://webkit.org/b/79559>
+
+        Reviewed by Anders Carlsson.
+
+        Out-of-line name() and value(), and move the logic from parseAttribute()
+        into them instead. This makes the class a bit simpler and shrinks it by
+        two AtomicStrings. Also reduced isURLAttribute() to a two-liner.
+
+        * html/HTMLParamElement.cpp:
+        (WebCore::HTMLParamElement::name):
+        (WebCore::HTMLParamElement::value):
+        (WebCore::HTMLParamElement::isURLAttribute):
+        * html/HTMLParamElement.h:
+
+2012-02-24  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] Replace RefPtr with OwnPtr for CCLayerImpl tree structure
+        https://bugs.webkit.org/show_bug.cgi?id=78404
+
+        Reviewed by James Robinson.
+
+        No new tests. Updated existing test to reflect changes.
+
+        * platform/graphics/chromium/CanvasLayerChromium.cpp:
+        (WebCore::CanvasLayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/CanvasLayerChromium.h:
+        (CanvasLayerChromium):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/PluginLayerChromium.cpp:
+        (WebCore::PluginLayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/PluginLayerChromium.h:
+        (PluginLayerChromium):
+        * platform/graphics/chromium/SolidColorLayerChromium.cpp:
+        (WebCore::SolidColorLayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/SolidColorLayerChromium.h:
+        (SolidColorLayerChromium):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/TreeSynchronizer.cpp:
+        (WebCore::TreeSynchronizer::synchronizeTrees):
+        (WebCore::TreeSynchronizer::collectExistingCCLayerImplRecursive):
+        (WebCore):
+        (WebCore::TreeSynchronizer::reuseOrCreateCCLayerImpl):
+        (WebCore::TreeSynchronizer::synchronizeTreeRecursive):
+        * platform/graphics/chromium/TreeSynchronizer.h:
+        (TreeSynchronizer):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        (VideoLayerChromium):
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.h:
+        (WebCore::CCCanvasLayerImpl::create):
+        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
+        (WebCore::CCDamageTracker::updateDamageTrackingState):
+        (WebCore::CCDamageTracker::trackDamageFromActiveLayers):
+        * platform/graphics/chromium/cc/CCDamageTracker.h:
+        (CCDamageTracker):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        (WebCore::CCLayerImpl::addChild):
+        (WebCore::sortLayers):
+        (WebCore::CCLayerImpl::setMaskLayer):
+        (WebCore::CCLayerImpl::setReplicaLayer):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::create):
+        (WebCore::CCLayerImpl::children):
+        (CCLayerImpl):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerIterator.cpp:
+        (WebCore):
+        (WebCore::CCLayerIteratorActions::BackToFront::begin):
+        (WebCore::CCLayerIteratorActions::BackToFront::end):
+        (WebCore::CCLayerIteratorActions::BackToFront::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::begin):
+        (WebCore::CCLayerIteratorActions::FrontToBack::end):
+        (WebCore::CCLayerIteratorActions::FrontToBack::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::goToHighestInSubtree):
+        * platform/graphics/chromium/cc/CCLayerIterator.h:
+        (WebCore):
+        (CCLayerIterator):
+        (WebCore::CCLayerIterator::begin):
+        (WebCore::CCLayerIterator::end):
+        (WebCore::CCLayerIterator::targetRenderSurfaceLayer):
+        (WebCore::CCLayerIterator::CCLayerIterator):
+        (WebCore::CCLayerIterator::getRawPtr):
+        (WebCore::CCLayerIterator::currentLayer):
+        (WebCore::CCLayerIterator::targetRenderSurfaceChildren):
+        (BackToFront):
+        (FrontToBack):
+        * platform/graphics/chromium/cc/CCLayerSorter.cpp:
+        (WebCore::CCLayerSorter::createGraphNodes):
+        * platform/graphics/chromium/cc/CCLayerSorter.h:
+        (CCLayerSorter):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::didBecomeInvisibleOnImplThread):
+        (WebCore::CCLayerTreeHost::reserveTextures):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        (WebCore::CCLayerTreeHost::updateCompositorResources):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore):
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+        (WebCore::walkLayersAndCalculateVisibleLayerRects):
+        (WebCore::CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
+        (CCLayerTreeHostCommon):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::trackDamageForAllSurfaces):
+        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        (WebCore::CCLayerTreeHostImpl::setRootLayer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::releaseRootLayer):
+        (WebCore::CCLayerTreeHostImpl::scrollLayer):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.h:
+        (WebCore::CCPluginLayerImpl::create):
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (WebCore::CCRenderSurface::layerList):
+        (CCRenderSurface):
+        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.h:
+        (WebCore::CCSolidColorLayerImpl::create):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+        (WebCore::CCTiledLayerImpl::create):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (WebCore::CCVideoLayerImpl::create):
+
+2012-02-24  Andreas Kling  <awesomekling@apple.com>
+
+        Don't pass constant strings to CSSParser for presentation attributes.
+        <http://webkit.org/b/79530>
+
+        Reviewed by Anders Carlsson.
+
+        "both" -> CSSValueBoth.
+        "center" -> CSSValueCenter.
+
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::collectStyleForAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::collectStyleForAttribute):
+
+2012-02-24  Yael Aharon  <yael.aharon@nokia.com>
+
+        [Texmap] Add const-ness to TextureMapperShaderManager
+        https://bugs.webkit.org/show_bug.cgi?id=79545
+
+        Reviewed by Noam Rosenthal.
+        
+        Add const to new methods.
+        No new tests.
+
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
+        (WebCore::TextureMapperShaderProgramSimple::vertexShaderSource):
+        (WebCore::TextureMapperShaderProgramSimple::fragmentShaderSource):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::vertexShaderSource):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource):
+        * platform/graphics/texmap/TextureMapperShaderManager.h:
+        (WebCore::TextureMapperShaderProgram::matrixVariable):
+        (WebCore::TextureMapperShaderProgram::sourceMatrixVariable):
+        (WebCore::TextureMapperShaderProgram::sourceTextureVariable):
+        (WebCore::TextureMapperShaderProgram::opacityVariable):
+        (TextureMapperShaderProgram):
+        (TextureMapperShaderProgramSimple):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskMatrixVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskTextureVariable):
+        (TextureMapperShaderProgramOpacityAndMask):
+
+2012-02-24  Tom Sepez  <tsepez@chromium.org>
+
+        XSS Auditor targeting legitimate frames as false positives.
+        https://bugs.webkit.org/show_bug.cgi?id=79397
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/xssAuditor/script-tag-safe4.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::filterCharacterToken):
+        (WebCore::XSSAuditor::filterScriptToken):
+        (WebCore::XSSAuditor::filterObjectToken):
+        (WebCore::XSSAuditor::filterEmbedToken):
+        (WebCore::XSSAuditor::filterAppletToken):
+        (WebCore::XSSAuditor::filterIframeToken):
+        (WebCore::XSSAuditor::decodedSnippetForToken):
+        (WebCore):
+        (WebCore::XSSAuditor::decodedSnippetForName):
+        (WebCore::XSSAuditor::decodedSnippetForAttribute):
+        (WebCore::XSSAuditor::decodedSnippetForJavascript):
+        (WebCore::XSSAuditor::isContainedInRequest):
+        (WebCore::XSSAuditor::isSameOriginResource):
+        * html/parser/XSSAuditor.h:
+
+2012-02-24  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Plumb animation started notifications from CCLayerTreeHost to GraphicsLayerChromium
+        https://bugs.webkit.org/show_bug.cgi?id=77646
+
+        Reviewed by James Robinson.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (std):
+        (WebCore::GraphicsLayerChromium::~GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::addAnimation):
+        (WebCore::GraphicsLayerChromium::pauseAnimation):
+        (WebCore::GraphicsLayerChromium::removeAnimation):
+        (WebCore::GraphicsLayerChromium::suspendAnimations):
+        (WebCore::GraphicsLayerChromium::resumeAnimations):
+        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerChromium::mapAnimationNameToId):
+        (WebCore):
+        (WebCore::GraphicsLayerChromium::notifyAnimationStarted):
+        (WebCore::GraphicsLayerChromium::notifyAnimationFinished):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (GraphicsLayerChromium):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::setAnimationEvent):
+        (WebCore):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore):
+        (LayerChromium):
+        (WebCore::LayerChromium::setLayerAnimationDelegate):
+        * platform/graphics/chromium/cc/CCAnimationEvents.cpp: Added.
+        (WebCore):
+        (WebCore::CCAnimationEvent::CCAnimationEvent):
+        (WebCore::CCAnimationEvent::~CCAnimationEvent):
+        (WebCore::CCAnimationEvent::toAnimationStartedEvent):
+        (WebCore::CCAnimationEvent::toAnimationFinishedEvent):
+        (WebCore::CCAnimationStartedEvent::create):
+        (WebCore::CCAnimationStartedEvent::CCAnimationStartedEvent):
+        (WebCore::CCAnimationStartedEvent::~CCAnimationStartedEvent):
+        (WebCore::CCAnimationStartedEvent::type):
+        (WebCore::CCAnimationFinishedEvent::create):
+        (WebCore::CCAnimationFinishedEvent::CCAnimationFinishedEvent):
+        (WebCore::CCAnimationFinishedEvent::~CCAnimationFinishedEvent):
+        (WebCore::CCAnimationFinishedEvent::type):
+        * platform/graphics/chromium/cc/CCAnimationEvents.h:
+        (WebCore):
+        (CCAnimationEvent):
+        (WebCore::CCAnimationEvent::layerId):
+        (CCAnimationStartedEvent):
+        (WebCore::CCAnimationStartedEvent::startTime):
+        (CCAnimationFinishedEvent):
+        (WebCore::CCAnimationFinishedEvent::animationId):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp:
+        (WebCore::CCLayerAnimationControllerImpl::animate):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability):
+        (WebCore::CCLayerAnimationControllerImpl::purgeFinishedAnimations):
+        (WebCore::CCLayerAnimationControllerImpl::tickAnimations):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h:
+        (CCLayerAnimationControllerImpl):
+        * platform/graphics/chromium/cc/CCLayerAnimationDelegate.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h.
+        (WebCore):
+        (CCLayerAnimationDelegate):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::setAnimationEvents):
+        (WebCore::CCLayerTreeHost::setAnimationEventsRecursive):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+
+2012-02-24  Abhishek Arya  <inferno@chromium.org>
+
+        Regression(r107477): Crash in StaticNodeList::itemWithName.
+        https://bugs.webkit.org/show_bug.cgi?id=79532
+
+        Reviewed by Andreas Kling.
+
+        Make sure that node is an element node before checking its id attribute.
+
+        Test: fast/mutation/mutation-callback-non-element-crash.html
+
+        * dom/StaticNodeList.cpp:
+        (WebCore::StaticNodeList::itemWithName):
+
+2012-02-24  Tony Chang  <tony@chromium.org>
+
+        More refactoring in RenderFlexibleBox
+        https://bugs.webkit.org/show_bug.cgi?id=79533
+
+        Reviewed by Ojan Vafai.
+
+        No new tests, just refactoring.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutFlexItems): Move the flipping of RTL+column positions to its own method.
+        This might be a tiny bit slower, but it's clearer since it's not related to alignment.
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): Move the logical height calculation out of the loop.  We only need the final height.
+        (WebCore::RenderFlexibleBox::alignChildren):
+        (WebCore::RenderFlexibleBox::flipForRightToLeftColumn):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-02-24  Abhishek Arya  <inferno@chromium.org>
+
+        Positioned objects not cleared when moving children
+        to clone block in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78416
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/multicol/span/positioned-child-not-removed-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::splitBlocks):
+
+2012-02-24  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed, Windows build fix.  Changed "-1" to newly
+        created constant JSC::Yarr::offsetNoMatch added in r108858.
+
+        * platform/text/RegularExpression.cpp:
+        (WebCore::RegularExpression::match):
+
+2012-02-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Update TextTrackCue API
+        https://bugs.webkit.org/show_bug.cgi?id=79368
+
+        Change TextTrackCue.alignment to .align, TextTrackCue.linePosition and .textPosition to .line
+        and .position, and TextTrackCue.direction to .vertical. Change direction values "horizontal" 
+        to "","vertical" to "rl", and "vertical-lr" to "lr".
+
+        Reviewed by Eric Seidel.
+
+        No new tests, updated existing tests for API changes.
+
+        * html/track/TextTrackCue.cpp:
+        (WebCore::horizontalKeyword):
+        (WebCore::verticalGrowingLeftKeyword):
+        (WebCore):
+        (WebCore::verticalGrowingRightKeyword):
+        (WebCore::verticalKeywordOLD):
+        (WebCore::verticallrKeywordOLD):
+        (WebCore::TextTrackCue::TextTrackCue):
+        (WebCore::TextTrackCue::vertical):
+        (WebCore::TextTrackCue::setVertical):
+        (WebCore::TextTrackCue::setLine):
+        (WebCore::TextTrackCue::setPosition):
+        (WebCore::TextTrackCue::align):
+        (WebCore::TextTrackCue::setAlign):
+        (WebCore::TextTrackCue::parseSettings):
+        * html/track/TextTrackCue.h:
+        (TextTrackCue):
+        (WebCore::TextTrackCue::line):
+        (WebCore::TextTrackCue::position):
+        * html/track/TextTrackCue.idl:
+
+2012-02-24  Adrienne Walker  <enne@google.com>
+
+        Fix uninitialized variables in HarfBuzzShaperBase
+        https://bugs.webkit.org/show_bug.cgi?id=79546
+
+        Reviewed by Dirk Pranke.
+
+        These were introduced in r108733.
+
+        * platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp:
+        (WebCore::HarfBuzzShaperBase::HarfBuzzShaperBase):
+
+2012-02-24  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] JPEG RGB image with Adode Marker fails to turbo swizzle decode
+        https://bugs.webkit.org/show_bug.cgi?id=79457
+
+        Reviewed by Adam Barth.
+
+        If a JPEG has no JFIF marker, the Adode Marker must be used to determine the image
+        color space for decoding via that markers transform value. Transform 0 images with
+        3 color components (RGB) fail to decode with libjpeg-turbo when a swizzle decoding
+        is active. Detect this case and decode using JCS_RGB output color space instead.
+
+        Test: fast/images/rgb-jpeg-with-abode-marker-only.html
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+
+2012-02-24  Joshua Bell  <jsbell@chromium.org>
+
+        [V8] IndexedDB: IDBTransaction objects leak in Workers
+        https://bugs.webkit.org/show_bug.cgi?id=79308
+
+        Use a V8RecursionScope whenever Workers call into script, so that
+        post-script side-effects can be executed.
+
+        Reviewed by Tony Chang.
+
+        Test: storage/indexeddb/transaction-abort-workers.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/V8WorkerContextErrorHandler.cpp:
+        (WebCore::V8WorkerContextErrorHandler::callListenerFunction):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::callListenerFunction):
+        * bindings/v8/WorkerContextExecutionProxy.cpp: Replace custom recursion tracking.
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::runScript):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WorkerContextExecutionProxy):
+
+2012-02-24  Gregg Tavares  <gman@google.com>
+
+        Limit WebGL Errors in Console to 10 per context
+        https://bugs.webkit.org/show_bug.cgi?id=79387
+
+        Reviewed by Kenneth Russell.
+        
+        Some apps generated enough errors to overload
+        the Dev Tools so limit the number of errors.
+        For a correct app there should never be any
+        errors so seeing the first few should be enough
+        to debug.
+
+        No new tests as no new functionality
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContextErrorMessageCallback::onErrorMessage):
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::initializeNewContext):
+        (WebCore::WebGLRenderingContext::printGLErrorToConsole):
+        (WebCore::WebGLRenderingContext::synthesizeGLError):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebGLRenderingContext):
+
+2012-02-24  Michael Saboff  <msaboff@apple.com>
+
+        ASSERT(position < 0) in JSC::Yarr::Interpreter::InputStream::readChecked
+        https://bugs.webkit.org/show_bug.cgi?id=73728
+
+        Reviewed by Gavin Barraclough.
+
+        No new tests, refactored usage of JSC::Yarr interpreter.
+        Should be covered by existing tests.
+
+        Changed WebCore callers of JSC::Yarr:Interpreter::interpret() to match the
+        new signature with unsigned offsets.
+
+        * inspector/ContentSearchUtils.cpp:
+        (WebCore::ContentSearchUtils::findMagicComment):
+        * platform/text/RegularExpression.cpp:
+        (WebCore::RegularExpression::match):
+
+2012-02-24  Hans Muller  <hmuller@adobe.com>
+
+        onclick is not reliable for transformed SVG elements
+        https://bugs.webkit.org/show_bug.cgi?id=34714
+
+        Reviewed by Dirk Schulze.
+
+        Use FloatPoints in RenderSVGRoot::nodeAtPoint() when converting the incoming
+        point to local coordinates.
+
+        Test: svg/hittest/svg-small-viewbox.xhtml
+
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+
+2012-02-24  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Implement limited parsing of -webkit-grid-column and -webkit-grid-row
+        https://bugs.webkit.org/show_bug.cgi?id=79151
+
+        Reviewed by Ojan Vafai.
+
+        Test: fast/css-grid-layout/grid-item-column-row-get-set.html
+
+        This change implements a subset of the grammar:
+
+        -webkit-grid-{row|column} := <integer> | 'auto'
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added the new files to our build systems.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForGridPosition): Check that we have the right translated grammar
+        (this function will be more useful once we implement more of the grammar).
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        Added handling for the new properties.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        Allow only 'auto' or <integer>.
+
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        grid-colum and grid-row are not inherited.
+
+        * css/CSSPropertyNames.in:
+        Added the 2 new properties.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::RenderStyle):
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleGridItemData.cpp: Added.
+        (WebCore::StyleGridItemData::StyleGridItemData):
+        * rendering/style/StyleGridItemData.h: Added.
+        (StyleGridItemData):
+        (WebCore::StyleGridItemData::create):
+        (WebCore::StyleGridItemData::copy):
+        (WebCore::StyleGridItemData::operator==):
+        (WebCore::StyleGridItemData::operator!=):
+        Implemented the minimum working class.
+
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+        (StyleRareNonInheritedData):
+        Added StyleGridItemData to the class StyleRareNonInheritedData.
+
+2012-02-24  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: IDBObjectStore.count() and IDBIndex.count() should accept key argument
+        https://bugs.webkit.org/show_bug.cgi?id=79422
+
+        Reviewed by Tony Chang.
+
+        Tests: storage/indexeddb/index-count.html
+               storage/indexeddb/objectstore-count.html
+
+        * storage/IDBIndex.cpp:
+        (WebCore::IDBIndex::count):
+        (WebCore):
+        * storage/IDBIndex.h:
+        (WebCore::IDBIndex::count):
+        (IDBIndex):
+        * storage/IDBIndex.idl:
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::deleteFunction):
+        (WebCore::IDBObjectStore::count):
+        (WebCore):
+        * storage/IDBObjectStore.h:
+        (WebCore::IDBObjectStore::count):
+        (IDBObjectStore):
+        * storage/IDBObjectStore.idl:
+
+2012-02-24  Adam Barth  <abarth@webkit.org>
+
+        Move mediastream into Modules/mediastream
+        https://bugs.webkit.org/show_bug.cgi?id=79517
+
+        Reviewed by Eric Seidel.
+
+        This patch moves the mediastream directory into Modules.  mediastream
+        is a self-contained feature and is a good candidate for being a module.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Modules/mediastream: Copied from Source/WebCore/mediastream.
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * mediastream: Removed.
+        * mediastream/DOMWindowMediaStream.idl: Removed.
+        * mediastream/LocalMediaStream.cpp: Removed.
+        * mediastream/LocalMediaStream.h: Removed.
+        * mediastream/LocalMediaStream.idl: Removed.
+        * mediastream/MediaStream.cpp: Removed.
+        * mediastream/MediaStream.h: Removed.
+        * mediastream/MediaStream.idl: Removed.
+        * mediastream/MediaStreamEvent.cpp: Removed.
+        * mediastream/MediaStreamEvent.h: Removed.
+        * mediastream/MediaStreamEvent.idl: Removed.
+        * mediastream/MediaStreamList.cpp: Removed.
+        * mediastream/MediaStreamList.h: Removed.
+        * mediastream/MediaStreamList.idl: Removed.
+        * mediastream/MediaStreamRegistry.cpp: Removed.
+        * mediastream/MediaStreamRegistry.h: Removed.
+        * mediastream/MediaStreamTrack.cpp: Removed.
+        * mediastream/MediaStreamTrack.h: Removed.
+        * mediastream/MediaStreamTrack.idl: Removed.
+        * mediastream/MediaStreamTrackList.cpp: Removed.
+        * mediastream/MediaStreamTrackList.h: Removed.
+        * mediastream/MediaStreamTrackList.idl: Removed.
+        * mediastream/NavigatorMediaStream.cpp: Removed.
+        * mediastream/NavigatorMediaStream.h: Removed.
+        * mediastream/NavigatorMediaStream.idl: Removed.
+        * mediastream/NavigatorUserMediaError.h: Removed.
+        * mediastream/NavigatorUserMediaError.idl: Removed.
+        * mediastream/NavigatorUserMediaErrorCallback.h: Removed.
+        * mediastream/NavigatorUserMediaErrorCallback.idl: Removed.
+        * mediastream/NavigatorUserMediaSuccessCallback.h: Removed.
+        * mediastream/NavigatorUserMediaSuccessCallback.idl: Removed.
+        * mediastream/PeerConnection.cpp: Removed.
+        * mediastream/PeerConnection.h: Removed.
+        * mediastream/PeerConnection.idl: Removed.
+        * mediastream/SignalingCallback.h: Removed.
+        * mediastream/SignalingCallback.idl: Removed.
+        * mediastream/UserMediaClient.h: Removed.
+        * mediastream/UserMediaController.cpp: Removed.
+        * mediastream/UserMediaController.h: Removed.
+        * mediastream/UserMediaRequest.cpp: Removed.
+        * mediastream/UserMediaRequest.h: Removed.
+
+2012-02-24  Abhishek Arya  <inferno@chromium.org>
+
+        Overhanging floats not removed from new flex box.
+        https://bugs.webkit.org/show_bug.cgi?id=79522
+
+        Reviewed by Ojan Vafai.
+
+        Similar to r69476.
+
+        Test: fast/flexbox/overhanging-floats-not-removed-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
+
+2012-02-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Compute more acurate font heights.
+        https://bugs.webkit.org/show_bug.cgi?id=79524
+
+        Reviewed by Adam Roben.
+
+        Adjust font handling as suggested by Lynn Neir to use the proper
+        xHeight value for the font, rather than the fall-back guess
+        used in the current code.
+
+        css1/text_properties/line_height.html
+
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit): Properly initialize a
+          few elements.
+        (WebCore::SimpleFontData::platformWidthForGlyph): Use the Cairo
+          cairo_scaled_font_text_extents call, rather than attempting
+          to compute the value from ::GetGlyphOutline.
+
+2012-02-24  Tim Horton  <timothy_horton@apple.com>
+
+        Infinite repaint loop with SVGImageCache and deferred repaint timers
+        https://bugs.webkit.org/show_bug.cgi?id=78315
+        <rdar://problem/10651634>
+
+        Reviewed by Dean Jackson.
+
+        Only defer image redraw on a timer if we're in layout. This breaks
+        the repaint loop while still preventing us from drawing inside layout.
+
+        No new tests, as the problem only occurs in a nonstandard configuration.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+        (WebCore::SVGImage::frameView):
+        (WebCore):
+        * svg/graphics/SVGImage.h:
+        (WebCore):
+        * svg/graphics/SVGImageCache.cpp:
+        (WebCore::SVGImageCache::imageContentChanged):
+        (WebCore::SVGImageCache::redraw):
+        (WebCore::SVGImageCache::redrawTimerFired):
+        (WebCore):
+        * svg/graphics/SVGImageCache.h:
+        (SVGImageCache):
+
+2012-02-24  Tim Horton  <timothy_horton@apple.com>
+
+        SVG should be supported in Dashboard compatibility mode
+        https://bugs.webkit.org/show_bug.cgi?id=78322
+        <rdar://problem/5861278>
+
+        Reviewed by Dean Jackson.
+
+        Enable SVG elements inside Dashboard, more or less reverting r21418.
+
+        Tests: http/tests/xmlhttprequest/svg-created-by-xhr-allowed-in-dashboard.html
+               svg/custom/embedded-svg-allowed-in-dashboard.xml
+               svg/custom/manually-parsed-embedded-svg-allowed-in-dashboard.html
+               svg/custom/manually-parsed-svg-allowed-in-dashboard.html
+               svg/custom/svg-allowed-in-dashboard-object.html
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * dom/Document.cpp:
+        (WebCore::Document::importNode):
+        * dom/make_names.pl:
+        (printFactoryCppFile):
+
+2012-02-24  Min Qin  <qinmin@google.com>
+
+        Expose a setting to exempt media playback from user gesture requirement after a user gesture is initiated on loading/playing a media
+        https://bugs.webkit.org/show_bug.cgi?id=79167
+
+        Reviewed by Adam Barth.
+
+        Test: media/video-play-require-user-gesture.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::load):
+        (WebCore::HTMLMediaElement::play):
+        (WebCore::HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture):
+        (WebCore):
+        * html/HTMLMediaElement.h:
+        (HTMLMediaElement):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setMediaPlaybackRequiresUserGesture):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-24  Adam Barth  <abarth@webkit.org>
+
+        DOMWindow*.idl should have had the same license block as DOMWindow.idl did originally
+        https://bugs.webkit.org/show_bug.cgi?id=79507
+
+        Reviewed by Alexey Proskuryakov.
+
+        In moving pieces of DOMWindow.idl into separate files, we mistakenly
+        changed some of the license blocks.  All these files should have a
+        license block that matches the file that originally contained the code.
+
+        * Modules/intents/DOMWindowIntents.idl:
+        * fileapi/DOMWindowFileSystem.idl:
+        * html/DOMWindowHTML.idl:
+        * html/canvas/DOMWindowWebGL.idl:
+        * mediastream/DOMWindowMediaStream.idl:
+        * storage/DOMWindowSQLDatabase.idl:
+        * svg/DOMWindowSVG.idl:
+        * webaudio/DOMWindowWebAudio.idl:
+        * websockets/DOMWindowWebSocket.idl:
+        * workers/DOMWindowWorker.idl:
+        * xml/DOMWindowXML.idl:
+
+2012-02-24  David Kilzer  <ddkilzer@apple.com>
+
+        Use xcrun to find compiler paths for Generate Derived Sources build phase script
+        <http://webkit.org/b/79512>
+
+        Reviewed by Mark Rowe.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        (Generate Derived Sources): Use xcrun to find the path to the
+        compiler since that works on both iOS and OS X.
+
+2012-02-24  Anders Carlsson  <andersca@apple.com>
+
+        Crash in TileCache::revalidateTiles
+        https://bugs.webkit.org/show_bug.cgi?id=79510
+        <rdar://problem/10928035>
+
+        Reviewed by Sam Weinig.
+
+        Handle the tile cache layer's PlatformCALayer going away before the
+        CALayer itself has been deallocated.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::revalidateTiles):
+
+2012-02-24  Adam Klein  <adamk@chromium.org>
+
+        Don't notify the inspector of Node insertions initiated by the parser
+        https://bugs.webkit.org/show_bug.cgi?id=79388
+
+        Reviewed by Adam Barth.
+
+        This is part of a series of changes to make ContainerNode's
+        implementation simpler and more internally consistent.
+
+        I don't know of a way to break on parser-initiated insertions,
+        and the code already doesn't notify on parser-initiated removes
+        (in ContainerNode::parserRemoveChild).
+
+        No new tests, should already be covered by
+        inspector/debugger/dom-breakpoints.html.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::parserInsertBefore):
+        (WebCore::ContainerNode::parserAddChild):
+
+2012-02-24  Daniel Bates  <dbates@webkit.org>
+
+        Attempt to fix the Windows and WinCE build after changeset r108809
+        <http://trac.webkit.org/changeset/108809> (https://bugs.webkit.org/show_bug.cgi?id=38995)
+
+        Substitute styleLoadEventSender() for loadEventSender() in HTMLStyleElement.cpp
+        and substitute linkLoadEventSender() for loadEventSender() in HTMLLinkElement.cpp. 
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::linkLoadEventSender):
+        (WebCore::HTMLLinkElement::~HTMLLinkElement):
+        (WebCore::HTMLLinkElement::dispatchPendingLoadEvents):
+        (WebCore::HTMLLinkElement::dispatchPendingEvent):
+        (WebCore::HTMLLinkElement::notifyLoadedSheetAndAllCriticalSubresources):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::styleLoadEventSender):
+        (WebCore::HTMLStyleElement::~HTMLStyleElement):
+        (WebCore::HTMLStyleElement::dispatchPendingLoadEvents):
+        (WebCore::HTMLStyleElement::dispatchPendingEvent):
+        (WebCore::HTMLStyleElement::notifyLoadedSheetAndAllCriticalSubresources):
+
+2012-02-24  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Fix Chromium Android build by building HarfBuzzShaperBase.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79497
+
+        Reviewed by Tony Gentilcore.
+
+        The Chromium Android build was broken by revision r108733, as the
+        HarfBuzzShaperBase.cpp file also should have been included for Android.
+        Fix the build by including it.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-02-24  Yael Aharon  <yael.aharon@nokia.com>
+
+        [Texmap] Consolidate the common parts of TextureMapperGL::drawTexture
+        https://bugs.webkit.org/show_bug.cgi?id=79143
+
+        Reviewed by Noam Rosenthal.
+
+        Combine the two drawTexture methods into one, and extract the part that
+        could not be combined into its own method.
+        No new tests. Refactoring only.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore):
+        (WebCore::TextureMapperGL::drawTexture):
+        * platform/graphics/texmap/TextureMapperGL.h:
+        (WebCore):
+        (BitmapTextureGL):
+        (WebCore::BitmapTextureGL::~BitmapTextureGL):
+        (WebCore::BitmapTextureGL::id):
+        (WebCore::BitmapTextureGL::relativeSize):
+        (WebCore::BitmapTextureGL::setTextureMapper):
+        (WebCore::BitmapTextureGL::BitmapTextureGL):
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource):
+        (WebCore):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::prepare):
+        * platform/graphics/texmap/TextureMapperShaderManager.h:
+        (WebCore):
+        (WebCore::TextureMapperShaderProgram::prepare):
+        (WebCore::TextureMapperShaderProgram::matrixVariable):
+        (WebCore::TextureMapperShaderProgram::sourceMatrixVariable):
+        (WebCore::TextureMapperShaderProgram::sourceTextureVariable):
+        (WebCore::TextureMapperShaderProgram::opacityVariable):
+        (TextureMapperShaderProgram):
+        (TextureMapperShaderProgramSimple):
+        (TextureMapperShaderProgramOpacityAndMask):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskMatrixVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskTextureVariable):
+
+2012-02-24  Daniel Bates  <dbates@webkit.org>
+
+        style element and link element for CSS stylesheet should emit load/error event when sheet loads/fails to load
+        https://bugs.webkit.org/show_bug.cgi?id=38995
+
+        Reviewed by Adam Barth and Nate Chapin.
+
+        Tests: fast/dom/HTMLLinkElement/link-onerror-stylesheet-with-existent-and-non-existent-import.html
+               fast/dom/HTMLLinkElement/link-onerror-stylesheet-with-non-existent-import.html
+               fast/dom/HTMLLinkElement/link-onerror.html
+               fast/dom/HTMLLinkElement/link-onload-before-page-load.html
+               fast/dom/HTMLLinkElement/link-onload-stylesheet-with-import.html
+               fast/dom/HTMLLinkElement/link-onload.html
+               fast/dom/HTMLLinkElement/link-onload2.html
+               fast/dom/HTMLLinkElement/programmatically-add-link-with-onerror-handler.html
+               fast/dom/HTMLLinkElement/programmatically-add-link-with-onload-handler.html
+               fast/dom/HTMLStyleElement/programmatically-add-style-with-onerror-handler.html
+               fast/dom/HTMLStyleElement/programmatically-add-style-with-onload-handler.html
+               fast/dom/HTMLStyleElement/style-onerror-with-existent-and-non-existent-import.html
+               fast/dom/HTMLStyleElement/style-onerror.html
+               fast/dom/HTMLStyleElement/style-onload-before-page-load.html
+               fast/dom/HTMLStyleElement/style-onload.html
+               fast/dom/HTMLStyleElement/style-onload2.html
+
+        Implements support for firing Load and Error events at HTML Link and HTML Style elements as per
+        the HTML5 spec. (draft 05/25/2011) section "The link element" <http://www.w3.org/TR/html5/semantics.html#the-link-element>
+        and "The style element" <http://www.w3.org/TR/html5/semantics.html#the-style-element>, respectively.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): Modified to call CSSStyleSheet::notifyLoadedSheet()
+        after the style sheet associated with the @import rule loaded.
+        * css/CSSStyleSheet.cpp: Added instance variable m_didLoadErrorOccur to track whether a network error
+        occurred while loading any @import style sheets.
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        (WebCore::CSSStyleSheet::checkLoaded):
+        (WebCore):
+        (WebCore::CSSStyleSheet::notifyLoadedSheet): Added; update m_didLoadErrorOccur to reflect if a network
+        error occurred while loading a style sheet associated with an @import rule.
+        * css/CSSStyleSheet.h:
+        (WebCore):
+        (CSSStyleSheet):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): Call HTML{LinkElement, StyleElement}::dispatchPendingLoadEvents() to
+        ensure that all pending Load events for link and style elements are dispatched before we fire the Load
+        event for the window.
+        * dom/Node.h:
+        (WebCore::Node::notifyLoadedSheetAndAllCriticalSubresources): Added; as stated in its name, this method is
+        called once a style sheet and all its critical subresources (@imports) have loaded.
+        * html/HTMLLinkElement.cpp:
+        (WebCore::loadEventSender):
+        (WebCore):
+        (WebCore::HTMLLinkElement::HTMLLinkElement):
+        (WebCore::HTMLLinkElement::~HTMLLinkElement): Modified to cancel all pending Load events on destruction.
+        (WebCore::HTMLLinkElement::parseAttribute): Register event listeners for Load and Error events regardless of whether we
+        built with link prefetch support.
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+        (WebCore::HTMLLinkElement::dispatchPendingLoadEvents): Added; called from Document::implicitClose() to
+        ensure that all pending Load events for link elements have been dispatched before we fire the Load event
+        for the window.
+        (WebCore::HTMLLinkElement::dispatchPendingEvent): Added; called by EventSender.
+        (WebCore::HTMLLinkElement::notifyLoadedSheetAndAllCriticalSubresources): Added.
+        * html/HTMLLinkElement.h:
+        (WebCore):
+        (HTMLLinkElement):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::loadEventSender):
+        (WebCore):
+        (WebCore::HTMLStyleElement::HTMLStyleElement):
+        (WebCore::HTMLStyleElement::~HTMLStyleElement): Modified to cancel all pending Load events on destruction.
+        (WebCore::HTMLStyleElement::parseAttribute): Register event listeners for Load and Error events.
+        (WebCore::HTMLStyleElement::dispatchPendingLoadEvents): Added; called from Document::implicitClose() to
+        ensure that all pending Load events for link elements have been dispatched before we fire the Load event
+        for the window.
+        (WebCore::HTMLStyleElement::dispatchPendingEvent): Added; called by EventSender.
+        (WebCore::HTMLStyleElement::notifyLoadedSheetAndAllCriticalSubresources): Added.
+        * html/HTMLStyleElement.h:
+        (WebCore):
+        (HTMLStyleElement):
+
+2012-02-24  Adam Roben  <aroben@apple.com>
+
+        Mac build fix after r108698
+
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm: Added missing #import.
+
+2012-02-24  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed speculative buildfix after r108785 for ENABLE(SVG) && !ENABLE(XSLT) case.
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+
+2012-02-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Do not show scripts panel navigator automatically more than once to the same user.
+        https://bugs.webkit.org/show_bug.cgi?id=79489
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptsPanel.js:
+
+2012-02-24  Philippe Normand  <pnormand@igalia.com>
+
+        Fix GTK WebAudio build for WebKitGTK 1.7.90.
+
+        Patch by Priit Laes <plaes@plaes.org> on 2012-02-24
+        Rubber-stamped by Philippe Normand.
+
+        * GNUmakefile.list.am: Add AudioBufferCallback.h and
+        DenormalDisabler.h to the list of files so they get disted in the
+        tarballs.
+
+2012-02-24  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: show all counters on one graph
+        https://bugs.webkit.org/show_bug.cgi?id=79484
+
+        Now it is possible to hide any counter. All graphs share the same area.
+        Current values are displayed above that area.
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.getDocumentCount):
+        (WebInspector.MemoryStatistics.getNodeCount):
+        (WebInspector.MemoryStatistics.getListenerCount):
+        (WebInspector.MemoryStatistics):
+        (WebInspector.SwatchCheckbox):
+        (WebInspector.SwatchCheckbox.prototype.get checked):
+        (WebInspector.SwatchCheckbox.prototype.set checked):
+        (WebInspector.SwatchCheckbox.prototype._toggleCheckbox):
+        (WebInspector.CounterUI):
+        (WebInspector.CounterUI.prototype._toggleCounterGraph):
+        (WebInspector.CounterUI.prototype.setRange):
+        (WebInspector.CounterUI.prototype.updateCurrentValue):
+        (WebInspector.CounterUI.prototype.clearCurrentValueAndMarker):
+        (WebInspector.CounterUI.prototype.get visible):
+        (WebInspector.CounterUI.prototype.saveImageUnderMarker):
+        (WebInspector.CounterUI.prototype.restoreImageUnderMarker):
+        (WebInspector.CounterUI.prototype.discardImageUnderMarker):
+        (WebInspector.MemoryStatistics.prototype._updateSize):
+        (WebInspector.MemoryStatistics.prototype._draw):
+        (WebInspector.MemoryStatistics.prototype._onMouseOut):
+        (WebInspector.MemoryStatistics.prototype._refreshCurrentValues):
+        (WebInspector.MemoryStatistics.prototype._highlightCurrentPositionOnGraphs):
+        (WebInspector.MemoryStatistics.prototype._drawGraph):
+        (WebInspector.MemoryStatistics.prototype._clear):
+        * inspector/front-end/timelinePanel.css:
+        (.memory-counter-sidebar-info):
+        (.memory-counter-sidebar-info .swatch):
+        (.memory-counter-sidebar-info .title):
+        (.memory-counter-value):
+        (#counter-values-bar):
+
+2012-02-24  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: map Ctrl/Cmd +/- to zoom in hosted mode.
+        https://bugs.webkit.org/show_bug.cgi?id=79475
+
+        (In remote front-end mode, default zoom actions are working.)
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::setZoomFactor):
+        (WebCore):
+        * inspector/InspectorFrontendHost.h:
+        (InspectorFrontendHost):
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub):
+        (.WebInspector.InspectorFrontendHostStub.prototype.loadResourceSynchronously):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setZoomFactor):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.js:
+        (WebInspector._initializeCapability):
+        (WebInspector._zoomIn):
+        (WebInspector._zoomOut):
+        (WebInspector._resetZoom):
+        (WebInspector._requestZoom.set InspectorFrontendHost):
+        (WebInspector._requestZoom):
+        (WebInspector._doLoadedDoneWithCapabilities.get if):
+        (WebInspector.documentKeyDown):
+
+2012-02-24  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Refactor EventHandler::handleGestureEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=79476
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new tests. No behavior change.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        (WebCore::EventHandler::handleGestureTap):
+        (WebCore::EventHandler::handleGestureScrollUpdate):
+        * page/EventHandler.h:
+
+2012-02-24  Zoltan Horvath  <zoltan@webkit.org>
+
+        [Qt] Allow to use WebCore imagedecoders
+        https://bugs.webkit.org/show_bug.cgi?id=32410
+
+        Add ENABLE(QT_IMAGE_DECODER) guards around Qt imagedecoders and set it to default.
+        By passing ENABLE_QT_IMAGE_DECODER=0 define to the build system, WebKit will build
+        with WebCore's imagedecoders.
+
+        I added NO_RETURN attribute and PLATFORM(QT) conditionals to 2 functions of PNG and
+        JPEG decoders to avoid compiler warnings because in Qt-port we treat warning as errors (-Werror).
+
+        I'm continuing the refactoring of this area and try to use Qt imagedecoders only in
+        cases when WebCore doesn't support the image format.
+
+        Reviewed by Simon Hausmann.
+
+        No behavior change, no need new tests.
+
+        * Target.pri:
+        * WebCore.pri:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageFrame::getAddr):
+        (ImageFrame):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        NO_RETURN has been added to a function to avoid warning message.
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        NO_RETURN has been added to a function to avoid warning message.
+        (WebCore):
+        * platform/image-decoders/qt/ImageFrameQt.cpp:
+        (WebCore):
+        (WebCore::ImageFrame::asNewNativeImage):
+
+2012-02-24  Lynn Neir <lynn.neir@skype.net>
+
+        [Windows, WinCairo] Handle indeterminate checkbox state
+        https://bugs.webkit.org/show_bug.cgi?id=79288
+
+        Reviewed by Adam Roben.
+
+        Tested by fast/forms/indeterminate.html
+
+        * rendering/RenderThemeWin.cpp: Add code to check for indeterminate
+          state in CheckBox.
+
 2012-02-24  Simon Hausmann  <simon.hausmann@nokia.com>
 
         [Qt] Font related problem with newer Qt5
@@ -2508,7 +21141,6 @@
         (WebCore::ContainerNode::insertBefore):
         (WebCore::ContainerNode::replaceChild):
         (WebCore::ContainerNode::removeChild):
-
 2012-02-22  Dmitry Lomov  <dslomov@google.com>
 
         [JSC] Implement ArrayBuffer and typed array cloning in JSC
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index 3e2090355..58a02f521 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -90,12 +90,14 @@ ENABLE_INDEXED_DATABASE = ;
 ENABLE_INPUT_COLOR = ;
 ENABLE_INPUT_SPEECH = ;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
+ENABLE_LEGACY_NOTIFICATIONS = ENABLE_LEGACY_NOTIFICATIONS;
 ENABLE_LINK_PREFETCH = ;
 ENABLE_MATHML = ENABLE_MATHML;
 ENABLE_MEDIA_SOURCE = ;
 ENABLE_MEDIA_STATISTICS = ;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_MHTML = ;
+ENABLE_MICRODATA = ;
 ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 
 ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
@@ -109,6 +111,7 @@ ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 ENABLE_QUOTA = ;
 ENABLE_REGISTER_PROTOCOL_HANDLER = ;
 ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
+ENABLE_SCRIPTED_SPEECH = ;
 ENABLE_SHADOW_DOM = ;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SQL_DATABASE = ENABLE_SQL_DATABASE;
@@ -118,7 +121,10 @@ ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
 ENABLE_VIDEO = ENABLE_VIDEO;
-ENABLE_VIDEO_TRACK = ENABLE_VIDEO_TRACK;
+
+ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(REAL_PLATFORM_NAME));
+ENABLE_VIDEO_TRACK_macosx = ENABLE_VIDEO_TRACK;
+
 ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
@@ -126,4 +132,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LINK_PREFETCH) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebCore/Configurations/Version.xcconfig b/Source/WebCore/Configurations/Version.xcconfig
index 14e0bdc80..0f427a3ac 100644
--- a/Source/WebCore/Configurations/Version.xcconfig
+++ b/Source/WebCore/Configurations/Version.xcconfig
@@ -21,8 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-MAJOR_VERSION = 535;
-MINOR_VERSION = 23;
+MAJOR_VERSION = 536;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebCore/Configurations/WebCore.xcconfig b/Source/WebCore/Configurations/WebCore.xcconfig
index 662e99427..7624aad8b 100644
--- a/Source/WebCore/Configurations/WebCore.xcconfig
+++ b/Source/WebCore/Configurations/WebCore.xcconfig
@@ -26,10 +26,11 @@
 
 EXPORTED_SYMBOLS_FILE = $(EXPORTED_SYMBOLS_FILE_$(CURRENT_ARCH));
 EXPORTED_SYMBOLS_FILE_ = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
-EXPORTED_SYMBOLS_FILE_armv5 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
-EXPORTED_SYMBOLS_FILE_armv6 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
-EXPORTED_SYMBOLS_FILE_armv7 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
-EXPORTED_SYMBOLS_FILE_i386 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
+EXPORTED_SYMBOLS_FILE_armv6 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.armv6.exp;
+EXPORTED_SYMBOLS_FILE_armv7 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.armv7.exp;
+EXPORTED_SYMBOLS_FILE_i386 = $(EXPORTED_SYMBOLS_FILE_i386_$(REAL_PLATFORM_NAME));
+EXPORTED_SYMBOLS_FILE_i386_iphonesimulator = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.i386.exp;
+EXPORTED_SYMBOLS_FILE_i386_macosx = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
 EXPORTED_SYMBOLS_FILE_ppc = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
 EXPORTED_SYMBOLS_FILE_ppc64 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
 EXPORTED_SYMBOLS_FILE_x86_64 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
@@ -49,8 +50,15 @@ STAGED_FRAMEWORKS_SEARCH_PATH_YES = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/StagedFram
 HEADER_SEARCH_PATHS = ForwardingHeaders icu /usr/include/libxslt /usr/include/libxml2 $(SQLITE3_HEADER_SEARCH_PATHS) "${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore" "${BUILT_PRODUCTS_DIR}/usr/local/include" $(HEADER_SEARCH_PATHS);
 INFOPLIST_FILE = Info.plist;
 INSTALL_PATH = $(INSTALL_PATH_$(REAL_PLATFORM_NAME));
+INSTALL_PATH_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+INSTALL_PATH_iphonesimulator = $(INDIGO_INSTALL_PATH_PREFIX)$(INSTALL_PATH_ACTUAL);
 INSTALL_PATH_macosx = $(WEBCORE_FRAMEWORKS_DIR);
-DYLIB_INSTALL_NAME_BASE = $(NORMAL_WEBCORE_FRAMEWORKS_DIR);
+INSTALL_PATH_ACTUAL = $(INSTALL_PATH_ACTUAL_$(REAL_PLATFORM_NAME));
+INSTALL_PATH_ACTUAL_iphonesimulator = $(INSTALL_PATH_iphoneos);
+DYLIB_INSTALL_NAME_BASE = $(DYLIB_INSTALL_NAME_BASE_$(REAL_PLATFORM_NAME));
+DYLIB_INSTALL_NAME_BASE_macosx = $(NORMAL_WEBCORE_FRAMEWORKS_DIR);
+DYLIB_INSTALL_NAME_BASE_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+DYLIB_INSTALL_NAME_BASE_iphonesimulator =  $(SDKROOT)$(DYLIB_INSTALL_NAME_BASE_iphoneos);
 INSTALLHDRS_COPY_PHASE = YES;
 INSTALLHDRS_SCRIPT_PHASE = YES;
 PRODUCT_NAME = WebCore;
@@ -77,7 +85,7 @@ WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_NO = $(NORMAL_WEBCORE_FRA
 WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_YES = $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
 NORMAL_PRODUCTION_FRAMEWORKS_DIR = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
-NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_macosx = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks;
 
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index 828d9b233..24606833a 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -29,6 +29,9 @@
 VPATH = \
     $(WebCore) \
     $(WebCore)/Modules/geolocation \
+    $(WebCore)/Modules/indexeddb \
+    $(WebCore)/Modules/webdatabase \
+    $(WebCore)/Modules/websockets \
     $(WebCore)/bindings/generic \
     $(WebCore)/bindings/js \
     $(WebCore)/bindings/objc \
@@ -60,6 +63,39 @@ BINDING_IDLS = \
     $(WebCore)/Modules/geolocation/PositionCallback.idl \
     $(WebCore)/Modules/geolocation/PositionError.idl \
     $(WebCore)/Modules/geolocation/PositionErrorCallback.idl \
+    $(WebCore)/Modules/indexeddb/DOMWindowIndexedDatabase.idl \
+    $(WebCore)/Modules/indexeddb/IDBAny.idl \
+    $(WebCore)/Modules/indexeddb/IDBCursor.idl \
+    $(WebCore)/Modules/indexeddb/IDBDatabase.idl \
+    $(WebCore)/Modules/indexeddb/IDBDatabaseError.idl \
+    $(WebCore)/Modules/indexeddb/IDBDatabaseException.idl \
+    $(WebCore)/Modules/indexeddb/IDBFactory.idl \
+    $(WebCore)/Modules/indexeddb/IDBIndex.idl \
+    $(WebCore)/Modules/indexeddb/IDBKey.idl \
+    $(WebCore)/Modules/indexeddb/IDBKeyRange.idl \
+    $(WebCore)/Modules/indexeddb/IDBObjectStore.idl \
+    $(WebCore)/Modules/indexeddb/IDBRequest.idl \
+    $(WebCore)/Modules/indexeddb/IDBTransaction.idl \
+    $(WebCore)/Modules/indexeddb/WorkerContextIndexedDatabase.idl \
+    $(WebCore)/Modules/webdatabase/DOMWindowSQLDatabase.idl \
+    $(WebCore)/Modules/webdatabase/Database.idl \
+    $(WebCore)/Modules/webdatabase/DatabaseCallback.idl \
+    $(WebCore)/Modules/webdatabase/DatabaseSync.idl \
+    $(WebCore)/Modules/webdatabase/SQLError.idl \
+    $(WebCore)/Modules/webdatabase/SQLException.idl \
+    $(WebCore)/Modules/webdatabase/SQLResultSet.idl \
+    $(WebCore)/Modules/webdatabase/SQLResultSetRowList.idl \
+    $(WebCore)/Modules/webdatabase/SQLStatementCallback.idl \
+    $(WebCore)/Modules/webdatabase/SQLStatementErrorCallback.idl \
+    $(WebCore)/Modules/webdatabase/SQLTransaction.idl \
+    $(WebCore)/Modules/webdatabase/SQLTransactionCallback.idl \
+    $(WebCore)/Modules/webdatabase/SQLTransactionErrorCallback.idl \
+    $(WebCore)/Modules/webdatabase/SQLTransactionSync.idl \
+    $(WebCore)/Modules/webdatabase/SQLTransactionSyncCallback.idl \
+    $(WebCore)/Modules/webdatabase/WorkerContextSQLDatabase.idl \
+    $(WebCore)/Modules/websockets/CloseEvent.idl \
+    $(WebCore)/Modules/websockets/DOMWindowWebSocket.idl \
+    $(WebCore)/Modules/websockets/WebSocket.idl \
     $(WebCore)/css/CSSCharsetRule.idl \
     $(WebCore)/css/CSSFontFaceRule.idl \
     $(WebCore)/css/CSSImportRule.idl \
@@ -187,11 +223,11 @@ BINDING_IDLS = \
     $(WebCore)/fileapi/MetadataCallback.idl \
     $(WebCore)/fileapi/OperationNotAllowedException.idl \
     $(WebCore)/fileapi/WebKitBlobBuilder.idl \
+    $(WebCore)/fileapi/WorkerContextFileSystem.idl \
     $(WebCore)/html/DOMFormData.idl \
     $(WebCore)/html/DOMSettableTokenList.idl \
     $(WebCore)/html/DOMTokenList.idl \
     $(WebCore)/html/DOMURL.idl \
-    $(WebCore)/html/DOMWindowHTML.idl \
     $(WebCore)/html/HTMLAllCollection.idl \
     $(WebCore)/html/HTMLAnchorElement.idl \
     $(WebCore)/html/HTMLAppletElement.idl \
@@ -277,8 +313,8 @@ BINDING_IDLS = \
     $(WebCore)/html/canvas/CanvasPattern.idl \
     $(WebCore)/html/canvas/CanvasRenderingContext.idl \
     $(WebCore)/html/canvas/CanvasRenderingContext2D.idl \
-    $(WebCore)/html/canvas/DOMWindowWebGL.idl \
     $(WebCore)/html/canvas/DataView.idl \
+    $(WebCore)/html/canvas/EXTTextureFilterAnisotropic.idl \
     $(WebCore)/html/canvas/Float32Array.idl \
     $(WebCore)/html/canvas/Float64Array.idl \
     $(WebCore)/html/canvas/Int16Array.idl \
@@ -346,40 +382,12 @@ BINDING_IDLS = \
     $(WebCore)/plugins/DOMMimeTypeArray.idl \
     $(WebCore)/plugins/DOMPlugin.idl \
     $(WebCore)/plugins/DOMPluginArray.idl \
-    $(WebCore)/storage/DOMWindowSQLDatabase.idl \
-    $(WebCore)/storage/Database.idl \
-    $(WebCore)/storage/DatabaseCallback.idl \
-    $(WebCore)/storage/DatabaseSync.idl \
-    $(WebCore)/storage/IDBAny.idl \
-    $(WebCore)/storage/IDBCursor.idl \
-    $(WebCore)/storage/IDBDatabase.idl \
-    $(WebCore)/storage/IDBDatabaseError.idl \
-    $(WebCore)/storage/IDBDatabaseException.idl \
-    $(WebCore)/storage/IDBFactory.idl \
-    $(WebCore)/storage/IDBIndex.idl \
-    $(WebCore)/storage/IDBKey.idl \
-    $(WebCore)/storage/IDBKeyRange.idl \
-    $(WebCore)/storage/IDBObjectStore.idl \
-    $(WebCore)/storage/IDBRequest.idl \
-    $(WebCore)/storage/IDBTransaction.idl \
-    $(WebCore)/storage/SQLError.idl \
-    $(WebCore)/storage/SQLException.idl \
-    $(WebCore)/storage/SQLResultSet.idl \
-    $(WebCore)/storage/SQLResultSetRowList.idl \
-    $(WebCore)/storage/SQLStatementCallback.idl \
-    $(WebCore)/storage/SQLStatementErrorCallback.idl \
-    $(WebCore)/storage/SQLTransaction.idl \
-    $(WebCore)/storage/SQLTransactionCallback.idl \
-    $(WebCore)/storage/SQLTransactionErrorCallback.idl \
-    $(WebCore)/storage/SQLTransactionSync.idl \
-    $(WebCore)/storage/SQLTransactionSyncCallback.idl \
     $(WebCore)/storage/Storage.idl \
     $(WebCore)/storage/StorageEvent.idl \
     $(WebCore)/storage/StorageInfo.idl \
     $(WebCore)/storage/StorageInfoErrorCallback.idl \
     $(WebCore)/storage/StorageInfoQuotaCallback.idl \
     $(WebCore)/storage/StorageInfoUsageCallback.idl \
-    $(WebCore)/svg/DOMWindowSVG.idl \
     $(WebCore)/svg/ElementTimeControl.idl \
     $(WebCore)/svg/SVGAElement.idl \
     $(WebCore)/svg/SVGAltGlyphDefElement.idl \
@@ -561,18 +569,13 @@ BINDING_IDLS = \
     $(WebCore)/webaudio/OfflineAudioCompletionEvent.idl \
     $(WebCore)/webaudio/RealtimeAnalyserNode.idl \
     $(WebCore)/webaudio/WaveShaperNode.idl \
-    $(WebCore)/websockets/CloseEvent.idl \
-    $(WebCore)/websockets/DOMWindowWebSocket.idl \
-    $(WebCore)/websockets/WebSocket.idl \
     $(WebCore)/workers/AbstractWorker.idl \
-    $(WebCore)/workers/DOMWindowWorker.idl \
     $(WebCore)/workers/DedicatedWorkerContext.idl \
     $(WebCore)/workers/SharedWorker.idl \
     $(WebCore)/workers/SharedWorkerContext.idl \
     $(WebCore)/workers/Worker.idl \
     $(WebCore)/workers/WorkerContext.idl \
     $(WebCore)/workers/WorkerLocation.idl \
-    $(WebCore)/xml/DOMWindowXML.idl \
     $(WebCore)/xml/DOMParser.idl \
     $(WebCore)/xml/XMLHttpRequest.idl \
     $(WebCore)/xml/XMLHttpRequestException.idl \
@@ -635,14 +638,15 @@ ADDITIONAL_IDL_DEFINES :=
 ifeq ($(OS),MACOS)
 
 FRAMEWORK_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_SEARCH_PATHS) | perl -e 'print "-F " . join(" -F ", split(" ", <>));')
+HEADER_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(HEADER_SEARCH_PATHS) | perl -e 'print "-I" . join(" -I", split(" ", <>));')
 
-ifeq ($(shell $(CC) -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_DASHBOARD_SUPPORT | cut -d' ' -f3), 1)
+ifeq ($(shell $(CC) -x c++ -E -P -dM $(FRAMEWORK_FLAGS) $(HEADER_FLAGS) -include "wtf/Platform.h" /dev/null | grep ENABLE_DASHBOARD_SUPPORT | cut -d' ' -f3), 1)
     ENABLE_DASHBOARD_SUPPORT = 1
 else
     ENABLE_DASHBOARD_SUPPORT = 0
 endif
 
-ifeq ($(shell $(CC) -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_ORIENTATION_EVENTS | cut -d' ' -f3), 1)
+ifeq ($(shell $(CC) -x c++ -E -P -dM $(FRAMEWORK_FLAGS) $(HEADER_FLAGS) -include "wtf/Platform.h" /dev/null | grep ENABLE_ORIENTATION_EVENTS | cut -d' ' -f3), 1)
     ENABLE_ORIENTATION_EVENTS = 1
 else
     ENABLE_ORIENTATION_EVENTS = 0
@@ -865,8 +869,8 @@ XLinkNames.cpp : dom/make_names.pl svg/xlinkattrs.in
  
 # Register event constructors and targets
 
-EventFactory.cpp EventHeaders.h EventInterfaces.h : dom/make_event_factory.pl dom/EventFactory.in
-	perl -I $(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventFactory.in
+EventFactory.cpp EventHeaders.h EventInterfaces.h : dom/make_event_factory.pl dom/EventNames.in
+	perl -I $(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventNames.in
 
 EventTargetHeaders.h EventTargetInterfaces.h : dom/make_event_factory.pl dom/EventTargetFactory.in
 	perl -I $(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventTargetFactory.in
@@ -892,13 +896,13 @@ GENERATE_SCRIPTS = \
     bindings/scripts/generate-bindings.pl \
     bindings/scripts/preprocessor.pm
 
-RESOLVE_SUPPLEMENTAL_SCRIPTS = \
+PREPROCESS_IDLS_SCRIPTS = \
     bindings/scripts/IDLParser.pm \
-    bindings/scripts/resolve-supplemental.pl
+    bindings/scripts/preprocess-idls.pl
 
 generator_script = perl $(addprefix -I $(WebCore)/, $(sort $(dir $(1)))) $(WebCore)/bindings/scripts/generate-bindings.pl
 
-resolve_supplemental_script = perl $(addprefix -I $(WebCore)/, $(sort $(dir $(1)))) $(WebCore)/bindings/scripts/resolve-supplemental.pl
+preprocess_idls_script = perl $(addprefix -I $(WebCore)/, $(sort $(dir $(1)))) $(WebCore)/bindings/scripts/preprocess-idls.pl
 
 # JS bindings generator
 
@@ -926,9 +930,9 @@ IDL_ATTRIBUTES_FILE = $(WebCore)/bindings/scripts/IDLAttributes.txt
 space :=
 space +=
 
-$(SUPPLEMENTAL_DEPENDENCY_FILE) : $(RESOLVE_SUPPLEMENTAL_SCRIPTS) $(BINDING_IDLS) $(ADDITIONAL_IDLS) $(IDL_ATTRIBUTES_FILE)
+$(SUPPLEMENTAL_DEPENDENCY_FILE) : $(PREPROCESS_IDLS_SCRIPTS) $(BINDING_IDLS) $(ADDITIONAL_IDLS) $(IDL_ATTRIBUTES_FILE)
 	printf "$(subst $(space),,$(patsubst %,%\n,$(BINDING_IDLS) $(ADDITIONAL_IDLS)))" > $(IDL_FILES_TMP)
-	$(call resolve_supplemental_script, $(RESOLVE_SUPPLEMENTAL_SCRIPTS)) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_JAVASCRIPT" --idlFilesList $(IDL_FILES_TMP) --supplementalDependencyFile $@ --idlAttributesFile $(IDL_ATTRIBUTES_FILE)
+	$(call preprocess_idls_script, $(PREPROCESS_IDLS_SCRIPTS)) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_JAVASCRIPT" --idlFilesList $(IDL_FILES_TMP) --supplementalDependencyFile $@ --idlAttributesFile $(IDL_ATTRIBUTES_FILE)
 	rm -f $(IDL_FILES_TMP)
 
 JS%.h : %.idl $(JS_BINDINGS_SCRIPTS) $(SUPPLEMENTAL_DEPENDENCY_FILE)
diff --git a/Source/WebCore/DerivedSources.pri b/Source/WebCore/DerivedSources.pri
index a6976b4cb..af4f5b50b 100644
--- a/Source/WebCore/DerivedSources.pri
+++ b/Source/WebCore/DerivedSources.pri
@@ -43,7 +43,7 @@ XMLNS_NAMES = $$PWD/xml/xmlnsattrs.in
 
 HTML_ENTITIES = $$PWD/html/parser/HTMLEntityNames.in
 
-EVENT_FACTORY = $$PWD/dom/EventFactory.in
+EVENTS_NAMES = $$PWD/dom/EventNames.in
 
 EVENT_TARGET_FACTORY = $$PWD/dom/EventTargetFactory.in
 
@@ -92,6 +92,39 @@ IDL_BINDINGS += \
     $$PWD/Modules/geolocation/PositionCallback.idl \
     $$PWD/Modules/geolocation/PositionError.idl \
     $$PWD/Modules/geolocation/PositionErrorCallback.idl \
+    $$PWD/Modules/indexeddb/DOMWindowIndexedDatabase.idl \
+    $$PWD/Modules/indexeddb/IDBAny.idl \
+    $$PWD/Modules/indexeddb/IDBCursor.idl \
+    $$PWD/Modules/indexeddb/IDBDatabaseError.idl \
+    $$PWD/Modules/indexeddb/IDBDatabaseException.idl \
+    $$PWD/Modules/indexeddb/IDBDatabase.idl \
+    $$PWD/Modules/indexeddb/IDBFactory.idl \
+    $$PWD/Modules/indexeddb/IDBIndex.idl \
+    $$PWD/Modules/indexeddb/IDBKey.idl \
+    $$PWD/Modules/indexeddb/IDBKeyRange.idl \
+    $$PWD/Modules/indexeddb/IDBObjectStore.idl \
+    $$PWD/Modules/indexeddb/IDBRequest.idl \
+    $$PWD/Modules/indexeddb/IDBTransaction.idl \
+    $$PWD/Modules/indexeddb/WorkerContextIndexedDatabase.idl \
+    $$PWD/Modules/webdatabase/DOMWindowSQLDatabase.idl \
+    $$PWD/Modules/webdatabase/Database.idl \
+    $$PWD/Modules/webdatabase/DatabaseCallback.idl \
+    $$PWD/Modules/webdatabase/DatabaseSync.idl \
+    $$PWD/Modules/webdatabase/SQLError.idl \
+    $$PWD/Modules/webdatabase/SQLException.idl \
+    $$PWD/Modules/webdatabase/SQLResultSet.idl \
+    $$PWD/Modules/webdatabase/SQLResultSetRowList.idl \
+    $$PWD/Modules/webdatabase/SQLStatementCallback.idl \
+    $$PWD/Modules/webdatabase/SQLStatementErrorCallback.idl \
+    $$PWD/Modules/webdatabase/SQLTransaction.idl \
+    $$PWD/Modules/webdatabase/SQLTransactionCallback.idl \
+    $$PWD/Modules/webdatabase/SQLTransactionErrorCallback.idl \
+    $$PWD/Modules/webdatabase/SQLTransactionSync.idl \
+    $$PWD/Modules/webdatabase/SQLTransactionSyncCallback.idl \
+    $$PWD/Modules/webdatabase/WorkerContextSQLDatabase.idl \
+    $$PWD/Modules/websockets/CloseEvent.idl \
+    $$PWD/Modules/websockets/DOMWindowWebSocket.idl \
+    $$PWD/Modules/websockets/WebSocket.idl \
     $$PWD/css/Counter.idl \
     $$PWD/css/CSSCharsetRule.idl \
     $$PWD/css/CSSFontFaceRule.idl \
@@ -213,9 +246,9 @@ IDL_BINDINGS += \
     $$PWD/fileapi/Metadata.idl \
     $$PWD/fileapi/MetadataCallback.idl \
     $$PWD/fileapi/WebKitBlobBuilder.idl \
+    $$PWD/fileapi/WorkerContextFileSystem.idl \
     $$PWD/html/canvas/ArrayBufferView.idl \
     $$PWD/html/canvas/ArrayBuffer.idl \
-    $$PWD/html/canvas/DOMWindowWebGL.idl \
     $$PWD/html/canvas/DataView.idl \
     $$PWD/html/canvas/Int8Array.idl \
     $$PWD/html/canvas/Float32Array.idl \
@@ -225,6 +258,7 @@ IDL_BINDINGS += \
     $$PWD/html/canvas/CanvasPattern.idl \
     $$PWD/html/canvas/CanvasRenderingContext.idl \
     $$PWD/html/canvas/CanvasRenderingContext2D.idl \
+    $$PWD/html/canvas/EXTTextureFilterAnisotropic.idl \
     $$PWD/html/canvas/OESStandardDerivatives.idl \
     $$PWD/html/canvas/OESTextureFloat.idl \
     $$PWD/html/canvas/OESVertexArrayObject.idl \
@@ -253,7 +287,6 @@ IDL_BINDINGS += \
     $$PWD/html/DOMSettableTokenList.idl \
     $$PWD/html/DOMTokenList.idl \
     $$PWD/html/DOMURL.idl \
-    $$PWD/html/DOMWindowHTML.idl \
     $$PWD/html/HTMLAllCollection.idl \
     $$PWD/html/HTMLAudioElement.idl \
     $$PWD/html/HTMLAnchorElement.idl \
@@ -370,39 +403,12 @@ IDL_BINDINGS += \
     $$PWD/plugins/DOMMimeType.idl \
     $$PWD/plugins/DOMPluginArray.idl \
     $$PWD/plugins/DOMMimeTypeArray.idl \
-    $$PWD/storage/DOMWindowSQLDatabase.idl \
-    $$PWD/storage/Database.idl \
-    $$PWD/storage/DatabaseCallback.idl \
-    $$PWD/storage/DatabaseSync.idl \
-    $$PWD/storage/IDBAny.idl \
-    $$PWD/storage/IDBCursor.idl \
-    $$PWD/storage/IDBDatabaseError.idl \
-    $$PWD/storage/IDBDatabaseException.idl \
-    $$PWD/storage/IDBDatabase.idl \
-    $$PWD/storage/IDBFactory.idl \
-    $$PWD/storage/IDBIndex.idl \
-    $$PWD/storage/IDBKey.idl \
-    $$PWD/storage/IDBKeyRange.idl \
-    $$PWD/storage/IDBObjectStore.idl \
-    $$PWD/storage/IDBRequest.idl \
-    $$PWD/storage/IDBTransaction.idl \
     $$PWD/storage/Storage.idl \
     $$PWD/storage/StorageEvent.idl \
     $$PWD/storage/StorageInfo.idl \
     $$PWD/storage/StorageInfoErrorCallback.idl \
     $$PWD/storage/StorageInfoQuotaCallback.idl \
     $$PWD/storage/StorageInfoUsageCallback.idl \
-    $$PWD/storage/SQLError.idl \
-    $$PWD/storage/SQLException.idl \
-    $$PWD/storage/SQLResultSet.idl \
-    $$PWD/storage/SQLResultSetRowList.idl \
-    $$PWD/storage/SQLStatementCallback.idl \
-    $$PWD/storage/SQLStatementErrorCallback.idl \
-    $$PWD/storage/SQLTransaction.idl \
-    $$PWD/storage/SQLTransactionCallback.idl \
-    $$PWD/storage/SQLTransactionErrorCallback.idl \
-    $$PWD/storage/SQLTransactionSync.idl \
-    $$PWD/storage/SQLTransactionSyncCallback.idl \
     $$PWD/testing/Internals.idl \
     $$PWD/testing/InternalSettings.idl \
     $$PWD/webaudio/AudioBuffer.idl \
@@ -426,18 +432,13 @@ IDL_BINDINGS += \
     $$PWD/webaudio/JavaScriptAudioNode.idl \
     $$PWD/webaudio/LowPass2FilterNode.idl \
     $$PWD/webaudio/RealtimeAnalyserNode.idl \
-    $$PWD/websockets/CloseEvent.idl \
-    $$PWD/websockets/DOMWindowWebSocket.idl \
-    $$PWD/websockets/WebSocket.idl \
     $$PWD/workers/AbstractWorker.idl \
-    $$PWD/workers/DOMWindowWorker.idl \
     $$PWD/workers/DedicatedWorkerContext.idl \
     $$PWD/workers/SharedWorker.idl \
     $$PWD/workers/SharedWorkerContext.idl \
     $$PWD/workers/Worker.idl \
     $$PWD/workers/WorkerContext.idl \
     $$PWD/workers/WorkerLocation.idl \
-    $$PWD/xml/DOMWindowXML.idl \
     $$PWD/xml/DOMParser.idl \
     $$PWD/xml/XMLHttpRequest.idl \
     $$PWD/xml/XMLHttpRequestException.idl \
@@ -460,7 +461,6 @@ v8 {
 
 contains(DEFINES, ENABLE_SVG=1) {
   IDL_BINDINGS += \
-    $$PWD/svg/DOMWindowSVG.idl \
     $$PWD/svg/SVGZoomEvent.idl \
     $$PWD/svg/SVGAElement.idl \
     $$PWD/svg/SVGAltGlyphDefElement.idl \
@@ -665,23 +665,28 @@ GENERATORS += cssvalues
 # GENERATOR 0: Resolve [Supplemental] dependency in IDLs
 SUPPLEMENTAL_DEPENDENCY_FILE = supplemental_dependency.tmp
 IDL_FILES_TMP = ${QMAKE_FUNC_FILE_OUT_PATH}/idl_files.tmp
-RESOLVE_SUPPLEMENTAL_SCRIPT = $$PWD/bindings/scripts/resolve-supplemental.pl
+PREPROCESS_IDLS_SCRIPT = $$PWD/bindings/scripts/preprocess-idls.pl
 IDL_ATTRIBUTES_FILE = $$PWD/bindings/scripts/IDLAttributes.txt
 
-resolveSupplemental.input = IDL_ATTRIBUTES_FILE
-resolveSupplemental.script = $$RESOLVE_SUPPLEMENTAL_SCRIPT
+preprocessIdls.input = IDL_ATTRIBUTES_FILE
+preprocessIdls.script = $$PREPROCESS_IDLS_SCRIPT
 # FIXME : We need to use only perl at some point.
-resolveSupplemental.commands = echo $$IDL_BINDINGS | tr \' \' \'\\n\' > $$IDL_FILES_TMP && \
-                               perl -I$$PWD/bindings/scripts $$resolveSupplemental.script \
+EOC = $$escape_expand(\\n\\t)
+win_cmd_shell: preprocessIdls.commands = type nul > $$IDL_FILES_TMP $$EOC
+else: preprocessIdls.commands = cat /dev/null > $$IDL_FILES_TMP $$EOC
+for(binding, IDL_BINDINGS) {
+    preprocessIdls.commands += echo $$binding >> $$IDL_FILES_TMP $$EOC
+}
+preprocessIdls.commands += perl -I$$PWD/bindings/scripts $$preprocessIdls.script \
                                --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" \
                                --idlFilesList $$IDL_FILES_TMP \
                                --supplementalDependencyFile ${QMAKE_FUNC_FILE_OUT_PATH}/$$SUPPLEMENTAL_DEPENDENCY_FILE \
                                --idlAttributesFile $${IDL_ATTRIBUTES_FILE} \
                                --preprocessor \"$${QMAKE_MOC} -E\"
-resolveSupplemental.output = $$SUPPLEMENTAL_DEPENDENCY_FILE
-resolveSupplemental.add_output_to_sources = false
-resolveSupplemental.depends = $$PWD/bindings/scripts/IDLParser.pm $$IDL_BINDINGS
-GENERATORS += resolveSupplemental
+preprocessIdls.output = $$SUPPLEMENTAL_DEPENDENCY_FILE
+preprocessIdls.add_output_to_sources = false
+preprocessIdls.depends = $$PWD/bindings/scripts/IDLParser.pm $$IDL_BINDINGS
+GENERATORS += preprocessIdls
 
 # GENERATOR 1: Generate .h and .cpp from IDLs
 generateBindings.input = IDL_BINDINGS
@@ -692,6 +697,9 @@ generateBindings.commands = perl -I$$PWD/bindings/scripts $$generateBindings.scr
                             --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" \
                             --generator $$generator \
                             --include $$PWD/Modules/geolocation \
+                            --include $$PWD/Modules/indexeddb \
+                            --include $$PWD/Modules/webdatabase \
+                            --include $$PWD/Modules/websockets \
                             --include $$PWD/dom \
                             --include $$PWD/fileapi \
                             --include $$PWD/html \
@@ -814,10 +822,10 @@ GENERATORS += fontnames
 
 # GENERATOR 5-E:
 eventfactory.output = EventFactory.cpp
-eventfactory.input = EVENT_FACTORY
+eventfactory.input = EVENTS_NAMES
 eventfactory.script = $$PWD/dom/make_event_factory.pl
-eventfactory.commands = perl -I$$PWD/bindings/scripts $$eventfactory.script --input $$EVENT_FACTORY --outputDir ${QMAKE_FUNC_FILE_OUT_PATH}
-eventfactory.depends = $$PWD/dom/make_event_factory.pl $$EVENT_FACTORY
+eventfactory.commands = perl -I$$PWD/bindings/scripts $$eventfactory.script --input $$EVENTS_NAMES --outputDir ${QMAKE_FUNC_FILE_OUT_PATH}
+eventfactory.depends = $$PWD/dom/make_event_factory.pl $$EVENTS_NAMES
 GENERATORS += eventfactory
 
 # GENERATOR 5-F:
diff --git a/Source/WebCore/English.lproj/Localizable.strings b/Source/WebCore/English.lproj/Localizable.strings
index 0c2378a0e..100ec3fc3 100644
--- a/Source/WebCore/English.lproj/Localizable.strings
+++ b/Source/WebCore/English.lproj/Localizable.strings
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index cadf49ee2..648eb5112 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ASCIICType.h b/Source/WebCore/ForwardingHeaders/wtf/ASCIICType.h
deleted file mode 100644
index 5851cc6f4..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ASCIICType.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ASCIICType_h
-#define WebCore_FWD_ASCIICType_h
-#include <JavaScriptCore/ASCIICType.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/AVLTree.h b/Source/WebCore/ForwardingHeaders/wtf/AVLTree.h
deleted file mode 100644
index 151b7f7ce..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/AVLTree.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_AVLTree_h
-#define WebCore_FWD_AVLTree_h
-#include <JavaScriptCore/AVLTree.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Alignment.h b/Source/WebCore/ForwardingHeaders/wtf/Alignment.h
deleted file mode 100644
index 3754945be..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Alignment.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Alignment_h
-#define WebCore_FWD_Alignment_h
-#include <JavaScriptCore/Alignment.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/AlwaysInline.h b/Source/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
deleted file mode 100644
index e23416262..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_AlwaysInline_h
-#define WebCore_FWD_AlwaysInline_h
-#include <JavaScriptCore/AlwaysInline.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ArrayBuffer.h b/Source/WebCore/ForwardingHeaders/wtf/ArrayBuffer.h
deleted file mode 100644
index 687d98c8a..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ArrayBuffer.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ArrayBuffer_h
-#define WebCore_FWD_ArrayBuffer_h
-#include <JavaScriptCore/ArrayBuffer.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ArrayBufferView.h b/Source/WebCore/ForwardingHeaders/wtf/ArrayBufferView.h
deleted file mode 100644
index de3952669..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ArrayBufferView.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ArrayBufferView_h
-#define WebCore_FWD_ArrayBufferView_h
-#include <JavaScriptCore/ArrayBufferView.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Assertions.h b/Source/WebCore/ForwardingHeaders/wtf/Assertions.h
deleted file mode 100644
index 5445be411..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Assertions.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Assertions_h
-#define WebCore_FWD_Assertions_h
-#include <JavaScriptCore/Assertions.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Atomics.h b/Source/WebCore/ForwardingHeaders/wtf/Atomics.h
deleted file mode 100644
index 2fee17506..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Atomics.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Atomics_h
-#define WebCore_FWD_Atomics_h
-#include <JavaScriptCore/Atomics.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Bitmap.h b/Source/WebCore/ForwardingHeaders/wtf/Bitmap.h
deleted file mode 100644
index 25fb88593..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Bitmap.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Bitmap_h
-#define WebCore_FWD_Bitmap_h
-#include <JavaScriptCore/Bitmap.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/BloomFilter.h b/Source/WebCore/ForwardingHeaders/wtf/BloomFilter.h
deleted file mode 100644
index 98a67b9cc..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/BloomFilter.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_BloomFilter_h
-#define WebCore_FWD_BloomFilter_h
-#include <JavaScriptCore/BloomFilter.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/BumpPointerAllocator.h b/Source/WebCore/ForwardingHeaders/wtf/BumpPointerAllocator.h
deleted file mode 100644
index 25acbf4bc..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/BumpPointerAllocator.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_BumpPointerAllocator_h
-#define WebCore_FWD_BumpPointerAllocator_h
-#include <JavaScriptCore/BumpPointerAllocator.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ByteArray.h b/Source/WebCore/ForwardingHeaders/wtf/ByteArray.h
deleted file mode 100644
index 9c078c9fd..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ByteArray.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ByteArray_h
-#define WebCore_FWD_ByteArray_h
-#include <JavaScriptCore/ByteArray.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/CheckedArithmetic.h b/Source/WebCore/ForwardingHeaders/wtf/CheckedArithmetic.h
deleted file mode 100644
index bc48ae52e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/CheckedArithmetic.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_CheckedArithmetic_h
-#define WebCore_FWD_CheckedArithmetic_h
-#include <JavaScriptCore/CheckedArithmetic.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/CheckedBoolean.h b/Source/WebCore/ForwardingHeaders/wtf/CheckedBoolean.h
deleted file mode 100644
index 79e051ce3..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/CheckedBoolean.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/CheckedBoolean.h>
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Compiler.h b/Source/WebCore/ForwardingHeaders/wtf/Compiler.h
deleted file mode 100644
index 596c50a03..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Compiler.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Compiler_h
-#define WebCore_FWD_Compiler_h
-#include <JavaScriptCore/Compiler.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Complex.h b/Source/WebCore/ForwardingHeaders/wtf/Complex.h
deleted file mode 100644
index 1234f8aba..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Complex.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Complex_h
-#define WebCore_FWD_Complex_h
-#include <JavaScriptCore/Complex.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/CryptographicallyRandomNumber.h b/Source/WebCore/ForwardingHeaders/wtf/CryptographicallyRandomNumber.h
deleted file mode 100644
index 6c36f9b8d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/CryptographicallyRandomNumber.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_CryptographicallyRandomNumber_h
-#define WebCore_FWD_CryptographicallyRandomNumber_h
-#include <JavaScriptCore/CryptographicallyRandomNumber.h>
-#endif
-
diff --git a/Source/WebCore/ForwardingHeaders/wtf/CurrentTime.h b/Source/WebCore/ForwardingHeaders/wtf/CurrentTime.h
deleted file mode 100644
index 00709150c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/CurrentTime.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_CurrentTime_h
-#define WebCore_FWD_CurrentTime_h
-#include <JavaScriptCore/CurrentTime.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DataLog.h b/Source/WebCore/ForwardingHeaders/wtf/DataLog.h
deleted file mode 100644
index 1be170fcb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DataLog.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DataLog_h
-#define WebCore_FWD_DataLog_h
-#include <JavaScriptCore/DataLog.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h b/Source/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h
deleted file mode 100644
index f39bdee4b..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DateInstanceCache_h
-#define WebCore_FWD_DateInstanceCache_h
-#include <JavaScriptCore/DateInstanceCache.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DateMath.h b/Source/WebCore/ForwardingHeaders/wtf/DateMath.h
deleted file mode 100644
index 4135742f2..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DateMath.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DateMath_h
-#define WebCore_FWD_DateMath_h
-#include <JavaScriptCore/DateMath.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DecimalNumber.h b/Source/WebCore/ForwardingHeaders/wtf/DecimalNumber.h
deleted file mode 100644
index 333174d58..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DecimalNumber.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DecimalNumber_h
-#define WebCore_FWD_DecimalNumber_h
-#include <JavaScriptCore/DecimalNumber.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Decoder.h b/Source/WebCore/ForwardingHeaders/wtf/Decoder.h
deleted file mode 100644
index e82373e26..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Decoder.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Decoder_h
-#define WebCore_FWD_Decoder_h
-#include <JavaScriptCore/Decoder.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Deque.h b/Source/WebCore/ForwardingHeaders/wtf/Deque.h
deleted file mode 100644
index a4eee78e4..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Deque.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Deque_h
-#define WebCore_FWD_Deque_h
-#include <JavaScriptCore/Deque.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DisallowCType.h b/Source/WebCore/ForwardingHeaders/wtf/DisallowCType.h
deleted file mode 100644
index c4d59aca7..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DisallowCType.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DisallowCType_h
-#define WebCore_FWD_DisallowCType_h
-#include <JavaScriptCore/DisallowCType.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DoublyLinkedList.h b/Source/WebCore/ForwardingHeaders/wtf/DoublyLinkedList.h
deleted file mode 100644
index 86c8f7a1c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DoublyLinkedList.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DoublyLinkedList_h
-#define WebCore_FWD_DoublyLinkedList_h
-#include <JavaScriptCore/DoublyLinkedList.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DynamicAnnotations.h b/Source/WebCore/ForwardingHeaders/wtf/DynamicAnnotations.h
deleted file mode 100644
index e5a2f2d3c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DynamicAnnotations.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DynamicAnnotations_h
-#define WebCore_FWD_DynamicAnnotations_h
-#include <JavaScriptCore/DynamicAnnotations.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Encoder.h b/Source/WebCore/ForwardingHeaders/wtf/Encoder.h
deleted file mode 100644
index 773ad37b4..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Encoder.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Encoder_h
-#define WebCore_FWD_Encoder_h
-#include <JavaScriptCore/Encoder.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ExportMacros.h b/Source/WebCore/ForwardingHeaders/wtf/ExportMacros.h
deleted file mode 100644
index b0b7e44a4..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ExportMacros.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ExportMacros_h
-#define WebCore_FWD_ExportMacros_h
-#include <JavaScriptCore/ExportMacros.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/FastAllocBase.h b/Source/WebCore/ForwardingHeaders/wtf/FastAllocBase.h
deleted file mode 100644
index 6e50bd805..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/FastAllocBase.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_FastAllocBase_h
-#define WebCore_FWD_FastAllocBase_h
-#include <JavaScriptCore/FastAllocBase.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/FastMalloc.h b/Source/WebCore/ForwardingHeaders/wtf/FastMalloc.h
deleted file mode 100644
index b883c0b32..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/FastMalloc.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_FastMalloc_h
-#define WebCore_FWD_FastMalloc_h
-#include <JavaScriptCore/FastMalloc.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/FixedArray.h b/Source/WebCore/ForwardingHeaders/wtf/FixedArray.h
deleted file mode 100644
index fc8dd7e4a..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/FixedArray.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_FixedArray_h
-#define WebCore_FWD_FixedArray_h
-#include <JavaScriptCore/FixedArray.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Float32Array.h b/Source/WebCore/ForwardingHeaders/wtf/Float32Array.h
deleted file mode 100644
index b2453dd21..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Float32Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Float32Array_h
-#define WebCore_FWD_Float32Array_h
-#include <JavaScriptCore/Float32Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Float64Array.h b/Source/WebCore/ForwardingHeaders/wtf/Float64Array.h
deleted file mode 100644
index e7e35aadc..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Float64Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Float64Array_h
-#define WebCore_FWD_Float64Array_h
-#include <JavaScriptCore/Float64Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Forward.h b/Source/WebCore/ForwardingHeaders/wtf/Forward.h
deleted file mode 100644
index 3e6b8c843..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Forward.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Forward_h
-#define WebCore_FWD_Forward_h
-#include <JavaScriptCore/Forward.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Functional.h b/Source/WebCore/ForwardingHeaders/wtf/Functional.h
deleted file mode 100644
index 44313274d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Functional.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Functional_h
-#define WebCore_FWD_Functional_h
-#include <JavaScriptCore/Functional.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/GetPtr.h b/Source/WebCore/ForwardingHeaders/wtf/GetPtr.h
deleted file mode 100644
index 5a36ce210..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/GetPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_GetPtr_h
-#define WebCore_FWD_GetPtr_h
-#include <JavaScriptCore/GetPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashCountedSet.h b/Source/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
deleted file mode 100644
index c92e9f01d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashCountedSet_h
-#define WebCore_FWD_HashCountedSet_h
-#include <JavaScriptCore/HashCountedSet.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashFunctions.h b/Source/WebCore/ForwardingHeaders/wtf/HashFunctions.h
deleted file mode 100644
index 65e110ddb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashFunctions.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashFunctions_h
-#define WebCore_FWD_HashFunctions_h
-#include <JavaScriptCore/HashFunctions.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashMap.h b/Source/WebCore/ForwardingHeaders/wtf/HashMap.h
deleted file mode 100644
index 68ea68e19..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashMap.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashMap_h
-#define WebCore_FWD_HashMap_h
-#include <JavaScriptCore/HashMap.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashSet.h b/Source/WebCore/ForwardingHeaders/wtf/HashSet.h
deleted file mode 100644
index a4cf32bad..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashSet.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashSet_h
-#define WebCore_FWD_HashSet_h
-#include <JavaScriptCore/HashSet.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashTable.h b/Source/WebCore/ForwardingHeaders/wtf/HashTable.h
deleted file mode 100644
index 5975685f0..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashTable.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashTable_h
-#define WebCore_FWD_HashTable_h
-#include <JavaScriptCore/HashTable.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashTraits.h b/Source/WebCore/ForwardingHeaders/wtf/HashTraits.h
deleted file mode 100644
index 3cf24cb06..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashTraits.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashTraits_h
-#define WebCore_FWD_HashTraits_h
-#include <JavaScriptCore/HashTraits.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h b/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h
deleted file mode 100644
index d17b95e45..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HexNumber_h
-#define WebCore_FWD_HexNumber_h
-#include <JavaScriptCore/HexNumber.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Int16Array.h b/Source/WebCore/ForwardingHeaders/wtf/Int16Array.h
deleted file mode 100644
index 45d00399d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Int16Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Int16Array_h
-#define WebCore_FWD_Int16Array_h
-#include <JavaScriptCore/Int16Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Int32Array.h b/Source/WebCore/ForwardingHeaders/wtf/Int32Array.h
deleted file mode 100644
index 7b65741d7..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Int32Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Int32Array_h
-#define WebCore_FWD_Int32Array_h
-#include <JavaScriptCore/Int32Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Int8Array.h b/Source/WebCore/ForwardingHeaders/wtf/Int8Array.h
deleted file mode 100644
index 6b6ad5274..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Int8Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Int8Array_h
-#define WebCore_FWD_Int8Array_h
-#include <JavaScriptCore/Int8Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ListHashSet.h b/Source/WebCore/ForwardingHeaders/wtf/ListHashSet.h
deleted file mode 100644
index c528b78dc..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ListHashSet.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ListHashSet_h
-#define WebCore_FWD_ListHashSet_h
-#include <JavaScriptCore/ListHashSet.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ListRefPtr.h b/Source/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
deleted file mode 100644
index 379adfb9f..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ListRefPtr_h
-#define WebCore_FWD_ListRefPtr_h
-#include <JavaScriptCore/ListRefPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Locker.h b/Source/WebCore/ForwardingHeaders/wtf/Locker.h
deleted file mode 100644
index 4dbe13e90..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Locker.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Locker_h
-#define WebCore_FWD_Locker_h
-#include <JavaScriptCore/Locker.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MD5.h b/Source/WebCore/ForwardingHeaders/wtf/MD5.h
deleted file mode 100644
index 0c657860b..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MD5.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_MD5_h
-#define WebCore_FWD_MD5_h
-#include <JavaScriptCore/MD5.h>
-#endif
-
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MainThread.h b/Source/WebCore/ForwardingHeaders/wtf/MainThread.h
deleted file mode 100644
index 2d8e280fa..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MainThread.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_MainThread_h
-#define WebCore_FWD_MainThread_h
-#include <JavaScriptCore/MainThread.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MathExtras.h b/Source/WebCore/ForwardingHeaders/wtf/MathExtras.h
deleted file mode 100644
index 8594e644e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MathExtras.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_MathExtras_h
-#define WebCore_FWD_MathExtras_h
-#include <JavaScriptCore/MathExtras.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MessageQueue.h b/Source/WebCore/ForwardingHeaders/wtf/MessageQueue.h
deleted file mode 100644
index c597e0883..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MessageQueue.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_MessageQueue_h
-#define WebCore_FWD_MessageQueue_h
-#include <JavaScriptCore/MessageQueue.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MetaAllocator.h b/Source/WebCore/ForwardingHeaders/wtf/MetaAllocator.h
deleted file mode 100644
index 7457af54e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MetaAllocator.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_MetaAllocator_h
-#define WebCore_FWD_MetaAllocator_h
-#include <JavaScriptCore/MetaAllocator.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MetaAllocatorHandle.h b/Source/WebCore/ForwardingHeaders/wtf/MetaAllocatorHandle.h
deleted file mode 100644
index a17b08ee0..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MetaAllocatorHandle.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/MetaAllocatorHandle.h>
diff --git a/Source/WebCore/ForwardingHeaders/wtf/NonCopyingSort.h b/Source/WebCore/ForwardingHeaders/wtf/NonCopyingSort.h
deleted file mode 100644
index d30e61f31..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/NonCopyingSort.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_NonCopyingSort_h
-#define WebCore_FWD_NonCopyingSort_h
-#include <JavaScriptCore/NonCopyingSort.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Noncopyable.h b/Source/WebCore/ForwardingHeaders/wtf/Noncopyable.h
deleted file mode 100644
index c5126776a..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Noncopyable.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Noncopyable_h
-#define WebCore_FWD_Noncopyable_h
-#include <JavaScriptCore/Noncopyable.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/NotFound.h b/Source/WebCore/ForwardingHeaders/wtf/NotFound.h
deleted file mode 100644
index 17576837e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/NotFound.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_NotFound_h
-#define WebCore_FWD_NotFound_h
-#include <JavaScriptCore/NotFound.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/OSAllocator.h b/Source/WebCore/ForwardingHeaders/wtf/OSAllocator.h
deleted file mode 100644
index 637611adb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/OSAllocator.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/OSAllocator.h>
diff --git a/Source/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h b/Source/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
deleted file mode 100644
index 7700641f6..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_OwnArrayPtr_h
-#define WebCore_FWD_OwnArrayPtr_h
-#include <JavaScriptCore/OwnArrayPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/OwnPtr.h b/Source/WebCore/ForwardingHeaders/wtf/OwnPtr.h
deleted file mode 100644
index 977382d9e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/OwnPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_OwnPtr_h
-#define WebCore_FWD_OwnPtr_h
-#include <JavaScriptCore/OwnPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h b/Source/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h
deleted file mode 100644
index 58260316e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PassOwnPtr_h
-#define WebCore_FWD_PassOwnPtr_h
-#include <JavaScriptCore/PassOwnPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PageAllocation.h b/Source/WebCore/ForwardingHeaders/wtf/PageAllocation.h
deleted file mode 100644
index 6471b7332..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PageAllocation.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PageAllocation_h
-#define WebCore_FWD_PageAllocation_h
-#include <JavaScriptCore/PageAllocation.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PageAllocationAligned.h b/Source/WebCore/ForwardingHeaders/wtf/PageAllocationAligned.h
deleted file mode 100644
index 26d221646..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PageAllocationAligned.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PageAllocationAligned_h
-#define WebCore_FWD_PageAllocationAligned_h
-#include <JavaScriptCore/PageAllocationAligned.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PageBlock.h b/Source/WebCore/ForwardingHeaders/wtf/PageBlock.h
deleted file mode 100644
index b616eddf3..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PageBlock.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PageBlock_h
-#define WebCore_FWD_PageBlock_h
-#include <JavaScriptCore/PageBlock.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PageReservation.h b/Source/WebCore/ForwardingHeaders/wtf/PageReservation.h
deleted file mode 100644
index 212b02c7f..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PageReservation.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PageReservation_h
-#define WebCore_FWD_PageReservation_h
-#include <JavaScriptCore/PageReservation.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ParallelJobs.h b/Source/WebCore/ForwardingHeaders/wtf/ParallelJobs.h
deleted file mode 100644
index b064e969c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ParallelJobs.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ParallelJobs_h
-#define WebCore_FWD_ParallelJobs_h
-#include <JavaScriptCore/ParallelJobs.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PassOwnArrayPtr.h b/Source/WebCore/ForwardingHeaders/wtf/PassOwnArrayPtr.h
deleted file mode 100644
index 8202caecd..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PassOwnArrayPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PassOwnArrayPtr_h
-#define WebCore_FWD_PassOwnArrayPtr_h
-#include <JavaScriptCore/PassOwnArrayPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h b/Source/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h
deleted file mode 100644
index 58260316e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PassOwnPtr_h
-#define WebCore_FWD_PassOwnPtr_h
-#include <JavaScriptCore/PassOwnPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PassRefPtr.h b/Source/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
deleted file mode 100644
index ef57e5fe2..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PassRefPtr_h
-#define WebCore_FWD_PassRefPtr_h
-#include <JavaScriptCore/PassRefPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Platform.h b/Source/WebCore/ForwardingHeaders/wtf/Platform.h
deleted file mode 100644
index 9f2bb3a4c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Platform.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Platform_h
-#define WebCore_FWD_Platform_h
-#include <JavaScriptCore/Platform.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PossiblyNull.h b/Source/WebCore/ForwardingHeaders/wtf/PossiblyNull.h
deleted file mode 100644
index d52a4a044..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PossiblyNull.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PossiblyNull_h
-#define WebCore_FWD_PossiblyNull_h
-#include <JavaScriptCore/PossiblyNull.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RandomNumber.h b/Source/WebCore/ForwardingHeaders/wtf/RandomNumber.h
deleted file mode 100644
index cb156d22d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RandomNumber.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_RandomNumber_h
-#define WebCore_FWD_RandomNumber_h
-#include <JavaScriptCore/RandomNumber.h>
-#endif
-
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RedBlackTree.h b/Source/WebCore/ForwardingHeaders/wtf/RedBlackTree.h
deleted file mode 100644
index bd63b03e8..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RedBlackTree.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_RedBlackTree_h
-#define WebCore_FWD_RedBlackTree_h
-#include <JavaScriptCore/RedBlackTree.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RefCounted.h b/Source/WebCore/ForwardingHeaders/wtf/RefCounted.h
deleted file mode 100644
index c6b2deeb3..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RefCounted.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_RefCounted_h
-#define WebCore_FWD_RefCounted_h
-#include <JavaScriptCore/RefCounted.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h b/Source/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
deleted file mode 100644
index 2abe37e81..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_RefCountedLeakCounter_h
-#define WebCore_FWD_RefCountedLeakCounter_h
-#include <JavaScriptCore/RefCountedLeakCounter.h>
-#endif
-
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RefPtr.h b/Source/WebCore/ForwardingHeaders/wtf/RefPtr.h
deleted file mode 100644
index 594929deb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RefPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_RefPtr_h
-#define WebCore_FWD_RefPtr_h
-#include <JavaScriptCore/RefPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RetainPtr.h b/Source/WebCore/ForwardingHeaders/wtf/RetainPtr.h
deleted file mode 100644
index 1352bd893..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RetainPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_RetainPtr_h
-#define WebCore_FWD_RetainPtr_h
-#include <JavaScriptCore/RetainPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/SHA1.h b/Source/WebCore/ForwardingHeaders/wtf/SHA1.h
deleted file mode 100644
index 8bb48b240..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/SHA1.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_SHA1_h
-#define WebCore_FWD_SHA1_h
-#include <JavaScriptCore/SHA1.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/SegmentedVector.h b/Source/WebCore/ForwardingHeaders/wtf/SegmentedVector.h
deleted file mode 100644
index 5aa39a4b6..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/SegmentedVector.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_SegmentedVector_h
-#define WebCore_FWD_SegmentedVector_h
-#include <JavaScriptCore/SegmentedVector.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Spectrum.h b/Source/WebCore/ForwardingHeaders/wtf/Spectrum.h
deleted file mode 100644
index ccf503206..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Spectrum.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/Spectrum.h>
diff --git a/Source/WebCore/ForwardingHeaders/wtf/StackBounds.h b/Source/WebCore/ForwardingHeaders/wtf/StackBounds.h
deleted file mode 100644
index 770265e32..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/StackBounds.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StackBounds_h
-#define WebCore_FWD_StackBounds_h
-#include <JavaScriptCore/StackBounds.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/StaticConstructors.h b/Source/WebCore/ForwardingHeaders/wtf/StaticConstructors.h
deleted file mode 100644
index c8ce157e3..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/StaticConstructors.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StaticConstructors_h
-#define WebCore_FWD_StaticConstructors_h
-#include <JavaScriptCore/StaticConstructors.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/StdLibExtras.h b/Source/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
deleted file mode 100644
index 20032951b..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StdLibExtras_h
-#define WebCore_FWD_StdLibExtras_h
-#include <JavaScriptCore/StdLibExtras.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/StringExtras.h b/Source/WebCore/ForwardingHeaders/wtf/StringExtras.h
deleted file mode 100644
index d89f2384f..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/StringExtras.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringExtras_h
-#define WebCore_FWD_StringExtras_h
-#include <JavaScriptCore/StringExtras.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/StringHasher.h b/Source/WebCore/ForwardingHeaders/wtf/StringHasher.h
deleted file mode 100644
index fbc0d8d72..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/StringHasher.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringHasher_h
-#define WebCore_FWD_StringHasher_h
-#include <JavaScriptCore/StringHasher.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/TemporaryChange.h b/Source/WebCore/ForwardingHeaders/wtf/TemporaryChange.h
deleted file mode 100644
index 4e475df15..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/TemporaryChange.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_TemporaryChange_h
-#define WebCore_FWD_TemporaryChange_h
-#include <JavaScriptCore/TemporaryChange.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadRestrictionVerifier.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadRestrictionVerifier.h
deleted file mode 100644
index 8442d1cba..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ThreadRestrictionVerifier.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ThreadRestrictionVerifier_h
-#define WebCore_FWD_ThreadRestrictionVerifier_h
-#include <JavaScriptCore/ThreadRestrictionVerifier.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
deleted file mode 100644
index d7a35f882..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ThreadSafeRefCounted_h
-#define WebCore_FWD_ThreadSafeRefCounted_h
-#include <JavaScriptCore/ThreadSafeRefCounted.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
deleted file mode 100644
index 1e5474ffb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ThreadSpecific_h
-#define WebCore_FWD_ThreadSpecific_h
-#include <JavaScriptCore/ThreadSpecific.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Threading.h b/Source/WebCore/ForwardingHeaders/wtf/Threading.h
deleted file mode 100644
index ad2984721..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Threading.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Threading_h
-#define WebCore_FWD_Threading_h
-#include <JavaScriptCore/Threading.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadingPrimitives.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadingPrimitives.h
deleted file mode 100644
index 5dd2e0301..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ThreadingPrimitives.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ThreadingPrimitives_h
-#define WebCore_FWD_ThreadingPrimitives_h
-#include <JavaScriptCore/ThreadingPrimitives.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/TypeTraits.h b/Source/WebCore/ForwardingHeaders/wtf/TypeTraits.h
deleted file mode 100644
index a4ae09fac..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/TypeTraits.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_TypeTraits_h
-#define WebCore_FWD_TypeTraits_h
-#include <JavaScriptCore/TypeTraits.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Uint16Array.h b/Source/WebCore/ForwardingHeaders/wtf/Uint16Array.h
deleted file mode 100644
index cccea2c1b..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Uint16Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Uint16Array_h
-#define WebCore_FWD_Uint16Array_h
-#include <JavaScriptCore/Uint16Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Uint32Array.h b/Source/WebCore/ForwardingHeaders/wtf/Uint32Array.h
deleted file mode 100644
index f6026f15c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Uint32Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Uint32Array_h
-#define WebCore_FWD_Uint32Array_h
-#include <JavaScriptCore/Uint32Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Uint8Array.h b/Source/WebCore/ForwardingHeaders/wtf/Uint8Array.h
deleted file mode 100644
index 4c8de4ea7..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Uint8Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Uint8Array_h
-#define WebCore_FWD_Uint8Array_h
-#include <JavaScriptCore/Uint8Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Uint8ClampedArray.h b/Source/WebCore/ForwardingHeaders/wtf/Uint8ClampedArray.h
deleted file mode 100644
index 27d2e01d1..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Uint8ClampedArray.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Uint8ClampedArray_h
-#define WebCore_FWD_Uint8ClampedArray_h
-#include <JavaScriptCore/Uint8ClampedArray.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/UnusedParam.h b/Source/WebCore/ForwardingHeaders/wtf/UnusedParam.h
deleted file mode 100644
index 5202740c0..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/UnusedParam.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_UnusedParam_h
-#define WebCore_FWD_UnusedParam_h
-#include <JavaScriptCore/UnusedParam.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/VMTags.h b/Source/WebCore/ForwardingHeaders/wtf/VMTags.h
deleted file mode 100644
index ffd1e128e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/VMTags.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_VMTags_h
-#define WebCore_FWD_VMTags_h
-#include <JavaScriptCore/VMTags.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ValueCheck.h b/Source/WebCore/ForwardingHeaders/wtf/ValueCheck.h
deleted file mode 100644
index 4667674eb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ValueCheck.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ValueCheck_h
-#define WebCore_FWD_ValueCheck_h
-#include <JavaScriptCore/ValueCheck.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Vector.h b/Source/WebCore/ForwardingHeaders/wtf/Vector.h
deleted file mode 100644
index 2c1cf7b97..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Vector.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Vector_h
-#define WebCore_FWD_Vector_h
-#include <JavaScriptCore/Vector.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/VectorTraits.h b/Source/WebCore/ForwardingHeaders/wtf/VectorTraits.h
deleted file mode 100644
index 87a38229e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/VectorTraits.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_VectorTraits_h
-#define WebCore_FWD_VectorTraits_h
-#include <JavaScriptCore/VectorTraits.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/WTFThreadData.h b/Source/WebCore/ForwardingHeaders/wtf/WTFThreadData.h
deleted file mode 100644
index a08417a51..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/WTFThreadData.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_WTFThreadData_h
-#define WebCore_FWD_WTFThreadData_h
-#include <JavaScriptCore/WTFThreadData.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/dtoa.h b/Source/WebCore/ForwardingHeaders/wtf/dtoa.h
deleted file mode 100644
index 7fd92652f..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/dtoa.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_dtoa_h
-#define WebCore_FWD_dtoa_h
-#include <JavaScriptCore/dtoa.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/dtoa/double-conversion.h b/Source/WebCore/ForwardingHeaders/wtf/dtoa/double-conversion.h
deleted file mode 100644
index 86fb12789..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/dtoa/double-conversion.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_double_conversion_h
-#define WebCore_FWD_double_conversion_h
-#include <JavaScriptCore/double-conversion.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/ASCIIFastPath.h b/Source/WebCore/ForwardingHeaders/wtf/text/ASCIIFastPath.h
deleted file mode 100644
index 837357d16..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/ASCIIFastPath.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ASCIIFastPath_h
-#define WebCore_FWD_ASCIIFastPath_h
-#include <JavaScriptCore/ASCIIFastPath.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicString.h b/Source/WebCore/ForwardingHeaders/wtf/text/AtomicString.h
deleted file mode 100644
index 83289d2a5..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicString.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_AtomicString_h
-#define WebCore_FWD_AtomicString_h
-#include <JavaScriptCore/AtomicString.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringHash.h b/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringHash.h
deleted file mode 100644
index 3ca1b77d5..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringHash.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_AtomicStringHash_h
-#define WebCore_FWD_AtomicStringHash_h
-#include <JavaScriptCore/AtomicStringHash.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringImpl.h b/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringImpl.h
deleted file mode 100644
index 87214a10c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringImpl.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_AtomicStringImpl_h
-#define WebCore_FWD_AtomicStringImpl_h
-#include <JavaScriptCore/AtomicStringImpl.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/CString.h b/Source/WebCore/ForwardingHeaders/wtf/text/CString.h
deleted file mode 100644
index a8c2ac98a..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/CString.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_CString_h
-#define WebCore_FWD_CString_h
-#include <JavaScriptCore/CString.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/StringBuffer.h b/Source/WebCore/ForwardingHeaders/wtf/text/StringBuffer.h
deleted file mode 100644
index 0b5324049..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/StringBuffer.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringBuffer_h
-#define WebCore_FWD_StringBuffer_h
-#include <JavaScriptCore/StringBuffer.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/StringBuilder.h b/Source/WebCore/ForwardingHeaders/wtf/text/StringBuilder.h
deleted file mode 100644
index 115db065a..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/StringBuilder.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringBuilder_h
-#define WebCore_FWD_StringBuilder_h
-#include <JavaScriptCore/StringBuilder.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/StringConcatenate.h b/Source/WebCore/ForwardingHeaders/wtf/text/StringConcatenate.h
deleted file mode 100644
index 666ac0855..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/StringConcatenate.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringConcatenate_h
-#define WebCore_FWD_StringConcatenate_h
-#include <JavaScriptCore/StringConcatenate.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/StringHash.h b/Source/WebCore/ForwardingHeaders/wtf/text/StringHash.h
deleted file mode 100644
index f56c7b5be..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/StringHash.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringHash_h
-#define WebCore_FWD_StringHash_h
-#include <JavaScriptCore/StringHash.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/StringImpl.h b/Source/WebCore/ForwardingHeaders/wtf/text/StringImpl.h
deleted file mode 100644
index 3e506d44b..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/StringImpl.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringImpl_h
-#define WebCore_FWD_StringImpl_h
-#include <JavaScriptCore/StringImpl.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/TextPosition.h b/Source/WebCore/ForwardingHeaders/wtf/text/TextPosition.h
deleted file mode 100644
index 16009846e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/TextPosition.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_TextPosition_h
-#define WebCore_FWD_TextPosition_h
-#include <JavaScriptCore/TextPosition.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/WTFString.h b/Source/WebCore/ForwardingHeaders/wtf/text/WTFString.h
deleted file mode 100644
index 4b9f31d16..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/WTFString.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_WTFString_h
-#define WebCore_FWD_WTFString_h
-#include <JavaScriptCore/WTFString.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/CharacterNames.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/CharacterNames.h
deleted file mode 100644
index 551864209..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/CharacterNames.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_CharacterNames_h
-#define WebCore_FWD_CharacterNames_h
-#include <JavaScriptCore/CharacterNames.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/Collator.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
deleted file mode 100644
index f28a11728..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Collator_h
-#define WebCore_FWD_Collator_h
-#include <JavaScriptCore/Collator.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
deleted file mode 100644
index b9daa435d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_UTF8_h
-#define WebCore_FWD_UTF8_h
-#include <JavaScriptCore/UTF8.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
deleted file mode 100644
index 9f06747f1..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Unicode_h
-#define WebCore_FWD_Unicode_h
-#include <JavaScriptCore/Unicode.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
deleted file mode 100644
index 4819f476f..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_UnicodeIcu_h
-#define WebCore_FWD_UnicodeIcu_h
-#include <JavaScriptCore/UnicodeIcu.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/wince/UnicodeWince.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/wince/UnicodeWince.h
deleted file mode 100644
index 6d63d31d3..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/wince/UnicodeWince.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_UnicodeWince_h
-#define WebCore_FWD_UnicodeWince_h
-#include <JavaScriptCore/UnicodeWince.h>
-#endif
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index 2df6a36d6..ebdcc8fcc 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -12,6 +12,10 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/ThirdParty/ANGLE/include/GLSLANG \
 	-I$(srcdir)/Source/WebCore \
 	-I$(srcdir)/Source/WebCore/Modules/geolocation \
+	-I$(srcdir)/Source/WebCore/Modules/indexeddb \
+	-I$(srcdir)/Source/WebCore/Modules/mediastream \
+	-I$(srcdir)/Source/WebCore/Modules/webdatabase \
+	-I$(srcdir)/Source/WebCore/Modules/websockets \
 	-I$(srcdir)/Source/WebCore/accessibility \
 	-I$(srcdir)/Source/WebCore/bindings \
 	-I$(srcdir)/Source/WebCore/bindings/generic \
@@ -39,7 +43,6 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/WebCore/loader/cache \
 	-I$(srcdir)/Source/WebCore/loader/icon \
 	-I$(srcdir)/Source/WebCore/mathml \
-	-I$(srcdir)/Source/WebCore/mediastream \
 	-I$(srcdir)/Source/WebCore/notifications \
 	-I$(srcdir)/Source/WebCore/page \
 	-I$(srcdir)/Source/WebCore/page/animation \
@@ -110,6 +113,12 @@ webcoregtk_cppflags += \
 	-I$(srcdir)/Source/WebCore/platform/network/soup
 
 # ---
+# Features enabled by default at compilation time
+# ---
+FEATURE_DEFINES += ENABLE_SMOOTH_SCROLLING=1
+webcore_cppflags += -DENABLE_SMOOTH_SCROLLING=1
+
+# ---
 # Channel mesaging support
 # ---
 if ENABLE_CHANNEL_MESSAGING
@@ -295,6 +304,16 @@ webcore_cppflags += -DENABLE_INPUT_SPEECH=0
 endif # END ENABLE_INPUT_SPEECH
 
 # ----
+# Scripted Speech API support
+# ----
+if ENABLE_SCRIPTED_SPEECH
+FEATURE_DEFINES += ENABLE_SCRIPTED_SPEECH=1
+webcore_cppflags += -DENABLE_SCRIPTED_SPEECH=1
+else
+webcore_cppflags += -DENABLE_SCRIPTED_SPEECH=0
+endif # END ENABLE_SCRIPTED_SPEECH
+
+# ----
 # Icon Database Support
 # ----
 if ENABLE_ICONDATABASE
@@ -464,8 +483,8 @@ DerivedSources/WebCore/MathMLElementFactory.cpp DerivedSources/WebCore/MathMLNam
 # Notifications support
 # ----
 if ENABLE_NOTIFICATIONS
-FEATURE_DEFINES += ENABLE_NOTIFICATIONS=1
-webcore_cppflags += -DENABLE_NOTIFICATIONS=1
+FEATURE_DEFINES += ENABLE_NOTIFICATIONS=1 ENABLE_LEGACY_NOTIFICATIONS=1
+webcore_cppflags += -DENABLE_NOTIFICATIONS=1 -DENABLE_LEGACY_NOTIFICATIONS=1
 endif # END ENABLE_NOTIFICATIONS
 
 # ----
@@ -686,9 +705,9 @@ SCRIPTS_FOR_GENERATE_BINDINGS = \
 	$(WebCore)/bindings/scripts/generate-bindings.pl \
 	$(WebCore)/bindings/scripts/preprocessor.pm
 
-SCRIPTS_FOR_RESOLVE_SUPPLEMENTAL = \
+SCRIPTS_FOR_PREPROCESS_IDLS = \
 	$(WebCore)/bindings/scripts/IDLParser.pm \
-	$(WebCore)/bindings/scripts/resolve-supplemental.pl
+	$(WebCore)/bindings/scripts/preprocess-idls.pl
 
 DerivedSources/WebCore/UserAgentStyleSheetsData.cpp: DerivedSources/WebCore/UserAgentStyleSheets.h
 DerivedSources/WebCore/UserAgentStyleSheets.h: $(WebCore)/css/make-css-file-arrays.pl $(WebCore)/bindings/scripts/preprocessor.pm $(USER_AGENT_STYLE_SHEETS)
@@ -719,8 +738,8 @@ DerivedSources/WebCore/XMLNSNames.cpp DerivedSources/WebCore/XMLNSNames.h: $(Web
 DerivedSources/WebCore/XMLNames.cpp DerivedSources/WebCore/XMLNames.h: $(WebCore)/dom/make_names.pl $(WebCore)/xml/xmlattrs.in
 	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlattrs.in --outputDir "$(GENSOURCES_WEBCORE)"
 
-DerivedSources/WebCore/EventFactory.cpp DerivedSources/WebCore/EventHeaders.h DerivedSources/WebCore/EventInterfaces.h: $(WebCore)/dom/make_event_factory.pl $(WebCore)/dom/EventFactory.in
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventFactory.in --outputDir "$(GENSOURCES_WEBCORE)"
+DerivedSources/WebCore/EventFactory.cpp DerivedSources/WebCore/EventHeaders.h DerivedSources/WebCore/EventInterfaces.h: $(WebCore)/dom/make_event_factory.pl $(WebCore)/dom/EventNames.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventNames.in --outputDir "$(GENSOURCES_WEBCORE)"
 
 DerivedSources/WebCore/EventTargetHeaders.h DerivedSources/WebCore/EventTargetInterfaces.h: $(WebCore)/dom/make_event_factory.pl $(WebCore)/dom/EventTargetFactory.in
 	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventTargetFactory.in --outputDir "$(GENSOURCES_WEBCORE)"
@@ -760,6 +779,10 @@ DerivedSources/ANGLE/glslang_tab.h: DerivedSources/ANGLE/glslang_tab.cpp
 
 IDL_PATH := \
     $(WebCore)/Modules/geolocation \
+    $(WebCore)/Modules/indexeddb \
+    $(WebCore)/Modules/mediastream \
+    $(WebCore)/Modules/webdatabase \
+    $(WebCore)/Modules/websockets \
     $(WebCore)/bindings/js \
     $(WebCore)/css \
     $(WebCore)/dom \
@@ -771,7 +794,6 @@ IDL_PATH := \
     $(WebCore)/html/track \
     $(WebCore)/inspector \
     $(WebCore)/loader/appcache \
-    $(WebCore)/mediastream \
     $(WebCore)/notifications \
     $(WebCore)/page \
     $(WebCore)/plugins \
@@ -790,11 +812,11 @@ idl_files_list = $(top_builddir)/DerivedSources/WebCore/idl_files_list
 idl_attributes_file = $(WebCore)/bindings/scripts/IDLAttributes.txt
 
 .SECONDARY:
-$(supplemental_dependency_file): $(SCRIPTS_FOR_RESOLVE_SUPPLEMENTAL) $(dom_binding_idls) $(idl_attributes_file)
+$(supplemental_dependency_file): $(SCRIPTS_FOR_PREPROCESS_IDLS) $(dom_binding_idls) $(idl_attributes_file)
 	$(AM_V_GEN)
 	$(AM_V_at)echo -n > $(idl_files_list)
 	$(AM_V_at)($(foreach idl, $(dom_binding_idls), echo $(idl) &&) echo -n) >> $(idl_files_list)
-	$(AM_V_at)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/resolve-supplemental.pl --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --idlFilesList $(idl_files_list) --supplementalDependencyFile $@ --idlAttributesFile $(idl_attributes_file)
+	$(AM_V_at)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/preprocess-idls.pl --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --idlFilesList $(idl_files_list) --supplementalDependencyFile $@ --idlAttributesFile $(idl_attributes_file)
 
 # This does not appear to work correctly with gnumake unless
 # it includes an empty command list (the semicolon).
@@ -899,6 +921,11 @@ libWebCoreGtk_la_CPPFLAGS = \
 	$(XT_CFLAGS)
 
 EXTRA_DIST += \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/geolocation/*.idl) \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/indexeddb/*.idl) \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/mediastream/*.idl) \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/webdatabase/*.idl) \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/websockets/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/css/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/dom/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/fileapi/*.idl) \
@@ -908,7 +935,6 @@ EXTRA_DIST += \
 	$(shell ls $(srcdir)/Source/WebCore/html/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/inspector/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/loader/appcache/*.idl) \
-	$(shell ls $(srcdir)/Source/WebCore/mediastream/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/notifications/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/page/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/plugins/*.idl) \
@@ -916,7 +942,6 @@ EXTRA_DIST += \
 	$(shell ls $(srcdir)/Source/WebCore/svg/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/testing/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/webaudio/*.idl) \
-	$(shell ls $(srcdir)/Source/WebCore/websockets/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/workers/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/xml/*.idl) \
 	Source/ThirdParty/ANGLE/src/compiler/glslang.l \
@@ -924,6 +949,7 @@ EXTRA_DIST += \
 	Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm \
 	Source/WebCore/bindings/scripts/CodeGeneratorJS.pm \
 	Source/WebCore/bindings/scripts/CodeGenerator.pm \
+	Source/WebCore/bindings/scripts/IDLAttributes.txt \
 	Source/WebCore/bindings/scripts/IDLParser.pm \
 	Source/WebCore/bindings/scripts/IDLStructure.pm \
 	Source/WebCore/bindings/scripts/InFilesCompiler.pm \
@@ -931,7 +957,7 @@ EXTRA_DIST += \
 	Source/WebCore/bindings/scripts/generate-bindings.pl \
 	Source/WebCore/bindings/scripts/gobject-generate-headers.pl \
 	Source/WebCore/bindings/scripts/preprocessor.pm \
-	Source/WebCore/bindings/scripts/resolve-supplemental.pl \
+	Source/WebCore/bindings/scripts/preprocess-idls.pl \
 	Source/WebCore/ChangeLog \
 	Source/WebCore/css/CSSGrammar.y \
 	Source/WebCore/css/CSSPropertyNames.in \
@@ -954,7 +980,7 @@ EXTRA_DIST += \
 	Source/WebCore/css/SVGCSSValueKeywords.in \
 	Source/WebCore/css/view-source.css \
 	Source/WebCore/css/WebKitFontFamilyNames.in \
-	Source/WebCore/dom/EventFactory.in \
+	Source/WebCore/dom/EventNames.in \
 	Source/WebCore/dom/EventTargetFactory.in \
 	Source/WebCore/dom/make_dom_exceptions.pl \
 	Source/WebCore/dom/make_event_factory.pl \
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
index e5a03cb53..2bd1f654c 100644
--- a/Source/WebCore/GNUmakefile.list.am
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -161,6 +161,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSEntityReference.h \
 	DerivedSources/WebCore/JSErrorEvent.cpp \
 	DerivedSources/WebCore/JSErrorEvent.h \
+	DerivedSources/WebCore/JSEXTTextureFilterAnisotropic.cpp \
+	DerivedSources/WebCore/JSEXTTextureFilterAnisotropic.h \
 	DerivedSources/WebCore/JSEvent.cpp \
 	DerivedSources/WebCore/JSEventException.cpp \
 	DerivedSources/WebCore/JSEventException.h \
@@ -656,6 +658,19 @@ dom_binding_idls += \
 	$(WebCore)/Modules/geolocation/PositionCallback.idl \
 	$(WebCore)/Modules/geolocation/PositionError.idl \
 	$(WebCore)/Modules/geolocation/PositionErrorCallback.idl \
+	$(WebCore)/Modules/mediastream/DOMWindowMediaStream.idl \
+	$(WebCore)/Modules/mediastream/LocalMediaStream.idl \
+	$(WebCore)/Modules/mediastream/MediaStream.idl \
+	$(WebCore)/Modules/mediastream/MediaStreamEvent.idl \
+	$(WebCore)/Modules/mediastream/MediaStreamList.idl \
+	$(WebCore)/Modules/mediastream/MediaStreamTrack.idl \
+	$(WebCore)/Modules/mediastream/MediaStreamTrackList.idl \
+	$(WebCore)/Modules/mediastream/NavigatorMediaStream.idl \
+	$(WebCore)/Modules/mediastream/NavigatorUserMediaError.idl \
+	$(WebCore)/Modules/mediastream/NavigatorUserMediaErrorCallback.idl \
+	$(WebCore)/Modules/mediastream/NavigatorUserMediaSuccessCallback.idl \
+	$(WebCore)/Modules/mediastream/PeerConnection.idl \
+	$(WebCore)/Modules/mediastream/SignalingCallback.idl \
 	$(WebCore)/css/CSSCharsetRule.idl \
 	$(WebCore)/css/CSSFontFaceRule.idl \
 	$(WebCore)/css/CSSImportRule.idl \
@@ -757,7 +772,6 @@ dom_binding_idls += \
 	$(WebCore)/html/DOMSettableTokenList.idl \
 	$(WebCore)/html/DOMTokenList.idl \
 	$(WebCore)/html/DOMURL.idl \
-	$(WebCore)/html/DOMWindowHTML.idl \
 	$(WebCore)/html/HTMLAllCollection.idl \
 	$(WebCore)/html/HTMLAnchorElement.idl \
 	$(WebCore)/html/HTMLAppletElement.idl \
@@ -844,8 +858,8 @@ dom_binding_idls += \
 	$(WebCore)/html/canvas/CanvasPattern.idl \
 	$(WebCore)/html/canvas/CanvasRenderingContext.idl \
 	$(WebCore)/html/canvas/CanvasRenderingContext2D.idl \
-	$(WebCore)/html/canvas/DOMWindowWebGL.idl \
 	$(WebCore)/html/canvas/DataView.idl \
+	$(WebCore)/html/canvas/EXTTextureFilterAnisotropic.idl \
 	$(WebCore)/html/canvas/Float32Array.idl \
 	$(WebCore)/html/canvas/Float64Array.idl \
 	$(WebCore)/html/canvas/Int16Array.idl \
@@ -884,19 +898,6 @@ dom_binding_idls += \
 	$(WebCore)/inspector/ScriptProfile.idl \
 	$(WebCore)/inspector/ScriptProfileNode.idl \
 	$(WebCore)/loader/appcache/DOMApplicationCache.idl \
-	$(WebCore)/mediastream/DOMWindowMediaStream.idl \
-	$(WebCore)/mediastream/LocalMediaStream.idl \
-	$(WebCore)/mediastream/MediaStream.idl \
-	$(WebCore)/mediastream/MediaStreamEvent.idl \
-	$(WebCore)/mediastream/MediaStreamList.idl \
-	$(WebCore)/mediastream/MediaStreamTrack.idl \
-	$(WebCore)/mediastream/MediaStreamTrackList.idl \
-	$(WebCore)/mediastream/NavigatorMediaStream.idl \
-	$(WebCore)/mediastream/NavigatorUserMediaError.idl \
-	$(WebCore)/mediastream/NavigatorUserMediaErrorCallback.idl \
-	$(WebCore)/mediastream/NavigatorUserMediaSuccessCallback.idl \
-	$(WebCore)/mediastream/PeerConnection.idl \
-	$(WebCore)/mediastream/SignalingCallback.idl \
 	$(WebCore)/notifications/Notification.idl \
 	$(WebCore)/notifications/NotificationCenter.idl \
 	$(WebCore)/page/BarInfo.idl \
@@ -935,14 +936,12 @@ dom_binding_idls += \
 	$(WebCore)/webaudio/DOMWindowWebAudio.idl \
 	$(WebCore)/webaudio/WaveShaperNode.idl \
 	$(WebCore)/workers/AbstractWorker.idl \
-	$(WebCore)/workers/DOMWindowWorker.idl \
 	$(WebCore)/workers/DedicatedWorkerContext.idl \
 	$(WebCore)/workers/SharedWorker.idl \
 	$(WebCore)/workers/SharedWorkerContext.idl \
 	$(WebCore)/workers/Worker.idl \
 	$(WebCore)/workers/WorkerContext.idl \
 	$(WebCore)/workers/WorkerLocation.idl \
-	$(WebCore)/xml/DOMWindowXML.idl \
 	$(WebCore)/xml/DOMParser.idl \
 	$(WebCore)/xml/XMLHttpRequest.idl \
 	$(WebCore)/xml/XMLHttpRequestException.idl \
@@ -970,6 +969,175 @@ webcore_sources += \
 	Source/WebCore/Modules/geolocation/PositionError.h \
 	Source/WebCore/Modules/geolocation/PositionErrorCallback.h \
 	Source/WebCore/Modules/geolocation/PositionOptions.h \
+	Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp \
+	Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h \
+	Source/WebCore/Modules/indexeddb/IDBAny.cpp \
+	Source/WebCore/Modules/indexeddb/IDBAny.h \
+	Source/WebCore/Modules/indexeddb/IDBBackingStore.h \
+	Source/WebCore/Modules/indexeddb/IDBCallbacks.h \
+	Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp \
+	Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBCursorBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBCursor.cpp \
+	Source/WebCore/Modules/indexeddb/IDBCursor.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabase.cpp \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseError.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseException.cpp \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseException.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabase.h \
+	Source/WebCore/Modules/indexeddb/IDBEventDispatcher.cpp \
+	Source/WebCore/Modules/indexeddb/IDBEventDispatcher.h \
+	Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp \
+	Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.cpp \
+	Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBFactory.cpp \
+	Source/WebCore/Modules/indexeddb/IDBFactory.h \
+	Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp \
+	Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBIndex.cpp \
+	Source/WebCore/Modules/indexeddb/IDBIndex.h \
+	Source/WebCore/Modules/indexeddb/IDBKey.h \
+	Source/WebCore/Modules/indexeddb/IDBKeyPath.h \
+	Source/WebCore/Modules/indexeddb/IDBKeyPathBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBKeyRange.cpp \
+	Source/WebCore/Modules/indexeddb/IDBKeyRange.h \
+	Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp \
+	Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h \
+	Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp \
+	Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.h \
+	Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp \
+	Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp \
+	Source/WebCore/Modules/indexeddb/IDBObjectStore.h \
+	Source/WebCore/Modules/indexeddb/IDBRequest.cpp \
+	Source/WebCore/Modules/indexeddb/IDBRequest.h \
+	Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.h \
+	Source/WebCore/Modules/indexeddb/IDBTransaction.cpp \
+	Source/WebCore/Modules/indexeddb/IDBTransaction.h \
+	Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.h \
+	Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.h \
+	Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.cpp \
+	Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.h \
+	Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.cpp \
+	Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.h \
+	Source/WebCore/Modules/mediastream/LocalMediaStream.cpp \
+	Source/WebCore/Modules/mediastream/LocalMediaStream.h \
+	Source/WebCore/Modules/mediastream/MediaStream.cpp \
+	Source/WebCore/Modules/mediastream/MediaStream.h \
+	Source/WebCore/Modules/mediastream/MediaStreamEvent.cpp \
+	Source/WebCore/Modules/mediastream/MediaStreamEvent.h \
+	Source/WebCore/Modules/mediastream/MediaStreamList.cpp \
+	Source/WebCore/Modules/mediastream/MediaStreamList.h \
+	Source/WebCore/Modules/mediastream/MediaStreamRegistry.cpp \
+	Source/WebCore/Modules/mediastream/MediaStreamRegistry.h \
+	Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp \
+	Source/WebCore/Modules/mediastream/MediaStreamTrack.h \
+	Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp \
+	Source/WebCore/Modules/mediastream/MediaStreamTrackList.h \
+	Source/WebCore/Modules/mediastream/NavigatorMediaStream.cpp \
+	Source/WebCore/Modules/mediastream/NavigatorMediaStream.h \
+	Source/WebCore/Modules/mediastream/NavigatorUserMediaError.h \
+	Source/WebCore/Modules/mediastream/NavigatorUserMediaErrorCallback.h \
+	Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.h \
+	Source/WebCore/Modules/mediastream/PeerConnection.cpp \
+	Source/WebCore/Modules/mediastream/PeerConnection.h \
+	Source/WebCore/Modules/mediastream/SignalingCallback.h \
+	Source/WebCore/Modules/mediastream/UserMediaClient.h \
+	Source/WebCore/Modules/mediastream/UserMediaController.h \
+	Source/WebCore/Modules/mediastream/UserMediaController.cpp \
+	Source/WebCore/Modules/mediastream/UserMediaRequest.cpp \
+	Source/WebCore/Modules/mediastream/UserMediaRequest.h \
+	Source/WebCore/Modules/webdatabase/AbstractDatabase.cpp \
+	Source/WebCore/Modules/webdatabase/AbstractDatabase.h \
+	Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.cpp \
+	Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.h \
+	Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.cpp \
+	Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.h \
+	Source/WebCore/Modules/webdatabase/Database.cpp \
+	Source/WebCore/Modules/webdatabase/Database.h \
+	Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.h \
+	Source/WebCore/Modules/webdatabase/DatabaseCallback.h \
+	Source/WebCore/Modules/webdatabase/DatabaseContext.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseContext.h \
+	Source/WebCore/Modules/webdatabase/DatabaseDetails.h \
+	Source/WebCore/Modules/webdatabase/DatabaseSync.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseSync.h \
+	Source/WebCore/Modules/webdatabase/DatabaseTask.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseTask.h \
+	Source/WebCore/Modules/webdatabase/DatabaseThread.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseThread.h \
+	Source/WebCore/Modules/webdatabase/DatabaseTrackerClient.h \
+	Source/WebCore/Modules/webdatabase/DatabaseTracker.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseTracker.h \
+	Source/WebCore/Modules/webdatabase/OriginQuotaManager.cpp \
+	Source/WebCore/Modules/webdatabase/OriginQuotaManager.h \
+	Source/WebCore/Modules/webdatabase/OriginUsageRecord.cpp \
+	Source/WebCore/Modules/webdatabase/OriginUsageRecord.h \
+	Source/WebCore/Modules/webdatabase/SQLCallbackWrapper.h \
+	Source/WebCore/Modules/webdatabase/SQLError.h \
+	Source/WebCore/Modules/webdatabase/SQLException.cpp \
+	Source/WebCore/Modules/webdatabase/SQLException.h \
+	Source/WebCore/Modules/webdatabase/SQLResultSet.cpp \
+	Source/WebCore/Modules/webdatabase/SQLResultSet.h \
+	Source/WebCore/Modules/webdatabase/SQLResultSetRowList.cpp \
+	Source/WebCore/Modules/webdatabase/SQLResultSetRowList.h \
+	Source/WebCore/Modules/webdatabase/SQLStatementCallback.h \
+	Source/WebCore/Modules/webdatabase/SQLStatement.cpp \
+	Source/WebCore/Modules/webdatabase/SQLStatementErrorCallback.h \
+	Source/WebCore/Modules/webdatabase/SQLStatement.h \
+	Source/WebCore/Modules/webdatabase/SQLStatementSync.cpp \
+	Source/WebCore/Modules/webdatabase/SQLStatementSync.h \
+	Source/WebCore/Modules/webdatabase/SQLTransactionCallback.h \
+	Source/WebCore/Modules/webdatabase/SQLTransactionClient.cpp \
+	Source/WebCore/Modules/webdatabase/SQLTransactionClient.h \
+	Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.cpp \
+	Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.h \
+	Source/WebCore/Modules/webdatabase/SQLTransaction.cpp \
+	Source/WebCore/Modules/webdatabase/SQLTransactionErrorCallback.h \
+	Source/WebCore/Modules/webdatabase/SQLTransaction.h \
+	Source/WebCore/Modules/webdatabase/SQLTransactionSyncCallback.h \
+	Source/WebCore/Modules/webdatabase/SQLTransactionSync.cpp \
+	Source/WebCore/Modules/webdatabase/SQLTransactionSync.h \
+	Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.cpp \
+	Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.h \
+	Source/WebCore/Modules/websockets/CloseEvent.h \
+	Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp \
+	Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h \
+	Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.cpp \
+	Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h \
+	Source/WebCore/Modules/websockets/WebSocketChannelClient.h \
+	Source/WebCore/Modules/websockets/WebSocketChannel.cpp \
+	Source/WebCore/Modules/websockets/WebSocketChannel.h \
+	Source/WebCore/Modules/websockets/WebSocket.cpp \
+	Source/WebCore/Modules/websockets/WebSocket.h \
+	Source/WebCore/Modules/websockets/WebSocketDeflateFramer.cpp \
+	Source/WebCore/Modules/websockets/WebSocketDeflateFramer.h \
+	Source/WebCore/Modules/websockets/WebSocketDeflater.cpp \
+	Source/WebCore/Modules/websockets/WebSocketDeflater.h \
+	Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.cpp \
+	Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.h \
+	Source/WebCore/Modules/websockets/WebSocketExtensionProcessor.h \
+	Source/WebCore/Modules/websockets/WebSocketFrame.h \
+	Source/WebCore/Modules/websockets/WebSocketHandshake.cpp \
+	Source/WebCore/Modules/websockets/WebSocketHandshake.h \
+	Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.cpp \
+	Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.h \
+	Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.cpp \
+	Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.h \
+	Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp \
+	Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h \
 	Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp \
 	Source/WebCore/accessibility/AccessibilityARIAGridCell.h \
 	Source/WebCore/accessibility/AccessibilityARIAGrid.cpp \
@@ -1441,6 +1609,8 @@ webcore_sources += \
 	Source/WebCore/css/StyleMedia.h \
 	Source/WebCore/css/StylePropertySet.cpp \
 	Source/WebCore/css/StylePropertySet.h \
+	Source/WebCore/css/StyleRule.cpp \
+	Source/WebCore/css/StyleRule.h \
 	Source/WebCore/css/StyleSheet.cpp \
 	Source/WebCore/css/StyleSheet.h \
 	Source/WebCore/css/StyleSheetList.cpp \
@@ -1501,6 +1671,8 @@ webcore_sources += \
 	Source/WebCore/dom/ContainerNodeAlgorithms.h \
 	Source/WebCore/dom/ContainerNode.cpp \
 	Source/WebCore/dom/ContainerNode.h \
+	Source/WebCore/dom/ContextDestructionObserver.cpp \
+	Source/WebCore/dom/ContextDestructionObserver.h \
 	Source/WebCore/dom/CrossThreadTask.h \
 	Source/WebCore/dom/CustomEvent.cpp \
 	Source/WebCore/dom/CustomEvent.h \
@@ -1666,6 +1838,8 @@ webcore_sources += \
 	Source/WebCore/dom/RangeException.h \
 	Source/WebCore/dom/Range.h \
 	Source/WebCore/dom/RawDataDocumentParser.h \
+	Source/WebCore/dom/RegionNodeList.cpp \
+	Source/WebCore/dom/RegionNodeList.h \
 	Source/WebCore/dom/RegisteredEventListener.cpp \
 	Source/WebCore/dom/RegisteredEventListener.h \
 	Source/WebCore/dom/RenderedDocumentMarker.h \
@@ -1685,8 +1859,8 @@ webcore_sources += \
 	Source/WebCore/dom/SelectorQuery.h \
 	Source/WebCore/dom/ShadowRoot.cpp \
 	Source/WebCore/dom/ShadowRoot.h \
-	Source/WebCore/dom/ShadowRootList.cpp \
-	Source/WebCore/dom/ShadowRootList.h \
+	Source/WebCore/dom/ShadowTree.cpp \
+	Source/WebCore/dom/ShadowTree.h \
 	Source/WebCore/dom/SpaceSplitString.cpp \
 	Source/WebCore/dom/SpaceSplitString.h \
 	Source/WebCore/dom/StaticHashSetNodeList.cpp \
@@ -1857,6 +2031,8 @@ webcore_sources += \
 	Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp \
 	Source/WebCore/editing/WrapContentsInDummySpanCommand.h \
 	Source/WebCore/editing/WritingDirection.h \
+	Source/WebCore/fileapi/AsyncFileStream.cpp \
+	Source/WebCore/fileapi/AsyncFileStream.h \
 	Source/WebCore/fileapi/AsyncFileWriter.h \
 	Source/WebCore/fileapi/AsyncFileWriterClient.h \
 	Source/WebCore/fileapi/Blob.cpp \
@@ -1914,8 +2090,6 @@ webcore_sources += \
 	Source/WebCore/fileapi/FileReaderLoaderClient.h \
 	Source/WebCore/fileapi/FileReaderSync.cpp \
 	Source/WebCore/fileapi/FileReaderSync.h \
-	Source/WebCore/fileapi/FileStreamProxy.cpp \
-	Source/WebCore/fileapi/FileStreamProxy.h \
 	Source/WebCore/fileapi/FileSystemCallback.h \
 	Source/WebCore/fileapi/FileSystemCallbacks.cpp \
 	Source/WebCore/fileapi/FileSystemCallbacks.h \
@@ -1941,6 +2115,8 @@ webcore_sources += \
 	Source/WebCore/fileapi/ThreadableBlobRegistry.h \
 	Source/WebCore/fileapi/WebKitBlobBuilder.cpp \
 	Source/WebCore/fileapi/WebKitBlobBuilder.h \
+	Source/WebCore/fileapi/WorkerContextFileSystem.cpp \
+	Source/WebCore/fileapi/WorkerContextFileSystem.h \
 	Source/WebCore/history/BackForwardController.cpp \
 	Source/WebCore/history/BackForwardController.h \
 	Source/WebCore/history/BackForwardList.h \
@@ -1959,6 +2135,8 @@ webcore_sources += \
 	Source/WebCore/html/BaseButtonInputType.h \
 	Source/WebCore/html/BaseCheckableInputType.cpp \
 	Source/WebCore/html/BaseCheckableInputType.h \
+	Source/WebCore/html/BaseClickableWithKeyInputType.cpp \
+	Source/WebCore/html/BaseClickableWithKeyInputType.h \
 	Source/WebCore/html/BaseDateAndTimeInputType.cpp \
 	Source/WebCore/html/BaseDateAndTimeInputType.h \
 	Source/WebCore/html/BaseTextInputType.cpp \
@@ -2199,6 +2377,8 @@ webcore_sources += \
 	Source/WebCore/html/ImageInputType.h \
 	Source/WebCore/html/InputType.cpp \
 	Source/WebCore/html/InputType.h \
+	Source/WebCore/html/LabelableElement.cpp \
+	Source/WebCore/html/LabelableElement.h \
 	Source/WebCore/html/LabelsNodeList.cpp \
 	Source/WebCore/html/LabelsNodeList.h \
 	Source/WebCore/html/LinkRelAttribute.cpp \
@@ -2640,41 +2820,14 @@ webcore_sources += \
 	Source/WebCore/mathml/MathMLMathElement.h \
 	Source/WebCore/mathml/MathMLTextElement.cpp \
 	Source/WebCore/mathml/MathMLTextElement.h \
-	Source/WebCore/mediastream/LocalMediaStream.cpp \
-	Source/WebCore/mediastream/LocalMediaStream.h \
-	Source/WebCore/mediastream/MediaStream.cpp \
-	Source/WebCore/mediastream/MediaStream.h \
-	Source/WebCore/mediastream/MediaStreamEvent.cpp \
-	Source/WebCore/mediastream/MediaStreamEvent.h \
-	Source/WebCore/mediastream/MediaStreamList.cpp \
-	Source/WebCore/mediastream/MediaStreamList.h \
-	Source/WebCore/mediastream/MediaStreamRegistry.cpp \
-	Source/WebCore/mediastream/MediaStreamRegistry.h \
-	Source/WebCore/mediastream/MediaStreamTrack.cpp \
-	Source/WebCore/mediastream/MediaStreamTrack.h \
-	Source/WebCore/mediastream/MediaStreamTrackList.cpp \
-	Source/WebCore/mediastream/MediaStreamTrackList.h \
-	Source/WebCore/mediastream/NavigatorMediaStream.cpp \
-	Source/WebCore/mediastream/NavigatorMediaStream.h \
-	Source/WebCore/mediastream/NavigatorUserMediaError.h \
-	Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.h \
-	Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.h \
-	Source/WebCore/mediastream/PeerConnection.cpp \
-	Source/WebCore/mediastream/PeerConnection.h \
-	Source/WebCore/mediastream/SignalingCallback.h \
-	Source/WebCore/mediastream/UserMediaClient.h \
-	Source/WebCore/mediastream/UserMediaController.h \
-	Source/WebCore/mediastream/UserMediaController.cpp \
-	Source/WebCore/mediastream/UserMediaRequest.cpp \
-	Source/WebCore/mediastream/UserMediaRequest.h \
 	Source/WebCore/notifications/NotificationCenter.cpp \
 	Source/WebCore/notifications/NotificationCenter.h \
+	Source/WebCore/notifications/NotificationClient.h \
 	Source/WebCore/notifications/NotificationContents.h \
 	Source/WebCore/notifications/NotificationController.cpp \
 	Source/WebCore/notifications/NotificationController.h \
 	Source/WebCore/notifications/Notification.cpp \
 	Source/WebCore/notifications/Notification.h \
-	Source/WebCore/notifications/NotificationPresenter.h \
 	Source/WebCore/page/animation/AnimationBase.cpp \
 	Source/WebCore/page/animation/AnimationBase.h \
 	Source/WebCore/page/animation/AnimationController.cpp \
@@ -2756,8 +2909,6 @@ webcore_sources += \
 	Source/WebCore/page/NavigatorBase.h \
 	Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp \
 	Source/WebCore/page/NavigatorRegisterProtocolHandler.h \
-	Source/WebCore/page/NavigatorSupplement.cpp \
-	Source/WebCore/page/NavigatorSupplement.h \
 	Source/WebCore/page/OriginAccessEntry.cpp \
 	Source/WebCore/page/OriginAccessEntry.h \
 	Source/WebCore/page/Page.cpp \
@@ -2768,8 +2919,6 @@ webcore_sources += \
 	Source/WebCore/page/PageGroupLoadDeferrer.h \
 	Source/WebCore/page/PageSerializer.cpp \
 	Source/WebCore/page/PageSerializer.h \
-	Source/WebCore/page/PageSupplement.cpp \
-	Source/WebCore/page/PageSupplement.h \
 	Source/WebCore/page/PageVisibilityState.cpp \
 	Source/WebCore/page/PageVisibilityState.h \
 	Source/WebCore/page/Performance.cpp \
@@ -2788,6 +2937,8 @@ webcore_sources += \
 	Source/WebCore/page/scrolling/ScrollingCoordinator.cpp \
 	Source/WebCore/page/scrolling/ScrollingCoordinator.h \
 	Source/WebCore/page/scrolling/ScrollingCoordinatorNone.cpp \
+	Source/WebCore/page/scrolling/ScrollingTreeState.cpp \
+	Source/WebCore/page/scrolling/ScrollingTreeState.h \
 	Source/WebCore/page/SecurityOrigin.cpp \
 	Source/WebCore/page/SecurityOrigin.h \
 	Source/WebCore/page/SecurityOriginHash.h \
@@ -2834,7 +2985,6 @@ webcore_sources += \
 	Source/WebCore/platform/animation/TimingFunction.h \
 	Source/WebCore/platform/Arena.cpp \
 	Source/WebCore/platform/Arena.h \
-	Source/WebCore/platform/AsyncFileStream.h \
 	Source/WebCore/platform/AsyncFileSystem.cpp \
 	Source/WebCore/platform/AsyncFileSystem.h \
 	Source/WebCore/platform/AutodrainedPool.h \
@@ -3129,6 +3279,8 @@ webcore_sources += \
 	Source/WebCore/platform/KURL.cpp \
 	Source/WebCore/platform/KURL.h \
 	Source/WebCore/platform/KURLHash.h \
+	Source/WebCore/platform/KURLWTFURL.cpp \
+	Source/WebCore/platform/KURLWTFURLImpl.h \
 	Source/WebCore/platform/Language.cpp \
 	Source/WebCore/platform/Language.h \
 	Source/WebCore/platform/LengthBox.h \
@@ -3269,6 +3421,7 @@ webcore_sources += \
 	Source/WebCore/platform/PlatformEvent.cpp \
 	Source/WebCore/platform/PlatformEvent.h \
 	Source/WebCore/platform/PlatformExportMacros.h \
+	Source/WebCore/platform/PlatformGestureEvent.h \
 	Source/WebCore/platform/PlatformKeyboardEvent.h \
 	Source/WebCore/platform/PlatformMenuDescription.h \
 	Source/WebCore/platform/PlatformMouseEvent.h \
@@ -3292,10 +3445,13 @@ webcore_sources += \
 	Source/WebCore/platform/SchemeRegistry.h \
 	Source/WebCore/platform/ScrollAnimator.cpp \
 	Source/WebCore/platform/ScrollAnimator.h \
+	Source/WebCore/platform/ScrollAnimatorNone.cpp \
+	Source/WebCore/platform/ScrollAnimatorNone.h \
 	Source/WebCore/platform/ScrollableArea.cpp \
 	Source/WebCore/platform/ScrollableArea.h \
 	Source/WebCore/platform/Scrollbar.cpp \
 	Source/WebCore/platform/Scrollbar.h \
+	Source/WebCore/platform/ScrollbarThemeClient.h \
 	Source/WebCore/platform/ScrollbarThemeComposite.cpp \
 	Source/WebCore/platform/ScrollbarThemeComposite.h \
 	Source/WebCore/platform/ScrollbarTheme.cpp \
@@ -3324,6 +3480,7 @@ webcore_sources += \
 	Source/WebCore/platform/sql/SQLValue.h \
 	Source/WebCore/platform/SSLKeyGenerator.h \
 	Source/WebCore/platform/SuddenTermination.h \
+	Source/WebCore/platform/Supplementable.h \
 	Source/WebCore/platform/SystemTime.h \
 	Source/WebCore/platform/text/Base64.cpp \
 	Source/WebCore/platform/text/Base64.h \
@@ -3489,8 +3646,6 @@ webcore_sources += \
 	Source/WebCore/rendering/RenderCounter.h \
 	Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp \
 	Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h \
-	Source/WebCore/rendering/RenderDetails.cpp \
-	Source/WebCore/rendering/RenderDetails.h \
 	Source/WebCore/rendering/RenderDetailsMarker.cpp \
 	Source/WebCore/rendering/RenderDetailsMarker.h \
 	Source/WebCore/rendering/RenderEmbeddedObject.cpp \
@@ -3580,8 +3735,6 @@ webcore_sources += \
 	Source/WebCore/rendering/RenderSelectionInfo.h \
 	Source/WebCore/rendering/RenderSlider.cpp \
 	Source/WebCore/rendering/RenderSlider.h \
-	Source/WebCore/rendering/RenderSummary.cpp \
-	Source/WebCore/rendering/RenderSummary.h \
 	Source/WebCore/rendering/RenderTableCaption.cpp \
 	Source/WebCore/rendering/RenderTableCaption.h \
 	Source/WebCore/rendering/RenderTableCell.cpp \
@@ -3688,6 +3841,8 @@ webcore_sources += \
 	Source/WebCore/rendering/style/StyleGeneratedImage.h \
 	Source/WebCore/rendering/style/StyleGridData.cpp \
 	Source/WebCore/rendering/style/StyleGridData.h \
+	Source/WebCore/rendering/style/StyleGridItemData.cpp \
+	Source/WebCore/rendering/style/StyleGridItemData.h \
 	Source/WebCore/rendering/style/StyleImage.h \
 	Source/WebCore/rendering/style/StyleInheritedData.cpp \
 	Source/WebCore/rendering/style/StyleInheritedData.h \
@@ -3761,8 +3916,6 @@ webcore_sources += \
 	Source/WebCore/rendering/svg/RenderSVGResourceSolidColor.h \
 	Source/WebCore/rendering/svg/RenderSVGRoot.cpp \
 	Source/WebCore/rendering/svg/RenderSVGRoot.h \
-	Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp \
-	Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.h \
 	Source/WebCore/rendering/svg/RenderSVGShape.cpp \
 	Source/WebCore/rendering/svg/RenderSVGShape.h \
 	Source/WebCore/rendering/svg/RenderSVGTSpan.cpp \
@@ -3790,6 +3943,8 @@ webcore_sources += \
 	Source/WebCore/rendering/svg/SVGRenderSupport.h \
 	Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp \
 	Source/WebCore/rendering/svg/SVGRenderTreeAsText.h \
+	Source/WebCore/rendering/svg/SVGRenderingContext.cpp \
+	Source/WebCore/rendering/svg/SVGRenderingContext.h \
 	Source/WebCore/rendering/svg/SVGResourcesCache.cpp \
 	Source/WebCore/rendering/svg/SVGResourcesCache.h \
 	Source/WebCore/rendering/svg/SVGResources.cpp \
@@ -3798,8 +3953,6 @@ webcore_sources += \
 	Source/WebCore/rendering/svg/SVGResources.h \
 	Source/WebCore/rendering/svg/SVGRootInlineBox.cpp \
 	Source/WebCore/rendering/svg/SVGRootInlineBox.h \
-	Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp \
-	Source/WebCore/rendering/svg/SVGShadowTreeElements.h \
 	Source/WebCore/rendering/svg/SVGSubpathData.h \
 	Source/WebCore/rendering/svg/SVGTextChunk.cpp \
 	Source/WebCore/rendering/svg/SVGTextChunk.h \
@@ -3826,116 +3979,10 @@ webcore_sources += \
 	Source/WebCore/rendering/svg/SVGTextRunRenderingContext.h \
 	Source/WebCore/rendering/TableLayout.h \
 	Source/WebCore/rendering/TrailingFloatsRootInlineBox.h \
-	Source/WebCore/storage/AbstractDatabase.cpp \
-	Source/WebCore/storage/AbstractDatabase.h \
-	Source/WebCore/storage/ChangeVersionWrapper.cpp \
-	Source/WebCore/storage/ChangeVersionWrapper.h \
-	Source/WebCore/storage/DOMWindowSQLDatabase.cpp \
-	Source/WebCore/storage/DOMWindowSQLDatabase.h \
-	Source/WebCore/storage/DatabaseAuthorizer.cpp \
-	Source/WebCore/storage/DatabaseAuthorizer.h \
-	Source/WebCore/storage/DatabaseCallback.h \
-	Source/WebCore/storage/Database.cpp \
-	Source/WebCore/storage/DatabaseDetails.h \
-	Source/WebCore/storage/Database.h \
-	Source/WebCore/storage/DatabaseSync.cpp \
-	Source/WebCore/storage/DatabaseSync.h \
-	Source/WebCore/storage/DatabaseTask.cpp \
-	Source/WebCore/storage/DatabaseTask.h \
-	Source/WebCore/storage/DatabaseThread.cpp \
-	Source/WebCore/storage/DatabaseThread.h \
-	Source/WebCore/storage/DatabaseTrackerClient.h \
-	Source/WebCore/storage/DatabaseTracker.cpp \
-	Source/WebCore/storage/DatabaseTracker.h \
-	Source/WebCore/storage/IDBAny.cpp \
-	Source/WebCore/storage/IDBAny.h \
-	Source/WebCore/storage/IDBBackingStore.h \
-	Source/WebCore/storage/IDBCallbacks.h \
-	Source/WebCore/storage/IDBCursorBackendImpl.cpp \
-	Source/WebCore/storage/IDBCursorBackendImpl.h \
-	Source/WebCore/storage/IDBCursorBackendInterface.h \
-	Source/WebCore/storage/IDBCursor.cpp \
-	Source/WebCore/storage/IDBCursor.h \
-	Source/WebCore/storage/IDBDatabaseBackendImpl.cpp \
-	Source/WebCore/storage/IDBDatabaseBackendImpl.h \
-	Source/WebCore/storage/IDBDatabaseBackendInterface.h \
-	Source/WebCore/storage/IDBDatabaseCallbacks.h \
-	Source/WebCore/storage/IDBDatabaseCallbacksImpl.h \
-	Source/WebCore/storage/IDBDatabase.cpp \
-	Source/WebCore/storage/IDBDatabaseError.h \
-	Source/WebCore/storage/IDBDatabaseException.cpp \
-	Source/WebCore/storage/IDBDatabaseException.h \
-	Source/WebCore/storage/IDBDatabase.h \
-	Source/WebCore/storage/IDBEventDispatcher.cpp \
-	Source/WebCore/storage/IDBEventDispatcher.h \
-	Source/WebCore/storage/IDBFactoryBackendImpl.cpp \
-	Source/WebCore/storage/IDBFactoryBackendImpl.h \
-	Source/WebCore/storage/IDBFactoryBackendInterface.cpp \
-	Source/WebCore/storage/IDBFactoryBackendInterface.h \
-	Source/WebCore/storage/IDBFactory.cpp \
-	Source/WebCore/storage/IDBFactory.h \
-	Source/WebCore/storage/IDBIndexBackendImpl.cpp \
-	Source/WebCore/storage/IDBIndexBackendImpl.h \
-	Source/WebCore/storage/IDBIndexBackendInterface.h \
-	Source/WebCore/storage/IDBIndexBackendInterface.h \
-	Source/WebCore/storage/IDBIndex.cpp \
-	Source/WebCore/storage/IDBIndex.h \
-	Source/WebCore/storage/IDBKey.h \
-	Source/WebCore/storage/IDBKeyPath.h \
-	Source/WebCore/storage/IDBKeyPathBackendImpl.h \
-	Source/WebCore/storage/IDBKeyRange.cpp \
-	Source/WebCore/storage/IDBKeyRange.h \
-	Source/WebCore/storage/IDBLevelDBBackingStore.cpp \
-	Source/WebCore/storage/IDBLevelDBBackingStore.h \
-	Source/WebCore/storage/IDBLevelDBCoding.cpp \
-	Source/WebCore/storage/IDBLevelDBCoding.h \
-	Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp \
-	Source/WebCore/storage/IDBObjectStoreBackendImpl.h \
-	Source/WebCore/storage/IDBObjectStoreBackendInterface.h \
-	Source/WebCore/storage/IDBObjectStoreBackendInterface.h \
-	Source/WebCore/storage/IDBObjectStore.cpp \
-	Source/WebCore/storage/IDBObjectStore.h \
-	Source/WebCore/storage/IDBRequest.cpp \
-	Source/WebCore/storage/IDBRequest.h \
-	Source/WebCore/storage/IDBTransactionBackendInterface.h \
-	Source/WebCore/storage/IDBTransactionCoordinator.h \
-	Source/WebCore/storage/IDBTransaction.cpp \
-	Source/WebCore/storage/IDBTransaction.h \
-	Source/WebCore/storage/IDBVersionChangeEvent.h \
-	Source/WebCore/storage/IDBVersionChangeRequest.h \
 	Source/WebCore/storage/StorageTask.cpp \
 	Source/WebCore/storage/StorageTask.h \
 	Source/WebCore/storage/StorageThread.cpp \
 	Source/WebCore/storage/StorageThread.h \
-	Source/WebCore/storage/OriginQuotaManager.cpp \
-	Source/WebCore/storage/OriginQuotaManager.h \
-	Source/WebCore/storage/OriginUsageRecord.cpp \
-	Source/WebCore/storage/OriginUsageRecord.h \
-	Source/WebCore/storage/SQLCallbackWrapper.h \
-	Source/WebCore/storage/SQLError.h \
-	Source/WebCore/storage/SQLException.cpp \
-	Source/WebCore/storage/SQLException.h \
-	Source/WebCore/storage/SQLResultSet.cpp \
-	Source/WebCore/storage/SQLResultSet.h \
-	Source/WebCore/storage/SQLResultSetRowList.cpp \
-	Source/WebCore/storage/SQLResultSetRowList.h \
-	Source/WebCore/storage/SQLStatementCallback.h \
-	Source/WebCore/storage/SQLStatement.cpp \
-	Source/WebCore/storage/SQLStatementErrorCallback.h \
-	Source/WebCore/storage/SQLStatement.h \
-	Source/WebCore/storage/SQLStatementSync.cpp \
-	Source/WebCore/storage/SQLStatementSync.h \
-	Source/WebCore/storage/SQLTransactionCallback.h \
-	Source/WebCore/storage/SQLTransactionClient.cpp \
-	Source/WebCore/storage/SQLTransactionClient.h \
-	Source/WebCore/storage/SQLTransactionCoordinator.cpp \
-	Source/WebCore/storage/SQLTransactionCoordinator.h \
-	Source/WebCore/storage/SQLTransaction.cpp \
-	Source/WebCore/storage/SQLTransactionErrorCallback.h \
-	Source/WebCore/storage/SQLTransaction.h \
-	Source/WebCore/storage/SQLTransactionSyncCallback.h \
-	Source/WebCore/storage/SQLTransactionSync.cpp \
-	Source/WebCore/storage/SQLTransactionSync.h \
 	Source/WebCore/storage/StorageArea.h \
 	Source/WebCore/storage/StorageAreaImpl.cpp \
 	Source/WebCore/storage/StorageAreaImpl.h \
@@ -4339,30 +4386,6 @@ webcore_sources += \
 	Source/WebCore/svg/SVGZoomEvent.cpp \
 	Source/WebCore/svg/SVGZoomEvent.h \
 	Source/WebCore/WebCorePrefix.h \
-	Source/WebCore/websockets/CloseEvent.h \
-	Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp \
-	Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h \
-	Source/WebCore/websockets/ThreadableWebSocketChannel.cpp \
-	Source/WebCore/websockets/ThreadableWebSocketChannel.h \
-	Source/WebCore/websockets/WebSocketChannelClient.h \
-	Source/WebCore/websockets/WebSocketChannel.cpp \
-	Source/WebCore/websockets/WebSocketChannel.h \
-	Source/WebCore/websockets/WebSocket.cpp \
-	Source/WebCore/websockets/WebSocket.h \
-	Source/WebCore/websockets/WebSocketDeflater.cpp \
-	Source/WebCore/websockets/WebSocketDeflater.h \
-	Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp \
-	Source/WebCore/websockets/WebSocketExtensionDispatcher.h \
-	Source/WebCore/websockets/WebSocketExtensionProcessor.h \
-	Source/WebCore/websockets/WebSocketFrame.h \
-	Source/WebCore/websockets/WebSocketHandshake.cpp \
-	Source/WebCore/websockets/WebSocketHandshake.h \
-	Source/WebCore/websockets/WebSocketHandshakeRequest.cpp \
-	Source/WebCore/websockets/WebSocketHandshakeRequest.h \
-	Source/WebCore/websockets/WebSocketHandshakeResponse.cpp \
-	Source/WebCore/websockets/WebSocketHandshakeResponse.h \
-	Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp \
-	Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h \
 	Source/WebCore/workers/AbstractWorker.cpp \
 	Source/WebCore/workers/AbstractWorker.h \
 	Source/WebCore/workers/DedicatedWorkerContext.cpp \
@@ -4521,6 +4544,8 @@ webcoregtk_sources += \
 	Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.h \
 	Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp \
 	Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h \
+	Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.cpp \
+	Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h \
 	Source/WebCore/platform/graphics/gstreamer/ImageGStreamerCairo.cpp \
 	Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h \
 	Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp \
@@ -4609,6 +4634,9 @@ webcoregtk_sources += \
 
 if TARGET_X11
 webcoregtk_sources += \
+	Source/WebCore/platform/graphics/glx/GLContextGLX.cpp \
+	Source/WebCore/platform/graphics/gtk/GLContextGtk.cpp \
+	Source/WebCore/platform/graphics/cairo/GLContext.h \
 	Source/WebCore/platform/gtk/GtkWidgetBackingStoreX11.cpp \
 	Source/WebCore/plugins/gtk/gtk2xtbin.c \
 	Source/WebCore/plugins/gtk/gtk2xtbin.h \
@@ -4710,21 +4738,22 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSSQLTransactionSyncCallback.h
 
 dom_binding_idls += \
-	$(WebCore)/storage/DOMWindowSQLDatabase.idl \
-	$(WebCore)/storage/Database.idl \
-	$(WebCore)/storage/DatabaseCallback.idl \
-	$(WebCore)/storage/DatabaseSync.idl \
-	$(WebCore)/storage/SQLError.idl \
-	$(WebCore)/storage/SQLException.idl \
-	$(WebCore)/storage/SQLResultSet.idl \
-	$(WebCore)/storage/SQLResultSetRowList.idl \
-	$(WebCore)/storage/SQLStatementCallback.idl \
-	$(WebCore)/storage/SQLStatementErrorCallback.idl \
-	$(WebCore)/storage/SQLTransaction.idl \
-	$(WebCore)/storage/SQLTransactionCallback.idl \
-	$(WebCore)/storage/SQLTransactionErrorCallback.idl \
-	$(WebCore)/storage/SQLTransactionSync.idl \
-	$(WebCore)/storage/SQLTransactionSyncCallback.idl
+	$(WebCore)/Modules/webdatabase/DOMWindowSQLDatabase.idl \
+	$(WebCore)/Modules/webdatabase/Database.idl \
+	$(WebCore)/Modules/webdatabase/DatabaseCallback.idl \
+	$(WebCore)/Modules/webdatabase/DatabaseSync.idl \
+	$(WebCore)/Modules/webdatabase/SQLError.idl \
+	$(WebCore)/Modules/webdatabase/SQLException.idl \
+	$(WebCore)/Modules/webdatabase/SQLResultSet.idl \
+	$(WebCore)/Modules/webdatabase/SQLResultSetRowList.idl \
+	$(WebCore)/Modules/webdatabase/SQLStatementCallback.idl \
+	$(WebCore)/Modules/webdatabase/SQLStatementErrorCallback.idl \
+	$(WebCore)/Modules/webdatabase/SQLTransaction.idl \
+	$(WebCore)/Modules/webdatabase/SQLTransactionCallback.idl \
+	$(WebCore)/Modules/webdatabase/SQLTransactionErrorCallback.idl \
+	$(WebCore)/Modules/webdatabase/SQLTransactionSync.idl \
+	$(WebCore)/Modules/webdatabase/SQLTransactionSyncCallback.idl \
+	$(WebCore)/Modules/webdatabase/WorkerContextSQLDatabase.idl
 endif # END ENABLE_SQL_DATABASE
 
 # ----
@@ -4778,16 +4807,18 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSIDBTransaction.h
 
 dom_binding_idls += \
-	$(WebCore)/storage/IDBAny.idl \
-	$(WebCore)/storage/IDBDatabase.idl \
-	$(WebCore)/storage/IDBDatabaseError.idl \
-	$(WebCore)/storage/IDBDatabaseException.idl \
-	$(WebCore)/storage/IDBFactory.idl \
-	$(WebCore)/storage/IDBIndex.idl \
-	$(WebCore)/storage/IDBKeyRange.idl \
-	$(WebCore)/storage/IDBObjectStore.idl \
-	$(WebCore)/storage/IDBRequest.idl \
-	$(WebCore)/storage/IDBTransaction.idl
+	$(WebCore)/Modules/indexeddb/DOMWindowIndexedDatabase.idl \
+	$(WebCore)/Modules/indexeddb/IDBAny.idl \
+	$(WebCore)/Modules/indexeddb/IDBDatabase.idl \
+	$(WebCore)/Modules/indexeddb/IDBDatabaseError.idl \
+	$(WebCore)/Modules/indexeddb/IDBDatabaseException.idl \
+	$(WebCore)/Modules/indexeddb/IDBFactory.idl \
+	$(WebCore)/Modules/indexeddb/IDBIndex.idl \
+	$(WebCore)/Modules/indexeddb/IDBKeyRange.idl \
+	$(WebCore)/Modules/indexeddb/IDBObjectStore.idl \
+	$(WebCore)/Modules/indexeddb/IDBRequest.idl \
+	$(WebCore)/Modules/indexeddb/IDBTransaction.idl \
+	$(WebCore)/Modules/indexeddb/WorkerContextIndexedDatabase.idl
 endif # END ENABLE_INDEXED_DATABASE
 
 # ----
@@ -4863,7 +4894,8 @@ dom_binding_idls += \
 	$(WebCore)/fileapi/FileWriterCallback.idl \
 	$(WebCore)/fileapi/FileWriterSync.idl \
 	$(WebCore)/fileapi/Metadata.idl \
-	$(WebCore)/fileapi/MetadataCallback.idl
+	$(WebCore)/fileapi/MetadataCallback.idl \
+	$(WebCore)/fileapi/WorkerContextFileSystem.idl
 
 webcoregtk_sources += \
 	Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp \
@@ -5172,7 +5204,6 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSSVGZoomEvent.h
 
 dom_binding_idls += \
-	$(WebCore)/svg/DOMWindowSVG.idl \
 	$(WebCore)/svg/SVGAElement.idl \
 	$(WebCore)/svg/SVGAltGlyphDefElement.idl \
 	$(WebCore)/svg/SVGAltGlyphElement.idl \
@@ -5333,6 +5364,7 @@ webcore_sources += \
 	Source/WebCore/webaudio/AudioBasicProcessorNode.h \
 	Source/WebCore/webaudio/AudioBuffer.cpp \
 	Source/WebCore/webaudio/AudioBuffer.h \
+	Source/WebCore/webaudio/AudioBufferCallback.h \
 	Source/WebCore/webaudio/AudioBufferSourceNode.cpp \
 	Source/WebCore/webaudio/AudioBufferSourceNode.h \
 	Source/WebCore/webaudio/AudioChannelMerger.cpp \
@@ -5426,6 +5458,7 @@ webcore_sources += \
 	Source/WebCore/platform/audio/Biquad.h \
 	Source/WebCore/platform/audio/Cone.cpp \
 	Source/WebCore/platform/audio/Cone.h \
+	Source/WebCore/platform/audio/DenormalDisabler.h \
 	Source/WebCore/platform/audio/Distance.cpp \
 	Source/WebCore/platform/audio/Distance.h \
 	Source/WebCore/platform/audio/DynamicsCompressor.h \
@@ -5560,9 +5593,9 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSWebSocket.h
 
 dom_binding_idls += \
-	$(WebCore)/websockets/CloseEvent.idl \
-	$(WebCore)/websockets/DOMWindowWebSocket.idl \
-	$(WebCore)/websockets/WebSocket.idl
+	$(WebCore)/Modules/websockets/CloseEvent.idl \
+	$(WebCore)/Modules/websockets/DOMWindowWebSocket.idl \
+	$(WebCore)/Modules/websockets/WebSocket.idl
 endif  # END ENABLE_WEB_SOCKETS
 
 # ---
@@ -5710,6 +5743,8 @@ webcore_sources += \
 	Source/WebCore/html/canvas/WebGLVertexArrayObjectOES.h \
 	Source/WebCore/html/canvas/WebGLExtension.cpp \
 	Source/WebCore/html/canvas/WebGLExtension.h \
+	Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.cpp \
+	Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.h \
 	Source/WebCore/html/canvas/OESStandardDerivatives.cpp \
 	Source/WebCore/html/canvas/OESStandardDerivatives.h \
 	Source/WebCore/html/canvas/OESTextureFloat.cpp \
@@ -5720,8 +5755,8 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/ANGLEWebKitBridge.h \
 	Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp \
 	Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp \
-	Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.cpp \
-	Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.h \
+	Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp \
+	Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.h \
 	Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp \
 	Source/WebCore/platform/graphics/gpu/DrawingBuffer.h \
 	Source/WebCore/platform/graphics/GraphicsContext3D.cpp \
@@ -5818,9 +5853,6 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp \
 	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h \
 	Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
-webcoregtk_sources += \
-	Source/WebCore/platform/graphics/gtk/WindowGLContextGLX.cpp \
-	Source/WebCore/platform/graphics/gtk/WindowGLContext.h
 endif  # END USE_TEXTURE_MAPPER_GL
 endif  # USE_ACCELERATED_COMPOSITING
 
diff --git a/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp b/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
index 95cd602a2..9ad62ad9c 100644
--- a/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
+++ b/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
@@ -46,7 +46,7 @@ NavigatorGamepad::~NavigatorGamepad()
 NavigatorGamepad* NavigatorGamepad::from(Navigator* navigator)
 {
     DEFINE_STATIC_LOCAL(AtomicString, name, ("NavigatorGamepad"));
-    NavigatorGamepad* supplement = static_cast<NavigatorGamepad*>(NavigatorSupplement::from(navigator, name));
+    NavigatorGamepad* supplement = static_cast<NavigatorGamepad*>(Supplement<Navigator>::from(navigator, name));
     if (!supplement) {
         supplement = new NavigatorGamepad();
         provideTo(navigator, name, adoptPtr(supplement));
diff --git a/Source/WebCore/Modules/gamepad/NavigatorGamepad.h b/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
index 0ab51b594..87e4d8ae8 100644
--- a/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
+++ b/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
@@ -28,14 +28,14 @@
 
 #if ENABLE(GAMEPAD)
 
-#include "NavigatorSupplement.h"
+#include "Supplementable.h"
 
 namespace WebCore {
 
 class GamepadList;
 class Navigator;
 
-class NavigatorGamepad : public NavigatorSupplement {
+class NavigatorGamepad : public Supplement<Navigator> {
 public:
     virtual ~NavigatorGamepad();
     static NavigatorGamepad* from(Navigator*);
diff --git a/Source/WebCore/Modules/geolocation/Geolocation.cpp b/Source/WebCore/Modules/geolocation/Geolocation.cpp
index ae1f4fcbc..a689a1812 100644
--- a/Source/WebCore/Modules/geolocation/Geolocation.cpp
+++ b/Source/WebCore/Modules/geolocation/Geolocation.cpp
@@ -225,38 +225,57 @@ void Geolocation::Watchers::getNotifiersVector(GeoNotifierVector& copy) const
     copyValuesToVector(m_idToNotifierMap, copy);
 }
 
-Geolocation::Geolocation(Frame* frame)
-    : DOMWindowProperty(frame)
+PassRefPtr<Geolocation> Geolocation::create(ScriptExecutionContext* context)
+{
+    RefPtr<Geolocation> geolocation = adoptRef(new Geolocation(context));
+    geolocation->suspendIfNeeded();
+    return geolocation.release();
+}
+
+Geolocation::Geolocation(ScriptExecutionContext* context)
+    : ActiveDOMObject(context, this)
 #if !ENABLE(CLIENT_BASED_GEOLOCATION)
     , m_service(GeolocationService::create(this))
 #endif
     , m_allowGeolocation(Unknown)
 {
-    if (!m_frame)
-        return;
-    ASSERT(m_frame->document());
-    m_frame->document()->setUsingGeolocation(true);
 }
 
 Geolocation::~Geolocation()
 {
     ASSERT(m_allowGeolocation != InProgress);
-    ASSERT(!m_frame);
+}
+
+Document* Geolocation::document() const
+{
+    ASSERT(!scriptExecutionContext() || scriptExecutionContext()->isDocument());
+    return static_cast<Document*>(scriptExecutionContext());
+}
+
+Frame* Geolocation::frame() const
+{
+    return document() ? document()->frame() : 0;
 }
 
 Page* Geolocation::page() const
 {
-    return m_frame ? m_frame->page() : 0;
+    return document() ? document()->page() : 0;
 }
 
-void Geolocation::reset()
+void Geolocation::stop()
 {
+    // FIXME: We should ideally allow existing Geolocation activities to continue
+    // when the Geolocation's iframe is reparented. (Assuming we continue to
+    // support reparenting iframes.)
+    // See https://bugs.webkit.org/show_bug.cgi?id=55577
+    // and https://bugs.webkit.org/show_bug.cgi?id=52877
+
     Page* page = this->page();
     if (page && m_allowGeolocation == InProgress) {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
         page->geolocationController()->cancelPermissionRequest(this);
 #else
-        page->chrome()->client()->cancelGeolocationPermissionRequestForFrame(m_frame, this);
+        page->chrome()->client()->cancelGeolocationPermissionRequestForFrame(frame(), this);
 #endif
     }
     // The frame may be moving to a new page and we want to get the permissions from the new page's client.
@@ -268,15 +287,6 @@ void Geolocation::reset()
 #endif
 }
 
-void Geolocation::disconnectFrame()
-{
-    // Once we are disconnected from the Frame, it is no longer possible to perform any operations.
-    reset();
-    if (m_frame && m_frame->document())
-        m_frame->document()->setUsingGeolocation(false);
-    DOMWindowProperty::disconnectFrame();
-}
-
 Geoposition* Geolocation::lastPosition()
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
@@ -294,7 +304,7 @@ Geoposition* Geolocation::lastPosition()
 
 void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
-    if (!m_frame)
+    if (!frame())
         return;
 
     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
@@ -305,7 +315,7 @@ void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallbac
 
 int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
-    if (!m_frame)
+    if (!frame())
         return 0;
 
     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
@@ -620,7 +630,7 @@ void Geolocation::requestPermission()
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
     page->geolocationController()->requestPermission(this);
 #else
-    page->chrome()->client()->requestGeolocationPermissionForFrame(m_frame, this);
+    page->chrome()->client()->requestGeolocationPermissionForFrame(frame(), this);
 #endif
 }
 
@@ -757,17 +767,11 @@ void Geolocation::handlePendingPermissionNotifiers()
 
 namespace WebCore {
 
-void Geolocation::clearWatch(int) {}
-
-void Geolocation::reset() {}
-
-void Geolocation::disconnectFrame() {}
-
-Geolocation::Geolocation(Frame*) : DOMWindowProperty(0) {}
-
-Geolocation::~Geolocation() {}
-
-void Geolocation::setIsAllowed(bool) {}
+void Geolocation::clearWatch(int) { }
+void Geolocation::stop() { }
+Geolocation::Geolocation(ScriptExecutionContext* context) : ActiveDOMObject(context, this) { }
+Geolocation::~Geolocation() { }
+void Geolocation::setIsAllowed(bool) { }
 
 }
                                                         
diff --git a/Source/WebCore/Modules/geolocation/Geolocation.h b/Source/WebCore/Modules/geolocation/Geolocation.h
index ea55cbf1f..2c6bab8bd 100644
--- a/Source/WebCore/Modules/geolocation/Geolocation.h
+++ b/Source/WebCore/Modules/geolocation/Geolocation.h
@@ -27,7 +27,7 @@
 #ifndef Geolocation_h
 #define Geolocation_h
 
-#include "DOMWindowProperty.h"
+#include "ActiveDOMObject.h"
 #include "Geoposition.h"
 #include "PositionCallback.h"
 #include "PositionError.h"
@@ -41,24 +41,27 @@
 
 namespace WebCore {
 
+class Document;
 class Frame;
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
 class GeolocationPosition;
 class GeolocationError;
 #endif
 class Page;
+class ScriptExecutionContext;
 
-class Geolocation : public RefCounted<Geolocation>, public DOMWindowProperty
+class Geolocation : public RefCounted<Geolocation>, public ActiveDOMObject
 #if !ENABLE(CLIENT_BASED_GEOLOCATION) && ENABLE(GEOLOCATION)
     , public GeolocationServiceClient
 #endif
 {
 public:
-    static PassRefPtr<Geolocation> create(Frame* frame) { return adoptRef(new Geolocation(frame)); }
+    static PassRefPtr<Geolocation> create(ScriptExecutionContext*);
     ~Geolocation();
 
-    virtual void disconnectFrame() OVERRIDE;
-    void reset();
+    virtual void stop() OVERRIDE;
+    Document* document() const;
+    Frame* frame() const;
 
     void getCurrentPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
     int watchPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
@@ -79,7 +82,7 @@ private:
     bool isAllowed() const { return m_allowGeolocation == Yes; }
     bool isDenied() const { return m_allowGeolocation == No; }
 
-    explicit Geolocation(Frame*);
+    explicit Geolocation(ScriptExecutionContext*);
 
     Page* page() const;
 
diff --git a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp
index b8a47c1f5..da0ebf54a 100644
--- a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp
+++ b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp
@@ -1,31 +1,33 @@
 /*
- * Copyright (C) 2012, Google Inc. All rights reserved.
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (c) 2000 Daniel Molkentin (molkentin@kde.org)
+ *  Copyright (c) 2000 Stefan Schimanski (schimmi@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
  *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
- * DAMAGE.
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
 #include "config.h"
+
+#if ENABLE(GEOLOCATION)
+
 #include "NavigatorGeolocation.h"
 
+#include "Document.h"
+#include "Frame.h"
 #include "Geolocation.h"
 #include "Navigator.h"
 
@@ -40,21 +42,10 @@ NavigatorGeolocation::~NavigatorGeolocation()
 {
 }
 
-void NavigatorGeolocation::willDetachPage()
-{
-    // FIXME: We should ideally allow existing Geolocation activities to continue
-    // when the Geolocation's iframe is reparented. (Assuming we continue to
-    // support reparenting iframes.)
-    // See https://bugs.webkit.org/show_bug.cgi?id=55577
-    // and https://bugs.webkit.org/show_bug.cgi?id=52877
-    if (m_geolocation)
-        m_geolocation->reset();
-}
-
 NavigatorGeolocation* NavigatorGeolocation::from(Navigator* navigator)
 {
     DEFINE_STATIC_LOCAL(AtomicString, name, ("NavigatorGeolocation"));
-    NavigatorGeolocation* supplement = static_cast<NavigatorGeolocation*>(NavigatorSupplement::from(navigator, name));
+    NavigatorGeolocation* supplement = static_cast<NavigatorGeolocation*>(Supplement<Navigator>::from(navigator, name));
     if (!supplement) {
         supplement = new NavigatorGeolocation(navigator->frame());
         provideTo(navigator, name, adoptPtr(supplement));
@@ -69,9 +60,11 @@ Geolocation* NavigatorGeolocation::geolocation(Navigator* navigator)
 
 Geolocation* NavigatorGeolocation::geolocation() const
 {
-    if (!m_geolocation)
-        m_geolocation = Geolocation::create(frame());
+    if (!m_geolocation && frame())
+        m_geolocation = Geolocation::create(frame()->document());
     return m_geolocation.get();
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h
index b8c92e6a3..6f9d8057f 100644
--- a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h
+++ b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h
@@ -1,33 +1,29 @@
 /*
- * Copyright (C) 2011, Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
- * DAMAGE.
- */
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
 
 #ifndef NavigatorGeolocation_h
 #define NavigatorGeolocation_h
 
+#if ENABLE(GEOLOCATION)
+
 #include "DOMWindowProperty.h"
-#include "NavigatorSupplement.h"
+#include "Supplementable.h"
 
 namespace WebCore {
 
@@ -35,7 +31,7 @@ class Frame;
 class Geolocation;
 class Navigator;
 
-class NavigatorGeolocation : public NavigatorSupplement, public DOMWindowProperty {
+class NavigatorGeolocation : public Supplement<Navigator>, public DOMWindowProperty {
 public:
     virtual ~NavigatorGeolocation();
     static NavigatorGeolocation* from(Navigator*);
@@ -46,11 +42,11 @@ public:
 private:
     NavigatorGeolocation(Frame*);
 
-    virtual void willDetachPage() OVERRIDE;
-
     mutable RefPtr<Geolocation> m_geolocation;
 };
 
 } // namespace WebCore
 
+#endif // ENABLE(GEOLOCATION)
+
 #endif // NavigatorGeolocation_h
diff --git a/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp b/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp
index 9b40c5ad3..6ec2dc001 100644
--- a/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp
+++ b/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
@@ -32,12 +32,14 @@
 #include "Document.h"
 #include "IDBFactory.h"
 #include "Page.h"
-#include "PageGroup.h"
+#include "PageGroupIndexedDatabase.h"
 #include "SecurityOrigin.h"
 
 namespace WebCore {
 
-DOMWindowIndexedDatabase::DOMWindowIndexedDatabase()
+DOMWindowIndexedDatabase::DOMWindowIndexedDatabase(DOMWindow* window)
+    : DOMWindowProperty(window->frame())
+    , m_window(window)
 {
 }
 
@@ -45,9 +47,31 @@ DOMWindowIndexedDatabase::~DOMWindowIndexedDatabase()
 {
 }
 
+DOMWindowIndexedDatabase* DOMWindowIndexedDatabase::from(DOMWindow* window)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("DOMWindowIndexedDatabase"));
+    DOMWindowIndexedDatabase* supplement = static_cast<DOMWindowIndexedDatabase*>(Supplement<DOMWindow>::from(window, name));
+    if (!supplement) {
+        supplement = new DOMWindowIndexedDatabase(window);
+        provideTo(window, name, adoptPtr(supplement));
+    }
+    return supplement;
+}
+
+void DOMWindowIndexedDatabase::disconnectFrame()
+{
+    m_idbFactory = 0;
+    DOMWindowProperty::disconnectFrame();
+}
+
 IDBFactory* DOMWindowIndexedDatabase::webkitIndexedDB(DOMWindow* window)
 {
-    Document* document = window->document();
+    return from(window)->webkitIndexedDB();
+}
+
+IDBFactory* DOMWindowIndexedDatabase::webkitIndexedDB()
+{
+    Document* document = m_window->document();
     if (!document)
         return 0;
 
@@ -58,9 +82,9 @@ IDBFactory* DOMWindowIndexedDatabase::webkitIndexedDB(DOMWindow* window)
     if (!document->securityOrigin()->canAccessDatabase())
         return 0;
 
-    if (!window->idbFactory() && window->isCurrentlyDisplayedInFrame())
-        window->setIDBFactory(IDBFactory::create(page->group().idbFactory()));
-    return window->idbFactory();
+    if (!m_idbFactory && m_window->isCurrentlyDisplayedInFrame())
+        m_idbFactory = IDBFactory::create(PageGroupIndexedDatabase::from(page->group())->factoryBackend());
+    return m_idbFactory.get();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h b/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h
index 960c144f7..d71f82dd3 100644
--- a/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h
+++ b/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
@@ -28,18 +28,30 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
+#include "DOMWindowProperty.h"
+#include "Supplementable.h"
+
 namespace WebCore {
 
 class IDBFactory;
 class DOMWindow;
 
-class DOMWindowIndexedDatabase {
+class DOMWindowIndexedDatabase : public DOMWindowProperty, public Supplement<DOMWindow> {
 public:
+    virtual ~DOMWindowIndexedDatabase();
+    static DOMWindowIndexedDatabase* from(DOMWindow*);
+
     static IDBFactory* webkitIndexedDB(DOMWindow*);
 
+    virtual void disconnectFrame() OVERRIDE;
+
 private:
-    DOMWindowIndexedDatabase();
-    ~DOMWindowIndexedDatabase();
+    explicit DOMWindowIndexedDatabase(DOMWindow*);
+
+    IDBFactory* webkitIndexedDB();
+
+    DOMWindow* m_window;
+    RefPtr<IDBFactory> m_idbFactory;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBAny.cpp b/Source/WebCore/Modules/indexeddb/IDBAny.cpp
index 57a406e2b..57a406e2b 100644
--- a/Source/WebCore/storage/IDBAny.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBAny.cpp
diff --git a/Source/WebCore/storage/IDBAny.h b/Source/WebCore/Modules/indexeddb/IDBAny.h
index 6beda5888..6beda5888 100644
--- a/Source/WebCore/storage/IDBAny.h
+++ b/Source/WebCore/Modules/indexeddb/IDBAny.h
diff --git a/Source/WebCore/storage/IDBAny.idl b/Source/WebCore/Modules/indexeddb/IDBAny.idl
index dd51c4daa..dd51c4daa 100644
--- a/Source/WebCore/storage/IDBAny.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBAny.idl
diff --git a/Source/WebCore/storage/IDBBackingStore.h b/Source/WebCore/Modules/indexeddb/IDBBackingStore.h
index b5fcb3ad7..b5fcb3ad7 100644
--- a/Source/WebCore/storage/IDBBackingStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBBackingStore.h
diff --git a/Source/WebCore/storage/IDBCallbacks.h b/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
index 7dee5500f..7dee5500f 100644
--- a/Source/WebCore/storage/IDBCallbacks.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
diff --git a/Source/WebCore/storage/IDBCursor.cpp b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
index 1dd1e9ebe..e7a01ecb7 100644
--- a/Source/WebCore/storage/IDBCursor.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
@@ -50,6 +50,7 @@ IDBCursor::IDBCursor(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest*
     , m_request(request)
     , m_source(source)
     , m_transaction(transaction)
+    , m_transactionNotifier(transaction, this)
 {
     ASSERT(m_backend);
     ASSERT(m_request);
@@ -110,6 +111,10 @@ void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
         return;
     }
 
+    if (!m_request) {
+        ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
+        return;
+    }
     // FIXME: We're not using the context from when continue was called, which means the callback
     //        will be on the original context openCursor was called on. Is this right?
     if (m_request->resetReadyState(m_transaction.get())) {
@@ -136,6 +141,13 @@ void IDBCursor::postSuccessHandlerCallback()
     m_backend->postSuccessHandlerCallback();
 }
 
+void IDBCursor::close()
+{
+    ASSERT(m_request);
+    m_request->finishCursor();
+    m_request.clear();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/storage/IDBCursor.h b/Source/WebCore/Modules/indexeddb/IDBCursor.h
index ba49d827c..eb7670643 100644
--- a/Source/WebCore/storage/IDBCursor.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.h
@@ -29,6 +29,7 @@
 #if ENABLE(INDEXED_DATABASE)
 
 #include "IDBKey.h"
+#include "IDBTransaction.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -39,7 +40,6 @@ class IDBAny;
 class IDBCallbacks;
 class IDBCursorBackendInterface;
 class IDBRequest;
-class IDBTransaction;
 class ScriptExecutionContext;
 class SerializedScriptValue;
 
@@ -71,6 +71,7 @@ public:
     PassRefPtr<IDBRequest> deleteFunction(ScriptExecutionContext*, ExceptionCode&);
 
     void postSuccessHandlerCallback();
+    void close();
 
 protected:
     IDBCursor(PassRefPtr<IDBCursorBackendInterface>, IDBRequest*, IDBAny* source, IDBTransaction*);
@@ -80,6 +81,7 @@ private:
     RefPtr<IDBRequest> m_request;
     RefPtr<IDBAny> m_source;
     RefPtr<IDBTransaction> m_transaction;
+    IDBTransaction::OpenCursorNotifier m_transactionNotifier;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBCursor.idl b/Source/WebCore/Modules/indexeddb/IDBCursor.idl
index 41540e2f2..41540e2f2 100644
--- a/Source/WebCore/storage/IDBCursor.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.idl
diff --git a/Source/WebCore/storage/IDBCursorBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
index cdbe707fc..cdbe707fc 100644
--- a/Source/WebCore/storage/IDBCursorBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
diff --git a/Source/WebCore/storage/IDBCursorBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
index 4ee5ac40a..4ee5ac40a 100644
--- a/Source/WebCore/storage/IDBCursorBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
diff --git a/Source/WebCore/storage/IDBCursorBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBCursorBackendInterface.h
index b57bb5868..b57bb5868 100644
--- a/Source/WebCore/storage/IDBCursorBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendInterface.h
diff --git a/Source/WebCore/storage/IDBCursorWithValue.cpp b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.cpp
index 30d242c98..30d242c98 100644
--- a/Source/WebCore/storage/IDBCursorWithValue.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.cpp
diff --git a/Source/WebCore/storage/IDBCursorWithValue.h b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.h
index a1ba14f96..a1ba14f96 100644
--- a/Source/WebCore/storage/IDBCursorWithValue.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.h
diff --git a/Source/WebCore/storage/IDBCursorWithValue.idl b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.idl
index 6ffc5b554..6ffc5b554 100644
--- a/Source/WebCore/storage/IDBCursorWithValue.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.idl
diff --git a/Source/WebCore/storage/IDBDatabase.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
index cc53a882a..cc53a882a 100644
--- a/Source/WebCore/storage/IDBDatabase.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
diff --git a/Source/WebCore/storage/IDBDatabase.h b/Source/WebCore/Modules/indexeddb/IDBDatabase.h
index ffe21d826..ffe21d826 100644
--- a/Source/WebCore/storage/IDBDatabase.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabase.h
diff --git a/Source/WebCore/storage/IDBDatabase.idl b/Source/WebCore/Modules/indexeddb/IDBDatabase.idl
index 9abb38d89..9abb38d89 100644
--- a/Source/WebCore/storage/IDBDatabase.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabase.idl
diff --git a/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
index 6720fe2f9..b05b32863 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
@@ -133,6 +133,7 @@ PassRefPtr<DOMStringList> IDBDatabaseBackendImpl::objectStoreNames() const
     RefPtr<DOMStringList> objectStoreNames = DOMStringList::create();
     for (ObjectStoreMap::const_iterator it = m_objectStores.begin(); it != m_objectStores.end(); ++it)
         objectStoreNames->append(it->first);
+    objectStoreNames->sort();
     return objectStoreNames.release();
 }
 
diff --git a/Source/WebCore/storage/IDBDatabaseBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
index 7a5ce1da8..7a5ce1da8 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
diff --git a/Source/WebCore/storage/IDBDatabaseBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h
index 56e8f2dbb..56e8f2dbb 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h
diff --git a/Source/WebCore/storage/IDBDatabaseCallbacks.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h
index b3f244f51..b3f244f51 100644
--- a/Source/WebCore/storage/IDBDatabaseCallbacks.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h
diff --git a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp
index 39c440909..39c440909 100644
--- a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp
diff --git a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.h
index e8b1f99b8..e8b1f99b8 100644
--- a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.h
diff --git a/Source/WebCore/storage/IDBDatabaseError.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseError.h
index 8b42f1707..8b42f1707 100644
--- a/Source/WebCore/storage/IDBDatabaseError.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseError.h
diff --git a/Source/WebCore/storage/IDBDatabaseError.idl b/Source/WebCore/Modules/indexeddb/IDBDatabaseError.idl
index 2912a1d72..2912a1d72 100644
--- a/Source/WebCore/storage/IDBDatabaseError.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseError.idl
diff --git a/Source/WebCore/storage/IDBDatabaseException.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.cpp
index 4fc681e0c..4fc681e0c 100644
--- a/Source/WebCore/storage/IDBDatabaseException.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.cpp
diff --git a/Source/WebCore/storage/IDBDatabaseException.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.h
index 570a2fcd6..570a2fcd6 100644
--- a/Source/WebCore/storage/IDBDatabaseException.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.h
diff --git a/Source/WebCore/storage/IDBDatabaseException.idl b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.idl
index c8e1b3536..c8e1b3536 100644
--- a/Source/WebCore/storage/IDBDatabaseException.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.idl
diff --git a/Source/WebCore/storage/IDBEventDispatcher.cpp b/Source/WebCore/Modules/indexeddb/IDBEventDispatcher.cpp
index 726346754..726346754 100644
--- a/Source/WebCore/storage/IDBEventDispatcher.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBEventDispatcher.cpp
diff --git a/Source/WebCore/storage/IDBEventDispatcher.h b/Source/WebCore/Modules/indexeddb/IDBEventDispatcher.h
index 00bf15463..00bf15463 100644
--- a/Source/WebCore/storage/IDBEventDispatcher.h
+++ b/Source/WebCore/Modules/indexeddb/IDBEventDispatcher.h
diff --git a/Source/WebCore/storage/IDBFactory.cpp b/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
index 42b4fee9b..42b4fee9b 100644
--- a/Source/WebCore/storage/IDBFactory.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
diff --git a/Source/WebCore/storage/IDBFactory.h b/Source/WebCore/Modules/indexeddb/IDBFactory.h
index 4611cb6c4..4611cb6c4 100644
--- a/Source/WebCore/storage/IDBFactory.h
+++ b/Source/WebCore/Modules/indexeddb/IDBFactory.h
diff --git a/Source/WebCore/storage/IDBFactory.idl b/Source/WebCore/Modules/indexeddb/IDBFactory.idl
index c44996ba0..c44996ba0 100644
--- a/Source/WebCore/storage/IDBFactory.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBFactory.idl
diff --git a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
index dd242eab5..dd242eab5 100644
--- a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
diff --git a/Source/WebCore/storage/IDBFactoryBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.h
index 7982168be..7982168be 100644
--- a/Source/WebCore/storage/IDBFactoryBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.h
diff --git a/Source/WebCore/storage/IDBFactoryBackendInterface.cpp b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.cpp
index ac136521f..ac136521f 100644
--- a/Source/WebCore/storage/IDBFactoryBackendInterface.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.cpp
diff --git a/Source/WebCore/storage/IDBFactoryBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.h
index 19a1c9784..19a1c9784 100644
--- a/Source/WebCore/storage/IDBFactoryBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.h
diff --git a/Source/WebCore/storage/IDBIndex.cpp b/Source/WebCore/Modules/indexeddb/IDBIndex.cpp
index a7c8dd3bb..b2a31f62a 100644
--- a/Source/WebCore/storage/IDBIndex.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBIndex.cpp
@@ -87,6 +87,15 @@ PassRefPtr<IDBRequest> IDBIndex::count(ScriptExecutionContext* context, PassRefP
     return request;
 }
 
+PassRefPtr<IDBRequest> IDBIndex::count(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
+{
+    IDB_TRACE("IDBIndex::count");
+    RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(key, ec);
+    if (ec)
+        return 0;
+    return count(context, keyRange.release(), ec);
+}
+
 PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, ExceptionCode& ec)
 {
     IDB_TRACE("IDBIndex::openKeyCursor");
diff --git a/Source/WebCore/storage/IDBIndex.h b/Source/WebCore/Modules/indexeddb/IDBIndex.h
index 96b380bc9..4057eed5d 100644
--- a/Source/WebCore/storage/IDBIndex.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndex.h
@@ -58,8 +58,9 @@ public:
     PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openCursor(context, 0, ec); }
     PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec) { return openCursor(context, keyRange, IDBCursor::NEXT, ec); }
     PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, unsigned short direction, ExceptionCode&);
-    PassRefPtr<IDBRequest> count(ScriptExecutionContext* context, ExceptionCode& ec) { return count(context, 0, ec); }
+    PassRefPtr<IDBRequest> count(ScriptExecutionContext* context, ExceptionCode& ec) { return count(context, static_cast<IDBKeyRange*>(0), ec); }
     PassRefPtr<IDBRequest> count(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, ExceptionCode&);
+    PassRefPtr<IDBRequest> count(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
 
     PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openKeyCursor(context, 0, ec); } 
     PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec) { return openKeyCursor(context, keyRange, IDBCursor::NEXT, ec); }
diff --git a/Source/WebCore/storage/IDBIndex.idl b/Source/WebCore/Modules/indexeddb/IDBIndex.idl
index 4c8f655e3..1e49a4f13 100644
--- a/Source/WebCore/storage/IDBIndex.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBIndex.idl
@@ -44,6 +44,8 @@ module storage {
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest count(in [Optional] IDBKeyRange range)
             raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest count(in IDBKey key)
+            raises (IDBDatabaseException);
     };
 
 }
diff --git a/Source/WebCore/storage/IDBIndexBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
index cec43b98e..cec43b98e 100644
--- a/Source/WebCore/storage/IDBIndexBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
diff --git a/Source/WebCore/storage/IDBIndexBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
index 9ef51d5a9..9ef51d5a9 100644
--- a/Source/WebCore/storage/IDBIndexBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
diff --git a/Source/WebCore/storage/IDBIndexBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h
index a0f1ba81b..a0f1ba81b 100644
--- a/Source/WebCore/storage/IDBIndexBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h
diff --git a/Source/WebCore/storage/IDBKey.cpp b/Source/WebCore/Modules/indexeddb/IDBKey.cpp
index 598686e1a..598686e1a 100644
--- a/Source/WebCore/storage/IDBKey.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKey.cpp
diff --git a/Source/WebCore/storage/IDBKey.h b/Source/WebCore/Modules/indexeddb/IDBKey.h
index 17c4eaea5..17c4eaea5 100644
--- a/Source/WebCore/storage/IDBKey.h
+++ b/Source/WebCore/Modules/indexeddb/IDBKey.h
diff --git a/Source/WebCore/storage/IDBKey.idl b/Source/WebCore/Modules/indexeddb/IDBKey.idl
index 1464d9f73..1464d9f73 100644
--- a/Source/WebCore/storage/IDBKey.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBKey.idl
diff --git a/Source/WebCore/storage/IDBKeyPath.cpp b/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
index cd5e96634..cd5e96634 100644
--- a/Source/WebCore/storage/IDBKeyPath.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
diff --git a/Source/WebCore/storage/IDBKeyPath.h b/Source/WebCore/Modules/indexeddb/IDBKeyPath.h
index c52a63ba8..c52a63ba8 100644
--- a/Source/WebCore/storage/IDBKeyPath.h
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyPath.h
diff --git a/Source/WebCore/storage/IDBKeyPathBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBKeyPathBackendImpl.cpp
index 4f0fcee64..4f0fcee64 100644
--- a/Source/WebCore/storage/IDBKeyPathBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyPathBackendImpl.cpp
diff --git a/Source/WebCore/storage/IDBKeyPathBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBKeyPathBackendImpl.h
index 1c7623221..1c7623221 100644
--- a/Source/WebCore/storage/IDBKeyPathBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyPathBackendImpl.h
diff --git a/Source/WebCore/storage/IDBKeyRange.cpp b/Source/WebCore/Modules/indexeddb/IDBKeyRange.cpp
index 0c2326e5d..0c2326e5d 100644
--- a/Source/WebCore/storage/IDBKeyRange.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyRange.cpp
diff --git a/Source/WebCore/storage/IDBKeyRange.h b/Source/WebCore/Modules/indexeddb/IDBKeyRange.h
index b9a98daeb..b9a98daeb 100644
--- a/Source/WebCore/storage/IDBKeyRange.h
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyRange.h
diff --git a/Source/WebCore/storage/IDBKeyRange.idl b/Source/WebCore/Modules/indexeddb/IDBKeyRange.idl
index 161cb9c47..161cb9c47 100644
--- a/Source/WebCore/storage/IDBKeyRange.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyRange.idl
diff --git a/Source/WebCore/storage/IDBLevelDBBackingStore.cpp b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
index f423bb007..f423bb007 100644
--- a/Source/WebCore/storage/IDBLevelDBBackingStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
diff --git a/Source/WebCore/storage/IDBLevelDBBackingStore.h b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h
index 24d439d76..24d439d76 100644
--- a/Source/WebCore/storage/IDBLevelDBBackingStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h
diff --git a/Source/WebCore/storage/IDBLevelDBCoding.cpp b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp
index f0263f89f..f0263f89f 100644
--- a/Source/WebCore/storage/IDBLevelDBCoding.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp
diff --git a/Source/WebCore/storage/IDBLevelDBCoding.h b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.h
index 14c42ea73..14c42ea73 100644
--- a/Source/WebCore/storage/IDBLevelDBCoding.h
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.h
diff --git a/Source/WebCore/storage/IDBObjectStore.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
index 6d4ffab7d..5c34666d3 100644
--- a/Source/WebCore/storage/IDBObjectStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
@@ -131,6 +131,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::put(ScriptExecutionContext* context, Pass
 
 PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::delete");
     if (!keyRange) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
@@ -257,6 +258,15 @@ PassRefPtr<IDBRequest> IDBObjectStore::count(ScriptExecutionContext* context, Pa
     return request.release();
 }
 
+PassRefPtr<IDBRequest> IDBObjectStore::count(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
+{
+    IDB_TRACE("IDBObjectStore::count");
+    RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(key, ec);
+    if (ec)
+        return 0;
+    return count(context, keyRange.release(), ec);
+}
+
 void IDBObjectStore::transactionFinished()
 {
     ASSERT(m_transaction->finished());
diff --git a/Source/WebCore/storage/IDBObjectStore.h b/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
index 60a9b1d3f..509090ed8 100644
--- a/Source/WebCore/storage/IDBObjectStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
@@ -79,8 +79,9 @@ public:
     void deleteIndex(const String& name, ExceptionCode&);
 
     PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, unsigned short direction, ExceptionCode&); 
-    PassRefPtr<IDBRequest> count(ScriptExecutionContext* context, ExceptionCode& ec) { return count(context, 0, ec); }
+    PassRefPtr<IDBRequest> count(ScriptExecutionContext* context, ExceptionCode& ec) { return count(context, static_cast<IDBKeyRange*>(0), ec); }
     PassRefPtr<IDBRequest> count(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, ExceptionCode&);
+    PassRefPtr<IDBRequest> count(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
 
     void transactionFinished();
 
diff --git a/Source/WebCore/storage/IDBObjectStore.idl b/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl
index 5bcaf8ec4..ab1200cf4 100644
--- a/Source/WebCore/storage/IDBObjectStore.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl
@@ -55,5 +55,7 @@ module storage {
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest count(in [Optional] IDBKeyRange range)
             raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest count(in IDBKey key)
+            raises (IDBDatabaseException);
     };
 }
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
index b9ecce329..548f1a293 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
@@ -79,6 +79,7 @@ PassRefPtr<DOMStringList> IDBObjectStoreBackendImpl::indexNames() const
     RefPtr<DOMStringList> indexNames = DOMStringList::create();
     for (IndexMap::const_iterator it = m_indexes.begin(); it != m_indexes.end(); ++it)
         indexNames->append(it->first);
+    indexNames->sort();
     return indexNames.release();
 }
 
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
index cdf360cdf..cdf360cdf 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
index 5e6bf49c5..5e6bf49c5 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
diff --git a/Source/WebCore/storage/IDBPendingTransactionMonitor.cpp b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.cpp
index f2de3e7a9..f2de3e7a9 100644
--- a/Source/WebCore/storage/IDBPendingTransactionMonitor.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.cpp
diff --git a/Source/WebCore/storage/IDBPendingTransactionMonitor.h b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.h
index 128b55133..128b55133 100644
--- a/Source/WebCore/storage/IDBPendingTransactionMonitor.h
+++ b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.h
diff --git a/Source/WebCore/storage/IDBRequest.cpp b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
index a04c0c668..90c188cbf 100644
--- a/Source/WebCore/storage/IDBRequest.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
@@ -58,6 +58,7 @@ IDBRequest::IDBRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> sourc
     , m_transaction(transaction)
     , m_readyState(LOADING)
     , m_requestFinished(false)
+    , m_cursorFinished(false)
     , m_contextStopped(false)
     , m_cursorType(IDBCursorBackendInterface::InvalidCursorType)
     , m_cursor(0)
@@ -182,6 +183,13 @@ void IDBRequest::setCursor(PassRefPtr<IDBCursor> cursor)
     m_cursor = cursor;
 }
 
+void IDBRequest::finishCursor()
+{
+    m_cursorFinished = true;
+    if (m_readyState != LOADING)
+        m_requestFinished = true;
+}
+
 void IDBRequest::onError(PassRefPtr<IDBDatabaseError> error)
 {
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
@@ -364,7 +372,7 @@ bool IDBRequest::dispatchEvent(PassRefPtr<Event> event)
     bool dontPreventDefault = IDBEventDispatcher::dispatch(event.get(), targets);
 
     // If the result was of type IDBCursor, or a onBlocked event, then we'll fire again.
-    if (event->type() != eventNames().blockedEvent && m_result && m_result->type() != IDBAny::IDBCursorType && m_result->type() != IDBAny::IDBCursorWithValueType)
+    if (event->type() != eventNames().blockedEvent && (!cursorToNotify || m_cursorFinished))
         m_requestFinished = true;
 
     if (cursorToNotify)
diff --git a/Source/WebCore/storage/IDBRequest.h b/Source/WebCore/Modules/indexeddb/IDBRequest.h
index 8bc7865ac..a6b573d87 100644
--- a/Source/WebCore/storage/IDBRequest.h
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.h
@@ -72,6 +72,7 @@ public:
     bool resetReadyState(IDBTransaction*);
     void setCursorType(IDBCursorBackendInterface::CursorType);
     void setCursor(PassRefPtr<IDBCursor>);
+    void finishCursor();
     IDBAny* source();
     void abort();
 
@@ -122,6 +123,7 @@ private:
 
     ReadyState m_readyState;
     bool m_requestFinished; // Is it possible that we'll fire any more events? If not, we're finished.
+    bool m_cursorFinished;
     bool m_contextStopped;
     Vector<RefPtr<Event> > m_enqueuedEvents;
 
diff --git a/Source/WebCore/storage/IDBRequest.idl b/Source/WebCore/Modules/indexeddb/IDBRequest.idl
index 8c3e38529..8c3e38529 100644
--- a/Source/WebCore/storage/IDBRequest.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.idl
diff --git a/Source/WebCore/storage/IDBTracing.h b/Source/WebCore/Modules/indexeddb/IDBTracing.h
index e1b3ef60f..e1b3ef60f 100644
--- a/Source/WebCore/storage/IDBTracing.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTracing.h
diff --git a/Source/WebCore/storage/IDBTransaction.cpp b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
index ccdfb2b9e..9e0b3a8f7 100644
--- a/Source/WebCore/storage/IDBTransaction.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
@@ -126,6 +126,36 @@ void IDBTransaction::abort()
         m_backend->abort();
 }
 
+IDBTransaction::OpenCursorNotifier::OpenCursorNotifier(PassRefPtr<IDBTransaction> transaction, IDBCursor* cursor)
+    : m_transaction(transaction),
+      m_cursor(cursor)
+{
+    m_transaction->registerOpenCursor(m_cursor);
+}
+
+IDBTransaction::OpenCursorNotifier::~OpenCursorNotifier()
+{
+    m_transaction->unregisterOpenCursor(m_cursor);
+}
+
+void IDBTransaction::registerOpenCursor(IDBCursor* cursor)
+{
+    m_openCursors.add(cursor);
+}
+
+void IDBTransaction::unregisterOpenCursor(IDBCursor* cursor)
+{
+    m_openCursors.remove(cursor);
+}
+
+void IDBTransaction::closeOpenCursors()
+{
+    HashSet<IDBCursor*> cursors;
+    cursors.swap(m_openCursors);
+    for (HashSet<IDBCursor*>::iterator i = cursors.begin(); i != cursors.end(); ++i)
+        (*i)->close();
+}
+
 void IDBTransaction::registerRequest(IDBRequest* request)
 {
     m_childRequests.add(request);
@@ -148,6 +178,7 @@ void IDBTransaction::onAbort()
 
     if (m_mode == IDBTransaction::VERSION_CHANGE)
         m_database->clearVersionChangeTransaction(this);
+    closeOpenCursors();
 
     if (m_contextStopped || !scriptExecutionContext())
         return;
@@ -160,6 +191,7 @@ void IDBTransaction::onComplete()
     ASSERT(!m_transactionFinished);
     if (m_mode == IDBTransaction::VERSION_CHANGE)
         m_database->clearVersionChangeTransaction(this);
+    closeOpenCursors();
 
     if (m_contextStopped || !scriptExecutionContext())
         return;
diff --git a/Source/WebCore/storage/IDBTransaction.h b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
index 1d34cc3bd..3c60350d6 100644
--- a/Source/WebCore/storage/IDBTransaction.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
@@ -36,10 +36,12 @@
 #include "EventTarget.h"
 #include "IDBTransactionBackendInterface.h"
 #include "IDBTransactionCallbacks.h"
+#include <wtf/HashSet.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
+class IDBCursor;
 class IDBDatabase;
 class IDBObjectStore;
 
@@ -62,6 +64,15 @@ public:
     PassRefPtr<IDBObjectStore> objectStore(const String& name, ExceptionCode&);
     void abort();
 
+    class OpenCursorNotifier {
+    public:
+        OpenCursorNotifier(PassRefPtr<IDBTransaction>, IDBCursor*);
+        ~OpenCursorNotifier();
+    private:
+        RefPtr<IDBTransaction> m_transaction;
+        IDBCursor* m_cursor;
+    };
+
     void registerRequest(IDBRequest*);
     void unregisterRequest(IDBRequest*);
     void objectStoreCreated(const String&, PassRefPtr<IDBObjectStore>);
@@ -93,6 +104,10 @@ private:
     IDBTransaction(ScriptExecutionContext*, PassRefPtr<IDBTransactionBackendInterface>, IDBDatabase*);
 
     void enqueueEvent(PassRefPtr<Event>);
+    void closeOpenCursors();
+
+    void registerOpenCursor(IDBCursor*);
+    void unregisterOpenCursor(IDBCursor*);
 
     // EventTarget
     virtual void refEventTarget() { ref(); }
@@ -111,6 +126,8 @@ private:
     typedef HashMap<String, RefPtr<IDBObjectStore> > IDBObjectStoreMap;
     IDBObjectStoreMap m_objectStoreMap;
 
+    HashSet<IDBCursor*> m_openCursors;
+
     EventTargetData m_eventTargetData;
 };
 
diff --git a/Source/WebCore/storage/IDBTransaction.idl b/Source/WebCore/Modules/indexeddb/IDBTransaction.idl
index 9e3b0e920..9e3b0e920 100644
--- a/Source/WebCore/storage/IDBTransaction.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.idl
diff --git a/Source/WebCore/storage/IDBTransactionBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
index 012e6b6dd..012e6b6dd 100644
--- a/Source/WebCore/storage/IDBTransactionBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
diff --git a/Source/WebCore/storage/IDBTransactionBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.h
index 2f9c2ba84..2f9c2ba84 100644
--- a/Source/WebCore/storage/IDBTransactionBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.h
diff --git a/Source/WebCore/storage/IDBTransactionBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
index 003dbfdcc..003dbfdcc 100644
--- a/Source/WebCore/storage/IDBTransactionBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
diff --git a/Source/WebCore/storage/IDBTransactionCallbacks.h b/Source/WebCore/Modules/indexeddb/IDBTransactionCallbacks.h
index 8d906a6eb..8d906a6eb 100644
--- a/Source/WebCore/storage/IDBTransactionCallbacks.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionCallbacks.h
diff --git a/Source/WebCore/storage/IDBTransactionCoordinator.cpp b/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.cpp
index edaff2c50..edaff2c50 100644
--- a/Source/WebCore/storage/IDBTransactionCoordinator.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.cpp
diff --git a/Source/WebCore/storage/IDBTransactionCoordinator.h b/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.h
index ef99e737a..ef99e737a 100644
--- a/Source/WebCore/storage/IDBTransactionCoordinator.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.h
diff --git a/Source/WebCore/storage/IDBVersionChangeEvent.cpp b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.cpp
index a299d7485..a299d7485 100644
--- a/Source/WebCore/storage/IDBVersionChangeEvent.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.cpp
diff --git a/Source/WebCore/storage/IDBVersionChangeEvent.h b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.h
index dae9f236c..dae9f236c 100644
--- a/Source/WebCore/storage/IDBVersionChangeEvent.h
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.h
diff --git a/Source/WebCore/storage/IDBVersionChangeEvent.idl b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.idl
index c6a41718f..c6a41718f 100644
--- a/Source/WebCore/storage/IDBVersionChangeEvent.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.idl
diff --git a/Source/WebCore/storage/IDBVersionChangeRequest.cpp b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.cpp
index f13ca9d3c..f13ca9d3c 100644
--- a/Source/WebCore/storage/IDBVersionChangeRequest.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.cpp
diff --git a/Source/WebCore/storage/IDBVersionChangeRequest.h b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.h
index ce284e933..ce284e933 100644
--- a/Source/WebCore/storage/IDBVersionChangeRequest.h
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.h
diff --git a/Source/WebCore/storage/IDBVersionChangeRequest.idl b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.idl
index 2aa238a8b..2aa238a8b 100644
--- a/Source/WebCore/storage/IDBVersionChangeRequest.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.idl
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.cpp b/Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.cpp
index 204d6e3b7..5803fc0c5 100644
--- a/Source/WebCore/mediastream/NavigatorMediaStream.cpp
+++ b/Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.cpp
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
@@ -24,50 +24,43 @@
  */
 
 #include "config.h"
-#include "NavigatorMediaStream.h"
+#include "PageGroupIndexedDatabase.h"
 
-#if ENABLE(MEDIA_STREAM)
+#if ENABLE(INDEXED_DATABASE)
 
-#include "Document.h"
-#include "ExceptionCode.h"
-#include "Frame.h"
-#include "Navigator.h"
-#include "NavigatorUserMediaErrorCallback.h"
-#include "NavigatorUserMediaSuccessCallback.h"
-#include "Page.h"
-#include "UserMediaController.h"
-#include "UserMediaRequest.h"
+#include "IDBFactoryBackendInterface.h"
+#include "PageGroup.h"
 
 namespace WebCore {
 
-NavigatorMediaStream::NavigatorMediaStream()
+PageGroupIndexedDatabase::PageGroupIndexedDatabase()
 {
 }
 
-NavigatorMediaStream::~NavigatorMediaStream()
+PageGroupIndexedDatabase::~PageGroupIndexedDatabase()
 {
 }
 
-void NavigatorMediaStream::webkitGetUserMedia(Navigator* navigator, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback, ExceptionCode& ec)
+PageGroupIndexedDatabase* PageGroupIndexedDatabase::from(PageGroup& group)
 {
-    if (!successCallback)
-        return;
-
-    UserMediaController* userMedia = UserMediaController::from(navigator->frame());
-    if (!userMedia) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
-    }
-
-    RefPtr<UserMediaRequest> request = UserMediaRequest::create(navigator->frame()->document(), userMedia, options, successCallback, errorCallback);
-    if (!request) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("PageGroupIndexedDatabase"));
+    PageGroupIndexedDatabase* supplement = static_cast<PageGroupIndexedDatabase*>(Supplement<PageGroup>::from(&group, name));
+    if (!supplement) {
+        supplement = new PageGroupIndexedDatabase();
+        provideTo(&group, name, adoptPtr(supplement));
     }
+    return supplement;
+}
 
-    request->start();
+IDBFactoryBackendInterface* PageGroupIndexedDatabase::factoryBackend()
+{
+    // Do not add page setting based access control here since this object is shared by all pages in
+    // the group and having per-page controls is misleading.
+    if (!m_factoryBackend)
+        m_factoryBackend = IDBFactoryBackendInterface::create();
+    return m_factoryBackend.get();
 }
 
 } // namespace WebCore
 
-#endif // ENABLE(MEDIA_STREAM)
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.h b/Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.h
index b7b01fa52..187c78a5c 100644
--- a/Source/WebCore/mediastream/NavigatorMediaStream.h
+++ b/Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.h
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
@@ -23,33 +23,33 @@
  * DAMAGE.
  */
 
-#ifndef NavigatorMediaStream_h
-#define NavigatorMediaStream_h
+#ifndef PageGroupIndexedDatabase_h
+#define PageGroupIndexedDatabase_h
 
-#if ENABLE(MEDIA_STREAM)
+#if ENABLE(INDEXED_DATABASE)
 
-#include <wtf/PassRefPtr.h>
-#include <wtf/text/WTFString.h>
+#include "Supplementable.h"
 
 namespace WebCore {
 
-class Navigator;
-class NavigatorUserMediaErrorCallback;
-class NavigatorUserMediaSuccessCallback;
+class IDBFactoryBackendInterface;
+class PageGroup;
 
-typedef int ExceptionCode;
-
-class NavigatorMediaStream {
+class PageGroupIndexedDatabase : public Supplement<PageGroup> {
 public:
-    static void webkitGetUserMedia(Navigator*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>, ExceptionCode&);
+    virtual ~PageGroupIndexedDatabase();
+    static PageGroupIndexedDatabase* from(PageGroup&);
+
+    IDBFactoryBackendInterface* factoryBackend();
 
 private:
-    NavigatorMediaStream();
-    ~NavigatorMediaStream();
+    PageGroupIndexedDatabase();
+
+    RefPtr<IDBFactoryBackendInterface> m_factoryBackend;
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(MEDIA_STREAM)
+#endif // ENABLE(INDEXED_DATABASE)
 
-#endif // NavigatorMediaStream_h
+#endif // PageGroupIndexedDatabase_h
diff --git a/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.cpp b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.cpp
new file mode 100644
index 000000000..b3d209992
--- /dev/null
+++ b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(WORKERS) && ENABLE(INDEXED_DATABASE)
+
+#include "WorkerContextIndexedDatabase.h"
+
+#include "IDBFactory.h"
+#include "IDBFactoryBackendInterface.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+
+WorkerContextIndexedDatabase::WorkerContextIndexedDatabase(ScriptExecutionContext* context)
+    : m_context(context)
+{
+}
+
+WorkerContextIndexedDatabase::~WorkerContextIndexedDatabase()
+{
+}
+
+WorkerContextIndexedDatabase* WorkerContextIndexedDatabase::from(ScriptExecutionContext* context)
+{
+    AtomicString name = "WorkderContextIndexedDatabase";
+    WorkerContextIndexedDatabase* supplement = static_cast<WorkerContextIndexedDatabase*>(Supplement<ScriptExecutionContext>::from(context, name));
+    if (!supplement) {
+        supplement = new WorkerContextIndexedDatabase(context);
+        provideTo(context, name, adoptPtr(supplement));
+    }
+    return supplement;
+}
+
+IDBFactory* WorkerContextIndexedDatabase::webkitIndexedDB(ScriptExecutionContext* context)
+{
+    return from(context)->webkitIndexedDB();
+}
+
+IDBFactory* WorkerContextIndexedDatabase::webkitIndexedDB()
+{
+    if (!m_context->securityOrigin()->canAccessDatabase())
+        return 0;
+    if (!m_factoryBackend)
+        m_factoryBackend = IDBFactoryBackendInterface::create();
+    if (!m_idbFactory)
+        m_idbFactory = IDBFactory::create(m_factoryBackend.get());
+    return m_idbFactory.get();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS) && ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.h b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.h
new file mode 100644
index 000000000..836caa8c6
--- /dev/null
+++ b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef WorkerContextIndexedDatabase_h
+#define WorkerContextIndexedDatabase_h
+
+#if ENABLE(WORKERS) && ENABLE(INDEXED_DATABASE)
+
+#include "Supplementable.h"
+
+namespace WebCore {
+
+class IDBFactory;
+class IDBFactoryBackendInterface;
+class ScriptExecutionContext;
+
+class WorkerContextIndexedDatabase : public Supplement<ScriptExecutionContext> {
+public:
+    virtual ~WorkerContextIndexedDatabase();
+    static WorkerContextIndexedDatabase* from(ScriptExecutionContext*);
+
+    static IDBFactory* webkitIndexedDB(ScriptExecutionContext*);
+
+private:
+    explicit WorkerContextIndexedDatabase(ScriptExecutionContext*);
+
+    IDBFactory* webkitIndexedDB();
+
+    ScriptExecutionContext* m_context;
+    RefPtr<IDBFactoryBackendInterface> m_factoryBackend;
+    RefPtr<IDBFactory> m_idbFactory;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS) && ENABLE(INDEXED_DATABASE)
+
+#endif // WorkerContextIndexedDatabase_h
diff --git a/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.idl b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.idl
new file mode 100644
index 000000000..f9795a89d
--- /dev/null
+++ b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.idl
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module threads {
+
+    interface [
+        Conditional=INDEXED_DATABASE,
+        Supplemental=WorkerContext
+    ] WorkerContextIndexedDatabase {
+        readonly attribute [V8EnabledAtRuntime] IDBFactory webkitIndexedDB;
+
+        attribute [V8EnabledAtRuntime] IDBCursorConstructor webkitIDBCursor;
+        attribute [V8EnabledAtRuntime] IDBDatabaseConstructor webkitIDBDatabase;
+        attribute [V8EnabledAtRuntime] IDBDatabaseErrorConstructor webkitIDBDatabaseError;
+        attribute [V8EnabledAtRuntime] IDBDatabaseExceptionConstructor webkitIDBDatabaseException;
+        attribute [V8EnabledAtRuntime] IDBFactoryConstructor webkitIDBFactory;
+        attribute [V8EnabledAtRuntime] IDBIndexConstructor webkitIDBIndex;
+        attribute [V8EnabledAtRuntime] IDBKeyRangeConstructor webkitIDBKeyRange;
+        attribute [V8EnabledAtRuntime] IDBObjectStoreConstructor webkitIDBObjectStore;
+        attribute [V8EnabledAtRuntime] IDBRequestConstructor webkitIDBRequest;
+        attribute [V8EnabledAtRuntime] IDBTransactionConstructor webkitIDBTransaction;
+    };
+
+}
diff --git a/Source/WebCore/Modules/intents/DOMWindowIntents.idl b/Source/WebCore/Modules/intents/DOMWindowIntents.idl
index b8a089d34..638dbe034 100644
--- a/Source/WebCore/Modules/intents/DOMWindowIntents.idl
+++ b/Source/WebCore/Modules/intents/DOMWindowIntents.idl
@@ -1,20 +1,27 @@
 /*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 module window {
diff --git a/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl b/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl
new file mode 100644
index 000000000..85011ae96
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    interface [
+        Conditional=MEDIA_STREAM,
+        Supplemental=DOMWindow
+    ] DOMWindowMediaStream {
+        attribute [V8EnabledAtRuntime] PeerConnectionConstructor webkitPeerConnection;
+        attribute MediaStreamEventConstructor MediaStreamEvent;
+    };
+
+}
diff --git a/Source/WebCore/mediastream/LocalMediaStream.cpp b/Source/WebCore/Modules/mediastream/LocalMediaStream.cpp
index 31ba25bfc..31ba25bfc 100644
--- a/Source/WebCore/mediastream/LocalMediaStream.cpp
+++ b/Source/WebCore/Modules/mediastream/LocalMediaStream.cpp
diff --git a/Source/WebCore/mediastream/LocalMediaStream.h b/Source/WebCore/Modules/mediastream/LocalMediaStream.h
index 8c958085a..8c958085a 100644
--- a/Source/WebCore/mediastream/LocalMediaStream.h
+++ b/Source/WebCore/Modules/mediastream/LocalMediaStream.h
diff --git a/Source/WebCore/mediastream/LocalMediaStream.idl b/Source/WebCore/Modules/mediastream/LocalMediaStream.idl
index 49360fff2..49360fff2 100644
--- a/Source/WebCore/mediastream/LocalMediaStream.idl
+++ b/Source/WebCore/Modules/mediastream/LocalMediaStream.idl
diff --git a/Source/WebCore/mediastream/MediaStream.cpp b/Source/WebCore/Modules/mediastream/MediaStream.cpp
index 01f1e04e6..01f1e04e6 100644
--- a/Source/WebCore/mediastream/MediaStream.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStream.cpp
diff --git a/Source/WebCore/mediastream/MediaStream.h b/Source/WebCore/Modules/mediastream/MediaStream.h
index 0db47879f..0db47879f 100644
--- a/Source/WebCore/mediastream/MediaStream.h
+++ b/Source/WebCore/Modules/mediastream/MediaStream.h
diff --git a/Source/WebCore/mediastream/MediaStream.idl b/Source/WebCore/Modules/mediastream/MediaStream.idl
index 65a183312..65a183312 100644
--- a/Source/WebCore/mediastream/MediaStream.idl
+++ b/Source/WebCore/Modules/mediastream/MediaStream.idl
diff --git a/Source/WebCore/mediastream/MediaStreamEvent.cpp b/Source/WebCore/Modules/mediastream/MediaStreamEvent.cpp
index be0e5cbc5..be0e5cbc5 100644
--- a/Source/WebCore/mediastream/MediaStreamEvent.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamEvent.cpp
diff --git a/Source/WebCore/mediastream/MediaStreamEvent.h b/Source/WebCore/Modules/mediastream/MediaStreamEvent.h
index 01b06565b..01b06565b 100644
--- a/Source/WebCore/mediastream/MediaStreamEvent.h
+++ b/Source/WebCore/Modules/mediastream/MediaStreamEvent.h
diff --git a/Source/WebCore/mediastream/MediaStreamEvent.idl b/Source/WebCore/Modules/mediastream/MediaStreamEvent.idl
index a1930a4b6..a1930a4b6 100644
--- a/Source/WebCore/mediastream/MediaStreamEvent.idl
+++ b/Source/WebCore/Modules/mediastream/MediaStreamEvent.idl
diff --git a/Source/WebCore/mediastream/MediaStreamList.cpp b/Source/WebCore/Modules/mediastream/MediaStreamList.cpp
index 50921300e..ba7407419 100644
--- a/Source/WebCore/mediastream/MediaStreamList.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamList.cpp
@@ -50,6 +50,8 @@ unsigned MediaStreamList::length() const
 
 MediaStream* MediaStreamList::item(unsigned index) const
 {
+    if (index >= m_streams.size())
+        return 0;
     return m_streams[index].get();
 }
 
diff --git a/Source/WebCore/mediastream/MediaStreamList.h b/Source/WebCore/Modules/mediastream/MediaStreamList.h
index a056ade51..a056ade51 100644
--- a/Source/WebCore/mediastream/MediaStreamList.h
+++ b/Source/WebCore/Modules/mediastream/MediaStreamList.h
diff --git a/Source/WebCore/mediastream/MediaStreamList.idl b/Source/WebCore/Modules/mediastream/MediaStreamList.idl
index d182e6f82..d182e6f82 100644
--- a/Source/WebCore/mediastream/MediaStreamList.idl
+++ b/Source/WebCore/Modules/mediastream/MediaStreamList.idl
diff --git a/Source/WebCore/mediastream/MediaStreamRegistry.cpp b/Source/WebCore/Modules/mediastream/MediaStreamRegistry.cpp
index eb9fdbbb3..eb9fdbbb3 100644
--- a/Source/WebCore/mediastream/MediaStreamRegistry.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamRegistry.cpp
diff --git a/Source/WebCore/mediastream/MediaStreamRegistry.h b/Source/WebCore/Modules/mediastream/MediaStreamRegistry.h
index 1f9274509..1f9274509 100644
--- a/Source/WebCore/mediastream/MediaStreamRegistry.h
+++ b/Source/WebCore/Modules/mediastream/MediaStreamRegistry.h
diff --git a/Source/WebCore/mediastream/MediaStreamTrack.cpp b/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
index c34efa5f2..c34efa5f2 100644
--- a/Source/WebCore/mediastream/MediaStreamTrack.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
diff --git a/Source/WebCore/mediastream/MediaStreamTrack.h b/Source/WebCore/Modules/mediastream/MediaStreamTrack.h
index c45be18c7..c45be18c7 100644
--- a/Source/WebCore/mediastream/MediaStreamTrack.h
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrack.h
diff --git a/Source/WebCore/mediastream/MediaStreamTrack.idl b/Source/WebCore/Modules/mediastream/MediaStreamTrack.idl
index 79875975e..79875975e 100644
--- a/Source/WebCore/mediastream/MediaStreamTrack.idl
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrack.idl
diff --git a/Source/WebCore/mediastream/MediaStreamTrackList.cpp b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp
index 92bf0f786..b63bcef61 100644
--- a/Source/WebCore/mediastream/MediaStreamTrackList.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp
@@ -51,7 +51,8 @@ unsigned MediaStreamTrackList::length() const
 
 MediaStreamTrack* MediaStreamTrackList::item(unsigned index) const
 {
-    ASSERT(index < length());
+    if (index >= m_trackVector.size())
+        return 0;
     return m_trackVector[index].get();
 }
 
diff --git a/Source/WebCore/mediastream/MediaStreamTrackList.h b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.h
index 4d61f85e6..4d61f85e6 100644
--- a/Source/WebCore/mediastream/MediaStreamTrackList.h
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.h
diff --git a/Source/WebCore/mediastream/MediaStreamTrackList.idl b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.idl
index 4dd9c2972..4dd9c2972 100644
--- a/Source/WebCore/mediastream/MediaStreamTrackList.idl
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.idl
diff --git a/Source/WebCore/Modules/mediastream/NavigatorMediaStream.cpp b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.cpp
new file mode 100644
index 000000000..0b21d8ca2
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.cpp
@@ -0,0 +1,70 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (c) 2000 Daniel Molkentin (molkentin@kde.org)
+ *  Copyright (c) 2000 Stefan Schimanski (schimmi@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "NavigatorMediaStream.h"
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "Navigator.h"
+#include "NavigatorUserMediaErrorCallback.h"
+#include "NavigatorUserMediaSuccessCallback.h"
+#include "Page.h"
+#include "UserMediaController.h"
+#include "UserMediaRequest.h"
+
+namespace WebCore {
+
+NavigatorMediaStream::NavigatorMediaStream()
+{
+}
+
+NavigatorMediaStream::~NavigatorMediaStream()
+{
+}
+
+void NavigatorMediaStream::webkitGetUserMedia(Navigator* navigator, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback, ExceptionCode& ec)
+{
+    if (!successCallback)
+        return;
+
+    UserMediaController* userMedia = UserMediaController::from(navigator->frame() ? navigator->frame()->page() : 0);
+    if (!userMedia) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    RefPtr<UserMediaRequest> request = UserMediaRequest::create(navigator->frame()->document(), userMedia, options, successCallback, errorCallback);
+    if (!request) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    request->start();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/Modules/mediastream/NavigatorMediaStream.h b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.h
new file mode 100644
index 000000000..6ea5da4c0
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.h
@@ -0,0 +1,49 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef NavigatorMediaStream_h
+#define NavigatorMediaStream_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Navigator;
+class NavigatorUserMediaErrorCallback;
+class NavigatorUserMediaSuccessCallback;
+
+typedef int ExceptionCode;
+
+class NavigatorMediaStream {
+public:
+    static void webkitGetUserMedia(Navigator*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>, ExceptionCode&);
+
+private:
+    NavigatorMediaStream();
+    ~NavigatorMediaStream();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // NavigatorMediaStream_h
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.idl b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.idl
index 84e062e64..84e062e64 100644
--- a/Source/WebCore/mediastream/NavigatorMediaStream.idl
+++ b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.idl
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaError.h b/Source/WebCore/Modules/mediastream/NavigatorUserMediaError.h
index 5edd97d90..5edd97d90 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaError.h
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaError.h
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaError.idl b/Source/WebCore/Modules/mediastream/NavigatorUserMediaError.idl
index 293450b22..293450b22 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaError.idl
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaError.idl
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.h b/Source/WebCore/Modules/mediastream/NavigatorUserMediaErrorCallback.h
index dd3c8b32b..dd3c8b32b 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.h
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaErrorCallback.h
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl b/Source/WebCore/Modules/mediastream/NavigatorUserMediaErrorCallback.idl
index 44928f81f..44928f81f 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaErrorCallback.idl
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.h b/Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.h
index 2b6aae5df..2b6aae5df 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.h
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.h
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl b/Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.idl
index 0a661807b..0a661807b 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.idl
diff --git a/Source/WebCore/mediastream/PeerConnection.cpp b/Source/WebCore/Modules/mediastream/PeerConnection.cpp
index 4dd3bf0da..4dd3bf0da 100644
--- a/Source/WebCore/mediastream/PeerConnection.cpp
+++ b/Source/WebCore/Modules/mediastream/PeerConnection.cpp
diff --git a/Source/WebCore/mediastream/PeerConnection.h b/Source/WebCore/Modules/mediastream/PeerConnection.h
index fd2f2fb2d..fd2f2fb2d 100644
--- a/Source/WebCore/mediastream/PeerConnection.h
+++ b/Source/WebCore/Modules/mediastream/PeerConnection.h
diff --git a/Source/WebCore/mediastream/PeerConnection.idl b/Source/WebCore/Modules/mediastream/PeerConnection.idl
index 7760d10ce..7543a0dbc 100644
--- a/Source/WebCore/mediastream/PeerConnection.idl
+++ b/Source/WebCore/Modules/mediastream/PeerConnection.idl
@@ -27,7 +27,6 @@ module p2p {
     interface [
         Conditional=MEDIA_STREAM,
         ActiveDOMObject,
-        ConstructorParameters=2,
         Constructor(in DOMString serverConfiguration, in [Callback] SignalingCallback signalingCallback),
         CallWith=ScriptExecutionContext,
         JSCustomConstructor,
diff --git a/Source/WebCore/mediastream/SignalingCallback.h b/Source/WebCore/Modules/mediastream/SignalingCallback.h
index a4a30e712..a4a30e712 100644
--- a/Source/WebCore/mediastream/SignalingCallback.h
+++ b/Source/WebCore/Modules/mediastream/SignalingCallback.h
diff --git a/Source/WebCore/mediastream/SignalingCallback.idl b/Source/WebCore/Modules/mediastream/SignalingCallback.idl
index e2e0cebd2..e2e0cebd2 100644
--- a/Source/WebCore/mediastream/SignalingCallback.idl
+++ b/Source/WebCore/Modules/mediastream/SignalingCallback.idl
diff --git a/Source/WebCore/mediastream/UserMediaClient.h b/Source/WebCore/Modules/mediastream/UserMediaClient.h
index 744711e42..744711e42 100644
--- a/Source/WebCore/mediastream/UserMediaClient.h
+++ b/Source/WebCore/Modules/mediastream/UserMediaClient.h
diff --git a/Source/WebCore/mediastream/UserMediaController.cpp b/Source/WebCore/Modules/mediastream/UserMediaController.cpp
index 3b4dd14e9..3077d411b 100644
--- a/Source/WebCore/mediastream/UserMediaController.cpp
+++ b/Source/WebCore/Modules/mediastream/UserMediaController.cpp
@@ -52,7 +52,7 @@ PassOwnPtr<UserMediaController> UserMediaController::create(UserMediaClient* cli
 
 void provideUserMediaTo(Page* page, UserMediaClient* client)
 {
-    PageSupplement::provideTo(page, UserMediaController::supplementName(), UserMediaController::create(client));
+    UserMediaController::provideTo(page, UserMediaController::supplementName(), UserMediaController::create(client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/mediastream/UserMediaController.h b/Source/WebCore/Modules/mediastream/UserMediaController.h
index 6b0590ecf..dd85c0341 100644
--- a/Source/WebCore/mediastream/UserMediaController.h
+++ b/Source/WebCore/Modules/mediastream/UserMediaController.h
@@ -27,16 +27,13 @@
 
 #if ENABLE(MEDIA_STREAM)
 
-#include "PageSupplement.h"
+#include "Page.h"
 #include "UserMediaClient.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-class Frame;
-class Page;
-
-class UserMediaController : public PageSupplement {
+class UserMediaController : public Supplement<Page> {
 public:
     ~UserMediaController();
 
@@ -46,8 +43,7 @@ public:
 
     static PassOwnPtr<UserMediaController> create(UserMediaClient*);
     static const AtomicString& supplementName();
-    static UserMediaController* from(Frame* frame) { return static_cast<UserMediaController*>(PageSupplement::from(frame, supplementName())); }
-    static UserMediaController* from(Page* page) { return static_cast<UserMediaController*>(PageSupplement::from(page, supplementName())); }
+    static UserMediaController* from(Page* page) { return static_cast<UserMediaController*>(Supplement<Page>::from(page, supplementName())); }
 
 protected:
     UserMediaController(UserMediaClient*);
diff --git a/Source/WebCore/mediastream/UserMediaRequest.cpp b/Source/WebCore/Modules/mediastream/UserMediaRequest.cpp
index 3f3c9efe1..3f3c9efe1 100644
--- a/Source/WebCore/mediastream/UserMediaRequest.cpp
+++ b/Source/WebCore/Modules/mediastream/UserMediaRequest.cpp
diff --git a/Source/WebCore/mediastream/UserMediaRequest.h b/Source/WebCore/Modules/mediastream/UserMediaRequest.h
index 6af31f30b..6af31f30b 100644
--- a/Source/WebCore/mediastream/UserMediaRequest.h
+++ b/Source/WebCore/Modules/mediastream/UserMediaRequest.h
diff --git a/Source/WebCore/Modules/speech/DOMWindowSpeech.idl b/Source/WebCore/Modules/speech/DOMWindowSpeech.idl
new file mode 100644
index 000000000..70200b1be
--- /dev/null
+++ b/Source/WebCore/Modules/speech/DOMWindowSpeech.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        Supplemental=DOMWindow
+    ] DOMWindowSpeech {
+        attribute [V8EnabledAtRuntime] SpeechRecognitionErrorConstructor webkitSpeechRecognitionError;
+        attribute [V8EnabledAtRuntime] SpeechRecognitionEventConstructor webkitSpeechRecognitionEvent;
+        attribute [V8EnabledAtRuntime] SpeechGrammarConstructor webkitSpeechGrammar;
+        attribute [V8EnabledAtRuntime] SpeechGrammarListConstructor webkitSpeechGrammarList;
+    };
+}
diff --git a/Source/WebCore/Modules/speech/SpeechGrammar.cpp b/Source/WebCore/Modules/speech/SpeechGrammar.cpp
new file mode 100644
index 000000000..1736e1e4a
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammar.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechGrammar.h"
+
+#include "Document.h"
+
+namespace WebCore {
+
+PassRefPtr<SpeechGrammar> SpeechGrammar::create()
+{
+    return adoptRef(new SpeechGrammar);
+}
+
+PassRefPtr<SpeechGrammar> SpeechGrammar::create(const KURL& src, double weight)
+{
+    return adoptRef(new SpeechGrammar(src, weight));
+}
+
+void SpeechGrammar::setSrc(ScriptExecutionContext* scriptExecutionContext, const String& src)
+{
+    ASSERT(scriptExecutionContext->isDocument());
+    Document* document = static_cast<Document*>(scriptExecutionContext);
+    m_src = document->completeURL(src);
+}
+
+SpeechGrammar::SpeechGrammar()
+    : m_weight(1.0)
+{
+}
+
+SpeechGrammar::SpeechGrammar(const KURL& src, double weight)
+    : m_src(src)
+    , m_weight(weight)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechGrammar.h b/Source/WebCore/Modules/speech/SpeechGrammar.h
new file mode 100644
index 000000000..62088c18b
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammar.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechGrammar_h
+#define SpeechGrammar_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "KURL.h"
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class SpeechGrammar : public RefCounted<SpeechGrammar> {
+public:
+    static PassRefPtr<SpeechGrammar> create(); // FIXME: The spec is not clear on what the constructor should look like.
+    static PassRefPtr<SpeechGrammar> create(const KURL& src, double weight);
+
+    const KURL& src(ScriptExecutionContext*) const { return m_src; }
+    void setSrc(ScriptExecutionContext*, const String& src);
+
+    double weight() const { return m_weight; }
+    void setWeight(double weight) { m_weight = weight; }
+
+private:
+    SpeechGrammar();
+    SpeechGrammar(const KURL& src, double weight);
+
+    KURL m_src;
+    double m_weight;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechGrammar_h
diff --git a/Source/WebCore/Modules/speech/SpeechGrammar.idl b/Source/WebCore/Modules/speech/SpeechGrammar.idl
new file mode 100644
index 000000000..b793ac3ab
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammar.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        Constructor
+    ] SpeechGrammar {
+        attribute [URL,CallWith=ScriptExecutionContext] DOMString src;
+        attribute float weight;
+    };
+}
diff --git a/Source/WebCore/Modules/speech/SpeechGrammarList.cpp b/Source/WebCore/Modules/speech/SpeechGrammarList.cpp
new file mode 100644
index 000000000..841df2948
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammarList.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechGrammarList.h"
+
+#include "Document.h"
+
+namespace WebCore {
+
+PassRefPtr<SpeechGrammarList> SpeechGrammarList::create()
+{
+    return adoptRef(new SpeechGrammarList);
+}
+
+SpeechGrammar* SpeechGrammarList::item(unsigned long index) const
+{
+    if (index >= m_grammars.size())
+        return 0;
+
+    return m_grammars[index].get();
+}
+
+void SpeechGrammarList::addFromUri(ScriptExecutionContext* scriptExecutionContext, const String& src, double weight)
+{
+    ASSERT(scriptExecutionContext->isDocument());
+    Document* document = static_cast<Document*>(scriptExecutionContext);
+    m_grammars.append(SpeechGrammar::create(document->completeURL(src), weight));
+}
+
+void SpeechGrammarList::addFromString(const String& string, double weight)
+{
+    String urlString = String("data:application/xml,") + encodeWithURLEscapeSequences(string);
+    m_grammars.append(SpeechGrammar::create(KURL(KURL(), urlString), weight));
+}
+
+SpeechGrammarList::SpeechGrammarList()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechGrammarList.h b/Source/WebCore/Modules/speech/SpeechGrammarList.h
new file mode 100644
index 000000000..d7b53d757
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammarList.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechGrammarList_h
+#define SpeechGrammarList_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechGrammar.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class SpeechGrammarList : public RefCounted<SpeechGrammarList> {
+public:
+    static PassRefPtr<SpeechGrammarList> create();
+
+    unsigned long length() const { return m_grammars.size(); }
+    SpeechGrammar* item(unsigned long) const;
+
+    void addFromUri(ScriptExecutionContext*, const String& src, double weight = 1.0);
+    void addFromString(const String&, double weight = 1.0);
+
+private:
+    SpeechGrammarList();
+
+    Vector<RefPtr<SpeechGrammar> > m_grammars;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechGrammarList_h
diff --git a/Source/WebCore/Modules/speech/SpeechGrammarList.idl b/Source/WebCore/Modules/speech/SpeechGrammarList.idl
new file mode 100644
index 000000000..bf4d7c69f
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammarList.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        IndexedGetter,
+        Constructor,
+    ] SpeechGrammarList {
+        readonly attribute unsigned long length;
+        SpeechGrammar item(in [IsIndex] unsigned long index);
+        [CallWith=ScriptExecutionContext] void addFromUri(in DOMString src, in [Optional] float weight);
+        void addFromString(in DOMString string, in [Optional] float weight);
+    };
+}
diff --git a/Source/WebCore/page/NavigatorSupplement.cpp b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.cpp
index bb424d4d6..c58c1e78e 100644
--- a/Source/WebCore/page/NavigatorSupplement.cpp
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.cpp
@@ -24,27 +24,24 @@
  */
 
 #include "config.h"
-#include "NavigatorSupplement.h"
 
-#include "Navigator.h"
-#include <wtf/PassOwnPtr.h>
+#if ENABLE(SCRIPTED_SPEECH)
 
-namespace WebCore {
+#include "SpeechRecognitionAlternative.h"
 
-NavigatorSupplement::~NavigatorSupplement()
-{
-}
+namespace WebCore {
 
-void NavigatorSupplement::provideTo(Navigator* navigator, const AtomicString& key, PassOwnPtr<NavigatorSupplement> supplement)
+PassRefPtr<SpeechRecognitionAlternative> SpeechRecognitionAlternative::create(const String& transcript, double confidence)
 {
-    navigator->provideSupplement(key, supplement);
+    return adoptRef(new SpeechRecognitionAlternative(transcript, confidence));
 }
 
-NavigatorSupplement* NavigatorSupplement::from(Navigator* navigator, const AtomicString& name)
+SpeechRecognitionAlternative::SpeechRecognitionAlternative(const String& transcript, double confidence)
+    : m_transcript(transcript)
+    , m_confidence(confidence)
 {
-    if (!navigator)
-        return 0;
-    return navigator->requireSupplement(name);
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.h b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.h
new file mode 100644
index 000000000..c577ea7ce
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechRecognitionAlternative_h
+#define SpeechRecognitionAlternative_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class SpeechRecognitionAlternative : public RefCounted<SpeechRecognitionAlternative> {
+public:
+    static PassRefPtr<SpeechRecognitionAlternative> create(const String&, double);
+
+    const String& transcript() const { return m_transcript; }
+    double confidence() const { return m_confidence; }
+
+private:
+    SpeechRecognitionAlternative(const String&, double);
+
+    String m_transcript;
+    double m_confidence;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechRecognitionAlternative_h
diff --git a/Source/WebCore/page/PageSupplement.h b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.idl
index e1b48aa90..a9d4dec3d 100644
--- a/Source/WebCore/page/PageSupplement.h
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.idl
@@ -23,28 +23,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef PageSupplement_h
-#define PageSupplement_h
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH
+    ] SpeechRecognitionAlternative {
+        readonly attribute DOMString transcript;
+        readonly attribute float confidence;
+    };
+}
 
-#include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/text/AtomicString.h>
-
-namespace WebCore {
-
-class Page;
-class Frame;
-
-class PageSupplement {
-public:
-    virtual ~PageSupplement();
-
-    static void provideTo(Page*, const AtomicString&, PassOwnPtr<PageSupplement>);
-    static PageSupplement* from(Page*, const AtomicString&);
-    static PageSupplement* from(Frame*, const AtomicString&);
-};
-
-} // namespace WebCore
-
-#endif // PageSupplement_h
diff --git a/Source/WebCore/page/NavigatorSupplement.h b/Source/WebCore/Modules/speech/SpeechRecognitionError.cpp
index fc958fd96..b7b507237 100644
--- a/Source/WebCore/page/NavigatorSupplement.h
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionError.cpp
@@ -23,26 +23,25 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef NavigatorSupplement_h
-#define NavigatorSupplement_h
+#include "config.h"
 
-#include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/text/AtomicString.h>
+#if ENABLE(SCRIPTED_SPEECH)
 
-namespace WebCore {
+#include "SpeechRecognitionError.h"
 
-class Navigator;
+namespace WebCore {
 
-class NavigatorSupplement {
-public:
-    virtual ~NavigatorSupplement();
+PassRefPtr<SpeechRecognitionError> SpeechRecognitionError::create(Code code, const String& message)
+{
+    return adoptRef(new SpeechRecognitionError(code, message));
+}
 
-    static void provideTo(Navigator*, const AtomicString&, PassOwnPtr<NavigatorSupplement>);
-    static NavigatorSupplement* from(Navigator*, const AtomicString&);
-};
+SpeechRecognitionError::SpeechRecognitionError(Code code, const String& message)
+    : m_code(code)
+    , m_message(message)
+{
+}
 
 } // namespace WebCore
 
-#endif // NavigatorSupplement_h
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionError.h b/Source/WebCore/Modules/speech/SpeechRecognitionError.h
new file mode 100644
index 000000000..daf945c58
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionError.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechRecognitionError_h
+#define SpeechRecognitionError_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class SpeechRecognitionError : public RefCounted<SpeechRecognitionError> {
+public:
+    enum Code {
+        OTHER = 0,
+        NO_SPEECH = 1,
+        ABORTED = 2,
+        AUDIO_CAPTURE = 3,
+        NETWORK = 4,
+        NOT_ALLOWED = 5,
+        SERVICE_NOT_ALLOWED = 6,
+        BAD_GRAMMAR = 7,
+        LANGUAGE_NOT_SUPPORTED = 8
+    };
+
+    static PassRefPtr<SpeechRecognitionError> create(Code, const String&);
+
+    Code code() { return m_code; }
+    const String& message() { return m_message; }
+
+private:
+    SpeechRecognitionError(Code, const String&);
+
+    Code m_code;
+    String m_message;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechRecognitionError_h
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionError.idl b/Source/WebCore/Modules/speech/SpeechRecognitionError.idl
new file mode 100644
index 000000000..39ecb1d0a
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionError.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH
+    ] SpeechRecognitionError {
+        const unsigned short OTHER = 0;
+        const unsigned short NO_SPEECH = 1;
+        const unsigned short ABORTED = 2;
+        const unsigned short AUDIO_CAPTURE = 3;
+        const unsigned short NETWORK = 4;
+        const unsigned short NOT_ALLOWED = 5;
+        const unsigned short SERVICE_NOT_ALLOWED = 6;
+        const unsigned short BAD_GRAMMAR = 7;
+        const unsigned short LANGUAGE_NOT_SUPPORTED = 8;
+
+        readonly attribute unsigned short code;
+        readonly attribute DOMString message;
+    };
+}
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionEvent.cpp b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.cpp
new file mode 100644
index 000000000..c9f88e3a9
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechRecognitionEvent.h"
+
+namespace WebCore {
+
+SpeechRecognitionEventInit::SpeechRecognitionEventInit()
+    : resultIndex(0)
+{
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::create()
+{
+    return adoptRef(new SpeechRecognitionEvent());
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::create(const AtomicString& eventName, const SpeechRecognitionEventInit& initializer)
+{
+    return adoptRef(new SpeechRecognitionEvent(eventName, initializer));
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::createResult(PassRefPtr<SpeechRecognitionResult> result, short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory)
+{
+    return adoptRef(new SpeechRecognitionEvent(eventNames().resultEvent, result, resultIndex, resultHistory));
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::createNoMatch(PassRefPtr<SpeechRecognitionResult> result)
+{
+    return adoptRef(new SpeechRecognitionEvent(eventNames().nomatchEvent, result, 0, 0));
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::createResultDeleted(short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory)
+{
+    return adoptRef(new SpeechRecognitionEvent(eventNames().resultdeletedEvent, 0, resultIndex, resultHistory));
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::createError(PassRefPtr<SpeechRecognitionError> error)
+{
+    return adoptRef(new SpeechRecognitionEvent(error));
+}
+
+const AtomicString& SpeechRecognitionEvent::interfaceName() const
+{
+    return eventNames().interfaceForSpeechRecognitionEvent;
+}
+
+SpeechRecognitionEvent::SpeechRecognitionEvent()
+    : m_resultIndex(0)
+{
+}
+
+SpeechRecognitionEvent::SpeechRecognitionEvent(const AtomicString& eventName, const SpeechRecognitionEventInit& initializer)
+    : Event(eventName, initializer)
+    , m_result(initializer.result)
+    , m_error(initializer.error)
+    , m_resultIndex(initializer.resultIndex)
+    , m_resultHistory(initializer.resultHistory)
+{
+}
+
+SpeechRecognitionEvent::SpeechRecognitionEvent(const AtomicString& eventName, PassRefPtr<SpeechRecognitionResult> result, short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory)
+    : Event(eventName, /*canBubble=*/false, /*cancelable=*/false)
+    , m_result(result)
+    , m_error(0)
+    , m_resultIndex(resultIndex)
+    , m_resultHistory(resultHistory)
+{
+}
+
+SpeechRecognitionEvent::SpeechRecognitionEvent(PassRefPtr<SpeechRecognitionError> error)
+    : Event(eventNames().errorEvent, /*canBubble=*/false, /*cancelable=*/false) // FIXME: The spec should say whether these bubble or not.
+    , m_error(error)
+    , m_resultIndex(0)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionEvent.h b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.h
new file mode 100644
index 000000000..443906e88
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechRecognitionEvent_h
+#define SpeechRecognitionEvent_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "Event.h"
+#include "SpeechRecognitionError.h"
+#include "SpeechRecognitionResult.h"
+#include "SpeechRecognitionResultList.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class SpeechRecognitionError;
+class SpeechRecognitionResult;
+class SpeechRecognitionResultList;
+
+struct SpeechRecognitionEventInit : public EventInit {
+    SpeechRecognitionEventInit();
+
+    RefPtr<SpeechRecognitionResult> result;
+    RefPtr<SpeechRecognitionError> error;
+    short resultIndex;
+    RefPtr<SpeechRecognitionResultList> resultHistory;
+};
+
+class SpeechRecognitionEvent : public Event {
+public:
+    static PassRefPtr<SpeechRecognitionEvent> create();
+    static PassRefPtr<SpeechRecognitionEvent> create(const AtomicString&, const SpeechRecognitionEventInit&);
+
+    static PassRefPtr<SpeechRecognitionEvent> createResult(PassRefPtr<SpeechRecognitionResult>, short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory);
+    static PassRefPtr<SpeechRecognitionEvent> createNoMatch(PassRefPtr<SpeechRecognitionResult>);
+    static PassRefPtr<SpeechRecognitionEvent> createResultDeleted(short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory);
+    static PassRefPtr<SpeechRecognitionEvent> createError(PassRefPtr<SpeechRecognitionError>);
+
+    SpeechRecognitionResult* result() const { return m_result.get(); }
+    SpeechRecognitionError* error() const { return m_error.get(); }
+    short resultIndex() const { return m_resultIndex; } // FIXME: Spec says this should be short, but other indices are unsigned ints.
+    SpeechRecognitionResultList* resultHistory() const { return m_resultHistory.get(); }
+
+    // Event
+    virtual const AtomicString& interfaceName() const OVERRIDE;
+
+private:
+    SpeechRecognitionEvent();
+    SpeechRecognitionEvent(const AtomicString&, const SpeechRecognitionEventInit&);
+    SpeechRecognitionEvent(const AtomicString& eventName, PassRefPtr<SpeechRecognitionResult>, short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory);
+    SpeechRecognitionEvent(PassRefPtr<SpeechRecognitionError>);
+
+    RefPtr<SpeechRecognitionResult> m_result;
+    RefPtr<SpeechRecognitionError> m_error;
+    short m_resultIndex;
+    RefPtr<SpeechRecognitionResultList> m_resultHistory;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechRecognitionEvent_h
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionEvent.idl b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.idl
new file mode 100644
index 000000000..49000810c
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module events {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        ConstructorTemplate=Event
+    ] SpeechRecognitionEvent : Event {
+        readonly attribute [InitializedByEventConstructor] SpeechRecognitionResult result;
+        readonly attribute [InitializedByEventConstructor] SpeechRecognitionError error;
+        readonly attribute [InitializedByEventConstructor] short resultIndex;
+        readonly attribute [InitializedByEventConstructor] SpeechRecognitionResultList resultHistory;
+    };
+}
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResult.cpp b/Source/WebCore/Modules/speech/SpeechRecognitionResult.cpp
new file mode 100644
index 000000000..1dff24c19
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResult.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechRecognitionResult.h"
+
+namespace WebCore {
+
+PassRefPtr<SpeechRecognitionResult> SpeechRecognitionResult::create(const Vector<RefPtr<SpeechRecognitionAlternative> >& alternatives, bool final)
+{
+    return adoptRef(new SpeechRecognitionResult(alternatives, final));
+}
+
+SpeechRecognitionAlternative* SpeechRecognitionResult::item(unsigned long index)
+{
+    if (index >= m_alternatives.size())
+        return 0;
+
+    return m_alternatives[index].get();
+}
+
+SpeechRecognitionResult::SpeechRecognitionResult(const Vector<RefPtr<SpeechRecognitionAlternative> >& alternatives, bool final)
+    : m_alternatives(alternatives)
+    , m_final(final)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResult.h b/Source/WebCore/Modules/speech/SpeechRecognitionResult.h
new file mode 100644
index 000000000..38645cb04
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResult.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechRecognitionResult_h
+#define SpeechRecognitionResult_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechRecognitionAlternative.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class SpeechRecognitionResult : public RefCounted<SpeechRecognitionResult> {
+public:
+    static PassRefPtr<SpeechRecognitionResult> create(const Vector<RefPtr<SpeechRecognitionAlternative> >&, bool final);
+
+    unsigned long length() { return m_alternatives.size(); }
+    SpeechRecognitionAlternative* item(unsigned long index);
+    bool final() { return m_final; }
+
+private:
+    SpeechRecognitionResult(const Vector<RefPtr<SpeechRecognitionAlternative> >&, bool final);
+
+    Vector<RefPtr<SpeechRecognitionAlternative> > m_alternatives;
+    bool m_final;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechRecognitionResult_h
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl b/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl
new file mode 100644
index 000000000..3f912621c
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        IndexedGetter
+    ] SpeechRecognitionResult {
+        readonly attribute unsigned long length;
+        SpeechRecognitionAlternative item(in [IsIndex] unsigned long index);
+        readonly attribute boolean final;
+    };
+}
+
diff --git a/Source/WebCore/page/PageSupplement.cpp b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.cpp
index fb8c1e77e..e8b2419c3 100644
--- a/Source/WebCore/page/PageSupplement.cpp
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.cpp
@@ -24,34 +24,31 @@
  */
 
 #include "config.h"
-#include "PageSupplement.h"
 
-#include "Frame.h"
-#include "Page.h"
+#if ENABLE(SCRIPTED_SPEECH)
 
-namespace WebCore {
+#include "SpeechRecognitionResultList.h"
 
-PageSupplement::~PageSupplement()
-{
-}
+namespace WebCore {
 
-void PageSupplement::provideTo(Page* page, const AtomicString& key, PassOwnPtr<PageSupplement> supplement)
+PassRefPtr<SpeechRecognitionResultList> SpeechRecognitionResultList::create(const Vector<RefPtr<SpeechRecognitionResult> >& results)
 {
-    page->provideSupplement(key, supplement);
+    return adoptRef(new SpeechRecognitionResultList(results));
 }
 
-PageSupplement* PageSupplement::from(Page* page, const AtomicString& name)
+SpeechRecognitionResult* SpeechRecognitionResultList::item(unsigned long index)
 {
-    if (!page)
+    if (index >= m_results.size())
         return 0;
-    return page->requireSupplement(name);
+
+    return m_results[index].get();
 }
 
-PageSupplement* PageSupplement::from(Frame* frame, const AtomicString& name)
+SpeechRecognitionResultList::SpeechRecognitionResultList(const Vector<RefPtr<SpeechRecognitionResult> >& results)
+    : m_results(results)
 {
-    if (!frame || !frame->page())
-        return 0;
-    return frame->page()->requireSupplement(name);
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResultList.h b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.h
new file mode 100644
index 000000000..22e3d4f19
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechRecognitionResultList_h
+#define SpeechRecognitionResultList_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechRecognitionResult.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class SpeechRecognitionResultList : public RefCounted<SpeechRecognitionResultList> {
+public:
+    static PassRefPtr<SpeechRecognitionResultList> create(const Vector<RefPtr<SpeechRecognitionResult> >&);
+
+    unsigned long length() { return m_results.size(); }
+    SpeechRecognitionResult* item(unsigned long index);
+
+private:
+    SpeechRecognitionResultList(const Vector<RefPtr<SpeechRecognitionResult> >&);
+
+    Vector<RefPtr<SpeechRecognitionResult> > m_results;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechRecognitionResultList_h
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResultList.idl b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.idl
new file mode 100644
index 000000000..fd7be4f1c
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        IndexedGetter
+    ] SpeechRecognitionResultList {
+        readonly attribute unsigned long length;
+        SpeechRecognitionResult item(in [IsIndex] unsigned long index);
+    };
+}
diff --git a/Source/WebCore/Modules/vibration/Vibration.cpp b/Source/WebCore/Modules/vibration/Vibration.cpp
index 9e52c3dfb..a1da4b047 100644
--- a/Source/WebCore/Modules/vibration/Vibration.cpp
+++ b/Source/WebCore/Modules/vibration/Vibration.cpp
@@ -124,7 +124,7 @@ void Vibration::timerStopFired(Timer<Vibration>* timer)
 
 const AtomicString& Vibration::supplementName()
 {
-    DEFINE_STATIC_LOCAL(AtomicString, name, ("vibration"));
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("Vibration"));
     return name;
 }
 
@@ -135,7 +135,7 @@ bool Vibration::isActive(Page* page)
 
 void provideVibrationTo(Page* page, VibrationClient* client)
 {
-    PageSupplement::provideTo(page, Vibration::supplementName(), Vibration::create(client));
+    Vibration::provideTo(page, Vibration::supplementName(), Vibration::create(client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/vibration/Vibration.h b/Source/WebCore/Modules/vibration/Vibration.h
index 27e0736be..9b01086a6 100644
--- a/Source/WebCore/Modules/vibration/Vibration.h
+++ b/Source/WebCore/Modules/vibration/Vibration.h
@@ -22,7 +22,7 @@
 
 #if ENABLE(VIBRATION)
 
-#include "PageSupplement.h"
+#include "Page.h"
 #include "Timer.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -32,7 +32,7 @@ class Navigator;
 class Page;
 class VibrationClient;
 
-class Vibration : public PageSupplement {
+class Vibration : public Supplement<Page> {
 public:
     typedef Vector<unsigned long> VibrationPattern;
 
@@ -52,7 +52,7 @@ public:
     void timerStopFired(Timer<Vibration>*);
 
     static const AtomicString& supplementName();
-    static Vibration* from(Page* page) { return static_cast<Vibration*>(PageSupplement::from(page, supplementName())); }
+    static Vibration* from(Page* page) { return static_cast<Vibration*>(Supplement<Page>::from(page, supplementName())); }
     static bool isActive(Page*);
 
 private:
diff --git a/Source/WebCore/storage/AbstractDatabase.cpp b/Source/WebCore/Modules/webdatabase/AbstractDatabase.cpp
index 27051138d..e51c24448 100644
--- a/Source/WebCore/storage/AbstractDatabase.cpp
+++ b/Source/WebCore/Modules/webdatabase/AbstractDatabase.cpp
@@ -32,6 +32,7 @@
 #if ENABLE(SQL_DATABASE)
 
 #include "DatabaseAuthorizer.h"
+#include "DatabaseContext.h"
 #include "DatabaseTracker.h"
 #include "ExceptionCode.h"
 #include "Logging.h"
@@ -188,6 +189,7 @@ const char* AbstractDatabase::databaseInfoTableName()
 AbstractDatabase::AbstractDatabase(ScriptExecutionContext* context, const String& name, const String& expectedVersion,
                                    const String& displayName, unsigned long estimatedSize, DatabaseType databaseType)
     : m_scriptExecutionContext(context)
+    , m_databaseContext(DatabaseContext::from(context))
     , m_name(name.isolatedCopy())
     , m_expectedVersion(expectedVersion.isolatedCopy())
     , m_displayName(displayName.isolatedCopy())
diff --git a/Source/WebCore/storage/AbstractDatabase.h b/Source/WebCore/Modules/webdatabase/AbstractDatabase.h
index 3286a87b2..12b8985d1 100644
--- a/Source/WebCore/storage/AbstractDatabase.h
+++ b/Source/WebCore/Modules/webdatabase/AbstractDatabase.h
@@ -42,6 +42,7 @@
 namespace WebCore {
 
 class DatabaseAuthorizer;
+class DatabaseContext;
 class ScriptExecutionContext;
 class SecurityOrigin;
 
@@ -86,6 +87,8 @@ public:
     virtual void markAsDeletedAndClose() = 0;
     virtual void closeImmediately() = 0;
 
+    DatabaseContext* databaseContext() const { return m_databaseContext; }
+
 protected:
     friend class ChangeVersionWrapper;
     friend class SQLStatement;
@@ -124,8 +127,9 @@ protected:
 
     static const char* databaseInfoTableName();
 
-    RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
     RefPtr<SecurityOrigin> m_contextThreadSecurityOrigin;
+    RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
+    DatabaseContext* m_databaseContext; // Owned by m_scriptExecutionContext.
 
     String m_name;
     String m_expectedVersion;
diff --git a/Source/WebCore/storage/ChangeVersionWrapper.cpp b/Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.cpp
index c46ee2e83..c46ee2e83 100644
--- a/Source/WebCore/storage/ChangeVersionWrapper.cpp
+++ b/Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.cpp
diff --git a/Source/WebCore/storage/ChangeVersionWrapper.h b/Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.h
index 785fe2892..785fe2892 100644
--- a/Source/WebCore/storage/ChangeVersionWrapper.h
+++ b/Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.h
diff --git a/Source/WebCore/storage/DOMWindowSQLDatabase.cpp b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.cpp
index e4b609080..996357c65 100644
--- a/Source/WebCore/storage/DOMWindowSQLDatabase.cpp
+++ b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.cpp
@@ -1,34 +1,33 @@
 /*
- * Copyright (C) 2012 Google Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
 #include "config.h"
+
+#if ENABLE(SQL_DATABASE)
+
 #include "DOMWindowSQLDatabase.h"
 
 #include "AbstractDatabase.h"
@@ -39,8 +38,6 @@
 #include "Frame.h"
 #include "SecurityOrigin.h"
 
-#if ENABLE(SQL_DATABASE)
-
 namespace WebCore {
 
 PassRefPtr<Database> DOMWindowSQLDatabase::openDatabase(DOMWindow* window, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
diff --git a/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.h b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.h
new file mode 100644
index 000000000..c362b9f11
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DOMWindowSQLDatabase_h
+#define DOMWindowSQLDatabase_h
+
+#if ENABLE(SQL_DATABASE)
+#include "ExceptionCode.h"
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class DOMWindow;
+class Database;
+class DatabaseCallback;
+class Frame;
+
+class DOMWindowSQLDatabase {
+public:
+    static PassRefPtr<Database> openDatabase(DOMWindow*, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
+
+private:
+    DOMWindowSQLDatabase() { };
+    ~DOMWindowSQLDatabase() { };
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SQL_DATABASE)
+
+#endif // DOMWindowSQLDatabase_h
diff --git a/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.idl b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.idl
new file mode 100644
index 000000000..f2aea7751
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    interface [
+        Conditional=SQL_DATABASE,
+        Supplemental=DOMWindow
+    ] DOMWindowSQLDatabase {
+        [V8EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
+            raises(DOMException);
+#if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
+        attribute SQLExceptionConstructor SQLException;
+#endif
+    };
+
+}
diff --git a/Source/WebCore/storage/Database.cpp b/Source/WebCore/Modules/webdatabase/Database.cpp
index d9911c919..d0c3a7a1e 100644
--- a/Source/WebCore/storage/Database.cpp
+++ b/Source/WebCore/Modules/webdatabase/Database.cpp
@@ -34,6 +34,7 @@
 #include "ChangeVersionWrapper.h"
 #include "CrossThreadTask.h"
 #include "DatabaseCallback.h"
+#include "DatabaseContext.h"
 #include "DatabaseTask.h"
 #include "DatabaseThread.h"
 #include "DatabaseTracker.h"
@@ -109,7 +110,7 @@ PassRefPtr<Database> Database::openDatabase(ScriptExecutionContext* context, con
 
     DatabaseTracker::tracker().setDatabaseDetails(context->securityOrigin(), name, displayName, estimatedSize);
 
-    context->setHasOpenDatabases();
+    DatabaseContext::from(context)->setHasOpenDatabases();
 
     InspectorInstrumentation::didOpenDatabase(context, database, context->securityOrigin()->host(), name, expectedVersion);
 
@@ -130,7 +131,7 @@ Database::Database(ScriptExecutionContext* context, const String& name, const St
     m_databaseThreadSecurityOrigin = m_contextThreadSecurityOrigin->isolatedCopy();
 
     ScriptController::initializeThreading();
-    ASSERT(m_scriptExecutionContext->databaseThread());
+    ASSERT(databaseContext()->databaseThread());
 }
 
 class DerefContextTask : public ScriptExecutionContext::Task {
@@ -179,12 +180,12 @@ String Database::version() const
 bool Database::openAndVerifyVersion(bool setVersionInNewDatabase, ExceptionCode& e, String& errorMessage)
 {
     DatabaseTaskSynchronizer synchronizer;
-    if (!m_scriptExecutionContext->databaseThread() || m_scriptExecutionContext->databaseThread()->terminationRequested(&synchronizer))
+    if (!databaseContext()->databaseThread() || databaseContext()->databaseThread()->terminationRequested(&synchronizer))
         return false;
 
     bool success = false;
     OwnPtr<DatabaseOpenTask> task = DatabaseOpenTask::create(this, setVersionInNewDatabase, &synchronizer, e, errorMessage, success);
-    m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
+    databaseContext()->databaseThread()->scheduleImmediateTask(task.release());
     synchronizer.waitForTaskCompletion();
 
     return success;
@@ -192,27 +193,27 @@ bool Database::openAndVerifyVersion(bool setVersionInNewDatabase, ExceptionCode&
 
 void Database::markAsDeletedAndClose()
 {
-    if (m_deleted || !m_scriptExecutionContext->databaseThread())
+    if (m_deleted || !databaseContext()->databaseThread())
         return;
 
     LOG(StorageAPI, "Marking %s (%p) as deleted", stringIdentifier().ascii().data(), this);
     m_deleted = true;
 
     DatabaseTaskSynchronizer synchronizer;
-    if (m_scriptExecutionContext->databaseThread()->terminationRequested(&synchronizer)) {
+    if (databaseContext()->databaseThread()->terminationRequested(&synchronizer)) {
         LOG(StorageAPI, "Database handle %p is on a terminated DatabaseThread, cannot be marked for normal closure\n", this);
         return;
     }
 
     OwnPtr<DatabaseCloseTask> task = DatabaseCloseTask::create(this, &synchronizer);
-    m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
+    databaseContext()->databaseThread()->scheduleImmediateTask(task.release());
     synchronizer.waitForTaskCompletion();
 }
 
 void Database::close()
 {
-    ASSERT(m_scriptExecutionContext->databaseThread());
-    ASSERT(currentThread() == m_scriptExecutionContext->databaseThread()->getThreadID());
+    ASSERT(databaseContext()->databaseThread());
+    ASSERT(currentThread() == databaseContext()->databaseThread()->getThreadID());
 
     {
         MutexLocker locker(m_transactionInProgressMutex);
@@ -225,15 +226,15 @@ void Database::close()
 
     // Must ref() before calling databaseThread()->recordDatabaseClosed().
     RefPtr<Database> protect = this;
-    m_scriptExecutionContext->databaseThread()->recordDatabaseClosed(this);
-    m_scriptExecutionContext->databaseThread()->unscheduleDatabaseTasks(this);
+    databaseContext()->databaseThread()->recordDatabaseClosed(this);
+    databaseContext()->databaseThread()->unscheduleDatabaseTasks(this);
     DatabaseTracker::tracker().removeOpenDatabase(this);
 }
 
 void Database::closeImmediately()
 {
     ASSERT(m_scriptExecutionContext->isContextThread());
-    DatabaseThread* databaseThread = scriptExecutionContext()->databaseThread();
+    DatabaseThread* databaseThread = databaseContext()->databaseThread();
     if (databaseThread && !databaseThread->terminationRequested() && opened()) {
         logErrorMessage("forcibly closing database");
         databaseThread->scheduleImmediateTask(DatabaseCloseTask::create(this, 0));
@@ -248,8 +249,8 @@ unsigned long long Database::maximumSize() const
 bool Database::performOpenAndVerify(bool setVersionInNewDatabase, ExceptionCode& e, String& errorMessage)
 {
     if (AbstractDatabase::performOpenAndVerify(setVersionInNewDatabase, e, errorMessage)) {
-        if (m_scriptExecutionContext->databaseThread())
-            m_scriptExecutionContext->databaseThread()->recordDatabaseOpen(this);
+        if (databaseContext()->databaseThread())
+            databaseContext()->databaseThread()->recordDatabaseOpen(this);
 
         return true;
     }
@@ -311,26 +312,26 @@ void Database::scheduleTransaction()
     if (m_isTransactionQueueEnabled && !m_transactionQueue.isEmpty())
         transaction = m_transactionQueue.takeFirst();
 
-    if (transaction && m_scriptExecutionContext->databaseThread()) {
+    if (transaction && databaseContext()->databaseThread()) {
         OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
         LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for transaction %p\n", task.get(), task->transaction());
         m_transactionInProgress = true;
-        m_scriptExecutionContext->databaseThread()->scheduleTask(task.release());
+        databaseContext()->databaseThread()->scheduleTask(task.release());
     } else
         m_transactionInProgress = false;
 }
 
 void Database::scheduleTransactionStep(SQLTransaction* transaction, bool immediately)
 {
-    if (!m_scriptExecutionContext->databaseThread())
+    if (!databaseContext()->databaseThread())
         return;
 
     OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
     LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for the transaction step\n", task.get());
     if (immediately)
-        m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
+        databaseContext()->databaseThread()->scheduleImmediateTask(task.release());
     else
-        m_scriptExecutionContext->databaseThread()->scheduleTask(task.release());
+        databaseContext()->databaseThread()->scheduleTask(task.release());
 }
 
 class DeliverPendingCallbackTask : public ScriptExecutionContext::Task {
@@ -390,12 +391,12 @@ Vector<String> Database::performGetTableNames()
 
 SQLTransactionClient* Database::transactionClient() const
 {
-    return m_scriptExecutionContext->databaseThread()->transactionClient();
+    return databaseContext()->databaseThread()->transactionClient();
 }
 
 SQLTransactionCoordinator* Database::transactionCoordinator() const
 {
-    return m_scriptExecutionContext->databaseThread()->transactionCoordinator();
+    return databaseContext()->databaseThread()->transactionCoordinator();
 }
 
 Vector<String> Database::tableNames()
@@ -404,11 +405,11 @@ Vector<String> Database::tableNames()
     // in dealing with them. However, if the code changes, this may not be true anymore.
     Vector<String> result;
     DatabaseTaskSynchronizer synchronizer;
-    if (!m_scriptExecutionContext->databaseThread() || m_scriptExecutionContext->databaseThread()->terminationRequested(&synchronizer))
+    if (!databaseContext()->databaseThread() || databaseContext()->databaseThread()->terminationRequested(&synchronizer))
         return result;
 
     OwnPtr<DatabaseTableNamesTask> task = DatabaseTableNamesTask::create(this, &synchronizer, result);
-    m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
+    databaseContext()->databaseThread()->scheduleImmediateTask(task.release());
     synchronizer.waitForTaskCompletion();
 
     return result;
@@ -418,7 +419,7 @@ SecurityOrigin* Database::securityOrigin() const
 {
     if (m_scriptExecutionContext->isContextThread())
         return m_contextThreadSecurityOrigin.get();
-    if (currentThread() == m_scriptExecutionContext->databaseThread()->getThreadID())
+    if (currentThread() == databaseContext()->databaseThread()->getThreadID())
         return m_databaseThreadSecurityOrigin.get();
     return 0;
 }
diff --git a/Source/WebCore/storage/Database.h b/Source/WebCore/Modules/webdatabase/Database.h
index 12b430e33..12b430e33 100644
--- a/Source/WebCore/storage/Database.h
+++ b/Source/WebCore/Modules/webdatabase/Database.h
diff --git a/Source/WebCore/storage/Database.idl b/Source/WebCore/Modules/webdatabase/Database.idl
index ddc544a86..ddc544a86 100644
--- a/Source/WebCore/storage/Database.idl
+++ b/Source/WebCore/Modules/webdatabase/Database.idl
diff --git a/Source/WebCore/storage/DatabaseAuthorizer.cpp b/Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.cpp
index 72dba4cbf..72dba4cbf 100644
--- a/Source/WebCore/storage/DatabaseAuthorizer.cpp
+++ b/Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.cpp
diff --git a/Source/WebCore/storage/DatabaseAuthorizer.h b/Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.h
index 939b409eb..939b409eb 100644
--- a/Source/WebCore/storage/DatabaseAuthorizer.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.h
diff --git a/Source/WebCore/storage/DatabaseCallback.h b/Source/WebCore/Modules/webdatabase/DatabaseCallback.h
index bfa7bc627..bfa7bc627 100644
--- a/Source/WebCore/storage/DatabaseCallback.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseCallback.h
diff --git a/Source/WebCore/storage/DatabaseCallback.idl b/Source/WebCore/Modules/webdatabase/DatabaseCallback.idl
index 8d316484b..8d316484b 100644
--- a/Source/WebCore/storage/DatabaseCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/DatabaseCallback.idl
diff --git a/Source/WebCore/Modules/webdatabase/DatabaseContext.cpp b/Source/WebCore/Modules/webdatabase/DatabaseContext.cpp
new file mode 100644
index 000000000..0b662a890
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/DatabaseContext.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2011 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "DatabaseContext.h"
+
+#if ENABLE(SQL_DATABASE)
+
+#include "Chrome.h"
+#include "ChromeClient.h"
+#include "Database.h"
+#include "DatabaseTask.h"
+#include "DatabaseThread.h"
+#include "DatabaseTracker.h"
+#include "Document.h"
+#include "Page.h"
+#include "SchemeRegistry.h"
+#include "SecurityOrigin.h"
+#include "Settings.h"
+
+namespace WebCore {
+
+static DatabaseContext* existingDatabaseContextFrom(ScriptExecutionContext* context)
+{
+    return static_cast<DatabaseContext*>(Supplement<ScriptExecutionContext>::from(context, "DatabaseContext"));
+}
+
+DatabaseContext::DatabaseContext(ScriptExecutionContext* context)
+    : m_scriptExecutionContext(context)
+    , m_hasOpenDatabases(false)
+{
+}
+
+DatabaseContext::~DatabaseContext()
+{
+    if (m_databaseThread) {
+        ASSERT(m_databaseThread->terminationRequested());
+        m_databaseThread = 0;
+    }
+}
+
+DatabaseContext* DatabaseContext::from(ScriptExecutionContext* context)
+{
+    DatabaseContext* supplement = existingDatabaseContextFrom(context);
+    if (!supplement) {
+        supplement = new DatabaseContext(context);
+        provideTo(context, "DatabaseContext", adoptPtr(supplement));
+        ASSERT(supplement == existingDatabaseContextFrom(context));
+    }
+    return supplement;
+}
+
+DatabaseThread* DatabaseContext::databaseThread()
+{
+    if (!m_databaseThread && !m_hasOpenDatabases) {
+        // Create the database thread on first request - but not if at least one database was already opened,
+        // because in that case we already had a database thread and terminated it and should not create another.
+        m_databaseThread = DatabaseThread::create();
+        if (!m_databaseThread->start())
+            m_databaseThread = 0;
+    }
+
+    return m_databaseThread.get();
+}
+
+bool DatabaseContext::hasOpenDatabases(ScriptExecutionContext* context)
+{
+    // We don't use DatabaseContext::from because we don't want to cause
+    // DatabaseContext to be allocated if we don't have one already.
+    DatabaseContext* databaseContext = existingDatabaseContextFrom(context);
+    if (!databaseContext)
+        return false;
+    return databaseContext->m_hasOpenDatabases;
+}
+
+void DatabaseContext::stopDatabases(ScriptExecutionContext* context, DatabaseTaskSynchronizer* cleanupSync)
+{
+    // We don't use DatabaseContext::from because we don't want to cause
+    // DatabaseContext to be allocated if we don't have one already.
+    DatabaseContext* databaseContext = existingDatabaseContextFrom(context);
+
+    if (databaseContext && databaseContext->m_databaseThread)
+        databaseContext->m_databaseThread->requestTermination(cleanupSync);
+    else if (cleanupSync)
+        cleanupSync->taskCompleted();
+}
+
+bool DatabaseContext::allowDatabaseAccess() const
+{
+    if (m_scriptExecutionContext->isDocument()) {
+        Document* document = static_cast<Document*>(m_scriptExecutionContext);
+        if (!document->page() || (document->page()->settings()->privateBrowsingEnabled() && !SchemeRegistry::allowsDatabaseAccessInPrivateBrowsing(document->securityOrigin()->protocol())))
+            return false;
+        return true;
+    }
+    ASSERT(m_scriptExecutionContext->isWorkerContext());
+    // allowDatabaseAccess is not yet implemented for workers.
+    return true;
+}
+
+void DatabaseContext::databaseExceededQuota(const String& name)
+{
+    if (m_scriptExecutionContext->isDocument()) {
+        Document* document = static_cast<Document*>(m_scriptExecutionContext);
+        if (Page* page = document->page())
+            page->chrome()->client()->exceededDatabaseQuota(document->frame(), name);
+        return;
+    }
+    ASSERT(m_scriptExecutionContext->isWorkerContext());
+#if !PLATFORM(CHROMIUM)
+    // FIXME: This needs a real implementation; this is a temporary solution for testing.
+    const unsigned long long defaultQuota = 5 * 1024 * 1024;
+    DatabaseTracker::tracker().setQuota(m_scriptExecutionContext->securityOrigin(), defaultQuota);
+#endif
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SQL_DATABASE)
diff --git a/Source/WebCore/Modules/webdatabase/DatabaseContext.h b/Source/WebCore/Modules/webdatabase/DatabaseContext.h
new file mode 100644
index 000000000..fced47dd5
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/DatabaseContext.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2011 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef DatabaseContext_h
+#define DatabaseContext_h
+
+#if ENABLE(SQL_DATABASE)
+
+#include "Supplementable.h"
+
+namespace WebCore {
+
+class Database;
+class DatabaseTaskSynchronizer;
+class DatabaseThread;
+class ScriptExecutionContext;
+
+class DatabaseContext : public Supplement<ScriptExecutionContext> {
+public:
+    virtual ~DatabaseContext();
+    static DatabaseContext* from(ScriptExecutionContext*);
+
+    DatabaseThread* databaseThread();
+
+    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
+
+    static bool hasOpenDatabases(ScriptExecutionContext*);
+
+    // When the database cleanup is done, cleanupSync will be signalled.
+    static void stopDatabases(ScriptExecutionContext*, DatabaseTaskSynchronizer*);
+
+    bool allowDatabaseAccess() const;
+    void databaseExceededQuota(const String& name);
+
+private:
+    explicit DatabaseContext(ScriptExecutionContext*);
+
+    ScriptExecutionContext* m_scriptExecutionContext;
+    RefPtr<DatabaseThread> m_databaseThread;
+    bool m_hasOpenDatabases; // This never changes back to false, even after the database thread is closed.
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SQL_DATABASE)
+
+#endif // DatabaseContext_h
diff --git a/Source/WebCore/storage/DatabaseDetails.h b/Source/WebCore/Modules/webdatabase/DatabaseDetails.h
index d2bc71b7e..d2bc71b7e 100644
--- a/Source/WebCore/storage/DatabaseDetails.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseDetails.h
diff --git a/Source/WebCore/storage/DatabaseSync.cpp b/Source/WebCore/Modules/webdatabase/DatabaseSync.cpp
index 8b744b8c6..8b744b8c6 100644
--- a/Source/WebCore/storage/DatabaseSync.cpp
+++ b/Source/WebCore/Modules/webdatabase/DatabaseSync.cpp
diff --git a/Source/WebCore/storage/DatabaseSync.h b/Source/WebCore/Modules/webdatabase/DatabaseSync.h
index bfc124b17..bfc124b17 100644
--- a/Source/WebCore/storage/DatabaseSync.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseSync.h
diff --git a/Source/WebCore/storage/DatabaseSync.idl b/Source/WebCore/Modules/webdatabase/DatabaseSync.idl
index cfb0b590c..cfb0b590c 100644
--- a/Source/WebCore/storage/DatabaseSync.idl
+++ b/Source/WebCore/Modules/webdatabase/DatabaseSync.idl
diff --git a/Source/WebCore/storage/DatabaseTask.cpp b/Source/WebCore/Modules/webdatabase/DatabaseTask.cpp
index 066725fe3..066725fe3 100644
--- a/Source/WebCore/storage/DatabaseTask.cpp
+++ b/Source/WebCore/Modules/webdatabase/DatabaseTask.cpp
diff --git a/Source/WebCore/storage/DatabaseTask.h b/Source/WebCore/Modules/webdatabase/DatabaseTask.h
index 82d51f03f..82d51f03f 100644
--- a/Source/WebCore/storage/DatabaseTask.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseTask.h
diff --git a/Source/WebCore/storage/DatabaseThread.cpp b/Source/WebCore/Modules/webdatabase/DatabaseThread.cpp
index d771b1ca1..d771b1ca1 100644
--- a/Source/WebCore/storage/DatabaseThread.cpp
+++ b/Source/WebCore/Modules/webdatabase/DatabaseThread.cpp
diff --git a/Source/WebCore/storage/DatabaseThread.h b/Source/WebCore/Modules/webdatabase/DatabaseThread.h
index fa4fd088f..fa4fd088f 100644
--- a/Source/WebCore/storage/DatabaseThread.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseThread.h
diff --git a/Source/WebCore/storage/DatabaseTracker.cpp b/Source/WebCore/Modules/webdatabase/DatabaseTracker.cpp
index f11cc599e..233b3721b 100644
--- a/Source/WebCore/storage/DatabaseTracker.cpp
+++ b/Source/WebCore/Modules/webdatabase/DatabaseTracker.cpp
@@ -34,6 +34,7 @@
 #include "AbstractDatabase.h"
 #include "Chrome.h"
 #include "ChromeClient.h"
+#include "DatabaseContext.h"
 #include "DatabaseThread.h"
 #include "DatabaseTrackerClient.h"
 #include "Logging.h"
@@ -175,7 +176,7 @@ bool DatabaseTracker::canEstablishDatabase(ScriptExecutionContext* context, cons
         m_proposedDatabases.add(&details);
     }
     // Drop all locks before calling out; we don't know what they'll do.
-    context->databaseExceededQuota(name);
+    DatabaseContext::from(context)->databaseExceededQuota(name);
 
     MutexLocker lockDatabase(m_databaseGuard);
 
diff --git a/Source/WebCore/storage/DatabaseTracker.h b/Source/WebCore/Modules/webdatabase/DatabaseTracker.h
index d94a41578..d94a41578 100644
--- a/Source/WebCore/storage/DatabaseTracker.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseTracker.h
diff --git a/Source/WebCore/storage/DatabaseTrackerClient.h b/Source/WebCore/Modules/webdatabase/DatabaseTrackerClient.h
index 9c08bcd31..9c08bcd31 100644
--- a/Source/WebCore/storage/DatabaseTrackerClient.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseTrackerClient.h
diff --git a/Source/WebCore/storage/OriginQuotaManager.cpp b/Source/WebCore/Modules/webdatabase/OriginQuotaManager.cpp
index b6cbef15b..b6cbef15b 100644
--- a/Source/WebCore/storage/OriginQuotaManager.cpp
+++ b/Source/WebCore/Modules/webdatabase/OriginQuotaManager.cpp
diff --git a/Source/WebCore/storage/OriginQuotaManager.h b/Source/WebCore/Modules/webdatabase/OriginQuotaManager.h
index 974de7216..974de7216 100644
--- a/Source/WebCore/storage/OriginQuotaManager.h
+++ b/Source/WebCore/Modules/webdatabase/OriginQuotaManager.h
diff --git a/Source/WebCore/storage/OriginUsageRecord.cpp b/Source/WebCore/Modules/webdatabase/OriginUsageRecord.cpp
index 443550a57..443550a57 100644
--- a/Source/WebCore/storage/OriginUsageRecord.cpp
+++ b/Source/WebCore/Modules/webdatabase/OriginUsageRecord.cpp
diff --git a/Source/WebCore/storage/OriginUsageRecord.h b/Source/WebCore/Modules/webdatabase/OriginUsageRecord.h
index 61d9c9019..61d9c9019 100644
--- a/Source/WebCore/storage/OriginUsageRecord.h
+++ b/Source/WebCore/Modules/webdatabase/OriginUsageRecord.h
diff --git a/Source/WebCore/storage/SQLCallbackWrapper.h b/Source/WebCore/Modules/webdatabase/SQLCallbackWrapper.h
index 3cb0e2dbc..3cb0e2dbc 100644
--- a/Source/WebCore/storage/SQLCallbackWrapper.h
+++ b/Source/WebCore/Modules/webdatabase/SQLCallbackWrapper.h
diff --git a/Source/WebCore/storage/SQLError.h b/Source/WebCore/Modules/webdatabase/SQLError.h
index e51db8b12..e51db8b12 100644
--- a/Source/WebCore/storage/SQLError.h
+++ b/Source/WebCore/Modules/webdatabase/SQLError.h
diff --git a/Source/WebCore/storage/SQLError.idl b/Source/WebCore/Modules/webdatabase/SQLError.idl
index ad847598a..ad847598a 100644
--- a/Source/WebCore/storage/SQLError.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLError.idl
diff --git a/Source/WebCore/storage/SQLException.cpp b/Source/WebCore/Modules/webdatabase/SQLException.cpp
index 0e7be829f..0e7be829f 100644
--- a/Source/WebCore/storage/SQLException.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLException.cpp
diff --git a/Source/WebCore/storage/SQLException.h b/Source/WebCore/Modules/webdatabase/SQLException.h
index be968cf05..be968cf05 100644
--- a/Source/WebCore/storage/SQLException.h
+++ b/Source/WebCore/Modules/webdatabase/SQLException.h
diff --git a/Source/WebCore/storage/SQLException.idl b/Source/WebCore/Modules/webdatabase/SQLException.idl
index 39e58d68e..39e58d68e 100644
--- a/Source/WebCore/storage/SQLException.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLException.idl
diff --git a/Source/WebCore/storage/SQLResultSet.cpp b/Source/WebCore/Modules/webdatabase/SQLResultSet.cpp
index 73cb430e5..73cb430e5 100644
--- a/Source/WebCore/storage/SQLResultSet.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSet.cpp
diff --git a/Source/WebCore/storage/SQLResultSet.h b/Source/WebCore/Modules/webdatabase/SQLResultSet.h
index e30be595d..e30be595d 100644
--- a/Source/WebCore/storage/SQLResultSet.h
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSet.h
diff --git a/Source/WebCore/storage/SQLResultSet.idl b/Source/WebCore/Modules/webdatabase/SQLResultSet.idl
index 60692cbea..60692cbea 100644
--- a/Source/WebCore/storage/SQLResultSet.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSet.idl
diff --git a/Source/WebCore/storage/SQLResultSetRowList.cpp b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.cpp
index c99b40a56..c99b40a56 100644
--- a/Source/WebCore/storage/SQLResultSetRowList.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.cpp
diff --git a/Source/WebCore/storage/SQLResultSetRowList.h b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.h
index 45d88b6ef..45d88b6ef 100644
--- a/Source/WebCore/storage/SQLResultSetRowList.h
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.h
diff --git a/Source/WebCore/storage/SQLResultSetRowList.idl b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.idl
index ba0cb4cf7..ba0cb4cf7 100644
--- a/Source/WebCore/storage/SQLResultSetRowList.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.idl
diff --git a/Source/WebCore/storage/SQLStatement.cpp b/Source/WebCore/Modules/webdatabase/SQLStatement.cpp
index 79ec135a5..79ec135a5 100644
--- a/Source/WebCore/storage/SQLStatement.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLStatement.cpp
diff --git a/Source/WebCore/storage/SQLStatement.h b/Source/WebCore/Modules/webdatabase/SQLStatement.h
index b636b068b..b636b068b 100644
--- a/Source/WebCore/storage/SQLStatement.h
+++ b/Source/WebCore/Modules/webdatabase/SQLStatement.h
diff --git a/Source/WebCore/storage/SQLStatementCallback.h b/Source/WebCore/Modules/webdatabase/SQLStatementCallback.h
index 83201d2b8..83201d2b8 100644
--- a/Source/WebCore/storage/SQLStatementCallback.h
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementCallback.h
diff --git a/Source/WebCore/storage/SQLStatementCallback.idl b/Source/WebCore/Modules/webdatabase/SQLStatementCallback.idl
index c3053c0ee..c3053c0ee 100644
--- a/Source/WebCore/storage/SQLStatementCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementCallback.idl
diff --git a/Source/WebCore/storage/SQLStatementErrorCallback.h b/Source/WebCore/Modules/webdatabase/SQLStatementErrorCallback.h
index c7c9f5450..c7c9f5450 100644
--- a/Source/WebCore/storage/SQLStatementErrorCallback.h
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementErrorCallback.h
diff --git a/Source/WebCore/storage/SQLStatementErrorCallback.idl b/Source/WebCore/Modules/webdatabase/SQLStatementErrorCallback.idl
index 1fc96cb0a..1fc96cb0a 100644
--- a/Source/WebCore/storage/SQLStatementErrorCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementErrorCallback.idl
diff --git a/Source/WebCore/storage/SQLStatementSync.cpp b/Source/WebCore/Modules/webdatabase/SQLStatementSync.cpp
index 4a934ec00..4a934ec00 100644
--- a/Source/WebCore/storage/SQLStatementSync.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementSync.cpp
diff --git a/Source/WebCore/storage/SQLStatementSync.h b/Source/WebCore/Modules/webdatabase/SQLStatementSync.h
index 6dfcc748e..6dfcc748e 100644
--- a/Source/WebCore/storage/SQLStatementSync.h
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementSync.h
diff --git a/Source/WebCore/storage/SQLTransaction.cpp b/Source/WebCore/Modules/webdatabase/SQLTransaction.cpp
index 97c34cd5f..e9f38a976 100644
--- a/Source/WebCore/storage/SQLTransaction.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLTransaction.cpp
@@ -33,6 +33,7 @@
 
 #include "Database.h"
 #include "DatabaseAuthorizer.h"
+#include "DatabaseContext.h"
 #include "DatabaseThread.h"
 #include "ExceptionCode.h"
 #include "Logging.h"
@@ -97,7 +98,7 @@ void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValu
     }
 
     int permissions = DatabaseAuthorizer::ReadWriteMask;
-    if (!m_database->scriptExecutionContext()->allowDatabaseAccess())
+    if (!m_database->databaseContext()->allowDatabaseAccess())
         permissions |= DatabaseAuthorizer::NoAccessMask;
     else if (m_readOnly)
         permissions |= DatabaseAuthorizer::ReadOnlyMask;
@@ -163,7 +164,7 @@ void SQLTransaction::checkAndHandleClosedOrInterruptedDatabase()
     m_errorCallbackWrapper.clear();
 
     // The next steps should be executed only if we're on the DB thread.
-    if (currentThread() != database()->scriptExecutionContext()->databaseThread()->getThreadID())
+    if (currentThread() != database()->databaseContext()->databaseThread()->getThreadID())
         return;
 
     // The current SQLite transaction should be stopped, as well
@@ -215,7 +216,7 @@ void SQLTransaction::performPendingCallback()
 
 void SQLTransaction::notifyDatabaseThreadIsShuttingDown()
 {
-    ASSERT(currentThread() == database()->scriptExecutionContext()->databaseThread()->getThreadID());
+    ASSERT(currentThread() == database()->databaseContext()->databaseThread()->getThreadID());
 
     // If the transaction is in progress, we should roll it back here, since this is our last
     // oportunity to do something related to this transaction on the DB thread.
diff --git a/Source/WebCore/storage/SQLTransaction.h b/Source/WebCore/Modules/webdatabase/SQLTransaction.h
index 11438e22a..11438e22a 100644
--- a/Source/WebCore/storage/SQLTransaction.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransaction.h
diff --git a/Source/WebCore/storage/SQLTransaction.idl b/Source/WebCore/Modules/webdatabase/SQLTransaction.idl
index f0994a1f8..f0994a1f8 100644
--- a/Source/WebCore/storage/SQLTransaction.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLTransaction.idl
diff --git a/Source/WebCore/storage/SQLTransactionCallback.h b/Source/WebCore/Modules/webdatabase/SQLTransactionCallback.h
index 208ce111b..208ce111b 100644
--- a/Source/WebCore/storage/SQLTransactionCallback.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionCallback.h
diff --git a/Source/WebCore/storage/SQLTransactionCallback.idl b/Source/WebCore/Modules/webdatabase/SQLTransactionCallback.idl
index 1b50bee2f..1b50bee2f 100644
--- a/Source/WebCore/storage/SQLTransactionCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionCallback.idl
diff --git a/Source/WebCore/storage/SQLTransactionClient.cpp b/Source/WebCore/Modules/webdatabase/SQLTransactionClient.cpp
index 5dba32ed1..07c83d2c9 100644
--- a/Source/WebCore/storage/SQLTransactionClient.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionClient.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(SQL_DATABASE)
 
 #include "AbstractDatabase.h"
+#include "DatabaseContext.h"
 #include "DatabaseTracker.h"
 #include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
@@ -55,7 +56,7 @@ bool SQLTransactionClient::didExceedQuota(AbstractDatabase* database)
 {
     ASSERT(database->scriptExecutionContext()->isContextThread());
     unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(database->securityOrigin());
-    database->scriptExecutionContext()->databaseExceededQuota(database->stringIdentifier());
+    database->databaseContext()->databaseExceededQuota(database->stringIdentifier());
     unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(database->securityOrigin());
     return (newQuota > currentQuota);
 }
diff --git a/Source/WebCore/storage/SQLTransactionClient.h b/Source/WebCore/Modules/webdatabase/SQLTransactionClient.h
index 28559ed49..28559ed49 100644
--- a/Source/WebCore/storage/SQLTransactionClient.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionClient.h
diff --git a/Source/WebCore/storage/SQLTransactionCoordinator.cpp b/Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.cpp
index 4158c98d7..4158c98d7 100644
--- a/Source/WebCore/storage/SQLTransactionCoordinator.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.cpp
diff --git a/Source/WebCore/storage/SQLTransactionCoordinator.h b/Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.h
index d586de4b7..d586de4b7 100644
--- a/Source/WebCore/storage/SQLTransactionCoordinator.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.h
diff --git a/Source/WebCore/storage/SQLTransactionErrorCallback.h b/Source/WebCore/Modules/webdatabase/SQLTransactionErrorCallback.h
index 56727cc05..56727cc05 100644
--- a/Source/WebCore/storage/SQLTransactionErrorCallback.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionErrorCallback.h
diff --git a/Source/WebCore/storage/SQLTransactionErrorCallback.idl b/Source/WebCore/Modules/webdatabase/SQLTransactionErrorCallback.idl
index f6ec15641..f6ec15641 100644
--- a/Source/WebCore/storage/SQLTransactionErrorCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionErrorCallback.idl
diff --git a/Source/WebCore/storage/SQLTransactionSync.cpp b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.cpp
index d1da05ee7..7aae7d4ae 100644
--- a/Source/WebCore/storage/SQLTransactionSync.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(SQL_DATABASE)
 
 #include "DatabaseAuthorizer.h"
+#include "DatabaseContext.h"
 #include "DatabaseSync.h"
 #include "PlatformString.h"
 #include "SQLException.h"
@@ -94,7 +95,7 @@ PassRefPtr<SQLResultSet> SQLTransactionSync::executeSQL(const String& sqlStateme
         return 0;
 
     int permissions = DatabaseAuthorizer::ReadWriteMask;
-    if (!m_database->scriptExecutionContext()->allowDatabaseAccess())
+    if (!m_database->databaseContext()->allowDatabaseAccess())
       permissions |= DatabaseAuthorizer::NoAccessMask;
     else if (m_readOnly)
       permissions |= DatabaseAuthorizer::ReadOnlyMask;
diff --git a/Source/WebCore/storage/SQLTransactionSync.h b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.h
index 309acfbe8..309acfbe8 100644
--- a/Source/WebCore/storage/SQLTransactionSync.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.h
diff --git a/Source/WebCore/storage/SQLTransactionSync.idl b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.idl
index e5bdedf01..e5bdedf01 100644
--- a/Source/WebCore/storage/SQLTransactionSync.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.idl
diff --git a/Source/WebCore/storage/SQLTransactionSyncCallback.h b/Source/WebCore/Modules/webdatabase/SQLTransactionSyncCallback.h
index 0c5f8fd63..0c5f8fd63 100644
--- a/Source/WebCore/storage/SQLTransactionSyncCallback.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionSyncCallback.h
diff --git a/Source/WebCore/storage/SQLTransactionSyncCallback.idl b/Source/WebCore/Modules/webdatabase/SQLTransactionSyncCallback.idl
index ea22e5f29..ea22e5f29 100644
--- a/Source/WebCore/storage/SQLTransactionSyncCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionSyncCallback.idl
diff --git a/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.cpp b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.cpp
new file mode 100644
index 000000000..8a2935571
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(SQL_DATABASE)
+
+#include "WorkerContextSQLDatabase.h"
+
+#include "AbstractDatabase.h"
+#include "Database.h"
+#include "DatabaseCallback.h"
+#include "DatabaseSync.h"
+#include "DatabaseTracker.h"
+#include "SecurityOrigin.h"
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+PassRefPtr<Database> WorkerContextSQLDatabase::openDatabase(WorkerContext* context, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
+{
+    if (!context->securityOrigin()->canAccessDatabase() || !AbstractDatabase::isAvailable()) {
+        ec = SECURITY_ERR;
+        return 0;
+    }
+
+    return Database::openDatabase(context, name, version, displayName, estimatedSize, creationCallback, ec);
+}
+
+PassRefPtr<DatabaseSync> WorkerContextSQLDatabase::openDatabaseSync(WorkerContext* context, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
+{
+    if (!context->securityOrigin()->canAccessDatabase() || !AbstractDatabase::isAvailable()) {
+        ec = SECURITY_ERR;
+        return 0;
+    }
+
+    return DatabaseSync::openDatabaseSync(context, name, version, displayName, estimatedSize, creationCallback, ec);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SQL_DATABASE)
diff --git a/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.h b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.h
new file mode 100644
index 000000000..257d9efe2
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef WorkerContextSQLDatabase_h
+#define WorkerContextSQLDatabase_h
+
+#if ENABLE(SQL_DATABASE)
+
+#include "ExceptionCode.h"
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class Database;
+class DatabaseCallback;
+class DatabaseSync;
+class WorkerContext;
+
+class WorkerContextSQLDatabase {
+public:
+    static PassRefPtr<Database> openDatabase(WorkerContext*, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
+    static PassRefPtr<DatabaseSync> openDatabaseSync(WorkerContext*, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
+
+private:
+    WorkerContextSQLDatabase() { };
+    ~WorkerContextSQLDatabase() { };
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SQL_DATABASE)
+
+#endif // WorkerContextSQLDatabase_h
diff --git a/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.idl b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.idl
new file mode 100644
index 000000000..d3e6df47a
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module window {
+
+    interface [
+        Conditional=SQL_DATABASE,
+        Supplemental=WorkerContext
+    ] WorkerContextSQLDatabase {
+        [V8EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
+            raises(DOMException);
+
+        [V8EnabledAtRuntime] DatabaseSync openDatabaseSync(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
+            raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/storage/chromium/DatabaseObserver.h b/Source/WebCore/Modules/webdatabase/chromium/DatabaseObserver.h
index 657c78e9e..657c78e9e 100644
--- a/Source/WebCore/storage/chromium/DatabaseObserver.h
+++ b/Source/WebCore/Modules/webdatabase/chromium/DatabaseObserver.h
diff --git a/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp b/Source/WebCore/Modules/webdatabase/chromium/DatabaseTrackerChromium.cpp
index 117fdbeed..117fdbeed 100644
--- a/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
+++ b/Source/WebCore/Modules/webdatabase/chromium/DatabaseTrackerChromium.cpp
diff --git a/Source/WebCore/storage/chromium/QuotaTracker.cpp b/Source/WebCore/Modules/webdatabase/chromium/QuotaTracker.cpp
index 2a0962798..2a0962798 100644
--- a/Source/WebCore/storage/chromium/QuotaTracker.cpp
+++ b/Source/WebCore/Modules/webdatabase/chromium/QuotaTracker.cpp
diff --git a/Source/WebCore/storage/chromium/QuotaTracker.h b/Source/WebCore/Modules/webdatabase/chromium/QuotaTracker.h
index def731ed4..def731ed4 100644
--- a/Source/WebCore/storage/chromium/QuotaTracker.h
+++ b/Source/WebCore/Modules/webdatabase/chromium/QuotaTracker.h
diff --git a/Source/WebCore/storage/chromium/SQLTransactionClientChromium.cpp b/Source/WebCore/Modules/webdatabase/chromium/SQLTransactionClientChromium.cpp
index d12f47193..d12f47193 100644
--- a/Source/WebCore/storage/chromium/SQLTransactionClientChromium.cpp
+++ b/Source/WebCore/Modules/webdatabase/chromium/SQLTransactionClientChromium.cpp
diff --git a/Source/WebCore/websockets/CloseEvent.h b/Source/WebCore/Modules/websockets/CloseEvent.h
index 75a775042..75a775042 100644
--- a/Source/WebCore/websockets/CloseEvent.h
+++ b/Source/WebCore/Modules/websockets/CloseEvent.h
diff --git a/Source/WebCore/websockets/CloseEvent.idl b/Source/WebCore/Modules/websockets/CloseEvent.idl
index ea75111ac..ea75111ac 100644
--- a/Source/WebCore/websockets/CloseEvent.idl
+++ b/Source/WebCore/Modules/websockets/CloseEvent.idl
diff --git a/Source/WebCore/Modules/websockets/DOMWindowWebSocket.idl b/Source/WebCore/Modules/websockets/DOMWindowWebSocket.idl
new file mode 100644
index 000000000..2b5fca8bb
--- /dev/null
+++ b/Source/WebCore/Modules/websockets/DOMWindowWebSocket.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    interface [
+        Conditional=WEB_SOCKETS,
+        Supplemental=DOMWindow
+    ] DOMWindowWebSocket {
+#if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
+        attribute CloseEventConstructor CloseEvent;
+        attribute [JSCustomGetter, V8EnabledAtRuntime] WebSocketConstructor WebSocket; // Usable with the new operator
+#endif
+    };
+
+}
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.cpp
index 029e4ffd7..029e4ffd7 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.cpp
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannel.h b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h
index a14582a8f..32ea8aae1 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h
@@ -50,13 +50,19 @@ public:
     ThreadableWebSocketChannel() { }
     static PassRefPtr<ThreadableWebSocketChannel> create(ScriptExecutionContext*, WebSocketChannelClient*);
 
+    enum SendResult {
+        SendSuccess,
+        SendFail,
+        InvalidMessage
+    };
+
     virtual bool useHixie76Protocol() = 0;
     virtual void connect(const KURL&, const String& protocol) = 0;
     virtual String subprotocol() = 0; // Will be available after didConnect() callback is invoked.
     virtual String extensions() = 0; // Will be available after didConnect() callback is invoked.
-    virtual bool send(const String& message) = 0;
-    virtual bool send(const ArrayBuffer&) = 0;
-    virtual bool send(const Blob&) = 0;
+    virtual SendResult send(const String& message) = 0;
+    virtual SendResult send(const ArrayBuffer&) = 0;
+    virtual SendResult send(const Blob&) = 0;
     virtual unsigned long bufferedAmount() const = 0;
     virtual void close(int code, const String& reason) = 0;
     // Log the reason text and close the connection. Will call didClose().
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
index dcb1802a2..9a4f3fa23 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
@@ -46,7 +46,7 @@ ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper
     , m_client(client)
     , m_syncMethodDone(true)
     , m_useHixie76Protocol(true)
-    , m_sendRequestResult(false)
+    , m_sendRequestResult(ThreadableWebSocketChannel::SendFail)
     , m_bufferedAmount(0)
     , m_suspended(false)
 {
@@ -112,12 +112,12 @@ void ThreadableWebSocketChannelClientWrapper::setExtensions(const String& extens
         memcpy(m_extensions.data(), extensions.characters(), sizeof(UChar) * length);
 }
 
-bool ThreadableWebSocketChannelClientWrapper::sendRequestResult() const
+ThreadableWebSocketChannel::SendResult ThreadableWebSocketChannelClientWrapper::sendRequestResult() const
 {
     return m_sendRequestResult;
 }
 
-void ThreadableWebSocketChannelClientWrapper::setSendRequestResult(bool sendRequestResult)
+void ThreadableWebSocketChannelClientWrapper::setSendRequestResult(ThreadableWebSocketChannel::SendResult sendRequestResult)
 {
     m_sendRequestResult = sendRequestResult;
     m_syncMethodDone = true;
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h
index 4b9b7fde7..bfd106381 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h
@@ -35,6 +35,7 @@
 
 #include "PlatformString.h"
 #include "ScriptExecutionContext.h"
+#include "ThreadableWebSocketChannel.h"
 #include "WebSocketChannelClient.h"
 #include <wtf/Forward.h>
 #include <wtf/OwnPtr.h>
@@ -66,8 +67,8 @@ public:
     String extensions() const;
     void setExtensions(const String&);
 
-    bool sendRequestResult() const;
-    void setSendRequestResult(bool);
+    ThreadableWebSocketChannel::SendResult sendRequestResult() const;
+    void setSendRequestResult(ThreadableWebSocketChannel::SendResult);
 
     unsigned long bufferedAmount() const;
     void setBufferedAmount(unsigned long);
@@ -104,7 +105,7 @@ private:
     // ThreadSafeRefCounted must not have String member variables.
     Vector<UChar> m_subprotocol;
     Vector<UChar> m_extensions;
-    bool m_sendRequestResult;
+    ThreadableWebSocketChannel::SendResult m_sendRequestResult;
     unsigned long m_bufferedAmount;
     bool m_suspended;
     Vector<OwnPtr<ScriptExecutionContext::Task> > m_pendingTasks;
diff --git a/Source/WebCore/websockets/WebSocket.cpp b/Source/WebCore/Modules/websockets/WebSocket.cpp
index 36dbb6f32..78183f1fb 100644
--- a/Source/WebCore/websockets/WebSocket.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocket.cpp
@@ -288,9 +288,14 @@ bool WebSocket::send(const String& message, ExceptionCode& ec)
         m_bufferedAmountAfterClose = saturateAdd(m_bufferedAmountAfterClose, getFramingOverhead(payloadSize));
         return false;
     }
-    // FIXME: check message is valid utf8.
     ASSERT(m_channel);
-    return m_channel->send(message);
+    ThreadableWebSocketChannel::SendResult result = m_channel->send(message);
+    if (result == ThreadableWebSocketChannel::InvalidMessage) {
+        scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Websocket message contains invalid character(s).");
+        ec = SYNTAX_ERR;
+        return false;
+    }
+    return result == ThreadableWebSocketChannel::SendSuccess;
 }
 
 bool WebSocket::send(ArrayBuffer* binaryData, ExceptionCode& ec)
@@ -310,7 +315,7 @@ bool WebSocket::send(ArrayBuffer* binaryData, ExceptionCode& ec)
         return false;
     }
     ASSERT(m_channel);
-    return m_channel->send(*binaryData);
+    return m_channel->send(*binaryData) == ThreadableWebSocketChannel::SendSuccess;
 }
 
 bool WebSocket::send(Blob* binaryData, ExceptionCode& ec)
@@ -330,7 +335,7 @@ bool WebSocket::send(Blob* binaryData, ExceptionCode& ec)
         return false;
     }
     ASSERT(m_channel);
-    return m_channel->send(*binaryData);
+    return m_channel->send(*binaryData) == ThreadableWebSocketChannel::SendSuccess;
 }
 
 void WebSocket::close(int code, const String& reason, ExceptionCode& ec)
@@ -343,8 +348,15 @@ void WebSocket::close(int code, const String& reason, ExceptionCode& ec)
             ec = INVALID_ACCESS_ERR;
             return;
         }
-        // FIXME: if reason contains any unpaired surrogates, raise SYNTAX_ERR.
-        if (reason.utf8().length() > maxReasonSizeInBytes) {
+        CString utf8 = reason.utf8(true);
+        if (utf8.length() > maxReasonSizeInBytes) {
+            scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "WebSocket close message is too long.");
+            ec = SYNTAX_ERR;
+            return;
+        }
+        // Checks whether reason is valid utf8.
+        if (utf8.isNull() && reason.length()) {
+            scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "WebSocket close message contains invalid character(s).");
             ec = SYNTAX_ERR;
             return;
         }
@@ -478,6 +490,7 @@ void WebSocket::didConnect()
     ASSERT(scriptExecutionContext());
     m_state = OPEN;
     m_subprotocol = m_channel->subprotocol();
+    m_extensions = m_channel->extensions();
     dispatchEvent(Event::create(eventNames().openEvent, false, false));
 }
 
diff --git a/Source/WebCore/websockets/WebSocket.h b/Source/WebCore/Modules/websockets/WebSocket.h
index 1e44245e8..1e44245e8 100644
--- a/Source/WebCore/websockets/WebSocket.h
+++ b/Source/WebCore/Modules/websockets/WebSocket.h
diff --git a/Source/WebCore/websockets/WebSocket.idl b/Source/WebCore/Modules/websockets/WebSocket.idl
index 92835ae43..92835ae43 100644
--- a/Source/WebCore/websockets/WebSocket.idl
+++ b/Source/WebCore/Modules/websockets/WebSocket.idl
diff --git a/Source/WebCore/websockets/WebSocketChannel.cpp b/Source/WebCore/Modules/websockets/WebSocketChannel.cpp
index ec0706db4..6c976aac9 100644
--- a/Source/WebCore/websockets/WebSocketChannel.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketChannel.cpp
@@ -127,6 +127,8 @@ void WebSocketChannel::connect(const KURL& url, const String& protocol)
     ASSERT(!m_suspended);
     m_handshake = adoptPtr(new WebSocketHandshake(url, protocol, m_document, m_useHixie76Protocol));
     m_handshake->reset();
+    if (!m_useHixie76Protocol && m_deflateFramer.canDeflate())
+        m_handshake->addExtensionProcessor(m_deflateFramer.createExtensionProcessor());
     if (m_identifier)
         InspectorInstrumentation::didCreateWebSocket(m_document, m_identifier, url, m_document->url());
     ref();
@@ -155,37 +157,39 @@ String WebSocketChannel::extensions()
     return extensions;
 }
 
-bool WebSocketChannel::send(const String& message)
+ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const String& message)
 {
     LOG(Network, "WebSocketChannel %p send %s", this, message.utf8().data());
+    CString utf8 = message.utf8(true);
+    if (utf8.isNull() && message.length())
+        return InvalidMessage;
     if (m_useHixie76Protocol) {
-        CString utf8 = message.utf8();
-        return sendFrameHixie76(utf8.data(), utf8.length());
+        return sendFrameHixie76(utf8.data(), utf8.length()) ? ThreadableWebSocketChannel::SendSuccess : ThreadableWebSocketChannel::SendFail;
     }
-    enqueueTextFrame(message);
+    enqueueTextFrame(utf8);
     // According to WebSocket API specification, WebSocket.send() should return void instead
     // of boolean. However, our implementation still returns boolean due to compatibility
     // concern (see bug 65850).
     // m_channel->send() may happen later, thus it's not always possible to know whether
     // the message has been sent to the socket successfully. In this case, we have no choice
     // but to return true.
-    return true;
+    return ThreadableWebSocketChannel::SendSuccess;
 }
 
-bool WebSocketChannel::send(const ArrayBuffer& binaryData)
+ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const ArrayBuffer& binaryData)
 {
     LOG(Network, "WebSocketChannel %p send arraybuffer %p", this, &binaryData);
     ASSERT(!m_useHixie76Protocol);
     enqueueRawFrame(WebSocketFrame::OpCodeBinary, static_cast<const char*>(binaryData.data()), binaryData.byteLength());
-    return true;
+    return ThreadableWebSocketChannel::SendSuccess;
 }
 
-bool WebSocketChannel::send(const Blob& binaryData)
+ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const Blob& binaryData)
 {
     LOG(Network, "WebSocketChannel %p send blob %s", this, binaryData.url().string().utf8().data());
     ASSERT(!m_useHixie76Protocol);
     enqueueBlobFrame(WebSocketFrame::OpCodeBinary, binaryData);
-    return true;
+    return ThreadableWebSocketChannel::SendSuccess;
 }
 
 bool WebSocketChannel::send(const char* data, int length)
@@ -228,6 +232,7 @@ void WebSocketChannel::fail(const String& reason)
         m_shouldDiscardReceivedData = true;
         if (m_buffer)
             skipBuffer(m_bufferSize); // Save memory.
+        m_deflateFramer.didFail();
         m_hasContinuousFrame = false;
         m_continuousFrameData.clear();
     }
@@ -618,6 +623,12 @@ bool WebSocketChannel::processFrame()
     ASSERT(m_buffer < frameEnd);
     ASSERT(frameEnd <= m_buffer + m_bufferSize);
 
+    OwnPtr<InflateResultHolder> inflateResult = m_deflateFramer.inflate(frame);
+    if (!inflateResult->succeeded()) {
+        fail(inflateResult->failureReason());
+        return false;
+    }
+
     // Validate the frame data.
     if (WebSocketFrame::isReservedOpCode(frame.opCode)) {
         fail("Unrecognized frame opcode: " + String::number(frame.opCode));
@@ -847,7 +858,7 @@ bool WebSocketChannel::processFrameHixie76()
     return false;
 }
 
-void WebSocketChannel::enqueueTextFrame(const String& string)
+void WebSocketChannel::enqueueTextFrame(const CString& string)
 {
     ASSERT(!m_useHixie76Protocol);
     ASSERT(m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen);
@@ -895,8 +906,7 @@ void WebSocketChannel::processOutgoingFrameQueue()
         OwnPtr<QueuedFrame> frame = m_outgoingFrameQueue.takeFirst();
         switch (frame->frameType) {
         case QueuedFrameTypeString: {
-            CString utf8 = frame->stringData.utf8();
-            if (!sendFrame(frame->opCode, utf8.data(), utf8.length()))
+            if (!sendFrame(frame->opCode, frame->stringData.data(), frame->stringData.length()))
                 fail("Failed to send WebSocket frame.");
             break;
         }
@@ -1011,6 +1021,13 @@ bool WebSocketChannel::sendFrame(WebSocketFrame::OpCode opCode, const char* data
 
     ASSERT(!(opCode & ~opCodeMask)); // Checks whether "opCode" fits in the range of opCodes.
     WebSocketFrame frame(opCode, true, false, true, data, dataLength);
+
+    OwnPtr<DeflateResultHolder> deflateResult = m_deflateFramer.deflate(frame);
+    if (!deflateResult->succeeded()) {
+        fail(deflateResult->failureReason());
+        return false;
+    }
+
     Vector<char> frameData;
     makeFrameData(frame, frameData);
 
diff --git a/Source/WebCore/websockets/WebSocketChannel.h b/Source/WebCore/Modules/websockets/WebSocketChannel.h
index 4bb28c9f2..62b4fd35f 100644
--- a/Source/WebCore/websockets/WebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/WebSocketChannel.h
@@ -37,12 +37,14 @@
 #include "SocketStreamHandleClient.h"
 #include "ThreadableWebSocketChannel.h"
 #include "Timer.h"
+#include "WebSocketDeflateFramer.h"
 #include "WebSocketFrame.h"
 #include "WebSocketHandshake.h"
 #include <wtf/Deque.h>
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
+#include <wtf/text/CString.h>
 
 namespace WebCore {
 
@@ -70,9 +72,9 @@ public:
     virtual void connect(const KURL&, const String& protocol) OVERRIDE;
     virtual String subprotocol() OVERRIDE;
     virtual String extensions() OVERRIDE;
-    virtual bool send(const String& message) OVERRIDE;
-    virtual bool send(const ArrayBuffer&) OVERRIDE;
-    virtual bool send(const Blob&) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const String& message) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const Blob&) OVERRIDE;
     virtual unsigned long bufferedAmount() const OVERRIDE;
     virtual void close(int code, const String& reason) OVERRIDE; // Start closing handshake.
     virtual void fail(const String& reason) OVERRIDE;
@@ -159,11 +161,11 @@ private:
         WebSocketFrame::OpCode opCode;
         QueuedFrameType frameType;
         // Only one of the following items is used, according to the value of frameType.
-        String stringData;
+        CString stringData;
         Vector<char> vectorData;
         RefPtr<Blob> blobData;
     };
-    void enqueueTextFrame(const String&);
+    void enqueueTextFrame(const CString&);
     void enqueueRawFrame(WebSocketFrame::OpCode, const char* data, size_t dataLength);
     void enqueueBlobFrame(WebSocketFrame::OpCode, const Blob&);
 
@@ -231,6 +233,8 @@ private:
     OwnPtr<FileReaderLoader> m_blobLoader;
     BlobLoaderStatus m_blobLoaderStatus;
 #endif
+
+    WebSocketDeflateFramer m_deflateFramer;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/websockets/WebSocketChannelClient.h b/Source/WebCore/Modules/websockets/WebSocketChannelClient.h
index 31d189217..31d189217 100644
--- a/Source/WebCore/websockets/WebSocketChannelClient.h
+++ b/Source/WebCore/Modules/websockets/WebSocketChannelClient.h
diff --git a/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.cpp b/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.cpp
new file mode 100644
index 000000000..67f9533ab
--- /dev/null
+++ b/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.cpp
@@ -0,0 +1,257 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketDeflateFramer.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class WebSocketExtensionDeflateFrame : public WebSocketExtensionProcessor {
+public:
+    static PassOwnPtr<WebSocketExtensionDeflateFrame> create(WebSocketDeflateFramer* framer)
+    {
+        return adoptPtr(new WebSocketExtensionDeflateFrame(framer));
+    }
+    virtual ~WebSocketExtensionDeflateFrame() { }
+
+    virtual String handshakeString() OVERRIDE;
+    virtual bool processResponse(const HashMap<String, String>&) OVERRIDE;
+    virtual String failureReason() OVERRIDE { return m_failureReason; }
+
+private:
+    WebSocketExtensionDeflateFrame(WebSocketDeflateFramer*);
+
+    WebSocketDeflateFramer* m_framer;
+    bool m_responseProcessed;
+    String m_failureReason;
+};
+
+// FXIME: Remove vendor prefix after the specification matured.
+WebSocketExtensionDeflateFrame::WebSocketExtensionDeflateFrame(WebSocketDeflateFramer* framer)
+    : WebSocketExtensionProcessor("x-webkit-deflate-frame")
+    , m_framer(framer)
+    , m_responseProcessed(false)
+{
+    ASSERT(m_framer);
+}
+
+String WebSocketExtensionDeflateFrame::handshakeString()
+{
+    return extensionToken(); // No parameter
+}
+
+bool WebSocketExtensionDeflateFrame::processResponse(const HashMap<String, String>& serverParameters)
+{
+#if USE(ZLIB)
+    if (m_responseProcessed) {
+        m_failureReason = "Received duplicate deflate-frame response";
+        return false;
+    }
+    m_responseProcessed = true;
+
+    int expectedNumParameters = 0;
+    int windowBits = 15;
+    HashMap<String, String>::const_iterator parameter = serverParameters.find("max_window_bits");
+    if (parameter != serverParameters.end()) {
+        windowBits = parameter->second.toInt();
+        if (windowBits < 8 || windowBits > 15) {
+            m_failureReason = "Received invalid max_window_bits parameter";
+            return false;
+        }
+        expectedNumParameters++;
+    }
+
+    WebSocketDeflater::ContextTakeOverMode mode = WebSocketDeflater::TakeOverContext;
+    parameter = serverParameters.find("no_context_takeover");
+    if (parameter != serverParameters.end()) {
+        if (!parameter->second.isNull()) {
+            m_failureReason = "Received invalid no_context_takeover parameter";
+            return false;
+        }
+        mode = WebSocketDeflater::DoNotTakeOverContext;
+        expectedNumParameters++;
+    }
+
+    if (expectedNumParameters != serverParameters.size()) {
+        m_failureReason = "Received unexpected deflate-frame parameter";
+        return false;
+    }
+
+    m_framer->enableDeflate(windowBits, mode);
+    return true;
+#else
+    ASSERT_NOT_REACHED();
+    return false;
+#endif
+}
+
+DeflateResultHolder::DeflateResultHolder(WebSocketDeflateFramer* framer)
+    : m_framer(framer)
+    , m_succeeded(true)
+{
+    ASSERT(m_framer);
+}
+
+DeflateResultHolder::~DeflateResultHolder()
+{
+    m_framer->resetDeflateContext();
+}
+
+void DeflateResultHolder::fail(const String& failureReason)
+{
+    m_succeeded = false;
+    m_failureReason = failureReason;
+}
+
+InflateResultHolder::InflateResultHolder(WebSocketDeflateFramer* framer)
+    : m_framer(framer)
+    , m_succeeded(true)
+{
+    ASSERT(m_framer);
+}
+
+InflateResultHolder::~InflateResultHolder()
+{
+    m_framer->resetInflateContext();
+}
+
+void InflateResultHolder::fail(const String& failureReason)
+{
+    m_succeeded = false;
+    m_failureReason = failureReason;
+}
+
+WebSocketDeflateFramer::WebSocketDeflateFramer()
+    : m_enabled(false)
+{
+}
+
+PassOwnPtr<WebSocketExtensionProcessor> WebSocketDeflateFramer::createExtensionProcessor()
+{
+    return WebSocketExtensionDeflateFrame::create(this);
+}
+
+bool WebSocketDeflateFramer::canDeflate() const
+{
+#if USE(ZLIB)
+    return true;
+#else
+    return false;
+#endif
+}
+
+#if USE(ZLIB)
+void WebSocketDeflateFramer::enableDeflate(int windowBits, WebSocketDeflater::ContextTakeOverMode mode)
+{
+    m_deflater = WebSocketDeflater::create(windowBits, mode);
+    m_inflater = WebSocketInflater::create();
+    if (!m_deflater->initialize() || !m_inflater->initialize()) {
+        m_deflater.clear();
+        m_inflater.clear();
+        return;
+    }
+    m_enabled = true;
+}
+#endif
+
+PassOwnPtr<DeflateResultHolder> WebSocketDeflateFramer::deflate(WebSocketFrame& frame)
+{
+#if USE(ZLIB)
+    OwnPtr<DeflateResultHolder> result = DeflateResultHolder::create(this);
+    if (!enabled() || !WebSocketFrame::isNonControlOpCode(frame.opCode) || !frame.payloadLength)
+        return result.release();
+    if (!m_deflater->addBytes(frame.payload, frame.payloadLength) || !m_deflater->finish()) {
+        result->fail("Failed to compress frame");
+        return result.release();
+    }
+    frame.compress = true;
+    frame.payload = m_deflater->data();
+    frame.payloadLength = m_deflater->size();
+    return result.release();
+#else
+    return DeflateResultHolder::create(this);
+#endif
+}
+
+void WebSocketDeflateFramer::resetDeflateContext()
+{
+#if USE(ZLIB)
+    if (m_deflater)
+        m_deflater->reset();
+#endif
+}
+
+PassOwnPtr<InflateResultHolder> WebSocketDeflateFramer::inflate(WebSocketFrame& frame)
+{
+#if USE(ZLIB)
+    OwnPtr<InflateResultHolder> result = InflateResultHolder::create(this);
+    if (!frame.compress)
+        return result.release();
+    if (!enabled() || !WebSocketFrame::isNonControlOpCode(frame.opCode)) {
+        result->fail("Received unexpected compressed frame");
+        return result.release();
+    }
+    if (!m_inflater->addBytes(frame.payload, frame.payloadLength) || !m_inflater->finish()) {
+        result->fail("Failed to decompress frame");
+        return result.release();
+    }
+    frame.compress = false;
+    frame.payload = m_inflater->data();
+    frame.payloadLength = m_inflater->size();
+    return result.release();
+#else
+    return InflateResultHolder::create(this);
+#endif
+}
+
+void WebSocketDeflateFramer::resetInflateContext()
+{
+#if USE(ZLIB)
+    if (m_inflater)
+        m_inflater->reset();
+#endif
+}
+
+void WebSocketDeflateFramer::didFail()
+{
+    resetDeflateContext();
+    resetInflateContext();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
diff --git a/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.h b/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.h
new file mode 100644
index 000000000..a35526821
--- /dev/null
+++ b/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketDeflateFramer_h
+#define WebSocketDeflateFramer_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#if USE(ZLIB)
+#include "WebSocketDeflater.h"
+#endif
+#include "WebSocketExtensionProcessor.h"
+#include "WebSocketFrame.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class WebSocketDeflateFramer;
+
+class DeflateResultHolder {
+public:
+    static PassOwnPtr<DeflateResultHolder> create(WebSocketDeflateFramer* framer)
+    {
+        return adoptPtr(new DeflateResultHolder(framer));
+    }
+
+    ~DeflateResultHolder();
+
+    bool succeeded() const { return m_succeeded; }
+    String failureReason() const { return m_failureReason; }
+
+    void fail(const String& failureReason);
+
+private:
+    explicit DeflateResultHolder(WebSocketDeflateFramer*);
+
+    WebSocketDeflateFramer* m_framer;
+    bool m_succeeded;
+    String m_failureReason;
+};
+
+class InflateResultHolder {
+public:
+    static PassOwnPtr<InflateResultHolder> create(WebSocketDeflateFramer* framer)
+    {
+        return adoptPtr(new InflateResultHolder(framer));
+    }
+
+    ~InflateResultHolder();
+
+    bool succeeded() const { return m_succeeded; }
+    String failureReason() const { return m_failureReason; }
+
+    void fail(const String& failureReason);
+
+private:
+    explicit InflateResultHolder(WebSocketDeflateFramer*);
+
+    WebSocketDeflateFramer* m_framer;
+    bool m_succeeded;
+    String m_failureReason;
+};
+
+class WebSocketDeflateFramer {
+public:
+    WebSocketDeflateFramer();
+
+    PassOwnPtr<WebSocketExtensionProcessor> createExtensionProcessor();
+
+    bool canDeflate() const;
+    bool enabled() const { return m_enabled; }
+
+    PassOwnPtr<DeflateResultHolder> deflate(WebSocketFrame&);
+    void resetDeflateContext();
+    PassOwnPtr<InflateResultHolder> inflate(WebSocketFrame&);
+    void resetInflateContext();
+
+    void didFail();
+
+#if USE(ZLIB)
+    void enableDeflate(int windowBits, WebSocketDeflater::ContextTakeOverMode);
+#endif
+
+private:
+    bool m_enabled;
+#if USE(ZLIB)
+    OwnPtr<WebSocketDeflater> m_deflater;
+    OwnPtr<WebSocketInflater> m_inflater;
+#endif
+};
+
+}
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WebSocketDeflateFramer_h
diff --git a/Source/WebCore/websockets/WebSocketDeflater.cpp b/Source/WebCore/Modules/websockets/WebSocketDeflater.cpp
index 47ea94055..ca4960129 100644
--- a/Source/WebCore/websockets/WebSocketDeflater.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketDeflater.cpp
@@ -29,11 +29,10 @@
  */
 
 #include "config.h"
-
-#if ENABLE(WEB_SOCKETS)
-
 #include "WebSocketDeflater.h"
 
+#if ENABLE(WEB_SOCKETS) && USE(ZLIB)
+
 #include "Logging.h"
 #include <wtf/FastMalloc.h>
 #include <wtf/HashMap.h>
@@ -209,4 +208,4 @@ void WebSocketInflater::reset()
 
 } // namespace WebCore
 
-#endif // ENABLE(WEB_SOCKETS)
+#endif // ENABLE(WEB_SOCKETS) && USE(ZLIB)
diff --git a/Source/WebCore/websockets/WebSocketDeflater.h b/Source/WebCore/Modules/websockets/WebSocketDeflater.h
index 9c630dcfb..9c630dcfb 100644
--- a/Source/WebCore/websockets/WebSocketDeflater.h
+++ b/Source/WebCore/Modules/websockets/WebSocketDeflater.h
diff --git a/Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp b/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.cpp
index 7c592ad1b..7c592ad1b 100644
--- a/Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.cpp
diff --git a/Source/WebCore/websockets/WebSocketExtensionDispatcher.h b/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.h
index 35cd769ea..35cd769ea 100644
--- a/Source/WebCore/websockets/WebSocketExtensionDispatcher.h
+++ b/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.h
diff --git a/Source/WebCore/websockets/WebSocketExtensionProcessor.h b/Source/WebCore/Modules/websockets/WebSocketExtensionProcessor.h
index ee3d53d41..ee3d53d41 100644
--- a/Source/WebCore/websockets/WebSocketExtensionProcessor.h
+++ b/Source/WebCore/Modules/websockets/WebSocketExtensionProcessor.h
diff --git a/Source/WebCore/websockets/WebSocketFrame.h b/Source/WebCore/Modules/websockets/WebSocketFrame.h
index 7efea78db..7efea78db 100644
--- a/Source/WebCore/websockets/WebSocketFrame.h
+++ b/Source/WebCore/Modules/websockets/WebSocketFrame.h
diff --git a/Source/WebCore/websockets/WebSocketHandshake.cpp b/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp
index 8cc509e59..8cc509e59 100644
--- a/Source/WebCore/websockets/WebSocketHandshake.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp
diff --git a/Source/WebCore/websockets/WebSocketHandshake.h b/Source/WebCore/Modules/websockets/WebSocketHandshake.h
index b025f0c27..b025f0c27 100644
--- a/Source/WebCore/websockets/WebSocketHandshake.h
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshake.h
diff --git a/Source/WebCore/websockets/WebSocketHandshakeRequest.cpp b/Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.cpp
index 1132a4478..1132a4478 100644
--- a/Source/WebCore/websockets/WebSocketHandshakeRequest.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.cpp
diff --git a/Source/WebCore/websockets/WebSocketHandshakeRequest.h b/Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.h
index 792f67e52..792f67e52 100644
--- a/Source/WebCore/websockets/WebSocketHandshakeRequest.h
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.h
diff --git a/Source/WebCore/websockets/WebSocketHandshakeResponse.cpp b/Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.cpp
index 2e0dad7f0..2e0dad7f0 100644
--- a/Source/WebCore/websockets/WebSocketHandshakeResponse.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.cpp
diff --git a/Source/WebCore/websockets/WebSocketHandshakeResponse.h b/Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.h
index fe435ee14..fe435ee14 100644
--- a/Source/WebCore/websockets/WebSocketHandshakeResponse.h
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.h
diff --git a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
index c7486557a..762dc4369 100644
--- a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
+++ b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
@@ -89,24 +89,24 @@ String WorkerThreadableWebSocketChannel::extensions()
     return m_workerClientWrapper->extensions();
 }
 
-bool WorkerThreadableWebSocketChannel::send(const String& message)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::send(const String& message)
 {
     if (!m_bridge)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     return m_bridge->send(message);
 }
 
-bool WorkerThreadableWebSocketChannel::send(const ArrayBuffer& binaryData)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::send(const ArrayBuffer& binaryData)
 {
     if (!m_bridge)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     return m_bridge->send(binaryData);
 }
 
-bool WorkerThreadableWebSocketChannel::send(const Blob& binaryData)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::send(const Blob& binaryData)
 {
     if (!m_bridge)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     return m_bridge->send(binaryData);
 }
 
@@ -180,7 +180,7 @@ void WorkerThreadableWebSocketChannel::Peer::connect(const KURL& url, const Stri
     m_mainWebSocketChannel->connect(url, protocol);
 }
 
-static void workerContextDidSend(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, bool sendRequestResult)
+static void workerContextDidSend(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, ThreadableWebSocketChannel::SendResult sendRequestResult)
 {
     ASSERT_UNUSED(context, context->isWorkerContext());
     workerClientWrapper->setSendRequestResult(sendRequestResult);
@@ -191,7 +191,7 @@ void WorkerThreadableWebSocketChannel::Peer::send(const String& message)
     ASSERT(isMainThread());
     if (!m_mainWebSocketChannel || !m_workerClientWrapper)
         return;
-    bool sendRequestResult = m_mainWebSocketChannel->send(message);
+    ThreadableWebSocketChannel::SendResult sendRequestResult = m_mainWebSocketChannel->send(message);
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSend, m_workerClientWrapper, sendRequestResult), m_taskMode);
 }
 
@@ -200,7 +200,7 @@ void WorkerThreadableWebSocketChannel::Peer::send(const ArrayBuffer& binaryData)
     ASSERT(isMainThread());
     if (!m_mainWebSocketChannel || !m_workerClientWrapper)
         return;
-    bool sendRequestResult = m_mainWebSocketChannel->send(binaryData);
+    ThreadableWebSocketChannel::SendResult sendRequestResult = m_mainWebSocketChannel->send(binaryData);
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSend, m_workerClientWrapper, sendRequestResult), m_taskMode);
 }
 
@@ -209,7 +209,7 @@ void WorkerThreadableWebSocketChannel::Peer::send(const Blob& binaryData)
     ASSERT(isMainThread());
     if (!m_mainWebSocketChannel || !m_workerClientWrapper)
         return;
-    bool sendRequestResult = m_mainWebSocketChannel->send(binaryData);
+    ThreadableWebSocketChannel::SendResult sendRequestResult = m_mainWebSocketChannel->send(binaryData);
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSend, m_workerClientWrapper, sendRequestResult), m_taskMode);
 }
 
@@ -432,23 +432,25 @@ void WorkerThreadableWebSocketChannel::mainThreadSendBlob(ScriptExecutionContext
     peer->send(*blob);
 }
 
-bool WorkerThreadableWebSocketChannel::Bridge::send(const String& message)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::Bridge::send(const String& message)
 {
     if (!m_workerClientWrapper)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     ASSERT(m_peer);
     setMethodNotCompleted();
     m_loaderProxy.postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadSend, AllowCrossThreadAccess(m_peer), message));
     RefPtr<Bridge> protect(this);
     waitForMethodCompletion();
     ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
-    return clientWrapper && clientWrapper->sendRequestResult();
+    if (!clientWrapper)
+        return ThreadableWebSocketChannel::SendFail;
+    return clientWrapper->sendRequestResult();
 }
 
-bool WorkerThreadableWebSocketChannel::Bridge::send(const ArrayBuffer& binaryData)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::Bridge::send(const ArrayBuffer& binaryData)
 {
     if (!m_workerClientWrapper)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     ASSERT(m_peer);
     // ArrayBuffer isn't thread-safe, hence the content of ArrayBuffer is copied into Vector<char>.
     OwnPtr<Vector<char> > data = adoptPtr(new Vector<char>(binaryData.byteLength()));
@@ -459,20 +461,24 @@ bool WorkerThreadableWebSocketChannel::Bridge::send(const ArrayBuffer& binaryDat
     RefPtr<Bridge> protect(this);
     waitForMethodCompletion();
     ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
-    return clientWrapper && clientWrapper->sendRequestResult();
+    if (!clientWrapper)
+        return ThreadableWebSocketChannel::SendFail;
+    return clientWrapper->sendRequestResult();
 }
 
-bool WorkerThreadableWebSocketChannel::Bridge::send(const Blob& binaryData)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::Bridge::send(const Blob& binaryData)
 {
     if (!m_workerClientWrapper)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     ASSERT(m_peer);
     setMethodNotCompleted();
     m_loaderProxy.postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadSendBlob, AllowCrossThreadAccess(m_peer), binaryData.url(), binaryData.type(), binaryData.size()));
     RefPtr<Bridge> protect(this);
     waitForMethodCompletion();
     ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
-    return clientWrapper && clientWrapper->sendRequestResult();
+    if (!clientWrapper)
+        return ThreadableWebSocketChannel::SendFail;
+    return clientWrapper->sendRequestResult();
 }
 
 void WorkerThreadableWebSocketChannel::mainThreadBufferedAmount(ScriptExecutionContext* context, Peer* peer)
diff --git a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h
index 317fce93c..fa816da76 100644
--- a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h
@@ -65,9 +65,9 @@ public:
     virtual void connect(const KURL&, const String& protocol) OVERRIDE;
     virtual String subprotocol() OVERRIDE;
     virtual String extensions() OVERRIDE;
-    virtual bool send(const String& message) OVERRIDE;
-    virtual bool send(const ArrayBuffer&) OVERRIDE;
-    virtual bool send(const Blob&) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const String& message) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const Blob&) OVERRIDE;
     virtual unsigned long bufferedAmount() const OVERRIDE;
     virtual void close(int code, const String& reason) OVERRIDE;
     virtual void fail(const String& reason) OVERRIDE;
@@ -132,9 +132,9 @@ private:
         }
         ~Bridge();
         void connect(const KURL&, const String& protocol);
-        bool send(const String& message);
-        bool send(const ArrayBuffer&);
-        bool send(const Blob&);
+        ThreadableWebSocketChannel::SendResult send(const String& message);
+        ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&);
+        ThreadableWebSocketChannel::SendResult send(const Blob&);
         unsigned long bufferedAmount();
         void close(int code, const String& reason);
         void fail(const String& reason);
diff --git a/Source/WebCore/PlatformBlackBerry.cmake b/Source/WebCore/PlatformBlackBerry.cmake
index 32524d084..42f4ccd97 100644
--- a/Source/WebCore/PlatformBlackBerry.cmake
+++ b/Source/WebCore/PlatformBlackBerry.cmake
@@ -77,6 +77,7 @@ LIST(APPEND WebCore_SOURCES
     platform/image-decoders/png/PNGImageDecoder.cpp
     platform/image-decoders/webp/WEBPImageDecoder.cpp
     platform/image-encoders/JPEGImageEncoder.cpp
+    platform/image-encoders/skia/JPEGImageEncoder.cpp
     platform/posix/FileSystemPOSIX.cpp
     platform/posix/SharedBufferPOSIX.cpp
     platform/text/TextBreakIteratorICU.cpp
@@ -87,6 +88,7 @@ LIST(APPEND WebCore_SOURCES
 
 # Networking sources
 LIST(APPEND WebCore_SOURCES
+    platform/network/MIMESniffing.cpp
     platform/network/ProxyServer.cpp
     platform/network/blackberry/DeferredData.cpp
     platform/network/blackberry/NetworkJob.cpp
@@ -132,7 +134,6 @@ LIST(APPEND WebCore_SOURCES
     page/blackberry/AccessibilityObjectBlackBerry.cpp
     page/blackberry/DragControllerBlackBerry.cpp
     page/blackberry/EventHandlerBlackBerry.cpp
-    page/blackberry/FrameBlackBerry.cpp
     platform/blackberry/ClipboardBlackBerry.cpp
     platform/blackberry/ContextMenuBlackBerry.cpp
     platform/blackberry/ContextMenuItemBlackBerry.cpp
@@ -153,6 +154,7 @@ LIST(APPEND WebCore_SOURCES
     platform/blackberry/PlatformTouchPointBlackBerry.cpp
     platform/blackberry/PopupMenuBlackBerry.cpp
     platform/blackberry/RenderThemeBlackBerry.cpp
+    platform/blackberry/RunLoopBlackBerry.cpp
     platform/blackberry/SSLKeyGeneratorBlackBerry.cpp
     platform/blackberry/ScrollbarThemeBlackBerry.cpp
     platform/blackberry/SearchPopupMenuBlackBerry.cpp
@@ -169,8 +171,7 @@ LIST(APPEND WebCore_SOURCES
     platform/graphics/blackberry/IntPointBlackBerry.cpp
     platform/graphics/blackberry/IntRectBlackBerry.cpp
     platform/graphics/blackberry/IntSizeBlackBerry.cpp
-    platform/graphics/blackberry/MMrenderer.cpp
-    platform/graphics/blackberry/MediaPlayerPrivateMMrenderer.cpp
+    platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
     platform/text/blackberry/StringBlackBerry.cpp
 )
 
@@ -238,6 +239,7 @@ IF (WTF_USE_ACCELERATED_COMPOSITING)
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerAnimation.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerCompositingThread.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerRenderer.cpp
+        ${WEBCORE_DIR}/platform/graphics/blackberry/LayerRendererSurface.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerTile.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerTiler.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerWebKitThread.cpp
diff --git a/Source/WebCore/PlatformEfl.cmake b/Source/WebCore/PlatformEfl.cmake
index 5d98c8904..e461e0f59 100644
--- a/Source/WebCore/PlatformEfl.cmake
+++ b/Source/WebCore/PlatformEfl.cmake
@@ -47,6 +47,7 @@ LIST(APPEND WebCore_SOURCES
   platform/efl/PopupMenuEfl.cpp
   platform/efl/RefPtrEfl.cpp
   platform/efl/RenderThemeEfl.cpp
+  platform/efl/RunLoopEfl.cpp
   platform/efl/ScrollViewEfl.cpp
   platform/efl/ScrollbarEfl.cpp
   platform/efl/ScrollbarThemeEfl.cpp
@@ -188,6 +189,7 @@ IF (ENABLE_VIDEO)
   LIST(APPEND WebCore_SOURCES
     platform/graphics/gstreamer/GRefPtrGStreamer.cpp
     platform/graphics/gstreamer/GStreamerGWorld.cpp
+    platform/graphics/gstreamer/GStreamerVersioning.cpp
     platform/graphics/gstreamer/ImageGStreamerCairo.cpp
     platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
     platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp
@@ -203,8 +205,10 @@ LIST(APPEND WebCore_LIBRARIES
   ${EVAS_LIBRARIES}
   ${FREETYPE_LIBRARIES}
   ${ICU_LIBRARIES}
+  ${JPEG_LIBRARY}
   ${LIBXML2_LIBRARIES}
   ${LIBXSLT_LIBRARIES}
+  ${PNG_LIBRARY}
   ${SQLITE_LIBRARIES}
   ${Glib_LIBRARIES}
   ${LIBSOUP24_LIBRARIES}
diff --git a/Source/WebCore/PlatformWinCE.cmake b/Source/WebCore/PlatformWinCE.cmake
index 11bb4b1ec..63457119f 100644
--- a/Source/WebCore/PlatformWinCE.cmake
+++ b/Source/WebCore/PlatformWinCE.cmake
@@ -32,7 +32,6 @@ LIST(APPEND WebCore_SOURCES
     platform/Cursor.cpp
     platform/LocalizedStrings.cpp
     platform/PlatformStrategies.cpp
-    platform/RunLoop.cpp
     platform/ScrollAnimatorWin.cpp
 
     platform/graphics/ImageSource.cpp
diff --git a/Source/WebCore/Resources/linearSRGB.icc b/Source/WebCore/Resources/linearSRGB.icc
new file mode 100644
index 000000000..5cc437106
--- /dev/null
+++ b/Source/WebCore/Resources/linearSRGB.icc
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index 9f5ce3817..56c17f3fc 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -19,7 +19,7 @@ DEFINES += QT_MAKEDLL
 haveQt(5) {
     # Add a QtScript dependency for the time being, in order to pull in the include
     # path for QtScript when it's built as a standalone module
-    QT += script widgets
+    QT += script
 } else {
     INCLUDEPATH += $$PWD/../JavaScriptCore/wtf/qt/compat
 }
@@ -38,6 +38,14 @@ SOURCES += \
     Modules/geolocation/GeolocationController.cpp \
     Modules/geolocation/NavigatorGeolocation.cpp \
     \
+    Modules/webdatabase/AbstractDatabase.cpp \
+    Modules/webdatabase/DOMWindowSQLDatabase.cpp \
+    Modules/webdatabase/Database.cpp \
+    Modules/webdatabase/DatabaseAuthorizer.cpp \
+    Modules/webdatabase/DatabaseContext.cpp \
+    Modules/webdatabase/DatabaseSync.cpp \
+    Modules/webdatabase/WorkerContextSQLDatabase.cpp \
+    \
     accessibility/AccessibilityImageMapLink.cpp \
     accessibility/AccessibilityMediaControls.cpp \
     accessibility/AccessibilityMenuList.cpp \
@@ -173,7 +181,6 @@ v8 {
         bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp \
         bindings/v8/custom/V8DocumentCustom.cpp \
         bindings/v8/custom/V8DocumentLocationCustom.cpp \
-        bindings/v8/custom/V8ElementCustom.cpp \
         bindings/v8/custom/V8EventCustom.cpp \
         bindings/v8/custom/V8FileReaderCustom.cpp \
         bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
@@ -461,6 +468,7 @@ SOURCES += \
     css/ShadowValue.cpp \
     css/StyleMedia.cpp \
     css/StylePropertySet.cpp \
+    css/StyleRule.cpp \
     css/StyleSheet.cpp \
     css/StyleSheetList.cpp \
     css/WebKitCSSFilterValue.cpp \
@@ -488,6 +496,7 @@ SOURCES += \
     dom/Comment.cpp \
     dom/CompositionEvent.cpp \
     dom/ContainerNode.cpp \
+    dom/ContextDestructionObserver.cpp \
     dom/CustomEvent.cpp \
     dom/DecodedDataDocumentParser.cpp \
     dom/DeviceMotionController.cpp \
@@ -560,6 +569,7 @@ SOURCES += \
     dom/Range.cpp \
     dom/RangeException.cpp \
     dom/RawDataDocumentParser.h \
+    dom/RegionNodeList.cpp \
     dom/RegisteredEventListener.cpp \
     dom/ScopedEventQueue.cpp \
     dom/ScriptedAnimationController.cpp \
@@ -570,7 +580,7 @@ SOURCES += \
     dom/SecurityContext.cpp \
     dom/SelectorQuery.cpp \
     dom/ShadowRoot.cpp \
-    dom/ShadowRootList.cpp \
+    dom/ShadowTree.cpp \
     dom/SpaceSplitString.cpp \
     dom/StaticNodeList.cpp \
     dom/StyledElement.cpp \
@@ -650,6 +660,8 @@ SOURCES += \
     editing/VisibleSelection.cpp \
     editing/visible_units.cpp \
     editing/WrapContentsInDummySpanCommand.cpp \
+    fileapi/AsyncFileStream.cpp \
+    fileapi/AsyncFileStream.cpp \
     fileapi/Blob.cpp \
     fileapi/BlobURL.cpp \
     fileapi/DOMFilePath.cpp \
@@ -674,8 +686,6 @@ SOURCES += \
     fileapi/FileReader.cpp \
     fileapi/FileReaderLoader.cpp \
     fileapi/FileReaderSync.cpp \
-    fileapi/FileStreamProxy.cpp \
-    fileapi/FileSystemCallbacks.cpp \
     fileapi/FileThread.cpp \
     fileapi/FileWriter.cpp \
     fileapi/FileWriterBase.cpp \
@@ -684,6 +694,7 @@ SOURCES += \
     fileapi/OperationNotAllowedException.cpp \
     fileapi/ThreadableBlobRegistry.cpp \
     fileapi/WebKitBlobBuilder.cpp \
+    fileapi/WorkerContextFileSystem.cpp \
     history/BackForwardController.cpp \
     history/BackForwardListImpl.cpp \
     history/CachedFrame.cpp \
@@ -693,6 +704,7 @@ SOURCES += \
     history/PageCache.cpp \
     html/BaseButtonInputType.cpp \
     html/BaseCheckableInputType.cpp \
+    html/BaseClickableWithKeyInputType.cpp \
     html/BaseDateAndTimeInputType.cpp \
     html/BaseTextInputType.cpp \
     html/ButtonInputType.cpp \
@@ -798,6 +810,7 @@ SOURCES += \
     html/ImageDocument.cpp \
     html/ImageInputType.cpp \
     html/InputType.cpp \
+    html/LabelableElement.cpp \
     html/LabelsNodeList.cpp \
     html/LinkRelAttribute.cpp \
     html/MediaDocument.cpp \
@@ -1005,12 +1018,10 @@ SOURCES += \
     page/Navigator.cpp \
     page/NavigatorBase.cpp \
     page/NavigatorRegisterProtocolHandler.cpp \
-    page/NavigatorSupplement.cpp \
     page/OriginAccessEntry.cpp \
     page/Page.cpp \
     page/PageGroup.cpp \
     page/PageGroupLoadDeferrer.cpp \
-    page/PageSupplement.cpp \
     page/PageVisibilityState.cpp \
     page/Performance.cpp \
     page/PerformanceNavigation.cpp \
@@ -1072,6 +1083,8 @@ SOURCES += \
     platform/graphics/FontData.cpp \
     platform/graphics/Font.cpp \
     platform/graphics/FontCache.cpp \
+    platform/graphics/FractionalLayoutRect.cpp \
+    platform/graphics/FractionalLayoutSize.cpp \
     platform/graphics/GeneratorGeneratedImage.cpp \
     platform/graphics/Gradient.cpp \
     platform/graphics/GraphicsContext.cpp \
@@ -1212,7 +1225,6 @@ SOURCES += \
     rendering/RenderCombineText.cpp \
     rendering/RenderCounter.cpp \
     rendering/RenderDeprecatedFlexibleBox.cpp \
-    rendering/RenderDetails.cpp \
     rendering/RenderDetailsMarker.cpp \
     rendering/RenderEmbeddedObject.cpp \
     rendering/RenderFieldset.cpp \
@@ -1254,7 +1266,6 @@ SOURCES += \
     rendering/RenderScrollbarPart.cpp \
     rendering/RenderScrollbarTheme.cpp \
     rendering/RenderSlider.cpp \
-    rendering/RenderSummary.cpp \
     rendering/RenderTable.cpp \
     rendering/RenderTableCaption.cpp \
     rendering/RenderTableCell.cpp \
@@ -1290,6 +1301,7 @@ SOURCES += \
     rendering/style/StyleFlexibleBoxData.cpp \
     rendering/style/StyleGeneratedImage.cpp \
     rendering/style/StyleGridData.cpp \
+    rendering/style/StyleGridItemData.cpp \
     rendering/style/StyleInheritedData.cpp \
     rendering/style/StyleMarqueeData.cpp \
     rendering/style/StyleMultiColData.cpp \
@@ -1298,11 +1310,6 @@ SOURCES += \
     rendering/style/StyleSurroundData.cpp \
     rendering/style/StyleTransformData.cpp \
     rendering/style/StyleVisualData.cpp \
-    storage/AbstractDatabase.cpp \
-    storage/DOMWindowSQLDatabase.cpp \
-    storage/Database.cpp \
-    storage/DatabaseAuthorizer.cpp \
-    storage/DatabaseSync.cpp \
     storage/StorageTask.cpp \
     storage/StorageThread.cpp \
     storage/Storage.cpp \
@@ -1528,6 +1535,30 @@ HEADERS += \
     Modules/geolocation/PositionErrorCallback.h \
     Modules/geolocation/PositionOptions.h \
     \
+    Modules/webdatabase/AbstractDatabase.h \
+    Modules/webdatabase/ChangeVersionWrapper.h \
+    Modules/webdatabase/DOMWindowSQLDatabase.h \
+    Modules/webdatabase/DatabaseAuthorizer.h \
+    Modules/webdatabase/Database.h \
+    Modules/webdatabase/DatabaseCallback.h \
+    Modules/webdatabase/DatabaseSync.h \
+    Modules/webdatabase/DatabaseTask.h \
+    Modules/webdatabase/DatabaseThread.h \
+    Modules/webdatabase/DatabaseTracker.h \
+    Modules/webdatabase/OriginQuotaManager.h \
+    Modules/webdatabase/OriginUsageRecord.h \
+    Modules/webdatabase/SQLCallbackWrapper.h \
+    Modules/webdatabase/SQLResultSet.h \
+    Modules/webdatabase/SQLResultSetRowList.h \
+    Modules/webdatabase/SQLStatement.h \
+    Modules/webdatabase/SQLStatementSync.h \
+    Modules/webdatabase/SQLTransaction.h \
+    Modules/webdatabase/SQLTransactionClient.h \
+    Modules/webdatabase/SQLTransactionCoordinator.h \
+    Modules/webdatabase/SQLTransactionSync.h \
+    Modules/webdatabase/SQLTransactionSyncCallback.h \
+    Modules/webdatabase/WorkerContextSQLDatabase.h \
+    \
     css/CSSAspectRatioValue.h \
     css/CSSBorderImageSliceValue.h \
     css/CSSBorderImage.h \
@@ -1592,6 +1623,7 @@ HEADERS += \
     css/ShadowValue.h \
     css/StyleMedia.h \
     css/StylePropertySet.h \
+    css/StyleRule.h \
     css/StyleSheet.h \
     css/StyleSheetList.h \
     css/WebKitCSSFilterValue.h \
@@ -1690,7 +1722,7 @@ HEADERS += \
     dom/ScriptExecutionContext.h \
     dom/SelectorQuery.h \
     dom/ShadowRoot.h \
-    dom/ShadowRootList.h \
+    dom/ShadowTree.h \
     dom/SpaceSplitString.h \
     dom/StaticNodeList.h \
     dom/StyledElement.h \
@@ -1780,7 +1812,6 @@ HEADERS += \
     fileapi/FileReaderLoader.h \
     fileapi/FileReaderLoaderClient.h \
     fileapi/FileReaderSync.h \
-    fileapi/FileStreamProxy.h \
     fileapi/FileThread.h \
     fileapi/FileThreadTask.h \
     fileapi/OperationNotAllowedException.h \
@@ -1895,6 +1926,7 @@ HEADERS += \
     html/HTMLViewSourceDocument.h \
     html/ImageData.h \
     html/ImageDocument.h \
+    html/LabelableElement.h \
     html/LabelsNodeList.h \
     html/LinkRelAttribute.h \
     html/MediaController.h \
@@ -2046,7 +2078,7 @@ HEADERS += \
     mathml/MathMLTextElement.h \
     notifications/Notification.h \
     notifications/NotificationCenter.h \
-    notifications/NotificationPresenter.h \
+    notifications/NotificationClient.h \
     notifications/NotificationContents.h \
     notifications/NotificationController.h \
     page/animation/AnimationBase.h \
@@ -2084,7 +2116,6 @@ HEADERS += \
     page/PageGroup.h \
     page/PageGroupLoadDeferrer.h \
     page/Page.h \
-    page/PageSupplement.h \
     page/PageVisibilityState.h \
     page/PrintContext.h \
     page/Screen.h \
@@ -2105,7 +2136,6 @@ HEADERS += \
     platform/animation/AnimationList.h \
     platform/animation/AnimationUtilities.h \
     platform/Arena.h \
-    platform/AsyncFileStream.h \
     platform/CalculationValue.h \
     platform/Clock.h \
     platform/ClockGeneric.h \
@@ -2194,7 +2224,6 @@ HEADERS += \
     platform/graphics/Region.h \
     platform/graphics/RoundedRect.h \
     platform/graphics/qt/FontCustomPlatformData.h \
-    platform/graphics/qt/ImageDecoderQt.h \
     platform/graphics/qt/StillImageQt.h \
     platform/graphics/qt/TransparencyLayer.h \
     platform/graphics/SegmentedFontData.h \
@@ -2277,6 +2306,7 @@ HEADERS += \
     platform/ScrollableArea.h \
     platform/ScrollAnimator.h \
     platform/Scrollbar.h \
+    platform/ScrollbarThemeClient.h \
     platform/ScrollbarThemeComposite.h \
     platform/ScrollView.h \
     platform/SearchPopupMenu.h \
@@ -2363,7 +2393,6 @@ HEADERS += \
     rendering/RenderCombineText.h \
     rendering/RenderCounter.h \
     rendering/RenderDeprecatedFlexibleBox.h \
-    rendering/RenderDetails.h \
     rendering/RenderDetailsMarker.h \
     rendering/RenderEmbeddedObject.h \
     rendering/RenderFieldset.h \
@@ -2405,7 +2434,6 @@ HEADERS += \
     rendering/RenderScrollbarPart.h \
     rendering/RenderScrollbarTheme.h \
     rendering/RenderSlider.h \
-    rendering/RenderSummary.h \
     rendering/RenderTableCaption.h \
     rendering/RenderTableCell.h \
     rendering/RenderTableCol.h \
@@ -2481,7 +2509,6 @@ HEADERS += \
     rendering/svg/RenderSVGResourceRadialGradient.h \
     rendering/svg/RenderSVGResourceSolidColor.h \
     rendering/svg/RenderSVGRoot.h \
-    rendering/svg/RenderSVGShadowTreeRootContainer.h \
     rendering/svg/RenderSVGShape.h \
     rendering/svg/RenderSVGTSpan.h \
     rendering/svg/RenderSVGText.h \
@@ -2496,11 +2523,11 @@ HEADERS += \
     rendering/svg/SVGPathData.h \
     rendering/svg/SVGRenderSupport.h \
     rendering/svg/SVGRenderTreeAsText.h \
+    rendering/svg/SVGRenderingContext.h \
     rendering/svg/SVGResources.h \
     rendering/svg/SVGResourcesCache.h \
     rendering/svg/SVGResourcesCycleSolver.h \
     rendering/svg/SVGRootInlineBox.h \
-    rendering/svg/SVGShadowTreeElements.h \
     rendering/svg/SVGTextChunk.h \
     rendering/svg/SVGTextChunkBuilder.h \
     rendering/svg/SVGTextFragment.h \
@@ -2513,40 +2540,18 @@ HEADERS += \
     rendering/svg/SVGTextMetricsBuilder.h \
     rendering/svg/SVGTextQuery.h \
     rendering/svg/SVGTextRunRenderingContext.h \
-    storage/AbstractDatabase.h \
-    storage/ChangeVersionWrapper.h \
-    storage/DOMWindowSQLDatabase.h \
-    storage/DatabaseAuthorizer.h \
-    storage/Database.h \
-    storage/DatabaseCallback.h \
-    storage/DatabaseSync.h \
-    storage/DatabaseTask.h \
-    storage/DatabaseThread.h \
-    storage/DatabaseTracker.h \
-    storage/StorageTask.h \
-    storage/StorageThread.h \
-    storage/OriginQuotaManager.h \
-    storage/OriginUsageRecord.h \
-    storage/SQLCallbackWrapper.h \
-    storage/SQLResultSet.h \
-    storage/SQLResultSetRowList.h \
-    storage/SQLStatement.h \
-    storage/SQLStatementSync.h \
-    storage/SQLTransaction.h \
-    storage/SQLTransactionClient.h \
-    storage/SQLTransactionCoordinator.h \
-    storage/SQLTransactionSync.h \
-    storage/SQLTransactionSyncCallback.h \
+    storage/Storage.h \
     storage/StorageArea.h \
     storage/StorageAreaImpl.h \
     storage/StorageAreaSync.h \
     storage/StorageEvent.h \
     storage/StorageEventDispatcher.h \
-    storage/Storage.h \
     storage/StorageMap.h \
     storage/StorageNamespace.h \
     storage/StorageNamespaceImpl.h \
     storage/StorageSyncManager.h \
+    storage/StorageTask.h \
+    storage/StorageThread.h \
     storage/StorageTracker.h \
     storage/StorageTrackerClient.h \
     svg/animation/SMILTimeContainer.h \
@@ -2805,7 +2810,6 @@ SOURCES += \
     platform/graphics/qt/GraphicsContextQt.cpp \
     platform/graphics/qt/IconQt.cpp \
     platform/graphics/qt/ImageBufferQt.cpp \
-    platform/graphics/qt/ImageDecoderQt.cpp \
     platform/graphics/qt/ImageQt.cpp \
     platform/graphics/qt/IntPointQt.cpp \
     platform/graphics/qt/IntRectQt.cpp \
@@ -2867,13 +2871,6 @@ SOURCES += \
     SOURCES += xml/parser/XMLDocumentParserQt.cpp
 }
 
-contains(DEFINES, HAVE_QSTYLE=1) {
-    HEADERS += platform/qt/QtStyleOptionWebComboBox.h \
-               platform/qt/RenderThemeQStyle.h \
-               platform/qt/ScrollbarThemeQt.h
-    SOURCES += platform/qt/RenderThemeQStyle.cpp
-}
-
 contains(DEFINES, ENABLE_SMOOTH_SCROLLING=1) {
     win32-*|wince* {
         HEADERS += platform/ScrollAnimatorWin.h
@@ -2957,21 +2954,21 @@ plugin_backend_xlib {
 
 contains(DEFINES, ENABLE_SQL_DATABASE=1) {
     SOURCES += \
-        storage/ChangeVersionWrapper.cpp \
-        storage/DatabaseTask.cpp \
-        storage/DatabaseThread.cpp \
-        storage/DatabaseTracker.cpp \
-        storage/OriginQuotaManager.cpp \
-        storage/OriginUsageRecord.cpp \
-        storage/SQLException.cpp \
-        storage/SQLResultSet.cpp \
-        storage/SQLResultSetRowList.cpp \
-        storage/SQLStatement.cpp \
-        storage/SQLStatementSync.cpp \
-        storage/SQLTransaction.cpp \
-        storage/SQLTransactionClient.cpp \
-        storage/SQLTransactionCoordinator.cpp \
-        storage/SQLTransactionSync.cpp
+        Modules/webdatabase/ChangeVersionWrapper.cpp \
+        Modules/webdatabase/DatabaseTask.cpp \
+        Modules/webdatabase/DatabaseThread.cpp \
+        Modules/webdatabase/DatabaseTracker.cpp \
+        Modules/webdatabase/OriginQuotaManager.cpp \
+        Modules/webdatabase/OriginUsageRecord.cpp \
+        Modules/webdatabase/SQLException.cpp \
+        Modules/webdatabase/SQLResultSet.cpp \
+        Modules/webdatabase/SQLResultSetRowList.cpp \
+        Modules/webdatabase/SQLStatement.cpp \
+        Modules/webdatabase/SQLStatementSync.cpp \
+        Modules/webdatabase/SQLTransaction.cpp \
+        Modules/webdatabase/SQLTransactionClient.cpp \
+        Modules/webdatabase/SQLTransactionCoordinator.cpp \
+        Modules/webdatabase/SQLTransactionSync.cpp \
 
     !v8 {
         SOURCES += \
@@ -2989,31 +2986,31 @@ contains(DEFINES, ENABLE_INDEXED_DATABASE=1) {
     }
 
     HEADERS += \
-        storage/IDBAny.h \
-        storage/IDBCallbacks.h \
-        storage/IDBCursor.h \
-        storage/IDBCursorBackendImpl.h \
-        storage/IDBCursorBackendInterface.h \
-        storage/IDBDatabase.h \
-        storage/IDBDatabaseBackendImpl.h \
-        storage/IDBDatabaseBackendInterface.h \
-        storage/IDBDatabaseError.h \
-        storage/IDBDatabaseException.h \
-        storage/IDBEventDispatcher.h \
-        storage/IDBFactory.h \
-        storage/IDBFactoryBackendInterface.h \
-        storage/IDBFactoryBackendImpl.h \
-        storage/IDBIndex.h \
-        storage/IDBIndexBackendInterface.h \
-        storage/IDBIndexBackendImpl.h \
-        storage/IDBKey.h \
-        storage/IDBKeyRange.h \
-        storage/IDBObjectStore.h \
-        storage/IDBObjectStoreBackendImpl.h \
-        storage/IDBObjectStoreBackendInterface.h \
-        storage/IDBRequest.h \
-        storage/IDBTransaction.h \
-        storage/IDBTransactionBackendInterface.h
+        Modules/indexeddb/IDBAny.h \
+        Modules/indexeddb/IDBCallbacks.h \
+        Modules/indexeddb/IDBCursor.h \
+        Modules/indexeddb/IDBCursorBackendImpl.h \
+        Modules/indexeddb/IDBCursorBackendInterface.h \
+        Modules/indexeddb/IDBDatabase.h \
+        Modules/indexeddb/IDBDatabaseBackendImpl.h \
+        Modules/indexeddb/IDBDatabaseBackendInterface.h \
+        Modules/indexeddb/IDBDatabaseError.h \
+        Modules/indexeddb/IDBDatabaseException.h \
+        Modules/indexeddb/IDBEventDispatcher.h \
+        Modules/indexeddb/IDBFactory.h \
+        Modules/indexeddb/IDBFactoryBackendInterface.h \
+        Modules/indexeddb/IDBFactoryBackendImpl.h \
+        Modules/indexeddb/IDBIndex.h \
+        Modules/indexeddb/IDBIndexBackendInterface.h \
+        Modules/indexeddb/IDBIndexBackendImpl.h \
+        Modules/indexeddb/IDBKey.h \
+        Modules/indexeddb/IDBKeyRange.h \
+        Modules/indexeddb/IDBObjectStore.h \
+        Modules/indexeddb/IDBObjectStoreBackendImpl.h \
+        Modules/indexeddb/IDBObjectStoreBackendInterface.h \
+        Modules/indexeddb/IDBRequest.h \
+        Modules/indexeddb/IDBTransaction.h \
+        Modules/indexeddb/IDBTransactionBackendInterface.h
 
     !v8 {
         SOURCES += \
@@ -3023,24 +3020,27 @@ contains(DEFINES, ENABLE_INDEXED_DATABASE=1) {
     }
 
     SOURCES += \
-        storage/IDBAny.cpp \
-        storage/IDBCursor.cpp \
-        storage/IDBCursorBackendImpl.cpp \
-        storage/IDBDatabase.cpp \
-        storage/IDBDatabaseBackendImpl.cpp \
-        storage/IDBDatabaseException.cpp \
-        storage/IDBEventDispatcher.cpp \
-        storage/IDBFactory.cpp \
-        storage/IDBFactoryBackendInterface.cpp \
-        storage/IDBFactoryBackendImpl.cpp \
-        storage/IDBIndex.cpp \
-        storage/IDBIndexBackendImpl.cpp \
-        storage/IDBKey.cpp \
-        storage/IDBKeyRange.cpp \
-        storage/IDBObjectStore.cpp \
-        storage/IDBObjectStoreBackendImpl.cpp \
-        storage/IDBRequest.cpp \
-        storage/IDBTransaction.cpp
+        Modules/indexeddb/DOMWindowIndexedDatabase.cpp \
+        Modules/indexeddb/IDBAny.cpp \
+        Modules/indexeddb/IDBCursor.cpp \
+        Modules/indexeddb/IDBCursorBackendImpl.cpp \
+        Modules/indexeddb/IDBDatabase.cpp \
+        Modules/indexeddb/IDBDatabaseBackendImpl.cpp \
+        Modules/indexeddb/IDBDatabaseException.cpp \
+        Modules/indexeddb/IDBEventDispatcher.cpp \
+        Modules/indexeddb/IDBFactory.cpp \
+        Modules/indexeddb/IDBFactoryBackendInterface.cpp \
+        Modules/indexeddb/IDBFactoryBackendImpl.cpp \
+        Modules/indexeddb/IDBIndex.cpp \
+        Modules/indexeddb/IDBIndexBackendImpl.cpp \
+        Modules/indexeddb/IDBKey.cpp \
+        Modules/indexeddb/IDBKeyRange.cpp \
+        Modules/indexeddb/IDBObjectStore.cpp \
+        Modules/indexeddb/IDBObjectStoreBackendImpl.cpp \
+        Modules/indexeddb/IDBRequest.cpp \
+        Modules/indexeddb/IDBTransaction.cpp \
+        Modules/indexeddb/PageGroupIndexedDatabase.cpp \
+        Modules/indexeddb/WorkerContextIndexedDatabase.cpp
 }
 
 contains(DEFINES, ENABLE_DATA_TRANSFER_ITEMS=1) {
@@ -3158,6 +3158,10 @@ contains(DEFINES, ENABLE_INPUT_SPEECH=1) {
         rendering/RenderInputSpeech.cpp
 }
 
+contains(DEFINES, ENABLE_SCRIPTED_SPEECH=1) {
+    SOURCES += # FIXME!
+}
+
 contains(DEFINES, ENABLE_QUOTA=1) {
     HEADERS += \
         storage/StorageInfo.h \
@@ -3232,6 +3236,7 @@ contains(DEFINES, ENABLE_VIDEO=1) {
         HEADERS += \
             platform/graphics/gstreamer/GRefPtrGStreamer.h \
             platform/graphics/gstreamer/GStreamerGWorld.h \
+            platform/graphics/gstreamer/GStreamerVersioning.h \
             platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h \
             platform/graphics/gstreamer/VideoSinkGStreamer.h \
             platform/graphics/gstreamer/WebKitWebSourceGStreamer.h \
@@ -3241,6 +3246,7 @@ contains(DEFINES, ENABLE_VIDEO=1) {
         SOURCES += \
             platform/graphics/gstreamer/GRefPtrGStreamer.cpp \
             platform/graphics/gstreamer/GStreamerGWorld.cpp \
+            platform/graphics/gstreamer/GStreamerVersioning.cpp \
             platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp \
             platform/graphics/gstreamer/VideoSinkGStreamer.cpp \
             platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp \
@@ -3449,7 +3455,6 @@ contains(DEFINES, ENABLE_SVG=1) {
               rendering/svg/RenderSVGResourceRadialGradient.cpp \
               rendering/svg/RenderSVGResourceSolidColor.cpp \
               rendering/svg/RenderSVGRoot.cpp \
-              rendering/svg/RenderSVGShadowTreeRootContainer.cpp \
               rendering/svg/RenderSVGTSpan.cpp \
               rendering/svg/RenderSVGText.cpp \
               rendering/svg/RenderSVGTextPath.cpp \
@@ -3462,11 +3467,11 @@ contains(DEFINES, ENABLE_SVG=1) {
               rendering/svg/SVGPathData.cpp \
               rendering/svg/SVGRenderSupport.cpp \
               rendering/svg/SVGRenderTreeAsText.cpp \
+              rendering/svg/SVGRenderingContext.cpp \
               rendering/svg/SVGResources.cpp \
               rendering/svg/SVGResourcesCache.cpp \
               rendering/svg/SVGResourcesCycleSolver.cpp \
               rendering/svg/SVGRootInlineBox.cpp \
-              rendering/svg/SVGShadowTreeElements.cpp \
               rendering/svg/SVGTextChunk.cpp \
               rendering/svg/SVGTextChunkBuilder.cpp \
               rendering/svg/SVGTextLayoutAttributes.cpp \
@@ -3672,29 +3677,35 @@ contains(DEFINES, ENABLE_VIDEO_TRACK=1) {
 
 contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
     HEADERS += \
-        websockets/CloseEvent.h \
-        websockets/ThreadableWebSocketChannel.h \
-        websockets/ThreadableWebSocketChannelClientWrapper.h \
-        websockets/WebSocket.h \
-        websockets/WebSocketChannel.h \
-        websockets/WebSocketChannelClient.h \
-        websockets/WebSocketExtensionDispatcher.h \
-        websockets/WebSocketExtensionProcessor.h \
-        websockets/WebSocketFrame.h \
-        websockets/WebSocketHandshake.h \
-        websockets/WebSocketHandshakeRequest.h \
-        websockets/WebSocketHandshakeResponse.h \
+        Modules/websockets/CloseEvent.h \
+        Modules/websockets/ThreadableWebSocketChannel.h \
+        Modules/websockets/ThreadableWebSocketChannelClientWrapper.h \
+        Modules/websockets/WebSocket.h \
+        Modules/websockets/WebSocketChannel.h \
+        Modules/websockets/WebSocketChannelClient.h \
+        Modules/websockets/WebSocketDeflateFramer.h \
+        Modules/websockets/WebSocketDeflater.h \
+        Modules/websockets/WebSocketExtensionDispatcher.h \
+        Modules/websockets/WebSocketExtensionProcessor.h \
+        Modules/websockets/WebSocketFrame.h \
+        Modules/websockets/WebSocketHandshake.h \
+        Modules/websockets/WebSocketHandshakeRequest.h \
+        Modules/websockets/WebSocketHandshakeResponse.h \
+        Modules/websockets/WorkerThreadableWebSocketChannel.h \
         platform/network/qt/SocketStreamHandlePrivate.h
 
     SOURCES += \
-        websockets/WebSocket.cpp \
-        websockets/WebSocketChannel.cpp \
-        websockets/WebSocketExtensionDispatcher.cpp \
-        websockets/WebSocketHandshake.cpp \
-        websockets/WebSocketHandshakeRequest.cpp \
-        websockets/WebSocketHandshakeResponse.cpp \
-        websockets/ThreadableWebSocketChannel.cpp \
-        websockets/ThreadableWebSocketChannelClientWrapper.cpp \
+        Modules/websockets/WebSocket.cpp \
+        Modules/websockets/WebSocketChannel.cpp \
+        Modules/websockets/WebSocketDeflateFramer.cpp \
+        Modules/websockets/WebSocketDeflater.cpp \
+        Modules/websockets/WebSocketExtensionDispatcher.cpp \
+        Modules/websockets/WebSocketHandshake.cpp \
+        Modules/websockets/WebSocketHandshakeRequest.cpp \
+        Modules/websockets/WebSocketHandshakeResponse.cpp \
+        Modules/websockets/WorkerThreadableWebSocketChannel.cpp \
+        Modules/websockets/ThreadableWebSocketChannel.cpp \
+        Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp \
         platform/network/SocketStreamErrorBase.cpp \
         platform/network/SocketStreamHandleBase.cpp \
         platform/network/qt/SocketStreamHandleQt.cpp
@@ -3706,10 +3717,10 @@ contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
 
     contains(DEFINES, ENABLE_WORKERS=1) {
         HEADERS += \
-            websockets/WorkerThreadableWebSocketChannel.h
+            Modules/websockets/WorkerThreadableWebSocketChannel.h
 
         SOURCES += \
-            websockets/WorkerThreadableWebSocketChannel.cpp
+            Modules/websockets/WorkerThreadableWebSocketChannel.cpp
     }
 }
 
@@ -3735,6 +3746,7 @@ contains(DEFINES, ENABLE_WEBGL=1) {
         html/canvas/WebGLRenderingContext.h \
         html/canvas/WebGLShader.h \
         html/canvas/WebGLSharedObject.h \
+        html/canvas/EXTTextureFilterAnisotropic.h \
         html/canvas/OESStandardDerivatives.h \
         html/canvas/OESTextureFloat.h \
         html/canvas/OESVertexArrayObject.h \
@@ -3775,6 +3787,7 @@ contains(DEFINES, ENABLE_WEBGL=1) {
         html/canvas/WebGLRenderingContext.cpp \
         html/canvas/WebGLShader.cpp \
         html/canvas/WebGLSharedObject.cpp \
+        html/canvas/EXTTextureFilterAnisotropic.cpp \
         html/canvas/OESStandardDerivatives.cpp \
         html/canvas/OESTextureFloat.cpp \
         html/canvas/OESVertexArrayObject.cpp \
@@ -3941,6 +3954,35 @@ contains(DEFINES, ENABLE_MHTML=1) {
         page/PageSerializer.cpp
 }
 
+contains(DEFINES, WTF_USE_QT_IMAGE_DECODER=1) {
+    HEADERS += platform/graphics/qt/ImageDecoderQt.h
+    SOURCES += platform/graphics/qt/ImageDecoderQt.cpp
+} else {
+    HEADERS += \
+        platform/image-decoders/bmp/BMPImageDecoder.h \
+        platform/image-decoders/bmp/BMPImageReader.h \
+        platform/image-decoders/gif/GIFImageDecoder.h \
+        platform/image-decoders/gif/GIFImageReader.h\
+        platform/image-decoders/ico/ICOImageDecoder.h \
+        platform/image-decoders/jpeg/JPEGImageDecoder.h \
+        platform/image-decoders/png/PNGImageDecoder.h
+
+    SOURCES += \
+        platform/image-decoders/ImageDecoder.cpp \
+        platform/image-decoders/bmp/BMPImageDecoder.cpp \
+        platform/image-decoders/bmp/BMPImageReader.cpp \
+        platform/image-decoders/gif/GIFImageDecoder.cpp \
+        platform/image-decoders/gif/GIFImageReader.cpp\
+        platform/image-decoders/ico/ICOImageDecoder.cpp \
+        platform/image-decoders/jpeg/JPEGImageDecoder.cpp \
+        platform/image-decoders/png/PNGImageDecoder.cpp
+
+    contains(DEFINES, WTF_USE_WEBP=1) {
+        HEADERS += platform/image-decoders/webp/WEBPImageDecoder.h
+        SOURCES += platform/image-decoders/webp/WEBPImageDecoder.cpp
+    }
+}
+
 !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
     # Build sqlite3 into WebCore from source
     # somewhat copied from $$QT_SOURCE_TREE/src/plugins/sqldrivers/sqlite/sqlite.pro
diff --git a/Source/WebCore/UseJSC.cmake b/Source/WebCore/UseJSC.cmake
index e8a35d1ff..09038dd68 100644
--- a/Source/WebCore/UseJSC.cmake
+++ b/Source/WebCore/UseJSC.cmake
@@ -3,6 +3,10 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/bridge/jsc"
 )
 
+LIST(APPEND WebCoreTestSupport_INCLUDE_DIRECTORIES
+    "${WEBCORE_DIR}/testing/js"
+)
+
 LIST(APPEND WebCore_IDL_INCLUDES
     bindings/js
 )
@@ -164,6 +168,11 @@ LIST(APPEND WebCore_SOURCES
     bridge/jsc/BridgeJSC.cpp
 )
 
+LIST(APPEND WebCoreTestSupport_SOURCES
+    testing/js/JSInternalsCustom.cpp
+    testing/js/WebCoreTestSupport.cpp
+)
+
 IF (ENABLE_BLOB)
     LIST(APPEND WebCore_SOURCES
         bindings/js/JSFileReaderCustom.cpp
@@ -254,6 +263,10 @@ FOREACH (_include ${WebCore_IDL_INCLUDES})
     LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
 ENDFOREACH ()
 
+FOREACH (_include ${WebCoreTestSupport_IDL_INCLUDES})
+    LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
+ENDFOREACH ()
+
 SET(FEATURE_DEFINES_JAVASCRIPT "LANGUAGE_JAVASCRIPT=1")
 FOREACH (_feature ${FEATURE_DEFINES})
     SET(FEATURE_DEFINES_JAVASCRIPT "${FEATURE_DEFINES_JAVASCRIPT} ${_feature}")
@@ -263,12 +276,17 @@ ENDFOREACH ()
 FOREACH (_idl ${WebCore_IDL_FILES})
     SET(IDL_FILES_LIST "${IDL_FILES_LIST}${WEBCORE_DIR}/${_idl}\n")
 ENDFOREACH ()
+
+FOREACH (_idl ${WebCoreTestSupport_IDL_FILES})
+    SET(IDL_FILES_LIST "${IDL_FILES_LIST}${WEBCORE_DIR}/${_idl}\n")
+ENDFOREACH ()
+
 FILE(WRITE ${IDL_FILES_TMP} ${IDL_FILES_LIST})
 
 ADD_CUSTOM_COMMAND(
     OUTPUT ${SUPPLEMENTAL_DEPENDENCY_FILE}
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/preprocess-idls.pl ${SCRIPTS_PREPROCESS_IDLS} ${WebCore_IDL_FILES} ${WebCoreTestSupport_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/preprocess-idls.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
     VERBATIM)
 
 FOREACH (_file ${WebCore_IDL_FILES})
@@ -281,3 +299,14 @@ FOREACH (_file ${WebCore_IDL_FILES})
         VERBATIM)
     LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp)
 ENDFOREACH ()
+
+FOREACH (_file ${WebCoreTestSupport_IDL_FILES})
+    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
+    ADD_CUSTOM_COMMAND(
+        OUTPUT  ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.h
+        MAIN_DEPENDENCY ${_file}
+        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorJS.pm ${SUPPLEMENTAL_DEPENDENCY_FILE}
+        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator JS ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_WEBCORE_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} ${WEBCORE_DIR}/${_file}
+        VERBATIM)
+    LIST(APPEND WebCoreTestSupport_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp)
+ENDFOREACH ()
diff --git a/Source/WebCore/UseV8.cmake b/Source/WebCore/UseV8.cmake
index befe1c76f..b8f5fd267 100755
--- a/Source/WebCore/UseV8.cmake
+++ b/Source/WebCore/UseV8.cmake
@@ -8,6 +8,10 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/runtime"
 )
 
+LIST(APPEND WebCoreTestSupport_INCLUDE_DIRECTORIES
+    "${WEBCORE_DIR}/testing/v8"
+)
+
 LIST(APPEND WebCore_IDL_INCLUDES
     bindings/v8
 )
@@ -91,7 +95,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp
     bindings/v8/custom/V8DocumentCustom.cpp
     bindings/v8/custom/V8DocumentLocationCustom.cpp
-    bindings/v8/custom/V8ElementCustom.cpp
     bindings/v8/custom/V8EntrySyncCustom.cpp
     bindings/v8/custom/V8EventConstructors.cpp
     bindings/v8/custom/V8EventCustom.cpp
@@ -160,6 +163,11 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/specialization/V8BindingState.cpp
 )
 
+LIST(APPEND WebCoreTestSupport_SOURCES
+    testing/v8/V8InternalsCustom.cpp
+    testing/v8/WebCoreTestSupport.cpp
+)
+
 LIST(APPEND WebCore_SOURCES
     ${JAVASCRIPTCORE_DIR}/yarr/YarrInterpreter.cpp
     ${JAVASCRIPTCORE_DIR}/yarr/YarrJIT.cpp
@@ -214,6 +222,10 @@ FOREACH (_include ${WebCore_IDL_INCLUDES})
     LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
 ENDFOREACH ()
 
+FOREACH (_include ${WebCoreTestSupport_IDL_INCLUDES})
+    LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
+ENDFOREACH ()
+
 SET(FEATURE_DEFINES_JAVASCRIPT "LANGUAGE_JAVASCRIPT=1 V8_BINDING=1")
 FOREACH (_feature ${FEATURE_DEFINES})
     SET(FEATURE_DEFINES_JAVASCRIPT "${FEATURE_DEFINES_JAVASCRIPT} ${_feature}")
@@ -249,12 +261,17 @@ LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/V8ArrayBufferViewCust
 FOREACH (_idl ${WebCore_IDL_FILES})
     SET(IDL_FILES_LIST "${IDL_FILES_LIST}${WEBCORE_DIR}/${_idl}\n")
 ENDFOREACH ()
+
+FOREACH (_idl ${WebCoreTestSupport_IDL_FILES})
+    SET(IDL_FILES_LIST "${IDL_FILES_LIST}${WEBCORE_DIR}/${_idl}\n")
+ENDFOREACH ()
+
 FILE(WRITE ${IDL_FILES_TMP} ${IDL_FILES_LIST})
 
 ADD_CUSTOM_COMMAND(
     OUTPUT ${SUPPLEMENTAL_DEPENDENCY_FILE}
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/preprocess-idls.pl ${SCRIPTS_PREPROCESS_IDLS} ${WebCore_IDL_FILES} ${WebCoreTestSupport_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/preprocess-idls.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
     VERBATIM)
 
 FOREACH (_file ${WebCore_IDL_FILES})
@@ -267,3 +284,14 @@ FOREACH (_file ${WebCore_IDL_FILES})
         VERBATIM)
     LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.cpp)
 ENDFOREACH ()
+
+FOREACH (_file ${WebCoreTestSupport_IDL_FILES})
+    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
+    ADD_CUSTOM_COMMAND(
+        OUTPUT  ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.h
+        MAIN_DEPENDENCY ${_file}
+        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorV8.pm ${SUPPLEMENTAL_DEPENDENCY_FILE}
+        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator V8 ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_WEBCORE_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} ${WEBCORE_DIR}/${_file}
+        VERBATIM)
+    LIST(APPEND WebCoreTestSupport_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.cpp)
+ENDFOREACH ()
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index e812ffff6..590b7c50f 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -104,11 +104,14 @@
 .objc_class_name_DOMTreeWalker
 .objc_class_name_DOMUIEvent
 .objc_class_name_DOMWheelEvent
+.objc_class_name_WebCoreFullScreenWindow
 .objc_class_name_WebFontCache
 .objc_class_name_WebHTMLConverter
 .objc_class_name_WebScriptObject
 .objc_class_name_WebScriptObjectPrivate
 .objc_class_name_WebUndefined
+.objc_class_name_WebWindowFadeAnimation
+.objc_class_name_WebWindowScaleAnimation
 _DOMEventException
 _DOMException
 _DOMRangeException
@@ -143,6 +146,8 @@ __ZN7WebCore10FloatPointC1ERKNS_8IntPointE
 __ZN7WebCore10JSDocument6s_infoE
 __ZN7WebCore10MouseEvent6createERKN3WTF12AtomicStringENS1_10PassRefPtrINS_9DOMWindowEEERKNS_18PlatformMouseEventEiNS5_INS_4NodeEEE
 __ZN7WebCore10MouseEventC1ERKN3WTF12AtomicStringEbbNS1_10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9ClipboardEEEb
+__ZN7WebCore10RenderView10compositorEv
+__ZN7WebCore10ShadowTree20removeAllShadowRootsEv
 __ZN7WebCore10ScrollView17setUseFixedLayoutEb
 __ZN7WebCore10ScrollView18setFixedLayoutSizeERKNS_7IntSizeE
 __ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
@@ -217,6 +222,7 @@ __ZN7WebCore11MemoryCache14evictResourcesEv
 __ZN7WebCore11MemoryCache19getOriginsWithCacheERN3WTF7HashSetINS1_6RefPtrINS_14SecurityOriginEEENS_18SecurityOriginHashENS1_10HashTraitsIS5_EEEE
 __ZN7WebCore11MemoryCache25removeResourcesWithOriginEPNS_14SecurityOriginE
 __ZN7WebCore11RenderLayer19scrollRectToVisibleERKNS_7IntRectERKNS_15ScrollAlignmentES6_
+__ZN7WebCore11URLWithDataEP6NSDataP5NSURL
 __ZN7WebCore11globalPointERK8_NSPointP8NSWindow
 __ZN7WebCore11memoryCacheEv
 __ZN7WebCore11startOfWordERKNS_15VisiblePositionENS_9EWordSideE
@@ -246,25 +252,6 @@ __ZN7WebCore12EventHandler8keyEventERKNS_21PlatformKeyboardEventE
 __ZN7WebCore12EventHandler9mouseDownEP7NSEvent
 __ZN7WebCore12GCController17garbageCollectNowEv
 __ZN7WebCore12GCController43garbageCollectOnAlternateThreadForDebuggingEb
-__ZN7WebCore12IconDatabase10setEnabledEb
-__ZN7WebCore12IconDatabase11defaultIconERKNS_7IntSizeE
-__ZN7WebCore12IconDatabase14removeAllIconsEv
-__ZN7WebCore12IconDatabase15iconRecordCountEv
-__ZN7WebCore12IconDatabase19pageURLMappingCountEv
-__ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
-__ZN7WebCore12IconDatabase20delayDatabaseCleanupEv   
-__ZN7WebCore12IconDatabase20retainIconForPageURLERKN3WTF6StringE
-__ZN7WebCore12IconDatabase20retainedPageURLCountEv
-__ZN7WebCore12IconDatabase21releaseIconForPageURLERKN3WTF6StringE
-__ZN7WebCore12IconDatabase23defaultDatabaseFilenameEv
-__ZN7WebCore12IconDatabase23iconRecordCountWithDataEv
-__ZN7WebCore12IconDatabase23importIconURLForPageURLERKN3WTF6StringES4_
-__ZN7WebCore12IconDatabase24importIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS1_6StringE
-__ZN7WebCore12IconDatabase25setPrivateBrowsingEnabledEb
-__ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
-__ZN7WebCore12IconDatabase5closeEv
-__ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
-__ZN7WebCore12IconDatabaseC1Ev
 __ZN7WebCore12PopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore12PrintContext12pagePropertyEPNS_5FrameEPKci
 __ZN7WebCore12PrintContext13numberOfPagesEPNS_5FrameERKNS_9FloatSizeE
@@ -408,6 +395,8 @@ __ZN7WebCore14StorageTracker32syncFileSystemAndTrackerDatabaseEv
 __ZN7WebCore14StorageTracker7originsERN3WTF6VectorINS1_6RefPtrINS_14SecurityOriginEEELm0EEE
 __ZN7WebCore14StorageTracker7trackerEv
 __ZN7WebCore14StorageTracker9setClientEPNS_20StorageTrackerClientE
+__ZN7WebCore14decodeHostNameEP8NSString
+__ZN7WebCore14encodeHostNameEP8NSString
 __ZN7WebCore14endOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore15AffineTransform5flipYEv
 __ZN7WebCore15AffineTransform5scaleEd
@@ -418,6 +407,7 @@ __ZN7WebCore15AffineTransformC1Ev
 __ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS1_6StringESA_SA_RKNS_16ResourceResponseE
 __ZN7WebCore15DOMWrapperWorld13clearWrappersEv
 __ZN7WebCore15DOMWrapperWorldD1Ev
+__ZN7WebCore15DatabaseContext16hasOpenDatabasesEPNS_22ScriptExecutionContextE
 __ZN7WebCore15DatabaseTracker12deleteOriginEPNS_14SecurityOriginE
 __ZN7WebCore15DatabaseTracker14deleteDatabaseEPNS_14SecurityOriginERKN3WTF6StringE
 __ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
@@ -475,6 +465,7 @@ __ZN7WebCore15StringTruncator5widthERKN3WTF6StringERKNS_4FontENS0_24EnableRoundi
 __ZN7WebCore15VisiblePositionC1ERKNS_8PositionENS_9EAffinityE
 __ZN7WebCore15defaultLanguageEv
 __ZN7WebCore15localizedStringEPKc
+__ZN7WebCore15originalURLDataEP5NSURL
 __ZN7WebCore15pathGetFileNameERKN3WTF6StringE
 __ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_7JSValueE
 __ZN7WebCore15setDOMExceptionEPN3JSC9ExecStateEi
@@ -534,6 +525,7 @@ __ZN7WebCore16deleteAllCookiesEv
 __ZN7WebCore16enclosingIntRectERK7_NSRect
 __ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
 __ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
+__ZN7WebCore16isUserVisibleURLEP8NSString
 __ZN7WebCore16startOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore17CredentialStorage24getFromPersistentStorageERKNS_15ProtectionSpaceE
 __ZN7WebCore17CredentialStorage3getERKNS_15ProtectionSpaceE
@@ -547,6 +539,7 @@ __ZN7WebCore17RegularExpressionC1ERKN3WTF6StringENS1_19TextCaseSensitivityE
 __ZN7WebCore17RegularExpressionD1Ev
 __ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEPN3JSC9StructureEPKNS2_9ClassInfoE
 __ZN7WebCore17openTemporaryFileERKN3WTF6StringERi
+__ZN7WebCore17userVisibleStringEP5NSURL
 __ZN7WebCore18HTMLContentElement6createEPNS_8DocumentE
 __ZN7WebCore18PlatformPasteboard13bufferForTypeERKN3WTF6StringE
 __ZN7WebCore18PlatformPasteboard13stringForTypeERKN3WTF6StringE
@@ -604,11 +597,6 @@ __ZN7WebCore19TextResourceDecoder6decodeEPKcm
 __ZN7WebCore19TextResourceDecoderC1ERKN3WTF6StringERKNS_12TextEncodingEb
 __ZN7WebCore19TextResourceDecoderD1Ev
 __ZN7WebCore19applicationIsSafariEv
-
-#if ENABLE(NOTIFICATIONS)
-__ZN7WebCore19provideNotificationEPNS_4PageEPNS_21NotificationPresenterE
-#endif
-
 __ZN7WebCore20DisplaySleepDisablerC1EPKc
 __ZN7WebCore20DisplaySleepDisablerD1Ev
 __ZN7WebCore20NodeRenderingContextC1EPNS_4NodeE
@@ -638,6 +626,8 @@ __ZN7WebCore21SerializedScriptValue11deserializeEPK15OpaqueJSContextPPK13OpaqueJ
 __ZN7WebCore21SerializedScriptValue6createEPK15OpaqueJSContextPK13OpaqueJSValuePS6_
 __ZN7WebCore21SerializedScriptValueC1ERN3WTF6VectorIhLm0EEE
 __ZN7WebCore21SerializedScriptValueD1Ev
+__ZN7WebCore21URLByRemovingUserInfoEP5NSURL
+__ZN7WebCore22URLWithUserTypedStringEP8NSStringP5NSURL
 __ZN7WebCore21UserContentURLPattern5parseERKN3WTF6StringE
 __ZN7WebCore21WindowsLatin1EncodingEv
 __ZN7WebCore21applicationIsApertureEv
@@ -661,6 +651,9 @@ __ZN7WebCore22externalRepresentationEPNS_7ElementEj
 __ZN7WebCore22userPreferredLanguagesEv
 __ZN7WebCore23AuthenticationChallengeC1ERKNS_15ProtectionSpaceERKNS_10CredentialEjRKNS_16ResourceResponseERKNS_13ResourceErrorE
 __ZN7WebCore23createFragmentFromNodesEPNS_8DocumentERKN3WTF6VectorIPNS_4NodeELm0EEE
+__ZN7WebCore23dataForURLComponentTypeEP5NSURLl
+__ZN7WebCore23decodeHostNameWithRangeEP8NSString8_NSRange
+__ZN7WebCore23encodeHostNameWithRangeEP8NSString8_NSRange
 __ZN7WebCore23getHostnamesWithCookiesERN3WTF7HashSetINS0_6StringENS0_10StringHashENS0_10HashTraitsIS2_EEEE
 __ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
 __ZN7WebCore24CachedResourceHandleBase11setResourceEPNS_14CachedResourceE
@@ -724,6 +717,8 @@ __ZN7WebCore29isCharacterSmartReplaceExemptEib
 __ZN7WebCore29setUsesTestModeFocusRingColorEb
 __ZN7WebCore30contextMenuItemTagSpellingMenuEv
 __ZN7WebCore30contextMenuItemTagStopSpeakingEv
+__ZN7WebCore30hostNameNeedsDecodingWithRangeEP8NSString8_NSRange
+__ZN7WebCore30hostNameNeedsEncodingWithRangeEP8NSString8_NSRange
 __ZN7WebCore30overrideUserPreferredLanguagesERKN3WTF6VectorINS0_6StringELm0EEE
 __ZN7WebCore31CrossOriginPreflightResultCache5emptyEv
 __ZN7WebCore31CrossOriginPreflightResultCache6sharedEv
@@ -750,6 +745,7 @@ __ZN7WebCore38contextMenuItemTagWritingDirectionMenuEv
 __ZN7WebCore3macERKNS_10CredentialE
 __ZN7WebCore3macERKNS_23AuthenticationChallengeE
 __ZN7WebCore40restrictMinimumScaleFactorToViewportSizeERNS_18ViewportAttributesENS_7IntSizeE
+__ZN7WebCore42URLByTruncatingOneCharacterBeforeComponentEP5NSURLl
 __ZN7WebCore42contextMenuItemTagCheckGrammarWithSpellingEv
 __ZN7WebCore42contextMenuItemTagCheckSpellingWhileTypingEv
 __ZN7WebCore46contextMenuItemTagCorrectSpellingAutomaticallyEv
@@ -798,6 +794,8 @@ __ZN7WebCore4Page27setJavaScriptURLsAreAllowedEb
 __ZN7WebCore4Page31setCustomHTMLTokenizerChunkSizeEi
 __ZN7WebCore4Page31setCustomHTMLTokenizerTimeDelayEd
 __ZN7WebCore4Page32setMemoryCacheClientCallsEnabledEb
+__ZN7WebCore4Page35resumeActiveDOMObjectsAndAnimationsEv
+__ZN7WebCore4Page36suspendActiveDOMObjectsAndAnimationsEv
 __ZN7WebCore4Page37setInLowQualityImageInterpolationModeEb
 __ZN7WebCore4Page43setRelevantRepaintedObjectsCounterThresholdEy
 __ZN7WebCore4Page6goBackEv
@@ -915,7 +913,6 @@ __ZN7WebCore6WidgetD2Ev
 __ZN7WebCore6toNodeEN3JSC7JSValueE
 __ZN7WebCore7Console21shouldPrintExceptionsEv
 __ZN7WebCore7Console24setShouldPrintExceptionsEb
-__ZN7WebCore7Element16removeShadowRootEv
 __ZN7WebCore7Element21boundsInRootViewSpaceEv
 __ZN7WebCore7Element9innerTextEv
 __ZN7WebCore7IntRect5scaleEf
@@ -1180,6 +1177,7 @@ __ZNK7WebCore10ScrollView16windowToContentsERKNS_7IntRectE
 __ZNK7WebCore10ScrollView16windowToContentsERKNS_8IntPointE
 __ZNK7WebCore10ScrollView18contentsToRootViewERKNS_7IntRectE
 __ZNK7WebCore10ScrollView18contentsToRootViewERKNS_8IntPointE
+__ZNK7WebCore10ScrollView16contentsToScreenERKNS_7IntRectE
 __ZNK7WebCore10ScrollView18visibleContentRectEb
 __ZNK7WebCore11FrameLoader10isCompleteEv
 __ZNK7WebCore11FrameLoader14cancelledErrorERKNS_15ResourceRequestE
@@ -1189,6 +1187,7 @@ __ZNK7WebCore11FrameLoader17networkingContextEv
 __ZNK7WebCore11FrameLoader20activeDocumentLoaderEv
 __ZNK7WebCore11FrameLoader27numPendingOrLoadingRequestsEb
 __ZNK7WebCore11FrameLoader8loadTypeEv
+__ZNK7WebCore11Geolocation5frameEv
 __ZNK7WebCore11HistoryItem10visitCountEv
 __ZNK7WebCore11HistoryItem11hasChildrenEv
 __ZNK7WebCore11HistoryItem11originalURLEv
@@ -1212,11 +1211,9 @@ __ZNK7WebCore11HistoryItem9viewStateEv
 __ZNK7WebCore11RenderLayer19absoluteBoundingBoxEv
 __ZNK7WebCore11RenderStyle21visitedDependentColorEi
 __ZNK7WebCore11ScriptValue9getStringEPN3JSC9ExecStateERN3WTF6StringE
-__ZNK7WebCore12IconDatabase12databasePathEv
-__ZNK7WebCore12IconDatabase24shouldStopThreadActivityEv
-__ZNK7WebCore12IconDatabase9isEnabledEv
 __ZNK7WebCore12RenderObject14enclosingLayerEv
 __ZNK7WebCore12RenderObject15localToAbsoluteERKNS_10FloatPointEbb
+__ZNK7WebCore12RenderObject20localToContainerQuadERKNS_9FloatQuadEPNS_20RenderBoxModelObjectEbPb
 __ZNK7WebCore12RenderObject23absoluteBoundingBoxRectEb
 __ZNK7WebCore12RenderObject7childAtEj
 __ZNK7WebCore12RenderWidget14windowClipRectEv
@@ -1347,6 +1344,8 @@ __ZNK7WebCore20ResourceResponseBase8mimeTypeEv
 __ZNK7WebCore21BackForwardController12forwardCountEv
 __ZNK7WebCore21BackForwardController9backCountEv
 __ZNK7WebCore21UserContentURLPattern7matchesERKNS_4KURLE
+__ZNK7WebCore21RenderLayerCompositor11scrollLayerEv
+__ZNK7WebCore21RenderLayerCompositor15rootRenderLayerEv
 __ZNK7WebCore23AuthenticationChallenge20authenticationClientEv
 __ZNK7WebCore23FrameLoaderStateMachine15firstLayoutDoneEv
 __ZNK7WebCore23FrameLoaderStateMachine23committingFirstRealLoadEv
@@ -1374,6 +1373,12 @@ __ZNK7WebCore4KURL4pathEv
 __ZNK7WebCore4KURL4portEv
 __ZNK7WebCore4KURL4userEv
 __ZNK7WebCore4KURL5queryEv
+#if USE(WTFURL)
+__ZNK7WebCore4KURL6stringEv
+__ZNK7WebCore4KURL7isEmptyEv
+__ZNK7WebCore4KURL7isValidEv
+__ZNK7WebCore4KURL22protocolIsInHTTPFamilyEv
+#endif
 __ZNK7WebCore4KURL8protocolEv
 __ZNK7WebCore4KURLcvP5NSURLEv
 __ZNK7WebCore4Node14isDescendantOfEPKS0_
@@ -1431,6 +1436,7 @@ __ZNK7WebCore6Editor7canEditEv
 __ZNK7WebCore6Editor8canPasteEv
 __ZNK7WebCore6Editor9canDeleteEv
 __ZNK7WebCore6JSNode21pushEventHandlerScopeEPN3JSC9ExecStateEPNS1_14ScopeChainNodeE
+__ZNK7WebCore6Length22decrementCalculatedRefEv
 __ZNK7WebCore6Region5rectsEv
 __ZNK7WebCore6Widget14platformWidgetEv
 __ZNK7WebCore6Widget23convertToContainingViewERKNS_7IntRectE
@@ -1441,9 +1447,9 @@ __ZNK7WebCore6Widget25convertToContainingWindowERKNS_7IntRectE
 __ZNK7WebCore6Widget25convertToContainingWindowERKNS_8IntPointE
 __ZNK7WebCore6Widget9frameRectEv
 __ZNK7WebCore7Element10screenRectEv
+__ZNK7WebCore7Element10shadowTreeEv
 __ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
 __ZNK7WebCore7Element13hasShadowRootEv
-__ZNK7WebCore7Element14shadowRootListEv
 __ZNK7WebCore7IntRect10intersectsERKS0_
 __ZNK7WebCore7IntRect8containsERKS0_
 __ZNK7WebCore7IntRectcv6CGRectEv
@@ -1494,17 +1500,22 @@ __ZNK7WebCore9PageCache10frameCountEv
 __ZNK7WebCore9PageCache21autoreleasedPageCountEv
 __ZNK7WebCore9TreeScope14getElementByIdERKN3WTF12AtomicStringE
 __ZTVN7WebCore12ChromeClientE
+__ZN7WebCore14setMetadataURLERN3WTF6StringERKS1_S4_
 __ZTVN7WebCore16IconDatabaseBaseE
 __ZTVN7WebCore17FrameLoaderClientE
 __ZTVN7WebCore25HistoryPropertyListWriterE
 __ZTVN7WebCore28InspectorFrontendClientLocal8SettingsE
 _filenameByFixingIllegalCharacters
 _hasCaseInsensitiveSubstring
+_hasCaseInsensitivePrefix
 _hasCaseInsensitiveSuffix
 _stringEncodingForResource
 _stringIsCaseInsensitiveEqualToString
 _suggestedFilenameWithMIMEType
 _wkAdvanceDefaultButtonPulseAnimation
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+_wkCALayerEnumerateRectsBeingDrawnWithBlock
+#endif
 _wkCGContextGetShouldSmoothFonts
 _wkCGContextResetClip
 _wkCGPatternCreateWithImageAndTransform
@@ -1583,6 +1594,7 @@ _wkSetHTTPCookiesForURL
 _wkSetHTTPPipeliningMaximumPriority
 _wkSetHTTPPipeliningMinimumFastLanePriority
 _wkSetHTTPPipeliningPriority
+_wkSetMetadataURL
 _wkSetNSURLConnectionDefersCallbacks
 _wkSetNSURLRequestShouldContentSniff
 _wkSetPatternPhaseInUserSpace
@@ -1663,7 +1675,6 @@ __ZNK7WebCore21ContextMenuController21checkOrEnableIfNeededERNS_15ContextMenuIte
 __ZN7WebCore21ContextMenuController23contextMenuItemSelectedEPNS_15ContextMenuItemE
 __ZN7WebCore21contextMenuItemVectorEP14NSMutableArray
 __ZN7WebCore23platformMenuDescriptionERN3WTF6VectorINS_15ContextMenuItemELm0EEE
-__ZN7WebCore6Chrome15showContextMenuEv
 __ZNK7WebCore11ContextMenu19platformDescriptionEv
 __ZNK7WebCore15ContextMenuItem15platformSubMenuEv
 __ZNK7WebCore15ContextMenuItem4typeEv
@@ -1700,6 +1711,31 @@ __ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErr
 #endif
 #endif
 
+#if ENABLE(ICONDATABASE)
+__ZN7WebCore12IconDatabase10setEnabledEb
+__ZN7WebCore12IconDatabase11defaultIconERKNS_7IntSizeE
+__ZN7WebCore12IconDatabase14removeAllIconsEv
+__ZN7WebCore12IconDatabase15iconRecordCountEv
+__ZN7WebCore12IconDatabase19pageURLMappingCountEv
+__ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
+__ZN7WebCore12IconDatabase20delayDatabaseCleanupEv   
+__ZN7WebCore12IconDatabase20retainIconForPageURLERKN3WTF6StringE
+__ZN7WebCore12IconDatabase20retainedPageURLCountEv
+__ZN7WebCore12IconDatabase21releaseIconForPageURLERKN3WTF6StringE
+__ZN7WebCore12IconDatabase23defaultDatabaseFilenameEv
+__ZN7WebCore12IconDatabase23iconRecordCountWithDataEv
+__ZN7WebCore12IconDatabase23importIconURLForPageURLERKN3WTF6StringES4_
+__ZN7WebCore12IconDatabase24importIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS1_6StringE
+__ZN7WebCore12IconDatabase25setPrivateBrowsingEnabledEb
+__ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
+__ZN7WebCore12IconDatabase5closeEv
+__ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
+__ZN7WebCore12IconDatabaseC1Ev
+__ZNK7WebCore12IconDatabase12databasePathEv
+__ZNK7WebCore12IconDatabase24shouldStopThreadActivityEv
+__ZNK7WebCore12IconDatabase9isEnabledEv
+#endif // ENABLE(ICONDATABASE)
+
 #if ENABLE(INSPECTOR)
 __ZN7WebCore15InspectorClient31doDispatchMessageOnFrontendPageEPNS_4PageERKN3WTF6StringE
 __ZN7WebCore19InspectorController14enableProfilerEv
@@ -1725,6 +1761,7 @@ __ZN7WebCore28InspectorFrontendClientLocal19requestDetachWindowEv
 __ZN7WebCore28InspectorFrontendClientLocal19windowObjectClearedEv
 __ZN7WebCore28InspectorFrontendClientLocal20sendMessageToBackendERKN3WTF6StringE
 __ZN7WebCore28InspectorFrontendClientLocal21isProfilingJavaScriptEv
+__ZN7WebCore28InspectorFrontendClientLocal21setDockingUnavailableEb
 __ZN7WebCore28InspectorFrontendClientLocal23stopProfilingJavaScriptEv
 __ZN7WebCore28InspectorFrontendClientLocal24showMainResourceForFrameEPNS_5FrameE
 __ZN7WebCore28InspectorFrontendClientLocal24startProfilingJavaScriptEv
@@ -1999,6 +2036,7 @@ __ZN7WebCore8Document34webkitWillExitFullScreenForElementEPNS_7ElementE
 __ZN7WebCore8Document35webkitWillEnterFullScreenForElementEPNS_7ElementE
 __ZN7WebCore8Document25setFullScreenRendererSizeERKNS_7IntSizeE
 __ZN7WebCore8Document36setFullScreenRendererBackgroundColorENS_5ColorE
+__ZN7WebCore8Document22setAnimatingFullScreenEb
 __ZNK7WebCore8Document9domWindowEv
 __ZNK7WebCore4Node16traverseNextNodeEPKS0_
 #endif
@@ -2085,6 +2123,7 @@ __ZN7WebCore12Notification17dispatchShowEventEv
 __ZN7WebCore12Notification18dispatchClickEventEv
 __ZN7WebCore12Notification18dispatchCloseEventEv
 __ZN7WebCore12Notification18dispatchErrorEventEv
+__ZN7WebCore19provideNotificationEPNS_4PageEPNS_18NotificationClientE
 #endif
 
 #if ENABLE(THREADED_SCROLLING)
@@ -2092,6 +2131,7 @@ __ZN7WebCore13ScrollingTree21tryToHandleWheelEventERKNS_18PlatformWheelEventE
 __ZN7WebCore13ScrollingTree22updateBackForwardStateEbb
 __ZN7WebCore13ScrollingTreeD1Ev
 __ZN7WebCore15ScrollingThread8dispatchERKN3WTF8FunctionIFvvEEE
+__ZN7WebCore20ScrollingCoordinator44setForceMainThreadScrollLayerPositionUpdatesEb
 __ZN7WebCore4Page20scrollingCoordinatorEv
 __ZNK7WebCore20ScrollingCoordinator13scrollingTreeEv
 #endif
@@ -2100,4 +2140,5 @@ __ZNK7WebCore4Node31numberOfScopedHTMLStyleChildrenEv
 
 #if ENABLE(SHADOW_DOM)
 __ZN7WebCore22RuntimeEnabledFeatures32setMultipleShadowSubtreesEnabledEb
+__ZN7WebCore22RuntimeEnabledFeatures18isShadowDOMEnabledE
 #endif
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index 25c541336..aeb715427 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -55,6 +55,11 @@
       '../Modules/geolocation',
       '../Modules/intents',
       '../Modules/indexeddb',
+      '../Modules/mediastream',
+      '../Modules/speech',
+      '../Modules/webdatabase',
+      '../Modules/webdatabase/chromium',
+      '../Modules/websockets',
       '../accessibility',
       '../accessibility/chromium',
       '../bindings',
@@ -85,7 +90,6 @@
       '../loader/cache',
       '../loader/icon',
       '../mathml',
-      '../mediastream',
       '../notifications',
       '../page',
       '../page/animation',
@@ -136,7 +140,6 @@
       '../svg/properties',
       '../../ThirdParty/glu',
       '../webaudio',
-      '../websockets',
       '../workers',
       '../xml',
       '../xml/parser',
@@ -190,18 +193,6 @@
           '<@(webcore_svg_bindings_idl_files)',
         ],
       }],
-      ['OS=="mac" and use_skia==0', {
-        'webcore_include_dirs+': [
-          # platform/graphics/cg and cocoa need to come before
-          # platform/graphics/chromium so that the Mac build picks up the
-          # version of ImageBufferData.h in the cg directory and
-          # FontPlatformData.h in the cocoa directory.  The + prepends this
-          # directory to the list.
-          # FIXME: This shouldn't need to be prepended.
-          '../platform/graphics/cocoa',
-          '../platform/graphics/cg',
-        ],
-      }],
       ['OS=="mac"', {
         'webcore_include_dirs': [
           # FIXME: Eliminate dependency on platform/mac and related
@@ -211,17 +202,13 @@
           # platform/graphics/cg may need to stick around, though.
           '../platform/audio/mac',
           '../platform/cocoa',
+          '../platform/graphics/cg',
+          '../platform/graphics/cocoa',
           '../platform/graphics/mac',
           '../platform/mac',
           '../platform/text/mac',
         ],
       }],
-      ['OS=="mac" and use_skia==1', {
-        'webcore_include_dirs': [
-              '../platform/graphics/cocoa',
-              '../platform/graphics/cg',
-        ],
-      }],
       ['OS=="win"', {
         'webcore_include_dirs': [
           '../page/win',
@@ -477,7 +464,7 @@
             'idl_files_list': '<|(idl_files_list.tmp <@(bindings_idl_files))',
           },
           'inputs': [
-            '../bindings/scripts/resolve-supplemental.pl',
+            '../bindings/scripts/preprocess-idls.pl',
             '../bindings/scripts/IDLParser.pm',
             '../bindings/scripts/IDLAttributes.txt',
             '<(idl_files_list)',
@@ -490,7 +477,7 @@
             'perl',
             '-w',
             '-I../bindings/scripts',
-            '../bindings/scripts/resolve-supplemental.pl',
+            '../bindings/scripts/preprocess-idls.pl',
             '--defines',
             '<(feature_defines) LANGUAGE_JAVASCRIPT V8_BINDING',
             '--idlFilesList',
@@ -728,7 +715,7 @@
           'action_name': 'EventFactory',
           'inputs': [
             '../dom/make_event_factory.pl',
-            '../dom/EventFactory.in',
+            '../dom/EventNames.in',
           ],
           'outputs': [
             '<(SHARED_INTERMEDIATE_DIR)/webkit/EventFactory.cpp',
@@ -827,6 +814,7 @@
               '../css/mathml.css',
               '../css/mediaControls.css',
               '../css/mediaControlsChromium.css',
+              '../css/mediaControlsChromiumAndroid.css',
               '../css/fullscreen.css',
               # Skip fullscreenQuickTime.
             ],
@@ -987,11 +975,13 @@
           ],
           'variables': {
             'generator_include_dirs': [
+              '--include', '../Modules/indexeddb',
+              '--include', '../Modules/mediastream',
+              '--include', '../Modules/webdatabase',
               '--include', '../css',
               '--include', '../dom',
               '--include', '../fileapi',
               '--include', '../html',
-              '--include', '../mediastream',
               '--include', '../notifications',
               '--include', '../page',
               '--include', '../plugins',
@@ -999,7 +989,6 @@
               '--include', '../svg',
               '--include', '../testing',
               '--include', '../webaudio',
-              '--include', '../websockets',
               '--include', '../workers',
               '--include', '../xml',
             ],
@@ -1195,6 +1184,7 @@
         '<(chromium_src_dir)/third_party/ots/ots.gyp:ots',
         '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
         '<(chromium_src_dir)/third_party/angle/src/build_angle.gyp:translator_glsl',
+        '<(chromium_src_dir)/third_party/zlib/zlib.gyp:zlib',
         '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
         '<(libjpeg_gyp_path):libjpeg',
       ],
@@ -1363,7 +1353,6 @@
           # This directory needs to be on the include path for multiple sub-targets of webcore.
           'direct_dependent_settings': {
             'include_dirs': [
-              '<(chromium_src_dir)/third_party/ffmpeg/patched-ffmpeg',
               '<(chromium_src_dir)/third_party/ffmpeg',
             ],
           },
@@ -1513,15 +1502,6 @@
             ['include', 'platform/graphics/opentype/OpenTypeSanitizer\\.cpp$'],
           ],
         }],
-        ['OS=="mac" and use_skia==0', {
-          'sources/': [
-            # The Mac build is PLATFORM_CG too.  platform/graphics/cg is the
-            # only place that CG files we want to build are located, and not
-            # all of them even have a CG suffix, so just add them by a
-            # regexp matching their directory.
-            ['include', 'platform/graphics/cg/[^/]*(?<!Win)?\\.(cpp|mm?)$'],
-          ],
-        }],
         ['OS=="mac"', {
           # Necessary for Mac .mm stuff.
           'include_dirs': [
@@ -1618,29 +1598,7 @@
             ['exclude', 'platform/graphics/FontPlatformData\\.cpp$'],
           ],
         }],
-        ['OS=="mac" and use_skia==0', {
-          'sources/': [
-            # Cherry-pick some files that can't be included by broader regexps.
-            # Some of these are used instead of Chromium platform files, see
-            # the specific exclusions in the "exclude" list below.
-            ['include', 'platform/graphics/mac/GraphicsContextMac\\.mm$'],
-
-            # Chromium Mac does not use skia.
-            ['exclude', 'platform/graphics/skia/[^/]*Skia\\.(cpp|h)$'],
-
-            # The Mac currently uses ImageChromiumMac.mm from
-            # platform/graphics/chromium, included by regex above, instead.
-            ['exclude', 'platform/graphics/chromium/ImageChromium\\.cpp$'],
-
-            # ImageDecoderSkia is not used on mac.  ImageDecoderCG is used instead.
-            ['exclude', 'platform/image-decoders/skia/ImageDecoderSkia\\.cpp$'],
-            ['include', 'platform/image-decoders/cg/ImageDecoderCG\\.cpp$'],
-
-            # Again, Skia is not used on Mac.
-            ['exclude', 'platform/chromium/DragImageChromiumSkia\\.cpp$'],
-          ],
-        }],
-        ['OS=="mac" and use_skia==1', {
+        ['OS=="mac"', {
           'sources/': [
             ['include', 'platform/graphics/cg/FloatPointCG\\.cpp$'],
             ['include', 'platform/graphics/cg/FloatRectCG\\.cpp$'],
@@ -1656,7 +1614,7 @@
             ['exclude', 'platform/chromium/DragImageChromiumMac\\.cpp$'],
           ],
         }],
-        ['use_x11 == 0 and (OS!="mac" or use_skia==0)', {
+        ['use_x11 == 0 and OS != "mac"', {
           'sources/': [
             ['exclude', 'VDMX[^/]+\\.(cpp|h)$'],
           ],
@@ -1701,6 +1659,7 @@
             ['include', 'platform/graphics/harfbuzz/FontHarfBuzz\\.cpp$'],
             ['include', 'platform/graphics/harfbuzz/FontPlatformDataHarfBuzz\\.cpp$'],
             ['include', 'platform/graphics/harfbuzz/HarfBuzzSkia\\.cpp$'],
+            ['include', 'platform/graphics/harfbuzz/HarfBuzzShaperBase\\.cpp$'],
             ['include', 'platform/graphics/skia/SimpleFontDataSkia\\.cpp$'],
           ],
         }, { # OS!="android"
@@ -1715,25 +1674,28 @@
     # See https://bugs.webkit.org/show_bug.cgi?id=62916.
     {
       'target_name': 'webcore_arm_neon',
-      'type': 'static_library',
-      'dependencies': [
-        'webcore_prerequisites',
-      ],
-      'hard_dependency': 1,
-      'sources': [
-        '<@(webcore_files)',
-      ],
-      'sources/': [
-        ['exclude', '.*'],
-        ['include', 'platform/graphics/filters/arm/.*NEON\\.(cpp|h)'],
-      ],
       'conditions': [
-        ['OS=="android"', {
-          'cflags!': ['-mthumb'],
-          'cflags': ['-marm'],
-        }],
-        ['OS=="linux" and target_arch=="arm"', {
+        ['target_arch=="arm"', {
+          'type': 'static_library',
+          'dependencies': [
+            'webcore_prerequisites',
+          ],
+          'hard_dependency': 1,
+          'sources': [
+            '<@(webcore_files)',
+          ],
+          'sources/': [
+            ['exclude', '.*'],
+            ['include', 'platform/graphics/filters/arm/.*NEON\\.(cpp|h)'],
+          ],
           'cflags': ['-marm'],
+          'conditions': [
+            ['OS=="android"', {
+              'cflags!': ['-mthumb'],
+            }],
+          ],
+        },{  # target_arch!="arm"
+          'type': 'none',
         }],
       ],
     },
@@ -1840,6 +1802,13 @@
 
         ['exclude', 'AllInOne\\.cpp$'],
 
+        ['exclude', 'Modules/indexeddb/IDBFactoryBackendInterface\\.cpp$'],
+        ['exclude', 'Modules/indexeddb/IDBKeyPathBackendImpl\\.cpp$'],
+        ['exclude', 'Modules/webdatabase/DatabaseTrackerClient\\.h$'],
+        ['exclude', 'Modules/webdatabase/DatabaseTracker\\.cpp$'],
+        ['exclude', 'Modules/webdatabase/OriginQuotaManager\\.(cpp|h)$'],
+        ['exclude', 'Modules/webdatabase/OriginUsageRecord\\.(cpp|h)$'],
+        ['exclude', 'Modules/webdatabase/SQLTransactionClient\\.cpp$'],
         ['exclude', 'fileapi/LocalFileSystem\\.cpp$'],
         ['exclude', 'inspector/InspectorFrontendClientLocal\\.cpp$'],
         ['exclude', 'inspector/JavaScript[^/]*\\.cpp$'],
@@ -1856,13 +1825,6 @@
         ['exclude', 'plugins/PluginStream\\.cpp$'],
         ['exclude', 'plugins/PluginView\\.cpp$'],
         ['exclude', 'plugins/npapi\\.cpp$'],
-        ['exclude', 'storage/DatabaseTrackerClient\\.h$'],
-        ['exclude', 'storage/DatabaseTracker\\.cpp$'],
-        ['exclude', 'storage/IDBFactoryBackendInterface\\.cpp$'],
-        ['exclude', 'storage/IDBKeyPathBackendImpl\\.cpp$'],
-        ['exclude', 'storage/OriginQuotaManager\\.(cpp|h)$'],
-        ['exclude', 'storage/OriginUsageRecord\\.(cpp|h)$'],
-        ['exclude', 'storage/SQLTransactionClient\\.cpp$'],
         ['exclude', 'storage/StorageEventDispatcher\\.cpp$'],
         ['exclude', 'storage/StorageNamespace\\.cpp$'],
         ['exclude', 'workers/DefaultSharedWorkerRepository\\.(cpp|h)$'],
diff --git a/Source/WebCore/WebCore.gyp/scripts/action_makenames.py b/Source/WebCore/WebCore.gyp/scripts/action_makenames.py
index a5dae1204..9afd8e885 100644
--- a/Source/WebCore/WebCore.gyp/scripts/action_makenames.py
+++ b/Source/WebCore/WebCore.gyp/scripts/action_makenames.py
@@ -130,8 +130,8 @@ def main(args):
              or inputBasename.endswith('attrs.in'):
             assert attrInput == None
             attrInput = inputAbsPosix
-        elif inputBasename.endswith('EventFactory.in') \
-            or inputBasename.endswith('EventTargetFactory.in') \
+        elif inputBasename.endswith('EventTargetFactory.in') \
+            or inputBasename.endswith('EventNames.in') \
             or inputBasename.endswith('DOMExceptions.in'):
             eventsInput = inputAbsPosix
         elif inputBasename.endswith('Names.in'):
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index bf1e89651..b8171ec68 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -193,9 +193,24 @@
             'loader/icon/IconDatabaseBase.h',
             'loader/icon/IconDatabaseClient.h',
             'loader/mac/LoaderNSURLExtras.h',
+            'Modules/webdatabase/AbstractDatabase.h',
+            'Modules/webdatabase/Database.h',
+            'Modules/webdatabase/DatabaseDetails.h',
+            'Modules/webdatabase/DatabaseTracker.h',
+            'Modules/webdatabase/DatabaseTrackerClient.h',
+            'Modules/webdatabase/SQLError.h',
+            'Modules/webdatabase/SQLResultSet.h',
+            'Modules/webdatabase/SQLResultSetRowList.h',
+            'Modules/webdatabase/SQLStatementCallback.h',
+            'Modules/webdatabase/SQLStatementErrorCallback.h',
+            'Modules/webdatabase/SQLTransaction.h',
+            'Modules/webdatabase/SQLTransactionCallback.h',
+            'Modules/webdatabase/SQLTransactionErrorCallback.h',
+            'Modules/webdatabase/StorageTracker.h',
+            'Modules/webdatabase/StorageTrackerClient.h',
+            'notifications/NotificationClient.h',
             'notifications/NotificationContents.h',
             'notifications/NotificationController.h',
-            'notifications/NotificationPresenter.h',
             'page/Chrome.h',
             'page/ChromeClient.h',
             'page/Console.h',
@@ -223,7 +238,6 @@
             'page/Page.h',
             'page/PageGroup.h',
             'page/PageSerializer.h',
-            'page/PageSupplement.h',
             'page/PageVisibilityState.h',
             'page/PrintContext.h',
             'page/SecurityOrigin.h',
@@ -241,7 +255,6 @@
             'page/WindowFeatures.h',
             'page/animation/AnimationController.h',
             'page/mac/WebCoreFrameView.h',
-            'platform/AsyncFileStream.h',
             'platform/Clock.h',
             'platform/ColorChooser.h',
             'platform/ColorChooserClient.h',
@@ -292,9 +305,11 @@
             'platform/ScrollableArea.h',
             'platform/Scrollbar.h',
             'platform/ScrollbarTheme.h',
+            'platform/ScrollbarThemeClient.h',
             'platform/SearchPopupMenu.h',
             'platform/SharedBuffer.h',
             'platform/SharedBufferChunkReader.h',
+            'platform/Supplementable.h',
             'platform/SystemTime.h',
             'platform/Theme.h',
             'platform/ThemeTypes.h',
@@ -335,6 +350,8 @@
             'platform/graphics/FontSmoothingMode.h',
             'platform/graphics/FontTraitsMask.h',
             'platform/graphics/FontWidthVariant.h',
+            'platform/graphics/FractionalLayoutRect.h',
+            'platform/graphics/FractionalLayoutSize.h',
             'platform/graphics/Generator.h',
             'platform/graphics/Glyph.h',
             'platform/graphics/GlyphBuffer.h',
@@ -538,6 +555,7 @@
             'rendering/style/StyleFlexibleBoxData.h',
             'rendering/style/StyleGeneratedImage.h',
             'rendering/style/StyleGridData.h',
+            'rendering/style/StyleGridItemData.h',
             'rendering/style/StyleImage.h',
             'rendering/style/StyleInheritedData.h',
             'rendering/style/StyleMarqueeData.h',
@@ -549,22 +567,6 @@
             'rendering/style/StyleTransformData.h',
             'rendering/style/StyleVisualData.h',
             'rendering/svg/SVGResourcesCache.h',
-            'storage/AbstractDatabase.h',
-            'storage/Database.h',
-            'storage/DatabaseDetails.h',
-            'storage/DatabaseTracker.h',
-            'storage/DatabaseTrackerClient.h',
-            'storage/SQLError.h',
-            'storage/SQLResultSet.h',
-            'storage/SQLResultSetRowList.h',
-            'storage/SQLStatement.h',
-            'storage/SQLStatementCallback.h',
-            'storage/SQLStatementErrorCallback.h',
-            'storage/SQLTransaction.h',
-            'storage/SQLTransactionCallback.h',
-            'storage/SQLTransactionErrorCallback.h',
-            'storage/StorageTracker.h',
-            'storage/StorageTrackerClient.h',
             'workers/WorkerRunLoop.h',
             'workers/WorkerThread.h',
         ],
@@ -577,6 +579,7 @@
             'dom/Clipboard.h',
             'dom/ClipboardAccessPolicy.h',
             'dom/ContainerNode.h',
+            'dom/ContextDestructionObserver.h',
             'dom/DOMImplementation.h',
             'dom/DOMTimeStamp.h',
             'dom/DeviceOrientation.h',
@@ -617,7 +620,7 @@
             'dom/ScriptExecutionContext.h',
             'dom/ScriptRunner.h',
             'dom/ShadowRoot.h',
-            'dom/ShadowRootList.h',
+            'dom/ShadowTree.h',
             'dom/SpaceSplitString.h',
             'dom/StyledElement.h',
             'dom/Text.h',
@@ -653,6 +656,7 @@
             'html/HTMLTextAreaElement.h',
             'html/HTMLTextFormControlElement.h',
             'html/InputType.h',
+            'html/LabelableElement.h',
             'html/VoidCallback.h',
             'html/parser/HTMLParserIdioms.h',
         ],
@@ -727,10 +731,66 @@
             'Modules/geolocation/PositionError.idl',
             'Modules/geolocation/PositionErrorCallback.idl',
             'Modules/indexeddb/DOMWindowIndexedDatabase.idl',
+            'Modules/indexeddb/IDBAny.idl',
+            'Modules/indexeddb/IDBCursor.idl',
+            'Modules/indexeddb/IDBCursorWithValue.idl',
+            'Modules/indexeddb/IDBDatabaseError.idl',
+            'Modules/indexeddb/IDBDatabaseException.idl',
+            'Modules/indexeddb/IDBDatabase.idl',
+            'Modules/indexeddb/IDBFactory.idl',
+            'Modules/indexeddb/IDBIndex.idl',
+            'Modules/indexeddb/IDBKey.idl',
+            'Modules/indexeddb/IDBKeyRange.idl',
+            'Modules/indexeddb/IDBObjectStore.idl',
+            'Modules/indexeddb/IDBRequest.idl',
+            'Modules/indexeddb/IDBTransaction.idl',
+            'Modules/indexeddb/IDBVersionChangeEvent.idl',
+            'Modules/indexeddb/IDBVersionChangeRequest.idl',
+            'Modules/indexeddb/WorkerContextIndexedDatabase.idl',
             'Modules/intents/DOMWindowIntents.idl',
             'Modules/intents/Intent.idl',
             'Modules/intents/IntentResultCallback.idl',
             'Modules/intents/NavigatorIntents.idl',
+            'Modules/mediastream/DOMWindowMediaStream.idl',
+            'Modules/mediastream/LocalMediaStream.idl',
+            'Modules/mediastream/MediaStream.idl',
+            'Modules/mediastream/MediaStreamEvent.idl',
+            'Modules/mediastream/MediaStreamList.idl',
+            'Modules/mediastream/MediaStreamTrack.idl',
+            'Modules/mediastream/MediaStreamTrackList.idl',
+            'Modules/mediastream/NavigatorMediaStream.idl',
+            'Modules/mediastream/NavigatorUserMediaError.idl',
+            'Modules/mediastream/NavigatorUserMediaErrorCallback.idl',
+            'Modules/mediastream/NavigatorUserMediaSuccessCallback.idl',
+            'Modules/mediastream/PeerConnection.idl',
+            'Modules/mediastream/SignalingCallback.idl',
+            'Modules/speech/DOMWindowSpeech.idl',
+            'Modules/speech/SpeechGrammar.idl',
+            'Modules/speech/SpeechGrammarList.idl',
+            'Modules/speech/SpeechRecognitionAlternative.idl',
+            'Modules/speech/SpeechRecognitionError.idl',
+            'Modules/speech/SpeechRecognitionEvent.idl',
+            'Modules/speech/SpeechRecognitionResult.idl',
+            'Modules/speech/SpeechRecognitionResultList.idl',
+            'Modules/webdatabase/DOMWindowSQLDatabase.idl',
+            'Modules/webdatabase/Database.idl',
+            'Modules/webdatabase/DatabaseCallback.idl',
+            'Modules/webdatabase/DatabaseSync.idl',
+            'Modules/webdatabase/SQLError.idl',
+            'Modules/webdatabase/SQLException.idl',
+            'Modules/webdatabase/SQLResultSet.idl',
+            'Modules/webdatabase/SQLResultSetRowList.idl',
+            'Modules/webdatabase/SQLStatementCallback.idl',
+            'Modules/webdatabase/SQLStatementErrorCallback.idl',
+            'Modules/webdatabase/SQLTransaction.idl',
+            'Modules/webdatabase/SQLTransactionCallback.idl',
+            'Modules/webdatabase/SQLTransactionErrorCallback.idl',
+            'Modules/webdatabase/SQLTransactionSync.idl',
+            'Modules/webdatabase/SQLTransactionSyncCallback.idl',
+            'Modules/webdatabase/WorkerContextSQLDatabase.idl',
+            'Modules/websockets/CloseEvent.idl',
+            'Modules/websockets/DOMWindowWebSocket.idl',
+            'Modules/websockets/WebSocket.idl',
             'css/CSSCharsetRule.idl',
             'css/CSSFontFaceRule.idl',
             'css/CSSImportRule.idl',
@@ -857,11 +917,11 @@
             'fileapi/Metadata.idl',
             'fileapi/MetadataCallback.idl',
             'fileapi/WebKitBlobBuilder.idl',
+            'fileapi/WorkerContextFileSystem.idl',
             'html/DOMFormData.idl',
             'html/DOMSettableTokenList.idl',
             'html/DOMTokenList.idl',
             'html/DOMURL.idl',
-            'html/DOMWindowHTML.idl',
             'html/HTMLAllCollection.idl',
             'html/HTMLAnchorElement.idl',
             'html/HTMLAppletElement.idl',
@@ -949,8 +1009,8 @@
             'html/canvas/CanvasPixelArray.idl',
             'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
-            'html/canvas/DOMWindowWebGL.idl',
             'html/canvas/DataView.idl',
+            'html/canvas/EXTTextureFilterAnisotropic.idl',
             'html/canvas/Float32Array.idl',
             'html/canvas/Float64Array.idl',
             'html/canvas/Int16Array.idl',
@@ -992,19 +1052,6 @@
             'inspector/ScriptProfile.idl',
             'inspector/ScriptProfileNode.idl',
             'loader/appcache/DOMApplicationCache.idl',
-            'mediastream/DOMWindowMediaStream.idl',
-            'mediastream/LocalMediaStream.idl',
-            'mediastream/MediaStream.idl',
-            'mediastream/MediaStreamEvent.idl',
-            'mediastream/MediaStreamList.idl',
-            'mediastream/MediaStreamTrack.idl',
-            'mediastream/MediaStreamTrackList.idl',
-            'mediastream/NavigatorMediaStream.idl',
-            'mediastream/NavigatorUserMediaError.idl',
-            'mediastream/NavigatorUserMediaErrorCallback.idl',
-            'mediastream/NavigatorUserMediaSuccessCallback.idl',
-            'mediastream/PeerConnection.idl',
-            'mediastream/SignalingCallback.idl',
             'notifications/Notification.idl',
             'notifications/NotificationCenter.idl',
             'page/AbstractView.idl',
@@ -1036,36 +1083,6 @@
             'plugins/DOMMimeTypeArray.idl',
             'plugins/DOMPlugin.idl',
             'plugins/DOMPluginArray.idl',
-            'storage/DOMWindowSQLDatabase.idl',
-            'storage/Database.idl',
-            'storage/DatabaseCallback.idl',
-            'storage/DatabaseSync.idl',
-            'storage/IDBAny.idl',
-            'storage/IDBCursor.idl',
-            'storage/IDBCursorWithValue.idl',
-            'storage/IDBDatabaseError.idl',
-            'storage/IDBDatabaseException.idl',
-            'storage/IDBDatabase.idl',
-            'storage/IDBFactory.idl',
-            'storage/IDBIndex.idl',
-            'storage/IDBKey.idl',
-            'storage/IDBKeyRange.idl',
-            'storage/IDBObjectStore.idl',
-            'storage/IDBRequest.idl',
-            'storage/IDBTransaction.idl',
-            'storage/IDBVersionChangeEvent.idl',
-            'storage/IDBVersionChangeRequest.idl',
-            'storage/SQLError.idl',
-            'storage/SQLException.idl',
-            'storage/SQLResultSet.idl',
-            'storage/SQLResultSetRowList.idl',
-            'storage/SQLStatementCallback.idl',
-            'storage/SQLStatementErrorCallback.idl',
-            'storage/SQLTransaction.idl',
-            'storage/SQLTransactionCallback.idl',
-            'storage/SQLTransactionErrorCallback.idl',
-            'storage/SQLTransactionSync.idl',
-            'storage/SQLTransactionSyncCallback.idl',
             'storage/Storage.idl',
             'storage/StorageEvent.idl',
             'storage/StorageInfo.idl',
@@ -1099,18 +1116,13 @@
             'webaudio/OfflineAudioCompletionEvent.idl',
             'webaudio/RealtimeAnalyserNode.idl',
             'webaudio/WaveShaperNode.idl',
-            'websockets/CloseEvent.idl',
-            'websockets/DOMWindowWebSocket.idl',
-            'websockets/WebSocket.idl',
             'workers/AbstractWorker.idl',
-            'workers/DOMWindowWorker.idl',
             'workers/DedicatedWorkerContext.idl',
             'workers/SharedWorker.idl',
             'workers/SharedWorkerContext.idl',
             'workers/Worker.idl',
             'workers/WorkerContext.idl',
             'workers/WorkerLocation.idl',
-            'xml/DOMWindowXML.idl',
             'xml/DOMParser.idl',
             'xml/XMLHttpRequest.idl',
             'xml/XMLHttpRequestException.idl',
@@ -1125,7 +1137,6 @@
             'xml/XSLTProcessor.idl',
         ],
         'webcore_svg_bindings_idl_files': [
-            'svg/DOMWindowSVG.idl',
             'svg/ElementTimeControl.idl',
             'svg/SVGAElement.idl',
             'svg/SVGAltGlyphElement.idl',
@@ -1292,6 +1303,80 @@
             'Modules/geolocation/NavigatorGeolocation.h',
             'Modules/indexeddb/DOMWindowIndexedDatabase.cpp',
             'Modules/indexeddb/DOMWindowIndexedDatabase.h',
+            'Modules/indexeddb/IDBAny.cpp',
+            'Modules/indexeddb/IDBAny.h',
+            'Modules/indexeddb/IDBBackingStore.h',
+            'Modules/indexeddb/IDBCallbacks.h',
+            'Modules/indexeddb/IDBCursor.cpp',
+            'Modules/indexeddb/IDBCursor.h',
+            'Modules/indexeddb/IDBCursorBackendImpl.cpp',
+            'Modules/indexeddb/IDBCursorBackendImpl.h',
+            'Modules/indexeddb/IDBCursorBackendInterface.h',
+            'Modules/indexeddb/IDBCursorWithValue.cpp',
+            'Modules/indexeddb/IDBCursorWithValue.h',
+            'Modules/indexeddb/IDBDatabase.cpp',
+            'Modules/indexeddb/IDBDatabase.h',
+            'Modules/indexeddb/IDBDatabaseBackendImpl.cpp',
+            'Modules/indexeddb/IDBDatabaseBackendImpl.h',
+            'Modules/indexeddb/IDBDatabaseBackendInterface.h',
+            'Modules/indexeddb/IDBDatabaseCallbacks.h',
+            'Modules/indexeddb/IDBDatabaseCallbacks.h',
+            'Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp',
+            'Modules/indexeddb/IDBDatabaseCallbacksImpl.h',
+            'Modules/indexeddb/IDBDatabaseError.h',
+            'Modules/indexeddb/IDBDatabaseException.cpp',
+            'Modules/indexeddb/IDBDatabaseException.h',
+            'Modules/indexeddb/IDBEventDispatcher.cpp',
+            'Modules/indexeddb/IDBEventDispatcher.h',
+            'Modules/indexeddb/IDBFactory.cpp',
+            'Modules/indexeddb/IDBFactory.h',
+            'Modules/indexeddb/IDBFactoryBackendImpl.cpp',
+            'Modules/indexeddb/IDBFactoryBackendImpl.h',
+            'Modules/indexeddb/IDBFactoryBackendInterface.cpp',
+            'Modules/indexeddb/IDBFactoryBackendInterface.h',
+            'Modules/indexeddb/IDBIndex.cpp',
+            'Modules/indexeddb/IDBIndex.h',
+            'Modules/indexeddb/IDBIndexBackendImpl.cpp',
+            'Modules/indexeddb/IDBIndexBackendImpl.h',
+            'Modules/indexeddb/IDBIndexBackendInterface.h',
+            'Modules/indexeddb/IDBKey.cpp',
+            'Modules/indexeddb/IDBKey.h',
+            'Modules/indexeddb/IDBKeyPath.cpp',
+            'Modules/indexeddb/IDBKeyPath.h',
+            'Modules/indexeddb/IDBKeyPathBackendImpl.cpp',
+            'Modules/indexeddb/IDBKeyPathBackendImpl.h',
+            'Modules/indexeddb/IDBKeyRange.cpp',
+            'Modules/indexeddb/IDBKeyRange.h',
+            'Modules/indexeddb/IDBLevelDBCoding.cpp',
+            'Modules/indexeddb/IDBLevelDBCoding.h',
+            'Modules/indexeddb/IDBLevelDBBackingStore.cpp',
+            'Modules/indexeddb/IDBLevelDBBackingStore.h',
+            'Modules/indexeddb/IDBObjectStore.cpp',
+            'Modules/indexeddb/IDBObjectStore.h',
+            'Modules/indexeddb/IDBObjectStoreBackendImpl.cpp',
+            'Modules/indexeddb/IDBObjectStoreBackendImpl.h',
+            'Modules/indexeddb/IDBObjectStoreBackendInterface.h',
+            'Modules/indexeddb/IDBPendingTransactionMonitor.cpp',
+            'Modules/indexeddb/IDBPendingTransactionMonitor.h',
+            'Modules/indexeddb/IDBRequest.cpp',
+            'Modules/indexeddb/IDBRequest.h',
+            'Modules/indexeddb/IDBTracing.h',
+            'Modules/indexeddb/IDBTransaction.cpp',
+            'Modules/indexeddb/IDBTransaction.h',
+            'Modules/indexeddb/IDBTransactionBackendImpl.cpp',
+            'Modules/indexeddb/IDBTransactionBackendImpl.h',
+            'Modules/indexeddb/IDBTransactionBackendInterface.h',
+            'Modules/indexeddb/IDBTransactionCallbacks.h',
+            'Modules/indexeddb/IDBTransactionCoordinator.cpp',
+            'Modules/indexeddb/IDBTransactionCoordinator.h',
+            'Modules/indexeddb/IDBVersionChangeEvent.cpp',
+            'Modules/indexeddb/IDBVersionChangeEvent.h',
+            'Modules/indexeddb/IDBVersionChangeRequest.cpp',
+            'Modules/indexeddb/IDBVersionChangeRequest.h',
+            'Modules/indexeddb/PageGroupIndexedDatabase.cpp',
+            'Modules/indexeddb/PageGroupIndexedDatabase.h',
+            'Modules/indexeddb/WorkerContextIndexedDatabase.cpp',
+            'Modules/indexeddb/WorkerContextIndexedDatabase.h',
             'Modules/intents/Intent.cpp',
             'Modules/intents/Intent.h',
             'Modules/intents/IntentRequest.cpp',
@@ -1299,6 +1384,118 @@
             'Modules/intents/IntentResultCallback.h',
             'Modules/intents/NavigatorIntents.cpp',
             'Modules/intents/NavigatorIntents.h',
+            'Modules/mediastream/LocalMediaStream.cpp',
+            'Modules/mediastream/LocalMediaStream.h',
+            'Modules/mediastream/MediaStream.cpp',
+            'Modules/mediastream/MediaStream.h',
+            'Modules/mediastream/MediaStreamEvent.cpp',
+            'Modules/mediastream/MediaStreamEvent.h',
+            'Modules/mediastream/MediaStreamList.cpp',
+            'Modules/mediastream/MediaStreamList.h',
+            'Modules/mediastream/MediaStreamRegistry.cpp',
+            'Modules/mediastream/MediaStreamRegistry.h',
+            'Modules/mediastream/MediaStreamTrack.cpp',
+            'Modules/mediastream/MediaStreamTrack.h',
+            'Modules/mediastream/MediaStreamTrackList.cpp',
+            'Modules/mediastream/MediaStreamTrackList.h',
+            'Modules/mediastream/NavigatorMediaStream.cpp',
+            'Modules/mediastream/NavigatorMediaStream.h',
+            'Modules/mediastream/NavigatorUserMediaError.h',
+            'Modules/mediastream/NavigatorUserMediaErrorCallback.h',
+            'Modules/mediastream/NavigatorUserMediaSuccessCallback.h',
+            'Modules/mediastream/PeerConnection.cpp',
+            'Modules/mediastream/PeerConnection.h',
+            'Modules/mediastream/SignalingCallback.h',
+            'Modules/mediastream/UserMediaClient.h',
+            'Modules/mediastream/UserMediaController.h',
+            'Modules/mediastream/UserMediaController.cpp',
+            'Modules/mediastream/UserMediaRequest.cpp',
+            'Modules/mediastream/UserMediaRequest.h',
+            'Modules/speech/SpeechGrammar.cpp',
+            'Modules/speech/SpeechGrammar.h',
+            'Modules/speech/SpeechGrammarList.cpp',
+            'Modules/speech/SpeechGrammarList.h',
+            'Modules/speech/SpeechRecognitionAlternative.cpp',
+            'Modules/speech/SpeechRecognitionAlternative.h',
+            'Modules/speech/SpeechRecognitionError.cpp',
+            'Modules/speech/SpeechRecognitionError.h',
+            'Modules/speech/SpeechRecognitionEvent.cpp',
+            'Modules/speech/SpeechRecognitionEvent.h',
+            'Modules/speech/SpeechRecognitionResult.cpp',
+            'Modules/speech/SpeechRecognitionResult.h',
+            'Modules/speech/SpeechRecognitionResultList.cpp',
+            'Modules/speech/SpeechRecognitionResultList.h',
+            'Modules/webdatabase/AbstractDatabase.cpp',
+            'Modules/webdatabase/ChangeVersionWrapper.cpp',
+            'Modules/webdatabase/ChangeVersionWrapper.h',
+            'Modules/webdatabase/Database.cpp',
+            'Modules/webdatabase/DatabaseAuthorizer.cpp',
+            'Modules/webdatabase/DatabaseAuthorizer.h',
+            'Modules/webdatabase/DatabaseCallback.h',
+            'Modules/webdatabase/DatabaseContext.cpp',
+            'Modules/webdatabase/DatabaseContext.h',
+            'Modules/webdatabase/DatabaseSync.cpp',
+            'Modules/webdatabase/DatabaseSync.h',
+            'Modules/webdatabase/DatabaseTask.cpp',
+            'Modules/webdatabase/DatabaseTask.h',
+            'Modules/webdatabase/DatabaseThread.cpp',
+            'Modules/webdatabase/DatabaseThread.h',
+            'Modules/webdatabase/DatabaseTracker.cpp',
+            'Modules/webdatabase/DOMWindowSQLDatabase.cpp',
+            'Modules/webdatabase/DOMWindowSQLDatabase.h',
+            'Modules/webdatabase/OriginQuotaManager.cpp',
+            'Modules/webdatabase/OriginQuotaManager.h',
+            'Modules/webdatabase/OriginUsageRecord.cpp',
+            'Modules/webdatabase/OriginUsageRecord.h',
+            'Modules/webdatabase/SQLCallbackWrapper.h',
+            'Modules/webdatabase/SQLException.cpp',
+            'Modules/webdatabase/SQLException.h',
+            'Modules/webdatabase/SQLResultSet.cpp',
+            'Modules/webdatabase/SQLResultSetRowList.cpp',
+            'Modules/webdatabase/SQLStatement.cpp',
+            'Modules/webdatabase/SQLStatementSync.cpp',
+            'Modules/webdatabase/SQLStatementSync.h',
+            'Modules/webdatabase/SQLTransaction.cpp',
+            'Modules/webdatabase/SQLTransactionClient.cpp',
+            'Modules/webdatabase/SQLTransactionClient.h',
+            'Modules/webdatabase/SQLTransactionCoordinator.cpp',
+            'Modules/webdatabase/SQLTransactionCoordinator.h',
+            'Modules/webdatabase/SQLTransactionSync.cpp',
+            'Modules/webdatabase/SQLTransactionSync.h',
+            'Modules/webdatabase/SQLTransactionSyncCallback.h',
+            'Modules/webdatabase/WorkerContextSQLDatabase.cpp',
+            'Modules/webdatabase/WorkerContextSQLDatabase.h',
+            'Modules/webdatabase/chromium/DatabaseObserver.h',
+            'Modules/webdatabase/chromium/DatabaseTrackerChromium.cpp',
+            'Modules/webdatabase/chromium/QuotaTracker.cpp',
+            'Modules/webdatabase/chromium/QuotaTracker.h',
+            'Modules/webdatabase/chromium/SQLTransactionClientChromium.cpp',
+            'Modules/websockets/CloseEvent.h',
+            'Modules/websockets/ThreadableWebSocketChannel.cpp',
+            'Modules/websockets/ThreadableWebSocketChannel.h',
+            'Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp',
+            'Modules/websockets/ThreadableWebSocketChannelClientWrapper.h',
+            'Modules/websockets/WebSocket.cpp',
+            'Modules/websockets/WebSocket.h',
+            'Modules/websockets/WebSocketChannel.cpp',
+            'Modules/websockets/WebSocketChannel.h',
+            'Modules/websockets/WebSocketChannelClient.h',
+            'Modules/websockets/WebSocketDeflateFramer.cpp',
+            'Modules/websockets/WebSocketDeflateFramer.h',
+            'Modules/websockets/WebSocketDeflater.cpp',
+            'Modules/websockets/WebSocketDeflater.h',
+            'Modules/websockets/WebSocketExtensionDispatcher.cpp',
+            'Modules/websockets/WebSocketExtensionDispatcher.h',
+            'Modules/websockets/WebSocketExtensionProcessor.h',
+            'Modules/websockets/WebSocketFrame.h',
+            'Modules/websockets/WebSocketHandshake.cpp',
+            'Modules/websockets/WebSocketHandshake.h',
+            'Modules/websockets/WebSocketHandshakeRequest.cpp',
+            'Modules/websockets/WebSocketHandshakeRequest.h',
+            'Modules/websockets/WebSocketHandshakeResponse.cpp',
+            'Modules/websockets/WebSocketHandshakeResponse.h',
+            'Modules/websockets/WorkerThreadableWebSocketChannel.cpp',
+            'Modules/websockets/WorkerThreadableWebSocketChannel.h',
             'accessibility/AXObjectCache.cpp',
             'accessibility/AccessibilityARIAGrid.cpp',
             'accessibility/AccessibilityARIAGrid.h',
@@ -1837,7 +2034,6 @@
             'bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp',
             'bindings/v8/custom/V8DocumentCustom.cpp',
             'bindings/v8/custom/V8DocumentLocationCustom.cpp',
-            'bindings/v8/custom/V8ElementCustom.cpp',
             'bindings/v8/custom/V8EntryCustom.cpp',
             'bindings/v8/custom/V8EntrySyncCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
@@ -2108,6 +2304,8 @@
             'css/StyleMedia.h',
             'css/StylePropertySet.cpp',
             'css/StylePropertySet.h',
+            'css/StyleRule.cpp',
+            'css/StyleRule.h',
             'css/StyleSheet.cpp',
             'css/StyleSheet.h',
             'css/StyleSheetList.cpp',
@@ -2225,6 +2423,8 @@
             'editing/qt/SmartReplaceQt.cpp',
             'editing/visible_units.cpp',
             'editing/wx/EditorWx.cpp',
+            'fileapi/AsyncFileStream.cpp',
+            'fileapi/AsyncFileStream.h',
             'fileapi/AsyncFileWriter.h',
             'fileapi/AsyncFileWriterClient.h',
             'fileapi/Blob.cpp',
@@ -2282,8 +2482,6 @@
             'fileapi/FileReaderLoaderClient.h',
             'fileapi/FileReaderSync.cpp',
             'fileapi/FileReaderSync.h',
-            'fileapi/FileStreamProxy.cpp',
-            'fileapi/FileStreamProxy.h',
             'fileapi/FileSystemCallback.h',
             'fileapi/FileSystemCallbacks.cpp',
             'fileapi/FileSystemCallbacks.h',
@@ -2299,6 +2497,8 @@
             'fileapi/FileWriterSync.cpp',
             'fileapi/FileWriterSync.h',
             'fileapi/WebKitFlags.h',
+            'fileapi/WorkerContextFileSystem.cpp',
+            'fileapi/WorkerContextFileSystem.h',
             'fileapi/LocalFileSystem.cpp',
             'fileapi/LocalFileSystem.h',
             'fileapi/Metadata.h',
@@ -2580,33 +2780,6 @@
             'mathml/MathMLMathElement.h',
             'mathml/MathMLTextElement.cpp',
             'mathml/MathMLTextElement.h',
-            'mediastream/LocalMediaStream.cpp',
-            'mediastream/LocalMediaStream.h',
-            'mediastream/MediaStream.cpp',
-            'mediastream/MediaStream.h',
-            'mediastream/MediaStreamEvent.cpp',
-            'mediastream/MediaStreamEvent.h',
-            'mediastream/MediaStreamList.cpp',
-            'mediastream/MediaStreamList.h',
-            'mediastream/MediaStreamRegistry.cpp',
-            'mediastream/MediaStreamRegistry.h',
-            'mediastream/MediaStreamTrack.cpp',
-            'mediastream/MediaStreamTrack.h',
-            'mediastream/MediaStreamTrackList.cpp',
-            'mediastream/MediaStreamTrackList.h',
-            'mediastream/NavigatorMediaStream.cpp',
-            'mediastream/NavigatorMediaStream.h',
-            'mediastream/NavigatorUserMediaError.h',
-            'mediastream/NavigatorUserMediaErrorCallback.h',
-            'mediastream/NavigatorUserMediaSuccessCallback.h',
-            'mediastream/PeerConnection.cpp',
-            'mediastream/PeerConnection.h',
-            'mediastream/SignalingCallback.h',
-            'mediastream/UserMediaClient.h',
-            'mediastream/UserMediaController.h',
-            'mediastream/UserMediaController.cpp',
-            'mediastream/UserMediaRequest.cpp',
-            'mediastream/UserMediaRequest.h',
             'notifications/Notification.cpp',
             'notifications/Notification.h',
             'notifications/NotificationCenter.cpp',
@@ -2656,8 +2829,6 @@
             'page/NavigatorBase.h',
             'page/NavigatorRegisterProtocolHandler.cpp',
             'page/NavigatorRegisterProtocolHandler.h',
-            'page/NavigatorSupplement.cpp',
-            'page/NavigatorSupplement.h',
             'page/OriginAccessEntry.cpp',
             'page/OriginAccessEntry.h',
             'page/Page.cpp',
@@ -2665,7 +2836,6 @@
             'page/PageGroupLoadDeferrer.cpp',
             'page/PageGroupLoadDeferrer.h',
             'page/PageSerializer.cpp',
-            'page/PageSupplement.cpp',
             'page/PageVisibilityState.cpp',
             'page/Performance.cpp',
             'page/Performance.h',
@@ -2745,6 +2915,8 @@
             'page/wince/FrameWinCE.cpp',
             'page/wx/DragControllerWx.cpp',
             'page/wx/EventHandlerWx.cpp',
+            'platform/ActivePlatformGestureAnimation.cpp',
+            'platform/ActivePlatformGestureAnimation.h',
             'platform/Arena.cpp',
             'platform/Arena.h',
             'platform/AsyncFileSystem.cpp',
@@ -2790,6 +2962,7 @@
             'platform/MemoryPressureHandler.cpp',
             'platform/MIMETypeRegistry.cpp',
             'platform/Pasteboard.h',
+            'platform/PlatformGestureCurve.h',
             'platform/PlatformStrategies.cpp',
             'platform/PlatformTouchEvent.h',
             'platform/PlatformTouchPoint.h',
@@ -2821,8 +2994,12 @@
             'platform/ThreadTimers.cpp',
             'platform/ThreadTimers.h',
             'platform/Timer.cpp',
+            'platform/TouchFlingPlatformGestureCurve.cpp',
+            'platform/TouchFlingPlatformGestureCurve.h',
             'platform/UUID.cpp',
             'platform/UUID.h',
+            'platform/WheelFlingPlatformGestureCurve.cpp',
+            'platform/WheelFlingPlatformGestureCurve.h',
             'platform/Widget.cpp',
             'platform/animation/Animation.cpp',
             'platform/animation/AnimationList.cpp',
@@ -3049,6 +3226,8 @@
             'platform/graphics/FontFastPath.cpp',
             'platform/graphics/FontPlatformData.cpp',
             'platform/graphics/FontPlatformData.h',
+            'platform/graphics/FractionalLayoutRect.cpp',
+            'platform/graphics/FractionalLayoutSize.cpp',
             'platform/graphics/GeneratorGeneratedImage.cpp',
             'platform/graphics/GeneratedImage.h',
             'platform/graphics/GlyphPageTreeNode.cpp',
@@ -3207,6 +3386,8 @@
             'platform/graphics/chromium/LayerTextureSubImage.h',
             'platform/graphics/chromium/LayerTextureUpdater.h',
             'platform/graphics/chromium/MediaPlayerPrivateChromium.h',
+            'platform/graphics/chromium/ScrollbarLayerChromium.cpp',
+            'platform/graphics/chromium/ScrollbarLayerChromium.h',
             'platform/graphics/chromium/SolidColorLayerChromium.cpp',
             'platform/graphics/chromium/SolidColorLayerChromium.h',
             'platform/graphics/chromium/PlatformCanvas.cpp',
@@ -3253,9 +3434,12 @@
             'platform/graphics/chromium/WebGLLayerChromium.h',
             'platform/graphics/chromium/cc/CCActiveAnimation.cpp',
             'platform/graphics/chromium/cc/CCActiveAnimation.h',
+            'platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp',
+            'platform/graphics/chromium/cc/CCActiveGestureAnimation.h',
             'platform/graphics/chromium/cc/CCAnimationCurve.cpp',
             'platform/graphics/chromium/cc/CCAnimationCurve.h',
-            'platform/graphics/chromium/cc/CCAnimationResults.h',
+            'platform/graphics/chromium/cc/CCAnimationEvents.cpp',
+            'platform/graphics/chromium/cc/CCAnimationEvents.h',
             'platform/graphics/chromium/cc/CCCanvasDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCCanvasDrawQuad.h',
             'platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp',
@@ -3270,6 +3454,7 @@
             'platform/graphics/chromium/cc/CCDrawQuad.h',
             'platform/graphics/chromium/cc/CCFrameRateController.cpp',
             'platform/graphics/chromium/cc/CCFrameRateController.h',
+            'platform/graphics/chromium/cc/CCGestureCurve.h',
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp',
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.h',
             'platform/graphics/chromium/cc/CCInputHandler.h',
@@ -3279,6 +3464,7 @@
             'platform/graphics/chromium/cc/CCLayerAnimationController.cpp',
             'platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h',
             'platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp',
+            'platform/graphics/chromium/cc/CCLayerAnimationDelegate.h',
             'platform/graphics/chromium/cc/CCLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerImpl.h',
             'platform/graphics/chromium/cc/CCLayerIterator.cpp',
@@ -3320,6 +3506,8 @@
             'platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp',
             'platform/graphics/chromium/cc/CCSchedulerStateMachine.h',
             'platform/graphics/chromium/cc/CCScopedThreadProxy.h',
+            'platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCScrollbarLayerImpl.h',
             'platform/graphics/chromium/cc/CCSharedQuadState.cpp',
             'platform/graphics/chromium/cc/CCSharedQuadState.h',
             'platform/graphics/chromium/cc/CCSingleThreadProxy.cpp',
@@ -3332,6 +3520,8 @@
             'platform/graphics/chromium/cc/CCTextureUpdater.h',
             'platform/graphics/chromium/cc/CCTileDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCTileDrawQuad.h',
+            'platform/graphics/chromium/cc/CCTimingFunction.cpp',
+            'platform/graphics/chromium/cc/CCTimingFunction.h',
             'platform/graphics/chromium/cc/CCThread.h',
             'platform/graphics/chromium/cc/CCThreadProxy.cpp',
             'platform/graphics/chromium/cc/CCThreadProxy.h',
@@ -3856,12 +4046,11 @@
             'platform/mac/Language.mm',
             'platform/mac/LocalCurrentGraphicsContext.h',
             'platform/mac/LocalCurrentGraphicsContext.mm',
-            'platform/mac/LocalizedStringsMac.mm',
+            'platform/mac/LocalizedStringsMac.cpp',
             'platform/mac/LoggingMac.mm',
             'platform/mac/MIMETypeRegistryMac.mm',
             'platform/mac/NSScrollerImpDetails.h',
             'platform/mac/NSScrollerImpDetails.mm',
-            'platform/mac/PasteboardHelper.h',
             'platform/mac/PasteboardMac.mm',
             'platform/mac/PlatformClockCA.cpp',
             'platform/mac/PlatformScreenMac.mm',
@@ -4068,14 +4257,11 @@
             'platform/qt/PlatformTouchEventQt.cpp',
             'platform/qt/PlatformTouchPointQt.cpp',
             'platform/qt/QWebPageClient.h',
-            'platform/qt/QtStyleOptionWebComboBox.h',
             'platform/qt/RenderThemeQt.cpp',
             'platform/qt/RenderThemeQt.h',
             'platform/qt/ScreenQt.cpp',
             'platform/qt/ScrollViewQt.cpp',
-            'platform/qt/ScrollbarQt.cpp',
             'platform/qt/ScrollbarThemeQt.cpp',
-            'platform/qt/ScrollbarThemeQt.h',
             'platform/qt/SharedBufferQt.cpp',
             'platform/qt/SharedTimerQt.cpp',
             'platform/qt/SoundQt.cpp',
@@ -4106,6 +4292,7 @@
             'platform/text/LocalizedDateNone.cpp',
             'platform/text/LocalizedNumber.h',
             'platform/text/LocalizedNumberICU.cpp',
+            'platform/text/LocalizedNumberICU.h',
             'platform/text/LocalizedNumberNone.cpp',
             'platform/text/ParserUtilities.h',
             'platform/text/QuotedPrintable.h',
@@ -4362,8 +4549,6 @@
             'rendering/RenderCounter.h',
             'rendering/RenderDeprecatedFlexibleBox.cpp',
             'rendering/RenderDeprecatedFlexibleBox.h',
-            'rendering/RenderDetails.cpp',
-            'rendering/RenderDetails.h',
             'rendering/RenderDetailsMarker.cpp',
             'rendering/RenderDetailsMarker.h',
             'rendering/RenderEmbeddedObject.cpp',
@@ -4445,8 +4630,6 @@
             'rendering/RenderSelectionInfo.h',
             'rendering/RenderSlider.cpp',
             'rendering/RenderSlider.h',
-            'rendering/RenderSummary.cpp',
-            'rendering/RenderSummary.h',
             'rendering/RenderTable.cpp',
             'rendering/RenderTable.h',
             'rendering/RenderTableCaption.cpp',
@@ -4546,6 +4729,7 @@
             'rendering/style/StyleFlexibleBoxData.cpp',
             'rendering/style/StyleGeneratedImage.cpp',
             'rendering/style/StyleGridData.cpp',
+            'rendering/style/StyleGridItemData.cpp',
             'rendering/style/StyleInheritedData.cpp',
             'rendering/style/StyleMarqueeData.cpp',
             'rendering/style/StyleMultiColData.cpp',
@@ -4572,6 +4756,8 @@
             'rendering/svg/SVGRenderSupport.h',
             'rendering/svg/SVGRenderTreeAsText.cpp',
             'rendering/svg/SVGRenderTreeAsText.h',
+            'rendering/svg/SVGRenderingContext.cpp',
+            'rendering/svg/SVGRenderingContext.h',
             'rendering/svg/SVGResources.cpp',
             'rendering/svg/SVGResources.h',
             'rendering/svg/SVGResourcesCache.cpp',
@@ -4579,8 +4765,6 @@
             'rendering/svg/SVGResourcesCycleSolver.h',
             'rendering/svg/SVGRootInlineBox.cpp',
             'rendering/svg/SVGRootInlineBox.h',
-            'rendering/svg/SVGShadowTreeElements.cpp',
-            'rendering/svg/SVGShadowTreeElements.h',
             'rendering/svg/SVGTextChunk.cpp',
             'rendering/svg/SVGTextChunk.h',
             'rendering/svg/SVGTextChunkBuilder.cpp',
@@ -4604,116 +4788,6 @@
             'rendering/svg/SVGTextQuery.h',
             'rendering/svg/SVGTextRunRenderingContext.cpp',
             'rendering/svg/SVGTextRunRenderingContext.h',
-            'storage/AbstractDatabase.cpp',
-            'storage/ChangeVersionWrapper.cpp',
-            'storage/ChangeVersionWrapper.h',
-            'storage/DOMWindowSQLDatabase.cpp',
-            'storage/DOMWindowSQLDatabase.h',
-            'storage/Database.cpp',
-            'storage/DatabaseAuthorizer.cpp',
-            'storage/DatabaseAuthorizer.h',
-            'storage/DatabaseCallback.h',
-            'storage/DatabaseSync.cpp',
-            'storage/DatabaseSync.h',
-            'storage/DatabaseTask.cpp',
-            'storage/DatabaseTask.h',
-            'storage/DatabaseThread.cpp',
-            'storage/DatabaseThread.h',
-            'storage/DatabaseTracker.cpp',
-            'storage/IDBAny.cpp',
-            'storage/IDBAny.h',
-            'storage/IDBBackingStore.h',
-            'storage/IDBCallbacks.h',
-            'storage/IDBCursor.cpp',
-            'storage/IDBCursor.h',
-            'storage/IDBCursorBackendImpl.cpp',
-            'storage/IDBCursorBackendImpl.h',
-            'storage/IDBCursorBackendInterface.h',
-            'storage/IDBCursorWithValue.cpp',
-            'storage/IDBCursorWithValue.h',
-            'storage/IDBDatabase.cpp',
-            'storage/IDBDatabase.h',
-            'storage/IDBDatabaseBackendImpl.cpp',
-            'storage/IDBDatabaseBackendImpl.h',
-            'storage/IDBDatabaseBackendInterface.h',
-            'storage/IDBDatabaseCallbacks.h',
-            'storage/IDBDatabaseCallbacks.h',
-            'storage/IDBDatabaseCallbacksImpl.cpp',
-            'storage/IDBDatabaseCallbacksImpl.h',
-            'storage/IDBDatabaseError.h',
-            'storage/IDBDatabaseException.cpp',
-            'storage/IDBDatabaseException.h',
-            'storage/IDBEventDispatcher.cpp',
-            'storage/IDBEventDispatcher.h',
-            'storage/IDBFactory.cpp',
-            'storage/IDBFactory.h',
-            'storage/IDBFactoryBackendImpl.cpp',
-            'storage/IDBFactoryBackendImpl.h',
-            'storage/IDBFactoryBackendInterface.cpp',
-            'storage/IDBFactoryBackendInterface.h',
-            'storage/IDBIndex.cpp',
-            'storage/IDBIndex.h',
-            'storage/IDBIndexBackendImpl.cpp',
-            'storage/IDBIndexBackendImpl.h',
-            'storage/IDBIndexBackendInterface.h',
-            'storage/IDBKey.cpp',
-            'storage/IDBKey.h',
-            'storage/IDBKeyPath.cpp',
-            'storage/IDBKeyPath.h',
-            'storage/IDBKeyPathBackendImpl.cpp',
-            'storage/IDBKeyPathBackendImpl.h',
-            'storage/IDBKeyRange.cpp',
-            'storage/IDBKeyRange.h',
-            'storage/IDBLevelDBCoding.cpp',
-            'storage/IDBLevelDBCoding.h',
-            'storage/IDBLevelDBBackingStore.cpp',
-            'storage/IDBLevelDBBackingStore.h',
-            'storage/IDBObjectStore.cpp',
-            'storage/IDBObjectStore.h',
-            'storage/IDBObjectStoreBackendImpl.cpp',
-            'storage/IDBObjectStoreBackendImpl.h',
-            'storage/IDBObjectStoreBackendInterface.h',
-            'storage/IDBPendingTransactionMonitor.cpp',
-            'storage/IDBPendingTransactionMonitor.h',
-            'storage/IDBRequest.cpp',
-            'storage/IDBRequest.h',
-            'storage/IDBTracing.h',
-            'storage/IDBTransaction.cpp',
-            'storage/IDBTransaction.h',
-            'storage/IDBTransactionBackendImpl.cpp',
-            'storage/IDBTransactionBackendImpl.h',
-            'storage/IDBTransactionBackendInterface.h',
-            'storage/IDBTransactionCallbacks.h',
-            'storage/IDBTransactionCoordinator.cpp',
-            'storage/IDBTransactionCoordinator.h',
-            'storage/IDBVersionChangeEvent.cpp',
-            'storage/IDBVersionChangeEvent.h',
-            'storage/IDBVersionChangeRequest.cpp',
-            'storage/IDBVersionChangeRequest.h',
-            'storage/StorageTask.cpp',
-            'storage/StorageTask.h',
-            'storage/StorageThread.cpp',
-            'storage/StorageThread.h',
-            'storage/OriginQuotaManager.cpp',
-            'storage/OriginQuotaManager.h',
-            'storage/OriginUsageRecord.cpp',
-            'storage/OriginUsageRecord.h',
-            'storage/SQLCallbackWrapper.h',
-            'storage/SQLException.cpp',
-            'storage/SQLException.h',
-            'storage/SQLResultSet.cpp',
-            'storage/SQLResultSetRowList.cpp',
-            'storage/SQLStatement.cpp',
-            'storage/SQLStatementSync.cpp',
-            'storage/SQLStatementSync.h',
-            'storage/SQLTransaction.cpp',
-            'storage/SQLTransactionClient.cpp',
-            'storage/SQLTransactionClient.h',
-            'storage/SQLTransactionCoordinator.cpp',
-            'storage/SQLTransactionCoordinator.h',
-            'storage/SQLTransactionSync.cpp',
-            'storage/SQLTransactionSync.h',
-            'storage/SQLTransactionSyncCallback.h',
             'storage/Storage.cpp',
             'storage/Storage.h',
             'storage/StorageArea.h',
@@ -4738,14 +4812,13 @@
             'storage/StorageNamespaceImpl.h',
             'storage/StorageSyncManager.cpp',
             'storage/StorageSyncManager.h',
+            'storage/StorageTask.cpp',
+            'storage/StorageTask.h',
+            'storage/StorageThread.cpp',
+            'storage/StorageThread.h',
             'storage/StorageTracker.cpp',
-            'storage/chromium/DatabaseObserver.h',
-            'storage/chromium/DatabaseTrackerChromium.cpp',
             'storage/chromium/IDBFactoryBackendInterface.cpp',
             'storage/chromium/IDBKeyPathBackendImpl.cpp',
-            'storage/chromium/QuotaTracker.cpp',
-            'storage/chromium/QuotaTracker.h',
-            'storage/chromium/SQLTransactionClientChromium.cpp',
             'storage/wince/DatabaseThreadWinCE.cpp',
             'storage/wince/DatabaseThreadWinCE.h',
             'storage/wince/StorageThreadWinCE.cpp',
@@ -4827,30 +4900,6 @@
             'webaudio/WaveShaperNode.h',
             'webaudio/WaveShaperProcessor.cpp',
             'webaudio/WaveShaperProcessor.h',
-            'websockets/CloseEvent.h',
-            'websockets/ThreadableWebSocketChannel.cpp',
-            'websockets/ThreadableWebSocketChannel.h',
-            'websockets/ThreadableWebSocketChannelClientWrapper.cpp',
-            'websockets/ThreadableWebSocketChannelClientWrapper.h',
-            'websockets/WebSocket.cpp',
-            'websockets/WebSocket.h',
-            'websockets/WebSocketChannel.cpp',
-            'websockets/WebSocketChannel.h',
-            'websockets/WebSocketChannelClient.h',
-            'websockets/WebSocketDeflater.cpp',
-            'websockets/WebSocketDeflater.h',
-            'websockets/WebSocketExtensionDispatcher.cpp',
-            'websockets/WebSocketExtensionDispatcher.h',
-            'websockets/WebSocketExtensionProcessor.h',
-            'websockets/WebSocketFrame.h',
-            'websockets/WebSocketHandshake.cpp',
-            'websockets/WebSocketHandshake.h',
-            'websockets/WebSocketHandshakeRequest.cpp',
-            'websockets/WebSocketHandshakeRequest.h',
-            'websockets/WebSocketHandshakeResponse.cpp',
-            'websockets/WebSocketHandshakeResponse.h',
-            'websockets/WorkerThreadableWebSocketChannel.cpp',
-            'websockets/WorkerThreadableWebSocketChannel.h',
             'workers/AbstractWorker.cpp',
             'workers/AbstractWorker.h',
             'workers/DedicatedWorkerContext.cpp',
@@ -4999,6 +5048,7 @@
             'dom/CompositionEvent.h',
             'dom/ContainerNode.cpp',
             'dom/ContainerNodeAlgorithms.h',
+            'dom/ContextDestructionObserver.cpp',
             'dom/CrossThreadTask.h',
             'dom/CustomEvent.cpp',
             'dom/CustomEvent.h',
@@ -5128,6 +5178,8 @@
             'dom/Range.cpp',
             'dom/RangeException.cpp',
             'dom/RangeException.h',
+            'dom/RegionNodeList.cpp',
+            'dom/RegionNodeList.h',
             'dom/RawDataDocumentParser.h',
             'dom/RegisteredEventListener.cpp',
             'dom/RequestAnimationFrameCallback.h',
@@ -5147,8 +5199,8 @@
             'dom/SelectorQuery.h',
             'dom/ShadowRoot.cpp',
             'dom/ShadowRoot.h',
-            'dom/ShadowRootList.cpp',
-            'dom/ShadowRootList.h',
+            'dom/ShadowTree.cpp',
+            'dom/ShadowTree.h',
             'dom/SpaceSplitString.cpp',
             'dom/StaticHashSetNodeList.cpp',
             'dom/StaticHashSetNodeList.h',
@@ -5207,6 +5259,8 @@
             'html/BaseButtonInputType.h',
             'html/BaseCheckableInputType.cpp',
             'html/BaseCheckableInputType.h',
+            'html/BaseClickableWithKeyInputType.cpp',
+            'html/BaseClickableWithKeyInputType.h',
             'html/BaseDateAndTimeInputType.cpp',
             'html/BaseDateAndTimeInputType.h',
             'html/BaseTextInputType.cpp',
@@ -5407,6 +5461,7 @@
             'html/ImageInputType.cpp',
             'html/ImageInputType.h',
             'html/InputType.cpp',
+            'html/LabelableElement.cpp',
             'html/LabelsNodeList.cpp',
             'html/LabelsNodeList.h',
             'html/LinkRelAttribute.cpp',
@@ -5479,6 +5534,8 @@
             'html/canvas/CheckedInt.h',
             'html/canvas/DataView.cpp',
             'html/canvas/DataView.h',
+            'html/canvas/EXTTextureFilterAnisotropic.cpp',
+            'html/canvas/EXTTextureFilterAnisotropic.h',
             'html/canvas/OESStandardDerivatives.cpp',
             'html/canvas/OESStandardDerivatives.h',
             'html/canvas/OESTextureFloat.cpp',
@@ -5665,8 +5722,6 @@
             'rendering/svg/RenderSVGResourceSolidColor.h',
             'rendering/svg/RenderSVGRoot.cpp',
             'rendering/svg/RenderSVGRoot.h',
-            'rendering/svg/RenderSVGShadowTreeRootContainer.cpp',
-            'rendering/svg/RenderSVGShadowTreeRootContainer.h',
             'rendering/svg/RenderSVGShape.cpp',
             'rendering/svg/RenderSVGShape.h',
             'rendering/svg/RenderSVGTSpan.cpp',
@@ -5694,6 +5749,8 @@
             'rendering/svg/SVGRenderSupport.h',
             'rendering/svg/SVGRenderTreeAsText.cpp',
             'rendering/svg/SVGRenderTreeAsText.h',
+            'rendering/svg/SVGRenderingContext.cpp',
+            'rendering/svg/SVGRenderingContext.h',
             'rendering/svg/SVGResources.cpp',
             'rendering/svg/SVGResources.h',
             'rendering/svg/SVGResourcesCache.cpp',
@@ -5701,8 +5758,6 @@
             'rendering/svg/SVGResourcesCycleSolver.h',
             'rendering/svg/SVGRootInlineBox.cpp',
             'rendering/svg/SVGRootInlineBox.h',
-            'rendering/svg/SVGShadowTreeElements.cpp',
-            'rendering/svg/SVGShadowTreeElements.h',
             'rendering/svg/SVGTextChunk.cpp',
             'rendering/svg/SVGTextChunk.h',
             'rendering/svg/SVGTextChunkBuilder.cpp',
@@ -6219,6 +6274,7 @@
             'inspector/front-end/Script.js',
             'inspector/front-end/ScriptFormatter.js',
             'inspector/front-end/ScriptFormatterWorker.js',
+            'inspector/front-end/ScriptMapping.js',
             'inspector/front-end/ScriptsNavigator.js',
             'inspector/front-end/ScriptsPanel.js',
             'inspector/front-end/ScriptsSearchScope.js',
@@ -6248,8 +6304,9 @@
             'inspector/front-end/TextEditorModel.js',
             'inspector/front-end/TextPrompt.js',
             'inspector/front-end/TextViewer.js',
-            'inspector/front-end/TimelineAgent.js',
             'inspector/front-end/TimelineManager.js',
+            'inspector/front-end/TimelineModel.js',
+            'inspector/front-end/TimelinePresentationModel.js',
             'inspector/front-end/TimelineOverviewPane.js',
             'inspector/front-end/TimelineGrid.js',
             'inspector/front-end/TimelinePanel.js',
@@ -7166,6 +7223,8 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSErrorCallback.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSErrorEvent.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSErrorEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEXTTextureFilterAnisotropic.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEXTTextureFilterAnisotropic.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEvent.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEventException.cpp',
diff --git a/Source/WebCore/WebCore.order b/Source/WebCore/WebCore.order
index 952c2992b..0cbed9ef6 100644
--- a/Source/WebCore/WebCore.order
+++ b/Source/WebCore/WebCore.order
@@ -78,7 +78,6 @@ __ZN7WebCore12IconDatabase21wasExcludedFromBackupEv
 __ZN7WebCore12IconDatabase8importedEv
 __ZN7WebCore12IconDatabase16performURLImportEv
 __ZN7WebCore15SQLiteStatement13getColumnTextEi
-__ZN7WebCore22protocolIsInHTTPFamilyERKN3WTF6StringE
 __ZN7WebCore13PageURLRecordC1ERKN3WTF6StringE
 __ZN7WebCore12IconDatabase21getOrCreateIconRecordERKN3WTF6StringE
 __ZN7WebCore10IconRecordC1ERKN3WTF6StringE
@@ -19684,7 +19683,6 @@ __ZN7WebCore23jsHTMLAnchorElementHashEPN3JSC9ExecStateENS0_7JSValueERKNS0_10Iden
 __ZNK7WebCore17HTMLAnchorElement4hashEv
 __ZN7WebCore48jsHTMLAnchorElementPrototypeFunctionGetParameterEPN3JSC9ExecStateE
 __ZNK7WebCore17HTMLAnchorElement12getParameterERKN3WTF6StringE
-__ZNK7WebCore4KURL17copyParsedQueryToERN3WTF7HashMapINS1_6StringES3_NS1_10StringHashENS1_10HashTraitsIS3_EES6_EE
 __ZN7WebCore25jsHTMLAnchorElementOriginEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
 __ZNK7WebCore17HTMLAnchorElement6originEv
 __ZN7WebCore23jsHTMLAnchorElementTextEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index af9941a25..bdcd10780 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -19,6 +19,9 @@ WEBCORE_GENERATED_SOURCES_DIR = $${ROOT_BUILD_DIR}/Source/WebCore/$${GENERATED_S
 INCLUDEPATH += \
     $$SOURCE_DIR \
     $$SOURCE_DIR/Modules/geolocation \
+    $$SOURCE_DIR/Modules/indexeddb \
+    $$SOURCE_DIR/Modules/webdatabase \
+    $$SOURCE_DIR/Modules/websockets \
     $$SOURCE_DIR/accessibility \
     $$SOURCE_DIR/bindings \
     $$SOURCE_DIR/bindings/generic \
@@ -182,18 +185,21 @@ contains(DEFINES, ENABLE_WEBGL=1) {
     !contains(QT_CONFIG, opengl) {
         error( "This configuration needs an OpenGL enabled Qt. Your Qt is missing OpenGL.")
     }
-    QT *= opengl
 }
 
 contains(CONFIG, texmap) {
     DEFINES += WTF_USE_TEXTURE_MAPPER=1
     !win32-*:contains(QT_CONFIG, opengl) {
-        DEFINES += WTF_USE_TEXTURE_MAPPER_GL
-        QT *= opengl
+        DEFINES += WTF_USE_TEXTURE_MAPPER_GL=1
         contains(QT_CONFIG, opengles2): LIBS += -lEGL
     }
 }
 
+contains(DEFINES, WTF_USE_TEXTURE_MAPPER_GL=1)|contains(DEFINES, ENABLE_WEBGL=1) {
+    # Only Qt 4 needs the opengl module, for Qt 5 everything we need is part of QtGui.
+    haveQt(4): QT *= opengl
+}
+
 !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
     INCLUDEPATH += $${SQLITE3SRCDIR}
     DEFINES += SQLITE_CORE SQLITE_OMIT_LOAD_EXTENSION SQLITE_OMIT_COMPLETE
@@ -203,6 +209,28 @@ contains(CONFIG, texmap) {
     LIBS += -lsqlite3
 }
 
+contains(DEFINES, WTF_USE_QT_IMAGE_DECODER=0) {
+    INCLUDEPATH += \
+        $$SOURCE_DIR/platform/image-decoders/bmp \
+        $$SOURCE_DIR/platform/image-decoders/gif \
+        $$SOURCE_DIR/platform/image-decoders/ico \
+        $$SOURCE_DIR/platform/image-decoders/jpeg \
+        $$SOURCE_DIR/platform/image-decoders/png
+
+    haveQt(5) {
+        # Qt5 allows us to use config tests to check for the presence of these libraries
+        !contains(config_test_libjpeg, yes): error("JPEG library not found!")
+        !contains(config_test_libpng, yes): error("PNG 1.2 library not found!")
+    }
+
+    LIBS += -ljpeg -lpng12
+
+    contains(DEFINES, WTF_USE_WEBP=1) {
+        INCLUDEPATH += $$SOURCE_DIR/platform/image-decoders/webp
+        LIBS += -lwebp
+    }
+}
+
 win32-*|wince* {
     DLLDESTDIR = $${ROOT_BUILD_DIR}/bin
 
diff --git a/Source/WebCore/WebCore.vcproj/MigrateScripts b/Source/WebCore/WebCore.vcproj/MigrateScripts
index 4cdb17314..9cb049552 100644
--- a/Source/WebCore/WebCore.vcproj/MigrateScripts
+++ b/Source/WebCore/WebCore.vcproj/MigrateScripts
@@ -31,7 +31,7 @@ all : \
     $(WEBKIT_OUTPUT)/IDLStructure.pm \
     $(WEBKIT_OUTPUT)/generate-bindings.pl \
     $(WEBKIT_OUTPUT)/preprocessor.pm \
-    $(WEBKIT_OUTPUT)/resolve-supplemental.pl \
+    $(WEBKIT_OUTPUT)/preprocess-idls.pl \
 #
 
 MIGRATE_CMD = cp $< $@
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index 19106c0e5..3ad09cf45 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -24109,6 +24109,510 @@
 					>
 				</File>
 			</Filter>
+			<Filter
+				Name="indexeddb"
+				>
+				<File
+					RelativePath="..\Modules\indexeddb\DOMWindowIndexedDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\DOMWindowIndexedDatabase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBAny.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBAny.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCallbacks.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCursor.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCursor.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCursorBackendImpl.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCursorBackendImpl.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCursorBackendInterface.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabaseBackendImpl.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabaseBackendImpl.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabaseBackendInterface.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabaseError.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabaseException.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactory.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactory.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactoryBackendImpl.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactoryBackendImpl.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactoryBackendInterface.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactoryBackendInterface.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBIndex.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBIndex.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBIndexBackendImpl.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBIndexBackendImpl.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBIndexBackendInterface.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBKey.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBKey.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBKeyRange.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBKeyRange.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBObjectStore.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBObjectStore.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBObjectStoreBackendImpl.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBObjectStoreBackendImpl.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBObjectStoreBackendInterface.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBRequest.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBRequest.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBTransaction.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBTransaction.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\PageGroupIndexedDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\PageGroupIndexedDatabase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\WorkerContextIndexedDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\WorkerContextIndexedDatabase.h"
+					>
+				</File>
+			</Filter>
+			<Filter
+				Name="webdatabase"
+				>
+				<File
+					RelativePath="..\Modules\webdatabase\AbstractDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\AbstractDatabase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\ChangeVersionWrapper.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\ChangeVersionWrapper.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\Database.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\Database.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseAuthorizer.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseAuthorizer.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseContext.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseContext.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseSync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseSync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseTask.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseTask.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseThread.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseThread.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseTracker.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseTracker.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DOMWindowSQLDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DOMWindowSQLDatabase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\OriginQuotaManager.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\OriginQuotaManager.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\OriginUsageRecord.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\OriginUsageRecord.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLCallbackWrapper.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLError.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLException.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLException.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLResultSet.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLResultSet.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLResultSetRowList.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLResultSetRowList.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatement.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatement.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatementCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatementErrorCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatementSync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatementSync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransaction.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransaction.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionClient.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionClient.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionCoordinator.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionCoordinator.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionErrorCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionSync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionSync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionSyncCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\WorkerContextSQLDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\WorkerContextSQLDatabase.h"
+					>
+				</File>
+			</Filter>
+			<Filter
+				Name="websockets"
+				>
+				<File
+					RelativePath="..\Modules\websockets\CloseEvent.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\ThreadableWebSocketChannel.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\ThreadableWebSocketChannel.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\ThreadableWebSocketChannelClientWrapper.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\ThreadableWebSocketChannelClientWrapper.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocket.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocket.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketChannel.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketChannel.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketChannelClient.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketDeflateFramer.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketDeflateFramer.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketDeflater.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketDeflater.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketExtensionDispatcher.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketExtensionDispatcher.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketExtensionProcessor.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketFrame.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshake.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshake.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshakeRequest.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshakeRequest.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshakeResponse.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshakeResponse.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WorkerThreadableWebSocketChannel.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WorkerThreadableWebSocketChannel.h"
+					>
+				</File>
+			</Filter>
 		</Filter>
 		<Filter
 			Name="accessibility"
@@ -25610,14 +26114,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\page\NavigatorSupplement.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\NavigatorSupplement.h"
-				>
-			</File>
-			<File
 				RelativePath="..\page\OriginAccessEntry.cpp"
 				>
 			</File>
@@ -25654,14 +26150,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\page\PageSupplement.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\PageSupplement.h"
-				>
-			</File>
-			<File
 				RelativePath="..\page\PageVisibilityState.cpp"
 				>
 			</File>
@@ -25710,6 +26198,18 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinator.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinator.h"
+				>
+			</File>
+			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinatorNone.cpp"
+				>
+			</File>
+			<File
 				RelativePath="..\page\SecurityOrigin.cpp"
 				>
 			</File>
@@ -25833,18 +26333,6 @@
 				RelativePath="..\page\WorkerNavigator.h"
 				>
 			</File>
-			<File
-				RelativePath="..\page\scrolling\ScrollingCoordinator.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\scrolling\ScrollingCoordinator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\scrolling\ScrollingCoordinatorNone.cpp"
-				>
-			</File>
 			<Filter
 				Name="win"
 				>
@@ -26299,14 +26787,82 @@
 				<File
 					RelativePath="..\loader\appcache\ApplicationCache.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\loader\appcache\ApplicationCache.h"
 					>
 				</File>
 				<File
+					RelativePath="..\loader\appcache\ApplicationCacheAllInOne.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
 					RelativePath="..\loader\appcache\ApplicationCacheGroup.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheGroup.h"
@@ -26315,6 +26871,22 @@
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheHost.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheHost.h"
@@ -26323,6 +26895,22 @@
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheResource.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheResource.h"
@@ -26331,6 +26919,22 @@
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheStorage.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheStorage.h"
@@ -26550,10 +27154,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\platform\AsyncFileStream.h"
-				>
-			</File>
-			<File
 				RelativePath="..\platform\AsyncFileSystem.cpp"
 				>
 			</File>
@@ -26950,6 +27550,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\platform\ScrollbarThemeClient.h"
+				>
+			</File>
+			<File
 				RelativePath="..\platform\ScrollbarThemeComposite.cpp"
 				>
 			</File>
@@ -27605,26 +28209,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\platform\graphics\FractionalLayoutRect.cpp"
-					>
-				</File>
-				<File
-					RelativePath="..\platform\graphics\FractionalLayoutRect.h"
-					>
-				</File>
-				<File
-					RelativePath="..\platform\graphics\FractionalLayoutSize.cpp"
-					>
-				</File>
-				<File
-					RelativePath="..\platform\graphics\FractionalLayoutSize.h"
-					>
-				</File>
-				<File
-					RelativePath="..\platform\graphics\FractionalLayoutPoint.h"
-					>
-				</File>
-				<File
 					RelativePath="..\platform\graphics\FloatPoint.cpp"
 					>
 				</File>
@@ -27753,6 +28337,26 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\graphics\FractionalLayoutPoint.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutRect.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutRect.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutSize.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutSize.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\graphics\GeneratedImage.h"
 					>
 				</File>
@@ -31729,8 +32333,60 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\text\TextAllInOne.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
 					RelativePath="..\platform\text\TextBoundaries.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextBoundaries.h"
@@ -31743,6 +32399,22 @@
 				<File
 					RelativePath="..\platform\text\TextBreakIteratorICU.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextBreakIteratorInternalICU.h"
@@ -31759,6 +32431,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodec.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodec.h"
@@ -31771,6 +32459,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodecICU.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodecICU.h"
@@ -31779,6 +32483,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodecLatin1.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodecLatin1.h"
@@ -31787,6 +32507,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodecUserDefined.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodecUserDefined.h"
@@ -31795,6 +32531,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodecUTF16.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodecUTF16.h"
@@ -31803,6 +32555,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodecUTF8.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodecUTF8.h"
@@ -31815,6 +32583,22 @@
 				<File
 					RelativePath="..\platform\text\TextEncoding.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextEncoding.h"
@@ -31827,10 +32611,42 @@
 				<File
 					RelativePath="..\platform\text\TextEncodingDetectorICU.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextEncodingRegistry.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextEncodingRegistry.h"
@@ -31839,6 +32655,22 @@
 				<File
 					RelativePath="..\platform\text\TextStream.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextStream.h"
@@ -35418,12 +36250,64 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\MediaAllInOne.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
 				RelativePath="..\css\mediaControls.css"
 				>
 			</File>
 			<File
 				RelativePath="..\css\MediaFeatureNames.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaFeatureNames.h"
@@ -35432,6 +36316,22 @@
 			<File
 				RelativePath="..\css\MediaList.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaList.h"
@@ -35440,6 +36340,22 @@
 			<File
 				RelativePath="..\css\MediaQuery.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQuery.h"
@@ -35448,6 +36364,22 @@
 			<File
 				RelativePath="..\css\MediaQueryEvaluator.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQueryEvaluator.h"
@@ -35456,6 +36388,22 @@
 			<File
 				RelativePath="..\css\MediaQueryExp.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQueryExp.h"
@@ -35464,6 +36412,22 @@
 			<File
 				RelativePath="..\css\MediaQueryList.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQueryList.h"
@@ -35472,6 +36436,22 @@
 			<File
 				RelativePath="..\css\MediaQueryListListener.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQueryListListener.h"
@@ -35480,6 +36460,22 @@
 			<File
 				RelativePath="..\css\MediaQueryMatcher.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQueryMatcher.h"
@@ -35594,6 +36590,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\StyleRule.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\css\StyleRule.h"
+				>
+			</File>
+			<File
 				RelativePath="..\css\StyleSheet.cpp"
 				>
 			</File>
@@ -37162,62 +38166,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\RenderDetails.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\rendering\RenderDetails.h"
-				>
-			</File>
-			<File
 				RelativePath="..\rendering\RenderDetailsMarker.cpp"
 				>
 				<FileConfiguration
@@ -39522,62 +40470,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\RenderSummary.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\rendering\RenderSummary.h"
-				>
-			</File>
-			<File
 				RelativePath="..\rendering\svg\RenderSVGAllInOne.cpp"
 				>
 			</File>
@@ -40646,114 +41538,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\RenderSVGShadowTreeRootContainer.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\rendering\svg\RenderSVGShadowTreeRootContainer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\rendering\svg\RenderSVGTransformableContainer.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
 				RelativePath="..\rendering\svg\RenderSVGTransformableContainer.h"
 				>
 			</File>
@@ -42240,7 +43024,7 @@
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResources.cpp"
+				RelativePath="..\rendering\svg\SVGRenderingContext.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -42292,11 +43076,11 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResources.h"
+				RelativePath="..\rendering\svg\SVGRenderingContext.h"
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResourcesCache.cpp"
+				RelativePath="..\rendering\svg\SVGResources.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -42348,11 +43132,11 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResourcesCache.h"
+				RelativePath="..\rendering\svg\SVGResources.h"
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResourcesCycleSolver.cpp"
+				RelativePath="..\rendering\svg\SVGResourcesCache.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -42404,11 +43188,11 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResourcesCycleSolver.h"
+				RelativePath="..\rendering\svg\SVGResourcesCache.h"
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGShadowTreeElements.cpp"
+				RelativePath="..\rendering\svg\SVGResourcesCycleSolver.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -42460,7 +43244,7 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGShadowTreeElements.h"
+				RelativePath="..\rendering\svg\SVGResourcesCycleSolver.h"
 				>
 			</File>
 			<File
@@ -43507,6 +44291,62 @@
 					>
 				</File>
 				<File
+					RelativePath="..\rendering\style\StyleGridItemData.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\rendering\style\StyleGridItemData.h"
+					>
+				</File>
+				<File
 					RelativePath="..\rendering\style\StyleImage.h"
 					>
 				</File>
@@ -46814,6 +47654,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\ContextDestructionObserver.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\ContextDestructionObserver.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\CrossThreadTask.h"
 				>
 			</File>
@@ -50654,6 +51550,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\RegionNodeList.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\dom\RegionNodeList.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\RegisteredEventListener.cpp"
 				>
 				<FileConfiguration
@@ -52690,11 +53594,11 @@
 				>
 			</File>
 			<File
-				RelativePath="..\notifications\NotificationContents.h"
+				RelativePath="..\notifications\NotificationClient.h"
 				>
 			</File>
 			<File
-				RelativePath="..\notifications\NotificationPresenter.h"
+				RelativePath="..\notifications\NotificationContents.h"
 				>
 			</File>
 		</Filter>
@@ -55766,6 +56670,14 @@
 			Name="html"
 			>
 			<File
+				RelativePath="..\fileapi\AsyncFileStream.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\fileapi\AsyncFileStream.h"
+				>
+			</File>
+			<File
 				RelativePath="..\fileapi\AsyncFileWriter.h"
 				>
 			</File>
@@ -55790,6 +56702,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\BaseClickableWithKeyInputType.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\BaseClickableWithKeyInputType.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\BaseDateAndTimeInputType.cpp"
 				>
 			</File>
@@ -56178,14 +57098,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\fileapi\FileStreamProxy.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\fileapi\FileStreamProxy.h"
-				>
-			</File>
-			<File
 				RelativePath="..\fileapi\FileSystemCallback.h"
 				>
 			</File>
@@ -60554,6 +61466,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\LabelableElement.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\LabelableElement.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\LabelsNodeList.cpp"
 				>
 			</File>
@@ -68889,19 +69809,19 @@
 					>
 				</File>
 				<File
-					RelativePath="..\bindings\scripts\IDLParser.pm"
+					RelativePath="..\bindings\scripts\IDLAttributes.txt"
 					>
 				</File>
 				<File
-					RelativePath="..\bindings\scripts\IDLStructure.pm"
+					RelativePath="..\bindings\scripts\IDLParser.pm"
 					>
 				</File>
 				<File
-					RelativePath="..\bindings\scripts\resolve-supplemental.pl"
+					RelativePath="..\bindings\scripts\IDLStructure.pm"
 					>
 				</File>
 				<File
-					RelativePath="..\bindings\scripts\IDLAttributes.txt"
+					RelativePath="..\bindings\scripts\preprocess-idls.pl"
 					>
 				</File>
 			</Filter>
@@ -70702,370 +71622,6 @@
 			Name="storage"
 			>
 			<File
-				RelativePath="..\storage\AbstractDatabase.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\AbstractDatabase.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\ChangeVersionWrapper.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\ChangeVersionWrapper.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\Database.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\Database.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseAuthorizer.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseAuthorizer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseSync.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseSync.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseTask.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseTask.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseThread.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseThread.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseTracker.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseTracker.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DOMWindowSQLDatabase.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DOMWindowSQLDatabase.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBAny.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBAny.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCallbacks.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCursor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCursor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCursorBackendImpl.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCursorBackendImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCursorBackendInterface.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabase.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabase.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabaseBackendImpl.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabaseBackendImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabaseBackendInterface.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabaseError.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabaseException.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactory.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactory.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactoryBackendImpl.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactoryBackendImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactoryBackendInterface.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactoryBackendInterface.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBIndex.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBIndex.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBIndexBackendImpl.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBIndexBackendImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBIndexBackendInterface.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBKey.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBKey.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBKeyRange.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBKeyRange.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBObjectStore.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBObjectStore.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBObjectStoreBackendImpl.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBObjectStoreBackendImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBObjectStoreBackendInterface.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBRequest.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBRequest.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBTransaction.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBTransaction.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\StorageTask.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\StorageTask.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\StorageThread.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\StorageThread.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\OriginQuotaManager.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\OriginQuotaManager.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\OriginUsageRecord.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\OriginUsageRecord.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLCallbackWrapper.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLError.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLException.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLException.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLResultSet.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLResultSet.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLResultSetRowList.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLResultSetRowList.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatement.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatement.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatementCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatementErrorCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatementSync.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatementSync.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransaction.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransaction.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionClient.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionClient.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionCoordinator.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionCoordinator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionErrorCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionSync.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionSync.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionSyncCallback.h"
-				>
-			</File>
-			<File
 				RelativePath="..\storage\Storage.cpp"
 				>
 			</File>
@@ -71162,15 +71718,27 @@
 				>
 			</File>
 			<File
-				RelativePath="..\storage\StorageTracker.cpp"
+				RelativePath="..\storage\StorageTask.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\storage\StorageTracker.h"
+				RelativePath="..\storage\StorageTask.h"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageThread.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageThread.h"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageTracker.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\storage\VersionChangeCallback.h"
+				RelativePath="..\storage\StorageTracker.h"
 				>
 			</File>
 		</Filter>
@@ -71178,15 +71746,15 @@
 			Name="strings"
 			>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\AtomicString.cpp"
+				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\AtomicString.cpp"
 				>
 			</File>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\StringImpl.cpp"
+				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\StringImpl.cpp"
 				>
 			</File>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\WTFString.cpp"
+				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\WTFString.cpp"
 				>
 			</File>
 		</Filter>
@@ -71714,7 +72282,7 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\inspector\InspectorCounters.h"
+				RelativePath="..\inspector\InspectorController.h"
 				>
 			</File>
 			<File
@@ -71738,7 +72306,7 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\inspector\InspectorController.h"
+				RelativePath="..\inspector\InspectorCounters.h"
 				>
 			</File>
 			<File
@@ -73233,6 +73801,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\ScriptMapping.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\ScriptsNavigator.js"
 					>
 				</File>
@@ -73373,15 +73945,15 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TimelineAgent.js"
+					RelativePath="..\inspector\front-end\TimelineGrid.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TimelineGrid.js"
+					RelativePath="..\inspector\front-end\TimelineManager.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TimelineManager.js"
+					RelativePath="..\inspector\front-end\TimelineModel.js"
 					>
 				</File>
 				<File
@@ -73397,6 +73969,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\TimelinePresentationModel.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\Toolbar.js"
 					>
 				</File>
@@ -73439,138 +74015,166 @@
 			</Filter>
 		</Filter>
 		<Filter
-			Name="websockets"
+			Name="mathml"
 			>
 			<File
-				RelativePath="..\websockets\CloseEvent.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\ThreadableWebSocketChannel.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\ThreadableWebSocketChannel.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\ThreadableWebSocketChannelClientWrapper.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\ThreadableWebSocketChannelClientWrapper.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocket.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocket.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketChannel.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketChannel.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketChannelClient.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketDeflater.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketDeflater.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketExtensionDispatcher.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketExtensionDispatcher.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketExtensionProcessor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketFrame.h"
+				RelativePath="..\mathml\MathMLAllInOne.cpp"
 				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshake.cpp"
+				RelativePath="..\mathml\MathMLElement.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshake.h"
+				RelativePath="..\mathml\MathMLElement.h"
 				>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshakeRequest.cpp"
+				RelativePath="..\mathml\MathMLInlineContainerElement.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshakeRequest.h"
+				RelativePath="..\mathml\MathMLInlineContainerElement.h"
 				>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshakeResponse.cpp"
+				RelativePath="..\mathml\MathMLMathElement.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshakeResponse.h"
+				RelativePath="..\mathml\MathMLMathElement.h"
 				>
 			</File>
 			<File
-				RelativePath="..\websockets\WorkerThreadableWebSocketChannel.cpp"
+				RelativePath="..\mathml\MathMLTextElement.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\websockets\WorkerThreadableWebSocketChannel.h"
+				RelativePath="..\mathml\MathMLTextElement.h"
 				>
 			</File>
 		</Filter>
 		<Filter
-			Name="mathml"
+			Name="fileapi"
 			>
 			<File
-				RelativePath="..\mathml\MathMLElement.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\mathml\MathMLElement.h"
-				>
-			</File>
-			<File
-				RelativePath="..\mathml\MathMLInlineContainerElement.cpp"
+				RelativePath="..\fileapi\DOMWindowFileSystem.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\mathml\MathMLInlineContainerElement.h"
+				RelativePath="..\fileapi\DOMWindowFileSystem.h"
 				>
 			</File>
 			<File
-				RelativePath="..\mathml\MathMLMathElement.cpp"
+				RelativePath="..\fileapi\EntryBase.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\mathml\MathMLMathElement.h"
+				RelativePath="..\fileapi\SyncCallbackHelper.h"
 				>
 			</File>
 			<File
-				RelativePath="..\mathml\MathMLTextElement.cpp"
+				RelativePath="..\fileapi\WorkerContextFileSystem.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\mathml\MathMLTextElement.h"
+				RelativePath="..\fileapi\WorkerContextFileSystem.h"
 				>
 			</File>
 		</Filter>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
index 838c080a6..48621c27c 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
+++ b/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -7,7 +7,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\Modules\geolocation&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\mathml&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\html\shadow&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\cache&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\scrolling&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\ca&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\filters\arm&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(ProjectDir)..\xml\parser&quot;;&quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\properties&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\testing&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"
+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\Modules\geolocation&quot;;&quot;$(ProjectDir)..\Modules\indexeddb&quot;;&quot;$(ProjectDir)..\Modules\webdatabase&quot;;&quot;$(ProjectDir)..\Modules\websockets&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\mathml&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\html\shadow&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\cache&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\scrolling&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\ca&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\filters\arm&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(ProjectDir)..\xml\parser&quot;;&quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\properties&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\testing&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"
 		PreprocessorDefinitions="__WIN32__;DISABLE_3D_RENDERING;WEBCORE_CONTEXT_MENUS"
 		UsePrecompiledHeader="2"
 		PrecompiledHeaderThrough="WebCorePrefix.h"
diff --git a/Source/WebCore/WebCore.vcproj/build-generated-files.sh b/Source/WebCore/WebCore.vcproj/build-generated-files.sh
index 5660538c6..5660538c6 100644..100755
--- a/Source/WebCore/WebCore.vcproj/build-generated-files.sh
+++ b/Source/WebCore/WebCore.vcproj/build-generated-files.sh
diff --git a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
index dfd62b12d..f46ff4658 100755
--- a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
+++ b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
@@ -20,6 +20,8 @@ mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCoreTestSupport"
 xcopy /y /d "%ProjectDir%..\config.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%CONFIGURATIONBUILDDIR%\obj\WebCore\DerivedSources\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\Modules\geolocation\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
+xcopy /y /d "%ProjectDir%..\Modules\webdatabase\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
+xcopy /y /d "%ProjectDir%..\Modules\websockets\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\accessibility\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\accessibility\win\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\inspector\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
@@ -77,7 +79,6 @@ xcopy /y /d "%ProjectDir%..\svg\graphics\*.h" "%CONFIGURATIONBUILDDIR%\include\W
 xcopy /y /d "%ProjectDir%..\svg\properties\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\svg\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\storage\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
-xcopy /y /d "%ProjectDir%..\websockets\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\workers\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\bindings\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\bindings"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\parser\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\parser"
diff --git a/Source/WebCore/WebCore.vcproj/migrate-scripts.sh b/Source/WebCore/WebCore.vcproj/migrate-scripts.sh
index d68075a88..d68075a88 100644..100755
--- a/Source/WebCore/WebCore.vcproj/migrate-scripts.sh
+++ b/Source/WebCore/WebCore.vcproj/migrate-scripts.sh
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 729d53276..2e9059eb3 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -355,6 +355,7 @@
 		18F831B80FD48C7800D8C56B /* WorkerLoaderProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 18F831B70FD48C7800D8C56B /* WorkerLoaderProxy.h */; };
 		1921327411C0E6BB00456238 /* SVGFEConvolveMatrixElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1921327111C0E6BB00456238 /* SVGFEConvolveMatrixElement.cpp */; };
 		1921327511C0E6BB00456238 /* SVGFEConvolveMatrixElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 1921327211C0E6BB00456238 /* SVGFEConvolveMatrixElement.h */; };
+		197B180C1506353200E4ADA8 /* SVGRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 197B180B150634C000E4ADA8 /* SVGRenderingContext.h */; };
 		19BFF64B11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 19BFF64611C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h */; };
 		19BFF64C11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = 19BFF64711C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.mm */; };
 		19BFF64D11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 19BFF64811C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h */; };
@@ -452,11 +453,6 @@
 		1A762C780A074F2600989F5B /* JSXPathNSResolver.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A762C700A074F2600989F5B /* JSXPathNSResolver.h */; };
 		1A762C790A074F2600989F5B /* JSXPathResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A762C710A074F2600989F5B /* JSXPathResult.cpp */; };
 		1A762C7A0A074F2600989F5B /* JSXPathResult.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A762C720A074F2600989F5B /* JSXPathResult.h */; };
-		1A7CCB190CD9469A00B7B64E /* SQLStatementCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7CCB150CD9469A00B7B64E /* SQLStatementCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1A7CCB1A0CD9469A00B7B64E /* SQLStatementErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7CCB160CD9469A00B7B64E /* SQLStatementErrorCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1A7CCB1B0CD9469A00B7B64E /* SQLTransactionCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7CCB170CD9469A00B7B64E /* SQLTransactionCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1A7CCB1C0CD9469A00B7B64E /* SQLTransactionErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7CCB180CD9469A00B7B64E /* SQLTransactionErrorCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1A7CCB240CD946FD00B7B64E /* SQLTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7CCB220CD946FD00B7B64E /* SQLTransaction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1A7FA6190DDA3B3A0028F8A5 /* NetworkStateNotifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7FA6180DDA3B3A0028F8A5 /* NetworkStateNotifier.h */; };
 		1A7FA61B0DDA3BBE0028F8A5 /* NetworkStateNotifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A7FA61A0DDA3BBE0028F8A5 /* NetworkStateNotifier.cpp */; };
 		1A7FA6490DDA3CBA0028F8A5 /* NetworkStateNotifierMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A7FA6470DDA3CBA0028F8A5 /* NetworkStateNotifierMac.cpp */; };
@@ -535,7 +531,6 @@
 		1ABA76C911D20E47004C201C /* ColorData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E406F3FB1198307D009D59D6 /* ColorData.cpp */; };
 		1ABA76CA11D20E50004C201C /* CSSPropertyNames.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E41EA038119836DB00710BC5 /* CSSPropertyNames.cpp */; };
 		1ABA76CB11D20E57004C201C /* CSSValueKeywords.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E41EA0391198374900710BC5 /* CSSValueKeywords.cpp */; };
-		1ABFE7530CD968D000FE4834 /* SQLTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1ABFE7520CD968D000FE4834 /* SQLTransaction.cpp */; };
 		1AC2260C0DB69F190089B669 /* JSDOMApplicationCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC2260A0DB69F190089B669 /* JSDOMApplicationCache.cpp */; };
 		1AC2260D0DB69F190089B669 /* JSDOMApplicationCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AC2260B0DB69F190089B669 /* JSDOMApplicationCache.h */; };
 		1ACD1B630B029739007E5016 /* DOMCSSStyleDeclarationInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85E711440AC5D5340053270F /* DOMCSSStyleDeclarationInternal.h */; };
@@ -548,8 +543,6 @@
 		1ACE53F60A8D19470022947D /* JSXMLSerializer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1ACE53F40A8D19470022947D /* JSXMLSerializer.cpp */; };
 		1ACE53F70A8D19470022947D /* JSXMLSerializer.h in Headers */ = {isa = PBXBuildFile; fileRef = 1ACE53F50A8D19470022947D /* JSXMLSerializer.h */; };
 		1AD2316E0CD269E700C1F194 /* JSSQLTransactionCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AD2316D0CD269E700C1F194 /* JSSQLTransactionCustom.cpp */; };
-		1AD51A140CB59CD300953D11 /* DatabaseTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AD51A120CB59CD300953D11 /* DatabaseTracker.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1AD51A150CB59CD300953D11 /* DatabaseTracker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AD51A130CB59CD300953D11 /* DatabaseTracker.cpp */; };
 		1AD8F81B11CAB9E900E93E54 /* PlatformStrategies.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AD8F81911CAB9E900E93E54 /* PlatformStrategies.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AD8F81C11CAB9E900E93E54 /* PlatformStrategies.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AD8F81A11CAB9E900E93E54 /* PlatformStrategies.cpp */; };
 		1ADA14100E1AE5D900023EE5 /* PluginMainThreadScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1ADA140E0E1AE5D900023EE5 /* PluginMainThreadScheduler.cpp */; };
@@ -608,8 +601,6 @@
 		1AF8E11A1256592600230FF7 /* ProxyServer.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF8E1191256592600230FF7 /* ProxyServer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AF8E13312565A4400230FF7 /* ProxyServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF8E13212565A4400230FF7 /* ProxyServer.cpp */; };
 		1AF8E1C3125673E000230FF7 /* ProxyServerCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF8E1C1125673E000230FF7 /* ProxyServerCFNet.cpp */; };
-		1AFE117D0CBFFB36003017FA /* SQLResultSetRowList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */; };
-		1AFE117E0CBFFB36003017FA /* SQLResultSetRowList.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AFE11990CBFFCC4003017FA /* JSSQLResultSetRowList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AFE11970CBFFCC4003017FA /* JSSQLResultSetRowList.cpp */; };
 		1AFE119A0CBFFCC4003017FA /* JSSQLResultSetRowList.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AFE11980CBFFCC4003017FA /* JSSQLResultSetRowList.h */; };
 		1C11CCB50AA6093700DADB20 /* DOMNotation.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85CA96E80A9624E900690CCF /* DOMNotation.h */; };
@@ -678,7 +669,6 @@
 		2292B27C1356669400CF11EF /* ImageBufferDataCG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2292B27B1356669400CF11EF /* ImageBufferDataCG.cpp */; };
 		22BD9F7F1353625C009BD102 /* ImageBufferData.h in Headers */ = {isa = PBXBuildFile; fileRef = 22BD9F7D1353625C009BD102 /* ImageBufferData.h */; };
 		22BD9F81135364FE009BD102 /* ImageBufferDataCG.h in Headers */ = {isa = PBXBuildFile; fileRef = 22BD9F80135364FE009BD102 /* ImageBufferDataCG.h */; };
-		245D80A313280E40003492A6 /* SQLCallbackWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 245D80A213280E40003492A6 /* SQLCallbackWrapper.h */; };
 		24AA568D13CC94CE00E902F6 /* DOMSVGAltGlyphItemElementInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 24D912A313CA977D00D21915 /* DOMSVGAltGlyphItemElementInternal.h */; };
 		24AA568E13CC950900E902F6 /* DOMSVGAltGlyphItemElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 24D912A113CA977D00D21915 /* DOMSVGAltGlyphItemElement.h */; };
 		24AA569013CC952F00E902F6 /* DOMSVGAltGlyphDefElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 24D9129B13CA975A00D21915 /* DOMSVGAltGlyphDefElement.h */; };
@@ -713,6 +703,8 @@
 		265541391489811C000DFC5D /* KeyEventCodesIOS.h in Headers */ = {isa = PBXBuildFile; fileRef = 265541371489811C000DFC5D /* KeyEventCodesIOS.h */; };
 		2655413A1489811C000DFC5D /* KeyEventIOS.mm in Sources */ = {isa = PBXBuildFile; fileRef = 265541381489811C000DFC5D /* KeyEventIOS.mm */; };
 		265541521489B233000DFC5D /* CursorIOS.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2655414B1489AA2B000DFC5D /* CursorIOS.cpp */; };
+		26A5034E14F0983600AA730D /* KURLWTFURLImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 26A5034D14F0983600AA730D /* KURLWTFURLImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		26A5035A14F0A2BC00AA730D /* KURLWTFURL.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 26A5035914F0A2BC00AA730D /* KURLWTFURL.cpp */; };
 		26C17A3E1491D2D400D12BA2 /* FileSystemIOS.h in Headers */ = {isa = PBXBuildFile; fileRef = 26C17A3C1491D2D400D12BA2 /* FileSystemIOS.h */; };
 		26C17A3F1491D2D400D12BA2 /* FileSystemIOS.mm in Sources */ = {isa = PBXBuildFile; fileRef = 26C17A3D1491D2D400D12BA2 /* FileSystemIOS.mm */; };
 		26E98A10130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h in Headers */ = {isa = PBXBuildFile; fileRef = 26E98A0F130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h */; };
@@ -760,6 +752,7 @@
 		2D8FEBDD143E3EF70072502B /* CSSCrossfadeValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 2D8FEBDB143E3EF70072502B /* CSSCrossfadeValue.h */; };
 		2D9066060BE141D400956998 /* LayoutState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2D9066040BE141D400956998 /* LayoutState.cpp */; };
 		2D9066070BE141D400956998 /* LayoutState.h in Headers */ = {isa = PBXBuildFile; fileRef = 2D9066050BE141D400956998 /* LayoutState.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		2D9F0E1314FF1CBF00BA0FF7 /* linearSRGB.icc in Resources */ = {isa = PBXBuildFile; fileRef = 2D9F0E1214FF1CBF00BA0FF7 /* linearSRGB.icc */; };
 		2E0888D41148848A00AF4265 /* JSDOMFormData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2E0888D21148848A00AF4265 /* JSDOMFormData.cpp */; };
 		2E0888D51148848A00AF4265 /* JSDOMFormData.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E0888D31148848A00AF4265 /* JSDOMFormData.h */; };
 		2E0888E6114884E200AF4265 /* JSDOMFormDataCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2E0888E5114884E200AF4265 /* JSDOMFormDataCustom.cpp */; };
@@ -832,7 +825,6 @@
 		2EDF369F122C94C8002F7D4E /* FileException.h in Headers */ = {isa = PBXBuildFile; fileRef = 2EDF369E122C94C8002F7D4E /* FileException.h */; };
 		2EF1BFEA121C9F4200C27627 /* FileStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2EF1BFE8121C9F4200C27627 /* FileStream.cpp */; };
 		2EF1BFEB121C9F4200C27627 /* FileStream.h in Headers */ = {isa = PBXBuildFile; fileRef = 2EF1BFE9121C9F4200C27627 /* FileStream.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		2EF1BFF7121CB0BD00C27627 /* AsyncFileStream.h in Headers */ = {isa = PBXBuildFile; fileRef = 2EF1BFF6121CB0BD00C27627 /* AsyncFileStream.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		2EF1BFF9121CB0CE00C27627 /* FileStreamClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 2EF1BFF8121CB0CE00C27627 /* FileStreamClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3106036F14327D2E00ABF4BA /* WebKitCSSFilterValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3106036C14327D2E00ABF4BA /* WebKitCSSFilterValue.cpp */; };
 		3106037014327D2E00ABF4BA /* WebKitCSSFilterValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 3106036D14327D2E00ABF4BA /* WebKitCSSFilterValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -919,7 +911,7 @@
 		31FB1A6C120A5D6900DC02A0 /* JSDeviceMotionEventCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 31FB1A6B120A5D6900DC02A0 /* JSDeviceMotionEventCustom.cpp */; };
 		3314ACEB10892086000F0E56 /* JSExceptionBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3314ACE910892086000F0E56 /* JSExceptionBase.cpp */; };
 		3314ACEC10892086000F0E56 /* JSExceptionBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 3314ACEA10892086000F0E56 /* JSExceptionBase.h */; };
-		33503C9A10179A74003B47E1 /* NotificationPresenter.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503C9910179A74003B47E1 /* NotificationPresenter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		33503C9A10179A74003B47E1 /* NotificationClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503C9910179A74003B47E1 /* NotificationClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		33503CA310179AD7003B47E1 /* JSNotification.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503C9F10179AD7003B47E1 /* JSNotification.cpp */; };
 		33503CA410179AD7003B47E1 /* JSNotification.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503CA010179AD7003B47E1 /* JSNotification.h */; };
 		33503CA510179AD7003B47E1 /* JSNotificationCenter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503CA110179AD7003B47E1 /* JSNotificationCenter.cpp */; };
@@ -1112,7 +1104,6 @@
 		436708E112D9CA4B00044234 /* RenderSVGResourceRadialGradient.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708A212D9CA4B00044234 /* RenderSVGResourceRadialGradient.h */; };
 		436708E312D9CA4B00044234 /* RenderSVGResourceSolidColor.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708A412D9CA4B00044234 /* RenderSVGResourceSolidColor.h */; };
 		436708E512D9CA4B00044234 /* RenderSVGRoot.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708A612D9CA4B00044234 /* RenderSVGRoot.h */; };
-		436708E712D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708A812D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.h */; };
 		436708E912D9CA4B00044234 /* RenderSVGTransformableContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708AA12D9CA4B00044234 /* RenderSVGTransformableContainer.h */; };
 		436708EB12D9CA4B00044234 /* RenderSVGViewportContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708AC12D9CA4B00044234 /* RenderSVGViewportContainer.h */; };
 		436708ED12D9CA4B00044234 /* SVGImageBufferTools.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708AE12D9CA4B00044234 /* SVGImageBufferTools.h */; };
@@ -1123,7 +1114,6 @@
 		436708F612D9CA4B00044234 /* SVGResources.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708B712D9CA4B00044234 /* SVGResources.h */; };
 		436708F812D9CA4B00044234 /* SVGResourcesCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708B912D9CA4B00044234 /* SVGResourcesCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		436708FA12D9CA4B00044234 /* SVGResourcesCycleSolver.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708BB12D9CA4B00044234 /* SVGResourcesCycleSolver.h */; };
-		436708FC12D9CA4B00044234 /* SVGShadowTreeElements.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708BD12D9CA4B00044234 /* SVGShadowTreeElements.h */; };
 		4381763B13A697D4007D1187 /* SVGAnimatedLength.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4381763A13A697D4007D1187 /* SVGAnimatedLength.cpp */; };
 		439046D712DA25E800AF80A2 /* RenderMathMLBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 439046C312DA25E800AF80A2 /* RenderMathMLBlock.cpp */; };
 		439046D812DA25E800AF80A2 /* RenderMathMLBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 439046C412DA25E800AF80A2 /* RenderMathMLBlock.h */; };
@@ -1179,6 +1169,8 @@
 		44A28AAC12DFB8AC00AE923B /* MathMLElementFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 44A28AAB12DFB8AC00AE923B /* MathMLElementFactory.h */; };
 		44A28AAF12DFB8BF00AE923B /* MathMLNames.h in Headers */ = {isa = PBXBuildFile; fileRef = 44A28AAE12DFB8BF00AE923B /* MathMLNames.h */; };
 		45099C411370A7800058D513 /* IconURL.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 45099C401370A7800058D513 /* IconURL.cpp */; };
+		450CEBF015073BBE002BB149 /* LabelableElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 450CEBEE15073BBE002BB149 /* LabelableElement.cpp */; };
+		450CEBF115073BBE002BB149 /* LabelableElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 450CEBEF15073BBE002BB149 /* LabelableElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		45BAC2B01360BBAB005DA258 /* IconURL.h in Headers */ = {isa = PBXBuildFile; fileRef = 45BAC2AF1360BBAB005DA258 /* IconURL.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4614A1FE0B23A8D600446E1C /* copyCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 4614A1FD0B23A8D600446E1C /* copyCursor.png */; };
 		46700ED0127B96CB00F5D5D6 /* FileWriterSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 46700ECE127B96CB00F5D5D6 /* FileWriterSync.cpp */; };
@@ -1367,14 +1359,13 @@
 		4A1E719614E101F900626F9D /* JSHTMLShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A1E719414E101F900626F9D /* JSHTMLShadowElement.h */; };
 		4A1E71A514E106AC00626F9D /* JSShadowRoot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A1E71A314E106AC00626F9D /* JSShadowRoot.cpp */; };
 		4A1E71A614E106AC00626F9D /* JSShadowRoot.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A1E71A414E106AC00626F9D /* JSShadowRoot.h */; };
-		4A4A234614F1E1440046FBF1 /* WebSocketFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */; };
+		4A38BF5014FE1C0900612512 /* WebSocketDeflateFramer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A38BF4E14FE1C0900612512 /* WebSocketDeflateFramer.cpp */; };
+		4A38BF5114FE1C0900612512 /* WebSocketDeflateFramer.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A38BF4F14FE1C0900612512 /* WebSocketDeflateFramer.h */; };
 		4A6E9FC313C17D1D0046A7F8 /* FontFeatureValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A6E9FC113C17D1D0046A7F8 /* FontFeatureValue.cpp */; };
 		4A6E9FC413C17D1D0046A7F8 /* FontFeatureValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A6E9FC213C17D1D0046A7F8 /* FontFeatureValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4A6E9FC713C17D570046A7F8 /* FontFeatureSettings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A6E9FC513C17D570046A7F8 /* FontFeatureSettings.cpp */; };
 		4A6E9FC813C17D570046A7F8 /* FontFeatureSettings.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A6E9FC613C17D570046A7F8 /* FontFeatureSettings.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4A8C96EB0BE69032004EEFF0 /* FrameSelectionMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4A8C96EA0BE69032004EEFF0 /* FrameSelectionMac.mm */; };
-		4A957F0614E2412A0049DBFB /* WebSocketExtensionDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */; };
-		4A957F0714E241300049DBFB /* WebSocketExtensionDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */; };
 		4ABDFF0B14DBE385004D117D /* HTMLShadowElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4ABDFF0714DBE312004D117D /* HTMLShadowElement.cpp */; };
 		4ABDFF0C14DBE385004D117D /* HTMLShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4ABDFF0814DBE312004D117D /* HTMLShadowElement.h */; };
 		4ACBC0BE12713CBD0094F9B2 /* ClassList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4ACBC0BC12713CBD0094F9B2 /* ClassList.cpp */; };
@@ -1388,9 +1379,6 @@
 		4AD01009127E642A0015035F /* HTMLOutputElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AD01006127E642A0015035F /* HTMLOutputElement.h */; };
 		4AD0173C127E82860015035F /* JSHTMLOutputElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AD0173A127E82860015035F /* JSHTMLOutputElement.cpp */; };
 		4AD0173D127E82860015035F /* JSHTMLOutputElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AD0173B127E82860015035F /* JSHTMLOutputElement.h */; };
-		4ADE25FA14E3BB4C004C2213 /* WebSocketExtensionProcessor.h in Headers */ = {isa = PBXBuildFile; fileRef = 4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */; };
-		4AE02ABD14E8A9D200BC3BA7 /* WebSocketDeflater.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */; };
-		4AE02ABE14E8A9D200BC3BA7 /* WebSocketDeflater.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */; };
 		4AF1AD3E13FD23A400AA9590 /* EventDispatchMediator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AF1AD3C13FD23A400AA9590 /* EventDispatchMediator.cpp */; };
 		4AF1AD3F13FD23A400AA9590 /* EventDispatchMediator.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AF1AD3D13FD23A400AA9590 /* EventDispatchMediator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B2708C50AF19EE40065127F /* Pasteboard.h */; };
@@ -1463,16 +1451,6 @@
 		510D4A36103165EE0049EA54 /* SocketStreamHandleBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510D4A30103165EE0049EA54 /* SocketStreamHandleBase.cpp */; };
 		510D4A37103165EE0049EA54 /* SocketStreamHandleBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A31103165EE0049EA54 /* SocketStreamHandleBase.h */; };
 		510D4A38103165EE0049EA54 /* SocketStreamHandleClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A32103165EE0049EA54 /* SocketStreamHandleClient.h */; };
-		510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510D4A47103177A20049EA54 /* WebSocketChannel.cpp */; };
-		510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A48103177A20049EA54 /* WebSocketChannel.h */; };
-		510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A49103177A20049EA54 /* WebSocketChannelClient.h */; };
-		510F079B11FEE9C000B8EE49 /* ThreadableWebSocketChannelClientWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510F078111FEBE7500B8EE49 /* ThreadableWebSocketChannelClientWrapper.cpp */; };
-		5112247210CFB8C6008099D7 /* ThreadableWebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5112247110CFB8C6008099D7 /* ThreadableWebSocketChannel.cpp */; };
-		5112247410CFB8D8008099D7 /* ThreadableWebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 5112247310CFB8D8008099D7 /* ThreadableWebSocketChannel.h */; };
-		5112247610CFB8E8008099D7 /* ThreadableWebSocketChannelClientWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 5112247510CFB8E8008099D7 /* ThreadableWebSocketChannelClientWrapper.h */; };
-		5112247810CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5112247710CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp */; };
-		5112247A10CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 5112247910CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h */; };
-		5116D9770CF177BD00C2B84D /* DatabaseDetails.h in Headers */ = {isa = PBXBuildFile; fileRef = 5116D9750CF177BD00C2B84D /* DatabaseDetails.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		511F23170DC160DA004F0032 /* StorageTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23130DC160DA004F0032 /* StorageTask.cpp */; };
 		511F23180DC160DA004F0032 /* StorageTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23140DC160DA004F0032 /* StorageTask.h */; };
 		511F23190DC160DA004F0032 /* StorageThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23150DC160DA004F0032 /* StorageThread.cpp */; };
@@ -1493,8 +1471,6 @@
 		51327D6111A33A2B004F9D65 /* SinkDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51327D5F11A33A2B004F9D65 /* SinkDocument.cpp */; };
 		513F14530AB634C400094DDF /* IconLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 513F14510AB634C400094DDF /* IconLoader.cpp */; };
 		513F14540AB634C400094DDF /* IconLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 513F14520AB634C400094DDF /* IconLoader.h */; };
-		514185EE0CD65F0400763C99 /* ChangeVersionWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 514185EC0CD65F0400763C99 /* ChangeVersionWrapper.h */; };
-		514185EF0CD65F0400763C99 /* ChangeVersionWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 514185ED0CD65F0400763C99 /* ChangeVersionWrapper.cpp */; };
 		514B3F730C722047000530DF /* FileSystem.h in Headers */ = {isa = PBXBuildFile; fileRef = 514B3F720C722047000530DF /* FileSystem.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		514B3F760C722055000530DF /* FileSystemMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 514B3F750C722055000530DF /* FileSystemMac.mm */; };
 		514C76370CE9225E007EF3CD /* JSSQLError.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 514C76350CE9225E007EF3CD /* JSSQLError.cpp */; };
@@ -1525,8 +1501,6 @@
 		514C767E0CE923A1007EF3CD /* ResourceResponseBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 514C76690CE923A1007EF3CD /* ResourceResponseBase.cpp */; };
 		514C767F0CE923A1007EF3CD /* ResourceResponseBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 514C766A0CE923A1007EF3CD /* ResourceResponseBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		515788C11207852C00A37C4A /* VisitedLinkStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = 515788C01207852C00A37C4A /* VisitedLinkStrategy.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		515B03990CD1642A00B7EA9C /* SQLStatement.h in Headers */ = {isa = PBXBuildFile; fileRef = 515B03970CD1642A00B7EA9C /* SQLStatement.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		515B039A0CD1642A00B7EA9C /* SQLStatement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 515B03980CD1642A00B7EA9C /* SQLStatement.cpp */; };
 		5160300B0CC4251200C8AC25 /* FileSystemPOSIX.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5160300A0CC4251200C8AC25 /* FileSystemPOSIX.cpp */; };
 		5160306C0CC4362300C8AC25 /* FileSystemCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5160306B0CC4362300C8AC25 /* FileSystemCF.cpp */; };
 		5160F4980B0AA75F00C1D2AF /* HistoryItemMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5160F4970B0AA75F00C1D2AF /* HistoryItemMac.mm */; };
@@ -1542,32 +1516,14 @@
 		5189F01D10B37BD900F3C739 /* JSPopStateEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */; };
 		5189F01E10B37BD900F3C739 /* JSPopStateEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */; };
 		5189F0DE10B46B0E00F3C739 /* PopStateEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */; };
-		518A34C11026C831001B6896 /* WebSocket.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 518A34BE1026C831001B6896 /* WebSocket.cpp */; };
-		518A34C21026C831001B6896 /* WebSocket.h in Headers */ = {isa = PBXBuildFile; fileRef = 518A34BF1026C831001B6896 /* WebSocket.h */; };
 		518A34C91026C8C9001B6896 /* JSWebSocketCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 518A34C61026C8C9001B6896 /* JSWebSocketCustom.cpp */; };
-		5196116A0CAC56570010A80C /* Database.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5196115E0CAC56570010A80C /* Database.cpp */; };
-		5196116B0CAC56570010A80C /* Database.h in Headers */ = {isa = PBXBuildFile; fileRef = 5196115F0CAC56570010A80C /* Database.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		5196116D0CAC56570010A80C /* DatabaseThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 519611610CAC56570010A80C /* DatabaseThread.cpp */; };
-		519611730CAC56570010A80C /* SQLResultSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 519611670CAC56570010A80C /* SQLResultSet.cpp */; };
-		519611740CAC56570010A80C /* SQLResultSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 519611680CAC56570010A80C /* SQLResultSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		519611780CAC56A80010A80C /* DatabaseThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 519611620CAC56570010A80C /* DatabaseThread.h */; };
-		519611EA0CAC749C0010A80C /* DatabaseTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 519611E80CAC749C0010A80C /* DatabaseTask.h */; };
-		519611EB0CAC749C0010A80C /* DatabaseTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 519611E90CAC749C0010A80C /* DatabaseTask.cpp */; };
 		51A052331058774F00CC9E95 /* CredentialStorage.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A052311058774F00CC9E95 /* CredentialStorage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51A052341058774F00CC9E95 /* CredentialStorage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A052321058774F00CC9E95 /* CredentialStorage.cpp */; };
 		51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A052551058874000CC9E95 /* ProtectionSpaceHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		51A45B560CAD7FD7000D2BE9 /* DatabaseAuthorizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A45B540CAD7FD7000D2BE9 /* DatabaseAuthorizer.h */; };
-		51A45B570CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A45B550CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp */; };
-		51A9267C0D53F0570063ECC2 /* OriginQuotaManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */; };
-		51A9267D0D53F0570063ECC2 /* OriginQuotaManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A926790D53F0570063ECC2 /* OriginQuotaManager.h */; };
-		51A9267E0D53F0570063ECC2 /* OriginUsageRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */; };
-		51A9267F0D53F0570063ECC2 /* OriginUsageRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */; };
 		51AA3F6F0BD5AA9E00892971 /* ResourceLoaderMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51AA3F6E0BD5AA9E00892971 /* ResourceLoaderMac.mm */; };
 		51ABAE1B103C18FF008C5260 /* SocketStreamError.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE1A103C18FF008C5260 /* SocketStreamError.h */; };
 		51ABAE1E103C1913008C5260 /* SocketStreamHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */; };
 		51ABAE1F103C1913008C5260 /* SocketStreamHandleCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */; };
-		51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */; };
-		51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */; };
 		51B2417B0D931F3F00E83F5C /* LegacyWebArchiveMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51B2417A0D931F3F00E83F5C /* LegacyWebArchiveMac.mm */; };
 		51BE37E00DAEE00E001085FC /* StorageArea.h in Headers */ = {isa = PBXBuildFile; fileRef = 51BE37DE0DAEE00E001085FC /* StorageArea.h */; };
 		51C0AA390F2AA10A001648C2 /* CachedFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 51C0AA380F2AA10A001648C2 /* CachedFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1594,10 +1550,7 @@
 		51E1ECC30C91C90400DC255B /* PageURLRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 51E1ECBD0C91C90400DC255B /* PageURLRecord.h */; };
 		51E3F9C70DA059DC00250911 /* Storage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51E3F9C50DA059DC00250911 /* Storage.cpp */; };
 		51E3F9D60DA05E1D00250911 /* JSStorage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51E3F9D40DA05E1D00250911 /* JSStorage.cpp */; };
-		51EC92590CE90DB400F90308 /* SQLError.h in Headers */ = {isa = PBXBuildFile; fileRef = 51EC92570CE90DB400F90308 /* SQLError.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51EC92650CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51EC925D0CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp */; };
-		51FAFE340CECBF2D00BB3F24 /* DatabaseTrackerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 51FAFE330CECBF2D00BB3F24 /* DatabaseTrackerClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		51FB54F5113E364200821176 /* CloseEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 51FB54F4113E364200821176 /* CloseEvent.h */; };
 		51FB5504113E3E9100821176 /* JSCloseEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 51FB5502113E3E9100821176 /* JSCloseEvent.h */; };
 		51FB5505113E3E9100821176 /* JSCloseEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51FB5503113E3E9100821176 /* JSCloseEvent.cpp */; };
 		521D46F611AEC98100514613 /* KillRingMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 521D46F511AEC98100514613 /* KillRingMac.mm */; };
@@ -1611,8 +1564,6 @@
 		53C8298E13D8D92700DE2DEB /* RenderFlexibleBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 53C8298C13D8D92700DE2DEB /* RenderFlexibleBox.h */; };
 		550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 550A0BC7085F6039007353D6 /* QualifiedName.cpp */; };
 		550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */ = {isa = PBXBuildFile; fileRef = 550A0BC8085F6039007353D6 /* QualifiedName.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		572E92FB14E540580087FFBA /* ShadowRootList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 572E92F914E540580087FFBA /* ShadowRootList.cpp */; };
-		572E92FC14E540580087FFBA /* ShadowRootList.h in Headers */ = {isa = PBXBuildFile; fileRef = 572E92FA14E540580087FFBA /* ShadowRootList.h */; };
 		573D134714CE39FF0057ABCA /* InspectorTypeBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */; };
 		57B791A314C6A62900F202D1 /* HTMLContentSelector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */; };
 		57B791A414C6A62900F202D1 /* HTMLContentSelector.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A014C6A62900F202D1 /* HTMLContentSelector.h */; };
@@ -1622,6 +1573,8 @@
 		57B791AA14C6A63300F202D1 /* HTMLContentElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A814C6A63300F202D1 /* HTMLContentElement.h */; };
 		57CF497414EE36D700ECFF14 /* InsertionPoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57CF497214EE36D700ECFF14 /* InsertionPoint.cpp */; };
 		57CF497514EE36D700ECFF14 /* InsertionPoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 57CF497314EE36D700ECFF14 /* InsertionPoint.h */; };
+		57CF4C8614F7597A00ECFF14 /* ShadowTree.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57CF4C8414F7597A00ECFF14 /* ShadowTree.cpp */; };
+		57CF4C8714F7597A00ECFF14 /* ShadowTree.h in Headers */ = {isa = PBXBuildFile; fileRef = 57CF4C8514F7597A00ECFF14 /* ShadowTree.h */; };
 		5905ADBF1302F3CE00F116DF /* XMLTreeViewer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5905ADBD1302F3CE00F116DF /* XMLTreeViewer.cpp */; };
 		5905ADC01302F3CE00F116DF /* XMLTreeViewer.h in Headers */ = {isa = PBXBuildFile; fileRef = 5905ADBE1302F3CE00F116DF /* XMLTreeViewer.h */; };
 		590E1B4911E4EF4B0069F784 /* DeviceOrientation.h in Headers */ = {isa = PBXBuildFile; fileRef = 590E1B4811E4EF4B0069F784 /* DeviceOrientation.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1862,10 +1815,6 @@
 		758978EC127090D60076D5A9 /* SpeechInputResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 758978EA127090D60076D5A9 /* SpeechInputResult.cpp */; };
 		7633A72613D8B33A008501B6 /* LocaleToScriptMapping.h in Headers */ = {isa = PBXBuildFile; fileRef = 7633A72413D8B33A008501B6 /* LocaleToScriptMapping.h */; };
 		7633A72713D8B33A008501B6 /* LocaleToScriptMappingDefault.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7633A72513D8B33A008501B6 /* LocaleToScriptMappingDefault.cpp */; };
-		7637C541112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7637C540112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp */; };
-		7637C543112E7B7E003D6CDC /* WebSocketHandshakeRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 7637C542112E7B7E003D6CDC /* WebSocketHandshakeRequest.h */; };
-		767F99BE11A1194A0080C51D /* WebSocketHandshakeResponse.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 767F99BD11A1194A0080C51D /* WebSocketHandshakeResponse.cpp */; };
-		767F99C011A119560080C51D /* WebSocketHandshakeResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 767F99BF11A119560080C51D /* WebSocketHandshakeResponse.h */; };
 		7694563C1214D97C0007CBAE /* JSDOMTokenList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7694563A1214D97C0007CBAE /* JSDOMTokenList.cpp */; };
 		7694563D1214D97C0007CBAE /* JSDOMTokenList.h in Headers */ = {isa = PBXBuildFile; fileRef = 7694563B1214D97C0007CBAE /* JSDOMTokenList.h */; };
 		7694565B1214DB630007CBAE /* DOMDOMTokenList.h in Headers */ = {isa = PBXBuildFile; fileRef = 769456591214DB630007CBAE /* DOMDOMTokenList.h */; };
@@ -1879,6 +1828,10 @@
 		76FC2B0B12370DA0006A991A /* DOMTokenList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 76FC2B0812370DA0006A991A /* DOMTokenList.cpp */; };
 		76FC2B0C12370DA0006A991A /* DOMTokenList.h in Headers */ = {isa = PBXBuildFile; fileRef = 76FC2B0912370DA0006A991A /* DOMTokenList.h */; };
 		76FF17E311235673001D61B5 /* PluginViewNone.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 76FF17E211235673001D61B5 /* PluginViewNone.cpp */; };
+		7728694E14F8882500F484DC /* EXTTextureFilterAnisotropic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7728694B14F8882500F484DC /* EXTTextureFilterAnisotropic.cpp */; };
+		7728694F14F8882500F484DC /* EXTTextureFilterAnisotropic.h in Headers */ = {isa = PBXBuildFile; fileRef = 7728694C14F8882500F484DC /* EXTTextureFilterAnisotropic.h */; };
+		7728698314FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7728698114FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.cpp */; };
+		7728698414FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.h in Headers */ = {isa = PBXBuildFile; fileRef = 7728698214FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.h */; };
 		77A17A7112F28182004E02F6 /* OESVertexArrayObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 77A17A6E12F28182004E02F6 /* OESVertexArrayObject.cpp */; };
 		77A17A7212F28182004E02F6 /* OESVertexArrayObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 77A17A6F12F28182004E02F6 /* OESVertexArrayObject.h */; };
 		77A17A7712F28642004E02F6 /* WebGLVertexArrayObjectOES.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 77A17A7412F28642004E02F6 /* WebGLVertexArrayObjectOES.cpp */; };
@@ -1954,14 +1907,9 @@
 		809DD1E0130DE2AD00CAE3ED /* CSSStyleApplyProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 809DD1DE130DE2AD00CAE3ED /* CSSStyleApplyProperty.h */; };
 		8102C5881325BB1100DDE67A /* StringCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8102C5871325BB1100DDE67A /* StringCallback.cpp */; };
 		815E6167132587AA00B622B0 /* DataTransferItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 815E6166132587AA00B622B0 /* DataTransferItem.cpp */; };
-		81A7325E1210189B00FC0D9E /* IDBCursor.h in Headers */ = {isa = PBXBuildFile; fileRef = 81A7325D1210189B00FC0D9E /* IDBCursor.h */; };
-		81A73260121018A400FC0D9E /* IDBCursor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81A7325F121018A400FC0D9E /* IDBCursor.cpp */; };
-		81A73278121019E100FC0D9E /* IDBCursorBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 81A73277121019E100FC0D9E /* IDBCursorBackendImpl.h */; };
 		81AC5999131636E60009A7E0 /* DataTransferItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC5997131636E60009A7E0 /* DataTransferItem.h */; };
 		81AC599A131636E60009A7E0 /* DataTransferItemList.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC5998131636E60009A7E0 /* DataTransferItemList.h */; };
 		81AC6C36131C57D30009A7E0 /* StringCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC6C35131C57D30009A7E0 /* StringCallback.h */; };
-		81BE209811F4AB8D00915DFA /* IDBCursorBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81BE209311F4AB8D00915DFA /* IDBCursorBackendImpl.cpp */; };
-		81BE209911F4AB8D00915DFA /* IDBCursorBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 81BE209411F4AB8D00915DFA /* IDBCursorBackendInterface.h */; };
 		81BE20D211F4BC3200915DFA /* JSIDBCursor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81BE20A711F4B66F00915DFA /* JSIDBCursor.cpp */; };
 		81BE20D311F4BC3200915DFA /* JSIDBCursor.h in Headers */ = {isa = PBXBuildFile; fileRef = 81BE20A811F4B66F00915DFA /* JSIDBCursor.h */; };
 		81F65FF613788FAA00FF6F2D /* DragState.h in Headers */ = {isa = PBXBuildFile; fileRef = 81F65FF513788FAA00FF6F2D /* DragState.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3033,6 +2981,8 @@
 		8AA61CFF144D595B00F37350 /* WebKitCSSRegionRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8AA61CFD144D595B00F37350 /* WebKitCSSRegionRule.cpp */; };
 		8AA61D00144D595B00F37350 /* WebKitCSSRegionRule.h in Headers */ = {isa = PBXBuildFile; fileRef = 8AA61CFE144D595B00F37350 /* WebKitCSSRegionRule.h */; };
 		8AB4BC77126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h in Headers */ = {isa = PBXBuildFile; fileRef = 8AB4BC76126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h */; };
+		8ABAFB9F14F5107500A4984B /* RegionNodeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8ABAFB9D14F5107500A4984B /* RegionNodeList.cpp */; };
+		8ABAFBA014F5107500A4984B /* RegionNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = 8ABAFB9E14F5107500A4984B /* RegionNodeList.h */; };
 		8AD0A59414C88336000D83C5 /* JSWebKitCSSRegionRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8ACC24CD148E24B200EFCC0D /* JSWebKitCSSRegionRule.cpp */; };
 		8AD0A59514C88336000D83C5 /* JSWebKitCSSRegionRule.h in Headers */ = {isa = PBXBuildFile; fileRef = 8ACC24CE148E24B200EFCC0D /* JSWebKitCSSRegionRule.h */; };
 		8AD0A59614C88358000D83C5 /* DOMWebKitCSSRegionRule.h in Headers */ = {isa = PBXBuildFile; fileRef = 8ACC2817148E47E700EFCC0D /* DOMWebKitCSSRegionRule.h */; };
@@ -3327,6 +3277,81 @@
 		970B72A6145008EB00F00A37 /* EventHeaders.h in Headers */ = {isa = PBXBuildFile; fileRef = 970B72A5145008EB00F00A37 /* EventHeaders.h */; };
 		9711460314EF009A00674FD9 /* NavigatorGeolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9711460014EF009A00674FD9 /* NavigatorGeolocation.cpp */; };
 		9711460414EF009A00674FD9 /* NavigatorGeolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 9711460114EF009A00674FD9 /* NavigatorGeolocation.h */; };
+		9712A5AD15004EDA0048AF10 /* DOMWindowIndexedDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A55415004EDA0048AF10 /* DOMWindowIndexedDatabase.cpp */; };
+		9712A5AE15004EDA0048AF10 /* DOMWindowIndexedDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A55515004EDA0048AF10 /* DOMWindowIndexedDatabase.h */; };
+		9712A5B015004EDA0048AF10 /* IDBAny.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A55715004EDA0048AF10 /* IDBAny.cpp */; };
+		9712A5B115004EDA0048AF10 /* IDBAny.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A55815004EDA0048AF10 /* IDBAny.h */; };
+		9712A5B315004EDA0048AF10 /* IDBBackingStore.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A55A15004EDA0048AF10 /* IDBBackingStore.h */; };
+		9712A5B415004EDA0048AF10 /* IDBCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A55B15004EDA0048AF10 /* IDBCallbacks.h */; };
+		9712A5B515004EDA0048AF10 /* IDBCursor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A55C15004EDA0048AF10 /* IDBCursor.cpp */; };
+		9712A5B615004EDA0048AF10 /* IDBCursor.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A55D15004EDA0048AF10 /* IDBCursor.h */; };
+		9712A5B815004EDA0048AF10 /* IDBCursorBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A55F15004EDA0048AF10 /* IDBCursorBackendImpl.cpp */; };
+		9712A5B915004EDA0048AF10 /* IDBCursorBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56015004EDA0048AF10 /* IDBCursorBackendImpl.h */; };
+		9712A5BA15004EDA0048AF10 /* IDBCursorBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56115004EDA0048AF10 /* IDBCursorBackendInterface.h */; };
+		9712A5BB15004EDA0048AF10 /* IDBCursorWithValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A56215004EDA0048AF10 /* IDBCursorWithValue.cpp */; };
+		9712A5BC15004EDA0048AF10 /* IDBCursorWithValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56315004EDA0048AF10 /* IDBCursorWithValue.h */; };
+		9712A5BE15004EDA0048AF10 /* IDBDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A56515004EDA0048AF10 /* IDBDatabase.cpp */; };
+		9712A5BF15004EDA0048AF10 /* IDBDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56615004EDA0048AF10 /* IDBDatabase.h */; };
+		9712A5C115004EDA0048AF10 /* IDBDatabaseBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A56815004EDA0048AF10 /* IDBDatabaseBackendImpl.cpp */; };
+		9712A5C215004EDA0048AF10 /* IDBDatabaseBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56915004EDA0048AF10 /* IDBDatabaseBackendImpl.h */; };
+		9712A5C315004EDA0048AF10 /* IDBDatabaseBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56A15004EDA0048AF10 /* IDBDatabaseBackendInterface.h */; };
+		9712A5C415004EDA0048AF10 /* IDBDatabaseCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56B15004EDA0048AF10 /* IDBDatabaseCallbacks.h */; };
+		9712A5C515004EDA0048AF10 /* IDBDatabaseCallbacksImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A56C15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.cpp */; };
+		9712A5C615004EDA0048AF10 /* IDBDatabaseCallbacksImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56D15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.h */; };
+		9712A5C715004EDA0048AF10 /* IDBDatabaseError.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56E15004EDA0048AF10 /* IDBDatabaseError.h */; };
+		9712A5C915004EDA0048AF10 /* IDBDatabaseException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57015004EDA0048AF10 /* IDBDatabaseException.cpp */; };
+		9712A5CA15004EDA0048AF10 /* IDBDatabaseException.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57115004EDA0048AF10 /* IDBDatabaseException.h */; };
+		9712A5CC15004EDA0048AF10 /* IDBEventDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57315004EDA0048AF10 /* IDBEventDispatcher.cpp */; };
+		9712A5CD15004EDA0048AF10 /* IDBEventDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57415004EDA0048AF10 /* IDBEventDispatcher.h */; };
+		9712A5CE15004EDA0048AF10 /* IDBFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57515004EDA0048AF10 /* IDBFactory.cpp */; };
+		9712A5CF15004EDA0048AF10 /* IDBFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57615004EDA0048AF10 /* IDBFactory.h */; };
+		9712A5D115004EDA0048AF10 /* IDBFactoryBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57815004EDA0048AF10 /* IDBFactoryBackendImpl.cpp */; };
+		9712A5D215004EDA0048AF10 /* IDBFactoryBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57915004EDA0048AF10 /* IDBFactoryBackendImpl.h */; };
+		9712A5D315004EDA0048AF10 /* IDBFactoryBackendInterface.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57A15004EDA0048AF10 /* IDBFactoryBackendInterface.cpp */; };
+		9712A5D415004EDA0048AF10 /* IDBFactoryBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57B15004EDA0048AF10 /* IDBFactoryBackendInterface.h */; };
+		9712A5D515004EDA0048AF10 /* IDBIndex.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57C15004EDA0048AF10 /* IDBIndex.cpp */; };
+		9712A5D615004EDA0048AF10 /* IDBIndex.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57D15004EDA0048AF10 /* IDBIndex.h */; };
+		9712A5D815004EDA0048AF10 /* IDBIndexBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57F15004EDA0048AF10 /* IDBIndexBackendImpl.cpp */; };
+		9712A5D915004EDA0048AF10 /* IDBIndexBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58015004EDA0048AF10 /* IDBIndexBackendImpl.h */; };
+		9712A5DA15004EDA0048AF10 /* IDBIndexBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58115004EDA0048AF10 /* IDBIndexBackendInterface.h */; };
+		9712A5DB15004EDA0048AF10 /* IDBKey.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58215004EDA0048AF10 /* IDBKey.cpp */; };
+		9712A5DC15004EDA0048AF10 /* IDBKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58315004EDA0048AF10 /* IDBKey.h */; };
+		9712A5DE15004EDA0048AF10 /* IDBKeyPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58515004EDA0048AF10 /* IDBKeyPath.cpp */; };
+		9712A5DF15004EDA0048AF10 /* IDBKeyPath.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58615004EDA0048AF10 /* IDBKeyPath.h */; };
+		9712A5E015004EDA0048AF10 /* IDBKeyPathBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58715004EDA0048AF10 /* IDBKeyPathBackendImpl.cpp */; };
+		9712A5E115004EDA0048AF10 /* IDBKeyPathBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58815004EDA0048AF10 /* IDBKeyPathBackendImpl.h */; };
+		9712A5E215004EDA0048AF10 /* IDBKeyRange.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58915004EDA0048AF10 /* IDBKeyRange.cpp */; };
+		9712A5E315004EDA0048AF10 /* IDBKeyRange.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58A15004EDA0048AF10 /* IDBKeyRange.h */; };
+		9712A5E515004EDA0048AF10 /* IDBLevelDBBackingStore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58C15004EDA0048AF10 /* IDBLevelDBBackingStore.cpp */; };
+		9712A5E615004EDA0048AF10 /* IDBLevelDBBackingStore.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58D15004EDA0048AF10 /* IDBLevelDBBackingStore.h */; };
+		9712A5E715004EDA0048AF10 /* IDBLevelDBCoding.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58E15004EDA0048AF10 /* IDBLevelDBCoding.cpp */; };
+		9712A5E815004EDA0048AF10 /* IDBLevelDBCoding.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58F15004EDA0048AF10 /* IDBLevelDBCoding.h */; };
+		9712A5E915004EDA0048AF10 /* IDBObjectStore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59015004EDA0048AF10 /* IDBObjectStore.cpp */; };
+		9712A5EA15004EDA0048AF10 /* IDBObjectStore.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59115004EDA0048AF10 /* IDBObjectStore.h */; };
+		9712A5EC15004EDA0048AF10 /* IDBObjectStoreBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59315004EDA0048AF10 /* IDBObjectStoreBackendImpl.cpp */; };
+		9712A5ED15004EDA0048AF10 /* IDBObjectStoreBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59415004EDA0048AF10 /* IDBObjectStoreBackendImpl.h */; };
+		9712A5EE15004EDA0048AF10 /* IDBObjectStoreBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59515004EDA0048AF10 /* IDBObjectStoreBackendInterface.h */; };
+		9712A5EF15004EDA0048AF10 /* IDBPendingTransactionMonitor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59615004EDA0048AF10 /* IDBPendingTransactionMonitor.cpp */; };
+		9712A5F015004EDA0048AF10 /* IDBPendingTransactionMonitor.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59715004EDA0048AF10 /* IDBPendingTransactionMonitor.h */; };
+		9712A5F115004EDA0048AF10 /* IDBRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59815004EDA0048AF10 /* IDBRequest.cpp */; };
+		9712A5F215004EDA0048AF10 /* IDBRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59915004EDA0048AF10 /* IDBRequest.h */; };
+		9712A5F415004EDA0048AF10 /* IDBTracing.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59B15004EDA0048AF10 /* IDBTracing.h */; };
+		9712A5F515004EDA0048AF10 /* IDBTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59C15004EDA0048AF10 /* IDBTransaction.cpp */; };
+		9712A5F615004EDA0048AF10 /* IDBTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59D15004EDA0048AF10 /* IDBTransaction.h */; };
+		9712A5F815004EDA0048AF10 /* IDBTransactionBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59F15004EDA0048AF10 /* IDBTransactionBackendImpl.cpp */; };
+		9712A5F915004EDA0048AF10 /* IDBTransactionBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A015004EDA0048AF10 /* IDBTransactionBackendImpl.h */; };
+		9712A5FA15004EDA0048AF10 /* IDBTransactionBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A115004EDA0048AF10 /* IDBTransactionBackendInterface.h */; };
+		9712A5FB15004EDA0048AF10 /* IDBTransactionCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A215004EDA0048AF10 /* IDBTransactionCallbacks.h */; };
+		9712A5FC15004EDA0048AF10 /* IDBTransactionCoordinator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A5A315004EDA0048AF10 /* IDBTransactionCoordinator.cpp */; };
+		9712A5FD15004EDA0048AF10 /* IDBTransactionCoordinator.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A415004EDA0048AF10 /* IDBTransactionCoordinator.h */; };
+		9712A5FE15004EDA0048AF10 /* IDBVersionChangeEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A5A515004EDA0048AF10 /* IDBVersionChangeEvent.cpp */; };
+		9712A5FF15004EDA0048AF10 /* IDBVersionChangeEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A615004EDA0048AF10 /* IDBVersionChangeEvent.h */; };
+		9712A60115004EDA0048AF10 /* IDBVersionChangeRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A5A815004EDA0048AF10 /* IDBVersionChangeRequest.cpp */; };
+		9712A60215004EDA0048AF10 /* IDBVersionChangeRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A915004EDA0048AF10 /* IDBVersionChangeRequest.h */; };
+		9712A60415004EDA0048AF10 /* PageGroupIndexedDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A5AB15004EDA0048AF10 /* PageGroupIndexedDatabase.cpp */; };
+		9712A60515004EDA0048AF10 /* PageGroupIndexedDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5AC15004EDA0048AF10 /* PageGroupIndexedDatabase.h */; };
+		9712A611150090CE0048AF10 /* WorkerContextIndexedDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A60E150090CE0048AF10 /* WorkerContextIndexedDatabase.cpp */; };
+		9712A612150090CE0048AF10 /* WorkerContextIndexedDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A60F150090CE0048AF10 /* WorkerContextIndexedDatabase.h */; };
 		97205AAF123928CA00B17380 /* FTPDirectoryDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97205AAD123928CA00B17380 /* FTPDirectoryDocument.cpp */; };
 		97205AB0123928CA00B17380 /* FTPDirectoryDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = 97205AAE123928CA00B17380 /* FTPDirectoryDocument.h */; };
 		97205AB51239291000B17380 /* ImageDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97205AB11239291000B17380 /* ImageDocument.cpp */; };
@@ -3372,6 +3397,9 @@
 		975CA28B130365F800E99AD9 /* Crypto.h in Headers */ = {isa = PBXBuildFile; fileRef = 975CA288130365F800E99AD9 /* Crypto.h */; };
 		975CA2A11303679D00E99AD9 /* JSCrypto.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 975CA29F1303679D00E99AD9 /* JSCrypto.cpp */; };
 		975CA2A21303679D00E99AD9 /* JSCrypto.h in Headers */ = {isa = PBXBuildFile; fileRef = 975CA2A01303679D00E99AD9 /* JSCrypto.h */; };
+		97627B8D14FB3CEE002CDCA1 /* ContextDestructionObserver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97627B8B14FB3CEE002CDCA1 /* ContextDestructionObserver.cpp */; };
+		97627B8E14FB3CEE002CDCA1 /* ContextDestructionObserver.h in Headers */ = {isa = PBXBuildFile; fileRef = 97627B8C14FB3CEE002CDCA1 /* ContextDestructionObserver.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97627B9814FB5424002CDCA1 /* Supplementable.h in Headers */ = {isa = PBXBuildFile; fileRef = 97627B9714FB5424002CDCA1 /* Supplementable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97665013144FAA4200F6BB51 /* EventFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 97665011144FAA4200F6BB51 /* EventFactory.h */; };
 		9766504F144FBFFE00F6BB51 /* EventFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9766504E144FBFFE00F6BB51 /* EventFactory.cpp */; };
 		9767CE0B145ABC13005E64DB /* ExceptionHeaders.h in Headers */ = {isa = PBXBuildFile; fileRef = 9767CE09145ABC12005E64DB /* ExceptionHeaders.h */; };
@@ -3390,8 +3418,6 @@
 		976D6C86122B8A3D001FD1F7 /* FileList.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C67122B8A3D001FD1F7 /* FileList.h */; };
 		976D6C88122B8A3D001FD1F7 /* FileReader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C69122B8A3D001FD1F7 /* FileReader.cpp */; };
 		976D6C89122B8A3D001FD1F7 /* FileReader.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C6A122B8A3D001FD1F7 /* FileReader.h */; };
-		976D6C8B122B8A3D001FD1F7 /* FileStreamProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C6C122B8A3D001FD1F7 /* FileStreamProxy.cpp */; };
-		976D6C8C122B8A3D001FD1F7 /* FileStreamProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C6D122B8A3D001FD1F7 /* FileStreamProxy.h */; };
 		976D6C8D122B8A3D001FD1F7 /* FileThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C6E122B8A3D001FD1F7 /* FileThread.cpp */; };
 		976D6C8E122B8A3D001FD1F7 /* FileThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C6F122B8A3D001FD1F7 /* FileThread.h */; };
 		976D6C8F122B8A3D001FD1F7 /* FileThreadTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C70122B8A3D001FD1F7 /* FileThreadTask.h */; };
@@ -3436,8 +3462,6 @@
 		977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */ = {isa = PBXBuildFile; fileRef = 977E2E0C12F0FC9C00C13379 /* XSSAuditor.h */; };
 		978AD67414130A8D00C7CAE3 /* HTMLSpanElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978AD67114130A8D00C7CAE3 /* HTMLSpanElement.cpp */; };
 		978AD67514130A8D00C7CAE3 /* HTMLSpanElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 978AD67214130A8D00C7CAE3 /* HTMLSpanElement.h */; };
-		978D07B2145A0EBD0096908D /* IDBDatabaseException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978D07B1145A0EBD0096908D /* IDBDatabaseException.cpp */; };
-		978D07B4145A0ECD0096908D /* SQLException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978D07B3145A0ECD0096908D /* SQLException.cpp */; };
 		978D07B6145A0F030096908D /* FileException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978D07B5145A0F030096908D /* FileException.cpp */; };
 		978D07B8145A0F1B0096908D /* OperationNotAllowedException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978D07B7145A0F1B0096908D /* OperationNotAllowedException.cpp */; };
 		978D07BA145A0F3C0096908D /* RangeException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978D07B9145A0F3C0096908D /* RangeException.cpp */; };
@@ -3450,8 +3474,86 @@
 		979F43D41075E44A0000F83B /* NavigationScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 979F43D21075E44A0000F83B /* NavigationScheduler.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97AA3CA5145237CC003E1DA6 /* EventTargetHeaders.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AA3CA3145237CC003E1DA6 /* EventTargetHeaders.h */; };
 		97AA3CA6145237CC003E1DA6 /* EventTargetInterfaces.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AA3CA4145237CC003E1DA6 /* EventTargetInterfaces.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97AABD1314FA09D5007457AE /* CloseEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABCF814FA09D5007457AE /* CloseEvent.h */; };
+		97AABD1614FA09D5007457AE /* ThreadableWebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABCFB14FA09D5007457AE /* ThreadableWebSocketChannel.cpp */; };
+		97AABD1714FA09D5007457AE /* ThreadableWebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABCFC14FA09D5007457AE /* ThreadableWebSocketChannel.h */; };
+		97AABD1814FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABCFD14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.cpp */; };
+		97AABD1914FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABCFE14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.h */; };
+		97AABD1A14FA09D5007457AE /* WebSocket.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABCFF14FA09D5007457AE /* WebSocket.cpp */; };
+		97AABD1B14FA09D5007457AE /* WebSocket.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0014FA09D5007457AE /* WebSocket.h */; };
+		97AABD1D14FA09D5007457AE /* WebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0214FA09D5007457AE /* WebSocketChannel.cpp */; };
+		97AABD1E14FA09D5007457AE /* WebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0314FA09D5007457AE /* WebSocketChannel.h */; };
+		97AABD1F14FA09D5007457AE /* WebSocketChannelClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0414FA09D5007457AE /* WebSocketChannelClient.h */; };
+		97AABD2014FA09D5007457AE /* WebSocketDeflater.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0514FA09D5007457AE /* WebSocketDeflater.cpp */; };
+		97AABD2114FA09D5007457AE /* WebSocketDeflater.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0614FA09D5007457AE /* WebSocketDeflater.h */; };
+		97AABD2214FA09D5007457AE /* WebSocketExtensionDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0714FA09D5007457AE /* WebSocketExtensionDispatcher.cpp */; };
+		97AABD2314FA09D5007457AE /* WebSocketExtensionDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0814FA09D5007457AE /* WebSocketExtensionDispatcher.h */; };
+		97AABD2414FA09D5007457AE /* WebSocketExtensionProcessor.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0914FA09D5007457AE /* WebSocketExtensionProcessor.h */; };
+		97AABD2514FA09D5007457AE /* WebSocketFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0A14FA09D5007457AE /* WebSocketFrame.h */; };
+		97AABD2614FA09D5007457AE /* WebSocketHandshake.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0B14FA09D5007457AE /* WebSocketHandshake.cpp */; };
+		97AABD2714FA09D5007457AE /* WebSocketHandshake.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0C14FA09D5007457AE /* WebSocketHandshake.h */; };
+		97AABD2814FA09D5007457AE /* WebSocketHandshakeRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0D14FA09D5007457AE /* WebSocketHandshakeRequest.cpp */; };
+		97AABD2914FA09D5007457AE /* WebSocketHandshakeRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0E14FA09D5007457AE /* WebSocketHandshakeRequest.h */; };
+		97AABD2A14FA09D5007457AE /* WebSocketHandshakeResponse.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0F14FA09D5007457AE /* WebSocketHandshakeResponse.cpp */; };
+		97AABD2B14FA09D5007457AE /* WebSocketHandshakeResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD1014FA09D5007457AE /* WebSocketHandshakeResponse.h */; };
+		97AABD2C14FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD1114FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp */; };
+		97AABD2D14FA09D5007457AE /* WorkerThreadableWebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD1214FA09D5007457AE /* WorkerThreadableWebSocketChannel.h */; };
 		97B1F02E13B025CA00F5103F /* SharedBufferChunkReader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37569E0013AF172C00CDBA8E /* SharedBufferChunkReader.cpp */; };
 		97B1F02F13B025D200F5103F /* SharedBufferChunkReader.h in Headers */ = {isa = PBXBuildFile; fileRef = 37569E0213AF172C00CDBA8E /* SharedBufferChunkReader.h */; };
+		97BC69DA1505F076001B74AC /* AbstractDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69D61505F076001B74AC /* AbstractDatabase.cpp */; };
+		97BC69DB1505F076001B74AC /* AbstractDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69D71505F076001B74AC /* AbstractDatabase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97BC69DC1505F076001B74AC /* ChangeVersionWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69D81505F076001B74AC /* ChangeVersionWrapper.cpp */; };
+		97BC69DD1505F076001B74AC /* ChangeVersionWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69D91505F076001B74AC /* ChangeVersionWrapper.h */; };
+		97BC6A201505F081001B74AC /* Database.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69DE1505F081001B74AC /* Database.cpp */; };
+		97BC6A211505F081001B74AC /* Database.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69DF1505F081001B74AC /* Database.h */; };
+		97BC6A231505F081001B74AC /* DatabaseAuthorizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69E11505F081001B74AC /* DatabaseAuthorizer.cpp */; };
+		97BC6A241505F081001B74AC /* DatabaseAuthorizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69E21505F081001B74AC /* DatabaseAuthorizer.h */; };
+		97BC6A251505F081001B74AC /* DatabaseCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69E31505F081001B74AC /* DatabaseCallback.h */; };
+		97BC6A271505F081001B74AC /* DatabaseContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69E51505F081001B74AC /* DatabaseContext.cpp */; };
+		97BC6A281505F081001B74AC /* DatabaseContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69E61505F081001B74AC /* DatabaseContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97BC6A291505F081001B74AC /* DatabaseDetails.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69E71505F081001B74AC /* DatabaseDetails.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97BC6A2A1505F081001B74AC /* DatabaseSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69E81505F081001B74AC /* DatabaseSync.cpp */; };
+		97BC6A2B1505F081001B74AC /* DatabaseSync.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69E91505F081001B74AC /* DatabaseSync.h */; };
+		97BC6A2D1505F081001B74AC /* DatabaseTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69EB1505F081001B74AC /* DatabaseTask.cpp */; };
+		97BC6A2E1505F081001B74AC /* DatabaseTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69EC1505F081001B74AC /* DatabaseTask.h */; };
+		97BC6A2F1505F081001B74AC /* DatabaseThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69ED1505F081001B74AC /* DatabaseThread.cpp */; };
+		97BC6A301505F081001B74AC /* DatabaseThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69EE1505F081001B74AC /* DatabaseThread.h */; };
+		97BC6A311505F081001B74AC /* DatabaseTracker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69EF1505F081001B74AC /* DatabaseTracker.cpp */; };
+		97BC6A321505F081001B74AC /* DatabaseTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F01505F081001B74AC /* DatabaseTracker.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97BC6A331505F081001B74AC /* DatabaseTrackerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F11505F081001B74AC /* DatabaseTrackerClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97BC6A341505F081001B74AC /* DOMWindowSQLDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69F21505F081001B74AC /* DOMWindowSQLDatabase.cpp */; };
+		97BC6A351505F081001B74AC /* DOMWindowSQLDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F31505F081001B74AC /* DOMWindowSQLDatabase.h */; };
+		97BC6A371505F081001B74AC /* OriginQuotaManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69F51505F081001B74AC /* OriginQuotaManager.cpp */; };
+		97BC6A381505F081001B74AC /* OriginQuotaManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F61505F081001B74AC /* OriginQuotaManager.h */; };
+		97BC6A391505F081001B74AC /* OriginUsageRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69F71505F081001B74AC /* OriginUsageRecord.cpp */; };
+		97BC6A3A1505F081001B74AC /* OriginUsageRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F81505F081001B74AC /* OriginUsageRecord.h */; };
+		97BC6A3B1505F081001B74AC /* SQLCallbackWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F91505F081001B74AC /* SQLCallbackWrapper.h */; };
+		97BC6A3C1505F081001B74AC /* SQLError.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69FA1505F081001B74AC /* SQLError.h */; };
+		97BC6A3E1505F081001B74AC /* SQLException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69FC1505F081001B74AC /* SQLException.cpp */; };
+		97BC6A3F1505F081001B74AC /* SQLException.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69FD1505F081001B74AC /* SQLException.h */; };
+		97BC6A411505F081001B74AC /* SQLResultSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69FF1505F081001B74AC /* SQLResultSet.cpp */; };
+		97BC6A421505F081001B74AC /* SQLResultSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A001505F081001B74AC /* SQLResultSet.h */; };
+		97BC6A441505F081001B74AC /* SQLResultSetRowList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A021505F081001B74AC /* SQLResultSetRowList.cpp */; };
+		97BC6A451505F081001B74AC /* SQLResultSetRowList.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A031505F081001B74AC /* SQLResultSetRowList.h */; };
+		97BC6A471505F081001B74AC /* SQLStatement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A051505F081001B74AC /* SQLStatement.cpp */; };
+		97BC6A481505F081001B74AC /* SQLStatement.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A061505F081001B74AC /* SQLStatement.h */; };
+		97BC6A491505F081001B74AC /* SQLStatementCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A071505F081001B74AC /* SQLStatementCallback.h */; };
+		97BC6A4B1505F081001B74AC /* SQLStatementErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A091505F081001B74AC /* SQLStatementErrorCallback.h */; };
+		97BC6A4D1505F081001B74AC /* SQLStatementSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A0B1505F081001B74AC /* SQLStatementSync.cpp */; };
+		97BC6A4E1505F081001B74AC /* SQLStatementSync.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A0C1505F081001B74AC /* SQLStatementSync.h */; };
+		97BC6A4F1505F081001B74AC /* SQLTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A0D1505F081001B74AC /* SQLTransaction.cpp */; };
+		97BC6A501505F081001B74AC /* SQLTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A0E1505F081001B74AC /* SQLTransaction.h */; };
+		97BC6A521505F081001B74AC /* SQLTransactionCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A101505F081001B74AC /* SQLTransactionCallback.h */; };
+		97BC6A541505F081001B74AC /* SQLTransactionClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A121505F081001B74AC /* SQLTransactionClient.cpp */; };
+		97BC6A551505F081001B74AC /* SQLTransactionClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A131505F081001B74AC /* SQLTransactionClient.h */; };
+		97BC6A561505F081001B74AC /* SQLTransactionCoordinator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A141505F081001B74AC /* SQLTransactionCoordinator.cpp */; };
+		97BC6A571505F081001B74AC /* SQLTransactionCoordinator.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A151505F081001B74AC /* SQLTransactionCoordinator.h */; };
+		97BC6A581505F081001B74AC /* SQLTransactionErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A161505F081001B74AC /* SQLTransactionErrorCallback.h */; };
+		97BC6A5A1505F081001B74AC /* SQLTransactionSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A181505F081001B74AC /* SQLTransactionSync.cpp */; };
+		97BC6A5B1505F081001B74AC /* SQLTransactionSync.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A191505F081001B74AC /* SQLTransactionSync.h */; };
+		97BC6A5D1505F081001B74AC /* SQLTransactionSyncCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A1B1505F081001B74AC /* SQLTransactionSyncCallback.h */; };
+		97BC6A5F1505F081001B74AC /* WorkerContextSQLDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A1D1505F081001B74AC /* WorkerContextSQLDatabase.cpp */; };
+		97BC6A601505F081001B74AC /* WorkerContextSQLDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A1E1505F081001B74AC /* WorkerContextSQLDatabase.h */; };
 		97BC84831236FD93000C6161 /* TextDocumentParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC84811236FD93000C6161 /* TextDocumentParser.cpp */; };
 		97BC84841236FD93000C6161 /* TextDocumentParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC84821236FD93000C6161 /* TextDocumentParser.h */; };
 		97BC849B12370A4B000C6161 /* HTMLInputStream.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC849A12370A4B000C6161 /* HTMLInputStream.h */; };
@@ -3462,8 +3564,6 @@
 		97C078501165D5BE003A32EF /* SuffixTree.h in Headers */ = {isa = PBXBuildFile; fileRef = 97C0784F1165D5BE003A32EF /* SuffixTree.h */; };
 		97C471DB12F925BD0086354B /* ContentSecurityPolicy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97C471D912F925BC0086354B /* ContentSecurityPolicy.cpp */; };
 		97C471DC12F925BD0086354B /* ContentSecurityPolicy.h in Headers */ = {isa = PBXBuildFile; fileRef = 97C471DA12F925BD0086354B /* ContentSecurityPolicy.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		97CC3AE214E8E4A200894988 /* NavigatorSupplement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */; };
-		97CC3AE314E8E4A200894988 /* NavigatorSupplement.h in Headers */ = {isa = PBXBuildFile; fileRef = 97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97D2AD0314B823A60093DF32 /* DOMWindowProperty.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97D2AD0114B823A60093DF32 /* DOMWindowProperty.cpp */; };
 		97D2AD0414B823A60093DF32 /* DOMWindowProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 97D2AD0214B823A60093DF32 /* DOMWindowProperty.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97DCE20110807C750057D394 /* HistoryController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97DCE1FF10807C750057D394 /* HistoryController.cpp */; };
@@ -3481,6 +3581,7 @@
 		98EB1F951313FE0500D0E1EA /* NotImplemented.h in Headers */ = {isa = PBXBuildFile; fileRef = 98EB1F941313FE0500D0E1EA /* NotImplemented.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9B0FB191140DB5790022588F /* HTTPValidation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9B0FB18F140DB5790022588F /* HTTPValidation.cpp */; };
 		9B0FB192140DB5790022588F /* HTTPValidation.h in Headers */ = {isa = PBXBuildFile; fileRef = 9B0FB190140DB5790022588F /* HTTPValidation.h */; };
+		9B2B7AC11509850A008932CC /* MicroDataItemValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9B2F7CF714562120007F8B50 /* MicroDataItemValue.cpp */; };
 		9B2D8A7914997CCF00ECEF3E /* UndoStep.h in Headers */ = {isa = PBXBuildFile; fileRef = 9B2D8A7814997CCF00ECEF3E /* UndoStep.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9B32CDA913DF7FA900F34D13 /* RenderedPosition.h in Headers */ = {isa = PBXBuildFile; fileRef = 9B32CDA713DF7FA900F34D13 /* RenderedPosition.h */; };
 		9B32CDAA13DF7FA900F34D13 /* RenderedPosition.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9B32CDA813DF7FA900F34D13 /* RenderedPosition.cpp */; };
@@ -3527,6 +3628,8 @@
 		A10BB58B1484E3B300B2E87A /* RenderSVGShape.h in Headers */ = {isa = PBXBuildFile; fileRef = A10BB5891484E3B300B2E87A /* RenderSVGShape.h */; };
 		A10DC76A14747BAB005E2471 /* StyleGridData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A10DC76814747BAB005E2471 /* StyleGridData.cpp */; };
 		A10DC76B14747BAB005E2471 /* StyleGridData.h in Headers */ = {isa = PBXBuildFile; fileRef = A10DC76914747BAB005E2471 /* StyleGridData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A110DB9B14F5DF7700A03B93 /* StyleGridItemData.h in Headers */ = {isa = PBXBuildFile; fileRef = A110DB9A14F5DF7700A03B93 /* StyleGridItemData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A110DB9D14F5DF8700A03B93 /* StyleGridItemData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A110DB9C14F5DF8700A03B93 /* StyleGridItemData.cpp */; };
 		A120ACA413F998CA00FE4AC7 /* LayoutRepainter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A120ACA113F9984600FE4AC7 /* LayoutRepainter.cpp */; };
 		A12538D413F9B60A00024754 /* LayoutRepainter.h in Headers */ = {isa = PBXBuildFile; fileRef = A120ACA013F9983700FE4AC7 /* LayoutRepainter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A136A00C1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A136A00A1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.cpp */; };
@@ -3585,8 +3688,6 @@
 		A715E653134BBBEC00D8E713 /* ProgressShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A715E651134BBBEC00D8E713 /* ProgressShadowElement.h */; };
 		A718760E0B2A120100A16ECE /* DragActions.h in Headers */ = {isa = PBXBuildFile; fileRef = A718760D0B2A120100A16ECE /* DragActions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A71878900B2D04AC00A16ECE /* DragControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */; };
-		A71E083714E3CEAF006A4619 /* PageSupplement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A71E083514E3CEAF006A4619 /* PageSupplement.cpp */; };
-		A71E083814E3CEAF006A4619 /* PageSupplement.h in Headers */ = {isa = PBXBuildFile; fileRef = A71E083614E3CEAF006A4619 /* PageSupplement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A723F77B1484CA4C008C6DBE /* PlatformExportMacros.h in Headers */ = {isa = PBXBuildFile; fileRef = A723F77A1484CA4C008C6DBE /* PlatformExportMacros.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A73F95FE12C97BFE0031AAF9 /* RoundedRect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A73F95FC12C97BFE0031AAF9 /* RoundedRect.cpp */; };
 		A73F95FF12C97BFE0031AAF9 /* RoundedRect.h in Headers */ = {isa = PBXBuildFile; fileRef = A73F95FD12C97BFE0031AAF9 /* RoundedRect.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3642,7 +3743,6 @@
 		A7D20F62107F406900A80392 /* JSWebGLActiveInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D20F60107F406900A80392 /* JSWebGLActiveInfo.cpp */; };
 		A7D20F63107F406900A80392 /* JSWebGLActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F61107F406900A80392 /* JSWebGLActiveInfo.h */; };
 		A7D20F6D107F438B00A80392 /* WebGLActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F6B107F438B00A80392 /* WebGLActiveInfo.h */; };
-		A7D3C5240B576B4B002CA450 /* PasteboardHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7D6B3490F61104500B79FD1 /* WorkerScriptLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D6B3470F61104500B79FD1 /* WorkerScriptLoader.h */; };
 		A7D6B34A0F61104500B79FD1 /* WorkerScriptLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D6B3480F61104500B79FD1 /* WorkerScriptLoader.cpp */; };
 		A7DBF8DD1276919C006B6008 /* TextCheckingHelper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7DBF8DB1276919C006B6008 /* TextCheckingHelper.cpp */; };
@@ -4138,8 +4238,6 @@
 		A8EA800C0A19516E00A8EF5F /* StyleSheet.h in Headers */ = {isa = PBXBuildFile; fileRef = A8EA80040A19516E00A8EF5F /* StyleSheet.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A8EA800D0A19516E00A8EF5F /* StyleSheet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8EA80050A19516E00A8EF5F /* StyleSheet.cpp */; };
 		A8EA800E0A19516E00A8EF5F /* MediaList.h in Headers */ = {isa = PBXBuildFile; fileRef = A8EA80060A19516E00A8EF5F /* MediaList.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A8F457A014BC1A88000CEA59 /* DOMWindowSQLDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8F4579D14BC13EC000CEA59 /* DOMWindowSQLDatabase.cpp */; };
-		A8F457A114BC1A94000CEA59 /* DOMWindowSQLDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = A8F4579E14BC13EC000CEA59 /* DOMWindowSQLDatabase.h */; };
 		A8F46A840CB20A9D003A9670 /* DOMSVGClipPathElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 8503612C0ACE007B001F3D9E /* DOMSVGClipPathElement.h */; };
 		A8F46A880CB20A9D003A9670 /* DOMSVGGradientElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85C9A2EC0AD7E90300FBFF1E /* DOMSVGGradientElement.h */; };
 		A8F46A890CB20A9D003A9670 /* DOMSVGAnimateColorElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 850361280ACE007B001F3D9E /* DOMSVGAnimateColorElement.h */; };
@@ -4959,23 +5057,13 @@
 		B2FA3E180AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B2FA3D300AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp */; };
 		B2FA3E190AB75A6F000E5AC4 /* JSSVGZoomEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = B2FA3D310AB75A6F000E5AC4 /* JSSVGZoomEvent.h */; };
 		B50F5B810E96CD9900AD71A6 /* WebCoreObjCExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = B50F5B800E96CD9900AD71A6 /* WebCoreObjCExtras.mm */; settings = {COMPILER_FLAGS = "-Wno-deprecated-declarations"; }; };
-		B51BF6F0102C9E590002C15A /* SQLTransactionClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */; };
-		B51BF6F1102C9E590002C15A /* SQLTransactionClient.h in Headers */ = {isa = PBXBuildFile; fileRef = B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */; };
-		B523CF061182675400EBB29C /* SQLTransactionSyncCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B523CEFF1182675400EBB29C /* SQLTransactionSyncCallback.h */; };
-		B523CF081182675400EBB29C /* SQLTransactionSync.h in Headers */ = {isa = PBXBuildFile; fileRef = B523CF011182675400EBB29C /* SQLTransactionSync.h */; };
-		B523CF091182675400EBB29C /* SQLTransactionSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B523CF021182675400EBB29C /* SQLTransactionSync.cpp */; };
-		B523CF0A1182675400EBB29C /* DatabaseSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B523CF031182675400EBB29C /* DatabaseSync.cpp */; };
-		B523CF0B1182675400EBB29C /* DatabaseSync.h in Headers */ = {isa = PBXBuildFile; fileRef = B523CF041182675400EBB29C /* DatabaseSync.h */; };
 		B525A96511CA2340003A23A8 /* JSSQLException.h in Headers */ = {isa = PBXBuildFile; fileRef = B525A96311CA2340003A23A8 /* JSSQLException.h */; };
 		B525A96611CA2340003A23A8 /* JSSQLException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B525A96411CA2340003A23A8 /* JSSQLException.cpp */; };
 		B5320D6B122A24E9002D1440 /* FontPlatformData.h in Headers */ = {isa = PBXBuildFile; fileRef = B5320D69122A24E9002D1440 /* FontPlatformData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B5320D6C122A24E9002D1440 /* FontPlatformDataCocoa.mm in Sources */ = {isa = PBXBuildFile; fileRef = B5320D6A122A24E9002D1440 /* FontPlatformDataCocoa.mm */; };
-		B550B52511DC68A800923885 /* SQLStatementSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B550B52111DC68A800923885 /* SQLStatementSync.cpp */; };
-		B550B52611DC68A800923885 /* SQLStatementSync.h in Headers */ = {isa = PBXBuildFile; fileRef = B550B52211DC68A800923885 /* SQLStatementSync.h */; };
 		B55D5AA4119131FC00BCC315 /* JSSQLTransactionSyncCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B55D5AA2119131FC00BCC315 /* JSSQLTransactionSyncCallback.h */; };
 		B55D5AA5119131FC00BCC315 /* JSSQLTransactionSyncCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B55D5AA3119131FC00BCC315 /* JSSQLTransactionSyncCallback.cpp */; };
 		B55D5AA91191325000BCC315 /* JSSQLTransactionSyncCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B55D5AA71191325000BCC315 /* JSSQLTransactionSyncCustom.cpp */; };
-		B56EBA8511C9FF8100B04477 /* SQLException.h in Headers */ = {isa = PBXBuildFile; fileRef = B56EBA8311C9FF8100B04477 /* SQLException.h */; };
 		B58CEB6911913607002A6790 /* JSDatabaseSync.h in Headers */ = {isa = PBXBuildFile; fileRef = B58CEB6711913607002A6790 /* JSDatabaseSync.h */; };
 		B58CEB6A11913607002A6790 /* JSDatabaseSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B58CEB6811913607002A6790 /* JSDatabaseSync.cpp */; };
 		B58CEB6D1191361C002A6790 /* JSSQLTransactionSync.h in Headers */ = {isa = PBXBuildFile; fileRef = B58CEB6B1191361C002A6790 /* JSSQLTransactionSync.h */; };
@@ -4992,20 +5080,10 @@
 		B59DD6AA11902A71007E9684 /* JSSQLStatementErrorCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B59DD6A811902A71007E9684 /* JSSQLStatementErrorCallback.cpp */; };
 		B5A684220FFABE9800D24689 /* SQLiteFileSystem.h in Headers */ = {isa = PBXBuildFile; fileRef = B5A684210FFABE9800D24689 /* SQLiteFileSystem.h */; };
 		B5A684240FFABEAA00D24689 /* SQLiteFileSystem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5A684230FFABEAA00D24689 /* SQLiteFileSystem.cpp */; };
-		B5B5DC69119BB3D5002A8790 /* AbstractDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5B5DC67119BB3D5002A8790 /* AbstractDatabase.cpp */; };
-		B5B5DC6A119BB3D5002A8790 /* AbstractDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = B5B5DC68119BB3D5002A8790 /* AbstractDatabase.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */; };
-		B5C1123C102B6C4600096578 /* SQLTransactionCoordinator.h in Headers */ = {isa = PBXBuildFile; fileRef = B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */; };
 		B5D31DFA11CF610B009F22B4 /* ActiveDOMCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5D31DF811CF610B009F22B4 /* ActiveDOMCallback.cpp */; };
 		B5D31DFB11CF610B009F22B4 /* ActiveDOMCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B5D31DF911CF610B009F22B4 /* ActiveDOMCallback.h */; };
-		B5D3601A112F8B560048DEA8 /* DatabaseCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B5D36019112F8B560048DEA8 /* DatabaseCallback.h */; };
-		B61762541203374F00EF9114 /* IDBDatabaseBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = B61762531203374F00EF9114 /* IDBDatabaseBackendInterface.h */; };
-		B61762621203490800EF9114 /* IDBDatabaseBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = B61762611203490800EF9114 /* IDBDatabaseBackendImpl.h */; };
-		B656626A120B115A006EA85C /* IDBTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B6566267120B115A006EA85C /* IDBTransaction.cpp */; };
-		B656626B120B115A006EA85C /* IDBTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = B6566268120B115A006EA85C /* IDBTransaction.h */; };
 		B6566270120B1227006EA85C /* JSIDBTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = B656626E120B1227006EA85C /* JSIDBTransaction.h */; };
 		B6566271120B1227006EA85C /* JSIDBTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B656626F120B1227006EA85C /* JSIDBTransaction.cpp */; };
-		B691C1F91206D4A00025D980 /* IDBDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6A311D4FB3D004C3E4B /* IDBDatabase.cpp */; };
 		B71FE6DF11091CB300DAEF77 /* PrintContext.h in Headers */ = {isa = PBXBuildFile; fileRef = B776D43A1104525D00BEB0EC /* PrintContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B734B181119B9911006587BD /* FontTranscoder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B734B180119B9911006587BD /* FontTranscoder.cpp */; };
 		B734B183119B991D006587BD /* FontTranscoder.h in Headers */ = {isa = PBXBuildFile; fileRef = B734B182119B991D006587BD /* FontTranscoder.h */; };
@@ -5095,7 +5173,7 @@
 		BC23EE920DAED2BC009FDC91 /* CSSImageGeneratorValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC23EE910DAED2BC009FDC91 /* CSSImageGeneratorValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC23F0DB0DAFF4A4009FDC91 /* GeneratedImage.h in Headers */ = {isa = PBXBuildFile; fileRef = BC23F0DA0DAFF4A4009FDC91 /* GeneratedImage.h */; };
 		BC2441C40E8B65D00055320F /* ScrollView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2441C30E8B65D00055320F /* ScrollView.cpp */; };
-		BC25B52A131C6D3900180E10 /* LocalizedStringsMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC25B528131C6D3900180E10 /* LocalizedStringsMac.mm */; };
+		BC25B52A131C6D3900180E10 /* LocalizedStringsMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC25B528131C6D3900180E10 /* LocalizedStringsMac.cpp */; };
 		BC274B2F140EBEB200EADFA6 /* CSSBorderImageSliceValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC274B2E140EBEB200EADFA6 /* CSSBorderImageSliceValue.h */; };
 		BC274B31140EBED800EADFA6 /* CSSBorderImageSliceValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC274B30140EBED800EADFA6 /* CSSBorderImageSliceValue.cpp */; };
 		BC275B7911C5D1C300C9206C /* JSWebKitPointCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC275B7811C5D1C300C9206C /* JSWebKitPointCustom.cpp */; };
@@ -5525,6 +5603,8 @@
 		C105DA620F3AA68F001DD44F /* TextEncodingDetectorICU.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C105DA610F3AA68F001DD44F /* TextEncodingDetectorICU.cpp */; };
 		C105DA640F3AA6B8001DD44F /* TextEncodingDetector.h in Headers */ = {isa = PBXBuildFile; fileRef = C105DA630F3AA6B8001DD44F /* TextEncodingDetector.h */; };
 		C330A22313EC196B0000B45B /* ColorChooser.h in Headers */ = {isa = PBXBuildFile; fileRef = C330A22113EC196B0000B45B /* ColorChooser.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C33EE5C414FB49610002095A /* BaseClickableWithKeyInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C33EE5C214FB49610002095A /* BaseClickableWithKeyInputType.cpp */; };
+		C33EE5C514FB49610002095A /* BaseClickableWithKeyInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = C33EE5C314FB49610002095A /* BaseClickableWithKeyInputType.h */; };
 		C37CDEBD149EF2030042090D /* ColorChooserClient.h in Headers */ = {isa = PBXBuildFile; fileRef = C37CDEBC149EF2030042090D /* ColorChooserClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C50B561612119D23008B46E0 /* GroupSettings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C50B561412119D23008B46E0 /* GroupSettings.cpp */; };
 		C50B561712119D23008B46E0 /* GroupSettings.h in Headers */ = {isa = PBXBuildFile; fileRef = C50B561512119D23008B46E0 /* GroupSettings.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -5542,11 +5622,6 @@
 		C55610F111A704EB00B82D27 /* DOMStringList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C55610F011A704EB00B82D27 /* DOMStringList.cpp */; };
 		C55E38BF10040D5D00A56BDB /* StorageNamespaceImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */; };
 		C55E38C010040D5D00A56BDB /* StorageNamespaceImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C55E38BC10040D5D00A56BDB /* StorageNamespaceImpl.cpp */; };
-		C572EE0A1201C736007D8F82 /* IDBIndex.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C572EE041201C736007D8F82 /* IDBIndex.cpp */; };
-		C572EE0B1201C736007D8F82 /* IDBIndex.h in Headers */ = {isa = PBXBuildFile; fileRef = C572EE051201C736007D8F82 /* IDBIndex.h */; };
-		C572EE0D1201C736007D8F82 /* IDBIndexBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C572EE071201C736007D8F82 /* IDBIndexBackendImpl.cpp */; };
-		C572EE0E1201C736007D8F82 /* IDBIndexBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C572EE081201C736007D8F82 /* IDBIndexBackendImpl.h */; };
-		C572EE0F1201C736007D8F82 /* IDBIndexBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = C572EE091201C736007D8F82 /* IDBIndexBackendInterface.h */; };
 		C572EE1E1201C9BC007D8F82 /* JSIDBIndex.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C572EE1C1201C9BC007D8F82 /* JSIDBIndex.cpp */; };
 		C572EE1F1201C9BC007D8F82 /* JSIDBIndex.h in Headers */ = {isa = PBXBuildFile; fileRef = C572EE1D1201C9BC007D8F82 /* JSIDBIndex.h */; };
 		C57FEDE11212EE9C0097BE65 /* FileSystem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C57FEDE01212EE9C0097BE65 /* FileSystem.cpp */; };
@@ -5572,36 +5647,15 @@
 		C585A69111D4FB08004C3E4B /* JSIDBRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A67911D4FB07004C3E4B /* JSIDBRequest.h */; };
 		C585A69611D4FB13004C3E4B /* JSIDBFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A69411D4FB13004C3E4B /* JSIDBFactory.cpp */; };
 		C585A69711D4FB13004C3E4B /* JSIDBFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A69511D4FB13004C3E4B /* JSIDBFactory.h */; };
-		C585A6CC11D4FB3D004C3E4B /* IDBAny.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A69811D4FB3D004C3E4B /* IDBAny.cpp */; };
-		C585A6CD11D4FB3D004C3E4B /* IDBAny.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A69911D4FB3D004C3E4B /* IDBAny.h */; };
-		C585A6CF11D4FB3D004C3E4B /* IDBCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A69B11D4FB3D004C3E4B /* IDBCallbacks.h */; };
-		C585A6D111D4FB3D004C3E4B /* IDBDatabaseError.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A69D11D4FB3D004C3E4B /* IDBDatabaseError.h */; };
-		C585A6D311D4FB3D004C3E4B /* IDBDatabaseException.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A69F11D4FB3D004C3E4B /* IDBDatabaseException.h */; };
-		C585A6D511D4FB3D004C3E4B /* IDBDatabaseBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6A111D4FB3D004C3E4B /* IDBDatabaseBackendImpl.cpp */; };
-		C585A6D811D4FB3D004C3E4B /* IDBDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6A411D4FB3D004C3E4B /* IDBDatabase.h */; };
-		C585A6E611D4FB3D004C3E4B /* IDBKey.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6B211D4FB3D004C3E4B /* IDBKey.cpp */; };
-		C585A6E711D4FB3D004C3E4B /* IDBKey.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6B311D4FB3D004C3E4B /* IDBKey.h */; };
-		C585A6E911D4FB3D004C3E4B /* IDBKeyRange.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6B511D4FB3D004C3E4B /* IDBKeyRange.cpp */; };
-		C585A6EA11D4FB3D004C3E4B /* IDBKeyRange.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6B611D4FB3D004C3E4B /* IDBKeyRange.h */; };
-		C585A6ED11D4FB3D004C3E4B /* IDBObjectStore.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6B911D4FB3D004C3E4B /* IDBObjectStore.h */; };
-		C585A6EE11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6BA11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp */; };
-		C585A6EF11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6BB11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h */; };
-		C585A6F011D4FB3D004C3E4B /* IDBObjectStore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6BC11D4FB3D004C3E4B /* IDBObjectStore.cpp */; };
-		C585A6F111D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6BD11D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h */; };
-		C585A6F311D4FB3D004C3E4B /* IDBRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6BF11D4FB3D004C3E4B /* IDBRequest.cpp */; };
-		C585A6F411D4FB3D004C3E4B /* IDBRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6C011D4FB3D004C3E4B /* IDBRequest.h */; };
-		C585A6F911D4FB3D004C3E4B /* IDBFactoryBackendInterface.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6C511D4FB3D004C3E4B /* IDBFactoryBackendInterface.cpp */; };
-		C585A6FA11D4FB3D004C3E4B /* IDBFactoryBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6C611D4FB3D004C3E4B /* IDBFactoryBackendInterface.h */; };
-		C585A6FB11D4FB3D004C3E4B /* IDBFactoryBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6C711D4FB3D004C3E4B /* IDBFactoryBackendImpl.cpp */; };
-		C585A6FC11D4FB3D004C3E4B /* IDBFactoryBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6C811D4FB3D004C3E4B /* IDBFactoryBackendImpl.h */; };
-		C585A6FD11D4FB3D004C3E4B /* IDBFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6C911D4FB3D004C3E4B /* IDBFactory.cpp */; };
-		C585A6FE11D4FB3D004C3E4B /* IDBFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6CA11D4FB3D004C3E4B /* IDBFactory.h */; };
 		C598902E14E9B0F800E8D18B /* PlatformPasteboardMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = C5F765BA14E1ECF4006C899B /* PlatformPasteboardMac.mm */; };
 		C598905714E9C28000E8D18B /* PasteboardStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = C5F765B414E1D414006C899B /* PasteboardStrategy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C598905814E9C29900E8D18B /* PlatformPasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = C5BAC16F14E30E4700008837 /* PlatformPasteboard.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C5B4C24D1509236C00A6EF37 /* WebCoreNSURLExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = C5B4C24B1509236C00A6EF37 /* WebCoreNSURLExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C5B4C24E1509236C00A6EF37 /* WebCoreNSURLExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = C5B4C24C1509236C00A6EF37 /* WebCoreNSURLExtras.mm */; };
 		C5D4AA7A116BAFB60069CA93 /* GlyphMetricsMap.h in Headers */ = {isa = PBXBuildFile; fileRef = C5D4AA78116BAFB60069CA93 /* GlyphMetricsMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C5E9B67710697E1300C7BB1A /* StorageEventDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */; };
 		C5EBDD84105EDDEC0056816F /* StorageEventDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */; };
+		C6B31B2E14F841FB0089F23F /* ScrollbarThemeClient.h in Headers */ = {isa = PBXBuildFile; fileRef = C691614714F6EBA70046375C /* ScrollbarThemeClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C6D74AD509AA282E000B0A52 /* ModifySelectionListLevel.h in Headers */ = {isa = PBXBuildFile; fileRef = C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */; };
 		C6D74AE409AA290A000B0A52 /* ModifySelectionListLevel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */; };
 		C6F08FBC1430FE8F00685849 /* MutationRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F08FB91430FE8F00685849 /* MutationRecord.cpp */; };
@@ -5622,6 +5676,8 @@
 		CA3BF67E10D99BAE00E6CE53 /* ScrollAnimator.h in Headers */ = {isa = PBXBuildFile; fileRef = CA3BF67D10D99BAE00E6CE53 /* ScrollAnimator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CAE9F90F146441F000C245B0 /* CSSAspectRatioValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CAE9F90D146441F000C245B0 /* CSSAspectRatioValue.cpp */; };
 		CAE9F910146441F000C245B0 /* CSSAspectRatioValue.h in Headers */ = {isa = PBXBuildFile; fileRef = CAE9F90E146441F000C245B0 /* CSSAspectRatioValue.h */; };
+		CD127DED14F3097D00E84779 /* WebCoreFullScreenWindow.mm in Sources */ = {isa = PBXBuildFile; fileRef = CD127DEB14F3097900E84779 /* WebCoreFullScreenWindow.mm */; };
+		CD127DEE14F3098400E84779 /* WebCoreFullScreenWindow.h in Headers */ = {isa = PBXBuildFile; fileRef = CD127DEA14F3097900E84779 /* WebCoreFullScreenWindow.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CD27F6E51457685A0078207D /* JSMediaController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD27F6E2145767580078207D /* JSMediaController.cpp */; };
 		CD27F6E7145770D30078207D /* MediaController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD27F6E6145770D30078207D /* MediaController.cpp */; };
 		CD4AC52A1496AE9A0087C4EF /* Composite.wav in Copy Audio Resources */ = {isa = PBXBuildFile; fileRef = CD4AC5281496AE2F0087C4EF /* Composite.wav */; };
@@ -5629,7 +5685,7 @@
 		CD82030B1395AB6A00F956C6 /* WebVideoFullscreenController.mm in Sources */ = {isa = PBXBuildFile; fileRef = CD8203071395AB6A00F956C6 /* WebVideoFullscreenController.mm */; settings = {COMPILER_FLAGS = "-Wno-undef"; }; };
 		CD82030C1395AB6A00F956C6 /* WebVideoFullscreenHUDWindowController.h in Headers */ = {isa = PBXBuildFile; fileRef = CD8203081395AB6A00F956C6 /* WebVideoFullscreenHUDWindowController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CD82030D1395AB6A00F956C6 /* WebVideoFullscreenHUDWindowController.mm in Sources */ = {isa = PBXBuildFile; fileRef = CD8203091395AB6A00F956C6 /* WebVideoFullscreenHUDWindowController.mm */; };
-		CD8203101395ACE700F956C6 /* WebWindowAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = CD82030E1395ACE700F956C6 /* WebWindowAnimation.h */; };
+		CD8203101395ACE700F956C6 /* WebWindowAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = CD82030E1395ACE700F956C6 /* WebWindowAnimation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CD8203111395ACE700F956C6 /* WebWindowAnimation.mm in Sources */ = {isa = PBXBuildFile; fileRef = CD82030F1395ACE700F956C6 /* WebWindowAnimation.mm */; };
 		CDAA8D0A14D71B2E0061EA60 /* PlatformClockCM.mm in Sources */ = {isa = PBXBuildFile; fileRef = CDAA8D0814D385600061EA60 /* PlatformClockCM.mm */; };
 		CDD525D7145B6DD0008D204D /* JSHTMLMediaElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CDF65CCC145B6AFE00C4C7AA /* JSHTMLMediaElementCustom.cpp */; };
@@ -5676,12 +5732,8 @@
 		D23CA55D0AB0EAAE005108A5 /* JSRangeException.h in Headers */ = {isa = PBXBuildFile; fileRef = D23CA55C0AB0EAAE005108A5 /* JSRangeException.h */; };
 		D23CA55F0AB0EAB6005108A5 /* JSRangeException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D23CA55E0AB0EAB6005108A5 /* JSRangeException.cpp */; };
 		D23CA56C0AB0EB8D005108A5 /* RangeException.h in Headers */ = {isa = PBXBuildFile; fileRef = D23CA56B0AB0EB8D005108A5 /* RangeException.h */; };
-		D302754712A5FE84004BD828 /* RenderDetails.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D302754312A5FE84004BD828 /* RenderDetails.cpp */; };
-		D302754812A5FE84004BD828 /* RenderDetails.h in Headers */ = {isa = PBXBuildFile; fileRef = D302754412A5FE84004BD828 /* RenderDetails.h */; };
 		D302754912A5FE84004BD828 /* RenderDetailsMarker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D302754512A5FE84004BD828 /* RenderDetailsMarker.cpp */; };
 		D302754A12A5FE84004BD828 /* RenderDetailsMarker.h in Headers */ = {isa = PBXBuildFile; fileRef = D302754612A5FE84004BD828 /* RenderDetailsMarker.h */; };
-		D302754D12A5FEAB004BD828 /* RenderSummary.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D302754B12A5FEAB004BD828 /* RenderSummary.cpp */; };
-		D302754E12A5FEAB004BD828 /* RenderSummary.h in Headers */ = {isa = PBXBuildFile; fileRef = D302754C12A5FEAB004BD828 /* RenderSummary.h */; };
 		D340629B1253BC8C009E4259 /* MediaQueryListListener.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D340629A1253BC8C009E4259 /* MediaQueryListListener.cpp */; };
 		D359D789129CA2710006E5D2 /* HTMLDetailsElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D359D786129CA2710006E5D2 /* HTMLDetailsElement.cpp */; };
 		D359D78A129CA2710006E5D2 /* HTMLDetailsElement.h in Headers */ = {isa = PBXBuildFile; fileRef = D359D787129CA2710006E5D2 /* HTMLDetailsElement.h */; };
@@ -5821,6 +5873,8 @@
 		E1C8BE5D0E8BD15A0064CB7D /* JSWorker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1C8BE5C0E8BD15A0064CB7D /* JSWorker.cpp */; };
 		E1CA5CBC0E8CDCAF00E8EF90 /* JSWorkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1CA5CBB0E8CDCAF00E8EF90 /* JSWorkerCustom.cpp */; };
 		E1CAA5C60E8BD23600A73ECA /* JSWorker.h in Headers */ = {isa = PBXBuildFile; fileRef = E1CAA5C50E8BD23600A73ECA /* JSWorker.h */; };
+		E1CDE92015018ED000862CC5 /* AsyncFileStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1CDE91F15018ED000862CC5 /* AsyncFileStream.cpp */; };
+		E1CDE9221501916900862CC5 /* AsyncFileStream.h in Headers */ = {isa = PBXBuildFile; fileRef = E1CDE9211501916900862CC5 /* AsyncFileStream.h */; };
 		E1E1BF00115FF6FB006F52CA /* WindowsKeyboardCodes.h in Headers */ = {isa = PBXBuildFile; fileRef = E1E1BEFF115FF6FB006F52CA /* WindowsKeyboardCodes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E1E6EEA40B628DA8005F2F70 /* JSHTMLSelectElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1E6EEA30B628DA8005F2F70 /* JSHTMLSelectElement.cpp */; };
 		E1E6EEA80B628DB3005F2F70 /* JSHTMLSelectElement.h in Headers */ = {isa = PBXBuildFile; fileRef = E1E6EEA70B628DB3005F2F70 /* JSHTMLSelectElement.h */; };
@@ -5889,13 +5943,14 @@
 		E4AFD0100DAF335500F5F55C /* SVGSMILElement.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD00A0DAF335400F5F55C /* SVGSMILElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E4BBED0E14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4BBED0C14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp */; };
 		E4BBED0F14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h in Headers */ = {isa = PBXBuildFile; fileRef = E4BBED0D14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h */; };
+		E4BBED4C14FCDBA1003F0B98 /* StyleRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4BBED4A14FCDBA1003F0B98 /* StyleRule.cpp */; };
+		E4BBED4D14FCDBA1003F0B98 /* StyleRule.h in Headers */ = {isa = PBXBuildFile; fileRef = E4BBED4B14FCDBA1003F0B98 /* StyleRule.h */; };
 		E4C1789A0EE6903800824D69 /* CSSSelectorList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C178950EE6903800824D69 /* CSSSelectorList.cpp */; };
 		E4C1789B0EE6903800824D69 /* CSSSelectorList.h in Headers */ = {isa = PBXBuildFile; fileRef = E4C178960EE6903800824D69 /* CSSSelectorList.h */; };
 		E4C279580CF9741900E97B98 /* RenderMedia.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C279560CF9741900E97B98 /* RenderMedia.cpp */; };
 		E4C279590CF9741900E97B98 /* RenderMedia.h in Headers */ = {isa = PBXBuildFile; fileRef = E4C279570CF9741900E97B98 /* RenderMedia.h */; };
 		E4D687770ED7AE3D006EA978 /* PurgeableBufferMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4D687760ED7AE3D006EA978 /* PurgeableBufferMac.cpp */; };
 		E4D687790ED7AE4F006EA978 /* PurgeableBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = E4D687780ED7AE4F006EA978 /* PurgeableBuffer.h */; };
-		EB49DB8F14F46E8B002299D9 /* IDBTracing.h in Headers */ = {isa = PBXBuildFile; fileRef = EB49DB8E14F46E8B002299D9 /* IDBTracing.h */; };
 		ED2BA83C09A24B91006C0AC4 /* DocumentMarker.h in Headers */ = {isa = PBXBuildFile; fileRef = ED2BA83B09A24B91006C0AC4 /* DocumentMarker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED501DC50B249F2900AE18D9 /* EditorMac.mm */; };
 		EDE3A5000C7A430600956A37 /* ColorMac.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE3A4FF0C7A430600956A37 /* ColorMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -7100,6 +7155,8 @@
 		1921327111C0E6BB00456238 /* SVGFEConvolveMatrixElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFEConvolveMatrixElement.cpp; sourceTree = "<group>"; };
 		1921327211C0E6BB00456238 /* SVGFEConvolveMatrixElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGFEConvolveMatrixElement.h; sourceTree = "<group>"; };
 		1921327311C0E6BB00456238 /* SVGFEConvolveMatrixElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SVGFEConvolveMatrixElement.idl; sourceTree = "<group>"; };
+		197B180A150634C000E4ADA8 /* SVGRenderingContext.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = SVGRenderingContext.cpp; sourceTree = "<group>"; };
+		197B180B150634C000E4ADA8 /* SVGRenderingContext.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = SVGRenderingContext.h; sourceTree = "<group>"; };
 		19BFF64611C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGFEConvolveMatrixElement.h; sourceTree = "<group>"; };
 		19BFF64711C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMSVGFEConvolveMatrixElement.mm; sourceTree = "<group>"; };
 		19BFF64811C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGFEConvolveMatrixElementInternal.h; sourceTree = "<group>"; };
@@ -7203,12 +7260,6 @@
 		1A762C700A074F2600989F5B /* JSXPathNSResolver.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSXPathNSResolver.h; sourceTree = "<group>"; };
 		1A762C710A074F2600989F5B /* JSXPathResult.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSXPathResult.cpp; sourceTree = "<group>"; };
 		1A762C720A074F2600989F5B /* JSXPathResult.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSXPathResult.h; sourceTree = "<group>"; };
-		1A7CCB150CD9469A00B7B64E /* SQLStatementCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLStatementCallback.h; sourceTree = "<group>"; };
-		1A7CCB160CD9469A00B7B64E /* SQLStatementErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLStatementErrorCallback.h; sourceTree = "<group>"; };
-		1A7CCB170CD9469A00B7B64E /* SQLTransactionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionCallback.h; sourceTree = "<group>"; };
-		1A7CCB180CD9469A00B7B64E /* SQLTransactionErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionErrorCallback.h; sourceTree = "<group>"; };
-		1A7CCB220CD946FD00B7B64E /* SQLTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransaction.h; sourceTree = "<group>"; };
-		1A7CCB230CD946FD00B7B64E /* SQLTransaction.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLTransaction.idl; sourceTree = "<group>"; };
 		1A7FA6180DDA3B3A0028F8A5 /* NetworkStateNotifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NetworkStateNotifier.h; sourceTree = "<group>"; };
 		1A7FA61A0DDA3BBE0028F8A5 /* NetworkStateNotifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NetworkStateNotifier.cpp; sourceTree = "<group>"; };
 		1A7FA6470DDA3CBA0028F8A5 /* NetworkStateNotifierMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NetworkStateNotifierMac.cpp; sourceTree = "<group>"; };
@@ -7297,7 +7348,6 @@
 		1AB7FC650A8B92EC00D9D37B /* XPathValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = XPathValue.h; sourceTree = "<group>"; };
 		1AB7FC660A8B92EC00D9D37B /* XPathVariableReference.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = XPathVariableReference.cpp; sourceTree = "<group>"; };
 		1AB7FC670A8B92EC00D9D37B /* XPathVariableReference.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = XPathVariableReference.h; sourceTree = "<group>"; };
-		1ABFE7520CD968D000FE4834 /* SQLTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransaction.cpp; sourceTree = "<group>"; };
 		1AC2260A0DB69F190089B669 /* JSDOMApplicationCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMApplicationCache.cpp; sourceTree = "<group>"; };
 		1AC2260B0DB69F190089B669 /* JSDOMApplicationCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMApplicationCache.h; sourceTree = "<group>"; };
 		1ACE53DD0A8D18810022947D /* JSDOMParser.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMParser.cpp; sourceTree = "<group>"; };
@@ -7311,8 +7361,6 @@
 		1ACE53F40A8D19470022947D /* JSXMLSerializer.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSXMLSerializer.cpp; sourceTree = "<group>"; };
 		1ACE53F50A8D19470022947D /* JSXMLSerializer.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSXMLSerializer.h; sourceTree = "<group>"; };
 		1AD2316D0CD269E700C1F194 /* JSSQLTransactionCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLTransactionCustom.cpp; sourceTree = "<group>"; };
-		1AD51A120CB59CD300953D11 /* DatabaseTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseTracker.h; sourceTree = "<group>"; };
-		1AD51A130CB59CD300953D11 /* DatabaseTracker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseTracker.cpp; sourceTree = "<group>"; };
 		1AD8F81911CAB9E900E93E54 /* PlatformStrategies.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformStrategies.h; sourceTree = "<group>"; };
 		1AD8F81A11CAB9E900E93E54 /* PlatformStrategies.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PlatformStrategies.cpp; sourceTree = "<group>"; };
 		1ADA140E0E1AE5D900023EE5 /* PluginMainThreadScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginMainThreadScheduler.cpp; sourceTree = "<group>"; };
@@ -7391,9 +7439,6 @@
 		1AF8E1191256592600230FF7 /* ProxyServer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyServer.h; sourceTree = "<group>"; };
 		1AF8E13212565A4400230FF7 /* ProxyServer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyServer.cpp; sourceTree = "<group>"; };
 		1AF8E1C1125673E000230FF7 /* ProxyServerCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyServerCFNet.cpp; sourceTree = "<group>"; };
-		1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLResultSetRowList.cpp; sourceTree = "<group>"; };
-		1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLResultSetRowList.h; sourceTree = "<group>"; };
-		1AFE118C0CBFFC4E003017FA /* SQLResultSetRowList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLResultSetRowList.idl; sourceTree = "<group>"; };
 		1AFE11970CBFFCC4003017FA /* JSSQLResultSetRowList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLResultSetRowList.cpp; sourceTree = "<group>"; };
 		1AFE11980CBFFCC4003017FA /* JSSQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLResultSetRowList.h; sourceTree = "<group>"; };
 		1C2649790D7E248A00BD10F2 /* DocumentLoaderMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentLoaderMac.cpp; sourceTree = "<group>"; };
@@ -7448,7 +7493,6 @@
 		22BD9F7D1353625C009BD102 /* ImageBufferData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageBufferData.h; sourceTree = "<group>"; };
 		22BD9F80135364FE009BD102 /* ImageBufferDataCG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageBufferDataCG.h; sourceTree = "<group>"; };
 		2442BBF81194C9D300D49469 /* HashChangeEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashChangeEvent.h; sourceTree = "<group>"; };
-		245D80A213280E40003492A6 /* SQLCallbackWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLCallbackWrapper.h; sourceTree = "<group>"; };
 		24D9128F13CA951E00D21915 /* JSSVGAltGlyphDefElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGAltGlyphDefElement.cpp; sourceTree = "<group>"; };
 		24D9129013CA951E00D21915 /* JSSVGAltGlyphDefElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGAltGlyphDefElement.h; sourceTree = "<group>"; };
 		24D9129313CA956100D21915 /* JSSVGAltGlyphItemElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGAltGlyphItemElement.cpp; sourceTree = "<group>"; };
@@ -7480,6 +7524,8 @@
 		265541371489811C000DFC5D /* KeyEventCodesIOS.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = KeyEventCodesIOS.h; path = ios/KeyEventCodesIOS.h; sourceTree = "<group>"; };
 		265541381489811C000DFC5D /* KeyEventIOS.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = KeyEventIOS.mm; path = ios/KeyEventIOS.mm; sourceTree = "<group>"; };
 		2655414B1489AA2B000DFC5D /* CursorIOS.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CursorIOS.cpp; path = ios/CursorIOS.cpp; sourceTree = "<group>"; };
+		26A5034D14F0983600AA730D /* KURLWTFURLImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = KURLWTFURLImpl.h; sourceTree = "<group>"; };
+		26A5035914F0A2BC00AA730D /* KURLWTFURL.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = KURLWTFURL.cpp; sourceTree = "<group>"; };
 		26C17A3C1491D2D400D12BA2 /* FileSystemIOS.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileSystemIOS.h; path = ios/FileSystemIOS.h; sourceTree = "<group>"; };
 		26C17A3D1491D2D400D12BA2 /* FileSystemIOS.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = FileSystemIOS.mm; path = ios/FileSystemIOS.mm; sourceTree = "<group>"; };
 		26E98A0F130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextCodecASCIIFastPath.h; sourceTree = "<group>"; };
@@ -7548,6 +7594,7 @@
 		2D9066050BE141D400956998 /* LayoutState.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = LayoutState.h; sourceTree = "<group>"; };
 		2D90660B0665D937006B6F1A /* ClipboardMac.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = ClipboardMac.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		2D90660C0665D937006B6F1A /* ClipboardMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ClipboardMac.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		2D9F0E1214FF1CBF00BA0FF7 /* linearSRGB.icc */ = {isa = PBXFileReference; lastKnownFileType = file; path = linearSRGB.icc; sourceTree = "<group>"; };
 		2E0888C3114883A900AF4265 /* DOMFormData.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMFormData.idl; sourceTree = "<group>"; };
 		2E0888D21148848A00AF4265 /* JSDOMFormData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMFormData.cpp; sourceTree = "<group>"; };
 		2E0888D31148848A00AF4265 /* JSDOMFormData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMFormData.h; sourceTree = "<group>"; };
@@ -7626,7 +7673,6 @@
 		2EDF369E122C94C8002F7D4E /* FileException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileException.h; path = fileapi/FileException.h; sourceTree = "<group>"; };
 		2EF1BFE8121C9F4200C27627 /* FileStream.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FileStream.cpp; sourceTree = "<group>"; };
 		2EF1BFE9121C9F4200C27627 /* FileStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FileStream.h; sourceTree = "<group>"; };
-		2EF1BFF6121CB0BD00C27627 /* AsyncFileStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncFileStream.h; sourceTree = "<group>"; };
 		2EF1BFF8121CB0CE00C27627 /* FileStreamClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FileStreamClient.h; sourceTree = "<group>"; };
 		3106036C14327D2E00ABF4BA /* WebKitCSSFilterValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitCSSFilterValue.cpp; sourceTree = "<group>"; };
 		3106036D14327D2E00ABF4BA /* WebKitCSSFilterValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitCSSFilterValue.h; sourceTree = "<group>"; };
@@ -7723,7 +7769,7 @@
 		3314ACEA10892086000F0E56 /* JSExceptionBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSExceptionBase.h; sourceTree = "<group>"; };
 		333F704E0FB49CA2008E12A6 /* Notification.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Notification.idl; path = notifications/Notification.idl; sourceTree = "<group>"; };
 		333F704F0FB49CA2008E12A6 /* Notification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Notification.h; path = notifications/Notification.h; sourceTree = "<group>"; };
-		33503C9910179A74003B47E1 /* NotificationPresenter.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; name = NotificationPresenter.h; path = notifications/NotificationPresenter.h; sourceTree = "<group>"; };
+		33503C9910179A74003B47E1 /* NotificationClient.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; name = NotificationClient.h; path = notifications/NotificationClient.h; sourceTree = "<group>"; };
 		33503C9F10179AD7003B47E1 /* JSNotification.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotification.cpp; sourceTree = "<group>"; };
 		33503CA010179AD7003B47E1 /* JSNotification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNotification.h; sourceTree = "<group>"; };
 		33503CA110179AD7003B47E1 /* JSNotificationCenter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotificationCenter.cpp; sourceTree = "<group>"; };
@@ -7942,8 +7988,6 @@
 		436708A412D9CA4B00044234 /* RenderSVGResourceSolidColor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGResourceSolidColor.h; sourceTree = "<group>"; };
 		436708A512D9CA4B00044234 /* RenderSVGRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGRoot.cpp; sourceTree = "<group>"; };
 		436708A612D9CA4B00044234 /* RenderSVGRoot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGRoot.h; sourceTree = "<group>"; };
-		436708A712D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGShadowTreeRootContainer.cpp; sourceTree = "<group>"; };
-		436708A812D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGShadowTreeRootContainer.h; sourceTree = "<group>"; };
 		436708A912D9CA4B00044234 /* RenderSVGTransformableContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGTransformableContainer.cpp; sourceTree = "<group>"; };
 		436708AA12D9CA4B00044234 /* RenderSVGTransformableContainer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGTransformableContainer.h; sourceTree = "<group>"; };
 		436708AB12D9CA4B00044234 /* RenderSVGViewportContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGViewportContainer.cpp; sourceTree = "<group>"; };
@@ -7963,8 +8007,6 @@
 		436708B912D9CA4B00044234 /* SVGResourcesCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGResourcesCache.h; sourceTree = "<group>"; };
 		436708BA12D9CA4B00044234 /* SVGResourcesCycleSolver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGResourcesCycleSolver.cpp; sourceTree = "<group>"; };
 		436708BB12D9CA4B00044234 /* SVGResourcesCycleSolver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGResourcesCycleSolver.h; sourceTree = "<group>"; };
-		436708BC12D9CA4B00044234 /* SVGShadowTreeElements.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGShadowTreeElements.cpp; sourceTree = "<group>"; };
-		436708BD12D9CA4B00044234 /* SVGShadowTreeElements.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGShadowTreeElements.h; sourceTree = "<group>"; };
 		4381763A13A697D4007D1187 /* SVGAnimatedLength.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGAnimatedLength.cpp; sourceTree = "<group>"; };
 		439046C312DA25E800AF80A2 /* RenderMathMLBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderMathMLBlock.cpp; path = mathml/RenderMathMLBlock.cpp; sourceTree = "<group>"; };
 		439046C412DA25E800AF80A2 /* RenderMathMLBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderMathMLBlock.h; path = mathml/RenderMathMLBlock.h; sourceTree = "<group>"; };
@@ -8022,6 +8064,8 @@
 		44D8DA98139545BE00337B75 /* SVGMPathElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SVGMPathElement.idl; sourceTree = "<group>"; };
 		44D8DA9A139545CD00337B75 /* SVGAnimateMotionElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SVGAnimateMotionElement.idl; sourceTree = "<group>"; };
 		45099C401370A7800058D513 /* IconURL.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IconURL.cpp; sourceTree = "<group>"; };
+		450CEBEE15073BBE002BB149 /* LabelableElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LabelableElement.cpp; sourceTree = "<group>"; };
+		450CEBEF15073BBE002BB149 /* LabelableElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LabelableElement.h; sourceTree = "<group>"; };
 		45BAC2AF1360BBAB005DA258 /* IconURL.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IconURL.h; sourceTree = "<group>"; };
 		4614A1FD0B23A8D600446E1C /* copyCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = copyCursor.png; sourceTree = "<group>"; };
 		46700ECE127B96CB00F5D5D6 /* FileWriterSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileWriterSync.cpp; path = fileapi/FileWriterSync.cpp; sourceTree = "<group>"; };
@@ -8234,14 +8278,13 @@
 		4A1E719414E101F900626F9D /* JSHTMLShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLShadowElement.h; sourceTree = "<group>"; };
 		4A1E71A314E106AC00626F9D /* JSShadowRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSShadowRoot.cpp; sourceTree = "<group>"; };
 		4A1E71A414E106AC00626F9D /* JSShadowRoot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSShadowRoot.h; sourceTree = "<group>"; };
-		4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketFrame.h; sourceTree = "<group>"; };
+		4A38BF4E14FE1C0900612512 /* WebSocketDeflateFramer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketDeflateFramer.cpp; path = Modules/websockets/WebSocketDeflateFramer.cpp; sourceTree = "<group>"; };
+		4A38BF4F14FE1C0900612512 /* WebSocketDeflateFramer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketDeflateFramer.h; path = Modules/websockets/WebSocketDeflateFramer.h; sourceTree = "<group>"; };
 		4A6E9FC113C17D1D0046A7F8 /* FontFeatureValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFeatureValue.cpp; sourceTree = "<group>"; };
 		4A6E9FC213C17D1D0046A7F8 /* FontFeatureValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontFeatureValue.h; sourceTree = "<group>"; };
 		4A6E9FC513C17D570046A7F8 /* FontFeatureSettings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFeatureSettings.cpp; sourceTree = "<group>"; };
 		4A6E9FC613C17D570046A7F8 /* FontFeatureSettings.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; path = FontFeatureSettings.h; sourceTree = "<group>"; };
 		4A8C96EA0BE69032004EEFF0 /* FrameSelectionMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = FrameSelectionMac.mm; path = mac/FrameSelectionMac.mm; sourceTree = "<group>"; };
-		4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketExtensionDispatcher.cpp; sourceTree = "<group>"; };
-		4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketExtensionDispatcher.h; sourceTree = "<group>"; };
 		4ABDFF0714DBE312004D117D /* HTMLShadowElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLShadowElement.cpp; sourceTree = "<group>"; };
 		4ABDFF0814DBE312004D117D /* HTMLShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLShadowElement.h; sourceTree = "<group>"; };
 		4ABDFF0914DBE312004D117D /* HTMLShadowElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLShadowElement.idl; sourceTree = "<group>"; };
@@ -8258,9 +8301,6 @@
 		4AD01007127E642A0015035F /* HTMLOutputElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLOutputElement.idl; sourceTree = "<group>"; };
 		4AD0173A127E82860015035F /* JSHTMLOutputElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLOutputElement.cpp; sourceTree = "<group>"; };
 		4AD0173B127E82860015035F /* JSHTMLOutputElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLOutputElement.h; sourceTree = "<group>"; };
-		4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketExtensionProcessor.h; sourceTree = "<group>"; };
-		4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketDeflater.cpp; sourceTree = "<group>"; };
-		4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketDeflater.h; sourceTree = "<group>"; };
 		4AF1AD3C13FD23A400AA9590 /* EventDispatchMediator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventDispatchMediator.cpp; sourceTree = "<group>"; };
 		4AF1AD3D13FD23A400AA9590 /* EventDispatchMediator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventDispatchMediator.h; sourceTree = "<group>"; };
 		4B2708C50AF19EE40065127F /* Pasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pasteboard.h; sourceTree = "<group>"; };
@@ -8335,16 +8375,6 @@
 		510D4A30103165EE0049EA54 /* SocketStreamHandleBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamHandleBase.cpp; sourceTree = "<group>"; };
 		510D4A31103165EE0049EA54 /* SocketStreamHandleBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandleBase.h; sourceTree = "<group>"; };
 		510D4A32103165EE0049EA54 /* SocketStreamHandleClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandleClient.h; sourceTree = "<group>"; };
-		510D4A47103177A20049EA54 /* WebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketChannel.cpp; sourceTree = "<group>"; };
-		510D4A48103177A20049EA54 /* WebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketChannel.h; sourceTree = "<group>"; };
-		510D4A49103177A20049EA54 /* WebSocketChannelClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketChannelClient.h; sourceTree = "<group>"; };
-		510F078111FEBE7500B8EE49 /* ThreadableWebSocketChannelClientWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ThreadableWebSocketChannelClientWrapper.cpp; sourceTree = "<group>"; };
-		5112247110CFB8C6008099D7 /* ThreadableWebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ThreadableWebSocketChannel.cpp; sourceTree = "<group>"; };
-		5112247310CFB8D8008099D7 /* ThreadableWebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadableWebSocketChannel.h; sourceTree = "<group>"; };
-		5112247510CFB8E8008099D7 /* ThreadableWebSocketChannelClientWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadableWebSocketChannelClientWrapper.h; sourceTree = "<group>"; };
-		5112247710CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerThreadableWebSocketChannel.cpp; sourceTree = "<group>"; };
-		5112247910CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerThreadableWebSocketChannel.h; sourceTree = "<group>"; };
-		5116D9750CF177BD00C2B84D /* DatabaseDetails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseDetails.h; sourceTree = "<group>"; };
 		511F23130DC160DA004F0032 /* StorageTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageTask.cpp; sourceTree = "<group>"; };
 		511F23140DC160DA004F0032 /* StorageTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTask.h; sourceTree = "<group>"; };
 		511F23150DC160DA004F0032 /* StorageThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageThread.cpp; sourceTree = "<group>"; };
@@ -8365,8 +8395,6 @@
 		51327D5F11A33A2B004F9D65 /* SinkDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SinkDocument.cpp; sourceTree = "<group>"; };
 		513F14510AB634C400094DDF /* IconLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = IconLoader.cpp; sourceTree = "<group>"; };
 		513F14520AB634C400094DDF /* IconLoader.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = IconLoader.h; sourceTree = "<group>"; };
-		514185EC0CD65F0400763C99 /* ChangeVersionWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ChangeVersionWrapper.h; sourceTree = "<group>"; };
-		514185ED0CD65F0400763C99 /* ChangeVersionWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ChangeVersionWrapper.cpp; sourceTree = "<group>"; };
 		514B3F720C722047000530DF /* FileSystem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FileSystem.h; sourceTree = "<group>"; };
 		514B3F750C722055000530DF /* FileSystemMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = FileSystemMac.mm; sourceTree = "<group>"; };
 		514C76350CE9225E007EF3CD /* JSSQLError.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLError.cpp; sourceTree = "<group>"; };
@@ -8397,8 +8425,6 @@
 		514C76690CE923A1007EF3CD /* ResourceResponseBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceResponseBase.cpp; sourceTree = "<group>"; };
 		514C766A0CE923A1007EF3CD /* ResourceResponseBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceResponseBase.h; sourceTree = "<group>"; };
 		515788C01207852C00A37C4A /* VisitedLinkStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VisitedLinkStrategy.h; sourceTree = "<group>"; };
-		515B03970CD1642A00B7EA9C /* SQLStatement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLStatement.h; sourceTree = "<group>"; };
-		515B03980CD1642A00B7EA9C /* SQLStatement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLStatement.cpp; sourceTree = "<group>"; };
 		5160300A0CC4251200C8AC25 /* FileSystemPOSIX.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FileSystemPOSIX.cpp; sourceTree = "<group>"; };
 		5160306B0CC4362300C8AC25 /* FileSystemCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FileSystemCF.cpp; sourceTree = "<group>"; };
 		5160F4970B0AA75F00C1D2AF /* HistoryItemMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = HistoryItemMac.mm; path = mac/HistoryItemMac.mm; sourceTree = "<group>"; };
@@ -8415,37 +8441,16 @@
 		5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPopStateEvent.cpp; sourceTree = "<group>"; };
 		5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPopStateEvent.h; sourceTree = "<group>"; };
 		5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PopStateEvent.cpp; sourceTree = "<group>"; };
-		518A34BE1026C831001B6896 /* WebSocket.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocket.cpp; sourceTree = "<group>"; };
-		518A34BF1026C831001B6896 /* WebSocket.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocket.h; sourceTree = "<group>"; };
-		518A34C01026C831001B6896 /* WebSocket.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebSocket.idl; sourceTree = "<group>"; };
 		518A34C61026C8C9001B6896 /* JSWebSocketCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebSocketCustom.cpp; sourceTree = "<group>"; };
-		5196115E0CAC56570010A80C /* Database.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Database.cpp; sourceTree = "<group>"; };
-		5196115F0CAC56570010A80C /* Database.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Database.h; sourceTree = "<group>"; };
-		519611600CAC56570010A80C /* Database.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Database.idl; sourceTree = "<group>"; };
-		519611610CAC56570010A80C /* DatabaseThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseThread.cpp; sourceTree = "<group>"; };
-		519611620CAC56570010A80C /* DatabaseThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseThread.h; sourceTree = "<group>"; };
-		519611670CAC56570010A80C /* SQLResultSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLResultSet.cpp; sourceTree = "<group>"; };
-		519611680CAC56570010A80C /* SQLResultSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLResultSet.h; sourceTree = "<group>"; };
-		519611690CAC56570010A80C /* SQLResultSet.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLResultSet.idl; sourceTree = "<group>"; };
-		519611E80CAC749C0010A80C /* DatabaseTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseTask.h; sourceTree = "<group>"; };
-		519611E90CAC749C0010A80C /* DatabaseTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseTask.cpp; sourceTree = "<group>"; };
 		519FE0A10DAD446E00A08F21 /* HTMLAttributeNames.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLAttributeNames.in; sourceTree = "<group>"; };
 		519FE0A20DAD446E00A08F21 /* HTMLTagNames.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLTagNames.in; sourceTree = "<group>"; };
 		51A052311058774F00CC9E95 /* CredentialStorage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CredentialStorage.h; sourceTree = "<group>"; };
 		51A052321058774F00CC9E95 /* CredentialStorage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CredentialStorage.cpp; sourceTree = "<group>"; };
 		51A052551058874000CC9E95 /* ProtectionSpaceHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProtectionSpaceHash.h; sourceTree = "<group>"; };
-		51A45B540CAD7FD7000D2BE9 /* DatabaseAuthorizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseAuthorizer.h; sourceTree = "<group>"; };
-		51A45B550CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseAuthorizer.cpp; sourceTree = "<group>"; };
-		51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginQuotaManager.cpp; sourceTree = "<group>"; };
-		51A926790D53F0570063ECC2 /* OriginQuotaManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OriginQuotaManager.h; sourceTree = "<group>"; };
-		51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginUsageRecord.cpp; sourceTree = "<group>"; };
-		51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OriginUsageRecord.h; sourceTree = "<group>"; };
 		51AA3F6E0BD5AA9E00892971 /* ResourceLoaderMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ResourceLoaderMac.mm; sourceTree = "<group>"; };
 		51ABAE1A103C18FF008C5260 /* SocketStreamError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamError.h; sourceTree = "<group>"; };
 		51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandle.h; sourceTree = "<group>"; };
 		51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamHandleCFNet.cpp; sourceTree = "<group>"; };
-		51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketHandshake.cpp; sourceTree = "<group>"; };
-		51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketHandshake.h; sourceTree = "<group>"; };
 		51B2417A0D931F3F00E83F5C /* LegacyWebArchiveMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LegacyWebArchiveMac.mm; sourceTree = "<group>"; };
 		51BE37DE0DAEE00E001085FC /* StorageArea.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageArea.h; sourceTree = "<group>"; };
 		51C0AA380F2AA10A001648C2 /* CachedFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedFrame.h; sourceTree = "<group>"; };
@@ -8476,14 +8481,9 @@
 		51E3F9D10DA05D7100250911 /* Storage.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Storage.idl; sourceTree = "<group>"; };
 		51E3F9D40DA05E1D00250911 /* JSStorage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStorage.cpp; sourceTree = "<group>"; };
 		51E3F9D50DA05E1D00250911 /* JSStorage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStorage.h; sourceTree = "<group>"; };
-		51EC92570CE90DB400F90308 /* SQLError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLError.h; sourceTree = "<group>"; };
-		51EC92580CE90DB400F90308 /* SQLError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLError.idl; sourceTree = "<group>"; };
 		51EC925D0CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCustomSQLStatementErrorCallback.cpp; sourceTree = "<group>"; };
 		51F6A3D50663BF04004D2919 /* HTMLCanvasElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLCanvasElement.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		51F6A3D60663BF04004D2919 /* HTMLCanvasElement.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = HTMLCanvasElement.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		51FAFE330CECBF2D00BB3F24 /* DatabaseTrackerClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseTrackerClient.h; sourceTree = "<group>"; };
-		51FB54F4113E364200821176 /* CloseEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CloseEvent.h; sourceTree = "<group>"; };
-		51FB54F6113E365900821176 /* CloseEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = CloseEvent.idl; sourceTree = "<group>"; };
 		51FB5502113E3E9100821176 /* JSCloseEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCloseEvent.h; sourceTree = "<group>"; };
 		51FB5503113E3E9100821176 /* JSCloseEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCloseEvent.cpp; sourceTree = "<group>"; };
 		521D46F511AEC98100514613 /* KillRingMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = KillRingMac.mm; sourceTree = "<group>"; };
@@ -8497,8 +8497,6 @@
 		53C8298C13D8D92700DE2DEB /* RenderFlexibleBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderFlexibleBox.h; sourceTree = "<group>"; };
 		550A0BC7085F6039007353D6 /* QualifiedName.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = QualifiedName.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		550A0BC8085F6039007353D6 /* QualifiedName.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = QualifiedName.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		572E92F914E540580087FFBA /* ShadowRootList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ShadowRootList.cpp; path = ../../dom/ShadowRootList.cpp; sourceTree = "<group>"; };
-		572E92FA14E540580087FFBA /* ShadowRootList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ShadowRootList.h; path = ../../dom/ShadowRootList.h; sourceTree = "<group>"; };
 		573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorTypeBuilder.cpp; sourceTree = "<group>"; };
 		573D134614CE39FF0057ABCA /* InspectorTypeBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorTypeBuilder.h; sourceTree = "<group>"; };
 		57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLContentSelector.cpp; sourceTree = "<group>"; };
@@ -8509,6 +8507,8 @@
 		57B791A814C6A63300F202D1 /* HTMLContentElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLContentElement.h; sourceTree = "<group>"; };
 		57CF497214EE36D700ECFF14 /* InsertionPoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InsertionPoint.cpp; sourceTree = "<group>"; };
 		57CF497314EE36D700ECFF14 /* InsertionPoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InsertionPoint.h; sourceTree = "<group>"; };
+		57CF4C8414F7597A00ECFF14 /* ShadowTree.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ShadowTree.cpp; sourceTree = "<group>"; };
+		57CF4C8514F7597A00ECFF14 /* ShadowTree.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShadowTree.h; sourceTree = "<group>"; };
 		5905ADBD1302F3CE00F116DF /* XMLTreeViewer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLTreeViewer.cpp; sourceTree = "<group>"; };
 		5905ADBE1302F3CE00F116DF /* XMLTreeViewer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XMLTreeViewer.h; sourceTree = "<group>"; };
 		590E1B4811E4EF4B0069F784 /* DeviceOrientation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeviceOrientation.h; sourceTree = "<group>"; };
@@ -8768,10 +8768,6 @@
 		758978EB127090D60076D5A9 /* SpeechInputResult.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpeechInputResult.h; sourceTree = "<group>"; };
 		7633A72413D8B33A008501B6 /* LocaleToScriptMapping.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocaleToScriptMapping.h; sourceTree = "<group>"; };
 		7633A72513D8B33A008501B6 /* LocaleToScriptMappingDefault.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocaleToScriptMappingDefault.cpp; sourceTree = "<group>"; };
-		7637C540112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketHandshakeRequest.cpp; sourceTree = "<group>"; };
-		7637C542112E7B7E003D6CDC /* WebSocketHandshakeRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketHandshakeRequest.h; sourceTree = "<group>"; };
-		767F99BD11A1194A0080C51D /* WebSocketHandshakeResponse.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketHandshakeResponse.cpp; sourceTree = "<group>"; };
-		767F99BF11A119560080C51D /* WebSocketHandshakeResponse.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketHandshakeResponse.h; sourceTree = "<group>"; };
 		7694563A1214D97C0007CBAE /* JSDOMTokenList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMTokenList.cpp; sourceTree = "<group>"; };
 		7694563B1214D97C0007CBAE /* JSDOMTokenList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMTokenList.h; sourceTree = "<group>"; };
 		769456591214DB630007CBAE /* DOMDOMTokenList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDOMTokenList.h; sourceTree = "<group>"; };
@@ -8786,6 +8782,11 @@
 		76FC2B0912370DA0006A991A /* DOMTokenList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMTokenList.h; sourceTree = "<group>"; };
 		76FC2B0A12370DA0006A991A /* DOMTokenList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMTokenList.idl; sourceTree = "<group>"; };
 		76FF17E211235673001D61B5 /* PluginViewNone.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginViewNone.cpp; sourceTree = "<group>"; };
+		7728694B14F8882500F484DC /* EXTTextureFilterAnisotropic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = EXTTextureFilterAnisotropic.cpp; path = canvas/EXTTextureFilterAnisotropic.cpp; sourceTree = "<group>"; };
+		7728694C14F8882500F484DC /* EXTTextureFilterAnisotropic.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = EXTTextureFilterAnisotropic.h; path = canvas/EXTTextureFilterAnisotropic.h; sourceTree = "<group>"; };
+		7728694D14F8882500F484DC /* EXTTextureFilterAnisotropic.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = EXTTextureFilterAnisotropic.idl; path = canvas/EXTTextureFilterAnisotropic.idl; sourceTree = "<group>"; };
+		7728698114FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEXTTextureFilterAnisotropic.cpp; sourceTree = "<group>"; };
+		7728698214FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSEXTTextureFilterAnisotropic.h; sourceTree = "<group>"; };
 		77A17A6E12F28182004E02F6 /* OESVertexArrayObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OESVertexArrayObject.cpp; path = canvas/OESVertexArrayObject.cpp; sourceTree = "<group>"; };
 		77A17A6F12F28182004E02F6 /* OESVertexArrayObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = OESVertexArrayObject.h; path = canvas/OESVertexArrayObject.h; sourceTree = "<group>"; };
 		77A17A7012F28182004E02F6 /* OESVertexArrayObject.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = OESVertexArrayObject.idl; path = canvas/OESVertexArrayObject.idl; sourceTree = "<group>"; };
@@ -8868,18 +8869,12 @@
 		809DD1DE130DE2AD00CAE3ED /* CSSStyleApplyProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSStyleApplyProperty.h; sourceTree = "<group>"; };
 		8102C5871325BB1100DDE67A /* StringCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringCallback.cpp; sourceTree = "<group>"; };
 		815E6166132587AA00B622B0 /* DataTransferItem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DataTransferItem.cpp; sourceTree = "<group>"; };
-		81A7325D1210189B00FC0D9E /* IDBCursor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursor.h; sourceTree = "<group>"; };
-		81A7325F121018A400FC0D9E /* IDBCursor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBCursor.cpp; sourceTree = "<group>"; };
-		81A73277121019E100FC0D9E /* IDBCursorBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursorBackendImpl.h; sourceTree = "<group>"; };
 		81AC5997131636E60009A7E0 /* DataTransferItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataTransferItem.h; sourceTree = "<group>"; };
 		81AC5998131636E60009A7E0 /* DataTransferItemList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataTransferItemList.h; sourceTree = "<group>"; };
 		81AC5AE81316392E0009A7E0 /* DataTransferItem.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DataTransferItem.idl; sourceTree = "<group>"; };
 		81AC5AE91316392E0009A7E0 /* DataTransferItemList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DataTransferItemList.idl; sourceTree = "<group>"; };
 		81AC6C34131C57C20009A7E0 /* StringCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = StringCallback.idl; sourceTree = "<group>"; };
 		81AC6C35131C57D30009A7E0 /* StringCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringCallback.h; sourceTree = "<group>"; };
-		81BE209311F4AB8D00915DFA /* IDBCursorBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBCursorBackendImpl.cpp; sourceTree = "<group>"; };
-		81BE209411F4AB8D00915DFA /* IDBCursorBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursorBackendInterface.h; sourceTree = "<group>"; };
-		81BE209C11F4ABBD00915DFA /* IDBCursor.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBCursor.idl; sourceTree = "<group>"; };
 		81BE20A711F4B66F00915DFA /* JSIDBCursor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSIDBCursor.cpp; sourceTree = "<group>"; };
 		81BE20A811F4B66F00915DFA /* JSIDBCursor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSIDBCursor.h; sourceTree = "<group>"; };
 		81F65FF513788FAA00FF6F2D /* DragState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragState.h; sourceTree = "<group>"; };
@@ -9901,6 +9896,8 @@
 		8AA61CFD144D595B00F37350 /* WebKitCSSRegionRule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitCSSRegionRule.cpp; sourceTree = "<group>"; };
 		8AA61CFE144D595B00F37350 /* WebKitCSSRegionRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitCSSRegionRule.h; sourceTree = "<group>"; };
 		8AB4BC76126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IgnoreDestructiveWriteCountIncrementer.h; sourceTree = "<group>"; };
+		8ABAFB9D14F5107500A4984B /* RegionNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegionNodeList.cpp; sourceTree = "<group>"; };
+		8ABAFB9E14F5107500A4984B /* RegionNodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegionNodeList.h; sourceTree = "<group>"; };
 		8ACC24CD148E24B200EFCC0D /* JSWebKitCSSRegionRule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitCSSRegionRule.cpp; sourceTree = "<group>"; };
 		8ACC24CE148E24B200EFCC0D /* JSWebKitCSSRegionRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitCSSRegionRule.h; sourceTree = "<group>"; };
 		8ACC2817148E47E700EFCC0D /* DOMWebKitCSSRegionRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitCSSRegionRule.h; sourceTree = "<group>"; };
@@ -10196,6 +10193,98 @@
 		9711460014EF009A00674FD9 /* NavigatorGeolocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NavigatorGeolocation.cpp; path = Modules/geolocation/NavigatorGeolocation.cpp; sourceTree = "<group>"; };
 		9711460114EF009A00674FD9 /* NavigatorGeolocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NavigatorGeolocation.h; path = Modules/geolocation/NavigatorGeolocation.h; sourceTree = "<group>"; };
 		9711460214EF009A00674FD9 /* NavigatorGeolocation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = NavigatorGeolocation.idl; path = Modules/geolocation/NavigatorGeolocation.idl; sourceTree = "<group>"; };
+		9712A55415004EDA0048AF10 /* DOMWindowIndexedDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DOMWindowIndexedDatabase.cpp; path = Modules/indexeddb/DOMWindowIndexedDatabase.cpp; sourceTree = "<group>"; };
+		9712A55515004EDA0048AF10 /* DOMWindowIndexedDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMWindowIndexedDatabase.h; path = Modules/indexeddb/DOMWindowIndexedDatabase.h; sourceTree = "<group>"; };
+		9712A55615004EDA0048AF10 /* DOMWindowIndexedDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowIndexedDatabase.idl; path = Modules/indexeddb/DOMWindowIndexedDatabase.idl; sourceTree = "<group>"; };
+		9712A55715004EDA0048AF10 /* IDBAny.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBAny.cpp; path = Modules/indexeddb/IDBAny.cpp; sourceTree = "<group>"; };
+		9712A55815004EDA0048AF10 /* IDBAny.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBAny.h; path = Modules/indexeddb/IDBAny.h; sourceTree = "<group>"; };
+		9712A55915004EDA0048AF10 /* IDBAny.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBAny.idl; path = Modules/indexeddb/IDBAny.idl; sourceTree = "<group>"; };
+		9712A55A15004EDA0048AF10 /* IDBBackingStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBBackingStore.h; path = Modules/indexeddb/IDBBackingStore.h; sourceTree = "<group>"; };
+		9712A55B15004EDA0048AF10 /* IDBCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBCallbacks.h; path = Modules/indexeddb/IDBCallbacks.h; sourceTree = "<group>"; };
+		9712A55C15004EDA0048AF10 /* IDBCursor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBCursor.cpp; path = Modules/indexeddb/IDBCursor.cpp; sourceTree = "<group>"; };
+		9712A55D15004EDA0048AF10 /* IDBCursor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBCursor.h; path = Modules/indexeddb/IDBCursor.h; sourceTree = "<group>"; };
+		9712A55E15004EDA0048AF10 /* IDBCursor.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBCursor.idl; path = Modules/indexeddb/IDBCursor.idl; sourceTree = "<group>"; };
+		9712A55F15004EDA0048AF10 /* IDBCursorBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBCursorBackendImpl.cpp; path = Modules/indexeddb/IDBCursorBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A56015004EDA0048AF10 /* IDBCursorBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBCursorBackendImpl.h; path = Modules/indexeddb/IDBCursorBackendImpl.h; sourceTree = "<group>"; };
+		9712A56115004EDA0048AF10 /* IDBCursorBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBCursorBackendInterface.h; path = Modules/indexeddb/IDBCursorBackendInterface.h; sourceTree = "<group>"; };
+		9712A56215004EDA0048AF10 /* IDBCursorWithValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBCursorWithValue.cpp; path = Modules/indexeddb/IDBCursorWithValue.cpp; sourceTree = "<group>"; };
+		9712A56315004EDA0048AF10 /* IDBCursorWithValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBCursorWithValue.h; path = Modules/indexeddb/IDBCursorWithValue.h; sourceTree = "<group>"; };
+		9712A56415004EDA0048AF10 /* IDBCursorWithValue.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBCursorWithValue.idl; path = Modules/indexeddb/IDBCursorWithValue.idl; sourceTree = "<group>"; };
+		9712A56515004EDA0048AF10 /* IDBDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBDatabase.cpp; path = Modules/indexeddb/IDBDatabase.cpp; sourceTree = "<group>"; };
+		9712A56615004EDA0048AF10 /* IDBDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabase.h; path = Modules/indexeddb/IDBDatabase.h; sourceTree = "<group>"; };
+		9712A56715004EDA0048AF10 /* IDBDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBDatabase.idl; path = Modules/indexeddb/IDBDatabase.idl; sourceTree = "<group>"; };
+		9712A56815004EDA0048AF10 /* IDBDatabaseBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBDatabaseBackendImpl.cpp; path = Modules/indexeddb/IDBDatabaseBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A56915004EDA0048AF10 /* IDBDatabaseBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseBackendImpl.h; path = Modules/indexeddb/IDBDatabaseBackendImpl.h; sourceTree = "<group>"; };
+		9712A56A15004EDA0048AF10 /* IDBDatabaseBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseBackendInterface.h; path = Modules/indexeddb/IDBDatabaseBackendInterface.h; sourceTree = "<group>"; };
+		9712A56B15004EDA0048AF10 /* IDBDatabaseCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseCallbacks.h; path = Modules/indexeddb/IDBDatabaseCallbacks.h; sourceTree = "<group>"; };
+		9712A56C15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBDatabaseCallbacksImpl.cpp; path = Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp; sourceTree = "<group>"; };
+		9712A56D15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseCallbacksImpl.h; path = Modules/indexeddb/IDBDatabaseCallbacksImpl.h; sourceTree = "<group>"; };
+		9712A56E15004EDA0048AF10 /* IDBDatabaseError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseError.h; path = Modules/indexeddb/IDBDatabaseError.h; sourceTree = "<group>"; };
+		9712A56F15004EDA0048AF10 /* IDBDatabaseError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBDatabaseError.idl; path = Modules/indexeddb/IDBDatabaseError.idl; sourceTree = "<group>"; };
+		9712A57015004EDA0048AF10 /* IDBDatabaseException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBDatabaseException.cpp; path = Modules/indexeddb/IDBDatabaseException.cpp; sourceTree = "<group>"; };
+		9712A57115004EDA0048AF10 /* IDBDatabaseException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseException.h; path = Modules/indexeddb/IDBDatabaseException.h; sourceTree = "<group>"; };
+		9712A57215004EDA0048AF10 /* IDBDatabaseException.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBDatabaseException.idl; path = Modules/indexeddb/IDBDatabaseException.idl; sourceTree = "<group>"; };
+		9712A57315004EDA0048AF10 /* IDBEventDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBEventDispatcher.cpp; path = Modules/indexeddb/IDBEventDispatcher.cpp; sourceTree = "<group>"; };
+		9712A57415004EDA0048AF10 /* IDBEventDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBEventDispatcher.h; path = Modules/indexeddb/IDBEventDispatcher.h; sourceTree = "<group>"; };
+		9712A57515004EDA0048AF10 /* IDBFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBFactory.cpp; path = Modules/indexeddb/IDBFactory.cpp; sourceTree = "<group>"; };
+		9712A57615004EDA0048AF10 /* IDBFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBFactory.h; path = Modules/indexeddb/IDBFactory.h; sourceTree = "<group>"; };
+		9712A57715004EDA0048AF10 /* IDBFactory.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBFactory.idl; path = Modules/indexeddb/IDBFactory.idl; sourceTree = "<group>"; };
+		9712A57815004EDA0048AF10 /* IDBFactoryBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBFactoryBackendImpl.cpp; path = Modules/indexeddb/IDBFactoryBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A57915004EDA0048AF10 /* IDBFactoryBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBFactoryBackendImpl.h; path = Modules/indexeddb/IDBFactoryBackendImpl.h; sourceTree = "<group>"; };
+		9712A57A15004EDA0048AF10 /* IDBFactoryBackendInterface.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBFactoryBackendInterface.cpp; path = Modules/indexeddb/IDBFactoryBackendInterface.cpp; sourceTree = "<group>"; };
+		9712A57B15004EDA0048AF10 /* IDBFactoryBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBFactoryBackendInterface.h; path = Modules/indexeddb/IDBFactoryBackendInterface.h; sourceTree = "<group>"; };
+		9712A57C15004EDA0048AF10 /* IDBIndex.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBIndex.cpp; path = Modules/indexeddb/IDBIndex.cpp; sourceTree = "<group>"; };
+		9712A57D15004EDA0048AF10 /* IDBIndex.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBIndex.h; path = Modules/indexeddb/IDBIndex.h; sourceTree = "<group>"; };
+		9712A57E15004EDA0048AF10 /* IDBIndex.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBIndex.idl; path = Modules/indexeddb/IDBIndex.idl; sourceTree = "<group>"; };
+		9712A57F15004EDA0048AF10 /* IDBIndexBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBIndexBackendImpl.cpp; path = Modules/indexeddb/IDBIndexBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A58015004EDA0048AF10 /* IDBIndexBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBIndexBackendImpl.h; path = Modules/indexeddb/IDBIndexBackendImpl.h; sourceTree = "<group>"; };
+		9712A58115004EDA0048AF10 /* IDBIndexBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBIndexBackendInterface.h; path = Modules/indexeddb/IDBIndexBackendInterface.h; sourceTree = "<group>"; };
+		9712A58215004EDA0048AF10 /* IDBKey.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBKey.cpp; path = Modules/indexeddb/IDBKey.cpp; sourceTree = "<group>"; };
+		9712A58315004EDA0048AF10 /* IDBKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBKey.h; path = Modules/indexeddb/IDBKey.h; sourceTree = "<group>"; };
+		9712A58415004EDA0048AF10 /* IDBKey.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBKey.idl; path = Modules/indexeddb/IDBKey.idl; sourceTree = "<group>"; };
+		9712A58515004EDA0048AF10 /* IDBKeyPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBKeyPath.cpp; path = Modules/indexeddb/IDBKeyPath.cpp; sourceTree = "<group>"; };
+		9712A58615004EDA0048AF10 /* IDBKeyPath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBKeyPath.h; path = Modules/indexeddb/IDBKeyPath.h; sourceTree = "<group>"; };
+		9712A58715004EDA0048AF10 /* IDBKeyPathBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBKeyPathBackendImpl.cpp; path = Modules/indexeddb/IDBKeyPathBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A58815004EDA0048AF10 /* IDBKeyPathBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBKeyPathBackendImpl.h; path = Modules/indexeddb/IDBKeyPathBackendImpl.h; sourceTree = "<group>"; };
+		9712A58915004EDA0048AF10 /* IDBKeyRange.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBKeyRange.cpp; path = Modules/indexeddb/IDBKeyRange.cpp; sourceTree = "<group>"; };
+		9712A58A15004EDA0048AF10 /* IDBKeyRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBKeyRange.h; path = Modules/indexeddb/IDBKeyRange.h; sourceTree = "<group>"; };
+		9712A58B15004EDA0048AF10 /* IDBKeyRange.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBKeyRange.idl; path = Modules/indexeddb/IDBKeyRange.idl; sourceTree = "<group>"; };
+		9712A58C15004EDA0048AF10 /* IDBLevelDBBackingStore.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBLevelDBBackingStore.cpp; path = Modules/indexeddb/IDBLevelDBBackingStore.cpp; sourceTree = "<group>"; };
+		9712A58D15004EDA0048AF10 /* IDBLevelDBBackingStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBLevelDBBackingStore.h; path = Modules/indexeddb/IDBLevelDBBackingStore.h; sourceTree = "<group>"; };
+		9712A58E15004EDA0048AF10 /* IDBLevelDBCoding.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBLevelDBCoding.cpp; path = Modules/indexeddb/IDBLevelDBCoding.cpp; sourceTree = "<group>"; };
+		9712A58F15004EDA0048AF10 /* IDBLevelDBCoding.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBLevelDBCoding.h; path = Modules/indexeddb/IDBLevelDBCoding.h; sourceTree = "<group>"; };
+		9712A59015004EDA0048AF10 /* IDBObjectStore.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBObjectStore.cpp; path = Modules/indexeddb/IDBObjectStore.cpp; sourceTree = "<group>"; };
+		9712A59115004EDA0048AF10 /* IDBObjectStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBObjectStore.h; path = Modules/indexeddb/IDBObjectStore.h; sourceTree = "<group>"; };
+		9712A59215004EDA0048AF10 /* IDBObjectStore.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBObjectStore.idl; path = Modules/indexeddb/IDBObjectStore.idl; sourceTree = "<group>"; };
+		9712A59315004EDA0048AF10 /* IDBObjectStoreBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBObjectStoreBackendImpl.cpp; path = Modules/indexeddb/IDBObjectStoreBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A59415004EDA0048AF10 /* IDBObjectStoreBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBObjectStoreBackendImpl.h; path = Modules/indexeddb/IDBObjectStoreBackendImpl.h; sourceTree = "<group>"; };
+		9712A59515004EDA0048AF10 /* IDBObjectStoreBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBObjectStoreBackendInterface.h; path = Modules/indexeddb/IDBObjectStoreBackendInterface.h; sourceTree = "<group>"; };
+		9712A59615004EDA0048AF10 /* IDBPendingTransactionMonitor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBPendingTransactionMonitor.cpp; path = Modules/indexeddb/IDBPendingTransactionMonitor.cpp; sourceTree = "<group>"; };
+		9712A59715004EDA0048AF10 /* IDBPendingTransactionMonitor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBPendingTransactionMonitor.h; path = Modules/indexeddb/IDBPendingTransactionMonitor.h; sourceTree = "<group>"; };
+		9712A59815004EDA0048AF10 /* IDBRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBRequest.cpp; path = Modules/indexeddb/IDBRequest.cpp; sourceTree = "<group>"; };
+		9712A59915004EDA0048AF10 /* IDBRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBRequest.h; path = Modules/indexeddb/IDBRequest.h; sourceTree = "<group>"; };
+		9712A59A15004EDA0048AF10 /* IDBRequest.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBRequest.idl; path = Modules/indexeddb/IDBRequest.idl; sourceTree = "<group>"; };
+		9712A59B15004EDA0048AF10 /* IDBTracing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTracing.h; path = Modules/indexeddb/IDBTracing.h; sourceTree = "<group>"; };
+		9712A59C15004EDA0048AF10 /* IDBTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBTransaction.cpp; path = Modules/indexeddb/IDBTransaction.cpp; sourceTree = "<group>"; };
+		9712A59D15004EDA0048AF10 /* IDBTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTransaction.h; path = Modules/indexeddb/IDBTransaction.h; sourceTree = "<group>"; };
+		9712A59E15004EDA0048AF10 /* IDBTransaction.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBTransaction.idl; path = Modules/indexeddb/IDBTransaction.idl; sourceTree = "<group>"; };
+		9712A59F15004EDA0048AF10 /* IDBTransactionBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBTransactionBackendImpl.cpp; path = Modules/indexeddb/IDBTransactionBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A5A015004EDA0048AF10 /* IDBTransactionBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTransactionBackendImpl.h; path = Modules/indexeddb/IDBTransactionBackendImpl.h; sourceTree = "<group>"; };
+		9712A5A115004EDA0048AF10 /* IDBTransactionBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTransactionBackendInterface.h; path = Modules/indexeddb/IDBTransactionBackendInterface.h; sourceTree = "<group>"; };
+		9712A5A215004EDA0048AF10 /* IDBTransactionCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTransactionCallbacks.h; path = Modules/indexeddb/IDBTransactionCallbacks.h; sourceTree = "<group>"; };
+		9712A5A315004EDA0048AF10 /* IDBTransactionCoordinator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBTransactionCoordinator.cpp; path = Modules/indexeddb/IDBTransactionCoordinator.cpp; sourceTree = "<group>"; };
+		9712A5A415004EDA0048AF10 /* IDBTransactionCoordinator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTransactionCoordinator.h; path = Modules/indexeddb/IDBTransactionCoordinator.h; sourceTree = "<group>"; };
+		9712A5A515004EDA0048AF10 /* IDBVersionChangeEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBVersionChangeEvent.cpp; path = Modules/indexeddb/IDBVersionChangeEvent.cpp; sourceTree = "<group>"; };
+		9712A5A615004EDA0048AF10 /* IDBVersionChangeEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBVersionChangeEvent.h; path = Modules/indexeddb/IDBVersionChangeEvent.h; sourceTree = "<group>"; };
+		9712A5A715004EDA0048AF10 /* IDBVersionChangeEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBVersionChangeEvent.idl; path = Modules/indexeddb/IDBVersionChangeEvent.idl; sourceTree = "<group>"; };
+		9712A5A815004EDA0048AF10 /* IDBVersionChangeRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBVersionChangeRequest.cpp; path = Modules/indexeddb/IDBVersionChangeRequest.cpp; sourceTree = "<group>"; };
+		9712A5A915004EDA0048AF10 /* IDBVersionChangeRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBVersionChangeRequest.h; path = Modules/indexeddb/IDBVersionChangeRequest.h; sourceTree = "<group>"; };
+		9712A5AA15004EDA0048AF10 /* IDBVersionChangeRequest.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBVersionChangeRequest.idl; path = Modules/indexeddb/IDBVersionChangeRequest.idl; sourceTree = "<group>"; };
+		9712A5AB15004EDA0048AF10 /* PageGroupIndexedDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = PageGroupIndexedDatabase.cpp; path = Modules/indexeddb/PageGroupIndexedDatabase.cpp; sourceTree = "<group>"; };
+		9712A5AC15004EDA0048AF10 /* PageGroupIndexedDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PageGroupIndexedDatabase.h; path = Modules/indexeddb/PageGroupIndexedDatabase.h; sourceTree = "<group>"; };
+		9712A60E150090CE0048AF10 /* WorkerContextIndexedDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerContextIndexedDatabase.cpp; path = Modules/indexeddb/WorkerContextIndexedDatabase.cpp; sourceTree = "<group>"; };
+		9712A60F150090CE0048AF10 /* WorkerContextIndexedDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerContextIndexedDatabase.h; path = Modules/indexeddb/WorkerContextIndexedDatabase.h; sourceTree = "<group>"; };
+		9712A610150090CE0048AF10 /* WorkerContextIndexedDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WorkerContextIndexedDatabase.idl; path = Modules/indexeddb/WorkerContextIndexedDatabase.idl; sourceTree = "<group>"; };
 		97205AAD123928CA00B17380 /* FTPDirectoryDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FTPDirectoryDocument.cpp; sourceTree = "<group>"; };
 		97205AAE123928CA00B17380 /* FTPDirectoryDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FTPDirectoryDocument.h; sourceTree = "<group>"; };
 		97205AB11239291000B17380 /* ImageDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageDocument.cpp; sourceTree = "<group>"; };
@@ -10253,6 +10342,9 @@
 		975CA289130365F800E99AD9 /* Crypto.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Crypto.idl; sourceTree = "<group>"; };
 		975CA29F1303679D00E99AD9 /* JSCrypto.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCrypto.cpp; sourceTree = "<group>"; };
 		975CA2A01303679D00E99AD9 /* JSCrypto.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCrypto.h; sourceTree = "<group>"; };
+		97627B8B14FB3CEE002CDCA1 /* ContextDestructionObserver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContextDestructionObserver.cpp; sourceTree = "<group>"; };
+		97627B8C14FB3CEE002CDCA1 /* ContextDestructionObserver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContextDestructionObserver.h; sourceTree = "<group>"; };
+		97627B9714FB5424002CDCA1 /* Supplementable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Supplementable.h; sourceTree = "<group>"; };
 		97665011144FAA4200F6BB51 /* EventFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventFactory.h; sourceTree = "<group>"; };
 		9766504E144FBFFE00F6BB51 /* EventFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventFactory.cpp; sourceTree = "<group>"; };
 		9767CE09145ABC12005E64DB /* ExceptionHeaders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionHeaders.h; sourceTree = "<group>"; };
@@ -10271,8 +10363,6 @@
 		976D6C67122B8A3D001FD1F7 /* FileList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileList.h; path = fileapi/FileList.h; sourceTree = "<group>"; };
 		976D6C69122B8A3D001FD1F7 /* FileReader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileReader.cpp; path = fileapi/FileReader.cpp; sourceTree = "<group>"; };
 		976D6C6A122B8A3D001FD1F7 /* FileReader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileReader.h; path = fileapi/FileReader.h; sourceTree = "<group>"; };
-		976D6C6C122B8A3D001FD1F7 /* FileStreamProxy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileStreamProxy.cpp; path = fileapi/FileStreamProxy.cpp; sourceTree = "<group>"; };
-		976D6C6D122B8A3D001FD1F7 /* FileStreamProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileStreamProxy.h; path = fileapi/FileStreamProxy.h; sourceTree = "<group>"; };
 		976D6C6E122B8A3D001FD1F7 /* FileThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileThread.cpp; path = fileapi/FileThread.cpp; sourceTree = "<group>"; };
 		976D6C6F122B8A3D001FD1F7 /* FileThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileThread.h; path = fileapi/FileThread.h; sourceTree = "<group>"; };
 		976D6C70122B8A3D001FD1F7 /* FileThreadTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileThreadTask.h; path = fileapi/FileThreadTask.h; sourceTree = "<group>"; };
@@ -10319,8 +10409,6 @@
 		978AD67114130A8D00C7CAE3 /* HTMLSpanElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLSpanElement.cpp; sourceTree = "<group>"; };
 		978AD67214130A8D00C7CAE3 /* HTMLSpanElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLSpanElement.h; sourceTree = "<group>"; };
 		978AD67314130A8D00C7CAE3 /* HTMLSpanElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLSpanElement.idl; sourceTree = "<group>"; };
-		978D07B1145A0EBD0096908D /* IDBDatabaseException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBDatabaseException.cpp; sourceTree = "<group>"; };
-		978D07B3145A0ECD0096908D /* SQLException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLException.cpp; sourceTree = "<group>"; };
 		978D07B5145A0F030096908D /* FileException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileException.cpp; path = fileapi/FileException.cpp; sourceTree = "<group>"; };
 		978D07B7145A0F1B0096908D /* OperationNotAllowedException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OperationNotAllowedException.cpp; path = fileapi/OperationNotAllowedException.cpp; sourceTree = "<group>"; };
 		978D07B9145A0F3C0096908D /* RangeException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RangeException.cpp; sourceTree = "<group>"; };
@@ -10333,6 +10421,103 @@
 		979F43D21075E44A0000F83B /* NavigationScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigationScheduler.h; sourceTree = "<group>"; };
 		97AA3CA3145237CC003E1DA6 /* EventTargetHeaders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventTargetHeaders.h; sourceTree = "<group>"; };
 		97AA3CA4145237CC003E1DA6 /* EventTargetInterfaces.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventTargetInterfaces.h; sourceTree = "<group>"; };
+		97AABCF814FA09D5007457AE /* CloseEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CloseEvent.h; path = Modules/websockets/CloseEvent.h; sourceTree = "<group>"; };
+		97AABCF914FA09D5007457AE /* CloseEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CloseEvent.idl; path = Modules/websockets/CloseEvent.idl; sourceTree = "<group>"; };
+		97AABCFA14FA09D5007457AE /* DOMWindowWebSocket.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowWebSocket.idl; path = Modules/websockets/DOMWindowWebSocket.idl; sourceTree = "<group>"; };
+		97AABCFB14FA09D5007457AE /* ThreadableWebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ThreadableWebSocketChannel.cpp; path = Modules/websockets/ThreadableWebSocketChannel.cpp; sourceTree = "<group>"; };
+		97AABCFC14FA09D5007457AE /* ThreadableWebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ThreadableWebSocketChannel.h; path = Modules/websockets/ThreadableWebSocketChannel.h; sourceTree = "<group>"; };
+		97AABCFD14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ThreadableWebSocketChannelClientWrapper.cpp; path = Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp; sourceTree = "<group>"; };
+		97AABCFE14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ThreadableWebSocketChannelClientWrapper.h; path = Modules/websockets/ThreadableWebSocketChannelClientWrapper.h; sourceTree = "<group>"; };
+		97AABCFF14FA09D5007457AE /* WebSocket.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocket.cpp; path = Modules/websockets/WebSocket.cpp; sourceTree = "<group>"; };
+		97AABD0014FA09D5007457AE /* WebSocket.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocket.h; path = Modules/websockets/WebSocket.h; sourceTree = "<group>"; };
+		97AABD0114FA09D5007457AE /* WebSocket.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebSocket.idl; path = Modules/websockets/WebSocket.idl; sourceTree = "<group>"; };
+		97AABD0214FA09D5007457AE /* WebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketChannel.cpp; path = Modules/websockets/WebSocketChannel.cpp; sourceTree = "<group>"; };
+		97AABD0314FA09D5007457AE /* WebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketChannel.h; path = Modules/websockets/WebSocketChannel.h; sourceTree = "<group>"; };
+		97AABD0414FA09D5007457AE /* WebSocketChannelClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketChannelClient.h; path = Modules/websockets/WebSocketChannelClient.h; sourceTree = "<group>"; };
+		97AABD0514FA09D5007457AE /* WebSocketDeflater.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketDeflater.cpp; path = Modules/websockets/WebSocketDeflater.cpp; sourceTree = "<group>"; };
+		97AABD0614FA09D5007457AE /* WebSocketDeflater.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketDeflater.h; path = Modules/websockets/WebSocketDeflater.h; sourceTree = "<group>"; };
+		97AABD0714FA09D5007457AE /* WebSocketExtensionDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketExtensionDispatcher.cpp; path = Modules/websockets/WebSocketExtensionDispatcher.cpp; sourceTree = "<group>"; };
+		97AABD0814FA09D5007457AE /* WebSocketExtensionDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketExtensionDispatcher.h; path = Modules/websockets/WebSocketExtensionDispatcher.h; sourceTree = "<group>"; };
+		97AABD0914FA09D5007457AE /* WebSocketExtensionProcessor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketExtensionProcessor.h; path = Modules/websockets/WebSocketExtensionProcessor.h; sourceTree = "<group>"; };
+		97AABD0A14FA09D5007457AE /* WebSocketFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketFrame.h; path = Modules/websockets/WebSocketFrame.h; sourceTree = "<group>"; };
+		97AABD0B14FA09D5007457AE /* WebSocketHandshake.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketHandshake.cpp; path = Modules/websockets/WebSocketHandshake.cpp; sourceTree = "<group>"; };
+		97AABD0C14FA09D5007457AE /* WebSocketHandshake.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketHandshake.h; path = Modules/websockets/WebSocketHandshake.h; sourceTree = "<group>"; };
+		97AABD0D14FA09D5007457AE /* WebSocketHandshakeRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketHandshakeRequest.cpp; path = Modules/websockets/WebSocketHandshakeRequest.cpp; sourceTree = "<group>"; };
+		97AABD0E14FA09D5007457AE /* WebSocketHandshakeRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketHandshakeRequest.h; path = Modules/websockets/WebSocketHandshakeRequest.h; sourceTree = "<group>"; };
+		97AABD0F14FA09D5007457AE /* WebSocketHandshakeResponse.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketHandshakeResponse.cpp; path = Modules/websockets/WebSocketHandshakeResponse.cpp; sourceTree = "<group>"; };
+		97AABD1014FA09D5007457AE /* WebSocketHandshakeResponse.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketHandshakeResponse.h; path = Modules/websockets/WebSocketHandshakeResponse.h; sourceTree = "<group>"; };
+		97AABD1114FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerThreadableWebSocketChannel.cpp; path = Modules/websockets/WorkerThreadableWebSocketChannel.cpp; sourceTree = "<group>"; };
+		97AABD1214FA09D5007457AE /* WorkerThreadableWebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerThreadableWebSocketChannel.h; path = Modules/websockets/WorkerThreadableWebSocketChannel.h; sourceTree = "<group>"; };
+		97BC69D61505F076001B74AC /* AbstractDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AbstractDatabase.cpp; path = Modules/webdatabase/AbstractDatabase.cpp; sourceTree = "<group>"; };
+		97BC69D71505F076001B74AC /* AbstractDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AbstractDatabase.h; path = Modules/webdatabase/AbstractDatabase.h; sourceTree = "<group>"; };
+		97BC69D81505F076001B74AC /* ChangeVersionWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ChangeVersionWrapper.cpp; path = Modules/webdatabase/ChangeVersionWrapper.cpp; sourceTree = "<group>"; };
+		97BC69D91505F076001B74AC /* ChangeVersionWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ChangeVersionWrapper.h; path = Modules/webdatabase/ChangeVersionWrapper.h; sourceTree = "<group>"; };
+		97BC69DE1505F081001B74AC /* Database.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Database.cpp; path = Modules/webdatabase/Database.cpp; sourceTree = "<group>"; };
+		97BC69DF1505F081001B74AC /* Database.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Database.h; path = Modules/webdatabase/Database.h; sourceTree = "<group>"; };
+		97BC69E01505F081001B74AC /* Database.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Database.idl; path = Modules/webdatabase/Database.idl; sourceTree = "<group>"; };
+		97BC69E11505F081001B74AC /* DatabaseAuthorizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseAuthorizer.cpp; path = Modules/webdatabase/DatabaseAuthorizer.cpp; sourceTree = "<group>"; };
+		97BC69E21505F081001B74AC /* DatabaseAuthorizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseAuthorizer.h; path = Modules/webdatabase/DatabaseAuthorizer.h; sourceTree = "<group>"; };
+		97BC69E31505F081001B74AC /* DatabaseCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseCallback.h; path = Modules/webdatabase/DatabaseCallback.h; sourceTree = "<group>"; };
+		97BC69E41505F081001B74AC /* DatabaseCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DatabaseCallback.idl; path = Modules/webdatabase/DatabaseCallback.idl; sourceTree = "<group>"; };
+		97BC69E51505F081001B74AC /* DatabaseContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseContext.cpp; path = Modules/webdatabase/DatabaseContext.cpp; sourceTree = "<group>"; };
+		97BC69E61505F081001B74AC /* DatabaseContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseContext.h; path = Modules/webdatabase/DatabaseContext.h; sourceTree = "<group>"; };
+		97BC69E71505F081001B74AC /* DatabaseDetails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseDetails.h; path = Modules/webdatabase/DatabaseDetails.h; sourceTree = "<group>"; };
+		97BC69E81505F081001B74AC /* DatabaseSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseSync.cpp; path = Modules/webdatabase/DatabaseSync.cpp; sourceTree = "<group>"; };
+		97BC69E91505F081001B74AC /* DatabaseSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseSync.h; path = Modules/webdatabase/DatabaseSync.h; sourceTree = "<group>"; };
+		97BC69EA1505F081001B74AC /* DatabaseSync.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DatabaseSync.idl; path = Modules/webdatabase/DatabaseSync.idl; sourceTree = "<group>"; };
+		97BC69EB1505F081001B74AC /* DatabaseTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseTask.cpp; path = Modules/webdatabase/DatabaseTask.cpp; sourceTree = "<group>"; };
+		97BC69EC1505F081001B74AC /* DatabaseTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseTask.h; path = Modules/webdatabase/DatabaseTask.h; sourceTree = "<group>"; };
+		97BC69ED1505F081001B74AC /* DatabaseThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseThread.cpp; path = Modules/webdatabase/DatabaseThread.cpp; sourceTree = "<group>"; };
+		97BC69EE1505F081001B74AC /* DatabaseThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseThread.h; path = Modules/webdatabase/DatabaseThread.h; sourceTree = "<group>"; };
+		97BC69EF1505F081001B74AC /* DatabaseTracker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseTracker.cpp; path = Modules/webdatabase/DatabaseTracker.cpp; sourceTree = "<group>"; };
+		97BC69F01505F081001B74AC /* DatabaseTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseTracker.h; path = Modules/webdatabase/DatabaseTracker.h; sourceTree = "<group>"; };
+		97BC69F11505F081001B74AC /* DatabaseTrackerClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseTrackerClient.h; path = Modules/webdatabase/DatabaseTrackerClient.h; sourceTree = "<group>"; };
+		97BC69F21505F081001B74AC /* DOMWindowSQLDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DOMWindowSQLDatabase.cpp; path = Modules/webdatabase/DOMWindowSQLDatabase.cpp; sourceTree = "<group>"; };
+		97BC69F31505F081001B74AC /* DOMWindowSQLDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMWindowSQLDatabase.h; path = Modules/webdatabase/DOMWindowSQLDatabase.h; sourceTree = "<group>"; };
+		97BC69F41505F081001B74AC /* DOMWindowSQLDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowSQLDatabase.idl; path = Modules/webdatabase/DOMWindowSQLDatabase.idl; sourceTree = "<group>"; };
+		97BC69F51505F081001B74AC /* OriginQuotaManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OriginQuotaManager.cpp; path = Modules/webdatabase/OriginQuotaManager.cpp; sourceTree = "<group>"; };
+		97BC69F61505F081001B74AC /* OriginQuotaManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = OriginQuotaManager.h; path = Modules/webdatabase/OriginQuotaManager.h; sourceTree = "<group>"; };
+		97BC69F71505F081001B74AC /* OriginUsageRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OriginUsageRecord.cpp; path = Modules/webdatabase/OriginUsageRecord.cpp; sourceTree = "<group>"; };
+		97BC69F81505F081001B74AC /* OriginUsageRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = OriginUsageRecord.h; path = Modules/webdatabase/OriginUsageRecord.h; sourceTree = "<group>"; };
+		97BC69F91505F081001B74AC /* SQLCallbackWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLCallbackWrapper.h; path = Modules/webdatabase/SQLCallbackWrapper.h; sourceTree = "<group>"; };
+		97BC69FA1505F081001B74AC /* SQLError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLError.h; path = Modules/webdatabase/SQLError.h; sourceTree = "<group>"; };
+		97BC69FB1505F081001B74AC /* SQLError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLError.idl; path = Modules/webdatabase/SQLError.idl; sourceTree = "<group>"; };
+		97BC69FC1505F081001B74AC /* SQLException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLException.cpp; path = Modules/webdatabase/SQLException.cpp; sourceTree = "<group>"; };
+		97BC69FD1505F081001B74AC /* SQLException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLException.h; path = Modules/webdatabase/SQLException.h; sourceTree = "<group>"; };
+		97BC69FE1505F081001B74AC /* SQLException.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLException.idl; path = Modules/webdatabase/SQLException.idl; sourceTree = "<group>"; };
+		97BC69FF1505F081001B74AC /* SQLResultSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLResultSet.cpp; path = Modules/webdatabase/SQLResultSet.cpp; sourceTree = "<group>"; };
+		97BC6A001505F081001B74AC /* SQLResultSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLResultSet.h; path = Modules/webdatabase/SQLResultSet.h; sourceTree = "<group>"; };
+		97BC6A011505F081001B74AC /* SQLResultSet.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLResultSet.idl; path = Modules/webdatabase/SQLResultSet.idl; sourceTree = "<group>"; };
+		97BC6A021505F081001B74AC /* SQLResultSetRowList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLResultSetRowList.cpp; path = Modules/webdatabase/SQLResultSetRowList.cpp; sourceTree = "<group>"; };
+		97BC6A031505F081001B74AC /* SQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLResultSetRowList.h; path = Modules/webdatabase/SQLResultSetRowList.h; sourceTree = "<group>"; };
+		97BC6A041505F081001B74AC /* SQLResultSetRowList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLResultSetRowList.idl; path = Modules/webdatabase/SQLResultSetRowList.idl; sourceTree = "<group>"; };
+		97BC6A051505F081001B74AC /* SQLStatement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLStatement.cpp; path = Modules/webdatabase/SQLStatement.cpp; sourceTree = "<group>"; };
+		97BC6A061505F081001B74AC /* SQLStatement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLStatement.h; path = Modules/webdatabase/SQLStatement.h; sourceTree = "<group>"; };
+		97BC6A071505F081001B74AC /* SQLStatementCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLStatementCallback.h; path = Modules/webdatabase/SQLStatementCallback.h; sourceTree = "<group>"; };
+		97BC6A081505F081001B74AC /* SQLStatementCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLStatementCallback.idl; path = Modules/webdatabase/SQLStatementCallback.idl; sourceTree = "<group>"; };
+		97BC6A091505F081001B74AC /* SQLStatementErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLStatementErrorCallback.h; path = Modules/webdatabase/SQLStatementErrorCallback.h; sourceTree = "<group>"; };
+		97BC6A0A1505F081001B74AC /* SQLStatementErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLStatementErrorCallback.idl; path = Modules/webdatabase/SQLStatementErrorCallback.idl; sourceTree = "<group>"; };
+		97BC6A0B1505F081001B74AC /* SQLStatementSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLStatementSync.cpp; path = Modules/webdatabase/SQLStatementSync.cpp; sourceTree = "<group>"; };
+		97BC6A0C1505F081001B74AC /* SQLStatementSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLStatementSync.h; path = Modules/webdatabase/SQLStatementSync.h; sourceTree = "<group>"; };
+		97BC6A0D1505F081001B74AC /* SQLTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLTransaction.cpp; path = Modules/webdatabase/SQLTransaction.cpp; sourceTree = "<group>"; };
+		97BC6A0E1505F081001B74AC /* SQLTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransaction.h; path = Modules/webdatabase/SQLTransaction.h; sourceTree = "<group>"; };
+		97BC6A0F1505F081001B74AC /* SQLTransaction.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLTransaction.idl; path = Modules/webdatabase/SQLTransaction.idl; sourceTree = "<group>"; };
+		97BC6A101505F081001B74AC /* SQLTransactionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionCallback.h; path = Modules/webdatabase/SQLTransactionCallback.h; sourceTree = "<group>"; };
+		97BC6A111505F081001B74AC /* SQLTransactionCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLTransactionCallback.idl; path = Modules/webdatabase/SQLTransactionCallback.idl; sourceTree = "<group>"; };
+		97BC6A121505F081001B74AC /* SQLTransactionClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLTransactionClient.cpp; path = Modules/webdatabase/SQLTransactionClient.cpp; sourceTree = "<group>"; };
+		97BC6A131505F081001B74AC /* SQLTransactionClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionClient.h; path = Modules/webdatabase/SQLTransactionClient.h; sourceTree = "<group>"; };
+		97BC6A141505F081001B74AC /* SQLTransactionCoordinator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLTransactionCoordinator.cpp; path = Modules/webdatabase/SQLTransactionCoordinator.cpp; sourceTree = "<group>"; };
+		97BC6A151505F081001B74AC /* SQLTransactionCoordinator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionCoordinator.h; path = Modules/webdatabase/SQLTransactionCoordinator.h; sourceTree = "<group>"; };
+		97BC6A161505F081001B74AC /* SQLTransactionErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionErrorCallback.h; path = Modules/webdatabase/SQLTransactionErrorCallback.h; sourceTree = "<group>"; };
+		97BC6A171505F081001B74AC /* SQLTransactionErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLTransactionErrorCallback.idl; path = Modules/webdatabase/SQLTransactionErrorCallback.idl; sourceTree = "<group>"; };
+		97BC6A181505F081001B74AC /* SQLTransactionSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLTransactionSync.cpp; path = Modules/webdatabase/SQLTransactionSync.cpp; sourceTree = "<group>"; };
+		97BC6A191505F081001B74AC /* SQLTransactionSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionSync.h; path = Modules/webdatabase/SQLTransactionSync.h; sourceTree = "<group>"; };
+		97BC6A1A1505F081001B74AC /* SQLTransactionSync.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLTransactionSync.idl; path = Modules/webdatabase/SQLTransactionSync.idl; sourceTree = "<group>"; };
+		97BC6A1B1505F081001B74AC /* SQLTransactionSyncCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionSyncCallback.h; path = Modules/webdatabase/SQLTransactionSyncCallback.h; sourceTree = "<group>"; };
+		97BC6A1C1505F081001B74AC /* SQLTransactionSyncCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLTransactionSyncCallback.idl; path = Modules/webdatabase/SQLTransactionSyncCallback.idl; sourceTree = "<group>"; };
+		97BC6A1D1505F081001B74AC /* WorkerContextSQLDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerContextSQLDatabase.cpp; path = Modules/webdatabase/WorkerContextSQLDatabase.cpp; sourceTree = "<group>"; };
+		97BC6A1E1505F081001B74AC /* WorkerContextSQLDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerContextSQLDatabase.h; path = Modules/webdatabase/WorkerContextSQLDatabase.h; sourceTree = "<group>"; };
+		97BC6A1F1505F081001B74AC /* WorkerContextSQLDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WorkerContextSQLDatabase.idl; path = Modules/webdatabase/WorkerContextSQLDatabase.idl; sourceTree = "<group>"; };
 		97BC84811236FD93000C6161 /* TextDocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = TextDocumentParser.cpp; path = parser/TextDocumentParser.cpp; sourceTree = "<group>"; };
 		97BC84821236FD93000C6161 /* TextDocumentParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TextDocumentParser.h; path = parser/TextDocumentParser.h; sourceTree = "<group>"; };
 		97BC849A12370A4B000C6161 /* HTMLInputStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLInputStream.h; path = parser/HTMLInputStream.h; sourceTree = "<group>"; };
@@ -10344,8 +10529,6 @@
 		97C1F552122855CB00EDE616 /* HTMLToken.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLToken.h; path = parser/HTMLToken.h; sourceTree = "<group>"; };
 		97C471D912F925BC0086354B /* ContentSecurityPolicy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentSecurityPolicy.cpp; sourceTree = "<group>"; };
 		97C471DA12F925BD0086354B /* ContentSecurityPolicy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentSecurityPolicy.h; sourceTree = "<group>"; };
-		97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NavigatorSupplement.cpp; sourceTree = "<group>"; };
-		97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigatorSupplement.h; sourceTree = "<group>"; };
 		97D2AD0114B823A60093DF32 /* DOMWindowProperty.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMWindowProperty.cpp; sourceTree = "<group>"; };
 		97D2AD0214B823A60093DF32 /* DOMWindowProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWindowProperty.h; sourceTree = "<group>"; };
 		97DCE1FF10807C750057D394 /* HistoryController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HistoryController.cpp; sourceTree = "<group>"; };
@@ -10416,6 +10599,8 @@
 		A10BB5891484E3B300B2E87A /* RenderSVGShape.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGShape.h; sourceTree = "<group>"; };
 		A10DC76814747BAB005E2471 /* StyleGridData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = StyleGridData.cpp; path = style/StyleGridData.cpp; sourceTree = "<group>"; };
 		A10DC76914747BAB005E2471 /* StyleGridData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = StyleGridData.h; path = style/StyleGridData.h; sourceTree = "<group>"; };
+		A110DB9A14F5DF7700A03B93 /* StyleGridItemData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = StyleGridItemData.h; path = style/StyleGridItemData.h; sourceTree = "<group>"; };
+		A110DB9C14F5DF8700A03B93 /* StyleGridItemData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = StyleGridItemData.cpp; path = style/StyleGridItemData.cpp; sourceTree = "<group>"; };
 		A120ACA013F9983700FE4AC7 /* LayoutRepainter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LayoutRepainter.h; sourceTree = "<group>"; };
 		A120ACA113F9984600FE4AC7 /* LayoutRepainter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LayoutRepainter.cpp; sourceTree = "<group>"; };
 		A136A00A1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLHttpRequestProgressEventThrottle.cpp; sourceTree = "<group>"; };
@@ -10477,8 +10662,6 @@
 		A718760D0B2A120100A16ECE /* DragActions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragActions.h; sourceTree = "<group>"; };
 		A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DragControllerMac.mm; sourceTree = "<group>"; };
 		A71A70C911AFB02000989D6D /* HTMLMeterElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLMeterElement.idl; sourceTree = "<group>"; };
-		A71E083514E3CEAF006A4619 /* PageSupplement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageSupplement.cpp; sourceTree = "<group>"; };
-		A71E083614E3CEAF006A4619 /* PageSupplement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageSupplement.h; sourceTree = "<group>"; };
 		A723F77A1484CA4C008C6DBE /* PlatformExportMacros.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformExportMacros.h; sourceTree = "<group>"; };
 		A73F95FC12C97BFE0031AAF9 /* RoundedRect.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RoundedRect.cpp; sourceTree = "<group>"; };
 		A73F95FD12C97BFE0031AAF9 /* RoundedRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RoundedRect.h; sourceTree = "<group>"; };
@@ -10538,7 +10721,6 @@
 		A7D20F60107F406900A80392 /* JSWebGLActiveInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLActiveInfo.cpp; sourceTree = "<group>"; };
 		A7D20F61107F406900A80392 /* JSWebGLActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLActiveInfo.h; sourceTree = "<group>"; };
 		A7D20F6B107F438B00A80392 /* WebGLActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLActiveInfo.h; path = canvas/WebGLActiveInfo.h; sourceTree = "<group>"; };
-		A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PasteboardHelper.h; sourceTree = "<group>"; };
 		A7D6B3470F61104500B79FD1 /* WorkerScriptLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerScriptLoader.h; path = workers/WorkerScriptLoader.h; sourceTree = "<group>"; };
 		A7D6B3480F61104500B79FD1 /* WorkerScriptLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerScriptLoader.cpp; path = workers/WorkerScriptLoader.cpp; sourceTree = "<group>"; };
 		A7DB418114CE1F0A00A2E316 /* ShadowRoot.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = ShadowRoot.idl; sourceTree = "<group>"; };
@@ -10677,8 +10859,7 @@
 		A833C80A0A2CF25600D57664 /* XMLNames.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = XMLNames.cpp; sourceTree = "<group>"; };
 		A833C80B0A2CF25600D57664 /* XMLNames.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = XMLNames.h; sourceTree = "<group>"; };
 		A83B533814F399BB00720D9D /* IDLAttributes.txt */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDLAttributes.txt; path = scripts/IDLAttributes.txt; sourceTree = "<group>"; };
-		A83B535B14F7413A00720D9D /* DOMWindowWebGL.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowWebGL.idl; path = canvas/DOMWindowWebGL.idl; sourceTree = "<group>"; };
-		A83B536C14F749E200720D9D /* DOMWindowXML.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMWindowXML.idl; sourceTree = "<group>"; };
+		A83B538014FBB2EC00720D9D /* preprocess-idls.pl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.perl; name = "preprocess-idls.pl"; path = "scripts/preprocess-idls.pl"; sourceTree = "<group>"; };
 		A83B78F20CCAFF15000B0825 /* JSSVGFontFaceUriElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGFontFaceUriElement.h; sourceTree = "<group>"; };
 		A83B78F30CCAFF15000B0825 /* JSSVGFontFaceUriElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGFontFaceUriElement.cpp; sourceTree = "<group>"; };
 		A83B78F40CCAFF15000B0825 /* JSSVGFontFaceSrcElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGFontFaceSrcElement.h; sourceTree = "<group>"; };
@@ -10786,10 +10967,8 @@
 		A88DD4880B4629B000C02990 /* PathTraversalState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PathTraversalState.cpp; sourceTree = "<group>"; };
 		A89943260B42338700D7C802 /* BitmapImage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BitmapImage.h; sourceTree = "<group>"; };
 		A89943270B42338700D7C802 /* BitmapImage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BitmapImage.cpp; sourceTree = "<group>"; };
-		A89AACD514F6C12700C1FA4A /* DOMWindowSVG.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = DOMWindowSVG.idl; sourceTree = "<group>"; };
 		A89CCC500F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ReplaceNodeWithSpanCommand.cpp; sourceTree = "<group>"; };
 		A89CCC510F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReplaceNodeWithSpanCommand.h; sourceTree = "<group>"; };
-		A8A5205D14F6BD3C00FBA19E /* DOMWindowHTML.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMWindowHTML.idl; sourceTree = "<group>"; };
 		A8BC04911214F69600B5F122 /* HTMLEntityTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLEntityTable.cpp; sourceTree = "<group>"; };
 		A8C2280D11D4A59700D5A7D3 /* DocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentParser.cpp; sourceTree = "<group>"; };
 		A8C2289F11D5722E00D5A7D3 /* DecodedDataDocumentParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecodedDataDocumentParser.h; sourceTree = "<group>"; };
@@ -11032,10 +11211,6 @@
 		A8EA80040A19516E00A8EF5F /* StyleSheet.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = StyleSheet.h; sourceTree = "<group>"; };
 		A8EA80050A19516E00A8EF5F /* StyleSheet.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = StyleSheet.cpp; sourceTree = "<group>"; };
 		A8EA80060A19516E00A8EF5F /* MediaList.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaList.h; sourceTree = "<group>"; };
-		A8F4578F14B2B004000CEA59 /* resolve-supplemental.pl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.perl; name = "resolve-supplemental.pl"; path = "scripts/resolve-supplemental.pl"; sourceTree = "<group>"; };
-		A8F4579D14BC13EC000CEA59 /* DOMWindowSQLDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMWindowSQLDatabase.cpp; sourceTree = "<group>"; };
-		A8F4579E14BC13EC000CEA59 /* DOMWindowSQLDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWindowSQLDatabase.h; sourceTree = "<group>"; };
-		A8F4579F14BC13EC000CEA59 /* DOMWindowSQLDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMWindowSQLDatabase.idl; sourceTree = "<group>"; };
 		A8FA6E5B0E4CFDED00D5CF49 /* Pattern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pattern.h; sourceTree = "<group>"; };
 		A8FA6E5C0E4CFDED00D5CF49 /* Pattern.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Pattern.cpp; sourceTree = "<group>"; };
 		A9C6E4E10D745E05006442E9 /* DOMMimeType.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = DOMMimeType.cpp; sourceTree = "<group>"; };
@@ -11890,36 +12065,17 @@
 		B2FA3D300AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGZoomEvent.cpp; sourceTree = "<group>"; };
 		B2FA3D310AB75A6F000E5AC4 /* JSSVGZoomEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSSVGZoomEvent.h; sourceTree = "<group>"; };
 		B50F5B800E96CD9900AD71A6 /* WebCoreObjCExtras.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreObjCExtras.mm; sourceTree = "<group>"; };
-		B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransactionClient.cpp; sourceTree = "<group>"; };
-		B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionClient.h; sourceTree = "<group>"; };
-		B523CEFF1182675400EBB29C /* SQLTransactionSyncCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionSyncCallback.h; sourceTree = "<group>"; };
-		B523CF011182675400EBB29C /* SQLTransactionSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionSync.h; sourceTree = "<group>"; };
-		B523CF021182675400EBB29C /* SQLTransactionSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransactionSync.cpp; sourceTree = "<group>"; };
-		B523CF031182675400EBB29C /* DatabaseSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseSync.cpp; sourceTree = "<group>"; };
-		B523CF041182675400EBB29C /* DatabaseSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseSync.h; sourceTree = "<group>"; };
 		B525A96311CA2340003A23A8 /* JSSQLException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLException.h; sourceTree = "<group>"; };
 		B525A96411CA2340003A23A8 /* JSSQLException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLException.cpp; sourceTree = "<group>"; };
 		B5320D69122A24E9002D1440 /* FontPlatformData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontPlatformData.h; sourceTree = "<group>"; };
 		B5320D6A122A24E9002D1440 /* FontPlatformDataCocoa.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = FontPlatformDataCocoa.mm; sourceTree = "<group>"; };
-		B550B52111DC68A800923885 /* SQLStatementSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLStatementSync.cpp; sourceTree = "<group>"; };
-		B550B52211DC68A800923885 /* SQLStatementSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLStatementSync.h; sourceTree = "<group>"; };
 		B55D5AA2119131FC00BCC315 /* JSSQLTransactionSyncCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLTransactionSyncCallback.h; sourceTree = "<group>"; };
 		B55D5AA3119131FC00BCC315 /* JSSQLTransactionSyncCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLTransactionSyncCallback.cpp; sourceTree = "<group>"; };
 		B55D5AA71191325000BCC315 /* JSSQLTransactionSyncCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLTransactionSyncCustom.cpp; sourceTree = "<group>"; };
-		B55D5ABB1191327200BCC315 /* DatabaseSync.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DatabaseSync.idl; sourceTree = "<group>"; };
-		B55D5ABC1191327200BCC315 /* SQLTransactionSync.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLTransactionSync.idl; sourceTree = "<group>"; };
-		B55D5ABD1191327200BCC315 /* SQLTransactionSyncCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLTransactionSyncCallback.idl; sourceTree = "<group>"; };
-		B56EBA8311C9FF8100B04477 /* SQLException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLException.h; sourceTree = "<group>"; };
-		B56EBA8411C9FF8100B04477 /* SQLException.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLException.idl; sourceTree = "<group>"; };
 		B58CEB6711913607002A6790 /* JSDatabaseSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDatabaseSync.h; sourceTree = "<group>"; };
 		B58CEB6811913607002A6790 /* JSDatabaseSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDatabaseSync.cpp; sourceTree = "<group>"; };
 		B58CEB6B1191361C002A6790 /* JSSQLTransactionSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLTransactionSync.h; sourceTree = "<group>"; };
 		B58CEB6C1191361C002A6790 /* JSSQLTransactionSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLTransactionSync.cpp; sourceTree = "<group>"; };
-		B59DD68D1190298E007E9684 /* DatabaseCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DatabaseCallback.idl; sourceTree = "<group>"; };
-		B59DD68E1190298E007E9684 /* SQLStatementCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLStatementCallback.idl; sourceTree = "<group>"; };
-		B59DD68F1190298E007E9684 /* SQLStatementErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLStatementErrorCallback.idl; sourceTree = "<group>"; };
-		B59DD6901190298E007E9684 /* SQLTransactionCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLTransactionCallback.idl; sourceTree = "<group>"; };
-		B59DD6911190298E007E9684 /* SQLTransactionErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLTransactionErrorCallback.idl; sourceTree = "<group>"; };
 		B59DD697119029E5007E9684 /* JSDatabaseCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDatabaseCallback.h; sourceTree = "<group>"; };
 		B59DD698119029E5007E9684 /* JSDatabaseCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDatabaseCallback.cpp; sourceTree = "<group>"; };
 		B59DD69B11902A42007E9684 /* JSSQLTransactionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLTransactionCallback.h; sourceTree = "<group>"; };
@@ -11932,19 +12088,8 @@
 		B59DD6A811902A71007E9684 /* JSSQLStatementErrorCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLStatementErrorCallback.cpp; sourceTree = "<group>"; };
 		B5A684210FFABE9800D24689 /* SQLiteFileSystem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLiteFileSystem.h; path = sql/SQLiteFileSystem.h; sourceTree = "<group>"; };
 		B5A684230FFABEAA00D24689 /* SQLiteFileSystem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLiteFileSystem.cpp; path = sql/SQLiteFileSystem.cpp; sourceTree = "<group>"; };
-		B5B5DC67119BB3D5002A8790 /* AbstractDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AbstractDatabase.cpp; sourceTree = "<group>"; };
-		B5B5DC68119BB3D5002A8790 /* AbstractDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AbstractDatabase.h; sourceTree = "<group>"; };
-		B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransactionCoordinator.cpp; sourceTree = "<group>"; };
-		B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionCoordinator.h; sourceTree = "<group>"; };
 		B5D31DF811CF610B009F22B4 /* ActiveDOMCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ActiveDOMCallback.cpp; path = generic/ActiveDOMCallback.cpp; sourceTree = "<group>"; };
 		B5D31DF911CF610B009F22B4 /* ActiveDOMCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ActiveDOMCallback.h; path = generic/ActiveDOMCallback.h; sourceTree = "<group>"; };
-		B5D36019112F8B560048DEA8 /* DatabaseCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseCallback.h; sourceTree = "<group>"; };
-		B61762531203374F00EF9114 /* IDBDatabaseBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBDatabaseBackendInterface.h; sourceTree = "<group>"; };
-		B61762611203490800EF9114 /* IDBDatabaseBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBDatabaseBackendImpl.h; sourceTree = "<group>"; };
-		B6566267120B115A006EA85C /* IDBTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBTransaction.cpp; sourceTree = "<group>"; };
-		B6566268120B115A006EA85C /* IDBTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBTransaction.h; sourceTree = "<group>"; };
-		B6566269120B115A006EA85C /* IDBTransaction.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBTransaction.idl; sourceTree = "<group>"; };
-		B656626D120B116B006EA85C /* IDBTransactionBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBTransactionBackendInterface.h; sourceTree = "<group>"; };
 		B656626E120B1227006EA85C /* JSIDBTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSIDBTransaction.h; sourceTree = "<group>"; };
 		B656626F120B1227006EA85C /* JSIDBTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSIDBTransaction.cpp; sourceTree = "<group>"; };
 		B734B180119B9911006587BD /* FontTranscoder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FontTranscoder.cpp; path = transcoder/FontTranscoder.cpp; sourceTree = "<group>"; };
@@ -12039,7 +12184,7 @@
 		BC23EE910DAED2BC009FDC91 /* CSSImageGeneratorValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSImageGeneratorValue.h; sourceTree = "<group>"; };
 		BC23F0DA0DAFF4A4009FDC91 /* GeneratedImage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeneratedImage.h; sourceTree = "<group>"; };
 		BC2441C30E8B65D00055320F /* ScrollView.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollView.cpp; sourceTree = "<group>"; };
-		BC25B528131C6D3900180E10 /* LocalizedStringsMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LocalizedStringsMac.mm; sourceTree = "<group>"; };
+		BC25B528131C6D3900180E10 /* LocalizedStringsMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocalizedStringsMac.cpp; sourceTree = "<group>"; };
 		BC274B2E140EBEB200EADFA6 /* CSSBorderImageSliceValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSBorderImageSliceValue.h; sourceTree = "<group>"; };
 		BC274B30140EBED800EADFA6 /* CSSBorderImageSliceValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSBorderImageSliceValue.cpp; sourceTree = "<group>"; };
 		BC275B7811C5D1C300C9206C /* JSWebKitPointCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitPointCustom.cpp; sourceTree = "<group>"; };
@@ -12274,7 +12419,7 @@
 		BC98A27C0C0C9950004BEBF7 /* JSStyleSheetCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStyleSheetCustom.cpp; sourceTree = "<group>"; };
 		BC99812D0DBE807A008CE9EF /* DOMAbstractViewFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMAbstractViewFrame.h; sourceTree = "<group>"; };
 		BC9A6141146859D9006057FD /* DOMExceptions.in */ = {isa = PBXFileReference; lastKnownFileType = text; path = DOMExceptions.in; sourceTree = "<group>"; };
-		BC9A6142146859D9006057FD /* EventFactory.in */ = {isa = PBXFileReference; lastKnownFileType = text; path = EventFactory.in; sourceTree = "<group>"; };
+		BC9A6142146859D9006057FD /* EventNames.in */ = {isa = PBXFileReference; lastKnownFileType = text; path = EventNames.in; sourceTree = "<group>"; };
 		BC9A6144146859D9006057FD /* make_dom_exceptions.pl */ = {isa = PBXFileReference; lastKnownFileType = text.script.perl; path = make_dom_exceptions.pl; sourceTree = "<group>"; };
 		BC9A6145146859D9006057FD /* make_event_factory.pl */ = {isa = PBXFileReference; lastKnownFileType = text.script.perl; path = make_event_factory.pl; sourceTree = "<group>"; };
 		BC9A6146146859D9006057FD /* make_names.pl */ = {isa = PBXFileReference; lastKnownFileType = text.script.perl; path = make_names.pl; sourceTree = "<group>"; };
@@ -12500,6 +12645,8 @@
 		C105DA610F3AA68F001DD44F /* TextEncodingDetectorICU.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextEncodingDetectorICU.cpp; sourceTree = "<group>"; };
 		C105DA630F3AA6B8001DD44F /* TextEncodingDetector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextEncodingDetector.h; sourceTree = "<group>"; };
 		C330A22113EC196B0000B45B /* ColorChooser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorChooser.h; sourceTree = "<group>"; };
+		C33EE5C214FB49610002095A /* BaseClickableWithKeyInputType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BaseClickableWithKeyInputType.cpp; sourceTree = "<group>"; };
+		C33EE5C314FB49610002095A /* BaseClickableWithKeyInputType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BaseClickableWithKeyInputType.h; sourceTree = "<group>"; };
 		C37CDEBC149EF2030042090D /* ColorChooserClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorChooserClient.h; sourceTree = "<group>"; };
 		C50B561412119D23008B46E0 /* GroupSettings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GroupSettings.cpp; sourceTree = "<group>"; };
 		C50B561512119D23008B46E0 /* GroupSettings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GroupSettings.h; sourceTree = "<group>"; };
@@ -12520,12 +12667,6 @@
 		C55610F011A704EB00B82D27 /* DOMStringList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMStringList.cpp; sourceTree = "<group>"; };
 		C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageNamespaceImpl.h; sourceTree = "<group>"; };
 		C55E38BC10040D5D00A56BDB /* StorageNamespaceImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageNamespaceImpl.cpp; sourceTree = "<group>"; };
-		C572EE041201C736007D8F82 /* IDBIndex.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBIndex.cpp; sourceTree = "<group>"; };
-		C572EE051201C736007D8F82 /* IDBIndex.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBIndex.h; sourceTree = "<group>"; };
-		C572EE061201C736007D8F82 /* IDBIndex.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBIndex.idl; sourceTree = "<group>"; };
-		C572EE071201C736007D8F82 /* IDBIndexBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBIndexBackendImpl.cpp; sourceTree = "<group>"; };
-		C572EE081201C736007D8F82 /* IDBIndexBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBIndexBackendImpl.h; sourceTree = "<group>"; };
-		C572EE091201C736007D8F82 /* IDBIndexBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBIndexBackendInterface.h; sourceTree = "<group>"; };
 		C572EE1C1201C9BC007D8F82 /* JSIDBIndex.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSIDBIndex.cpp; sourceTree = "<group>"; };
 		C572EE1D1201C9BC007D8F82 /* JSIDBIndex.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSIDBIndex.h; sourceTree = "<group>"; };
 		C57FEDE01212EE9C0097BE65 /* FileSystem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FileSystem.cpp; sourceTree = "<group>"; };
@@ -12551,46 +12692,15 @@
 		C585A67911D4FB07004C3E4B /* JSIDBRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSIDBRequest.h; sourceTree = "<group>"; };
 		C585A69411D4FB13004C3E4B /* JSIDBFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSIDBFactory.cpp; sourceTree = "<group>"; };
 		C585A69511D4FB13004C3E4B /* JSIDBFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSIDBFactory.h; sourceTree = "<group>"; };
-		C585A69811D4FB3D004C3E4B /* IDBAny.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBAny.cpp; sourceTree = "<group>"; };
-		C585A69911D4FB3D004C3E4B /* IDBAny.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBAny.h; sourceTree = "<group>"; };
-		C585A69A11D4FB3D004C3E4B /* IDBAny.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBAny.idl; sourceTree = "<group>"; };
-		C585A69B11D4FB3D004C3E4B /* IDBCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCallbacks.h; sourceTree = "<group>"; };
-		C585A69D11D4FB3D004C3E4B /* IDBDatabaseError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBDatabaseError.h; sourceTree = "<group>"; };
-		C585A69E11D4FB3D004C3E4B /* IDBDatabaseError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBDatabaseError.idl; sourceTree = "<group>"; };
-		C585A69F11D4FB3D004C3E4B /* IDBDatabaseException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBDatabaseException.h; sourceTree = "<group>"; };
-		C585A6A011D4FB3D004C3E4B /* IDBDatabaseException.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBDatabaseException.idl; sourceTree = "<group>"; };
-		C585A6A111D4FB3D004C3E4B /* IDBDatabaseBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBDatabaseBackendImpl.cpp; sourceTree = "<group>"; };
-		C585A6A311D4FB3D004C3E4B /* IDBDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBDatabase.cpp; sourceTree = "<group>"; };
-		C585A6A411D4FB3D004C3E4B /* IDBDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBDatabase.h; sourceTree = "<group>"; };
-		C585A6A511D4FB3D004C3E4B /* IDBDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBDatabase.idl; sourceTree = "<group>"; };
-		C585A6B211D4FB3D004C3E4B /* IDBKey.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBKey.cpp; sourceTree = "<group>"; };
-		C585A6B311D4FB3D004C3E4B /* IDBKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBKey.h; sourceTree = "<group>"; };
-		C585A6B411D4FB3D004C3E4B /* IDBKey.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBKey.idl; sourceTree = "<group>"; };
-		C585A6B511D4FB3D004C3E4B /* IDBKeyRange.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBKeyRange.cpp; sourceTree = "<group>"; };
-		C585A6B611D4FB3D004C3E4B /* IDBKeyRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBKeyRange.h; sourceTree = "<group>"; };
-		C585A6B711D4FB3D004C3E4B /* IDBKeyRange.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBKeyRange.idl; sourceTree = "<group>"; };
-		C585A6B911D4FB3D004C3E4B /* IDBObjectStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBObjectStore.h; sourceTree = "<group>"; };
-		C585A6BA11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBObjectStoreBackendImpl.cpp; sourceTree = "<group>"; };
-		C585A6BB11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBObjectStoreBackendImpl.h; sourceTree = "<group>"; };
-		C585A6BC11D4FB3D004C3E4B /* IDBObjectStore.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBObjectStore.cpp; sourceTree = "<group>"; };
-		C585A6BD11D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBObjectStoreBackendInterface.h; sourceTree = "<group>"; };
-		C585A6BE11D4FB3D004C3E4B /* IDBObjectStore.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBObjectStore.idl; sourceTree = "<group>"; };
-		C585A6BF11D4FB3D004C3E4B /* IDBRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBRequest.cpp; sourceTree = "<group>"; };
-		C585A6C011D4FB3D004C3E4B /* IDBRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBRequest.h; sourceTree = "<group>"; };
-		C585A6C111D4FB3D004C3E4B /* IDBRequest.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBRequest.idl; sourceTree = "<group>"; };
-		C585A6C511D4FB3D004C3E4B /* IDBFactoryBackendInterface.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBFactoryBackendInterface.cpp; sourceTree = "<group>"; };
-		C585A6C611D4FB3D004C3E4B /* IDBFactoryBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBFactoryBackendInterface.h; sourceTree = "<group>"; };
-		C585A6C711D4FB3D004C3E4B /* IDBFactoryBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBFactoryBackendImpl.cpp; sourceTree = "<group>"; };
-		C585A6C811D4FB3D004C3E4B /* IDBFactoryBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBFactoryBackendImpl.h; sourceTree = "<group>"; };
-		C585A6C911D4FB3D004C3E4B /* IDBFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBFactory.cpp; sourceTree = "<group>"; };
-		C585A6CA11D4FB3D004C3E4B /* IDBFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBFactory.h; sourceTree = "<group>"; };
-		C585A6CB11D4FB3D004C3E4B /* IDBFactory.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBFactory.idl; sourceTree = "<group>"; };
+		C5B4C24B1509236C00A6EF37 /* WebCoreNSURLExtras.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreNSURLExtras.h; sourceTree = "<group>"; };
+		C5B4C24C1509236C00A6EF37 /* WebCoreNSURLExtras.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreNSURLExtras.mm; sourceTree = "<group>"; };
 		C5BAC16F14E30E4700008837 /* PlatformPasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformPasteboard.h; sourceTree = "<group>"; };
 		C5D4AA78116BAFB60069CA93 /* GlyphMetricsMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GlyphMetricsMap.h; sourceTree = "<group>"; };
 		C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageEventDispatcher.cpp; sourceTree = "<group>"; };
 		C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageEventDispatcher.h; sourceTree = "<group>"; };
 		C5F765B414E1D414006C899B /* PasteboardStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PasteboardStrategy.h; sourceTree = "<group>"; };
 		C5F765BA14E1ECF4006C899B /* PlatformPasteboardMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformPasteboardMac.mm; sourceTree = "<group>"; };
+		C691614714F6EBA70046375C /* ScrollbarThemeClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollbarThemeClient.h; sourceTree = "<group>"; };
 		C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModifySelectionListLevel.h; sourceTree = "<group>"; };
 		C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModifySelectionListLevel.cpp; sourceTree = "<group>"; };
 		C6F08FB91430FE8F00685849 /* MutationRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutationRecord.cpp; sourceTree = "<group>"; };
@@ -12614,6 +12724,8 @@
 		CA3BF67D10D99BAE00E6CE53 /* ScrollAnimator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollAnimator.h; sourceTree = "<group>"; };
 		CAE9F90D146441F000C245B0 /* CSSAspectRatioValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSAspectRatioValue.cpp; sourceTree = "<group>"; };
 		CAE9F90E146441F000C245B0 /* CSSAspectRatioValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSAspectRatioValue.h; sourceTree = "<group>"; };
+		CD127DEA14F3097900E84779 /* WebCoreFullScreenWindow.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreFullScreenWindow.h; sourceTree = "<group>"; };
+		CD127DEB14F3097900E84779 /* WebCoreFullScreenWindow.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreFullScreenWindow.mm; sourceTree = "<group>"; };
 		CD27F6E014575C1B0078207D /* MediaController.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = MediaController.idl; sourceTree = "<group>"; };
 		CD27F6E2145767580078207D /* JSMediaController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMediaController.cpp; sourceTree = "<group>"; };
 		CD27F6E3145767580078207D /* JSMediaController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMediaController.h; sourceTree = "<group>"; };
@@ -12679,12 +12791,8 @@
 		D23CA55C0AB0EAAE005108A5 /* JSRangeException.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSRangeException.h; sourceTree = "<group>"; };
 		D23CA55E0AB0EAB6005108A5 /* JSRangeException.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSRangeException.cpp; sourceTree = "<group>"; };
 		D23CA56B0AB0EB8D005108A5 /* RangeException.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RangeException.h; sourceTree = "<group>"; };
-		D302754312A5FE84004BD828 /* RenderDetails.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderDetails.cpp; sourceTree = "<group>"; };
-		D302754412A5FE84004BD828 /* RenderDetails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderDetails.h; sourceTree = "<group>"; };
 		D302754512A5FE84004BD828 /* RenderDetailsMarker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderDetailsMarker.cpp; sourceTree = "<group>"; };
 		D302754612A5FE84004BD828 /* RenderDetailsMarker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderDetailsMarker.h; sourceTree = "<group>"; };
-		D302754B12A5FEAB004BD828 /* RenderSummary.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSummary.cpp; sourceTree = "<group>"; };
-		D302754C12A5FEAB004BD828 /* RenderSummary.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSummary.h; sourceTree = "<group>"; };
 		D340629A1253BC8C009E4259 /* MediaQueryListListener.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaQueryListListener.cpp; sourceTree = "<group>"; };
 		D359D786129CA2710006E5D2 /* HTMLDetailsElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDetailsElement.cpp; sourceTree = "<group>"; };
 		D359D787129CA2710006E5D2 /* HTMLDetailsElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDetailsElement.h; sourceTree = "<group>"; };
@@ -12760,6 +12868,7 @@
 		E1284BB010449FFA00EAEB52 /* JSPageTransitionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPageTransitionEvent.cpp; sourceTree = "<group>"; };
 		E1284BD31044A01E00EAEB52 /* DOMPageTransitionEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMPageTransitionEvent.mm; sourceTree = "<group>"; };
 		E1284BD41044A01E00EAEB52 /* DOMPageTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMPageTransitionEvent.h; sourceTree = "<group>"; };
+		E129CBD21501702200A7C5FB /* npapi-sandbox.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = "npapi-sandbox.h"; sourceTree = "<group>"; };
 		E12EDB7A0B308A78002704B6 /* EventTarget.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventTarget.h; sourceTree = "<group>"; };
 		E12EDBE90B308E0B002704B6 /* EventTarget.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventTarget.cpp; sourceTree = "<group>"; };
 		E134F5AA12EE343F004EC58D /* IntRectHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntRectHash.h; sourceTree = "<group>"; };
@@ -12857,6 +12966,8 @@
 		E1C8BE5C0E8BD15A0064CB7D /* JSWorker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorker.cpp; sourceTree = "<group>"; };
 		E1CA5CBB0E8CDCAF00E8EF90 /* JSWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorkerCustom.cpp; sourceTree = "<group>"; };
 		E1CAA5C50E8BD23600A73ECA /* JSWorker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWorker.h; sourceTree = "<group>"; };
+		E1CDE91F15018ED000862CC5 /* AsyncFileStream.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AsyncFileStream.cpp; path = fileapi/AsyncFileStream.cpp; sourceTree = "<group>"; };
+		E1CDE9211501916900862CC5 /* AsyncFileStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AsyncFileStream.h; path = fileapi/AsyncFileStream.h; sourceTree = "<group>"; };
 		E1E1BEFF115FF6FB006F52CA /* WindowsKeyboardCodes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WindowsKeyboardCodes.h; sourceTree = "<group>"; };
 		E1E6EEA30B628DA8005F2F70 /* JSHTMLSelectElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLSelectElement.cpp; sourceTree = "<group>"; };
 		E1E6EEA70B628DB3005F2F70 /* JSHTMLSelectElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.h; path = JSHTMLSelectElement.h; sourceTree = "<group>"; };
@@ -12937,13 +13048,14 @@
 		E4B423860CBFB73C00AF2ECE /* JSProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSProgressEvent.h; sourceTree = "<group>"; };
 		E4BBED0C14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertySetCSSStyleDeclaration.cpp; sourceTree = "<group>"; };
 		E4BBED0D14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertySetCSSStyleDeclaration.h; sourceTree = "<group>"; };
+		E4BBED4A14FCDBA1003F0B98 /* StyleRule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StyleRule.cpp; sourceTree = "<group>"; };
+		E4BBED4B14FCDBA1003F0B98 /* StyleRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StyleRule.h; sourceTree = "<group>"; };
 		E4C178950EE6903800824D69 /* CSSSelectorList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSSelectorList.cpp; sourceTree = "<group>"; };
 		E4C178960EE6903800824D69 /* CSSSelectorList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSSelectorList.h; sourceTree = "<group>"; };
 		E4C279560CF9741900E97B98 /* RenderMedia.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderMedia.cpp; sourceTree = "<group>"; };
 		E4C279570CF9741900E97B98 /* RenderMedia.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderMedia.h; sourceTree = "<group>"; };
 		E4D687760ED7AE3D006EA978 /* PurgeableBufferMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PurgeableBufferMac.cpp; sourceTree = "<group>"; };
 		E4D687780ED7AE4F006EA978 /* PurgeableBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PurgeableBuffer.h; sourceTree = "<group>"; };
-		EB49DB8E14F46E8B002299D9 /* IDBTracing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBTracing.h; sourceTree = "<group>"; };
 		ED2BA83B09A24B91006C0AC4 /* DocumentMarker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentMarker.h; sourceTree = "<group>"; };
 		ED501DC50B249F2900AE18D9 /* EditorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = EditorMac.mm; path = mac/EditorMac.mm; sourceTree = "<group>"; };
 		EDE3A4FF0C7A430600956A37 /* ColorMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorMac.h; sourceTree = "<group>"; };
@@ -13505,7 +13617,6 @@
 				B22277CA0D00BF1E0071B782 /* svg */,
 				417DA4CD13734204007C57FB /* testing */,
 				FD315FA212B025B100C1A359 /* webaudio */,
-				518A34BD1026C831001B6896 /* websockets */,
 				2E4346310F546A6800B0F1BA /* workers */,
 				E1F0424309839389006694EA /* xml */,
 				656580EC09D12B20000E61D7 /* Derived Sources */,
@@ -13595,8 +13706,6 @@
 				436708A412D9CA4B00044234 /* RenderSVGResourceSolidColor.h */,
 				436708A512D9CA4B00044234 /* RenderSVGRoot.cpp */,
 				436708A612D9CA4B00044234 /* RenderSVGRoot.h */,
-				436708A712D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.cpp */,
-				436708A812D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.h */,
 				A10BB5881484E3B300B2E87A /* RenderSVGShape.cpp */,
 				A10BB5891484E3B300B2E87A /* RenderSVGShape.h */,
 				0854B0061255E4E600B9CDD0 /* RenderSVGText.cpp */,
@@ -13624,6 +13733,8 @@
 				436708B312D9CA4B00044234 /* SVGRenderSupport.h */,
 				436708B412D9CA4B00044234 /* SVGRenderTreeAsText.cpp */,
 				436708B512D9CA4B00044234 /* SVGRenderTreeAsText.h */,
+				197B180A150634C000E4ADA8 /* SVGRenderingContext.cpp */,
+				197B180B150634C000E4ADA8 /* SVGRenderingContext.h */,
 				436708B612D9CA4B00044234 /* SVGResources.cpp */,
 				436708B712D9CA4B00044234 /* SVGResources.h */,
 				436708B812D9CA4B00044234 /* SVGResourcesCache.cpp */,
@@ -13632,8 +13743,6 @@
 				436708BB12D9CA4B00044234 /* SVGResourcesCycleSolver.h */,
 				0854B0101255E4E600B9CDD0 /* SVGRootInlineBox.cpp */,
 				0854B0111255E4E600B9CDD0 /* SVGRootInlineBox.h */,
-				436708BC12D9CA4B00044234 /* SVGShadowTreeElements.cpp */,
-				436708BD12D9CA4B00044234 /* SVGShadowTreeElements.h */,
 				08F0BFBD1255C53C00075185 /* SVGTextChunk.cpp */,
 				08F0BFBE1255C53C00075185 /* SVGTextChunk.h */,
 				081668D1125603BF006F25DE /* SVGTextChunkBuilder.cpp */,
@@ -13677,6 +13786,7 @@
 				85136C8A0AED665800F90A3D /* eastWestResizeCursor.png */,
 				85136C8B0AED665800F90A3D /* helpCursor.png */,
 				93153BE314195B2900FCF5BE /* inputSpeech.png */,
+				2D9F0E1214FF1CBF00BA0FF7 /* linearSRGB.icc */,
 				85136C8C0AED665800F90A3D /* linkCursor.png */,
 				BCAD1808131C7A0D00990406 /* Localizable.strings */,
 				93153BE114195A5700FCF5BE /* missingImage.png */,
@@ -13885,129 +13995,6 @@
 		1AE82EC90CAAE177002237AE /* storage */ = {
 			isa = PBXGroup;
 			children = (
-				B5B5DC67119BB3D5002A8790 /* AbstractDatabase.cpp */,
-				B5B5DC68119BB3D5002A8790 /* AbstractDatabase.h */,
-				514185ED0CD65F0400763C99 /* ChangeVersionWrapper.cpp */,
-				514185EC0CD65F0400763C99 /* ChangeVersionWrapper.h */,
-				5196115E0CAC56570010A80C /* Database.cpp */,
-				5196115F0CAC56570010A80C /* Database.h */,
-				519611600CAC56570010A80C /* Database.idl */,
-				51A45B550CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp */,
-				51A45B540CAD7FD7000D2BE9 /* DatabaseAuthorizer.h */,
-				B5D36019112F8B560048DEA8 /* DatabaseCallback.h */,
-				B59DD68D1190298E007E9684 /* DatabaseCallback.idl */,
-				5116D9750CF177BD00C2B84D /* DatabaseDetails.h */,
-				B523CF031182675400EBB29C /* DatabaseSync.cpp */,
-				B523CF041182675400EBB29C /* DatabaseSync.h */,
-				B55D5ABB1191327200BCC315 /* DatabaseSync.idl */,
-				519611E90CAC749C0010A80C /* DatabaseTask.cpp */,
-				519611E80CAC749C0010A80C /* DatabaseTask.h */,
-				519611610CAC56570010A80C /* DatabaseThread.cpp */,
-				519611620CAC56570010A80C /* DatabaseThread.h */,
-				1AD51A130CB59CD300953D11 /* DatabaseTracker.cpp */,
-				1AD51A120CB59CD300953D11 /* DatabaseTracker.h */,
-				51FAFE330CECBF2D00BB3F24 /* DatabaseTrackerClient.h */,
-				A8F4579D14BC13EC000CEA59 /* DOMWindowSQLDatabase.cpp */,
-				A8F4579E14BC13EC000CEA59 /* DOMWindowSQLDatabase.h */,
-				A8F4579F14BC13EC000CEA59 /* DOMWindowSQLDatabase.idl */,
-				C585A69811D4FB3D004C3E4B /* IDBAny.cpp */,
-				C585A69911D4FB3D004C3E4B /* IDBAny.h */,
-				C585A69A11D4FB3D004C3E4B /* IDBAny.idl */,
-				C585A69B11D4FB3D004C3E4B /* IDBCallbacks.h */,
-				81A7325F121018A400FC0D9E /* IDBCursor.cpp */,
-				81A7325D1210189B00FC0D9E /* IDBCursor.h */,
-				81BE209C11F4ABBD00915DFA /* IDBCursor.idl */,
-				81BE209311F4AB8D00915DFA /* IDBCursorBackendImpl.cpp */,
-				81A73277121019E100FC0D9E /* IDBCursorBackendImpl.h */,
-				81BE209411F4AB8D00915DFA /* IDBCursorBackendInterface.h */,
-				C585A6A311D4FB3D004C3E4B /* IDBDatabase.cpp */,
-				C585A6A411D4FB3D004C3E4B /* IDBDatabase.h */,
-				C585A6A511D4FB3D004C3E4B /* IDBDatabase.idl */,
-				C585A6A111D4FB3D004C3E4B /* IDBDatabaseBackendImpl.cpp */,
-				B61762611203490800EF9114 /* IDBDatabaseBackendImpl.h */,
-				B61762531203374F00EF9114 /* IDBDatabaseBackendInterface.h */,
-				C585A69D11D4FB3D004C3E4B /* IDBDatabaseError.h */,
-				C585A69E11D4FB3D004C3E4B /* IDBDatabaseError.idl */,
-				978D07B1145A0EBD0096908D /* IDBDatabaseException.cpp */,
-				C585A69F11D4FB3D004C3E4B /* IDBDatabaseException.h */,
-				C585A6A011D4FB3D004C3E4B /* IDBDatabaseException.idl */,
-				C585A6C911D4FB3D004C3E4B /* IDBFactory.cpp */,
-				C585A6CA11D4FB3D004C3E4B /* IDBFactory.h */,
-				C585A6CB11D4FB3D004C3E4B /* IDBFactory.idl */,
-				C585A6C711D4FB3D004C3E4B /* IDBFactoryBackendImpl.cpp */,
-				C585A6C811D4FB3D004C3E4B /* IDBFactoryBackendImpl.h */,
-				C585A6C511D4FB3D004C3E4B /* IDBFactoryBackendInterface.cpp */,
-				C585A6C611D4FB3D004C3E4B /* IDBFactoryBackendInterface.h */,
-				C572EE041201C736007D8F82 /* IDBIndex.cpp */,
-				C572EE051201C736007D8F82 /* IDBIndex.h */,
-				C572EE061201C736007D8F82 /* IDBIndex.idl */,
-				C572EE071201C736007D8F82 /* IDBIndexBackendImpl.cpp */,
-				C572EE081201C736007D8F82 /* IDBIndexBackendImpl.h */,
-				C572EE091201C736007D8F82 /* IDBIndexBackendInterface.h */,
-				C585A6B211D4FB3D004C3E4B /* IDBKey.cpp */,
-				C585A6B311D4FB3D004C3E4B /* IDBKey.h */,
-				C585A6B411D4FB3D004C3E4B /* IDBKey.idl */,
-				C585A6B511D4FB3D004C3E4B /* IDBKeyRange.cpp */,
-				C585A6B611D4FB3D004C3E4B /* IDBKeyRange.h */,
-				C585A6B711D4FB3D004C3E4B /* IDBKeyRange.idl */,
-				C585A6BC11D4FB3D004C3E4B /* IDBObjectStore.cpp */,
-				C585A6B911D4FB3D004C3E4B /* IDBObjectStore.h */,
-				C585A6BE11D4FB3D004C3E4B /* IDBObjectStore.idl */,
-				C585A6BA11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp */,
-				C585A6BB11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h */,
-				C585A6BD11D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h */,
-				C585A6BF11D4FB3D004C3E4B /* IDBRequest.cpp */,
-				C585A6C011D4FB3D004C3E4B /* IDBRequest.h */,
-				C585A6C111D4FB3D004C3E4B /* IDBRequest.idl */,
-				EB49DB8E14F46E8B002299D9 /* IDBTracing.h */,
-				B6566267120B115A006EA85C /* IDBTransaction.cpp */,
-				B6566268120B115A006EA85C /* IDBTransaction.h */,
-				B6566269120B115A006EA85C /* IDBTransaction.idl */,
-				B656626D120B116B006EA85C /* IDBTransactionBackendInterface.h */,
-				511F23130DC160DA004F0032 /* StorageTask.cpp */,
-				511F23140DC160DA004F0032 /* StorageTask.h */,
-				511F23150DC160DA004F0032 /* StorageThread.cpp */,
-				511F23160DC160DA004F0032 /* StorageThread.h */,
-				51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */,
-				51A926790D53F0570063ECC2 /* OriginQuotaManager.h */,
-				51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */,
-				51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */,
-				245D80A213280E40003492A6 /* SQLCallbackWrapper.h */,
-				51EC92570CE90DB400F90308 /* SQLError.h */,
-				51EC92580CE90DB400F90308 /* SQLError.idl */,
-				978D07B3145A0ECD0096908D /* SQLException.cpp */,
-				B56EBA8311C9FF8100B04477 /* SQLException.h */,
-				B56EBA8411C9FF8100B04477 /* SQLException.idl */,
-				519611670CAC56570010A80C /* SQLResultSet.cpp */,
-				519611680CAC56570010A80C /* SQLResultSet.h */,
-				519611690CAC56570010A80C /* SQLResultSet.idl */,
-				1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */,
-				1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */,
-				1AFE118C0CBFFC4E003017FA /* SQLResultSetRowList.idl */,
-				515B03980CD1642A00B7EA9C /* SQLStatement.cpp */,
-				515B03970CD1642A00B7EA9C /* SQLStatement.h */,
-				1A7CCB150CD9469A00B7B64E /* SQLStatementCallback.h */,
-				B59DD68E1190298E007E9684 /* SQLStatementCallback.idl */,
-				1A7CCB160CD9469A00B7B64E /* SQLStatementErrorCallback.h */,
-				B59DD68F1190298E007E9684 /* SQLStatementErrorCallback.idl */,
-				B550B52111DC68A800923885 /* SQLStatementSync.cpp */,
-				B550B52211DC68A800923885 /* SQLStatementSync.h */,
-				1ABFE7520CD968D000FE4834 /* SQLTransaction.cpp */,
-				1A7CCB220CD946FD00B7B64E /* SQLTransaction.h */,
-				1A7CCB230CD946FD00B7B64E /* SQLTransaction.idl */,
-				1A7CCB170CD9469A00B7B64E /* SQLTransactionCallback.h */,
-				B59DD6901190298E007E9684 /* SQLTransactionCallback.idl */,
-				B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */,
-				B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */,
-				B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */,
-				B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */,
-				1A7CCB180CD9469A00B7B64E /* SQLTransactionErrorCallback.h */,
-				B59DD6911190298E007E9684 /* SQLTransactionErrorCallback.idl */,
-				B523CF021182675400EBB29C /* SQLTransactionSync.cpp */,
-				B523CF011182675400EBB29C /* SQLTransactionSync.h */,
-				B55D5ABC1191327200BCC315 /* SQLTransactionSync.idl */,
-				B523CEFF1182675400EBB29C /* SQLTransactionSyncCallback.h */,
-				B55D5ABD1191327200BCC315 /* SQLTransactionSyncCallback.idl */,
 				51E3F9C50DA059DC00250911 /* Storage.cpp */,
 				51E3F9C40DA059DC00250911 /* Storage.h */,
 				51E3F9D10DA05D7100250911 /* Storage.idl */,
@@ -14034,6 +14021,10 @@
 				C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */,
 				C5102D930FD9AA2D00FAFF04 /* StorageSyncManager.cpp */,
 				C5102D920FD9AA2D00FAFF04 /* StorageSyncManager.h */,
+				511F23130DC160DA004F0032 /* StorageTask.cpp */,
+				511F23140DC160DA004F0032 /* StorageTask.h */,
+				511F23150DC160DA004F0032 /* StorageThread.cpp */,
+				511F23160DC160DA004F0032 /* StorageThread.h */,
 				3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */,
 				3AB02D2812D4F91600FBB694 /* StorageTracker.h */,
 				3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */,
@@ -14400,10 +14391,10 @@
 				3390CA510FFC157B00921962 /* NotificationCenter.cpp */,
 				3390CA520FFC157B00921962 /* NotificationCenter.h */,
 				3390CA530FFC157B00921962 /* NotificationCenter.idl */,
+				33503C9910179A74003B47E1 /* NotificationClient.h */,
 				3390CA540FFC157B00921962 /* NotificationContents.h */,
 				3128CA67147331520074C72A /* NotificationController.cpp */,
 				3128CA6A147331630074C72A /* NotificationController.h */,
-				33503C9910179A74003B47E1 /* NotificationPresenter.h */,
 			);
 			name = notifications;
 			sourceTree = "<group>";
@@ -14457,8 +14448,6 @@
 				A78E526E1346BD1700AD9C31 /* MeterShadowElement.h */,
 				A715E650134BBBEC00D8E713 /* ProgressShadowElement.cpp */,
 				A715E651134BBBEC00D8E713 /* ProgressShadowElement.h */,
-				572E92F914E540580087FFBA /* ShadowRootList.cpp */,
-				572E92FA14E540580087FFBA /* ShadowRootList.h */,
 				4150F9F012B6E0E70008C860 /* SliderThumbElement.cpp */,
 				4150F9EF12B6E0E70008C860 /* SliderThumbElement.h */,
 				142B97C713138943008BEF4B /* TextControlInnerElements.cpp */,
@@ -14541,7 +14530,6 @@
 		49484FAE102CF01E00187DD3 /* canvas */ = {
 			isa = PBXGroup;
 			children = (
-				A83B535B14F7413A00720D9D /* DOMWindowWebGL.idl */,
 				49EECDCC10503C2300099FAB /* ArrayBuffer.idl */,
 				49EECDC910503C2300099FAB /* ArrayBufferView.idl */,
 				6E4E91A710F7FB3100A2779C /* CanvasContextAttributes.cpp */,
@@ -14567,6 +14555,9 @@
 				2E97CCE712939CB800C5C8FF /* DataView.cpp */,
 				2E97CCE812939CB800C5C8FF /* DataView.h */,
 				2E97CCE912939CB800C5C8FF /* DataView.idl */,
+				7728694B14F8882500F484DC /* EXTTextureFilterAnisotropic.cpp */,
+				7728694C14F8882500F484DC /* EXTTextureFilterAnisotropic.h */,
+				7728694D14F8882500F484DC /* EXTTextureFilterAnisotropic.idl */,
 				49EECDCF10503C2300099FAB /* Float32Array.idl */,
 				6EBC5D80138B4C4E00A0CF8A /* Float64Array.idl */,
 				49EECDD510503C2300099FAB /* Int16Array.idl */,
@@ -14852,39 +14843,6 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
-		518A34BD1026C831001B6896 /* websockets */ = {
-			isa = PBXGroup;
-			children = (
-				51FB54F4113E364200821176 /* CloseEvent.h */,
-				51FB54F6113E365900821176 /* CloseEvent.idl */,
-				5112247110CFB8C6008099D7 /* ThreadableWebSocketChannel.cpp */,
-				5112247310CFB8D8008099D7 /* ThreadableWebSocketChannel.h */,
-				510F078111FEBE7500B8EE49 /* ThreadableWebSocketChannelClientWrapper.cpp */,
-				5112247510CFB8E8008099D7 /* ThreadableWebSocketChannelClientWrapper.h */,
-				518A34BE1026C831001B6896 /* WebSocket.cpp */,
-				518A34BF1026C831001B6896 /* WebSocket.h */,
-				518A34C01026C831001B6896 /* WebSocket.idl */,
-				510D4A47103177A20049EA54 /* WebSocketChannel.cpp */,
-				510D4A48103177A20049EA54 /* WebSocketChannel.h */,
-				510D4A49103177A20049EA54 /* WebSocketChannelClient.h */,
-				4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */,
-				4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */,
-				4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */,
-				4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */,
-				4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */,
-				4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */,
-				51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */,
-				51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */,
-				7637C540112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp */,
-				7637C542112E7B7E003D6CDC /* WebSocketHandshakeRequest.h */,
-				767F99BD11A1194A0080C51D /* WebSocketHandshakeResponse.cpp */,
-				767F99BF11A119560080C51D /* WebSocketHandshakeResponse.h */,
-				5112247710CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp */,
-				5112247910CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h */,
-			);
-			path = websockets;
-			sourceTree = "<group>";
-		};
 		599D1E2F10C97D4C00E0EF12 /* jsc */ = {
 			isa = PBXGroup;
 			children = (
@@ -14955,6 +14913,7 @@
 				A9C6E4ED0D745E38006442E9 /* DOMPluginArray.cpp */,
 				A9C6E4EE0D745E38006442E9 /* DOMPluginArray.h */,
 				A9C6E6610D74671E006442E9 /* DOMPluginArray.idl */,
+				E129CBD21501702200A7C5FB /* npapi-sandbox.h */,
 				1A927FCF1416A15B003A83C8 /* npapi.h */,
 				1A219B3A0DCA87AB0040E3A0 /* npfunctions.h */,
 				1A927FD01416A15B003A83C8 /* npruntime.h */,
@@ -15119,6 +15078,8 @@
 		6582A14809999D6C00BEEB6D /* mac */ = {
 			isa = PBXGroup;
 			children = (
+				CD127DEA14F3097900E84779 /* WebCoreFullScreenWindow.h */,
+				CD127DEB14F3097900E84779 /* WebCoreFullScreenWindow.mm */,
 				51E1ECAD0C91C54600DC255B /* AutodrainedPool.mm */,
 				65A640F00533BB1F0085E777 /* BlockExceptions.h */,
 				65F80697054D9F86008BF776 /* BlockExceptions.mm */,
@@ -15144,13 +15105,12 @@
 				9352084409BD43B900F2038D /* Language.mm */,
 				06E81ED60AB5D5E900C87837 /* LocalCurrentGraphicsContext.h */,
 				06E81EEB0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm */,
-				BC25B528131C6D3900180E10 /* LocalizedStringsMac.mm */,
+				BC25B528131C6D3900180E10 /* LocalizedStringsMac.cpp */,
 				1402645D0AFDC19B005919E2 /* LoggingMac.mm */,
 				657EDA0A1385CBD8004E0645 /* MemoryPressureHandlerMac.mm */,
 				BC772C5D0C4EB3440083285F /* MIMETypeRegistryMac.mm */,
 				93500F3113FDE3BE0099EC24 /* NSScrollerImpDetails.h */,
 				52F52E1014A0134F00ACC397 /* NSScrollerImpDetails.mm */,
-				A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */,
 				4B2709810AF2E5E00065127F /* PasteboardMac.mm */,
 				CDEA762E146084DE008B31F1 /* PlatformClockCA.cpp */,
 				CDEA762F146084EE008B31F1 /* PlatformClockCA.h */,
@@ -15186,6 +15146,8 @@
 				51DF6D7F0B92A18E00C2DC85 /* ThreadCheck.mm */,
 				934D9BA60B8C1175007B42A9 /* WebCoreNSStringExtras.h */,
 				934D9BA40B8C116B007B42A9 /* WebCoreNSStringExtras.mm */,
+				C5B4C24B1509236C00A6EF37 /* WebCoreNSURLExtras.h */,
+				C5B4C24C1509236C00A6EF37 /* WebCoreNSURLExtras.mm */,
 				DD05FE0B0B8BA3C6009ACDFE /* WebCoreObjCExtras.h */,
 				B50F5B800E96CD9900AD71A6 /* WebCoreObjCExtras.mm */,
 				93EB169609F880C00091F8FF /* WebCoreSystemInterface.h */,
@@ -15294,8 +15256,6 @@
 				9730BE1414EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.cpp */,
 				9730BE1514EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.h */,
 				9730BE1614EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.idl */,
-				97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */,
-				97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */,
 				00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */,
 				00146289103CD1DE000B20DB /* OriginAccessEntry.h */,
 				65FEA86809833ADE00BED4AB /* Page.cpp */,
@@ -15306,8 +15266,6 @@
 				7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */,
 				371E65CD13661EED00BEEDB0 /* PageSerializer.cpp */,
 				371E65CB13661EDC00BEEDB0 /* PageSerializer.h */,
-				A71E083514E3CEAF006A4619 /* PageSupplement.cpp */,
-				A71E083614E3CEAF006A4619 /* PageSupplement.h */,
 				FFD5B977135CC97800D5E92A /* PageVisibilityState.cpp */,
 				FFD5B978135CC97800D5E92A /* PageVisibilityState.h */,
 				8A844D0111D3C18E0014065C /* Performance.cpp */,
@@ -16721,6 +16679,8 @@
 				379E61C6126CA5C300B63E8D /* BaseButtonInputType.h */,
 				379E61C7126CA5C300B63E8D /* BaseCheckableInputType.cpp */,
 				379E61C8126CA5C300B63E8D /* BaseCheckableInputType.h */,
+				C33EE5C214FB49610002095A /* BaseClickableWithKeyInputType.cpp */,
+				C33EE5C314FB49610002095A /* BaseClickableWithKeyInputType.h */,
 				F59C95FD1255B23F000623C0 /* BaseDateAndTimeInputType.cpp */,
 				F59C95FE1255B23F000623C0 /* BaseDateAndTimeInputType.h */,
 				F55B3D791251F12D003EF269 /* BaseTextInputType.cpp */,
@@ -16752,7 +16712,6 @@
 				2E37DFD712DBAFB800A6B233 /* DOMURL.cpp */,
 				2E37DFD812DBAFB800A6B233 /* DOMURL.h */,
 				2E37DFD912DBAFB800A6B233 /* DOMURL.idl */,
-				A8A5205D14F6BD3C00FBA19E /* DOMWindowHTML.idl */,
 				F55B3D871251F12D003EF269 /* EmailInputType.cpp */,
 				F55B3D881251F12D003EF269 /* EmailInputType.h */,
 				F55B3D891251F12D003EF269 /* FileInputType.cpp */,
@@ -17023,6 +16982,8 @@
 				F55B3D8E1251F12D003EF269 /* ImageInputType.h */,
 				37E3524A12450C5200BAF5D9 /* InputType.cpp */,
 				37E3524C12450C6600BAF5D9 /* InputType.h */,
+				450CEBEE15073BBE002BB149 /* LabelableElement.cpp */,
+				450CEBEF15073BBE002BB149 /* LabelableElement.h */,
 				A456FA2411AD4A830020B420 /* LabelsNodeList.cpp */,
 				A456FA2511AD4A830020B420 /* LabelsNodeList.h */,
 				985BB96B13A94058007A0B69 /* LinkRelAttribute.cpp */,
@@ -17096,6 +17057,9 @@
 			isa = PBXGroup;
 			children = (
 				971145FF14EF007900674FD9 /* geolocation */,
+				9712A55315004E3C0048AF10 /* indexeddb */,
+				97BC69D51505F054001B74AC /* webdatabase */,
+				97AABCF714FA09B5007457AE /* websockets */,
 			);
 			name = Modules;
 			sourceTree = "<group>";
@@ -17126,9 +17090,110 @@
 			name = geolocation;
 			sourceTree = "<group>";
 		};
+		9712A55315004E3C0048AF10 /* indexeddb */ = {
+			isa = PBXGroup;
+			children = (
+				9712A55415004EDA0048AF10 /* DOMWindowIndexedDatabase.cpp */,
+				9712A55515004EDA0048AF10 /* DOMWindowIndexedDatabase.h */,
+				9712A55615004EDA0048AF10 /* DOMWindowIndexedDatabase.idl */,
+				9712A55715004EDA0048AF10 /* IDBAny.cpp */,
+				9712A55815004EDA0048AF10 /* IDBAny.h */,
+				9712A55915004EDA0048AF10 /* IDBAny.idl */,
+				9712A55A15004EDA0048AF10 /* IDBBackingStore.h */,
+				9712A55B15004EDA0048AF10 /* IDBCallbacks.h */,
+				9712A55C15004EDA0048AF10 /* IDBCursor.cpp */,
+				9712A55D15004EDA0048AF10 /* IDBCursor.h */,
+				9712A55E15004EDA0048AF10 /* IDBCursor.idl */,
+				9712A55F15004EDA0048AF10 /* IDBCursorBackendImpl.cpp */,
+				9712A56015004EDA0048AF10 /* IDBCursorBackendImpl.h */,
+				9712A56115004EDA0048AF10 /* IDBCursorBackendInterface.h */,
+				9712A56215004EDA0048AF10 /* IDBCursorWithValue.cpp */,
+				9712A56315004EDA0048AF10 /* IDBCursorWithValue.h */,
+				9712A56415004EDA0048AF10 /* IDBCursorWithValue.idl */,
+				9712A56515004EDA0048AF10 /* IDBDatabase.cpp */,
+				9712A56615004EDA0048AF10 /* IDBDatabase.h */,
+				9712A56715004EDA0048AF10 /* IDBDatabase.idl */,
+				9712A56815004EDA0048AF10 /* IDBDatabaseBackendImpl.cpp */,
+				9712A56915004EDA0048AF10 /* IDBDatabaseBackendImpl.h */,
+				9712A56A15004EDA0048AF10 /* IDBDatabaseBackendInterface.h */,
+				9712A56B15004EDA0048AF10 /* IDBDatabaseCallbacks.h */,
+				9712A56C15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.cpp */,
+				9712A56D15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.h */,
+				9712A56E15004EDA0048AF10 /* IDBDatabaseError.h */,
+				9712A56F15004EDA0048AF10 /* IDBDatabaseError.idl */,
+				9712A57015004EDA0048AF10 /* IDBDatabaseException.cpp */,
+				9712A57115004EDA0048AF10 /* IDBDatabaseException.h */,
+				9712A57215004EDA0048AF10 /* IDBDatabaseException.idl */,
+				9712A57315004EDA0048AF10 /* IDBEventDispatcher.cpp */,
+				9712A57415004EDA0048AF10 /* IDBEventDispatcher.h */,
+				9712A57515004EDA0048AF10 /* IDBFactory.cpp */,
+				9712A57615004EDA0048AF10 /* IDBFactory.h */,
+				9712A57715004EDA0048AF10 /* IDBFactory.idl */,
+				9712A57815004EDA0048AF10 /* IDBFactoryBackendImpl.cpp */,
+				9712A57915004EDA0048AF10 /* IDBFactoryBackendImpl.h */,
+				9712A57A15004EDA0048AF10 /* IDBFactoryBackendInterface.cpp */,
+				9712A57B15004EDA0048AF10 /* IDBFactoryBackendInterface.h */,
+				9712A57C15004EDA0048AF10 /* IDBIndex.cpp */,
+				9712A57D15004EDA0048AF10 /* IDBIndex.h */,
+				9712A57E15004EDA0048AF10 /* IDBIndex.idl */,
+				9712A57F15004EDA0048AF10 /* IDBIndexBackendImpl.cpp */,
+				9712A58015004EDA0048AF10 /* IDBIndexBackendImpl.h */,
+				9712A58115004EDA0048AF10 /* IDBIndexBackendInterface.h */,
+				9712A58215004EDA0048AF10 /* IDBKey.cpp */,
+				9712A58315004EDA0048AF10 /* IDBKey.h */,
+				9712A58415004EDA0048AF10 /* IDBKey.idl */,
+				9712A58515004EDA0048AF10 /* IDBKeyPath.cpp */,
+				9712A58615004EDA0048AF10 /* IDBKeyPath.h */,
+				9712A58715004EDA0048AF10 /* IDBKeyPathBackendImpl.cpp */,
+				9712A58815004EDA0048AF10 /* IDBKeyPathBackendImpl.h */,
+				9712A58915004EDA0048AF10 /* IDBKeyRange.cpp */,
+				9712A58A15004EDA0048AF10 /* IDBKeyRange.h */,
+				9712A58B15004EDA0048AF10 /* IDBKeyRange.idl */,
+				9712A58C15004EDA0048AF10 /* IDBLevelDBBackingStore.cpp */,
+				9712A58D15004EDA0048AF10 /* IDBLevelDBBackingStore.h */,
+				9712A58E15004EDA0048AF10 /* IDBLevelDBCoding.cpp */,
+				9712A58F15004EDA0048AF10 /* IDBLevelDBCoding.h */,
+				9712A59015004EDA0048AF10 /* IDBObjectStore.cpp */,
+				9712A59115004EDA0048AF10 /* IDBObjectStore.h */,
+				9712A59215004EDA0048AF10 /* IDBObjectStore.idl */,
+				9712A59315004EDA0048AF10 /* IDBObjectStoreBackendImpl.cpp */,
+				9712A59415004EDA0048AF10 /* IDBObjectStoreBackendImpl.h */,
+				9712A59515004EDA0048AF10 /* IDBObjectStoreBackendInterface.h */,
+				9712A59615004EDA0048AF10 /* IDBPendingTransactionMonitor.cpp */,
+				9712A59715004EDA0048AF10 /* IDBPendingTransactionMonitor.h */,
+				9712A59815004EDA0048AF10 /* IDBRequest.cpp */,
+				9712A59915004EDA0048AF10 /* IDBRequest.h */,
+				9712A59A15004EDA0048AF10 /* IDBRequest.idl */,
+				9712A59B15004EDA0048AF10 /* IDBTracing.h */,
+				9712A59C15004EDA0048AF10 /* IDBTransaction.cpp */,
+				9712A59D15004EDA0048AF10 /* IDBTransaction.h */,
+				9712A59E15004EDA0048AF10 /* IDBTransaction.idl */,
+				9712A59F15004EDA0048AF10 /* IDBTransactionBackendImpl.cpp */,
+				9712A5A015004EDA0048AF10 /* IDBTransactionBackendImpl.h */,
+				9712A5A115004EDA0048AF10 /* IDBTransactionBackendInterface.h */,
+				9712A5A215004EDA0048AF10 /* IDBTransactionCallbacks.h */,
+				9712A5A315004EDA0048AF10 /* IDBTransactionCoordinator.cpp */,
+				9712A5A415004EDA0048AF10 /* IDBTransactionCoordinator.h */,
+				9712A5A515004EDA0048AF10 /* IDBVersionChangeEvent.cpp */,
+				9712A5A615004EDA0048AF10 /* IDBVersionChangeEvent.h */,
+				9712A5A715004EDA0048AF10 /* IDBVersionChangeEvent.idl */,
+				9712A5A815004EDA0048AF10 /* IDBVersionChangeRequest.cpp */,
+				9712A5A915004EDA0048AF10 /* IDBVersionChangeRequest.h */,
+				9712A5AA15004EDA0048AF10 /* IDBVersionChangeRequest.idl */,
+				9712A5AB15004EDA0048AF10 /* PageGroupIndexedDatabase.cpp */,
+				9712A5AC15004EDA0048AF10 /* PageGroupIndexedDatabase.h */,
+				9712A60E150090CE0048AF10 /* WorkerContextIndexedDatabase.cpp */,
+				9712A60F150090CE0048AF10 /* WorkerContextIndexedDatabase.h */,
+				9712A610150090CE0048AF10 /* WorkerContextIndexedDatabase.idl */,
+			);
+			name = indexeddb;
+			sourceTree = "<group>";
+		};
 		976D6C57122B8A18001FD1F7 /* fileapi */ = {
 			isa = PBXGroup;
 			children = (
+				E1CDE91F15018ED000862CC5 /* AsyncFileStream.cpp */,
+				E1CDE9211501916900862CC5 /* AsyncFileStream.h */,
 				976D6C58122B8A3D001FD1F7 /* AsyncFileWriter.h */,
 				976D6C74122B8A3D001FD1F7 /* AsyncFileWriterClient.h */,
 				976D6C59122B8A3D001FD1F7 /* Blob.cpp */,
@@ -17208,8 +17273,6 @@
 				2EDF369A122C94B4002F7D4E /* FileReaderSync.cpp */,
 				2EDF369B122C94B4002F7D4E /* FileReaderSync.h */,
 				E1AB1EBD14E9E3A800449E13 /* FileReaderSync.idl */,
-				976D6C6C122B8A3D001FD1F7 /* FileStreamProxy.cpp */,
-				976D6C6D122B8A3D001FD1F7 /* FileStreamProxy.h */,
 				8987854A122CA064003AABDA /* FileSystemCallback.h */,
 				E1AB1EBE14E9E3B200449E13 /* FileSystemCallback.idl */,
 				8987854B122CA064003AABDA /* FileSystemCallbacks.cpp */,
@@ -17247,6 +17310,119 @@
 			name = fileapi;
 			sourceTree = "<group>";
 		};
+		97AABCF714FA09B5007457AE /* websockets */ = {
+			isa = PBXGroup;
+			children = (
+				97AABCF814FA09D5007457AE /* CloseEvent.h */,
+				97AABCF914FA09D5007457AE /* CloseEvent.idl */,
+				97AABCFA14FA09D5007457AE /* DOMWindowWebSocket.idl */,
+				97AABCFB14FA09D5007457AE /* ThreadableWebSocketChannel.cpp */,
+				97AABCFC14FA09D5007457AE /* ThreadableWebSocketChannel.h */,
+				97AABCFD14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.cpp */,
+				97AABCFE14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.h */,
+				97AABCFF14FA09D5007457AE /* WebSocket.cpp */,
+				97AABD0014FA09D5007457AE /* WebSocket.h */,
+				97AABD0114FA09D5007457AE /* WebSocket.idl */,
+				97AABD0214FA09D5007457AE /* WebSocketChannel.cpp */,
+				97AABD0314FA09D5007457AE /* WebSocketChannel.h */,
+				97AABD0414FA09D5007457AE /* WebSocketChannelClient.h */,
+				4A38BF4E14FE1C0900612512 /* WebSocketDeflateFramer.cpp */,
+				4A38BF4F14FE1C0900612512 /* WebSocketDeflateFramer.h */,
+				97AABD0514FA09D5007457AE /* WebSocketDeflater.cpp */,
+				97AABD0614FA09D5007457AE /* WebSocketDeflater.h */,
+				97AABD0714FA09D5007457AE /* WebSocketExtensionDispatcher.cpp */,
+				97AABD0814FA09D5007457AE /* WebSocketExtensionDispatcher.h */,
+				97AABD0914FA09D5007457AE /* WebSocketExtensionProcessor.h */,
+				97AABD0A14FA09D5007457AE /* WebSocketFrame.h */,
+				97AABD0B14FA09D5007457AE /* WebSocketHandshake.cpp */,
+				97AABD0C14FA09D5007457AE /* WebSocketHandshake.h */,
+				97AABD0D14FA09D5007457AE /* WebSocketHandshakeRequest.cpp */,
+				97AABD0E14FA09D5007457AE /* WebSocketHandshakeRequest.h */,
+				97AABD0F14FA09D5007457AE /* WebSocketHandshakeResponse.cpp */,
+				97AABD1014FA09D5007457AE /* WebSocketHandshakeResponse.h */,
+				97AABD1114FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp */,
+				97AABD1214FA09D5007457AE /* WorkerThreadableWebSocketChannel.h */,
+			);
+			name = websockets;
+			sourceTree = "<group>";
+		};
+		97BC69D51505F054001B74AC /* webdatabase */ = {
+			isa = PBXGroup;
+			children = (
+				97BC69D61505F076001B74AC /* AbstractDatabase.cpp */,
+				97BC69D71505F076001B74AC /* AbstractDatabase.h */,
+				97BC69D81505F076001B74AC /* ChangeVersionWrapper.cpp */,
+				97BC69D91505F076001B74AC /* ChangeVersionWrapper.h */,
+				97BC69DE1505F081001B74AC /* Database.cpp */,
+				97BC69DF1505F081001B74AC /* Database.h */,
+				97BC69E01505F081001B74AC /* Database.idl */,
+				97BC69E11505F081001B74AC /* DatabaseAuthorizer.cpp */,
+				97BC69E21505F081001B74AC /* DatabaseAuthorizer.h */,
+				97BC69E31505F081001B74AC /* DatabaseCallback.h */,
+				97BC69E41505F081001B74AC /* DatabaseCallback.idl */,
+				97BC69E51505F081001B74AC /* DatabaseContext.cpp */,
+				97BC69E61505F081001B74AC /* DatabaseContext.h */,
+				97BC69E71505F081001B74AC /* DatabaseDetails.h */,
+				97BC69E81505F081001B74AC /* DatabaseSync.cpp */,
+				97BC69E91505F081001B74AC /* DatabaseSync.h */,
+				97BC69EA1505F081001B74AC /* DatabaseSync.idl */,
+				97BC69EB1505F081001B74AC /* DatabaseTask.cpp */,
+				97BC69EC1505F081001B74AC /* DatabaseTask.h */,
+				97BC69ED1505F081001B74AC /* DatabaseThread.cpp */,
+				97BC69EE1505F081001B74AC /* DatabaseThread.h */,
+				97BC69EF1505F081001B74AC /* DatabaseTracker.cpp */,
+				97BC69F01505F081001B74AC /* DatabaseTracker.h */,
+				97BC69F11505F081001B74AC /* DatabaseTrackerClient.h */,
+				97BC69F21505F081001B74AC /* DOMWindowSQLDatabase.cpp */,
+				97BC69F31505F081001B74AC /* DOMWindowSQLDatabase.h */,
+				97BC69F41505F081001B74AC /* DOMWindowSQLDatabase.idl */,
+				97BC69F51505F081001B74AC /* OriginQuotaManager.cpp */,
+				97BC69F61505F081001B74AC /* OriginQuotaManager.h */,
+				97BC69F71505F081001B74AC /* OriginUsageRecord.cpp */,
+				97BC69F81505F081001B74AC /* OriginUsageRecord.h */,
+				97BC69F91505F081001B74AC /* SQLCallbackWrapper.h */,
+				97BC69FA1505F081001B74AC /* SQLError.h */,
+				97BC69FB1505F081001B74AC /* SQLError.idl */,
+				97BC69FC1505F081001B74AC /* SQLException.cpp */,
+				97BC69FD1505F081001B74AC /* SQLException.h */,
+				97BC69FE1505F081001B74AC /* SQLException.idl */,
+				97BC69FF1505F081001B74AC /* SQLResultSet.cpp */,
+				97BC6A001505F081001B74AC /* SQLResultSet.h */,
+				97BC6A011505F081001B74AC /* SQLResultSet.idl */,
+				97BC6A021505F081001B74AC /* SQLResultSetRowList.cpp */,
+				97BC6A031505F081001B74AC /* SQLResultSetRowList.h */,
+				97BC6A041505F081001B74AC /* SQLResultSetRowList.idl */,
+				97BC6A051505F081001B74AC /* SQLStatement.cpp */,
+				97BC6A061505F081001B74AC /* SQLStatement.h */,
+				97BC6A071505F081001B74AC /* SQLStatementCallback.h */,
+				97BC6A081505F081001B74AC /* SQLStatementCallback.idl */,
+				97BC6A091505F081001B74AC /* SQLStatementErrorCallback.h */,
+				97BC6A0A1505F081001B74AC /* SQLStatementErrorCallback.idl */,
+				97BC6A0B1505F081001B74AC /* SQLStatementSync.cpp */,
+				97BC6A0C1505F081001B74AC /* SQLStatementSync.h */,
+				97BC6A0D1505F081001B74AC /* SQLTransaction.cpp */,
+				97BC6A0E1505F081001B74AC /* SQLTransaction.h */,
+				97BC6A0F1505F081001B74AC /* SQLTransaction.idl */,
+				97BC6A101505F081001B74AC /* SQLTransactionCallback.h */,
+				97BC6A111505F081001B74AC /* SQLTransactionCallback.idl */,
+				97BC6A121505F081001B74AC /* SQLTransactionClient.cpp */,
+				97BC6A131505F081001B74AC /* SQLTransactionClient.h */,
+				97BC6A141505F081001B74AC /* SQLTransactionCoordinator.cpp */,
+				97BC6A151505F081001B74AC /* SQLTransactionCoordinator.h */,
+				97BC6A161505F081001B74AC /* SQLTransactionErrorCallback.h */,
+				97BC6A171505F081001B74AC /* SQLTransactionErrorCallback.idl */,
+				97BC6A181505F081001B74AC /* SQLTransactionSync.cpp */,
+				97BC6A191505F081001B74AC /* SQLTransactionSync.h */,
+				97BC6A1A1505F081001B74AC /* SQLTransactionSync.idl */,
+				97BC6A1B1505F081001B74AC /* SQLTransactionSyncCallback.h */,
+				97BC6A1C1505F081001B74AC /* SQLTransactionSyncCallback.idl */,
+				97BC6A1D1505F081001B74AC /* WorkerContextSQLDatabase.cpp */,
+				97BC6A1E1505F081001B74AC /* WorkerContextSQLDatabase.h */,
+				97BC6A1F1505F081001B74AC /* WorkerContextSQLDatabase.idl */,
+			);
+			name = webdatabase;
+			sourceTree = "<group>";
+		};
 		97C1F5511228558800EDE616 /* parser */ = {
 			isa = PBXGroup;
 			children = (
@@ -17419,6 +17595,8 @@
 				7694563B1214D97C0007CBAE /* JSDOMTokenList.h */,
 				2E37E00312DBC5A400A6B233 /* JSDOMURL.cpp */,
 				2E37E00412DBC5A400A6B233 /* JSDOMURL.h */,
+				7728698114FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.cpp */,
+				7728698214FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.h */,
 				49EECEF4105070C400099FAB /* JSFloat32Array.cpp */,
 				49EECEF5105070C400099FAB /* JSFloat32Array.h */,
 				6EBC5EAD138B50F200A0CF8A /* JSFloat64Array.cpp */,
@@ -18249,8 +18427,6 @@
 		A8D2B2521287A56000AF4DDA /* cache */ = {
 			isa = PBXGroup;
 			children = (
-				A104F24114C71F7A009E2C23 /* CachedSVGDocument.cpp */,
-				A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */,
 				BCB16C000979C3BD00467741 /* CachedCSSStyleSheet.cpp */,
 				BCB16C010979C3BD00467741 /* CachedCSSStyleSheet.h */,
 				BC64B4C90CB4295D005F2B62 /* CachedFont.cpp */,
@@ -18272,6 +18448,8 @@
 				5038BE3E1472AD980095E0D1 /* CachedShader.cpp */,
 				5038BE3F1472AD980095E0D1 /* CachedShader.h */,
 				D0BC54481443AC4A00E105DA /* CachedStyleSheetClient.h */,
+				A104F24114C71F7A009E2C23 /* CachedSVGDocument.cpp */,
+				A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */,
 				0753860014489E9800B78452 /* CachedTextTrack.cpp */,
 				0753860114489E9800B78452 /* CachedTextTrack.h */,
 				BCB16C0E0979C3BD00467741 /* CachedXSLStyleSheet.cpp */,
@@ -18337,7 +18515,6 @@
 				081CDFBD126ECFE800D215CA /* properties */,
 				B22277CB0D00BF1F0071B782 /* ColorDistance.cpp */,
 				B22277CC0D00BF1F0071B782 /* ColorDistance.h */,
-				A89AACD514F6C12700C1FA4A /* DOMWindowSVG.idl */,
 				E415F1830D9A1A830033CE97 /* ElementTimeControl.h */,
 				E415F10C0D9A05870033CE97 /* ElementTimeControl.idl */,
 				B22277CD0D00BF1F0071B782 /* GradientAttributes.h */,
@@ -19246,8 +19423,8 @@
 				A83B533814F399BB00720D9D /* IDLAttributes.txt */,
 				14813BF309EDF88E00F757E1 /* IDLParser.pm */,
 				93F8B3080A300FEA00F61AB8 /* IDLStructure.pm */,
+				A83B538014FBB2EC00720D9D /* preprocess-idls.pl */,
 				C0F2A43F13869A280066C534 /* preprocessor.pm */,
-				A8F4578F14B2B004000CEA59 /* resolve-supplemental.pl */,
 				8C6EA61711EF7E0400FD8EE3 /* RuntimeEnabledFeatures.cpp */,
 				8C6EA61811EF7E0400FD8EE3 /* RuntimeEnabledFeatures.h */,
 				97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */,
@@ -19590,6 +19767,8 @@
 				BCEF44490E6745E0001C1287 /* StyleGeneratedImage.h */,
 				A10DC76814747BAB005E2471 /* StyleGridData.cpp */,
 				A10DC76914747BAB005E2471 /* StyleGridData.h */,
+				A110DB9C14F5DF8700A03B93 /* StyleGridItemData.cpp */,
+				A110DB9A14F5DF7700A03B93 /* StyleGridItemData.h */,
 				BCEF43CE0E673DA1001C1287 /* StyleImage.h */,
 				BC2273010E82F1E600E7F975 /* StyleInheritedData.cpp */,
 				BC2273020E82F1E600E7F975 /* StyleInheritedData.h */,
@@ -19827,7 +20006,6 @@
 				B2C3D9EC0D006C1D00EF6F26 /* text */,
 				BCFB2F74097A2E1A00BA703D /* Arena.cpp */,
 				BCFB2F75097A2E1A00BA703D /* Arena.h */,
-				2EF1BFF6121CB0BD00C27627 /* AsyncFileStream.h */,
 				89D08D9C12228451001241DF /* AsyncFileSystem.cpp */,
 				89D08D9D12228451001241DF /* AsyncFileSystem.h */,
 				89D08D9E12228451001241DF /* AsyncFileSystemCallbacks.h */,
@@ -19879,6 +20057,8 @@
 				6593923509AE4346002C531F /* KURL.cpp */,
 				6593923609AE4346002C531F /* KURL.h */,
 				BCBD21AA0E417AD400A070F2 /* KURLHash.h */,
+				26A5035914F0A2BC00AA730D /* KURLWTFURL.cpp */,
+				26A5034D14F0983600AA730D /* KURLWTFURLImpl.h */,
 				E18772F0126E2629003DD586 /* Language.cpp */,
 				85EC9AF90A71A2C600EEEAED /* Language.h */,
 				BCE65BE80EACDF16007E4533 /* Length.cpp */,
@@ -19935,6 +20115,7 @@
 				BC7B2AF80450824100A8000F /* Scrollbar.h */,
 				0FE71415142189FC00DB33BA /* ScrollbarTheme.cpp */,
 				BC8B854A0E7C7F5600AB6984 /* ScrollbarTheme.h */,
+				C691614714F6EBA70046375C /* ScrollbarThemeClient.h */,
 				BC1402880E83680800319717 /* ScrollbarThemeComposite.cpp */,
 				BC1402890E83680800319717 /* ScrollbarThemeComposite.h */,
 				93C09C850B0657AA005ABD4D /* ScrollTypes.h */,
@@ -19951,6 +20132,7 @@
 				4B3043C60AE0370300A82647 /* Sound.h */,
 				F587866202DE3B1101EA4122 /* SSLKeyGenerator.h */,
 				93B2D8150F9920D2006AE6B2 /* SuddenTermination.h */,
+				97627B9714FB5424002CDCA1 /* Supplementable.h */,
 				93E62D990985F41600E1B5E3 /* SystemTime.h */,
 				BCE65D310EAD1211007E4533 /* Theme.cpp */,
 				BCE658FE0EA9248A007E4533 /* Theme.h */,
@@ -20018,7 +20200,6 @@
 		E1F0424309839389006694EA /* xml */ = {
 			isa = PBXGroup;
 			children = (
-				A83B536C14F749E200720D9D /* DOMWindowXML.idl */,
 				00B9318013BA867F0035A948 /* parser */,
 				1ACE53E10A8D18E70022947D /* DOMParser.cpp */,
 				1ACE53E20A8D18E70022947D /* DOMParser.h */,
@@ -20310,6 +20491,8 @@
 				0FF50270102BA96A0066F39A /* StyleMedia.idl */,
 				A80E6DF90A199067007FB8C5 /* StylePropertySet.cpp */,
 				A80E6DFA0A199067007FB8C5 /* StylePropertySet.h */,
+				E4BBED4A14FCDBA1003F0B98 /* StyleRule.cpp */,
+				E4BBED4B14FCDBA1003F0B98 /* StyleRule.h */,
 				A8EA80050A19516E00A8EF5F /* StyleSheet.cpp */,
 				A8EA80040A19516E00A8EF5F /* StyleSheet.h */,
 				850656DC0AAB44D9002D15C0 /* StyleSheet.idl */,
@@ -20416,8 +20599,6 @@
 				9392F1410AD185F400691BD4 /* RenderCounter.h */,
 				BCEA482E097D93020094C9E4 /* RenderDeprecatedFlexibleBox.cpp */,
 				BCEA482F097D93020094C9E4 /* RenderDeprecatedFlexibleBox.h */,
-				D302754312A5FE84004BD828 /* RenderDetails.cpp */,
-				D302754412A5FE84004BD828 /* RenderDetails.h */,
 				D302754512A5FE84004BD828 /* RenderDetailsMarker.cpp */,
 				D302754612A5FE84004BD828 /* RenderDetailsMarker.h */,
 				0F5B7A5210F65D7A00376302 /* RenderEmbeddedObject.cpp */,
@@ -20510,8 +20691,6 @@
 				0F11A54E0F39233100C37884 /* RenderSelectionInfo.h */,
 				AB247A6A0AFD6383003FA5FD /* RenderSlider.cpp */,
 				AB247A6B0AFD6383003FA5FD /* RenderSlider.h */,
-				D302754B12A5FEAB004BD828 /* RenderSummary.cpp */,
-				D302754C12A5FEAB004BD828 /* RenderSummary.h */,
 				A8DF4AE20980C42C0052981B /* RenderTable.cpp */,
 				A8DF4AE10980C42C0052981B /* RenderTable.h */,
 				6ED878C2147493F4004C3597 /* RenderTableCaption.cpp */,
@@ -20612,6 +20791,8 @@
 				A81872140977D3C0005826D9 /* ContainerNode.cpp */,
 				A81872110977D3C0005826D9 /* ContainerNode.h */,
 				E1A1470711102B1500EEC0F3 /* ContainerNodeAlgorithms.h */,
+				97627B8B14FB3CEE002CDCA1 /* ContextDestructionObserver.cpp */,
+				97627B8C14FB3CEE002CDCA1 /* ContextDestructionObserver.h */,
 				2E3FAA0811A36BF100576624 /* CrossThreadTask.h */,
 				62CD32561157E57C0063B0A7 /* CustomEvent.cpp */,
 				62CD32571157E57C0063B0A7 /* CustomEvent.h */,
@@ -20706,13 +20887,13 @@
 				BC60D9090D2A17CE00B9918F /* EventException.h */,
 				BC60D90A0D2A17CE00B9918F /* EventException.idl */,
 				97665011144FAA4200F6BB51 /* EventFactory.h */,
-				BC9A6142146859D9006057FD /* EventFactory.in */,
 				935FBC4409BA00B900E230B1 /* EventListener.h */,
 				85AFA7410AAF298400E84305 /* EventListener.idl */,
 				AD4495F1141FC08900541EDF /* EventListenerMap.cpp */,
 				AD4495F2141FC08900541EDF /* EventListenerMap.h */,
 				939885C108B7E3D100E707C4 /* EventNames.cpp */,
 				939885C208B7E3D100E707C4 /* EventNames.h */,
+				BC9A6142146859D9006057FD /* EventNames.in */,
 				8F6756191288B17B0047ACA3 /* EventQueue.h */,
 				CE5CB1B314EDAB6F00BB2795 /* EventSender.h */,
 				E12EDBE90B308E0B002704B6 /* EventTarget.cpp */,
@@ -20827,6 +21008,8 @@
 				D23CA56B0AB0EB8D005108A5 /* RangeException.h */,
 				D23CA5480AB0E983005108A5 /* RangeException.idl */,
 				A84D827B11D333ED00972990 /* RawDataDocumentParser.h */,
+				8ABAFB9D14F5107500A4984B /* RegionNodeList.cpp */,
+				8ABAFB9E14F5107500A4984B /* RegionNodeList.h */,
 				85031B350A44EFC700F992E0 /* RegisteredEventListener.cpp */,
 				85031B360A44EFC700F992E0 /* RegisteredEventListener.h */,
 				A76E5F7E135E0DCF00A69837 /* RenderedDocumentMarker.h */,
@@ -20851,6 +21034,8 @@
 				A6D169611346B49B000EB770 /* ShadowRoot.cpp */,
 				A6D169631346B4C1000EB770 /* ShadowRoot.h */,
 				A7DB418114CE1F0A00A2E316 /* ShadowRoot.idl */,
+				57CF4C8414F7597A00ECFF14 /* ShadowTree.cpp */,
+				57CF4C8514F7597A00ECFF14 /* ShadowTree.h */,
 				D01A27AB10C9BFD800026A42 /* SpaceSplitString.cpp */,
 				D01A27AC10C9BFD800026A42 /* SpaceSplitString.h */,
 				CEA3949A11D45CDA003094CF /* StaticHashSetNodeList.cpp */,
@@ -21222,7 +21407,7 @@
 			isa = PBXHeadersBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				B5B5DC6A119BB3D5002A8790 /* AbstractDatabase.h in Headers */,
+				97BC69DB1505F076001B74AC /* AbstractDatabase.h in Headers */,
 				41E1B1D10FF5986900576B3B /* AbstractWorker.h in Headers */,
 				29A8122E0FBB9C1D00510293 /* AccessibilityARIAGridCell.h in Headers */,
 				29A812330FBB9C1D00510293 /* AccessibilityARIAGridRow.h in Headers */,
@@ -21272,7 +21457,6 @@
 				512DD8F80D91E6AF000F89EE /* ArchiveResourceCollection.h in Headers */,
 				BCFB2F77097A2E1A00BA703D /* Arena.h in Headers */,
 				FD5686CA13AC180200B69C68 /* AsyncAudioDecoder.h in Headers */,
-				2EF1BFF7121CB0BD00C27627 /* AsyncFileStream.h in Headers */,
 				89D08DA012228451001241DF /* AsyncFileSystem.h in Headers */,
 				89D08DA112228451001241DF /* AsyncFileSystemCallbacks.h in Headers */,
 				976D6C77122B8A3D001FD1F7 /* AsyncFileWriter.h in Headers */,
@@ -21329,6 +21513,7 @@
 				B2C3DA220D006C1D00EF6F26 /* Base64.h in Headers */,
 				379E61CA126CA5C400B63E8D /* BaseButtonInputType.h in Headers */,
 				379E61CC126CA5C400B63E8D /* BaseCheckableInputType.h in Headers */,
+				C33EE5C514FB49610002095A /* BaseClickableWithKeyInputType.h in Headers */,
 				F59C96001255B23F000623C0 /* BaseDateAndTimeInputType.h in Headers */,
 				F55B3DAE1251F12D003EF269 /* BaseTextInputType.h in Headers */,
 				BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */,
@@ -21395,7 +21580,7 @@
 				49484FCB102CF23C00187DD3 /* CanvasRenderingContext2D.h in Headers */,
 				49484FCE102CF23C00187DD3 /* CanvasStyle.h in Headers */,
 				6550B69E099DF0270090D781 /* CDATASection.h in Headers */,
-				514185EE0CD65F0400763C99 /* ChangeVersionWrapper.h in Headers */,
+				97BC69DD1505F076001B74AC /* ChangeVersionWrapper.h in Headers */,
 				6550B6A0099DF0270090D781 /* CharacterData.h in Headers */,
 				00022E6913CE1BBA00282D5B /* CharacterReferenceParserInlineMethods.h in Headers */,
 				B2C3DA2A0D006C1D00EF6F26 /* CharsetData.h in Headers */,
@@ -21414,7 +21599,7 @@
 				4B8AF4AA0B1CE02B00687690 /* ClipboardAccessPolicy.h in Headers */,
 				85031B400A44EFC700F992E0 /* ClipboardEvent.h in Headers */,
 				93F199E708245E59001E9ABC /* ClipboardMac.h in Headers */,
-				51FB54F5113E364200821176 /* CloseEvent.h in Headers */,
+				97AABD1314FA09D5007457AE /* CloseEvent.h in Headers */,
 				C0C054CB1118C8E400CE2636 /* CodeGenerator.pm in Headers */,
 				BC5EB5DF0E81B9AB00B25965 /* CollapsedBorderValue.h in Headers */,
 				93C442000F813AE100C1A634 /* CollectionType.h in Headers */,
@@ -21444,6 +21629,7 @@
 				57B791A614C6A62900F202D1 /* ContentSelectorQuery.h in Headers */,
 				41D015CA0F4B5C71004A662F /* ContentType.h in Headers */,
 				370D6EDB138454550044103E /* ContentTypeParser.h in Headers */,
+				97627B8E14FB3CEE002CDCA1 /* ContextDestructionObserver.h in Headers */,
 				93B6A0E60B0BCA5C00F5027A /* ContextMenu.h in Headers */,
 				065AD4F50B0C2EDA005A2B1D /* ContextMenuClient.h in Headers */,
 				065AD4F70B0C2EDA005A2B1D /* ContextMenuController.h in Headers */,
@@ -21541,15 +21727,16 @@
 				50D40612147D49DE00D30BB5 /* CustomFilterShader.h in Headers */,
 				A8CB413E0E8633FD0032C4F0 /* DashArray.h in Headers */,
 				A80E6D0B0A1989CA007FB8C5 /* DashboardRegion.h in Headers */,
-				5196116B0CAC56570010A80C /* Database.h in Headers */,
-				51A45B560CAD7FD7000D2BE9 /* DatabaseAuthorizer.h in Headers */,
-				B5D3601A112F8B560048DEA8 /* DatabaseCallback.h in Headers */,
-				5116D9770CF177BD00C2B84D /* DatabaseDetails.h in Headers */,
-				B523CF0B1182675400EBB29C /* DatabaseSync.h in Headers */,
-				519611EA0CAC749C0010A80C /* DatabaseTask.h in Headers */,
-				519611780CAC56A80010A80C /* DatabaseThread.h in Headers */,
-				1AD51A140CB59CD300953D11 /* DatabaseTracker.h in Headers */,
-				51FAFE340CECBF2D00BB3F24 /* DatabaseTrackerClient.h in Headers */,
+				97BC6A211505F081001B74AC /* Database.h in Headers */,
+				97BC6A241505F081001B74AC /* DatabaseAuthorizer.h in Headers */,
+				97BC6A251505F081001B74AC /* DatabaseCallback.h in Headers */,
+				97BC6A281505F081001B74AC /* DatabaseContext.h in Headers */,
+				97BC6A291505F081001B74AC /* DatabaseDetails.h in Headers */,
+				97BC6A2B1505F081001B74AC /* DatabaseSync.h in Headers */,
+				97BC6A2E1505F081001B74AC /* DatabaseTask.h in Headers */,
+				97BC6A301505F081001B74AC /* DatabaseThread.h in Headers */,
+				97BC6A321505F081001B74AC /* DatabaseTracker.h in Headers */,
+				97BC6A331505F081001B74AC /* DatabaseTrackerClient.h in Headers */,
 				BC22746F0E83664500E7F975 /* DataRef.h in Headers */,
 				BC64641C11D7F416006455B0 /* DatasetDOMStringMap.h in Headers */,
 				81AC5999131636E60009A7E0 /* DataTransferItem.h in Headers */,
@@ -22206,8 +22393,9 @@
 				85C7F5E70AAFBAFB004014DD /* DOMWheelEvent.h in Headers */,
 				85989DD10ACC8BBD00A0BC51 /* DOMWheelEventInternal.h in Headers */,
 				1403B99709EB13AF00797C7F /* DOMWindow.h in Headers */,
+				9712A5AE15004EDA0048AF10 /* DOMWindowIndexedDatabase.h in Headers */,
 				97D2AD0414B823A60093DF32 /* DOMWindowProperty.h in Headers */,
-				A8F457A114BC1A94000CEA59 /* DOMWindowSQLDatabase.h in Headers */,
+				97BC6A351505F081001B74AC /* DOMWindowSQLDatabase.h in Headers */,
 				F35AE5AC14925F5B004D5776 /* DOMWrapperVisitor.h in Headers */,
 				BC53DA2E1143121E000D817E /* DOMWrapperWorld.h in Headers */,
 				1A1D13800A5325520064BF5F /* DOMXPath.h in Headers */,
@@ -22287,6 +22475,7 @@
 				9767CE0C145ABC13005E64DB /* ExceptionInterfaces.h in Headers */,
 				6E67D2A91280E8BD008758F7 /* Extensions3D.h in Headers */,
 				6E67D2A71280E8A4008758F7 /* Extensions3DOpenGL.h in Headers */,
+				7728694F14F8882500F484DC /* EXTTextureFilterAnisotropic.h in Headers */,
 				A75E8B890E1DE2D6007F2481 /* FEBlend.h in Headers */,
 				A75E8B8B0E1DE2D6007F2481 /* FEColorMatrix.h in Headers */,
 				A75E8B8D0E1DE2D6007F2481 /* FEComponentTransfer.h in Headers */,
@@ -22327,7 +22516,6 @@
 				2EDF369D122C94B4002F7D4E /* FileReaderSync.h in Headers */,
 				2EF1BFEB121C9F4200C27627 /* FileStream.h in Headers */,
 				2EF1BFF9121CB0CE00C27627 /* FileStreamClient.h in Headers */,
-				976D6C8C122B8A3D001FD1F7 /* FileStreamProxy.h in Headers */,
 				514B3F730C722047000530DF /* FileSystem.h in Headers */,
 				89878563122CA064003AABDA /* FileSystemCallback.h in Headers */,
 				89878565122CA064003AABDA /* FileSystemCallbacks.h in Headers */,
@@ -22579,31 +22767,47 @@
 				513F14540AB634C400094DDF /* IconLoader.h in Headers */,
 				51E1ECC10C91C90400DC255B /* IconRecord.h in Headers */,
 				45BAC2B01360BBAB005DA258 /* IconURL.h in Headers */,
-				C585A6CD11D4FB3D004C3E4B /* IDBAny.h in Headers */,
+				9712A5B115004EDA0048AF10 /* IDBAny.h in Headers */,
+				9712A5B315004EDA0048AF10 /* IDBBackingStore.h in Headers */,
 				C585A66311D4FAC5004C3E4B /* IDBBindingUtilities.h in Headers */,
-				C585A6CF11D4FB3D004C3E4B /* IDBCallbacks.h in Headers */,
-				81A7325E1210189B00FC0D9E /* IDBCursor.h in Headers */,
-				81A73278121019E100FC0D9E /* IDBCursorBackendImpl.h in Headers */,
-				81BE209911F4AB8D00915DFA /* IDBCursorBackendInterface.h in Headers */,
-				C585A6D811D4FB3D004C3E4B /* IDBDatabase.h in Headers */,
-				B61762621203490800EF9114 /* IDBDatabaseBackendImpl.h in Headers */,
-				B61762541203374F00EF9114 /* IDBDatabaseBackendInterface.h in Headers */,
-				C585A6D111D4FB3D004C3E4B /* IDBDatabaseError.h in Headers */,
-				C585A6D311D4FB3D004C3E4B /* IDBDatabaseException.h in Headers */,
-				C585A6FE11D4FB3D004C3E4B /* IDBFactory.h in Headers */,
-				C585A6FC11D4FB3D004C3E4B /* IDBFactoryBackendImpl.h in Headers */,
-				C585A6FA11D4FB3D004C3E4B /* IDBFactoryBackendInterface.h in Headers */,
-				C572EE0B1201C736007D8F82 /* IDBIndex.h in Headers */,
-				C572EE0E1201C736007D8F82 /* IDBIndexBackendImpl.h in Headers */,
-				C572EE0F1201C736007D8F82 /* IDBIndexBackendInterface.h in Headers */,
-				C585A6E711D4FB3D004C3E4B /* IDBKey.h in Headers */,
-				C585A6EA11D4FB3D004C3E4B /* IDBKeyRange.h in Headers */,
-				C585A6ED11D4FB3D004C3E4B /* IDBObjectStore.h in Headers */,
-				C585A6EF11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h in Headers */,
-				C585A6F111D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h in Headers */,
-				C585A6F411D4FB3D004C3E4B /* IDBRequest.h in Headers */,
-				EB49DB8F14F46E8B002299D9 /* IDBTracing.h in Headers */,
-				B656626B120B115A006EA85C /* IDBTransaction.h in Headers */,
+				9712A5B415004EDA0048AF10 /* IDBCallbacks.h in Headers */,
+				9712A5B615004EDA0048AF10 /* IDBCursor.h in Headers */,
+				9712A5B915004EDA0048AF10 /* IDBCursorBackendImpl.h in Headers */,
+				9712A5BA15004EDA0048AF10 /* IDBCursorBackendInterface.h in Headers */,
+				9712A5BC15004EDA0048AF10 /* IDBCursorWithValue.h in Headers */,
+				9712A5BF15004EDA0048AF10 /* IDBDatabase.h in Headers */,
+				9712A5C215004EDA0048AF10 /* IDBDatabaseBackendImpl.h in Headers */,
+				9712A5C315004EDA0048AF10 /* IDBDatabaseBackendInterface.h in Headers */,
+				9712A5C415004EDA0048AF10 /* IDBDatabaseCallbacks.h in Headers */,
+				9712A5C615004EDA0048AF10 /* IDBDatabaseCallbacksImpl.h in Headers */,
+				9712A5C715004EDA0048AF10 /* IDBDatabaseError.h in Headers */,
+				9712A5CA15004EDA0048AF10 /* IDBDatabaseException.h in Headers */,
+				9712A5CD15004EDA0048AF10 /* IDBEventDispatcher.h in Headers */,
+				9712A5CF15004EDA0048AF10 /* IDBFactory.h in Headers */,
+				9712A5D215004EDA0048AF10 /* IDBFactoryBackendImpl.h in Headers */,
+				9712A5D415004EDA0048AF10 /* IDBFactoryBackendInterface.h in Headers */,
+				9712A5D615004EDA0048AF10 /* IDBIndex.h in Headers */,
+				9712A5D915004EDA0048AF10 /* IDBIndexBackendImpl.h in Headers */,
+				9712A5DA15004EDA0048AF10 /* IDBIndexBackendInterface.h in Headers */,
+				9712A5DC15004EDA0048AF10 /* IDBKey.h in Headers */,
+				9712A5DF15004EDA0048AF10 /* IDBKeyPath.h in Headers */,
+				9712A5E115004EDA0048AF10 /* IDBKeyPathBackendImpl.h in Headers */,
+				9712A5E315004EDA0048AF10 /* IDBKeyRange.h in Headers */,
+				9712A5E615004EDA0048AF10 /* IDBLevelDBBackingStore.h in Headers */,
+				9712A5E815004EDA0048AF10 /* IDBLevelDBCoding.h in Headers */,
+				9712A5EA15004EDA0048AF10 /* IDBObjectStore.h in Headers */,
+				9712A5ED15004EDA0048AF10 /* IDBObjectStoreBackendImpl.h in Headers */,
+				9712A5EE15004EDA0048AF10 /* IDBObjectStoreBackendInterface.h in Headers */,
+				9712A5F015004EDA0048AF10 /* IDBPendingTransactionMonitor.h in Headers */,
+				9712A5F215004EDA0048AF10 /* IDBRequest.h in Headers */,
+				9712A5F415004EDA0048AF10 /* IDBTracing.h in Headers */,
+				9712A5F615004EDA0048AF10 /* IDBTransaction.h in Headers */,
+				9712A5F915004EDA0048AF10 /* IDBTransactionBackendImpl.h in Headers */,
+				9712A5FA15004EDA0048AF10 /* IDBTransactionBackendInterface.h in Headers */,
+				9712A5FB15004EDA0048AF10 /* IDBTransactionCallbacks.h in Headers */,
+				9712A5FD15004EDA0048AF10 /* IDBTransactionCoordinator.h in Headers */,
+				9712A5FF15004EDA0048AF10 /* IDBVersionChangeEvent.h in Headers */,
+				9712A60215004EDA0048AF10 /* IDBVersionChangeRequest.h in Headers */,
 				1A71D57C0F33819000F9CE4E /* IdentifierRep.h in Headers */,
 				5913A24213D49EBA00F5B05C /* IdentifiersFactory.h in Headers */,
 				49E911C50EF86D47009D0CAF /* IdentityTransformOperation.h in Headers */,
@@ -22816,6 +23020,7 @@
 				E0FEF372B37C53EAC1C1FBEE /* JSEventSource.h in Headers */,
 				BC60901F0E91B8EC000C68B5 /* JSEventTarget.h in Headers */,
 				3314ACEC10892086000F0E56 /* JSExceptionBase.h in Headers */,
+				7728698414FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.h in Headers */,
 				BC00F0150E0A189500FD04E3 /* JSFile.h in Headers */,
 				893C47B81238A099002B3D86 /* JSFileCallback.h in Headers */,
 				898785B1122CA2A7003AABDA /* JSFileEntry.h in Headers */,
@@ -23229,6 +23434,7 @@
 				521D46F811AEC9B100514613 /* KillRing.h in Headers */,
 				6593923809AE4346002C531F /* KURL.h in Headers */,
 				BCBD21AB0E417AD400A070F2 /* KURLHash.h in Headers */,
+				26A5034E14F0983600AA730D /* KURLWTFURLImpl.h in Headers */,
 				A456FA2711AD4A830020B420 /* LabelsNodeList.h in Headers */,
 				85EC9AFB0A71A2C600EEEAED /* Language.h in Headers */,
 				2917B5621473496C0052C9D0 /* LayerFlushScheduler.h in Headers */,
@@ -23264,8 +23470,6 @@
 				A5732B0D136A16C4005C8D7C /* LocalizedDate.h in Headers */,
 				F5142C69123F12B000F5BD4C /* LocalizedNumber.h in Headers */,
 				935207BE09BD410A00F2038D /* LocalizedStrings.h in Headers */,
-				511F23180DC160DA004F0032 /* StorageTask.h in Headers */,
-				511F231A0DC160DA004F0032 /* StorageThread.h in Headers */,
 				BCE1C41B0D982980003B02F2 /* Location.h in Headers */,
 				A8239E0109B3CF8A00B60641 /* Logging.h in Headers */,
 				FD31603912B0267600C1A359 /* LowPass2FilterNode.h in Headers */,
@@ -23344,7 +23548,6 @@
 				E12719C70EEEC16800F61213 /* NavigatorBase.h in Headers */,
 				9711460414EF009A00674FD9 /* NavigatorGeolocation.h in Headers */,
 				97E4A12614F4C5D400870E43 /* NavigatorRegisterProtocolHandler.h in Headers */,
-				97CC3AE314E8E4A200894988 /* NavigatorSupplement.h in Headers */,
 				8A309C9F123950BE00CB9204 /* NestingLevelIncrementer.h in Headers */,
 				656D37430ADBA5DE00A4554D /* NetscapePlugInStreamLoader.h in Headers */,
 				628D214C12131ED10055DCFC /* NetworkingContext.h in Headers */,
@@ -23366,7 +23569,7 @@
 				3390CA560FFC157B00921962 /* NotificationCenter.h in Headers */,
 				3390CA580FFC157B00921962 /* NotificationContents.h in Headers */,
 				3128CA6B147331630074C72A /* NotificationController.h in Headers */,
-				33503C9A10179A74003B47E1 /* NotificationPresenter.h in Headers */,
+				33503C9A10179A74003B47E1 /* NotificationClient.h in Headers */,
 				98EB1F951313FE0500D0E1EA /* NotImplemented.h in Headers */,
 				1A569D0B0D7E2B82007C3983 /* NP_jsobject.h in Headers */,
 				1A927FD21416A15B003A83C8 /* npapi.h in Headers */,
@@ -23394,8 +23597,8 @@
 				F4EAF4AF10C742B1009100D3 /* OpenTypeSanitizer.h in Headers */,
 				2E2445F71395893A004B6C19 /* OperationNotAllowedException.h in Headers */,
 				0014628B103CD1DE000B20DB /* OriginAccessEntry.h in Headers */,
-				51A9267D0D53F0570063ECC2 /* OriginQuotaManager.h in Headers */,
-				51A9267F0D53F0570063ECC2 /* OriginUsageRecord.h in Headers */,
+				97BC6A381505F081001B74AC /* OriginQuotaManager.h in Headers */,
+				97BC6A3A1505F081001B74AC /* OriginUsageRecord.h in Headers */,
 				BC5EB5DD0E81B8DD00B25965 /* OutlineValue.h in Headers */,
 				1A0D57370A5C77FE007EDD4C /* OverflowEvent.h in Headers */,
 				3774ABA50FA21EB400AD7DE9 /* OverlapTestRequestClient.h in Headers */,
@@ -23404,11 +23607,11 @@
 				F3820893147D35F90010BC06 /* PageConsoleAgent.h in Headers */,
 				F34742DD134362F000531BC2 /* PageDebuggerAgent.h in Headers */,
 				9302B0BF0D79F82C00C7EE83 /* PageGroup.h in Headers */,
+				9712A60515004EDA0048AF10 /* PageGroupIndexedDatabase.h in Headers */,
 				7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */,
 				F3820895147D35F90010BC06 /* PageRuntimeAgent.h in Headers */,
 				F34742E51343633C00531BC2 /* PageScriptDebugServer.h in Headers */,
 				371E65CC13661EDC00BEEDB0 /* PageSerializer.h in Headers */,
-				A71E083814E3CEAF006A4619 /* PageSupplement.h in Headers */,
 				E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */,
 				51E1ECC30C91C90400DC255B /* PageURLRecord.h in Headers */,
 				FFD5B97B135CC97800D5E92A /* PageVisibilityState.h in Headers */,
@@ -23419,7 +23622,6 @@
 				BC76AC130DD7AD5C00415F34 /* ParserUtilities.h in Headers */,
 				F55B3DCA1251F12D003EF269 /* PasswordInputType.h in Headers */,
 				4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */,
-				A7D3C5240B576B4B002CA450 /* PasteboardHelper.h in Headers */,
 				C598905714E9C28000E8D18B /* PasteboardStrategy.h in Headers */,
 				B27535800B053814002CE64F /* Path.h in Headers */,
 				A88DD4870B4629A300C02990 /* PathTraversalState.h in Headers */,
@@ -23501,6 +23703,7 @@
 				FD31603E12B0267600C1A359 /* RealtimeAnalyserNode.h in Headers */,
 				BC4368E80C226E32005EFB5F /* Rect.h in Headers */,
 				BCAB418213E356E800D8AAF3 /* Region.h in Headers */,
+				8ABAFBA014F5107500A4984B /* RegionNodeList.h in Headers */,
 				85031B4C0A44EFC700F992E0 /* RegisteredEventListener.h in Headers */,
 				B2C3DA2D0D006C1D00EF6F26 /* RegularExpression.h in Headers */,
 				93309E01099E64920056E581 /* RemoveCSSPropertyCommand.h in Headers */,
@@ -23518,7 +23721,6 @@
 				BCE4413412F748E2009B84B8 /* RenderCombineText.h in Headers */,
 				9392F1420AD185F400691BD4 /* RenderCounter.h in Headers */,
 				BCEA486E097D93020094C9E4 /* RenderDeprecatedFlexibleBox.h in Headers */,
-				D302754812A5FE84004BD828 /* RenderDetails.h in Headers */,
 				D302754A12A5FE84004BD828 /* RenderDetailsMarker.h in Headers */,
 				A76E5F7F135E0DCF00A69837 /* RenderedDocumentMarker.h in Headers */,
 				9B32CDA913DF7FA900F34D13 /* RenderedPosition.h in Headers */,
@@ -23580,7 +23782,6 @@
 				AB247A6D0AFD6383003FA5FD /* RenderSlider.h in Headers */,
 				BC8C8FAE0DDCD31B00B592F4 /* RenderStyle.h in Headers */,
 				BC5EB6680E81CB7100B25965 /* RenderStyleConstants.h in Headers */,
-				D302754E12A5FEAB004BD828 /* RenderSummary.h in Headers */,
 				436708C112D9CA4B00044234 /* RenderSVGBlock.h in Headers */,
 				436708C312D9CA4B00044234 /* RenderSVGContainer.h in Headers */,
 				43C092BC12D9E4EE00A989C3 /* RenderSVGForeignObject.h in Headers */,
@@ -23605,7 +23806,6 @@
 				436708E112D9CA4B00044234 /* RenderSVGResourceRadialGradient.h in Headers */,
 				436708E312D9CA4B00044234 /* RenderSVGResourceSolidColor.h in Headers */,
 				436708E512D9CA4B00044234 /* RenderSVGRoot.h in Headers */,
-				436708E712D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.h in Headers */,
 				A10BB58B1484E3B300B2E87A /* RenderSVGShape.h in Headers */,
 				0854B0191255E4E600B9CDD0 /* RenderSVGText.h in Headers */,
 				0854B01B1255E4E600B9CDD0 /* RenderSVGTextPath.h in Headers */,
@@ -23708,6 +23908,7 @@
 				BCAE1FA712939DB7004CB026 /* ScrollAnimatorMac.h in Headers */,
 				93F199B808245E59001E9ABC /* Scrollbar.h in Headers */,
 				BC8B854B0E7C7F5600AB6984 /* ScrollbarTheme.h in Headers */,
+				C6B31B2E14F841FB0089F23F /* ScrollbarThemeClient.h in Headers */,
 				BC14028B0E83680800319717 /* ScrollbarThemeComposite.h in Headers */,
 				BC8B853E0E7C7F1100AB6984 /* ScrollbarThemeMac.h in Headers */,
 				0FE71406142170B800DB33BA /* ScrollbarThemeMock.h in Headers */,
@@ -23741,7 +23942,7 @@
 				0F3DD45012F5EA1B000D9190 /* ShadowBlur.h in Headers */,
 				BC5EB8C40E82031B00B25965 /* ShadowData.h in Headers */,
 				A6D169641346B4C1000EB770 /* ShadowRoot.h in Headers */,
-				572E92FC14E540580087FFBA /* ShadowRootList.h in Headers */,
+				57CF4C8714F7597A00ECFF14 /* ShadowTree.h in Headers */,
 				A80E6CE80A1989CA007FB8C5 /* ShadowValue.h in Headers */,
 				B2AFFC940D00A5DF0030074D /* ShapeArabic.h in Headers */,
 				1A4A954E0B4EDCCB002D8C3C /* SharedBuffer.h in Headers */,
@@ -23782,26 +23983,26 @@
 				93309E14099E64920056E581 /* SplitTextNodeCommand.h in Headers */,
 				93309E16099E64920056E581 /* SplitTextNodeContainingElementCommand.h in Headers */,
 				84730D931248F0B300D3A9C9 /* SpotLightSource.h in Headers */,
-				245D80A313280E40003492A6 /* SQLCallbackWrapper.h in Headers */,
-				51EC92590CE90DB400F90308 /* SQLError.h in Headers */,
-				B56EBA8511C9FF8100B04477 /* SQLException.h in Headers */,
+				97BC6A3B1505F081001B74AC /* SQLCallbackWrapper.h in Headers */,
+				97BC6A3C1505F081001B74AC /* SQLError.h in Headers */,
+				97BC6A3F1505F081001B74AC /* SQLException.h in Headers */,
 				1A22464A0CC98DDB00C05240 /* SQLiteDatabase.h in Headers */,
 				B5A684220FFABE9800D24689 /* SQLiteFileSystem.h in Headers */,
 				1A22464C0CC98DDB00C05240 /* SQLiteStatement.h in Headers */,
 				1A22464E0CC98DDB00C05240 /* SQLiteTransaction.h in Headers */,
-				519611740CAC56570010A80C /* SQLResultSet.h in Headers */,
-				1AFE117E0CBFFB36003017FA /* SQLResultSetRowList.h in Headers */,
-				515B03990CD1642A00B7EA9C /* SQLStatement.h in Headers */,
-				1A7CCB190CD9469A00B7B64E /* SQLStatementCallback.h in Headers */,
-				1A7CCB1A0CD9469A00B7B64E /* SQLStatementErrorCallback.h in Headers */,
-				B550B52611DC68A800923885 /* SQLStatementSync.h in Headers */,
-				1A7CCB240CD946FD00B7B64E /* SQLTransaction.h in Headers */,
-				1A7CCB1B0CD9469A00B7B64E /* SQLTransactionCallback.h in Headers */,
-				B51BF6F1102C9E590002C15A /* SQLTransactionClient.h in Headers */,
-				B5C1123C102B6C4600096578 /* SQLTransactionCoordinator.h in Headers */,
-				1A7CCB1C0CD9469A00B7B64E /* SQLTransactionErrorCallback.h in Headers */,
-				B523CF081182675400EBB29C /* SQLTransactionSync.h in Headers */,
-				B523CF061182675400EBB29C /* SQLTransactionSyncCallback.h in Headers */,
+				97BC6A421505F081001B74AC /* SQLResultSet.h in Headers */,
+				97BC6A451505F081001B74AC /* SQLResultSetRowList.h in Headers */,
+				97BC6A481505F081001B74AC /* SQLStatement.h in Headers */,
+				97BC6A491505F081001B74AC /* SQLStatementCallback.h in Headers */,
+				97BC6A4B1505F081001B74AC /* SQLStatementErrorCallback.h in Headers */,
+				97BC6A4E1505F081001B74AC /* SQLStatementSync.h in Headers */,
+				97BC6A501505F081001B74AC /* SQLTransaction.h in Headers */,
+				97BC6A521505F081001B74AC /* SQLTransactionCallback.h in Headers */,
+				97BC6A551505F081001B74AC /* SQLTransactionClient.h in Headers */,
+				97BC6A571505F081001B74AC /* SQLTransactionCoordinator.h in Headers */,
+				97BC6A581505F081001B74AC /* SQLTransactionErrorCallback.h in Headers */,
+				97BC6A5B1505F081001B74AC /* SQLTransactionSync.h in Headers */,
+				97BC6A5D1505F081001B74AC /* SQLTransactionSyncCallback.h in Headers */,
 				1A2E6E5A0CC55213004A2062 /* SQLValue.h in Headers */,
 				93F1996308245E59001E9ABC /* SSLKeyGenerator.h in Headers */,
 				CEA3949D11D45CDA003094CF /* StaticHashSetNodeList.h in Headers */,
@@ -23820,6 +24021,8 @@
 				C50D0E830FF4272900AC2644 /* StorageNamespace.h in Headers */,
 				C55E38BF10040D5D00A56BDB /* StorageNamespaceImpl.h in Headers */,
 				C5102D940FD9AA2D00FAFF04 /* StorageSyncManager.h in Headers */,
+				511F23180DC160DA004F0032 /* StorageTask.h in Headers */,
+				511F231A0DC160DA004F0032 /* StorageThread.h in Headers */,
 				3AB02D2A12D4F91600FBB694 /* StorageTracker.h in Headers */,
 				3AC3680012EF7A09006A3D6F /* StorageTrackerClient.h in Headers */,
 				81AC6C36131C57D30009A7E0 /* StringCallback.h in Headers */,
@@ -23840,6 +24043,7 @@
 				5317612313C516690026E454 /* StyleFlexibleBoxData.h in Headers */,
 				BCEF444A0E6745E0001C1287 /* StyleGeneratedImage.h in Headers */,
 				A10DC76B14747BAB005E2471 /* StyleGridData.h in Headers */,
+				A110DB9B14F5DF7700A03B93 /* StyleGridItemData.h in Headers */,
 				BCEF43CF0E673DA1001C1287 /* StyleImage.h in Headers */,
 				BC2273040E82F1E600E7F975 /* StyleInheritedData.h in Headers */,
 				BC5EB72A0E81DE8100B25965 /* StyleMarqueeData.h in Headers */,
@@ -23849,6 +24053,7 @@
 				BC2272E40E82EE9B00E7F975 /* StyleRareInheritedData.h in Headers */,
 				BC2272BD0E82EAAE00E7F975 /* StyleRareNonInheritedData.h in Headers */,
 				BC2272870E82E70700E7F975 /* StyleReflection.h in Headers */,
+				E4BBED4D14FCDBA1003F0B98 /* StyleRule.h in Headers */,
 				3138A9E51474434600B0ED12 /* StyleShader.h in Headers */,
 				A8EA800C0A19516E00A8EF5F /* StyleSheet.h in Headers */,
 				A8EA800A0A19516E00A8EF5F /* StyleSheetList.h in Headers */,
@@ -23862,6 +24067,7 @@
 				1A8F6B020DB53006001DB794 /* SubstituteResource.h in Headers */,
 				93B2D8160F9920D2006AE6B2 /* SuddenTermination.h in Headers */,
 				97C078501165D5BE003A32EF /* SuffixTree.h in Headers */,
+				97627B9814FB5424002CDCA1 /* Supplementable.h in Headers */,
 				087558C613B4A57D00F49307 /* SurrogatePairAwareTextIterator.h in Headers */,
 				62C1217D11AB9E77003C462C /* SuspendableTimer.h in Headers */,
 				B22279740D00BF220071B782 /* SVGAElement.h in Headers */,
@@ -24044,13 +24250,13 @@
 				BC22747B0E8366E200E7F975 /* SVGRenderStyleDefs.h in Headers */,
 				436708F212D9CA4B00044234 /* SVGRenderSupport.h in Headers */,
 				436708F412D9CA4B00044234 /* SVGRenderTreeAsText.h in Headers */,
+				197B180C1506353200E4ADA8 /* SVGRenderingContext.h in Headers */,
 				436708F612D9CA4B00044234 /* SVGResources.h in Headers */,
 				436708F812D9CA4B00044234 /* SVGResourcesCache.h in Headers */,
 				436708FA12D9CA4B00044234 /* SVGResourcesCycleSolver.h in Headers */,
 				0854B0231255E4E600B9CDD0 /* SVGRootInlineBox.h in Headers */,
 				B2227AA30D00BF220071B782 /* SVGScriptElement.h in Headers */,
 				B2227AA60D00BF220071B782 /* SVGSetElement.h in Headers */,
-				436708FC12D9CA4B00044234 /* SVGShadowTreeElements.h in Headers */,
 				E4AFD0100DAF335500F5F55C /* SVGSMILElement.h in Headers */,
 				0880F70E1282B46D00948505 /* SVGStaticListPropertyTearOff.h in Headers */,
 				0813A4EA1284132600992511 /* SVGStaticPropertyTearOff.h in Headers */,
@@ -24150,8 +24356,8 @@
 				976D6C95122B8A3D001FD1F7 /* ThreadableBlobRegistry.h in Headers */,
 				0B90561B0F2578BF0095FF6A /* ThreadableLoader.h in Headers */,
 				0B90561C0F2578BF0095FF6A /* ThreadableLoaderClient.h in Headers */,
-				5112247410CFB8D8008099D7 /* ThreadableWebSocketChannel.h in Headers */,
-				5112247610CFB8E8008099D7 /* ThreadableWebSocketChannelClientWrapper.h in Headers */,
+				97AABD1714FA09D5007457AE /* ThreadableWebSocketChannel.h in Headers */,
+				97AABD1914FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.h in Headers */,
 				51DF6D7E0B92A16D00C2DC85 /* ThreadCheck.h in Headers */,
 				E1FF57A30F01255B00891EBB /* ThreadGlobalData.h in Headers */,
 				185BCF290F3279CE000EA262 /* ThreadTimers.h in Headers */,
@@ -24219,6 +24425,7 @@
 				37F818FD0D657606005E1F05 /* WebCoreURLResponse.h in Headers */,
 				93F199F008245E59001E9ABC /* WebCoreView.h in Headers */,
 				BC6DADEF0A195FDF00E5CD14 /* WebFontCache.h in Headers */,
+				CD127DEE14F3098400E84779 /* WebCoreFullScreenWindow.h in Headers */,
 				A7D20F6D107F438B00A80392 /* WebGLActiveInfo.h in Headers */,
 				49C7B9C91042D32F0009D447 /* WebGLBuffer.h in Headers */,
 				6E3FAE8F14733FDB00E42306 /* WebGLCompressedTextureS3TC.h in Headers */,
@@ -24262,16 +24469,17 @@
 				1CAF34810A6C405200ABE06E /* WebScriptObject.h in Headers */,
 				1A569D1B0D7E2B82007C3983 /* WebScriptObject.h in Headers */,
 				1CAF34830A6C405200ABE06E /* WebScriptObjectPrivate.h in Headers */,
-				518A34C21026C831001B6896 /* WebSocket.h in Headers */,
-				510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */,
-				510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */,
-				4AE02ABE14E8A9D200BC3BA7 /* WebSocketDeflater.h in Headers */,
-				4A957F0714E241300049DBFB /* WebSocketExtensionDispatcher.h in Headers */,
-				4ADE25FA14E3BB4C004C2213 /* WebSocketExtensionProcessor.h in Headers */,
-				4A4A234614F1E1440046FBF1 /* WebSocketFrame.h in Headers */,
-				51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */,
-				7637C543112E7B7E003D6CDC /* WebSocketHandshakeRequest.h in Headers */,
-				767F99C011A119560080C51D /* WebSocketHandshakeResponse.h in Headers */,
+				97AABD1B14FA09D5007457AE /* WebSocket.h in Headers */,
+				97AABD1E14FA09D5007457AE /* WebSocketChannel.h in Headers */,
+				97AABD1F14FA09D5007457AE /* WebSocketChannelClient.h in Headers */,
+				4A38BF5114FE1C0900612512 /* WebSocketDeflateFramer.h in Headers */,
+				97AABD2114FA09D5007457AE /* WebSocketDeflater.h in Headers */,
+				97AABD2314FA09D5007457AE /* WebSocketExtensionDispatcher.h in Headers */,
+				97AABD2414FA09D5007457AE /* WebSocketExtensionProcessor.h in Headers */,
+				97AABD2514FA09D5007457AE /* WebSocketFrame.h in Headers */,
+				97AABD2714FA09D5007457AE /* WebSocketHandshake.h in Headers */,
+				97AABD2914FA09D5007457AE /* WebSocketHandshakeRequest.h in Headers */,
+				97AABD2B14FA09D5007457AE /* WebSocketHandshakeResponse.h in Headers */,
 				0F580FA31496939100FB5BD8 /* WebTileCacheLayer.h in Headers */,
 				0FCF332D0F2B9A25004B6795 /* WebTiledLayer.h in Headers */,
 				CD82030A1395AB6A00F956C6 /* WebVideoFullscreenController.h in Headers */,
@@ -24292,7 +24500,9 @@
 				2E4346460F546A8200B0F1BA /* Worker.h in Headers */,
 				F3820897147D35F90010BC06 /* WorkerConsoleAgent.h in Headers */,
 				2E4346490F546A8200B0F1BA /* WorkerContext.h in Headers */,
+				9712A612150090CE0048AF10 /* WorkerContextIndexedDatabase.h in Headers */,
 				2E43464B0F546A8200B0F1BA /* WorkerContextProxy.h in Headers */,
+				97BC6A601505F081001B74AC /* WorkerContextSQLDatabase.h in Headers */,
 				F34742E11343631F00531BC2 /* WorkerDebuggerAgent.h in Headers */,
 				A3E2643114748991005A8588 /* WorkerEventQueue.h in Headers */,
 				F36E07A51358A8BE00AACBC9 /* WorkerInspectorController.h in Headers */,
@@ -24310,7 +24520,7 @@
 				2EA768040FE7126400AB9C8A /* WorkerScriptLoaderClient.h in Headers */,
 				2E4346550F546A8200B0F1BA /* WorkerThread.h in Headers */,
 				0B9056F90F2685F30095FF6A /* WorkerThreadableLoader.h in Headers */,
-				5112247A10CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h in Headers */,
+				97AABD2D14FA09D5007457AE /* WorkerThreadableWebSocketChannel.h in Headers */,
 				93309E24099E64920056E581 /* WrapContentsInDummySpanCommand.h in Headers */,
 				9BAF3B2412C1A39800014BF1 /* WritingDirection.h in Headers */,
 				6565820209D1508D000E61D7 /* XLinkNames.h in Headers */,
@@ -24353,6 +24563,9 @@
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */,
 				FD537353137B651800008DCE /* ZeroPole.h in Headers */,
+				E1CDE9221501916900862CC5 /* AsyncFileStream.h in Headers */,
+				450CEBF115073BBE002BB149 /* LabelableElement.h in Headers */,
+				C5B4C24D1509236C00A6EF37 /* WebCoreNSURLExtras.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -24504,6 +24717,7 @@
 				85136CA80AED665900F90A3D /* westResizeCursor.png in Resources */,
 				1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */,
 				1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */,
+				2D9F0E1314FF1CBF00BA0FF7 /* linearSRGB.icc in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -24680,7 +24894,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" WebCore\nexport WebCore=\"WebCore\"\n\nif [ ! $CC ]; then\n    case $TARGET_GCC_VERSION in\n        (GCC_42)\n            export CC=\"${DT_TOOLCHAIN_DIR}/usr/bin/gcc-4.2\";;\n        (LLVM_GCC_42)\n            export CC=\"${DT_TOOLCHAIN_DIR}/usr/bin/llvm-gcc-4.2\";;\n        (LLVM_COMPILER)\n            export CC=\"${DT_TOOLCHAIN_DIR}/usr/bin/clang\";;\n    esac\nfi\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make  --no-builtin-rules -f \"WebCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
+			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" WebCore\nexport WebCore=\"WebCore\"\n\nif [ ! $CC ]; then\n    case $TARGET_GCC_VERSION in\n        (GCC_42)\n            export CC=\"`xcrun -find gcc-4.2`\";;\n        (LLVM_GCC_42)\n            export CC=\"`xcrun -find llvm-gcc-4.2`\";;\n        (LLVM_COMPILER)\n            export CC=\"`xcrun -find clang`\";;\n    esac\nfi\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make  --no-builtin-rules -f \"WebCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
 		};
 /* End PBXShellScriptBuildPhase section */
 
@@ -24710,7 +24924,7 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				B5B5DC69119BB3D5002A8790 /* AbstractDatabase.cpp in Sources */,
+				97BC69DA1505F076001B74AC /* AbstractDatabase.cpp in Sources */,
 				41E1B1D00FF5986900576B3B /* AbstractWorker.cpp in Sources */,
 				0F29C16E1300C2E2002D794E /* AccessibilityAllInOne.cpp in Sources */,
 				76CDD2F21103DA6600680521 /* AccessibilityMenuList.cpp in Sources */,
@@ -24782,6 +24996,7 @@
 				B2C3DA210D006C1D00EF6F26 /* Base64.cpp in Sources */,
 				379E61C9126CA5C300B63E8D /* BaseButtonInputType.cpp in Sources */,
 				379E61CB126CA5C400B63E8D /* BaseCheckableInputType.cpp in Sources */,
+				C33EE5C414FB49610002095A /* BaseClickableWithKeyInputType.cpp in Sources */,
 				F59C95FF1255B23F000623C0 /* BaseDateAndTimeInputType.cpp in Sources */,
 				F55B3DAD1251F12D003EF269 /* BaseTextInputType.cpp in Sources */,
 				AB23A32709BBA7D00067CC53 /* BeforeTextInsertedEvent.cpp in Sources */,
@@ -24833,7 +25048,7 @@
 				49484FCA102CF23C00187DD3 /* CanvasRenderingContext2D.cpp in Sources */,
 				49484FCD102CF23C00187DD3 /* CanvasStyle.cpp in Sources */,
 				6550B69D099DF0270090D781 /* CDATASection.cpp in Sources */,
-				514185EF0CD65F0400763C99 /* ChangeVersionWrapper.cpp in Sources */,
+				97BC69DC1505F076001B74AC /* ChangeVersionWrapper.cpp in Sources */,
 				6550B69F099DF0270090D781 /* CharacterData.cpp in Sources */,
 				9326DC0C09DAD5D600AFC847 /* CharsetData.cpp in Sources */,
 				F55B3DB11251F12D003EF269 /* CheckboxInputType.cpp in Sources */,
@@ -24874,6 +25089,7 @@
 				57B791A514C6A62900F202D1 /* ContentSelectorQuery.cpp in Sources */,
 				41D015CB0F4B5C71004A662F /* ContentType.cpp in Sources */,
 				370D6EDA138454550044103E /* ContentTypeParser.cpp in Sources */,
+				97627B8D14FB3CEE002CDCA1 /* ContextDestructionObserver.cpp in Sources */,
 				065AD4F60B0C2EDA005A2B1D /* ContextMenuController.cpp in Sources */,
 				06027CB30B1CC03D00884B2D /* ContextMenuItemMac.mm in Sources */,
 				93B6A0EA0B0BCA8400F5027A /* ContextMenuMac.mm in Sources */,
@@ -24956,12 +25172,13 @@
 				50CC0A3914C6F5B10017AB51 /* CustomFilterOperation.cpp in Sources */,
 				503D0CAA14B5B08700F32F57 /* CustomFilterProgram.cpp in Sources */,
 				50D40611147D49DE00D30BB5 /* CustomFilterShader.cpp in Sources */,
-				5196116A0CAC56570010A80C /* Database.cpp in Sources */,
-				51A45B570CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp in Sources */,
-				B523CF0A1182675400EBB29C /* DatabaseSync.cpp in Sources */,
-				519611EB0CAC749C0010A80C /* DatabaseTask.cpp in Sources */,
-				5196116D0CAC56570010A80C /* DatabaseThread.cpp in Sources */,
-				1AD51A150CB59CD300953D11 /* DatabaseTracker.cpp in Sources */,
+				97BC6A201505F081001B74AC /* Database.cpp in Sources */,
+				97BC6A231505F081001B74AC /* DatabaseAuthorizer.cpp in Sources */,
+				97BC6A271505F081001B74AC /* DatabaseContext.cpp in Sources */,
+				97BC6A2A1505F081001B74AC /* DatabaseSync.cpp in Sources */,
+				97BC6A2D1505F081001B74AC /* DatabaseTask.cpp in Sources */,
+				97BC6A2F1505F081001B74AC /* DatabaseThread.cpp in Sources */,
+				97BC6A311505F081001B74AC /* DatabaseTracker.cpp in Sources */,
 				BC64641D11D7F416006455B0 /* DatasetDOMStringMap.cpp in Sources */,
 				815E6167132587AA00B622B0 /* DataTransferItem.cpp in Sources */,
 				2E97CCEA12939CB800C5C8FF /* DataView.cpp in Sources */,
@@ -25319,8 +25536,9 @@
 				31C0FF4D0E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm in Sources */,
 				85C7F5E80AAFBAFB004014DD /* DOMWheelEvent.mm in Sources */,
 				1403B99809EB13AF00797C7F /* DOMWindow.cpp in Sources */,
+				9712A5AD15004EDA0048AF10 /* DOMWindowIndexedDatabase.cpp in Sources */,
 				97D2AD0314B823A60093DF32 /* DOMWindowProperty.cpp in Sources */,
-				A8F457A014BC1A88000CEA59 /* DOMWindowSQLDatabase.cpp in Sources */,
+				97BC6A341505F081001B74AC /* DOMWindowSQLDatabase.cpp in Sources */,
 				BC53DA481143134D000D817E /* DOMWrapperWorld.cpp in Sources */,
 				1A1D13810A5325520064BF5F /* DOMXPath.mm in Sources */,
 				85E9E0A20AB3A0C700069CD0 /* DOMXPathExpression.mm in Sources */,
@@ -25374,6 +25592,7 @@
 				A7CACDB113CE875C00BBBE3F /* ExceptionCodePlaceholder.cpp in Sources */,
 				148AFDA60AF58360008CC700 /* ExceptionHandlers.mm in Sources */,
 				6E67D2A61280E8A4008758F7 /* Extensions3DOpenGL.cpp in Sources */,
+				7728694E14F8882500F484DC /* EXTTextureFilterAnisotropic.cpp in Sources */,
 				A75E8B880E1DE2D6007F2481 /* FEBlend.cpp in Sources */,
 				A75E8B8A0E1DE2D6007F2481 /* FEColorMatrix.cpp in Sources */,
 				A75E8B8C0E1DE2D6007F2481 /* FEComponentTransfer.cpp in Sources */,
@@ -25410,7 +25629,6 @@
 				2E75841D12779ADA0062628B /* FileReaderLoader.cpp in Sources */,
 				2EDF369C122C94B4002F7D4E /* FileReaderSync.cpp in Sources */,
 				2EF1BFEA121C9F4200C27627 /* FileStream.cpp in Sources */,
-				976D6C8B122B8A3D001FD1F7 /* FileStreamProxy.cpp in Sources */,
 				C57FEDE11212EE9C0097BE65 /* FileSystem.cpp in Sources */,
 				89878564122CA064003AABDA /* FileSystemCallbacks.cpp in Sources */,
 				5160306C0CC4362300C8AC25 /* FileSystemCF.cpp in Sources */,
@@ -25639,24 +25857,36 @@
 				B275358E0B053A66002CE64F /* IconMac.mm in Sources */,
 				51E1ECC00C91C90400DC255B /* IconRecord.cpp in Sources */,
 				45099C411370A7800058D513 /* IconURL.cpp in Sources */,
-				C585A6CC11D4FB3D004C3E4B /* IDBAny.cpp in Sources */,
+				9712A5B015004EDA0048AF10 /* IDBAny.cpp in Sources */,
 				C585A66211D4FAC5004C3E4B /* IDBBindingUtilities.cpp in Sources */,
-				81A73260121018A400FC0D9E /* IDBCursor.cpp in Sources */,
-				81BE209811F4AB8D00915DFA /* IDBCursorBackendImpl.cpp in Sources */,
-				B691C1F91206D4A00025D980 /* IDBDatabase.cpp in Sources */,
-				C585A6D511D4FB3D004C3E4B /* IDBDatabaseBackendImpl.cpp in Sources */,
-				978D07B2145A0EBD0096908D /* IDBDatabaseException.cpp in Sources */,
-				C585A6FD11D4FB3D004C3E4B /* IDBFactory.cpp in Sources */,
-				C585A6FB11D4FB3D004C3E4B /* IDBFactoryBackendImpl.cpp in Sources */,
-				C585A6F911D4FB3D004C3E4B /* IDBFactoryBackendInterface.cpp in Sources */,
-				C572EE0A1201C736007D8F82 /* IDBIndex.cpp in Sources */,
-				C572EE0D1201C736007D8F82 /* IDBIndexBackendImpl.cpp in Sources */,
-				C585A6E611D4FB3D004C3E4B /* IDBKey.cpp in Sources */,
-				C585A6E911D4FB3D004C3E4B /* IDBKeyRange.cpp in Sources */,
-				C585A6F011D4FB3D004C3E4B /* IDBObjectStore.cpp in Sources */,
-				C585A6EE11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp in Sources */,
-				C585A6F311D4FB3D004C3E4B /* IDBRequest.cpp in Sources */,
-				B656626A120B115A006EA85C /* IDBTransaction.cpp in Sources */,
+				9712A5B515004EDA0048AF10 /* IDBCursor.cpp in Sources */,
+				9712A5B815004EDA0048AF10 /* IDBCursorBackendImpl.cpp in Sources */,
+				9712A5BB15004EDA0048AF10 /* IDBCursorWithValue.cpp in Sources */,
+				9712A5BE15004EDA0048AF10 /* IDBDatabase.cpp in Sources */,
+				9712A5C115004EDA0048AF10 /* IDBDatabaseBackendImpl.cpp in Sources */,
+				9712A5C515004EDA0048AF10 /* IDBDatabaseCallbacksImpl.cpp in Sources */,
+				9712A5C915004EDA0048AF10 /* IDBDatabaseException.cpp in Sources */,
+				9712A5CC15004EDA0048AF10 /* IDBEventDispatcher.cpp in Sources */,
+				9712A5CE15004EDA0048AF10 /* IDBFactory.cpp in Sources */,
+				9712A5D115004EDA0048AF10 /* IDBFactoryBackendImpl.cpp in Sources */,
+				9712A5D315004EDA0048AF10 /* IDBFactoryBackendInterface.cpp in Sources */,
+				9712A5D515004EDA0048AF10 /* IDBIndex.cpp in Sources */,
+				9712A5D815004EDA0048AF10 /* IDBIndexBackendImpl.cpp in Sources */,
+				9712A5DB15004EDA0048AF10 /* IDBKey.cpp in Sources */,
+				9712A5DE15004EDA0048AF10 /* IDBKeyPath.cpp in Sources */,
+				9712A5E015004EDA0048AF10 /* IDBKeyPathBackendImpl.cpp in Sources */,
+				9712A5E215004EDA0048AF10 /* IDBKeyRange.cpp in Sources */,
+				9712A5E515004EDA0048AF10 /* IDBLevelDBBackingStore.cpp in Sources */,
+				9712A5E715004EDA0048AF10 /* IDBLevelDBCoding.cpp in Sources */,
+				9712A5E915004EDA0048AF10 /* IDBObjectStore.cpp in Sources */,
+				9712A5EC15004EDA0048AF10 /* IDBObjectStoreBackendImpl.cpp in Sources */,
+				9712A5EF15004EDA0048AF10 /* IDBPendingTransactionMonitor.cpp in Sources */,
+				9712A5F115004EDA0048AF10 /* IDBRequest.cpp in Sources */,
+				9712A5F515004EDA0048AF10 /* IDBTransaction.cpp in Sources */,
+				9712A5F815004EDA0048AF10 /* IDBTransactionBackendImpl.cpp in Sources */,
+				9712A5FC15004EDA0048AF10 /* IDBTransactionCoordinator.cpp in Sources */,
+				9712A5FE15004EDA0048AF10 /* IDBVersionChangeEvent.cpp in Sources */,
+				9712A60115004EDA0048AF10 /* IDBVersionChangeRequest.cpp in Sources */,
 				1A71D57B0F33819000F9CE4E /* IdentifierRep.cpp in Sources */,
 				5913A24113D49EBA00F5B05C /* IdentifiersFactory.cpp in Sources */,
 				B275356F0B053814002CE64F /* Image.cpp in Sources */,
@@ -25902,6 +26132,7 @@
 				E0FEF372B47C53EAC1C1FBEE /* JSEventSource.cpp in Sources */,
 				BC6090200E91B8EC000C68B5 /* JSEventTarget.cpp in Sources */,
 				3314ACEB10892086000F0E56 /* JSExceptionBase.cpp in Sources */,
+				7728698314FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.cpp in Sources */,
 				BC00F0140E0A189500FD04E3 /* JSFile.cpp in Sources */,
 				893C47B71238A099002B3D86 /* JSFileCallback.cpp in Sources */,
 				898785B0122CA2A7003AABDA /* JSFileEntry.cpp in Sources */,
@@ -26401,6 +26632,7 @@
 				6593923709AE4346002C531F /* KURL.cpp in Sources */,
 				1A98956B0AA78F80005EF5EF /* KURLCFNet.cpp in Sources */,
 				6593923A09AE435C002C531F /* KURLMac.mm in Sources */,
+				26A5035A14F0A2BC00AA730D /* KURLWTFURL.cpp in Sources */,
 				A456FA2611AD4A830020B420 /* LabelsNodeList.cpp in Sources */,
 				E18772F1126E2629003DD586 /* Language.cpp in Sources */,
 				9352084509BD43B900F2038D /* Language.mm in Sources */,
@@ -26428,9 +26660,7 @@
 				A5732B0F136A1715005C8D7C /* LocalizedDateNone.cpp in Sources */,
 				F5CC42DC12F801CA00D5F7E3 /* LocalizedNumberMac.mm in Sources */,
 				C046E1AC1208A9FE00BA2CF7 /* LocalizedStrings.cpp in Sources */,
-				BC25B52A131C6D3900180E10 /* LocalizedStringsMac.mm in Sources */,
-				511F23170DC160DA004F0032 /* StorageTask.cpp in Sources */,
-				511F23190DC160DA004F0032 /* StorageThread.cpp in Sources */,
+				BC25B52A131C6D3900180E10 /* LocalizedStringsMac.cpp in Sources */,
 				BCE1C41C0D982981003B02F2 /* Location.cpp in Sources */,
 				A8239E0009B3CF8A00B60641 /* Logging.cpp in Sources */,
 				1402645E0AFDC19B005919E2 /* LoggingMac.mm in Sources */,
@@ -26502,7 +26732,6 @@
 				E12719CA0EEEC21300F61213 /* NavigatorBase.cpp in Sources */,
 				9711460314EF009A00674FD9 /* NavigatorGeolocation.cpp in Sources */,
 				97E4A12714F4C5D700870E43 /* NavigatorRegisterProtocolHandler.cpp in Sources */,
-				97CC3AE214E8E4A200894988 /* NavigatorSupplement.cpp in Sources */,
 				5D874F130D161D3200796C3B /* NetscapePlugInStreamLoader.cpp in Sources */,
 				59C27F05138D28C10079B7E2 /* NetworkResourcesData.cpp in Sources */,
 				1A7FA61B0DDA3BBE0028F8A5 /* NetworkStateNotifier.cpp in Sources */,
@@ -26537,20 +26766,20 @@
 				F4EAF4AE10C742B1009100D3 /* OpenTypeSanitizer.cpp in Sources */,
 				978D07B8145A0F1B0096908D /* OperationNotAllowedException.cpp in Sources */,
 				0014628A103CD1DE000B20DB /* OriginAccessEntry.cpp in Sources */,
-				51A9267C0D53F0570063ECC2 /* OriginQuotaManager.cpp in Sources */,
-				51A9267E0D53F0570063ECC2 /* OriginUsageRecord.cpp in Sources */,
+				97BC6A371505F081001B74AC /* OriginQuotaManager.cpp in Sources */,
+				97BC6A391505F081001B74AC /* OriginUsageRecord.cpp in Sources */,
 				1A0D57360A5C77FE007EDD4C /* OverflowEvent.cpp in Sources */,
 				65FEA86909833ADE00BED4AB /* Page.cpp in Sources */,
 				1477E7760BF4134A00152872 /* PageCache.cpp in Sources */,
 				F3820892147D35F90010BC06 /* PageConsoleAgent.cpp in Sources */,
 				F34742DC134362F000531BC2 /* PageDebuggerAgent.cpp in Sources */,
 				9302B0BD0D79F82900C7EE83 /* PageGroup.cpp in Sources */,
+				9712A60415004EDA0048AF10 /* PageGroupIndexedDatabase.cpp in Sources */,
 				7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */,
 				1C26497C0D7E24EC00BD10F2 /* PageMac.cpp in Sources */,
 				F3820894147D35F90010BC06 /* PageRuntimeAgent.cpp in Sources */,
 				F34742E41343633C00531BC2 /* PageScriptDebugServer.cpp in Sources */,
 				371E65CE13661EED00BEEDB0 /* PageSerializer.cpp in Sources */,
-				A71E083714E3CEAF006A4619 /* PageSupplement.cpp in Sources */,
 				E1284AEA10447DEE00EAEB52 /* PageTransitionEvent.cpp in Sources */,
 				51E1ECC20C91C90400DC255B /* PageURLRecord.cpp in Sources */,
 				FFD5B97A135CC97800D5E92A /* PageVisibilityState.cpp in Sources */,
@@ -26612,6 +26841,7 @@
 				FD31603B12B0267600C1A359 /* RealtimeAnalyser.cpp in Sources */,
 				FD31603D12B0267600C1A359 /* RealtimeAnalyserNode.cpp in Sources */,
 				BCAB418113E356E800D8AAF3 /* Region.cpp in Sources */,
+				8ABAFB9F14F5107500A4984B /* RegionNodeList.cpp in Sources */,
 				85031B4B0A44EFC700F992E0 /* RegisteredEventListener.cpp in Sources */,
 				B2C3DA2C0D006C1D00EF6F26 /* RegularExpression.cpp in Sources */,
 				93309E00099E64920056E581 /* RemoveCSSPropertyCommand.cpp in Sources */,
@@ -26629,7 +26859,6 @@
 				BCE4413312F748E2009B84B8 /* RenderCombineText.cpp in Sources */,
 				9392F1440AD185FE00691BD4 /* RenderCounter.cpp in Sources */,
 				BCEA486D097D93020094C9E4 /* RenderDeprecatedFlexibleBox.cpp in Sources */,
-				D302754712A5FE84004BD828 /* RenderDetails.cpp in Sources */,
 				D302754912A5FE84004BD828 /* RenderDetailsMarker.cpp in Sources */,
 				9B32CDAA13DF7FA900F34D13 /* RenderedPosition.cpp in Sources */,
 				0F5B7A5410F65D7A00376302 /* RenderEmbeddedObject.cpp in Sources */,
@@ -26687,7 +26916,6 @@
 				BC3BE9A50E9C239600835588 /* RenderScrollbarTheme.cpp in Sources */,
 				AB247A6C0AFD6383003FA5FD /* RenderSlider.cpp in Sources */,
 				BC8C8FAD0DDCD31B00B592F4 /* RenderStyle.cpp in Sources */,
-				D302754D12A5FEAB004BD828 /* RenderSummary.cpp in Sources */,
 				0F4E57171313276200CF85AF /* RenderSVGAllInOne.cpp in Sources */,
 				A8DF4AEC0980C42C0052981B /* RenderTable.cpp in Sources */,
 				6ED878C4147493F4004C3597 /* RenderTableCaption.cpp in Sources */,
@@ -26815,7 +27043,7 @@
 				0F3DD44F12F5EA1B000D9190 /* ShadowBlur.cpp in Sources */,
 				BC5EB8C30E82031B00B25965 /* ShadowData.cpp in Sources */,
 				A6D169621346B49B000EB770 /* ShadowRoot.cpp in Sources */,
-				572E92FB14E540580087FFBA /* ShadowRootList.cpp in Sources */,
+				57CF4C8614F7597A00ECFF14 /* ShadowTree.cpp in Sources */,
 				A80E6CF40A1989CA007FB8C5 /* ShadowValue.cpp in Sources */,
 				B2AFFC930D00A5DF0030074D /* ShapeArabic.c in Sources */,
 				1A4A954D0B4EDCCB002D8C3C /* SharedBuffer.cpp in Sources */,
@@ -26857,20 +27085,20 @@
 				93309E13099E64920056E581 /* SplitTextNodeCommand.cpp in Sources */,
 				93309E15099E64920056E581 /* SplitTextNodeContainingElementCommand.cpp in Sources */,
 				A1E1154813015C5D0054AC8C /* SpotLightSource.cpp in Sources */,
-				978D07B4145A0ECD0096908D /* SQLException.cpp in Sources */,
+				97BC6A3E1505F081001B74AC /* SQLException.cpp in Sources */,
 				1A2E6E7A0CC556D5004A2062 /* SQLiteAuthorizer.cpp in Sources */,
 				1A2246490CC98DDB00C05240 /* SQLiteDatabase.cpp in Sources */,
 				B5A684240FFABEAA00D24689 /* SQLiteFileSystem.cpp in Sources */,
 				1A22464B0CC98DDB00C05240 /* SQLiteStatement.cpp in Sources */,
 				1A22464D0CC98DDB00C05240 /* SQLiteTransaction.cpp in Sources */,
-				519611730CAC56570010A80C /* SQLResultSet.cpp in Sources */,
-				1AFE117D0CBFFB36003017FA /* SQLResultSetRowList.cpp in Sources */,
-				515B039A0CD1642A00B7EA9C /* SQLStatement.cpp in Sources */,
-				B550B52511DC68A800923885 /* SQLStatementSync.cpp in Sources */,
-				1ABFE7530CD968D000FE4834 /* SQLTransaction.cpp in Sources */,
-				B51BF6F0102C9E590002C15A /* SQLTransactionClient.cpp in Sources */,
-				B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */,
-				B523CF091182675400EBB29C /* SQLTransactionSync.cpp in Sources */,
+				97BC6A411505F081001B74AC /* SQLResultSet.cpp in Sources */,
+				97BC6A441505F081001B74AC /* SQLResultSetRowList.cpp in Sources */,
+				97BC6A471505F081001B74AC /* SQLStatement.cpp in Sources */,
+				97BC6A4D1505F081001B74AC /* SQLStatementSync.cpp in Sources */,
+				97BC6A4F1505F081001B74AC /* SQLTransaction.cpp in Sources */,
+				97BC6A541505F081001B74AC /* SQLTransactionClient.cpp in Sources */,
+				97BC6A561505F081001B74AC /* SQLTransactionCoordinator.cpp in Sources */,
+				97BC6A5A1505F081001B74AC /* SQLTransactionSync.cpp in Sources */,
 				1A2E6E590CC55213004A2062 /* SQLValue.cpp in Sources */,
 				93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.cpp in Sources */,
 				CEA3949C11D45CDA003094CF /* StaticHashSetNodeList.cpp in Sources */,
@@ -26886,6 +27114,8 @@
 				C50D0E820FF4272900AC2644 /* StorageNamespace.cpp in Sources */,
 				C55E38C010040D5D00A56BDB /* StorageNamespaceImpl.cpp in Sources */,
 				C5102D950FD9AA2D00FAFF04 /* StorageSyncManager.cpp in Sources */,
+				511F23170DC160DA004F0032 /* StorageTask.cpp in Sources */,
+				511F23190DC160DA004F0032 /* StorageThread.cpp in Sources */,
 				3AB02D2B12D4F91600FBB694 /* StorageTracker.cpp in Sources */,
 				B2C3DA300D006C1D00EF6F26 /* String.cpp in Sources */,
 				8102C5881325BB1100DDE67A /* StringCallback.cpp in Sources */,
@@ -26905,6 +27135,7 @@
 				5317612213C516690026E454 /* StyleFlexibleBoxData.cpp in Sources */,
 				BCEF447D0E674806001C1287 /* StyleGeneratedImage.cpp in Sources */,
 				A10DC76A14747BAB005E2471 /* StyleGridData.cpp in Sources */,
+				A110DB9D14F5DF8700A03B93 /* StyleGridItemData.cpp in Sources */,
 				BC2273030E82F1E600E7F975 /* StyleInheritedData.cpp in Sources */,
 				BC5EB7290E81DE8100B25965 /* StyleMarqueeData.cpp in Sources */,
 				0FF50271102BA96A0066F39A /* StyleMedia.cpp in Sources */,
@@ -26912,6 +27143,7 @@
 				A80E6DFB0A199067007FB8C5 /* StylePropertySet.cpp in Sources */,
 				BC2272E30E82EE9B00E7F975 /* StyleRareInheritedData.cpp in Sources */,
 				BC2272BC0E82EAAE00E7F975 /* StyleRareNonInheritedData.cpp in Sources */,
+				E4BBED4C14FCDBA1003F0B98 /* StyleRule.cpp in Sources */,
 				A8EA800D0A19516E00A8EF5F /* StyleSheet.cpp in Sources */,
 				A8EA800B0A19516E00A8EF5F /* StyleSheetList.cpp in Sources */,
 				BC5EB5E70E81BFEF00B25965 /* StyleSurroundData.cpp in Sources */,
@@ -27131,8 +27363,8 @@
 				BCE659E90EA92FFA007E4533 /* ThemeMac.mm in Sources */,
 				976D6C94122B8A3D001FD1F7 /* ThreadableBlobRegistry.cpp in Sources */,
 				0B90561E0F257E930095FF6A /* ThreadableLoader.cpp in Sources */,
-				5112247210CFB8C6008099D7 /* ThreadableWebSocketChannel.cpp in Sources */,
-				510F079B11FEE9C000B8EE49 /* ThreadableWebSocketChannelClientWrapper.cpp in Sources */,
+				97AABD1614FA09D5007457AE /* ThreadableWebSocketChannel.cpp in Sources */,
+				97AABD1814FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.cpp in Sources */,
 				51DF6D800B92A18E00C2DC85 /* ThreadCheck.mm in Sources */,
 				E1FF57A60F01256B00891EBB /* ThreadGlobalData.cpp in Sources */,
 				185BCF280F3279CE000EA262 /* ThreadTimers.cpp in Sources */,
@@ -27183,6 +27415,7 @@
 				37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */,
 				93F19B0708245E59001E9ABC /* WebCoreView.m in Sources */,
 				BC6DADFA0A19602B00E5CD14 /* WebFontCache.mm in Sources */,
+				CD127DED14F3097D00E84779 /* WebCoreFullScreenWindow.mm in Sources */,
 				49C7B9C81042D32F0009D447 /* WebGLBuffer.cpp in Sources */,
 				6E3FAE8E14733FDB00E42306 /* WebGLCompressedTextureS3TC.cpp in Sources */,
 				6E4E91AE10F7FB3100A2779C /* WebGLContextAttributes.cpp in Sources */,
@@ -27223,13 +27456,14 @@
 				0FCF332E0F2B9A25004B6795 /* WebLayer.mm in Sources */,
 				E1A3162E134BC32D007C9A4F /* WebNSAttributedStringExtras.mm in Sources */,
 				1CAF34820A6C405200ABE06E /* WebScriptObject.mm in Sources */,
-				518A34C11026C831001B6896 /* WebSocket.cpp in Sources */,
-				510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */,
-				4AE02ABD14E8A9D200BC3BA7 /* WebSocketDeflater.cpp in Sources */,
-				4A957F0614E2412A0049DBFB /* WebSocketExtensionDispatcher.cpp in Sources */,
-				51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */,
-				7637C541112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp in Sources */,
-				767F99BE11A1194A0080C51D /* WebSocketHandshakeResponse.cpp in Sources */,
+				97AABD1A14FA09D5007457AE /* WebSocket.cpp in Sources */,
+				97AABD1D14FA09D5007457AE /* WebSocketChannel.cpp in Sources */,
+				4A38BF5014FE1C0900612512 /* WebSocketDeflateFramer.cpp in Sources */,
+				97AABD2014FA09D5007457AE /* WebSocketDeflater.cpp in Sources */,
+				97AABD2214FA09D5007457AE /* WebSocketExtensionDispatcher.cpp in Sources */,
+				97AABD2614FA09D5007457AE /* WebSocketHandshake.cpp in Sources */,
+				97AABD2814FA09D5007457AE /* WebSocketHandshakeRequest.cpp in Sources */,
+				97AABD2A14FA09D5007457AE /* WebSocketHandshakeResponse.cpp in Sources */,
 				0F580FA41496939100FB5BD8 /* WebTileCacheLayer.mm in Sources */,
 				0FCF332C0F2B9A25004B6795 /* WebTiledLayer.mm in Sources */,
 				1AA7161E149BF2FA0016EC19 /* WebTileLayer.mm in Sources */,
@@ -27249,6 +27483,8 @@
 				2E4346450F546A8200B0F1BA /* Worker.cpp in Sources */,
 				F3820896147D35F90010BC06 /* WorkerConsoleAgent.cpp in Sources */,
 				2E4346480F546A8200B0F1BA /* WorkerContext.cpp in Sources */,
+				9712A611150090CE0048AF10 /* WorkerContextIndexedDatabase.cpp in Sources */,
+				97BC6A5F1505F081001B74AC /* WorkerContextSQLDatabase.cpp in Sources */,
 				F34742E01343631F00531BC2 /* WorkerDebuggerAgent.cpp in Sources */,
 				A3E2643014748991005A8588 /* WorkerEventQueue.cpp in Sources */,
 				F36E07A41358A8BE00AACBC9 /* WorkerInspectorController.cpp in Sources */,
@@ -27262,7 +27498,7 @@
 				A7D6B34A0F61104500B79FD1 /* WorkerScriptLoader.cpp in Sources */,
 				2E4346540F546A8200B0F1BA /* WorkerThread.cpp in Sources */,
 				0B9056F80F2685F30095FF6A /* WorkerThreadableLoader.cpp in Sources */,
-				5112247810CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp in Sources */,
+				97AABD2C14FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp in Sources */,
 				93309E23099E64920056E581 /* WrapContentsInDummySpanCommand.cpp in Sources */,
 				A833C7CC0A2CF07400D57664 /* XLinkNames.cpp in Sources */,
 				00D0464A13C4D14500326FCC /* XMLCharacterReferenceParser.cpp in Sources */,
@@ -27304,6 +27540,10 @@
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				977E2E0E12F0FC9C00C13379 /* XSSAuditor.cpp in Sources */,
 				FD537352137B651800008DCE /* ZeroPole.cpp in Sources */,
+				E1CDE92015018ED000862CC5 /* AsyncFileStream.cpp in Sources */,
+				450CEBF015073BBE002BB149 /* LabelableElement.cpp in Sources */,
+				C5B4C24E1509236C00A6EF37 /* WebCoreNSURLExtras.mm in Sources */,
+				9B2B7AC11509850A008932CC /* MicroDataItemValue.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebCore/WebCorePrefix.h b/Source/WebCore/WebCorePrefix.h
index 142c6abfc..75fe70de2 100644
--- a/Source/WebCore/WebCorePrefix.h
+++ b/Source/WebCore/WebCorePrefix.h
@@ -99,18 +99,16 @@
 
 #include <type_traits>
 
+namespace WebCore {
+    class TimerHeapReference;
+}
+
 _LIBCPP_BEGIN_NAMESPACE_STD
 
-template <class _Tp>
 inline _LIBCPP_INLINE_VISIBILITY
-typename enable_if
-<
-    !is_convertible<_Tp, __rv<_Tp> >::value,
-    const _Tp&
->::type
-move(const _Tp& __t)
+const WebCore::TimerHeapReference& move(const WebCore::TimerHeapReference& t)
 {
-    return __t;
+    return t;
 }
 
 _LIBCPP_END_NAMESPACE_STD
diff --git a/Source/WebCore/accessibility/AccessibilitySlider.cpp b/Source/WebCore/accessibility/AccessibilitySlider.cpp
index e53ee20a7..9751e7826 100644
--- a/Source/WebCore/accessibility/AccessibilitySlider.cpp
+++ b/Source/WebCore/accessibility/AccessibilitySlider.cpp
@@ -65,6 +65,7 @@ AccessibilityOrientation AccessibilitySlider::orientation() const
     case SliderThumbHorizontalPart:
     case SliderHorizontalPart:
     case MediaSliderPart:
+    case MediaFullScreenVolumeSliderPart:
         return AccessibilityOrientationHorizontal;
     
     case SliderThumbVerticalPart: 
diff --git a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
index 6bc4c63eb..edd72236c 100644
--- a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
+++ b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
@@ -44,6 +44,7 @@
 #import "AccessibilityTableRow.h"
 #import "Chrome.h"
 #import "ColorMac.h"
+#import "ContextMenuController.h"
 #import "Frame.h"
 #import "FrameLoaderClient.h"
 #import "FrameSelection.h"
@@ -2614,14 +2615,7 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     Page* page = frame->page();
     if (!page)
         return;
-
-    // Simulate a click in the middle of the object.
-    IntPoint clickPoint = m_object->clickPoint();
-    
-    PlatformMouseEvent mouseEvent(clickPoint, clickPoint, RightButton, PlatformEvent::MousePressed, 1, false, false, false, false, currentTime());
-    bool handled = frame->eventHandler()->sendContextMenuEvent(mouseEvent);
-    if (handled)
-        page->chrome()->showContextMenu();
+    page->contextMenuController()->showContextMenuAt(frame, m_object->clickPoint());
 }
 
 - (void)accessibilityPerformAction:(NSString*)action
diff --git a/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp b/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
index c2041d3df..da840d949 100644
--- a/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
+++ b/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010. 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -33,111 +33,39 @@
 
 #include "ActiveDOMObject.h"
 #include "ScriptExecutionContext.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/ThreadingPrimitives.h>
 
-namespace WebCore {
-
-static void destroyOnContextThread(PassOwnPtr<ActiveDOMObjectCallbackImpl>);
-
-class DestroyOnContextThreadTask : public ScriptExecutionContext::Task {
-public:
-    static PassOwnPtr<DestroyOnContextThreadTask> create(PassOwnPtr<ActiveDOMObjectCallbackImpl> impl)
-    {
-        return adoptPtr(new DestroyOnContextThreadTask(impl));
-    }
-
-    virtual void performTask(ScriptExecutionContext*)
-    {
-        destroyOnContextThread(m_impl.release());
-    }
-
-private:
-    DestroyOnContextThreadTask(PassOwnPtr<ActiveDOMObjectCallbackImpl> impl)
-        : m_impl(impl)
-    {
-    }
-
-    OwnPtr<ActiveDOMObjectCallbackImpl> m_impl;
-};
-
-class ActiveDOMObjectCallbackImpl : public ActiveDOMObject {
-public:
-    ActiveDOMObjectCallbackImpl(ScriptExecutionContext* context)
-        : ActiveDOMObject(context, this)
-        , m_suspended(false)
-        , m_stopped(false)
-    {
-    }
-
-    virtual void contextDestroyed()
-    {
-        MutexLocker locker(m_mutex);
-        ActiveDOMObject::contextDestroyed();
-    }
-    virtual bool canSuspend() const { return false; }
-    virtual void suspend(ReasonForSuspension)
-    {
-        MutexLocker locker(m_mutex);
-        m_suspended = true;
-    }
-    virtual void resume()
-    {
-        MutexLocker locker(m_mutex);
-        m_suspended = false;
-    }
-    virtual void stop()
-    {
-        MutexLocker locker(m_mutex);
-        m_stopped = true;
-    }
-    bool canInvokeCallback()
-    {
-        MutexLocker locker(m_mutex);
-        return (!m_suspended && !m_stopped);
-    }
-    ScriptExecutionContext* scriptExecutionContext()
-    {
-        MutexLocker locker(m_mutex);
-        return ActiveDOMObject::scriptExecutionContext();
-    }
-    Mutex& mutex() { return m_mutex; }
+#if ENABLE(WORKERS)
+#include "WorkerContext.h"
+#endif
 
-private:
-    Mutex m_mutex;
-    bool m_suspended;
-    bool m_stopped;
-};
-
-static void destroyOnContextThread(PassOwnPtr<ActiveDOMObjectCallbackImpl> impl)
-{
-    OwnPtr<ActiveDOMObjectCallbackImpl> implOwnPtr = impl;
-
-    ScriptExecutionContext* context = implOwnPtr->scriptExecutionContext();
-    MutexLocker locker(implOwnPtr->mutex());
-    if (context && !context->isContextThread())
-        context->postTask(DestroyOnContextThreadTask::create(implOwnPtr.release()));
-}
+namespace WebCore {
 
 ActiveDOMCallback::ActiveDOMCallback(ScriptExecutionContext* context)
-    : m_impl(adoptPtr(new ActiveDOMObjectCallbackImpl(context)))
+    : ContextDestructionObserver(context)
 {
-    m_impl->suspendIfNeeded();
 }
 
 ActiveDOMCallback::~ActiveDOMCallback()
 {
-    destroyOnContextThread(m_impl.release());
 }
 
 bool ActiveDOMCallback::canInvokeCallback() const
 {
-    return m_impl->canInvokeCallback();
+    ScriptExecutionContext* context = scriptExecutionContext();
+    return context && !context->activeDOMObjectsAreSuspended() && !context->activeDOMObjectsAreStopped();
 }
 
-ScriptExecutionContext* ActiveDOMCallback::scriptExecutionContext() const
+bool ActiveDOMCallback::isScriptControllerTerminating() const
 {
-    return m_impl->scriptExecutionContext();
+#if ENABLE(WORKERS)
+    ScriptExecutionContext* context = scriptExecutionContext();
+    if (context && context->isWorkerContext()) {
+        WorkerScriptController* scriptController = static_cast<WorkerContext*>(context)->script();
+        if (!scriptController || scriptController->isExecutionForbidden() || scriptController->isExecutionTerminating())
+            return true;
+    }
+#endif
+    return false;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/generic/ActiveDOMCallback.h b/Source/WebCore/bindings/generic/ActiveDOMCallback.h
index 2fe99ab53..af3e1f6f2 100644
--- a/Source/WebCore/bindings/generic/ActiveDOMCallback.h
+++ b/Source/WebCore/bindings/generic/ActiveDOMCallback.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,26 +31,27 @@
 #ifndef ActiveDOMCallback_h
 #define ActiveDOMCallback_h
 
+#include "ContextDestructionObserver.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
-class ActiveDOMObjectCallbackImpl;
 class ScriptExecutionContext;
 
-// A class that allows callbacks to behave like ActiveDOMObjects, and also
-// be destroyed on the context thread or any other thread.
-class ActiveDOMCallback {
+// A base class that prevents binding callbacks from executing when
+// active dom objects are stopped or suspended, and is used by the
+// generated callback v8 bindings code to avoid erroneously CRASH()'ing
+// after script execution on a worker has been scheduled to terminate.
+//
+// Should only be created, used, and destroyed on the script execution
+// context thread.
+class ActiveDOMCallback : public ContextDestructionObserver {
 public:
     ActiveDOMCallback(ScriptExecutionContext* context);
-    ~ActiveDOMCallback();
+    virtual ~ActiveDOMCallback();
 
     bool canInvokeCallback() const;
-    ScriptExecutionContext* scriptExecutionContext() const;
-
-private:
-    // The ActiveDOMObject part of the callback.
-    OwnPtr<ActiveDOMObjectCallbackImpl> m_impl;
+    bool isScriptControllerTerminating() const;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index 8fad2c5d7..15f94d4d9 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -56,6 +56,10 @@ bool RuntimeEnabledFeatures::isDeviceMotionEnabled = true;
 bool RuntimeEnabledFeatures::isDeviceOrientationEnabled = true;
 bool RuntimeEnabledFeatures::isSpeechInputEnabled = true;
 
+#if ENABLE(SCRIPTED_SPEECH)
+bool RuntimeEnabledFeatures::isScriptedSpeechEnabled = false;
+#endif
+
 #if ENABLE(MEDIA_STREAM)
 bool RuntimeEnabledFeatures::isMediaStreamEnabled = true;
 #endif
@@ -181,6 +185,11 @@ bool RuntimeEnabledFeatures::isMediaSourceEnabled = false;
 #endif
 
 #if ENABLE(SHADOW_DOM)
+void RuntimeEnabledFeatures::setMultipleShadowSubtreesEnabled(bool isEnabled)
+{
+    isMultipleShadowSubtreesEnabled = isEnabled;
+}
+
 bool RuntimeEnabledFeatures::isShadowDOMEnabled = false;
 bool RuntimeEnabledFeatures::isMultipleShadowSubtreesEnabled = false;
 #endif
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 36065c82a..ee38d04e2 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -147,6 +147,16 @@ public:
     static bool webkitSpeechEnabled() { return isSpeechInputEnabled; }
     static bool webkitGrammarEnabled() { return isSpeechInputEnabled; }
 
+#if ENABLE(SCRIPTED_SPEECH)
+    static void setScriptedSpeechEnabled(bool isEnabled) { isScriptedSpeechEnabled = isEnabled; }
+    static bool scriptedSpeechEnabled() { return isScriptedSpeechEnabled; }
+    static bool webkitSpeechRecognitionEnabled() { return isScriptedSpeechEnabled; }
+    static bool webkitSpeechRecognitionErrorEnabled() { return isScriptedSpeechEnabled; }
+    static bool webkitSpeechRecognitionEventEnabled() { return isScriptedSpeechEnabled; }
+    static bool webkitSpeechGrammarEnabled() { return isScriptedSpeechEnabled; }
+    static bool webkitSpeechGrammarListEnabled() { return isScriptedSpeechEnabled; }
+#endif
+
 #if ENABLE(XHR_RESPONSE_BLOB)
     static bool xhrResponseBlobEnabled() { return isXHRResponseBlobEnabled; }
     static void setXHRResponseBlobEnabled(bool isEnabled) { isXHRResponseBlobEnabled = isEnabled; }
@@ -196,7 +206,7 @@ public:
     static void setShadowDOMEnabled(bool isEnabled) { isShadowDOMEnabled = isEnabled; }
 
     static bool multipleShadowSubtreesEnabled() { return isMultipleShadowSubtreesEnabled; }
-    static void setMultipleShadowSubtreesEnabled(bool isEnabled) { isMultipleShadowSubtreesEnabled = isEnabled; }
+    static void setMultipleShadowSubtreesEnabled(bool isEnabled);
 #endif
 
 #if ENABLE(STYLE_SCOPED)
@@ -221,6 +231,9 @@ private:
     static bool isDeviceMotionEnabled;
     static bool isDeviceOrientationEnabled;
     static bool isSpeechInputEnabled;
+#if ENABLE(SCRIPTED_SPEECH)
+    static bool isScriptedSpeechEnabled;
+#endif
 #if ENABLE(XHR_RESPONSE_BLOB)
     static bool isXHRResponseBlobEnabled;
 #endif
diff --git a/Source/WebCore/bindings/js/JSAudioContextCustom.cpp b/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
index f8fab6266..64e44e63f 100644
--- a/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
+++ b/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
@@ -101,7 +101,7 @@ EncodedJSValue JSC_HOST_CALL JSAudioContextConstructor::constructJSAudioContext(
     if (!audioContext.get())
         return throwVMError(exec, createReferenceError(exec, "Error creating AudioContext"));
 
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), audioContext.get())));
+    return JSValue::encode(CREATE_DOM_WRAPPER(exec, jsConstructor->globalObject(), AudioContext, audioContext.get()));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 8518cde35..aaa117170 100644
--- a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -58,6 +58,12 @@ void JSCSSStyleDeclaration::visitChildren(JSCell* cell, SlotVisitor& visitor)
     visitor.addOpaqueRoot(root(thisObject->impl()));
 }
 
+class CSSPropertyInfo {
+public:
+    int propertyID;
+    bool hadPixelOrPosPrefix;
+};
+
 enum PropertyNamePrefix
 {
     PropertyNamePrefixNone,
@@ -161,16 +167,23 @@ static inline void writeEpubPrefix(char*& buffer)
     *buffer++ = '-';
 }
 
-static int cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName, bool* hadPixelOrPosPrefix = 0)
+static CSSPropertyInfo cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName)
 {
-    if (hadPixelOrPosPrefix)
-        *hadPixelOrPosPrefix = false;
+    CSSPropertyInfo propertyInfo = {0, false};
+    bool hadPixelOrPosPrefix = false;
 
     unsigned length = propertyName.length();
     if (!length)
-        return 0;
+        return propertyInfo;
 
     StringImpl* propertyNameString = propertyName.impl();
+    String stringForCache = String(propertyNameString);
+    typedef HashMap<String, CSSPropertyInfo> CSSPropertyInfoMap;
+    DEFINE_STATIC_LOCAL(CSSPropertyInfoMap, propertyInfoCache, ());
+    propertyInfo = propertyInfoCache.get(stringForCache);
+    if (propertyInfo.propertyID)
+        return propertyInfo;
+
     const size_t bufferSize = maxCSSPropertyNameLength + 1;
     char buffer[bufferSize];
     char* bufferPtr = buffer;
@@ -183,20 +196,18 @@ static int cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName, boo
     switch (getCSSPropertyNamePrefix(*propertyNameString)) {
     case PropertyNamePrefixNone:
         if (isASCIIUpper((*propertyNameString)[0]))
-            return 0;
+            return propertyInfo;
         break;
     case PropertyNamePrefixCSS:
         i += 3;
         break;
     case PropertyNamePrefixPixel:
         i += 5;
-        if (hadPixelOrPosPrefix)
-            *hadPixelOrPosPrefix = true;
+        hadPixelOrPosPrefix = true;
         break;
     case PropertyNamePrefixPos:
         i += 3;
-        if (hadPixelOrPosPrefix)
-            *hadPixelOrPosPrefix = true;
+        hadPixelOrPosPrefix = true;
         break;
     case PropertyNamePrefixApple:
     case PropertyNamePrefixKHTML:
@@ -220,17 +231,17 @@ static int cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName, boo
     size_t bufferSizeLeft = stringEnd - bufferPtr;
     size_t propertySizeLeft = length - i;
     if (propertySizeLeft > bufferSizeLeft)
-        return 0;
+        return propertyInfo;
 
     for (; i < length; ++i) {
         UChar c = (*propertyNameString)[i];
         if (!c || c >= 0x7F)
-            return 0; // illegal character
+            return propertyInfo; // illegal character
         if (isASCIIUpper(c)) {
             size_t bufferSizeLeft = stringEnd - bufferPtr;
             size_t propertySizeLeft = length - i + 1;
             if (propertySizeLeft > bufferSizeLeft)
-                return 0;
+                return propertyInfo;
             *bufferPtr++ = '-';
             *bufferPtr++ = toASCIILower(c);
         } else
@@ -246,54 +257,97 @@ static int cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName, boo
 #endif
 
     const Property* hashTableEntry = findProperty(name, outputLength);
-    return hashTableEntry ? hashTableEntry->id : 0;
-}
-
-static bool isCSSPropertyName(const Identifier& propertyIdentifier)
-{
-    return cssPropertyIDForJSCSSPropertyName(propertyIdentifier);
+    int propertyID = hashTableEntry ? hashTableEntry->id : 0;
+    if (propertyID) {
+        propertyInfo.hadPixelOrPosPrefix = hadPixelOrPosPrefix;
+        propertyInfo.propertyID = propertyID;
+        propertyInfoCache.add(stringForCache, propertyInfo);
+    }
+    return propertyInfo;
 }
 
-bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*, const Identifier& propertyName)
+static inline JSValue getPropertyValueFallback(ExecState* exec, JSCSSStyleDeclaration* thisObj, unsigned index)
 {
-    return isCSSPropertyName(propertyName);
+    // If the property is a shorthand property (such as "padding"),
+    // it can only be accessed using getPropertyValue.
+    return jsString(exec, thisObj->impl()->getPropertyValueInternal(static_cast<CSSPropertyID>(index)));
 }
 
-JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+static inline JSValue cssPropertyGetterPixelOrPosPrefix(ExecState* exec, JSCSSStyleDeclaration* thisObj, unsigned propertyID)
 {
-    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
-
     // Set up pixelOrPos boolean to handle the fact that
     // pixelTop returns "CSS Top" as number value in unit pixels
     // posTop returns "CSS top" as number value in unit pixels _if_ its a
     // positioned element. if it is not a positioned element, return 0
     // from MSIE documentation FIXME: IMPLEMENT THAT (Dirk)
-    bool pixelOrPos;
-    int cssPropertyID = cssPropertyIDForJSCSSPropertyName(propertyName, &pixelOrPos);
-    RefPtr<CSSValue> v = thisObj->impl()->getPropertyCSSValueInternal(static_cast<CSSPropertyID>(cssPropertyID));
+    RefPtr<CSSValue> v = thisObj->impl()->getPropertyCSSValueInternal(static_cast<CSSPropertyID>(propertyID));
     if (v) {
-        if (pixelOrPos && v->isPrimitiveValue())
+        if (v->isPrimitiveValue())
             return jsNumber(static_pointer_cast<CSSPrimitiveValue>(v)->getFloatValue(CSSPrimitiveValue::CSS_PX));
         return jsStringOrNull(exec, v->cssText());
     }
 
-    // If the property is a shorthand property (such as "padding"), 
-    // it can only be accessed using getPropertyValue.
-    return jsString(exec, thisObj->impl()->getPropertyValueInternal(static_cast<CSSPropertyID>(cssPropertyID)));
+    return getPropertyValueFallback(exec, thisObj, propertyID);
+}
+
+static JSValue cssPropertyGetterPixelOrPosPrefixCallback(ExecState* exec, JSValue slotBase, unsigned propertyID)
+{
+    return cssPropertyGetterPixelOrPosPrefix(exec, static_cast<JSCSSStyleDeclaration*>(asObject(slotBase)), propertyID);
+}
+
+static inline JSValue cssPropertyGetter(ExecState* exec, JSCSSStyleDeclaration* thisObj, unsigned propertyID)
+{
+    RefPtr<CSSValue> v = thisObj->impl()->getPropertyCSSValueInternal(static_cast<CSSPropertyID>(propertyID));
+    if (v)
+        return jsStringOrNull(exec, v->cssText());
+
+    return getPropertyValueFallback(exec, thisObj, propertyID);
+}
+
+static JSValue cssPropertyGetterCallback(ExecState* exec, JSValue slotBase, unsigned propertyID)
+{
+    return cssPropertyGetter(exec, static_cast<JSCSSStyleDeclaration*>(asObject(slotBase)), propertyID);
+}
+
+bool JSCSSStyleDeclaration::getOwnPropertySlotDelegate(ExecState*, const Identifier& propertyIdentifier, PropertySlot& slot)
+{
+    CSSPropertyInfo propertyInfo = cssPropertyIDForJSCSSPropertyName(propertyIdentifier);
+    if (!propertyInfo.propertyID)
+        return false;
+
+    if (propertyInfo.hadPixelOrPosPrefix)
+        slot.setCustomIndex(this, static_cast<unsigned>(propertyInfo.propertyID), cssPropertyGetterPixelOrPosPrefixCallback);
+    else
+        slot.setCustomIndex(this, static_cast<unsigned>(propertyInfo.propertyID), cssPropertyGetterCallback);
+    return true;
+}
+
+bool JSCSSStyleDeclaration::getOwnPropertyDescriptorDelegate(JSC::ExecState* exec, const JSC::Identifier& propertyIdentifier, JSC::PropertyDescriptor& descriptor)
+{
+    CSSPropertyInfo propertyInfo = cssPropertyIDForJSCSSPropertyName(propertyIdentifier);
+    if (!propertyInfo.propertyID)
+        return false;
+
+    JSValue value;
+    if (propertyInfo.hadPixelOrPosPrefix)
+        value = cssPropertyGetterPixelOrPosPrefix(exec, this, propertyInfo.propertyID);
+    else
+        value = cssPropertyGetter(exec, this, propertyInfo.propertyID);
+    descriptor.setDescriptor(value, ReadOnly | DontDelete | DontEnum);
+    return true;
 }
 
 bool JSCSSStyleDeclaration::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
-    bool pixelOrPos;
-    int cssPropertyID = cssPropertyIDForJSCSSPropertyName(propertyName, &pixelOrPos);
-    if (!cssPropertyID)
+    CSSPropertyInfo propertyInfo = cssPropertyIDForJSCSSPropertyName(propertyName);
+    if (!propertyInfo.propertyID)
         return false;
 
     String propValue = valueToStringWithNullCheck(exec, value);
-    if (pixelOrPos)
+    if (propertyInfo.hadPixelOrPosPrefix)
         propValue += "px";
     ExceptionCode ec = 0;
-    impl()->setPropertyInternal(static_cast<CSSPropertyID>(cssPropertyID), propValue, false, ec);
+    impl()->setPropertyInternal(static_cast<CSSPropertyID>(propertyInfo.propertyID), propValue, false, ec);
     setDOMException(exec, ec);
     return true;
 }
diff --git a/Source/WebCore/bindings/js/JSCallbackData.cpp b/Source/WebCore/bindings/js/JSCallbackData.cpp
index 332437561..1c0c452d9 100644
--- a/Source/WebCore/bindings/js/JSCallbackData.cpp
+++ b/Source/WebCore/bindings/js/JSCallbackData.cpp
@@ -65,16 +65,14 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
         return JSValue();
 
     globalObject()->globalData().timeoutChecker.start();
+    InspectorInstrumentationCookie cookie = JSMainThreadExecState::instrumentFunctionCall(context, callType, callData);
 
     bool contextIsDocument = context->isDocument();
-    JSValue result;
-    if (contextIsDocument) {
-        Frame* frame = static_cast<JSDOMWindow*>(globalObject())->impl()->frame();
-        Page* page = frame ? frame->page() : 0;
-        result = JSMainThreadExecState::instrumentedCall(page, exec, function, callType, callData, callback(), args);
-    } else
-        result = JSC::call(exec, function, callType, callData, callback(), args);
+    JSValue result = contextIsDocument
+        ? JSMainThreadExecState::call(exec, function, callType, callData, callback(), args)
+        : JSC::call(exec, function, callType, callData, callback(), args);
 
+    InspectorInstrumentation::didCallFunction(cookie);
     globalObject()->globalData().timeoutChecker.stop();
 
     if (contextIsDocument)
diff --git a/Source/WebCore/bindings/js/JSClipboardCustom.cpp b/Source/WebCore/bindings/js/JSClipboardCustom.cpp
index 3532c7859..8cfd65a29 100644
--- a/Source/WebCore/bindings/js/JSClipboardCustom.cpp
+++ b/Source/WebCore/bindings/js/JSClipboardCustom.cpp
@@ -48,6 +48,21 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+JSValue JSClipboard::types(ExecState* exec) const
+{
+    Clipboard* clipboard = impl();
+
+    HashSet<String> types = clipboard->types();
+    if (types.isEmpty())
+        return jsNull();
+
+    MarkedArgumentBuffer list;
+    HashSet<String>::const_iterator end = types.end();
+    for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it)
+        list.append(jsString(exec, stringToUString(*it)));
+    return constructArray(exec, globalObject(), list);
+}
+
 JSValue JSClipboard::clearData(ExecState* exec)
 {
     Clipboard* clipboard = impl();
@@ -66,22 +81,6 @@ JSValue JSClipboard::clearData(ExecState* exec)
     return throwError(exec, createSyntaxError(exec, "clearData: Invalid number of arguments"));
 }
 
-JSValue JSClipboard::getData(ExecState* exec)
-{
-    // FIXME: It does not match the rest of the JS bindings to throw on invalid number of arguments.
-    if (exec->argumentCount() != 1)
-        return throwError(exec, createSyntaxError(exec, "getData: Invalid number of arguments"));
-
-    Clipboard* clipboard = impl();
-
-    bool success;
-    String result = clipboard->getData(ustringToString(exec->argument(0).toString(exec)->value(exec)), success);
-    if (!success)
-        return jsUndefined();
-
-    return jsString(exec, result);
-}
-
 JSValue JSClipboard::setDragImage(ExecState* exec)
 {
     Clipboard* clipboard = impl();
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.cpp b/Source/WebCore/bindings/js/JSDOMBinding.cpp
index 13580aec8..0050a7315 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/Source/WebCore/bindings/js/JSDOMBinding.cpp
@@ -161,9 +161,8 @@ void reportException(ExecState* exec, JSValue exception)
         errorMessage = stringToUString(exceptionBase->message() + ": "  + exceptionBase->description());
 
     ScriptExecutionContext* scriptExecutionContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
-    ASSERT(scriptExecutionContext);
 
-    // Crash data indicates null-dereference crashes at this point in the Safari 4 Public Beta.
+    // scriptExecutionContext can be null when the relevant global object is a stale inner window object.
     // It's harmless to return here without reporting the exception to the log and the debugger in this case.
     if (!scriptExecutionContext)
         return;
diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 0ba259e76..be551bf96 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -404,30 +404,6 @@ bool JSDOMWindow::defineOwnProperty(JSC::JSObject* object, JSC::ExecState* exec,
 
 // Custom Attributes
 
-JSValue JSDOMWindow::history(ExecState* exec) const
-{
-    History* history = impl()->history();
-    if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), history))
-        return wrapper;
-
-    JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
-    JSHistory* jsHistory = JSHistory::create(getDOMStructure<JSHistory>(exec, window), window, history);
-    cacheWrapper(currentWorld(exec), history, jsHistory);
-    return jsHistory;
-}
-
-JSValue JSDOMWindow::location(ExecState* exec) const
-{
-    Location* location = impl()->location();
-    if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), location))
-        return wrapper;
-
-    JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
-    JSLocation* jsLocation = JSLocation::create(getDOMStructure<JSLocation>(exec, window), window, location);
-    cacheWrapper(currentWorld(exec), location, jsLocation);
-    return jsLocation;
-}
-
 void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
 {
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -568,6 +544,7 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec)
 static JSValue handlePostMessage(DOMWindow* impl, ExecState* exec, bool doTransfer)
 {
     MessagePortArray messagePorts;
+    ArrayBufferArray arrayBuffers;
 
     // This function has variable arguments and can be:
     // Per current spec:
@@ -582,13 +559,14 @@ static JSValue handlePostMessage(DOMWindow* impl, ExecState* exec, bool doTransf
             targetOriginArgIndex = 2;
             transferablesArgIndex = 1;
         }
-        fillMessagePortArray(exec, exec->argument(transferablesArgIndex), messagePorts);
+        fillMessagePortArray(exec, exec->argument(transferablesArgIndex), messagePorts, arrayBuffers);
     }
     if (exec->hadException())
         return jsUndefined();
 
-    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, exec->argument(0), 
-                                                                         doTransfer ? &messagePorts : 0);
+    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, exec->argument(0),
+                                                                         doTransfer ? &messagePorts : 0,
+                                                                         doTransfer ? &arrayBuffers : 0);
 
     if (exec->hadException())
         return jsUndefined();
diff --git a/Source/WebCore/bindings/js/JSDOMWindowWebAudioCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowWebAudioCustom.cpp
index 8d8c711ad..013140e87 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowWebAudioCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowWebAudioCustom.cpp
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/Source/WebCore/bindings/js/JSDOMWindowWebSocketCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowWebSocketCustom.cpp
index 3ee6f2c7b..ce001048b 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowWebSocketCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowWebSocketCustom.cpp
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/Source/WebCore/bindings/js/JSDictionary.cpp b/Source/WebCore/bindings/js/JSDictionary.cpp
index bd06216cf..d7913fa16 100644
--- a/Source/WebCore/bindings/js/JSDictionary.cpp
+++ b/Source/WebCore/bindings/js/JSDictionary.cpp
@@ -103,7 +103,7 @@ void JSDictionary::convertValue(ExecState* exec, JSValue value, ScriptValue& res
 
 void JSDictionary::convertValue(ExecState* exec, JSValue value, RefPtr<SerializedScriptValue>& result)
 {
-    result = SerializedScriptValue::create(exec, value, 0);
+    result = SerializedScriptValue::create(exec, value, 0, 0);
 }
 
 void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<DOMWindow>& result)
@@ -128,7 +128,8 @@ void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Storage>& resu
 
 void JSDictionary::convertValue(ExecState* exec, JSValue value, MessagePortArray& result)
 {
-    fillMessagePortArray(exec, value, result);
+    ArrayBufferArray arrayBuffers;
+    fillMessagePortArray(exec, value, result, arrayBuffers);
 }
 
 #if ENABLE(VIDEO_TRACK)
diff --git a/Source/WebCore/bindings/js/JSDocumentCustom.cpp b/Source/WebCore/bindings/js/JSDocumentCustom.cpp
index 466caf2d3..8377a0912 100644
--- a/Source/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -119,7 +119,7 @@ JSValue JSDocument::createTouchList(ExecState* exec)
 {
     RefPtr<TouchList> touchList = TouchList::create();
 
-    for (int i = 0; i < exec->argumentCount(); i++)
+    for (size_t i = 0; i < exec->argumentCount(); i++)
         touchList->append(toTouch(exec->argument(i)));
 
     return toJS(exec, globalObject(), touchList.release());
diff --git a/Source/WebCore/bindings/js/JSEventListener.cpp b/Source/WebCore/bindings/js/JSEventListener.cpp
index 6de073b05..58369005f 100644
--- a/Source/WebCore/bindings/js/JSEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSEventListener.cpp
@@ -45,12 +45,16 @@ JSEventListener::JSEventListener(JSObject* function, JSObject* wrapper, bool isA
         m_jsFunction.setMayBeNull(*m_isolatedWorld->globalData(), wrapper, function);
     else
         ASSERT(!function);
-    InspectorCounters::incrementCounter(InspectorCounters::JSEventListenerCounter);
+#if ENABLE(INSPECTOR)
+    ThreadLocalInspectorCounters::current().incrementCounter(ThreadLocalInspectorCounters::JSEventListenerCounter);
+#endif
 }
 
 JSEventListener::~JSEventListener()
 {
-    InspectorCounters::decrementCounter(InspectorCounters::JSEventListenerCounter);
+#if ENABLE(INSPECTOR)
+    ThreadLocalInspectorCounters::current().decrementCounter(ThreadLocalInspectorCounters::JSEventListenerCounter);
+#endif
 }
 
 JSObject* JSEventListener::initializeJSFunction(ScriptExecutionContext*) const
@@ -121,10 +125,14 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
         DynamicGlobalObjectScope globalObjectScope(globalData, globalData.dynamicGlobalObject ? globalData.dynamicGlobalObject : globalObject);
 
         globalData.timeoutChecker.start();
+        InspectorInstrumentationCookie cookie = JSMainThreadExecState::instrumentFunctionCall(scriptExecutionContext, callType, callData);
+
         JSValue thisValue = handleEventFunction == jsFunction ? toJS(exec, globalObject, event->currentTarget()) : jsFunction;
         JSValue retval = scriptExecutionContext->isDocument()
-            ? JSMainThreadExecState::instrumentedCall(frame ? frame->page() : 0, exec, handleEventFunction, callType, callData, thisValue, args)
+            ? JSMainThreadExecState::call(exec, handleEventFunction, callType, callData, thisValue, args)
             : JSC::call(exec, handleEventFunction, callType, callData, thisValue, args);
+
+        InspectorInstrumentation::didCallFunction(cookie);
         globalData.timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
diff --git a/Source/WebCore/bindings/js/JSHistoryCustom.cpp b/Source/WebCore/bindings/js/JSHistoryCustom.cpp
index 480658b51..e72c25889 100644
--- a/Source/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -180,7 +180,7 @@ JSValue JSHistory::state(ExecState *exec) const
 
 JSValue JSHistory::pushState(ExecState* exec)
 {
-    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, exec->argument(0), 0);
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, exec->argument(0), 0, 0);
     if (exec->hadException())
         return jsUndefined();
 
@@ -206,7 +206,7 @@ JSValue JSHistory::pushState(ExecState* exec)
 
 JSValue JSHistory::replaceState(ExecState* exec)
 {
-    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, exec->argument(0), 0);
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, exec->argument(0), 0, 0);
     if (exec->hadException())
         return jsUndefined();
 
diff --git a/Source/WebCore/bindings/js/JSMainThreadExecState.h b/Source/WebCore/bindings/js/JSMainThreadExecState.h
index 5e4c4e2dc..14886f5e1 100644
--- a/Source/WebCore/bindings/js/JSMainThreadExecState.h
+++ b/Source/WebCore/bindings/js/JSMainThreadExecState.h
@@ -36,7 +36,7 @@
 
 namespace WebCore {
 
-class Page;
+class ScriptExecutionContext;
 
 class JSMainThreadExecState {
     WTF_MAKE_NONCOPYABLE(JSMainThreadExecState);
@@ -56,28 +56,19 @@ public:
         return JSC::call(exec, functionObject, callType, callData, thisValue, args);
     };
 
-    static JSC::JSValue instrumentedCall(Page* page, JSC::ExecState* exec, JSC::JSValue functionObject, JSC::CallType callType, const JSC::CallData& callData, JSC::JSValue thisValue, const JSC::ArgList& args)
+    static inline InspectorInstrumentationCookie instrumentFunctionCall(ScriptExecutionContext* context, JSC::CallType callType, const JSC::CallData& callData)
     {
-        InspectorInstrumentationCookie cookie;
-        if (InspectorInstrumentation::hasFrontends()) {
-            String resourceName;
-            int lineNumber = 1;
-
-            if (callType == JSC::CallTypeJS) {
-                resourceName = ustringToString(callData.js.functionExecutable->sourceURL());
-                lineNumber = callData.js.functionExecutable->lineNo();
-            } else
-                resourceName = "undefined";
-
-            cookie = InspectorInstrumentation::willCallFunction(page, resourceName, lineNumber);
-        }
-
-        JSC::JSValue value = call(exec, functionObject, callType, callData, thisValue, args);
-
-        InspectorInstrumentation::didCallFunction(cookie);
-
-        return value;
-    };
+        if (!InspectorInstrumentation::hasFrontends())
+            return InspectorInstrumentationCookie();
+        String resourceName;
+        int lineNumber = 1;
+        if (callType == JSC::CallTypeJS) {
+            resourceName = ustringToString(callData.js.functionExecutable->sourceURL());
+            lineNumber = callData.js.functionExecutable->lineNo();
+        } else
+            resourceName = "undefined";
+        return InspectorInstrumentation::willCallFunction(context, resourceName, lineNumber);
+    }
 
     static JSC::JSValue evaluate(JSC::ExecState* exec, JSC::ScopeChainNode* chain, const JSC::SourceCode& source, JSC::JSValue thisValue, JSC::JSValue* exception)
     {
diff --git a/Source/WebCore/bindings/js/JSMessageEventCustom.cpp b/Source/WebCore/bindings/js/JSMessageEventCustom.cpp
index 64b989cb2..64fcef88a 100644
--- a/Source/WebCore/bindings/js/JSMessageEventCustom.cpp
+++ b/Source/WebCore/bindings/js/JSMessageEventCustom.cpp
@@ -109,9 +109,11 @@ static JSC::JSValue handleInitMessageEvent(JSMessageEvent* jsEvent, JSC::ExecSta
     const UString& lastEventIdArg = exec->argument(5).toString(exec)->value(exec);
     DOMWindow* sourceArg = toDOMWindow(exec->argument(6));
     OwnPtr<MessagePortArray> messagePorts;
+    OwnPtr<ArrayBufferArray> arrayBuffers;
     if (!exec->argument(7).isUndefinedOrNull()) {
         messagePorts = adoptPtr(new MessagePortArray);
-        fillMessagePortArray(exec, exec->argument(7), *messagePorts);
+        arrayBuffers = adoptPtr(new ArrayBufferArray);
+        fillMessagePortArray(exec, exec->argument(7), *messagePorts, *arrayBuffers);
         if (exec->hadException())
             return jsUndefined();
     }
diff --git a/Source/WebCore/bindings/js/JSMessagePortCustom.cpp b/Source/WebCore/bindings/js/JSMessagePortCustom.cpp
index 711166b41..76a8c0f48 100644
--- a/Source/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/Source/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -30,6 +30,7 @@
 #include "Event.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "JSArrayBuffer.h"
 #include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
@@ -67,12 +68,13 @@ JSC::JSValue JSMessagePort::webkitPostMessage(JSC::ExecState* exec)
     return handlePostMessage(exec, impl());
 }
 
-void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortArray& portArray)
+void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortArray& portArray, ArrayBufferArray& arrayBuffers)
 {
     // Convert from the passed-in JS array-like object to a MessagePortArray.
     // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
     if (value.isUndefinedOrNull()) {
         portArray.resize(0);
+        arrayBuffers.resize(0);
         return;
     }
 
@@ -94,11 +96,17 @@ void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortA
 
         // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
         RefPtr<MessagePort> port = toMessagePort(value);
-        if (!port) {
-            throwTypeError(exec);
-            return;
+        if (port)
+            portArray.append(port.release());
+        else {
+            RefPtr<ArrayBuffer> arrayBuffer = toArrayBuffer(value);
+            if (arrayBuffer)
+                arrayBuffers.append(arrayBuffer);
+            else {
+                throwTypeError(exec);
+                return;
+            }
         }
-        portArray.append(port.release());
     }
 }
 
diff --git a/Source/WebCore/bindings/js/JSMessagePortCustom.h b/Source/WebCore/bindings/js/JSMessagePortCustom.h
index 5a9e04b6d..e76e76d2a 100644
--- a/Source/WebCore/bindings/js/JSMessagePortCustom.h
+++ b/Source/WebCore/bindings/js/JSMessagePortCustom.h
@@ -42,15 +42,16 @@ namespace WebCore {
     // Helper function which pulls the values out of a JS sequence and into a MessagePortArray.
     // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
     // May generate an exception via the passed ExecState.
-    void fillMessagePortArray(JSC::ExecState*, JSC::JSValue, MessagePortArray&);
+    void fillMessagePortArray(JSC::ExecState*, JSC::JSValue, MessagePortArray&, ArrayBufferArray&);
 
     // Helper function to convert from JS postMessage arguments to WebCore postMessage arguments.
     template <typename T>
     inline JSC::JSValue handlePostMessage(JSC::ExecState* exec, T* impl)
     {
         MessagePortArray portArray;
-        fillMessagePortArray(exec, exec->argument(1), portArray);
-        RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, exec->argument(0), &portArray);
+        ArrayBufferArray arrayBufferArray;
+        fillMessagePortArray(exec, exec->argument(1), portArray, arrayBufferArray);
+        RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, exec->argument(0), &portArray, &arrayBufferArray);
         if (exec->hadException())
             return JSC::jsUndefined();
 
diff --git a/Source/WebCore/bindings/js/JSNodeCustom.cpp b/Source/WebCore/bindings/js/JSNodeCustom.cpp
index 7cdd5fce7..7d00c099d 100644
--- a/Source/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeCustom.cpp
@@ -116,7 +116,7 @@ static inline bool isReachableFromDOM(JSNode* jsNode, Node* node, SlotVisitor& v
         }
     #if ENABLE(VIDEO)
         else if (node->hasTagName(audioTag)) {
-            if (!static_cast<HTMLAudioElement*>(node)->paused())
+            if (!static_cast<HTMLAudioElement*>(node)->hasPendingActivity())
                 return true;
         }
     #endif
diff --git a/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
index 0bfa63afb..6d71e5e13 100644
--- a/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
@@ -29,9 +29,11 @@
 
 #include "JSWebGLRenderingContext.h"
 
+#include "EXTTextureFilterAnisotropic.h"
 #include "ExceptionCode.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
+#include "JSEXTTextureFilterAnisotropic.h"
 #include "JSFloat32Array.h"
 #include "JSHTMLCanvasElement.h"
 #include "JSHTMLImageElement.h"
@@ -188,6 +190,8 @@ static JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, WebGLExten
     switch (extension->getName()) {
     case WebGLExtension::WebKitWebGLLoseContextName:
         return toJS(exec, globalObject, static_cast<WebGLLoseContext*>(extension));
+    case WebGLExtension::EXTTextureFilterAnisotropicName:
+        return toJS(exec, globalObject, static_cast<EXTTextureFilterAnisotropic*>(extension));
     case WebGLExtension::OESStandardDerivativesName:
         return toJS(exec, globalObject, static_cast<OESStandardDerivatives*>(extension));
     case WebGLExtension::OESTextureFloatName:
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.cpp b/Source/WebCore/bindings/js/ScriptProfiler.cpp
index a63fe4d9e..790739b21 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/js/ScriptProfiler.cpp
@@ -30,9 +30,13 @@
 
 #include "ScriptProfiler.h"
 
+#include "Frame.h"
 #include "GCController.h"
 #include "JSDOMBinding.h"
+#include "JSDOMWindow.h"
+#include "Page.h"
 #include "ScriptObject.h"
+#include "ScriptState.h"
 #include <profiler/Profiler.h>
 
 namespace WebCore {
@@ -52,12 +56,38 @@ void ScriptProfiler::start(ScriptState* state, const String& title)
     JSC::Profiler::profiler()->startProfiling(state, stringToUString(title));
 }
 
+void ScriptProfiler::startForPage(Page* inspectedPage, const String& title)
+{
+    JSC::ExecState* scriptState = toJSDOMWindow(inspectedPage->mainFrame(), debuggerWorld())->globalExec();
+    start(scriptState, title);
+}
+
+#if ENABLE(WORKERS)
+void ScriptProfiler::startForWorkerContext(WorkerContext* context, const String& title)
+{
+    start(scriptStateFromWorkerContext(context), title);
+}
+#endif
+
 PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String& title)
 {
     RefPtr<JSC::Profile> profile = JSC::Profiler::profiler()->stopProfiling(state, stringToUString(title));
     return ScriptProfile::create(profile);
 }
 
+PassRefPtr<ScriptProfile> ScriptProfiler::stopForPage(Page* inspectedPage, const String& title)
+{
+    JSC::ExecState* scriptState = toJSDOMWindow(inspectedPage->mainFrame(), debuggerWorld())->globalExec();
+    return stop(scriptState, title);
+}
+
+#if ENABLE(WORKERS)
+PassRefPtr<ScriptProfile> ScriptProfiler::stopForWorkerContext(WorkerContext* context, const String& title)
+{
+    return stop(scriptStateFromWorkerContext(context), title);
+}
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.h b/Source/WebCore/bindings/js/ScriptProfiler.h
index a21eada4c..efed031a7 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.h
+++ b/Source/WebCore/bindings/js/ScriptProfiler.h
@@ -37,7 +37,9 @@
 namespace WebCore {
 
 class DOMWrapperVisitor;
+class Page;
 class ScriptObject;
+class WorkerContext;
 
 class ScriptProfiler {
     WTF_MAKE_NONCOPYABLE(ScriptProfiler);
@@ -54,7 +56,15 @@ public:
     static void collectGarbage();
     static ScriptObject objectByHeapObjectId(unsigned id);
     static void start(ScriptState* state, const String& title);
+    static void startForPage(Page*, const String& title);
+#if ENABLE(WORKERS)
+    static void startForWorkerContext(WorkerContext*, const String& title);
+#endif
     static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
+    static PassRefPtr<ScriptProfile> stopForPage(Page*, const String& title);
+#if ENABLE(WORKERS)
+    static PassRefPtr<ScriptProfile> stopForWorkerContext(WorkerContext*, const String& title);
+#endif
     static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String&, HeapSnapshotProgress*) { return 0; }
     static bool causesRecompilation() { return true; }
     static bool isSampling() { return false; }
diff --git a/Source/WebCore/bindings/js/ScriptState.cpp b/Source/WebCore/bindings/js/ScriptState.cpp
index e823c6e3a..eb66bdcfa 100644
--- a/Source/WebCore/bindings/js/ScriptState.cpp
+++ b/Source/WebCore/bindings/js/ScriptState.cpp
@@ -71,6 +71,14 @@ DOMWindow* domWindowFromScriptState(ScriptState* scriptState)
     return static_cast<JSDOMWindowBase*>(globalObject)->impl();
 }
 
+ScriptExecutionContext* scriptExecutionContextFromScriptState(ScriptState* scriptState)
+{
+    JSC::JSGlobalObject* globalObject = scriptState->lexicalGlobalObject();
+    if (!globalObject->inherits(&JSDOMGlobalObject::s_info))
+        return 0;
+    return static_cast<JSDOMGlobalObject*>(globalObject)->scriptExecutionContext();
+}
+
 bool evalEnabled(ScriptState* scriptState)
 {
     JSC::JSGlobalObject* globalObject = scriptState->lexicalGlobalObject();
diff --git a/Source/WebCore/bindings/js/ScriptState.h b/Source/WebCore/bindings/js/ScriptState.h
index 58f36f599..45ace2ba4 100644
--- a/Source/WebCore/bindings/js/ScriptState.h
+++ b/Source/WebCore/bindings/js/ScriptState.h
@@ -46,6 +46,7 @@ class DOMWrapperWorld;
 class Frame;
 class Node;
 class Page;
+class ScriptExecutionContext;
 class WorkerContext;
 
 // The idea is to expose "state-like" methods (hadException, and any other
@@ -65,6 +66,7 @@ private:
 };
 
 DOMWindow* domWindowFromScriptState(ScriptState*);
+ScriptExecutionContext* scriptExecutionContextFromScriptState(ScriptState*);
 
 bool evalEnabled(ScriptState*);
 void setEvalEnabled(ScriptState*, bool);
diff --git a/Source/WebCore/bindings/js/ScriptValue.cpp b/Source/WebCore/bindings/js/ScriptValue.cpp
index 7272a1029..f75851f39 100644
--- a/Source/WebCore/bindings/js/ScriptValue.cpp
+++ b/Source/WebCore/bindings/js/ScriptValue.cpp
@@ -102,7 +102,7 @@ bool ScriptValue::isFunction() const
 
 PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState, SerializationErrorMode throwExceptions)
 {
-    return SerializedScriptValue::create(scriptState, jsValue(), 0, throwExceptions);
+    return SerializedScriptValue::create(scriptState, jsValue(), 0, 0, throwExceptions);
 }
 
 ScriptValue ScriptValue::deserialize(ScriptState* scriptState, SerializedScriptValue* value, SerializationErrorMode throwExceptions)
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
index 77cd65b3a..7c586aa67 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -61,6 +61,7 @@
 #include <runtime/PropertyNameArray.h>
 #include <runtime/RegExp.h>
 #include <runtime/RegExpObject.h>
+#include <wtf/ArrayBuffer.h>
 #include <wtf/ByteArray.h>
 #include <wtf/HashTraits.h>
 #include <wtf/Vector.h>
@@ -105,6 +106,7 @@ enum SerializationTag {
     MessagePortReferenceTag = 20,
     ArrayBufferTag = 21,
     ArrayBufferViewTag = 22,
+    ArrayBufferTransferTag = 23,
     ErrorTag = 255
 };
 
@@ -191,6 +193,7 @@ static const unsigned int StringPoolTag = 0xFFFFFFFE;
  *    | MessagePortReferenceTag <value:uint32_t>
  *    | ArrayBuffer
  *    | ArrayBufferViewTag ArrayBufferViewSubtag <byteOffset:uint32_t> <byteLenght:uint32_t> (ArrayBuffer | ObjectReference)
+ *    | ArrayBufferTransferTag <value:uint32_t>
  *
  * String :-
  *      EmptyStringTag
@@ -315,9 +318,11 @@ template <typename T> static bool writeLittleEndian(Vector<uint8_t>& buffer, con
 
 class CloneSerializer : CloneBase {
 public:
-    static SerializationReturnCode serialize(ExecState* exec, JSValue value, MessagePortArray* messagePorts, Vector<uint8_t>& out)
+    static SerializationReturnCode serialize(ExecState* exec, JSValue value,
+                                             MessagePortArray* messagePorts, ArrayBufferArray* arrayBuffers,
+                                             Vector<uint8_t>& out)
     {
-        CloneSerializer serializer(exec, messagePorts, out);
+        CloneSerializer serializer(exec, messagePorts, arrayBuffers, out);
         return serializer.serialize(value);
     }
 
@@ -346,19 +351,29 @@ public:
     }
 
 private:
-    CloneSerializer(ExecState* exec, MessagePortArray* messagePorts, Vector<uint8_t>& out)
+    typedef HashMap<JSObject*, uint32_t> ObjectPool;
+
+    CloneSerializer(ExecState* exec, MessagePortArray* messagePorts, ArrayBufferArray* arrayBuffers, Vector<uint8_t>& out)
         : CloneBase(exec)
         , m_buffer(out)
         , m_emptyIdentifier(exec, UString("", 0))
     {
         write(CurrentVersion);
-        if (messagePorts) {
-            JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
-            for (size_t i = 0; i < messagePorts->size(); i++) {
-                JSC::JSValue value = toJS(exec, globalObject, messagePorts->at(i).get());
-                if (value.getObject())
-                    m_transferredMessagePorts.add(value.getObject(), i);
-            }
+        fillTransferMap(messagePorts, m_transferredMessagePorts);
+        fillTransferMap(arrayBuffers, m_transferredArrayBuffers);
+    }
+
+    template <class T>
+    void fillTransferMap(Vector<RefPtr<T>, 1>* input, ObjectPool& result)
+    {
+        if (!input)
+            return;
+        JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(m_exec->lexicalGlobalObject());
+        for (size_t i = 0; i < input->size(); i++) {
+            JSC::JSValue value = toJS(m_exec, globalObject, input->at(i).get());
+            JSC::JSObject* obj = value.getObject();
+            if (obj && !result.contains(obj))
+                result.add(obj, i);
         }
     }
 
@@ -475,7 +490,7 @@ private:
         }
     }
 
-    bool dumpArrayBufferView(JSObject* obj)
+    bool dumpArrayBufferView(JSObject* obj, SerializationReturnCode& code)
     {
         write(ArrayBufferViewTag);
         if (obj->inherits(&JSDataView::s_info))
@@ -505,11 +520,15 @@ private:
         write(static_cast<uint32_t>(arrayBufferView->byteOffset()));
         write(static_cast<uint32_t>(arrayBufferView->byteLength()));
         RefPtr<ArrayBuffer> arrayBuffer = arrayBufferView->buffer();
+        if (!arrayBuffer) {
+            code = ValidationError;
+            return true;
+        }
         JSValue bufferObj = toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_exec->lexicalGlobalObject()), arrayBuffer.get());
-        return dumpIfTerminal(bufferObj);
+        return dumpIfTerminal(bufferObj, code);
     }
 
-    bool dumpIfTerminal(JSValue value)
+    bool dumpIfTerminal(JSValue value, SerializationReturnCode& code)
     {
         if (!value.isCell()) {
             dumpImmediate(value);
@@ -596,17 +615,26 @@ private:
                 ObjectPool::iterator index = m_transferredMessagePorts.find(obj);
                 if (index != m_transferredMessagePorts.end()) {
                     write(MessagePortReferenceTag);
-                    uint32_t i = index->second;
-                    write(i);
+                    write(index->second);
                     return true;
                 }
                 return false;
             }
             if (obj->inherits(&JSArrayBuffer::s_info)) {
+                RefPtr<ArrayBuffer> arrayBuffer = toArrayBuffer(obj);
+                if (arrayBuffer->isNeutered()) {
+                    code = ValidationError;
+                    return true;
+                }
+                ObjectPool::iterator index = m_transferredArrayBuffers.find(obj);
+                if (index != m_transferredArrayBuffers.end()) {
+                    write(ArrayBufferTransferTag);
+                    write(index->second);
+                    return true;
+                }
                 if (!startObjectInternal(obj)) // handle duplicates
                     return true;
                 write(ArrayBufferTag);
-                RefPtr<ArrayBuffer> arrayBuffer = toArrayBuffer(obj);
                 write(arrayBuffer->byteLength());
                 write(static_cast<const uint8_t *>(arrayBuffer->data()), arrayBuffer->byteLength());
                 return true;
@@ -614,7 +642,7 @@ private:
             if (obj->inherits(&JSArrayBufferView::s_info)) {
                 if (!startObjectInternal(obj))
                     return true;
-                return dumpArrayBufferView(obj);
+                return dumpArrayBufferView(obj, code);
             }
 
             CallData unusedData;
@@ -749,9 +777,9 @@ private:
     }
 
     Vector<uint8_t>& m_buffer;
-    typedef HashMap<JSObject*, uint32_t> ObjectPool;
     ObjectPool m_objectPool;
     ObjectPool m_transferredMessagePorts;
+    ObjectPool m_transferredArrayBuffers;
     typedef HashMap<RefPtr<StringImpl>, uint32_t, IdentifierRepHash> StringConstantPool;
     StringConstantPool m_constantPool;
     Identifier m_emptyIdentifier;
@@ -814,7 +842,10 @@ SerializationReturnCode CloneSerializer::serialize(JSValue in)
                 }
 
                 write(index);
-                if (dumpIfTerminal(inValue)) {
+                SerializationReturnCode terminalCode = SuccessfullyCompleted;
+                if (dumpIfTerminal(inValue, terminalCode)) {
+                    if (terminalCode != SuccessfullyCompleted)
+                        return terminalCode;
                     indexStack.last()++;
                     goto arrayStartVisitMember;
                 }
@@ -871,10 +902,13 @@ SerializationReturnCode CloneSerializer::serialize(JSValue in)
                 if (shouldTerminate())
                     return ExistingExceptionError;
 
-                if (!dumpIfTerminal(inValue)) {
+                SerializationReturnCode terminalCode = SuccessfullyCompleted;
+                if (!dumpIfTerminal(inValue, terminalCode)) {
                     stateStack.append(ObjectEndVisitMember);
                     goto stateUnknown;
                 }
+                if (terminalCode != SuccessfullyCompleted)
+                    return terminalCode;
                 // fallthrough
             }
             case ObjectEndVisitMember: {
@@ -885,13 +919,18 @@ SerializationReturnCode CloneSerializer::serialize(JSValue in)
                 goto objectStartVisitMember;
             }
             stateUnknown:
-            case StateUnknown:
-                if (dumpIfTerminal(inValue))
+            case StateUnknown: {
+                SerializationReturnCode terminalCode = SuccessfullyCompleted;
+                if (dumpIfTerminal(inValue, terminalCode)) {
+                    if (terminalCode != SuccessfullyCompleted)
+                        return terminalCode;
                     break;
+                }
 
                 if (isArray(inValue))
                     goto arrayStartState;
                 goto objectStartState;
+            }
         }
         if (stateStack.isEmpty())
             break;
@@ -911,6 +950,8 @@ SerializationReturnCode CloneSerializer::serialize(JSValue in)
     return SuccessfullyCompleted;
 }
 
+typedef Vector<WTF::ArrayBufferContents> ArrayBufferContentsArray;
+
 class CloneDeserializer : CloneBase {
 public:
     static String deserializeString(const Vector<uint8_t>& buffer)
@@ -932,12 +973,13 @@ public:
         return String(str.impl());
     }
 
-    static DeserializationResult deserialize(ExecState* exec, JSGlobalObject* globalObject, MessagePortArray* messagePorts,
+    static DeserializationResult deserialize(ExecState* exec, JSGlobalObject* globalObject,
+                                             MessagePortArray* messagePorts, ArrayBufferContentsArray* arrayBufferContentsArray,
                                              const Vector<uint8_t>& buffer)
     {
         if (!buffer.size())
             return make_pair(jsNull(), UnspecifiedError);
-        CloneDeserializer deserializer(exec, globalObject, messagePorts, buffer);
+        CloneDeserializer deserializer(exec, globalObject, messagePorts, arrayBufferContentsArray, buffer);
         if (!deserializer.isValid())
             return make_pair(JSValue(), ValidationError);
         return deserializer.deserialize();
@@ -982,7 +1024,9 @@ private:
         size_t m_index;
     };
 
-    CloneDeserializer(ExecState* exec, JSGlobalObject* globalObject, MessagePortArray* messagePorts, const Vector<uint8_t>& buffer)
+    CloneDeserializer(ExecState* exec, JSGlobalObject* globalObject, 
+                      MessagePortArray* messagePorts, ArrayBufferContentsArray* arrayBufferContents,
+                      const Vector<uint8_t>& buffer)
         : CloneBase(exec)
         , m_globalObject(globalObject)
         , m_isDOMGlobalObject(globalObject->inherits(&JSDOMGlobalObject::s_info))
@@ -990,6 +1034,8 @@ private:
         , m_end(buffer.data() + buffer.size())
         , m_version(0xFFFFFFFF)
         , m_messagePorts(messagePorts)
+        , m_arrayBufferContents(arrayBufferContents)
+        , m_arrayBuffers(arrayBufferContents ? arrayBufferContents->size() : 0)
     {
         if (!read(m_version))
             m_version = 0xFFFFFFFF;
@@ -1186,10 +1232,7 @@ private:
 
     void putProperty(JSArray* array, unsigned index, JSValue value)
     {
-        if (array->canSetIndex(index))
-            array->setIndex(m_exec->globalData(), index, value);
-        else
-            array->methodTable()->putByIndex(array, m_exec, index, value);
+        array->putDirectIndex(m_exec, index, value, false);
     }
 
     void putProperty(JSObject* object, const Identifier& property, JSValue value)
@@ -1432,6 +1475,19 @@ private:
             m_gcBuffer.append(result);
             return result;
         }
+        case ArrayBufferTransferTag: {
+            uint32_t index;
+            bool indexSuccessfullyRead = read(index);
+            if (!indexSuccessfullyRead || index >= m_arrayBuffers.size()) {
+                fail();
+                return JSValue();
+            }
+
+            if (!m_arrayBuffers[index])
+                m_arrayBuffers[index] = ArrayBuffer::create(m_arrayBufferContents->at(index));
+
+            return getJSValue(m_arrayBuffers[index].get());
+        }
         case ArrayBufferViewTag: {
             JSValue arrayBufferView;
             if (!readArrayBufferView(arrayBufferView)) {
@@ -1454,6 +1510,8 @@ private:
     unsigned m_version;
     Vector<CachedString> m_constantPool;
     MessagePortArray* m_messagePorts;
+    ArrayBufferContentsArray* m_arrayBufferContents;
+    ArrayBufferArray m_arrayBuffers;
 };
 
 DeserializationResult CloneDeserializer::deserialize()
@@ -1603,17 +1661,61 @@ SerializedScriptValue::SerializedScriptValue(Vector<uint8_t>& buffer)
     m_data.swap(buffer);
 }
 
-PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(ExecState* exec, JSValue value, MessagePortArray* messagePorts, SerializationErrorMode throwExceptions)
+SerializedScriptValue::SerializedScriptValue(Vector<uint8_t>& buffer, PassOwnPtr<ArrayBufferContentsArray> arrayBufferContentsArray)
+    : m_arrayBufferContentsArray(arrayBufferContentsArray)
+{
+    m_data.swap(buffer);
+}
+
+PassOwnPtr<SerializedScriptValue::ArrayBufferContentsArray> SerializedScriptValue::transferArrayBuffers(
+    ArrayBufferArray& arrayBuffers, SerializationReturnCode& code)
+{
+    for (size_t i = 0; i < arrayBuffers.size(); i++) {
+        if (arrayBuffers[i]->isNeutered()) {
+            code = ValidationError;
+            return nullptr;
+        }
+    }
+
+    OwnPtr<ArrayBufferContentsArray> contents = adoptPtr(new ArrayBufferContentsArray(arrayBuffers.size()));
+
+    HashSet<WTF::ArrayBuffer*> visited;
+    for (size_t i = 0; i < arrayBuffers.size(); i++) {
+        Vector<RefPtr<ArrayBufferView> > neuteredViews;
+
+        if (visited.contains(arrayBuffers[i].get()))
+            continue;
+        visited.add(arrayBuffers[i].get());
+
+        bool result = arrayBuffers[i]->transfer(contents->at(i), neuteredViews);
+        if (!result) {
+            code = ValidationError;
+            return nullptr;
+        }
+    }
+    return contents.release();
+}
+
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(ExecState* exec, JSValue value,
+                                                                MessagePortArray* messagePorts, ArrayBufferArray* arrayBuffers,
+                                                                SerializationErrorMode throwExceptions)
 {
     Vector<uint8_t> buffer;
-    SerializationReturnCode code = CloneSerializer::serialize(exec, value, messagePorts, buffer);
+    SerializationReturnCode code = CloneSerializer::serialize(exec, value, messagePorts, arrayBuffers, buffer);
+
+    OwnPtr<ArrayBufferContentsArray> arrayBufferContentsArray;
+
+    if (arrayBuffers && serializationDidCompleteSuccessfully(code))
+        arrayBufferContentsArray = transferArrayBuffers(*arrayBuffers, code);
+
     if (throwExceptions == Throwing)
         maybeThrowExceptionIfSerializationFailed(exec, code);
 
     if (!serializationDidCompleteSuccessfully(code))
         return 0;
-        
-    return adoptRef(new SerializedScriptValue(buffer));
+
+    return adoptRef(new SerializedScriptValue(buffer, arrayBufferContentsArray.release()));
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create()
@@ -1631,12 +1733,13 @@ PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(const String& st
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(JSContextRef originContext, JSValueRef apiValue, 
-                                                                MessagePortArray* messagePorts, JSValueRef* exception)
+                                                                MessagePortArray* messagePorts, ArrayBufferArray* arrayBuffers,
+                                                                JSValueRef* exception)
 {
     ExecState* exec = toJS(originContext);
     APIEntryShim entryShim(exec);
     JSValue value = toJS(exec, apiValue);
-    RefPtr<SerializedScriptValue> serializedValue = SerializedScriptValue::create(exec, value, messagePorts);
+    RefPtr<SerializedScriptValue> serializedValue = SerializedScriptValue::create(exec, value, messagePorts, arrayBuffers);
     if (exec->hadException()) {
         if (exception)
             *exception = toRef(exec, exec->exception());
@@ -1650,7 +1753,7 @@ PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(JSContextRef ori
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(JSContextRef originContext, JSValueRef apiValue,
                                                                 JSValueRef* exception)
 {
-    return create(originContext, apiValue, 0, exception);
+    return create(originContext, apiValue, 0, 0, exception);
 }
 
 String SerializedScriptValue::toString()
@@ -1658,10 +1761,11 @@ String SerializedScriptValue::toString()
     return CloneDeserializer::deserializeString(m_data);
 }
 
-JSValue SerializedScriptValue::deserialize(ExecState* exec, JSGlobalObject* globalObject, 
+JSValue SerializedScriptValue::deserialize(ExecState* exec, JSGlobalObject* globalObject,
                                            MessagePortArray* messagePorts, SerializationErrorMode throwExceptions)
 {
-    DeserializationResult result = CloneDeserializer::deserialize(exec, globalObject, messagePorts, m_data);
+    DeserializationResult result = CloneDeserializer::deserialize(exec, globalObject, messagePorts,
+                                                                  m_arrayBufferContentsArray.get(), m_data);
     if (throwExceptions == Throwing)
         maybeThrowExceptionIfSerializationFailed(exec, result.second);
     return result.first;
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.h b/Source/WebCore/bindings/js/SerializedScriptValue.h
index 75ce694b2..3f8da5e8f 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.h
@@ -30,6 +30,7 @@
 #include "ScriptState.h"
 #include <heap/Strong.h>
 #include <runtime/JSValue.h>
+#include <wtf/ArrayBuffer.h>
 #include <wtf/Forward.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -41,6 +42,7 @@ namespace WebCore {
 
 class MessagePort;
 typedef Vector<RefPtr<MessagePort>, 1> MessagePortArray;
+typedef Vector<RefPtr<WTF::ArrayBuffer>, 1> ArrayBufferArray;
  
 enum SerializationReturnCode {
     SuccessfullyCompleted,
@@ -58,8 +60,9 @@ class SharedBuffer;
 
 class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
 public:
-    static PassRefPtr<SerializedScriptValue> create(JSC::ExecState*, JSC::JSValue, MessagePortArray*, SerializationErrorMode = Throwing);
-    static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef, MessagePortArray*,  JSValueRef* exception);
+    static PassRefPtr<SerializedScriptValue> create(JSC::ExecState*, JSC::JSValue, MessagePortArray*, ArrayBufferArray*,
+                                                    SerializationErrorMode = Throwing);
+    static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef, MessagePortArray*, ArrayBufferArray*, JSValueRef* exception);
     static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef, JSValueRef* exception);
 
     static PassRefPtr<SerializedScriptValue> create(const String&);
@@ -88,11 +91,15 @@ public:
     ~SerializedScriptValue();
 
 private:
+    typedef Vector<WTF::ArrayBufferContents> ArrayBufferContentsArray;
     static void maybeThrowExceptionIfSerializationFailed(JSC::ExecState*, SerializationReturnCode);
     static bool serializationDidCompleteSuccessfully(SerializationReturnCode);
+    static PassOwnPtr<ArrayBufferContentsArray> transferArrayBuffers(ArrayBufferArray&, SerializationReturnCode&);
     
     SerializedScriptValue(Vector<unsigned char>&);
+    SerializedScriptValue(Vector<unsigned char>&, PassOwnPtr<ArrayBufferContentsArray>);
     Vector<unsigned char> m_data;
+    OwnPtr<ArrayBufferContentsArray> m_arrayBufferContentsArray;
 };
 
 }
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.cpp b/Source/WebCore/bindings/js/WorkerScriptController.cpp
index 2c60ffff0..6cff92b22 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptController.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- * Copyright (C) 2011 Google Inc. All Rights Reserved.
+ * Copyright (C) 2011, 2012 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -162,9 +162,20 @@ void WorkerScriptController::setException(ScriptValue exception)
 
 void WorkerScriptController::scheduleExecutionTermination()
 {
+    // The mutex provides a memory barrier to ensure that once
+    // termination is scheduled, isExecutionTerminating will
+    // accurately reflect that state when called from another thread.
+    MutexLocker locker(m_scheduledTerminationMutex);
     m_globalData->terminator.terminateSoon();
 }
 
+bool WorkerScriptController::isExecutionTerminating() const
+{
+    // See comments in scheduleExecutionTermination regarding mutex usage.
+    MutexLocker locker(m_scheduledTerminationMutex);
+    return m_globalData->terminator.shouldTerminate();
+}
+
 void WorkerScriptController::forbidExecution()
 {
     ASSERT(m_workerContext->isContextThread());
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.h b/Source/WebCore/bindings/js/WorkerScriptController.h
index 6985ee894..59727f6dc 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.h
+++ b/Source/WebCore/bindings/js/WorkerScriptController.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2012 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -67,6 +68,7 @@ namespace WebCore {
         // forbidExecution()/isExecutionForbidden() to guard against reentry into JS.
         // Can be called from any thread.
         void scheduleExecutionTermination();
+        bool isExecutionTerminating() const;
 
         // Called on Worker thread when JS exits with termination exception caused by forbidExecution() request,
         // or by Worker thread termination code to prevent future entry into JS.
@@ -89,6 +91,7 @@ namespace WebCore {
         WorkerContext* m_workerContext;
         JSC::Strong<JSWorkerContext> m_workerContextWrapper;
         bool m_executionForbidden;
+        mutable Mutex m_scheduledTerminationMutex;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/objc/DOM.mm b/Source/WebCore/bindings/objc/DOM.mm
index 780634acb..7bd99a148 100644
--- a/Source/WebCore/bindings/objc/DOM.mm
+++ b/Source/WebCore/bindings/objc/DOM.mm
@@ -264,7 +264,7 @@ static NSArray *kit(const Vector<IntRect>& rects)
 - (NSString *)description
 {
     if (!_internal)
-        return [NSString stringWithFormat:@"<%@: null>", [[self class] description], self];
+        return [NSString stringWithFormat:@"<%@: null>", [[self class] description]];
 
     NSString *value = [self nodeValue];
     if (value)
diff --git a/Source/WebCore/bindings/objc/WebScriptObject.mm b/Source/WebCore/bindings/objc/WebScriptObject.mm
index 7a41315ab..d0df7bf57 100644
--- a/Source/WebCore/bindings/objc/WebScriptObject.mm
+++ b/Source/WebCore/bindings/objc/WebScriptObject.mm
@@ -486,7 +486,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ASSERT(!exec->hadException());
 
     JSLock lock(SilenceAssertionsOnly);
-    [self _imp]->methodTable()->putByIndex([self _imp], exec, index, convertObjcValueToValue(exec, &value, ObjcObjectType, [self _rootObject]));
+    [self _imp]->methodTable()->putByIndex([self _imp], exec, index, convertObjcValueToValue(exec, &value, ObjcObjectType, [self _rootObject]), false);
 
     if (exec->hadException()) {
         addExceptionToConsole(exec);
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
index efe755290..5a1c2b93f 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
@@ -197,7 +197,7 @@ sub ShouldSkipType
     # FIXME: We don't generate bindings for SVG related interfaces yet
     return 1 if $typeInfo->signature->name =~ /getSVGDocument/;
 
-    return 1 if $typeInfo->signature->name =~ /Constructor/;
+    return 1 if $typeInfo->signature->type =~ /Constructor$/;
     
     # FIXME: This is typically used to add script execution state arguments to the method.
     # These functions will not compile with the C++ bindings as is, so disable them
@@ -494,8 +494,11 @@ sub GenerateHeader
                 AddForwardDeclarationsForType($type, 1);
             }
 
+            my $conditionalString = GenerateConditionalString($function->signature);
+            push(@headerFunctions, "#if ${conditionalString}\n") if $conditionalString;
             push(@headerFunctions, "    ");
             push(@headerFunctions, $functionDeclaration);
+            push(@headerFunctions, "#endif\n") if $conditionalString;
         }
 
         if (@headerFunctions > 0) {
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 2aa9f5977..99ca0be11 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -776,7 +776,7 @@ sub GenerateHeader
     # Getters
     if ($hasSetter) {
         push(@headerContent, "    static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
-        push(@headerContent, "    static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue);\n") if $dataNode->extendedAttributes->{"CustomIndexedSetter"};
+        push(@headerContent, "    static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue, bool shouldThrow);\n") if $dataNode->extendedAttributes->{"CustomIndexedSetter"};
         push(@headerContent, "    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomNamedSetter"};
     }
 
@@ -844,9 +844,12 @@ sub GenerateHeader
             $numCustomAttributes++ if ($attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCustomGetter"});
             $numCustomAttributes++ if ($attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCustomSetter"});
             if ($attribute->signature->extendedAttributes->{"CachedAttribute"}) {
+                my $conditionalString = GenerateConditionalString($attribute->signature);
+                push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
                 push(@headerContent, "    JSC::WriteBarrier<JSC::Unknown> m_" . $attribute->signature->name . ";\n");
                 $numCachedAttributes++;
                 $needsMarkChildren = 1;
+                push(@headerContent, "#endif\n") if $conditionalString;
             }
         }
     }
@@ -861,12 +864,17 @@ sub GenerateHeader
         push(@headerContent, "\n    // Custom attributes\n");
 
         foreach my $attribute (@{$dataNode->attributes}) {
+            my $conditionalString = GenerateConditionalString($attribute->signature);
             if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCustom"} || $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCustomGetter"}) {
+                push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
                 my $methodName = $codeGenerator->WK_lcfirst($attribute->signature->name);
                 push(@headerContent, "    JSC::JSValue " . $methodName . "(JSC::ExecState*) const;\n");
+                push(@headerContent, "#endif\n") if $conditionalString;
             }
             if (($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCustom"} || $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCustomSetter"}) && $attribute->type !~ /^readonly/) {
+                push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
                 push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValue);\n");
+                push(@headerContent, "#endif\n") if $conditionalString;
             }
         }
     }
@@ -880,8 +888,11 @@ sub GenerateHeader
         foreach my $function (@{$dataNode->functions}) {
             next unless $function->signature->extendedAttributes->{"Custom"} or $function->signature->extendedAttributes->{"JSCustom"};
             next if $function->{overloads} && $function->{overloadIndex} != 1;
+            my $conditionalString = GenerateConditionalString($function->signature);
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             my $functionImplementationName = $function->signature->extendedAttributes->{"ImplementedAs"} || $codeGenerator->WK_lcfirst($function->signature->name);
-            push(@headerContent, "    JSC::JSValue " . $functionImplementationName . "(JSC::ExecState*);\n");
+            push(@headerContent, "    " . ($function->isStatic ? "static " : "") . "JSC::JSValue " . $functionImplementationName . "(JSC::ExecState*);\n");
+            push(@headerContent, "#endif\n") if $conditionalString;
         }
     }
 
@@ -1067,20 +1078,26 @@ sub GenerateHeader
         push(@headerContent,"// Functions\n\n");
         foreach my $function (@{$dataNode->functions}) {
             next if $function->{overloadIndex} && $function->{overloadIndex} > 1;
+            my $conditionalString = GenerateConditionalString($function->signature);
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             my $functionName = GetFunctionName($className, $function);
             push(@headerContent, "JSC::EncodedJSValue JSC_HOST_CALL ${functionName}(JSC::ExecState*);\n");
+            push(@headerContent, "#endif\n") if $conditionalString;
         }
     }
 
     if ($numAttributes > 0 || !$dataNode->extendedAttributes->{"OmitConstructor"}) {
         push(@headerContent,"// Attributes\n\n");
         foreach my $attribute (@{$dataNode->attributes}) {
+            my $conditionalString = GenerateConditionalString($attribute->signature);
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
             push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
             unless ($attribute->type =~ /readonly/) {
                 my $setter = "setJS" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
                 push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);\n");
             }
+            push(@headerContent, "#endif\n") if $conditionalString;
         }
         
         if (!$dataNode->extendedAttributes->{"OmitConstructor"}) {
@@ -1097,14 +1114,11 @@ sub GenerateHeader
     if ($numConstants > 0) {
         push(@headerContent,"// Constants\n\n");
         foreach my $constant (@{$dataNode->constants}) {
+            my $conditionalString = GenerateConditionalString($constant);
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
-            my $conditional = $constant->extendedAttributes->{"Conditional"};
-            if ($conditional) {
-                my $conditionalString = $codeGenerator->GenerateConditionalStringFromAttributeValue($conditional);
-                push(@headerContent, "#if ${conditionalString}\n");
-            }
             push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
-            push(@headerContent, "#endif\n") if $conditional;
+            push(@headerContent, "#endif\n") if $conditionalString;
         }
     }
 
@@ -1841,7 +1855,7 @@ sub GenerateImplementation
             }
 
             if ($dataNode->extendedAttributes->{"CustomIndexedSetter"}) {
-                push(@implContent, "void ${className}::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value)\n");
+                push(@implContent, "void ${className}::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    ${className}* thisObject = jsCast<${className}*>(cell);\n");
                 push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\n");
@@ -2063,63 +2077,79 @@ sub GenerateImplementation
 
             $implIncludes{"<runtime/Error.h>"} = 1;
 
-            if ($interfaceName eq "DOMWindow") {
-                push(@implContent, "    $className* castedThis = toJSDOMWindow(exec->hostThisValue().toThisObject(exec));\n");
-                push(@implContent, "    if (!castedThis)\n");
-                push(@implContent, "        return throwVMTypeError(exec);\n");
-            } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
-                push(@implContent, "    $className* castedThis = to${className}(exec->hostThisValue().toThisObject(exec));\n");
-                push(@implContent, "    if (!castedThis)\n");
-                push(@implContent, "        return throwVMTypeError(exec);\n");
-            } elsif (!$function->isStatic) {
-                push(@implContent, "    JSValue thisValue = exec->hostThisValue();\n");
-                push(@implContent, "    if (!thisValue.inherits(&${className}::s_info))\n");
-                push(@implContent, "        return throwVMTypeError(exec);\n");
-                push(@implContent, "    $className* castedThis = static_cast<$className*>(asObject(thisValue));\n");
-            }
-
-            push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(castedThis, &${className}::s_info);\n") unless ($function->isStatic);
+            if ($function->isStatic) {
+                if ($isCustom) {
+                    GenerateArgumentsCountCheck(\@implContent, $function, $dataNode);
+                    push(@implContent, "    return JSValue::encode(${className}::" . $functionImplementationName . "(exec));\n");
+                } else {
+                    GenerateArgumentsCountCheck(\@implContent, $function, $dataNode);
 
-            if ($dataNode->extendedAttributes->{"CheckSecurity"} and
-                !$function->signature->extendedAttributes->{"DoNotCheckSecurity"} and
-                !$function->isStatic) {
-                push(@implContent, "    if (!castedThis->allowsAccessFrom(exec))\n");
-                push(@implContent, "        return JSValue::encode(jsUndefined());\n");
-            }
+                    if (@{$function->raisesExceptions}) {
+                        push(@implContent, "    ExceptionCode ec = 0;\n");
+                    }
 
-            if ($isCustom) {
-                push(@implContent, "    return JSValue::encode(castedThis->" . $functionImplementationName . "(exec));\n") unless ($function->isStatic);
+                    my $numParameters = @{$function->parameters};
+                    my ($functionString, $dummy) = GenerateParametersCheck(\@implContent, $function, $dataNode, $numParameters, $implClassName, $functionImplementationName, $svgPropertyType, $svgPropertyOrListPropertyType, $svgListPropertyType);
+                    GenerateImplementationFunctionCall($function, $functionString, "    ", $svgPropertyType, $implClassName);
+                }
             } else {
-                push(@implContent, "    $implType* impl = static_cast<$implType*>(castedThis->impl());\n") unless ($function->isStatic);
-                if ($svgPropertyType and !$function->isStatic) {
-                    push(@implContent, "    if (impl->role() == AnimValRole) {\n");
-                    push(@implContent, "        setDOMException(exec, NO_MODIFICATION_ALLOWED_ERR);\n");
-                    push(@implContent, "        return JSValue::encode(jsUndefined());\n");
-                    push(@implContent, "    }\n");
-                    push(@implContent, "    $svgPropertyType& podImpl = impl->propertyReference();\n");
-                    $implIncludes{"ExceptionCode.h"} = 1;
+                if ($interfaceName eq "DOMWindow") {
+                    push(@implContent, "    $className* castedThis = toJSDOMWindow(exec->hostThisValue().toThisObject(exec));\n");
+                    push(@implContent, "    if (!castedThis)\n");
+                    push(@implContent, "        return throwVMTypeError(exec);\n");
+                } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
+                    push(@implContent, "    $className* castedThis = to${className}(exec->hostThisValue().toThisObject(exec));\n");
+                    push(@implContent, "    if (!castedThis)\n");
+                    push(@implContent, "        return throwVMTypeError(exec);\n");
+                } else {
+                    push(@implContent, "    JSValue thisValue = exec->hostThisValue();\n");
+                    push(@implContent, "    if (!thisValue.inherits(&${className}::s_info))\n");
+                    push(@implContent, "        return throwVMTypeError(exec);\n");
+                    push(@implContent, "    $className* castedThis = static_cast<$className*>(asObject(thisValue));\n");
                 }
 
-                GenerateArgumentsCountCheck(\@implContent, $function, $dataNode);
-
-                if (@{$function->raisesExceptions}) {
-                    push(@implContent, "    ExceptionCode ec = 0;\n");
-                }
+                push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(castedThis, &${className}::s_info);\n");
 
-                if ($function->signature->extendedAttributes->{"CheckSecurityForNode"} and !$function->isStatic) {
-                    push(@implContent, "    if (!shouldAllowAccessToNode(exec, impl->" . $function->signature->name . "(" . (@{$function->raisesExceptions} ? "ec" : "") .")))\n");
+                if ($dataNode->extendedAttributes->{"CheckSecurity"} and
+                    !$function->signature->extendedAttributes->{"DoNotCheckSecurity"}) {
+                    push(@implContent, "    if (!castedThis->allowsAccessFrom(exec))\n");
                     push(@implContent, "        return JSValue::encode(jsUndefined());\n");
-                    $implIncludes{"JSDOMBinding.h"} = 1;
                 }
 
-                if ($function->signature->name eq "addEventListener") {
-                    push(@implContent, GenerateEventListenerCall($className, "add"));
-                } elsif ($function->signature->name eq "removeEventListener") {
-                    push(@implContent, GenerateEventListenerCall($className, "remove"));
+                if ($isCustom) {
+                    push(@implContent, "    return JSValue::encode(castedThis->" . $functionImplementationName . "(exec));\n");
                 } else {
-                    my $numParameters = @{$function->parameters};
-                    my ($functionString, $dummy) = GenerateParametersCheck(\@implContent, $function, $dataNode, $numParameters, $implClassName, $functionImplementationName, $svgPropertyType, $svgPropertyOrListPropertyType, $svgListPropertyType);
-                    GenerateImplementationFunctionCall($function, $functionString, "    ", $svgPropertyType, $implClassName);
+                    push(@implContent, "    $implType* impl = static_cast<$implType*>(castedThis->impl());\n");
+                    if ($svgPropertyType) {
+                        push(@implContent, "    if (impl->role() == AnimValRole) {\n");
+                        push(@implContent, "        setDOMException(exec, NO_MODIFICATION_ALLOWED_ERR);\n");
+                        push(@implContent, "        return JSValue::encode(jsUndefined());\n");
+                        push(@implContent, "    }\n");
+                        push(@implContent, "    $svgPropertyType& podImpl = impl->propertyReference();\n");
+                        $implIncludes{"ExceptionCode.h"} = 1;
+                    }
+
+                    GenerateArgumentsCountCheck(\@implContent, $function, $dataNode);
+
+                    if (@{$function->raisesExceptions}) {
+                        push(@implContent, "    ExceptionCode ec = 0;\n");
+                    }
+
+                    if ($function->signature->extendedAttributes->{"CheckSecurityForNode"}) {
+                        push(@implContent, "    if (!shouldAllowAccessToNode(exec, impl->" . $function->signature->name . "(" . (@{$function->raisesExceptions} ? "ec" : "") .")))\n");
+                        push(@implContent, "        return JSValue::encode(jsUndefined());\n");
+                        $implIncludes{"JSDOMBinding.h"} = 1;
+                    }
+
+                    if ($function->signature->name eq "addEventListener") {
+                        push(@implContent, GenerateEventListenerCall($className, "add"));
+                    } elsif ($function->signature->name eq "removeEventListener") {
+                        push(@implContent, GenerateEventListenerCall($className, "remove"));
+                    } else {
+                        my $numParameters = @{$function->parameters};
+                        my ($functionString, $dummy) = GenerateParametersCheck(\@implContent, $function, $dataNode, $numParameters, $implClassName, $functionImplementationName, $svgPropertyType, $svgPropertyOrListPropertyType, $svgListPropertyType);
+                        GenerateImplementationFunctionCall($function, $functionString, "    ", $svgPropertyType, $implClassName);
+                    }
                 }
             }
 
@@ -2224,6 +2254,20 @@ sub GenerateImplementation
         }
     }
 
+    if ($interfaceName eq "HTMLPropertiesCollection") {
+        if ($dataNode->extendedAttributes->{"NamedGetter"}) {
+            push(@implContent, "bool ${className}::canGetItemsForName(ExecState*, $implClassName* collection, const Identifier& propertyName)\n");
+            push(@implContent, "{\n");
+            push(@implContent, "    return collection->hasNamedItem(identifierToAtomicString(propertyName));\n");
+            push(@implContent, "}\n\n");
+            push(@implContent, "JSValue ${className}::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)\n");
+            push(@implContent, "{\n");
+            push(@implContent, "    ${className}* thisObj = static_cast<$className*>(asObject(slotBase));\n");
+            push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->namedItem(identifierToAtomicString(propertyName)));\n");
+            push(@implContent, "}\n\n");
+        }
+    }
+
     if ((!$hasParent && !$dataNode->extendedAttributes->{"JSCustomIsReachable"})|| $dataNode->extendedAttributes->{"JSGenerateIsReachable"} || $dataNode->extendedAttributes->{"ActiveDOMObject"}) {
         push(@implContent, "static inline bool isObservable(JS${implClassName}* js${implClassName})\n");
         push(@implContent, "{\n");
@@ -3368,7 +3412,7 @@ sub GenerateConstructorDefinition
     if (!defined $numberOfConstructorParameters) {
         if (IsConstructorTemplate($dataNode, "Event")) {
             $numberOfConstructorParameters = 2;
-        } elsif ($dataNode->extendedAttributes->{"Constructor"} and !$dataNode->extendedAttributes->{"CustomConstructor"} and !$dataNode->extendedAttributes->{"JSCustomConstructor"}) {
+        } elsif ($dataNode->extendedAttributes->{"Constructor"}) {
             $numberOfConstructorParameters = @{$dataNode->constructor->parameters};
         }
     }
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 3978481bc..4543414ed 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -920,6 +920,13 @@ sub GenerateHeader
                 AddForwardDeclarationsForType($type, $public) unless $public and $needsDeprecatedVersion;
             }
 
+            my $functionConditionalString = GenerateConditionalString($function->signature);
+            if ($functionConditionalString) {
+                push(@headerFunctions, "#if ${functionConditionalString}\n") if $public;
+                push(@privateHeaderFunctions, "#if ${functionConditionalString}\n") unless $public;
+                push(@deprecatedHeaderFunctions, "#if ${functionConditionalString}\n") if $needsDeprecatedVersion;
+            }
+
             push(@headerFunctions, $functionDeclaration) if $public;
             push(@privateHeaderFunctions, $functionDeclaration) unless $public;
 
@@ -948,6 +955,12 @@ sub GenerateHeader
 
                 delete $publicInterfaces{$publicInterfaceKey};
             }
+
+            if ($functionConditionalString) {
+                push(@headerFunctions, "#endif\n") if $public;
+                push(@privateHeaderFunctions, "#endif\n") unless $public;
+                push(@deprecatedHeaderFunctions, "#endif\n") if $needsDeprecatedVersion;
+            }
         }
 
         if (@headerFunctions > 0) {
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 8c46f8c42..a5dabdfd5 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -3,7 +3,7 @@
 # Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006 Apple Computer, Inc.
-# Copyright (C) 2007, 2008, 2009 Google Inc.
+# Copyright (C) 2007, 2008, 2009, 2012 Google Inc.
 # Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 # Copyright (C) Research In Motion Limited 2010. All rights reserved.
 # Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
@@ -365,9 +365,12 @@ END
         my $attrExt = $function->signature->extendedAttributes;
 
         if (($attrExt->{"Custom"} || $attrExt->{"V8Custom"}) && !$attrExt->{"ImplementedBy"} && $function->{overloadIndex} == 1) {
+            my $conditionalString = GenerateConditionalString($function->signature);
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             push(@headerContent, <<END);
     static v8::Handle<v8::Value> ${name}Callback(const v8::Arguments&);
 END
+            push(@headerContent, "#endif // ${conditionalString}\n") if $conditionalString;
         }
 
         if ($attrExt->{"V8EnabledAtRuntime"}) {
@@ -384,19 +387,24 @@ END
     foreach my $attribute (@{$dataNode->attributes}) {
         my $name = $attribute->signature->name;
         my $attrExt = $attribute->signature->extendedAttributes;
+        my $conditionalString = GenerateConditionalString($attribute->signature);
         if (($attrExt->{"V8CustomGetter"} || $attrExt->{"CustomGetter"} ||
              $attrExt->{"V8Custom"} || $attrExt->{"Custom"}) &&
             !$attrExt->{"ImplementedBy"}) {
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             push(@headerContent, <<END);
     static v8::Handle<v8::Value> ${name}AccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo&);
 END
+            push(@headerContent, "#endif // ${conditionalString}\n") if $conditionalString;
         }
         if (($attrExt->{"V8CustomSetter"} || $attrExt->{"CustomSetter"} ||
              $attrExt->{"V8Custom"} || $attrExt->{"Custom"}) &&
             !$attrExt->{"ImplementedBy"}) {
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             push(@headerContent, <<END);
     static void ${name}AccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value>, const v8::AccessorInfo&);
 END
+            push(@headerContent, "#endif // ${conditionalString}\n") if $conditionalString;
         }
         if ($attrExt->{"V8EnabledAtRuntime"}) {
             push(@enabledAtRuntime, $attribute);
@@ -447,7 +455,9 @@ END
 }
 END
 
-    if (!($dataNode->extendedAttributes->{"CustomToJSObject"} or $dataNode->extendedAttributes->{"V8CustomToJSObject"})) {
+    if ($interfaceName eq 'Element') {
+        # Do not generate toV8() for performance optimization.
+    } elsif (!($dataNode->extendedAttributes->{"CustomToJSObject"} or $dataNode->extendedAttributes->{"V8CustomToJSObject"})) {
         push(@headerContent, <<END);
 
 inline v8::Handle<v8::Value> toV8(${nativeType}* impl${forceNewObjectParameter})
@@ -2988,7 +2998,8 @@ END
                 my $paramName = $param->name;
                 push(@implContent, "    v8::Handle<v8::Value> ${paramName}Handle = " . NativeToJSValue($param, $paramName) . ";\n");
                 push(@implContent, "    if (${paramName}Handle.IsEmpty()) {\n");
-                push(@implContent, "        CRASH();\n");
+                push(@implContent, "        if (!isScriptControllerTerminating())\n");
+                push(@implContent, "            CRASH();\n");
                 push(@implContent, "        return true;\n");
                 push(@implContent, "    }\n");
                 push(@args, "        ${paramName}Handle");
@@ -3029,21 +3040,28 @@ sub GenerateToV8Converters
 v8::Handle<v8::Object> ${className}::wrapSlow(${nativeType}* impl)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
 END
 
+    my $proxyInit;
     if (IsNodeSubType($dataNode)) {
-        push(@implContent, <<END);
-    if (impl->document()) {
-        proxy = V8Proxy::retrieve(impl->document()->frame());
-        if (proxy && static_cast<Node*>(impl->document()) == static_cast<Node*>(impl)) {
-            if (proxy->windowShell()->context().IsEmpty() && proxy->windowShell()->initContextIfNeeded()) {
-                // initContextIfNeeded may have created a wrapper for the object, retry from the start.
-                return ${className}::wrap(impl);
-            }
+        $proxyInit = "V8Proxy::retrieve(impl->document()->frame())";
+        # DocumentType nodes are the only nodes that may have a NULL document.
+        if ($interfaceName eq "DocumentType") {
+            $proxyInit = "impl->document() ? $proxyInit : 0";
         }
+    } else {
+        $proxyInit = "0";
     }
+    push(@implContent, <<END);
+    V8Proxy* proxy = $proxyInit;
+END
 
+    if (IsSubType($dataNode, "Document")) {
+        push(@implContent, <<END);
+    if (proxy && proxy->windowShell()->context().IsEmpty() && proxy->windowShell()->initContextIfNeeded()) {
+        // initContextIfNeeded may have created a wrapper for the object, retry from the start.
+        return ${className}::wrap(impl);
+    }
 END
     }
 
@@ -3085,7 +3103,7 @@ END
     }
 
     push(@implContent, <<END);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 END
     push(@implContent, "\n    impl->ref();\n") if IsRefPtrType($interfaceName);
diff --git a/Source/WebCore/bindings/scripts/IDLParser.pm b/Source/WebCore/bindings/scripts/IDLParser.pm
index 52671a335..4d126db84 100644
--- a/Source/WebCore/bindings/scripts/IDLParser.pm
+++ b/Source/WebCore/bindings/scripts/IDLParser.pm
@@ -326,6 +326,7 @@ sub ParseInterface
         my @interfaceMethods = split(/;/, $interfaceData);
 
         foreach my $line (@interfaceMethods) {
+            next if $line =~ /^\s*$/;
             if ($line =~ /\Wattribute\W/) {
                 $line =~ /$IDLStructure::interfaceAttributeSelector/;
 
@@ -361,11 +362,11 @@ sub ParseInterface
                 $setterException =~ s/\s+//g;
                 @{$newDataNode->getterExceptions} = split(/,/, $getterException);
                 @{$newDataNode->setterExceptions} = split(/,/, $setterException);
-            } elsif (($line !~ s/^\s*$//g) and ($line !~ /^\s*const/)) {
+            } elsif ($line !~ /^\s*($IDLStructure::extendedAttributeSyntax )?const\s+/) {
                 $line =~ /$IDLStructure::interfaceMethodSelector/ or die "Parsing error!\nSource:\n$line\n)";
 
-                my $isStatic = defined($1);
-                my $methodExtendedAttributes = (defined($2) ? $2 : " "); chop($methodExtendedAttributes);
+                my $methodExtendedAttributes = (defined($1) ? $1 : " "); chop($methodExtendedAttributes);
+                my $isStatic = defined($2);
                 my $methodType = (defined($3) ? $3 : die("Parsing error!\nSource:\n$line\n)"));
                 my $methodName = (defined($4) ? $4 : die("Parsing error!\nSource:\n$line\n)"));
                 my $methodSignature = (defined($5) ? $5 : die("Parsing error!\nSource:\n$line\n)"));
@@ -393,7 +394,7 @@ sub ParseInterface
 
                 my $arrayRef = $dataNode->functions;
                 push(@$arrayRef, $newDataNode);
-            } elsif ($line =~ /^\s*const/) {
+            } else {
                 $line =~ /$IDLStructure::constantSelector/;
                 my $constExtendedAttributes = (defined($1) ? $1 : " "); chop($constExtendedAttributes);
                 my $constType = (defined($2) ? $2 : die("Parsing error!\nSource:\n$line\n)"));
diff --git a/Source/WebCore/bindings/scripts/IDLStructure.pm b/Source/WebCore/bindings/scripts/IDLStructure.pm
index add0474d0..63f4090e9 100644
--- a/Source/WebCore/bindings/scripts/IDLStructure.pm
+++ b/Source/WebCore/bindings/scripts/IDLStructure.pm
@@ -96,7 +96,7 @@ our $extendedAttributeSyntax = qr/\[[^\[\]]*(?:(??{$IDLStructure::extendedAttrib
 # Regular expression based IDL 'syntactical tokenizer' used in the IDLParser
 our $moduleSelector = 'module\s*(' . $idlId . '*)\s*{';
 our $moduleNSSelector = 'module\s*(' . $idlId . '*)\s*\[ns\s*(' . $idlIdNs . '*)\s*(' . $idlIdNs . '*)\]\s*;';
-our $constantSelector = 'const\s*(' . $extendedAttributeSyntax . ' )?' . $supportedTypes . '\s*(' . $idlType . '*)\s*=\s*(' . $constValue . ')';
+our $constantSelector = '(' . $extendedAttributeSyntax . ' )?const\s+' . $supportedTypes . '\s*(' . $idlType . '*)\s*=\s*(' . $constValue . ')';
 our $raisesSelector = 'raises\s*\((' . $idlIdNsList . '*)\s*\)';
 our $getterRaisesSelector = '\bgetter\s+raises\s*\((' . $idlIdNsList . '*)\s*\)';
 our $setterRaisesSelector = '\bsetter\s+raises\s*\((' . $idlIdNsList . '*)\s*\)';
@@ -104,7 +104,7 @@ our $setterRaisesSelector = '\bsetter\s+raises\s*\((' . $idlIdNsList . '*)\s*\)'
 our $typeNamespaceSelector = '((?:' . $idlId . '*::)*)\s*(' . $idlDataType . '*)';
 
 our $interfaceSelector = 'interface\s*((?:' . $extendedAttributeSyntax . ' )?)(' . $idlIdNs . '*)\s*(?::(\s*[^{]*))?{([-a-zA-Z0-9_"=\s(),;:\[\]&\|]*)';
-our $interfaceMethodSelector = '\s*(static\s+)?((?:' . $extendedAttributeSyntax . ' )?)' . $supportedTypes . '\s*(' . $idlIdNs . '*)\s*\(\s*([a-zA-Z0-9:\s,=\[\]]*)';
+our $interfaceMethodSelector = '\s*((?:' . $extendedAttributeSyntax . ' )?)(static\s+)?' . $supportedTypes . '\s*(' . $idlIdNs . '*)\s*\(\s*([a-zA-Z0-9:\s,=\[\]]*)';
 our $interfaceParameterSelector = '(in|out)\s*((?:' . $extendedAttributeSyntax . ' )?)' . $supportedTypes . '\s*(' . $idlIdNs . '*)';
 
 our $interfaceAttributeSelector = '\s*(readonly attribute|attribute)\s*(' . $extendedAttributeSyntax . ' )?' . $supportedTypes . '\s*(' . $idlType . '*)';
diff --git a/Source/WebCore/bindings/scripts/resolve-supplemental.pl b/Source/WebCore/bindings/scripts/preprocess-idls.pl
index 168b349dc..168b349dc 100644
--- a/Source/WebCore/bindings/scripts/resolve-supplemental.pl
+++ b/Source/WebCore/bindings/scripts/preprocess-idls.pl
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
index 280460bbd..ca5588402 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
@@ -64,8 +64,12 @@ public:
     void setSupplementalNode(const WebDOMNode&);
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
     void supplementalMethod1();
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
     void supplementalMethod4();
+#endif
 
     WebCore::TestInterface* impl() const;
 
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
index ac076486f..9d63fdde7 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
@@ -541,60 +541,6 @@ void WebDOMTestObj::setConditionalAttr3(int newConditionalAttr3)
 }
 
 #endif
-#if ENABLE(Condition1)
-WebDOMTestObjectAConstructor WebDOMTestObj::conditionalAttr4() const
-{
-    if (!impl())
-        return WebDOMTestObjectAConstructor();
-
-    return toWebKit(WTF::getPtr(impl()->conditionalAttr4()));
-}
-
-void WebDOMTestObj::setConditionalAttr4(const WebDOMTestObjectAConstructor& newConditionalAttr4)
-{
-    if (!impl())
-        return;
-
-    impl()->setConditionalAttr4(toWebCore(newConditionalAttr4));
-}
-
-#endif
-#if ENABLE(Condition1) && ENABLE(Condition2)
-WebDOMTestObjectBConstructor WebDOMTestObj::conditionalAttr5() const
-{
-    if (!impl())
-        return WebDOMTestObjectBConstructor();
-
-    return toWebKit(WTF::getPtr(impl()->conditionalAttr5()));
-}
-
-void WebDOMTestObj::setConditionalAttr5(const WebDOMTestObjectBConstructor& newConditionalAttr5)
-{
-    if (!impl())
-        return;
-
-    impl()->setConditionalAttr5(toWebCore(newConditionalAttr5));
-}
-
-#endif
-#if ENABLE(Condition1) || ENABLE(Condition2)
-WebDOMTestObjectCConstructor WebDOMTestObj::conditionalAttr6() const
-{
-    if (!impl())
-        return WebDOMTestObjectCConstructor();
-
-    return toWebKit(WTF::getPtr(impl()->conditionalAttr6()));
-}
-
-void WebDOMTestObj::setConditionalAttr6(const WebDOMTestObjectCConstructor& newConditionalAttr6)
-{
-    if (!impl())
-        return;
-
-    impl()->setConditionalAttr6(toWebCore(newConditionalAttr6));
-}
-
-#endif
 WebDOMDocument WebDOMTestObj::contentDocument() const
 {
     if (!impl())
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
index 5d90fd261..8c72f2333 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
@@ -37,9 +37,6 @@ class WebDOMOptionsObject;
 class WebDOMSVGPoint;
 class WebDOMString;
 class WebDOMTestObj;
-class WebDOMTestObjectAConstructor;
-class WebDOMTestObjectBConstructor;
-class WebDOMTestObjectCConstructor;
 class WebDOMa;
 class WebDOMb;
 class WebDOMbool;
@@ -132,18 +129,6 @@ public:
     int conditionalAttr3() const;
     void setConditionalAttr3(int);
 #endif
-#if ENABLE(Condition1)
-    WebDOMTestObjectAConstructor conditionalAttr4() const;
-    void setConditionalAttr4(const WebDOMTestObjectAConstructor&);
-#endif
-#if ENABLE(Condition1) && ENABLE(Condition2)
-    WebDOMTestObjectBConstructor conditionalAttr5() const;
-    void setConditionalAttr5(const WebDOMTestObjectBConstructor&);
-#endif
-#if ENABLE(Condition1) || ENABLE(Condition2)
-    WebDOMTestObjectCConstructor conditionalAttr6() const;
-    void setConditionalAttr6(const WebDOMTestObjectCConstructor&);
-#endif
     WebDOMDocument contentDocument() const;
     WebDOMSVGPoint mutablePoint() const;
     void setMutablePoint(const WebDOMSVGPoint&);
@@ -175,13 +160,23 @@ public:
     void methodWithOptionalString(const WebDOMString& str);
     void methodWithOptionalStringIsUndefined(const WebDOMString& str);
     void methodWithOptionalStringIsNullString(const WebDOMString& str);
+#if ENABLE(Condition1)
     WebDOMString conditionalMethod1();
+#endif
+#if ENABLE(Condition1) && ENABLE(Condition2)
     void conditionalMethod2();
+#endif
+#if ENABLE(Condition1) || ENABLE(Condition2)
     void conditionalMethod3();
+#endif
     void classMethod();
     int classMethodWithOptional(int arg);
+#if ENABLE(Condition1)
     void overloadedMethod1(int arg);
+#endif
+#if ENABLE(Condition1)
     void overloadedMethod1(const WebDOMString& type);
+#endif
     void convert1(const WebDOMa& );
     void convert2(const WebDOMb& );
     void convert3(const WebDOMc& );
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
index a73ebf1c7..e6b5ac23c 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
@@ -104,7 +104,7 @@ webkit_dom_test_interface_supplemental_method4(WebKitDOMTestInterface* self)
     g_return_if_fail(self);
     WebCore::JSMainThreadNullState state;
     WebCore::TestInterface * item = WebKit::core(self);
-    TestSupplemental::supplementalMethod4(item);
+    WebCore::TestSupplemental::supplementalMethod4(item);
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
index 67220b7af..9ce2b68f3 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
@@ -65,6 +65,7 @@ void JSFloat64ArrayConstructor::finishCreation(ExecState* exec, JSDOMGlobalObjec
     Base::finishCreation(exec->globalData());
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSFloat64ArrayPrototype::self(exec, globalObject), DontDelete | ReadOnly);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(123), ReadOnly | DontDelete | DontEnum);
 }
 
 bool JSFloat64ArrayConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -199,7 +200,7 @@ void JSFloat64Array::put(JSCell* cell, ExecState* exec, const Identifier& proper
     Base::put(thisObject, exec, propertyName, value, slot);
 }
 
-void JSFloat64Array::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value)
+void JSFloat64Array::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool)
 {
     JSFloat64Array* thisObject = jsCast<JSFloat64Array*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
index ab2ec07a2..3a3b7cd8b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
@@ -43,7 +43,7 @@ public:
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static bool getOwnPropertySlotByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+    static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue, bool shouldThrow);
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
index a0ce24452..d16bcbd29 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
@@ -58,11 +58,17 @@ public:
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom attributes
+#if ENABLE(Condition11) || ENABLE(Condition12)
     JSC::JSValue supplementalStr3(JSC::ExecState*) const;
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
     void setSupplementalStr3(JSC::ExecState*, JSC::JSValue);
+#endif
 
     // Custom functions
+#if ENABLE(Condition11) || ENABLE(Condition12)
     JSC::JSValue supplementalMethod3(JSC::ExecState*);
+#endif
     TestInterface* impl() const { return m_impl; }
     void releaseImpl() { m_impl->deref(); m_impl = 0; }
 
@@ -149,19 +155,35 @@ protected:
 
 // Functions
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod1(JSC::ExecState*);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod2(JSC::ExecState*);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod3(JSC::ExecState*);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfaceConstructorFunctionSupplementalMethod4(JSC::ExecState*);
+#endif
 // Attributes
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::JSValue jsTestInterfaceSupplementalStr1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::JSValue jsTestInterfaceSupplementalStr2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestInterfaceSupplementalStr2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::JSValue jsTestInterfaceSupplementalStr3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestInterfaceSupplementalStr3(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::JSValue jsTestInterfaceSupplementalNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestInterfaceSupplementalNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
 JSC::JSValue jsTestInterfaceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index 97dcc8f2f..11a20df92 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -163,6 +163,7 @@ static const HashTableValue JSTestObjConstructorTableValues[] =
     { "CONST_JAVASCRIPT", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjCONST_JAVASCRIPT), (intptr_t)0, NoIntrinsic },
     { "classMethod", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjConstructorFunctionClassMethod), (intptr_t)0, NoIntrinsic },
     { "classMethodWithOptional", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjConstructorFunctionClassMethodWithOptional), (intptr_t)1, NoIntrinsic },
+    { "classMethod2", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjConstructorFunctionClassMethod2), (intptr_t)1, NoIntrinsic },
 #if ENABLE(Condition1)
     { "overloadedMethod1", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjConstructorFunctionOverloadedMethod1), (intptr_t)1, NoIntrinsic },
 #endif
@@ -2082,6 +2083,13 @@ EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethodWithOptional
     return JSValue::encode(result);
 }
 
+EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethod2(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
+    return JSValue::encode(JSTestObj::classMethod2(exec));
+}
+
 #if ENABLE(Condition1)
 static EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod11(ExecState* exec)
 {
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
index cb9dafb6d..28419eca1 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
@@ -65,6 +65,7 @@ public:
     // Custom functions
     JSC::JSValue customMethod(JSC::ExecState*);
     JSC::JSValue customMethodWithArgs(JSC::ExecState*);
+    static JSC::JSValue classMethod2(JSC::ExecState*);
     TestObj* impl() const { return m_impl; }
     void releaseImpl() { m_impl->deref(); m_impl = 0; }
 
@@ -184,13 +185,22 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalSt
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg(JSC::ExecState*);
+#if ENABLE(Condition1)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConditionalMethod1(JSC::ExecState*);
+#endif
+#if ENABLE(Condition1) && ENABLE(Condition2)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConditionalMethod2(JSC::ExecState*);
+#endif
+#if ENABLE(Condition1) || ENABLE(Condition2)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConditionalMethod3(JSC::ExecState*);
+#endif
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethod(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethodWithOptional(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethod2(JSC::ExecState*);
+#if ENABLE(Condition1)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod1(JSC::ExecState*);
+#endif
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithUnsignedLongArray(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionGetSVGDocument(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert1(JSC::ExecState*);
@@ -269,18 +279,30 @@ JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribut
 void setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjWithScriptArgumentsAndCallStackAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#if ENABLE(Condition1)
 JSC::JSValue jsTestObjConditionalAttr1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition1) && ENABLE(Condition2)
 JSC::JSValue jsTestObjConditionalAttr2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition1) || ENABLE(Condition2)
 JSC::JSValue jsTestObjConditionalAttr3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr3(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition1)
 JSC::JSValue jsTestObjConditionalAttr4Constructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr4Constructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition1) && ENABLE(Condition2)
 JSC::JSValue jsTestObjConditionalAttr5Constructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr5Constructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition1) || ENABLE(Condition2)
 JSC::JSValue jsTestObjConditionalAttr6Constructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr6Constructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
 JSC::JSValue jsTestObjCachedAttribute1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 JSC::JSValue jsTestObjCachedAttribute2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 JSC::JSValue jsTestObjContentDocument(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
index 7e3b1c402..b86f999d0 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
@@ -58,10 +58,18 @@ enum {
 - (DOMNode *)supplementalNode;
 - (void)setSupplementalNode:(DOMNode *)newSupplementalNode;
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 - (void)supplementalMethod1;
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 - (DOMTestObj *)supplementalMethod2:(NSString *)strArg objArg:(DOMTestObj *)objArg;
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 - (void)supplementalMethod3;
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 - (void)supplementalMethod4;
+#endif
 @end
 
 #endif
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
index 295741e67..aebc39fb3 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
@@ -195,13 +195,24 @@ enum {
 - (void)methodWithOptionalString:(NSString *)str;
 - (void)methodWithOptionalStringIsUndefined:(NSString *)str;
 - (void)methodWithOptionalStringIsNullString:(NSString *)str;
+#if ENABLE(Condition1)
 - (NSString *)conditionalMethod1;
+#endif
+#if ENABLE(Condition1) && ENABLE(Condition2)
 - (void)conditionalMethod2;
+#endif
+#if ENABLE(Condition1) || ENABLE(Condition2)
 - (void)conditionalMethod3;
+#endif
 - (void)classMethod;
 - (int)classMethodWithOptional:(int)arg;
+- (void)classMethod2:(int)arg;
+#if ENABLE(Condition1)
 - (void)overloadedMethod1:(int)arg;
+#endif
+#if ENABLE(Condition1)
 - (void)overloadedMethod1:(NSString *)type;
+#endif
 - (DOMSVGDocument *)getSVGDocument;
 - (void)convert1:(DOMa *);
 - (void)convert2:(DOMb *);
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
index 38f9c6bec..abd3b9cc5 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
@@ -932,6 +932,12 @@
     return IMPL->classMethodWithOptional(arg);
 }
 
+- (void)classMethod2:(int)arg
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->classMethod2(arg);
+}
+
 
 #if ENABLE(Condition1)
 - (void)overloadedMethod1:(int)arg
diff --git a/Source/WebCore/bindings/scripts/test/TestObj.idl b/Source/WebCore/bindings/scripts/test/TestObj.idl
index 171fda48c..fd5dbf930 100644
--- a/Source/WebCore/bindings/scripts/test/TestObj.idl
+++ b/Source/WebCore/bindings/scripts/test/TestObj.idl
@@ -151,7 +151,7 @@ module test {
         attribute [Conditional=Condition1&Condition2] TestObjectBConstructor conditionalAttr5;
         attribute [Conditional=Condition1|Condition2] TestObjectCConstructor conditionalAttr6;
 
-        const [Conditional=Condition1] unsigned short CONDITIONAL_CONST = 0;
+        [Conditional=Condition1] const unsigned short CONDITIONAL_CONST = 0;
 
 #if defined(TESTING_V8) || defined(TESTING_JS)
         readonly attribute [CachedAttribute] any cachedAttribute1;
@@ -172,11 +172,11 @@ module test {
         // Class methods within JavaScript (like what's used for IDBKeyRange).
         static void classMethod();
         static long classMethodWithOptional(in [Optional] long arg);
+        [Custom] static void classMethod2(in long arg);
 
         // Static method with conditional on overloaded methods
-
-        static [Conditional=Condition1] void overloadedMethod1(in long arg);
-        static [Conditional=Condition1] void overloadedMethod1(in DOMString type);
+        [Conditional=Condition1] static void overloadedMethod1(in long arg);
+        [Conditional=Condition1] static void overloadedMethod1(in DOMString type);
 
 #if defined(TESTING_V8)
         // 'V8EnabledAtRuntime' methods and attributes.
@@ -234,6 +234,6 @@ module test {
         const unsigned short CONST_VALUE_12 = 0x01;
         const unsigned short CONST_VALUE_13 = 0X20;
         const unsigned short CONST_VALUE_14 = 0x1abc;
-        const [Reflect=CONST_IMPL] unsigned short CONST_JAVASCRIPT = 15;
+        [Reflect=CONST_IMPL] const unsigned short CONST_JAVASCRIPT = 15;
     };
 }
diff --git a/Source/WebCore/bindings/scripts/test/TestSupplemental.idl b/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
index 0d7e96169..60514124b 100644
--- a/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
+++ b/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
@@ -44,6 +44,6 @@ module test {
         static void supplementalMethod4();
 
         const unsigned short SUPPLEMENTALCONSTANT1 = 1;
-        const [Reflect=CONST_IMPL] unsigned short SUPPLEMENTALCONSTANT2 = 2;
+        [Reflect=CONST_IMPL] const unsigned short SUPPLEMENTALCONSTANT2 = 2;
     };
 }
diff --git a/Source/WebCore/bindings/scripts/test/TestTypedArray.idl b/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
index cf5306d42..e816b3860 100644
--- a/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
+++ b/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=123,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
index 0a0f628b4..bdc6028be 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
@@ -125,7 +125,7 @@ v8::Handle<v8::Object> V8Float64Array::wrapSlow(Float64Array* impl)
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
index dc73c2690..ffc97e462 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
@@ -179,7 +179,7 @@ v8::Handle<v8::Object> V8TestActiveDOMObject::wrapSlow(TestActiveDOMObject* impl
     // Exit the node's context if it was entered.
     if (!context.IsEmpty())
         context->Exit();
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
index 8577a93e8..3a17f7a3b 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
@@ -87,7 +87,8 @@ bool V8TestCallback::callbackWithClass1Param(Class1* class1Param)
 
     v8::Handle<v8::Value> class1ParamHandle = toV8(class1Param);
     if (class1ParamHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
 
@@ -114,12 +115,14 @@ bool V8TestCallback::callbackWithClass2Param(Class2* class2Param, const String&
 
     v8::Handle<v8::Value> class2ParamHandle = toV8(class2Param);
     if (class2ParamHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
     v8::Handle<v8::Value> strArgHandle = v8String(strArg);
     if (strArgHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
 
@@ -147,7 +150,8 @@ bool V8TestCallback::callbackWithStringList(RefPtr<DOMStringList> listParam)
 
     v8::Handle<v8::Value> listParamHandle = toV8(listParam);
     if (listParamHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
index 699eb4b93..cbff6d4e7 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
@@ -115,7 +115,7 @@ v8::Handle<v8::Object> V8TestCustomNamedGetter::wrapSlow(TestCustomNamedGetter*
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
index d561eb491..7c06e34e6 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
@@ -150,7 +150,7 @@ v8::Handle<v8::Object> V8TestEventConstructor::wrapSlow(TestEventConstructor* im
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
index be0113383..1e6fbfa53 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
@@ -178,7 +178,7 @@ v8::Handle<v8::Object> V8TestEventTarget::wrapSlow(TestEventTarget* impl)
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
index a347626f1..a2c551860 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
@@ -311,7 +311,7 @@ v8::Handle<v8::Object> V8TestInterface::wrapSlow(TestInterface* impl)
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
index 1fa12d4eb..934f66839 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
@@ -115,7 +115,7 @@ v8::Handle<v8::Object> V8TestMediaQueryListListener::wrapSlow(TestMediaQueryList
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
index 8e6f61dff..5abce0e7d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
@@ -160,7 +160,7 @@ v8::Handle<v8::Object> V8TestNamedConstructor::wrapSlow(TestNamedConstructor* im
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 4a2029a22..530bbedc4 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -2011,6 +2011,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestObjTemplate(v8::Persi
     proto->Set(v8::String::New("methodThatRequiresAllArgsAndThrows"), v8::FunctionTemplate::New(TestObjInternal::methodThatRequiresAllArgsAndThrowsCallback, v8::Handle<v8::Value>(), methodThatRequiresAllArgsAndThrowsSignature));
     desc->Set(v8::String::New("classMethod"), v8::FunctionTemplate::New(TestObjInternal::classMethodCallback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
     desc->Set(v8::String::New("classMethodWithOptional"), v8::FunctionTemplate::New(TestObjInternal::classMethodWithOptionalCallback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
+    desc->Set(v8::String::New("classMethod2"), v8::FunctionTemplate::New(V8TestObj::classMethod2Callback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
 #if ENABLE(Condition1)
     desc->Set(v8::String::New("overloadedMethod1"), v8::FunctionTemplate::New(TestObjInternal::overloadedMethod1Callback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
 #endif // ENABLE(Condition1)
@@ -2093,7 +2094,7 @@ v8::Handle<v8::Object> V8TestObj::wrapSlow(TestObj* impl)
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
index cdeae3ed3..e59dab8c9 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
@@ -45,6 +45,7 @@ public:
     static WrapperTypeInfo info;
     static v8::Handle<v8::Value> customMethodCallback(const v8::Arguments&);
     static v8::Handle<v8::Value> customMethodWithArgsCallback(const v8::Arguments&);
+    static v8::Handle<v8::Value> classMethod2Callback(const v8::Arguments&);
     static v8::Handle<v8::Value> constructorCallback(const v8::Arguments&);
     static v8::Handle<v8::Value> customAttrAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo&);
     static void customAttrAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value>, const v8::AccessorInfo&);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index aaf298e3c..f329ab0f3 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -197,7 +197,7 @@ v8::Handle<v8::Object> V8TestSerializedScriptValueInterface::wrapSlow(TestSerial
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
index b4ee695fb..9e6b12848 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -151,7 +151,7 @@ v8::Handle<v8::Value> ensureNthValueOnKeyPath(v8::Handle<v8::Value>& rootValue,
 PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<SerializedScriptValue> value, const Vector<String>& keyPath)
 {
     IDB_TRACE("createIDBKeyFromSerializedValueAndKeyPath");
-    V8LocalContext localContext;
+    V8AuxiliaryContext context;
     v8::Handle<v8::Value> v8Value(value->deserialize());
     v8::Handle<v8::Value> v8Key(getNthValueOnKeyPath(v8Value, keyPath, keyPath.size()));
     if (v8Key.IsEmpty())
@@ -162,7 +162,7 @@ PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<Serializ
 PassRefPtr<SerializedScriptValue> injectIDBKeyIntoSerializedValue(PassRefPtr<IDBKey> key, PassRefPtr<SerializedScriptValue> value, const Vector<String>& keyPath)
 {
     IDB_TRACE("injectIDBKeyIntoSerializedValue");
-    V8LocalContext localContext;
+    V8AuxiliaryContext context;
     if (!keyPath.size())
         return 0;
 
diff --git a/Source/WebCore/bindings/v8/OptionsObject.cpp b/Source/WebCore/bindings/v8/OptionsObject.cpp
index f8db97e5a..e8c7dd9cc 100644
--- a/Source/WebCore/bindings/v8/OptionsObject.cpp
+++ b/Source/WebCore/bindings/v8/OptionsObject.cpp
@@ -43,6 +43,15 @@
 #include "V8TextTrack.h"
 #endif
 
+#if ENABLE(SCRIPTED_SPEECH)
+#include "SpeechRecognitionError.h"
+#include "SpeechRecognitionResult.h"
+#include "SpeechRecognitionResultList.h"
+#include "V8SpeechRecognitionError.h"
+#include "V8SpeechRecognitionResult.h"
+#include "V8SpeechRecognitionResultList.h"
+#endif
+
 namespace WebCore {
 
 OptionsObject::OptionsObject()
@@ -168,6 +177,19 @@ bool OptionsObject::get(const String& key, unsigned short& value) const
     return true;
 }
 
+bool OptionsObject::get(const String& key, short& value) const
+{
+    v8::Local<v8::Value> v8Value;
+    if (!getKey(key, v8Value))
+        return false;
+
+    v8::Local<v8::Int32> v8Int32 = v8Value->ToInt32();
+    if (v8Int32.IsEmpty())
+        return false;
+    value = static_cast<short>(v8Int32->Value());
+    return true;
+}
+
 bool OptionsObject::get(const String& key, unsigned& value) const
 {
     v8::Local<v8::Value> v8Value;
@@ -293,4 +315,58 @@ bool OptionsObject::get(const String& key, RefPtr<TrackBase>& value) const
 }
 #endif
 
+#if ENABLE(SCRIPTED_SPEECH)
+bool OptionsObject::get(const String& key, RefPtr<SpeechRecognitionError>& value) const
+{
+    v8::Local<v8::Value> v8Value;
+    if (!getKey(key, v8Value))
+        return false;
+
+    SpeechRecognitionError* source = 0;
+    if (v8Value->IsObject()) {
+        v8::Handle<v8::Object> wrapper = v8::Handle<v8::Object>::Cast(v8Value);
+        v8::Handle<v8::Object> speechRecognitionError = V8DOMWrapper::lookupDOMWrapper(V8SpeechRecognitionError::GetTemplate(), wrapper);
+        if (!speechRecognitionError.IsEmpty())
+            source = V8SpeechRecognitionError::toNative(speechRecognitionError);
+    }
+    value = source;
+    return true;
+}
+
+bool OptionsObject::get(const String& key, RefPtr<SpeechRecognitionResult>& value) const
+{
+    v8::Local<v8::Value> v8Value;
+    if (!getKey(key, v8Value))
+        return false;
+
+    SpeechRecognitionResult* source = 0;
+    if (v8Value->IsObject()) {
+        v8::Handle<v8::Object> wrapper = v8::Handle<v8::Object>::Cast(v8Value);
+        v8::Handle<v8::Object> speechRecognitionResult = V8DOMWrapper::lookupDOMWrapper(V8SpeechRecognitionResult::GetTemplate(), wrapper);
+        if (!speechRecognitionResult.IsEmpty())
+            source = V8SpeechRecognitionResult::toNative(speechRecognitionResult);
+    }
+    value = source;
+    return true;
+}
+
+bool OptionsObject::get(const String& key, RefPtr<SpeechRecognitionResultList>& value) const
+{
+    v8::Local<v8::Value> v8Value;
+    if (!getKey(key, v8Value))
+        return false;
+
+    SpeechRecognitionResultList* source = 0;
+    if (v8Value->IsObject()) {
+        v8::Handle<v8::Object> wrapper = v8::Handle<v8::Object>::Cast(v8Value);
+        v8::Handle<v8::Object> speechRecognitionResultList = V8DOMWrapper::lookupDOMWrapper(V8SpeechRecognitionResultList::GetTemplate(), wrapper);
+        if (!speechRecognitionResultList.IsEmpty())
+            source = V8SpeechRecognitionResultList::toNative(speechRecognitionResultList);
+    }
+    value = source;
+    return true;
+}
+
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/OptionsObject.h b/Source/WebCore/bindings/v8/OptionsObject.h
index 2c7e80a07..326037816 100644
--- a/Source/WebCore/bindings/v8/OptionsObject.h
+++ b/Source/WebCore/bindings/v8/OptionsObject.h
@@ -40,6 +40,9 @@ class DOMWindow;
 class IDBKeyRange;
 class Storage;
 class TrackBase;
+class SpeechRecognitionError;
+class SpeechRecognitionResult;
+class SpeechRecognitionResultList;
 
 class OptionsObject {
 public:
@@ -57,6 +60,7 @@ public:
     bool get(const String&, double&) const;
     bool get(const String&, String&) const;
     bool get(const String&, ScriptValue&) const;
+    bool get(const String&, short&) const;
     bool get(const String&, unsigned short&) const;
     bool get(const String&, unsigned&) const;
     bool get(const String&, unsigned long long&) const;
@@ -66,6 +70,11 @@ public:
 #if ENABLE(VIDEO_TRACK)
     bool get(const String&, RefPtr<TrackBase>&) const;
 #endif
+#if ENABLE(SCRIPTED_SPEECH)
+    bool get(const String&, RefPtr<SpeechRecognitionError>&) const;
+    bool get(const String&, RefPtr<SpeechRecognitionResult>&) const;
+    bool get(const String&, RefPtr<SpeechRecognitionResultList>&) const;
+#endif
     bool get(const String&, HashSet<AtomicString>&) const;
 
     bool getWithUndefinedOrNullCheck(const String&, String&) const;
diff --git a/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp b/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
index 9edda78f4..6097eca5c 100644
--- a/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
+++ b/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
@@ -58,7 +58,7 @@ bool RetainedDOMInfo::IsEquivalent(v8::RetainedObjectInfo* other)
 
 intptr_t RetainedDOMInfo::GetHash()
 {
-    return reinterpret_cast<intptr_t>(m_root);
+    return PtrHash<void*>::hash(m_root);
 }
     
 const char* RetainedDOMInfo::GetGroupLabel()
diff --git a/Source/WebCore/bindings/v8/ScheduledAction.cpp b/Source/WebCore/bindings/v8/ScheduledAction.cpp
index f76b58d1c..c4060476b 100644
--- a/Source/WebCore/bindings/v8/ScheduledAction.cpp
+++ b/Source/WebCore/bindings/v8/ScheduledAction.cpp
@@ -41,6 +41,7 @@
 
 #include "V8Binding.h"
 #include "V8Proxy.h"
+#include "V8RecursionScope.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 #include "WorkerThread.h"
@@ -141,7 +142,8 @@ void ScheduledAction::execute(WorkerContext* workerContext)
 {
     // In a Worker, the execution should always happen on a worker thread.
     ASSERT(workerContext->thread()->threadID() == currentThread());
-  
+
+    V8RecursionScope recursionScope(workerContext);
     WorkerScriptController* scriptController = workerContext->script();
 
     if (!m_function.IsEmpty() && m_function->IsFunction()) {
diff --git a/Source/WebCore/bindings/v8/ScriptEventListener.cpp b/Source/WebCore/bindings/v8/ScriptEventListener.cpp
index 34b028cbd..d5b50839a 100644
--- a/Source/WebCore/bindings/v8/ScriptEventListener.cpp
+++ b/Source/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -42,6 +42,13 @@
 
 namespace WebCore {
 
+static const String& eventParameterName(bool isSVGEvent)
+{
+    DEFINE_STATIC_LOCAL(const String, eventString, ("event"));
+    DEFINE_STATIC_LOCAL(const String, evtString, ("evt"));
+    return isSVGEvent ? evtString : eventString;
+}
+
 PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
 {
     ASSERT(node);
@@ -57,12 +64,11 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribu
         ScriptController* scriptController = frame->script();
         if (!scriptController->canExecuteScripts(AboutToExecuteScript))
             return 0;
-
         position = scriptController->eventHandlerPosition();
         sourceURL = node->document()->url().string();
     }
 
-    return V8LazyEventListener::create(attr->localName().string(), node->isSVGElement(), attr->value(), sourceURL, position, WorldContextHandle(UseMainWorld));
+    return V8LazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), sourceURL, position, node, WorldContextHandle(UseMainWorld));
 }
 
 PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -80,7 +86,8 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attri
 
     TextPosition position = scriptController->eventHandlerPosition();
     String sourceURL = frame->document()->url().string();
-    return V8LazyEventListener::create(attr->localName().string(), frame->document()->isSVGDocument(), attr->value(), sourceURL, position, WorldContextHandle(UseMainWorld));
+
+    return V8LazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), sourceURL, position, 0, WorldContextHandle(UseMainWorld));
 }
 
 String eventListenerHandlerBody(Document* document, EventListener* listener)
diff --git a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
index 04c5e0f4f..539eae6d1 100644
--- a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
+++ b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
@@ -90,13 +90,13 @@ size_t ScriptGCEvent::getUsedHeapSize()
 
 void ScriptGCEvent::gcPrologueCallback(v8::GCType type, v8::GCCallbackFlags flags)
 {
-    s_startTime = WTF::currentTimeMS();
+    s_startTime = WTF::monotonicallyIncreasingTime();
     s_usedHeapSize = getUsedHeapSize();
 }
 
 void ScriptGCEvent::gcEpilogueCallback(v8::GCType type, v8::GCCallbackFlags flags)
 {
-    double endTime = WTF::currentTimeMS();
+    double endTime = WTF::monotonicallyIncreasingTime();
     size_t collectedBytes = s_usedHeapSize - getUsedHeapSize();
     GCEventListeners listeners(eventListeners());
     for (GCEventListeners::iterator i = listeners.begin(); i != listeners.end(); ++i)
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index a7f65faf2..567693742 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -49,6 +49,18 @@ void ScriptProfiler::start(ScriptState* state, const String& title)
     v8::CpuProfiler::StartProfiling(v8String(title));
 }
 
+void ScriptProfiler::startForPage(Page*, const String& title)
+{
+    return start(0, title);
+}
+
+#if ENABLE(WORKERS)
+void ScriptProfiler::startForWorkerContext(WorkerContext*, const String& title)
+{
+    return start(0, title);
+}
+#endif
+
 PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String& title)
 {
     v8::HandleScope hs;
@@ -58,6 +70,20 @@ PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String&
     return profile ? ScriptProfile::create(profile) : 0;
 }
 
+PassRefPtr<ScriptProfile> ScriptProfiler::stopForPage(Page*, const String& title)
+{
+    // Use null script state to avoid filtering by context security token.
+    // All functions from all iframes should be visible from Inspector UI.
+    return stop(0, title);
+}
+
+#if ENABLE(WORKERS)
+PassRefPtr<ScriptProfile> ScriptProfiler::stopForWorkerContext(WorkerContext*, const String& title)
+{
+    return stop(0, title);
+}
+#endif
+
 void ScriptProfiler::collectGarbage()
 {
     v8::V8::LowMemoryNotification();
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.h b/Source/WebCore/bindings/v8/ScriptProfiler.h
index 8e8a16144..5d3b968a2 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.h
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.h
@@ -41,7 +41,9 @@
 namespace WebCore {
 
 class DOMWrapperVisitor;
+class Page;
 class ScriptObject;
+class WorkerContext;
 
 class ScriptProfiler {
     WTF_MAKE_NONCOPYABLE(ScriptProfiler);
@@ -58,7 +60,15 @@ public:
     static void collectGarbage();
     static ScriptObject objectByHeapObjectId(unsigned id);
     static void start(ScriptState* state, const String& title);
+    static void startForPage(Page*, const String& title);
+#if ENABLE(WORKERS)
+    static void startForWorkerContext(WorkerContext*, const String& title);
+#endif
     static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
+    static PassRefPtr<ScriptProfile> stopForPage(Page*, const String& title);
+#if ENABLE(WORKERS)
+    static PassRefPtr<ScriptProfile> stopForWorkerContext(WorkerContext*, const String& title);
+#endif
     static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String& title, HeapSnapshotProgress*);
     static bool causesRecompilation() { return false; }
     static bool isSampling() { return true; }
diff --git a/Source/WebCore/bindings/v8/ScriptState.cpp b/Source/WebCore/bindings/v8/ScriptState.cpp
index b03f160fb..c19fb9892 100644
--- a/Source/WebCore/bindings/v8/ScriptState.cpp
+++ b/Source/WebCore/bindings/v8/ScriptState.cpp
@@ -37,7 +37,7 @@
 #include "ScriptController.h"
 #include "V8DOMWindow.h"
 #include "V8HiddenPropertyName.h"
-
+#include "V8WorkerContext.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 #include "WorkerScriptController.h"
@@ -68,6 +68,22 @@ DOMWindow* ScriptState::domWindow() const
     return V8DOMWindow::toNative(v8RealGlobal);
 }
 
+ScriptExecutionContext* ScriptState::scriptExecutionContext() const
+{
+    v8::HandleScope handleScope;
+
+    v8::Handle<v8::Object> global = m_context->Global();
+    v8::Handle<v8::Object> v8RealGlobal = v8::Handle<v8::Object>::Cast(global->GetPrototype());
+    if (V8DOMWrapper::isWrapperOfType(v8RealGlobal, &V8DOMWindow::info))
+        return V8DOMWindow::toNative(v8RealGlobal)->scriptExecutionContext();
+#if ENABLE(WORKERS)
+    global = V8DOMWrapper::lookupDOMWrapper(V8WorkerContext::GetTemplate(), global);
+    if (!global.IsEmpty())
+        return V8WorkerContext::toNative(global)->scriptExecutionContext();
+#endif
+    return 0;
+}
+
 ScriptState* ScriptState::forContext(v8::Local<v8::Context> context)
 {
     v8::Context::Scope contextScope(context);
@@ -109,6 +125,11 @@ DOMWindow* domWindowFromScriptState(ScriptState* scriptState)
     return scriptState->domWindow();
 }
 
+ScriptExecutionContext* scriptExecutionContextFromScriptState(ScriptState* scriptState)
+{
+    return scriptState->scriptExecutionContext();
+}
+
 bool evalEnabled(ScriptState* scriptState)
 {
     v8::HandleScope handleScope;
diff --git a/Source/WebCore/bindings/v8/ScriptState.h b/Source/WebCore/bindings/v8/ScriptState.h
index e338c3f65..009886a17 100644
--- a/Source/WebCore/bindings/v8/ScriptState.h
+++ b/Source/WebCore/bindings/v8/ScriptState.h
@@ -42,6 +42,7 @@ class DOMWrapperWorld;
 class Frame;
 class Node;
 class Page;
+class ScriptExecutionContext;
 class WorkerContext;
 
 class ScriptState {
@@ -60,6 +61,7 @@ public:
     }
 
     DOMWindow* domWindow() const;
+    ScriptExecutionContext* scriptExecutionContext() const;
 
     static ScriptState* forContext(v8::Local<v8::Context>);
     static ScriptState* current();
@@ -108,6 +110,7 @@ private:
 };
 
 DOMWindow* domWindowFromScriptState(ScriptState*);
+ScriptExecutionContext* scriptExecutionContextFromScriptState(ScriptState*);
 
 bool evalEnabled(ScriptState*);
 void setEvalEnabled(ScriptState*, bool);
diff --git a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
index 9c56440c4..17a0379ef 100644
--- a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -34,6 +34,7 @@
 #include "DateExtension.h"
 #include "Document.h"
 #include "Event.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "InspectorCounters.h"
 #include "V8Binding.h"
@@ -58,7 +59,9 @@ V8AbstractEventListener::V8AbstractEventListener(bool isAttribute, const WorldCo
     , m_isAttribute(isAttribute)
     , m_worldContext(worldContext)
 {
-    InspectorCounters::incrementCounter(InspectorCounters::JSEventListenerCounter);
+#if ENABLE(INSPECTOR)
+    ThreadLocalInspectorCounters::current().incrementCounter(ThreadLocalInspectorCounters::JSEventListenerCounter);
+#endif
 }
 
 V8AbstractEventListener::~V8AbstractEventListener()
@@ -69,7 +72,9 @@ V8AbstractEventListener::~V8AbstractEventListener()
         V8EventListenerList::clearWrapper(listener, m_isAttribute);
     }
     disposeListenerObject();
-    InspectorCounters::decrementCounter(InspectorCounters::JSEventListenerCounter);
+#if ENABLE(INSPECTOR)
+    ThreadLocalInspectorCounters::current().decrementCounter(ThreadLocalInspectorCounters::JSEventListenerCounter);
+#endif
 }
 
 void V8AbstractEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
@@ -136,7 +141,7 @@ void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context
     v8::Local<v8::Value> returnValue;
 
     // In beforeunload/unload handlers, we want to avoid sleeps which do tight loops of calling Date.getTime().
-    if (event->type() == "beforeunload" || event->type() == "unload")
+    if (event->type() == eventNames().beforeunloadEvent || event->type() == eventNames().unloadEvent)
         DateExtension::get()->setAllowSleep(false);
 
     {
@@ -173,7 +178,7 @@ void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context
         tryCatch.Reset();
     }
 
-    if (event->type() == "beforeunload" || event->type() == "unload")
+    if (event->type() == eventNames().beforeunloadEvent || event->type() == eventNames().unloadEvent)
         DateExtension::get()->setAllowSleep(true);
 
     ASSERT(!V8Proxy::handleOutOfMemory() || returnValue.IsEmpty());
diff --git a/Source/WebCore/bindings/v8/V8Binding.cpp b/Source/WebCore/bindings/v8/V8Binding.cpp
index 4fd672f45..2ae94e4c1 100644
--- a/Source/WebCore/bindings/v8/V8Binding.cpp
+++ b/Source/WebCore/bindings/v8/V8Binding.cpp
@@ -210,7 +210,7 @@ int toInt32(v8::Handle<v8::Value> value, bool& ok)
 {
     ok = true;
     
-    // Fast case.  The value is already a 32-bit integer.
+    // Fast case. The value is already a 32-bit integer.
     if (value->IsInt32())
         return value->Int32Value();
     
@@ -243,11 +243,10 @@ uint32_t toUInt32(v8::Handle<v8::Value> value, bool& ok)
 {
     ok = true;
 
-    // FIXME: there is currently no Value::IsUint32(). This code does
-    // some contortions to avoid silently converting out-of-range
-    // values to uint32_t.
+    // Fast case. The value is already a 32-bit unsigned integer.
+    if (value->IsUint32())
+        return value->Uint32Value();
 
-    // Fast case.  The value is already a 32-bit positive integer.
     if (value->IsInt32()) {
         int32_t result = value->Int32Value();
         if (result >= 0)
@@ -275,93 +274,7 @@ uint32_t toUInt32(v8::Handle<v8::Value> value, bool& ok)
         return 0;
     }
 
-    // FIXME: v8::Uint32::Value is not defined!
-    // http://code.google.com/p/v8/issues/detail?id=624
-    v8::Local<v8::Int32> intValue = value->ToInt32();
-    if (intValue.IsEmpty()) {
-        ok = false;
-        return 0;
-    }
-
-    return static_cast<uint32_t>(intValue->Value());
-}
-
-String toWebCoreString(const v8::Arguments& args, int index) {
-    return v8ValueToWebCoreString(args[index]);
-}
-
-    
-String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
-{
-    if (value->IsNull()) 
-        return String();
-    return v8ValueToWebCoreString(value);
-}
-
-AtomicString toAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
-{
-    if (value->IsNull())
-        return AtomicString();
-    return v8ValueToAtomicWebCoreString(value);
-}
-
-String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value)
-{
-    if (value->IsNull() || value->IsUndefined())
-        return String();
-    return toWebCoreString(value);
-}
-
-bool isUndefinedOrNull(v8::Handle<v8::Value> value)
-{
-    return value->IsNull() || value->IsUndefined();
-}
-
-bool isHostObject(v8::Handle<v8::Object> object)
-{
-    // If the object has any internal fields, then we won't be able to serialize or deserialize
-    // them; conveniently, this is also a quick way to detect DOM wrapper objects, because
-    // the mechanism for these relies on data stored in these fields. We should
-    // catch external array data and external pixel data as a special case (noting that CanvasPixelArrays
-    // can't be serialized without being wrapped by ImageData according to the standard).
-    return object->InternalFieldCount() || object->HasIndexedPropertiesInPixelData() || object->HasIndexedPropertiesInExternalArrayData();
-}
-
-v8::Handle<v8::Boolean> v8Boolean(bool value)
-{
-    return value ? v8::True() : v8::False();
-}
-
-v8::Handle<v8::String> v8UndetectableString(const String& str)
-{
-    return v8::String::NewUndetectable(fromWebCoreString(str), str.length());
-}
-
-v8::Handle<v8::Value> v8StringOrNull(const String& str)
-{
-    return str.isNull() ? v8::Handle<v8::Value>(v8::Null()) : v8::Handle<v8::Value>(v8String(str));
-}
-
-v8::Handle<v8::Value> v8StringOrUndefined(const String& str)
-{
-    return str.isNull() ? v8::Handle<v8::Value>(v8::Undefined()) : v8::Handle<v8::Value>(v8String(str));
-}
-
-v8::Handle<v8::Value> v8StringOrFalse(const String& str)
-{
-    return str.isNull() ? v8::Handle<v8::Value>(v8::False()) : v8::Handle<v8::Value>(v8String(str));
-}
-
-double toWebCoreDate(v8::Handle<v8::Value> object)
-{
-    return (object->IsDate() || object->IsNumber()) ? object->NumberValue() : std::numeric_limits<double>::quiet_NaN();
-}
-
-v8::Handle<v8::Value> v8DateOrNull(double value)
-{
-    if (isfinite(value))
-        return v8::Date::New(value);
-    return v8::Null();
+    return uintValue->Value();
 }
 
 template <class S> struct StringTraits
diff --git a/Source/WebCore/bindings/v8/V8Binding.h b/Source/WebCore/bindings/v8/V8Binding.h
index 0bb5e936b..d0092f980 100644
--- a/Source/WebCore/bindings/v8/V8Binding.h
+++ b/Source/WebCore/bindings/v8/V8Binding.h
@@ -129,6 +129,7 @@ namespace WebCore {
         DOMDataList& allStores() { return m_domDataList; }
 
         V8HiddenPropertyName* hiddenPropertyName() { return &m_hiddenPropertyName; }
+        v8::Persistent<v8::Context>& auxiliaryContext() { return m_auxiliaryContext; }
 
         void registerDOMDataStore(DOMDataStore* domDataStore) 
         {
@@ -169,6 +170,7 @@ namespace WebCore {
         DOMDataStore* m_domDataStore;
 
         V8HiddenPropertyName m_hiddenPropertyName;
+        v8::Persistent<v8::Context> m_auxiliaryContext;
 
         bool m_constructorMode;
         friend class ConstructorMode;
@@ -327,7 +329,10 @@ namespace WebCore {
         return v8ValueToWebCoreString(object);
     }
 
-    String toWebCoreString(const v8::Arguments&, int index);
+    inline String toWebCoreString(const v8::Arguments& args, int index)
+    {
+        return v8ValueToWebCoreString(args[index]);
+    }
 
     // The string returned by this function is still owned by the argument
     // and will be deallocated when the argument is deallocated.
@@ -336,27 +341,62 @@ namespace WebCore {
         return reinterpret_cast<const uint16_t*>(str.characters());
     }
 
-    bool isUndefinedOrNull(v8::Handle<v8::Value> value);
+    inline bool isUndefinedOrNull(v8::Handle<v8::Value> value)
+    {
+        return value->IsNull() || value->IsUndefined();
+    }
 
     // Returns true if the provided object is to be considered a 'host object', as used in the
     // HTML5 structured clone algorithm.
-    bool isHostObject(v8::Handle<v8::Object>);
+    inline bool isHostObject(v8::Handle<v8::Object> object)
+    {
+        // If the object has any internal fields, then we won't be able to serialize or deserialize
+        // them; conveniently, this is also a quick way to detect DOM wrapper objects, because
+        // the mechanism for these relies on data stored in these fields. We should
+        // catch external array data and external pixel data as a special case (noting that CanvasPixelArrays
+        // can't be serialized without being wrapped by ImageData according to the standard).
+        return object->InternalFieldCount() || object->HasIndexedPropertiesInPixelData() || object->HasIndexedPropertiesInExternalArrayData();
+    }
 
-    v8::Handle<v8::Boolean> v8Boolean(bool value);
+    inline v8::Handle<v8::Boolean> v8Boolean(bool value)
+    {
+        return value ? v8::True() : v8::False();
+    }
 
-    String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value);
+    inline String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
+    {
+        return value->IsNull() ? String() : v8ValueToWebCoreString(value);
+    }
 
-    AtomicString toAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value);
+    inline AtomicString toAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
+    {
+        return value->IsNull() ? AtomicString() : v8ValueToAtomicWebCoreString(value);
+    }
 
-    String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value);
+    inline String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value)
+    {
+        return (value->IsNull() || value->IsUndefined()) ? String() : toWebCoreString(value);
+    }
 
-    v8::Handle<v8::String> v8UndetectableString(const String& str);
+    inline v8::Handle<v8::String> v8UndetectableString(const String& str)
+    {
+        return v8::String::NewUndetectable(fromWebCoreString(str), str.length());
+    }
 
-    v8::Handle<v8::Value> v8StringOrNull(const String& str);
+    inline v8::Handle<v8::Value> v8StringOrNull(const String& str)
+    {
+        return str.isNull() ? v8::Handle<v8::Value>(v8::Null()) : v8::Handle<v8::Value>(v8String(str));
+    }
 
-    v8::Handle<v8::Value> v8StringOrUndefined(const String& str);
+    inline v8::Handle<v8::Value> v8StringOrUndefined(const String& str)
+    {
+        return str.isNull() ? v8::Handle<v8::Value>(v8::Undefined()) : v8::Handle<v8::Value>(v8String(str));
+    }
 
-    v8::Handle<v8::Value> v8StringOrFalse(const String& str);
+    inline v8::Handle<v8::Value> v8StringOrFalse(const String& str)
+    {
+        return str.isNull() ? v8::Handle<v8::Value>(v8::False()) : v8::Handle<v8::Value>(v8String(str));
+    }
 
     template <class T> v8::Handle<v8::Value> v8NumberArray(const Vector<T>& values)
     {
@@ -367,9 +407,15 @@ namespace WebCore {
         return result;
     }
 
-    double toWebCoreDate(v8::Handle<v8::Value> object);
+    inline double toWebCoreDate(v8::Handle<v8::Value> object)
+    {
+        return (object->IsDate() || object->IsNumber()) ? object->NumberValue() : std::numeric_limits<double>::quiet_NaN();
+    }
 
-    v8::Handle<v8::Value> v8DateOrNull(double value);
+    inline v8::Handle<v8::Value> v8DateOrNull(double value)
+    {
+        return isfinite(value) ? v8::Date::New(value) : v8::Handle<v8::Value>(v8::Null());
+    }
 
     v8::Persistent<v8::FunctionTemplate> createRawTemplate();
 
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index 8d16a1037..8c02201f7 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -339,7 +339,7 @@ bool V8DOMWindowShell::initContextIfNeeded()
 
     setSecurityToken();
 
-    m_frame->loader()->client()->didCreateScriptContext(m_context, 0);
+    m_frame->loader()->client()->didCreateScriptContext(m_context, 0, 0);
 
     // FIXME: This is wrong. We should actually do this for the proper world once
     // we do isolated worlds the WebCore way.
diff --git a/Source/WebCore/bindings/v8/V8GCController.cpp b/Source/WebCore/bindings/v8/V8GCController.cpp
index 826eb3a94..540312432 100644
--- a/Source/WebCore/bindings/v8/V8GCController.cpp
+++ b/Source/WebCore/bindings/v8/V8GCController.cpp
@@ -210,7 +210,7 @@ public:
 
     virtual intptr_t GetHash()
     {
-        return reinterpret_cast<intptr_t>(m_object);
+        return PtrHash<void*>::hash(m_object);
     }
     
     virtual const char* GetLabel()
diff --git a/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp b/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp
index 93ac75178..901fa5e44 100644
--- a/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp
+++ b/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp
@@ -33,6 +33,7 @@
 
 #include "V8Binding.h"
 #include <string.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -40,24 +41,24 @@ namespace WebCore {
 #define V8_AS_STRING(x) V8_AS_STRING_IMPL(x)
 #define V8_AS_STRING_IMPL(x) #x
 
-#define V8_DEFINE_PROPERTY(name) \
+#define V8_HIDDEN_PROPERTY_PREFIX "WebCore::HiddenProperty::"
+
+#define V8_DEFINE_HIDDEN_PROPERTY(name) \
 v8::Handle<v8::String> V8HiddenPropertyName::name() \
 { \
     V8HiddenPropertyName* hiddenPropertyName = V8BindingPerIsolateData::current()->hiddenPropertyName(); \
     if (hiddenPropertyName->m_##name.IsEmpty()) { \
-        hiddenPropertyName->m_##name = createString("WebCore::HiddenProperty::" V8_AS_STRING(name)); \
+        hiddenPropertyName->m_##name = createString(V8_HIDDEN_PROPERTY_PREFIX V8_AS_STRING(name)); \
     } \
     return hiddenPropertyName->m_##name; \
 }
 
-V8_HIDDEN_PROPERTIES(V8_DEFINE_PROPERTY);
-
-static const char hiddenReferenceNamePrefix[] = "WebCore::HiddenReference::";
+V8_HIDDEN_PROPERTIES(V8_DEFINE_HIDDEN_PROPERTY);
 
 v8::Handle<v8::String> V8HiddenPropertyName::hiddenReferenceName(const char* name)
 {
     Vector<char, 64> prefixedName;
-    prefixedName.append(hiddenReferenceNamePrefix, sizeof(hiddenReferenceNamePrefix) - 1);
+    prefixedName.append(V8_HIDDEN_PROPERTY_PREFIX, sizeof(V8_HIDDEN_PROPERTY_PREFIX) - 1);
     ASSERT(name && strlen(name));
     prefixedName.append(name, strlen(name));
     return v8::String::NewSymbol(prefixedName.data(), static_cast<int>(prefixedName.size()));
diff --git a/Source/WebCore/bindings/v8/V8HiddenPropertyName.h b/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
index c8f53527f..ef025d39f 100644
--- a/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
+++ b/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
@@ -44,8 +44,10 @@ namespace WebCore {
     V(sleepFunction) \
     V(toStringString) \
     V(event) \
-    V(state)
-
+    V(state) \
+    V(domStringMap) \
+    V(domTokenList) \
+    V(ownerNode)
 
     class V8HiddenPropertyName {
     public:
diff --git a/Source/WebCore/bindings/v8/V8IsolatedContext.cpp b/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
index 9e57dd5b6..ba7505cf9 100644
--- a/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
+++ b/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
@@ -75,7 +75,7 @@ V8IsolatedContext::V8IsolatedContext(V8Proxy* proxy, int extensionGroup, int wor
     //        changes.
     m_context->get()->UseDefaultSecurityToken();
 
-    m_frame->loader()->client()->didCreateScriptContext(context(), m_world->id());
+    m_frame->loader()->client()->didCreateScriptContext(context(), extensionGroup, m_world->id());
 }
 
 void V8IsolatedContext::destroy()
diff --git a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
index 9775d32a2..d2eaef1e5 100644
--- a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -32,9 +32,17 @@
 #include "V8LazyEventListener.h"
 
 #include "ContentSecurityPolicy.h"
+#include "Document.h"
 #include "Frame.h"
+#include "HTMLElement.h"
+#include "HTMLFormElement.h"
+#include "Node.h"
 #include "V8Binding.h"
+#include "V8DOMWrapper.h"
+#include "V8Document.h"
+#include "V8HTMLFormElement.h"
 #include "V8HiddenPropertyName.h"
+#include "V8Node.h"
 #include "V8Proxy.h"
 #include "WorldContextHandle.h"
 
@@ -42,14 +50,29 @@
 
 namespace WebCore {
 
-V8LazyEventListener::V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, const TextPosition& position, const WorldContextHandle& worldContext)
+V8LazyEventListener::V8LazyEventListener(const AtomicString& functionName, const AtomicString& eventParameterName, const String& code, const String sourceURL, const TextPosition& position, PassRefPtr<Node> node, const WorldContextHandle& worldContext)
     : V8AbstractEventListener(true, worldContext)
     , m_functionName(functionName)
-    , m_isSVGEvent(isSVGEvent)
+    , m_eventParameterName(eventParameterName)
     , m_code(code)
     , m_sourceURL(sourceURL)
+    , m_node(node)
+    , m_formElement(0)
     , m_position(position)
 {
+    if (m_node && m_node->isHTMLElement())
+        m_formElement = static_cast<HTMLElement*>(m_node.get())->form();
+}
+
+template<typename T>
+v8::Handle<v8::Object> toObjectWrapper(T* domObject)
+{
+    if (!domObject)
+        return v8::Object::New();
+    v8::Handle<v8::Value> value = toV8(domObject);
+    if (value.IsEmpty())
+        return v8::Object::New();
+    return value.As<v8::Object>();
 }
 
 v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(ScriptExecutionContext* context, v8::Handle<v8::Value> jsEvent, Event* event)
@@ -58,7 +81,7 @@ v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(ScriptExecutionCo
     if (listenerObject.IsEmpty())
         return v8::Local<v8::Value>();
 
-    v8::Local<v8::Function> handlerFunction = v8::Local<v8::Function>::Cast(listenerObject);
+    v8::Local<v8::Function> handlerFunction = listenerObject.As<v8::Function>();
     v8::Local<v8::Object> receiver = getReceiverObject(event);
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
@@ -104,8 +127,6 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
 
     v8::Context::Scope scope(v8Context);
 
-    // FIXME: cache the wrapper function.
-
     // Nodes other than the document object, when executing inline event
     // handlers push document, form, and the target node on the scope chain.
     // We do this by using 'with' statement.
@@ -115,60 +136,81 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
     //
     // Don't use new lines so that lines in the modified handler
     // have the same numbers as in the original code.
-    // FIXME: What about m_eventParameterName from JSLazyEventListener?
-    // FIXME: This approach is a giant hack! What if m_code escapes to run
-    //        arbitrary script?
-    String code = "(function (evt) {" \
-            "with (this.ownerDocument ? this.ownerDocument : {}) {" \
-            "with (this.form ? this.form : {}) {" \
-            "with (this) {" \
-            "return (function(evt){";
+    // FIXME: V8 does not allow us to programmatically create object environments so
+    //        we have to do this hack! What if m_code escapes to run arbitrary script?
+    //
+    String code = "(function() {" \
+        "with (arguments[2]) {" \
+        "with (arguments[1]) {" \
+        "with (arguments[0]) {";
+    code.append("return function(");
+    code.append(m_eventParameterName);
+    code.append(") {");
     code.append(m_code);
     // Insert '\n' otherwise //-style comments could break the handler.
-    code.append(  "\n}).call(this, evt);}}}})");
+    code.append("\n};}}}})");
     v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
+
     v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_sourceURL, m_position);
-    if (!script.IsEmpty()) {
-        // Call v8::Script::Run() directly to avoid an erroneous call to V8RecursionScope::didLeaveScriptContext().
-        // FIXME: Remove this code when we stop doing the 'with' hack above.
-        v8::Local<v8::Value> value = script->Run();
-        if (!value.IsEmpty()) {
-            ASSERT(value->IsFunction());
-
-            v8::Local<v8::Function> wrappedFunction = v8::Local<v8::Function>::Cast(value);
-
-            // Change the toString function on the wrapper function to avoid it
-            // returning the source for the actual wrapper function. Instead it
-            // returns source for a clean wrapper function with the event
-            // argument wrapping the event source code. The reason for this is
-            // that some web sites use toString on event functions and eval the
-            // source returned (sometimes a RegExp is applied as well) for some
-            // other use. That fails miserably if the actual wrapper source is
-            // returned.
-            v8::Persistent<v8::FunctionTemplate>& toStringTemplate =
-                V8BindingPerIsolateData::current()->lazyEventListenerToStringTemplate();
-            if (toStringTemplate.IsEmpty())
-                toStringTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8LazyEventListenerToString));
-            v8::Local<v8::Function> toStringFunction;
-            if (!toStringTemplate.IsEmpty())
-                toStringFunction = toStringTemplate->GetFunction();
-            if (!toStringFunction.IsEmpty()) {
-                String toStringResult = "function ";
-                toStringResult.append(m_functionName);
-                toStringResult.append("(");
-                toStringResult.append(m_isSVGEvent ? "evt" : "event");
-                toStringResult.append(") {\n  ");
-                toStringResult.append(m_code);
-                toStringResult.append("\n}");
-                wrappedFunction->SetHiddenValue(V8HiddenPropertyName::toStringString(), v8ExternalString(toStringResult));
-                wrappedFunction->Set(v8::String::New("toString"), toStringFunction);
-            }
-
-            wrappedFunction->SetName(v8::String::New(fromWebCoreString(m_functionName), m_functionName.length()));
-
-            setListenerObject(wrappedFunction);
-        }
+    if (script.IsEmpty())
+        return;
+
+    // Call v8::Script::Run() directly to avoid an erroneous call to V8RecursionScope::didLeaveScriptContext().
+    // FIXME: Remove this code when we stop doing the 'with' hack above.
+    v8::Local<v8::Value> value = script->Run();
+    if (value.IsEmpty())
+        return;
+
+    // Call the outer function to get the inner function.
+    ASSERT(value->IsFunction());
+    v8::Local<v8::Function> intermediateFunction = value.As<v8::Function>();
+
+    v8::Handle<v8::Object> nodeWrapper = toObjectWrapper<Node>(m_node.get());
+    v8::Handle<v8::Object> formWrapper = toObjectWrapper<HTMLFormElement>(m_formElement.get());
+    v8::Handle<v8::Object> documentWrapper = toObjectWrapper<Document>(m_node ? m_node->ownerDocument() : 0);
+
+    m_node.clear();
+    m_formElement.clear();
+
+    v8::Handle<v8::Value> parameters[3] = { nodeWrapper, formWrapper, documentWrapper };
+
+    // Use Call directly to avoid an erroneous call to V8RecursionScope::didLeaveScriptContext().
+    // FIXME: Remove this code when we stop doing the 'with' hack above.
+    v8::Local<v8::Value> innerValue = intermediateFunction->Call(v8Context->Global(), 3, parameters);
+
+    ASSERT(innerValue->IsFunction());
+    v8::Local<v8::Function> wrappedFunction = innerValue.As<v8::Function>();
+
+    // Change the toString function on the wrapper function to avoid it
+    // returning the source for the actual wrapper function. Instead it
+    // returns source for a clean wrapper function with the event
+    // argument wrapping the event source code. The reason for this is
+    // that some web sites use toString on event functions and eval the
+    // source returned (sometimes a RegExp is applied as well) for some
+    // other use. That fails miserably if the actual wrapper source is
+    // returned.
+    v8::Persistent<v8::FunctionTemplate>& toStringTemplate =
+        V8BindingPerIsolateData::current()->lazyEventListenerToStringTemplate();
+    if (toStringTemplate.IsEmpty())
+        toStringTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8LazyEventListenerToString));
+    v8::Local<v8::Function> toStringFunction;
+    if (!toStringTemplate.IsEmpty())
+        toStringFunction = toStringTemplate->GetFunction();
+    if (!toStringFunction.IsEmpty()) {
+        String toStringResult = "function ";
+        toStringResult.append(m_functionName);
+        toStringResult.append("(");
+        toStringResult.append(m_eventParameterName);
+        toStringResult.append(") {\n  ");
+        toStringResult.append(m_code);
+        toStringResult.append("\n}");
+        wrappedFunction->SetHiddenValue(V8HiddenPropertyName::toStringString(), v8ExternalString(toStringResult));
+        wrappedFunction->Set(v8::String::New("toString"), toStringFunction);
     }
+
+    wrappedFunction->SetName(v8::String::New(fromWebCoreString(m_functionName), m_functionName.length()));
+
+    setListenerObject(wrappedFunction);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8LazyEventListener.h b/Source/WebCore/bindings/v8/V8LazyEventListener.h
index 4d364888a..1fb565add 100644
--- a/Source/WebCore/bindings/v8/V8LazyEventListener.h
+++ b/Source/WebCore/bindings/v8/V8LazyEventListener.h
@@ -41,14 +41,16 @@ namespace WebCore {
 
     class Event;
     class Frame;
+    class HTMLFormElement;
+    class Node;
 
     // V8LazyEventListener is a wrapper for a JavaScript code string that is compiled and evaluated when an event is fired.
-    // A V8LazyEventListener is always a HTML event handler.
+    // A V8LazyEventListener is either a HTML or SVG event handler.
     class V8LazyEventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8LazyEventListener> create(const String& functionName, bool isSVGEvent, const String& code, const String& sourceURL, const TextPosition& position, const WorldContextHandle& worldContext)
+        static PassRefPtr<V8LazyEventListener> create(const AtomicString& functionName, const AtomicString& eventParameterName, const String& code, const String& sourceURL, const TextPosition& position, PassRefPtr<Node> node, const WorldContextHandle& worldContext)
         {
-            return adoptRef(new V8LazyEventListener(functionName, isSVGEvent, code, sourceURL, position, worldContext));
+            return adoptRef(new V8LazyEventListener(functionName, eventParameterName, code, sourceURL, position, node, worldContext));
         }
 
         virtual bool isLazy() const { return true; }
@@ -57,7 +59,7 @@ namespace WebCore {
         virtual void prepareListenerObject(ScriptExecutionContext*);
 
     private:
-        V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, const TextPosition&, const WorldContextHandle&);
+        V8LazyEventListener(const AtomicString& functionName, const AtomicString& eventParameterName, const String& code, const String sourceURL, const TextPosition&, PassRefPtr<Node>, const WorldContextHandle&);
 
         virtual v8::Local<v8::Value> callListenerFunction(ScriptExecutionContext*, v8::Handle<v8::Value> jsEvent, Event*);
 
@@ -67,10 +69,12 @@ namespace WebCore {
         // SVGUseElement::transferEventListenersToShadowTree
         virtual bool wasCreatedFromMarkup() const { return true; }
 
-        String m_functionName;
-        bool m_isSVGEvent;
+        AtomicString m_functionName;
+        AtomicString m_eventParameterName;
         String m_code;
         String m_sourceURL;
+        RefPtr<Node> m_node;
+        RefPtr<HTMLFormElement> m_formElement;
         TextPosition m_position;
     };
 
diff --git a/Source/WebCore/bindings/v8/V8Proxy.cpp b/Source/WebCore/bindings/v8/V8Proxy.cpp
index e3dc00b3f..d8a7d466f 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.cpp
+++ b/Source/WebCore/bindings/v8/V8Proxy.cpp
@@ -414,8 +414,10 @@ v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<
     if (V8RecursionScope::recursionLevel() >= kMaxRecursionDepth)
         return handleMaxRecursionDepthExceeded();
 
+    ScriptExecutionContext* context = frame ? frame->document() : 0;
+
     InspectorInstrumentationCookie cookie;
-    if (InspectorInstrumentation::hasFrontends() && frame) {
+    if (InspectorInstrumentation::hasFrontends() && context) {
         String resourceName("undefined");
         int lineNumber = 1;
         v8::ScriptOrigin origin = function->GetScriptOrigin();
@@ -423,7 +425,7 @@ v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<
             resourceName = toWebCoreString(origin.ResourceName());
             lineNumber = function->GetScriptLineNumber() + 1;
         }
-        cookie = InspectorInstrumentation::willCallFunction(frame->page(), resourceName, lineNumber);
+        cookie = InspectorInstrumentation::willCallFunction(context, resourceName, lineNumber);
     }
 
     v8::Local<v8::Value> result;
@@ -431,7 +433,7 @@ v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<
 #if PLATFORM(CHROMIUM)
         TRACE_EVENT0("v8", "v8.callFunction");
 #endif
-        V8RecursionScope recursionScope(frame ? frame->document() : 0);
+        V8RecursionScope recursionScope(context);
         result = function->Call(receiver, argc, args);
     }
 
diff --git a/Source/WebCore/bindings/v8/V8Utilities.cpp b/Source/WebCore/bindings/v8/V8Utilities.cpp
index a5cf6d93c..f30a47c53 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.cpp
+++ b/Source/WebCore/bindings/v8/V8Utilities.cpp
@@ -53,18 +53,22 @@
 
 namespace WebCore {
 
-V8LocalContext::V8LocalContext()
-    : m_context(v8::Context::New())
+V8AuxiliaryContext::V8AuxiliaryContext()
 {
-    V8BindingPerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
-    m_context->Enter();
+    auxiliaryContext()->Enter();
 }
 
+V8AuxiliaryContext::~V8AuxiliaryContext()
+{
+    auxiliaryContext()->Exit();
+}
 
-V8LocalContext::~V8LocalContext()
+v8::Persistent<v8::Context>& V8AuxiliaryContext::auxiliaryContext()
 {
-    m_context->Exit();
-    m_context.Dispose();
+    v8::Persistent<v8::Context>& context = V8BindingPerIsolateData::current()->auxiliaryContext();
+    if (context.IsEmpty())
+        context = v8::Context::New();
+    return context;
 }
 
 // Use an array to hold dependents. It works like a ref-counted scheme.
diff --git a/Source/WebCore/bindings/v8/V8Utilities.h b/Source/WebCore/bindings/v8/V8Utilities.h
index 9956fa53e..bf7577534 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.h
+++ b/Source/WebCore/bindings/v8/V8Utilities.h
@@ -70,13 +70,13 @@ namespace WebCore {
 
     typedef unsigned CallbackAllowedValueFlags;
 
-    class V8LocalContext {
+    class V8AuxiliaryContext {
     public:
-        V8LocalContext();
-        virtual ~V8LocalContext();
+        V8AuxiliaryContext();
+        virtual ~V8AuxiliaryContext();
     private:
         v8::HandleScope m_handleScope;
-        v8::Persistent<v8::Context> m_context;
+        static v8::Persistent<v8::Context>& auxiliaryContext();
     };
 
     typedef WTF::Vector<RefPtr<MessagePort>, 1> MessagePortArray;
diff --git a/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp b/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
index d02278ed4..b9bdecd4b 100644
--- a/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
+++ b/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
@@ -37,6 +37,7 @@
 #include "EventNames.h"
 #include "ErrorEvent.h"
 #include "V8Binding.h"
+#include "V8RecursionScope.h"
 
 namespace WebCore {
 
@@ -55,6 +56,7 @@ v8::Local<v8::Value> V8WorkerContextErrorHandler::callListenerFunction(ScriptExe
         v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::Cast(listener);
         v8::Local<v8::Object> thisValue = v8::Context::GetCurrent()->Global();
         v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8::Integer::New(errorEvent->lineno()) };
+        V8RecursionScope recursionScope(context);
         returnValue = callFunction->Call(thisValue, 3, parameters);
     }
     return returnValue;
diff --git a/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp b/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
index 30b986586..0bc84d3c3 100644
--- a/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
@@ -34,9 +34,11 @@
 
 #include "V8WorkerContextEventListener.h"
 
+#include "InspectorInstrumentation.h"
 #include "V8Binding.h"
 #include "V8DOMWrapper.h"
 #include "V8Event.h"
+#include "V8RecursionScope.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 
@@ -89,12 +91,27 @@ v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(ScriptEx
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
+    InspectorInstrumentationCookie cookie;
+    if (InspectorInstrumentation::hasFrontends()) {
+        String resourceName("undefined");
+        int lineNumber = 1;
+        v8::ScriptOrigin origin = handlerFunction->GetScriptOrigin();
+        if (!origin.ResourceName().IsEmpty()) {
+            resourceName = toWebCoreString(origin.ResourceName());
+            lineNumber = handlerFunction->GetScriptLineNumber() + 1;
+        }
+        cookie = InspectorInstrumentation::willCallFunction(context, resourceName, lineNumber);
+    }
+
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
+    V8RecursionScope recursionScope(context);
     v8::Local<v8::Value> result = handlerFunction->Call(receiver, 1, parameters);
 
     if (WorkerContextExecutionProxy* proxy = workerProxy(context))
         proxy->trackEvent(event);
 
+    InspectorInstrumentation::didCallFunction(cookie);
+
     return result;
 }
 
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index d2840bd08..51be5ca83 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -44,6 +44,7 @@
 #include "V8DOMMap.h"
 #include "V8DedicatedWorkerContext.h"
 #include "V8Proxy.h"
+#include "V8RecursionScope.h"
 #include "V8SharedWorkerContext.h"
 #include "Worker.h"
 #include "WorkerContext.h"
@@ -81,7 +82,6 @@ static void v8MessageHandler(v8::Handle<v8::Message> message, v8::Handle<v8::Val
 
 WorkerContextExecutionProxy::WorkerContextExecutionProxy(WorkerContext* workerContext)
     : m_workerContext(workerContext)
-    , m_recursion(0)
 {
     initIsolate();
 }
@@ -234,7 +234,7 @@ v8::Local<v8::Value> WorkerContextExecutionProxy::runScript(v8::Handle<v8::Scrip
         return v8::Local<v8::Value>();
 
     // Compute the source string and prevent against infinite recursion.
-    if (m_recursion >= kMaxRecursionDepth) {
+    if (V8RecursionScope::recursionLevel() >= kMaxRecursionDepth) {
         v8::Local<v8::String> code = v8ExternalString("throw RangeError('Recursion too deep')");
         script = V8Proxy::compileScript(code, "", TextPosition::minimumPosition());
     }
@@ -248,9 +248,8 @@ v8::Local<v8::Value> WorkerContextExecutionProxy::runScript(v8::Handle<v8::Scrip
     // Run the script and keep track of the current recursion depth.
     v8::Local<v8::Value> result;
     {
-        m_recursion++;
+        V8RecursionScope recursionScope(m_workerContext);
         result = script->Run();
-        m_recursion--;
     }
 
     // Handle V8 internal error situation (Out-of-memory).
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
index 7d4d70ce6..e6c160544 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
@@ -86,7 +86,6 @@ namespace WebCore {
 
         WorkerContext* m_workerContext;
         v8::Persistent<v8::Context> m_context;
-        int m_recursion;
 
         Vector<Event*> m_events;
     };
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.cpp b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
index 9c827c3e5..433c3288a 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -53,6 +53,7 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
     : m_workerContext(workerContext)
     , m_isolate(v8::Isolate::New())
     , m_executionForbidden(false)
+    , m_executionScheduledToTerminate(false)
 {
     V8BindingPerIsolateData* data = V8BindingPerIsolateData::create(m_isolate);
     data->allStores().append(&m_DOMDataStore);
@@ -92,9 +93,23 @@ void WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode, Script
 
 void WorkerScriptController::scheduleExecutionTermination()
 {
+    // The mutex provides a memory barrier to ensure that once
+    // termination is scheduled, isExecutionTerminating will
+    // accurately reflect that state when called from another thread.
+    {
+        MutexLocker locker(m_scheduledTerminationMutex);
+        m_executionScheduledToTerminate = true;
+    }
     v8::V8::TerminateExecution(m_isolate);
 }
 
+bool WorkerScriptController::isExecutionTerminating() const
+{
+    // See comments in scheduleExecutionTermination regarding mutex usage.
+    MutexLocker locker(m_scheduledTerminationMutex);
+    return m_executionScheduledToTerminate;
+}
+
 void WorkerScriptController::forbidExecution()
 {
     ASSERT(m_workerContext->isContextThread());
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.h b/Source/WebCore/bindings/v8/WorkerScriptController.h
index b581e4143..5f6f3eeb1 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.h
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -66,6 +66,7 @@ namespace WebCore {
         // forbidExecution()/isExecutionForbidden() to guard against reentry into JS.
         // Can be called from any thread.
         void scheduleExecutionTermination();
+        bool isExecutionTerminating() const;
 
         // Called on Worker thread when JS exits with termination exception caused by forbidExecution() request,
         // or by Worker thread termination code to prevent future entry into JS.
@@ -83,6 +84,8 @@ namespace WebCore {
         v8::Isolate* m_isolate;
         ScopedDOMDataStore m_DOMDataStore;
         bool m_executionForbidden;
+        bool m_executionScheduledToTerminate;
+        mutable Mutex m_scheduledTerminationMutex;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
index 51d6f2c72..b33661064 100644
--- a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
@@ -44,6 +44,24 @@
 
 namespace WebCore {
 
+v8::Handle<v8::Value> V8Clipboard::typesAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.Clipboard.types()");
+    Clipboard* clipboard = V8Clipboard::toNative(info.Holder());
+
+    HashSet<String> types = clipboard->types();
+    if (types.isEmpty())
+        return v8::Null();
+
+    v8::Local<v8::Array> result = v8::Array::New(types.size());
+    HashSet<String>::const_iterator end = types.end();
+    int index = 0;
+    for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it, ++index)
+        result->Set(v8::Integer::New(index), v8String(*it));
+
+    return result;
+}
+
 v8::Handle<v8::Value> V8Clipboard::clearDataCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.Clipboard.clearData()");
@@ -62,22 +80,6 @@ v8::Handle<v8::Value> V8Clipboard::clearDataCallback(const v8::Arguments& args)
     return v8::Undefined();
 }
 
-v8::Handle<v8::Value> V8Clipboard::getDataCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Clipboard.getData()");
-    Clipboard* clipboard = V8Clipboard::toNative(args.Holder());
-
-    if (args.Length() != 1)
-        return throwError("getData: Invalid number of arguments", V8Proxy::SyntaxError);
-
-    bool success;
-    String result = clipboard->getData(toWebCoreString(args[0]), success);
-    if (success)
-        return v8String(result);
-
-    return v8::Undefined();
-}
-
 v8::Handle<v8::Value> V8Clipboard::setDragImageCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.Clipboard.setDragImage()");
diff --git a/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp b/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
index a6d2c8bf2..9ee27fb72 100644
--- a/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2009, Google Inc. All rights reserved.
+ * Copyright (c) 2009, 2012 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -59,7 +59,8 @@ bool V8SQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLEr
     v8::Handle<v8::Value> transactionHandle = toV8(transaction);
     v8::Handle<v8::Value> errorHandle = toV8(error);
     if (transactionHandle.IsEmpty() || errorHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
index 2799ae2c8..ddf22a746 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
@@ -94,7 +94,7 @@ v8::Handle<v8::Value> toV8(DOMStringMap* impl)
     if (!wrapper.IsEmpty() && element) {
         v8::Handle<v8::Value> elementValue = toV8(element);
         if (!elementValue.IsEmpty() && elementValue->IsObject())
-            V8DOMWrapper::setNamedHiddenReference(elementValue.As<v8::Object>(), "domStringMap", wrapper);
+            elementValue.As<v8::Object>()->SetHiddenValue(V8HiddenPropertyName::domStringMap(), wrapper);
     }
     return wrapper;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp
index 08051abd5..a23da4810 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp
@@ -48,7 +48,7 @@ v8::Handle<v8::Value> toV8(DOMTokenList* impl)
     if (!wrapper.IsEmpty() && element) {
         v8::Handle<v8::Value> elementValue = toV8(element);
         if (!elementValue.IsEmpty() && elementValue->IsObject())
-            V8DOMWrapper::setNamedHiddenReference(elementValue.As<v8::Object>(), "domTokenList", wrapper);
+            elementValue.As<v8::Object>()->SetHiddenValue(V8HiddenPropertyName::domTokenList(), wrapper);
     }
     return wrapper;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
index 6f4878e6f..585593089 100644
--- a/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -70,7 +70,8 @@ bool V8MutationCallback::handleEvent(MutationRecordArray* mutations, WebKitMutat
 
     v8::Handle<v8::Value> observerHandle = toV8(observer);
     if (observerHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
index 4782dcc32..f303128e0 100644
--- a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
@@ -79,7 +79,7 @@ v8::Handle<v8::Value> toV8(NamedNodeMap* impl)
     // Add a hidden reference from named node map to its owner node.
     Element* element = impl->element();
     if (!wrapper.IsEmpty() && element)
-        V8DOMWrapper::setNamedHiddenReference(wrapper, "ownerNode", toV8(element));
+        wrapper->SetHiddenValue(V8HiddenPropertyName::ownerNode(), toV8(element));
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
index 449031558..242711344 100644
--- a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
@@ -48,12 +48,17 @@
 #include "V8Entity.h"
 #include "V8EntityReference.h"
 #include "V8EventListener.h"
+#include "V8HTMLElement.h"
 #include "V8Node.h"
 #include "V8Notation.h"
 #include "V8ProcessingInstruction.h"
 #include "V8Proxy.h"
 #include "V8Text.h"
 
+#if ENABLE(SVG)
+#include "V8SVGElement.h"
+#endif
+
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -143,7 +148,13 @@ v8::Handle<v8::Value> toV8Slow(Node* impl, bool forceNewObject)
     }
     switch (impl->nodeType()) {
     case Node::ELEMENT_NODE:
-        return toV8(static_cast<Element*>(impl), forceNewObject);
+        if (impl->isHTMLElement())
+            return toV8(toHTMLElement(impl), forceNewObject);
+#if ENABLE(SVG)
+        if (impl->isSVGElement())
+            return toV8(static_cast<SVGElement*>(impl), forceNewObject);
+#endif
+        return V8Element::wrap(static_cast<Element*>(impl), forceNewObject);
     case Node::ATTRIBUTE_NODE:
         return toV8(static_cast<Attr*>(impl), forceNewObject);
     case Node::TEXT_NODE:
diff --git a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index c07868858..7dcedbe25 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -39,6 +39,7 @@
 #include "V8ArrayBufferView.h"
 #include "V8Binding.h"
 #include "V8BindingMacros.h"
+#include "V8EXTTextureFilterAnisotropic.h"
 #include "V8Float32Array.h"
 #include "V8HTMLCanvasElement.h"
 #include "V8HTMLImageElement.h"
@@ -175,6 +176,10 @@ static v8::Handle<v8::Value> toV8Object(WebGLExtension* extension, v8::Handle<v8
         extensionObject = toV8(static_cast<WebGLLoseContext*>(extension));
         referenceName = "webKitWebGLLoseContextName";
         break;
+    case WebGLExtension::EXTTextureFilterAnisotropicName:
+        extensionObject = toV8(static_cast<EXTTextureFilterAnisotropic*>(extension));
+        referenceName = "extTextureFilterAnisotropicName";
+        break;
     case WebGLExtension::OESStandardDerivativesName:
         extensionObject = toV8(static_cast<OESStandardDerivatives*>(extension));
         referenceName = "oesStandardDerivativesName";
diff --git a/Source/WebCore/bridge/NP_jsobject.cpp b/Source/WebCore/bridge/NP_jsobject.cpp
index 771a4b3a3..2cbe923f5 100644
--- a/Source/WebCore/bridge/NP_jsobject.cpp
+++ b/Source/WebCore/bridge/NP_jsobject.cpp
@@ -339,7 +339,7 @@ bool _NPN_SetProperty(NPP, NPObject* o, NPIdentifier propertyName, const NPVaria
             PutPropertySlot slot;
             obj->imp->methodTable()->put(obj->imp, exec, identifierFromNPIdentifier(exec, i->string()), convertNPVariantToValue(exec, variant, rootObject), slot);
         } else
-            obj->imp->methodTable()->putByIndex(obj->imp, exec, i->number(), convertNPVariantToValue(exec, variant, rootObject));
+            obj->imp->methodTable()->putByIndex(obj->imp, exec, i->number(), convertNPVariantToValue(exec, variant, rootObject), false);
         exec->clearException();
         return true;
     }
diff --git a/Source/WebCore/bridge/jni/jni_jsobject.mm b/Source/WebCore/bridge/jni/jni_jsobject.mm
index a5cb9ee88..e0b5dbd2e 100644
--- a/Source/WebCore/bridge/jni/jni_jsobject.mm
+++ b/Source/WebCore/bridge/jni/jni_jsobject.mm
@@ -393,7 +393,7 @@ void JavaJSObject::setSlot(jint index, jobject value) const
 
     ExecState* exec = rootObject->globalObject()->globalExec();
     JSLock lock(SilenceAssertionsOnly);
-    _imp->methodTable()->putByIndex(_imp, exec, (unsigned)index, convertJObjectToValue(exec, value));
+    _imp->methodTable()->putByIndex(_imp, exec, (unsigned)index, convertJObjectToValue(exec, value), false);
 }
 
 
diff --git a/Source/WebCore/bridge/objc/objc_instance.mm b/Source/WebCore/bridge/objc/objc_instance.mm
index efbcfe20c..60dc229e8 100644
--- a/Source/WebCore/bridge/objc/objc_instance.mm
+++ b/Source/WebCore/bridge/objc/objc_instance.mm
@@ -170,7 +170,7 @@ Bindings::Class* ObjcInstance::getClass() const
     if (!_instance)
         return 0;
     if (!_class)
-        _class = ObjcClass::classForIsA(_instance->isa);
+        _class = ObjcClass::classForIsA(object_getClass(_instance.get()));
     return static_cast<Bindings::Class*>(_class);
 }
 
diff --git a/Source/WebCore/bridge/runtime_array.cpp b/Source/WebCore/bridge/runtime_array.cpp
index 7ded67307..c15c7cb39 100644
--- a/Source/WebCore/bridge/runtime_array.cpp
+++ b/Source/WebCore/bridge/runtime_array.cpp
@@ -157,7 +157,7 @@ void RuntimeArray::put(JSCell* cell, ExecState* exec, const Identifier& property
     JSObject::put(thisObject, exec, propertyName, value, slot);
 }
 
-void RuntimeArray::putByIndex(JSCell* cell, ExecState* exec, unsigned index, JSValue value)
+void RuntimeArray::putByIndex(JSCell* cell, ExecState* exec, unsigned index, JSValue value, bool)
 {
     RuntimeArray* thisObject = jsCast<RuntimeArray*>(cell);
     if (index >= thisObject->getLength()) {
diff --git a/Source/WebCore/bridge/runtime_array.h b/Source/WebCore/bridge/runtime_array.h
index a0d98ce7c..c7bee5282 100644
--- a/Source/WebCore/bridge/runtime_array.h
+++ b/Source/WebCore/bridge/runtime_array.h
@@ -55,7 +55,7 @@ public:
     static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned, PropertySlot&);
     static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
     static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-    static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue);
+    static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
     
     static bool deleteProperty(JSCell*, ExecState*, const Identifier &propertyName);
     static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
diff --git a/Source/WebCore/css/CSSCalculationValue.cpp b/Source/WebCore/css/CSSCalculationValue.cpp
index 87fa73782..7828c6542 100755
--- a/Source/WebCore/css/CSSCalculationValue.cpp
+++ b/Source/WebCore/css/CSSCalculationValue.cpp
@@ -114,6 +114,25 @@ public:
         return m_value->cssText();
     }
 
+    virtual PassOwnPtr<CalcExpressionNode> toCalcValue(RenderStyle* style, RenderStyle* rootStyle, double zoom) const
+    {
+        switch (m_category) {
+        case CalcNumber:
+            return adoptPtr(new CalcExpressionNumber(m_value->getFloatValue()));
+        case CalcLength:
+            return adoptPtr(new CalcExpressionNumber(m_value->computeLength<float>(style, rootStyle, zoom)));
+        case CalcPercent:
+        case CalcPercentLength:
+            return adoptPtr(new CalcExpressionLength(CSSStyleSelector::convertToFloatLength(m_value.get(), style, rootStyle, zoom)));
+        // Only types that could be part of a Length expression can be converted
+        // to a CalcExpressionNode. CalcPercentNumber makes no sense as a Length.
+        case CalcPercentNumber:
+        case CalcOther:
+            ASSERT_NOT_REACHED();
+        }
+        return nullptr;
+    }
+
     virtual double doubleValue() const
     {
         switch (m_category) {
@@ -208,6 +227,17 @@ public:
         return !doubleValue();
     }
 
+    virtual PassOwnPtr<CalcExpressionNode> toCalcValue(RenderStyle* style, RenderStyle* rootStyle, double zoom) const
+    {
+        OwnPtr<CalcExpressionNode> left(m_leftSide->toCalcValue(style, rootStyle, zoom));
+        if (!left)
+            return nullptr;
+        OwnPtr<CalcExpressionNode> right(m_rightSide->toCalcValue(style, rootStyle, zoom));
+        if (!right)
+            return nullptr;
+        return adoptPtr(new CalcExpressionBinaryOperation(left.release(), right.release(), m_operator));
+    }
+
     virtual double doubleValue() const 
     {
         return evaluate(m_leftSide->doubleValue(), m_rightSide->doubleValue());
diff --git a/Source/WebCore/css/CSSCalculationValue.h b/Source/WebCore/css/CSSCalculationValue.h
index 7c3667125..ac9be46d3 100755
--- a/Source/WebCore/css/CSSCalculationValue.h
+++ b/Source/WebCore/css/CSSCalculationValue.h
@@ -43,7 +43,7 @@ namespace WebCore {
 class CSSParserValueList;
 class CSSValueList;
 class RenderStyle;
-class CalcValue;
+class CalculationValue;
 class CalcExpressionNode;
 
 enum CalculationCategory {
@@ -58,8 +58,9 @@ enum CalculationCategory {
 class CSSCalcExpressionNode : public RefCounted<CSSCalcExpressionNode> {
 public:
     
-    virtual ~CSSCalcExpressionNode() = 0;  
+    virtual ~CSSCalcExpressionNode() = 0;
     virtual bool isZero() const = 0;
+    virtual PassOwnPtr<CalcExpressionNode> toCalcValue(RenderStyle*, RenderStyle* rootStyle, double zoom = 1.0) const = 0;    
     virtual double doubleValue() const = 0;
     virtual double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier = 1.0, bool computingFontSize = false) const = 0;
     
@@ -80,7 +81,12 @@ protected:
 class CSSCalcValue : public CSSValue {
 public:
     static PassRefPtr<CSSCalcValue> create(CSSParserString name, CSSParserValueList*, CalculationPermittedValueRange);
+    static PassRefPtr<CSSCalcValue> create(CalculationValue*);
 
+    PassRefPtr<CalculationValue> toCalcValue(RenderStyle* style, RenderStyle* rootStyle, double zoom = 1.0) const
+    {
+        return CalculationValue::create(m_expression->toCalcValue(style, rootStyle, zoom), m_nonNegative ? CalculationRangeNonNegative : CalculationRangeAll);
+    }
     CalculationCategory category() const { return m_expression->category(); }
     bool isInt() const { return m_expression->isInteger(); }    
     double doubleValue() const;
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index 04f72c86e..6c497f6ba 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -232,6 +232,9 @@ static const int computedProperties[] = {
 #if ENABLE(CSS_GRID_LAYOUT)
     CSSPropertyWebkitGridColumns,
     CSSPropertyWebkitGridRows,
+
+    CSSPropertyWebkitGridColumn,
+    CSSPropertyWebkitGridRow,
 #endif
     CSSPropertyWebkitHighlight,
     CSSPropertyWebkitHyphenateCharacter,
@@ -913,6 +916,15 @@ static PassRefPtr<CSSValue> valueForGridTrackList(const Vector<Length>& trackLen
         list->append(valueForGridTrackBreadth(trackLengths[i], style, cssValuePool));
     return list.release();
 }
+
+static PassRefPtr<CSSValue> valueForGridPosition(const Length& position, CSSValuePool* cssValuePool)
+{
+    if (position.isAuto())
+        return cssValuePool->createIdentifierValue(CSSValueAuto);
+
+    ASSERT(position.isFixed());
+    return cssValuePool->createValue(position.value(), CSSPrimitiveValue::CSS_NUMBER);
+}
 #endif
 
 static PassRefPtr<CSSValue> getDelayValue(const AnimationList* animList, CSSValuePool* cssValuePool)
@@ -1116,6 +1128,31 @@ static PassRefPtr<CSSPrimitiveValue> valueForFamily(const AtomicString& family,
     return cssValuePool->createValue(family.string(), CSSPrimitiveValue::CSS_STRING);
 }
 
+static PassRefPtr<CSSValue> renderUnicodeBidiFlagsToCSSValue(EUnicodeBidi unicodeBidi, CSSValuePool* cssValuePool)
+{
+    switch (unicodeBidi) {
+    case UBNormal:
+        return cssValuePool->createIdentifierValue(CSSValueNormal);
+    case Embed:
+        return cssValuePool->createIdentifierValue(CSSValueEmbed);
+    case Plaintext:
+        return cssValuePool->createIdentifierValue(CSSValueWebkitPlaintext);
+    case Override:
+        return cssValuePool->createIdentifierValue(CSSValueBidiOverride);
+    case Isolate:
+        return cssValuePool->createIdentifierValue(CSSValueWebkitIsolate);
+    case OverrideIsolate:
+    {
+        RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
+        list->append(cssValuePool->createIdentifierValue(CSSValueBidiOverride));
+        list->append(cssValuePool->createIdentifierValue(CSSValueWebkitIsolate));
+        return list;
+    }
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 static PassRefPtr<CSSValue> renderTextDecorationFlagsToCSSValue(int textDecoration, CSSValuePool* cssValuePool)
 {
     RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
@@ -1304,6 +1341,13 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
     if (!style)
         return 0;
 
+    if (renderer) {
+        if (m_pseudoElementSpecifier == AFTER)
+            renderer = renderer->afterPseudoElementRenderer();
+        else if (m_pseudoElementSpecifier == BEFORE)
+            renderer = renderer->beforePseudoElementRenderer();
+    }
+
     CSSValuePool* cssValuePool = node->document()->cssValuePool().get();
 
     propertyID = CSSProperty::resolveDirectionAwareProperty(propertyID, style->direction(), style->writingMode());
@@ -1648,6 +1692,11 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitGridRows: {
             return valueForGridTrackList(style->gridRows(), style.get(), cssValuePool);
         }
+
+        case CSSPropertyWebkitGridColumn:
+            return valueForGridPosition(style->gridItemColumn(), cssValuePool);
+        case CSSPropertyWebkitGridRow:
+            return valueForGridPosition(style->gridItemRow(), cssValuePool);
 #endif
         case CSSPropertyHeight:
             if (renderer) {
@@ -1792,19 +1841,19 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return cssValuePool->createValue(style->overflowY());
         case CSSPropertyPaddingTop:
             if (renderer && renderer->isBox())
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingTop(false), style.get(), cssValuePool);
+                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingTop(ExcludeIntrinsicPadding), style.get(), cssValuePool);
             return zoomAdjustedPixelValueForLength(style->paddingTop(), style.get(), cssValuePool);
         case CSSPropertyPaddingRight:
             if (renderer && renderer->isBox())
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingRight(false), style.get(), cssValuePool);
+                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingRight(ExcludeIntrinsicPadding), style.get(), cssValuePool);
             return zoomAdjustedPixelValueForLength(style->paddingRight(), style.get(), cssValuePool);
         case CSSPropertyPaddingBottom:
             if (renderer && renderer->isBox())
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingBottom(false), style.get(), cssValuePool);
+                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingBottom(ExcludeIntrinsicPadding), style.get(), cssValuePool);
             return zoomAdjustedPixelValueForLength(style->paddingBottom(), style.get(), cssValuePool);
         case CSSPropertyPaddingLeft:
             if (renderer && renderer->isBox())
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingLeft(false), style.get(), cssValuePool);
+                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingLeft(ExcludeIntrinsicPadding), style.get(), cssValuePool);
             return zoomAdjustedPixelValueForLength(style->paddingLeft(), style.get(), cssValuePool);
         case CSSPropertyPageBreakAfter:
             return cssValuePool->createValue(style->pageBreakAfter());
@@ -1880,7 +1929,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyTop:
             return getPositionOffsetValue(style.get(), CSSPropertyTop, cssValuePool);
         case CSSPropertyUnicodeBidi:
-            return cssValuePool->createValue(style->unicodeBidi());
+            return renderUnicodeBidiFlagsToCSSValue(style->unicodeBidi(), cssValuePool);
         case CSSPropertyVerticalAlign:
             switch (style->verticalAlign()) {
                 case BASELINE:
@@ -2250,7 +2299,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return counterToCSSValue(style.get(), propertyID, cssValuePool);
         case CSSPropertyWebkitFlowInto:
             if (style->flowThread().isNull())
-                return cssValuePool->createIdentifierValue(CSSValueAuto);
+                return cssValuePool->createIdentifierValue(CSSValueNone);
             return cssValuePool->createValue(style->flowThread(), CSSPrimitiveValue::CSS_STRING);
         case CSSPropertyWebkitFlowFrom:
             if (style->regionThread().isNull())
diff --git a/Source/WebCore/css/CSSCrossfadeValue.h b/Source/WebCore/css/CSSCrossfadeValue.h
index be6066037..fb4c2e0d7 100644
--- a/Source/WebCore/css/CSSCrossfadeValue.h
+++ b/Source/WebCore/css/CSSCrossfadeValue.h
@@ -27,6 +27,7 @@
 #define CSSCrossfadeValue_h
 
 #include "CachedImage.h"
+#include "CachedResourceHandle.h"
 #include "CSSImageGeneratorValue.h"
 #include "CSSPrimitiveValue.h"
 #include "Image.h"
@@ -89,8 +90,8 @@ private:
     RefPtr<CSSValue> m_toValue;
     RefPtr<CSSPrimitiveValue> m_percentageValue;
 
-    CachedImage* m_cachedFromImage;
-    CachedImage* m_cachedToImage;
+    CachedResourceHandle<CachedImage> m_cachedFromImage;
+    CachedResourceHandle<CachedImage> m_cachedToImage;
 
     RefPtr<Image> m_generatedImage;
 
diff --git a/Source/WebCore/css/CSSGrammar.y b/Source/WebCore/css/CSSGrammar.y
index a57edf3d1..1eef6b1e1 100644
--- a/Source/WebCore/css/CSSGrammar.y
+++ b/Source/WebCore/css/CSSGrammar.y
@@ -326,9 +326,9 @@ webkit_value:
         CSSParser* p = static_cast<CSSParser*>(parser);
         if ($4) {
             p->m_valueList = p->sinkFloatingValueList($4);
-            int oldParsedProperties = p->m_numParsedProperties;
+            int oldParsedProperties = p->m_parsedProperties.size();
             if (!p->parseValue(p->m_id, p->m_important))
-                p->rollbackLastProperties(p->m_numParsedProperties - oldParsedProperties);
+                p->rollbackLastProperties(p->m_parsedProperties.size() - oldParsedProperties);
             p->m_valueList = nullptr;
         }
     }
@@ -1300,10 +1300,10 @@ declaration:
         bool isPropertyParsed = false;
         if ($1 && $4) {
             p->m_valueList = p->sinkFloatingValueList($4);
-            int oldParsedProperties = p->m_numParsedProperties;
+            int oldParsedProperties = p->m_parsedProperties.size();
             $$ = p->parseValue($1, $5);
             if (!$$)
-                p->rollbackLastProperties(p->m_numParsedProperties - oldParsedProperties);
+                p->rollbackLastProperties(p->m_parsedProperties.size() - oldParsedProperties);
             else
                 isPropertyParsed = true;
             p->m_valueList = nullptr;
diff --git a/Source/WebCore/css/CSSImportRule.cpp b/Source/WebCore/css/CSSImportRule.cpp
index 7e210a82c..20d7706b3 100644
--- a/Source/WebCore/css/CSSImportRule.cpp
+++ b/Source/WebCore/css/CSSImportRule.cpp
@@ -103,8 +103,10 @@ void CSSImportRule::setCSSStyleSheet(const String& href, const KURL& baseURL, co
 
     m_loading = false;
 
-    if (parent)
+    if (parent) {
+        parent->notifyLoadedSheet(sheet);
         parent->checkLoaded();
+    }
 }
 
 bool CSSImportRule::isLoading() const
diff --git a/Source/WebCore/css/CSSPageRule.cpp b/Source/WebCore/css/CSSPageRule.cpp
index d067e46c5..3858d3a54 100644
--- a/Source/WebCore/css/CSSPageRule.cpp
+++ b/Source/WebCore/css/CSSPageRule.cpp
@@ -30,10 +30,9 @@
 
 namespace WebCore {
 
-CSSPageRule::CSSPageRule(CSSStyleSheet* parent, int sourceLine)
+CSSPageRule::CSSPageRule(CSSStyleSheet* parent)
     : CSSRule(parent, CSSRule::PAGE_RULE)
 {
-    setSourceLine(sourceLine);
 }
 
 CSSPageRule::~CSSPageRule()
diff --git a/Source/WebCore/css/CSSPageRule.h b/Source/WebCore/css/CSSPageRule.h
index 7b09665b3..c837274fd 100644
--- a/Source/WebCore/css/CSSPageRule.h
+++ b/Source/WebCore/css/CSSPageRule.h
@@ -35,9 +35,9 @@ class CSSSelectorList;
 
 class CSSPageRule : public CSSRule {
 public:
-    static PassRefPtr<CSSPageRule> create(CSSStyleSheet* parent, int sourceLine)
+    static PassRefPtr<CSSPageRule> create(CSSStyleSheet* parent)
     {
-        return adoptRef(new CSSPageRule(parent, sourceLine));
+        return adoptRef(new CSSPageRule(parent));
     }
     ~CSSPageRule();
 
@@ -55,7 +55,7 @@ public:
     void setDeclaration(PassRefPtr<StylePropertySet> style) { m_style = style; }
 
 private:
-    CSSPageRule(CSSStyleSheet* parent, int sourceLine);
+    CSSPageRule(CSSStyleSheet* parent);
 
     RefPtr<StylePropertySet> m_style;
     CSSSelectorList m_selectorList;
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index 52a80418d..3dc4bc912 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -74,6 +74,7 @@
 #include "Settings.h"
 #include "ShadowValue.h"
 #include "StylePropertySet.h"
+#include "StyleRule.h"
 #if ENABLE(CSS_FILTERS)
 #include "WebKitCSSFilterValue.h"
 #endif
@@ -177,17 +178,11 @@ inline void CSSParser::ensureCSSValuePool()
         m_cssValuePool = CSSValuePool::create();
 }
 
-// FIXME: Can m_parsedProperties just be a Vector?
-    
 CSSParser::CSSParser(bool strictParsing)
     : m_strict(strictParsing)
     , m_important(false)
     , m_id(0)
     , m_styleSheet(0)
-    , m_parsedProperties(static_cast<CSSProperty**>(fastMalloc(32 * sizeof(CSSProperty*))))
-    , m_numParsedProperties(0)
-    , m_maxParsedProperties(32)
-    , m_numParsedPropertiesBeforeMarginBox(INVALID_NUM_PARSED_PROPERTIES)
     , m_inParseShorthand(0)
     , m_currentShorthand(0)
     , m_implicitShorthand(false)
@@ -217,7 +212,6 @@ CSSParser::CSSParser(bool strictParsing)
 CSSParser::~CSSParser()
 {
     clearProperties();
-    fastFree(m_parsedProperties);
 
     fastDeleteAllValues(m_floatingSelectors);
     deleteAllValues(m_floatingSelectorVectors);
@@ -519,9 +513,9 @@ bool CSSParser::parseValue(StylePropertySet* declaration, int propertyId, const
     bool ok = false;
     if (m_hasFontFaceOnlyValues)
         deleteFontFaceOnlyValues();
-    if (m_numParsedProperties) {
+    if (!m_parsedProperties.isEmpty()) {
         ok = true;
-        declaration->addParsedProperties(m_parsedProperties, m_numParsedProperties);
+        declaration->addParsedProperties(m_parsedProperties.data(), m_parsedProperties.size());
         clearProperties();
     }
 
@@ -542,7 +536,7 @@ bool CSSParser::parseColor(RGBA32& color, const String& string, bool strict)
     if (!parser.parseColor(string))
         return false;
 
-    CSSValue* value = parser.m_parsedProperties[0]->value();
+    CSSValue* value = parser.m_parsedProperties.first().value();
     if (!value->isPrimitiveValue())
         return false;
 
@@ -564,7 +558,7 @@ bool CSSParser::parseColor(const String& string)
     cssyyparse(this);
     m_rule = 0;
 
-    return (m_numParsedProperties && m_parsedProperties[0]->m_id == CSSPropertyColor);
+    return !m_parsedProperties.isEmpty() && m_parsedProperties.first().id() == CSSPropertyColor;
 }
 
 bool CSSParser::parseSystemColor(RGBA32& color, const String& string, Document* document)
@@ -620,9 +614,9 @@ bool CSSParser::parseDeclaration(StylePropertySet* declaration, const String& st
     bool ok = false;
     if (m_hasFontFaceOnlyValues)
         deleteFontFaceOnlyValues();
-    if (m_numParsedProperties) {
+    if (!m_parsedProperties.isEmpty()) {
         ok = true;
-        declaration->addParsedProperties(m_parsedProperties, m_numParsedProperties);
+        declaration->addParsedProperties(m_parsedProperties.data(), m_parsedProperties.size());
         clearProperties();
     }
 
@@ -666,31 +660,19 @@ bool CSSParser::parseMediaQuery(MediaList* queries, const String& string)
 
 void CSSParser::addProperty(int propId, PassRefPtr<CSSValue> value, bool important, bool implicit)
 {
-    OwnPtr<CSSProperty> prop(adoptPtr(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand || implicit)));
-    if (m_numParsedProperties >= m_maxParsedProperties) {
-        if (m_numParsedProperties > (UINT_MAX / sizeof(CSSProperty*)) - 32)
-            CRASH();  // Avoid inconsistencies with rollbackLastProperties.
-        m_maxParsedProperties += 32;
-        m_parsedProperties = static_cast<CSSProperty**>(fastRealloc(m_parsedProperties,
-            m_maxParsedProperties * sizeof(CSSProperty*)));
-    }
-    m_parsedProperties[m_numParsedProperties++] = prop.leakPtr();
+    m_parsedProperties.append(CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand || implicit));
 }
 
 void CSSParser::rollbackLastProperties(int num)
 {
     ASSERT(num >= 0);
-    ASSERT(m_numParsedProperties >= static_cast<unsigned>(num));
-
-    for (int i = 0; i < num; ++i)
-        delete m_parsedProperties[--m_numParsedProperties];
+    ASSERT(m_parsedProperties.size() >= static_cast<unsigned>(num));
+    m_parsedProperties.shrink(m_parsedProperties.size() - num);
 }
 
 void CSSParser::clearProperties()
 {
-    for (unsigned i = 0; i < m_numParsedProperties; i++)
-        delete m_parsedProperties[i];
-    m_numParsedProperties = 0;
+    m_parsedProperties.clear();
     m_numParsedPropertiesBeforeMarginBox = INVALID_NUM_PARSED_PROPERTIES;
     m_hasFontFaceOnlyValues = false;
 }
@@ -967,13 +949,30 @@ bool CSSParser::parseValue(int propId, bool important)
         else
             return parseQuotes(propId, important);
         break;
-    case CSSPropertyUnicodeBidi: // normal | embed | bidi-override | isolate | plaintext | inherit
+    case CSSPropertyUnicodeBidi: // normal | embed | (bidi-override || isolate) | plaintext | inherit
         if (id == CSSValueNormal
             || id == CSSValueEmbed
-            || id == CSSValueBidiOverride
-            || id == CSSValueWebkitIsolate
             || id == CSSValueWebkitPlaintext)
             validPrimitive = true;
+        else {
+            RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
+            bool isValid = true;
+            while (isValid && value) {
+                switch (value->id) {
+                case CSSValueBidiOverride:
+                case CSSValueWebkitIsolate:
+                    list->append(cssValuePool()->createIdentifierValue(value->id));
+                    break;
+                default:
+                    isValid = false;
+                }
+                value = m_valueList->next();
+            }
+            if (list->length() && isValid) {
+                parsedValue = list.release();
+                m_valueList->next();
+            }
+        }
         break;
 
     case CSSPropertyPosition:             // static | relative | absolute | fixed | inherit
@@ -1054,7 +1053,7 @@ bool CSSParser::parseValue(int propId, bool important)
         ShorthandScope scope(this, propId);
         if (num != 1 || !parseValue(CSSPropertyOverflowX, important))
             return false;
-        CSSValue* value = m_parsedProperties[m_numParsedProperties - 1]->value();
+        CSSValue* value = m_parsedProperties.last().value();
         addProperty(CSSPropertyOverflowY, value, important);
         return true;
     }
@@ -1148,7 +1147,7 @@ bool CSSParser::parseValue(int propId, bool important)
             ShorthandScope scope(this, CSSPropertyBorderSpacing);
             if (!parseValue(properties[0], important))
                 return false;
-            CSSValue* value = m_parsedProperties[m_numParsedProperties-1]->value();
+            CSSValue* value = m_parsedProperties.last().value();
             addProperty(properties[1], value, important);
             return true;
         }
@@ -1882,6 +1881,11 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitGridColumns:
     case CSSPropertyWebkitGridRows:
         return parseGridTrackList(propId, important);
+
+    case CSSPropertyWebkitGridColumn:
+    case CSSPropertyWebkitGridRow:
+        validPrimitive = id == CSSValueAuto || validUnit(value, FInteger, m_strict);
+        break;
 #endif
     case CSSPropertyWebkitMarginCollapse: {
         const int properties[2] = { CSSPropertyWebkitMarginBeforeCollapse,
@@ -1890,7 +1894,7 @@ bool CSSParser::parseValue(int propId, bool important)
             ShorthandScope scope(this, CSSPropertyWebkitMarginCollapse);
             if (!parseValue(properties[0], important))
                 return false;
-            CSSValue* value = m_parsedProperties[m_numParsedProperties-1]->value();
+            CSSValue* value = m_parsedProperties.last().value();
             addProperty(properties[1], value, important);
             return true;
         }
@@ -2568,10 +2572,12 @@ bool CSSParser::parseAnimationShorthand(bool important)
     RefPtr<CSSValue> values[numProperties];
 
     int i;
+    int initialParsedPropertyIndex = 0;
     while (m_valueList->current()) {
         CSSParserValue* val = m_valueList->current();
         if (val->unit == CSSParserValue::Operator && val->iValue == ',') {
             // We hit the end.  Fill in all remaining values with the initial value.
+            initialParsedPropertyIndex = 0;
             m_valueList->next();
             for (i = 0; i < numProperties; ++i) {
                 if (!parsedProperty[i])
@@ -2583,11 +2589,12 @@ bool CSSParser::parseAnimationShorthand(bool important)
         }
 
         bool found = false;
-        for (i = 0; !found && i < numProperties; ++i) {
+        for (i = initialParsedPropertyIndex; !found && i < numProperties; ++i) {
             if (!parsedProperty[i]) {
                 RefPtr<CSSValue> val;
                 if (parseAnimationProperty(properties[i], val)) {
                     parsedProperty[i] = found = true;
+                    initialParsedPropertyIndex = 1;
                     addAnimationValue(values[i], val.release());
                 }
             }
@@ -2728,7 +2735,7 @@ bool CSSParser::parse4Values(int propId, const int *properties,  bool important)
         case 1: {
             if (!parseValue(properties[0], important))
                 return false;
-            CSSValue *value = m_parsedProperties[m_numParsedProperties-1]->value();
+            CSSValue *value = m_parsedProperties.last().value();
             ImplicitScope implicitScope(this, PropertyImplicit);
             addProperty(properties[1], value, important);
             addProperty(properties[2], value, important);
@@ -2738,17 +2745,17 @@ bool CSSParser::parse4Values(int propId, const int *properties,  bool important)
         case 2: {
             if (!parseValue(properties[0], important) || !parseValue(properties[1], important))
                 return false;
-            CSSValue *value = m_parsedProperties[m_numParsedProperties-2]->value();
+            CSSValue *value = m_parsedProperties[m_parsedProperties.size() - 2].value();
             ImplicitScope implicitScope(this, PropertyImplicit);
             addProperty(properties[2], value, important);
-            value = m_parsedProperties[m_numParsedProperties-2]->value();
+            value = m_parsedProperties[m_parsedProperties.size() - 2].value();
             addProperty(properties[3], value, important);
             break;
         }
         case 3: {
             if (!parseValue(properties[0], important) || !parseValue(properties[1], important) || !parseValue(properties[2], important))
                 return false;
-            CSSValue *value = m_parsedProperties[m_numParsedProperties-2]->value();
+            CSSValue *value = m_parsedProperties[m_parsedProperties.size() - 2].value();
             ImplicitScope implicitScope(this, PropertyImplicit);
             addProperty(properties[3], value, important);
             break;
@@ -7065,13 +7072,11 @@ PassRefPtr<CSSValueList> CSSParser::parseFilter()
 
 static bool validFlowName(const String& flowName)
 {
-    if (equalIgnoringCase(flowName, "auto")
-        || equalIgnoringCase(flowName, "default")
-        || equalIgnoringCase(flowName, "inherit")
-        || equalIgnoringCase(flowName, "initial")
-        || equalIgnoringCase(flowName, "none"))
-        return false;
-    return true;
+    return !(equalIgnoringCase(flowName, "auto")
+            || equalIgnoringCase(flowName, "default")
+            || equalIgnoringCase(flowName, "inherit")
+            || equalIgnoringCase(flowName, "initial")
+            || equalIgnoringCase(flowName, "none"));
 }
 
 bool CSSParser::cssRegionsEnabled() const
@@ -7082,7 +7087,23 @@ bool CSSParser::cssRegionsEnabled() const
     return false;
 }
 
-// auto | <ident>
+bool CSSParser::parseFlowThread(const String& flowName, Document* doc)
+{
+    ASSERT(doc);
+    ASSERT(doc->cssRegionsEnabled());
+
+    RefPtr<CSSStyleSheet> dummyStyleSheet = CSSStyleSheet::create(doc);
+    setStyleSheet(dummyStyleSheet.get());
+
+    setupParser("@-webkit-decls{-webkit-flow-into:", flowName, "}");
+    cssyyparse(this);
+
+    m_rule = 0;
+
+    return ((m_parsedProperties.size() == 1) && (m_parsedProperties.first().id() == CSSPropertyWebkitFlowInto));
+}
+
+// none | <ident>
 bool CSSParser::parseFlowThread(int propId, bool important)
 {
     ASSERT(propId == CSSPropertyWebkitFlowInto);
@@ -7098,7 +7119,7 @@ bool CSSParser::parseFlowThread(int propId, bool important)
     if (value->unit != CSSPrimitiveValue::CSS_IDENT)
         return false;
 
-    if (value->id == CSSValueAuto) {
+    if (value->id == CSSValueNone) {
         addProperty(propId, cssValuePool()->createIdentifierValue(value->id), important);
         return true;
     }
@@ -7109,7 +7130,7 @@ bool CSSParser::parseFlowThread(int propId, bool important)
             return false;
         addProperty(propId, cssValuePool()->createValue(inputProperty, CSSPrimitiveValue::CSS_STRING), important);
     } else
-        addProperty(propId, cssValuePool()->createIdentifierValue(CSSValueAuto), important);
+        addProperty(propId, cssValuePool()->createIdentifierValue(CSSValueNone), important);
 
     return true;
 }
@@ -8821,10 +8842,10 @@ CSSRule* CSSParser::createStyleRule(Vector<OwnPtr<CSSParserSelector> >* selector
     if (selectors) {
         m_allowImportRules = m_allowNamespaceDeclarations = false;
         RefPtr<CSSStyleRule> rule = CSSStyleRule::create(m_styleSheet, m_lastSelectorLineNumber);
-        rule->adoptSelectorVector(*selectors);
+        rule->styleRule()->adoptSelectorVector(*selectors);
         if (m_hasFontFaceOnlyValues)
             deleteFontFaceOnlyValues();
-        rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
+        rule->styleRule()->setProperties(StylePropertySet::create(m_parsedProperties.data(), m_parsedProperties.size(), m_strict));
         result = rule.get();
         m_parsedRules.append(rule.release());
         if (m_ruleRangeMap) {
@@ -8846,14 +8867,13 @@ CSSRule* CSSParser::createStyleRule(Vector<OwnPtr<CSSParserSelector> >* selector
 CSSRule* CSSParser::createFontFaceRule()
 {
     m_allowImportRules = m_allowNamespaceDeclarations = false;
-    for (unsigned i = 0; i < m_numParsedProperties; ++i) {
-        CSSProperty* property = m_parsedProperties[i];
-        int id = property->id();
-        if (id == CSSPropertyFontVariant && property->value()->isPrimitiveValue()) {
-            RefPtr<CSSValue> value = property->m_value.release();
-            property->m_value = CSSValueList::createCommaSeparated();
-            static_cast<CSSValueList*>(property->value())->append(value.release());
-        } else if (id == CSSPropertyFontFamily && (!property->value()->isValueList() || static_cast<CSSValueList*>(property->value())->length() != 1)) {
+    for (unsigned i = 0; i < m_parsedProperties.size(); ++i) {
+        CSSProperty& property = m_parsedProperties[i];
+        if (property.id() == CSSPropertyFontVariant && property.value()->isPrimitiveValue()) {
+            RefPtr<CSSValue> value = property.m_value.release();
+            property.m_value = CSSValueList::createCommaSeparated();
+            static_cast<CSSValueList*>(property.value())->append(value.release());
+        } else if (property.id() == CSSPropertyFontFamily && (!property.value()->isValueList() || static_cast<CSSValueList*>(property.value())->length() != 1)) {
             // Unlike font-family property, font-family descriptor in @font-face rule
             // has to be a value list with exactly one family name. It cannot have a
             // have 'initial' value and cannot 'inherit' from parent.
@@ -8863,7 +8883,7 @@ CSSRule* CSSParser::createFontFaceRule()
         }
     }
     RefPtr<CSSFontFaceRule> rule = CSSFontFaceRule::create(m_styleSheet);
-    rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
+    rule->setDeclaration(StylePropertySet::create(m_parsedProperties.data(), m_parsedProperties.size(), m_strict));
     clearProperties();
     CSSFontFaceRule* result = rule.get();
     m_parsedRules.append(rule.release());
@@ -8930,11 +8950,11 @@ CSSRule* CSSParser::createPageRule(PassOwnPtr<CSSParserSelector> pageSelector)
     m_allowImportRules = m_allowNamespaceDeclarations = false;
     CSSPageRule* pageRule = 0;
     if (pageSelector) {
-        RefPtr<CSSPageRule> rule = CSSPageRule::create(m_styleSheet, m_lastSelectorLineNumber);
+        RefPtr<CSSPageRule> rule = CSSPageRule::create(m_styleSheet);
         Vector<OwnPtr<CSSParserSelector> > selectorVector;
         selectorVector.append(pageSelector);
         rule->adoptSelectorVector(selectorVector);
-        rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
+        rule->setDeclaration(StylePropertySet::create(m_parsedProperties.data(), m_parsedProperties.size(), m_strict));
         pageRule = rule.get();
         m_parsedRules.append(rule.release());
     }
@@ -8967,7 +8987,7 @@ CSSRule* CSSParser::createMarginAtRule(CSSSelector::MarginBoxType /* marginBox *
 {
     // FIXME: Implement margin at-rule here, using:
     //        - marginBox: margin box
-    //        - m_parsedProperties: properties at [m_numParsedPropertiesBeforeMarginBox, m_numParsedProperties) are for this at-rule.
+    //        - m_parsedProperties: properties at [m_numParsedPropertiesBeforeMarginBox, m_parsedProperties.size()] are for this at-rule.
     // Don't forget to also update the action for page symbol in CSSGrammar.y such that margin at-rule data is cleared if page_selector is invalid.
 
     endDeclarationsForMarginBox();
@@ -8976,32 +8996,26 @@ CSSRule* CSSParser::createMarginAtRule(CSSSelector::MarginBoxType /* marginBox *
 
 void CSSParser::startDeclarationsForMarginBox()
 {
-    m_numParsedPropertiesBeforeMarginBox = m_numParsedProperties;
+    m_numParsedPropertiesBeforeMarginBox = m_parsedProperties.size();
 }
 
 void CSSParser::endDeclarationsForMarginBox()
 {
-    ASSERT(m_numParsedPropertiesBeforeMarginBox != INVALID_NUM_PARSED_PROPERTIES);
-    rollbackLastProperties(m_numParsedProperties - m_numParsedPropertiesBeforeMarginBox);
+    rollbackLastProperties(m_parsedProperties.size() - m_numParsedPropertiesBeforeMarginBox);
     m_numParsedPropertiesBeforeMarginBox = INVALID_NUM_PARSED_PROPERTIES;
 }
 
 void CSSParser::deleteFontFaceOnlyValues()
 {
     ASSERT(m_hasFontFaceOnlyValues);
-    int deletedProperties = 0;
-
-    for (unsigned i = 0; i < m_numParsedProperties; ++i) {
-        CSSProperty* property = m_parsedProperties[i];
-        int id = property->id();
-        if (id == CSSPropertyFontVariant && property->value()->isValueList()) {
-            delete property;
-            deletedProperties++;
-        } else if (deletedProperties)
-            m_parsedProperties[i - deletedProperties] = m_parsedProperties[i];
+    for (unsigned i = 0; i < m_parsedProperties.size();) {
+        CSSProperty& property = m_parsedProperties[i];
+        if (property.id() == CSSPropertyFontVariant && property.value()->isValueList()) {
+            m_parsedProperties.remove(i);
+            continue;
+        }
+        ++i;
     }
-
-    m_numParsedProperties -= deletedProperties;
 }
 
 WebKitCSSKeyframeRule* CSSParser::createKeyframeRule(CSSParserValueList* keys)
@@ -9018,7 +9032,7 @@ WebKitCSSKeyframeRule* CSSParser::createKeyframeRule(CSSParserValueList* keys)
 
     RefPtr<WebKitCSSKeyframeRule> keyframe = WebKitCSSKeyframeRule::create(m_styleSheet);
     keyframe->setKeyText(keyString);
-    keyframe->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
+    keyframe->setDeclaration(StylePropertySet::create(m_parsedProperties.data(), m_parsedProperties.size(), m_strict));
 
     clearProperties();
 
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index 5d766be88..45c5a4425 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -26,6 +26,7 @@
 #include "CSSCalculationValue.h"
 #include "CSSGradientValue.h"
 #include "CSSParserValues.h"
+#include "CSSProperty.h"
 #include "CSSPropertySourceData.h"
 #include "CSSSelector.h"
 #include "Color.h"
@@ -83,7 +84,7 @@ public:
 
     void addProperty(int propId, PassRefPtr<CSSValue>, bool important, bool implicit = false);
     void rollbackLastProperties(int num);
-    bool hasProperties() const { return m_numParsedProperties > 0; }
+    bool hasProperties() const { return !m_parsedProperties.isEmpty(); }
 
     bool parseValue(int propId, bool important);
     bool parseShorthand(int propId, const int* properties, int numProperties, bool important);
@@ -215,6 +216,7 @@ public:
     bool parseFontFeatureSettings(bool important);
 
     bool cssRegionsEnabled() const;
+    bool parseFlowThread(const String& flowName, Document*);
     bool parseFlowThread(int propId, bool important);
     bool parseRegionThread(int propId, bool important);
 
@@ -283,12 +285,10 @@ public:
     RefPtr<WebKitCSSKeyframeRule> m_keyframe;
     OwnPtr<MediaQuery> m_mediaQuery;
     OwnPtr<CSSParserValueList> m_valueList;
-    CSSProperty** m_parsedProperties;
+    Vector<CSSProperty, 256> m_parsedProperties;
     CSSSelectorList* m_selectorListForParseSelector;
 
     RefPtr<CSSValuePool> m_cssValuePool;
-    unsigned m_numParsedProperties;
-    unsigned m_maxParsedProperties;
     unsigned m_numParsedPropertiesBeforeMarginBox;
 
     int m_inParseShorthand;
diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
index fc14e8206..9d213dcdd 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -266,6 +266,7 @@ CSSPrimitiveValue::CSSPrimitiveValue(const Length& length)
             ASSERT(isfinite(length.percent()));
             m_value.num = length.percent();
             break;
+        case Calculated:
         case Relative:
         case Undefined:
             ASSERT_NOT_REACHED();
@@ -429,33 +430,26 @@ template<> double CSSPrimitiveValue::computeLength(RenderStyle* style, RenderSty
 
 double CSSPrimitiveValue::computeLengthDouble(RenderStyle* style, RenderStyle* rootStyle, float multiplier, bool computingFontSize)
 {
-    unsigned short type = primitiveType();
+    double factor;
 
-    // We do not apply the zoom factor when we are computing the value of the font-size property.  The zooming
-    // for font sizes is much more complicated, since we have to worry about enforcing the minimum font size preference
-    // as well as enforcing the implicit "smart minimum."  In addition the CSS property text-size-adjust is used to
-    // prevent text from zooming at all.  Therefore we will not apply the zoom here if we are computing font-size.
-    bool applyZoomMultiplier = !computingFontSize;
-
-    double factor = 1.0;
-    switch (type) {
+    switch (primitiveType()) {
         case CSS_EMS:
-            applyZoomMultiplier = false;
             factor = computingFontSize ? style->fontDescription().specifiedSize() : style->fontDescription().computedSize();
             break;
         case CSS_EXS:
             // FIXME: We have a bug right now where the zoom will be applied twice to EX units.
             // We really need to compute EX using fontMetrics for the original specifiedSize and not use
             // our actual constructed rendering font.
-            applyZoomMultiplier = false;
             factor = style->fontMetrics().xHeight();
             break;
         case CSS_REMS:
-            applyZoomMultiplier = false;
             if (rootStyle)
                 factor = computingFontSize ? rootStyle->fontDescription().specifiedSize() : rootStyle->fontDescription().computedSize();
+            else
+                factor = 1.0;
             break;
         case CSS_PX:
+            factor = 1.0;
             break;
         case CSS_CM:
             factor = cssPixelsPerInch / 2.54; // (2.54 cm/in)
@@ -489,15 +483,19 @@ double CSSPrimitiveValue::computeLengthDouble(RenderStyle* style, RenderStyle* r
     else
         computedValue = getDoubleValue();
     
+    // We do not apply the zoom factor when we are computing the value of the font-size property. The zooming
+    // for font sizes is much more complicated, since we have to worry about enforcing the minimum font size preference
+    // as well as enforcing the implicit "smart minimum." In addition the CSS property text-size-adjust is used to
+    // prevent text from zooming at all. Therefore we will not apply the zoom here if we are computing font-size.
     double result = computedValue * factor;
-    if (!applyZoomMultiplier || multiplier == 1.0f)
+    if (computingFontSize || isFontRelativeLength())
         return result;
 
     // Any original result that was >= 1 should not be allowed to fall below 1.  This keeps border lines from
     // vanishing.
     double zoomedResult = result * multiplier;
-    if (result >= 1.0)
-        zoomedResult = max(1.0, zoomedResult);
+    if (zoomedResult < 1.0 && result >= 1.0)
+        return 1.0;
     return zoomedResult;
 }
 
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index 73491c30d..7d88cec32 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -417,6 +417,12 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MediaControlsFullscreenBackgroundPart:
             m_value.ident = CSSValueMediaControlsFullscreenBackground;
             break;
+        case MediaFullScreenVolumeSliderPart:
+            m_value.ident = CSSValueMediaFullscreenVolumeSlider;
+            break;
+        case MediaFullScreenVolumeSliderThumbPart:
+            m_value.ident = CSSValueMediaFullscreenVolumeSliderThumb;
+            break;
         case MediaCurrentTimePart:
             m_value.ident = CSSValueMediaCurrentTimeDisplay;
             break;
@@ -2200,29 +2206,6 @@ template<> inline CSSPrimitiveValue::operator ETextTransform() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EUnicodeBidi e)
-    : CSSValue(PrimitiveClass)
-{
-    m_primitiveUnitType = CSS_IDENT;
-    switch (e) {
-    case UBNormal:
-        m_value.ident = CSSValueNormal;
-        break;
-    case Embed:
-        m_value.ident = CSSValueEmbed;
-        break;
-    case Override:
-        m_value.ident = CSSValueBidiOverride;
-        break;
-    case Isolate:
-        m_value.ident = CSSValueWebkitIsolate;
-        break;
-    case Plaintext:
-        m_value.ident = CSSValueWebkitPlaintext;
-        break;
-    }
-}
-
 template<> inline CSSPrimitiveValue::operator EUnicodeBidi() const
 {
     switch (m_value.ident) {
diff --git a/Source/WebCore/css/CSSProperty.cpp b/Source/WebCore/css/CSSProperty.cpp
index fd85e9bae..01e7077bf 100644
--- a/Source/WebCore/css/CSSProperty.cpp
+++ b/Source/WebCore/css/CSSProperty.cpp
@@ -573,6 +573,9 @@ bool CSSProperty::isInheritedProperty(unsigned propertyID)
 #if ENABLE(CSS_GRID_LAYOUT)
     case CSSPropertyWebkitGridColumns:
     case CSSPropertyWebkitGridRows:
+
+    case CSSPropertyWebkitGridColumn:
+    case CSSPropertyWebkitGridRow:
 #endif
     case CSSPropertyWebkitLineClamp:
     case CSSPropertyWebkitLogicalWidth:
diff --git a/Source/WebCore/css/CSSProperty.h b/Source/WebCore/css/CSSProperty.h
index 2674544d1..d90d31e68 100644
--- a/Source/WebCore/css/CSSProperty.h
+++ b/Source/WebCore/css/CSSProperty.h
@@ -30,7 +30,6 @@
 namespace WebCore {
 
 class CSSProperty {
-    WTF_MAKE_FAST_ALLOCATED;
 public:
     CSSProperty(unsigned propID, PassRefPtr<CSSValue> value, bool important = false, int shorthandID = 0, bool implicit = false)
         : m_id(propID)
@@ -68,9 +67,4 @@ public:
 
 } // namespace WebCore
 
-namespace WTF {
-    // Properties in Vector can be initialized with memset and moved using memcpy.
-    template<> struct VectorTraits<WebCore::CSSProperty> : SimpleClassVectorTraits { };
-}
-
 #endif // CSSProperty_h
diff --git a/Source/WebCore/css/CSSPropertyNames.in b/Source/WebCore/css/CSSPropertyNames.in
index 9afda37a7..41394466b 100644
--- a/Source/WebCore/css/CSSPropertyNames.in
+++ b/Source/WebCore/css/CSSPropertyNames.in
@@ -376,6 +376,8 @@ z-index
 #if defined(ENABLE_CSS_GRID_LAYOUT) && ENABLE_CSS_GRID_LAYOUT
 -webkit-grid-columns
 -webkit-grid-rows
+-webkit-grid-column
+-webkit-grid-row
 #endif
 #if defined(ENABLE_DASHBOARD_SUPPORT) && ENABLE_DASHBOARD_SUPPORT
 -webkit-dashboard-region
diff --git a/Source/WebCore/css/CSSRule.h b/Source/WebCore/css/CSSRule.h
index 5f5627417..6f9ee410b 100644
--- a/Source/WebCore/css/CSSRule.h
+++ b/Source/WebCore/css/CSSRule.h
@@ -111,8 +111,7 @@ public:
 
 protected:
     CSSRule(CSSStyleSheet* parent, Type type)
-        : m_sourceLine(0)
-        , m_hasCachedSelectorText(false)
+        : m_hasCachedSelectorText(false)
         , m_parentIsRule(false)
         , m_type(type)
         , m_parentStyleSheet(parent)
@@ -124,14 +123,10 @@ protected:
 
     ~CSSRule() { }
 
-    int sourceLine() const { return m_sourceLine; }
-    void setSourceLine(int sourceLine) { m_sourceLine = sourceLine; }
     bool hasCachedSelectorText() const { return m_hasCachedSelectorText; }
     void setHasCachedSelectorText(bool hasCachedSelectorText) const { m_hasCachedSelectorText = hasCachedSelectorText; }
 
 private:
-    // Only used by CSSStyleRule but kept here to maximize struct packing.
-    signed m_sourceLine : 26;
     mutable unsigned m_hasCachedSelectorText : 1;
     unsigned m_parentIsRule : 1;
     unsigned m_type : 4;
diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
index be28c601b..aee19f6e9 100644
--- a/Source/WebCore/css/CSSSelector.cpp
+++ b/Source/WebCore/css/CSSSelector.cpp
@@ -188,6 +188,7 @@ PseudoId CSSSelector::pseudoId(PseudoType type)
     case PseudoValid:
     case PseudoInvalid:
     case PseudoIndeterminate:
+    case PseudoScope:
     case PseudoTarget:
     case PseudoLang:
     case PseudoNot:
@@ -272,6 +273,7 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
     DEFINE_STATIC_LOCAL(AtomicString, scrollbarTrack, ("-webkit-scrollbar-track"));
     DEFINE_STATIC_LOCAL(AtomicString, scrollbarTrackPiece, ("-webkit-scrollbar-track-piece"));
     DEFINE_STATIC_LOCAL(AtomicString, selection, ("selection"));
+    DEFINE_STATIC_LOCAL(AtomicString, scope, ("scope"));
     DEFINE_STATIC_LOCAL(AtomicString, target, ("target"));
     DEFINE_STATIC_LOCAL(AtomicString, visited, ("visited"));
     DEFINE_STATIC_LOCAL(AtomicString, windowInactive, ("window-inactive"));
@@ -362,6 +364,7 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
         nameToPseudoType->set(scrollbarTrackPiece.impl(), CSSSelector::PseudoScrollbarTrackPiece);
         nameToPseudoType->set(cornerPresent.impl(), CSSSelector::PseudoCornerPresent);
         nameToPseudoType->set(selection.impl(), CSSSelector::PseudoSelection);
+        nameToPseudoType->set(scope.impl(), CSSSelector::PseudoScope);
         nameToPseudoType->set(target.impl(), CSSSelector::PseudoTarget);
         nameToPseudoType->set(visited.impl(), CSSSelector::PseudoVisited);
         nameToPseudoType->set(firstPage.impl(), CSSSelector::PseudoFirstPage);
@@ -454,6 +457,7 @@ void CSSSelector::extractPseudoType() const
     case PseudoValid:
     case PseudoInvalid:
     case PseudoIndeterminate:
+    case PseudoScope:
     case PseudoTarget:
     case PseudoLang:
     case PseudoNot:
diff --git a/Source/WebCore/css/CSSSelector.h b/Source/WebCore/css/CSSSelector.h
index afd52def9..112d96cea 100644
--- a/Source/WebCore/css/CSSSelector.h
+++ b/Source/WebCore/css/CSSSelector.h
@@ -144,6 +144,7 @@ namespace WebCore {
             PseudoValid,
             PseudoInvalid,
             PseudoIndeterminate,
+            PseudoScope,
             PseudoTarget,
             PseudoBefore,
             PseudoAfter,
diff --git a/Source/WebCore/css/CSSStyleApplyProperty.cpp b/Source/WebCore/css/CSSStyleApplyProperty.cpp
index 274ceb482..cfd6931d1 100644
--- a/Source/WebCore/css/CSSStyleApplyProperty.cpp
+++ b/Source/WebCore/css/CSSStyleApplyProperty.cpp
@@ -26,6 +26,7 @@
 #include "CSSStyleApplyProperty.h"
 
 #include "CSSAspectRatioValue.h"
+#include "CSSCalculationValue.h"
 #include "CSSCursorImageValue.h"
 #include "CSSFlexValue.h"
 #include "CSSPrimitiveValueMappings.h"
@@ -389,6 +390,8 @@ public:
                 setValue(selector->style(), length);
             } else if (primitiveValue->isPercentage())
                 setValue(selector->style(), Length(primitiveValue->getDoubleValue(), Percent));
+            else if (primitiveValue->isCalculatedPercentageWithLength())
+                setValue(selector->style(), Length(primitiveValue->cssCalcValue()->toCalcValue(selector->style(), selector->rootElementStyle(), selector->style()->effectiveZoom())));            
         }
     }
 
@@ -1144,6 +1147,36 @@ public:
     }
 };
 
+class ApplyPropertyUnicodeBidi {
+public:
+    static void applyValue(CSSStyleSelector* selector, CSSValue* value)
+    {
+        if (value->isValueList()) {
+            EUnicodeBidi rendererUnicodeBidi = RenderStyle::initialUnicodeBidi();
+            for (CSSValueListIterator i = value; i.hasMore(); i.advance()) {
+                CSSValue* item = i.value();
+                ASSERT(item->isPrimitiveValue());
+                EUnicodeBidi currentValue = *static_cast<CSSPrimitiveValue*>(item);
+                ASSERT(currentValue == Override || currentValue == Isolate);
+                if (currentValue != rendererUnicodeBidi && rendererUnicodeBidi != RenderStyle::initialUnicodeBidi())
+                    rendererUnicodeBidi = OverrideIsolate;
+                else
+                    rendererUnicodeBidi = currentValue;
+            }
+            selector->style()->setUnicodeBidi(rendererUnicodeBidi);
+        }
+        if (!value->isPrimitiveValue())
+            return;
+        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        selector->style()->setUnicodeBidi(*primitiveValue);
+    }
+    static PropertyHandler createHandler()
+    {
+        PropertyHandler handler = ApplyPropertyDefaultBase<EUnicodeBidi, &RenderStyle::unicodeBidi, EUnicodeBidi, &RenderStyle::setUnicodeBidi, EUnicodeBidi, &RenderStyle::initialUnicodeBidi>::createHandler();
+        return PropertyHandler(handler.inheritFunction(), handler.initialFunction(), &applyValue);
+    }
+};
+
 class ApplyPropertyLineHeight {
 public:
     static void applyValue(CSSStyleSelector* selector, CSSValue* value)
@@ -1186,14 +1219,22 @@ private:
     static Length inchLength(double inch) { return CSSPrimitiveValue::create(inch, CSSPrimitiveValue::CSS_IN)->computeLength<Length>(0, 0); }
     static bool getPageSizeFromName(CSSPrimitiveValue* pageSizeName, CSSPrimitiveValue* pageOrientation, Length& width, Length& height)
     {
-        static const Length a5Width = mmLength(148), a5Height = mmLength(210);
-        static const Length a4Width = mmLength(210), a4Height = mmLength(297);
-        static const Length a3Width = mmLength(297), a3Height = mmLength(420);
-        static const Length b5Width = mmLength(176), b5Height = mmLength(250);
-        static const Length b4Width = mmLength(250), b4Height = mmLength(353);
-        static const Length letterWidth = inchLength(8.5), letterHeight = inchLength(11);
-        static const Length legalWidth = inchLength(8.5), legalHeight = inchLength(14);
-        static const Length ledgerWidth = inchLength(11), ledgerHeight = inchLength(17);
+        DEFINE_STATIC_LOCAL(Length, a5Width, (mmLength(148)));
+        DEFINE_STATIC_LOCAL(Length, a5Height, (mmLength(210)));
+        DEFINE_STATIC_LOCAL(Length, a4Width, (mmLength(210)));
+        DEFINE_STATIC_LOCAL(Length, a4Height, (mmLength(297)));
+        DEFINE_STATIC_LOCAL(Length, a3Width, (mmLength(297)));
+        DEFINE_STATIC_LOCAL(Length, a3Height, (mmLength(420)));
+        DEFINE_STATIC_LOCAL(Length, b5Width, (mmLength(176)));
+        DEFINE_STATIC_LOCAL(Length, b5Height, (mmLength(250)));
+        DEFINE_STATIC_LOCAL(Length, b4Width, (mmLength(250)));
+        DEFINE_STATIC_LOCAL(Length, b4Height, (mmLength(353)));
+        DEFINE_STATIC_LOCAL(Length, letterWidth, (inchLength(8.5)));
+        DEFINE_STATIC_LOCAL(Length, letterHeight, (inchLength(11)));
+        DEFINE_STATIC_LOCAL(Length, legalWidth, (inchLength(8.5)));
+        DEFINE_STATIC_LOCAL(Length, legalHeight, (inchLength(14)));
+        DEFINE_STATIC_LOCAL(Length, ledgerWidth, (inchLength(11)));
+        DEFINE_STATIC_LOCAL(Length, ledgerHeight, (inchLength(17)));
 
         if (!pageSizeName)
             return false;
@@ -1684,239 +1725,119 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     for (int i = 0; i < numCSSProperties; ++i)
         m_propertyMap[i] = PropertyHandler();
 
-    setPropertyHandler(CSSPropertyWebkitAspectRatio, ApplyPropertyAspectRatio::createHandler());
-
-    setPropertyHandler(CSSPropertyColor, ApplyPropertyColor<InheritFromParent, &RenderStyle::color, &RenderStyle::setColor, &RenderStyle::setVisitedLinkColor, &RenderStyle::invalidColor, RenderStyle::initialColor>::createHandler());
-    setPropertyHandler(CSSPropertyDirection, ApplyPropertyDirection<&RenderStyle::direction, &RenderStyle::setDirection, RenderStyle::initialDirection>::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundAttachment, ApplyPropertyFillLayer<EFillAttachment, CSSPropertyBackgroundAttachment, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isAttachmentSet, &FillLayer::attachment, &FillLayer::setAttachment, &FillLayer::clearAttachment, &FillLayer::initialFillAttachment, &CSSStyleSelector::mapFillAttachment>::createHandler());
-    setPropertyHandler(CSSPropertyBackgroundClip, ApplyPropertyFillLayer<EFillBox, CSSPropertyBackgroundClip, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isClipSet, &FillLayer::clip, &FillLayer::setClip, &FillLayer::clearClip, &FillLayer::initialFillClip, &CSSStyleSelector::mapFillClip>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBackgroundClip, CSSPropertyBackgroundClip);
-    setPropertyHandler(CSSPropertyWebkitBackgroundComposite, ApplyPropertyFillLayer<CompositeOperator, CSSPropertyWebkitBackgroundComposite, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isCompositeSet, &FillLayer::composite, &FillLayer::setComposite, &FillLayer::clearComposite, &FillLayer::initialFillComposite, &CSSStyleSelector::mapFillComposite>::createHandler());
-
-    setPropertyHandler(CSSPropertyDisplay, ApplyPropertyDisplay::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundImage, ApplyPropertyFillLayer<StyleImage*, CSSPropertyBackgroundImage, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isImageSet, &FillLayer::image, &FillLayer::setImage, &FillLayer::clearImage, &FillLayer::initialFillImage, &CSSStyleSelector::mapFillImage>::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundOrigin, ApplyPropertyFillLayer<EFillBox, CSSPropertyBackgroundOrigin, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isOriginSet, &FillLayer::origin, &FillLayer::setOrigin, &FillLayer::clearOrigin, &FillLayer::initialFillOrigin, &CSSStyleSelector::mapFillOrigin>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBackgroundOrigin, CSSPropertyBackgroundOrigin);
-
-    setPropertyHandler(CSSPropertyBackgroundPositionX, ApplyPropertyFillLayer<Length, CSSPropertyBackgroundPositionX, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isXPositionSet, &FillLayer::xPosition, &FillLayer::setXPosition, &FillLayer::clearXPosition, &FillLayer::initialFillXPosition, &CSSStyleSelector::mapFillXPosition>::createHandler());
-    setPropertyHandler(CSSPropertyBackgroundPositionY, ApplyPropertyFillLayer<Length, CSSPropertyBackgroundPositionY, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isYPositionSet, &FillLayer::yPosition, &FillLayer::setYPosition, &FillLayer::clearYPosition, &FillLayer::initialFillYPosition, &CSSStyleSelector::mapFillYPosition>::createHandler());
+    // Please keep CSS property list in alphabetical order.
+    setPropertyHandler(CSSPropertyBackgroundAttachment, ApplyPropertyFillLayer<EFillAttachment, CSSPropertyBackgroundAttachment, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isAttachmentSet, &FillLayer::attachment, &FillLayer::setAttachment, &FillLayer::clearAttachment, &FillLayer::initialFillAttachment, &CSSStyleSelector::mapFillAttachment>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundClip, ApplyPropertyFillLayer<EFillBox, CSSPropertyBackgroundClip, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isClipSet, &FillLayer::clip, &FillLayer::setClip, &FillLayer::clearClip, &FillLayer::initialFillClip, &CSSStyleSelector::mapFillClip>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::backgroundColor, &RenderStyle::setBackgroundColor, &RenderStyle::setVisitedLinkBackgroundColor, &RenderStyle::invalidColor>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundImage, ApplyPropertyFillLayer<StyleImage*, CSSPropertyBackgroundImage, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isImageSet, &FillLayer::image, &FillLayer::setImage, &FillLayer::clearImage, &FillLayer::initialFillImage, &CSSStyleSelector::mapFillImage>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundOrigin, ApplyPropertyFillLayer<EFillBox, CSSPropertyBackgroundOrigin, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isOriginSet, &FillLayer::origin, &FillLayer::setOrigin, &FillLayer::clearOrigin, &FillLayer::initialFillOrigin, &CSSStyleSelector::mapFillOrigin>::createHandler());
     setPropertyHandler(CSSPropertyBackgroundPosition, ApplyPropertyExpanding<SuppressValue, CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY>::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundRepeatX, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyBackgroundRepeatX, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isRepeatXSet, &FillLayer::repeatX, &FillLayer::setRepeatX, &FillLayer::clearRepeatX, &FillLayer::initialFillRepeatX, &CSSStyleSelector::mapFillRepeatX>::createHandler());
-    setPropertyHandler(CSSPropertyBackgroundRepeatY, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyBackgroundRepeatY, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isRepeatYSet, &FillLayer::repeatY, &FillLayer::setRepeatY, &FillLayer::clearRepeatY, &FillLayer::initialFillRepeatY, &CSSStyleSelector::mapFillRepeatY>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundPositionX, ApplyPropertyFillLayer<Length, CSSPropertyBackgroundPositionX, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isXPositionSet, &FillLayer::xPosition, &FillLayer::setXPosition, &FillLayer::clearXPosition, &FillLayer::initialFillXPosition, &CSSStyleSelector::mapFillXPosition>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundPositionY, ApplyPropertyFillLayer<Length, CSSPropertyBackgroundPositionY, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isYPositionSet, &FillLayer::yPosition, &FillLayer::setYPosition, &FillLayer::clearYPosition, &FillLayer::initialFillYPosition, &CSSStyleSelector::mapFillYPosition>::createHandler());
     setPropertyHandler(CSSPropertyBackgroundRepeat, ApplyPropertyExpanding<SuppressValue, CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY>::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundSize, ApplyPropertyFillLayer<FillSize, CSSPropertyBackgroundSize, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isSizeSet, &FillLayer::size, &FillLayer::setSize, &FillLayer::clearSize, &FillLayer::initialFillSize, &CSSStyleSelector::mapFillSize>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBackgroundSize, CSSPropertyBackgroundSize);
-
-    setPropertyHandler(CSSPropertyWebkitMaskAttachment, ApplyPropertyFillLayer<EFillAttachment, CSSPropertyWebkitMaskAttachment, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isAttachmentSet, &FillLayer::attachment, &FillLayer::setAttachment, &FillLayer::clearAttachment, &FillLayer::initialFillAttachment, &CSSStyleSelector::mapFillAttachment>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskClip, ApplyPropertyFillLayer<EFillBox, CSSPropertyWebkitMaskClip, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isClipSet, &FillLayer::clip, &FillLayer::setClip, &FillLayer::clearClip, &FillLayer::initialFillClip, &CSSStyleSelector::mapFillClip>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskComposite, ApplyPropertyFillLayer<CompositeOperator, CSSPropertyWebkitMaskComposite, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isCompositeSet, &FillLayer::composite, &FillLayer::setComposite, &FillLayer::clearComposite, &FillLayer::initialFillComposite, &CSSStyleSelector::mapFillComposite>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitMaskImage, ApplyPropertyFillLayer<StyleImage*, CSSPropertyWebkitMaskImage, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isImageSet, &FillLayer::image, &FillLayer::setImage, &FillLayer::clearImage, &FillLayer::initialFillImage, &CSSStyleSelector::mapFillImage>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitMaskOrigin, ApplyPropertyFillLayer<EFillBox, CSSPropertyWebkitMaskOrigin, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isOriginSet, &FillLayer::origin, &FillLayer::setOrigin, &FillLayer::clearOrigin, &FillLayer::initialFillOrigin, &CSSStyleSelector::mapFillOrigin>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskSize, ApplyPropertyFillLayer<FillSize, CSSPropertyWebkitMaskSize, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isSizeSet, &FillLayer::size, &FillLayer::setSize, &FillLayer::clearSize, &FillLayer::initialFillSize, &CSSStyleSelector::mapFillSize>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitMaskPositionX, ApplyPropertyFillLayer<Length, CSSPropertyWebkitMaskPositionX, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isXPositionSet, &FillLayer::xPosition, &FillLayer::setXPosition, &FillLayer::clearXPosition, &FillLayer::initialFillXPosition, &CSSStyleSelector::mapFillXPosition>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskPositionY, ApplyPropertyFillLayer<Length, CSSPropertyWebkitMaskPositionY, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isYPositionSet, &FillLayer::yPosition, &FillLayer::setYPosition, &FillLayer::clearYPosition, &FillLayer::initialFillYPosition, &CSSStyleSelector::mapFillYPosition>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskPosition, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitMaskRepeatX, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyWebkitMaskRepeatX, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isRepeatXSet, &FillLayer::repeatX, &FillLayer::setRepeatX, &FillLayer::clearRepeatX, &FillLayer::initialFillRepeatX, &CSSStyleSelector::mapFillRepeatX>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskRepeatY, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyWebkitMaskRepeatY, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isRepeatYSet, &FillLayer::repeatY, &FillLayer::setRepeatY, &FillLayer::clearRepeatY, &FillLayer::initialFillRepeatY, &CSSStyleSelector::mapFillRepeatY>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskRepeat, ApplyPropertyExpanding<SuppressValue, CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY>::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::backgroundColor, &RenderStyle::setBackgroundColor, &RenderStyle::setVisitedLinkBackgroundColor, &RenderStyle::invalidColor>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderCollapse, ApplyPropertyDefault<EBorderCollapse, &RenderStyle::borderCollapse, EBorderCollapse, &RenderStyle::setBorderCollapse, EBorderCollapse, &RenderStyle::initialBorderCollapse>::createHandler());
-
+    setPropertyHandler(CSSPropertyBackgroundRepeatX, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyBackgroundRepeatX, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isRepeatXSet, &FillLayer::repeatX, &FillLayer::setRepeatX, &FillLayer::clearRepeatX, &FillLayer::initialFillRepeatX, &CSSStyleSelector::mapFillRepeatX>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundRepeatY, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyBackgroundRepeatY, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isRepeatYSet, &FillLayer::repeatY, &FillLayer::setRepeatY, &FillLayer::clearRepeatY, &FillLayer::initialFillRepeatY, &CSSStyleSelector::mapFillRepeatY>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundSize, ApplyPropertyFillLayer<FillSize, CSSPropertyBackgroundSize, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isSizeSet, &FillLayer::size, &FillLayer::setSize, &FillLayer::clearSize, &FillLayer::initialFillSize, &CSSStyleSelector::mapFillSize>::createHandler());
+    setPropertyHandler(CSSPropertyBorder, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderStyle, CSSPropertyBorderWidth, CSSPropertyBorderColor>::createHandler());
+    setPropertyHandler(CSSPropertyBorderBottom, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderBottomColor, CSSPropertyBorderBottomStyle, CSSPropertyBorderBottomWidth>::createHandler());
     setPropertyHandler(CSSPropertyBorderBottomColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderBottomColor, &RenderStyle::setBorderBottomColor, &RenderStyle::setVisitedLinkBorderBottomColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyBorderLeftColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderLeftColor, &RenderStyle::setBorderLeftColor, &RenderStyle::setVisitedLinkBorderLeftColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyBorderRightColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderRightColor, &RenderStyle::setBorderRightColor, &RenderStyle::setVisitedLinkBorderRightColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyBorderTopColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderTopColor, &RenderStyle::setBorderTopColor, &RenderStyle::setVisitedLinkBorderTopColor, &RenderStyle::color>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderTopStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderTopStyle, EBorderStyle, &RenderStyle::setBorderTopStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
-    setPropertyHandler(CSSPropertyBorderRightStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderRightStyle, EBorderStyle, &RenderStyle::setBorderRightStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
+    setPropertyHandler(CSSPropertyBorderBottomLeftRadius, ApplyPropertyBorderRadius<&RenderStyle::borderBottomLeftRadius, &RenderStyle::setBorderBottomLeftRadius, &RenderStyle::initialBorderRadius>::createHandler());
+    setPropertyHandler(CSSPropertyBorderBottomRightRadius, ApplyPropertyBorderRadius<&RenderStyle::borderBottomRightRadius, &RenderStyle::setBorderBottomRightRadius, &RenderStyle::initialBorderRadius>::createHandler());
     setPropertyHandler(CSSPropertyBorderBottomStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderBottomStyle, EBorderStyle, &RenderStyle::setBorderBottomStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
-    setPropertyHandler(CSSPropertyBorderLeftStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderLeftStyle, EBorderStyle, &RenderStyle::setBorderLeftStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderTopWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderTopWidth, &RenderStyle::setBorderTopWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyBorderRightWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderRightWidth, &RenderStyle::setBorderRightWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
     setPropertyHandler(CSSPropertyBorderBottomWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderBottomWidth, &RenderStyle::setBorderBottomWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyBorderLeftWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderLeftWidth, &RenderStyle::setBorderLeftWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyOutlineWidth, ApplyPropertyComputeLength<unsigned short, &RenderStyle::outlineWidth, &RenderStyle::setOutlineWidth, &RenderStyle::initialOutlineWidth, NormalDisabled, ThicknessEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitColumnRuleWidth, ApplyPropertyComputeLength<unsigned short, &RenderStyle::columnRuleWidth, &RenderStyle::setColumnRuleWidth, &RenderStyle::initialColumnRuleWidth, NormalDisabled, ThicknessEnabled>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderTop, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopColor, CSSPropertyBorderTopStyle, CSSPropertyBorderTopWidth>::createHandler());
-    setPropertyHandler(CSSPropertyBorderRight, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderRightColor, CSSPropertyBorderRightStyle, CSSPropertyBorderRightWidth>::createHandler());
-    setPropertyHandler(CSSPropertyBorderBottom, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderBottomColor, CSSPropertyBorderBottomStyle, CSSPropertyBorderBottomWidth>::createHandler());
-    setPropertyHandler(CSSPropertyBorderLeft, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderLeftColor, CSSPropertyBorderLeftStyle, CSSPropertyBorderLeftWidth>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderStyle, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle>::createHandler());
-    setPropertyHandler(CSSPropertyBorderWidth, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth>::createHandler());
+    setPropertyHandler(CSSPropertyBorderCollapse, ApplyPropertyDefault<EBorderCollapse, &RenderStyle::borderCollapse, EBorderCollapse, &RenderStyle::setBorderCollapse, EBorderCollapse, &RenderStyle::initialBorderCollapse>::createHandler());
     setPropertyHandler(CSSPropertyBorderColor, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopColor, CSSPropertyBorderRightColor, CSSPropertyBorderBottomColor, CSSPropertyBorderLeftColor>::createHandler());
-    setPropertyHandler(CSSPropertyBorder, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderStyle, CSSPropertyBorderWidth, CSSPropertyBorderColor>::createHandler());
-
     setPropertyHandler(CSSPropertyBorderImage, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderImageSource, CSSPropertyBorderImageSlice, CSSPropertyBorderImageWidth, CSSPropertyBorderImageOutset, CSSPropertyBorderImageRepeat>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBorderImage, ApplyPropertyBorderImage<Image, CSSPropertyWebkitBorderImage, &RenderStyle::borderImage, &RenderStyle::setBorderImage>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImage, ApplyPropertyBorderImage<Mask, CSSPropertyWebkitMaskBoxImage, &RenderStyle::maskBoxImage, &RenderStyle::setMaskBoxImage>::createHandler());
-
     setPropertyHandler(CSSPropertyBorderImageOutset, ApplyPropertyBorderImageModifier<Image, Outset>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImageOutset, ApplyPropertyBorderImageModifier<Mask, Outset>::createHandler());
     setPropertyHandler(CSSPropertyBorderImageRepeat, ApplyPropertyBorderImageModifier<Image, Repeat>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImageRepeat, ApplyPropertyBorderImageModifier<Mask, Repeat>::createHandler());
     setPropertyHandler(CSSPropertyBorderImageSlice, ApplyPropertyBorderImageModifier<Image, Slice>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImageSlice, ApplyPropertyBorderImageModifier<Mask, Slice>::createHandler());
-    setPropertyHandler(CSSPropertyBorderImageWidth, ApplyPropertyBorderImageModifier<Image, Width>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImageWidth, ApplyPropertyBorderImageModifier<Mask, Width>::createHandler());
-
     setPropertyHandler(CSSPropertyBorderImageSource, ApplyPropertyBorderImageSource<CSSPropertyBorderImageSource, &RenderStyle::borderImageSource, &RenderStyle::setBorderImageSource, &RenderStyle::initialBorderImageSource>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImageSource, ApplyPropertyBorderImageSource<CSSPropertyWebkitMaskBoxImageSource, &RenderStyle::maskBoxImageSource, &RenderStyle::setMaskBoxImageSource, &RenderStyle::initialMaskBoxImageSource>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderTopLeftRadius, ApplyPropertyBorderRadius<&RenderStyle::borderTopLeftRadius, &RenderStyle::setBorderTopLeftRadius, &RenderStyle::initialBorderRadius>::createHandler());
-    setPropertyHandler(CSSPropertyBorderTopRightRadius, ApplyPropertyBorderRadius<&RenderStyle::borderTopRightRadius, &RenderStyle::setBorderTopRightRadius, &RenderStyle::initialBorderRadius>::createHandler());
-    setPropertyHandler(CSSPropertyBorderBottomLeftRadius, ApplyPropertyBorderRadius<&RenderStyle::borderBottomLeftRadius, &RenderStyle::setBorderBottomLeftRadius, &RenderStyle::initialBorderRadius>::createHandler());
-    setPropertyHandler(CSSPropertyBorderBottomRightRadius, ApplyPropertyBorderRadius<&RenderStyle::borderBottomRightRadius, &RenderStyle::setBorderBottomRightRadius, &RenderStyle::initialBorderRadius>::createHandler());
+    setPropertyHandler(CSSPropertyBorderImageWidth, ApplyPropertyBorderImageModifier<Image, Width>::createHandler());
+    setPropertyHandler(CSSPropertyBorderLeft, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderLeftColor, CSSPropertyBorderLeftStyle, CSSPropertyBorderLeftWidth>::createHandler());
+    setPropertyHandler(CSSPropertyBorderLeftColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderLeftColor, &RenderStyle::setBorderLeftColor, &RenderStyle::setVisitedLinkBorderLeftColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyBorderLeftStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderLeftStyle, EBorderStyle, &RenderStyle::setBorderLeftStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
+    setPropertyHandler(CSSPropertyBorderLeftWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderLeftWidth, &RenderStyle::setBorderLeftWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
     setPropertyHandler(CSSPropertyBorderRadius, ApplyPropertyExpanding<ExpandValue, CSSPropertyBorderTopLeftRadius, CSSPropertyBorderTopRightRadius, CSSPropertyBorderBottomLeftRadius, CSSPropertyBorderBottomRightRadius>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBorderRadius, CSSPropertyBorderRadius);
-
-    setPropertyHandler(CSSPropertyWebkitBorderHorizontalSpacing, ApplyPropertyComputeLength<short, &RenderStyle::horizontalBorderSpacing, &RenderStyle::setHorizontalBorderSpacing, &RenderStyle::initialHorizontalBorderSpacing>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBorderVerticalSpacing, ApplyPropertyComputeLength<short, &RenderStyle::verticalBorderSpacing, &RenderStyle::setVerticalBorderSpacing, &RenderStyle::initialVerticalBorderSpacing>::createHandler());
+    setPropertyHandler(CSSPropertyBorderRight, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderRightColor, CSSPropertyBorderRightStyle, CSSPropertyBorderRightWidth>::createHandler());
+    setPropertyHandler(CSSPropertyBorderRightColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderRightColor, &RenderStyle::setBorderRightColor, &RenderStyle::setVisitedLinkBorderRightColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyBorderRightStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderRightStyle, EBorderStyle, &RenderStyle::setBorderRightStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
+    setPropertyHandler(CSSPropertyBorderRightWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderRightWidth, &RenderStyle::setBorderRightWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
     setPropertyHandler(CSSPropertyBorderSpacing, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitBorderHorizontalSpacing, CSSPropertyWebkitBorderVerticalSpacing>::createHandler());
-
-    setPropertyHandler(CSSPropertyLetterSpacing, ApplyPropertyComputeLength<int, &RenderStyle::letterSpacing, &RenderStyle::setLetterSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyWordSpacing, ApplyPropertyComputeLength<int, &RenderStyle::wordSpacing, &RenderStyle::setWordSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
-
+    setPropertyHandler(CSSPropertyBorderStyle, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTop, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopColor, CSSPropertyBorderTopStyle, CSSPropertyBorderTopWidth>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTopColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderTopColor, &RenderStyle::setBorderTopColor, &RenderStyle::setVisitedLinkBorderTopColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTopLeftRadius, ApplyPropertyBorderRadius<&RenderStyle::borderTopLeftRadius, &RenderStyle::setBorderTopLeftRadius, &RenderStyle::initialBorderRadius>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTopRightRadius, ApplyPropertyBorderRadius<&RenderStyle::borderTopRightRadius, &RenderStyle::setBorderTopRightRadius, &RenderStyle::initialBorderRadius>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTopStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderTopStyle, EBorderStyle, &RenderStyle::setBorderTopStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTopWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderTopWidth, &RenderStyle::setBorderTopWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyBorderWidth, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth>::createHandler());
+    setPropertyHandler(CSSPropertyBottom, ApplyPropertyLength<&RenderStyle::bottom, &RenderStyle::setBottom, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyBoxSizing, ApplyPropertyDefault<EBoxSizing, &RenderStyle::boxSizing, EBoxSizing, &RenderStyle::setBoxSizing, EBoxSizing, &RenderStyle::initialBoxSizing>::createHandler());
     setPropertyHandler(CSSPropertyCaptionSide, ApplyPropertyDefault<ECaptionSide, &RenderStyle::captionSide, ECaptionSide, &RenderStyle::setCaptionSide, ECaptionSide, &RenderStyle::initialCaptionSide>::createHandler());
     setPropertyHandler(CSSPropertyClear, ApplyPropertyDefault<EClear, &RenderStyle::clear, EClear, &RenderStyle::setClear, EClear, &RenderStyle::initialClear>::createHandler());
-
     setPropertyHandler(CSSPropertyClip, ApplyPropertyClip::createHandler());
-
-    setPropertyHandler(CSSPropertyCursor, ApplyPropertyCursor::createHandler());
-
+    setPropertyHandler(CSSPropertyColor, ApplyPropertyColor<InheritFromParent, &RenderStyle::color, &RenderStyle::setColor, &RenderStyle::setVisitedLinkColor, &RenderStyle::invalidColor, RenderStyle::initialColor>::createHandler());
     setPropertyHandler(CSSPropertyCounterIncrement, ApplyPropertyCounter<Increment>::createHandler());
     setPropertyHandler(CSSPropertyCounterReset, ApplyPropertyCounter<Reset>::createHandler());
-
+    setPropertyHandler(CSSPropertyCursor, ApplyPropertyCursor::createHandler());
+    setPropertyHandler(CSSPropertyDirection, ApplyPropertyDirection<&RenderStyle::direction, &RenderStyle::setDirection, RenderStyle::initialDirection>::createHandler());
+    setPropertyHandler(CSSPropertyDisplay, ApplyPropertyDisplay::createHandler());
     setPropertyHandler(CSSPropertyEmptyCells, ApplyPropertyDefault<EEmptyCell, &RenderStyle::emptyCells, EEmptyCell, &RenderStyle::setEmptyCells, EEmptyCell, &RenderStyle::initialEmptyCells>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitFlexOrder, ApplyPropertyDefault<int, &RenderStyle::flexOrder, int, &RenderStyle::setFlexOrder, int, &RenderStyle::initialFlexOrder>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexPack, ApplyPropertyDefault<EFlexPack, &RenderStyle::flexPack, EFlexPack, &RenderStyle::setFlexPack, EFlexPack, &RenderStyle::initialFlexPack>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexAlign, ApplyPropertyDefault<EFlexAlign, &RenderStyle::flexAlign, EFlexAlign, &RenderStyle::setFlexAlign, EFlexAlign, &RenderStyle::initialFlexAlign>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexItemAlign, ApplyPropertyDefault<EFlexAlign, &RenderStyle::flexItemAlign, EFlexAlign, &RenderStyle::setFlexItemAlign, EFlexAlign, &RenderStyle::initialFlexItemAlign>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexDirection, ApplyPropertyDefault<EFlexDirection, &RenderStyle::flexDirection, EFlexDirection, &RenderStyle::setFlexDirection, EFlexDirection, &RenderStyle::initialFlexDirection>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexWrap, ApplyPropertyDefault<EFlexWrap, &RenderStyle::flexWrap, EFlexWrap, &RenderStyle::setFlexWrap, EFlexWrap, &RenderStyle::initialFlexWrap>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexFlow, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitFlexDirection, CSSPropertyWebkitFlexWrap>::createHandler());
-
     setPropertyHandler(CSSPropertyFloat, ApplyPropertyDefault<EFloat, &RenderStyle::floating, EFloat, &RenderStyle::setFloating, EFloat, &RenderStyle::initialFloating>::createHandler());
-
     setPropertyHandler(CSSPropertyFontSize, ApplyPropertyFontSize::createHandler());
     setPropertyHandler(CSSPropertyFontStyle, ApplyPropertyFont<FontItalic, &FontDescription::italic, &FontDescription::setItalic, FontItalicOff>::createHandler());
     setPropertyHandler(CSSPropertyFontVariant, ApplyPropertyFont<FontSmallCaps, &FontDescription::smallCaps, &FontDescription::setSmallCaps, FontSmallCapsOff>::createHandler());
-    setPropertyHandler(CSSPropertyTextRendering, ApplyPropertyFont<TextRenderingMode, &FontDescription::textRenderingMode, &FontDescription::setTextRenderingMode, AutoTextRendering>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFontKerning, ApplyPropertyFont<FontDescription::Kerning, &FontDescription::kerning, &FontDescription::setKerning, FontDescription::AutoKerning>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFontSmoothing, ApplyPropertyFont<FontSmoothingMode, &FontDescription::fontSmoothing, &FontDescription::setFontSmoothing, AutoSmoothing>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTextOrientation, ApplyPropertyFont<TextOrientation, &FontDescription::textOrientation, &FontDescription::setTextOrientation, TextOrientationVerticalRight>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFontVariantLigatures, ApplyPropertyFontVariantLigatures::createHandler());
     setPropertyHandler(CSSPropertyFontWeight, ApplyPropertyFontWeight::createHandler());
-
-    setPropertyHandler(CSSPropertyTextAlign, ApplyPropertyTextAlign::createHandler());
-    setPropertyHandler(CSSPropertyTextDecoration, ApplyPropertyTextDecoration::createHandler());
-
-    setPropertyHandler(CSSPropertyOutlineStyle, ApplyPropertyOutlineStyle::createHandler());
-    setPropertyHandler(CSSPropertyOutlineColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor, &RenderStyle::setVisitedLinkOutlineColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyOutlineOffset, ApplyPropertyComputeLength<int, &RenderStyle::outlineOffset, &RenderStyle::setOutlineOffset, &RenderStyle::initialOutlineOffset>::createHandler());
-
-    setPropertyHandler(CSSPropertyOutline, ApplyPropertyExpanding<SuppressValue, CSSPropertyOutlineWidth, CSSPropertyOutlineColor, CSSPropertyOutlineStyle>::createHandler());
-
-    setPropertyHandler(CSSPropertyOverflowX, ApplyPropertyDefault<EOverflow, &RenderStyle::overflowX, EOverflow, &RenderStyle::setOverflowX, EOverflow, &RenderStyle::initialOverflowX>::createHandler());
-    setPropertyHandler(CSSPropertyOverflowY, ApplyPropertyDefault<EOverflow, &RenderStyle::overflowY, EOverflow, &RenderStyle::setOverflowY, EOverflow, &RenderStyle::initialOverflowY>::createHandler());
-    setPropertyHandler(CSSPropertyOverflow, ApplyPropertyExpanding<ExpandValue, CSSPropertyOverflowX, CSSPropertyOverflowY>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitColumnRuleColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::columnRuleColor, &RenderStyle::setColumnRuleColor, &RenderStyle::setVisitedLinkColumnRuleColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTextEmphasisColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textEmphasisColor, &RenderStyle::setTextEmphasisColor, &RenderStyle::setVisitedLinkTextEmphasisColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTextFillColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textFillColor, &RenderStyle::setTextFillColor, &RenderStyle::setVisitedLinkTextFillColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTextStrokeColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textStrokeColor, &RenderStyle::setTextStrokeColor, &RenderStyle::setVisitedLinkTextStrokeColor, &RenderStyle::color>::createHandler());
-
-    setPropertyHandler(CSSPropertyTop, ApplyPropertyLength<&RenderStyle::top, &RenderStyle::setTop, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyRight, ApplyPropertyLength<&RenderStyle::right, &RenderStyle::setRight, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyBottom, ApplyPropertyLength<&RenderStyle::bottom, &RenderStyle::setBottom, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyLeft, ApplyPropertyLength<&RenderStyle::left, &RenderStyle::setLeft, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
-
-    setPropertyHandler(CSSPropertyWidth, ApplyPropertyLength<&RenderStyle::width, &RenderStyle::setWidth, &RenderStyle::initialSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneDisabled, UndefinedDisabled, FlexWidth>::createHandler());
     setPropertyHandler(CSSPropertyHeight, ApplyPropertyLength<&RenderStyle::height, &RenderStyle::setHeight, &RenderStyle::initialSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneDisabled, UndefinedDisabled, FlexHeight>::createHandler());
-
-    setPropertyHandler(CSSPropertyTextIndent, ApplyPropertyLength<&RenderStyle::textIndent, &RenderStyle::setTextIndent, &RenderStyle::initialTextIndent>::createHandler());
-
+    setPropertyHandler(CSSPropertyImageRendering, ApplyPropertyDefault<EImageRendering, &RenderStyle::imageRendering, EImageRendering, &RenderStyle::setImageRendering, EImageRendering, &RenderStyle::initialImageRendering>::createHandler());
+    setPropertyHandler(CSSPropertyLeft, ApplyPropertyLength<&RenderStyle::left, &RenderStyle::setLeft, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyLetterSpacing, ApplyPropertyComputeLength<int, &RenderStyle::letterSpacing, &RenderStyle::setLetterSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
     setPropertyHandler(CSSPropertyLineHeight, ApplyPropertyLineHeight::createHandler());
-
+    setPropertyHandler(CSSPropertyListStyle, ApplyPropertyExpanding<SuppressValue, CSSPropertyListStyleType, CSSPropertyListStyleImage, CSSPropertyListStylePosition>::createHandler());
     setPropertyHandler(CSSPropertyListStyleImage, ApplyPropertyStyleImage<&RenderStyle::listStyleImage, &RenderStyle::setListStyleImage, &RenderStyle::initialListStyleImage, CSSPropertyListStyleImage>::createHandler());
     setPropertyHandler(CSSPropertyListStylePosition, ApplyPropertyDefault<EListStylePosition, &RenderStyle::listStylePosition, EListStylePosition, &RenderStyle::setListStylePosition, EListStylePosition, &RenderStyle::initialListStylePosition>::createHandler());
     setPropertyHandler(CSSPropertyListStyleType, ApplyPropertyDefault<EListStyleType, &RenderStyle::listStyleType, EListStyleType, &RenderStyle::setListStyleType, EListStyleType, &RenderStyle::initialListStyleType>::createHandler());
-    setPropertyHandler(CSSPropertyListStyle, ApplyPropertyExpanding<SuppressValue, CSSPropertyListStyleType, CSSPropertyListStyleImage, CSSPropertyListStylePosition>::createHandler());
-
+    setPropertyHandler(CSSPropertyMargin, ApplyPropertyExpanding<SuppressValue, CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft>::createHandler());
+    setPropertyHandler(CSSPropertyMarginBottom, ApplyPropertyLength<&RenderStyle::marginBottom, &RenderStyle::setMarginBottom, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyMarginLeft, ApplyPropertyLength<&RenderStyle::marginLeft, &RenderStyle::setMarginLeft, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyMarginRight, ApplyPropertyLength<&RenderStyle::marginRight, &RenderStyle::setMarginRight, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyMarginTop, ApplyPropertyLength<&RenderStyle::marginTop, &RenderStyle::setMarginTop, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
     setPropertyHandler(CSSPropertyMaxHeight, ApplyPropertyLength<&RenderStyle::maxHeight, &RenderStyle::setMaxHeight, &RenderStyle::initialMaxSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneEnabled, UndefinedEnabled>::createHandler());
     setPropertyHandler(CSSPropertyMaxWidth, ApplyPropertyLength<&RenderStyle::maxWidth, &RenderStyle::setMaxWidth, &RenderStyle::initialMaxSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneEnabled, UndefinedEnabled>::createHandler());
     setPropertyHandler(CSSPropertyMinHeight, ApplyPropertyLength<&RenderStyle::minHeight, &RenderStyle::setMinHeight, &RenderStyle::initialMinSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled>::createHandler());
     setPropertyHandler(CSSPropertyMinWidth, ApplyPropertyLength<&RenderStyle::minWidth, &RenderStyle::setMinWidth, &RenderStyle::initialMinSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled>::createHandler());
-
-    setPropertyHandler(CSSPropertyMarginTop, ApplyPropertyLength<&RenderStyle::marginTop, &RenderStyle::setMarginTop, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMarginRight, ApplyPropertyLength<&RenderStyle::marginRight, &RenderStyle::setMarginRight, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMarginBottom, ApplyPropertyLength<&RenderStyle::marginBottom, &RenderStyle::setMarginBottom, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMarginLeft, ApplyPropertyLength<&RenderStyle::marginLeft, &RenderStyle::setMarginLeft, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMargin, ApplyPropertyExpanding<SuppressValue, CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitMarginBeforeCollapse, ApplyPropertyDefault<EMarginCollapse, &RenderStyle::marginBeforeCollapse, EMarginCollapse, &RenderStyle::setMarginBeforeCollapse, EMarginCollapse, &RenderStyle::initialMarginBeforeCollapse>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMarginAfterCollapse, ApplyPropertyDefault<EMarginCollapse, &RenderStyle::marginAfterCollapse, EMarginCollapse, &RenderStyle::setMarginAfterCollapse, EMarginCollapse, &RenderStyle::initialMarginAfterCollapse>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMarginTopCollapse, CSSPropertyWebkitMarginBeforeCollapse);
-    setPropertyHandler(CSSPropertyWebkitMarginBottomCollapse, CSSPropertyWebkitMarginAfterCollapse);
-    setPropertyHandler(CSSPropertyWebkitMarginCollapse, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitMarginBeforeCollapse, CSSPropertyWebkitMarginAfterCollapse>::createHandler());
-
-    setPropertyHandler(CSSPropertyPaddingTop, ApplyPropertyLength<&RenderStyle::paddingTop, &RenderStyle::setPaddingTop, &RenderStyle::initialPadding>::createHandler());
-    setPropertyHandler(CSSPropertyPaddingRight, ApplyPropertyLength<&RenderStyle::paddingRight, &RenderStyle::setPaddingRight, &RenderStyle::initialPadding>::createHandler());
+    setPropertyHandler(CSSPropertyOrphans, ApplyPropertyDefault<short, &RenderStyle::orphans, short, &RenderStyle::setOrphans, short, &RenderStyle::initialOrphans>::createHandler());
+    setPropertyHandler(CSSPropertyOutline, ApplyPropertyExpanding<SuppressValue, CSSPropertyOutlineWidth, CSSPropertyOutlineColor, CSSPropertyOutlineStyle>::createHandler());
+    setPropertyHandler(CSSPropertyOutlineColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor, &RenderStyle::setVisitedLinkOutlineColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyOutlineOffset, ApplyPropertyComputeLength<int, &RenderStyle::outlineOffset, &RenderStyle::setOutlineOffset, &RenderStyle::initialOutlineOffset>::createHandler());
+    setPropertyHandler(CSSPropertyOutlineStyle, ApplyPropertyOutlineStyle::createHandler());
+    setPropertyHandler(CSSPropertyOutlineWidth, ApplyPropertyComputeLength<unsigned short, &RenderStyle::outlineWidth, &RenderStyle::setOutlineWidth, &RenderStyle::initialOutlineWidth, NormalDisabled, ThicknessEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyOverflow, ApplyPropertyExpanding<ExpandValue, CSSPropertyOverflowX, CSSPropertyOverflowY>::createHandler());
+    setPropertyHandler(CSSPropertyOverflowX, ApplyPropertyDefault<EOverflow, &RenderStyle::overflowX, EOverflow, &RenderStyle::setOverflowX, EOverflow, &RenderStyle::initialOverflowX>::createHandler());
+    setPropertyHandler(CSSPropertyOverflowY, ApplyPropertyDefault<EOverflow, &RenderStyle::overflowY, EOverflow, &RenderStyle::setOverflowY, EOverflow, &RenderStyle::initialOverflowY>::createHandler());
+    setPropertyHandler(CSSPropertyPadding, ApplyPropertyExpanding<SuppressValue, CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft>::createHandler());
     setPropertyHandler(CSSPropertyPaddingBottom, ApplyPropertyLength<&RenderStyle::paddingBottom, &RenderStyle::setPaddingBottom, &RenderStyle::initialPadding>::createHandler());
     setPropertyHandler(CSSPropertyPaddingLeft, ApplyPropertyLength<&RenderStyle::paddingLeft, &RenderStyle::setPaddingLeft, &RenderStyle::initialPadding>::createHandler());
-    setPropertyHandler(CSSPropertyPadding, ApplyPropertyExpanding<SuppressValue, CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft>::createHandler());
-
+    setPropertyHandler(CSSPropertyPaddingRight, ApplyPropertyLength<&RenderStyle::paddingRight, &RenderStyle::setPaddingRight, &RenderStyle::initialPadding>::createHandler());
+    setPropertyHandler(CSSPropertyPaddingTop, ApplyPropertyLength<&RenderStyle::paddingTop, &RenderStyle::setPaddingTop, &RenderStyle::initialPadding>::createHandler());
     setPropertyHandler(CSSPropertyPageBreakAfter, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakAfter, EPageBreak, &RenderStyle::setPageBreakAfter, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
     setPropertyHandler(CSSPropertyPageBreakBefore, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakBefore, EPageBreak, &RenderStyle::setPageBreakBefore, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
     setPropertyHandler(CSSPropertyPageBreakInside, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakInside, EPageBreak, &RenderStyle::setPageBreakInside, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
-
     setPropertyHandler(CSSPropertyPosition, ApplyPropertyDefault<EPosition, &RenderStyle::position, EPosition, &RenderStyle::setPosition, EPosition, &RenderStyle::initialPosition>::createHandler());
-
     setPropertyHandler(CSSPropertyResize, ApplyPropertyResize::createHandler());
+    setPropertyHandler(CSSPropertyRight, ApplyPropertyLength<&RenderStyle::right, &RenderStyle::setRight, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
     setPropertyHandler(CSSPropertySize, ApplyPropertyPageSize::createHandler());
+    setPropertyHandler(CSSPropertySpeak, ApplyPropertyDefault<ESpeak, &RenderStyle::speak, ESpeak, &RenderStyle::setSpeak, ESpeak, &RenderStyle::initialSpeak>::createHandler());
     setPropertyHandler(CSSPropertyTableLayout, ApplyPropertyDefault<ETableLayout, &RenderStyle::tableLayout, ETableLayout, &RenderStyle::setTableLayout, ETableLayout, &RenderStyle::initialTableLayout>::createHandler());
+    setPropertyHandler(CSSPropertyTextAlign, ApplyPropertyTextAlign::createHandler());
+    setPropertyHandler(CSSPropertyTextDecoration, ApplyPropertyTextDecoration::createHandler());
+    setPropertyHandler(CSSPropertyTextIndent, ApplyPropertyLength<&RenderStyle::textIndent, &RenderStyle::setTextIndent, &RenderStyle::initialTextIndent>::createHandler());
+    setPropertyHandler(CSSPropertyTextRendering, ApplyPropertyFont<TextRenderingMode, &FontDescription::textRenderingMode, &FontDescription::setTextRenderingMode, AutoTextRendering>::createHandler());
     setPropertyHandler(CSSPropertyTextTransform, ApplyPropertyDefault<ETextTransform, &RenderStyle::textTransform, ETextTransform, &RenderStyle::setTextTransform, ETextTransform, &RenderStyle::initialTextTransform>::createHandler());
-    setPropertyHandler(CSSPropertyUnicodeBidi, ApplyPropertyDefault<EUnicodeBidi, &RenderStyle::unicodeBidi, EUnicodeBidi, &RenderStyle::setUnicodeBidi, EUnicodeBidi, &RenderStyle::initialUnicodeBidi>::createHandler());
+    setPropertyHandler(CSSPropertyTop, ApplyPropertyLength<&RenderStyle::top, &RenderStyle::setTop, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyUnicodeBidi, ApplyPropertyUnicodeBidi::createHandler());
     setPropertyHandler(CSSPropertyVerticalAlign, ApplyPropertyVerticalAlign::createHandler());
     setPropertyHandler(CSSPropertyVisibility, ApplyPropertyDefault<EVisibility, &RenderStyle::visibility, EVisibility, &RenderStyle::setVisibility, EVisibility, &RenderStyle::initialVisibility>::createHandler());
-    setPropertyHandler(CSSPropertyWhiteSpace, ApplyPropertyDefault<EWhiteSpace, &RenderStyle::whiteSpace, EWhiteSpace, &RenderStyle::setWhiteSpace, EWhiteSpace, &RenderStyle::initialWhiteSpace>::createHandler());
-    setPropertyHandler(CSSPropertyWordBreak, ApplyPropertyDefault<EWordBreak, &RenderStyle::wordBreak, EWordBreak, &RenderStyle::setWordBreak, EWordBreak, &RenderStyle::initialWordBreak>::createHandler());
-    setPropertyHandler(CSSPropertyWordWrap, ApplyPropertyDefault<EWordWrap, &RenderStyle::wordWrap, EWordWrap, &RenderStyle::setWordWrap, EWordWrap, &RenderStyle::initialWordWrap>::createHandler());
-
     setPropertyHandler(CSSPropertyWebkitAnimationDelay, ApplyPropertyAnimation<double, &Animation::delay, &Animation::setDelay, &Animation::isDelaySet, &Animation::clearDelay, &Animation::initialAnimationDelay, &CSSStyleSelector::mapAnimationDelay, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationDirection, ApplyPropertyAnimation<Animation::AnimationDirection, &Animation::direction, &Animation::setDirection, &Animation::isDirectionSet, &Animation::clearDirection, &Animation::initialAnimationDirection, &CSSStyleSelector::mapAnimationDirection, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationDuration, ApplyPropertyAnimation<double, &Animation::duration, &Animation::setDuration, &Animation::isDurationSet, &Animation::clearDuration, &Animation::initialAnimationDuration, &CSSStyleSelector::mapAnimationDuration, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
@@ -1926,7 +1847,17 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitAnimationPlayState, ApplyPropertyAnimation<EAnimPlayState, &Animation::playState, &Animation::setPlayState, &Animation::isPlayStateSet, &Animation::clearPlayState, &Animation::initialAnimationPlayState, &CSSStyleSelector::mapAnimationPlayState, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationTimingFunction, ApplyPropertyAnimation<const PassRefPtr<TimingFunction>, &Animation::timingFunction, &Animation::setTimingFunction, &Animation::isTimingFunctionSet, &Animation::clearTimingFunction, &Animation::initialAnimationTimingFunction, &CSSStyleSelector::mapAnimationTimingFunction, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAppearance, ApplyPropertyDefault<ControlPart, &RenderStyle::appearance, ControlPart, &RenderStyle::setAppearance, ControlPart, &RenderStyle::initialAppearance>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitAspectRatio, ApplyPropertyAspectRatio::createHandler());
     setPropertyHandler(CSSPropertyWebkitBackfaceVisibility, ApplyPropertyDefault<EBackfaceVisibility, &RenderStyle::backfaceVisibility, EBackfaceVisibility, &RenderStyle::setBackfaceVisibility, EBackfaceVisibility, &RenderStyle::initialBackfaceVisibility>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBackgroundClip, CSSPropertyBackgroundClip);
+    setPropertyHandler(CSSPropertyWebkitBackgroundComposite, ApplyPropertyFillLayer<CompositeOperator, CSSPropertyWebkitBackgroundComposite, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isCompositeSet, &FillLayer::composite, &FillLayer::setComposite, &FillLayer::clearComposite, &FillLayer::initialFillComposite, &CSSStyleSelector::mapFillComposite>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBackgroundOrigin, CSSPropertyBackgroundOrigin);
+    setPropertyHandler(CSSPropertyWebkitBackgroundSize, CSSPropertyBackgroundSize);
+    setPropertyHandler(CSSPropertyWebkitBorderFit, ApplyPropertyDefault<EBorderFit, &RenderStyle::borderFit, EBorderFit, &RenderStyle::setBorderFit, EBorderFit, &RenderStyle::initialBorderFit>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBorderHorizontalSpacing, ApplyPropertyComputeLength<short, &RenderStyle::horizontalBorderSpacing, &RenderStyle::setHorizontalBorderSpacing, &RenderStyle::initialHorizontalBorderSpacing>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBorderImage, ApplyPropertyBorderImage<Image, CSSPropertyWebkitBorderImage, &RenderStyle::borderImage, &RenderStyle::setBorderImage>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBorderRadius, CSSPropertyBorderRadius);
+    setPropertyHandler(CSSPropertyWebkitBorderVerticalSpacing, ApplyPropertyComputeLength<short, &RenderStyle::verticalBorderSpacing, &RenderStyle::setVerticalBorderSpacing, &RenderStyle::initialVerticalBorderSpacing>::createHandler());
     setPropertyHandler(CSSPropertyWebkitBoxAlign, ApplyPropertyDefault<EBoxAlignment, &RenderStyle::boxAlign, EBoxAlignment, &RenderStyle::setBoxAlign, EBoxAlignment, &RenderStyle::initialBoxAlign>::createHandler());
     setPropertyHandler(CSSPropertyWebkitBoxDirection, ApplyPropertyDefault<EBoxDirection, &RenderStyle::boxDirection, EBoxDirection, &RenderStyle::setBoxDirection, EBoxDirection, &RenderStyle::initialBoxDirection>::createHandler());
     setPropertyHandler(CSSPropertyWebkitBoxFlex, ApplyPropertyDefault<float, &RenderStyle::boxFlex, float, &RenderStyle::setBoxFlex, float, &RenderStyle::initialBoxFlex>::createHandler());
@@ -1935,36 +1866,85 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitBoxOrdinalGroup, ApplyPropertyDefault<unsigned int, &RenderStyle::boxOrdinalGroup, unsigned int, &RenderStyle::setBoxOrdinalGroup, unsigned int, &RenderStyle::initialBoxOrdinalGroup>::createHandler());
     setPropertyHandler(CSSPropertyWebkitBoxOrient, ApplyPropertyDefault<EBoxOrient, &RenderStyle::boxOrient, EBoxOrient, &RenderStyle::setBoxOrient, EBoxOrient, &RenderStyle::initialBoxOrient>::createHandler());
     setPropertyHandler(CSSPropertyWebkitBoxPack, ApplyPropertyDefault<EBoxPack, &RenderStyle::boxPack, EBoxPack, &RenderStyle::setBoxPack, EBoxPack, &RenderStyle::initialBoxPack>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColorCorrection, ApplyPropertyDefault<ColorSpace, &RenderStyle::colorSpace, ColorSpace, &RenderStyle::setColorSpace, ColorSpace, &RenderStyle::initialColorSpace>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnAxis, ApplyPropertyDefault<ColumnAxis, &RenderStyle::columnAxis, ColumnAxis, &RenderStyle::setColumnAxis, ColumnAxis, &RenderStyle::initialColumnAxis>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnBreakAfter, ApplyPropertyDefault<EPageBreak, &RenderStyle::columnBreakAfter, EPageBreak, &RenderStyle::setColumnBreakAfter, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnBreakBefore, ApplyPropertyDefault<EPageBreak, &RenderStyle::columnBreakBefore, EPageBreak, &RenderStyle::setColumnBreakBefore, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnBreakInside, ApplyPropertyDefault<EPageBreak, &RenderStyle::columnBreakInside, EPageBreak, &RenderStyle::setColumnBreakInside, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnCount, ApplyPropertyAuto<unsigned short, &RenderStyle::columnCount, &RenderStyle::setColumnCount, &RenderStyle::hasAutoColumnCount, &RenderStyle::setHasAutoColumnCount>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnGap, ApplyPropertyAuto<float, &RenderStyle::columnGap, &RenderStyle::setColumnGap, &RenderStyle::hasNormalColumnGap, &RenderStyle::setHasNormalColumnGap, ComputeLength, CSSValueNormal>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnRuleColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::columnRuleColor, &RenderStyle::setColumnRuleColor, &RenderStyle::setVisitedLinkColumnRuleColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnRuleWidth, ApplyPropertyComputeLength<unsigned short, &RenderStyle::columnRuleWidth, &RenderStyle::setColumnRuleWidth, &RenderStyle::initialColumnRuleWidth, NormalDisabled, ThicknessEnabled>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumns, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitColumnWidth, CSSPropertyWebkitColumnCount>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnSpan, ApplyPropertyDefault<ColumnSpan, &RenderStyle::columnSpan, ColumnSpan, &RenderStyle::setColumnSpan, ColumnSpan, &RenderStyle::initialColumnSpan>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnRuleStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::columnRuleStyle, EBorderStyle, &RenderStyle::setColumnRuleStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnWidth, ApplyPropertyAuto<float, &RenderStyle::columnWidth, &RenderStyle::setColumnWidth, &RenderStyle::hasAutoColumnWidth, &RenderStyle::setHasAutoColumnWidth, ComputeLength>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexAlign, ApplyPropertyDefault<EFlexAlign, &RenderStyle::flexAlign, EFlexAlign, &RenderStyle::setFlexAlign, EFlexAlign, &RenderStyle::initialFlexAlign>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexDirection, ApplyPropertyDefault<EFlexDirection, &RenderStyle::flexDirection, EFlexDirection, &RenderStyle::setFlexDirection, EFlexDirection, &RenderStyle::initialFlexDirection>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexFlow, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitFlexDirection, CSSPropertyWebkitFlexWrap>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexItemAlign, ApplyPropertyDefault<EFlexAlign, &RenderStyle::flexItemAlign, EFlexAlign, &RenderStyle::setFlexItemAlign, EFlexAlign, &RenderStyle::initialFlexItemAlign>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexOrder, ApplyPropertyDefault<int, &RenderStyle::flexOrder, int, &RenderStyle::setFlexOrder, int, &RenderStyle::initialFlexOrder>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexPack, ApplyPropertyDefault<EFlexPack, &RenderStyle::flexPack, EFlexPack, &RenderStyle::setFlexPack, EFlexPack, &RenderStyle::initialFlexPack>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexWrap, ApplyPropertyDefault<EFlexWrap, &RenderStyle::flexWrap, EFlexWrap, &RenderStyle::setFlexWrap, EFlexWrap, &RenderStyle::initialFlexWrap>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlowFrom, ApplyPropertyString<MapNoneToNull, &RenderStyle::regionThread, &RenderStyle::setRegionThread, &RenderStyle::initialRegionThread>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlowInto, ApplyPropertyString<MapAutoToNull, &RenderStyle::flowThread, &RenderStyle::setFlowThread, &RenderStyle::initialFlowThread>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlowInto, ApplyPropertyString<MapNoneToNull, &RenderStyle::flowThread, &RenderStyle::setFlowThread, &RenderStyle::initialFlowThread>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFontKerning, ApplyPropertyFont<FontDescription::Kerning, &FontDescription::kerning, &FontDescription::setKerning, FontDescription::AutoKerning>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFontSmoothing, ApplyPropertyFont<FontSmoothingMode, &FontDescription::fontSmoothing, &FontDescription::setFontSmoothing, AutoSmoothing>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFontVariantLigatures, ApplyPropertyFontVariantLigatures::createHandler());
     setPropertyHandler(CSSPropertyWebkitHighlight, ApplyPropertyString<MapNoneToNull, &RenderStyle::highlight, &RenderStyle::setHighlight, &RenderStyle::initialHighlight>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateCharacter, ApplyPropertyString<MapAutoToNull, &RenderStyle::hyphenationString, &RenderStyle::setHyphenationString, &RenderStyle::initialHyphenationString>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitAfter, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitAfter, &RenderStyle::setHyphenationLimitAfter, &RenderStyle::initialHyphenationLimitAfter>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitBefore, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitBefore, &RenderStyle::setHyphenationLimitBefore, &RenderStyle::initialHyphenationLimitBefore>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitLines, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitLines, &RenderStyle::setHyphenationLimitLines, &RenderStyle::initialHyphenationLimitLines, CSSValueNoLimit>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitHyphens, ApplyPropertyDefault<Hyphens, &RenderStyle::hyphens, Hyphens, &RenderStyle::setHyphens, Hyphens, &RenderStyle::initialHyphens>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineAlign, ApplyPropertyDefault<LineAlign, &RenderStyle::lineAlign, LineAlign, &RenderStyle::setLineAlign, LineAlign, &RenderStyle::initialLineAlign>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineBreak, ApplyPropertyDefault<EKHTMLLineBreak, &RenderStyle::khtmlLineBreak, EKHTMLLineBreak, &RenderStyle::setKHTMLLineBreak, EKHTMLLineBreak, &RenderStyle::initialKHTMLLineBreak>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineGrid, ApplyPropertyString<MapNoneToNull, &RenderStyle::lineGrid, &RenderStyle::setLineGrid, &RenderStyle::initialLineGrid>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineSnap, ApplyPropertyDefault<LineSnap, &RenderStyle::lineSnap, LineSnap, &RenderStyle::setLineSnap, LineSnap, &RenderStyle::initialLineSnap>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarginAfterCollapse, ApplyPropertyDefault<EMarginCollapse, &RenderStyle::marginAfterCollapse, EMarginCollapse, &RenderStyle::setMarginAfterCollapse, EMarginCollapse, &RenderStyle::initialMarginAfterCollapse>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarginBeforeCollapse, ApplyPropertyDefault<EMarginCollapse, &RenderStyle::marginBeforeCollapse, EMarginCollapse, &RenderStyle::setMarginBeforeCollapse, EMarginCollapse, &RenderStyle::initialMarginBeforeCollapse>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarginBottomCollapse, CSSPropertyWebkitMarginAfterCollapse);
+    setPropertyHandler(CSSPropertyWebkitMarginCollapse, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitMarginBeforeCollapse, CSSPropertyWebkitMarginAfterCollapse>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarginTopCollapse, CSSPropertyWebkitMarginBeforeCollapse);
     setPropertyHandler(CSSPropertyWebkitMarqueeDirection, ApplyPropertyDefault<EMarqueeDirection, &RenderStyle::marqueeDirection, EMarqueeDirection, &RenderStyle::setMarqueeDirection, EMarqueeDirection, &RenderStyle::initialMarqueeDirection>::createHandler());
     setPropertyHandler(CSSPropertyWebkitMarqueeStyle, ApplyPropertyDefault<EMarqueeBehavior, &RenderStyle::marqueeBehavior, EMarqueeBehavior, &RenderStyle::setMarqueeBehavior, EMarqueeBehavior, &RenderStyle::initialMarqueeBehavior>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskAttachment, ApplyPropertyFillLayer<EFillAttachment, CSSPropertyWebkitMaskAttachment, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isAttachmentSet, &FillLayer::attachment, &FillLayer::setAttachment, &FillLayer::clearAttachment, &FillLayer::initialFillAttachment, &CSSStyleSelector::mapFillAttachment>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImage, ApplyPropertyBorderImage<Mask, CSSPropertyWebkitMaskBoxImage, &RenderStyle::maskBoxImage, &RenderStyle::setMaskBoxImage>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImageOutset, ApplyPropertyBorderImageModifier<Mask, Outset>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImageRepeat, ApplyPropertyBorderImageModifier<Mask, Repeat>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImageSlice, ApplyPropertyBorderImageModifier<Mask, Slice>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImageSource, ApplyPropertyBorderImageSource<CSSPropertyWebkitMaskBoxImageSource, &RenderStyle::maskBoxImageSource, &RenderStyle::setMaskBoxImageSource, &RenderStyle::initialMaskBoxImageSource>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImageWidth, ApplyPropertyBorderImageModifier<Mask, Width>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskClip, ApplyPropertyFillLayer<EFillBox, CSSPropertyWebkitMaskClip, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isClipSet, &FillLayer::clip, &FillLayer::setClip, &FillLayer::clearClip, &FillLayer::initialFillClip, &CSSStyleSelector::mapFillClip>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskComposite, ApplyPropertyFillLayer<CompositeOperator, CSSPropertyWebkitMaskComposite, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isCompositeSet, &FillLayer::composite, &FillLayer::setComposite, &FillLayer::clearComposite, &FillLayer::initialFillComposite, &CSSStyleSelector::mapFillComposite>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskImage, ApplyPropertyFillLayer<StyleImage*, CSSPropertyWebkitMaskImage, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isImageSet, &FillLayer::image, &FillLayer::setImage, &FillLayer::clearImage, &FillLayer::initialFillImage, &CSSStyleSelector::mapFillImage>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskOrigin, ApplyPropertyFillLayer<EFillBox, CSSPropertyWebkitMaskOrigin, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isOriginSet, &FillLayer::origin, &FillLayer::setOrigin, &FillLayer::clearOrigin, &FillLayer::initialFillOrigin, &CSSStyleSelector::mapFillOrigin>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskPosition, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskPositionX, ApplyPropertyFillLayer<Length, CSSPropertyWebkitMaskPositionX, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isXPositionSet, &FillLayer::xPosition, &FillLayer::setXPosition, &FillLayer::clearXPosition, &FillLayer::initialFillXPosition, &CSSStyleSelector::mapFillXPosition>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskPositionY, ApplyPropertyFillLayer<Length, CSSPropertyWebkitMaskPositionY, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isYPositionSet, &FillLayer::yPosition, &FillLayer::setYPosition, &FillLayer::clearYPosition, &FillLayer::initialFillYPosition, &CSSStyleSelector::mapFillYPosition>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskRepeat, ApplyPropertyExpanding<SuppressValue, CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskRepeatX, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyWebkitMaskRepeatX, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isRepeatXSet, &FillLayer::repeatX, &FillLayer::setRepeatX, &FillLayer::clearRepeatX, &FillLayer::initialFillRepeatX, &CSSStyleSelector::mapFillRepeatX>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskRepeatY, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyWebkitMaskRepeatY, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isRepeatYSet, &FillLayer::repeatY, &FillLayer::setRepeatY, &FillLayer::clearRepeatY, &FillLayer::initialFillRepeatY, &CSSStyleSelector::mapFillRepeatY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskSize, ApplyPropertyFillLayer<FillSize, CSSPropertyWebkitMaskSize, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isSizeSet, &FillLayer::size, &FillLayer::setSize, &FillLayer::clearSize, &FillLayer::initialFillSize, &CSSStyleSelector::mapFillSize>::createHandler());
     setPropertyHandler(CSSPropertyWebkitMatchNearestMailBlockquoteColor, ApplyPropertyDefault<EMatchNearestMailBlockquoteColor, &RenderStyle::matchNearestMailBlockquoteColor, EMatchNearestMailBlockquoteColor, &RenderStyle::setMatchNearestMailBlockquoteColor, EMatchNearestMailBlockquoteColor, &RenderStyle::initialMatchNearestMailBlockquoteColor>::createHandler());
     setPropertyHandler(CSSPropertyWebkitNbspMode, ApplyPropertyDefault<ENBSPMode, &RenderStyle::nbspMode, ENBSPMode, &RenderStyle::setNBSPMode, ENBSPMode, &RenderStyle::initialNBSPMode>::createHandler());
     setPropertyHandler(CSSPropertyWebkitPerspectiveOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitPerspectiveOriginX, CSSPropertyWebkitPerspectiveOriginY>::createHandler());
     setPropertyHandler(CSSPropertyWebkitPerspectiveOriginX, ApplyPropertyLength<&RenderStyle::perspectiveOriginX, &RenderStyle::setPerspectiveOriginX, &RenderStyle::initialPerspectiveOriginX>::createHandler());
     setPropertyHandler(CSSPropertyWebkitPerspectiveOriginY, ApplyPropertyLength<&RenderStyle::perspectiveOriginY, &RenderStyle::setPerspectiveOriginY, &RenderStyle::initialPerspectiveOriginY>::createHandler());
     setPropertyHandler(CSSPropertyWebkitPrintColorAdjust, ApplyPropertyDefault<PrintColorAdjust, &RenderStyle::printColorAdjust, PrintColorAdjust, &RenderStyle::setPrintColorAdjust, PrintColorAdjust, &RenderStyle::initialPrintColorAdjust>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitRegionBreakAfter, ApplyPropertyDefault<EPageBreak, &RenderStyle::regionBreakAfter, EPageBreak, &RenderStyle::setRegionBreakAfter, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitRegionBreakBefore, ApplyPropertyDefault<EPageBreak, &RenderStyle::regionBreakBefore, EPageBreak, &RenderStyle::setRegionBreakBefore, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitRegionBreakInside, ApplyPropertyDefault<EPageBreak, &RenderStyle::regionBreakInside, EPageBreak, &RenderStyle::setRegionBreakInside, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
     setPropertyHandler(CSSPropertyWebkitRegionOverflow, ApplyPropertyDefault<RegionOverflow, &RenderStyle::regionOverflow, RegionOverflow, &RenderStyle::setRegionOverflow, RegionOverflow, &RenderStyle::initialRegionOverflow>::createHandler());
     setPropertyHandler(CSSPropertyWebkitRtlOrdering, ApplyPropertyDefault<Order, &RenderStyle::rtlOrdering, Order, &RenderStyle::setRTLOrdering, Order, &RenderStyle::initialRTLOrdering>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextCombine, ApplyPropertyDefault<TextCombine, &RenderStyle::textCombine, TextCombine, &RenderStyle::setTextCombine, TextCombine, &RenderStyle::initialTextCombine>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTextEmphasisColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textEmphasisColor, &RenderStyle::setTextEmphasisColor, &RenderStyle::setVisitedLinkTextEmphasisColor, &RenderStyle::color>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextEmphasisPosition, ApplyPropertyDefault<TextEmphasisPosition, &RenderStyle::textEmphasisPosition, TextEmphasisPosition, &RenderStyle::setTextEmphasisPosition, TextEmphasisPosition, &RenderStyle::initialTextEmphasisPosition>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextEmphasisStyle, ApplyPropertyTextEmphasisStyle::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTextFillColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textFillColor, &RenderStyle::setTextFillColor, &RenderStyle::setVisitedLinkTextFillColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTextOrientation, ApplyPropertyFont<TextOrientation, &FontDescription::textOrientation, &FontDescription::setTextOrientation, TextOrientationVerticalRight>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextSecurity, ApplyPropertyDefault<ETextSecurity, &RenderStyle::textSecurity, ETextSecurity, &RenderStyle::setTextSecurity, ETextSecurity, &RenderStyle::initialTextSecurity>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTextStrokeColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textStrokeColor, &RenderStyle::setTextStrokeColor, &RenderStyle::setVisitedLinkTextStrokeColor, &RenderStyle::color>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTransformOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitTransformOriginX, CSSPropertyWebkitTransformOriginY, CSSPropertyWebkitTransformOriginZ>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTransformOriginX, ApplyPropertyLength<&RenderStyle::transformOriginX, &RenderStyle::setTransformOriginX, &RenderStyle::initialTransformOriginX>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTransformOriginY, ApplyPropertyLength<&RenderStyle::transformOriginY, &RenderStyle::setTransformOriginY, &RenderStyle::initialTransformOriginY>::createHandler());
@@ -1982,10 +1962,12 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitWrapMargin, ApplyPropertyLength<&RenderStyle::wrapMargin, &RenderStyle::setWrapMargin, &RenderStyle::initialWrapMargin>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapPadding, ApplyPropertyLength<&RenderStyle::wrapPadding, &RenderStyle::setWrapPadding, &RenderStyle::initialWrapPadding>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapThrough, ApplyPropertyDefault<WrapThrough, &RenderStyle::wrapThrough, WrapThrough, &RenderStyle::setWrapThrough, WrapThrough, &RenderStyle::initialWrapThrough>::createHandler());
-
+    setPropertyHandler(CSSPropertyWhiteSpace, ApplyPropertyDefault<EWhiteSpace, &RenderStyle::whiteSpace, EWhiteSpace, &RenderStyle::setWhiteSpace, EWhiteSpace, &RenderStyle::initialWhiteSpace>::createHandler());
     setPropertyHandler(CSSPropertyWidows, ApplyPropertyDefault<short, &RenderStyle::widows, short, &RenderStyle::setWidows, short, &RenderStyle::initialWidows>::createHandler());
-    setPropertyHandler(CSSPropertyOrphans, ApplyPropertyDefault<short, &RenderStyle::orphans, short, &RenderStyle::setOrphans, short, &RenderStyle::initialOrphans>::createHandler());
-
+    setPropertyHandler(CSSPropertyWidth, ApplyPropertyLength<&RenderStyle::width, &RenderStyle::setWidth, &RenderStyle::initialSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneDisabled, UndefinedDisabled, FlexWidth>::createHandler());
+    setPropertyHandler(CSSPropertyWordBreak, ApplyPropertyDefault<EWordBreak, &RenderStyle::wordBreak, EWordBreak, &RenderStyle::setWordBreak, EWordBreak, &RenderStyle::initialWordBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWordSpacing, ApplyPropertyComputeLength<int, &RenderStyle::wordSpacing, &RenderStyle::setWordSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyWordWrap, ApplyPropertyDefault<EWordWrap, &RenderStyle::wordWrap, EWordWrap, &RenderStyle::setWordWrap, EWordWrap, &RenderStyle::initialWordWrap>::createHandler());
     setPropertyHandler(CSSPropertyZIndex, ApplyPropertyAuto<int, &RenderStyle::zIndex, &RenderStyle::setZIndex, &RenderStyle::hasAutoZIndex, &RenderStyle::setHasAutoZIndex>::createHandler());
     setPropertyHandler(CSSPropertyZoom, ApplyPropertyZoom::createHandler());
 }
diff --git a/Source/WebCore/css/CSSStyleDeclaration.idl b/Source/WebCore/css/CSSStyleDeclaration.idl
index 8be67e4a6..9846c5458 100644
--- a/Source/WebCore/css/CSSStyleDeclaration.idl
+++ b/Source/WebCore/css/CSSStyleDeclaration.idl
@@ -24,8 +24,11 @@ module css {
     interface [
         JSCustomMarkFunction,
         JSGenerateIsReachable,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomNamedSetter,
+#if defined(V8_BINDING) && V8_BINDING
         NamedGetter,
+#endif
         IndexedGetter,
         CustomEnumerateProperty,
         V8DependentLifetime
diff --git a/Source/WebCore/css/CSSStyleRule.cpp b/Source/WebCore/css/CSSStyleRule.cpp
index 7a1d66fca..65da867c5 100644
--- a/Source/WebCore/css/CSSStyleRule.cpp
+++ b/Source/WebCore/css/CSSStyleRule.cpp
@@ -22,35 +22,34 @@
 #include "config.h"
 #include "CSSStyleRule.h"
 
-#include "CSSPageRule.h"
 #include "CSSParser.h"
 #include "CSSSelector.h"
 #include "CSSStyleSheet.h"
 #include "Document.h"
 #include "StylePropertySet.h"
-#include "StyledElement.h"
-#include "StyleSheet.h"
-
+#include "StyleRule.h"
 #include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
 CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent, int line)
     : CSSRule(parent, CSSRule::STYLE_RULE)
+    , m_styleRule(adoptPtr(new StyleRule(line, this)))
 {
-    setSourceLine(line);
-
-    // m_sourceLine is a bitfield, so let's catch any overflow early in debug mode.
-    ASSERT(sourceLine() == line);
 }
 
 CSSStyleRule::~CSSStyleRule()
 {
-    if (m_style)
-        m_style->clearParentRule(this);
+    if (m_styleRule->properties())
+        m_styleRule->properties()->clearParentRule(this);
     cleanup();
 }
 
+CSSStyleDeclaration* CSSStyleRule::style() const
+{
+    return m_styleRule->properties()->ensureRuleCSSStyleDeclaration(this);
+}
+
 typedef HashMap<const CSSStyleRule*, String> SelectorTextCache;
 static SelectorTextCache& selectorTextCache()
 {
@@ -69,8 +68,8 @@ inline void CSSStyleRule::cleanup()
 String CSSStyleRule::generateSelectorText() const
 {
     StringBuilder builder;
-    for (CSSSelector* s = selectorList().first(); s; s = CSSSelectorList::next(s)) {
-        if (s != selectorList().first())
+    for (CSSSelector* s = m_styleRule->selectorList().first(); s; s = CSSSelectorList::next(s)) {
+        if (s != m_styleRule->selectorList().first())
             builder.append(", ");
         builder.append(s->selectorText());
     }
@@ -106,7 +105,7 @@ void CSSStyleRule::setSelectorText(const String& selectorText)
         return;
 
     String oldSelectorText = this->selectorText();
-    m_selectorList.adopt(selectorList);
+    m_styleRule->adoptSelectorList(selectorList);
 
     if (hasCachedSelectorText()) {
         ASSERT(selectorTextCache().contains(this));
@@ -124,16 +123,10 @@ String CSSStyleRule::cssText() const
     String result = selectorText();
 
     result += " { ";
-    result += m_style->asText();
+    result += m_styleRule->properties()->asText();
     result += "}";
 
     return result;
 }
 
-void CSSStyleRule::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
-{
-    if (m_style)
-        m_style->addSubresourceStyleURLs(urls, parentStyleSheet());
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSStyleRule.h b/Source/WebCore/css/CSSStyleRule.h
index f70b9b231..c71d53ed2 100644
--- a/Source/WebCore/css/CSSStyleRule.h
+++ b/Source/WebCore/css/CSSStyleRule.h
@@ -23,39 +23,31 @@
 #define CSSStyleRule_h
 
 #include "CSSRule.h"
-#include "CSSSelectorList.h"
-#include "StylePropertySet.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
 class CSSSelector;
+class CSSStyleDeclaration;
+class StyleRule;
 
 class CSSStyleRule : public CSSRule {
 public:
-    static PassRefPtr<CSSStyleRule> create(CSSStyleSheet* parent, int sourceLine)
+    static PassRefPtr<CSSStyleRule> create(CSSStyleSheet* parent, int line)
     {
-        return adoptRef(new CSSStyleRule(parent, sourceLine));
+        return adoptRef(new CSSStyleRule(parent, line));
     }
     ~CSSStyleRule();
 
     String selectorText() const;
     void setSelectorText(const String&);
 
-    CSSStyleDeclaration* style() const { return m_style->ensureRuleCSSStyleDeclaration(this); }
+    CSSStyleDeclaration* style() const;
 
     String cssText() const;
-
-    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectors) { m_selectorList.adoptSelectorVector(selectors); }
-    void setDeclaration(PassRefPtr<StylePropertySet> style) { m_style = style; }
-
-    const CSSSelectorList& selectorList() const { return m_selectorList; }
-    StylePropertySet* declaration() const { return m_style.get(); }
-
-    void addSubresourceStyleURLs(ListHashSet<KURL>& urls);
-
-    using CSSRule::sourceLine;
+    
+    StyleRule* styleRule() const { return m_styleRule.get(); }
 
 private:
     CSSStyleRule(CSSStyleSheet* parent, int sourceLine);
@@ -63,8 +55,7 @@ private:
     void cleanup();
     String generateSelectorText() const;
 
-    RefPtr<StylePropertySet> m_style;
-    CSSSelectorList m_selectorList;
+    OwnPtr<StyleRule> m_styleRule;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index b172c4733..e9823d586 100644
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -30,10 +30,12 @@
 
 #include "Attribute.h"
 #include "CachedImage.h"
+#include "CalculationValue.h"
 #include "ContentData.h"
 #include "Counter.h"
 #include "CounterContent.h"
 #include "CSSBorderImage.h"
+#include "CSSCalculationValue.h"
 #include "CSSCursorImageValue.h"
 #include "CSSFontFaceRule.h"
 #include "CSSFontSelector.h"
@@ -92,10 +94,12 @@
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "ShadowData.h"
+#include "ShadowRoot.h"
 #include "ShadowValue.h"
 #include "SkewTransformOperation.h"
 #include "StyleCachedImage.h"
 #include "StylePendingImage.h"
+#include "StyleRule.h"
 #include "StyleGeneratedImage.h"
 #include "StyleSheetList.h"
 #include "Text.h"
@@ -121,6 +125,7 @@
 #endif
 
 #if ENABLE(SVG)
+#include "SVGElement.h"
 #include "SVGNames.h"
 #endif
 
@@ -166,17 +171,12 @@ HANDLE_INHERIT_AND_INITIAL(prop, Prop) \
 if (primitiveValue) \
     m_style->set##Prop(*primitiveValue);
 
-#define HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(prop, Prop, Value) \
-HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(prop, Prop, Value) \
-if (primitiveValue) \
-    m_style->set##Prop(*primitiveValue);
-
 class RuleData {
 public:
-    RuleData(CSSStyleRule*, CSSSelector*, unsigned position, bool canUseFastCheckSelector = true);
+    RuleData(StyleRule*, CSSSelector*, unsigned position, bool canUseFastCheckSelector, bool inRegionRule);
 
     unsigned position() const { return m_position; }
-    CSSStyleRule* rule() const { return m_rule; }
+    StyleRule* rule() const { return m_rule; }
     CSSSelector* selector() const { return m_selector; }
 
     bool hasFastCheckableSelector() const { return m_hasFastCheckableSelector; }
@@ -185,23 +185,25 @@ public:
     bool containsUncommonAttributeSelector() const { return m_containsUncommonAttributeSelector; }
     unsigned specificity() const { return m_specificity; }
     unsigned linkMatchType() const { return m_linkMatchType; }
+    bool isInRegionRule() const { return m_isInRegionRule; }
 
     // Try to balance between memory usage (there can be lots of RuleData objects) and good filtering performance.
     static const unsigned maximumIdentifierCount = 4;
     const unsigned* descendantSelectorIdentifierHashes() const { return m_descendantSelectorIdentifierHashes; }
 
 private:
-    CSSStyleRule* m_rule;
+    StyleRule* m_rule;
     CSSSelector* m_selector;
     unsigned m_specificity;
     // This number was picked fairly arbitrarily. We can probably lower it if we need to.
     // Some simple testing showed <100,000 RuleData's on large sites.
-    unsigned m_position : 26;
+    unsigned m_position : 25;
     unsigned m_hasFastCheckableSelector : 1;
     unsigned m_hasMultipartSelector : 1;
     unsigned m_hasRightmostSelectorMatchingHTMLBasedOnRuleHash : 1;
     unsigned m_containsUncommonAttributeSelector : 1;
     unsigned m_linkMatchType : 2; //  SelectorChecker::LinkMatchMask
+    unsigned m_isInRegionRule : 1;
     // Use plain array instead of a Vector to minimize memory overhead.
     unsigned m_descendantSelectorIdentifierHashes[maximumIdentifierCount];
 };
@@ -223,10 +225,10 @@ public:
 
     typedef HashMap<AtomicStringImpl*, OwnPtr<Vector<RuleData> > > AtomRuleMap;
 
-    void addRulesFromSheet(CSSStyleSheet*, const MediaQueryEvaluator&, CSSStyleSelector* = 0, const Element* = 0);
+    void addRulesFromSheet(CSSStyleSheet*, const MediaQueryEvaluator&, CSSStyleSelector* = 0, const ContainerNode* = 0);
 
-    void addStyleRule(CSSStyleRule*, bool canUseFastCheckSelector = true);
-    void addRule(CSSStyleRule*, CSSSelector*, bool canUseFastCheckSelector = true);
+    void addStyleRule(StyleRule*, bool canUseFastCheckSelector = true, bool isInRegionRule = false);
+    void addRule(StyleRule*, CSSSelector*, bool canUseFastCheckSelector = true, bool isInRegionRule = false);
     void addPageRule(CSSPageRule*);
     void addToRuleSet(AtomicStringImpl* key, AtomRuleMap&, const RuleData&);
     void addRegionRule(WebKitCSSRegionRule*);
@@ -339,7 +341,7 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
     , m_hasPendingShaders(false)
 #endif
 #if ENABLE(STYLE_SCOPED)
-    , m_scopingElementStackParent(0)
+    , m_scopeStackParent(0)
 #endif
 {
     Element* root = document->documentElement();
@@ -443,7 +445,7 @@ void CSSStyleSelector::collectFeatures()
 }
 
 #if ENABLE(STYLE_SCOPED)
-const Element* CSSStyleSelector::determineScopingElement(const CSSStyleSheet* sheet)
+const ContainerNode* CSSStyleSelector::determineScope(const CSSStyleSheet* sheet)
 {
     ASSERT(sheet);
 
@@ -458,14 +460,18 @@ const Element* CSSStyleSelector::determineScopingElement(const CSSStyleSheet* sh
     if (!styleElement->scoped())
         return 0;
 
-    return styleElement->parentElement();
+    ContainerNode* parent = styleElement->parentNode();
+    if (!parent)
+        return 0;
+
+    return (parent->isElementNode() || parent->isShadowRoot()) ? parent : 0;
 }
 
-inline RuleSet* CSSStyleSelector::scopedRuleSetForElement(const Element* element) const
+inline RuleSet* CSSStyleSelector::ruleSetForScope(const ContainerNode* scope) const
 {
-    if (!element->hasScopedHTMLStyleChild())
+    if (!scope->hasScopedHTMLStyleChild())
         return 0;
-    ScopedRuleSetMap::const_iterator it = m_scopedAuthorStyles.find(element);
+    ScopedRuleSetMap::const_iterator it = m_scopedAuthorStyles.find(scope);
     return it != m_scopedAuthorStyles.end() ? it->second.get() : 0; 
 }
 #endif
@@ -480,7 +486,7 @@ void CSSStyleSelector::appendAuthorStylesheets(unsigned firstNew, const Vector<R
             continue;
         CSSStyleSheet* cssSheet = static_cast<CSSStyleSheet*>(stylesheets[i].get());
 #if ENABLE(STYLE_SCOPED)
-        const Element* scope = determineScopingElement(cssSheet);
+        const ContainerNode* scope = determineScope(cssSheet);
         if (scope) {
             pair<ScopedRuleSetMap::iterator, bool> addResult = m_scopedAuthorStyles.add(scope, nullptr);
             if (addResult.second)
@@ -499,68 +505,88 @@ void CSSStyleSelector::appendAuthorStylesheets(unsigned firstNew, const Vector<R
 }
 
 #if ENABLE(STYLE_SCOPED)
-void CSSStyleSelector::setupScopingElementStack(const Element* parent)
+void CSSStyleSelector::setupScopeStack(const ContainerNode* parent)
 {
     // The scoping element stack shouldn't be used if <style scoped> isn't used anywhere.
     ASSERT(!m_scopedAuthorStyles.isEmpty());
 
-    m_scopingElementStack.shrink(0);
-    for (; parent; parent = parent->parentOrHostElement()) {
-        RuleSet* ruleSet = scopedRuleSetForElement(parent);
+    m_scopeStack.shrink(0);
+    for (; parent; parent = parent->parentOrHostNode()) {
+        RuleSet* ruleSet = ruleSetForScope(parent);
         if (ruleSet)
-            m_scopingElementStack.append(ScopeStackFrame(parent, ruleSet));
+            m_scopeStack.append(ScopeStackFrame(parent, ruleSet));
     }
-    m_scopingElementStack.reverse();
-    m_scopingElementStackParent = parent;
+    m_scopeStack.reverse();
+    m_scopeStackParent = parent;
 }
-#endif
 
-void CSSStyleSelector::pushParent(Element* parent)
+void CSSStyleSelector::pushScope(const ContainerNode* scope, const ContainerNode* scopeParent)
 {
-    const Element* parentsParent = parent->parentOrHostElement();
-    // We are not always invoked consistently. For example, script execution can cause us to enter
-    // style recalc in the middle of tree building. We may also be invoked from somewhere within the tree.
-    // Reset the stack in this case, or if we see a new root element.
-    // Otherwise just push the new parent.
-    if (!parentsParent || m_checker.parentStackIsEmpty())
-        m_checker.setupParentStack(parent);
-    else
-        m_checker.pushParent(parent);
-
-#if ENABLE(STYLE_SCOPED)
     // Shortcut: Don't bother with the scoping element stack if <style scoped> isn't used anywhere.
     if (m_scopedAuthorStyles.isEmpty()) {
-        ASSERT(!m_scopingElementStackParent);
-        ASSERT(m_scopingElementStack.isEmpty());
+        ASSERT(!m_scopeStackParent);
+        ASSERT(m_scopeStack.isEmpty());
         return;
     }
     // In some wacky cases during style resolve we may get invoked for random elements.
     // Recreate the whole scoping element stack in such cases.
-    if (!scopingElementStackIsConsistent(parentsParent)) {
-        setupScopingElementStack(parent);
+    if (!scopeStackIsConsistent(scopeParent)) {
+        setupScopeStack(scope);
         return;
     }
     // Otherwise just push the parent onto the stack.
-    RuleSet* ruleSet = scopedRuleSetForElement(parent);
+    RuleSet* ruleSet = ruleSetForScope(scope);
     if (ruleSet)
-        m_scopingElementStack.append(ScopeStackFrame(parent, ruleSet));
-    m_scopingElementStackParent = parent;
+        m_scopeStack.append(ScopeStackFrame(scope, ruleSet));
+    m_scopeStackParent = scope;
+}
+
+void CSSStyleSelector::popScope(const ContainerNode* scope)
+{
+    // Only bother to update the scoping element stack if it is consistent.
+    if (scopeStackIsConsistent(scope)) {
+        m_scopeStack.removeLast();
+        m_scopeStackParent = scope->parentOrHostNode();
+    }
+}
 #endif
+
+void CSSStyleSelector::pushParentElement(Element* parent)
+{
+    const ContainerNode* parentsParent = parent->parentOrHostElement();
+
+    // We are not always invoked consistently. For example, script execution can cause us to enter
+    // style recalc in the middle of tree building. We may also be invoked from somewhere within the tree.
+    // Reset the stack in this case, or if we see a new root element.
+    // Otherwise just push the new parent.
+    if (!parentsParent || m_checker.parentStackIsEmpty())
+        m_checker.setupParentStack(parent);
+    else
+        m_checker.pushParent(parent);
+
+    // Note: We mustn't skip ShadowRoot nodes for the scope stack.
+    pushScope(parent, parent->parentOrHostNode());
 }
 
-void CSSStyleSelector::popParent(Element* parent)
+void CSSStyleSelector::popParentElement(Element* parent)
 {
     // Note that we may get invoked for some random elements in some wacky cases during style resolve.
     // Pause maintaining the stack in this case.
     if (m_checker.parentStackIsConsistent(parent))
         m_checker.popParent();
-#if ENABLE(STYLE_SCOPED)
-    // Only bother to update the scoping element stack if it is consistent.
-    if (scopingElementStackIsConsistent(parent)) {
-        m_scopingElementStack.removeLast();
-        m_scopingElementStackParent = parent->parentOrHostElement();
-    }
-#endif
+    popScope(parent);
+}
+
+void CSSStyleSelector::pushParentShadowRoot(const ShadowRoot* shadowRoot)
+{
+    ASSERT(shadowRoot->host());
+    pushScope(shadowRoot, shadowRoot->host());
+}
+
+void CSSStyleSelector::popParentShadowRoot(const ShadowRoot* shadowRoot)
+{
+    ASSERT(shadowRoot->host());
+    popScope(shadowRoot);
 }
 
 // This is a simplified style setting function for keyframe styles
@@ -750,15 +776,28 @@ static void ensureDefaultStyleSheetsForElement(Element* element)
     ASSERT_UNUSED(loadedMathMLUserAgentSheet, loadedMathMLUserAgentSheet || defaultStyle->features().siblingRules.isEmpty());
 }
 
-void CSSStyleSelector::addMatchedProperties(MatchResult& matchResult, StylePropertySet* properties, CSSStyleRule* rule, unsigned linkMatchType)
+void CSSStyleSelector::addMatchedProperties(MatchResult& matchResult, StylePropertySet* properties, StyleRule* rule, unsigned linkMatchType, bool inRegionRule)
 {
     matchResult.matchedProperties.grow(matchResult.matchedProperties.size() + 1);
     MatchedProperties& newProperties = matchResult.matchedProperties.last();
     newProperties.properties = properties;
     newProperties.linkMatchType = linkMatchType;
+    newProperties.isInRegionRule = inRegionRule;
     matchResult.matchedRules.append(rule);
 }
 
+inline void CSSStyleSelector::addElementStyleProperties(MatchResult& result, StylePropertySet* propertySet, bool isCacheable)
+{
+    if (!propertySet)
+        return;
+    result.ranges.lastAuthorRule = result.matchedProperties.size();
+    if (result.ranges.firstAuthorRule == -1)
+        result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
+    addMatchedProperties(result, propertySet);
+    if (!isCacheable)
+        result.isCacheable = false;
+}
+
 void CSSStyleSelector::collectMatchingRules(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions& options)
 {
     ASSERT(rules);
@@ -815,7 +854,7 @@ void CSSStyleSelector::sortAndTransferMatchedRules(MatchResult& result)
         if (!m_ruleList)
             m_ruleList = CSSRuleList::create();
         for (unsigned i = 0; i < m_matchedRules.size(); ++i)
-            m_ruleList->append(m_matchedRules[i]->rule());
+            m_ruleList->append(m_matchedRules[i]->rule()->ensureCSSStyleRule());
         return;
     }
 
@@ -828,7 +867,7 @@ void CSSStyleSelector::sortAndTransferMatchedRules(MatchResult& result)
         unsigned linkMatchType = m_matchedRules[i]->linkMatchType();
         if (swapVisitedUnvisited && linkMatchType && linkMatchType != SelectorChecker::MatchAll)
             linkMatchType = (linkMatchType == SelectorChecker::MatchVisited) ? SelectorChecker::MatchLink : SelectorChecker::MatchVisited;
-        addMatchedProperties(result, m_matchedRules[i]->rule()->declaration(), m_matchedRules[i]->rule(), linkMatchType);
+        addMatchedProperties(result, m_matchedRules[i]->rule()->properties(), m_matchedRules[i]->rule(), linkMatchType, m_matchedRules[i]->isInRegionRule());
     }
 }
 
@@ -841,17 +880,17 @@ void CSSStyleSelector::matchScopedAuthorRules(MatchResult& result, bool includeE
     MatchOptions options(includeEmptyRules);
 
     // Match scoped author rules by traversing the scoped element stack (rebuild it if it got inconsistent).
-    const Element* parent = m_element->parentOrHostElement();
-    if (!scopingElementStackIsConsistent(parent))
-        setupScopingElementStack(parent);
-    for (size_t i = m_scopingElementStack.size(); i; --i) {
-        const ScopeStackFrame& frame = m_scopingElementStack[i - 1];
-        options.scope = frame.m_element;
+    const ContainerNode* parent = m_element->parentOrHostNode();
+    if (!scopeStackIsConsistent(parent))
+        setupScopeStack(parent);
+    for (size_t i = m_scopeStack.size(); i; --i) {
+        const ScopeStackFrame& frame = m_scopeStack[i - 1];
+        options.scope = frame.m_scope;
         collectMatchingRules(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
         collectMatchingRulesForRegion(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
     }
     // Also include the current element.
-    RuleSet* ruleSet = scopedRuleSetForElement(m_element);
+    RuleSet* ruleSet = ruleSetForScope(m_element);
     if (ruleSet) {
         options.scope = m_element;
         collectMatchingRules(ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
@@ -948,7 +987,7 @@ void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules
         if (canUseFastReject && m_checker.fastRejectSelector<RuleData::maximumIdentifierCount>(ruleData.descendantSelectorIdentifierHashes()))
             continue;
 
-        CSSStyleRule* rule = ruleData.rule();
+        StyleRule* rule = ruleData.rule();
         InspectorInstrumentationCookie cookie = InspectorInstrumentation::willMatchRule(document(), rule);
 #if ENABLE(STYLE_SCOPED)
         if (checkSelector(ruleData, options.scope)) {
@@ -972,12 +1011,13 @@ void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules
                 continue;
             }
             // If the rule has no properties to apply, then ignore it in the non-debug mode.
-            StylePropertySet* decl = rule->declaration();
-            if (!decl || (decl->isEmpty() && !options.includeEmptyRules)) {
+            StylePropertySet* properties = rule->properties();
+            if (!properties || (properties->isEmpty() && !options.includeEmptyRules)) {
                 InspectorInstrumentation::didMatchRule(cookie, false);
                 continue;
             }
-            if (m_sameOriginOnly && !m_checker.document()->securityOrigin()->canRequest(rule->baseURL())) {
+            // FIXME: Exposing getMatchedCSSRules as a web facing API is forcing us to have a way to get the base URL per-rule.
+            if (m_sameOriginOnly && !m_checker.document()->securityOrigin()->canRequest(rule->ensureCSSStyleRule()->baseURL())) {
                 InspectorInstrumentation::didMatchRule(cookie, false);
                 continue;
             }
@@ -1028,23 +1068,12 @@ void CSSStyleSelector::matchAllRules(MatchResult& result)
         
     // Now check author rules, beginning first with presentational attributes mapped from HTML.
     if (m_styledElement) {
-        if (StylePropertySet* attributeStyle = m_styledElement->attributeStyle()) {
-            result.ranges.lastAuthorRule = m_matchedRules.size();
-            if (result.ranges.firstAuthorRule == -1)
-                result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
-            addMatchedProperties(result, attributeStyle);
-        }
+        addElementStyleProperties(result, m_styledElement->attributeStyle());
 
         // Now we check additional mapped declarations.
         // Tables and table cells share an additional mapped rule that must be applied
         // after all attributes, since their mapped style depends on the values of multiple attributes.
-        if (StylePropertySet* additionalStyle = m_styledElement->additionalAttributeStyle()) {
-            if (result.ranges.firstAuthorRule == -1)
-                result.ranges.firstAuthorRule = result.matchedProperties.size();
-            result.ranges.lastAuthorRule = result.ranges.firstAuthorRule;
-            addMatchedProperties(result, additionalStyle);
-            result.isCacheable = false;
-        }
+        addElementStyleProperties(result, m_styledElement->additionalAttributeStyle());
 
         if (m_styledElement->isHTMLElement()) {
             bool isAuto;
@@ -1059,16 +1088,19 @@ void CSSStyleSelector::matchAllRules(MatchResult& result)
         matchAuthorRules(result, false);
 
     // Now check our inline style attribute.
-    if (m_matchAuthorAndUserStyles && m_styledElement) {
-        StylePropertySet* inlineDecl = m_styledElement->inlineStyleDecl();
-        if (inlineDecl) {
-            result.ranges.lastAuthorRule = result.matchedProperties.size();
-            if (result.ranges.firstAuthorRule == -1)
-                result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
-            addMatchedProperties(result, inlineDecl);
-            result.isCacheable = false;
-        }
+    if (m_matchAuthorAndUserStyles && m_styledElement && m_styledElement->inlineStyle()) {
+        // Inline style is immutable as long as there is no CSSOM wrapper.
+        // FIXME: Media control shadow trees seem to have problems with caching.
+        bool isInlineStyleCacheable = !m_styledElement->inlineStyle()->hasCSSOMWrapper() && !m_styledElement->isInShadowTree();
+        // FIXME: Constify.
+        addElementStyleProperties(result, const_cast<StylePropertySet*>(m_styledElement->inlineStyle()), isInlineStyleCacheable);
     }
+
+#if ENABLE(SVG)
+    // Now check SMIL animation override style.
+    if (m_matchAuthorAndUserStyles && m_styledElement && m_styledElement->isSVGElement())
+        addElementStyleProperties(result, static_cast<SVGElement*>(m_styledElement)->animatedSMILStyleProperties(), false /* isCacheable */);
+#endif
 }
 
 inline void CSSStyleSelector::initElement(Element* e)
@@ -1122,8 +1154,12 @@ Node* CSSStyleSelector::locateCousinList(Element* parent, unsigned& visitedNodeC
         return 0;
 #endif
     StyledElement* p = static_cast<StyledElement*>(parent);
-    if (p->inlineStyleDecl())
+    if (p->inlineStyle())
         return 0;
+#if ENABLE(SVG)
+    if (p->isSVGElement() && static_cast<SVGElement*>(p)->animatedSMILStyleProperties())
+        return 0;
+#endif
     if (p->hasID() && m_features.idsInRules.contains(p->idForStyleResolution().impl()))
         return 0;
 
@@ -1222,13 +1258,6 @@ bool CSSStyleSelector::canShareStyleWithControl(StyledElement* element) const
             return false;
     }
 
-    if (element->fastGetAttribute(typeAttr) != m_element->fastGetAttribute(typeAttr))
-        return false;
-
-    if (element->fastGetAttribute(readonlyAttr) != m_element->fastGetAttribute(readonlyAttr))
-        return false;
-
-
     return true;
 }
 
@@ -1270,10 +1299,18 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
         return false;
     if (element->hasClass() != m_element->hasClass())
         return false;
-    if (element->inlineStyleDecl())
+    if (element->inlineStyle())
         return false;
+#if ENABLE(SVG)
+    if (element->isSVGElement() && static_cast<SVGElement*>(element)->animatedSMILStyleProperties())
+        return false;
+#endif
     if (!!element->attributeStyle() != !!m_styledElement->attributeStyle())
         return false;
+    StylePropertySet* additionalAttributeStyleA = element->additionalAttributeStyle();
+    StylePropertySet* additionalAttributeStyleB = m_styledElement->additionalAttributeStyle();
+    if (!additionalAttributeStyleA != !additionalAttributeStyleB)
+        return false;
     if (element->isLink() != m_element->isLink())
         return false;
     if (style->affectedByUncommonAttributeSelectors())
@@ -1284,19 +1321,40 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
         return false;
     if (element->focused() != m_element->focused())
         return false;
+    if (element->shadowPseudoId() != m_element->shadowPseudoId())
+        return false;
     if (element == element->document()->cssTarget())
         return false;
     if (m_element == m_element->document()->cssTarget())
         return false;
-    if (style->transitions() || style->animations())
+    if (element->getAttribute(typeAttr) != m_element->getAttribute(typeAttr))
         return false;
-    if (element->isLink() && m_elementLinkState != style->insideLink())
+    if (element->fastGetAttribute(XMLNames::langAttr) != m_element->fastGetAttribute(XMLNames::langAttr))
         return false;
-    if (element->shadowPseudoId() != m_element->shadowPseudoId())
+    if (element->fastGetAttribute(langAttr) != m_element->fastGetAttribute(langAttr))
+        return false;
+    if (element->fastGetAttribute(readonlyAttr) != m_element->fastGetAttribute(readonlyAttr))
+        return false;
+    if (element->fastGetAttribute(cellpaddingAttr) != m_element->fastGetAttribute(cellpaddingAttr))
         return false;
+
     if (element->hasID() && m_features.idsInRules.contains(element->idForStyleResolution().impl()))
         return false;
-    if (m_element->isFormControlElement() && !canShareStyleWithControl(element))
+
+#if ENABLE(STYLE_SCOPED)
+    if (element->hasScopedHTMLStyleChild())
+        return false;
+#endif
+
+    bool isControl = element->isFormControlElement();
+
+    if (isControl != m_element->isFormControlElement())
+        return false;
+
+    if (isControl && !canShareStyleWithControl(element))
+        return false;
+
+    if (style->transitions() || style->animations())
         return false;
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -1317,26 +1375,14 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
     if (element->hasClass() && m_element->getAttribute(classAttr) != element->getAttribute(classAttr))
         return false;
 
-    StylePropertySet* additionalAttributeStyleA = element->additionalAttributeStyle();
-    StylePropertySet* additionalAttributeStyleB = m_styledElement->additionalAttributeStyle();
-    if (!additionalAttributeStyleA != !additionalAttributeStyleB)
-        return false;
-
-    if (element->fastGetAttribute(XMLNames::langAttr) != m_element->fastGetAttribute(XMLNames::langAttr))
-        return false;
-    if (element->fastGetAttribute(langAttr) != m_element->fastGetAttribute(langAttr))
-        return false;
-
     if (element->attributeStyle() && !attributeStylesEqual(element->attributeStyle(), m_styledElement->attributeStyle()))
         return false;
 
     if (additionalAttributeStyleA && !attributeStylesEqual(additionalAttributeStyleA, additionalAttributeStyleB))
         return false;
 
-#if ENABLE(STYLE_SCOPED)
-    if (element->hasScopedHTMLStyleChild())
+    if (element->isLink() && m_elementLinkState != style->insideLink())
         return false;
-#endif
 
     return true;
 }
@@ -1367,8 +1413,12 @@ RenderStyle* CSSStyleSelector::locateSharedStyle()
     if (!m_styledElement || !m_parentStyle)
         return 0;
     // If the element has inline style it is probably unique.
-    if (m_styledElement->inlineStyleDecl())
+    if (m_styledElement->inlineStyle())
+        return 0;
+#if ENABLE(SVG)
+    if (m_styledElement->isSVGElement() && static_cast<SVGElement*>(m_styledElement)->animatedSMILStyleProperties())
         return 0;
+#endif
     // Ids stop style sharing if they show up in the stylesheets.
     if (m_styledElement->hasID() && m_features.idsInRules.contains(m_styledElement->idForStyleResolution().impl()))
         return 0;
@@ -1437,7 +1487,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForDocument(Document* document, C
     RefPtr<RenderStyle> documentStyle = RenderStyle::create();
     documentStyle->setDisplay(BLOCK);
     documentStyle->setRTLOrdering(document->visuallyOrdered() ? VisualOrder : LogicalOrder);
-    documentStyle->setZoom(frame ? frame->pageZoomFactor() : 1);
+    documentStyle->setZoom(frame && !document->printing() ? frame->pageZoomFactor() : 1);
     documentStyle->setPageScaleTransform(frame ? frame->frameScaleFactor() : 1);
     documentStyle->setUserModify(document->inDesignMode() ? READ_WRITE : READ_ONLY);
     documentStyle->setLocale(document->contentLanguage());
@@ -2103,13 +2153,12 @@ PassRefPtr<CSSRuleList> CSSStyleSelector::pseudoStyleRulesForElement(Element* e,
     return m_ruleList.release();
 }
 
-inline bool CSSStyleSelector::checkSelector(const RuleData& ruleData, const Element* scope)
+inline bool CSSStyleSelector::checkSelector(const RuleData& ruleData, const ContainerNode* scope)
 {
     m_dynamicPseudo = NOPSEUDO;
     m_checker.clearHasUnknownPseudoElements();
 
-    // Let the slow path handle SVG as it has some additional rules regarding shadow trees.
-    if (ruleData.hasFastCheckableSelector() && !m_element->isSVGElement()) {
+    if (ruleData.hasFastCheckableSelector()) {
         // We know this selector does not include any pseudo elements.
         if (m_checker.pseudoStyle() != NOPSEUDO)
             return false;
@@ -2161,7 +2210,7 @@ bool CSSStyleSelector::determineStylesheetSelectorScopes(CSSStyleSheet* styleshe
     for (size_t i = 0; i < size; i++) {
         CSSRule* rule = stylesheet->item(i);
         if (rule->isStyleRule()) {
-            CSSStyleRule* styleRule = static_cast<CSSStyleRule*>(rule);
+            StyleRule* styleRule = static_cast<CSSStyleRule*>(rule)->styleRule();
             if (!SelectorChecker::determineSelectorScopes(styleRule->selectorList(), idScopes, classScopes))
                 return false;
             continue;
@@ -2210,7 +2259,7 @@ static inline bool selectorListContainsUncommonAttributeSelector(const CSSSelect
 
 static inline bool isCommonAttributeSelectorAttribute(const QualifiedName& attribute)
 {
-    // These are explicitly tested for equality in canShareStyleWithControl.
+    // These are explicitly tested for equality in canShareStyleWithElement.
     return attribute == typeAttr || attribute == readonlyAttr;
 }
 
@@ -2236,7 +2285,7 @@ static inline bool containsUncommonAttributeSelector(const CSSSelector* selector
     return false;
 }
 
-RuleData::RuleData(CSSStyleRule* rule, CSSSelector* selector, unsigned position, bool canUseFastCheckSelector)
+RuleData::RuleData(StyleRule* rule, CSSSelector* selector, unsigned position, bool canUseFastCheckSelector, bool inRegionRule)
     : m_rule(rule)
     , m_selector(selector)
     , m_specificity(selector->specificity())
@@ -2246,6 +2295,7 @@ RuleData::RuleData(CSSStyleRule* rule, CSSSelector* selector, unsigned position,
     , m_hasRightmostSelectorMatchingHTMLBasedOnRuleHash(isSelectorMatchingHTMLBasedOnRuleHash(selector))
     , m_containsUncommonAttributeSelector(WebCore::containsUncommonAttributeSelector(selector))
     , m_linkMatchType(SelectorChecker::determineLinkMatchType(selector))
+    , m_isInRegionRule(inRegionRule)
 {
     SelectorChecker::collectIdentifierHashes(m_selector, m_descendantSelectorIdentifierHashes, maximumIdentifierCount);
 }
@@ -2310,9 +2360,9 @@ void RuleSet::addToRuleSet(AtomicStringImpl* key, AtomRuleMap& map, const RuleDa
     rules->append(ruleData);
 }
 
-void RuleSet::addRule(CSSStyleRule* rule, CSSSelector* selector, bool canUseFastCheckSelector)
+void RuleSet::addRule(StyleRule* rule, CSSSelector* selector, bool canUseFastCheckSelector, bool inRegionRule)
 {
-    RuleData ruleData(rule, selector, m_ruleCount++, canUseFastCheckSelector);
+    RuleData ruleData(rule, selector, m_ruleCount++, canUseFastCheckSelector, inRegionRule);
     collectFeaturesFromRuleData(m_features, ruleData);
 
     if (selector->m_match == CSSSelector::Id) {
@@ -2369,13 +2419,13 @@ void RuleSet::addRegionRule(WebKitCSSRegionRule* rule)
     for (unsigned i = 0; i < rulesSize; ++i) {
         CSSRule* regionStylingRule = regionStylingRules->item(i);
         if (regionStylingRule->isStyleRule())
-            regionRuleSet->addStyleRule(static_cast<CSSStyleRule*>(regionStylingRule));
+            regionRuleSet->addStyleRule(static_cast<CSSStyleRule*>(regionStylingRule)->styleRule(), true, true);
     }
 
     m_regionSelectorsAndRuleSets.append(RuleSetSelectorPair(rule->selectorList().first(), regionRuleSet));
 }
 
-void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator& medium, CSSStyleSelector* styleSelector, const Element* scope)
+void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator& medium, CSSStyleSelector* styleSelector, const ContainerNode* scope)
 {
     ASSERT(sheet);
 
@@ -2389,7 +2439,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
     for (int i = 0; i < len; i++) {
         CSSRule* rule = sheet->item(i);
         if (rule->isStyleRule())
-            addStyleRule(static_cast<CSSStyleRule*>(rule), !scope);
+            addStyleRule(static_cast<CSSStyleRule*>(rule)->styleRule(), !scope);
         else if (rule->isPageRule())
             addPageRule(static_cast<CSSPageRule*>(rule));
         else if (rule->isImportRule()) {
@@ -2406,7 +2456,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
                 for (unsigned j = 0; j < rules->length(); j++) {
                     CSSRule *childItem = rules->item(j);
                     if (childItem->isStyleRule())
-                        addStyleRule(static_cast<CSSStyleRule*>(childItem), !scope);
+                        addStyleRule(static_cast<CSSStyleRule*>(childItem)->styleRule(), !scope);
                     else if (childItem->isPageRule())
                         addPageRule(static_cast<CSSPageRule*>(childItem));
                     else if (childItem->isFontFaceRule() && styleSelector) {
@@ -2450,10 +2500,10 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
         shrinkToFit();
 }
 
-void RuleSet::addStyleRule(CSSStyleRule* rule, bool canUseFastCheckSelector)
+void RuleSet::addStyleRule(StyleRule* rule, bool canUseFastCheckSelector, bool isInRegionRule)
 {
     for (CSSSelector* s = rule->selectorList().first(); s; s = CSSSelectorList::next(s))
-        addRule(rule, s, canUseFastCheckSelector);
+        addRule(rule, s, canUseFastCheckSelector, isInRegionRule);
 }
 
 static inline void shrinkMapVectorsToFit(RuleSet::AtomRuleMap& map)
@@ -2478,19 +2528,17 @@ void RuleSet::shrinkToFit()
 // -------------------------------------------------------------------------------------
 // this is mostly boring stuff on how to apply a certain rule to the renderstyle...
 
-static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, bool toFloat, double multiplier = 1, bool *ok = 0)
+static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, bool toFloat, double multiplier = 1)
 {
     // This function is tolerant of a null style value. The only place style is used is in
     // length measurements, like 'ems' and 'px'. And in those cases style is only used
     // when the units are EMS or EXS. So we will just fail in those cases.
     Length l;
     if (!primitiveValue) {
-        if (ok)
-            *ok = false;
+        l = Length(Undefined);
     } else {
         if (!style && primitiveValue->isFontRelativeLength()) {
-            if (ok)
-                *ok = false;
+            l = Length(Undefined);
         } else if (primitiveValue->isLength()) {
             if (toFloat)
                 l = Length(primitiveValue->computeLength<double>(style, rootStyle, multiplier), Fixed);
@@ -2500,38 +2548,27 @@ static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* st
             l = Length(primitiveValue->getDoubleValue(), Percent);
         else if (primitiveValue->isNumber())
             l = Length(primitiveValue->getDoubleValue() * 100.0, Percent);
-        else if (ok)
-            *ok = false;
+        else
+            l = Length(Undefined);
     }
     return l;
 }
 
-static Length convertToIntLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier = 1, bool *ok = 0)
-{
-    return convertToLength(primitiveValue, style, rootStyle, false, multiplier, ok);
-}
-
-static Length convertToFloatLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier = 1, bool *ok = 0)
+Length CSSStyleSelector::convertToIntLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier)
 {
-    return convertToLength(primitiveValue, style, rootStyle, true, multiplier, ok);
+    return convertToLength(primitiveValue, style, rootStyle, false, multiplier);
 }
 
-static inline bool isInsideRegionRule(CSSRule* rule)
+Length CSSStyleSelector::convertToFloatLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier)
 {
-    // FIXME: Cache this bit somewhere.
-    while (rule) {
-        if (rule->isRegionRule())
-            return true;
-        rule = rule->parentRule();
-    }
-    return false;
+    return convertToLength(primitiveValue, style, rootStyle, true, multiplier);
 }
 
 template <bool applyFirst>
-void CSSStyleSelector::applyProperties(const StylePropertySet* properties, CSSStyleRule* rule, bool isImportant, bool inheritedOnly)
+void CSSStyleSelector::applyProperties(const StylePropertySet* properties, StyleRule* rule, bool isImportant, bool inheritedOnly, bool filterRegionProperties)
 {
+    ASSERT(!filterRegionProperties || m_regionForStyling);
     InspectorInstrumentationCookie cookie = InspectorInstrumentation::willProcessRule(document(), rule);
-    bool styleDeclarationInsideRegionRule = m_regionForStyling && isInsideRegionRule(rule);
 
     unsigned propertyCount = properties->propertyCount();
     for (unsigned i = 0; i < propertyCount; ++i) {
@@ -2547,8 +2584,7 @@ void CSSStyleSelector::applyProperties(const StylePropertySet* properties, CSSSt
         }
         int property = current.id();
 
-        // Filter the properties that can be applied using region styling.
-        if (styleDeclarationInsideRegionRule && !CSSStyleSelector::isValidRegionStyleProperty(property))
+        if (filterRegionProperties && !CSSStyleSelector::isValidRegionStyleProperty(property))
             continue;
 
         if (applyFirst) {
@@ -2580,19 +2616,22 @@ void CSSStyleSelector::applyMatchedProperties(const MatchResult& matchResult, bo
 
     if (m_style->insideLink() != NotInsideLink) {
         for (int i = startIndex; i <= endIndex; ++i) {
-            unsigned linkMatchType = matchResult.matchedProperties[i].linkMatchType;
+            const MatchedProperties& matchedProperties = matchResult.matchedProperties[i];
+            unsigned linkMatchType = matchedProperties.linkMatchType;
             // FIXME: It would be nicer to pass these as arguments but that requires changes in many places.
             m_applyPropertyToRegularStyle = linkMatchType & SelectorChecker::MatchLink;
             m_applyPropertyToVisitedLinkStyle = linkMatchType & SelectorChecker::MatchVisited;
 
-            applyProperties<applyFirst>(matchResult.matchedProperties[i].properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly);
+            applyProperties<applyFirst>(matchedProperties.properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly, matchedProperties.isInRegionRule);
         }
         m_applyPropertyToRegularStyle = true;
         m_applyPropertyToVisitedLinkStyle = false;
         return;
     }
-    for (int i = startIndex; i <= endIndex; ++i)
-        applyProperties<applyFirst>(matchResult.matchedProperties[i].properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly);
+    for (int i = startIndex; i <= endIndex; ++i) {
+        const MatchedProperties& matchedProperties = matchResult.matchedProperties[i];
+        applyProperties<applyFirst>(matchedProperties.properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly, matchedProperties.isInRegionRule);
+    }
 }
 
 unsigned CSSStyleSelector::computeMatchedPropertiesHash(const MatchedProperties* properties, unsigned size)
@@ -2671,8 +2710,11 @@ void CSSStyleSelector::invalidateMatchedPropertiesCache()
     m_matchedPropertiesCache.clear();
 }
 
-static bool isCacheableInMatchedPropertiesCache(const RenderStyle* style, const RenderStyle* parentStyle)
+static bool isCacheableInMatchedPropertiesCache(const Element* element, const RenderStyle* style, const RenderStyle* parentStyle)
 {
+    // FIXME: CSSPropertyWebkitWritingMode modifies state when applying to document element. We can't skip the applying by caching.
+    if (element == element->document()->documentElement() && element->document()->writingModeSetOnDocumentElement())
+        return false;
     if (style->unique() || (style->styleType() != NOPSEUDO && parentStyle->unique()))
         return false;
     if (style->hasAppearance())
@@ -2754,7 +2796,7 @@ void CSSStyleSelector::applyMatchedProperties(const MatchResult& matchResult)
     
     if (cacheItem || !cacheHash)
         return;
-    if (!isCacheableInMatchedPropertiesCache(m_style.get(), m_parentStyle))
+    if (!isCacheableInMatchedPropertiesCache(m_element, m_style.get(), m_parentStyle))
         return;
     addToMatchedPropertiesCache(m_style.get(), m_parentStyle, cacheHash, matchResult);
 }
@@ -2952,6 +2994,22 @@ static bool createGridTrackList(CSSValue* value, Vector<Length>& lengths, CSSSty
 
     return false;
 }
+
+
+static bool createGridPosition(CSSValue* value, Length& position)
+{
+    // For now, we only accept: <integer> | 'auto'
+    if (!value->isPrimitiveValue())
+        return false;
+
+    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    if (primitiveValue->getIdent() == CSSValueAuto)
+        return true;
+
+    ASSERT(primitiveValue->isNumber());
+    position.setValue(primitiveValue->getIntValue());
+    return true;
+}
 #endif
 
 void CSSStyleSelector::applyProperty(int id, CSSValue *value)
@@ -3292,9 +3350,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
 
     // CSS3 Properties
-    case CSSPropertyImageRendering:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(imageRendering, ImageRendering);
-        return;
     case CSSPropertyTextShadow:
     case CSSPropertyBoxShadow:
     case CSSPropertyWebkitBoxShadow: {
@@ -3368,21 +3423,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     case CSSPropertyUnicodeRange: // Only used in @font-face rules.
         return;
-    case CSSPropertyBoxSizing:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxSizing, BoxSizing);
-        return;
-    case CSSPropertyWebkitColumnRuleStyle:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnRuleStyle, ColumnRuleStyle, BorderStyle)
-        return;
-    case CSSPropertyWebkitColumnBreakBefore:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakBefore, ColumnBreakBefore, PageBreak)
-        return;
-    case CSSPropertyWebkitColumnBreakAfter:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakAfter, ColumnBreakAfter, PageBreak)
-        return;
-    case CSSPropertyWebkitColumnBreakInside:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakInside, ColumnBreakInside, PageBreak)
-        return;
     case CSSPropertyWebkitColumnRule:
         if (isInherit) {
             m_style->setColumnRuleColor(m_parentStyle->columnRuleColor().isValid() ? m_parentStyle->columnRuleColor() : m_parentStyle->color());
@@ -3392,15 +3432,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         else if (isInitial)
             m_style->resetColumnRule();
         return;
-    case CSSPropertyWebkitRegionBreakBefore:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(regionBreakBefore, RegionBreakBefore, PageBreak)
-        return;
-    case CSSPropertyWebkitRegionBreakAfter:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(regionBreakAfter, RegionBreakAfter, PageBreak)
-        return;
-    case CSSPropertyWebkitRegionBreakInside:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(regionBreakInside, RegionBreakInside, PageBreak)
-        return;
     case CSSPropertyWebkitMarquee:
         if (!m_parentNode || !value->isInheritedValue())
             return;
@@ -3459,9 +3490,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                     break;
             }
         } else {
-            bool ok = true;
-            Length marqueeLength = convertToIntLength(primitiveValue, style(), m_rootElementStyle, 1, &ok);
-            if (ok)
+            Length marqueeLength = convertToIntLength(primitiveValue, style(), m_rootElementStyle, 1);
+            if (!marqueeLength.isUndefined())
                 m_style->setMarqueeIncrement(marqueeLength);
         }
         return;
@@ -3482,9 +3512,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             m_style->setLineClamp(LineClampValue(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_PERCENTAGE), LineClampPercentage));
         return;
     }
-    case CSSPropertyWebkitHyphens:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(hyphens, Hyphens);
-        return;
     case CSSPropertyWebkitLocale: {
         HANDLE_INHERIT_AND_INITIAL(locale, Locale);
         if (primitiveValue->getIdent() == CSSValueAuto)
@@ -3496,9 +3523,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         setFontDescription(fontDescription);
         return;
     }
-    case CSSPropertyWebkitBorderFit:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(borderFit, BorderFit);
-        return;
     case CSSPropertyWebkitTextSizeAdjust: {
         HANDLE_INHERIT_AND_INITIAL(textSizeAdjust, TextSizeAdjust)
         if (!primitiveValue || !primitiveValue->getIdent())
@@ -3527,6 +3551,16 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             Length right = convertToIntLength(region->right(), style(), m_rootElementStyle);
             Length bottom = convertToIntLength(region->bottom(), style(), m_rootElementStyle);
             Length left = convertToIntLength(region->left(), style(), m_rootElementStyle);
+
+            if (top.isUndefined())
+                top = Length();
+            if (right.isUndefined())
+                right = Length();
+            if (bottom.isUndefined())
+                bottom = Length();
+            if (left.isUndefined())
+                left = Length();
+
             if (region->m_isCircle)
                 m_style->setDashboardRegion(StyleDashboardRegion::Circle, region->m_label, top, right, bottom, left, region == first ? false : true);
             else if (region->m_isRectangle)
@@ -3632,12 +3666,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 #endif
-    case CSSPropertyWebkitColorCorrection:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(colorSpace, ColorSpace);
-        return;
-    case CSSPropertySpeak:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(speak, Speak);
-        return;
     case CSSPropertyInvalid:
         return;
     // Directional properties are resolved by resolveDirectionAwareProperty() before the switch.
@@ -3707,6 +3735,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     // CSS Text Layout Module Level 3: Vertical writing support
     case CSSPropertyWebkitWritingMode: {
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(writingMode, WritingMode)
+        // FIXME: It is not ok to modify document state while applying style.
         if (!isInherit && !isInitial && m_element && m_element == m_element->document()->documentElement())
             m_element->document()->setWritingModeSetOnDocumentElement(true);
         FontDescription fontDescription = m_style->fontDescription();
@@ -3730,10 +3759,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 
-    case CSSPropertyWebkitColumnAxis:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(columnAxis, ColumnAxis);
-        return;
-
     case CSSPropertyWebkitWrapShapeInside:
         HANDLE_INHERIT_AND_INITIAL(wrapShapeInside, WrapShapeInside);
         if (!primitiveValue)
@@ -3804,6 +3829,21 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setGridRows(lengths);
         return;
     }
+
+    case CSSPropertyWebkitGridColumn: {
+        Length column;
+        if (!createGridPosition(value, column))
+            return;
+        m_style->setGridItemColumn(column);
+        return;
+    }
+    case CSSPropertyWebkitGridRow: {
+        Length row;
+        if (!createGridPosition(value, row))
+            return;
+        m_style->setGridItemRow(row);
+        return;
+    }
 #endif
 
     // These properties are implemented in the CSSStyleApplyProperty lookup table.
@@ -3853,6 +3893,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyBorderTopWidth:
     case CSSPropertyBorderWidth:
     case CSSPropertyBottom:
+    case CSSPropertyBoxSizing:
     case CSSPropertyCaptionSide:
     case CSSPropertyClear:
     case CSSPropertyClip:
@@ -3869,6 +3910,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyFontVariant:
     case CSSPropertyFontWeight:
     case CSSPropertyHeight:
+    case CSSPropertyImageRendering:
     case CSSPropertyLeft:
     case CSSPropertyLetterSpacing:
     case CSSPropertyLineHeight:
@@ -3906,6 +3948,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyResize:
     case CSSPropertyRight:
     case CSSPropertySize:
+    case CSSPropertySpeak:
     case CSSPropertyTableLayout:
     case CSSPropertyTextAlign:
     case CSSPropertyTextDecoration:
@@ -3931,6 +3974,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitBackgroundComposite:
     case CSSPropertyWebkitBackgroundOrigin:
     case CSSPropertyWebkitBackgroundSize:
+    case CSSPropertyWebkitBorderFit:
     case CSSPropertyWebkitBorderHorizontalSpacing:
     case CSSPropertyWebkitBorderImage:
     case CSSPropertyWebkitBorderRadius:
@@ -3943,9 +3987,15 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitBoxOrdinalGroup:
     case CSSPropertyWebkitBoxOrient:
     case CSSPropertyWebkitBoxPack:
+    case CSSPropertyWebkitColorCorrection:
+    case CSSPropertyWebkitColumnAxis:
+    case CSSPropertyWebkitColumnBreakAfter:
+    case CSSPropertyWebkitColumnBreakBefore:
+    case CSSPropertyWebkitColumnBreakInside:
     case CSSPropertyWebkitColumnCount:
     case CSSPropertyWebkitColumnGap:
     case CSSPropertyWebkitColumnRuleColor:
+    case CSSPropertyWebkitColumnRuleStyle:
     case CSSPropertyWebkitColumnRuleWidth:
     case CSSPropertyWebkitColumns:
     case CSSPropertyWebkitColumnSpan:
@@ -3967,6 +4017,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitHyphenateLimitAfter:
     case CSSPropertyWebkitHyphenateLimitBefore:
     case CSSPropertyWebkitHyphenateLimitLines:
+    case CSSPropertyWebkitHyphens:
     case CSSPropertyWebkitLineAlign:
     case CSSPropertyWebkitLineBreak:
     case CSSPropertyWebkitLineGrid:
@@ -3997,6 +4048,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitPerspectiveOriginX:
     case CSSPropertyWebkitPerspectiveOriginY:
     case CSSPropertyWebkitPrintColorAdjust:
+    case CSSPropertyWebkitRegionBreakAfter:
+    case CSSPropertyWebkitRegionBreakBefore:
+    case CSSPropertyWebkitRegionBreakInside:
     case CSSPropertyWebkitRegionOverflow:
     case CSSPropertyWebkitRtlOrdering:
     case CSSPropertyWebkitTextCombine:
@@ -5059,22 +5113,21 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
             case WebKitCSSTransformValue::TranslateTransformOperation:
             case WebKitCSSTransformValue::TranslateXTransformOperation:
             case WebKitCSSTransformValue::TranslateYTransformOperation: {
-                bool ok = true;
                 Length tx = Length(0, Fixed);
                 Length ty = Length(0, Fixed);
                 if (transformValue->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                 else {
-                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                     if (transformValue->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
                         if (transformValue->length() > 1) {
                             CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
-                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor, &ok);
+                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor);
                         }
                     }
                 }
 
-                if (!ok)
+                if (tx.isUndefined() || ty.isUndefined())
                     return false;
 
                 operations.operations().append(TranslateTransformOperation::create(tx, ty, Length(0, Fixed), getTransformOperationType(transformValue->operationType())));
@@ -5082,29 +5135,28 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
             }
             case WebKitCSSTransformValue::TranslateZTransformOperation:
             case WebKitCSSTransformValue::Translate3DTransformOperation: {
-                bool ok = true;
                 Length tx = Length(0, Fixed);
                 Length ty = Length(0, Fixed);
                 Length tz = Length(0, Fixed);
                 if (transformValue->operationType() == WebKitCSSTransformValue::TranslateZTransformOperation)
-                    tz = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tz = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                 else if (transformValue->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                 else {
-                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                     if (transformValue->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
                         if (transformValue->length() > 2) {
                             CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(2));
-                            tz = convertToFloatLength(thirdValue, style, rootStyle, zoomFactor, &ok);
+                            tz = convertToFloatLength(thirdValue, style, rootStyle, zoomFactor);
                         }
                         if (transformValue->length() > 1) {
                             CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
-                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor, &ok);
+                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor);
                         }
                     }
                 }
 
-                if (!ok)
+                if (tx.isUndefined() || ty.isUndefined() || tz.isUndefined())
                     return false;
 
                 operations.operations().append(TranslateTransformOperation::create(tx, ty, tz, getTransformOperationType(transformValue->operationType())));
@@ -5200,18 +5252,16 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                 break;
             }
             case WebKitCSSTransformValue::PerspectiveTransformOperation: {
-                bool ok = true;
                 Length p = Length(0, Fixed);
                 if (firstValue->isLength())
-                    p = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    p = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                 else {
                     // This is a quirk that should go away when 3d transforms are finalized.
                     double val = firstValue->getDoubleValue();
-                    ok = val >= 0;
-                    p = Length(clampToPositiveInteger(val), Fixed);
+                    p = val >= 0 ? Length(clampToPositiveInteger(val), Fixed) : Length(Undefined);
                 }
 
-                if (!ok)
+                if (p.isUndefined())
                     return false;
 
                 operations.operations().append(PerspectiveTransformOperation::create(p));
@@ -5557,12 +5607,11 @@ bool CSSStyleSelector::createFilterOperations(CSSValue* inValue, RenderStyle* st
             break;
         }
         case WebKitCSSFilterValue::BlurFilterOperation: {
-            bool ok = true;
             Length stdDeviation = Length(0, Fixed);
             if (filterValue->length() >= 1) {
-                stdDeviation = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                stdDeviation = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
             }
-            if (!ok)
+            if (stdDeviation.isUndefined())
                 return false;
 
             operations.operations().append(BlurFilterOperation::create(stdDeviation, operationType));
diff --git a/Source/WebCore/css/CSSStyleSelector.h b/Source/WebCore/css/CSSStyleSelector.h
index 4db7f226d..099a9a73e 100644
--- a/Source/WebCore/css/CSSStyleSelector.h
+++ b/Source/WebCore/css/CSSStyleSelector.h
@@ -48,7 +48,6 @@ class CSSImageValue;
 class CSSRuleList;
 class CSSSelector;
 class CSSStyleApplyProperty;
-class CSSStyleRule;
 class CSSStyleSheet;
 class CSSValue;
 class ContainerNode;
@@ -70,6 +69,7 @@ class Settings;
 class StyleImage;
 class StylePendingImage;
 class StylePropertySet;
+class StyleRule;
 class StyleShader;
 class StyleSheet;
 class StyleSheetList;
@@ -107,8 +107,10 @@ public:
     ~CSSStyleSelector();
 
     // Using these during tree walk will allow style selector to optimize child and descendant selector lookups.
-    void pushParent(Element* parent);
-    void popParent(Element* parent);
+    void pushParentElement(Element*);
+    void popParentElement(Element*);
+    void pushParentShadowRoot(const ShadowRoot*);
+    void popParentShadowRoot(const ShadowRoot*);
 
     PassRefPtr<RenderStyle> styleForElement(Element*, RenderStyle* parentStyle = 0, bool allowSharing = true, bool resolveForRootDefault = false, RenderRegion* regionForStyling = 0);
 
@@ -150,6 +152,14 @@ private:
 
     PassRefPtr<RenderStyle> styleForKeyframe(const RenderStyle*, const WebKitCSSKeyframeRule*, KeyframeValue&);
 
+#if ENABLE(STYLE_SCOPED)
+    void pushScope(const ContainerNode* scope, const ContainerNode* scopeParent);
+    void popScope(const ContainerNode* scope);
+#else
+    void pushScope(const ContainerNode*, const ContainerNode*) { }
+    void popScope(const ContainerNode*) { }
+#endif
+
 public:
     // These methods will give back the set of rules that matched for a given element (or a pseudo-element).
     enum CSSRuleFilter {
@@ -228,8 +238,8 @@ public:
 #endif // ENABLE(CSS_FILTERS)
 
     struct RuleSelectorPair {
-        RuleSelectorPair(CSSStyleRule* rule, CSSSelector* selector) : rule(rule), selector(selector) { }
-        CSSStyleRule* rule;
+        RuleSelectorPair(StyleRule* rule, CSSSelector* selector) : rule(rule), selector(selector) { }
+        StyleRule* rule;
         CSSSelector* selector;
     };
     struct Features {
@@ -271,7 +281,10 @@ private:
         
         RefPtr<StylePropertySet> properties;
         union {
-            unsigned linkMatchType;
+            struct {
+                unsigned linkMatchType : 2;
+                unsigned isInRegionRule : 1;
+            };
             // Used to make sure all memory is zero-initialized since we compute the hash over the bytes of this object.
             void* possiblyPaddedMember;
         };
@@ -280,18 +293,19 @@ private:
     struct MatchResult {
         MatchResult() : isCacheable(true) { }
         Vector<MatchedProperties, 64> matchedProperties;
-        Vector<CSSStyleRule*, 64> matchedRules;
+        Vector<StyleRule*, 64> matchedRules;
         MatchRanges ranges;
         bool isCacheable;
     };
 
     struct MatchOptions {
-        MatchOptions(bool includeEmptyRules, const Element* scope = 0) : scope(scope), includeEmptyRules(includeEmptyRules) { }
-        const Element* scope;
+        MatchOptions(bool includeEmptyRules, const ContainerNode* scope = 0) : scope(scope), includeEmptyRules(includeEmptyRules) { }
+        const ContainerNode* scope;
         bool includeEmptyRules;
     };
 
-    static void addMatchedProperties(MatchResult& matchResult, StylePropertySet* properties, CSSStyleRule* rule = 0, unsigned linkMatchType =  SelectorChecker::MatchAll);
+    static void addMatchedProperties(MatchResult&, StylePropertySet* properties, StyleRule* = 0, unsigned linkMatchType = SelectorChecker::MatchAll, bool inRegionRule = false);
+    void addElementStyleProperties(MatchResult&, StylePropertySet*, bool isCacheable = true);
 
     void matchAllRules(MatchResult&);
     void matchUARules(MatchResult&);
@@ -306,13 +320,13 @@ private:
     void sortMatchedRules();
     void sortAndTransferMatchedRules(MatchResult&);
 
-    bool checkSelector(const RuleData&, const Element* scope = 0);
+    bool checkSelector(const RuleData&, const ContainerNode* scope = 0);
     bool checkRegionSelector(CSSSelector* regionSelector, Element* regionElement);
     void applyMatchedProperties(const MatchResult&);
     template <bool firstPass>
     void applyMatchedProperties(const MatchResult&, bool important, int startIndex, int endIndex, bool inheritedOnly);
     template <bool firstPass>
-    void applyProperties(const StylePropertySet* properties, CSSStyleRule*, bool isImportant, bool inheritedOnly);
+    void applyProperties(const StylePropertySet* properties, StyleRule*, bool isImportant, bool inheritedOnly, bool filterRegionProperties);
 
     static bool isValidRegionStyleProperty(int id);
 
@@ -348,6 +362,9 @@ public:
     bool applyPropertyToRegularStyle() const { return m_applyPropertyToRegularStyle; }
     bool applyPropertyToVisitedLinkStyle() const { return m_applyPropertyToVisitedLinkStyle; }
 
+    static Length convertToIntLength(CSSPrimitiveValue*, RenderStyle*, RenderStyle* rootStyle, double multiplier = 1);
+    static Length convertToFloatLength(CSSPrimitiveValue*, RenderStyle*, RenderStyle* rootStyle, double multiplier = 1);
+
 private:
     static RenderStyle* s_styleNotYetAvailable;
 
@@ -449,29 +466,29 @@ private:
 #endif
 
 #if ENABLE(STYLE_SCOPED)
-    static const Element* determineScopingElement(const CSSStyleSheet*);
+    static const ContainerNode* determineScope(const CSSStyleSheet*);
 
-    typedef HashMap<const Element*, OwnPtr<RuleSet> > ScopedRuleSetMap;
+    typedef HashMap<const ContainerNode*, OwnPtr<RuleSet> > ScopedRuleSetMap;
 
-    RuleSet* scopedRuleSetForElement(const Element*) const;
+    RuleSet* ruleSetForScope(const ContainerNode*) const;
 
-    void setupScopingElementStack(const Element*);
-    bool scopingElementStackIsConsistent(const Element* parent) const { return parent && parent == m_scopingElementStackParent; }
+    void setupScopeStack(const ContainerNode*);
+    bool scopeStackIsConsistent(const ContainerNode* parent) const { return parent && parent == m_scopeStackParent; }
 
     ScopedRuleSetMap m_scopedAuthorStyles;
     
     struct ScopeStackFrame {
-        ScopeStackFrame() : m_element(0), m_ruleSet(0) { }
-        ScopeStackFrame(const Element* element, RuleSet* ruleSet) : m_element(element), m_ruleSet(ruleSet) { }
-        const Element* m_element;
+        ScopeStackFrame() : m_scope(0), m_ruleSet(0) { }
+        ScopeStackFrame(const ContainerNode* scope, RuleSet* ruleSet) : m_scope(scope), m_ruleSet(ruleSet) { }
+        const ContainerNode* m_scope;
         RuleSet* m_ruleSet;
     };
     // Vector (used as stack) that keeps track of scoping elements (i.e., elements with a <style scoped> child)
     // encountered during tree iteration for style resolution.
-    Vector<ScopeStackFrame> m_scopingElementStack;
+    Vector<ScopeStackFrame> m_scopeStack;
     // Element last seen as parent element when updating m_scopingElementStack.
     // This is used to decide whether m_scopingElementStack is consistent, separately from SelectorChecker::m_parentStack.
-    const Element* m_scopingElementStackParent;
+    const ContainerNode* m_scopeStackParent;
 #endif
 
     friend class CSSStyleApplyProperty;
diff --git a/Source/WebCore/css/CSSStyleSheet.cpp b/Source/WebCore/css/CSSStyleSheet.cpp
index 707ca4c3c..4cd82af22 100644
--- a/Source/WebCore/css/CSSStyleSheet.cpp
+++ b/Source/WebCore/css/CSSStyleSheet.cpp
@@ -27,12 +27,14 @@
 #include "CSSParser.h"
 #include "CSSRuleList.h"
 #include "CSSStyleRule.h"
+#include "CachedCSSStyleSheet.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "Node.h"
 #include "SVGNames.h"
 #include "SecurityOrigin.h"
+#include "StyleRule.h"
 #include "TextEncoding.h"
 #include <wtf/Deque.h>
 
@@ -60,6 +62,7 @@ CSSStyleSheet::CSSStyleSheet(Node* parentNode, const String& href, const KURL& b
     , m_strictParsing(false)
     , m_isUserStyleSheet(false)
     , m_hasSyntacticallyValidCSSHeader(true)
+    , m_didLoadErrorOccur(false)
 {
     ASSERT(isAcceptableCSSStyleSheetParent(parentNode));
 }
@@ -70,6 +73,7 @@ CSSStyleSheet::CSSStyleSheet(CSSImportRule* ownerRule, const String& href, const
     , m_loadCompleted(false)
     , m_strictParsing(!ownerRule || ownerRule->useStrictParsing())
     , m_hasSyntacticallyValidCSSHeader(true)
+    , m_didLoadErrorOccur(false)
 {
     CSSStyleSheet* parentSheet = ownerRule ? ownerRule->parentStyleSheet() : 0;
     m_isUserStyleSheet = parentSheet ? parentSheet->isUserStyleSheet() : false;
@@ -237,7 +241,21 @@ void CSSStyleSheet::checkLoaded()
     RefPtr<CSSStyleSheet> protector(this);
     if (CSSStyleSheet* styleSheet = parentStyleSheet())
         styleSheet->checkLoaded();
-    m_loadCompleted = ownerNode() ? ownerNode()->sheetLoaded() : true;
+
+    RefPtr<Node> owner = ownerNode();
+    if (!owner)
+        m_loadCompleted = true;
+    else {
+        m_loadCompleted = owner->sheetLoaded();
+        if (m_loadCompleted)
+            owner->notifyLoadedSheetAndAllCriticalSubresources(m_didLoadErrorOccur);
+    }
+}
+
+void CSSStyleSheet::notifyLoadedSheet(const CachedCSSStyleSheet* sheet)
+{
+    ASSERT(sheet);
+    m_didLoadErrorOccur |= sheet->errorOccurred();
 }
 
 void CSSStyleSheet::startLoadingDynamicSheet()
@@ -306,7 +324,7 @@ void CSSStyleSheet::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
             } else if (rule->isFontFaceRule())
                 static_cast<CSSFontFaceRule*>(rule)->addSubresourceStyleURLs(urls);
             else if (rule->isStyleRule() || rule->isPageRule())
-                static_cast<CSSStyleRule*>(rule)->addSubresourceStyleURLs(urls);
+                static_cast<CSSStyleRule*>(rule)->styleRule()->addSubresourceStyleURLs(urls, this);
         }
     }
 }
diff --git a/Source/WebCore/css/CSSStyleSheet.h b/Source/WebCore/css/CSSStyleSheet.h
index b027365f2..e73491918 100644
--- a/Source/WebCore/css/CSSStyleSheet.h
+++ b/Source/WebCore/css/CSSStyleSheet.h
@@ -29,6 +29,7 @@ namespace WebCore {
 struct CSSNamespace;
 class CSSParser;
 class CSSRule;
+class CachedCSSStyleSheet;
 class CachedResourceLoader;
 class Document;
 
@@ -114,6 +115,8 @@ public:
     unsigned length() const { return m_children.size(); }
     CSSRule* item(unsigned index) { return index < length() ? m_children.at(index).get() : 0; }
 
+    void notifyLoadedSheet(const CachedCSSStyleSheet*);
+
 private:
     CSSStyleSheet(Node* ownerNode, const String& originalURL, const KURL& finalURL, const String& charset);
     CSSStyleSheet(CSSImportRule* ownerRule, const String& originalURL, const KURL& finalURL, const String& charset);
@@ -128,6 +131,7 @@ private:
     bool m_strictParsing : 1;
     bool m_isUserStyleSheet : 1;
     bool m_hasSyntacticallyValidCSSHeader : 1;
+    bool m_didLoadErrorOccur : 1;
 };
 
 } // namespace
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index d299391d8..a80581f75 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -615,6 +615,8 @@ list-button
 listbox
 listitem
 media-fullscreen-button
+media-fullscreen-volume-slider
+media-fullscreen-volume-slider-thumb
 media-mute-button
 media-play-button
 media-seek-back-button
diff --git a/Source/WebCore/css/CSSWrapShapes.cpp b/Source/WebCore/css/CSSWrapShapes.cpp
index e5e9f98c3..fff84b95d 100644
--- a/Source/WebCore/css/CSSWrapShapes.cpp
+++ b/Source/WebCore/css/CSSWrapShapes.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/CSSWrapShapes.h b/Source/WebCore/css/CSSWrapShapes.h
index 3ff9fab83..38487b6db 100644
--- a/Source/WebCore/css/CSSWrapShapes.h
+++ b/Source/WebCore/css/CSSWrapShapes.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/MediaAllInOne.cpp b/Source/WebCore/css/MediaAllInOne.cpp
new file mode 100644
index 000000000..3c71b8215
--- /dev/null
+++ b/Source/WebCore/css/MediaAllInOne.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "MediaFeatureNames.cpp"
+#include "MediaList.cpp"
+#include "MediaQuery.cpp"
+#include "MediaQueryEvaluator.cpp"
+#include "MediaQueryExp.cpp"
+#include "MediaQueryList.cpp"
+#include "MediaQueryListListener.cpp"
+#include "MediaQueryMatcher.cpp"
diff --git a/Source/WebCore/css/SVGCSSParser.cpp b/Source/WebCore/css/SVGCSSParser.cpp
index 2c295765a..8a67fabf1 100644
--- a/Source/WebCore/css/SVGCSSParser.cpp
+++ b/Source/WebCore/css/SVGCSSParser.cpp
@@ -292,7 +292,7 @@ bool CSSParser::parseSVGValue(int propId, bool important)
             rollbackLastProperties(1);
             return false;
         }
-        CSSValue* value = m_parsedProperties[m_numParsedProperties - 1]->value();
+        CSSValue* value = m_parsedProperties.last().value();
         addProperty(CSSPropertyMarkerMid, value, important);
         addProperty(CSSPropertyMarkerEnd, value, important);
         m_implicitShorthand = false;
diff --git a/Source/WebCore/css/SelectorChecker.cpp b/Source/WebCore/css/SelectorChecker.cpp
index bc216605d..316f44650 100644
--- a/Source/WebCore/css/SelectorChecker.cpp
+++ b/Source/WebCore/css/SelectorChecker.cpp
@@ -52,17 +52,13 @@
 #include "ScrollbarTheme.h"
 #include "StyledElement.h"
 #include "Text.h"
+#include "XLinkNames.h"
 
 #if USE(PLATFORM_STRATEGIES)
 #include "PlatformStrategies.h"
 #include "VisitedLinkStrategy.h"
 #endif
 
-#if ENABLE(SVG)
-#include "SVGNames.h"
-#include "XLinkNames.h"
-#endif
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -218,11 +214,8 @@ static inline const AtomicString* linkAttribute(Node* node)
     Element* element = static_cast<Element*>(node);
     if (element->isHTMLElement())
         return &element->fastGetAttribute(hrefAttr);
-
-#if ENABLE(SVG)
     if (element->isSVGElement())
         return &element->getAttribute(XLinkNames::hrefAttr);
-#endif
 
     return 0;
 }
@@ -445,13 +438,6 @@ bool SelectorChecker::isFastCheckableSelector(const CSSSelector* selector)
 // * SelectorFailsCompletely  - the selector fails for e and any sibling or ancestor of e
 SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorCheckingContext& context, PseudoId& dynamicPseudo) const
 {
-#if ENABLE(SVG)
-    // Spec: CSS2 selectors cannot be applied to the (conceptually) cloned DOM tree
-    // because its contents are not part of the formal document structure.
-    if (context.element->isSVGShadowRoot())
-        return SelectorFailsCompletely;
-#endif
-
     // first selector has to match
     if (!checkOneSelector(context, dynamicPseudo))
         return SelectorFailsLocally;
@@ -1122,6 +1108,10 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, P
                     return true;
                 break;
             }
+        case CSSSelector::PseudoScope:
+            if (context.scope)
+                return element == context.scope;
+            // If there is no scope, :scope should behave as :root -> fall through
         case CSSSelector::PseudoRoot:
             if (element == element->document()->documentElement())
                 return true;
diff --git a/Source/WebCore/css/SelectorChecker.h b/Source/WebCore/css/SelectorChecker.h
index 7e80808dd..22b127f02 100644
--- a/Source/WebCore/css/SelectorChecker.h
+++ b/Source/WebCore/css/SelectorChecker.h
@@ -66,7 +66,7 @@ public:
 
         CSSSelector* selector;
         Element* element;
-        const Element* scope;
+        const ContainerNode* scope;
         VisitedMatchType visitedMatchType;
         RenderStyle* elementStyle;
         RenderStyle* elementParentStyle;
diff --git a/Source/WebCore/css/StylePropertySet.cpp b/Source/WebCore/css/StylePropertySet.cpp
index e8d97cacc..65452ec3b 100644
--- a/Source/WebCore/css/StylePropertySet.cpp
+++ b/Source/WebCore/css/StylePropertySet.cpp
@@ -57,26 +57,27 @@ StylePropertySet::StylePropertySet(const Vector<CSSProperty>& properties)
     m_properties.shrinkToFit();
 }
 
-StylePropertySet::StylePropertySet(const CSSProperty* const * properties, int numProperties, bool useStrictParsing)
+StylePropertySet::StylePropertySet(const CSSProperty* properties, int numProperties, bool useStrictParsing)
     : m_strictParsing(useStrictParsing)
     , m_hasCSSOMWrapper(false)
 {
+    // FIXME: This logic belongs in CSSParser.
+
     m_properties.reserveInitialCapacity(numProperties);
     HashMap<int, bool> candidates;
     for (int i = 0; i < numProperties; ++i) {
-        const CSSProperty *property = properties[i];
-        ASSERT(property);
-        bool important = property->isImportant();
+        const CSSProperty& property = properties[i];
+        bool important = property.isImportant();
 
-        HashMap<int, bool>::iterator it = candidates.find(property->id());
+        HashMap<int, bool>::iterator it = candidates.find(property.id());
         if (it != candidates.end()) {
             if (!important && it->second)
                 continue;
-            removeProperty(property->id());
+            removeProperty(property.id());
         }
 
-        m_properties.append(*property);
-        candidates.set(property->id(), important);
+        m_properties.append(property);
+        candidates.set(property.id(), important);
     }
 }
 
@@ -628,11 +629,11 @@ void StylePropertySet::parseDeclaration(const String& styleDeclaration, CSSStyle
     parser.parseDeclaration(this, styleDeclaration, 0, contextStyleSheet);
 }
 
-void StylePropertySet::addParsedProperties(const CSSProperty* const* properties, int numProperties)
+void StylePropertySet::addParsedProperties(const CSSProperty* properties, int numProperties)
 {
     m_properties.reserveCapacity(numProperties);
     for (int i = 0; i < numProperties; ++i)
-        addParsedProperty(*properties[i]);
+        addParsedProperty(properties[i]);
 }
 
 void StylePropertySet::addParsedProperty(const CSSProperty& property)
diff --git a/Source/WebCore/css/StylePropertySet.h b/Source/WebCore/css/StylePropertySet.h
index 9aeb2e4ae..90452ff67 100644
--- a/Source/WebCore/css/StylePropertySet.h
+++ b/Source/WebCore/css/StylePropertySet.h
@@ -43,7 +43,7 @@ public:
     {
         return adoptRef(new StylePropertySet);
     }
-    static PassRefPtr<StylePropertySet> create(const CSSProperty* const* properties, int numProperties, bool useStrictParsing)
+    static PassRefPtr<StylePropertySet> create(const CSSProperty* properties, int numProperties, bool useStrictParsing)
     {
         return adoptRef(new StylePropertySet(properties, numProperties, useStrictParsing));
     }
@@ -76,7 +76,7 @@ public:
 
     void parseDeclaration(const String& styleDeclaration, CSSStyleSheet* contextStyleSheet);
 
-    void addParsedProperties(const CSSProperty* const *, int numProperties);
+    void addParsedProperties(const CSSProperty*, int numProperties);
     void addParsedProperty(const CSSProperty&);
 
     PassRefPtr<StylePropertySet> copyBlockProperties() const;
@@ -107,11 +107,13 @@ public:
     CSSStyleDeclaration* ensureCSSStyleDeclaration() const;
     CSSStyleDeclaration* ensureRuleCSSStyleDeclaration(const CSSRule* parentRule) const;
     CSSStyleDeclaration* ensureInlineCSSStyleDeclaration(const StyledElement* parentElement) const;
+    
+    bool hasCSSOMWrapper() const { return m_hasCSSOMWrapper; }
 
 private:
     StylePropertySet();
     StylePropertySet(const Vector<CSSProperty>&);
-    StylePropertySet(const CSSProperty* const *, int numProperties, bool useStrictParsing);
+    StylePropertySet(const CSSProperty*, int numProperties, bool useStrictParsing);
 
     void setNeedsStyleRecalc();
 
diff --git a/Source/WebCore/rendering/RenderSummary.cpp b/Source/WebCore/css/StyleRule.cpp
index da2086649..fc0f9d67d 100644
--- a/Source/WebCore/rendering/RenderSummary.cpp
+++ b/Source/WebCore/css/StyleRule.cpp
@@ -1,5 +1,7 @@
 /*
- * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
+ * (C) 1999-2003 Lars Knoll (knoll@kde.org)
+ * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2002, 2005, 2006, 2008, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -15,33 +17,34 @@
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
- *
  */
 
 #include "config.h"
-#include "RenderSummary.h"
-
-#if ENABLE(DETAILS)
-
-#include "RenderDetails.h"
+#include "StyleRule.h"
 
 namespace WebCore {
 
-RenderSummary::RenderSummary(Node* node)
-    : RenderBlock(node)
+StyleRule::StyleRule(int line, CSSStyleRule* wrapper)
+    : m_sourceLine(line)
+    , m_cssomWrapper(wrapper)
 {
 }
-
-void RenderSummary::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+    
+StyleRule::~StyleRule()
 {
-    RenderBlock::styleDidChange(diff, oldStyle);
-
-
-    // Ensure that if we ended up being inline that we set our replaced flag
-    // so that we're treated like an inline-block.
-    setReplaced(isInline());
 }
-
+    
+void StyleRule::addSubresourceStyleURLs(ListHashSet<KURL>& urls, CSSStyleSheet* styleSheet) 
+{
+    if (!m_properties)
+        return;
+    m_properties->addSubresourceStyleURLs(urls, styleSheet);
+}
+    
+CSSStyleRule* StyleRule::ensureCSSStyleRule() const
+{
+    ASSERT(m_cssomWrapper);
+    return m_cssomWrapper;
 }
 
-#endif
+} // namespace WebCore
diff --git a/Source/WebCore/css/StyleRule.h b/Source/WebCore/css/StyleRule.h
new file mode 100644
index 000000000..e230a94fd
--- /dev/null
+++ b/Source/WebCore/css/StyleRule.h
@@ -0,0 +1,63 @@
+/*
+ * (C) 1999-2003 Lars Knoll (knoll@kde.org)
+ * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2002, 2006, 2008, 2012 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef StyleRule_h
+#define StyleRule_h
+
+#include "CSSSelectorList.h"
+#include "StylePropertySet.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class CSSStyleRule;
+
+class StyleRule {
+    WTF_MAKE_NONCOPYABLE(StyleRule); WTF_MAKE_FAST_ALLOCATED;
+public:
+    StyleRule(int sourceLine, CSSStyleRule*);
+    ~StyleRule();
+            
+    const CSSSelectorList& selectorList() const { return m_selectorList; }
+    StylePropertySet* properties() const { return m_properties.get(); }
+    
+    void addSubresourceStyleURLs(ListHashSet<KURL>& urls, CSSStyleSheet*);
+
+    int sourceLine() const { return m_sourceLine; }
+    
+    CSSStyleRule* ensureCSSStyleRule() const;
+    
+    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectors) { m_selectorList.adoptSelectorVector(selectors); }
+    void adoptSelectorList(CSSSelectorList& selectors) { m_selectorList.adopt(selectors); }
+    void setProperties(PassRefPtr<StylePropertySet> properties) { m_properties = properties; }
+    
+private:
+    RefPtr<StylePropertySet> m_properties;
+    CSSSelectorList m_selectorList;
+    signed m_sourceLine;
+
+    CSSStyleRule* m_cssomWrapper;
+};
+
+} // namespace WebCore
+
+#endif // StyleRule_h
diff --git a/Source/WebCore/css/WebKitCSSFilterValue.cpp b/Source/WebCore/css/WebKitCSSFilterValue.cpp
index 93ae41097..2cbbf9c45 100644
--- a/Source/WebCore/css/WebKitCSSFilterValue.cpp
+++ b/Source/WebCore/css/WebKitCSSFilterValue.cpp
@@ -45,6 +45,7 @@ bool WebKitCSSFilterValue::typeUsesSpaceSeparator(FilterOperationType operationT
 #if ENABLE(CSS_SHADERS)
     return operationType != CustomFilterOperation;
 #else
+    UNUSED_PARAM(operationType);
     return true;
 #endif
 }
diff --git a/Source/WebCore/css/WebKitCSSMatrix.idl b/Source/WebCore/css/WebKitCSSMatrix.idl
index 08fd6641d..08c41aa12 100644
--- a/Source/WebCore/css/WebKitCSSMatrix.idl
+++ b/Source/WebCore/css/WebKitCSSMatrix.idl
@@ -27,7 +27,6 @@ module css {
 
     // Introduced in DOM Level ?:
     interface [
-        ConstructorParameters=1,
         Constructor(in [Optional=DefaultIsNullString] DOMString cssValue),
         ConstructorRaisesException,
     ] WebKitCSSMatrix {
diff --git a/Source/WebCore/css/WebKitCSSRegionRule.cpp b/Source/WebCore/css/WebKitCSSRegionRule.cpp
index d809aafba..cc377c461 100644
--- a/Source/WebCore/css/WebKitCSSRegionRule.cpp
+++ b/Source/WebCore/css/WebKitCSSRegionRule.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/WebKitCSSRegionRule.h b/Source/WebCore/css/WebKitCSSRegionRule.h
index f4dede542..624ed3f63 100644
--- a/Source/WebCore/css/WebKitCSSRegionRule.h
+++ b/Source/WebCore/css/WebKitCSSRegionRule.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/WebKitCSSRegionRule.idl b/Source/WebCore/css/WebKitCSSRegionRule.idl
index dc8b0a96d..428d0c5bb 100644
--- a/Source/WebCore/css/WebKitCSSRegionRule.idl
+++ b/Source/WebCore/css/WebKitCSSRegionRule.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/WebKitCSSShaderValue.cpp b/Source/WebCore/css/WebKitCSSShaderValue.cpp
index ea930304b..698f170bc 100644
--- a/Source/WebCore/css/WebKitCSSShaderValue.cpp
+++ b/Source/WebCore/css/WebKitCSSShaderValue.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/WebKitCSSShaderValue.h b/Source/WebCore/css/WebKitCSSShaderValue.h
index 610922001..fd95bc63c 100644
--- a/Source/WebCore/css/WebKitCSSShaderValue.h
+++ b/Source/WebCore/css/WebKitCSSShaderValue.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/fullscreenQuickTime.css b/Source/WebCore/css/fullscreenQuickTime.css
index ea1ebd6ec..b1b93fcf2 100644
--- a/Source/WebCore/css/fullscreenQuickTime.css
+++ b/Source/WebCore/css/fullscreenQuickTime.css
@@ -88,17 +88,17 @@ video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-min-button {
     position: absolute;
     left: 11px;
     top: 15px;
-    width: 14px;
-    height: 12px;
+    width: 17px;
+    height: 14px;
 }
 
 video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-slider {
-    -webkit-appearance: media-slider;
+    -webkit-appearance: media-fullscreen-volume-slider;
     display: block;
     position: absolute;
     left: 28px;
-    top: 15px;
-    height: 12px;
+    top: 14px;
+    height: 11px;
     width: 50px;
 }
 
@@ -108,8 +108,8 @@ video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-max-button {
     position: absolute;
     left: 84px;
     top: 15px;
-    width: 14px;
-    height: 12px;
+    width: 17px;
+    height: 14px;
 }
 
 video:-webkit-full-screen::-webkit-media-controls-play-button {
diff --git a/Source/WebCore/css/mediaControls.css b/Source/WebCore/css/mediaControls.css
index 31c9d4326..b81332fc7 100644
--- a/Source/WebCore/css/mediaControls.css
+++ b/Source/WebCore/css/mediaControls.css
@@ -37,8 +37,11 @@ audio {
     width: inherit;
     height: inherit;
     position: relative;
-    display: block;
+    display: -webkit-box;
     direction: ltr;
+    -webkit-box-align: start;
+    -webkit-box-pack: end;
+    -webkit-box-orient: vertical;
 }
 
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
@@ -46,7 +49,7 @@ audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
     -webkit-box-orient: horizontal;
     -webkit-box-align: center;
     -webkit-user-select: none;
-    position: absolute;
+    position: relative;
     bottom: 0;
     width: 100%;
     z-index: 0;
@@ -201,15 +204,16 @@ audio::-webkit-media-controls-fullscreen-volume-max-button, video::-webkit-media
 }
 
 video::-webkit-media-text-track-container {
-    position: absolute;
+    position: relative;
     width: 100%;
     overflow: hidden;
+    padding-bottom: 5px;
 
     font-size: 22px;
     font-family: sans-serif;
     text-align: center;
     color: rgba(255, 255, 255, 0);
-    
+
     letter-spacing: normal;
     word-spacing: normal;
     text-transform: none;
@@ -222,6 +226,6 @@ video::-webkit-media-text-track-container {
 video::-webkit-media-text-track-display {
     display: inline;
     background-color: rgba(0, 0, 0, 0.8);
-    color: yellow;
+    color: rgba(255, 255, 255, 1);
     padding: 0px 2px;
 }
diff --git a/Source/WebCore/css/mediaControlsChromium.css b/Source/WebCore/css/mediaControlsChromium.css
index 508d7445e..5fb62cc34 100644
--- a/Source/WebCore/css/mediaControlsChromium.css
+++ b/Source/WebCore/css/mediaControlsChromium.css
@@ -41,7 +41,7 @@ audio:-webkit-full-page-media, video:-webkit-full-page-media {
 
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
     -webkit-user-select: none;
-    position: absolute;
+    position: relative;
     overflow: visible;
     bottom: 0;
     width: 100%;
diff --git a/Source/WebCore/css/mediaControlsChromiumAndroid.css b/Source/WebCore/css/mediaControlsChromiumAndroid.css
new file mode 100644
index 000000000..e0498d886
--- /dev/null
+++ b/Source/WebCore/css/mediaControlsChromiumAndroid.css
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2012 Google Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* Media controls for Chromium on Android*/
+
+body:-webkit-full-page-media {
+    background-color: rgb(0, 0, 0);
+}
+
+audio {
+    width: 300px;
+    height: 32px;
+}
+
+audio:-webkit-full-page-media, video:-webkit-full-page-media {
+    max-height: 100%;
+    max-width: 100%;
+}
+
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    -webkit-user-select: none;
+    position: absolute;
+    overflow: visible;
+    bottom: 0;
+    width: 100%;
+    height: 32px;
+    z-index: 0;
+    background-color: rgba(0, 0, 0, 0.6);
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+    bottom: 0px;
+}
+
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
+    display: none;
+}
+
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
+    -webkit-appearance: media-play-button;
+
+    position: absolute;
+    top: auto;
+    bottom: 7px;
+    left: 7px;
+    right: 6px;
+
+    width: 18px;
+    height: 19px;
+}
+
+audio::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-timeline-container;
+    -webkit-user-select: none;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: center;
+    -webkit-box-pack: center;
+    -webkit-box-flex: 1;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 30px;
+    right: 0;
+
+    width: auto;
+    height: 32px;
+
+    border-left: 1px solid rgba(255, 255, 255, 0.2);
+    border-right: 1px solid rgba(255, 255, 255, 0.2);
+}
+
+video::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-timeline-container;
+    -webkit-user-select: none;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: center;
+    -webkit-box-pack: center;
+    -webkit-box-flex: 1;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 30px;
+    right: 34px;
+
+    width: auto;
+    height: 32px;
+
+    border-left: 1px solid rgba(255, 255, 255, 0.2);
+    border-right: 1px solid rgba(255, 255, 255, 0.2);
+}
+
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    -webkit-appearance: media-current-time-display;
+    -webkit-user-select: none;
+    display: -webkit-box;
+    -webkit-box-flex: 0;
+    -webkit-box-pack: center;
+    -webkit-box-align: center;
+
+    overflow: hidden;
+    cursor: default;
+
+    line-height: 21px;
+    height: 20px;
+    width: 58px;
+
+    text-align: center;
+    font-family: Arial;
+    font-size: 16px;
+    font-weight: bold;
+    color: white;
+
+    letter-spacing: normal;
+    word-spacing: normal;
+    text-transform: none;
+    text-indent: 0;
+    text-shadow: none;
+    text-decoration: none;
+}
+
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    -webkit-appearance: media-slider;
+    display: -webkit-box;
+    box-sizing: border-box;
+    -webkit-box-flex: 1;
+
+    padding: 0px;
+    margin: 0px 6px;
+    height: 18px;
+
+    border-color: rgba(255, 255, 255, 0.2);
+    border-style: solid;
+    border-width: 1px;
+    border-radius: 2px;
+    background-color: rgba(255, 255, 255, 0.08);
+    color: rgb(50, 140, 223);
+}
+
+
+video::-webkit-media-controls-fullscreen-button {
+    -webkit-appearance: media-fullscreen-button;
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    right: 0;
+    left: auto;
+
+    width: 34px;
+    height: 32px;
+}
+
+audio::-webkit-media-controls-fullscreen-button {
+    -webkit-appearance: media-fullscreen-button;
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    display: none;
+}
diff --git a/Source/WebCore/dom/ActiveDOMObject.cpp b/Source/WebCore/dom/ActiveDOMObject.cpp
index bb2ec2209..1fe832aee 100644
--- a/Source/WebCore/dom/ActiveDOMObject.cpp
+++ b/Source/WebCore/dom/ActiveDOMObject.cpp
@@ -33,30 +33,6 @@
 
 namespace WebCore {
 
-ContextDestructionObserver::ContextDestructionObserver(ScriptExecutionContext* scriptExecutionContext)
-    : m_scriptExecutionContext(scriptExecutionContext)
-{
-    if (!m_scriptExecutionContext)
-        return;
-
-    ASSERT(m_scriptExecutionContext->isContextThread());
-    m_scriptExecutionContext->didCreateDestructionObserver(this);
-}
-
-ContextDestructionObserver::~ContextDestructionObserver()
-{
-    if (!m_scriptExecutionContext)
-        return;
-
-    ASSERT(m_scriptExecutionContext->isContextThread());
-    m_scriptExecutionContext->willDestroyDestructionObserver(this);
-}
-
-void ContextDestructionObserver::contextDestroyed()
-{
-    m_scriptExecutionContext = 0;
-}
-
 ActiveDOMObject::ActiveDOMObject(ScriptExecutionContext* scriptExecutionContext, void* upcastPointer)
     : ContextDestructionObserver(scriptExecutionContext)
     , m_pendingActivityCount(0)
diff --git a/Source/WebCore/dom/ActiveDOMObject.h b/Source/WebCore/dom/ActiveDOMObject.h
index dce6b56dd..2a6b1ae80 100644
--- a/Source/WebCore/dom/ActiveDOMObject.h
+++ b/Source/WebCore/dom/ActiveDOMObject.h
@@ -27,78 +27,64 @@
 #ifndef ActiveDOMObject_h
 #define ActiveDOMObject_h
 
+#include "ContextDestructionObserver.h"
 #include <wtf/Assertions.h>
 
 namespace WebCore {
 
-    class ScriptExecutionContext;
+class ActiveDOMObject : public ContextDestructionObserver {
+public:
+    ActiveDOMObject(ScriptExecutionContext*, void* upcastPointer);
 
-    // FIXME: Move this class to it's own file.
-    class ContextDestructionObserver {
-    public:
-        explicit ContextDestructionObserver(ScriptExecutionContext*);
-        virtual void contextDestroyed();
-
-        ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
-
-    protected:
-        virtual ~ContextDestructionObserver();
-
-        ScriptExecutionContext* m_scriptExecutionContext;
-    };
-
-    class ActiveDOMObject : public ContextDestructionObserver {
-    public:
-        ActiveDOMObject(ScriptExecutionContext*, void* upcastPointer);
-
-        // suspendIfNeeded() should be called exactly once after object construction to synchronize
-        // the suspend state with that in ScriptExecutionContext.
-        void suspendIfNeeded();
+    // suspendIfNeeded() should be called exactly once after object construction to synchronize
+    // the suspend state with that in ScriptExecutionContext.
+    void suspendIfNeeded();
 #if !ASSERT_DISABLED
-        bool suspendIfNeededCalled() const { return m_suspendIfNeededCalled; }
+    bool suspendIfNeededCalled() const { return m_suspendIfNeededCalled; }
 #endif
 
-        virtual bool hasPendingActivity() const;
-
-        // canSuspend() is used by the caller if there is a choice between suspending and stopping.
-        // For example, a page won't be suspended and placed in the back/forward cache if it has
-        // the objects that can not be suspended.
-        // However, 'suspend' can be called even if canSuspend() would return 'false'. That
-        // happens in step-by-step JS debugging for example - in this case it would be incorrect
-        // to stop the object. Exact semantics of suspend is up to the object then.
-        enum ReasonForSuspension {
-            JavaScriptDebuggerPaused,
-            WillShowDialog,
-            DocumentWillBecomeInactive
-        };
-        virtual bool canSuspend() const;
-        virtual void suspend(ReasonForSuspension);
-        virtual void resume();
-        virtual void stop();
-
-        template<class T> void setPendingActivity(T* thisObject)
-        {
-            ASSERT(thisObject == this);
-            thisObject->ref();
-            m_pendingActivityCount++;
-        }
-
-        template<class T> void unsetPendingActivity(T* thisObject)
-        {
-            ASSERT(m_pendingActivityCount > 0);
-            --m_pendingActivityCount;
-            thisObject->deref();
-        }
-
-    protected:
-        virtual ~ActiveDOMObject();
-
-    private:
-        unsigned m_pendingActivityCount;
+    virtual bool hasPendingActivity() const;
+
+    // canSuspend() is used by the caller if there is a choice between suspending and stopping.
+    // For example, a page won't be suspended and placed in the back/forward cache if it has
+    // the objects that can not be suspended.
+    // However, 'suspend' can be called even if canSuspend() would return 'false'. That
+    // happens in step-by-step JS debugging for example - in this case it would be incorrect
+    // to stop the object. Exact semantics of suspend is up to the object then.
+    enum ReasonForSuspension {
+        JavaScriptDebuggerPaused,
+        WillShowDialog,
+        DocumentWillBecomeInactive,
+        PageWillBeSuspended
+    };
+    virtual bool canSuspend() const;
+    virtual void suspend(ReasonForSuspension);
+    virtual void resume();
+    virtual void stop();
+
+    template<class T> void setPendingActivity(T* thisObject)
+    {
+        ASSERT(thisObject == this);
+        thisObject->ref();
+        m_pendingActivityCount++;
+    }
+
+    template<class T> void unsetPendingActivity(T* thisObject)
+    {
+        ASSERT(m_pendingActivityCount > 0);
+        --m_pendingActivityCount;
+        thisObject->deref();
+    }
+
+protected:
+    virtual ~ActiveDOMObject();
+
+private:
+    unsigned m_pendingActivityCount;
 #if !ASSERT_DISABLED
-        bool m_suspendIfNeededCalled;
+    bool m_suspendIfNeededCalled;
 #endif
-    };
+};
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/dom/Attr.cpp b/Source/WebCore/dom/Attr.cpp
index e54c8d0df..75f7b8ffd 100644
--- a/Source/WebCore/dom/Attr.cpp
+++ b/Source/WebCore/dom/Attr.cpp
@@ -167,13 +167,11 @@ bool Attr::childTypeAllowed(NodeType type) const
     }
 }
 
-void Attr::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+void Attr::childrenChanged(bool, Node*, Node*, int)
 {
     if (m_ignoreChildrenChanged > 0)
         return;
 
-    Node::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-
     invalidateNodeListsCacheAfterAttributeChanged(m_attribute->name());
 
     // FIXME: We should include entity references in the value
diff --git a/Source/WebCore/dom/Attr.h b/Source/WebCore/dom/Attr.h
index b70357495..286cfafb3 100644
--- a/Source/WebCore/dom/Attr.h
+++ b/Source/WebCore/dom/Attr.h
@@ -39,8 +39,8 @@ class CSSStyleDeclaration;
 // destruction. however, this is not yet implemented.
 
 class Attr : public ContainerNode {
+    friend class AttributeVector;
     friend class ElementAttributeData;
-    friend class NamedNodeMap;
 public:
     static PassRefPtr<Attr> create(Element*, Document*, PassRefPtr<Attribute>);
     virtual ~Attr();
diff --git a/Source/WebCore/dom/Attribute.h b/Source/WebCore/dom/Attribute.h
index 8658775b8..8c59d1c48 100644
--- a/Source/WebCore/dom/Attribute.h
+++ b/Source/WebCore/dom/Attribute.h
@@ -31,7 +31,6 @@ namespace WebCore {
 
 class Attr;
 class Element;
-class NamedNodeMap;
 
 // This has no counterpart in DOM.
 // It is an internal representation of the node value of an Attr.
diff --git a/Source/WebCore/dom/CharacterData.cpp b/Source/WebCore/dom/CharacterData.cpp
index 3879a97e9..f8e034dd6 100644
--- a/Source/WebCore/dom/CharacterData.cpp
+++ b/Source/WebCore/dom/CharacterData.cpp
@@ -81,6 +81,7 @@ unsigned CharacterData::parserAppendData(const UChar* data, unsigned dataLength,
     m_data.append(data, end);
 
     updateRenderer(oldLength, 0);
+    document()->incDOMTreeVersion();
     // We don't call dispatchModifiedEvent here because we don't want the
     // parser to dispatch DOM mutation events.
     if (parentNode())
@@ -178,6 +179,7 @@ void CharacterData::setDataAndUpdate(const String& newData, unsigned offsetOfRep
     String oldData = m_data;
     m_data = newData;
     updateRenderer(offsetOfReplacedData, oldLength);
+    document()->incDOMTreeVersion();
     dispatchModifiedEvent(oldData);
 }
 
diff --git a/Source/WebCore/dom/Clipboard.cpp b/Source/WebCore/dom/Clipboard.cpp
index 2053292a1..027992515 100644
--- a/Source/WebCore/dom/Clipboard.cpp
+++ b/Source/WebCore/dom/Clipboard.cpp
@@ -27,7 +27,6 @@
 #include "Clipboard.h"
 
 #include "CachedImage.h"
-#include "DOMStringList.h"
 #include "FileList.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -148,7 +147,7 @@ bool Clipboard::hasStringOfType(const String& type) const
     if (m_policy != ClipboardReadable && m_policy != ClipboardTypesReadable)
         return false;
     
-    return types()->contains(type);
+    return types().contains(type); 
 }
     
 void Clipboard::setDropEffect(const String &effect)
diff --git a/Source/WebCore/dom/Clipboard.h b/Source/WebCore/dom/Clipboard.h
index d33829a6c..83f0f2428 100644
--- a/Source/WebCore/dom/Clipboard.h
+++ b/Source/WebCore/dom/Clipboard.h
@@ -33,7 +33,6 @@
 
 namespace WebCore {
 
-    class DOMStringList;
     class DataTransferItemList;
     class DragData;
     class FileList;
@@ -63,11 +62,11 @@ namespace WebCore {
     
         virtual void clearData(const String& type) = 0;
         virtual void clearAllData() = 0;
-        virtual String getData(const String& type, bool& success) const = 0;
+        virtual String getData(const String& type) const = 0;
         virtual bool setData(const String& type, const String& data) = 0;
     
         // extensions beyond IE's API
-        virtual PassRefPtr<DOMStringList> types() const = 0;
+        virtual HashSet<String> types() const = 0;
         virtual PassRefPtr<FileList> files() const = 0;
 
         IntPoint dragLocation() const { return m_dragLoc; }
diff --git a/Source/WebCore/dom/Clipboard.idl b/Source/WebCore/dom/Clipboard.idl
index c1c5850ec..c94621bc7 100644
--- a/Source/WebCore/dom/Clipboard.idl
+++ b/Source/WebCore/dom/Clipboard.idl
@@ -31,13 +31,12 @@ module core {
     interface Clipboard {
                  attribute [TreatReturnedNullStringAs=Undefined] DOMString dropEffect;
                  attribute [TreatReturnedNullStringAs=Undefined] DOMString effectAllowed;
-        readonly attribute DOMStringList types;
+        readonly attribute [CustomGetter] Array types;
         readonly attribute FileList files;
 
         [Custom] void clearData(in [Optional] DOMString type)
             raises(DOMException);
-        [Custom] void getData(in DOMString type)
-            raises(DOMException);
+        DOMString getData(in DOMString type);
         boolean setData(in DOMString type, in DOMString data);
         [Custom] void setDragImage(in HTMLImageElement image, in long x, in long y)
             raises(DOMException);
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index 0a81c6dea..4916eb1fb 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -69,7 +69,7 @@ static inline void collectNodes(Node* node, NodeVector& nodes)
 
 static void collectTargetNodes(Node* node, NodeVector& nodes)
 {
-    if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE || node->isShadowRoot()) {
+    if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) {
         nodes.append(node);
         return;
     }
@@ -240,10 +240,6 @@ void ContainerNode::parserInsertBefore(PassRefPtr<Node> newChild, Node* nextChil
     for (NodeVector::const_iterator it = targets.begin(); it != targets.end(); ++it) {
         Node* child = it->get();
 
-#if ENABLE(INSPECTOR)
-        InspectorInstrumentation::willInsertDOMNode(document(), child, this);
-#endif
-
         insertBeforeCommon(next.get(), child);
 
         childrenChanged(true, nextChildPreviousSibling.get(), nextChild, 1);
@@ -375,11 +371,14 @@ void ContainerNode::willRemove()
 {
     RefPtr<Node> protect(this);
 
-    for (RefPtr<Node> child = firstChild(); child; child = child->nextSibling()) {
-        if (child->parentNode() != this) // Check for child being removed from subtree while removing.
-            break;
-        child->willRemove();
+    NodeVector children;
+    collectNodes(this, children);
+    for (size_t i = 0; i < children.size(); ++i) {
+        if (children[i]->parentNode() != this) // Check for child being removed from subtree while removing.
+            continue;
+        children[i]->willRemove();
     }
+
     Node::willRemove();
 }
 
@@ -387,7 +386,6 @@ static void willRemoveChild(Node* child)
 {
     // update auxiliary doc info (e.g. iterators) to note that node is being removed
     child->document()->nodeWillBeRemoved(child);
-    child->document()->incDOMTreeVersion();
 
     // fire removed from document mutation events.
     dispatchChildRemovalEvents(child);
@@ -397,7 +395,6 @@ static void willRemoveChild(Node* child)
 static void willRemoveChildren(ContainerNode* container)
 {
     container->document()->nodeChildrenWillBeRemoved(container);
-    container->document()->incDOMTreeVersion();
 
     NodeVector children;
     collectNodes(container, children);
@@ -451,7 +448,6 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
     document()->removeFullScreenElementOfSubtree(child.get());
 #endif
 
-
     // Events fired when blurring currently focused node might have moved this
     // child into a different parent.
     if (child->parentNode() != this) {
@@ -467,8 +463,8 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
 
     if (child->inDocument())
         child->removedFromDocument();
-    else
-        child->removedFromTree(true);
+    else if (child->isContainerNode())
+        toContainerNode(child.get())->removedFromTree(true);
 
     dispatchSubtreeModifiedEvent();
 
@@ -517,8 +513,8 @@ void ContainerNode::parserRemoveChild(Node* oldChild)
     childrenChanged(true, prev, next, -1);
     if (oldChild->inDocument())
         oldChild->removedFromDocument();
-    else
-        oldChild->removedFromTree(true);
+    else if (oldChild->isContainerNode())
+        toContainerNode(oldChild)->removedFromTree(true);
 }
 
 // this differs from other remove functions because it forcibly removes all the children,
@@ -577,20 +573,17 @@ void ContainerNode::removeChildren()
             removedChild->detach();
     }
 
-    // FIXME: This should be just above dispatchSubtreeModifiedEvent();
-    allowEventDispatch();
-
     childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
 
     for (i = 0; i < removedChildrenCount; ++i) {
         Node* removedChild = removedChildren[i].get();
         if (removedChild->inDocument())
             removedChild->removedFromDocument();
-        // removeChild() calls removedFromTree(true) if the child was not in the
-        // document. There is no explanation for this discrepancy between removeChild()
-        // and its optimized version removeChildren().
+        else if (removedChild->isContainerNode())
+            toContainerNode(removedChild)->removedFromTree(true);
     }
 
+    allowEventDispatch();
     dispatchSubtreeModifiedEvent();
 }
 
@@ -682,10 +675,6 @@ void ContainerNode::parserAddChild(PassRefPtr<Node> newChild)
     ASSERT(newChild);
     ASSERT(!newChild->parentNode()); // Use appendChild if you need to handle reparenting (and want DOM mutation events).
 
-#if ENABLE(INSPECTOR)
-    InspectorInstrumentation::willInsertDOMNode(document(), newChild.get(), this);
-#endif
-
     forbidEventDispatch();
     Node* last = m_lastChild;
     // FIXME: This method should take a PassRefPtr.
@@ -695,7 +684,6 @@ void ContainerNode::parserAddChild(PassRefPtr<Node> newChild)
     allowEventDispatch();
 
     // FIXME: Why doesn't this use notifyChildInserted(newChild) instead?
-    document()->incDOMTreeVersion();
     if (inDocument())
         newChild->insertedIntoDocument();
     childrenChanged(true, last, 0, 1);
@@ -775,15 +763,13 @@ void ContainerNode::scheduleSetNeedsStyleRecalc(StyleChangeType changeType)
 
 void ContainerNode::attach()
 {
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
-        child->attach();
+    attachChildren();
     Node::attach();
 }
 
 void ContainerNode::detach()
 {
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
-        child->detach();
+    detachChildren();
     clearChildNeedsStyleRecalc();
     Node::detach();
 }
@@ -795,13 +781,17 @@ void ContainerNode::insertedIntoDocument()
     Node::insertedIntoDocument();
     insertedIntoTree(false);
 
-    for (RefPtr<Node> child = m_firstChild; child; child = child->nextSibling()) {
-        // Guard against mutation during re-parenting.
-        if (!inDocument()) // Check for self being removed from document while reparenting.
-            break;
-        if (child->parentNode() != this) // Check for child being removed from subtree while reparenting.
+    NodeVector children;
+    collectNodes(this, children);
+    for (size_t i = 0; i < children.size(); ++i) {
+        // If we have been removed from the document during this loop, then
+        // we don't want to tell the rest of our children that they've been
+        // inserted into the document because they haven't.
+        if (!inDocument())
             break;
-        child->insertedIntoDocument();
+        if (children[i]->parentNode() != this)
+            continue;
+        children[i]->insertedIntoDocument();
     }
 }
 
@@ -810,31 +800,45 @@ void ContainerNode::removedFromDocument()
     Node::removedFromDocument();
     if (document()->cssTarget() == this) 
         document()->setCSSTarget(0); 
-    clearInDocument();
     removedFromTree(false);
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
-        child->removedFromDocument();
+
+    NodeVector children;
+    collectNodes(this, children);
+    for (size_t i = 0; i < children.size(); ++i) {
+        // If we have been added to the document during this loop, then we
+        // don't want to tell the rest of our children that they've been
+        // removed from the document because they haven't.
+        if (inDocument())
+            break;
+        if (children[i]->parentNode() != this)
+            continue;
+        children[i]->removedFromDocument();
+    }
 }
 
 void ContainerNode::insertedIntoTree(bool deep)
 {
     if (!deep)
         return;
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
-        child->insertedIntoTree(true);
+    for (Node* child = m_firstChild; child; child = child->nextSibling()) {
+        if (child->isContainerNode())
+            toContainerNode(child)->insertedIntoTree(true);
+    }
 }
 
 void ContainerNode::removedFromTree(bool deep)
 {
     if (!deep)
         return;
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
-        child->removedFromTree(true);
+    for (Node* child = m_firstChild; child; child = child->nextSibling()) {
+        if (child->isContainerNode())
+            toContainerNode(child)->removedFromTree(true);
+    }
 }
 
-void ContainerNode::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+void ContainerNode::childrenChanged(bool changedByParser, Node*, Node*, int childCountDelta)
 {
-    Node::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    document()->incDOMTreeVersion();
     if (!changedByParser && childCountDelta)
         document()->updateRangesAfterChildrenChanged(this);
     invalidateNodeListsCacheAfterChildrenChanged();
@@ -1093,14 +1097,15 @@ static void notifyChildInserted(Node* child)
     Node* parentOrHostNode = c->parentOrHostNode();
     if (parentOrHostNode && parentOrHostNode->inDocument())
         c->insertedIntoDocument();
-    else
-        c->insertedIntoTree(true);
-
-    document->incDOMTreeVersion();
+    else if (c->isContainerNode())
+        toContainerNode(c.get())->insertedIntoTree(true);
 }
 
 static void dispatchChildInsertionEvents(Node* child)
 {
+    if (child->isInShadowTree())
+        return;
+
     ASSERT(!eventDispatchForbidden());
 
     RefPtr<Node> c = child;
@@ -1125,6 +1130,9 @@ static void dispatchChildInsertionEvents(Node* child)
 
 static void dispatchChildRemovalEvents(Node* child)
 {
+    if (child->isInShadowTree())
+        return;
+
     ASSERT(!eventDispatchForbidden());
 
 #if ENABLE(INSPECTOR)
diff --git a/Source/WebCore/dom/ContainerNode.h b/Source/WebCore/dom/ContainerNode.h
index 36a2f008c..e629e71eb 100644
--- a/Source/WebCore/dom/ContainerNode.h
+++ b/Source/WebCore/dom/ContainerNode.h
@@ -79,11 +79,29 @@ public:
     virtual void setHovered(bool = true) OVERRIDE;
     virtual void insertedIntoDocument() OVERRIDE;
     virtual void removedFromDocument() OVERRIDE;
-    virtual void insertedIntoTree(bool deep) OVERRIDE;
-    virtual void removedFromTree(bool deep) OVERRIDE;
-    virtual void childrenChanged(bool createdByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0) OVERRIDE;
     virtual void scheduleSetNeedsStyleRecalc(StyleChangeType = FullStyleChange) OVERRIDE;
 
+    // -----------------------------------------------------------------------------
+    // Notification of document structure changes (see Node.h for more notification methods)
+
+    // These functions are called whenever you are connected or disconnected from a tree. That tree may be the main
+    // document tree, or it could be another disconnected tree. Override these functions to do any work that depends
+    // on connectedness to some ancestor (e.g., an ancestor <form>).
+    virtual void insertedIntoTree(bool deep);
+    virtual void removedFromTree(bool deep);
+
+    // Notifies the node that it's list of children have changed (either by adding or removing child nodes), or a child
+    // node that is of the type CDATA_SECTION_NODE, TEXT_NODE or COMMENT_NODE has changed its value.
+    virtual void childrenChanged(bool createdByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+
+    void attachAsNode();
+    void attachChildren();
+    void attachChildrenIfNeeded();
+    void attachChildrenLazily();
+    void detachAsNode();
+    void detachChildren();
+    void detachChildrenIfNeeded();
+
 protected:
     ContainerNode(Document*, ConstructionType = CreateContainer);
 
@@ -136,6 +154,51 @@ inline ContainerNode::ContainerNode(Document* document, ConstructionType type)
 {
 }
 
+inline void ContainerNode::attachAsNode()
+{
+    Node::attach();
+}
+
+inline void ContainerNode::attachChildren()
+{
+    for (Node* child = firstChild(); child; child = child->nextSibling())
+        child->attach();
+}
+
+inline void ContainerNode::attachChildrenIfNeeded()
+{
+    for (Node* child = firstChild(); child; child = child->nextSibling()) {
+        if (!child->attached())
+            child->attach();
+    }
+}
+
+inline void ContainerNode::attachChildrenLazily()
+{
+    for (Node* child = firstChild(); child; child = child->nextSibling())
+        if (!child->attached())
+            child->lazyAttach();
+}
+
+inline void ContainerNode::detachAsNode()
+{
+    Node::detach();
+}
+
+inline void ContainerNode::detachChildrenIfNeeded()
+{
+    for (Node* child = firstChild(); child; child = child->nextSibling()) {
+        if (child->attached())
+            child->detach();
+    }
+}
+
+inline void ContainerNode::detachChildren()
+{
+    for (Node* child = firstChild(); child; child = child->nextSibling())
+        child->detach();
+}
+
 inline unsigned Node::childNodeCount() const
 {
     if (!isContainerNode())
diff --git a/Source/WebCore/platform/mac/PasteboardHelper.h b/Source/WebCore/dom/ContextDestructionObserver.cpp
index 6c1e844ea..2fdd556e3 100644
--- a/Source/WebCore/platform/mac/PasteboardHelper.h
+++ b/Source/WebCore/dom/ContextDestructionObserver.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -21,35 +21,38 @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
  */
 
-#ifndef PasteboardHelper_h
-#define PasteboardHelper_h
+#include "config.h"
+#include "ContextDestructionObserver.h"
 
-/* FIXME: This is a helper class used to provide access to functionality inside 
- * WebKit.  The required functionality should eventually be migrated to WebCore
- * so that this class can be removed.
- */
-#if PLATFORM(MAC)
+#include "ScriptExecutionContext.h"
 
-#import <wtf/Forward.h>
+namespace WebCore {
 
-OBJC_CLASS DOMDocumentFragment;
+ContextDestructionObserver::ContextDestructionObserver(ScriptExecutionContext* scriptExecutionContext)
+    : m_scriptExecutionContext(scriptExecutionContext)
+{
+    if (!m_scriptExecutionContext)
+        return;
 
-namespace WebCore {
+    ASSERT(m_scriptExecutionContext->isContextThread());
+    m_scriptExecutionContext->didCreateDestructionObserver(this);
+}
+
+ContextDestructionObserver::~ContextDestructionObserver()
+{
+    if (!m_scriptExecutionContext)
+        return;
+
+    ASSERT(m_scriptExecutionContext->isContextThread());
+    m_scriptExecutionContext->willDestroyDestructionObserver(this);
+}
 
-    class Document;
-    
-    class PasteboardHelper {
-    public:
-        virtual ~PasteboardHelper() {}
-        virtual String urlFromPasteboard(NSPasteboard*, String* title) const = 0;
-        virtual String plainTextFromPasteboard(NSPasteboard*) const = 0;
-        virtual DOMDocumentFragment* fragmentFromPasteboard(NSPasteboard*) const = 0;
-        virtual NSArray* insertablePasteboardTypes() const = 0;
-    };
-    
+void ContextDestructionObserver::contextDestroyed()
+{
+    m_scriptExecutionContext = 0;
 }
-#endif // PLATFORM(MAC)
 
-#endif // !PasteboardHelper_h
+} // namespace WebCore
diff --git a/Source/WebCore/dom/ContextDestructionObserver.h b/Source/WebCore/dom/ContextDestructionObserver.h
new file mode 100644
index 000000000..19a7a94b4
--- /dev/null
+++ b/Source/WebCore/dom/ContextDestructionObserver.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef ContextDestructionObserver_h
+#define ContextDestructionObserver_h
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class ContextDestructionObserver {
+public:
+    explicit ContextDestructionObserver(ScriptExecutionContext*);
+    virtual void contextDestroyed();
+
+    ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
+
+protected:
+    virtual ~ContextDestructionObserver();
+
+    ScriptExecutionContext* m_scriptExecutionContext;
+};
+
+} // namespace WebCore
+
+#endif // ContextDestructionObserver_h
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index 8ec4bfb6b..cd3dfd07f 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -43,6 +43,7 @@
 #include "Comment.cpp"
 #include "CompositionEvent.cpp"
 #include "ContainerNode.cpp"
+#include "ContextDestructionObserver.cpp"
 #include "CustomEvent.cpp"
 #include "DOMCoreException.cpp"
 #include "DOMImplementation.cpp"
@@ -117,7 +118,7 @@
 #include "SecurityContext.cpp"
 #include "SelectorQuery.cpp"
 #include "ShadowRoot.cpp"
-#include "ShadowRootList.cpp"
+#include "ShadowTree.cpp"
 #include "SpaceSplitString.cpp"
 #include "StaticHashSetNodeList.cpp"
 #include "StaticNodeList.cpp"
diff --git a/Source/WebCore/dom/DOMImplementation.cpp b/Source/WebCore/dom/DOMImplementation.cpp
index ae6d3665c..40197b322 100644
--- a/Source/WebCore/dom/DOMImplementation.cpp
+++ b/Source/WebCore/dom/DOMImplementation.cpp
@@ -399,13 +399,8 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame
         return TextDocument::create(frame, url);
 
 #if ENABLE(SVG)
-    if (type == "image/svg+xml") {
-#if ENABLE(DASHBOARD_SUPPORT)    
-        Settings* settings = frame ? frame->settings() : 0;
-        if (!settings || !settings->usesDashboardBackwardCompatibilityMode())
-#endif
-            return SVGDocument::create(frame, url);
-    }
+    if (type == "image/svg+xml")
+        return SVGDocument::create(frame, url);
 #endif
     if (isXMLMIMEType(type))
         return Document::create(frame, url);
diff --git a/Source/WebCore/dom/DOMStringList.cpp b/Source/WebCore/dom/DOMStringList.cpp
index 430265adb..bcc0d23ba 100644
--- a/Source/WebCore/dom/DOMStringList.cpp
+++ b/Source/WebCore/dom/DOMStringList.cpp
@@ -48,4 +48,9 @@ bool DOMStringList::contains(const String& string) const
     return false;
 }
 
+void DOMStringList::sort()
+{
+    std::sort(m_strings.begin(), m_strings.end(), WTF::codePointCompareLessThan);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DOMStringList.h b/Source/WebCore/dom/DOMStringList.h
index 6719f179a..057dac49e 100644
--- a/Source/WebCore/dom/DOMStringList.h
+++ b/Source/WebCore/dom/DOMStringList.h
@@ -45,6 +45,7 @@ public:
     bool isEmpty() const { return m_strings.isEmpty(); }
     void clear() { m_strings.clear(); }
     void append(const String& string) { m_strings.append(string); }
+    void sort();
 
     // Implements the IDL.
     size_t length() const { return m_strings.size(); }
diff --git a/Source/WebCore/dom/DeviceMotionController.cpp b/Source/WebCore/dom/DeviceMotionController.cpp
index 79eacc5e9..b988365d7 100644
--- a/Source/WebCore/dom/DeviceMotionController.cpp
+++ b/Source/WebCore/dom/DeviceMotionController.cpp
@@ -150,7 +150,7 @@ bool DeviceMotionController::isActiveAt(Page* page)
 
 void provideDeviceMotionTo(Page* page, DeviceMotionClient* client)
 {
-    PageSupplement::provideTo(page, DeviceMotionController::supplementName(), DeviceMotionController::create(client));
+    DeviceMotionController::provideTo(page, DeviceMotionController::supplementName(), DeviceMotionController::create(client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DeviceMotionController.h b/Source/WebCore/dom/DeviceMotionController.h
index 996c98861..1c1f6fcba 100644
--- a/Source/WebCore/dom/DeviceMotionController.h
+++ b/Source/WebCore/dom/DeviceMotionController.h
@@ -27,7 +27,7 @@
 #define DeviceMotionController_h
 
 #include "DOMWindow.h"
-#include "PageSupplement.h"
+#include "Page.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
 
@@ -36,7 +36,7 @@ namespace WebCore {
 class DeviceMotionData;
 class DeviceMotionClient;
 
-class DeviceMotionController : public PageSupplement {
+class DeviceMotionController : public Supplement<Page> {
 public:
     ~DeviceMotionController();
 
@@ -54,8 +54,7 @@ public:
     bool isActive() { return !m_listeners.isEmpty(); }
 
     static const AtomicString& supplementName();
-    static DeviceMotionController* from(Frame* frame) { return static_cast<DeviceMotionController*>(PageSupplement::from(frame, supplementName())); }
-    static DeviceMotionController* from(Page* page) { return static_cast<DeviceMotionController*>(PageSupplement::from(page, supplementName())); }
+    static DeviceMotionController* from(Page* page) { return static_cast<DeviceMotionController*>(Supplement<Page>::from(page, supplementName())); }
     static bool isActiveAt(Page*);
 
 private:
diff --git a/Source/WebCore/dom/DeviceOrientationController.cpp b/Source/WebCore/dom/DeviceOrientationController.cpp
index d298b3f44..eae6fb50a 100644
--- a/Source/WebCore/dom/DeviceOrientationController.cpp
+++ b/Source/WebCore/dom/DeviceOrientationController.cpp
@@ -152,7 +152,7 @@ bool DeviceOrientationController::isActiveAt(Page* page)
 
 void provideDeviceOrientationTo(Page* page, DeviceOrientationClient* client)
 {
-    PageSupplement::provideTo(page, DeviceOrientationController::supplementName(), DeviceOrientationController::create(page, client));
+    DeviceOrientationController::provideTo(page, DeviceOrientationController::supplementName(), DeviceOrientationController::create(page, client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DeviceOrientationController.h b/Source/WebCore/dom/DeviceOrientationController.h
index d8efaca39..707cd5cb6 100644
--- a/Source/WebCore/dom/DeviceOrientationController.h
+++ b/Source/WebCore/dom/DeviceOrientationController.h
@@ -27,7 +27,7 @@
 #define DeviceOrientationController_h
 
 #include "DOMWindow.h"
-#include "PageSupplement.h"
+#include "Page.h"
 #include "Timer.h"
 
 #include <wtf/HashCountedSet.h>
@@ -36,9 +36,8 @@ namespace WebCore {
 
 class DeviceOrientation;
 class DeviceOrientationClient;
-class Page;
 
-class DeviceOrientationController : public PageSupplement {
+class DeviceOrientationController : public Supplement<Page> {
 public:
     ~DeviceOrientationController();
 
@@ -58,8 +57,7 @@ public:
     DeviceOrientationClient* client() const { return m_client; }
 
     static const AtomicString& supplementName();
-    static DeviceOrientationController* from(Frame* frame) { return static_cast<DeviceOrientationController*>(PageSupplement::from(frame, supplementName())); }
-    static DeviceOrientationController* from(Page* page) { return static_cast<DeviceOrientationController*>(PageSupplement::from(page, supplementName())); }
+    static DeviceOrientationController* from(Page* page) { return static_cast<DeviceOrientationController*>(Supplement<Page>::from(page, supplementName())); }
     static bool isActiveAt(Page*);
 
 private:
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index e85d22f2c..809f99041 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -33,6 +33,7 @@
 #include "Attr.h"
 #include "Attribute.h"
 #include "CDATASection.h"
+#include "CSSParser.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
@@ -141,7 +142,7 @@
 #include "SegmentedString.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "StaticHashSetNodeList.h"
 #include "StyleSheetList.h"
 #include "TextResourceDecoder.h"
@@ -379,7 +380,7 @@ private:
 uint64_t Document::s_globalTreeVersion = 0;
 
 Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
-    : ContainerNode(0)
+    : ContainerNode(0, CreateDocument)
     , TreeScope(this)
     , m_guardRefCount(0)
     , m_compatibilityMode(NoQuirksMode)
@@ -419,7 +420,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_isHTML(isHTML)
     , m_isViewSource(false)
     , m_sawElementsInKnownNamespaces(false)
-    , m_usingGeolocation(false)
     , m_eventQueue(DocumentEventQueue::create(this))
     , m_weakReference(DocumentWeakReference::create(this))
     , m_idAttributeName(idAttr)
@@ -471,7 +471,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
 
     m_textColor = Color::black;
     m_listenerTypes = 0;
-    setInDocument();
     m_inStyleRecalc = false;
     m_closeAfterStyleRecalc = false;
 
@@ -507,9 +506,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     static int docID = 0;
     m_docID = docID++;
     
-#ifndef NDEBUG
-    m_updatingStyleSelector = false;
-#endif
     InspectorCounters::incrementCounter(InspectorCounters::DocumentCounter);
 }
 
@@ -673,7 +669,7 @@ void Document::buildAccessKeyMap(TreeScope* scope)
             m_elementsByAccessKey.set(accessKey.impl(), element);
 
         if (element->hasShadowRoot()) {
-            for (ShadowRoot* root = element->shadowRootList()->youngestShadowRoot(); root; root = root->olderShadowRoot())
+            for (ShadowRoot* root = element->shadowTree()->youngestShadowRoot(); root; root = root->olderShadowRoot())
                 buildAccessKeyMap(root);
         }
     }
@@ -833,11 +829,7 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
 {
     ec = 0;
     
-    if (!importedNode
-#if ENABLE(SVG) && ENABLE(DASHBOARD_SUPPORT)
-        || (importedNode->isSVGElement() && page() && page()->settings()->usesDashboardBackwardCompatibilityMode())
-#endif
-        ) {
+    if (!importedNode) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
@@ -1028,12 +1020,27 @@ bool Document::cssRegionsEnabled() const
     return settings() && settings()->cssRegionsEnabled(); 
 }
 
+static bool validFlowName(const String& flowName)
+{
+    if (equalIgnoringCase(flowName, "auto")
+        || equalIgnoringCase(flowName, "default")
+        || equalIgnoringCase(flowName, "inherit")
+        || equalIgnoringCase(flowName, "initial")
+        || equalIgnoringCase(flowName, "none"))
+        return false;
+    return true;
+}
+
 PassRefPtr<WebKitNamedFlow> Document::webkitGetFlowByName(const String& flowName)
 {
-    if (!cssRegionsEnabled())
+    if (!cssRegionsEnabled() || flowName.isEmpty() || !validFlowName(flowName) || !renderer())
         return 0;
-    if (!renderer())
+
+    // Make a slower check for invalid flow name
+    CSSParser p(true);
+    if (!p.parseFlowThread(flowName, this))
         return 0;
+
     if (RenderView* view = renderer()->view())
         return view->ensureRenderFlowThreadWithName(flowName)->ensureNamedFlow();
     return 0;
@@ -1851,7 +1858,6 @@ void Document::createStyleSelector()
     
 inline void Document::clearStyleSelector()
 {
-    ASSERT(!m_updatingStyleSelector);
     m_styleSelector.clear();
 }
 
@@ -2279,6 +2285,9 @@ void Document::implicitClose()
     ImageLoader::dispatchPendingBeforeLoadEvents();
     ImageLoader::dispatchPendingLoadEvents();
 
+    HTMLLinkElement::dispatchPendingLoadEvents();
+    HTMLStyleElement::dispatchPendingLoadEvents();
+
 #if ENABLE(SVG)
     // To align the HTML load event and the SVGLoad event for the outermost <svg> element, fire it from
     // here, instead of doing it from SVGElement::finishedParsingChildren (if externalResourcesRequired="false",
@@ -3042,20 +3051,21 @@ void Document::styleSelectorChanged(StyleSelectorUpdateFlag updateFlag)
 #endif
 
     bool stylesheetChangeRequiresStyleRecalc = updateActiveStylesheets(updateFlag);
-    if (!stylesheetChangeRequiresStyleRecalc)
-        return;
 
     if (updateFlag == DeferRecalcStyle) {
         scheduleForcedStyleRecalc();
         return;
     }
-    
+
     if (didLayoutWithPendingStylesheets() && m_pendingStylesheets <= 0) {
         m_pendingSheetLayout = IgnoreLayoutWithPendingSheets;
         if (renderer())
             renderer()->repaint();
     }
 
+    if (!stylesheetChangeRequiresStyleRecalc)
+        return;
+
     // This recalcStyle initiates a new recalc cycle. We need to bracket it to
     // make sure animations get the correct update time
     if (m_frame)
@@ -3290,8 +3300,6 @@ void Document::analyzeStylesheetChange(StyleSelectorUpdateFlag updateFlag, const
 
 bool Document::updateActiveStylesheets(StyleSelectorUpdateFlag updateFlag)
 {
-    ASSERT(!m_updatingStyleSelector);
-
     if (m_inStyleRecalc) {
         // SVG <use> element may manage to invalidate style selector in the middle of a style recalc.
         // https://bugs.webkit.org/show_bug.cgi?id=54344
@@ -3313,16 +3321,7 @@ bool Document::updateActiveStylesheets(StyleSelectorUpdateFlag updateFlag)
     if (requiresStyleSelectorReset)
         clearStyleSelector();
     else {
-#ifndef NDEBUG
-        m_updatingStyleSelector = true;
-#endif
-        // Detach the style selector temporarily so it can't get deleted during appendAuthorStylesheets
-        OwnPtr<CSSStyleSelector> detachedStyleSelector = m_styleSelector.release();
-        detachedStyleSelector->appendAuthorStylesheets(m_styleSheets->length(), newStylesheets);
-        m_styleSelector = detachedStyleSelector.release();
-#ifndef NDEBUG
-        m_updatingStyleSelector = false;
-#endif
+        m_styleSelector->appendAuthorStylesheets(m_styleSheets->length(), newStylesheets);
         resetCSSFeatureFlags();
     }
     m_styleSheets->swap(newStylesheets);
@@ -4751,24 +4750,6 @@ void Document::setSecurityOrigin(PassRefPtr<SecurityOrigin> origin)
     SecurityContext::setSecurityOrigin(origin);
 }
 
-#if ENABLE(SQL_DATABASE)
-
-bool Document::allowDatabaseAccess() const
-{
-    if (!page() || (page()->settings()->privateBrowsingEnabled() && !SchemeRegistry::allowsDatabaseAccessInPrivateBrowsing(securityOrigin()->protocol())))
-        return false;
-    return true;
-}
-
-void Document::databaseExceededQuota(const String& name)
-{
-    Page* currentPage = page();
-    if (currentPage)
-        currentPage->chrome()->client()->exceededDatabaseQuota(document()->frame(), name);
-}
-
-#endif
-
 bool Document::isContextThread() const
 {
     return isMainThread();
@@ -5130,28 +5111,12 @@ void Document::webkitWillEnterFullScreenForElement(Element* element)
     m_fullScreenElement->setContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(true);
     
     recalcStyle(Force);
-    
-    if (m_fullScreenRenderer) {
-        setAnimatingFullScreen(true);
-#if USE(ACCELERATED_COMPOSITING)
-        view()->updateCompositingLayers();
-        if (m_fullScreenRenderer->layer() && m_fullScreenRenderer->layer()->isComposited())
-            page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
-#endif
-    }
 }
     
 void Document::webkitDidEnterFullScreenForElement(Element*)
 {
     m_fullScreenElement->didBecomeFullscreenElement();
 
-    if (m_fullScreenRenderer) {
-        setAnimatingFullScreen(false);
-#if USE(ACCELERATED_COMPOSITING)
-        view()->updateCompositingLayers();
-        page()->chrome()->client()->setRootFullScreenLayer(0);
-#endif
-    }
     m_fullScreenChangeEventTargetQueue.append(m_fullScreenElement);
     m_fullScreenChangeDelayTimer.startOneShot(0);
 }
@@ -5161,29 +5126,16 @@ void Document::webkitWillExitFullScreenForElement(Element*)
     m_fullScreenElement->setContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(false);
     
     m_fullScreenElement->willStopBeingFullscreenElement();
-
-    if (m_fullScreenRenderer) {
-        setAnimatingFullScreen(true);
-#if USE(ACCELERATED_COMPOSITING)
-        view()->updateCompositingLayers();
-        if (m_fullScreenRenderer->layer() && m_fullScreenRenderer->layer()->isComposited())
-            page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
-#endif
-    }
 }
 
 void Document::webkitDidExitFullScreenForElement(Element*)
 {
     m_areKeysEnabledInFullScreen = false;
-    setAnimatingFullScreen(false);
     
     if (m_fullScreenRenderer)
         m_fullScreenRenderer->unwrapRenderer();
 
     m_fullScreenChangeEventTargetQueue.append(m_fullScreenElement.release());
-#if USE(ACCELERATED_COMPOSITING)
-    page()->chrome()->client()->setRootFullScreenLayer(0);
-#endif
     scheduleForcedStyleRecalc();
     
     m_fullScreenChangeDelayTimer.startOneShot(0);
@@ -5310,15 +5262,6 @@ void Document::setAnimatingFullScreen(bool flag)
         m_fullScreenElement->setNeedsStyleRecalc();
         scheduleForcedStyleRecalc();
     }
-
-#if USE(ACCELERATED_COMPOSITING)
-    if (m_fullScreenRenderer && m_fullScreenRenderer->layer()) {
-        m_fullScreenRenderer->layer()->contentChanged(RenderLayer::FullScreenChanged);
-        // Clearing the layer's backing will force the compositor to reparent
-        // the layer the next time layers are synchronized.
-        m_fullScreenRenderer->layer()->clearBacking();
-    }
-#endif
 }
 #endif
 
@@ -5478,7 +5421,6 @@ void Document::removeCachedMicroDataItemList(MicroDataItemList* list, const Stri
 {
     ASSERT(rareData());
     ASSERT(rareData()->nodeLists());
-    ASSERT_UNUSED(list, list->hasOwnCaches());
 
     NodeListsNodeData* data = rareData()->nodeLists();
 
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index 772e4cd6b..1e305d460 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -1028,17 +1028,9 @@ public:
     bool processingLoadEvent() const { return m_processingLoadEvent; }
     bool loadEventFinished() const { return m_loadEventFinished; }
 
-#if ENABLE(SQL_DATABASE)
-    virtual bool allowDatabaseAccess() const;
-    virtual void databaseExceededQuota(const String& name);
-#endif
-
     virtual bool isContextThread() const;
     virtual bool isJSExecutionForbidden() const { return false; }
 
-    void setUsingGeolocation(bool f) { m_usingGeolocation = f; }
-    bool usingGeolocation() const { return m_usingGeolocation; };
-
     bool containsValidityStyleRules() const { return m_containsValidityStyleRules; }
     void setContainsValidityStyleRules() { m_containsValidityStyleRules = true; }
 
@@ -1417,8 +1409,6 @@ private:
     bool m_isViewSource;
     bool m_sawElementsInKnownNamespaces;
 
-    bool m_usingGeolocation;
-
     RefPtr<DocumentEventQueue> m_eventQueue;
 
     RefPtr<DocumentWeakReference> m_weakReference;
@@ -1462,11 +1452,7 @@ private:
 #endif
 
     Timer<Document> m_pendingTasksTimer;
-    Vector<OwnPtr<Task> > m_pendingTasks;
-    
-#ifndef NDEBUG
-    bool m_updatingStyleSelector;
-#endif
+    Vector<OwnPtr<Task> > m_pendingTasks;    
 };
 
 // Put these methods here, because they require the Document definition, but we really want to inline them.
diff --git a/Source/WebCore/dom/DocumentType.h b/Source/WebCore/dom/DocumentType.h
index 8fd11f035..fd6c89124 100644
--- a/Source/WebCore/dom/DocumentType.h
+++ b/Source/WebCore/dom/DocumentType.h
@@ -37,6 +37,7 @@ public:
         return adoptRef(new DocumentType(document, name, publicId, systemId));
     }
 
+    // FIXME: We never fill m_entities and m_notations. Current implementation of NamedNodeMap doesn't work without an associated Element yet.
     NamedNodeMap* entities() const { return m_entities.get(); }
     NamedNodeMap* notations() const { return m_notations.get(); }
 
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 1b4d839db..cdb17b6b4 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -52,6 +52,7 @@
 #include "InspectorInstrumentation.h"
 #include "MutationObserverInterestGroup.h"
 #include "MutationRecord.h"
+#include "NamedNodeMap.h"
 #include "NodeList.h"
 #include "NodeRenderStyle.h"
 #include "NodeRenderingContext.h"
@@ -60,6 +61,7 @@
 #include "RenderRegion.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
+#include "RuntimeEnabledFeatures.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
 #include "Text.h"
@@ -93,7 +95,7 @@ public:
         if (m_pushedStyleSelector)
             return;
         m_pushedStyleSelector = m_parent->document()->styleSelector();
-        m_pushedStyleSelector->pushParent(m_parent);
+        m_pushedStyleSelector->pushParentElement(m_parent);
     }
     ~StyleSelectorParentPusher() 
     {
@@ -107,7 +109,7 @@ public:
         if (m_pushedStyleSelector != m_parent->document()->styleSelector())
             return;
 
-        m_pushedStyleSelector->popParent(m_parent); 
+        m_pushedStyleSelector->popParentElement(m_parent); 
     }
 
 private:
@@ -122,9 +124,10 @@ PassRefPtr<Element> Element::create(const QualifiedName& tagName, Document* docu
 
 Element::~Element()
 {
-    removeShadowRoot();
-    if (m_attributeMap)
-        m_attributeMap->detachFromElement();
+    if (shadowTree())
+        rareData()->m_shadowTree.clear();
+    if (m_attributeData)
+        m_attributeData->clearAttributes();
 }
 
 inline ElementRareData* Element::rareData() const
@@ -184,10 +187,9 @@ void Element::copyNonAttributeProperties(const Element*)
 
 void Element::removeAttribute(const QualifiedName& name)
 {
-    if (!m_attributeMap)
+    if (!attributeData())
         return;
-
-    m_attributeMap->removeAttribute(name);
+    attributeData()->removeAttribute(name, this);
 }
 
 void Element::setBooleanAttribute(const QualifiedName& name, bool value)
@@ -198,6 +200,17 @@ void Element::setBooleanAttribute(const QualifiedName& name, bool value)
         removeAttribute(name);
 }
 
+NamedNodeMap* Element::attributes() const
+{
+    ensureUpdatedAttributeData();
+    ElementRareData* rareData = const_cast<Element*>(this)->ensureRareData();
+    if (NamedNodeMap* attributeMap = rareData->m_attributeMap.get())
+        return attributeMap;
+
+    rareData->m_attributeMap = NamedNodeMap::create(const_cast<Element*>(this));
+    return rareData->m_attributeMap.get();
+}
+
 Node::NodeType Element::nodeType() const
 {
     return ELEMENT_NODE;
@@ -218,8 +231,8 @@ const AtomicString& Element::getAttribute(const QualifiedName& name) const
         updateAnimatedSVGAttribute(name);
 #endif
 
-    if (m_attributeMap) {
-        if (Attribute* attribute = m_attributeMap->getAttributeItem(name))
+    if (m_attributeData) {
+        if (Attribute* attribute = getAttributeItem(name))
             return attribute->value();
     }
     return nullAtom;
@@ -595,8 +608,8 @@ const AtomicString& Element::getAttribute(const String& name) const
     }
 #endif
 
-    if (m_attributeMap) {
-        if (Attribute* attribute = m_attributeMap->getAttributeItem(name, ignoreCase))
+    if (m_attributeData) {
+        if (Attribute* attribute = m_attributeData->getAttributeItem(name, ignoreCase))
             return attribute->value();
     }
 
@@ -622,38 +635,41 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
     setAttributeInternal(index, qName, value);
 }
 
-void Element::setAttribute(const QualifiedName& name, const AtomicString& value)
+void Element::setAttribute(const QualifiedName& name, const AtomicString& value, bool notifyChanged)
 {
-    setAttributeInternal(ensureUpdatedAttributeData()->getAttributeItemIndex(name), name, value);
+    setAttributeInternal(ensureUpdatedAttributeData()->getAttributeItemIndex(name), name, value, notifyChanged);
 }
 
-inline void Element::setAttributeInternal(size_t index, const QualifiedName& name, const AtomicString& value)
+inline void Element::setAttributeInternal(size_t index, const QualifiedName& name, const AtomicString& value, bool notifyChanged)
 {
-    ElementAttributeData* attributeData = &m_attributeMap->m_attributeData;
-    Attribute* old = index != notFound ? attributeData->attributeItem(index) : 0;
+    Attribute* old = index != notFound ? m_attributeData->attributeItem(index) : 0;
     if (value.isNull()) {
         if (old)
-            attributeData->removeAttribute(index, this);
+            m_attributeData->removeAttribute(index, this);
         return;
     }
 
     if (!old) {
-        attributeData->addAttribute(Attribute::create(name, value), this);
+        m_attributeData->addAttribute(Attribute::create(name, value), this);
         return;
     }
 
-    willModifyAttribute(name, old ? old->value() : nullAtom, value);
+    if (notifyChanged)
+        willModifyAttribute(name, old ? old->value() : nullAtom, value);
 
     if (Attr* attrNode = old->attr())
         attrNode->setValue(value);
     else
         old->setValue(value);
 
-    didModifyAttribute(old);
+    if (notifyChanged)
+        didModifyAttribute(old);
 }
 
 void Element::attributeChanged(Attribute* attr)
 {
+    document()->incDOMTreeVersion();
+
     if (isIdAttributeName(attr->name()))
         idAttributeChanged(attr);
     else if (attr->name() == HTMLNames::nameAttr)
@@ -723,48 +739,59 @@ static bool isAttributeToRemove(const QualifiedName& name, const AtomicString& v
     return (name.localName().endsWith(hrefAttr.localName()) || name == srcAttr || name == actionAttr) && protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(value));       
 }
 
-void Element::parserSetAttributeMap(PassOwnPtr<NamedNodeMap> list, FragmentScriptingPermission scriptingPermission)
+void Element::parserSetAttributes(PassOwnPtr<AttributeVector> attributeVector, FragmentScriptingPermission scriptingPermission)
 {
     ASSERT(!inDocument());
     ASSERT(!parentNode());
 
-    document()->incDOMTreeVersion();
+    ASSERT(!m_attributeData);
+
+    if (!attributeVector)
+        return;
 
-    ASSERT(!m_attributeMap);
-    m_attributeMap = list;
-
-    if (m_attributeMap) {
-        ElementAttributeData* attributeData = &m_attributeMap->m_attributeData;
-        m_attributeMap->m_element = this;
-        // If the element is created as result of a paste or drag-n-drop operation
-        // we want to remove all the script and event handlers.
-        if (scriptingPermission == FragmentScriptingNotAllowed) {
-            unsigned i = 0;
-            while (i < m_attributeMap->length()) {
-                const QualifiedName& attributeName = attributeData->m_attributes[i]->name();
-                if (isEventHandlerAttribute(attributeName)) {
-                    attributeData->m_attributes.remove(i);
-                    continue;
-                }
-
-                if (isAttributeToRemove(attributeName, attributeData->m_attributes[i]->value()))
-                    attributeData->m_attributes[i]->setValue(nullAtom);
-                i++;
+    createAttributeData();
+    m_attributeData->m_attributes.swap(*attributeVector);
+
+    // If the element is created as result of a paste or drag-n-drop operation
+    // we want to remove all the script and event handlers.
+    if (scriptingPermission == FragmentScriptingNotAllowed) {
+        unsigned i = 0;
+        while (i < m_attributeData->length()) {
+            const QualifiedName& attributeName = m_attributeData->m_attributes[i]->name();
+            if (isEventHandlerAttribute(attributeName)) {
+                m_attributeData->m_attributes.remove(i);
+                continue;
             }
+
+            if (isAttributeToRemove(attributeName, m_attributeData->m_attributes[i]->value()))
+                m_attributeData->m_attributes[i]->setValue(nullAtom);
+            i++;
         }
-        // Store the set of attributes that changed on the stack in case
-        // attributeChanged mutates m_attributeMap.
-        Vector<RefPtr<Attribute> > attributes;
-        attributeData->copyAttributesToVector(attributes);
-        for (Vector<RefPtr<Attribute> >::iterator iter = attributes.begin(); iter != attributes.end(); ++iter)
-            attributeChanged(iter->get());
     }
+
+    // Store the set of attributes that changed on the stack in case
+    // attributeChanged mutates m_attributeData.
+    Vector<RefPtr<Attribute> > attributes;
+    m_attributeData->copyAttributesToVector(attributes);
+    for (Vector<RefPtr<Attribute> >::iterator iter = attributes.begin(); iter != attributes.end(); ++iter)
+        attributeChanged(iter->get());
 }
 
 bool Element::hasAttributes() const
 {
     updateInvalidAttributes();
-    return m_attributeMap && m_attributeMap->length();
+    return m_attributeData && m_attributeData->length();
+}
+
+bool Element::hasEquivalentAttributes(const Element* other) const
+{
+    ElementAttributeData* attributeData = updatedAttributeData();
+    ElementAttributeData* otherAttributeData = other->updatedAttributeData();
+    if (attributeData)
+        return attributeData->isEquivalent(otherAttributeData);
+    if (otherAttributeData)
+        return otherAttributeData->isEquivalent(attributeData);
+    return true;
 }
 
 String Element::nodeName() const
@@ -805,9 +832,9 @@ KURL Element::baseURI() const
     return KURL(parentBase, baseAttribute);
 }
 
-void Element::createAttributeMap() const
+void Element::createAttributeData() const
 {
-    m_attributeMap = NamedNodeMap::create(const_cast<Element*>(this));
+    m_attributeData = ElementAttributeData::create();
 }
 
 bool Element::isURLAttribute(Attribute*) const
@@ -847,8 +874,8 @@ void Element::willRemove()
     if (containsFullScreenElement())
         setContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(false);
 #endif
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->willRemove();
+    if (ShadowTree* tree = shadowTree())
+        tree->willRemove();
     ContainerNode::willRemove();
 }
 
@@ -857,17 +884,17 @@ void Element::insertedIntoDocument()
     // need to do superclass processing first so inDocument() is true
     // by the time we reach updateId
     ContainerNode::insertedIntoDocument();
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->insertedIntoDocument();
+    if (ShadowTree* tree = shadowTree())
+        tree->insertedIntoDocument();
 
-    if (m_attributeMap) {
+    if (m_attributeData) {
         if (hasID()) {
-            Attribute* idItem = m_attributeMap->getAttributeItem(document()->idAttributeName());
+            Attribute* idItem = getAttributeItem(document()->idAttributeName());
             if (idItem && !idItem->isNull())
                 updateId(nullAtom, idItem->value());
         }
         if (hasName()) {
-            Attribute* nameItem = m_attributeMap->getAttributeItem(HTMLNames::nameAttr);
+            Attribute* nameItem = getAttributeItem(HTMLNames::nameAttr);
             if (nameItem && !nameItem->isNull())
                 updateName(nullAtom, nameItem->value());
         }
@@ -876,22 +903,22 @@ void Element::insertedIntoDocument()
 
 void Element::removedFromDocument()
 {
-    if (m_attributeMap) {
+    if (m_attributeData) {
         if (hasID()) {
-            Attribute* idItem = m_attributeMap->getAttributeItem(document()->idAttributeName());
+            Attribute* idItem = getAttributeItem(document()->idAttributeName());
             if (idItem && !idItem->isNull())
                 updateId(idItem->value(), nullAtom);
         }
         if (hasName()) {
-            Attribute* nameItem = m_attributeMap->getAttributeItem(HTMLNames::nameAttr);
+            Attribute* nameItem = getAttributeItem(HTMLNames::nameAttr);
             if (nameItem && !nameItem->isNull())
                 updateName(nameItem->value(), nullAtom);
         }
     }
 
     ContainerNode::removedFromDocument();
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->removedFromDocument();
+    if (ShadowTree* tree = shadowTree())
+        tree->removedFromDocument();
 }
 
 void Element::insertedIntoTree(bool deep)
@@ -899,8 +926,8 @@ void Element::insertedIntoTree(bool deep)
     ContainerNode::insertedIntoTree(deep);
     if (!deep)
         return;
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->insertedIntoTree(true);
+    if (ShadowTree* tree = shadowTree())
+        tree->insertedIntoTree(true);
 
 #if ENABLE(FULLSCREEN_API)
     if (containsFullScreenElement() && parentElement() && !parentElement()->containsFullScreenElement())
@@ -913,8 +940,8 @@ void Element::removedFromTree(bool deep)
     ContainerNode::removedFromTree(deep);
     if (!deep)
         return;
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->removedFromTree(true);
+    if (ShadowTree* tree = shadowTree())
+        tree->removedFromTree(true);
 }
 
 void Element::attach()
@@ -926,18 +953,9 @@ void Element::attach()
     StyleSelectorParentPusher parentPusher(this);
 
     // When a shadow root exists, it does the work of attaching the children.
-    if (hasShadowRoot()) {
+    if (ShadowTree* tree = shadowTree()) {
         parentPusher.push();
-        shadowRootList()->attach();
-
-        // In a shadow tree, some of light children may be attached by 'content' element.
-        // However, when there is no content element or content element does not select
-        // all light children, we have to attach the rest of light children here.
-        for (Node* child = firstChild(); child; child = child->nextSibling()) {
-            if (!child->attached())
-                child->attach();
-        }
-        Node::attach();
+        tree->attachHost(this);
     } else {
         if (firstChild())
             parentPusher.push();
@@ -964,9 +982,11 @@ void Element::detach()
     cancelFocusAppearanceUpdate();
     if (hasRareData())
         rareData()->resetComputedStyle();
-    ContainerNode::detach();
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->detach();
+
+    if (ShadowTree* tree = shadowTree())
+        tree->detachHost(this);
+    else
+        ContainerNode::detach();
 
     RenderWidget::resumeWidgetHierarchyUpdates();
 }
@@ -1089,12 +1109,16 @@ void Element::recalcStyle(StyleChange change)
         } else if (styleChangeType() == SyntheticStyleChange)
              setRenderStyle(newStyle);
 
+        // If "rem" units are used anywhere in the document, and if the document element's font size changes, then go ahead and force font updating
+        // all the way down the tree. This is simpler than having to maintain a cache of objects (and such font size changes should be rare anyway).
+        if (document()->usesRemUnits() && document()->documentElement() == this && ch != NoChange && currentStyle && newStyle && currentStyle->fontSize() != newStyle->fontSize()) {
+            // Cached RenderStyles may depend on the rem units.
+            document()->styleSelector()->invalidateMatchedPropertiesCache();
+            change = Force;
+        }
+
         if (change != Force) {
-            // If "rem" units are used anywhere in the document, and if the document element's font size changes, then go ahead and force font updating
-            // all the way down the tree.  This is simpler than having to maintain a cache of objects (and such font size changes should be rare anyway).
-            if (document()->usesRemUnits() && ch != NoChange && currentStyle && newStyle && currentStyle->fontSize() != newStyle->fontSize() && document()->documentElement() == this)
-                change = Force;
-            else if (styleChangeType() >= FullStyleChange)
+            if (styleChangeType() >= FullStyleChange)
                 change = Force;
             else
                 change = ch;
@@ -1126,10 +1150,10 @@ void Element::recalcStyle(StyleChange change)
     }
     // FIXME: This does not care about sibling combinators. Will be necessary in XBL2 world.
     if (hasShadowRoot()) {
-        ShadowRootList* list = shadowRootList();
-        if (change >= Inherit || list->childNeedsStyleRecalc() || list->needsStyleRecalc()) {
+        ShadowTree* tree = shadowTree();
+        if (change >= Inherit || tree->childNeedsStyleRecalc() || tree->needsStyleRecalc()) {
             parentPusher.push();
-            list->recalcShadowTreeStyle(change);
+            tree->recalcShadowTreeStyle(change);
         }
     }
 
@@ -1142,93 +1166,36 @@ void Element::recalcStyle(StyleChange change)
 
 bool Element::hasShadowRoot() const
 {
-    if (ShadowRootList* list = shadowRootList())
-        return list->hasShadowRoot();
+    if (ShadowTree* tree = shadowTree())
+        return tree->hasShadowRoot();
     return false;
 }
 
-ShadowRootList* Element::shadowRootList() const
+ShadowTree* Element::shadowTree() const
 {
     if (!hasRareData())
         return 0;
 
-    return &rareData()->m_shadowRootList;
+    return rareData()->m_shadowTree.get();
 }
 
-static bool validateShadowRoot(Document* document, ShadowRoot* shadowRoot, ExceptionCode& ec)
+ShadowTree* Element::ensureShadowTree()
 {
-    if (!shadowRoot)
-        return true;
-
-    if (shadowRoot->shadowHost()) {
-        ec = HIERARCHY_REQUEST_ERR;
-        return false;
-    }
-
-    if (shadowRoot->document() != document) {
-        ec = WRONG_DOCUMENT_ERR;
-        return false;
-    }
+    if (ShadowTree* tree = ensureRareData()->m_shadowTree.get())
+        return tree;
 
-    return true;
-}
-
-void Element::setShadowRoot(PassRefPtr<ShadowRoot> shadowRoot, ExceptionCode& ec)
-{
-    if (!validateShadowRoot(document(), shadowRoot.get(), ec))
-        return;
-
-    if (!hasRareData())
-        ensureRareData();
-
-    removeShadowRoot();
-
-    shadowRoot->setShadowHost(this);
-    shadowRootList()->pushShadowRoot(shadowRoot.get());
-
-    if (inDocument())
-        shadowRoot->insertedIntoDocument();
-    if (attached()) {
-        shadowRoot->lazyAttach();
-        for (Node* child = firstChild(); child; child = child->nextSibling())
-            child->detach();
-    }
+    rareData()->m_shadowTree = adoptPtr(new ShadowTree());
+    return rareData()->m_shadowTree.get();
 }
 
 ShadowRoot* Element::ensureShadowRoot()
 {
     if (hasShadowRoot())
-        return shadowRootList()->oldestShadowRoot();
+        return shadowTree()->oldestShadowRoot();
 
     return ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot).get();
 }
 
-void Element::removeShadowRoot()
-{
-    if (!hasShadowRoot())
-        return;
-
-    while (RefPtr<ShadowRoot> oldRoot = shadowRootList()->popShadowRoot()) {
-        document()->removeFocusedNodeOfSubtree(oldRoot.get());
-
-        if (oldRoot->attached())
-            oldRoot->detach();
-
-        oldRoot->setShadowHost(0);
-        document()->adoptIfNeeded(oldRoot.get());
-        if (oldRoot->inDocument())
-            oldRoot->removedFromDocument();
-        else
-            oldRoot->removedFromTree(true);
-        if (attached()) {
-            for (Node* child = firstChild(); child; child = child->nextSibling()) {
-                if (!child->attached())
-                    child->lazyAttach();
-            }
-        }
-    }
-}
-
 const AtomicString& Element::shadowPseudoId() const
 {
     return hasRareData() ? rareData()->m_shadowPseudoId : nullAtom;
@@ -1275,6 +1242,9 @@ static void checkForEmptyStyleChange(Element* element, RenderStyle* style)
 static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool finishedParsingCallback,
                                         Node* beforeChange, Node* afterChange, int childCountDelta)
 {
+    // :empty selector.
+    checkForEmptyStyleChange(e, style);
+    
     if (!style || (e->needsStyleRecalc() && style->childrenAffectedByPositionalRules()))
         return;
 
@@ -1346,9 +1316,6 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
     if ((style->childrenAffectedByForwardPositionalRules() && afterChange) ||
         (style->childrenAffectedByBackwardPositionalRules() && beforeChange))
         e->setNeedsStyleRecalc();
-    
-    // :empty selector.
-    checkForEmptyStyleChange(e, style);
 }
 
 void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -1361,7 +1328,7 @@ void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* af
 
     if (hasRareData()) {
         if (hasShadowRoot())
-            shadowRootList()->hostChildrenChanged();
+            shadowTree()->hostChildrenChanged();
     }
 }
 
@@ -1370,7 +1337,7 @@ void Element::beginParsingChildren()
     clearIsParsingChildrenFinished();
     CSSStyleSelector* styleSelector = document()->styleSelectorIfExists();
     if (styleSelector && attached())
-        styleSelector->pushParent(this);
+        styleSelector->pushParentElement(this);
 }
 
 void Element::finishParsingChildren()
@@ -1379,7 +1346,7 @@ void Element::finishParsingChildren()
     setIsParsingChildrenFinished();
     checkForSiblingStyleChanges(this, renderStyle(), true, lastChild(), 0, 0);
     if (CSSStyleSelector* styleSelector = document()->styleSelectorIfExists())
-        styleSelector->popParent(this);
+        styleSelector->popParentElement(this);
 }
 
 #ifndef NDEBUG
@@ -1419,16 +1386,34 @@ PassRefPtr<Attr> Element::setAttributeNode(Attr* attr, ExceptionCode& ec)
         ec = TYPE_MISMATCH_ERR;
         return 0;
     }
-    return static_pointer_cast<Attr>(ensureUpdatedAttributes()->setNamedItem(attr, ec));
+
+    ElementAttributeData* attributeData = ensureUpdatedAttributeData();
+    Attribute* attribute = attr->attr();
+    size_t index = attributeData->getAttributeItemIndex(attribute->name());
+    Attribute* oldAttribute = index != notFound ? attributeData->attributeItem(index) : 0;
+    if (oldAttribute == attribute)
+        return attr; // we know about it already
+
+    // INUSE_ATTRIBUTE_ERR: Raised if node is an Attr that is already an attribute of another Element object.
+    // The DOM user must explicitly clone Attr nodes to re-use them in other elements.
+    if (attr->ownerElement()) {
+        ec = INUSE_ATTRIBUTE_ERR;
+        return 0;
+    }
+
+    RefPtr<Attr> oldAttr;
+    if (oldAttribute) {
+        oldAttr = oldAttribute->createAttrIfNeeded(this);
+        attributeData->replaceAttribute(index, attribute, this);
+    } else
+        attributeData->addAttribute(attribute, this);
+
+    return oldAttr.release();
 }
 
 PassRefPtr<Attr> Element::setAttributeNodeNS(Attr* attr, ExceptionCode& ec)
 {
-    if (!attr) {
-        ec = TYPE_MISMATCH_ERR;
-        return 0;
-    }
-    return static_pointer_cast<Attr>(ensureUpdatedAttributes()->setNamedItem(attr, ec));
+    return setAttributeNode(attr, ec);
 }
 
 PassRefPtr<Attr> Element::removeAttributeNode(Attr* attr, ExceptionCode& ec)
@@ -1444,11 +1429,17 @@ PassRefPtr<Attr> Element::removeAttributeNode(Attr* attr, ExceptionCode& ec)
 
     ASSERT(document() == attr->document());
 
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData)
         return 0;
 
-    return static_pointer_cast<Attr>(attrs->removeNamedItem(attr->qualifiedName(), ec));
+    size_t index = attributeData->getAttributeItemIndex(attr->qualifiedName());
+    if (index == notFound) {
+        ec = NOT_FOUND_ERR;
+        return 0;
+    }
+
+    return attributeData->takeAttribute(index, this);
 }
 
 void Element::setAttributeNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode& ec, FragmentScriptingPermission scriptingPermission)
@@ -1491,19 +1482,18 @@ void Element::removeAttributeNS(const String& namespaceURI, const String& localN
 
 PassRefPtr<Attr> Element::getAttributeNode(const String& name)
 {
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData)
         return 0;
-    String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-    return static_pointer_cast<Attr>(attrs->getNamedItem(localName));
+    return attributeData->getAttributeNode(name, shouldIgnoreAttributeCase(this), this);
 }
 
 PassRefPtr<Attr> Element::getAttributeNodeNS(const String& namespaceURI, const String& localName)
 {
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData)
         return 0;
-    return static_pointer_cast<Attr>(attrs->getNamedItem(QualifiedName(nullAtom, localName, namespaceURI)));
+    return attributeData->getAttributeNode(QualifiedName(nullAtom, localName, namespaceURI), this);
 }
 
 bool Element::hasAttribute(const String& name) const
@@ -1653,8 +1643,13 @@ RenderStyle* Element::computedStyle(PseudoId pseudoElementSpecifier)
     // FIXME: Find and use the renderer from the pseudo element instead of the actual element so that the 'length'
     // properties, which are only known by the renderer because it did the layout, will be correct and so that the
     // values returned for the ":selection" pseudo-element will be correct.
-    if (RenderStyle* usedStyle = renderStyle())
-        return pseudoElementSpecifier ? usedStyle->getCachedPseudoStyle(pseudoElementSpecifier) : usedStyle;
+    if (RenderStyle* usedStyle = renderStyle()) {
+        if (pseudoElementSpecifier) {
+            RenderStyle* cachedPseudoStyle = usedStyle->getCachedPseudoStyle(pseudoElementSpecifier);
+            return cachedPseudoStyle ? cachedPseudoStyle : usedStyle;
+         } else
+            return usedStyle;
+    }
 
     if (!attached())
         // FIXME: Try to do better than this. Ensure that styleForElement() works for elements that are not in the
@@ -1807,8 +1802,8 @@ DOMStringMap* Element::dataset()
 KURL Element::getURLAttribute(const QualifiedName& name) const
 {
 #if !ASSERT_DISABLED
-    if (m_attributeMap) {
-        if (Attribute* attribute = m_attributeMap->getAttributeItem(name))
+    if (m_attributeData) {
+        if (Attribute* attribute = getAttributeItem(name))
             ASSERT(isURLAttribute(attribute));
     }
 #endif
@@ -1818,8 +1813,8 @@ KURL Element::getURLAttribute(const QualifiedName& name) const
 KURL Element::getNonEmptyURLAttribute(const QualifiedName& name) const
 {
 #if !ASSERT_DISABLED
-    if (m_attributeMap) {
-        if (Attribute* attribute = m_attributeMap->getAttributeItem(name))
+    if (m_attributeData) {
+        if (Attribute* attribute = getAttributeItem(name))
             ASSERT(isURLAttribute(attribute));
     }
 #endif
@@ -1986,25 +1981,27 @@ bool Element::fastAttributeLookupAllowed(const QualifiedName& name) const
 }
 #endif
 
-void Element::willModifyAttribute(const QualifiedName& name, const AtomicString& oldValue, const AtomicString& newValue)
+#ifdef DUMP_NODE_STATISTICS
+bool Element::hasNamedNodeMap() const
 {
-    document()->incDOMTreeVersion();
+    return hasRareData() && rareData()->m_attributeMap;
+}
+#endif
 
+void Element::willModifyAttribute(const QualifiedName& name, const AtomicString& oldValue, const AtomicString& newValue)
+{
     if (isIdAttributeName(name))
         updateId(oldValue, newValue);
     else if (name == HTMLNames::nameAttr)
         updateName(oldValue, newValue);
 
 #if ENABLE(MUTATION_OBSERVERS)
-    if (!isSynchronizingStyleAttribute()) {
-        if (OwnPtr<MutationObserverInterestGroup> recipients = MutationObserverInterestGroup::createForAttributesMutation(this, name))
-            recipients->enqueueMutationRecord(MutationRecord::createAttributes(this, name, oldValue));
-    }
+    if (OwnPtr<MutationObserverInterestGroup> recipients = MutationObserverInterestGroup::createForAttributesMutation(this, name))
+        recipients->enqueueMutationRecord(MutationRecord::createAttributes(this, name, oldValue));
 #endif
 
 #if ENABLE(INSPECTOR)
-    if (!isSynchronizingStyleAttribute())
-        InspectorInstrumentation::willModifyDOMAttr(document(), this, oldValue, newValue);
+    InspectorInstrumentation::willModifyDOMAttr(document(), this, oldValue, newValue);
 #endif
 }
 
@@ -2012,10 +2009,8 @@ void Element::didModifyAttribute(Attribute* attr)
 {
     attributeChanged(attr);
 
-    if (!isSynchronizingStyleAttribute()) {
-        InspectorInstrumentation::didModifyDOMAttr(document(), this, attr->name().localName(), attr->value());
-        dispatchSubtreeModifiedEvent();
-    }
+    InspectorInstrumentation::didModifyDOMAttr(document(), this, attr->name().localName(), attr->value());
+    dispatchSubtreeModifiedEvent();
 }
 
 void Element::didRemoveAttribute(Attribute* attr)
@@ -2028,10 +2023,8 @@ void Element::didRemoveAttribute(Attribute* attr)
     attributeChanged(attr);
     attr->setValue(savedValue);
 
-    if (!isSynchronizingStyleAttribute()) {
-        InspectorInstrumentation::didRemoveDOMAttr(document(), this, attr->name().localName());
-        dispatchSubtreeModifiedEvent();
-    }
+    InspectorInstrumentation::didRemoveDOMAttr(document(), this, attr->name().localName());
+    dispatchSubtreeModifiedEvent();
 }
 
 
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index c9a1139a9..8c825073f 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -27,9 +27,9 @@
 
 #include "CollectionType.h"
 #include "Document.h"
+#include "ElementAttributeData.h"
 #include "FragmentScriptingPermission.h"
 #include "HTMLNames.h"
-#include "NamedNodeMap.h"
 #include "ScrollTypes.h"
 
 namespace WebCore {
@@ -42,7 +42,7 @@ class DOMTokenList;
 class ElementRareData;
 class IntSize;
 class ShadowRoot;
-class ShadowRootList;
+class ShadowTree;
 class WebKitAnimationList;
 
 enum SpellcheckAttributeState {
@@ -113,7 +113,7 @@ public:
 
     bool hasAttribute(const QualifiedName&) const;
     const AtomicString& getAttribute(const QualifiedName&) const;
-    void setAttribute(const QualifiedName&, const AtomicString& value);
+    void setAttribute(const QualifiedName&, const AtomicString& value, bool notifyChanged = true);
     void removeAttribute(const QualifiedName&);
 
     // Typed getters and setters for language bindings.
@@ -130,6 +130,9 @@ public:
     bool fastAttributeLookupAllowed(const QualifiedName&) const;
 #endif
 
+#ifdef DUMP_NODE_STATISTICS
+    bool hasNamedNodeMap() const;
+#endif
     bool hasAttributes() const;
     // This variant will not update the potentially invalid attributes. To be used when not interested
     // in style attribute or one of the SVG animation attributes.
@@ -160,7 +163,6 @@ public:
     size_t attributeCount() const;
     Attribute* attributeItem(unsigned index) const;
     Attribute* getAttributeItem(const QualifiedName&) const;
-    void removeAttribute(unsigned index);
 
     void scrollIntoView(bool alignToTop = true);
     void scrollIntoViewIfNeeded(bool centerIfNeeded = true);
@@ -228,23 +230,21 @@ public:
     void setBooleanAttribute(const QualifiedName& name, bool);
 
     // For exposing to DOM only.
-    NamedNodeMap* attributes() const { return ensureUpdatedAttributes(); }
-
-    NamedNodeMap* ensureUpdatedAttributes() const;
-    NamedNodeMap* updatedAttributes() const;
+    NamedNodeMap* attributes() const;
 
     // This method is called whenever an attribute is added, changed or removed.
     virtual void attributeChanged(Attribute*);
 
     // Only called by the parser immediately after element construction.
-    void parserSetAttributeMap(PassOwnPtr<NamedNodeMap>, FragmentScriptingPermission);
+    void parserSetAttributes(PassOwnPtr<AttributeVector>, FragmentScriptingPermission);
 
-    ElementAttributeData* attributeData() const { return m_attributeMap ? m_attributeMap->attributeData() : 0; }
+    ElementAttributeData* attributeData() const { return m_attributeData.get(); }
     ElementAttributeData* ensureAttributeData() const;
     ElementAttributeData* updatedAttributeData() const;
     ElementAttributeData* ensureUpdatedAttributeData() const;
 
     void setAttributesFromElement(const Element&);
+    bool hasEquivalentAttributes(const Element* other) const;
 
     virtual void copyNonAttributeProperties(const Element* source);
 
@@ -254,13 +254,12 @@ public:
     void recalcStyle(StyleChange = NoChange);
 
     bool hasShadowRoot() const;
-    ShadowRootList* shadowRootList() const;
+    ShadowTree* shadowTree() const;
+    ShadowTree* ensureShadowTree();
 
-    // FIXME: These API will be moved to ShadowRootList.
-    // https://bugs.webkit.org/show_bug.cgi?id=78313
-    void setShadowRoot(PassRefPtr<ShadowRoot>, ExceptionCode&);
+    // FIXME: Remove Element::ensureShadowRoot
+    // https://bugs.webkit.org/show_bug.cgi?id=77608
     ShadowRoot* ensureShadowRoot();
-    void removeShadowRoot();
 
     virtual const AtomicString& shadowPseudoId() const;
     void setShadowPseudoId(const AtomicString&, ExceptionCode& = ASSERT_NO_EXCEPTION);
@@ -430,7 +429,7 @@ private:
     virtual NodeType nodeType() const;
     virtual bool childTypeAllowed(NodeType) const;
 
-    void setAttributeInternal(size_t index, const QualifiedName&, const AtomicString& value);
+    void setAttributeInternal(size_t index, const QualifiedName&, const AtomicString& value, bool notifyChanged = true);
 
 #ifndef NDEBUG
     virtual void formatForDebugger(char* buffer, unsigned length) const;
@@ -438,7 +437,7 @@ private:
 
     bool pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle);
 
-    void createAttributeMap() const;
+    void createAttributeData() const;
 
     virtual void updateStyleAttribute() const { }
 
@@ -470,7 +469,7 @@ private:
     void updateExtraNamedItemRegistration(const AtomicString& oldName, const AtomicString& newName);
 
 private:
-    mutable OwnPtr<NamedNodeMap> m_attributeMap;
+    mutable OwnPtr<ElementAttributeData> m_attributeData;
 };
     
 inline Element* toElement(Node* node)
@@ -530,25 +529,11 @@ inline Element* Element::nextElementSibling() const
     return static_cast<Element*>(n);
 }
 
-inline NamedNodeMap* Element::ensureUpdatedAttributes() const
-{
-    updateInvalidAttributes();
-    if (!m_attributeMap)
-        createAttributeMap();
-    return m_attributeMap.get();
-}
-
-inline NamedNodeMap* Element::updatedAttributes() const
-{
-    updateInvalidAttributes();
-    return m_attributeMap.get();
-}
-
 inline ElementAttributeData* Element::ensureAttributeData() const
 {
-    if (!m_attributeMap)
-        createAttributeMap();
-    return m_attributeMap->attributeData();
+    if (!m_attributeData)
+        createAttributeData();
+    return m_attributeData.get();
 }
 
 inline ElementAttributeData* Element::updatedAttributeData() const
@@ -608,14 +593,14 @@ inline void Element::willRemoveAttribute(const QualifiedName& name, const Atomic
 inline bool Element::fastHasAttribute(const QualifiedName& name) const
 {
     ASSERT(fastAttributeLookupAllowed(name));
-    return m_attributeMap && m_attributeMap->getAttributeItem(name);
+    return m_attributeData && getAttributeItem(name);
 }
 
 inline const AtomicString& Element::fastGetAttribute(const QualifiedName& name) const
 {
     ASSERT(fastAttributeLookupAllowed(name));
-    if (m_attributeMap) {
-        if (Attribute* attribute = m_attributeMap->getAttributeItem(name))
+    if (m_attributeData) {
+        if (Attribute* attribute = getAttributeItem(name))
             return attribute->value();
     }
     return nullAtom;
@@ -623,13 +608,13 @@ inline const AtomicString& Element::fastGetAttribute(const QualifiedName& name)
 
 inline bool Element::hasAttributesWithoutUpdate() const
 {
-    return m_attributeMap && !m_attributeMap->isEmpty();
+    return m_attributeData && !m_attributeData->isEmpty();
 }
 
 inline const AtomicString& Element::idForStyleResolution() const
 {
     ASSERT(hasID());
-    return attributeData()->idForStyleResolution();
+    return m_attributeData->idForStyleResolution();
 }
 
 inline bool Element::isIdAttributeName(const QualifiedName& attributeName) const
@@ -658,26 +643,20 @@ inline void Element::setIdAttribute(const AtomicString& value)
 
 inline size_t Element::attributeCount() const
 {
-    ASSERT(m_attributeMap);
-    return m_attributeMap->length();
+    ASSERT(m_attributeData);
+    return m_attributeData->length();
 }
 
 inline Attribute* Element::attributeItem(unsigned index) const
 {
-    ASSERT(m_attributeMap);
-    return m_attributeMap->attributeItem(index);
+    ASSERT(m_attributeData);
+    return m_attributeData->attributeItem(index);
 }
 
 inline Attribute* Element::getAttributeItem(const QualifiedName& name) const
 {
-    ASSERT(m_attributeMap);
-    return m_attributeMap->getAttributeItem(name);
-}
-
-inline void Element::removeAttribute(unsigned index)
-{
-    ASSERT(m_attributeMap);
-    m_attributeMap->removeAttribute(index);
+    ASSERT(m_attributeData);
+    return m_attributeData->getAttributeItem(name);
 }
 
 inline void Element::updateInvalidAttributes() const
diff --git a/Source/WebCore/dom/Element.idl b/Source/WebCore/dom/Element.idl
index c66b14592..8725bcbc1 100644
--- a/Source/WebCore/dom/Element.idl
+++ b/Source/WebCore/dom/Element.idl
@@ -22,8 +22,7 @@ module core {
 
     interface [
         JSGenerateToNativeObject,
-        JSInlineGetOwnPropertySlot,
-        V8CustomToJSObject
+        JSInlineGetOwnPropertySlot
     ] Element : Node {
 
         // DOM Level 1 Core
diff --git a/Source/WebCore/dom/ElementAttributeData.cpp b/Source/WebCore/dom/ElementAttributeData.cpp
index 71457f4b1..601c34b9b 100644
--- a/Source/WebCore/dom/ElementAttributeData.cpp
+++ b/Source/WebCore/dom/ElementAttributeData.cpp
@@ -26,11 +26,22 @@
 #include "config.h"
 #include "ElementAttributeData.h"
 
-#include "Attr.h"
 #include "StyledElement.h"
 
 namespace WebCore {
 
+void AttributeVector::removeAttribute(const QualifiedName& name)
+{
+    size_t index = getAttributeItemIndex(name);
+    if (index == notFound)
+        return;
+
+    RefPtr<Attribute> attribute = at(index);
+    if (Attr* attr = attribute->attr())
+        attr->m_element = 0;
+    remove(index);
+}
+
 ElementAttributeData::~ElementAttributeData()
 {
     detachAttributesFromElement();
@@ -40,8 +51,8 @@ void ElementAttributeData::setClass(const String& className, bool shouldFoldCase
 {
     m_classNames.set(className, shouldFoldCase);
 }
-
-StylePropertySet* ElementAttributeData::ensureInlineStyleDecl(StyledElement* element)
+    
+StylePropertySet* ElementAttributeData::ensureInlineStyle(StyledElement* element)
 {
     if (!m_inlineStyleDecl) {
         ASSERT(element->isStyledElement());
@@ -51,7 +62,30 @@ StylePropertySet* ElementAttributeData::ensureInlineStyleDecl(StyledElement* ele
     return m_inlineStyleDecl.get();
 }
 
-void ElementAttributeData::destroyInlineStyleDecl(StyledElement* element)
+StylePropertySet* ElementAttributeData::ensureMutableInlineStyle(StyledElement* element)
+{
+    if (m_inlineStyleDecl && !m_inlineStyleDecl->hasCSSOMWrapper()) {
+        m_inlineStyleDecl = m_inlineStyleDecl->copy();
+        m_inlineStyleDecl->setStrictParsing(element->isHTMLElement() && !element->document()->inQuirksMode());
+        return m_inlineStyleDecl.get();
+    }
+    return ensureInlineStyle(element);
+}
+    
+void ElementAttributeData::updateInlineStyleAvoidingMutation(StyledElement* element, const String& text)
+{
+    // We reconstruct the property set instead of mutating if there is no CSSOM wrapper.
+    // This makes wrapperless property sets immutable and so cacheable.
+    if (m_inlineStyleDecl && !m_inlineStyleDecl->hasCSSOMWrapper())
+        m_inlineStyleDecl.clear();
+    if (!m_inlineStyleDecl) {
+        m_inlineStyleDecl = StylePropertySet::create();
+        m_inlineStyleDecl->setStrictParsing(element->isHTMLElement() && !element->document()->inQuirksMode());
+    }
+    m_inlineStyleDecl->parseDeclaration(text, element->document()->elementSheet());
+}
+
+void ElementAttributeData::destroyInlineStyle(StyledElement* element)
 {
     if (!m_inlineStyleDecl)
         return;
@@ -91,6 +125,35 @@ void ElementAttributeData::removeAttribute(size_t index, Element* element)
         element->didRemoveAttribute(attribute.get());
 }
 
+PassRefPtr<Attr> ElementAttributeData::takeAttribute(size_t index, Element* element)
+{
+    ASSERT(index < length());
+    ASSERT(element);
+
+    RefPtr<Attr> attr = m_attributes[index]->createAttrIfNeeded(element);
+    removeAttribute(index, element);
+    return attr.release();
+}
+
+bool ElementAttributeData::isEquivalent(const ElementAttributeData* other) const
+{
+    if (!other)
+        return isEmpty();
+
+    unsigned len = length();
+    if (len != other->length())
+        return false;
+
+    for (unsigned i = 0; i < len; i++) {
+        Attribute* attr = attributeItem(i);
+        Attribute* otherAttr = other->getAttributeItem(attr->name());
+        if (!otherAttr || attr->value() != otherAttr->value())
+            return false;
+    }
+
+    return true;
+}
+
 void ElementAttributeData::detachAttributesFromElement()
 {
     size_t size = m_attributes.size();
diff --git a/Source/WebCore/dom/ElementAttributeData.h b/Source/WebCore/dom/ElementAttributeData.h
index be145617c..e0866b29a 100644
--- a/Source/WebCore/dom/ElementAttributeData.h
+++ b/Source/WebCore/dom/ElementAttributeData.h
@@ -26,6 +26,7 @@
 #ifndef ElementAttributeData_h
 #define ElementAttributeData_h
 
+#include "Attr.h"
 #include "Attribute.h"
 #include "SpaceSplitString.h"
 #include "StylePropertySet.h"
@@ -35,8 +36,57 @@ namespace WebCore {
 
 class Element;
 
+class AttributeVector : public Vector<RefPtr<Attribute>, 4> {
+    friend class ElementAttributeData;
+
+public:
+    static PassOwnPtr<AttributeVector> create()
+    {
+        return adoptPtr(new AttributeVector());
+    }
+
+    Attribute* attributeItem(unsigned index) const { return at(index).get(); }
+    Attribute* getAttributeItem(const QualifiedName&) const;
+    size_t getAttributeItemIndex(const QualifiedName&) const;
+
+    // Used during parsing: only inserts if not already there.
+    void insertAttribute(PassRefPtr<Attribute> newAttribute);
+    void removeAttribute(const QualifiedName&);
+
+private:
+    AttributeVector() { }
+};
+
+inline Attribute* AttributeVector::getAttributeItem(const QualifiedName& name) const
+{
+    size_t index = getAttributeItemIndex(name);
+    if (index != notFound)
+        return at(index).get();
+    return 0;
+}
+
+inline size_t AttributeVector::getAttributeItemIndex(const QualifiedName& name) const
+{
+    for (unsigned i = 0; i < size(); ++i) {
+        if (at(i)->name().matches(name))
+            return i;
+    }
+    return notFound;
+}
+
+inline void AttributeVector::insertAttribute(PassRefPtr<Attribute> newAttribute)
+{
+    if (!getAttributeItem(newAttribute->name()))
+        append(newAttribute);
+}
+
 class ElementAttributeData {
 public:
+    static PassOwnPtr<ElementAttributeData> create()
+    {
+        return adoptPtr(new ElementAttributeData);
+    }
+
     ~ElementAttributeData();
 
     void clearClass() { m_classNames.clear(); }
@@ -46,9 +96,11 @@ public:
     const AtomicString& idForStyleResolution() const { return m_idForStyleResolution; }
     void setIdForStyleResolution(const AtomicString& newId) { m_idForStyleResolution = newId; }
 
-    StylePropertySet* inlineStyleDecl() { return m_inlineStyleDecl.get(); }
-    StylePropertySet* ensureInlineStyleDecl(StyledElement*);
-    void destroyInlineStyleDecl(StyledElement* element);
+    StylePropertySet* inlineStyle() { return m_inlineStyleDecl.get(); }
+    StylePropertySet* ensureInlineStyle(StyledElement*);
+    StylePropertySet* ensureMutableInlineStyle(StyledElement*);
+    void updateInlineStyleAvoidingMutation(StyledElement*, const String& text);
+    void destroyInlineStyle(StyledElement*);
 
     StylePropertySet* attributeStyle() const { return m_attributeStyle.get(); }
     void setAttributeStyle(PassRefPtr<StylePropertySet> style) { m_attributeStyle = style; }
@@ -56,22 +108,28 @@ public:
     size_t length() const { return m_attributes.size(); }
     bool isEmpty() const { return m_attributes.isEmpty(); }
 
+    PassRefPtr<Attr> getAttributeNode(const String&, bool shouldIgnoreAttributeCase, Element*) const;
+    PassRefPtr<Attr> getAttributeNode(const QualifiedName&, Element*) const;
+
     // Internal interface.
-    Attribute* attributeItem(unsigned index) const { return m_attributes[index].get(); }
-    Attribute* getAttributeItem(const QualifiedName&) const;
-    size_t getAttributeItemIndex(const QualifiedName&) const;
+    Attribute* attributeItem(unsigned index) const { return m_attributes.attributeItem(index); }
+    Attribute* getAttributeItem(const QualifiedName& name) const { return m_attributes.getAttributeItem(name); }
+    size_t getAttributeItemIndex(const QualifiedName& name) const { return m_attributes.getAttributeItemIndex(name); }
+    size_t getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const;
 
     // These functions do no error checking.
     void addAttribute(PassRefPtr<Attribute>, Element*);
     void removeAttribute(const QualifiedName&, Element*);
     void removeAttribute(size_t index, Element*);
+    PassRefPtr<Attr> takeAttribute(size_t index, Element*);
 
     bool hasID() const { return !m_idForStyleResolution.isNull(); }
     bool hasClass() const { return !m_classNames.isNull(); }
 
+    bool isEquivalent(const ElementAttributeData* other) const;
+
 private:
     friend class Element;
-    friend class NamedNodeMap;
 
     ElementAttributeData()
     {
@@ -80,7 +138,6 @@ private:
     void detachAttributesFromElement();
     void copyAttributesToVector(Vector<RefPtr<Attribute> >&);
     Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
-    size_t getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const;
     size_t getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const;
     void setAttributes(const ElementAttributeData& other, Element*);
     void clearAttributes();
@@ -90,7 +147,7 @@ private:
     RefPtr<StylePropertySet> m_attributeStyle;
     SpaceSplitString m_classNames;
     AtomicString m_idForStyleResolution;
-    Vector<RefPtr<Attribute>, 4> m_attributes;
+    AttributeVector m_attributes;
 };
 
 inline void ElementAttributeData::removeAttribute(const QualifiedName& name, Element* element)
@@ -102,17 +159,27 @@ inline void ElementAttributeData::removeAttribute(const QualifiedName& name, Ele
     removeAttribute(index, element);
 }
 
-inline Attribute* ElementAttributeData::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+inline PassRefPtr<Attr> ElementAttributeData::getAttributeNode(const String& name, bool shouldIgnoreAttributeCase, Element* element) const
 {
-    size_t index = getAttributeItemIndex(name, shouldIgnoreAttributeCase);
-    if (index != notFound)
-        return m_attributes[index].get();
-    return 0;
+    ASSERT(element);
+    Attribute* attribute = getAttributeItem(name, shouldIgnoreAttributeCase);
+    if (!attribute)
+        return 0;
+    return attribute->createAttrIfNeeded(element);
 }
 
-inline Attribute* ElementAttributeData::getAttributeItem(const QualifiedName& name) const
+inline PassRefPtr<Attr> ElementAttributeData::getAttributeNode(const QualifiedName& name, Element* element) const
 {
-    size_t index = getAttributeItemIndex(name);
+    ASSERT(element);
+    Attribute* attribute = getAttributeItem(name);
+    if (!attribute)
+        return 0;
+    return attribute->createAttrIfNeeded(element);
+}
+
+inline Attribute* ElementAttributeData::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+{
+    size_t index = getAttributeItemIndex(name, shouldIgnoreAttributeCase);
     if (index != notFound)
         return m_attributes[index].get();
     return 0;
@@ -120,16 +187,6 @@ inline Attribute* ElementAttributeData::getAttributeItem(const QualifiedName& na
 
 // We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
 // can tune the behavior (hasAttribute is case sensitive whereas getAttribute is not).
-inline size_t ElementAttributeData::getAttributeItemIndex(const QualifiedName& name) const
-{
-    size_t len = length();
-    for (unsigned i = 0; i < len; ++i) {
-        if (m_attributes[i]->name().matches(name))
-            return i;
-    }
-    return notFound;
-}
-
 inline size_t ElementAttributeData::getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
diff --git a/Source/WebCore/dom/ElementRareData.h b/Source/WebCore/dom/ElementRareData.h
index ff45783bd..cd2384d88 100644
--- a/Source/WebCore/dom/ElementRareData.h
+++ b/Source/WebCore/dom/ElementRareData.h
@@ -26,8 +26,9 @@
 #include "DatasetDOMStringMap.h"
 #include "Element.h"
 #include "HTMLCollection.h"
+#include "NamedNodeMap.h"
 #include "NodeRareData.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -64,11 +65,12 @@ public:
 
     LayoutSize m_minimumSizeForResizing;
     RefPtr<RenderStyle> m_computedStyle;
-    ShadowRootList m_shadowRootList;
     AtomicString m_shadowPseudoId;
 
     OwnPtr<DatasetDOMStringMap> m_datasetDOMStringMap;
     OwnPtr<ClassList> m_classList;
+    OwnPtr<ShadowTree> m_shadowTree;
+    OwnPtr<NamedNodeMap> m_attributeMap;
 
     bool m_styleAffectedByEmpty;
 
@@ -94,7 +96,7 @@ inline ElementRareData::ElementRareData()
 
 inline ElementRareData::~ElementRareData()
 {
-    ASSERT(!m_shadowRootList.hasShadowRoot());
+    ASSERT(!m_shadowTree);
 }
 
 inline void ElementRareData::resetComputedStyle()
diff --git a/Source/WebCore/dom/EventDispatcher.cpp b/Source/WebCore/dom/EventDispatcher.cpp
index 3ee5285bc..5866e6068 100644
--- a/Source/WebCore/dom/EventDispatcher.cpp
+++ b/Source/WebCore/dom/EventDispatcher.cpp
@@ -55,36 +55,32 @@ bool EventDispatcher::dispatchEvent(Node* node, PassRefPtr<EventDispatchMediator
     return mediator->dispatchEvent(&dispatcher);
 }
 
-static EventTarget* findElementInstance(Node* referenceNode)
+inline static EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNode)
 {
+    ASSERT(referenceNode);
+
 #if ENABLE(SVG)
+    if (!referenceNode->isSVGElement() || !referenceNode->isInShadowTree())
+        return referenceNode;
+
     // Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
     // as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
-    for (Node* n = referenceNode; n; n = n->parentNode()) {
-        if (!n->isSVGShadowRoot() || !n->isSVGElement())
-            continue;
-
-        Element* shadowTreeParentElement = n->svgShadowHost();
-        ASSERT(shadowTreeParentElement->hasTagName(SVGNames::useTag));
-
-        if (SVGElementInstance* instance = static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode))
+    Element* shadowHostElement = referenceNode->treeScope()->rootNode()->shadowHost();
+    // At this time, SVG nodes are not allowed in non-<use> shadow trees, so any shadow root we do
+    // have should be a use. The assert and following test is here to catch future shadow DOM changes
+    // that do enable SVG in a shadow tree.
+    ASSERT(!shadowHostElement || shadowHostElement->hasTagName(SVGNames::useTag));
+    if (shadowHostElement && shadowHostElement->hasTagName(SVGNames::useTag)) {
+        SVGUseElement* useElement = static_cast<SVGUseElement*>(shadowHostElement);
+
+        if (SVGElementInstance* instance = useElement->instanceForShadowTreeElement(referenceNode))
             return instance;
     }
-#else
-    // SVG elements with SVG disabled should not be possible.
-    ASSERT_NOT_REACHED();
 #endif
 
     return referenceNode;
 }
 
-inline static EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNode)
-{
-    ASSERT(referenceNode);
-
-    return referenceNode->isSVGElement() ? findElementInstance(referenceNode) : referenceNode;
-}
-
 void EventDispatcher::dispatchScopedEvent(Node* node, PassRefPtr<EventDispatchMediator> mediator)
 {
     // We need to set the target here because it can go away by the time we actually fire the event.
@@ -120,11 +116,6 @@ void EventDispatcher::dispatchSimulatedClick(Node* node, PassRefPtr<Event> under
     gNodesDispatchingSimulatedClicks->remove(node);
 }
 
-static inline bool isShadowRootOrSVGShadowRoot(const Node* node)
-{
-    return node->isShadowRoot() || node->isSVGShadowRoot();
-}
-
 static inline bool isShadowHost(Node* node)
 {
     return node->isElementNode() && toElement(node)->hasShadowRoot();
@@ -141,7 +132,7 @@ PassRefPtr<EventTarget> EventDispatcher::adjustToShadowBoundaries(PassRefPtr<Nod
     bool diverged = false;
     for (Vector<Node*>::const_iterator i = relatedTargetAncestors.end() - 1; i >= relatedTargetAncestors.begin(); --i) {
         if (diverged) {
-            if (isShadowRootOrSVGShadowRoot(*i)) {
+            if ((*i)->isShadowRoot()) {
                 firstDivergentBoundary = i + 1;
                 break;
             }
@@ -155,7 +146,7 @@ PassRefPtr<EventTarget> EventDispatcher::adjustToShadowBoundaries(PassRefPtr<Nod
 
         targetAncestor--;
 
-        if (isShadowRootOrSVGShadowRoot(*i))
+        if ((*i)->isShadowRoot())
             lowestCommonBoundary = targetAncestor;
 
         if ((*i) != (*targetAncestor).node())
@@ -167,7 +158,7 @@ PassRefPtr<EventTarget> EventDispatcher::adjustToShadowBoundaries(PassRefPtr<Nod
         // FIXME: Remove the first check once conversion to new shadow DOM is complete <http://webkit.org/b/48698>
         if (m_node->shadowHost() == relatedTarget.get() || isShadowHost(relatedTarget.get())) {
             Vector<EventContext>::const_iterator relatedTargetChild = targetAncestor - 1;
-            if (relatedTargetChild >= m_ancestors.begin() && isShadowRootOrSVGShadowRoot(relatedTargetChild->node()))
+            if (relatedTargetChild >= m_ancestors.begin() && relatedTargetChild->node()->isShadowRoot())
                 lowestCommonBoundary = relatedTargetChild;
         }
     } else if ((*firstDivergentBoundary) == m_node.get()) {
@@ -217,7 +208,7 @@ PassRefPtr<EventTarget> EventDispatcher::adjustRelatedTarget(Event* event, PassR
     Vector<Node*> relatedTargetAncestors;
     Node* outermostShadowBoundary = relatedTarget.get();
     for (Node* n = outermostShadowBoundary; n; n = n->parentOrHostNode()) {
-        if (isShadowRootOrSVGShadowRoot(n))
+        if (n->isShadowRoot())
             outermostShadowBoundary = n->parentOrHostNode();
         if (!noCommonBoundary)
             relatedTargetAncestors.append(n);
@@ -251,18 +242,12 @@ void EventDispatcher::ensureEventAncestors(Event* event)
 
     Node* ancestor = m_node.get();
     EventTarget* target = eventTargetRespectingSVGTargetRules(ancestor);
-    bool shouldSkipNextAncestor = false;
     while (true) {
-        bool isSVGShadowRoot = ancestor->isSVGShadowRoot();
-        if (isSVGShadowRoot || ancestor->isShadowRoot()) {
+        if (ancestor->isShadowRoot()) {
             if (determineDispatchBehavior(event, ancestor) == StayInsideShadowDOM)
                 return;
-#if ENABLE(SVG)
-            ancestor = isSVGShadowRoot ? ancestor->svgShadowHost() : ancestor->shadowHost();
-#else
             ancestor = ancestor->shadowHost();
-#endif
-            if (!shouldSkipNextAncestor)
+            if (!m_node->isSVGElement())
                 target = ancestor;
         } else
             ancestor = ancestor->parentNodeGuaranteedHostFree();
@@ -270,13 +255,6 @@ void EventDispatcher::ensureEventAncestors(Event* event)
         if (!ancestor)
             return;
 
-#if ENABLE(SVG)
-        // Skip SVGShadowTreeRootElement.
-        shouldSkipNextAncestor = ancestor->isSVGShadowRoot();
-        if (shouldSkipNextAncestor)
-            continue;
-#endif
-        // FIXME: Unroll the extra loop inside eventTargetRespectingSVGTargetRules into this loop.
         m_ancestors.append(EventContext(ancestor, eventTargetRespectingSVGTargetRules(ancestor), target));
     }
 }
diff --git a/Source/WebCore/dom/EventNames.h b/Source/WebCore/dom/EventNames.h
index a616f7476..860423225 100644
--- a/Source/WebCore/dom/EventNames.h
+++ b/Source/WebCore/dom/EventNames.h
@@ -185,6 +185,18 @@ namespace WebCore {
     \
     macro(webkitspeechchange) \
     \
+    macro(audiostart) \
+    macro(soundstart) \
+    macro(speechstart) \
+    macro(speechend) \
+    macro(soundend) \
+    macro(audioend) \
+    macro(result) \
+    macro(nomatch) \
+    macro(resultdeleted) \
+    macro(start) \
+    macro(end) \
+    \
     macro(webglcontextlost) \
     macro(webglcontextrestored) \
     macro(webglcontextcreationerror) \
diff --git a/Source/WebCore/dom/EventFactory.in b/Source/WebCore/dom/EventNames.in
index 1b500cd79..d86611240 100644
--- a/Source/WebCore/dom/EventFactory.in
+++ b/Source/WebCore/dom/EventNames.in
@@ -31,6 +31,7 @@ AudioProcessingEvent conditional=WEB_AUDIO
 OfflineAudioCompletionEvent conditional=WEB_AUDIO
 MediaStreamEvent conditional=MEDIA_STREAM
 SpeechInputEvent conditional=INPUT_SPEECH
+SpeechRecognitionEvent conditional=SCRIPTED_SPEECH
 WebGLContextEvent conditional=WEBGL
 StorageEvent
 SVGEvents interfaceName=Event, conditional=SVG
diff --git a/Source/WebCore/dom/MouseRelatedEvent.cpp b/Source/WebCore/dom/MouseRelatedEvent.cpp
index c4b144475..caee58fe7 100644
--- a/Source/WebCore/dom/MouseRelatedEvent.cpp
+++ b/Source/WebCore/dom/MouseRelatedEvent.cpp
@@ -214,14 +214,14 @@ int MouseRelatedEvent::offsetX()
 {
     if (!m_hasCachedRelativePosition)
         computeRelativePosition();
-    return m_offsetLocation.x();
+    return roundToInt(m_offsetLocation.x());
 }
 
 int MouseRelatedEvent::offsetY()
 {
     if (!m_hasCachedRelativePosition)
         computeRelativePosition();
-    return m_offsetLocation.y();
+    return roundToInt(m_offsetLocation.y());
 }
 
 int MouseRelatedEvent::pageX() const
diff --git a/Source/WebCore/dom/NamedNodeMap.cpp b/Source/WebCore/dom/NamedNodeMap.cpp
index 47145970e..942c40c9b 100644
--- a/Source/WebCore/dom/NamedNodeMap.cpp
+++ b/Source/WebCore/dom/NamedNodeMap.cpp
@@ -42,58 +42,53 @@ static inline bool shouldIgnoreAttributeCase(const Element* e)
 
 void NamedNodeMap::ref()
 {
-    ASSERT(m_element);
     m_element->ref();
 }
 
 void NamedNodeMap::deref()
 {
-    ASSERT(m_element);
     m_element->deref();
 }
 
 PassRefPtr<Node> NamedNodeMap::getNamedItem(const String& name) const
 {
-    Attribute* a = m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
-    if (!a)
-        return 0;
-    
-    return a->createAttrIfNeeded(m_element);
+    return m_element->attributeData()->getAttributeNode(name, shouldIgnoreAttributeCase(m_element), m_element);
 }
 
 PassRefPtr<Node> NamedNodeMap::getNamedItemNS(const String& namespaceURI, const String& localName) const
 {
-    return getNamedItem(QualifiedName(nullAtom, localName, namespaceURI));
+    return m_element->attributeData()->getAttributeNode(QualifiedName(nullAtom, localName, namespaceURI), m_element);
 }
 
 PassRefPtr<Node> NamedNodeMap::removeNamedItem(const String& name, ExceptionCode& ec)
 {
-    Attribute* a = m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
-    if (!a) {
+    ElementAttributeData* attributeData = m_element->attributeData();
+
+    size_t index = attributeData->getAttributeItemIndex(name, shouldIgnoreAttributeCase(m_element));
+    if (index == notFound) {
         ec = NOT_FOUND_ERR;
         return 0;
     }
     
-    return removeNamedItem(a->name(), ec);
+    return attributeData->takeAttribute(index, m_element);
 }
 
 PassRefPtr<Node> NamedNodeMap::removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode& ec)
 {
-    return removeNamedItem(QualifiedName(nullAtom, localName, namespaceURI), ec);
-}
+    ElementAttributeData* attributeData = m_element->attributeData();
 
-PassRefPtr<Node> NamedNodeMap::getNamedItem(const QualifiedName& name) const
-{
-    Attribute* a = getAttributeItem(name);
-    if (!a)
+    size_t index = attributeData->getAttributeItemIndex(QualifiedName(nullAtom, localName, namespaceURI));
+    if (index == notFound) {
+        ec = NOT_FOUND_ERR;
         return 0;
+    }
 
-    return a->createAttrIfNeeded(m_element);
+    return attributeData->takeAttribute(index, m_element);
 }
 
 PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* node, ExceptionCode& ec)
 {
-    if (!m_element || !node) {
+    if (!node) {
         ec = NOT_FOUND_ERR;
         return 0;
     }
@@ -103,29 +98,8 @@ PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* node, ExceptionCode& ec)
         ec = HIERARCHY_REQUEST_ERR;
         return 0;
     }
-    Attr* attr = static_cast<Attr*>(node);
-
-    Attribute* attribute = attr->attr();
-    size_t index = getAttributeItemIndex(attribute->name());
-    Attribute* oldAttribute = index != notFound ? attributeItem(index) : 0;
-    if (oldAttribute == attribute)
-        return node; // we know about it already
-
-    // INUSE_ATTRIBUTE_ERR: Raised if node is an Attr that is already an attribute of another Element object.
-    // The DOM user must explicitly clone Attr nodes to re-use them in other elements.
-    if (attr->ownerElement()) {
-        ec = INUSE_ATTRIBUTE_ERR;
-        return 0;
-    }
-
-    RefPtr<Attr> oldAttr;
-    if (oldAttribute) {
-        oldAttr = oldAttribute->createAttrIfNeeded(m_element);
-        m_attributeData.replaceAttribute(index, attribute, m_element);
-    } else
-        m_attributeData.addAttribute(attribute, m_element);
 
-    return oldAttr.release();
+    return m_element->setAttributeNode(static_cast<Attr*>(node), ec);
 }
 
 PassRefPtr<Node> NamedNodeMap::setNamedItemNS(Node* node, ExceptionCode& ec)
@@ -133,58 +107,16 @@ PassRefPtr<Node> NamedNodeMap::setNamedItemNS(Node* node, ExceptionCode& ec)
     return setNamedItem(node, ec);
 }
 
-PassRefPtr<Node> NamedNodeMap::removeNamedItem(const QualifiedName& name, ExceptionCode& ec)
-{
-    ASSERT(m_element);
-
-    size_t index = getAttributeItemIndex(name);
-    if (index == notFound) {
-        ec = NOT_FOUND_ERR;
-        return 0;
-    }
-
-    RefPtr<Attr> attr = m_attributeData.m_attributes[index]->createAttrIfNeeded(m_element);
-
-    removeAttribute(index);
-
-    return attr.release();
-}
-
 PassRefPtr<Node> NamedNodeMap::item(unsigned index) const
 {
     if (index >= length())
         return 0;
-
-    return m_attributeData.m_attributes[index]->createAttrIfNeeded(m_element);
+    return m_element->attributeItem(index)->createAttrIfNeeded(m_element);
 }
 
-void NamedNodeMap::detachFromElement()
+size_t NamedNodeMap::length() const
 {
-    // This can't happen if the holder of the map is JavaScript, because we mark the
-    // element if the map is alive. So it has no impact on web page behavior. Because
-    // of that, we can simply clear all the attributes to avoid accessing stale
-    // pointers to do things like create Attr objects.
-    m_element = 0;
-    m_attributeData.clearAttributes();
-}
-
-bool NamedNodeMap::mapsEquivalent(const NamedNodeMap* otherMap) const
-{
-    if (!otherMap)
-        return isEmpty();
-    
-    unsigned len = length();
-    if (len != otherMap->length())
-        return false;
-    
-    for (unsigned i = 0; i < len; i++) {
-        Attribute* attr = attributeItem(i);
-        Attribute* otherAttr = otherMap->getAttributeItem(attr->name());
-        if (!otherAttr || attr->value() != otherAttr->value())
-            return false;
-    }
-    
-    return true;
+    return m_element->attributeCount();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NamedNodeMap.h b/Source/WebCore/dom/NamedNodeMap.h
index 3201fcd08..d42d52d23 100644
--- a/Source/WebCore/dom/NamedNodeMap.h
+++ b/Source/WebCore/dom/NamedNodeMap.h
@@ -25,19 +25,21 @@
 #ifndef NamedNodeMap_h
 #define NamedNodeMap_h
 
-#include "ElementAttributeData.h"
-#include "SpaceSplitString.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
 class Node;
+class Element;
 
 typedef int ExceptionCode;
 
 class NamedNodeMap {
     friend class Element;
 public:
-    static PassOwnPtr<NamedNodeMap> create(Element* element = 0)
+    static PassOwnPtr<NamedNodeMap> create(Element* element)
     {
         return adoptPtr(new NamedNodeMap(element));
     }
@@ -53,58 +55,22 @@ public:
     PassRefPtr<Node> getNamedItemNS(const String& namespaceURI, const String& localName) const;
     PassRefPtr<Node> removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode&);
 
-    PassRefPtr<Node> getNamedItem(const QualifiedName& name) const;
-    PassRefPtr<Node> removeNamedItem(const QualifiedName& name, ExceptionCode&);
     PassRefPtr<Node> setNamedItem(Node*, ExceptionCode&);
     PassRefPtr<Node> setNamedItemNS(Node*, ExceptionCode&);
 
     PassRefPtr<Node> item(unsigned index) const;
-    size_t length() const { return m_attributeData.length(); }
-    bool isEmpty() const { return m_attributeData.isEmpty(); }
-
-    // Internal interface.
-
-    Attribute* attributeItem(unsigned index) const { return m_attributeData.attributeItem(index); }
-    Attribute* getAttributeItem(const QualifiedName& name) const { return m_attributeData.getAttributeItem(name); }
-    size_t getAttributeItemIndex(const QualifiedName& name) const { return m_attributeData.getAttributeItemIndex(name); }
-
-    void shrinkToLength() { m_attributeData.m_attributes.shrinkCapacity(length()); }
-    void reserveInitialCapacity(unsigned capacity) { m_attributeData.m_attributes.reserveInitialCapacity(capacity); }
-
-    // Used during parsing: only inserts if not already there. No error checking!
-    void insertAttribute(PassRefPtr<Attribute> newAttribute, bool allowDuplicates)
-    {
-        ASSERT(!m_element);
-        if (allowDuplicates || !getAttributeItem(newAttribute->name()))
-            addAttribute(newAttribute);
-    }
-
-    bool mapsEquivalent(const NamedNodeMap* otherMap) const;
-
-    // These functions do no error checking.
-    void addAttribute(PassRefPtr<Attribute> attribute) { m_attributeData.addAttribute(attribute, m_element); }
-    void removeAttribute(const QualifiedName& name) { m_attributeData.removeAttribute(name, m_element); }
-    void removeAttribute(size_t index) { m_attributeData.removeAttribute(index, m_element); }
+    size_t length() const;
 
     Element* element() const { return m_element; }
 
-    ElementAttributeData* attributeData() { return &m_attributeData; }
-    const ElementAttributeData* attributeData() const { return &m_attributeData; }
-
 private:
     NamedNodeMap(Element* element)
         : m_element(element)
     {
+        // Only supports NamedNodeMaps with Element associated, DocumentType.entities and DocumentType.notations are not supported yet.
+        ASSERT(m_element);
     }
 
-    void detachFromElement();
-    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const { return m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase); }
-
-    // FIXME: NamedNodeMap is being broken up into two classes, one containing data
-    //        for elements with attributes, and one for exposure to the DOM.
-    //        See <http://webkit.org/b/75069> for more information.
-    ElementAttributeData m_attributeData;
-
     Element* m_element;
 };
 
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index 2e9c61a7e..aa789f517 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -86,7 +86,7 @@
 #include "ScopedEventQueue.h"
 #include "SelectorQuery.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "StaticNodeList.h"
 #include "StorageEvent.h"
 #include "TagNodeList.h"
@@ -120,8 +120,6 @@
 #include "HTMLPropertiesCollection.h"
 #endif
 
-#define DUMP_NODE_STATISTICS 0
-
 using namespace std;
 
 namespace WebCore {
@@ -161,13 +159,21 @@ void Node::dumpStatistics()
 
     size_t attributes = 0;
     size_t attributesWithAttr = 0;
-    size_t attrMaps = 0;
+    size_t elementsWithAttributeStorage = 0;
+    size_t elementsWithRareData = 0;
+    size_t elementsWithNamedNodeMap = 0;
 
     for (HashSet<Node*>::iterator it = liveNodeSet.begin(); it != liveNodeSet.end(); ++it) {
         Node* node = *it;
 
-        if (node->hasRareData())
+        if (node->hasRareData()) {
             ++nodesWithRareData;
+            if (node->isElementNode()) {
+                ++elementsWithRareData;
+                if (toElement(node)->hasNamedNodeMap())
+                    ++elementsWithNamedNodeMap;
+            }
+        }
 
         switch (node->nodeType()) {
             case ELEMENT_NODE: {
@@ -179,12 +185,11 @@ void Node::dumpStatistics()
                 if (!result.second)
                     result.first->second++;
 
-                // AttributeMap stats
-                if (NamedNodeMap* attrMap = element->attributes(true)) {
-                    attributes += attrMap->length();
-                    ++attrMaps;
-                    for (unsigned i = 0; i < attrMap->length(); ++i) {
-                        Attribute* attr = attrMap->attributeItem(i);
+                if (ElementAttributeData* attributeData = element->attributeData()) {
+                    attributes += attributeData->length();
+                    ++elementsWithAttributeStorage;
+                    for (unsigned i = 0; i < attributeData->length(); ++i) {
+                        Attribute* attr = attributeData->attributeItem(i);
                         if (attr->attr())
                             ++attributesWithAttr;
                     }
@@ -248,7 +253,7 @@ void Node::dumpStatistics()
     printf("Number of Nodes: %d\n\n", liveNodeSet.size());
     printf("Number of Nodes with RareData: %zu\n\n", nodesWithRareData);
 
-    printf("NodeType distrubution:\n");
+    printf("NodeType distribution:\n");
     printf("  Number of Element nodes: %zu\n", elementNodes);
     printf("  Number of Attribute nodes: %zu\n", attrNodes);
     printf("  Number of Text nodes: %zu\n", textNodes);
@@ -268,10 +273,12 @@ void Node::dumpStatistics()
     for (HashMap<String, size_t>::iterator it = perTagCount.begin(); it != perTagCount.end(); ++it)
         printf("  Number of <%s> tags: %zu\n", it->first.utf8().data(), it->second);
 
-    printf("Attribute Maps:\n");
+    printf("Attributes:\n");
     printf("  Number of Attributes (non-Node and Node): %zu [%zu]\n", attributes, sizeof(Attribute));
     printf("  Number of Attributes with an Attr: %zu\n", attributesWithAttr);
-    printf("  Number of NamedNodeMaps: %zu [%zu]\n", attrMaps, sizeof(NamedNodeMap));
+    printf("  Number of Elements with attribute storage: %zu [%zu]\n", elementsWithAttributeStorage, sizeof(ElementAttributeData));
+    printf("  Number of Elements with RareData: %zu\n", elementsWithRareData);
+    printf("  Number of Elements with NamedNodeMap: %zu [%zu]\n", elementsWithNamedNodeMap, sizeof(NamedNodeMap));
 #endif
 }
 
@@ -798,7 +805,7 @@ bool Node::hasNonEmptyBoundingBox() const
     if (!box->borderBoundingBox().isEmpty())
         return true;
 
-    Vector<LayoutRect> rects;
+    Vector<IntRect> rects;
     FloatPoint absPos = renderer()->localToAbsolute();
     renderer()->absoluteRects(rects, flooredLayoutPoint(absPos));
     size_t n = rects.size();
@@ -811,7 +818,7 @@ bool Node::hasNonEmptyBoundingBox() const
 
 inline static ShadowRoot* oldestShadowRootFor(const Node* node)
 {
-    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->oldestShadowRoot() : 0;
+    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowTree()->oldestShadowRoot() : 0;
 }
 
 inline void Node::setStyleChange(StyleChangeType changeType)
@@ -965,6 +972,7 @@ void Node::invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName& at
 #if ENABLE(MICRODATA)
         && attrName != itemscopeAttr
         && attrName != itempropAttr
+        && attrName != itemtypeAttr
 #endif
         && attrName != nameAttr)
         return;
@@ -1031,6 +1039,16 @@ void Node::removeCachedClassNodeList(ClassNodeList* list, const String& classNam
     data->m_classNodeListCache.remove(className);
 }
 
+void Node::removeCachedRegionNodeList(RegionNodeList* list, const AtomicString& flowName)
+{
+    ASSERT(rareData());
+    ASSERT(rareData()->nodeLists());
+
+    NodeListsNodeData* data = rareData()->nodeLists();
+    ASSERT_UNUSED(list, list == data->m_regionNodeListCache.get(flowName));
+    data->m_regionNodeListCache.remove(flowName);
+}
+
 void Node::removeCachedNameNodeList(NameNodeList* list, const String& nodeName)
 {
     ASSERT(rareData());
@@ -1470,12 +1488,6 @@ bool Node::canStartSelection() const
     return parentOrHostNode() ? parentOrHostNode()->canStartSelection() : true;
 }
 
-#if ENABLE(SVG)
-SVGUseElement* Node::svgShadowHost() const
-{
-    return isSVGShadowRoot() ? static_cast<SVGUseElement*>(parent()) : 0;
-}
-#endif
 
 Node* Node::shadowAncestorNode() const
 {
@@ -1498,7 +1510,7 @@ Node* Node::shadowTreeRootNode() const
 {
     Node* root = const_cast<Node*>(this);
     while (root) {
-        if (root->isShadowRoot() || root->isSVGShadowRoot())
+        if (root->isShadowRoot())
             return root;
         root = root->parentNodeGuaranteedHostFree();
     }
@@ -1510,7 +1522,7 @@ Node* Node::nonBoundaryShadowTreeRootNode()
     ASSERT(!isShadowRoot());
     Node* root = this;
     while (root) {
-        if (root->isShadowRoot() || root->isSVGShadowRoot())
+        if (root->isShadowRoot())
             return root;
         Node* parent = root->parentNodeGuaranteedHostFree();
         if (parent && parent->isShadowRoot())
@@ -1526,7 +1538,7 @@ ContainerNode* Node::nonShadowBoundaryParentNode() const
     return parent && !parent->isShadowRoot() ? parent : 0;
 }
 
-bool Node::isInShadowTree()
+bool Node::isInShadowTree() const
 {
     return treeScope() != document();
 }
@@ -1667,6 +1679,18 @@ PassRefPtr<NodeList> Node::getElementsByClassName(const String& classNames)
     return list.release();
 }
 
+PassRefPtr<NodeList> Node::getRegionsByContentNode(const AtomicString& flowName)
+{
+    pair<NodeListsNodeData::RegionNodeListCache::iterator, bool> result
+    = ensureRareData()->ensureNodeLists(this)->m_regionNodeListCache.add(flowName, 0);
+    if (!result.second)
+        return PassRefPtr<NodeList>(result.first->second);
+    
+    RefPtr<RegionNodeList> list = RegionNodeList::create(this, flowName);
+    result.first->second = list.get();
+    return list.release();
+}
+
 PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode& ec)
 {
     if (selectors.isEmpty()) {
@@ -1756,18 +1780,8 @@ bool Node::isEqualNode(Node* other) const
     if (nodeValue() != other->nodeValue())
         return false;
     
-    if (isElementNode()) {
-        NamedNodeMap* attributes = toElement(this)->updatedAttributes();
-        NamedNodeMap* otherAttributes = toElement(other)->updatedAttributes();
-
-        if (attributes) {
-            if (!attributes->mapsEquivalent(otherAttributes))
-                return false;
-        } else if (otherAttributes) {
-            if (!otherAttributes->mapsEquivalent(attributes))
-                return false;
-        }
-    }
+    if (isElementNode() && !toElement(this)->hasEquivalentAttributes(toElement(other)))
+        return false;
     
     Node* child = firstChild();
     Node* otherChild = other->firstChild();
@@ -1796,19 +1810,7 @@ bool Node::isEqualNode(Node* other) const
         if (documentTypeThis->internalSubset() != documentTypeOther->internalSubset())
             return false;
 
-        NamedNodeMap* entities = documentTypeThis->entities();
-        NamedNodeMap* otherEntities = documentTypeOther->entities();
-        if (!entities && otherEntities)
-            return false;
-        if (entities && !entities->mapsEquivalent(otherEntities))
-            return false;
-
-        NamedNodeMap* notations = documentTypeThis->notations();
-        NamedNodeMap* otherNotations = documentTypeOther->notations();
-        if (!notations && otherNotations)
-            return false;
-        if (notations && !notations->mapsEquivalent(otherNotations))
-            return false;
+        // FIXME: We don't compare entities or notations because currently both are always empty.
     }
     
     return true;
@@ -2043,7 +2045,7 @@ void Node::setTextContent(const String& text, ExceptionCode& ec)
         case ENTITY_NODE:
         case ENTITY_REFERENCE_NODE:
         case DOCUMENT_FRAGMENT_NODE: {
-            ContainerNode* container = toContainerNode(this);
+            RefPtr<ContainerNode> container = toContainerNode(this);
 #if ENABLE(MUTATION_OBSERVERS)
             ChildListMutationScope mutation(this);
 #endif
@@ -2107,7 +2109,7 @@ unsigned short Node::compareDocumentPosition(Node* otherNode)
     if (attr1 && attr2 && start1 == start2 && start1) {
         // We are comparing two attributes on the same node. Crawl our attribute map and see which one we hit first.
         Element* owner1 = attr1->ownerElement();
-        owner1->updatedAttributes(); // Force update invalid attributes.
+        owner1->updatedAttributeData(); // Force update invalid attributes.
         unsigned length = owner1->attributeCount();
         for (unsigned i = 0; i < length; ++i) {
             // If neither of the two determining nodes is a child node and nodeType is the same for both determining nodes, then an 
@@ -2204,23 +2206,6 @@ FloatPoint Node::convertFromPage(const FloatPoint& p) const
     return p;
 }
 
-#if ENABLE(MICRODATA)
-void Node::itemTypeAttributeChanged()
-{
-    Node * rootNode = document();
-
-    if (!rootNode->hasRareData())
-        return;
-
-    NodeRareData* data = rootNode->rareData();
-
-    if (!data->nodeLists())
-        return;
-
-    data->nodeLists()->invalidateMicrodataItemListCaches();
-}
-#endif
-
 #ifndef NDEBUG
 
 static void appendAttributeDesc(const Node* node, String& string, const QualifiedName& name, const char* attrDesc)
@@ -2352,6 +2337,9 @@ void NodeListsNodeData::invalidateCaches()
     TagNodeListCacheNS::const_iterator tagCacheNSEnd = m_tagNodeListCacheNS.end();
     for (TagNodeListCacheNS::const_iterator it = m_tagNodeListCacheNS.begin(); it != tagCacheNSEnd; ++it)
         it->second->invalidateCache();
+    RegionNodeListCache::const_iterator regionListCacheEnd = m_regionNodeListCache.end();
+    for (RegionNodeListCache::const_iterator it = m_regionNodeListCache.begin(); it != regionListCacheEnd; ++it)
+        it->second->invalidateCache();
     invalidateCachesThatDependOnAttributes();
 }
 
@@ -2368,18 +2356,11 @@ void NodeListsNodeData::invalidateCachesThatDependOnAttributes()
         m_labelsNodeListCache->invalidateCache();
 
 #if ENABLE(MICRODATA)
-    invalidateMicrodataItemListCaches();
-#endif
-}
-
-#if ENABLE(MICRODATA)
-void NodeListsNodeData::invalidateMicrodataItemListCaches()
-{
     MicroDataItemListCache::iterator itemListCacheEnd = m_microDataItemListCache.end();
     for (MicroDataItemListCache::iterator it = m_microDataItemListCache.begin(); it != itemListCacheEnd; ++it)
         it->second->invalidateCache();
-}
 #endif
+}
 
 bool NodeListsNodeData::isEmpty() const
 {
@@ -2398,10 +2379,12 @@ bool NodeListsNodeData::isEmpty() const
     if (!m_microDataItemListCache.isEmpty())
         return false;
 #endif
+    if (!m_regionNodeListCache.isEmpty())
+        return false;
 
     if (m_labelsNodeListCache)
         return false;
-
+    
     return true;
 }
 
@@ -2435,12 +2418,12 @@ ScriptExecutionContext* Node::scriptExecutionContext() const
 
 void Node::insertedIntoDocument()
 {
-    setInDocument();
+    setFlag(InDocumentFlag);
 }
 
 void Node::removedFromDocument()
 {
-    clearInDocument();
+    clearFlag(InDocumentFlag);
 }
 
 void Node::didMoveToNewDocument(Document* oldDocument)
@@ -2793,9 +2776,10 @@ bool Node::dispatchEvent(PassRefPtr<Event> event)
 
 void Node::dispatchSubtreeModifiedEvent()
 {
+    if (isInShadowTree())
+        return;
+
     ASSERT(!eventDispatchForbidden());
-    
-    document()->incDOMTreeVersion();
 
     if (!document()->hasListenerType(Document::DOMSUBTREEMODIFIED_LISTENER))
         return;
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 9ca126498..b2d403e14 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -44,6 +44,9 @@ namespace JSC {
 }
 #endif
 
+// This needs to be here because Document.h also depends on it.
+#define DUMP_NODE_STATISTICS 0
+
 namespace WebCore {
 
 class Attribute;
@@ -72,15 +75,13 @@ class PlatformKeyboardEvent;
 class PlatformMouseEvent;
 class PlatformWheelEvent;
 class QualifiedName;
+class RegionNodeList;
 class RegisteredEventListener;
 class RenderArena;
 class RenderBox;
 class RenderBoxModelObject;
 class RenderObject;
 class RenderStyle;
-#if ENABLE(SVG)
-class SVGUseElement;
-#endif
 class TagNodeList;
 class TreeScope;
 
@@ -90,7 +91,7 @@ class HTMLPropertiesCollection;
 
 typedef int ExceptionCode;
 
-const int nodeStyleChangeShift = 23;
+const int nodeStyleChangeShift = 22;
 
 // SyntheticStyleChange means that we need to go through the entire style change logic even though
 // no style property has actually changed. It is used to restructure the tree when, for instance,
@@ -204,14 +205,8 @@ public:
     bool isElementNode() const { return getFlag(IsElementFlag); }
     bool isContainerNode() const { return getFlag(IsContainerFlag); }
     bool isTextNode() const { return getFlag(IsTextFlag); }
-
     bool isHTMLElement() const { return getFlag(IsHTMLFlag); }
-
     bool isSVGElement() const { return getFlag(IsSVGFlag); }
-    bool isSVGShadowRoot() const { return getFlag(IsShadowRootOrSVGShadowRootFlag) && isSVGElement(); }
-#if ENABLE(SVG)
-    SVGUseElement* svgShadowHost() const;
-#endif
 
     virtual bool isMediaControlElement() const { return false; }
     virtual bool isMediaControls() const { return false; }
@@ -221,22 +216,18 @@ public:
     bool isCommentNode() const { return getFlag(IsCommentFlag); }
     virtual bool isCharacterDataNode() const { return false; }
     bool isDocumentNode() const;
-    bool isShadowRoot() const { return getFlag(IsShadowRootOrSVGShadowRootFlag) && !isSVGElement(); }
-    virtual bool isContentElement() const { return false; }
-#if ENABLE(SHADOW_DOM)
-    virtual bool isShadowElement() const { return false; }
-#endif
+    bool isShadowRoot() const { return getFlag(IsShadowRootFlag); }
 
     Node* shadowAncestorNode() const;
     // Returns 0, a ShadowRoot, or a legacy shadow root.
     Node* shadowTreeRootNode() const;
     // Returns 0, a child of ShadowRoot, or a legacy shadow root.
     Node* nonBoundaryShadowTreeRootNode();
-    bool isInShadowTree();
-    // Node's parent, shadow tree host, or SVG use.
+    bool isInShadowTree() const;
+    // Node's parent, shadow tree host.
     ContainerNode* parentOrHostNode() const;
     Element* parentOrHostElement() const;
-    // Use when it's guaranteed to that shadowHost is 0 and svgShadowHost is 0.
+    // Use when it's guaranteed to that shadowHost is 0.
     ContainerNode* parentNodeGuaranteedHostFree() const;
     // Returns the parent node, but 0 if the parent node is a ShadowRoot.
     ContainerNode* nonShadowBoundaryParentNode() const;
@@ -297,6 +288,7 @@ public:
 
     // For <link> and <style> elements.
     virtual bool sheetLoaded() { return true; }
+    virtual void notifyLoadedSheetAndAllCriticalSubresources(bool /* error loading subresource */) { }
     virtual void startLoadingDynamicSheet() { ASSERT_NOT_REACHED(); }
 
     bool attributeStyleDirty() const { return getFlag(AttributeStyleDirtyFlag); }
@@ -322,8 +314,6 @@ public:
     void setHasName(bool f) { setFlag(f, HasNameFlag); }
     void setChildNeedsStyleRecalc() { setFlag(ChildNeedsStyleRecalcFlag); }
     void clearChildNeedsStyleRecalc() { clearFlag(ChildNeedsStyleRecalcFlag); }
-    void setInDocument() { setFlag(InDocumentFlag); }
-    void clearInDocument() { clearFlag(InDocumentFlag); }
 
     void setInActiveChain() { setFlag(InActiveChainFlag); }
     void clearInActiveChain() { clearFlag(InActiveChainFlag); }
@@ -508,7 +498,7 @@ public:
     RenderStyle* computedStyle(PseudoId pseudoElementSpecifier = NOPSEUDO) { return virtualComputedStyle(pseudoElementSpecifier); }
 
     // -----------------------------------------------------------------------------
-    // Notification of document structure changes
+    // Notification of document structure changes (see ContainerNode.h for more notification methods)
 
     // Notifies the node that it has been inserted into the document. This is called during document parsing, and also
     // when a node is added through the DOM methods insertBefore(), appendChild() or replaceChild(). Note that this only
@@ -526,16 +516,6 @@ public:
     // dispatching, and is called _after_ the node is removed from the tree.
     virtual void removedFromDocument();
 
-    // These functions are called whenever you are connected or disconnected from a tree.  That tree may be the main
-    // document tree, or it could be another disconnected tree.  Override these functions to do any work that depends
-    // on connectedness to some ancestor (e.g., an ancestor <form> for example).
-    virtual void insertedIntoTree(bool /*deep*/) { }
-    virtual void removedFromTree(bool /*deep*/) { }
-
-    // Notifies the node that it's list of children have changed (either by adding or removing child nodes), or a child
-    // node that is of the type CDATA_SECTION_NODE, TEXT_NODE or COMMENT_NODE has changed its value.
-    virtual void childrenChanged(bool /*changedByParser*/ = false, Node* /*beforeChange*/ = 0, Node* /*afterChange*/ = 0, int /*childCountDelta*/ = 0) { }
-
 #ifndef NDEBUG
     virtual void formatForDebugger(char* buffer, unsigned length) const;
 
@@ -549,6 +529,7 @@ public:
     void unregisterDynamicSubtreeNodeList(DynamicSubtreeNodeList*);
     void invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName&);
     void invalidateNodeListsCacheAfterChildrenChanged();
+    void invalidateRegionListCache();
     void notifyLocalNodeListsLabelChanged();
     void removeCachedClassNodeList(ClassNodeList*, const String&);
 
@@ -556,6 +537,7 @@ public:
     void removeCachedTagNodeList(TagNodeList*, const AtomicString&);
     void removeCachedTagNodeList(TagNodeList*, const QualifiedName&);
     void removeCachedLabelsNodeList(DynamicSubtreeNodeList*);
+    void removeCachedRegionNodeList(RegionNodeList*, const AtomicString&);
 
     void removeCachedChildNodeList();
 
@@ -563,6 +545,7 @@ public:
     PassRefPtr<NodeList> getElementsByTagNameNS(const AtomicString& namespaceURI, const AtomicString& localName);
     PassRefPtr<NodeList> getElementsByName(const String& elementName);
     PassRefPtr<NodeList> getElementsByClassName(const String& classNames);
+    PassRefPtr<NodeList> getRegionsByContentNode(const AtomicString& flowName);
 
     PassRefPtr<Element> querySelector(const String& selectors, ExceptionCode&);
     PassRefPtr<NodeList> querySelectorAll(const String& selectors, ExceptionCode&);
@@ -620,8 +603,6 @@ public:
     virtual EventTargetData* ensureEventTargetData();
 
 #if ENABLE(MICRODATA)
-    void itemTypeAttributeChanged();
-
     DOMSettableTokenList* itemProp();
     DOMSettableTokenList* itemRef();
     DOMSettableTokenList* itemType();
@@ -662,28 +643,27 @@ private:
         InActiveChainFlag = 1 << 13,
         InDetachFlag = 1 << 14,
         HasRareDataFlag = 1 << 15,
-        IsShadowRootOrSVGShadowRootFlag = 1 << 16,
+        IsShadowRootFlag = 1 << 16,
 
         // These bits are used by derived classes, pulled up here so they can
         // be stored in the same memory word as the Node bits above.
         IsParsingChildrenFinishedFlag = 1 << 17, // Element
         IsStyleAttributeValidFlag = 1 << 18, // StyledElement
-        IsSynchronizingStyleAttributeFlag = 1 << 19, // StyledElement
 #if ENABLE(SVG)
-        AreSVGAttributesValidFlag = 1 << 20, // Element
-        IsSynchronizingSVGAttributesFlag = 1 << 21, // SVGElement
-        HasSVGRareDataFlag = 1 << 22, // SVGElement
+        AreSVGAttributesValidFlag = 1 << 19, // Element
+        IsSynchronizingSVGAttributesFlag = 1 << 20, // SVGElement
+        HasSVGRareDataFlag = 1 << 21, // SVGElement
 #endif
 
         StyleChangeMask = 1 << nodeStyleChangeShift | 1 << (nodeStyleChangeShift + 1),
 
-        SelfOrAncestorHasDirAutoFlag = 1 << 25,
-        HasCustomWillOrDidRecalcStyleFlag = 1 << 26,
-        HasCustomStyleForRendererFlag = 1 << 27,
+        SelfOrAncestorHasDirAutoFlag = 1 << 24,
+        HasCustomWillOrDidRecalcStyleFlag = 1 << 25,
+        HasCustomStyleForRendererFlag = 1 << 26,
 
-        HasNameFlag = 1 << 28,
+        HasNameFlag = 1 << 27,
 
-        AttributeStyleDirtyFlag = 1 << 31,
+        AttributeStyleDirtyFlag = 1 << 28,
 
 #if ENABLE(SVG)
         DefaultNodeFlags = IsParsingChildrenFinishedFlag | IsStyleAttributeValidFlag | AreSVGAttributesValidFlag
@@ -706,11 +686,11 @@ protected:
         CreateComment = DefaultNodeFlags | IsCommentFlag,
         CreateContainer = DefaultNodeFlags | IsContainerFlag, 
         CreateElement = CreateContainer | IsElementFlag, 
-        CreateShadowRoot = CreateContainer | IsShadowRootOrSVGShadowRootFlag,
+        CreateShadowRoot = CreateContainer | IsShadowRootFlag,
         CreateStyledElement = CreateElement | IsStyledElementFlag, 
         CreateHTMLElement = CreateStyledElement | IsHTMLFlag, 
         CreateSVGElement = CreateStyledElement | IsSVGFlag,
-        CreateSVGShadowRoot = CreateSVGElement | IsShadowRootOrSVGShadowRootFlag,
+        CreateDocument = CreateContainer | InDocumentFlag
     };
     Node(Document*, ConstructionType);
 
@@ -790,10 +770,6 @@ protected:
     void setIsStyleAttributeValid(bool f) { setFlag(f, IsStyleAttributeValidFlag); }
     void setIsStyleAttributeValid() const { setFlag(IsStyleAttributeValidFlag); }
     void clearIsStyleAttributeValid() { clearFlag(IsStyleAttributeValidFlag); }
-    bool isSynchronizingStyleAttribute() const { return getFlag(IsSynchronizingStyleAttributeFlag); }
-    void setIsSynchronizingStyleAttribute(bool f) { setFlag(f, IsSynchronizingStyleAttributeFlag); }
-    void setIsSynchronizingStyleAttribute() const { setFlag(IsSynchronizingStyleAttributeFlag); }
-    void clearIsSynchronizingStyleAttribute() const { clearFlag(IsSynchronizingStyleAttributeFlag); }
 
 #if ENABLE(SVG)
     bool areSVGAttributesValid() const { return getFlag(AreSVGAttributesValidFlag); }
@@ -823,7 +799,7 @@ inline void addSubresourceURL(ListHashSet<KURL>& urls, const KURL& url)
 
 inline ContainerNode* Node::parentNode() const
 {
-    return getFlag(IsShadowRootOrSVGShadowRootFlag) ? 0 : parent();
+    return getFlag(IsShadowRootFlag) ? 0 : parent();
 }
 
 inline ContainerNode* Node::parentOrHostNode() const
@@ -833,7 +809,7 @@ inline ContainerNode* Node::parentOrHostNode() const
 
 inline ContainerNode* Node::parentNodeGuaranteedHostFree() const
 {
-    ASSERT(!getFlag(IsShadowRootOrSVGShadowRootFlag));
+    ASSERT(!getFlag(IsShadowRootFlag));
     return parentOrHostNode();
 }
 
diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
index 0864b2626..97a0fbabd 100644
--- a/Source/WebCore/dom/NodeRareData.h
+++ b/Source/WebCore/dom/NodeRareData.h
@@ -29,6 +29,7 @@
 #include "MutationObserverRegistration.h"
 #include "NameNodeList.h"
 #include "QualifiedName.h"
+#include "RegionNodeList.h"
 #include "TagNodeList.h"
 #include "WebKitMutationObserver.h"
 #include <wtf/HashSet.h>
@@ -71,6 +72,9 @@ public:
 #endif
 
     LabelsNodeList* m_labelsNodeListCache;
+
+    typedef HashMap<AtomicString, RegionNodeList*> RegionNodeListCache;
+    RegionNodeListCache m_regionNodeListCache;
  
     static PassOwnPtr<NodeListsNodeData> create()
     {
@@ -80,10 +84,6 @@ public:
     void invalidateCaches();
     void invalidateCachesThatDependOnAttributes();
 
-#if ENABLE(MICRODATA)
-    void invalidateMicrodataItemListCaches();
-#endif
-
     bool isEmpty() const;
 
 private:
diff --git a/Source/WebCore/dom/NodeRenderingContext.cpp b/Source/WebCore/dom/NodeRenderingContext.cpp
index cdcb102d8..93f316668 100644
--- a/Source/WebCore/dom/NodeRenderingContext.cpp
+++ b/Source/WebCore/dom/NodeRenderingContext.cpp
@@ -29,13 +29,15 @@
 #include "ContainerNode.h"
 #include "HTMLContentElement.h"
 #include "HTMLContentSelector.h"
+#include "HTMLNames.h"
+#include "HTMLShadowElement.h"
 #include "Node.h"
 #include "RenderFlowThread.h"
 #include "RenderFullScreen.h"
 #include "RenderObject.h"
 #include "RenderView.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 
 #if ENABLE(SVG)
 #include "SVGNames.h"
@@ -43,11 +45,16 @@
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
+static RenderObject* firstRendererOf(Node*);
+static RenderObject* lastRendererOf(Node*);
+
 NodeRenderingContext::NodeRenderingContext(Node* node)
     : m_phase(AttachingNotInTree)
     , m_node(node)
     , m_parentNodeForRenderingAndStyle(0)
-    , m_visualParentShadowRootList(0)
+    , m_visualParentShadowTree(0)
     , m_insertionPoint(0)
     , m_style(0)
     , m_parentFlowRenderer(0)
@@ -56,20 +63,25 @@ NodeRenderingContext::NodeRenderingContext(Node* node)
     if (!parent)
         return;
 
-    if (parent->isShadowRoot()) {
+    if (parent->isShadowRoot() && toShadowRoot(parent)->isYoungest()) {
         m_phase = AttachingShadowChild;
         m_parentNodeForRenderingAndStyle = parent->shadowHost();
         return;
     }
 
-    if (parent->isElementNode()) {
-        if (toElement(parent)->hasShadowRoot()) {
-            m_visualParentShadowRootList = toElement(parent)->shadowRootList();
-            if ((m_insertionPoint = m_visualParentShadowRootList->insertionPointFor(m_node))
-                && m_visualParentShadowRootList->isSelectorActive()) {
-                m_phase = AttachingDistributed;
-                m_parentNodeForRenderingAndStyle = NodeRenderingContext(m_insertionPoint).parentNodeForRenderingAndStyle();
-                return;
+    if (parent->isElementNode() || parent->isShadowRoot()) {
+        if (parent->isElementNode() && toElement(parent)->hasShadowRoot())
+            m_visualParentShadowTree = toElement(parent)->shadowTree();
+        else if (parent->isShadowRoot())
+            m_visualParentShadowTree = toShadowRoot(parent)->tree();
+
+        if (m_visualParentShadowTree) {
+            if ((m_insertionPoint = m_visualParentShadowTree->insertionPointFor(m_node))) {
+                if (toShadowRoot(m_insertionPoint->shadowTreeRootNode())->isUsedForRendering()) {
+                    m_phase = AttachingDistributed;
+                    m_parentNodeForRenderingAndStyle = NodeRenderingContext(m_insertionPoint).parentNodeForRenderingAndStyle();
+                    return;
+                }
             }
 
             m_phase = AttachingNotDistributed;
@@ -77,7 +89,13 @@ NodeRenderingContext::NodeRenderingContext(Node* node)
             return;
         }
 
-        if (isInsertionPoint(parent)) {
+        if (isShadowBoundary(parent)) {
+            if (!toShadowRoot(parent->shadowTreeRootNode())->isUsedForRendering()) {
+                m_phase = AttachingNotDistributed;
+                m_parentNodeForRenderingAndStyle = parent;
+                return;
+            }
+
             if (toInsertionPoint(parent)->hasSelection())
                 m_phase = AttachingNotFallbacked;
             else
@@ -95,7 +113,7 @@ NodeRenderingContext::NodeRenderingContext(Node* node, RenderStyle* style)
     : m_phase(Calculating)
     , m_node(node)
     , m_parentNodeForRenderingAndStyle(0)
-    , m_visualParentShadowRootList(0)
+    , m_visualParentShadowTree(0)
     , m_insertionPoint(0)
     , m_style(style)
     , m_parentFlowRenderer(0)
@@ -117,7 +135,7 @@ PassRefPtr<RenderStyle> NodeRenderingContext::releaseStyle()
     return m_style.release();
 }
 
-static RenderObject* nextRendererOf(InsertionPoint* parent, Node* current)
+static inline RenderObject* nextRendererOfInsertionPoint(InsertionPoint* parent, Node* current)
 {
     HTMLContentSelection* currentSelection = parent->selections()->find(current);
     if (!currentSelection)
@@ -131,7 +149,7 @@ static RenderObject* nextRendererOf(InsertionPoint* parent, Node* current)
     return 0;
 }
 
-static RenderObject* previousRendererOf(InsertionPoint* parent, Node* current)
+static inline RenderObject* previousRendererOfInsertionPoint(InsertionPoint* parent, Node* current)
 {
     RenderObject* lastRenderer = 0;
 
@@ -145,7 +163,7 @@ static RenderObject* previousRendererOf(InsertionPoint* parent, Node* current)
     return lastRenderer;
 }
 
-static RenderObject* firstRendererOf(InsertionPoint* parent)
+static inline RenderObject* firstRendererOfInsertionPoint(InsertionPoint* parent)
 {
     if (parent->hasSelection()) {
         for (HTMLContentSelection* selection = parent->selections()->first(); selection; selection = selection->next()) {
@@ -156,10 +174,10 @@ static RenderObject* firstRendererOf(InsertionPoint* parent)
         return 0;
     }
 
-    return NodeRenderingContext(parent).nextRenderer();
+    return firstRendererOf(parent->firstChild());
 }
 
-static RenderObject* lastRendererOf(InsertionPoint* parent)
+static inline RenderObject* lastRendererOfInsertionPoint(InsertionPoint* parent)
 {
     if (parent->hasSelection()) {
         for (HTMLContentSelection* selection = parent->selections()->last(); selection; selection = selection->previous()) {
@@ -170,7 +188,44 @@ static RenderObject* lastRendererOf(InsertionPoint* parent)
         return 0;
     }
 
-    return NodeRenderingContext(parent).previousRenderer();
+    return lastRendererOf(parent->lastChild());
+}
+
+static inline RenderObject* firstRendererOf(Node* node)
+{
+    for (; node; node = node->nextSibling()) {
+        if (node->renderer()) {
+            // Do not return elements that are attached to a different flow-thread.
+            if (node->renderer()->style() && !node->renderer()->style()->flowThread().isEmpty())
+                continue;
+            return node->renderer();
+        }
+
+        if (isInsertionPoint(node)) {
+            if (RenderObject* first = firstRendererOfInsertionPoint(toInsertionPoint(node)))
+                return first;
+        }
+    }
+
+    return 0;
+}
+
+static inline RenderObject* lastRendererOf(Node* node)
+{
+    for (; node; node = node->previousSibling()) {
+        if (node->renderer()) {
+            // Do not return elements that are attached to a different flow-thread.
+            if (node->renderer()->style() && !node->renderer()->style()->flowThread().isEmpty())
+                continue;
+            return node->renderer();
+        }
+        if (isInsertionPoint(node)) {
+            if (RenderObject* last = lastRendererOfInsertionPoint(toInsertionPoint(node)))
+                return last;
+        }
+    }
+
+    return 0;
 }
 
 RenderObject* NodeRenderingContext::nextRenderer() const
@@ -183,7 +238,7 @@ RenderObject* NodeRenderingContext::nextRenderer() const
         return m_parentFlowRenderer->nextRendererForNode(m_node);
 
     if (m_phase == AttachingDistributed) {
-        if (RenderObject* found = nextRendererOf(m_insertionPoint, m_node))
+        if (RenderObject* found = nextRendererOfInsertionPoint(m_insertionPoint, m_node))
             return found;
         return NodeRenderingContext(m_insertionPoint).nextRenderer();
     }
@@ -193,21 +248,7 @@ RenderObject* NodeRenderingContext::nextRenderer() const
     if (m_node->parentOrHostNode() && !m_node->parentOrHostNode()->attached())
         return 0;
 
-    for (Node* node = m_node->nextSibling(); node; node = node->nextSibling()) {
-        if (node->renderer()) {
-            // Do not return elements that are attached to a different flow-thread.
-            if (node->renderer()->style() && !node->renderer()->style()->flowThread().isEmpty())
-                continue;
-            return node->renderer();
-        }
-
-        if (isInsertionPoint(node)) {
-            if (RenderObject* first = firstRendererOf(toInsertionPoint(node)))
-                return first;
-        }
-    }
-
-    return 0;
+    return firstRendererOf(m_node->nextSibling());
 }
 
 RenderObject* NodeRenderingContext::previousRenderer() const
@@ -221,27 +262,14 @@ RenderObject* NodeRenderingContext::previousRenderer() const
         return m_parentFlowRenderer->previousRendererForNode(m_node);
 
     if (m_phase == AttachingDistributed) {
-        if (RenderObject* found = previousRendererOf(m_insertionPoint, m_node))
+        if (RenderObject* found = previousRendererOfInsertionPoint(m_insertionPoint, m_node))
             return found;
         return NodeRenderingContext(m_insertionPoint).previousRenderer();
     }
 
     // FIXME: We should have the same O(N^2) avoidance as nextRenderer does
     // however, when I tried adding it, several tests failed.
-    for (Node* node = m_node->previousSibling(); node; node = node->previousSibling()) {
-        if (node->renderer()) {
-            // Do not return elements that are attached to a different flow-thread.
-            if (node->renderer()->style() && !node->renderer()->style()->flowThread().isEmpty())
-                continue;
-            return node->renderer();
-        }
-        if (isInsertionPoint(node)) {
-            if (RenderObject* last = lastRendererOf(toInsertionPoint(node)))
-                return last;
-        }
-    }
-
-    return 0;
+    return lastRendererOf(m_node->previousSibling());
 }
 
 RenderObject* NodeRenderingContext::parentRenderer() const
@@ -260,8 +288,8 @@ RenderObject* NodeRenderingContext::parentRenderer() const
 
 void NodeRenderingContext::hostChildrenChanged()
 {
-    if (m_phase == AttachingNotDistributed)
-        m_visualParentShadowRootList->hostChildrenChanged();
+    if (m_phase == AttachingNotDistributed && m_visualParentShadowTree)
+        m_visualParentShadowTree->hostChildrenChanged();
 }
 
 bool NodeRenderingContext::shouldCreateRenderer() const
diff --git a/Source/WebCore/dom/NodeRenderingContext.h b/Source/WebCore/dom/NodeRenderingContext.h
index ca20d525c..ce2c2e1f1 100644
--- a/Source/WebCore/dom/NodeRenderingContext.h
+++ b/Source/WebCore/dom/NodeRenderingContext.h
@@ -39,7 +39,7 @@ class Node;
 class RenderFlowThread;
 class RenderObject;
 class RenderStyle;
-class ShadowRootList;
+class ShadowTree;
 
 class NodeRenderingContext {
 public:
@@ -82,7 +82,7 @@ private:
     AttachingPhase m_phase;
     Node* m_node;
     ContainerNode* m_parentNodeForRenderingAndStyle;
-    ShadowRootList* m_visualParentShadowRootList;
+    ShadowTree* m_visualParentShadowTree;
     InsertionPoint* m_insertionPoint;
     RefPtr<RenderStyle> m_style;
     RenderFlowThread* m_parentFlowRenderer;
diff --git a/Source/WebCore/dom/Position.cpp b/Source/WebCore/dom/Position.cpp
index 74b16ab60..31ab445a0 100644
--- a/Source/WebCore/dom/Position.cpp
+++ b/Source/WebCore/dom/Position.cpp
@@ -1152,7 +1152,8 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             }
 
             if (((caretOffset == caretMaxOffset) ^ (affinity == DOWNSTREAM))
-                || ((caretOffset == caretMinOffset) ^ (affinity == UPSTREAM)))
+                || ((caretOffset == caretMinOffset) ^ (affinity == UPSTREAM))
+                || (caretOffset == caretMaxOffset && box->nextLeafChild() && box->nextLeafChild()->isLineBreak()))
                 break;
 
             candidate = box;
@@ -1217,10 +1218,10 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
     }
 
     if (caretOffset == inlineBox->caretLeftmostOffset()) {
-        InlineBox* prevBox = inlineBox->prevLeafChild();
+        InlineBox* prevBox = inlineBox->prevLeafChildIgnoringLineBreak();
         if (!prevBox || prevBox->bidiLevel() < level) {
             // Left edge of a secondary run. Set to the right edge of the entire run.
-            while (InlineBox* nextBox = inlineBox->nextLeafChild()) {
+            while (InlineBox* nextBox = inlineBox->nextLeafChildIgnoringLineBreak()) {
                 if (nextBox->bidiLevel() < level)
                     break;
                 inlineBox = nextBox;
@@ -1228,7 +1229,7 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             caretOffset = inlineBox->caretRightmostOffset();
         } else if (prevBox->bidiLevel() > level) {
             // Right edge of a "tertiary" run. Set to the left edge of that run.
-            while (InlineBox* tertiaryBox = inlineBox->prevLeafChild()) {
+            while (InlineBox* tertiaryBox = inlineBox->prevLeafChildIgnoringLineBreak()) {
                 if (tertiaryBox->bidiLevel() <= level)
                     break;
                 inlineBox = tertiaryBox;
@@ -1236,10 +1237,10 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             caretOffset = inlineBox->caretLeftmostOffset();
         }
     } else {
-        InlineBox* nextBox = inlineBox->nextLeafChild();
+        InlineBox* nextBox = inlineBox->nextLeafChildIgnoringLineBreak();
         if (!nextBox || nextBox->bidiLevel() < level) {
             // Right edge of a secondary run. Set to the left edge of the entire run.
-            while (InlineBox* prevBox = inlineBox->prevLeafChild()) {
+            while (InlineBox* prevBox = inlineBox->prevLeafChildIgnoringLineBreak()) {
                 if (prevBox->bidiLevel() < level)
                     break;
                 inlineBox = prevBox;
@@ -1247,7 +1248,7 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             caretOffset = inlineBox->caretLeftmostOffset();
         } else if (nextBox->bidiLevel() > level) {
             // Left edge of a "tertiary" run. Set to the right edge of that run.
-            while (InlineBox* tertiaryBox = inlineBox->nextLeafChild()) {
+            while (InlineBox* tertiaryBox = inlineBox->nextLeafChildIgnoringLineBreak()) {
                 if (tertiaryBox->bidiLevel() <= level)
                     break;
                 inlineBox = tertiaryBox;
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index 0c00cfda9..88b337b32 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -1275,8 +1275,6 @@ void Range::checkNodeBA(Node* n, ExceptionCode& ec) const
         case Node::PROCESSING_INSTRUCTION_NODE:
         case Node::TEXT_NODE:
         case Node::XPATH_NAMESPACE_NODE:
-            if (root->isSVGShadowRoot())
-                break;
             ec = RangeException::INVALID_NODE_TYPE_ERR;
             return;
     }
@@ -1672,7 +1670,7 @@ IntRect Range::boundingBox()
     const size_t n = rects.size();
     for (size_t i = 0; i < n; ++i)
         result.unite(rects[i]);
-    return pixelSnappedIntRect(result);
+    return result;
 }
 
 void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight, RangeInFixedPosition* inFixed)
diff --git a/Source/WebCore/dom/RegionNodeList.cpp b/Source/WebCore/dom/RegionNodeList.cpp
new file mode 100644
index 000000000..2116d3bcc
--- /dev/null
+++ b/Source/WebCore/dom/RegionNodeList.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RegionNodeList.h"
+
+#include "Document.h"
+#include "RenderFlowThread.h"
+#include "RenderRegion.h"
+#include "WebKitNamedFlow.h"
+
+namespace WebCore {
+
+RegionNodeList::RegionNodeList(PassRefPtr<Node> node, const AtomicString& flowName)
+: DynamicSubtreeNodeList(node->document())
+, m_contentNode(node)
+, m_flowName(flowName)
+{
+}
+
+RegionNodeList::~RegionNodeList()
+{
+    m_contentNode->removeCachedRegionNodeList(this, m_flowName);
+} 
+
+bool RegionNodeList::nodeMatches(Element* testNode) const
+{
+    if (!m_contentNode->renderer())
+        return false;
+
+    if (!testNode->renderer() || !testNode->renderer()->isRenderRegion())
+        return false;
+
+    RenderRegion* region = toRenderRegion(testNode->renderer());
+    if (!region->isValid() || (region->style()->regionThread() != m_flowName))
+        return false;
+
+    return region->flowThread()->objectInFlowRegion(m_contentNode->renderer(), region);
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/dom/RegionNodeList.h b/Source/WebCore/dom/RegionNodeList.h
new file mode 100644
index 000000000..813957d2d
--- /dev/null
+++ b/Source/WebCore/dom/RegionNodeList.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef RegionNodeList_h
+#define RegionNodeList_h
+
+#include "DynamicNodeList.h"
+#include "Node.h"
+
+namespace WebCore {
+
+class RegionNodeList : public DynamicSubtreeNodeList {
+public:
+    static PassRefPtr<RegionNodeList> create(PassRefPtr<Node> node, const AtomicString& flowName)
+    {
+        return adoptRef(new RegionNodeList(node, flowName));
+    }
+    
+    virtual ~RegionNodeList();
+
+protected:
+    virtual bool nodeMatches(Element*) const;
+
+private:
+    RegionNodeList(PassRefPtr<Node>, const AtomicString& flowName);
+    
+    RefPtr<Node> m_contentNode;
+    AtomicString m_flowName;
+};
+    
+} // namespace WebCore
+
+#endif
+
diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
index 895e8337d..6e8e83bb4 100644
--- a/Source/WebCore/dom/ScriptElement.cpp
+++ b/Source/WebCore/dom/ScriptElement.cpp
@@ -199,15 +199,6 @@ bool ScriptElement::prepareScript(const TextPosition& scriptStartPosition, Legac
     if (!document->frame()->script()->canExecuteScripts(AboutToExecuteScript))
         return false;
 
-    Node* ancestor = m_element->parentNode();
-    while (ancestor) {
-        if (ancestor->isSVGShadowRoot()) {
-            fprintf(stderr, "aborted script: shadow root\n");
-            return false;
-        }
-        ancestor = ancestor->parentNode();
-    }
-
     if (!isScriptForEventSupported())
         return false;
 
diff --git a/Source/WebCore/dom/ScriptExecutionContext.cpp b/Source/WebCore/dom/ScriptExecutionContext.cpp
index 9a5682d7f..92445ca80 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.cpp
+++ b/Source/WebCore/dom/ScriptExecutionContext.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2012 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,9 +31,6 @@
 #include "ActiveDOMObject.h"
 #include "ContentSecurityPolicy.h"
 #include "DOMTimer.h"
-#include "Database.h"
-#include "DatabaseTask.h"
-#include "DatabaseThread.h"
 #include "ErrorEvent.h"
 #include "EventListener.h"
 #include "EventTarget.h"
@@ -94,9 +92,8 @@ ScriptExecutionContext::ScriptExecutionContext()
     , m_inDestructor(false)
     , m_inDispatchErrorEvent(false)
     , m_activeDOMObjectsAreSuspended(false)
-#if ENABLE(SQL_DATABASE)
-    , m_hasOpenDatabases(false)
-#endif
+    , m_reasonForSuspendingActiveDOMObjects(static_cast<ActiveDOMObject::ReasonForSuspension>(-1))
+    , m_activeDOMObjectsAreStopped(false)
 {
 }
 
@@ -115,50 +112,16 @@ ScriptExecutionContext::~ScriptExecutionContext()
         ASSERT((*iter)->scriptExecutionContext() == this);
         (*iter)->contextDestroyed();
     }
-#if ENABLE(SQL_DATABASE)
-    if (m_databaseThread) {
-        ASSERT(m_databaseThread->terminationRequested());
-        m_databaseThread = 0;
-    }
-#endif
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
     if (m_fileThread) {
         m_fileThread->stop();
         m_fileThread = 0;
     }
-#endif
-#if ENABLE(BLOB)
     if (m_publicURLManager)
         m_publicURLManager->contextDestroyed();
 #endif
 }
 
-#if ENABLE(SQL_DATABASE)
-
-DatabaseThread* ScriptExecutionContext::databaseThread()
-{
-    if (!m_databaseThread && !m_hasOpenDatabases) {
-        // Create the database thread on first request - but not if at least one database was already opened,
-        // because in that case we already had a database thread and terminated it and should not create another.
-        m_databaseThread = DatabaseThread::create();
-        if (!m_databaseThread->start())
-            m_databaseThread = 0;
-    }
-
-    return m_databaseThread.get();
-}
-
-void ScriptExecutionContext::stopDatabases(DatabaseTaskSynchronizer* cleanupSync)
-{
-    ASSERT(isContextThread());
-    if (m_databaseThread)
-        m_databaseThread->requestTermination(cleanupSync);
-    else if (cleanupSync)
-        cleanupSync->taskCompleted();
-}
-
-#endif
-
 void ScriptExecutionContext::processMessagePortMessagesSoon()
 {
     postTask(ProcessMessagesSoonTask::create());
@@ -252,6 +215,7 @@ void ScriptExecutionContext::resumeActiveDOMObjects()
 
 void ScriptExecutionContext::stopActiveDOMObjects()
 {
+    m_activeDOMObjectsAreStopped = true;
     // No protection against m_activeDOMObjects changing during iteration: stop() shouldn't execute arbitrary JS.
     m_iteratingActiveDOMObjects = true;
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
@@ -393,7 +357,7 @@ DOMTimer* ScriptExecutionContext::findTimeout(int timeoutId)
     return m_timeouts.get(timeoutId);
 }
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 FileThread* ScriptExecutionContext::fileThread()
 {
     if (!m_fileThread) {
@@ -403,9 +367,7 @@ FileThread* ScriptExecutionContext::fileThread()
     }
     return m_fileThread.get();
 }
-#endif
 
-#if ENABLE(BLOB)
 PublicURLManager& ScriptExecutionContext::publicURLManager()
 {
     if (!m_publicURLManager)
diff --git a/Source/WebCore/dom/ScriptExecutionContext.h b/Source/WebCore/dom/ScriptExecutionContext.h
index 15ceb42ee..238fa6d2b 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.h
+++ b/Source/WebCore/dom/ScriptExecutionContext.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2012 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,6 +33,7 @@
 #include "KURL.h"
 #include "ScriptCallStack.h"
 #include "SecurityContext.h"
+#include "Supplementable.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -56,17 +58,12 @@ class MessagePort;
 #if ENABLE(BLOB)
 class PublicURLManager;
 #endif
-#if ENABLE(SQL_DATABASE)
-class Database;
-class DatabaseTaskSynchronizer;
-class DatabaseThread;
-#endif
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 class FileThread;
 #endif
 
-class ScriptExecutionContext : public SecurityContext {
+class ScriptExecutionContext : public SecurityContext, public Supplementable<ScriptExecutionContext> {
 public:
     ScriptExecutionContext();
     virtual ~ScriptExecutionContext();
@@ -74,15 +71,6 @@ public:
     virtual bool isDocument() const { return false; }
     virtual bool isWorkerContext() const { return false; }
 
-#if ENABLE(SQL_DATABASE)
-    virtual bool allowDatabaseAccess() const = 0;
-    virtual void databaseExceededQuota(const String& name) = 0;
-    DatabaseThread* databaseThread();
-    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
-    bool hasOpenDatabases() const { return m_hasOpenDatabases; }
-    // When the database cleanup is done, cleanupSync will be signalled.
-    void stopDatabases(DatabaseTaskSynchronizer*);
-#endif
     virtual bool isContextThread() const { return true; }
     virtual bool isJSExecutionForbidden() const = 0;
 
@@ -110,6 +98,7 @@ public:
     virtual void stopActiveDOMObjects();
 
     bool activeDOMObjectsAreSuspended() const { return m_activeDOMObjectsAreSuspended; }
+    bool activeDOMObjectsAreStopped() const { return m_activeDOMObjectsAreStopped; }
 
     // Called from the constructor and destructors of ActiveDOMObject.
     void didCreateActiveDOMObject(ActiveDOMObject*, void* upcastPointer);
@@ -158,7 +147,7 @@ public:
     JSC::JSGlobalData* globalData();
 #endif
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
     FileThread* fileThread();
     void stopFileThread();
 #endif
@@ -223,13 +212,9 @@ private:
 
     bool m_activeDOMObjectsAreSuspended;
     ActiveDOMObject::ReasonForSuspension m_reasonForSuspendingActiveDOMObjects;
+    bool m_activeDOMObjectsAreStopped;
 
-#if ENABLE(SQL_DATABASE)
-    RefPtr<DatabaseThread> m_databaseThread;
-    bool m_hasOpenDatabases; // This never changes back to false, even after the database thread is closed.
-#endif
-
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
     RefPtr<FileThread> m_fileThread;
 #endif
 };
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
index 6cf50acb9..7a971d5fb 100644
--- a/Source/WebCore/dom/ShadowRoot.cpp
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -27,15 +27,18 @@
 #include "config.h"
 #include "ShadowRoot.h"
 
+#include "CSSStyleSelector.h"
 #include "Document.h"
+#include "DocumentFragment.h"
 #include "Element.h"
 #include "HTMLContentElement.h"
 #include "HTMLContentSelector.h"
 #include "HTMLNames.h"
 #include "InsertionPoint.h"
 #include "NodeRareData.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SVGNames.h"
+#include "markup.h"
 
 #if ENABLE(SHADOW_DOM)
 #include "RuntimeEnabledFeatures.h"
@@ -49,6 +52,7 @@ ShadowRoot::ShadowRoot(Document* document)
     , m_prev(0)
     , m_next(0)
     , m_applyAuthorSheets(false)
+    , m_insertionPointAssignedTo(0)
 {
     ASSERT(document);
     
@@ -123,7 +127,7 @@ PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ShadowRootCreationPu
     RefPtr<ShadowRoot> shadowRoot = adoptRef(new ShadowRoot(element->document()));
 
     ec = 0;
-    element->setShadowRoot(shadowRoot, ec);
+    element->ensureShadowTree()->addShadowRoot(element, shadowRoot, ec);
     if (ec)
         return 0;
     ASSERT(element == shadowRoot->host());
@@ -142,6 +146,18 @@ PassRefPtr<Node> ShadowRoot::cloneNode(bool)
     return 0;
 }
 
+String ShadowRoot::innerHTML() const
+{
+    return createMarkup(this, ChildrenOnly);
+}
+
+void ShadowRoot::setInnerHTML(const String& markup, ExceptionCode& ec)
+{
+    RefPtr<DocumentFragment> fragment = createFragmentFromSource(markup, host(), ec);
+    if (fragment)
+        replaceChildrenWithFragment(this, fragment.release(), ec);
+}
+
 bool ShadowRoot::childTypeAllowed(NodeType type) const
 {
     switch (type) {
@@ -157,17 +173,17 @@ bool ShadowRoot::childTypeAllowed(NodeType type) const
     }
 }
 
-ShadowRootList* ShadowRoot::list() const
+ShadowTree* ShadowRoot::tree() const
 {
     if (host())
-        return host()->shadowRootList();
+        return host()->shadowTree();
     return 0;
 }
 
-bool ShadowRoot::hasContentElement() const
+bool ShadowRoot::hasInsertionPoint() const
 {
     for (Node* n = firstChild(); n; n = n->traverseNextNode(this)) {
-        if (n->isContentElement())
+        if (isInsertionPoint(n))
             return true;
     }
 
@@ -186,15 +202,10 @@ void ShadowRoot::setApplyAuthorSheets(bool value)
 
 void ShadowRoot::attach()
 {
-    // Children of m_selector is populated lazily in
-    // ensureSelector(), and here we just ensure that
-    // it is in clean state.
-    // FIXME: This assertion breaks if multiple shadow roots are being attached.
-    // ShadowRootList should have responsibility of side effect of selector in attaching/detaching.
-    ASSERT(!host()->shadowRootList()->selector() || !host()->shadowRootList()->selector()->hasCandidates());
+    CSSStyleSelector* styleSelector = document()->styleSelector();
+    styleSelector->pushParentShadowRoot(this);
     DocumentFragment::attach();
-    if (HTMLContentSelector* selector = host()->shadowRootList()->selector())
-        selector->didSelect();
+    styleSelector->popParentShadowRoot(this);
 }
 
 }
diff --git a/Source/WebCore/dom/ShadowRoot.h b/Source/WebCore/dom/ShadowRoot.h
index 312116749..e760558f9 100644
--- a/Source/WebCore/dom/ShadowRoot.h
+++ b/Source/WebCore/dom/ShadowRoot.h
@@ -27,6 +27,7 @@
 #ifndef ShadowRoot_h
 #define ShadowRoot_h
 
+#include "Document.h"
 #include "DocumentFragment.h"
 #include "ExceptionCode.h"
 #include "TreeScope.h"
@@ -38,7 +39,7 @@ class Document;
 class HTMLContentElement;
 class HTMLContentSelector;
 class InsertionPoint;
-class ShadowRootList;
+class ShadowTree;
 
 class ShadowRoot : public DocumentFragment, public TreeScope, public DoublyLinkedListNode<ShadowRoot> {
     friend class WTF::DoublyLinkedListNode<ShadowRoot>;
@@ -64,18 +65,30 @@ public:
     InsertionPoint* insertionPointFor(Node*) const;
     void hostChildrenChanged();
 
-    virtual void attach();
-
     virtual bool applyAuthorSheets() const;
     void setApplyAuthorSheets(bool);
 
     Element* host() const { return shadowHost(); }
-    ShadowRootList* list() const;
+    ShadowTree* tree() const;
+
+    String innerHTML() const;
+    void setInnerHTML(const String&, ExceptionCode&);
+
+    Element* activeElement() const;
 
     ShadowRoot* youngerShadowRoot() const { return prev(); }
     ShadowRoot* olderShadowRoot() const { return next(); }
 
-    bool hasContentElement() const;
+    bool isYoungest() const { return !youngerShadowRoot(); }
+    bool isOldest() const { return !olderShadowRoot(); }
+
+    bool hasInsertionPoint() const;
+
+    virtual void attach();
+
+    bool isUsedForRendering() const;
+    InsertionPoint* assignedTo() const;
+    void setAssignedTo(InsertionPoint*);
 
 private:
     ShadowRoot(Document*);
@@ -88,8 +101,32 @@ private:
     ShadowRoot* m_prev;
     ShadowRoot* m_next;
     bool m_applyAuthorSheets : 1;
+    InsertionPoint* m_insertionPointAssignedTo;
 };
 
+inline InsertionPoint* ShadowRoot::assignedTo() const
+{
+    return m_insertionPointAssignedTo;
+}
+
+inline void ShadowRoot::setAssignedTo(InsertionPoint* insertionPoint)
+{
+    ASSERT(!m_insertionPointAssignedTo || !insertionPoint);
+    m_insertionPointAssignedTo = insertionPoint;
+}
+
+inline bool ShadowRoot::isUsedForRendering() const
+{
+    return isYoungest() || assignedTo();
+}
+
+inline Element* ShadowRoot::activeElement() const
+{
+    if (document()->isHTMLDocument())
+        return treeScope()->activeElement();
+    return 0;
+}
+
 inline const ShadowRoot* toShadowRoot(const Node* node)
 {
     ASSERT(!node || node->isShadowRoot());
@@ -101,6 +138,18 @@ inline ShadowRoot* toShadowRoot(Node* node)
     return const_cast<ShadowRoot*>(toShadowRoot(static_cast<const Node*>(node)));
 }
 
+inline ShadowRoot* toShadowRoot(TreeScope* scope)
+{
+    ASSERT(!scope || scope->isShadowRoot());
+    return static_cast<ShadowRoot*>(scope);
+}
+
+// Put this TreeScope method here to inline it.
+inline bool TreeScope::isShadowRoot() const
+{
+    return m_rootNode->isShadowRoot();
+}
+
 } // namespace
 
 #endif
diff --git a/Source/WebCore/dom/ShadowRoot.idl b/Source/WebCore/dom/ShadowRoot.idl
index ffa3b03b4..e9e8b1b40 100644
--- a/Source/WebCore/dom/ShadowRoot.idl
+++ b/Source/WebCore/dom/ShadowRoot.idl
@@ -33,6 +33,11 @@ module core {
         ConstructorRaisesException
     ] ShadowRoot : DocumentFragment {
         readonly attribute Element host;
+        readonly attribute Element activeElement;
+
+        attribute [TreatNullAs=NullString] DOMString innerHTML
+            setter raises(DOMException);
+
         Element getElementById(in [Optional=DefaultIsUndefined] DOMString elementId);
         NodeList getElementsByClassName(in [Optional=DefaultIsUndefined] DOMString className);
         NodeList getElementsByTagName(in [Optional=DefaultIsUndefined] DOMString tagName);
diff --git a/Source/WebCore/dom/ShadowRootList.cpp b/Source/WebCore/dom/ShadowRootList.cpp
deleted file mode 100644
index 3adee6370..000000000
--- a/Source/WebCore/dom/ShadowRootList.cpp
+++ /dev/null
@@ -1,238 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ShadowRootList.h"
-
-#include "Document.h"
-#include "Element.h"
-#include "HTMLContentSelector.h"
-#include "RuntimeEnabledFeatures.h"
-#include "ShadowRoot.h"
-#include "Text.h"
-
-namespace WebCore {
-
-ShadowRootList::ShadowRootList()
-    : m_needsRecalculateContent(false)
-{
-}
-
-ShadowRootList::~ShadowRootList()
-{
-    ASSERT(!hasShadowRoot());
-}
-
-void ShadowRootList::pushShadowRoot(ShadowRoot* shadowRoot)
-{
-#if ENABLE(SHADOW_DOM)
-    if (!RuntimeEnabledFeatures::multipleShadowSubtreesEnabled())
-        ASSERT(!hasShadowRoot());
-#else
-    ASSERT(!hasShadowRoot());
-#endif
-
-    m_shadowRoots.push(shadowRoot);
-}
-
-ShadowRoot* ShadowRootList::popShadowRoot()
-{
-    if (!hasShadowRoot())
-        return 0;
-
-    return m_shadowRoots.removeHead();
-}
-
-void ShadowRootList::insertedIntoDocument()
-{
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
-        root->insertedIntoDocument();
-}
-
-void ShadowRootList::removedFromDocument()
-{
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
-        root->removedFromDocument();
-}
-
-void ShadowRootList::insertedIntoTree(bool deep)
-{
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
-        root->insertedIntoTree(deep);
-}
-
-void ShadowRootList::removedFromTree(bool deep)
-{
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
-        root->removedFromTree(deep);
-}
-
-void ShadowRootList::willRemove()
-{
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
-        root->willRemove();
-}
-
-void ShadowRootList::attach()
-{
-    // FIXME: Currently we only support the case that the shadow root list has at most one shadow root.
-    // See also https://bugs.webkit.org/show_bug.cgi?id=77503 and its dependent bugs.
-    ASSERT(m_shadowRoots.size() <= 1);
-
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
-        if (!root->attached())
-            root->attach();
-    }
-}
-
-void ShadowRootList::detach()
-{
-    // FIXME: Currently we only support the case that the shadow root list has at most one shadow root.
-    // See also https://bugs.webkit.org/show_bug.cgi?id=77503 and its dependent bugs.
-    ASSERT(m_shadowRoots.size() <= 1);
-
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
-        if (root->attached())
-            root->detach();
-    }
-}
-
-InsertionPoint* ShadowRootList::insertionPointFor(Node* node) const
-{
-    if (!m_selector)
-        return 0;
-    HTMLContentSelection* found = m_selector->findFor(node);
-    if (!found)
-        return 0;
-    return found->insertionPoint();
-}
-
-bool ShadowRootList::isSelectorActive() const
-{
-    return m_selector && m_selector->hasCandidates();
-}
-
-void ShadowRootList::reattach()
-{
-    detach();
-    attach();
-}
-
-bool ShadowRootList::childNeedsStyleRecalc()
-{
-    ASSERT(youngestShadowRoot());
-    if (!youngestShadowRoot())
-        return false;
-
-    return youngestShadowRoot()->childNeedsStyleRecalc();
-}
-
-bool ShadowRootList::needsStyleRecalc()
-{
-    ASSERT(youngestShadowRoot());
-    if (!youngestShadowRoot())
-        return false;
-
-    return youngestShadowRoot()->needsStyleRecalc();
-}
-
-void ShadowRootList::recalcShadowTreeStyle(Node::StyleChange change)
-{
-    ShadowRoot* youngest = youngestShadowRoot();
-    if (!youngest)
-        return;
-
-    if (needsReattachHostChildrenAndShadow())
-        reattachHostChildrenAndShadow();
-    else {
-        for (Node* n = youngest->firstChild(); n; n = n->nextSibling()) {
-            if (n->isElementNode())
-                static_cast<Element*>(n)->recalcStyle(change);
-            else if (n->isTextNode())
-                toText(n)->recalcTextStyle(change);
-        }
-    }
-
-    clearNeedsReattachHostChildrenAndShadow();
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
-        root->clearNeedsStyleRecalc();
-        root->clearChildNeedsStyleRecalc();
-    }
-}
-
-bool ShadowRootList::needsReattachHostChildrenAndShadow()
-{
-    return m_needsRecalculateContent || (youngestShadowRoot() && youngestShadowRoot()->hasContentElement());
-}
-
-void ShadowRootList::hostChildrenChanged()
-{
-    ASSERT(youngestShadowRoot());
-
-    if (!youngestShadowRoot()->hasContentElement())
-        return;
-
-    // This results in forced detaching/attaching of the shadow render tree. See ShadowRoot::recalcStyle().
-    setNeedsReattachHostChildrenAndShadow();
-}
-
-void ShadowRootList::setNeedsReattachHostChildrenAndShadow()
-{
-    m_needsRecalculateContent = true;
-
-    host()->setNeedsStyleRecalc();
-}
-
-void ShadowRootList::reattachHostChildrenAndShadow()
-{
-    ASSERT(youngestShadowRoot());
-
-    Node* hostNode = youngestShadowRoot()->host();
-    if (!hostNode)
-        return;
-
-    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
-        if (child->attached())
-            child->detach();
-    }
-
-    reattach();
-
-    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
-        if (!child->attached())
-            child->attach();
-    }
-}
-
-HTMLContentSelector* ShadowRootList::ensureSelector()
-{
-    if (!m_selector)
-        m_selector = adoptPtr(new HTMLContentSelector());
-    m_selector->willSelectOver(host());
-    return m_selector.get();
-}
-
-} // namespace
diff --git a/Source/WebCore/dom/ShadowTree.cpp b/Source/WebCore/dom/ShadowTree.cpp
new file mode 100644
index 000000000..aec998bd8
--- /dev/null
+++ b/Source/WebCore/dom/ShadowTree.cpp
@@ -0,0 +1,328 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ShadowTree.h"
+
+#include "CSSStyleSelector.h"
+#include "Document.h"
+#include "Element.h"
+#include "HTMLContentSelector.h"
+#include "HTMLShadowElement.h"
+#include "InspectorInstrumentation.h"
+#include "RuntimeEnabledFeatures.h"
+#include "ShadowRoot.h"
+#include "Text.h"
+
+namespace WebCore {
+
+class ShadowRootVector : public Vector<RefPtr<ShadowRoot> > {
+public:
+    explicit ShadowRootVector(ShadowTree* tree)
+    {
+        for (ShadowRoot* root = tree->youngestShadowRoot(); root; root = root->olderShadowRoot())
+            append(root);
+    }
+};
+
+ShadowTree::ShadowTree()
+    : m_needsRecalculateContent(false)
+{
+}
+
+ShadowTree::~ShadowTree()
+{
+    if (hasShadowRoot())
+        removeAllShadowRoots();
+}
+
+static bool validateShadowRoot(Document* document, ShadowRoot* shadowRoot, ExceptionCode& ec)
+{
+    if (!shadowRoot)
+        return true;
+
+    if (shadowRoot->shadowHost()) {
+        ec = HIERARCHY_REQUEST_ERR;
+        return false;
+    }
+
+    if (shadowRoot->document() != document) {
+        ec = WRONG_DOCUMENT_ERR;
+        return false;
+    }
+
+    return true;
+}
+
+void ShadowTree::addShadowRoot(Element* shadowHost, PassRefPtr<ShadowRoot> shadowRoot, ExceptionCode& ec)
+{
+    ASSERT(shadowHost);
+    ASSERT(shadowRoot);
+#if ENABLE(SHADOW_DOM)
+    ASSERT(!hasShadowRoot() || RuntimeEnabledFeatures::multipleShadowSubtreesEnabled());
+#else
+    ASSERT(!hasShadowRoot());
+#endif
+
+    if (!validateShadowRoot(shadowHost->document(), shadowRoot.get(), ec))
+        return;
+
+    shadowRoot->setShadowHost(shadowHost);
+
+    if (shadowHost->inDocument())
+        shadowRoot->insertedIntoDocument();
+    if (shadowHost->attached()) {
+        shadowRoot->lazyAttach();
+        detach();
+        shadowHost->detachChildren();
+    }
+
+    m_shadowRoots.push(shadowRoot.get());
+    InspectorInstrumentation::didPushShadowRoot(shadowHost, shadowRoot.get());
+}
+
+void ShadowTree::removeAllShadowRoots()
+{
+    if (!hasShadowRoot())
+        return;
+
+    // Dont protect this ref count.
+    Element* shadowHost = host();
+
+    while (RefPtr<ShadowRoot> oldRoot = m_shadowRoots.removeHead()) {
+        InspectorInstrumentation::willPopShadowRoot(shadowHost, oldRoot.get());
+        shadowHost->document()->removeFocusedNodeOfSubtree(oldRoot.get());
+
+        if (oldRoot->attached())
+            oldRoot->detach();
+
+        oldRoot->setShadowHost(0);
+        oldRoot->setPrev(0);
+        oldRoot->setNext(0);
+        shadowHost->document()->adoptIfNeeded(oldRoot.get());
+        if (oldRoot->inDocument())
+            oldRoot->removedFromDocument();
+        else
+            oldRoot->removedFromTree(true);
+    }
+
+    if (shadowHost->attached())
+        shadowHost->attachChildrenLazily();
+}
+
+void ShadowTree::insertedIntoDocument()
+{
+    ShadowRootVector roots(this);
+    for (size_t i = 0; i < roots.size(); ++i)
+        roots[i]->insertedIntoDocument();
+}
+
+void ShadowTree::removedFromDocument()
+{
+    ShadowRootVector roots(this);
+    for (size_t i = 0; i < roots.size(); ++i)
+        roots[i]->removedFromDocument();
+}
+
+void ShadowTree::insertedIntoTree(bool deep)
+{
+    ShadowRootVector roots(this);
+    for (size_t i = 0; i < roots.size(); ++i)
+        roots[i]->insertedIntoTree(deep);
+}
+
+void ShadowTree::removedFromTree(bool deep)
+{
+    ShadowRootVector roots(this);
+    for (size_t i = 0; i < roots.size(); ++i)
+        roots[i]->removedFromTree(deep);
+}
+
+void ShadowTree::willRemove()
+{
+    ShadowRootVector roots(this);
+    for (size_t i = 0; i < roots.size(); ++i)
+        roots[i]->willRemove();
+}
+
+void ShadowTree::setParentTreeScope(TreeScope* scope)
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->setParentTreeScope(scope);
+}
+
+void ShadowTree::attach()
+{
+    // Children of m_selector is populated lazily in
+    // ensureSelector(), and here we just ensure that it is in clean state.
+    ASSERT(!selector() || !selector()->hasCandidates());
+
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        if (!root->attached())
+            root->attach();
+    }
+
+    if (HTMLContentSelector* contentSelector = selector())
+        contentSelector->didSelect();
+}
+
+void ShadowTree::attachHost(Element* host)
+{
+    attach();
+    host->attachChildrenIfNeeded();
+    host->attachAsNode();
+}
+
+void ShadowTree::detach()
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        if (root->attached())
+            root->detach();
+    }
+}
+
+void ShadowTree::detachHost(Element* host)
+{
+    host->detachChildrenIfNeeded();
+    detach();
+    host->detachAsNode();
+}
+
+InsertionPoint* ShadowTree::insertionPointFor(Node* node) const
+{
+    ASSERT(node && node->parentNode());
+
+    if (node->parentNode()->isShadowRoot()) {
+        if (InsertionPoint* insertionPoint = toShadowRoot(node->parentNode())->assignedTo())
+            return insertionPoint;
+
+        return 0;
+    }
+
+    if (!m_selector)
+        return 0;
+    HTMLContentSelection* found = m_selector->findFor(node);
+    if (!found)
+        return 0;
+    return found->insertionPoint();
+}
+
+void ShadowTree::reattach()
+{
+    detach();
+    attach();
+}
+
+bool ShadowTree::childNeedsStyleRecalc()
+{
+    ASSERT(youngestShadowRoot());
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        if (root->childNeedsStyleRecalc())
+            return true;
+
+    return false;
+}
+
+bool ShadowTree::needsStyleRecalc()
+{
+    ASSERT(youngestShadowRoot());
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        if (root->needsStyleRecalc())
+            return true;
+
+    return false;
+}
+
+void ShadowTree::recalcShadowTreeStyle(Node::StyleChange change)
+{
+    ShadowRoot* youngest = youngestShadowRoot();
+    if (!youngest)
+        return;
+
+    if (needsReattachHostChildrenAndShadow())
+        reattachHostChildrenAndShadow();
+    else {
+        CSSStyleSelector* styleSelector = youngest->document()->styleSelector();
+
+        styleSelector->pushParentShadowRoot(youngest);
+        for (Node* n = youngest->firstChild(); n; n = n->nextSibling()) {
+            if (n->isElementNode())
+                static_cast<Element*>(n)->recalcStyle(change);
+            else if (n->isTextNode())
+                toText(n)->recalcTextStyle(change);
+        }
+        styleSelector->popParentShadowRoot(youngest);
+    }
+
+    clearNeedsReattachHostChildrenAndShadow();
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        root->clearNeedsStyleRecalc();
+        root->clearChildNeedsStyleRecalc();
+    }
+}
+
+bool ShadowTree::needsReattachHostChildrenAndShadow()
+{
+    return m_needsRecalculateContent || (youngestShadowRoot() && youngestShadowRoot()->hasInsertionPoint());
+}
+
+void ShadowTree::hostChildrenChanged()
+{
+    ASSERT(youngestShadowRoot());
+
+    if (!youngestShadowRoot()->hasInsertionPoint())
+        return;
+
+    // This results in forced detaching/attaching of the shadow render tree. See ShadowRoot::recalcStyle().
+    setNeedsReattachHostChildrenAndShadow();
+}
+
+void ShadowTree::setNeedsReattachHostChildrenAndShadow()
+{
+    m_needsRecalculateContent = true;
+
+    host()->setNeedsStyleRecalc();
+}
+
+void ShadowTree::reattachHostChildrenAndShadow()
+{
+    ASSERT(youngestShadowRoot());
+
+    Element* hostNode = youngestShadowRoot()->host();
+    hostNode->detachChildrenIfNeeded();
+    reattach();
+    hostNode->attachChildrenIfNeeded();
+}
+
+HTMLContentSelector* ShadowTree::ensureSelector()
+{
+    if (!m_selector)
+        m_selector = adoptPtr(new HTMLContentSelector());
+    m_selector->willSelectOver(host());
+    return m_selector.get();
+}
+
+} // namespace
diff --git a/Source/WebCore/dom/ShadowRootList.h b/Source/WebCore/dom/ShadowTree.h
index db3170a6d..54c41bbe4 100644
--- a/Source/WebCore/dom/ShadowRootList.h
+++ b/Source/WebCore/dom/ShadowTree.h
@@ -24,9 +24,10 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ShadowRootList_h
-#define ShadowRootList_h
+#ifndef ShadowTree_h
+#define ShadowTree_h
 
+#include "ExceptionCode.h"
 #include "ShadowRoot.h"
 #include <wtf/DoublyLinkedList.h>
 #include <wtf/Noncopyable.h>
@@ -39,18 +40,19 @@ class Node;
 class Element;
 class HTMLContentSelector;
 class InsertionPoint;
+class TreeScope;
 
-class ShadowRootList {
+class ShadowTree {
 public:
-    ShadowRootList();
-    ~ShadowRootList();
+    ShadowTree();
+    ~ShadowTree();
 
     bool hasShadowRoot() const;
     ShadowRoot* youngestShadowRoot() const;
     ShadowRoot* oldestShadowRoot() const;
 
-    void pushShadowRoot(ShadowRoot*);
-    ShadowRoot* popShadowRoot();
+    void addShadowRoot(Element* shadowHost, PassRefPtr<ShadowRoot>, ExceptionCode&);
+    void removeAllShadowRoots();
 
     void insertedIntoDocument();
     void removedFromDocument();
@@ -58,9 +60,13 @@ public:
     void removedFromTree(bool deep);
     void willRemove();
 
+    void setParentTreeScope(TreeScope*);
+
     void attach();
     void detach();
     void reattach();
+    void attachHost(Element*);
+    void detachHost(Element*);
 
     bool childNeedsStyleRecalc();
     bool needsStyleRecalc();
@@ -76,43 +82,41 @@ public:
     HTMLContentSelector* selector() const;
     HTMLContentSelector* ensureSelector();
 
-    bool isSelectorActive() const;
-
 private:
     Element* host() const;
 
     DoublyLinkedList<ShadowRoot> m_shadowRoots;
     OwnPtr<HTMLContentSelector> m_selector;
     bool m_needsRecalculateContent : 1;
-    WTF_MAKE_NONCOPYABLE(ShadowRootList);
+    WTF_MAKE_NONCOPYABLE(ShadowTree);
 };
 
-inline bool ShadowRootList::hasShadowRoot() const
+inline bool ShadowTree::hasShadowRoot() const
 {
     return !m_shadowRoots.isEmpty();
 }
 
-inline ShadowRoot* ShadowRootList::youngestShadowRoot() const
+inline ShadowRoot* ShadowTree::youngestShadowRoot() const
 {
     return m_shadowRoots.head();
 }
 
-inline ShadowRoot* ShadowRootList::oldestShadowRoot() const
+inline ShadowRoot* ShadowTree::oldestShadowRoot() const
 {
     return m_shadowRoots.tail();
 }
 
-inline HTMLContentSelector* ShadowRootList::selector() const
+inline HTMLContentSelector* ShadowTree::selector() const
 {
     return m_selector.get();
 }
 
-inline void ShadowRootList::clearNeedsReattachHostChildrenAndShadow()
+inline void ShadowTree::clearNeedsReattachHostChildrenAndShadow()
 {
     m_needsRecalculateContent = false;
 }
 
-inline Element* ShadowRootList::host() const
+inline Element* ShadowTree::host() const
 {
     ASSERT(hasShadowRoot());
     return youngestShadowRoot()->host();
diff --git a/Source/WebCore/dom/StaticNodeList.cpp b/Source/WebCore/dom/StaticNodeList.cpp
index fe1d1cbe4..412c125e0 100644
--- a/Source/WebCore/dom/StaticNodeList.cpp
+++ b/Source/WebCore/dom/StaticNodeList.cpp
@@ -50,7 +50,7 @@ Node* StaticNodeList::itemWithName(const AtomicString& elementId) const
     size_t length = m_nodes.size();
     for (size_t i = 0; i < length; ++i) {
         Node* node = m_nodes[i].get();
-        if (static_cast<Element*>(node)->getIdAttribute() == elementId)
+        if (node->isElementNode() && toElement(node)->getIdAttribute() == elementId)
             return node;
     }
 
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index 99e7f3523..19b310488 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -46,27 +46,56 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+struct PresentationAttributeCacheKey {
+    PresentationAttributeCacheKey() : tagName(0) { }
+    AtomicStringImpl* tagName;
+    // Only the values need refcounting.
+    Vector<pair<AtomicStringImpl*, AtomicString>, 3> attributesAndValues;
+};
+
+struct PresentationAttributeCacheEntry {
+    PresentationAttributeCacheKey key;
+    RefPtr<StylePropertySet> value;
+};
+
+typedef HashMap<unsigned, OwnPtr<PresentationAttributeCacheEntry>, AlreadyHashed> PresentationAttributeCache;
+    
+static bool operator!=(const PresentationAttributeCacheKey& a, const PresentationAttributeCacheKey& b)
+{
+    if (a.tagName != b.tagName)
+        return true;
+    return a.attributesAndValues != b.attributesAndValues;
+}
+
+static PresentationAttributeCache& presentationAttributeCache()
+{
+    DEFINE_STATIC_LOCAL(PresentationAttributeCache, cache, ());
+    return cache;
+}
+
 void StyledElement::updateStyleAttribute() const
 {
     ASSERT(!isStyleAttributeValid());
     setIsStyleAttributeValid();
-    setIsSynchronizingStyleAttribute();
-    if (StylePropertySet* inlineStyle = inlineStyleDecl())
-        const_cast<StyledElement*>(this)->setAttribute(styleAttr, inlineStyle->asText());
-    clearIsSynchronizingStyleAttribute();
+    if (const StylePropertySet* inlineStyle = this->inlineStyle())
+        const_cast<StyledElement*>(this)->setAttribute(styleAttr, inlineStyle->asText(), /*notifyChanged*/ false);
 }
 
 StyledElement::~StyledElement()
 {
-    destroyInlineStyleDecl();
+    destroyInlineStyle();
+}
+
+CSSStyleDeclaration* StyledElement::style() 
+{ 
+    return ensureAttributeData()->ensureMutableInlineStyle(this)->ensureInlineCSSStyleDeclaration(this); 
 }
 
 void StyledElement::attributeChanged(Attribute* attr)
 {
-    if (!(attr->name() == styleAttr && isSynchronizingStyleAttribute()))
-        parseAttribute(attr);
+    parseAttribute(attr);
 
-    if (isPresentationAttribute(attr)) {
+    if (isPresentationAttribute(attr->name())) {
         setAttributeStyleDirty();
         setNeedsStyleRecalc(InlineStyleChange);
     }
@@ -100,9 +129,9 @@ void StyledElement::parseAttribute(Attribute* attr)
         classAttributeChanged(attr->value());
     else if (attr->name() == styleAttr) {
         if (attr->isNull())
-            destroyInlineStyleDecl();
+            destroyInlineStyle();
         else if (document()->contentSecurityPolicy()->allowInlineStyle())
-            ensureInlineStyleDecl()->parseDeclaration(attr->value(), document()->elementSheet());
+            ensureAttributeData()->updateInlineStyleAvoidingMutation(this, attr->value());
         setIsStyleAttributeValid();
         setNeedsStyleRecalc();
         InspectorInstrumentation::didInvalidateStyleAttr(document(), this);
@@ -118,21 +147,21 @@ void StyledElement::inlineStyleChanged()
     
 bool StyledElement::setInlineStyleProperty(int propertyID, int identifier, bool important)
 {
-    ensureInlineStyleDecl()->setProperty(propertyID, document()->cssValuePool()->createIdentifierValue(identifier), important);
+    ensureAttributeData()->ensureMutableInlineStyle(this)->setProperty(propertyID, document()->cssValuePool()->createIdentifierValue(identifier), important);
     inlineStyleChanged();
     return true;
 }
 
 bool StyledElement::setInlineStyleProperty(int propertyID, double value, CSSPrimitiveValue::UnitTypes unit, bool important)
 {
-    ensureInlineStyleDecl()->setProperty(propertyID, document()->cssValuePool()->createValue(value, unit), important);
+    ensureAttributeData()->ensureMutableInlineStyle(this)->setProperty(propertyID, document()->cssValuePool()->createValue(value, unit), important);
     inlineStyleChanged();
     return true;
 }
 
 bool StyledElement::setInlineStyleProperty(int propertyID, const String& value, bool important)
 {
-    bool changes = ensureInlineStyleDecl()->setProperty(propertyID, value, important, document()->elementSheet());
+    bool changes = ensureAttributeData()->ensureMutableInlineStyle(this)->setProperty(propertyID, value, important, document()->elementSheet());
     if (changes)
         inlineStyleChanged();
     return changes;
@@ -140,7 +169,10 @@ bool StyledElement::setInlineStyleProperty(int propertyID, const String& value,
 
 bool StyledElement::removeInlineStyleProperty(int propertyID)
 {
-    bool changes = ensureInlineStyleDecl()->removeProperty(propertyID);
+    StylePropertySet* inlineStyle = attributeData() ? attributeData()->inlineStyle() : 0;
+    if (!inlineStyle)
+        return false;
+    bool changes = inlineStyle->removeProperty(propertyID);
     if (changes)
         inlineStyleChanged();
     return changes;
@@ -148,16 +180,78 @@ bool StyledElement::removeInlineStyleProperty(int propertyID)
 
 void StyledElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
-    if (StylePropertySet* inlineStyle = inlineStyleDecl())
+    if (StylePropertySet* inlineStyle = attributeData() ? attributeData()->inlineStyle() : 0)
         inlineStyle->addSubresourceStyleURLs(urls, document()->elementSheet());
 }
 
-void StyledElement::updateAttributeStyle()
+static inline bool attributeNameSort(const pair<AtomicStringImpl*, AtomicString>& p1, const pair<AtomicStringImpl*, AtomicString>& p2)
 {
-    RefPtr<StylePropertySet> style = StylePropertySet::create();
-    for (unsigned i = 0; i < attributeCount(); ++i) {
+    // Sort based on the attribute name pointers. It doesn't matter what the order is as long as it is always the same. 
+    return p1.first < p2.first;
+}
+
+void StyledElement::makePresentationAttributeCacheKey(PresentationAttributeCacheKey& result) const
+{    
+    // FIXME: Enable for SVG.
+    if (namespaceURI() != xhtmlNamespaceURI)
+        return;
+    // Interpretation of the size attributes on <input> depends on the type attribute.
+    if (hasTagName(inputTag))
+        return;
+    unsigned size = attributeCount();
+    for (unsigned i = 0; i < size; ++i) {
         Attribute* attribute = attributeItem(i);
-        collectStyleForAttribute(attribute, style.get());
+        if (!isPresentationAttribute(attribute->name()))
+            continue;
+        if (!attribute->namespaceURI().isNull())
+            return;
+        // FIXME: Background URL may depend on the base URL and can't be shared. Disallow caching.
+        if (attribute->name() == backgroundAttr)
+            return;
+        result.attributesAndValues.append(make_pair(attribute->localName().impl(), attribute->value()));
+    }
+    if (result.attributesAndValues.isEmpty())
+        return;
+    // Attribute order doesn't matter. Sort for easy equality comparison.
+    std::sort(result.attributesAndValues.begin(), result.attributesAndValues.end(), attributeNameSort);
+    // The cache key is non-null when the tagName is set.
+    result.tagName = localName().impl();
+}
+
+static unsigned computePresentationAttributeCacheHash(const PresentationAttributeCacheKey& key)
+{
+    if (!key.tagName)
+        return 0;
+    ASSERT(key.attributesAndValues.size());
+    unsigned attributeHash = StringHasher::hashMemory(key.attributesAndValues.data(), key.attributesAndValues.size() * sizeof(key.attributesAndValues[0]));
+    return WTF::intHash((static_cast<uint64_t>(key.tagName->existingHash()) << 32 | attributeHash));
+}
+
+void StyledElement::updateAttributeStyle()
+{
+    PresentationAttributeCacheKey cacheKey;
+    makePresentationAttributeCacheKey(cacheKey);
+
+    unsigned cacheHash = computePresentationAttributeCacheHash(cacheKey);
+
+    PresentationAttributeCache::iterator cacheIterator;
+    if (cacheHash) {
+        cacheIterator = presentationAttributeCache().add(cacheHash, nullptr).first;
+        if (cacheIterator->second && cacheIterator->second->key != cacheKey)
+            cacheHash = 0;
+    } else
+        cacheIterator = presentationAttributeCache().end();
+
+    RefPtr<StylePropertySet> style;
+    if (cacheHash && cacheIterator->second) 
+        style = cacheIterator->second->value;
+    else {
+        style = StylePropertySet::create();
+        unsigned size = attributeCount();
+        for (unsigned i = 0; i < size; ++i) {
+            Attribute* attribute = attributeItem(i);
+            collectStyleForAttribute(attribute, style.get());
+        }
     }
     clearAttributeStyleDirty();
 
@@ -165,8 +259,23 @@ void StyledElement::updateAttributeStyle()
         attributeData()->setAttributeStyle(0);
     else {
         style->shrinkToFit();
-        attributeData()->setAttributeStyle(style.release());
+        attributeData()->setAttributeStyle(style);
     }
+
+    if (!cacheHash || cacheIterator->second)
+        return;
+
+    OwnPtr<PresentationAttributeCacheEntry> newEntry = adoptPtr(new PresentationAttributeCacheEntry);
+    newEntry->key = cacheKey;
+    newEntry->value = style.release();
+
+    static const int presentationAttributeCacheMaximumSize = 128;
+    if (presentationAttributeCache().size() > presentationAttributeCacheMaximumSize) {
+        // Start building from scratch if the cache ever gets big.
+        presentationAttributeCache().clear();
+        presentationAttributeCache().set(cacheHash, newEntry.release());
+    } else
+        cacheIterator->second = newEntry.release();
 }
 
 void StyledElement::addPropertyToAttributeStyle(StylePropertySet* style, int propertyID, int identifier)
diff --git a/Source/WebCore/dom/StyledElement.h b/Source/WebCore/dom/StyledElement.h
index 2773e41c3..e2079d8e0 100644
--- a/Source/WebCore/dom/StyledElement.h
+++ b/Source/WebCore/dom/StyledElement.h
@@ -31,6 +31,7 @@
 namespace WebCore {
 
 class Attribute;
+struct PresentationAttributeCacheKey;
 
 class StyledElement : public Element {
 public:
@@ -39,8 +40,8 @@ public:
     virtual StylePropertySet* additionalAttributeStyle() { return 0; }
     void invalidateStyleAttribute();
 
-    StylePropertySet* inlineStyleDecl() const { return attributeData() ? attributeData()->inlineStyleDecl() : 0; }
-    StylePropertySet* ensureInlineStyleDecl() { return ensureAttributeData()->ensureInlineStyleDecl(this); }
+    const StylePropertySet* inlineStyle() const { return attributeData() ? attributeData()->inlineStyle() : 0; }
+    const StylePropertySet* ensureInlineStyle() { return ensureAttributeData()->ensureInlineStyle(this); }
     
     // Unlike StylePropertySet setters, these implement invalidation.
     bool setInlineStyleProperty(int propertyID, int identifier, bool important = false);
@@ -48,7 +49,7 @@ public:
     bool setInlineStyleProperty(int propertyID, const String& value, bool important = false);
     bool removeInlineStyleProperty(int propertyID);
     
-    virtual CSSStyleDeclaration* style() OVERRIDE { return ensureInlineStyleDecl()->ensureInlineCSSStyleDeclaration(this); }
+    virtual CSSStyleDeclaration* style() OVERRIDE;
 
     StylePropertySet* attributeStyle();
 
@@ -64,7 +65,7 @@ protected:
     virtual void parseAttribute(Attribute*);
     virtual void copyNonAttributeProperties(const Element*);
 
-    virtual bool isPresentationAttribute(Attribute*) const { return false; }
+    virtual bool isPresentationAttribute(const QualifiedName&) const { return false; }
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) { }
 
     void addPropertyToAttributeStyle(StylePropertySet*, int propertyID, int identifier);
@@ -82,12 +83,13 @@ private:
     virtual void updateStyleAttribute() const;
     void inlineStyleChanged();
 
+    void makePresentationAttributeCacheKey(PresentationAttributeCacheKey&) const;
     void updateAttributeStyle();
 
-    void destroyInlineStyleDecl()
+    void destroyInlineStyle()
     {
         if (attributeData())
-            attributeData()->destroyInlineStyleDecl(this);
+            attributeData()->destroyInlineStyle(this);
     }
 };
 
diff --git a/Source/WebCore/dom/Text.cpp b/Source/WebCore/dom/Text.cpp
index 6b5f7f7b4..1bcabae57 100644
--- a/Source/WebCore/dom/Text.cpp
+++ b/Source/WebCore/dom/Text.cpp
@@ -147,7 +147,7 @@ PassRefPtr<Text> Text::replaceWholeText(const String& newText, ExceptionCode&)
     RefPtr<Text> endText = const_cast<Text*>(latestLogicallyAdjacentTextNode(this));
 
     RefPtr<Text> protectedThis(this); // Mutation event handlers could cause our last ref to go away
-    ContainerNode* parent = parentNode(); // Protect against mutation handlers moving this node during traversal
+    RefPtr<ContainerNode> parent = parentNode(); // Protect against mutation handlers moving this node during traversal
     ExceptionCode ignored = 0;
     for (RefPtr<Node> n = startText; n && n != this && n->isTextNode() && n->parentNode() == parent;) {
         RefPtr<Node> nodeToRemove(n.release());
diff --git a/Source/WebCore/dom/TreeScope.cpp b/Source/WebCore/dom/TreeScope.cpp
index 71384462e..a75bd24ee 100644
--- a/Source/WebCore/dom/TreeScope.cpp
+++ b/Source/WebCore/dom/TreeScope.cpp
@@ -29,9 +29,13 @@
 #include "ContainerNode.h"
 #include "Document.h"
 #include "Element.h"
+#include "FocusController.h"
+#include "Frame.h"
 #include "HTMLAnchorElement.h"
+#include "HTMLFrameOwnerElement.h"
 #include "HTMLMapElement.h"
 #include "HTMLNames.h"
+#include "Page.h"
 #include "TreeScopeAdopter.h"
 #include <wtf/text/AtomicString.h>
 #include <wtf/text/CString.h>
@@ -151,5 +155,35 @@ void TreeScope::adoptIfNeeded(Node* node)
         adopter.execute();
 }
 
+static Node* focusedFrameOwnerElement(Frame* focusedFrame, Frame* currentFrame)
+{
+    for (; focusedFrame; focusedFrame = focusedFrame->tree()->parent()) {
+        if (focusedFrame->tree()->parent() == currentFrame)
+            return focusedFrame->ownerElement();
+    }
+    return 0;
+}
+
+Element* TreeScope::activeElement()
+{
+    Document* document = rootNode()->document();
+    Node* node = document->focusedNode();
+    if (!node && document->page())
+        node = focusedFrameOwnerElement(document->page()->focusController()->focusedFrame(), document->frame());
+    if (!node)
+        return document->body();
+
+    TreeScope* treeScope = node->treeScope();
+
+    while (treeScope != this && treeScope != document) {
+        node = treeScope->rootNode()->shadowHost();
+        treeScope = node->treeScope();
+    }
+
+    if (node->isElementNode())
+        return toElement(node);
+    return 0;
+}
+
 } // namespace WebCore
 
diff --git a/Source/WebCore/dom/TreeScope.h b/Source/WebCore/dom/TreeScope.h
index b58bbdc83..aa30a8ae3 100644
--- a/Source/WebCore/dom/TreeScope.h
+++ b/Source/WebCore/dom/TreeScope.h
@@ -47,6 +47,7 @@ public:
     TreeScope* parentTreeScope() const { return m_parentTreeScope; }
     void setParentTreeScope(TreeScope*);
 
+    Element* activeElement();
     Element* getElementById(const AtomicString&) const;
     bool hasElementWithId(AtomicStringImpl* id) const;
     bool containsMultipleElementsWithId(const AtomicString& id) const;
@@ -60,6 +61,7 @@ public:
     void addNodeListCache() { ++m_numNodeListCaches; }
     void removeNodeListCache() { ASSERT(m_numNodeListCaches > 0); --m_numNodeListCaches; }
     bool hasNodeListCaches() const { return m_numNodeListCaches; }
+    bool isShadowRoot() const;
 
     // Find first anchor with the given name.
     // First searches for an element with the given ID, but if that fails, then looks
diff --git a/Source/WebCore/dom/TreeScopeAdopter.cpp b/Source/WebCore/dom/TreeScopeAdopter.cpp
index e76209cc8..82ea47747 100644
--- a/Source/WebCore/dom/TreeScopeAdopter.cpp
+++ b/Source/WebCore/dom/TreeScopeAdopter.cpp
@@ -28,13 +28,13 @@
 #include "Document.h"
 #include "NodeRareData.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 
 namespace WebCore {
 
-static inline ShadowRoot* shadowRootFor(Node* node)
+static inline ShadowTree* shadowTreeFor(Node* node)
 {
-    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->youngestShadowRoot() : 0;
+    return node->isElementNode() ? toElement(node)->shadowTree() : 0;
 }
 
 void TreeScopeAdopter::moveTreeToNewScope(Node* root) const
@@ -63,10 +63,10 @@ void TreeScopeAdopter::moveTreeToNewScope(Node* root) const
         if (willMoveToNewDocument)
             moveNodeToNewDocument(node, oldDocument, newDocument);
 
-        if (ShadowRoot* shadow = shadowRootFor(node)) {
-            shadow->setParentTreeScope(m_newScope);
+        if (ShadowTree* tree = shadowTreeFor(node)) {
+            tree->setParentTreeScope(m_newScope);
             if (willMoveToNewDocument)
-                moveTreeToNewDocument(shadow, oldDocument, newDocument);
+                moveShadowTreeToNewDocument(tree, oldDocument, newDocument);
         }
     }
 }
@@ -75,11 +75,17 @@ void TreeScopeAdopter::moveTreeToNewDocument(Node* root, Document* oldDocument,
 {
     for (Node* node = root; node; node = node->traverseNextNode(root)) {
         moveNodeToNewDocument(node, oldDocument, newDocument);
-        if (ShadowRoot* shadow = shadowRootFor(node))
-            moveTreeToNewDocument(shadow, oldDocument, newDocument);
+        if (ShadowTree* tree = shadowTreeFor(node))
+            moveShadowTreeToNewDocument(tree, oldDocument, newDocument);
     }
 }
 
+inline void TreeScopeAdopter::moveShadowTreeToNewDocument(ShadowTree* tree, Document* oldDocument, Document* newDocument) const
+{
+    for (ShadowRoot* root = tree->youngestShadowRoot(); root; root = root->olderShadowRoot())
+        moveTreeToNewDocument(root, oldDocument, newDocument);
+}
+
 #ifndef NDEBUG
 static bool didMoveToNewDocumentWasCalled = false;
 static Document* oldDocumentDidMoveToNewDocumentWasCalledWith = 0;
diff --git a/Source/WebCore/dom/TreeScopeAdopter.h b/Source/WebCore/dom/TreeScopeAdopter.h
index d2bd4d4f0..94255f479 100644
--- a/Source/WebCore/dom/TreeScopeAdopter.h
+++ b/Source/WebCore/dom/TreeScopeAdopter.h
@@ -46,6 +46,7 @@ private:
     void moveTreeToNewScope(Node*) const;
     void moveTreeToNewDocument(Node*, Document* oldDocument, Document* newDocument) const;
     void moveNodeToNewDocument(Node*, Document* oldDocument, Document* newDocument) const;
+    void moveShadowTreeToNewDocument(ShadowTree*, Document* oldDocument, Document* newDocument) const;
 
     Node* m_toAdopt;
     TreeScope* m_newScope;
diff --git a/Source/WebCore/dom/WebKitMutationObserver.cpp b/Source/WebCore/dom/WebKitMutationObserver.cpp
index 60153627c..330cdca46 100644
--- a/Source/WebCore/dom/WebKitMutationObserver.cpp
+++ b/Source/WebCore/dom/WebKitMutationObserver.cpp
@@ -89,6 +89,7 @@ void WebKitMutationObserver::observe(Node* node, MutationObserverOptions options
 
 void WebKitMutationObserver::disconnect()
 {
+    m_records.clear();
     HashSet<MutationObserverRegistration*> registrations(m_registrations);
     for (HashSet<MutationObserverRegistration*>::iterator iter = registrations.begin(); iter != registrations.end(); ++iter)
         (*iter)->unregister();
@@ -123,6 +124,9 @@ void WebKitMutationObserver::enqueueMutationRecord(PassRefPtr<MutationRecord> mu
 
 void WebKitMutationObserver::deliver()
 {
+    if (m_records.isEmpty())
+        return;
+
     MutationRecordArray records;
     records.swap(m_records);
 
diff --git a/Source/WebCore/dom/WebKitMutationObserver.idl b/Source/WebCore/dom/WebKitMutationObserver.idl
index 2c0e8faa6..cb760469d 100644
--- a/Source/WebCore/dom/WebKitMutationObserver.idl
+++ b/Source/WebCore/dom/WebKitMutationObserver.idl
@@ -31,7 +31,8 @@
 module core {
     interface [
         Conditional=MUTATION_OBSERVERS,
-        CustomConstructor
+        CustomConstructor,
+        ConstructorParameters=1
     ] WebKitMutationObserver {
         [Custom] void observe(in Node target, in MutationObserverOptions options)
             raises(DOMException);
diff --git a/Source/WebCore/dom/WebKitNamedFlow.cpp b/Source/WebCore/dom/WebKitNamedFlow.cpp
index bced96576..c36299430 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.cpp
+++ b/Source/WebCore/dom/WebKitNamedFlow.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,8 @@
 #include "config.h"
 #include "WebKitNamedFlow.h"
 
+#include "Node.h"
+#include "NodeList.h"
 #include "RenderFlowThread.h"
 
 namespace WebCore {
@@ -49,4 +51,13 @@ bool WebKitNamedFlow::overflow() const
     return m_parentFlowThread->overflow();
 }
 
+PassRefPtr<NodeList> WebKitNamedFlow::getRegionsByContentNode(Node* contentNode)
+{
+    if (!contentNode)
+        return 0;
+    m_parentFlowThread->document()->updateLayoutIgnorePendingStylesheets(); 
+    return contentNode->getRegionsByContentNode(m_parentFlowThread->flowThread());
+}
+
 } // namespace WebCore
+
diff --git a/Source/WebCore/dom/WebKitNamedFlow.h b/Source/WebCore/dom/WebKitNamedFlow.h
index e815f03f4..b6f58c12a 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.h
+++ b/Source/WebCore/dom/WebKitNamedFlow.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +35,8 @@
 
 namespace WebCore {
 
+class Node;
+class NodeList;
 class RenderFlowThread;
 
 class WebKitNamedFlow : public RefCounted<WebKitNamedFlow> {
@@ -47,6 +49,8 @@ public:
     ~WebKitNamedFlow();
 
     bool overflow() const;
+    PassRefPtr<NodeList> getRegionsByContentNode(Node*);
+
 private:
     WebKitNamedFlow(RenderFlowThread*);
 
diff --git a/Source/WebCore/dom/WebKitNamedFlow.idl b/Source/WebCore/dom/WebKitNamedFlow.idl
index 2a065dd17..10a4d9e98 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.idl
+++ b/Source/WebCore/dom/WebKitNamedFlow.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,5 +32,7 @@ module core {
         JSGenerateToJSObject
     ] WebKitNamedFlow {
         readonly attribute boolean overflow;
+        NodeList getRegionsByContentNode(in Node contentNode);
     };
 }
+
diff --git a/Source/WebCore/dom/make_names.pl b/Source/WebCore/dom/make_names.pl
index 90151e11b..c8ed58b57 100755
--- a/Source/WebCore/dom/make_names.pl
+++ b/Source/WebCore/dom/make_names.pl
@@ -179,12 +179,14 @@ sub defaultTagPropertyHash
     return (
         'constructorNeedsCreatedByParser' => 0,
         'constructorNeedsFormElement' => 0,
+        'noConstructor' => 0,
         'interfaceName' => defaultInterfaceName($_[0]),
         # By default, the JSInterfaceName is the same as the interfaceName.
         'JSInterfaceName' => defaultInterfaceName($_[0]),
         'mapToTagName' => '',
         'wrapperOnlyIfMediaIsAvailable' => 0,
-        'conditional' => 0
+        'conditional' => 0,
+        'runtimeConditional' => 0
     );
 }
 
@@ -367,12 +369,21 @@ sub printConstructorInterior
         print F <<END
     Settings* settings = document->settings();
     if (!MediaPlayer::isAvailable() || (settings && !settings->isMediaEnabled()))
-        return HTMLElement::create($constructorTagName, document);
+        return 0;
     
 END
 ;
     }
 
+    my $runtimeConditional = $enabledTags{$tagName}{runtimeConditional};
+    if ($runtimeConditional) {
+        print F <<END
+    if (!RuntimeEnabledFeatures::${runtimeConditional}Enabled())
+        return 0;
+END
+;
+    }
+
     # Call the constructor with the right parameters.
     print F "    return ${interfaceName}::create($constructorTagName, document";
     print F ", formElement" if $enabledTags{$tagName}{constructorNeedsFormElement};
@@ -393,6 +404,10 @@ sub printConstructors
         # Ignore the mapped tag
         # FIXME: It could be moved inside this loop but was split for readibility.
         next if (defined($uniqueTags{$interfaceName}) || $enabledTags{$tagName}{mapToTagName});
+        # Tags can have wrappers without constructors.
+        # This is useful to make user-agent shadow elements internally testable
+        # while keeping them from being avaialble in the HTML markup.
+        next if $enabledTags{$tagName}{noConstructor};
 
         $uniqueTags{$interfaceName} = '1';
 
@@ -426,6 +441,7 @@ sub printFunctionInits
     my %tagConstructorMap = %$tagConstructorMap;
 
     for my $tagName (sort keys %tagConstructorMap) {
+        next if $enabledTags{$tagName}{noConstructor};
 
         my $conditional = $enabledTags{$tagName}{conditional};
         if ($conditional) {
@@ -788,6 +804,8 @@ printConditionalElementIncludes($F);
 
 print F <<END
 
+#include "RuntimeEnabledFeatures.h"
+
 #if ENABLE(DASHBOARD_SUPPORT) || ENABLE(VIDEO)
 #include "Document.h"
 #include "Settings.h"
@@ -848,7 +866,7 @@ print F <<END
 END
 ;
 
-if ($parameters{namespace} ne "HTML") {
+if ($parameters{namespace} ne "HTML" and $parameters{namespace} ne "SVG") {
 print F <<END
 #if ENABLE(DASHBOARD_SUPPORT)
     Settings* settings = document->settings();
@@ -863,16 +881,22 @@ END
 print F <<END
     if (!gFunctionMap)
         createFunctionMap();
-    if (ConstructorFunction function = gFunctionMap->get(qName.localName().impl()))
+    if (ConstructorFunction function = gFunctionMap->get(qName.localName().impl())) {
 END
 ;
 
 if ($parameters{namespace} eq "HTML") {
-    print F "        return function(qName, document, formElement, createdByParser);\n";
+    print F "        if (PassRefPtr<$parameters{namespace}Element> element = function(qName, document, formElement, createdByParser))\n";
+    print F "            return element;\n";
 } else {
-    print F "        return function(qName, document, createdByParser);\n";
+    print F "        if (PassRefPtr<$parameters{namespace}Element> element = function(qName, document, createdByParser))\n";
+    print F "            return element;\n";
 }
+print F <<END
+    }
 
+END
+;
 print F "    return $parameters{fallbackInterfaceName}::create(qName, document);\n";
 
 print F <<END
@@ -984,6 +1008,20 @@ static JSDOMWrapper* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGloba
 
 END
 ;
+            } elsif ($enabledTags{$tagName}{runtimeConditional}) {
+                my $runtimeConditional = $enabledTags{$tagName}{runtimeConditional};
+                print F <<END
+static JSDOMWrapper* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
+{
+    if (!RuntimeEnabledFeatures::${runtimeConditional}Enabled()) {
+        ASSERT(!element || element->is$parameters{fallbackInterfaceName}());
+        return CREATE_DOM_WRAPPER(exec, globalObject, $parameters{fallbackInterfaceName}, element.get());
+    }
+
+    return CREATE_DOM_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
+}
+END
+;
             } else {
                 print F <<END
 static JSDOMWrapper* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
@@ -1007,6 +1045,17 @@ static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespa
 
 END
 ;
+            } elsif ($enabledTags{$tagName}{runtimeConditional}) {
+                my $runtimeConditional = $enabledTags{$tagName}{runtimeConditional};
+                print F <<END
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
+{
+    if (!RuntimeEnabledFeatures::${runtimeConditional}Enabled())
+        return V8$parameters{fallbackInterfaceName}::wrap(to$parameters{fallbackInterfaceName}(element));
+    return toV8(static_cast<${JSInterfaceName}*>(element));
+}
+END
+;
             } elsif (${JSInterfaceName} eq "HTMLElement") {
                 print F <<END
 static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
@@ -1062,6 +1111,8 @@ sub printWrapperFactoryCppFile
 
     print F <<END
 
+#include "RuntimeEnabledFeatures.h"
+
 #if ENABLE(VIDEO)
 #include "Document.h"
 #include "Settings.h"
@@ -1161,7 +1212,7 @@ END
     } elsif ($wrapperFactoryType eq "V8") {
         print F <<END
         return createWrapperFunction(element);
-    return V8$parameters{fallbackInterfaceName}::wrap(static_cast<$parameters{fallbackInterfaceName}*>(element), forceNewObject);
+    return V8$parameters{fallbackInterfaceName}::wrap(to$parameters{fallbackInterfaceName}(element), forceNewObject);
 END
 ;
     }
diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
index 25444bb7d..7c6347c41 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
@@ -80,7 +80,7 @@ static bool hasNoAttributeOrOnlyStyleAttribute(const StyledElement* element, Sho
     if (element->getAttribute(classAttr) == styleSpanClassString())
         matchedAttributes++;
     if (element->hasAttribute(styleAttr) && (shouldStyleAttributeBeEmpty == AllowNonEmptyStyleAttribute
-        || !element->inlineStyleDecl() || element->inlineStyleDecl()->isEmpty()))
+        || !element->inlineStyle() || element->inlineStyle()->isEmpty()))
         matchedAttributes++;
 
     ASSERT(matchedAttributes <= element->attributeCount());
@@ -382,7 +382,7 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(EditingStyle* style)
         }
         lastStyledNode = node;
 
-        StylePropertySet* inlineStyleDecl = element->ensureInlineStyleDecl();
+        RefPtr<StylePropertySet> inlineStyleDecl = element->ensureInlineStyle()->copy();
         float currentFontSize = computedFontSize(node);
         float desiredFontSize = max(MinimumFontSize, startingFontSizes.get(node) + style->fontSizeDelta());
         RefPtr<CSSValue> value = inlineStyleDecl->getPropertyCSSValue(CSSPropertyFontSize);
@@ -509,7 +509,7 @@ void ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock(Node* node, Node* unsp
             // other attributes, like we (should) do with B and I elements.
             removeNodeAttribute(element, dirAttr);
         } else {
-            RefPtr<StylePropertySet> inlineStyle = element->ensureInlineStyleDecl()->copy();
+            RefPtr<StylePropertySet> inlineStyle = element->ensureInlineStyle()->copy();
             inlineStyle->setProperty(CSSPropertyUnicodeBidi, CSSValueNormal);
             inlineStyle->removeProperty(CSSPropertyDirection);
             setNodeAttribute(element, styleAttr, inlineStyle->asText());
@@ -723,7 +723,7 @@ void ApplyStyleCommand::applyInlineStyleToNodeRange(EditingStyle* style, Node* n
                 break;
             // Add to this element's inline style and skip over its contents.
             HTMLElement* element = toHTMLElement(node);
-            RefPtr<StylePropertySet> inlineStyle = element->ensureInlineStyleDecl()->copy();
+            RefPtr<StylePropertySet> inlineStyle = element->ensureInlineStyle()->copy();
             inlineStyle->merge(style->style());
             setNodeAttribute(element, styleAttr, inlineStyle->asText());
             next = node->traverseNextSibling();
@@ -888,14 +888,12 @@ bool ApplyStyleCommand::removeCSSStyle(EditingStyle* style, HTMLElement* element
     if (!style->conflictsWithInlineStyleOfElement(element, extractedStyle, properties))
         return false;
 
-    StylePropertySet* inlineStyle = element->inlineStyleDecl();
-    ASSERT(inlineStyle);
     // FIXME: We should use a mass-removal function here but we don't have an undoable one yet.
     for (size_t i = 0; i < properties.size(); i++)
         removeCSSProperty(element, properties[i]);
 
     // No need to serialize <foo style=""> if we just removed the last css property
-    if (inlineStyle->isEmpty())
+    if (element->inlineStyle()->isEmpty())
         removeNodeAttribute(element, styleAttr);
 
     if (isSpanWithoutAttributesOrUnstyledStyleSpan(element))
@@ -932,7 +930,7 @@ void ApplyStyleCommand::applyInlineStyleToPushDown(Node* node, EditingStyle* sty
         return;
 
     RefPtr<EditingStyle> newInlineStyle = style;
-    if (node->isHTMLElement() && toHTMLElement(node)->inlineStyleDecl()) {
+    if (node->isHTMLElement() && toHTMLElement(node)->inlineStyle()) {
         newInlineStyle = style->copy();
         newInlineStyle->mergeInlineStyleOfElement(toHTMLElement(node), EditingStyle::OverrideValues);
     }
@@ -1308,7 +1306,7 @@ void ApplyStyleCommand::addBlockStyle(const StyleChange& styleChange, HTMLElemen
         return;
         
     String cssText = styleChange.cssStyle();
-    if (StylePropertySet* decl = block->inlineStyleDecl())
+    if (const StylePropertySet* decl = block->inlineStyle())
         cssText += decl->asText();
     setNodeAttribute(block, styleAttr, cssText);
 }
@@ -1373,7 +1371,7 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(EditingStyle* style, PassRefPtr<N
 
     if (styleChange.cssStyle().length()) {
         if (styleContainer) {
-            if (StylePropertySet* existingStyle = styleContainer->inlineStyleDecl())
+            if (const StylePropertySet* existingStyle = styleContainer->inlineStyle())
                 setNodeAttribute(styleContainer, styleAttr, existingStyle->asText() + styleChange.cssStyle());
             else
                 setNodeAttribute(styleContainer, styleAttr, styleChange.cssStyle());
diff --git a/Source/WebCore/editing/CompositeEditCommand.cpp b/Source/WebCore/editing/CompositeEditCommand.cpp
index f57657137..830eacf6f 100644
--- a/Source/WebCore/editing/CompositeEditCommand.cpp
+++ b/Source/WebCore/editing/CompositeEditCommand.cpp
@@ -1032,8 +1032,15 @@ void CompositeEditCommand::cleanupAfterDeletion(VisiblePosition destination)
         // doesn't require a placeholder to prop itself open (like a bordered
         // div or an li), remove it during the move (the list removal code
         // expects this behavior).
-        else if (isBlock(node))
+        else if (isBlock(node)) {
+            // If caret position after deletion and destination position coincides,
+            // node should not be removed.
+            if (!position.rendersInDifferentPosition(destination.deepEquivalent())) {
+                prune(node);
+                return;
+            }
             removeNodeAndPruneAncestors(node);
+        }
         else if (lineBreakExistsAtPosition(position)) {
             // There is a preserved '\n' at caretAfterDelete.
             // We can safely assume this is a text node.
diff --git a/Source/WebCore/editing/DeleteSelectionCommand.cpp b/Source/WebCore/editing/DeleteSelectionCommand.cpp
index 9a94509ce..5f5dfcfbd 100644
--- a/Source/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/Source/WebCore/editing/DeleteSelectionCommand.cpp
@@ -363,7 +363,7 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
         // Make sure empty cell has some height, if a placeholder can be inserted.
         document()->updateLayoutIgnorePendingStylesheets();
         RenderObject *r = node->renderer();
-        if (r && r->isTableCell() && toRenderTableCell(r)->contentHeight() <= 0) {
+        if (r && r->isTableCell() && toRenderTableCell(r)->contentHeight(IncludeIntrinsicPadding) <= 0) {
             Position firstEditablePosition = firstEditablePositionInNode(node.get());
             if (firstEditablePosition.isNotNull())
                 insertBlockPlaceholder(firstEditablePosition);
diff --git a/Source/WebCore/editing/EditingStyle.cpp b/Source/WebCore/editing/EditingStyle.cpp
index 57291c1f5..3a360d8a9 100644
--- a/Source/WebCore/editing/EditingStyle.cpp
+++ b/Source/WebCore/editing/EditingStyle.cpp
@@ -44,6 +44,7 @@
 #include "QualifiedName.h"
 #include "RenderStyle.h"
 #include "StylePropertySet.h"
+#include "StyleRule.h"
 #include "StyledElement.h"
 #include "htmlediting.h"
 #include "visible_units.h"
@@ -124,7 +125,7 @@ public:
     virtual ~HTMLElementEquivalent() { }
     virtual bool matches(const Element* element) const { return !m_tagName || element->hasTagName(*m_tagName); }
     virtual bool hasAttribute() const { return false; }
-    virtual bool propertyExistsInStyle(StylePropertySet* style) const { return style && style->getPropertyCSSValue(m_propertyID); }
+    virtual bool propertyExistsInStyle(const StylePropertySet* style) const { return style && style->getPropertyCSSValue(m_propertyID); }
     virtual bool valueIsPresentInStyle(Element*, StylePropertySet*) const;
     virtual void addToStyle(Element*, EditingStyle*) const;
 
@@ -174,7 +175,7 @@ public:
     {
         return adoptPtr(new HTMLTextDecorationEquivalent(primitiveValue, tagName));
     }
-    virtual bool propertyExistsInStyle(StylePropertySet*) const;
+    virtual bool propertyExistsInStyle(const StylePropertySet*) const;
     virtual bool valueIsPresentInStyle(Element*, StylePropertySet*) const;
 
 private:
@@ -187,7 +188,7 @@ HTMLTextDecorationEquivalent::HTMLTextDecorationEquivalent(int primitiveValue, c
 {
 }
 
-bool HTMLTextDecorationEquivalent::propertyExistsInStyle(StylePropertySet* style) const
+bool HTMLTextDecorationEquivalent::propertyExistsInStyle(const StylePropertySet* style) const
 {
     return style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect) || style->getPropertyCSSValue(CSSPropertyTextDecoration);
 }
@@ -663,7 +664,7 @@ bool EditingStyle::conflictsWithInlineStyleOfElement(StyledElement* element, Edi
     ASSERT(element);
     ASSERT(!conflictingProperties || conflictingProperties->isEmpty());
 
-    StylePropertySet* inlineStyle = element->inlineStyleDecl();
+    const StylePropertySet* inlineStyle = element->inlineStyle();
     if (!m_mutableStyle || !inlineStyle)
         return false;
 
@@ -849,7 +850,7 @@ bool EditingStyle::elementIsStyledSpanOrHTMLEquivalent(const HTMLElement* elemen
         matchedAttributes++;
 
     if (element->hasAttribute(HTMLNames::styleAttr)) {
-        if (StylePropertySet* style = element->inlineStyleDecl()) {
+        if (const StylePropertySet* style = element->inlineStyle()) {
             unsigned propertyCount = style->propertyCount();
             for (unsigned i = 0; i < propertyCount; ++i) {
                 if (!isEditingProperty(style->propertyAt(i).id()))
@@ -911,18 +912,18 @@ void EditingStyle::mergeTypingStyle(Document* document)
 void EditingStyle::mergeInlineStyleOfElement(StyledElement* element, CSSPropertyOverrideMode mode, PropertiesToInclude propertiesToInclude)
 {
     ASSERT(element);
-    if (!element->inlineStyleDecl())
+    if (!element->inlineStyle())
         return;
 
     switch (propertiesToInclude) {
     case AllProperties:
-        mergeStyle(element->inlineStyleDecl(), mode);
+        mergeStyle(element->inlineStyle(), mode);
         return;
     case OnlyEditingInheritableProperties:
-        mergeStyle(copyEditingProperties(element->inlineStyleDecl(), OnlyInheritableEditingProperties).get(), mode);
+        mergeStyle(copyEditingProperties(element->inlineStyle(), OnlyInheritableEditingProperties).get(), mode);
         return;
     case EditingPropertiesInEffect:
-        mergeStyle(copyEditingProperties(element->inlineStyleDecl(), AllEditingProperties).get(), mode);
+        mergeStyle(copyEditingProperties(element->inlineStyle(), AllEditingProperties).get(), mode);
         return;
     }
 }
@@ -930,7 +931,7 @@ void EditingStyle::mergeInlineStyleOfElement(StyledElement* element, CSSProperty
 static inline bool elementMatchesAndPropertyIsNotInInlineStyleDecl(const HTMLElementEquivalent* equivalent, const StyledElement* element,
     EditingStyle::CSSPropertyOverrideMode mode, StylePropertySet* style)
 {
-    return equivalent->matches(element) && !equivalent->propertyExistsInStyle(element->inlineStyleDecl())
+    return equivalent->matches(element) && !equivalent->propertyExistsInStyle(element->inlineStyle())
         && (mode == EditingStyle::OverrideValues || !equivalent->propertyExistsInStyle(style));
 }
 
@@ -996,7 +997,7 @@ static void mergeTextDecorationValues(CSSValueList* mergedValue, const CSSValueL
         mergedValue->append(lineThrough.get());
 }
 
-void EditingStyle::mergeStyle(StylePropertySet* style, CSSPropertyOverrideMode mode)
+void EditingStyle::mergeStyle(const StylePropertySet* style, CSSPropertyOverrideMode mode)
 {
     if (!style)
         return;
@@ -1032,7 +1033,7 @@ static PassRefPtr<StylePropertySet> styleFromMatchedRulesForElement(Element* ele
     if (matchedRules) {
         for (unsigned i = 0; i < matchedRules->length(); i++) {
             if (matchedRules->item(i)->type() == CSSRule::STYLE_RULE) {
-                RefPtr<StylePropertySet> s = static_cast<CSSStyleRule*>(matchedRules->item(i))->declaration();
+                RefPtr<StylePropertySet> s = static_cast<CSSStyleRule*>(matchedRules->item(i))->styleRule()->properties();
                 style->merge(s.get(), true);
             }
         }
@@ -1378,6 +1379,8 @@ void StyleChange::extractTextStyles(Document* document, StylePropertySet* style,
     }
 
     m_applyFontFace = style->getPropertyValue(CSSPropertyFontFamily);
+    // Remove single quotes for Outlook 2007 compatibility. See https://bugs.webkit.org/show_bug.cgi?id=79448
+    m_applyFontFace.replace('\'', "");
     style->removeProperty(CSSPropertyFontFamily);
 
     if (RefPtr<CSSValue> fontSize = style->getPropertyCSSValue(CSSPropertyFontSize)) {
diff --git a/Source/WebCore/editing/EditingStyle.h b/Source/WebCore/editing/EditingStyle.h
index 71dc652f0..c213036e1 100644
--- a/Source/WebCore/editing/EditingStyle.h
+++ b/Source/WebCore/editing/EditingStyle.h
@@ -161,7 +161,7 @@ private:
     TriState triStateOfStyle(CSSStyleDeclaration* styleToCompare, ShouldIgnoreTextOnlyProperties) const;
     bool conflictsWithInlineStyleOfElement(StyledElement*, EditingStyle* extractedStyle, Vector<CSSPropertyID>* conflictingProperties) const;
     void mergeInlineAndImplicitStyleOfElement(StyledElement*, CSSPropertyOverrideMode, PropertiesToInclude);
-    void mergeStyle(StylePropertySet*, CSSPropertyOverrideMode);
+    void mergeStyle(const StylePropertySet*, CSSPropertyOverrideMode);
 
     RefPtr<StylePropertySet> m_mutableStyle;
     bool m_shouldUseFixedDefaultFontSize;
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 1ce24e538..72e21fa24 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -846,6 +846,7 @@ Editor::Editor(Frame* frame)
     , m_spellChecker(adoptPtr(new SpellChecker(frame)))
     , m_spellingCorrector(adoptPtr(new SpellingCorrectionController(frame)))
     , m_areMarkedTextMatchesHighlighted(false)
+    , m_defaultParagraphSeparator(EditorParagraphSeparatorIsDiv)
 {
 }
 
@@ -858,6 +859,7 @@ void Editor::clear()
     m_compositionNode = 0;
     m_customCompositionUnderlines.clear();
     m_shouldStyleWithCSS = false;
+    m_defaultParagraphSeparator = EditorParagraphSeparatorIsDiv;
 }
 
 bool Editor::insertText(const String& text, Event* triggeringEvent)
diff --git a/Source/WebCore/editing/Editor.h b/Source/WebCore/editing/Editor.h
index e398bbf3e..3c2544a71 100644
--- a/Source/WebCore/editing/Editor.h
+++ b/Source/WebCore/editing/Editor.h
@@ -80,6 +80,7 @@ struct CompositionUnderline {
 };
 
 enum EditorCommandSource { CommandFromMenuOrKeyBinding, CommandFromDOM, CommandFromDOMWithUserInterface };
+enum EditorParagraphSeparator { EditorParagraphSeparatorIsDiv, EditorParagraphSeparatorIsP };
 
 class Editor {
 public:
@@ -383,6 +384,9 @@ public:
 
     void deviceScaleFactorChanged();
 
+    EditorParagraphSeparator defaultParagraphSeparator() const { return m_defaultParagraphSeparator; }
+    void setDefaultParagraphSeparator(EditorParagraphSeparator separator) { m_defaultParagraphSeparator = separator; }
+
 private:
     Frame* m_frame;
     OwnPtr<DeleteButtonController> m_deleteButtonController;
@@ -400,6 +404,7 @@ private:
     OwnPtr<SpellingCorrectionController> m_spellingCorrector;
     VisibleSelection m_mark;
     bool m_areMarkedTextMatchesHighlighted;
+    EditorParagraphSeparator m_defaultParagraphSeparator;
 
     bool canDeleteRange(Range*) const;
     bool canSmartReplaceWithPasteboard(Pasteboard*);
diff --git a/Source/WebCore/editing/EditorCommand.cpp b/Source/WebCore/editing/EditorCommand.cpp
index a4137425d..b9f34b980 100644
--- a/Source/WebCore/editing/EditorCommand.cpp
+++ b/Source/WebCore/editing/EditorCommand.cpp
@@ -307,6 +307,16 @@ static bool executeCut(Frame* frame, Event*, EditorCommandSource source, const S
     return true;
 }
 
+static bool executeDefaultParagraphSeparator(Frame* frame, Event*, EditorCommandSource, const String& value)
+{
+    if (equalIgnoringCase(value, "div"))
+        frame->editor()->setDefaultParagraphSeparator(EditorParagraphSeparatorIsDiv);
+    else if (equalIgnoringCase(value, "p"))
+        frame->editor()->setDefaultParagraphSeparator(EditorParagraphSeparatorIsP);
+
+    return true;
+}
+
 static bool executeDelete(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
     switch (source) {
@@ -1378,6 +1388,19 @@ static String valueBackColor(Frame* frame, Event*)
     return valueStyle(frame, CSSPropertyBackgroundColor);
 }
 
+static String valueDefaultParagraphSeparator(Frame* frame, Event*)
+{
+    switch (frame->editor()->defaultParagraphSeparator()) {
+    case EditorParagraphSeparatorIsDiv:
+        return divTag.localName();
+    case EditorParagraphSeparatorIsP:
+        return pTag.localName();
+    }
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
 static String valueFontName(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyFontFamily);
@@ -1429,6 +1452,7 @@ static const CommandMap& createCommandMap()
         { "Copy", { executeCopy, supportedCopyCut, enabledCopy, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
         { "CreateLink", { executeCreateLink, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Cut", { executeCut, supportedCopyCut, enabledCut, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
+        { "DefaultParagraphSeparator", { executeDefaultParagraphSeparator, supported, enabled, stateNone, valueDefaultParagraphSeparator, notTextInsertion, doNotAllowExecutionWhenDisabled} },
         { "Delete", { executeDelete, supported, enabledDelete, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "DeleteBackward", { executeDeleteBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "DeleteBackwardByDecomposingPreviousCharacter", { executeDeleteBackwardByDecomposingPreviousCharacter, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
diff --git a/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp b/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
index ca5baba4b..58ca6db61 100644
--- a/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
+++ b/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
@@ -43,7 +43,7 @@ RemoveCSSPropertyCommand::RemoveCSSPropertyCommand(Document* document, PassRefPt
 
 void RemoveCSSPropertyCommand::doApply()
 {
-    StylePropertySet* style = m_element->inlineStyleDecl();
+    const StylePropertySet* style = m_element->inlineStyle();
     m_oldValue = style->getPropertyValue(m_property);
     m_important = style->propertyIsImportant(m_property);
 
diff --git a/Source/WebCore/editing/RenderedPosition.cpp b/Source/WebCore/editing/RenderedPosition.cpp
index fb3bfb06a..8c900232a 100644
--- a/Source/WebCore/editing/RenderedPosition.cpp
+++ b/Source/WebCore/editing/RenderedPosition.cpp
@@ -100,14 +100,14 @@ RenderedPosition::RenderedPosition(const Position& position, EAffinity affinity)
 InlineBox* RenderedPosition::prevLeafChild() const
 {
     if (m_prevLeafChild == uncachedInlineBox())
-        m_prevLeafChild = m_inlineBox->prevLeafChild();
+        m_prevLeafChild = m_inlineBox->prevLeafChildIgnoringLineBreak();
     return m_prevLeafChild;
 }
 
 InlineBox* RenderedPosition::nextLeafChild() const
 {
     if (m_nextLeafChild == uncachedInlineBox())
-        m_nextLeafChild = m_inlineBox->nextLeafChild();
+        m_nextLeafChild = m_inlineBox->nextLeafChildIgnoringLineBreak();
     return m_nextLeafChild;
 }
 
@@ -137,7 +137,7 @@ RenderedPosition RenderedPosition::leftBoundaryOfBidiRun(unsigned char bidiLevel
 
     InlineBox* box = m_inlineBox;
     do {
-        InlineBox* prev = box->prevLeafChild();
+        InlineBox* prev = box->prevLeafChildIgnoringLineBreak();
         if (!prev || prev->bidiLevel() < bidiLevelOfRun)
             return RenderedPosition(box->renderer(), box, box->caretLeftmostOffset());
         box = prev;
@@ -154,7 +154,7 @@ RenderedPosition RenderedPosition::rightBoundaryOfBidiRun(unsigned char bidiLeve
 
     InlineBox* box = m_inlineBox;
     do {
-        InlineBox* next = box->nextLeafChild();
+        InlineBox* next = box->nextLeafChildIgnoringLineBreak();
         if (!next || next->bidiLevel() < bidiLevelOfRun)
             return RenderedPosition(box->renderer(), box, box->caretRightmostOffset());
         box = next;
diff --git a/Source/WebCore/editing/ReplaceSelectionCommand.cpp b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
index 95fdaf060..af5a8be13 100644
--- a/Source/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -484,7 +484,7 @@ void ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline(Insert
 
         StyledElement* element = static_cast<StyledElement*>(node.get());
 
-        StylePropertySet* inlineStyle = element->inlineStyleDecl();
+        const StylePropertySet* inlineStyle = element->inlineStyle();
         RefPtr<EditingStyle> newInlineStyle = EditingStyle::create(inlineStyle);
         if (inlineStyle) {
             ContainerNode* context = element->parentNode();
@@ -703,7 +703,7 @@ void ReplaceSelectionCommand::handleStyleSpans(InsertedNodes& insertedNodes)
     if (!wrappingStyleSpan)
         return;
 
-    RefPtr<EditingStyle> style = EditingStyle::create(wrappingStyleSpan->ensureInlineStyleDecl());
+    RefPtr<EditingStyle> style = EditingStyle::create(wrappingStyleSpan->ensureInlineStyle());
     ContainerNode* context = wrappingStyleSpan->parentNode();
 
     // If Mail wraps the fragment with a Paste as Quotation blockquote, or if you're pasting into a quoted region,
diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
index aaeca4f9a..e0bf8c3a0 100644
--- a/Source/WebCore/editing/TextIterator.cpp
+++ b/Source/WebCore/editing/TextIterator.cpp
@@ -394,7 +394,8 @@ void TextIterator::advance()
                     m_handledNode = handleTextNode();
                 else if (renderer && (renderer->isImage() || renderer->isWidget() ||
                          (renderer->node() && renderer->node()->isElementNode() &&
-                          static_cast<Element*>(renderer->node())->isFormControlElement())))
+                          (static_cast<Element*>(renderer->node())->isFormControlElement()
+                          || static_cast<Element*>(renderer->node())->hasTagName(legendTag)))))
                     m_handledNode = handleReplacedElement();
                 else
                     m_handledNode = handleNonTextNode();
diff --git a/Source/WebCore/editing/htmlediting.cpp b/Source/WebCore/editing/htmlediting.cpp
index 07046100e..f4d91e9ce 100644
--- a/Source/WebCore/editing/htmlediting.cpp
+++ b/Source/WebCore/editing/htmlediting.cpp
@@ -29,6 +29,8 @@
 #include "AXObjectCache.h"
 #include "Document.h"
 #include "EditingText.h"
+#include "Editor.h"
+#include "Frame.h"
 #include "HTMLBRElement.h"
 #include "HTMLDivElement.h"
 #include "HTMLElementFactory.h"
@@ -38,6 +40,7 @@
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
 #include "HTMLOListElement.h"
+#include "HTMLParagraphElement.h"
 #include "HTMLUListElement.h"
 #include "PositionIterator.h"
 #include "RenderObject.h"
@@ -844,7 +847,15 @@ bool isEmptyTableCell(const Node* node)
 
 PassRefPtr<HTMLElement> createDefaultParagraphElement(Document* document)
 {
-    return HTMLDivElement::create(document);
+    switch (document->frame()->editor()->defaultParagraphSeparator()) {
+    case EditorParagraphSeparatorIsDiv:
+        return HTMLDivElement::create(document);
+    case EditorParagraphSeparatorIsP:
+        return HTMLParagraphElement::create(document);
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
 }
 
 PassRefPtr<HTMLElement> createBreakElement(Document* document)
@@ -1142,22 +1153,15 @@ bool isRenderedAsNonInlineTableImageOrHR(const Node* node)
 
 bool areIdenticalElements(const Node* first, const Node* second)
 {
-    // check that tag name and all attribute names and values are identical
-
     if (!first->isElementNode() || !second->isElementNode())
         return false;
 
-    if (!toElement(first)->tagQName().matches(toElement(second)->tagQName()))
+    const Element* firstElement = toElement(first);
+    const Element* secondElement = toElement(second);
+    if (!firstElement->hasTagName(secondElement->tagQName()))
         return false;
 
-    NamedNodeMap* firstMap = toElement(first)->updatedAttributes();
-    NamedNodeMap* secondMap = toElement(second)->updatedAttributes();
-
-    if (firstMap)
-        return firstMap->mapsEquivalent(secondMap);
-    if (secondMap)
-        return secondMap->mapsEquivalent(firstMap);
-    return true;
+    return firstElement->hasEquivalentAttributes(secondElement);
 }
 
 bool isNonTableCellHTMLBlockElement(const Node* node)
diff --git a/Source/WebCore/editing/mac/EditorMac.mm b/Source/WebCore/editing/mac/EditorMac.mm
index 2f5833674..85133dd4f 100644
--- a/Source/WebCore/editing/mac/EditorMac.mm
+++ b/Source/WebCore/editing/mac/EditorMac.mm
@@ -74,7 +74,7 @@ void Editor::pasteWithPasteboard(Pasteboard* pasteboard, bool allowPlainText)
     RefPtr<Range> range = selectedRange();
     bool choosePlainText;
     
-    m_frame->editor()->client()->setInsertionPasteboard([NSPasteboard generalPasteboard]);
+    m_frame->editor()->client()->setInsertionPasteboard(NSGeneralPboard);
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
     RefPtr<DocumentFragment> fragment = pasteboard->documentFragment(m_frame, range, allowPlainText, choosePlainText);
     if (fragment && shouldInsertFragment(fragment, range, EditorInsertActionPasted))
@@ -94,7 +94,7 @@ void Editor::pasteWithPasteboard(Pasteboard* pasteboard, bool allowPlainText)
             pasteAsFragment(fragment, canSmartReplaceWithPasteboard(pasteboard), false);
     }
 #endif
-    m_frame->editor()->client()->setInsertionPasteboard(nil);
+    m_frame->editor()->client()->setInsertionPasteboard(String());
 }
 
 static RenderStyle* styleForSelectionStart(Frame* frame, Node *&nodeToRemove)
@@ -282,11 +282,10 @@ void Editor::takeFindStringFromSelection()
         return;
     }
 
-    NSString *nsSelectedText = m_frame->displayStringModifiedByEncoding(selectedText());
-
-    NSPasteboard *findPasteboard = [NSPasteboard pasteboardWithName:NSFindPboard];
-    [findPasteboard declareTypes:[NSArray arrayWithObject:NSStringPboardType] owner:nil];
-    [findPasteboard setString:nsSelectedText forType:NSStringPboardType];
+    Vector<String> types;
+    types.append(String(NSStringPboardType));
+    platformStrategies()->pasteboardStrategy()->setTypes(types, NSFindPboard);
+    platformStrategies()->pasteboardStrategy()->setStringForType(m_frame->displayStringModifiedByEncoding(selectedText()), NSStringPboardType, NSFindPboard);
 }
 
 void Editor::writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes)
diff --git a/Source/WebCore/editing/markup.cpp b/Source/WebCore/editing/markup.cpp
index c0c0bf4db..05cde4a63 100644
--- a/Source/WebCore/editing/markup.cpp
+++ b/Source/WebCore/editing/markup.cpp
@@ -39,10 +39,12 @@
 #include "CSSStyleSelector.h"
 #include "CSSValue.h"
 #include "CSSValueKeywords.h"
+#include "ChildListMutationScope.h"
 #include "DeleteButtonController.h"
 #include "DocumentFragment.h"
 #include "DocumentType.h"
 #include "Editor.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLBodyElement.h"
 #include "HTMLElement.h"
@@ -308,8 +310,8 @@ void StyledMarkupAccumulator::appendElement(StringBuilder& out, Element* element
         } else
             newInlineStyle = EditingStyle::create();
 
-        if (element->isStyledElement() && static_cast<StyledElement*>(element)->inlineStyleDecl())
-            newInlineStyle->overrideWithStyle(static_cast<StyledElement*>(element)->inlineStyleDecl());
+        if (element->isStyledElement() && static_cast<StyledElement*>(element)->inlineStyle())
+            newInlineStyle->overrideWithStyle(static_cast<StyledElement*>(element)->inlineStyle());
 
         if (shouldAnnotateOrForceInline) {
             if (shouldAnnotate())
@@ -493,7 +495,7 @@ static PassRefPtr<EditingStyle> styleFromMatchedRulesAndInlineDecl(const Node* n
     // FIXME: Having to const_cast here is ugly, but it is quite a bit of work to untangle
     // the non-const-ness of styleFromMatchedRulesForElement.
     HTMLElement* element = const_cast<HTMLElement*>(static_cast<const HTMLElement*>(node));
-    RefPtr<EditingStyle> style = EditingStyle::create(element->inlineStyleDecl());
+    RefPtr<EditingStyle> style = EditingStyle::create(element->inlineStyle());
     style->mergeStyleFromRules(element);
     return style.release();
 }
@@ -691,7 +693,7 @@ static bool findNodesSurroundingContext(Document* document, RefPtr<Node>& nodeBe
 static void trimFragment(DocumentFragment* fragment, Node* nodeBeforeContext, Node* nodeAfterContext)
 {
     ExceptionCode ec = 0;
-    Node* next;
+    RefPtr<Node> next;
     for (RefPtr<Node> node = fragment->firstChild(); node; node = next) {
         if (nodeBeforeContext->isDescendantOf(node.get())) {
             next = node->traverseNextNode();
@@ -705,9 +707,9 @@ static void trimFragment(DocumentFragment* fragment, Node* nodeBeforeContext, No
     }
 
     ASSERT(nodeAfterContext->parentNode());
-    for (Node* node = nodeAfterContext; node; node = next) {
+    for (RefPtr<Node> node = nodeAfterContext; node; node = next) {
         next = node->traverseNextSibling();
-        node->parentNode()->removeChild(node, ec);
+        node->parentNode()->removeChild(node.get(), ec);
         ASSERT(!ec);
     }
 }
@@ -990,4 +992,84 @@ String urlToMarkup(const KURL& url, const String& title)
     return markup.toString();
 }
 
+PassRefPtr<DocumentFragment> createFragmentFromSource(const String& markup, Element* contextElement, ExceptionCode& ec)
+{
+    Document* document = contextElement->document();
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document);
+
+    if (document->isHTMLDocument()) {
+        fragment->parseHTML(markup, contextElement);
+        return fragment;
+    }
+
+    bool wasValid = fragment->parseXML(markup, contextElement);
+    if (!wasValid) {
+        ec = INVALID_STATE_ERR;
+        return 0;
+    }
+    return fragment.release();
+}
+
+static inline bool hasOneChild(ContainerNode* node)
+{
+    Node* firstChild = node->firstChild();
+    return firstChild && !firstChild->nextSibling();
+}
+
+static inline bool hasOneTextChild(ContainerNode* node)
+{
+    return hasOneChild(node) && node->firstChild()->isTextNode();
+}
+
+void replaceChildrenWithFragment(ContainerNode* container, PassRefPtr<DocumentFragment> fragment, ExceptionCode& ec)
+{
+    RefPtr<ContainerNode> containerNode(container);
+
+#if ENABLE(MUTATION_OBSERVERS)
+    ChildListMutationScope mutation(containerNode.get());
+#endif
+
+    if (!fragment->firstChild()) {
+        containerNode->removeChildren();
+        return;
+    }
+
+    if (hasOneTextChild(containerNode.get()) && hasOneTextChild(fragment.get())) {
+        toText(containerNode->firstChild())->setData(toText(fragment->firstChild())->data(), ec);
+        return;
+    }
+
+    if (hasOneChild(containerNode.get())) {
+        containerNode->replaceChild(fragment, containerNode->firstChild(), ec);
+        return;
+    }
+
+    containerNode->removeChildren();
+    containerNode->appendChild(fragment, ec);
+}
+
+void replaceChildrenWithText(ContainerNode* container, const String& text, ExceptionCode& ec)
+{
+    RefPtr<ContainerNode> containerNode(container);
+
+#if ENABLE(MUTATION_OBSERVERS)
+    ChildListMutationScope mutation(containerNode.get());
+#endif
+
+    if (hasOneTextChild(containerNode.get())) {
+        toText(containerNode->firstChild())->setData(text, ec);
+        return;
+    }
+
+    RefPtr<Text> textNode = Text::create(containerNode->document(), text);
+
+    if (hasOneChild(containerNode.get())) {
+        containerNode->replaceChild(textNode.release(), containerNode->firstChild(), ec);
+        return;
+    }
+
+    containerNode->removeChildren();
+    containerNode->appendChild(textNode.release(), ec);
+}
+
 }
diff --git a/Source/WebCore/editing/markup.h b/Source/WebCore/editing/markup.h
index f28715b22..918ae9b13 100644
--- a/Source/WebCore/editing/markup.h
+++ b/Source/WebCore/editing/markup.h
@@ -33,6 +33,7 @@
 
 namespace WebCore {
 
+    class ContainerNode;
     class Document;
     class DocumentFragment;
     class Element;
@@ -40,6 +41,8 @@ namespace WebCore {
     class Node;
     class Range;
 
+    typedef int ExceptionCode;
+
     enum EChildrenOnly { IncludeNode, ChildrenOnly };
     enum EAbsoluteURLs { DoNotResolveURLs, ResolveAllURLs, ResolveNonLocalURLs };
 
@@ -47,9 +50,14 @@ namespace WebCore {
     PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document*, const String& markup, const String& baseURL, FragmentScriptingPermission = FragmentScriptingAllowed);
     PassRefPtr<DocumentFragment> createFragmentFromMarkupWithContext(Document*, const String& markup, unsigned fragmentStart, unsigned fragmentEnd, const String& baseURL, FragmentScriptingPermission);
     PassRefPtr<DocumentFragment> createFragmentFromNodes(Document*, const Vector<Node*>&);
+    PassRefPtr<DocumentFragment> createFragmentFromSource(const String&, Element*, ExceptionCode&);
 
     bool isPlainTextMarkup(Node *node);
 
+    // These methods are used by HTMLElement & ShadowRoot to replace the children with respected fragment/text.
+    void replaceChildrenWithFragment(ContainerNode*, PassRefPtr<DocumentFragment>, ExceptionCode&);
+    void replaceChildrenWithText(ContainerNode*, const String&, ExceptionCode&);
+
     String createMarkup(const Range*,
         Vector<Node*>* = 0, EAnnotateForInterchange = DoNotAnnotateForInterchange, bool convertBlocksToInlines = false, EAbsoluteURLs = DoNotResolveURLs);
     String createMarkup(const Node*, EChildrenOnly = IncludeNode, Vector<Node*>* = 0, EAbsoluteURLs = DoNotResolveURLs);
diff --git a/Source/WebCore/fileapi/FileStreamProxy.cpp b/Source/WebCore/fileapi/AsyncFileStream.cpp
index d43506566..1b035ccc3 100644
--- a/Source/WebCore/fileapi/FileStreamProxy.cpp
+++ b/Source/WebCore/fileapi/AsyncFileStream.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2010 Google Inc.  All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -30,13 +31,14 @@
 
 #include "config.h"
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
-#include "FileStreamProxy.h"
+#include "AsyncFileStream.h"
 
 #include "Blob.h"
 #include "CrossThreadTask.h"
 #include "FileStream.h"
+#include "FileStreamClient.h"
 #include "FileThread.h"
 #include "FileThreadTask.h"
 #include "PlatformString.h"
@@ -44,44 +46,44 @@
 
 namespace WebCore {
 
-inline FileStreamProxy::FileStreamProxy(ScriptExecutionContext* context, FileStreamClient* client)
-    : AsyncFileStream(client)
-    , m_context(context)
+inline AsyncFileStream::AsyncFileStream(ScriptExecutionContext* context, FileStreamClient* client)
+    : m_context(context)
     , m_stream(FileStream::create())
+    , m_client(client)
 {
 }
 
-PassRefPtr<FileStreamProxy> FileStreamProxy::create(ScriptExecutionContext* context, FileStreamClient* client)
+PassRefPtr<AsyncFileStream> AsyncFileStream::create(ScriptExecutionContext* context, FileStreamClient* client)
 {
-    RefPtr<FileStreamProxy> proxy = adoptRef(new FileStreamProxy(context, client));
+    RefPtr<AsyncFileStream> proxy = adoptRef(new AsyncFileStream(context, client));
 
-    // Hold an ref so that the instance will not get deleted while there are tasks on the file thread.
+    // Hold a reference so that the instance will not get deleted while there are tasks on the file thread.
     // This is balanced by the deref in derefProxyOnContext below.
     proxy->ref();
 
-    proxy->fileThread()->postTask(createFileThreadTask(proxy.get(), &FileStreamProxy::startOnFileThread));
+    proxy->fileThread()->postTask(createFileThreadTask(proxy.get(), &AsyncFileStream::startOnFileThread));
 
     return proxy.release();
 }
 
-FileStreamProxy::~FileStreamProxy()
+AsyncFileStream::~AsyncFileStream()
 {
 }
 
-FileThread* FileStreamProxy::fileThread()
+FileThread* AsyncFileStream::fileThread()
 {
     ASSERT(m_context->isContextThread());
     ASSERT(m_context->fileThread());
     return m_context->fileThread();
 }
 
-static void didStart(ScriptExecutionContext*, FileStreamProxy* proxy)
+static void didStart(ScriptExecutionContext*, AsyncFileStream* proxy)
 {
     if (proxy->client())
         proxy->client()->didStart();
 }
 
-void FileStreamProxy::startOnFileThread()
+void AsyncFileStream::startOnFileThread()
 {
     if (!client())
         return;
@@ -89,132 +91,132 @@ void FileStreamProxy::startOnFileThread()
     m_context->postTask(createCallbackTask(&didStart, AllowCrossThreadAccess(this)));
 }
 
-void FileStreamProxy::stop()
+void AsyncFileStream::stop()
 {
     // Clear the client so that we won't be calling callbacks on the client.
     setClient(0);
 
     fileThread()->unscheduleTasks(m_stream.get());
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::stopOnFileThread));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::stopOnFileThread));
 }
 
-static void derefProxyOnContext(ScriptExecutionContext*, FileStreamProxy* proxy)
+static void derefProxyOnContext(ScriptExecutionContext*, AsyncFileStream* proxy)
 {
     ASSERT(proxy->hasOneRef());
     proxy->deref();
 }
 
-void FileStreamProxy::stopOnFileThread()
+void AsyncFileStream::stopOnFileThread()
 {
     m_stream->stop();
     m_context->postTask(createCallbackTask(&derefProxyOnContext, AllowCrossThreadAccess(this)));
 }
 
-static void didGetSize(ScriptExecutionContext*, FileStreamProxy* proxy, long long size)
+static void didGetSize(ScriptExecutionContext*, AsyncFileStream* proxy, long long size)
 {
     if (proxy->client())
         proxy->client()->didGetSize(size);
 }
 
-void FileStreamProxy::getSize(const String& path, double expectedModificationTime)
+void AsyncFileStream::getSize(const String& path, double expectedModificationTime)
 {
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::getSizeOnFileThread, path, expectedModificationTime));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::getSizeOnFileThread, path, expectedModificationTime));
 }
 
-void FileStreamProxy::getSizeOnFileThread(const String& path, double expectedModificationTime)
+void AsyncFileStream::getSizeOnFileThread(const String& path, double expectedModificationTime)
 {
     long long size = m_stream->getSize(path, expectedModificationTime);
     m_context->postTask(createCallbackTask(&didGetSize, AllowCrossThreadAccess(this), size));
 }
 
-static void didOpen(ScriptExecutionContext*, FileStreamProxy* proxy, bool success)
+static void didOpen(ScriptExecutionContext*, AsyncFileStream* proxy, bool success)
 {
     if (proxy->client())
         proxy->client()->didOpen(success);
 }
 
-void FileStreamProxy::openForRead(const String& path, long long offset, long long length)
+void AsyncFileStream::openForRead(const String& path, long long offset, long long length)
 {
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::openForReadOnFileThread, path, offset, length));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::openForReadOnFileThread, path, offset, length));
 }
 
-void FileStreamProxy::openForReadOnFileThread(const String& path, long long offset, long long length)
+void AsyncFileStream::openForReadOnFileThread(const String& path, long long offset, long long length)
 {
     bool success = m_stream->openForRead(path, offset, length);
     m_context->postTask(createCallbackTask(&didOpen, AllowCrossThreadAccess(this), success));
 }
 
-void FileStreamProxy::openForWrite(const String& path)
+void AsyncFileStream::openForWrite(const String& path)
 {
     fileThread()->postTask(
         createFileThreadTask(this,
-                             &FileStreamProxy::openForWriteOnFileThread, path));
+                             &AsyncFileStream::openForWriteOnFileThread, path));
 }
 
-void FileStreamProxy::openForWriteOnFileThread(const String& path)
+void AsyncFileStream::openForWriteOnFileThread(const String& path)
 {
     bool success = m_stream->openForWrite(path);
     m_context->postTask(createCallbackTask(&didOpen, AllowCrossThreadAccess(this), success));
 }
 
-void FileStreamProxy::close()
+void AsyncFileStream::close()
 {
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::closeOnFileThread));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::closeOnFileThread));
 }
 
-void FileStreamProxy::closeOnFileThread()
+void AsyncFileStream::closeOnFileThread()
 {
     m_stream->close();
 }
 
-static void didRead(ScriptExecutionContext*, FileStreamProxy* proxy, int bytesRead)
+static void didRead(ScriptExecutionContext*, AsyncFileStream* proxy, int bytesRead)
 {
     if (proxy->client())
         proxy->client()->didRead(bytesRead);
 }
 
-void FileStreamProxy::read(char* buffer, int length)
+void AsyncFileStream::read(char* buffer, int length)
 {
     fileThread()->postTask(
-        createFileThreadTask(this, &FileStreamProxy::readOnFileThread,
+        createFileThreadTask(this, &AsyncFileStream::readOnFileThread,
                              AllowCrossThreadAccess(buffer), length));
 }
 
-void FileStreamProxy::readOnFileThread(char* buffer, int length)
+void AsyncFileStream::readOnFileThread(char* buffer, int length)
 {
     int bytesRead = m_stream->read(buffer, length);
     m_context->postTask(createCallbackTask(&didRead, AllowCrossThreadAccess(this), bytesRead));
 }
 
-static void didWrite(ScriptExecutionContext*, FileStreamProxy* proxy, int bytesWritten)
+static void didWrite(ScriptExecutionContext*, AsyncFileStream* proxy, int bytesWritten)
 {
     if (proxy->client())
         proxy->client()->didWrite(bytesWritten);
 }
 
-void FileStreamProxy::write(const KURL& blobURL, long long position, int length)
+void AsyncFileStream::write(const KURL& blobURL, long long position, int length)
 {
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::writeOnFileThread, blobURL, position, length));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::writeOnFileThread, blobURL, position, length));
 }
 
-void FileStreamProxy::writeOnFileThread(const KURL& blobURL, long long position, int length)
+void AsyncFileStream::writeOnFileThread(const KURL& blobURL, long long position, int length)
 {
     int bytesWritten = m_stream->write(blobURL, position, length);
     m_context->postTask(createCallbackTask(&didWrite, AllowCrossThreadAccess(this), bytesWritten));
 }
 
-static void didTruncate(ScriptExecutionContext*, FileStreamProxy* proxy, bool success)
+static void didTruncate(ScriptExecutionContext*, AsyncFileStream* proxy, bool success)
 {
     if (proxy->client())
         proxy->client()->didTruncate(success);
 }
 
-void FileStreamProxy::truncate(long long position)
+void AsyncFileStream::truncate(long long position)
 {
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::truncateOnFileThread, position));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::truncateOnFileThread, position));
 }
 
-void FileStreamProxy::truncateOnFileThread(long long position)
+void AsyncFileStream::truncateOnFileThread(long long position)
 {
     bool success = m_stream->truncate(position);
     m_context->postTask(createCallbackTask(&didTruncate, AllowCrossThreadAccess(this), success));
@@ -222,4 +224,4 @@ void FileStreamProxy::truncateOnFileThread(long long position)
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
diff --git a/Source/WebCore/fileapi/FileStreamProxy.h b/Source/WebCore/fileapi/AsyncFileStream.h
index ce9a1054c..04be2db0c 100644
--- a/Source/WebCore/fileapi/FileStreamProxy.h
+++ b/Source/WebCore/fileapi/AsyncFileStream.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2010 Google Inc.  All rights reserved.
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,44 +29,45 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef FileStreamProxy_h
-#define FileStreamProxy_h
+#ifndef AsyncFileStream_h
+#define AsyncFileStream_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
-#include "AsyncFileStream.h"
 #include <wtf/Forward.h>
-#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
+class FileStreamClient;
 class FileStream;
 class FileThread;
 class KURL;
 class ScriptExecutionContext;
 
-// A proxy module that asynchronously calls corresponding FileStream methods on the file thread.  Note: you must call stop() first and then release the reference to destruct the FileStreamProxy instance.
-class FileStreamProxy : public AsyncFileStream {
+class AsyncFileStream : public RefCounted<AsyncFileStream> {
 public:
-    static PassRefPtr<FileStreamProxy> create(ScriptExecutionContext*, FileStreamClient*);
-    virtual ~FileStreamProxy();
-
-    virtual void getSize(const String& path, double expectedModificationTime);
-    virtual void openForRead(const String& path, long long offset, long long length);
-    virtual void openForWrite(const String& path);
-    virtual void close();
-    virtual void read(char* buffer, int length);
-    virtual void write(const KURL& blobURL, long long position, int length);
-    virtual void truncate(long long position);
-
-    // Stops the proxy and scedules it to be destructed.  All the pending tasks will be aborted and the file stream will be closed.
+    static PassRefPtr<AsyncFileStream> create(ScriptExecutionContext*, FileStreamClient*);
+    ~AsyncFileStream();
+
+    void getSize(const String& path, double expectedModificationTime);
+    void openForRead(const String& path, long long offset, long long length);
+    void openForWrite(const String& path);
+    void close();
+    void read(char* buffer, int length);
+    void write(const KURL& blobURL, long long position, int length);
+    void truncate(long long position);
+
+    // Stops the proxy and schedules it to be destructed. All the pending tasks will be aborted and the file stream will be closed.
     // Note: the caller should deref the instance immediately after calling stop().
-    virtual void stop();
+    void stop();
+
+    FileStreamClient* client() const { return m_client; }
+    void setClient(FileStreamClient* client) { m_client = client; }
 
 private:
-    FileStreamProxy(ScriptExecutionContext*, FileStreamClient*);
+    AsyncFileStream(ScriptExecutionContext*, FileStreamClient*);
 
     FileThread* fileThread();
 
@@ -83,10 +84,12 @@ private:
 
     RefPtr<ScriptExecutionContext> m_context;
     RefPtr<FileStream> m_stream;
+
+    FileStreamClient* m_client;
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
-#endif // FileStreamProxy_h
+#endif // AsyncFileStream_h
diff --git a/Source/WebCore/fileapi/DOMFileSystem.cpp b/Source/WebCore/fileapi/DOMFileSystem.cpp
index 9799e1207..b178f0c64 100644
--- a/Source/WebCore/fileapi/DOMFileSystem.cpp
+++ b/Source/WebCore/fileapi/DOMFileSystem.cpp
@@ -154,7 +154,7 @@ private:
 
 void DOMFileSystem::createFile(const FileEntry* fileEntry, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
-    m_asyncFileSystem->readMetadata(fileEntry->fullPath(), GetPathCallback::create(this, fileEntry->name(), successCallback, errorCallback));
+    m_asyncFileSystem->createSnapshotFileAndReadMetadata(fileEntry->fullPath(), GetPathCallback::create(this, fileEntry->name(), successCallback, errorCallback));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/fileapi/DOMFileSystemSync.cpp b/Source/WebCore/fileapi/DOMFileSystemSync.cpp
index e7a8ca70b..8b772bb33 100644
--- a/Source/WebCore/fileapi/DOMFileSystemSync.cpp
+++ b/Source/WebCore/fileapi/DOMFileSystemSync.cpp
@@ -72,60 +72,35 @@ PassRefPtr<DirectoryEntrySync> DOMFileSystemSync::root()
 
 namespace {
 
-class GetPathHelper : public AsyncFileSystemCallbacks {
+class CreateFileHelper : public AsyncFileSystemCallbacks {
 public:
-    class GetPathResult : public RefCounted<GetPathResult> {
+    class CreateFileResult : public RefCounted<CreateFileResult> {
       public:
-        static PassRefPtr<GetPathResult> create()
+        static PassRefPtr<CreateFileResult> create()
         {
-            return adoptRef(new GetPathResult());
+            return adoptRef(new CreateFileResult());
         }
 
         bool m_failed;
         int m_code;
-        String m_path;
+        RefPtr<File> m_file;
 
       private:
-        GetPathResult()
+        CreateFileResult()
             : m_failed(false)
             , m_code(0)
         {
         }
 
-        ~GetPathResult()
+        ~CreateFileResult()
         {
         }
-        friend class WTF::RefCounted<GetPathResult>;
+        friend class WTF::RefCounted<CreateFileResult>;
     };
 
-    static PassOwnPtr<GetPathHelper> create(PassRefPtr<GetPathResult> result)
+    static PassOwnPtr<CreateFileHelper> create(PassRefPtr<CreateFileResult> result, const String& name)
     {
-        return adoptPtr(new GetPathHelper(result));
-    }
-
-    virtual void didSucceed()
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    virtual void didOpenFileSystem(const String&, PassOwnPtr<AsyncFileSystem>)
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    virtual void didReadDirectoryEntry(const String&, bool)
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    virtual void didReadDirectoryEntries(bool)
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    virtual void didCreateFileWriter(PassOwnPtr<AsyncFileWriter>, long long)
-    {
-        ASSERT_NOT_REACHED();
+        return adoptPtr(new CreateFileHelper(result, name));
     }
 
     virtual void didFail(int code)
@@ -134,21 +109,23 @@ public:
         m_result->m_code = code;
     }
 
-    virtual ~GetPathHelper()
+    virtual ~CreateFileHelper()
     {
     }
 
     void didReadMetadata(const FileMetadata& metadata)
     {
-        m_result->m_path = metadata.platformPath;
+        m_result->m_file = File::createWithName(metadata.platformPath, m_name);
     }
 private:
-    GetPathHelper(PassRefPtr<GetPathResult> result)
+    CreateFileHelper(PassRefPtr<CreateFileResult> result, const String& name)
         : m_result(result)
+        , m_name(name)
     {
     }
 
-    RefPtr<GetPathResult> m_result;
+    RefPtr<CreateFileResult> m_result;
+    String m_name;
 };
 
 } // namespace
@@ -156,8 +133,8 @@ private:
 PassRefPtr<File> DOMFileSystemSync::createFile(const FileEntrySync* fileEntry, ExceptionCode& ec)
 {
     ec = 0;
-    RefPtr<GetPathHelper::GetPathResult> result(GetPathHelper::GetPathResult::create());
-    m_asyncFileSystem->readMetadata(fileEntry->fullPath(), GetPathHelper::create(result));
+    RefPtr<CreateFileHelper::CreateFileResult> result(CreateFileHelper::CreateFileResult::create());
+    m_asyncFileSystem->createSnapshotFileAndReadMetadata(fileEntry->fullPath(), CreateFileHelper::create(result, fileEntry->name()));
     if (!m_asyncFileSystem->waitForOperationToComplete()) {
         ec = FileException::ABORT_ERR;
         return 0;
@@ -166,8 +143,7 @@ PassRefPtr<File> DOMFileSystemSync::createFile(const FileEntrySync* fileEntry, E
         ec = result->m_code;
         return 0;
     }
-    ASSERT(!result->m_path.isEmpty());
-    return File::createWithName(result->m_path, fileEntry->name());
+    return result->m_file;
 }
 
 namespace {
diff --git a/Source/WebCore/fileapi/DOMWindowFileSystem.idl b/Source/WebCore/fileapi/DOMWindowFileSystem.idl
index 79947cbd7..b6ef51319 100644
--- a/Source/WebCore/fileapi/DOMWindowFileSystem.idl
+++ b/Source/WebCore/fileapi/DOMWindowFileSystem.idl
@@ -1,20 +1,27 @@
 /*
- * Copyright (C) 2012 Google Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 module window {
diff --git a/Source/WebCore/fileapi/FileError.h b/Source/WebCore/fileapi/FileError.h
index 0597633e7..7678a5154 100644
--- a/Source/WebCore/fileapi/FileError.h
+++ b/Source/WebCore/fileapi/FileError.h
@@ -31,7 +31,7 @@
 #ifndef FileError_h
 #define FileError_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -70,6 +70,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // FileError_h
diff --git a/Source/WebCore/fileapi/FileException.cpp b/Source/WebCore/fileapi/FileException.cpp
index 7e62ff355..5007f1cd5 100644
--- a/Source/WebCore/fileapi/FileException.cpp
+++ b/Source/WebCore/fileapi/FileException.cpp
@@ -28,7 +28,7 @@
 
 #include "config.h"
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "FileException.h"
 
@@ -87,4 +87,4 @@ bool FileException::initializeDescription(ExceptionCode ec, ExceptionCodeDescrip
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
diff --git a/Source/WebCore/fileapi/FileException.h b/Source/WebCore/fileapi/FileException.h
index 38f1ed4ae..ccf7982df 100644
--- a/Source/WebCore/fileapi/FileException.h
+++ b/Source/WebCore/fileapi/FileException.h
@@ -31,7 +31,7 @@
 #ifndef FileException_h
 #define FileException_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "ExceptionBase.h"
 
@@ -80,6 +80,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // FileException_h
diff --git a/Source/WebCore/fileapi/FileSystemCallbacks.cpp b/Source/WebCore/fileapi/FileSystemCallbacks.cpp
index 06f3b9383..1e9a99d24 100644
--- a/Source/WebCore/fileapi/FileSystemCallbacks.cpp
+++ b/Source/WebCore/fileapi/FileSystemCallbacks.cpp
@@ -65,42 +65,6 @@ FileSystemCallbacksBase::~FileSystemCallbacksBase()
 {
 }
 
-void FileSystemCallbacksBase::didSucceed()
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
-void FileSystemCallbacksBase::didOpenFileSystem(const String&, PassOwnPtr<AsyncFileSystem>)
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
-void FileSystemCallbacksBase::didReadMetadata(const FileMetadata&)
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
-void FileSystemCallbacksBase::didReadDirectoryEntries(bool)
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
-void FileSystemCallbacksBase::didReadDirectoryEntry(const String&, bool)
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
-void FileSystemCallbacksBase::didCreateFileWriter(PassOwnPtr<AsyncFileWriter>, long long)
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
 void FileSystemCallbacksBase::didFail(int code)
 {
     if (m_errorCallback) {
@@ -268,7 +232,7 @@ MetadataCallbacks::MetadataCallbacks(PassRefPtr<MetadataCallback> successCallbac
 void MetadataCallbacks::didReadMetadata(const FileMetadata& metadata)
 {
     if (m_successCallback)
-        m_successCallback->handleEvent(Metadata::create(metadata.modificationTime).get());
+        m_successCallback->handleEvent(Metadata::create(metadata).get());
     m_successCallback.clear();
 }
 
diff --git a/Source/WebCore/fileapi/FileSystemCallbacks.h b/Source/WebCore/fileapi/FileSystemCallbacks.h
index 7f68625ac..e02deb9f0 100644
--- a/Source/WebCore/fileapi/FileSystemCallbacks.h
+++ b/Source/WebCore/fileapi/FileSystemCallbacks.h
@@ -59,25 +59,11 @@ class FileSystemCallbacksBase : public AsyncFileSystemCallbacks {
 public:
     virtual ~FileSystemCallbacksBase();
 
-    // For EntryCallbacks and VoidCallbacks.
-    virtual void didSucceed();
-
-    // For FileSystemCallbacks.
-    virtual void didOpenFileSystem(const String& name, PassOwnPtr<AsyncFileSystem>);
-
-    // For MetadataCallbacks.
-    virtual void didReadMetadata(const FileMetadata&);
-
-    // For EntriesCallbacks. didReadDirectoryEntry is called each time the API reads an entry, and didReadDirectoryDone is called when a chunk of entries have been read (i.e. good time to call back to the application).  If hasMore is true there can be more chunks.
-    virtual void didReadDirectoryEntry(const String& name, bool isDirectory);
-    virtual void didReadDirectoryEntries(bool hasMore);
-
-    // For createFileWriter.
-    virtual void didCreateFileWriter(PassOwnPtr<AsyncFileWriter>, long long length);
-
     // For ErrorCallback.
     virtual void didFail(int code);
 
+    // Other callback methods are implemented by each subclass.
+
 protected:
     FileSystemCallbacksBase(PassRefPtr<ErrorCallback> errorCallback);
     RefPtr<ErrorCallback> m_errorCallback;
diff --git a/Source/WebCore/fileapi/FileThread.cpp b/Source/WebCore/fileapi/FileThread.cpp
index 82bc686f6..4f4f473fd 100644
--- a/Source/WebCore/fileapi/FileThread.cpp
+++ b/Source/WebCore/fileapi/FileThread.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "FileThread.h"
 
@@ -114,4 +114,4 @@ void FileThread::runLoop()
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
diff --git a/Source/WebCore/fileapi/FileThread.h b/Source/WebCore/fileapi/FileThread.h
index 6c3255b57..d4e24bca3 100644
--- a/Source/WebCore/fileapi/FileThread.h
+++ b/Source/WebCore/fileapi/FileThread.h
@@ -31,7 +31,7 @@
 #ifndef FileThread_h
 #define FileThread_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include <wtf/MessageQueue.h>
 #include <wtf/PassOwnPtr.h>
@@ -84,6 +84,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // FileThread_h
diff --git a/Source/WebCore/fileapi/Metadata.h b/Source/WebCore/fileapi/Metadata.h
index b70806b09..7d1253a12 100644
--- a/Source/WebCore/fileapi/Metadata.h
+++ b/Source/WebCore/fileapi/Metadata.h
@@ -33,32 +33,34 @@
 
 #if ENABLE(FILE_SYSTEM)
 
+#include "FileMetadata.h"
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
 class Metadata : public RefCounted<Metadata> {
 public:
-    static PassRefPtr<Metadata> create(double modificationTime)
+    static PassRefPtr<Metadata> create(const FileMetadata& platformMetadata)
     {
-        return adoptRef(new Metadata(modificationTime));
+        return adoptRef(new Metadata(platformMetadata));
     }
 
     static PassRefPtr<Metadata> create(Metadata* metadata)
     {
-        return adoptRef(new Metadata(metadata->m_modificationTime));
+        return adoptRef(new Metadata(metadata->m_platformMetadata));
     }
 
-    // Needs to return epoch time in milliseconds for Date.
-    double modificationTime() const { return m_modificationTime * 1000.0; }
+    // Needs to return epoch time in milliseconds for Date while FileMetadata's modificationTime is in seconds.
+    double modificationTime() const { return m_platformMetadata.modificationTime * 1000.0; }
+    unsigned long long size() const { return static_cast<unsigned long long>(m_platformMetadata.length); }
 
 private:
-    Metadata(double modificationTime)
-        : m_modificationTime(modificationTime)
+    Metadata(const FileMetadata& platformMetadata)
+        : m_platformMetadata(platformMetadata)
     {
     }
 
-    double m_modificationTime;
+    FileMetadata m_platformMetadata;
 };
 
 } // namespace
diff --git a/Source/WebCore/fileapi/Metadata.idl b/Source/WebCore/fileapi/Metadata.idl
index ad477f771..ceaf21b5a 100644
--- a/Source/WebCore/fileapi/Metadata.idl
+++ b/Source/WebCore/fileapi/Metadata.idl
@@ -34,5 +34,6 @@ module storage {
         JSNoStaticTables
     ] Metadata {
         readonly attribute Date modificationTime;
+        readonly attribute unsigned long long size;
     };
 }
diff --git a/Source/WebCore/fileapi/OperationNotAllowedException.cpp b/Source/WebCore/fileapi/OperationNotAllowedException.cpp
index e97cfa035..2c9bc8e11 100644
--- a/Source/WebCore/fileapi/OperationNotAllowedException.cpp
+++ b/Source/WebCore/fileapi/OperationNotAllowedException.cpp
@@ -28,7 +28,7 @@
 
 #include "config.h"
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "OperationNotAllowedException.h"
 
@@ -65,4 +65,4 @@ bool OperationNotAllowedException::initializeDescription(ExceptionCode ec, Excep
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
diff --git a/Source/WebCore/fileapi/OperationNotAllowedException.h b/Source/WebCore/fileapi/OperationNotAllowedException.h
index c3e95595e..5a0e9a1c5 100644
--- a/Source/WebCore/fileapi/OperationNotAllowedException.h
+++ b/Source/WebCore/fileapi/OperationNotAllowedException.h
@@ -31,7 +31,7 @@
 #ifndef OperationNotAllowedException_h
 #define OperationNotAllowedException_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "ExceptionBase.h"
 
@@ -62,6 +62,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // OperationNotAllowedException_h
diff --git a/Source/WebCore/fileapi/WorkerContextFileSystem.cpp b/Source/WebCore/fileapi/WorkerContextFileSystem.cpp
new file mode 100644
index 000000000..9651ef427
--- /dev/null
+++ b/Source/WebCore/fileapi/WorkerContextFileSystem.cpp
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "WorkerContextFileSystem.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystem.h"
+#include "DOMFileSystem.h"
+#include "DOMFileSystemBase.h"
+#include "DOMFileSystemSync.h"
+#include "DirectoryEntrySync.h"
+#include "ErrorCallback.h"
+#include "FileEntrySync.h"
+#include "FileError.h"
+#include "FileException.h"
+#include "FileSystemCallback.h"
+#include "FileSystemCallbacks.h"
+#include "LocalFileSystem.h"
+#include "SecurityOrigin.h"
+#include "SyncCallbackHelper.h"
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+void WorkerContextFileSystem::webkitRequestFileSystem(WorkerContext* worker, int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    ScriptExecutionContext* secureContext = worker->scriptExecutionContext();
+    if (!AsyncFileSystem::isAvailable() || !secureContext->securityOrigin()->canAccessFileSystem()) {
+        DOMFileSystem::scheduleCallback(worker, errorCallback, FileError::create(FileError::SECURITY_ERR));
+        return;
+    }
+
+    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
+    if (!AsyncFileSystem::isValidType(fileSystemType)) {
+        DOMFileSystem::scheduleCallback(worker, errorCallback, FileError::create(FileError::INVALID_MODIFICATION_ERR));
+        return;
+    }
+
+    LocalFileSystem::localFileSystem().requestFileSystem(worker, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, worker), false);
+}
+
+PassRefPtr<DOMFileSystemSync> WorkerContextFileSystem::webkitRequestFileSystemSync(WorkerContext* worker, int type, long long size, ExceptionCode& ec)
+{
+    ec = 0;
+    ScriptExecutionContext* secureContext = worker->scriptExecutionContext();
+    if (!AsyncFileSystem::isAvailable() || !secureContext->securityOrigin()->canAccessFileSystem()) {
+        ec = FileException::SECURITY_ERR;
+        return 0;
+    }
+
+    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
+    if (!AsyncFileSystem::isValidType(fileSystemType)) {
+        ec = FileException::INVALID_MODIFICATION_ERR;
+        return 0;
+    }
+
+    FileSystemSyncCallbackHelper helper;
+    LocalFileSystem::localFileSystem().requestFileSystem(worker, fileSystemType, size, FileSystemCallbacks::create(helper.successCallback(), helper.errorCallback(), worker), true);
+    return helper.getResult(ec);
+}
+
+void WorkerContextFileSystem::webkitResolveLocalFileSystemURL(WorkerContext* worker, const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    KURL completedURL = worker->completeURL(url);
+    ScriptExecutionContext* secureContext = worker->scriptExecutionContext();
+    if (!AsyncFileSystem::isAvailable() || !secureContext->securityOrigin()->canAccessFileSystem() || !secureContext->securityOrigin()->canRequest(completedURL)) {
+        DOMFileSystem::scheduleCallback(worker, errorCallback, FileError::create(FileError::SECURITY_ERR));
+        return;
+    }
+
+    AsyncFileSystem::Type type;
+    String filePath;
+    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
+        DOMFileSystem::scheduleCallback(worker, errorCallback, FileError::create(FileError::ENCODING_ERR));
+        return;
+    }
+
+    LocalFileSystem::localFileSystem().readFileSystem(worker, type, ResolveURICallbacks::create(successCallback, errorCallback, worker, filePath));
+}
+
+PassRefPtr<EntrySync> WorkerContextFileSystem::webkitResolveLocalFileSystemSyncURL(WorkerContext* worker, const String& url, ExceptionCode& ec)
+{
+    ec = 0;
+    KURL completedURL = worker->completeURL(url);
+    ScriptExecutionContext* secureContext = worker->scriptExecutionContext();
+    if (!AsyncFileSystem::isAvailable() || !secureContext->securityOrigin()->canAccessFileSystem() || !secureContext->securityOrigin()->canRequest(completedURL)) {
+        ec = FileException::SECURITY_ERR;
+        return 0;
+    }
+
+    AsyncFileSystem::Type type;
+    String filePath;
+    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
+        ec = FileException::ENCODING_ERR;
+        return 0;
+    }
+
+    FileSystemSyncCallbackHelper readFileSystemHelper;
+    LocalFileSystem::localFileSystem().readFileSystem(worker, type, FileSystemCallbacks::create(readFileSystemHelper.successCallback(), readFileSystemHelper.errorCallback(), worker), true);
+    RefPtr<DOMFileSystemSync> fileSystem = readFileSystemHelper.getResult(ec);
+    if (!fileSystem)
+        return 0;
+
+    RefPtr<EntrySync> entry = fileSystem->root()->getDirectory(filePath, 0, ec);
+    if (ec == FileException::TYPE_MISMATCH_ERR)
+        return fileSystem->root()->getFile(filePath, 0, ec);
+
+    return entry.release();
+}
+
+COMPILE_ASSERT(static_cast<int>(WorkerContextFileSystem::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
+COMPILE_ASSERT(static_cast<int>(WorkerContextFileSystem::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/Source/WebCore/fileapi/WorkerContextFileSystem.h b/Source/WebCore/fileapi/WorkerContextFileSystem.h
new file mode 100644
index 000000000..c500f5e2e
--- /dev/null
+++ b/Source/WebCore/fileapi/WorkerContextFileSystem.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef WorkerContextFileSystem_h
+#define WorkerContextFileSystem_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DOMFileSystemSync.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class EntryCallback;
+class EntrySync;
+class ErrorCallback;
+class FileSystemCallback;
+class WorkerContext;
+
+class WorkerContextFileSystem {
+public:
+    enum FileSystemType {
+        TEMPORARY,
+        PERSISTENT,
+    };
+
+    static void webkitRequestFileSystem(WorkerContext*, int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback>);
+    static PassRefPtr<DOMFileSystemSync> webkitRequestFileSystemSync(WorkerContext*, int type, long long size, ExceptionCode&);
+    static void webkitResolveLocalFileSystemURL(WorkerContext*, const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback>);
+    static PassRefPtr<EntrySync> webkitResolveLocalFileSystemSyncURL(WorkerContext*, const String& url, ExceptionCode&);
+
+private:
+    WorkerContextFileSystem();
+    ~WorkerContextFileSystem();    
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // WorkerContextFileSystem_h
diff --git a/Source/WebCore/fileapi/WorkerContextFileSystem.idl b/Source/WebCore/fileapi/WorkerContextFileSystem.idl
new file mode 100644
index 000000000..cb9c32849
--- /dev/null
+++ b/Source/WebCore/fileapi/WorkerContextFileSystem.idl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module threads {
+
+    interface [
+        Conditional=FILE_SYSTEM,
+        Supplemental=WorkerContext
+    ] WorkerContextFileSystem {
+        const unsigned short TEMPORARY = 0;
+        const unsigned short PERSISTENT = 1;
+
+        [V8EnabledAtRuntime=FileSystem] void webkitRequestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [V8EnabledAtRuntime=FileSystem] DOMFileSystemSync webkitRequestFileSystemSync(in unsigned short type, in long long size) raises (FileException);
+        [V8EnabledAtRuntime=FileSystem] void webkitResolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [V8EnabledAtRuntime=FileSystem] EntrySync webkitResolveLocalFileSystemSyncURL(in DOMString url) raises (FileException);
+
+        attribute [V8EnabledAtRuntime=FileSystem] FileErrorConstructor FileError;
+        attribute [V8EnabledAtRuntime=FileSystem] FileExceptionConstructor FileException;
+    };
+
+}
diff --git a/Source/WebCore/history/PageCache.cpp b/Source/WebCore/history/PageCache.cpp
index a0d5de4d9..9f1773cef 100644
--- a/Source/WebCore/history/PageCache.cpp
+++ b/Source/WebCore/history/PageCache.cpp
@@ -31,6 +31,7 @@
 #include "MemoryCache.h"
 #include "CachedPage.h"
 #include "DOMWindow.h"
+#include "DatabaseContext.h"
 #include "DeviceMotionController.h"
 #include "DeviceOrientationController.h"
 #include "Document.h"
@@ -39,6 +40,7 @@
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "FrameLoaderStateMachine.h"
+#include "HistogramSupport.h"
 #include "HistoryItem.h"
 #include "Logging.h"
 #include "Page.h"
@@ -55,32 +57,36 @@ namespace WebCore {
 
 static const double autoreleaseInterval = 3;
 
-#ifndef NDEBUG
+#if PLATFORM(CHROMIUM) || !defined(NDEBUG)
 
-static String& pageCacheLogPrefix(int indentLevel)
-{
-    static int previousIndent = -1;
-    DEFINE_STATIC_LOCAL(String, prefix, ());
-    
-    if (indentLevel != previousIndent) {    
-        previousIndent = indentLevel;
-        prefix.truncate(0);
-        for (int i = 0; i < previousIndent; ++i)
-            prefix += "    ";
-    }
+#define PCLOG(...) LOG(PageCache, "%*s%s", indentLevel*4, "", makeString(__VA_ARGS__).utf8().data())
     
-    return prefix;
-}
-
-static void pageCacheLog(const String& prefix, const String& message)
-{
-    LOG(PageCache, "%s%s", prefix.utf8().data(), message.utf8().data());
-}
-    
-#define PCLOG(...) pageCacheLog(pageCacheLogPrefix(indentLevel), makeString(__VA_ARGS__))
-    
-static bool logCanCacheFrameDecision(Frame* frame, int indentLevel)
+// Used in histograms, please only add at the end, and do not remove elements (renaming e.g. to "FooEnumUnused1" is fine).
+// This is because statistics may be gathered from histograms between versions over time, and re-using values causes collisions.
+enum ReasonFrameCannotBeInPageCache {
+    NoDocumentLoader = 0,
+    MainDocumentError,
+    IsErrorPage,
+    HasPlugins,
+    IsHttpsAndCacheControlled,
+    HasUnloadListener,
+    HasDatabaseHandles,
+    HasSharedWorkers,
+    NoHistoryItem,
+    QuickRedirectComing,
+    IsLoadingInAPISense,
+    IsStopping,
+    CanSuspendActiveDOMObjects,
+    DocumentLoaderUsesApplicationCache,
+    ClientDeniesCaching,
+    NumberOfReasonsFramesCannotBeInPageCache,
+};
+
+static unsigned logCanCacheFrameDecision(Frame* frame, int indentLevel)
 {
+#ifdef NDEBUG
+    UNUSED_PARAM(indentLevel);
+#endif
     // Only bother logging for frames that have actually loaded and have content.
     if (frame->loader()->stateMachine()->creatingInitialEmptyDocument())
         return false;
@@ -94,87 +100,110 @@ static bool logCanCacheFrameDecision(Frame* frame, int indentLevel)
         PCLOG(" Determining if frame can be cached navigating from (", currentURL.string(), ") to (", newURL.string(), "):");
     else
         PCLOG(" Determining if subframe with URL (", currentURL.string(), ") can be cached:");
+     
+    unsigned rejectReasons = 0;
     
-    bool cannotCache = false;
-    
-    do {
-        if (!frame->loader()->documentLoader()) {
-            PCLOG("   -There is no DocumentLoader object");
-            cannotCache = true;
-            break;
-        }
+    if (!frame->loader()->documentLoader()) {
+        PCLOG("   -There is no DocumentLoader object");
+        rejectReasons |= 1 << NoDocumentLoader;
+    } else {
         if (!frame->loader()->documentLoader()->mainDocumentError().isNull()) {
             PCLOG("   -Main document has an error");
-            cannotCache = true;
+            rejectReasons |= 1 << MainDocumentError;
+        }
+        if (frame->loader()->documentLoader()->substituteData().isValid() && frame->loader()->documentLoader()->substituteData().failingURL().isEmpty()) {
+            PCLOG("   -Frame is an error page");
+            rejectReasons |= 1 << IsErrorPage;
         }
         if (frame->loader()->subframeLoader()->containsPlugins() && !frame->page()->settings()->pageCacheSupportsPlugins()) {
             PCLOG("   -Frame contains plugins");
-            cannotCache = true;
+            rejectReasons |= 1 << HasPlugins;
         }
-        if (frame->document()->url().protocolIs("https")) {
-            PCLOG("   -Frame is HTTPS");
-            cannotCache = true;
+        if (frame->document()->url().protocolIs("https")
+            && (frame->loader()->documentLoader()->response().cacheControlContainsNoCache()
+                || frame->loader()->documentLoader()->response().cacheControlContainsNoStore())) {
+            PCLOG("   -Frame is HTTPS, and cache control prohibits caching or storing");
+            rejectReasons |= 1 << IsHttpsAndCacheControlled;
         }
         if (frame->domWindow() && frame->domWindow()->hasEventListeners(eventNames().unloadEvent)) {
             PCLOG("   -Frame has an unload event listener");
-            cannotCache = true;
+            rejectReasons |= 1 << HasUnloadListener;
         }
 #if ENABLE(SQL_DATABASE)
-        if (frame->document()->hasOpenDatabases()) {
+        if (DatabaseContext::hasOpenDatabases(frame->document())) {
             PCLOG("   -Frame has open database handles");
-            cannotCache = true;
+            rejectReasons |= 1 << HasDatabaseHandles;
         }
 #endif
 #if ENABLE(SHARED_WORKERS)
         if (SharedWorkerRepository::hasSharedWorkers(frame->document())) {
             PCLOG("   -Frame has associated SharedWorkers");
-            cannotCache = true;
+            rejectReasons |= 1 << HasSharedWorkers;
         }
 #endif
-        if (frame->document()->usingGeolocation()) {
-            PCLOG("   -Frame uses Geolocation");
-            cannotCache = true;
-        }
         if (!frame->loader()->history()->currentItem()) {
             PCLOG("   -No current history item");
-            cannotCache = true;
+            rejectReasons |= 1 << NoHistoryItem;
         }
         if (frame->loader()->quickRedirectComing()) {
             PCLOG("   -Quick redirect is coming");
-            cannotCache = true;
+            rejectReasons |= 1 << QuickRedirectComing;
         }
         if (frame->loader()->documentLoader()->isLoadingInAPISense()) {
             PCLOG("   -DocumentLoader is still loading in API sense");
-            cannotCache = true;
+            rejectReasons |= 1 << IsLoadingInAPISense;
         }
         if (frame->loader()->documentLoader()->isStopping()) {
             PCLOG("   -DocumentLoader is in the middle of stopping");
-            cannotCache = true;
+            rejectReasons |= 1 << IsStopping;
         }
         if (!frame->document()->canSuspendActiveDOMObjects()) {
             PCLOG("   -The document cannot suspect its active DOM Objects");
-            cannotCache = true;
+            rejectReasons |= 1 << CanSuspendActiveDOMObjects;
         }
         if (!frame->loader()->documentLoader()->applicationCacheHost()->canCacheInPageCache()) {
             PCLOG("   -The DocumentLoader uses an application cache");
-            cannotCache = true;
+            rejectReasons |= 1 << DocumentLoaderUsesApplicationCache;
         }
         if (!frame->loader()->client()->canCachePage()) {
             PCLOG("   -The client says this frame cannot be cached");
-            cannotCache = true; 
+            rejectReasons |= 1 << ClientDeniesCaching;
         }
-    } while (false);
-    
+    }
+
+    HistogramSupport::histogramEnumeration("PageCache.FrameCacheable", !rejectReasons, 2);
+    int reasonCount = 0;
+    for (int i = 0; i < NumberOfReasonsFramesCannotBeInPageCache; ++i) {
+        if (rejectReasons & (1 << i)) {
+            ++reasonCount;
+            HistogramSupport::histogramEnumeration("PageCache.FrameRejectReason", i, NumberOfReasonsFramesCannotBeInPageCache);
+        }
+    }
+    HistogramSupport::histogramEnumeration("PageCache.FrameRejectReasonCount", reasonCount, 1 + NumberOfReasonsFramesCannotBeInPageCache);
+
     for (Frame* child = frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        if (!logCanCacheFrameDecision(child, indentLevel + 1))
-            cannotCache = true;
+        rejectReasons |= logCanCacheFrameDecision(child, indentLevel + 1);
     
-    PCLOG(cannotCache ? " Frame CANNOT be cached" : " Frame CAN be cached");
+    PCLOG(rejectReasons ? " Frame CANNOT be cached" : " Frame CAN be cached");
     PCLOG("+---");
     
-    return !cannotCache;
+    return rejectReasons;
 }
-    
+
+// Used in histograms, please only add at the end, and do not remove elements (renaming e.g. to "FooEnumUnused1" is fine).
+// This is because statistics may be gathered from histograms between versions over time, and re-using values causes collisions.
+enum ReasonPageCannotBeInPageCache {
+    FrameCannotBeInPageCache = 0,
+    DisabledBackForwardList,
+    DisabledPageCache,
+    UsesDeviceMotion,
+    UsesDeviceOrientation,
+    IsReload,
+    IsReloadFromOrigin,
+    IsSameLoad,
+    NumberOfReasonsPagesCannotBeInPageCache,
+};
+
 static void logCanCachePageDecision(Page* page)
 {
     // Only bother logging for main frames that have actually loaded and have content.
@@ -187,41 +216,66 @@ static void logCanCachePageDecision(Page* page)
     int indentLevel = 0;    
     PCLOG("--------\n Determining if page can be cached:");
     
-    bool cannotCache = !logCanCacheFrameDecision(page->mainFrame(), 1);
+    unsigned rejectReasons = 0;
+    unsigned frameRejectReasons = logCanCacheFrameDecision(page->mainFrame(), indentLevel+1);
+    if (frameRejectReasons)
+        rejectReasons |= 1 << FrameCannotBeInPageCache;
     
-    FrameLoadType loadType = page->mainFrame()->loader()->loadType();
     if (!page->backForward()->isActive()) {
         PCLOG("   -The back/forward list is disabled or has 0 capacity");
-        cannotCache = true;
+        rejectReasons |= 1 << DisabledBackForwardList;
     }
     if (!page->settings()->usesPageCache()) {
         PCLOG("   -Page settings says b/f cache disabled");
-        cannotCache = true;
+        rejectReasons |= 1 << DisabledPageCache;
     }
 #if ENABLE(DEVICE_ORIENTATION)
     if (DeviceMotionController::isActiveAt(page)) {
         PCLOG("   -Page is using DeviceMotion");
-        cannotCache = true;
+        rejectReasons |= 1 << UsesDeviceMotion;
     }
     if (DeviceOrientationController::isActiveAt(page)) {
         PCLOG("   -Page is using DeviceOrientation");
-        cannotCache = true;
+        rejectReasons |= 1 << UsesDeviceOrientation;
     }
 #endif
+    FrameLoadType loadType = page->mainFrame()->loader()->loadType();
     if (loadType == FrameLoadTypeReload) {
         PCLOG("   -Load type is: Reload");
-        cannotCache = true;
+        rejectReasons |= 1 << IsReload;
     }
     if (loadType == FrameLoadTypeReloadFromOrigin) {
         PCLOG("   -Load type is: Reload from origin");
-        cannotCache = true;
+        rejectReasons |= 1 << IsReloadFromOrigin;
     }
     if (loadType == FrameLoadTypeSame) {
         PCLOG("   -Load type is: Same");
-        cannotCache = true;
+        rejectReasons |= 1 << IsSameLoad;
     }
     
-    PCLOG(cannotCache ? " Page CANNOT be cached\n--------" : " Page CAN be cached\n--------");
+    PCLOG(rejectReasons ? " Page CANNOT be cached\n--------" : " Page CAN be cached\n--------");
+
+    HistogramSupport::histogramEnumeration("PageCache.PageCacheable", !rejectReasons, 2);
+    int reasonCount = 0;
+    for (int i = 0; i < NumberOfReasonsPagesCannotBeInPageCache; ++i) {
+        if (rejectReasons & (1 << i)) {
+            ++reasonCount;
+            HistogramSupport::histogramEnumeration("PageCache.PageRejectReason", i, NumberOfReasonsPagesCannotBeInPageCache);
+        }
+    }
+    HistogramSupport::histogramEnumeration("PageCache.PageRejectReasonCount", reasonCount, 1 + NumberOfReasonsPagesCannotBeInPageCache);
+
+    // Report also on the frame reasons by page; this is distinct from the per frame statistics since it coalesces the
+    // causes from all subframes together.
+    HistogramSupport::histogramEnumeration("PageCache.FrameCacheableByPage", !frameRejectReasons, 2);
+    int frameReasonCount = 0;
+    for (int i = 0; i <= NumberOfReasonsFramesCannotBeInPageCache; ++i) {
+        if (frameRejectReasons & (1 << i)) {
+            ++frameReasonCount;
+            HistogramSupport::histogramEnumeration("PageCache.FrameRejectReasonByPage", i, NumberOfReasonsFramesCannotBeInPageCache);
+        }
+    }
+    HistogramSupport::histogramEnumeration("PageCache.FrameRejectReasonCountByPage", frameReasonCount, 1 + NumberOfReasonsFramesCannotBeInPageCache);
 }
 
 #endif 
@@ -263,12 +317,11 @@ bool PageCache::canCachePageContainingThisFrame(Frame* frame)
         && (!document->url().protocolIs("https") || (!documentLoader->response().cacheControlContainsNoCache() && !documentLoader->response().cacheControlContainsNoStore()))
         && (!frame->domWindow() || !frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
 #if ENABLE(SQL_DATABASE)
-        && !document->hasOpenDatabases()
+        && !DatabaseContext::hasOpenDatabases(document)
 #endif
 #if ENABLE(SHARED_WORKERS)
         && !SharedWorkerRepository::hasSharedWorkers(document)
 #endif
-        && !document->usingGeolocation()
         && frameLoader->history()->currentItem()
         && !frameLoader->quickRedirectComing()
         && !documentLoader->isLoadingInAPISense()
@@ -285,7 +338,7 @@ bool PageCache::canCache(Page* page)
     if (!page)
         return false;
     
-#ifndef NDEBUG
+#if PLATFORM(CHROMIUM) || !defined(NDEBUG)
     logCanCachePageDecision(page);
 #endif
     
diff --git a/Source/WebCore/html/BaseButtonInputType.cpp b/Source/WebCore/html/BaseButtonInputType.cpp
index 9a1616fce..f7115019e 100644
--- a/Source/WebCore/html/BaseButtonInputType.cpp
+++ b/Source/WebCore/html/BaseButtonInputType.cpp
@@ -47,54 +47,11 @@ bool BaseButtonInputType::appendFormData(FormDataList&, bool) const
     return false;
 }
 
-void BaseButtonInputType::handleKeydownEvent(KeyboardEvent* event)
-{
-    const String& key = event->keyIdentifier();
-    if (key == "U+0020") {
-        element()->setActive(true, true);
-        // No setDefaultHandled(), because IE dispatches a keypress in this case
-        // and the caller will only dispatch a keypress if we don't call setDefaultHandled().
-    }
-}
-
-void BaseButtonInputType::handleKeypressEvent(KeyboardEvent* event)
-{
-    int charCode = event->charCode();
-    if (charCode == '\r') {
-        element()->dispatchSimulatedClick(event);
-        event->setDefaultHandled();
-        return;
-    }
-    if (charCode == ' ') {
-        // Prevent scrolling down the page.
-        event->setDefaultHandled();
-    }
-}
-
-void BaseButtonInputType::handleKeyupEvent(KeyboardEvent* event)
-{
-    const String& key = event->keyIdentifier();
-    if (key != "U+0020")
-        return;
-    // Simulate mouse click for spacebar for button types.
-    dispatchSimulatedClickIfActive(event);
-}
-
 RenderObject* BaseButtonInputType::createRenderer(RenderArena* arena, RenderStyle*) const
 {
     return new (arena) RenderButton(element());
 }
 
-// FIXME: Could share this with BaseCheckableInputType and RangeInputType if we had a common base class.
-void BaseButtonInputType::accessKeyAction(bool sendMouseEvents)
-{
-    InputType::accessKeyAction(sendMouseEvents);
-
-    // Send mouse button events if the caller specified sendMouseEvents.
-    // FIXME: The comment above is no good. It says what we do, but not why.
-    element()->dispatchSimulatedClick(0, sendMouseEvents);
-}
-
 bool BaseButtonInputType::storesValueSeparateFromAttribute()
 {
     return false;
diff --git a/Source/WebCore/html/BaseButtonInputType.h b/Source/WebCore/html/BaseButtonInputType.h
index 1b7543c05..cbd852fc9 100644
--- a/Source/WebCore/html/BaseButtonInputType.h
+++ b/Source/WebCore/html/BaseButtonInputType.h
@@ -31,22 +31,18 @@
 #ifndef BaseButtonInputType_h
 #define BaseButtonInputType_h
 
-#include "InputType.h"
+#include "BaseClickableWithKeyInputType.h"
 
 namespace WebCore {
 
 // Base of button, file, image, reset, and submit types.
-class BaseButtonInputType : public InputType {
+class BaseButtonInputType : public BaseClickableWithKeyInputType {
 protected:
-    BaseButtonInputType(HTMLInputElement* element) : InputType(element) { }
+    BaseButtonInputType(HTMLInputElement* element) : BaseClickableWithKeyInputType(element) { }
 
 private:
     virtual bool appendFormData(FormDataList&, bool) const OVERRIDE;
-    virtual void handleKeydownEvent(KeyboardEvent*) OVERRIDE;
-    virtual void handleKeypressEvent(KeyboardEvent*) OVERRIDE;
-    virtual void handleKeyupEvent(KeyboardEvent*) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
-    virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
     virtual void setValue(const String&, bool, TextFieldEventBehavior) OVERRIDE;
 };
diff --git a/Source/WebCore/html/BaseCheckableInputType.cpp b/Source/WebCore/html/BaseCheckableInputType.cpp
index ff28dae36..f578acbe7 100644
--- a/Source/WebCore/html/BaseCheckableInputType.cpp
+++ b/Source/WebCore/html/BaseCheckableInputType.cpp
@@ -48,7 +48,7 @@ bool BaseCheckableInputType::saveFormControlState(String& result) const
     return true;
 }
 
-void BaseCheckableInputType::restoreFormControlState(const String& state) const
+void BaseCheckableInputType::restoreFormControlState(const String& state)
 {
     element()->setChecked(state == "on");
 }
@@ -84,7 +84,7 @@ bool BaseCheckableInputType::canSetStringValue() const
     return false;
 }
 
-// FIXME: Could share this with BaseButtonInputType and RangeInputType if we had a common base class.
+// FIXME: Could share this with BaseClickableWithKeyInputType and RangeInputType if we had a common base class.
 void BaseCheckableInputType::accessKeyAction(bool sendMouseEvents)
 {
     InputType::accessKeyAction(sendMouseEvents);
diff --git a/Source/WebCore/html/BaseCheckableInputType.h b/Source/WebCore/html/BaseCheckableInputType.h
index 4211ad521..860d6fd90 100644
--- a/Source/WebCore/html/BaseCheckableInputType.h
+++ b/Source/WebCore/html/BaseCheckableInputType.h
@@ -43,7 +43,7 @@ protected:
 
 private:
     virtual bool saveFormControlState(String&) const OVERRIDE;
-    virtual void restoreFormControlState(const String&) const OVERRIDE;
+    virtual void restoreFormControlState(const String&) OVERRIDE;
     virtual bool appendFormData(FormDataList&, bool) const OVERRIDE;
     virtual void handleKeypressEvent(KeyboardEvent*) OVERRIDE;
     virtual bool canSetStringValue() const OVERRIDE;
diff --git a/Source/WebCore/html/BaseClickableWithKeyInputType.cpp b/Source/WebCore/html/BaseClickableWithKeyInputType.cpp
new file mode 100644
index 000000000..9bc56ea91
--- /dev/null
+++ b/Source/WebCore/html/BaseClickableWithKeyInputType.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2010, 2012 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BaseClickableWithKeyInputType.h"
+
+#include "HTMLInputElement.h"
+#include "KeyboardEvent.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+void BaseClickableWithKeyInputType::handleKeydownEvent(KeyboardEvent* event)
+{
+    const String& key = event->keyIdentifier();
+    if (key == "U+0020") {
+        element()->setActive(true, true);
+        // No setDefaultHandled(), because IE dispatches a keypress in this case
+        // and the caller will only dispatch a keypress if we don't call setDefaultHandled().
+    }
+}
+
+void BaseClickableWithKeyInputType::handleKeypressEvent(KeyboardEvent* event)
+{
+    int charCode = event->charCode();
+    if (charCode == '\r') {
+        element()->dispatchSimulatedClick(event);
+        event->setDefaultHandled();
+        return;
+    }
+    if (charCode == ' ') {
+        // Prevent scrolling down the page.
+        event->setDefaultHandled();
+    }
+}
+
+void BaseClickableWithKeyInputType::handleKeyupEvent(KeyboardEvent* event)
+{
+    const String& key = event->keyIdentifier();
+    if (key != "U+0020")
+        return;
+    // Simulate mouse click for spacebar for button types.
+    dispatchSimulatedClickIfActive(event);
+}
+
+// FIXME: Could share this with BaseCheckableInputType and RangeInputType if we had a common base class.
+void BaseClickableWithKeyInputType::accessKeyAction(bool sendMouseEvents)
+{
+    InputType::accessKeyAction(sendMouseEvents);
+
+    // Send mouse button events if the caller specified sendMouseEvents.
+    // FIXME: The comment above is no good. It says what we do, but not why.
+    element()->dispatchSimulatedClick(0, sendMouseEvents);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/storage/DOMWindowSQLDatabase.h b/Source/WebCore/html/BaseClickableWithKeyInputType.h
index 7af60be7a..5bb58cf4e 100644
--- a/Source/WebCore/storage/DOMWindowSQLDatabase.h
+++ b/Source/WebCore/html/BaseClickableWithKeyInputType.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Google Inc.  All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,34 +28,25 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef DOMWindowSQLDatabase_h
-#define DOMWindowSQLDatabase_h
+#ifndef BaseClickableWithKeyInputType_h
+#define BaseClickableWithKeyInputType_h
 
-#if ENABLE(SQL_DATABASE)
-#include "ExceptionCode.h"
-#include "PlatformString.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
+#include "InputType.h"
 
 namespace WebCore {
 
-class DOMWindow;
-class Database;
-class DatabaseCallback;
-class Frame;
-
-class DOMWindowSQLDatabase {
-public:
-    static PassRefPtr<Database> openDatabase(DOMWindow*, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
+// Base of input types that dispatches a simulated click on space/return key.
+class BaseClickableWithKeyInputType : public InputType {
+protected:
+    BaseClickableWithKeyInputType(HTMLInputElement* element) : InputType(element) { }
 
 private:
-    DOMWindowSQLDatabase() { };
-    ~DOMWindowSQLDatabase() { };
+    virtual void handleKeydownEvent(KeyboardEvent*) OVERRIDE;
+    virtual void handleKeypressEvent(KeyboardEvent*) OVERRIDE;
+    virtual void handleKeyupEvent(KeyboardEvent*) OVERRIDE;
+    virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(SQL_DATABASE)
-
-#endif // DOMWindowSQLDatabase_h
+#endif // BaseClickableWithKeyInputType_h
diff --git a/Source/WebCore/html/CollectionType.h b/Source/WebCore/html/CollectionType.h
index fa348f9c3..4ed981998 100644
--- a/Source/WebCore/html/CollectionType.h
+++ b/Source/WebCore/html/CollectionType.h
@@ -51,6 +51,7 @@ enum CollectionType {
     TSectionRows, // all row elements in this table section
     TRCells,      // all cells in this row
     SelectOptions,
+    SelectedOptions,
     DataListOptions,
     MapAreas,
 
diff --git a/Source/WebCore/html/ColorInputType.cpp b/Source/WebCore/html/ColorInputType.cpp
index 83647ea6a..077b559da 100644
--- a/Source/WebCore/html/ColorInputType.cpp
+++ b/Source/WebCore/html/ColorInputType.cpp
@@ -39,6 +39,7 @@
 #include "MouseEvent.h"
 #include "ScriptController.h"
 #include "ShadowRoot.h"
+#include "ShadowTree.h"
 
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/WTFString.h>
@@ -116,7 +117,7 @@ void ColorInputType::createShadowSubtree()
     ExceptionCode ec = 0;
     wrapperElement->appendChild(colorSwatch.release(), ec);
     ASSERT(!ec);
-    element()->shadowRootList()->oldestShadowRoot()->appendChild(wrapperElement.release(), ec);
+    element()->shadowTree()->oldestShadowRoot()->appendChild(wrapperElement.release(), ec);
     ASSERT(!ec);
     
     updateColorSwatch();
@@ -185,7 +186,7 @@ void ColorInputType::updateColorSwatch()
 
 HTMLElement* ColorInputType::shadowColorSwatch() const
 {
-    ShadowRoot* shadow = element()->shadowRootList()->oldestShadowRoot();
+    ShadowRoot* shadow = element()->shadowTree()->oldestShadowRoot();
     return shadow ? toHTMLElement(shadow->firstChild()->firstChild()) : 0;
 }
 
diff --git a/Source/WebCore/html/ColorInputType.h b/Source/WebCore/html/ColorInputType.h
index f92b91ced..e1ed03601 100644
--- a/Source/WebCore/html/ColorInputType.h
+++ b/Source/WebCore/html/ColorInputType.h
@@ -31,14 +31,14 @@
 #ifndef ColorInputType_h
 #define ColorInputType_h
 
+#include "BaseClickableWithKeyInputType.h"
 #include "ColorChooserClient.h"
-#include "InputType.h"
 
 #if ENABLE(INPUT_COLOR)
 
 namespace WebCore {
 
-class ColorInputType : public InputType, public ColorChooserClient {
+class ColorInputType : public BaseClickableWithKeyInputType, public ColorChooserClient {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
     virtual ~ColorInputType();
@@ -48,7 +48,7 @@ public:
     virtual void didEndChooser() OVERRIDE;
 
 private:
-    ColorInputType(HTMLInputElement* element) : InputType(element) { }
+    ColorInputType(HTMLInputElement* element) : BaseClickableWithKeyInputType(element) { }
     virtual bool isColorControl() const OVERRIDE;
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual bool supportsRequired() const OVERRIDE;
diff --git a/Source/WebCore/html/DOMFormData.idl b/Source/WebCore/html/DOMFormData.idl
index 4bab556be..73eaa6618 100644
--- a/Source/WebCore/html/DOMFormData.idl
+++ b/Source/WebCore/html/DOMFormData.idl
@@ -32,6 +32,7 @@ module html {
 
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         JSGenerateToNativeObject,
         JSGenerateToJSObject,
         InterfaceName=FormData
diff --git a/Source/WebCore/html/DOMURL.idl b/Source/WebCore/html/DOMURL.idl
index e929ca86f..df747c295 100644
--- a/Source/WebCore/html/DOMURL.idl
+++ b/Source/WebCore/html/DOMURL.idl
@@ -30,12 +30,13 @@ module html {
         Constructor,
         JSGenerateToNativeObject,
         JSGenerateToJSObject,
-        JSNoStaticTables
+        JSNoStaticTables,
+        InterfaceName=URL
     ] DOMURL {
 #if defined(ENABLE_MEDIA_STREAM) && ENABLE_MEDIA_STREAM
-        static [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] DOMString createObjectURL(in MediaStream stream);
+        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] static DOMString createObjectURL(in MediaStream stream);
 #endif
-        static [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] DOMString createObjectURL(in Blob blob);
-        static [CallWith=ScriptExecutionContext] void revokeObjectURL(in DOMString url);
+        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] static DOMString createObjectURL(in Blob blob);
+        [CallWith=ScriptExecutionContext] static void revokeObjectURL(in DOMString url);
     };
 }
diff --git a/Source/WebCore/html/DOMWindowHTML.idl b/Source/WebCore/html/DOMWindowHTML.idl
deleted file mode 100644
index 889c3a00e..000000000
--- a/Source/WebCore/html/DOMWindowHTML.idl
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    // FIXME: Most of this could/should be generated from make_names.pl/HTMLNames.in
-    // to reduce the chance that we forget a constructor when adding a new element.
-    interface [
-        Supplemental=DOMWindow
-    ] DOMWindowHTML {
-
-        attribute HTMLDocumentConstructor HTMLDocument;
-        attribute HTMLElementConstructor HTMLElement;
-        attribute HTMLAnchorElementConstructor HTMLAnchorElement;
-        attribute HTMLAppletElementConstructor HTMLAppletElement;
-        attribute HTMLAreaElementConstructor HTMLAreaElement;
-        attribute HTMLBRElementConstructor HTMLBRElement;
-        attribute HTMLBaseElementConstructor HTMLBaseElement;
-        attribute HTMLBaseFontElementConstructor HTMLBaseFontElement;
-        attribute HTMLBodyElementConstructor HTMLBodyElement;
-        attribute HTMLButtonElementConstructor HTMLButtonElement;
-        attribute HTMLCanvasElementConstructor HTMLCanvasElement;
-        attribute HTMLDListElementConstructor HTMLDListElement;
-        attribute HTMLDirectoryElementConstructor HTMLDirectoryElement;
-        attribute HTMLDivElementConstructor HTMLDivElement;
-        attribute HTMLEmbedElementConstructor HTMLEmbedElement;
-        attribute HTMLFieldSetElementConstructor HTMLFieldSetElement;
-        attribute HTMLFontElementConstructor HTMLFontElement;
-        attribute HTMLFormElementConstructor HTMLFormElement;
-        attribute HTMLFrameElementConstructor HTMLFrameElement;
-        attribute HTMLFrameSetElementConstructor HTMLFrameSetElement;
-        attribute HTMLHRElementConstructor HTMLHRElement;
-        attribute HTMLHeadElementConstructor HTMLHeadElement;
-        attribute HTMLHeadingElementConstructor HTMLHeadingElement;
-        attribute HTMLHtmlElementConstructor HTMLHtmlElement;
-        attribute HTMLIFrameElementConstructor HTMLIFrameElement;
-        attribute HTMLImageElementConstructor HTMLImageElement;
-        attribute HTMLInputElementConstructor HTMLInputElement;
-        attribute HTMLKeygenElementConstructor HTMLKeygenElement;
-        attribute HTMLLIElementConstructor HTMLLIElement;
-        attribute HTMLLabelElementConstructor HTMLLabelElement;
-        attribute HTMLLegendElementConstructor HTMLLegendElement;
-        attribute HTMLLinkElementConstructor HTMLLinkElement;
-        attribute HTMLMapElementConstructor HTMLMapElement;
-        attribute HTMLMarqueeElementConstructor HTMLMarqueeElement;
-        attribute HTMLMenuElementConstructor HTMLMenuElement;
-        attribute HTMLMetaElementConstructor HTMLMetaElement;
-#if defined(ENABLE_METER_TAG) && ENABLE_METER_TAG
-        attribute HTMLMeterElementConstructor HTMLMeterElement;
-#endif
-        attribute HTMLModElementConstructor HTMLModElement;
-        attribute HTMLOListElementConstructor HTMLOListElement;
-        attribute HTMLObjectElementConstructor HTMLObjectElement;
-        attribute HTMLOptGroupElementConstructor HTMLOptGroupElement;
-        attribute HTMLOptionElementConstructor HTMLOptionElement;
-        attribute HTMLOutputElementConstructor HTMLOutputElement;
-        attribute HTMLParagraphElementConstructor HTMLParagraphElement;
-        attribute HTMLParamElementConstructor HTMLParamElement;
-        attribute HTMLPreElementConstructor HTMLPreElement;
-#if defined(ENABLE_PROGRESS_TAG) && ENABLE_PROGRESS_TAG
-        attribute HTMLProgressElementConstructor HTMLProgressElement;
-#endif
-        attribute HTMLQuoteElementConstructor HTMLQuoteElement;
-        attribute HTMLScriptElementConstructor HTMLScriptElement;
-        attribute HTMLSelectElementConstructor HTMLSelectElement;
-        attribute HTMLSpanElementConstructor HTMLSpanElement;
-        attribute HTMLStyleElementConstructor HTMLStyleElement;
-        attribute HTMLTableCaptionElementConstructor HTMLTableCaptionElement;
-        attribute HTMLTableCellElementConstructor HTMLTableCellElement;
-        attribute HTMLTableColElementConstructor HTMLTableColElement;
-        attribute HTMLTableElementConstructor HTMLTableElement;
-        attribute HTMLTableRowElementConstructor HTMLTableRowElement;
-        attribute HTMLTableSectionElementConstructor HTMLTableSectionElement;
-        attribute HTMLTextAreaElementConstructor HTMLTextAreaElement;
-        attribute HTMLTitleElementConstructor HTMLTitleElement;
-        attribute HTMLUListElementConstructor HTMLUListElement;
-
-        attribute HTMLCollectionConstructor HTMLCollection;
-        attribute HTMLAllCollectionConstructor HTMLAllCollection;
-        attribute [Conditional=MICRODATA] HTMLPropertiesCollectionConstructor HTMLPropertiesCollection;
-        attribute HTMLUnknownElementConstructor HTMLUnknownElement;
-
-        attribute [JSCustomGetter, CustomConstructor] HTMLImageElementConstructorConstructor Image; // Usable with new operator
-        attribute [JSCustomGetter] HTMLOptionElementConstructorConstructor Option; // Usable with new operator
-
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] HTMLTrackElementConstructor HTMLTrackElement;
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackConstructor TextTrack;
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueConstructor TextTrackCue; // Usable with the new operator
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueListConstructor TextTrackCueList;
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackListConstructor TextTrackList;
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TrackEventConstructor TrackEvent;
-
-        attribute [JSCustomGetter, Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructorConstructor Audio; // Usable with the new operator
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructor HTMLAudioElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLMediaElementConstructor HTMLMediaElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLVideoElementConstructor HTMLVideoElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaErrorConstructor MediaError;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] TimeRangesConstructor TimeRanges;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLSourceElementConstructor HTMLSourceElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaControllerConstructor MediaController;
-    };
-
-}
diff --git a/Source/WebCore/html/FileInputType.cpp b/Source/WebCore/html/FileInputType.cpp
index 5759f6741..9cb39b667 100644
--- a/Source/WebCore/html/FileInputType.cpp
+++ b/Source/WebCore/html/FileInputType.cpp
@@ -36,7 +36,7 @@
 #include "RenderFileUploadControl.h"
 #include "ScriptController.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/WTFString.h>
@@ -84,7 +84,7 @@ const AtomicString& UploadButtonElement::shadowPseudoId() const
 }
 
 inline FileInputType::FileInputType(HTMLInputElement* element)
-    : BaseButtonInputType(element)
+    : BaseClickableWithKeyInputType(element)
     , m_fileList(FileList::create())
 {
 }
@@ -99,6 +99,26 @@ const AtomicString& FileInputType::formControlType() const
     return InputTypeNames::file();
 }
 
+bool FileInputType::saveFormControlState(String& result) const
+{
+    if (m_fileList->isEmpty())
+        return false;
+    result = String();
+    unsigned numFiles = m_fileList->length();
+    for (unsigned i = 0; i < numFiles; ++i) {
+        result.append(m_fileList->item(i)->path());
+        result.append('\0');
+    }
+    return true;
+}
+
+void FileInputType::restoreFormControlState(const String& state)
+{
+    Vector<String> files;
+    state.split('\0', files);
+    filesChosen(files);
+}
+
 bool FileInputType::appendFormData(FormDataList& encoding, bool multipart) const
 {
     FileList* fileList = element()->files();
@@ -213,11 +233,6 @@ bool FileInputType::getTypeSpecificValue(String& value)
     return true;
 }
 
-bool FileInputType::storesValueSeparateFromAttribute()
-{
-    return true;
-}
-
 void FileInputType::setValue(const String&, bool, TextFieldEventBehavior)
 {
     m_fileList->clear();
@@ -268,13 +283,13 @@ void FileInputType::createShadowSubtree()
 {
     ASSERT(element()->hasShadowRoot());
     ExceptionCode ec = 0;
-    element()->shadowRootList()->oldestShadowRoot()->appendChild(element()->multiple() ? UploadButtonElement::createForMultiple(element()->document()): UploadButtonElement::create(element()->document()), ec);
+    element()->shadowTree()->oldestShadowRoot()->appendChild(element()->multiple() ? UploadButtonElement::createForMultiple(element()->document()): UploadButtonElement::create(element()->document()), ec);
 }
 
 void FileInputType::multipleAttributeChanged()
 {
     ASSERT(element()->hasShadowRoot());
-    UploadButtonElement* button = static_cast<UploadButtonElement*>(element()->shadowRootList()->oldestShadowRoot()->firstChild());
+    UploadButtonElement* button = static_cast<UploadButtonElement*>(element()->shadowTree()->oldestShadowRoot()->firstChild());
     if (button)
         button->setValue(element()->multiple() ? fileButtonChooseMultipleFilesLabel() : fileButtonChooseFileLabel());
 }
diff --git a/Source/WebCore/html/FileInputType.h b/Source/WebCore/html/FileInputType.h
index 53575a420..00d362bda 100644
--- a/Source/WebCore/html/FileInputType.h
+++ b/Source/WebCore/html/FileInputType.h
@@ -32,7 +32,7 @@
 #ifndef FileInputType_h
 #define FileInputType_h
 
-#include "BaseButtonInputType.h"
+#include "BaseClickableWithKeyInputType.h"
 #include "FileChooser.h"
 #include "FileIconLoader.h"
 #include <wtf/RefPtr.h>
@@ -41,13 +41,15 @@ namespace WebCore {
 
 class FileList;
 
-class FileInputType : public BaseButtonInputType, private FileChooserClient, private FileIconLoaderClient {
+class FileInputType : public BaseClickableWithKeyInputType, private FileChooserClient, private FileIconLoaderClient {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
 
 private:
     FileInputType(HTMLInputElement*);
     virtual const AtomicString& formControlType() const OVERRIDE;
+    virtual bool saveFormControlState(String&) const OVERRIDE;
+    virtual void restoreFormControlState(const String&) OVERRIDE;
     virtual bool appendFormData(FormDataList&, bool) const OVERRIDE;
     virtual bool valueMissing(const String&) const OVERRIDE;
     virtual String valueMissingText() const OVERRIDE;
@@ -58,7 +60,6 @@ private:
     virtual FileList* files() OVERRIDE;
     virtual bool canSetValue(const String&) OVERRIDE;
     virtual bool getTypeSpecificValue(String&) OVERRIDE; // Checked first, before internal storage or the value attribute.
-    virtual bool storesValueSeparateFromAttribute() OVERRIDE;
     virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual void receiveDroppedFiles(const Vector<String>&) OVERRIDE;
     virtual Icon* icon() const OVERRIDE;
diff --git a/Source/WebCore/html/HTMLBRElement.cpp b/Source/WebCore/html/HTMLBRElement.cpp
index 33f0c533c..57253af0e 100644
--- a/Source/WebCore/html/HTMLBRElement.cpp
+++ b/Source/WebCore/html/HTMLBRElement.cpp
@@ -25,6 +25,7 @@
 
 #include "Attribute.h"
 #include "CSSPropertyNames.h"
+#include "CSSValueKeywords.h"
 #include "HTMLNames.h"
 #include "RenderBR.h"
 
@@ -48,11 +49,11 @@ PassRefPtr<HTMLBRElement> HTMLBRElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLBRElement(tagName, document));
 }
 
-bool HTMLBRElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLBRElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == clearAttr)
+    if (name == clearAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLBRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -62,7 +63,7 @@ void HTMLBRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet*
         // <br clear> and <br clear=""> are just treated like <br> by Gecko, Mac IE, etc. -dwh
         if (!attr->isEmpty()) {
             if (equalIgnoringCase(attr->value(), "all"))
-                addPropertyToAttributeStyle(style, CSSPropertyClear, "both");
+                addPropertyToAttributeStyle(style, CSSPropertyClear, CSSValueBoth);
             else
                 addPropertyToAttributeStyle(style, CSSPropertyClear, attr->value());
         }
diff --git a/Source/WebCore/html/HTMLBRElement.h b/Source/WebCore/html/HTMLBRElement.h
index 16c1beae7..a7e60f321 100644
--- a/Source/WebCore/html/HTMLBRElement.h
+++ b/Source/WebCore/html/HTMLBRElement.h
@@ -38,7 +38,7 @@ public:
 private:
     HTMLBRElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/html/HTMLBodyElement.cpp b/Source/WebCore/html/HTMLBodyElement.cpp
index 34d2924fa..a6b5b219e 100644
--- a/Source/WebCore/html/HTMLBodyElement.cpp
+++ b/Source/WebCore/html/HTMLBodyElement.cpp
@@ -61,11 +61,11 @@ HTMLBodyElement::~HTMLBodyElement()
 {
 }
 
-bool HTMLBodyElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLBodyElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == backgroundAttr || attr->name() == marginwidthAttr || attr->name() == leftmarginAttr || attr->name() == marginheightAttr || attr->name() == topmarginAttr || attr->name() == bgcolorAttr || attr->name() == textAttr || attr->name() == bgpropertiesAttr)
+    if (name == backgroundAttr || name == marginwidthAttr || name == leftmarginAttr || name == marginheightAttr || name == topmarginAttr || name == bgcolorAttr || name == textAttr || name == bgpropertiesAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLBodyElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLBodyElement.h b/Source/WebCore/html/HTMLBodyElement.h
index 41ba4485c..a0dce1f15 100644
--- a/Source/WebCore/html/HTMLBodyElement.h
+++ b/Source/WebCore/html/HTMLBodyElement.h
@@ -71,7 +71,7 @@ private:
     HTMLBodyElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void insertedIntoDocument();
diff --git a/Source/WebCore/html/HTMLButtonElement.cpp b/Source/WebCore/html/HTMLButtonElement.cpp
index a79641a31..d91bd49aa 100644
--- a/Source/WebCore/html/HTMLButtonElement.cpp
+++ b/Source/WebCore/html/HTMLButtonElement.cpp
@@ -79,15 +79,15 @@ const AtomicString& HTMLButtonElement::formControlType() const
     return emptyAtom;
 }
 
-bool HTMLButtonElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLButtonElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr) {
+    if (name == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox and IE do, but not Opera.
         // See http://bugs.webkit.org/show_bug.cgi?id=12071
         return false;
     }
 
-    return HTMLFormControlElement::isPresentationAttribute(attr);
+    return HTMLFormControlElement::isPresentationAttribute(name);
 }
 
 void HTMLButtonElement::parseAttribute(Attribute* attr)
diff --git a/Source/WebCore/html/HTMLButtonElement.h b/Source/WebCore/html/HTMLButtonElement.h
index 00518ea4c..51ea71a1c 100644
--- a/Source/WebCore/html/HTMLButtonElement.h
+++ b/Source/WebCore/html/HTMLButtonElement.h
@@ -44,11 +44,12 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void defaultEventHandler(Event*);
     virtual bool appendFormData(FormDataList&, bool);
 
     virtual bool isEnumeratable() const { return true; } 
+    virtual bool isLabelable() const OVERRIDE { return true; }
 
     virtual bool isSuccessfulSubmitButton() const;
     virtual bool isActivatedSubmit() const;
diff --git a/Source/WebCore/html/HTMLButtonElement.idl b/Source/WebCore/html/HTMLButtonElement.idl
index b9eafb0d5..692fd612a 100644
--- a/Source/WebCore/html/HTMLButtonElement.idl
+++ b/Source/WebCore/html/HTMLButtonElement.idl
@@ -21,34 +21,32 @@
 module html {
 
     interface HTMLButtonElement : HTMLElement {
+        attribute [Reflect] boolean autofocus;
+        attribute [Reflect] boolean disabled;
         readonly attribute HTMLFormElement form;
-
         attribute [Reflect, URL] DOMString formAction;
         attribute [TreatNullAs=NullString] DOMString formEnctype;
         attribute [TreatNullAs=NullString] DOMString formMethod;
         attribute [Reflect] boolean formNoValidate;
         attribute [Reflect] DOMString formTarget;
-        readonly attribute ValidityState validity;
-
-#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        attribute [Reflect] DOMString accessKey;
-#endif
-        attribute [Reflect] boolean disabled;
-        attribute [Reflect] boolean autofocus;
         attribute [Reflect] DOMString name;
         readonly attribute DOMString type;
         attribute [Reflect] DOMString value;
 
         readonly attribute boolean willValidate;
+        readonly attribute ValidityState validity;
         readonly attribute DOMString validationMessage;
         boolean checkValidity();
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
 
+        readonly attribute NodeList labels;
+
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        void click();
+        attribute [Reflect] DOMString accessKey;
 #endif
 
-        readonly attribute NodeList labels;
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        void click();
+#endif
     };
-
 }
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index 7ed6e3d11..60d21ce48 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -490,7 +490,7 @@ void HTMLCanvasElement::createImageBuffer() const
 
     m_hasCreatedImageBuffer = true;
 
-    FloatSize logicalSize(width(), height());
+    FloatSize logicalSize = size();
     FloatSize deviceSize = convertLogicalToDevice(logicalSize);
     if (!deviceSize.isExpressibleAsIntSize())
         return;
@@ -513,7 +513,7 @@ void HTMLCanvasElement::createImageBuffer() const
         Unaccelerated;
 #endif
     DeferralMode deferralMode = shouldDefer() ? Deferred : NonDeferred;
-    m_imageBuffer = ImageBuffer::create(bufferSize, ColorSpaceDeviceRGB, renderingMode, deferralMode);
+    m_imageBuffer = ImageBuffer::create(bufferSize, 1, ColorSpaceDeviceRGB, renderingMode, deferralMode);
     if (!m_imageBuffer)
         return;
     m_imageBuffer->context()->scale(FloatSize(bufferSize.width() / logicalSize.width(), bufferSize.height() / logicalSize.height()));
@@ -523,7 +523,8 @@ void HTMLCanvasElement::createImageBuffer() const
 
 #if USE(JSC)
     JSC::JSLock lock(JSC::SilenceAssertionsOnly);
-    scriptExecutionContext()->globalData()->heap.reportExtraMemoryCost(m_imageBuffer->dataSize());
+    size_t numBytes = 4 * m_imageBuffer->internalSize().width() * m_imageBuffer->internalSize().height();
+    scriptExecutionContext()->globalData()->heap.reportExtraMemoryCost(numBytes);
 #endif
 
 #if USE(IOSURFACE_CANVAS_BACKING_STORE) || (ENABLE(ACCELERATED_2D_CANVAS) && USE(ACCELERATED_COMPOSITING))
@@ -571,7 +572,7 @@ void HTMLCanvasElement::clearCopiedImage()
 AffineTransform HTMLCanvasElement::baseTransform() const
 {
     ASSERT(m_hasCreatedImageBuffer);
-    FloatSize unscaledSize(width(), height());
+    FloatSize unscaledSize = size();
     FloatSize deviceSize = convertLogicalToDevice(unscaledSize);
     IntSize size(deviceSize.width(), deviceSize.height());
     AffineTransform transform;
diff --git a/Source/WebCore/html/HTMLCollection.cpp b/Source/WebCore/html/HTMLCollection.cpp
index 7d06308fc..d11fee121 100644
--- a/Source/WebCore/html/HTMLCollection.cpp
+++ b/Source/WebCore/html/HTMLCollection.cpp
@@ -61,6 +61,7 @@ bool HTMLCollection::shouldIncludeChildren(CollectionType type)
     case MapAreas:
     case OtherCollection:
     case SelectOptions:
+    case SelectedOptions:
     case DataListOptions:
     case WindowNamedItems:
 #if ENABLE(MICRODATA)
@@ -114,6 +115,13 @@ inline bool HTMLCollection::isAcceptableElement(Element* element) const
         return element->hasLocalName(trTag);
     case SelectOptions:
         return element->hasLocalName(optionTag);
+    case SelectedOptions:
+        if (element->hasLocalName(optionTag)) {
+            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(element);
+            if (option->selected())
+                return true;
+        }
+        return false;
     case DataListOptions:
         if (element->hasLocalName(optionTag)) {
             HTMLOptionElement* option = static_cast<HTMLOptionElement*>(element);
diff --git a/Source/WebCore/html/HTMLDetailsElement.cpp b/Source/WebCore/html/HTMLDetailsElement.cpp
index d49daa4c6..332f1a740 100644
--- a/Source/WebCore/html/HTMLDetailsElement.cpp
+++ b/Source/WebCore/html/HTMLDetailsElement.cpp
@@ -29,9 +29,9 @@
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
 #include "NodeRenderingContext.h"
-#include "RenderDetails.h"
+#include "RenderBlock.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "Text.h"
 
 namespace WebCore {
@@ -50,7 +50,7 @@ public:
 
 private:
     DetailsContentElement(Document* document)
-        : HTMLContentElement(HTMLNames::divTag, document)
+        : HTMLContentElement(HTMLNames::webkitShadowContentTag, document)
     {
     }
 };
@@ -72,7 +72,7 @@ public:
 
 private:
     DetailsSummaryElement(Document* document)
-        : HTMLContentElement(HTMLNames::divTag, document)
+        : HTMLContentElement(HTMLNames::webkitShadowContentTag, document)
     {
         setSelect(summaryQuerySelector());
     }
@@ -105,7 +105,7 @@ HTMLDetailsElement::HTMLDetailsElement(const QualifiedName& tagName, Document* d
 
 RenderObject* HTMLDetailsElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderDetails(this);
+    return new (arena) RenderBlock(this);
 }
 
 void HTMLDetailsElement::createShadowSubtree()
@@ -124,7 +124,7 @@ Element* HTMLDetailsElement::findMainSummary() const
             return toElement(child);
     }
 
-    return static_cast<DetailsSummaryElement*>(shadowRootList()->oldestShadowRoot()->firstChild())->fallbackSummary();
+    return static_cast<DetailsSummaryElement*>(shadowTree()->oldestShadowRoot()->firstChild())->fallbackSummary();
 }
 
 void HTMLDetailsElement::parseAttribute(Attribute* attr)
diff --git a/Source/WebCore/html/HTMLDivElement.cpp b/Source/WebCore/html/HTMLDivElement.cpp
index bd15ae239..24efd8646 100644
--- a/Source/WebCore/html/HTMLDivElement.cpp
+++ b/Source/WebCore/html/HTMLDivElement.cpp
@@ -48,11 +48,11 @@ PassRefPtr<HTMLDivElement> HTMLDivElement::create(const QualifiedName& tagName,
     return adoptRef(new HTMLDivElement(tagName, document));
 }
 
-bool HTMLDivElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLDivElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr)
+    if (name == alignAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLDivElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLDivElement.h b/Source/WebCore/html/HTMLDivElement.h
index f8f4f7101..6a3dac3b3 100644
--- a/Source/WebCore/html/HTMLDivElement.h
+++ b/Source/WebCore/html/HTMLDivElement.h
@@ -36,7 +36,7 @@ protected:
     HTMLDivElement(const QualifiedName&, Document*);
 
 private:
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLDocument.cpp b/Source/WebCore/html/HTMLDocument.cpp
index b67eacd5a..f2e511eb0 100644
--- a/Source/WebCore/html/HTMLDocument.cpp
+++ b/Source/WebCore/html/HTMLDocument.cpp
@@ -136,30 +136,9 @@ void HTMLDocument::setDesignMode(const String& value)
     Document::setDesignMode(mode);
 }
 
-static Node* focusedFrameOwnerElement(Frame* focusedFrame, Frame* currentFrame)
-{
-    for (; focusedFrame; focusedFrame = focusedFrame->tree()->parent()) {
-        if (focusedFrame->tree()->parent() == currentFrame)
-            return focusedFrame->ownerElement();
-    }
-    return 0;
-}
-
 Element* HTMLDocument::activeElement()
 {
-    Node* node = focusedNode();
-    if (!node && page())
-        node = focusedFrameOwnerElement(page()->focusController()->focusedFrame(), frame());
-    if (!node)
-        return body();
-    ASSERT(node->document() == this);
-    while (node->treeScope() != this) {
-        node = node->parentOrHostNode();
-        ASSERT(node);
-    }
-    if (node->isElementNode())
-        return toElement(node);
-    return body();
+    return treeScope()->activeElement();
 }
 
 bool HTMLDocument::hasFocus()
diff --git a/Source/WebCore/html/HTMLDocument.idl b/Source/WebCore/html/HTMLDocument.idl
index 19420ee3d..de9b51d84 100644
--- a/Source/WebCore/html/HTMLDocument.idl
+++ b/Source/WebCore/html/HTMLDocument.idl
@@ -45,10 +45,8 @@ module html {
         void captureEvents();
         void releaseEvents();
 
-#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute long width;
         readonly attribute long height;
-#endif
                  attribute [TreatNullAs=NullString] DOMString dir;
                  attribute [TreatNullAs=NullString] DOMString designMode;
         readonly attribute DOMString compatMode;
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index 4e8da5c7d..d046814e3 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -159,18 +159,18 @@ void HTMLElement::mapLanguageAttributeToLocale(Attribute* attribute, StyleProper
     }
 }
 
-bool HTMLElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr || attr->name() == contenteditableAttr || attr->name() == hiddenAttr || attr->name() == langAttr || attr->name().matches(XMLNames::langAttr) || attr->name() == draggableAttr || attr->name() == dirAttr)
+    if (name == alignAttr || name == contenteditableAttr || name == hiddenAttr || name == langAttr || name.matches(XMLNames::langAttr) || name == draggableAttr || name == dirAttr)
         return true;
-    return StyledElement::isPresentationAttribute(attr);
+    return StyledElement::isPresentationAttribute(name);
 }
 
 void HTMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == alignAttr) {
         if (equalIgnoringCase(attr->value(), "middle"))
-            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, "center");
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueCenter);
         else
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
     } else if (attr->name() == contenteditableAttr) {
@@ -234,7 +234,6 @@ void HTMLElement::parseAttribute(Attribute* attr)
         setItemRef(attr->value());
     } else if (attr->name() == itemtypeAttr) {
         setItemType(attr->value());
-        itemTypeAttributeChanged();
 #endif
     }
 // standard events
@@ -343,84 +342,6 @@ String HTMLElement::outerHTML() const
     return createMarkup(this);
 }
 
-static inline bool hasOneChild(ContainerNode* node)
-{
-    Node* firstChild = node->firstChild();
-    return firstChild && !firstChild->nextSibling();
-}
-
-static inline bool hasOneTextChild(ContainerNode* node)
-{
-    return hasOneChild(node) && node->firstChild()->isTextNode();
-}
-
-static void replaceChildrenWithFragment(HTMLElement* element, PassRefPtr<DocumentFragment> fragment, ExceptionCode& ec)
-{
-#if ENABLE(MUTATION_OBSERVERS)
-    ChildListMutationScope mutation(element);
-#endif
-
-    if (!fragment->firstChild()) {
-        element->removeChildren();
-        return;
-    }
-
-    if (hasOneTextChild(element) && hasOneTextChild(fragment.get())) {
-        toText(element->firstChild())->setData(toText(fragment->firstChild())->data(), ec);
-        return;
-    }
-
-    if (hasOneChild(element)) {
-        element->replaceChild(fragment, element->firstChild(), ec);
-        return;
-    }
-
-    element->removeChildren();
-    element->appendChild(fragment, ec);
-}
-
-static void replaceChildrenWithText(HTMLElement* element, const String& text, ExceptionCode& ec)
-{
-#if ENABLE(MUTATION_OBSERVERS)
-    ChildListMutationScope mutation(element);
-#endif
-
-    if (hasOneTextChild(element)) {
-        toText(element->firstChild())->setData(text, ec);
-        return;
-    }
-
-    RefPtr<Text> textNode = Text::create(element->document(), text);
-
-    if (hasOneChild(element)) {
-        element->replaceChild(textNode.release(), element->firstChild(), ec);
-        return;
-    }
-
-    element->removeChildren();
-    element->appendChild(textNode.release(), ec);
-}
-
-// We may want to move a version of this function into DocumentFragment.h/cpp
-static PassRefPtr<DocumentFragment> createFragmentFromSource(const String& markup, Element* contextElement, ExceptionCode& ec)
-{
-    Document* document = contextElement->document();
-    RefPtr<DocumentFragment> fragment;
-
-    fragment = DocumentFragment::create(document);
-    if (document->isHTMLDocument()) {
-        fragment->parseHTML(markup, contextElement);
-        return fragment;
-    }
-
-    bool wasValid = fragment->parseXML(markup, contextElement);
-    if (!wasValid) {
-        ec = INVALID_STATE_ERR;
-        return 0;
-    }
-    return fragment;
-}
-
 void HTMLElement::setInnerHTML(const String& html, ExceptionCode& ec)
 {
     RefPtr<DocumentFragment> fragment = createFragmentFromSource(html, this, ec);
@@ -1184,16 +1105,15 @@ void StyledElement::copyNonAttributeProperties(const Element* sourceElement)
     ASSERT(sourceElement->isStyledElement());
 
     const StyledElement* source = static_cast<const StyledElement*>(sourceElement);
-    if (!source->inlineStyleDecl())
+    if (!source->inlineStyle())
         return;
 
-    StylePropertySet* inlineStyle = ensureInlineStyleDecl();
-    inlineStyle->copyPropertiesFrom(*source->inlineStyleDecl());
-    inlineStyle->setStrictParsing(source->inlineStyleDecl()->useStrictParsing());
+    StylePropertySet* inlineStyle = ensureAttributeData()->ensureMutableInlineStyle(this);
+    inlineStyle->copyPropertiesFrom(*source->inlineStyle());
+    inlineStyle->setStrictParsing(source->inlineStyle()->useStrictParsing());
 
     setIsStyleAttributeValid(source->isStyleAttributeValid());
-    setIsSynchronizingStyleAttribute(source->isSynchronizingStyleAttribute());
-    
+
     Element::copyNonAttributeProperties(sourceElement);
 }
 
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index 9d463cd77..b92152c9f 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -97,6 +97,12 @@ public:
     PassRefPtr<MicroDataItemValue> itemValue() const;
 #endif
 
+#ifndef NDEBUG
+    virtual bool isHTMLUnknownElement() const { return false; }
+#endif
+
+    virtual bool isInsertionPoint() const { return false; }
+
 protected:
     HTMLElement(const QualifiedName& tagName, Document*);
 
@@ -107,7 +113,7 @@ protected:
     void applyBorderAttributeToStyle(Attribute*, StylePropertySet*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
diff --git a/Source/WebCore/html/HTMLElement.idl b/Source/WebCore/html/HTMLElement.idl
index 8d5a0688d..4f5f236f6 100644
--- a/Source/WebCore/html/HTMLElement.idl
+++ b/Source/WebCore/html/HTMLElement.idl
@@ -69,6 +69,7 @@ module html {
 
                  attribute boolean spellcheck;
 
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C // No Objective-C bindings yet.
                  attribute [Conditional=MICRODATA, Reflect] boolean itemScope;
         readonly attribute [Conditional=MICRODATA] DOMSettableTokenList itemType;
                  attribute [Conditional=MICRODATA, Reflect, URL] DOMString itemId;
@@ -79,6 +80,7 @@ module html {
 #if defined(ENABLE_MICRODATA) && ENABLE_MICRODATA
         readonly attribute [Conditional=MICRODATA] HTMLPropertiesCollection properties;
 #endif
+#endif
 
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
diff --git a/Source/WebCore/html/HTMLEmbedElement.cpp b/Source/WebCore/html/HTMLEmbedElement.cpp
index 06cb9b1e9..0fc0b17a1 100644
--- a/Source/WebCore/html/HTMLEmbedElement.cpp
+++ b/Source/WebCore/html/HTMLEmbedElement.cpp
@@ -74,11 +74,11 @@ RenderWidget* HTMLEmbedElement::renderWidgetForJSBindings()
     return findWidgetRenderer(this);
 }
 
-bool HTMLEmbedElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLEmbedElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == hiddenAttr)
+    if (name == hiddenAttr)
         return true;
-    return HTMLPlugInImageElement::isPresentationAttribute(attr);
+    return HTMLPlugInImageElement::isPresentationAttribute(name);
 }
 
 void HTMLEmbedElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -208,13 +208,6 @@ bool HTMLEmbedElement::rendererIsNeeded(const NodeRenderingContext& context)
     return HTMLPlugInImageElement::rendererIsNeeded(context);
 }
 
-void HTMLEmbedElement::insertedIntoDocument()
-{
-    HTMLPlugInImageElement::insertedIntoDocument();
-    if (!inDocument())
-        return;
-}
-
 bool HTMLEmbedElement::isURLAttribute(Attribute* attr) const
 {
     return attr->name() == srcAttr || HTMLPlugInImageElement::isURLAttribute(attr);
diff --git a/Source/WebCore/html/HTMLEmbedElement.h b/Source/WebCore/html/HTMLEmbedElement.h
index f0fca2224..86bf8eddc 100644
--- a/Source/WebCore/html/HTMLEmbedElement.h
+++ b/Source/WebCore/html/HTMLEmbedElement.h
@@ -35,11 +35,10 @@ private:
     HTMLEmbedElement(const QualifiedName&, Document*, bool createdByParser);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual void insertedIntoDocument();
 
     virtual bool isURLAttribute(Attribute*) const;
     virtual const QualifiedName& imageSourceAttributeName() const;
diff --git a/Source/WebCore/html/HTMLFieldSetElement.idl b/Source/WebCore/html/HTMLFieldSetElement.idl
index dd699c0e8..0c34dee75 100644
--- a/Source/WebCore/html/HTMLFieldSetElement.idl
+++ b/Source/WebCore/html/HTMLFieldSetElement.idl
@@ -21,11 +21,14 @@ module html {
 
     interface HTMLFieldSetElement : HTMLElement {
         readonly attribute HTMLFormElement form;
-        readonly attribute ValidityState   validity;
+        attribute [Reflect] DOMString name;
+
+        readonly attribute DOMString type;
+
         readonly attribute boolean         willValidate;
+        readonly attribute ValidityState   validity;
         readonly attribute DOMString       validationMessage;
         boolean  checkValidity();
         void     setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
     };
-
 }
diff --git a/Source/WebCore/html/HTMLFontElement.cpp b/Source/WebCore/html/HTMLFontElement.cpp
index a7c2e950b..9c127419b 100644
--- a/Source/WebCore/html/HTMLFontElement.cpp
+++ b/Source/WebCore/html/HTMLFontElement.cpp
@@ -160,11 +160,11 @@ bool HTMLFontElement::cssValueFromFontSizeNumber(const String& s, int& size)
     return true;
 }
 
-bool HTMLFontElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLFontElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == sizeAttr || attr->name() == colorAttr || attr->name() == faceAttr)
+    if (name == sizeAttr || name == colorAttr || name == faceAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLFontElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLFontElement.h b/Source/WebCore/html/HTMLFontElement.h
index f24332c31..5ebbae9cb 100644
--- a/Source/WebCore/html/HTMLFontElement.h
+++ b/Source/WebCore/html/HTMLFontElement.h
@@ -37,7 +37,7 @@ public:
 private:
     HTMLFontElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index 8a72df061..0dad346f3 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -26,16 +26,12 @@
 #include "HTMLFormControlElement.h"
 
 #include "Attribute.h"
-#include "Document.h"
-#include "ElementRareData.h"
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
 #include "Frame.h"
 #include "HTMLFormElement.h"
 #include "HTMLInputElement.h"
-#include "HTMLNames.h"
-#include "LabelsNodeList.h"
 #include "RenderBox.h"
 #include "RenderTheme.h"
 #include "ScriptEventListener.h"
@@ -49,7 +45,7 @@ using namespace HTMLNames;
 using namespace std;
 
 HTMLFormControlElement::HTMLFormControlElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
-    : HTMLElement(tagName, document)
+    : LabelableElement(tagName, document)
     , m_disabled(false)
     , m_readOnly(false)
     , m_required(false)
@@ -467,33 +463,4 @@ bool HTMLFormControlElement::isDefaultButtonForForm() const
     return isSuccessfulSubmitButton() && form() && form()->defaultButton() == this;
 }
 
-bool HTMLFormControlElement::isLabelable() const
-{
-    // FIXME: Add meterTag and outputTag to the list once we support them.
-    return hasTagName(buttonTag) || hasTagName(inputTag) || hasTagName(keygenTag)
-#if ENABLE(METER_TAG)
-        || hasTagName(meterTag)
-#endif
-#if ENABLE(PROGRESS_TAG)
-        || hasTagName(progressTag)
-#endif
-        || hasTagName(selectTag) || hasTagName(textareaTag);
-}
-
-PassRefPtr<NodeList> HTMLFormControlElement::labels()
-{
-    if (!isLabelable())
-        return 0;
-    if (!document())
-        return 0;
-
-    NodeListsNodeData* nodeLists = Node::ensureRareData()->ensureNodeLists(this);
-    if (nodeLists->m_labelsNodeListCache)
-        return nodeLists->m_labelsNodeListCache;
-
-    RefPtr<LabelsNodeList> list = LabelsNodeList::create(this);
-    nodeLists->m_labelsNodeListCache = list.get();
-    return list.release();
-}
-
 } // namespace Webcore
diff --git a/Source/WebCore/html/HTMLFormControlElement.h b/Source/WebCore/html/HTMLFormControlElement.h
index 1bd485965..df07a8ba4 100644
--- a/Source/WebCore/html/HTMLFormControlElement.h
+++ b/Source/WebCore/html/HTMLFormControlElement.h
@@ -25,7 +25,7 @@
 #define HTMLFormControlElement_h
 
 #include "FormAssociatedElement.h"
-#include "HTMLElement.h"
+#include "LabelableElement.h"
 
 namespace WebCore {
 
@@ -37,7 +37,7 @@ class ValidityState;
 // HTMLFormControlElement is the default implementation of FormAssociatedElement,
 // and form-associated element implementations should use HTMLFormControlElement
 // unless there is a special reason.
-class HTMLFormControlElement : public HTMLElement, public FormAssociatedElement {
+class HTMLFormControlElement : public LabelableElement, public FormAssociatedElement {
 public:
     virtual ~HTMLFormControlElement();
 
@@ -100,9 +100,6 @@ public:
     void setNeedsValidityCheck();
     void setCustomValidity(const String&);
 
-    bool isLabelable() const;
-    PassRefPtr<NodeList> labels();
-
     bool readOnly() const { return m_readOnly; }
 
     bool hasAutofocused() { return m_hasAutofocused; }
diff --git a/Source/WebCore/html/HTMLFormElement.idl b/Source/WebCore/html/HTMLFormElement.idl
index 25386f5d9..b6a536c08 100644
--- a/Source/WebCore/html/HTMLFormElement.idl
+++ b/Source/WebCore/html/HTMLFormElement.idl
@@ -24,19 +24,19 @@ module html {
         IndexedGetter,
         CustomNamedGetter
     ] HTMLFormElement : HTMLElement {
-        readonly attribute HTMLCollection elements;
-        readonly attribute long length;
-
-        attribute [Reflect] DOMString name;
-        attribute [Reflect] boolean noValidate;
         attribute [Reflect=accept_charset] DOMString acceptCharset;
         attribute [Reflect, URL] DOMString action;
-        attribute [TreatNullAs=NullString] DOMString encoding;
+        attribute [Reflect] DOMString autocomplete;
         attribute [TreatNullAs=NullString] DOMString enctype;
+        attribute [TreatNullAs=NullString] DOMString encoding;
         attribute [TreatNullAs=NullString] DOMString method;
+        attribute [Reflect] DOMString name;
+        attribute [Reflect] boolean noValidate;
         attribute [Reflect] DOMString target;
-        attribute [Reflect] DOMString autocomplete;
-        
+
+        readonly attribute HTMLCollection elements;
+        readonly attribute long length;
+
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [ImplementedAs=submitFromJavaScript] void submit();
 #else
@@ -45,5 +45,4 @@ module html {
         void reset();
         boolean checkValidity();
     };
-
 }
diff --git a/Source/WebCore/html/HTMLFrameSetElement.cpp b/Source/WebCore/html/HTMLFrameSetElement.cpp
index d3fdb97a4..803a1b9c9 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.cpp
+++ b/Source/WebCore/html/HTMLFrameSetElement.cpp
@@ -64,11 +64,11 @@ PassRefPtr<HTMLFrameSetElement> HTMLFrameSetElement::create(const QualifiedName&
     return adoptRef(new HTMLFrameSetElement(tagName, document));
 }
 
-bool HTMLFrameSetElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLFrameSetElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == bordercolorAttr)
+    if (name == bordercolorAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLFrameSetElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLFrameSetElement.h b/Source/WebCore/html/HTMLFrameSetElement.h
index 1cd40a290..69c616205 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.h
+++ b/Source/WebCore/html/HTMLFrameSetElement.h
@@ -68,7 +68,7 @@ private:
     HTMLFrameSetElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
diff --git a/Source/WebCore/html/HTMLHRElement.cpp b/Source/WebCore/html/HTMLHRElement.cpp
index 8f8b6e140..aaaa56ec8 100644
--- a/Source/WebCore/html/HTMLHRElement.cpp
+++ b/Source/WebCore/html/HTMLHRElement.cpp
@@ -49,11 +49,11 @@ PassRefPtr<HTMLHRElement> HTMLHRElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLHRElement(tagName, document));
 }
 
-bool HTMLHRElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLHRElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr || attr->name() == widthAttr || attr->name() == colorAttr || attr->name() == noshadeAttr || attr->name() == sizeAttr)
+    if (name == alignAttr || name == widthAttr || name == colorAttr || name == noshadeAttr || name == sizeAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLHRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLHRElement.h b/Source/WebCore/html/HTMLHRElement.h
index 728619ac5..89ae018bf 100644
--- a/Source/WebCore/html/HTMLHRElement.h
+++ b/Source/WebCore/html/HTMLHRElement.h
@@ -37,7 +37,7 @@ public:
 private:
     HTMLHRElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLIFrameElement.cpp b/Source/WebCore/html/HTMLIFrameElement.cpp
index a846fa432..2969cf9f9 100644
--- a/Source/WebCore/html/HTMLIFrameElement.cpp
+++ b/Source/WebCore/html/HTMLIFrameElement.cpp
@@ -48,11 +48,11 @@ PassRefPtr<HTMLIFrameElement> HTMLIFrameElement::create(const QualifiedName& tag
     return adoptRef(new HTMLIFrameElement(tagName, document));
 }
 
-bool HTMLIFrameElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLIFrameElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == alignAttr || attr->name() == frameborderAttr)
+    if (name == widthAttr || name == heightAttr || name == alignAttr || name == frameborderAttr)
         return true;
-    return HTMLFrameElementBase::isPresentationAttribute(attr);
+    return HTMLFrameElementBase::isPresentationAttribute(name);
 }
 
 void HTMLIFrameElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLIFrameElement.h b/Source/WebCore/html/HTMLIFrameElement.h
index 075841091..1882acd59 100644
--- a/Source/WebCore/html/HTMLIFrameElement.h
+++ b/Source/WebCore/html/HTMLIFrameElement.h
@@ -36,7 +36,7 @@ private:
     HTMLIFrameElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void insertedIntoDocument();
diff --git a/Source/WebCore/html/HTMLImageElement.cpp b/Source/WebCore/html/HTMLImageElement.cpp
index 583a23fc8..ff89c6e4f 100644
--- a/Source/WebCore/html/HTMLImageElement.cpp
+++ b/Source/WebCore/html/HTMLImageElement.cpp
@@ -78,11 +78,11 @@ PassRefPtr<HTMLImageElement> HTMLImageElement::createForJSConstructor(Document*
     return image.release();
 }
 
-bool HTMLImageElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLImageElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == borderAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == valignAttr)
+    if (name == widthAttr || name == heightAttr || name == borderAttr || name == vspaceAttr || name == hspaceAttr || name == alignAttr || name == valignAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLImageElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLImageElement.h b/Source/WebCore/html/HTMLImageElement.h
index 37a23775a..bfe10eec0 100644
--- a/Source/WebCore/html/HTMLImageElement.h
+++ b/Source/WebCore/html/HTMLImageElement.h
@@ -84,7 +84,7 @@ protected:
 
 private:
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 422ac8513..cd078d139 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -660,11 +660,11 @@ void HTMLInputElement::accessKeyAction(bool sendMouseEvents)
     m_inputType->accessKeyAction(sendMouseEvents);
 }
 
-bool HTMLInputElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLInputElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == widthAttr || attr->name() == heightAttr || (attr->name() == borderAttr && isImageButton()))
+    if (name == vspaceAttr || name == hspaceAttr || name == alignAttr || name == widthAttr || name == heightAttr || (name == borderAttr && isImageButton()))
         return true;
-    return HTMLTextFormControlElement::isPresentationAttribute(attr);
+    return HTMLTextFormControlElement::isPresentationAttribute(name);
 }
 
 void HTMLInputElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -1356,7 +1356,8 @@ void HTMLInputElement::setCanReceiveDroppedFiles(bool canReceiveDroppedFiles)
     if (m_canReceiveDroppedFiles == canReceiveDroppedFiles)
         return;
     m_canReceiveDroppedFiles = canReceiveDroppedFiles;
-    renderer()->updateFromElement();
+    if (renderer())
+        renderer()->updateFromElement();
 }
 
 String HTMLInputElement::visibleValue() const
@@ -1760,6 +1761,12 @@ bool HTMLInputElement::isEnumeratable() const
     return m_inputType->isEnumeratable();
 }
 
+bool HTMLInputElement::isLabelable() const
+{
+    // FIXME: We should return false for type="hidden".
+    return true;
+}
+
 bool HTMLInputElement::shouldAppearChecked() const
 {
     return checked() && m_inputType->isCheckable();
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index 39cb48ba6..6db5f776a 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -256,6 +256,7 @@ private:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
     virtual bool isEnumeratable() const;
+    virtual bool isLabelable() const OVERRIDE;
     virtual void updateFocusAppearance(bool restorePreviousSelection);
     virtual void aboutToUnload();
     virtual bool shouldUseInputMethod();
@@ -276,7 +277,7 @@ private:
     virtual void accessKeyAction(bool sendMouseEvents);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void finishParsingChildren();
 
diff --git a/Source/WebCore/html/HTMLInputElement.idl b/Source/WebCore/html/HTMLInputElement.idl
index 84beb8ac5..ad1c3154f 100644
--- a/Source/WebCore/html/HTMLInputElement.idl
+++ b/Source/WebCore/html/HTMLInputElement.idl
@@ -21,36 +21,33 @@
 module html {
 
     interface HTMLInputElement : HTMLElement {
-        attribute [TreatNullAs=NullString] DOMString defaultValue;
+        attribute [Reflect] DOMString accept;
+        attribute [Reflect] DOMString alt;
+        attribute [Reflect] DOMString autocomplete;
+        attribute [Reflect] boolean autofocus;
         attribute [Reflect=checked] boolean defaultChecked;
+        attribute boolean checked;
         attribute [Reflect] DOMString dirName;
+        attribute [Reflect] boolean disabled;
         readonly attribute HTMLFormElement form;
+        readonly attribute FileList files;
         attribute [Reflect, URL] DOMString formAction;
         attribute [TreatNullAs=NullString] DOMString formEnctype;
         attribute [TreatNullAs=NullString] DOMString formMethod;
         attribute [Reflect] boolean formNoValidate;
         attribute [Reflect] DOMString formTarget;
-        readonly attribute ValidityState validity;
-        attribute [Reflect] DOMString accept;
-        attribute [Reflect] DOMString align;
-        attribute [Reflect] DOMString alt;
-        attribute boolean checked;
-        attribute [Reflect] boolean disabled;
-        attribute [Reflect] boolean autofocus;
-        attribute [Reflect] DOMString autocomplete;
+        attribute boolean indeterminate;
         readonly attribute [Conditional=DATALIST] HTMLElement list;
         attribute [Reflect] DOMString max;
         attribute long maxLength setter raises(DOMException);
         attribute [Reflect] DOMString min;
         attribute [Reflect] boolean multiple;
-        attribute [Conditional=DIRECTORY_UPLOAD, Reflect] boolean webkitdirectory;
         attribute [Reflect] DOMString name;
         attribute [Reflect] DOMString pattern;
         attribute [Reflect] DOMString placeholder;
         attribute [Reflect] boolean readOnly;
         attribute [Reflect] boolean required;
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        attribute [Reflect] DOMString accessKey;
         attribute [ObjCImplementedAsUnsignedLong] DOMString size; // DOM level 2 changed this to a long, but ObjC API is a string
 #else
         attribute unsigned long size; // Changed string -> long -> unsigned long
@@ -58,39 +55,28 @@ module html {
         attribute [Reflect, URL] DOMString src;
         attribute [Reflect] DOMString step;
         attribute [TreatNullAs=NullString] DOMString type; // readonly dropped as part of DOM level 2
-        attribute [Reflect] DOMString useMap;
+        attribute [TreatNullAs=NullString] DOMString defaultValue;
         attribute [TreatNullAs=NullString] DOMString value;
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
         attribute Date valueAsDate setter raises(DOMException);
 #endif
         attribute double valueAsNumber setter raises(DOMException);
-        readonly attribute [Conditional=DATALIST] HTMLOptionElement selectedOption;
-        attribute [Reflect] boolean incremental;
 
         void stepUp(in [Optional] long n) raises(DOMException);
         void stepDown(in [Optional] long n) raises(DOMException);
 
         readonly attribute boolean willValidate;
+        readonly attribute ValidityState validity;
         readonly attribute DOMString validationMessage;
         boolean checkValidity();
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
-        void select();
-
-#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        void click();
-#endif
-
-#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
-        void setValueForUser(in [TreatNullAs=NullString] DOMString value);
-#endif
 
-        // WinIE extension:
-        attribute boolean indeterminate;
+        readonly attribute NodeList labels;
 
+        void select();
         attribute [Custom] long selectionStart;
         attribute [Custom] long selectionEnd;
         attribute [Custom] DOMString selectionDirection;
-
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         [Custom] void setSelectionRange(in long start, in long end);
 #else
@@ -99,18 +85,33 @@ module html {
                                         in [Optional] DOMString direction);
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+        // Non-standard attributes
+        attribute [Reflect] DOMString align;
+        attribute [Conditional=DIRECTORY_UPLOAD, Reflect] boolean webkitdirectory;
+        attribute [Reflect] DOMString useMap;
+        readonly attribute [Conditional=DATALIST] HTMLOptionElement selectedOption;
+        attribute [Reflect] boolean incremental;
+        attribute [Conditional=INPUT_SPEECH, Reflect, V8EnabledAtRuntime] boolean webkitSpeech;
+        attribute [Conditional=INPUT_SPEECH, Reflect, V8EnabledAtRuntime] boolean webkitGrammar;
+        attribute [Conditional=INPUT_SPEECH, NotEnumerable] EventListener onwebkitspeechchange;
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        void click();
+#endif
+
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
+        void setValueForUser(in [TreatNullAs=NullString] DOMString value);
+#endif
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute DOMString altDisplayString;
         readonly attribute URL absoluteImageURL;
 #endif
 
-        readonly attribute FileList files;
-        readonly attribute NodeList labels;
-
-        attribute [Conditional=INPUT_SPEECH, Reflect, V8EnabledAtRuntime] boolean webkitSpeech;
-        attribute [Conditional=INPUT_SPEECH, Reflect, V8EnabledAtRuntime] boolean webkitGrammar;
-        attribute [Conditional=INPUT_SPEECH, NotEnumerable] EventListener onwebkitspeechchange;
     };
-
 }
diff --git a/Source/WebCore/html/HTMLKeygenElement.cpp b/Source/WebCore/html/HTMLKeygenElement.cpp
index e10079f64..80534419e 100644
--- a/Source/WebCore/html/HTMLKeygenElement.cpp
+++ b/Source/WebCore/html/HTMLKeygenElement.cpp
@@ -33,7 +33,7 @@
 #include "HTMLOptionElement.h"
 #include "SSLKeyGenerator.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
 
@@ -132,7 +132,7 @@ void HTMLKeygenElement::reset()
 HTMLSelectElement* HTMLKeygenElement::shadowSelect() const
 {
     ASSERT(hasShadowRoot());
-    ShadowRoot* shadow = shadowRootList()->oldestShadowRoot();
+    ShadowRoot* shadow = shadowTree()->oldestShadowRoot();
     return shadow ? toHTMLSelectElement(shadow->firstChild()) : 0;
 }
 
diff --git a/Source/WebCore/html/HTMLKeygenElement.h b/Source/WebCore/html/HTMLKeygenElement.h
index c793cb120..04a9ed53c 100644
--- a/Source/WebCore/html/HTMLKeygenElement.h
+++ b/Source/WebCore/html/HTMLKeygenElement.h
@@ -48,6 +48,7 @@ private:
     virtual bool isOptionalFormControl() const { return false; }
 
     virtual bool isEnumeratable() const { return true; }
+    virtual bool isLabelable() const OVERRIDE { return true; }
 
     virtual void reset();
 
diff --git a/Source/WebCore/html/HTMLLIElement.cpp b/Source/WebCore/html/HTMLLIElement.cpp
index ec7824ea4..dd62dce9a 100644
--- a/Source/WebCore/html/HTMLLIElement.cpp
+++ b/Source/WebCore/html/HTMLLIElement.cpp
@@ -49,11 +49,11 @@ PassRefPtr<HTMLLIElement> HTMLLIElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLLIElement(tagName, document));
 }
 
-bool HTMLLIElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLLIElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == typeAttr)
+    if (name == typeAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLLIElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLLIElement.h b/Source/WebCore/html/HTMLLIElement.h
index c730408a7..9f7685aa3 100644
--- a/Source/WebCore/html/HTMLLIElement.h
+++ b/Source/WebCore/html/HTMLLIElement.h
@@ -36,7 +36,7 @@ private:
     HTMLLIElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
diff --git a/Source/WebCore/html/HTMLLegendElement.cpp b/Source/WebCore/html/HTMLLegendElement.cpp
index 61d2db31b..fd103d5ed 100644
--- a/Source/WebCore/html/HTMLLegendElement.cpp
+++ b/Source/WebCore/html/HTMLLegendElement.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "HTMLLegendElement.h"
 
+#include "HTMLFormControlElement.h"
 #include "HTMLNames.h"
 #include <wtf/StdLibExtras.h>
 
@@ -32,26 +33,16 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-inline HTMLLegendElement::HTMLLegendElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
-    : HTMLFormControlElement(tagName, document, form)
-{
-    ASSERT(hasTagName(legendTag));
-}
 
-PassRefPtr<HTMLLegendElement> HTMLLegendElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+inline HTMLLegendElement::HTMLLegendElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
 {
-    return adoptRef(new HTMLLegendElement(tagName, document, form));
-}
-
-bool HTMLLegendElement::supportsFocus() const
-{
-    return HTMLElement::supportsFocus();
+    ASSERT(hasTagName(legendTag));
 }
 
-const AtomicString& HTMLLegendElement::formControlType() const
+PassRefPtr<HTMLLegendElement> HTMLLegendElement::create(const QualifiedName& tagName, Document* document)
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, legend, ("legend"));
-    return legend;
+    return adoptRef(new HTMLLegendElement(tagName, document));
 }
 
 HTMLFormControlElement* HTMLLegendElement::associatedControl()
@@ -69,7 +60,7 @@ HTMLFormControlElement* HTMLLegendElement::associatedControl()
     while ((node = node->traverseNextNode(fieldset))) {
         if (node->isElementNode()) {
             Element* element = static_cast<Element*>(node);
-            if (!element->hasLocalName(legendTag) && element->isFormControlElement())
+            if (element->isFormControlElement())
                 return static_cast<HTMLFormControlElement*>(element);
         }
     }
diff --git a/Source/WebCore/html/HTMLLegendElement.h b/Source/WebCore/html/HTMLLegendElement.h
index 24d8fce82..95129ec88 100644
--- a/Source/WebCore/html/HTMLLegendElement.h
+++ b/Source/WebCore/html/HTMLLegendElement.h
@@ -24,22 +24,22 @@
 #ifndef HTMLLegendElement_h
 #define HTMLLegendElement_h
 
-#include "HTMLFormControlElement.h"
+#include "HTMLElement.h"
 
 namespace WebCore {
 
-class HTMLLegendElement : public HTMLFormControlElement {
+class HTMLFormControlElement;
+
+class HTMLLegendElement : public HTMLElement {
 public:
-    static PassRefPtr<HTMLLegendElement> create(const QualifiedName&, Document*, HTMLFormElement*);
+    static PassRefPtr<HTMLLegendElement> create(const QualifiedName&, Document*);
 
 private:
-    HTMLLegendElement(const QualifiedName&, Document*, HTMLFormElement*);
+    HTMLLegendElement(const QualifiedName&, Document*);
 
     // Control in the legend's fieldset that gets focus and access key.
     HTMLFormControlElement* associatedControl();
 
-    virtual bool supportsFocus() const;
-    virtual const AtomicString& formControlType() const;
     virtual void accessKeyAction(bool sendMouseEvents);
     virtual void focus(bool restorePreviousSelection = true);
 };
diff --git a/Source/WebCore/html/HTMLLinkElement.cpp b/Source/WebCore/html/HTMLLinkElement.cpp
index 1d6536fc5..efe76155a 100644
--- a/Source/WebCore/html/HTMLLinkElement.cpp
+++ b/Source/WebCore/html/HTMLLinkElement.cpp
@@ -31,6 +31,7 @@
 #include "CachedResourceLoader.h"
 #include "CSSStyleSelector.h"
 #include "Document.h"
+#include "EventSender.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
@@ -51,6 +52,12 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static LinkEventSender& linkLoadEventSender()
+{
+    DEFINE_STATIC_LOCAL(LinkEventSender, sharedLoadEventSender, (eventNames().loadEvent));
+    return sharedLoadEventSender;
+}
+
 inline HTMLLinkElement::HTMLLinkElement(const QualifiedName& tagName, Document* document, bool createdByParser)
     : HTMLElement(tagName, document)
     , m_linkLoader(this)
@@ -59,6 +66,8 @@ inline HTMLLinkElement::HTMLLinkElement(const QualifiedName& tagName, Document*
     , m_loading(false)
     , m_createdByParser(createdByParser)
     , m_isInShadowTree(false)
+    , m_firedLoad(false)
+    , m_loadedSheet(false)
     , m_pendingSheetType(None)
 {
     ASSERT(hasTagName(linkTag));
@@ -81,6 +90,8 @@ HTMLLinkElement::~HTMLLinkElement()
 
     if (inDocument())
         document()->removeStyleSheetCandidateNode(this);
+
+    linkLoadEventSender().cancelEvent(this);
 }
 
 void HTMLLinkElement::setDisabledState(bool disabled)
@@ -141,12 +152,10 @@ void HTMLLinkElement::parseAttribute(Attribute* attr)
         setDisabledState(!attr->isNull());
     else if (attr->name() == onbeforeloadAttr)
         setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
-#if ENABLE(LINK_PREFETCH)
     else if (attr->name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onerrorAttr)
         setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
-#endif
     else {
         if (attr->name() == titleAttr && m_sheet)
             m_sheet->setTitle(attr->value());
@@ -330,6 +339,7 @@ void HTMLLinkElement::setCSSStyleSheet(const String& href, const KURL& baseURL,
     m_sheet->setMedia(media.get());
 
     m_loading = false;
+    m_sheet->notifyLoadedSheet(sheet);
     m_sheet->checkLoaded();
 }
 
@@ -361,6 +371,29 @@ bool HTMLLinkElement::sheetLoaded()
     return false;
 }
 
+void HTMLLinkElement::dispatchPendingLoadEvents()
+{
+    linkLoadEventSender().dispatchPendingEvents();
+}
+
+void HTMLLinkElement::dispatchPendingEvent(LinkEventSender* eventSender)
+{
+    ASSERT_UNUSED(eventSender, eventSender == &linkLoadEventSender());
+    if (m_loadedSheet)
+        linkLoaded();
+    else
+        linkLoadingErrored();
+}
+
+void HTMLLinkElement::notifyLoadedSheetAndAllCriticalSubresources(bool errorOccurred)
+{
+    if (m_firedLoad)
+        return;
+    m_loadedSheet = !errorOccurred;
+    linkLoadEventSender().dispatchEventSoon(this);
+    m_firedLoad = true;
+}
+
 void HTMLLinkElement::startLoadingDynamicSheet()
 {
     // We don't support multiple blocking sheets.
diff --git a/Source/WebCore/html/HTMLLinkElement.h b/Source/WebCore/html/HTMLLinkElement.h
index b99b62949..55c577728 100644
--- a/Source/WebCore/html/HTMLLinkElement.h
+++ b/Source/WebCore/html/HTMLLinkElement.h
@@ -37,8 +37,12 @@
 
 namespace WebCore {
 
+class HTMLLinkElement;
 class KURL;
 
+template<typename T> class EventSender;
+typedef EventSender<HTMLLinkElement> LinkEventSender;
+
 class HTMLLinkElement : public HTMLElement, public CachedStyleSheetClient, public LinkLoaderClient {
 public:
     static PassRefPtr<HTMLLinkElement> create(const QualifiedName&, Document*, bool createdByParser);
@@ -60,6 +64,9 @@ public:
     void setSizes(const String&);
     DOMSettableTokenList* sizes() const;
 
+    void dispatchPendingEvent(LinkEventSender*);
+    static void dispatchPendingLoadEvents();
+
 private:
     virtual void parseAttribute(Attribute*) OVERRIDE;
 
@@ -73,6 +80,7 @@ private:
     // from CachedResourceClient
     virtual void setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet* sheet);
     virtual bool sheetLoaded();
+    virtual void notifyLoadedSheetAndAllCriticalSubresources(bool errorOccurred);
     virtual void startLoadingDynamicSheet();
 
     virtual void linkLoaded();
@@ -119,7 +127,9 @@ private:
     bool m_loading;
     bool m_createdByParser;
     bool m_isInShadowTree;
-    
+    bool m_firedLoad;
+    bool m_loadedSheet;
+
     PendingSheetType m_pendingSheetType;
 };
 
diff --git a/Source/WebCore/html/HTMLMarqueeElement.cpp b/Source/WebCore/html/HTMLMarqueeElement.cpp
index a1445ad55..911fc8969 100644
--- a/Source/WebCore/html/HTMLMarqueeElement.cpp
+++ b/Source/WebCore/html/HTMLMarqueeElement.cpp
@@ -58,11 +58,11 @@ int HTMLMarqueeElement::minimumDelay() const
     return 0;
 }
 
-bool HTMLMarqueeElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLMarqueeElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == bgcolorAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == scrollamountAttr || attr->name() == scrolldelayAttr || attr->name() == loopAttr || attr->name() == behaviorAttr || attr->name() == directionAttr)
+    if (name == widthAttr || name == heightAttr || name == bgcolorAttr || name == vspaceAttr || name == hspaceAttr || name == scrollamountAttr || name == scrolldelayAttr || name == loopAttr || name == behaviorAttr || name == directionAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLMarqueeElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLMarqueeElement.h b/Source/WebCore/html/HTMLMarqueeElement.h
index 8ababa1d9..6c453662b 100644
--- a/Source/WebCore/html/HTMLMarqueeElement.h
+++ b/Source/WebCore/html/HTMLMarqueeElement.h
@@ -53,7 +53,7 @@ public:
 private:
     HTMLMarqueeElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     // ActiveDOMObject
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index b956d66d9..8033dc884 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -73,7 +73,7 @@
 #include "SecurityPolicy.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "TimeRanges.h"
 #include "UUID.h"
 #include <limits>
@@ -619,6 +619,8 @@ void HTMLMediaElement::load(ExceptionCode& ec)
         ec = INVALID_STATE_ERR;
     else {
         m_loadInitiatedByUserGesture = ScriptController::processingUserGesture();
+        if (m_loadInitiatedByUserGesture)
+            removeBehaviorsRestrictionsAfterFirstUserGesture();
         prepareForLoad();
         loadInternal();
     }
@@ -2073,6 +2075,8 @@ void HTMLMediaElement::play()
 
     if (userGestureRequiredForRateChange() && !ScriptController::processingUserGesture())
         return;
+    if (ScriptController::processingUserGesture())
+        removeBehaviorsRestrictionsAfterFirstUserGesture();
 
     Settings* settings = document()->settings();
     if (settings && settings->needsSiteSpecificQuirks() && m_dispatchingCanPlayEvent && !m_loadInitiatedByUserGesture) {
@@ -2754,6 +2758,7 @@ KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidUR
     HTMLSourceElement* source = 0;
     bool lookingForStartNode = m_nextChildNodeToConsider;
     bool canUse = false;
+    String type;
 
     for (node = firstChild(); !canUse && node; node = node->nextSibling()) {
         if (lookingForStartNode && m_nextChildNodeToConsider != node)
@@ -2785,12 +2790,15 @@ KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidUR
                 goto check_again;
         }
 
-        if (source->fastHasAttribute(typeAttr)) {
+        type = source->type();
+        if (type.isEmpty() && mediaURL.protocolIsData())
+            type = mimeTypeFromDataURL(mediaURL);
+        if (!type.isEmpty()) {
 #if !LOG_DISABLED
             if (shouldLog)
-                LOG(Media, "HTMLMediaElement::selectNextSourceChild - 'type' is %s", source->type().utf8().data());
+                LOG(Media, "HTMLMediaElement::selectNextSourceChild - 'type' is %s", type.utf8().data());
 #endif
-            if (!MediaPlayer::supportsType(ContentType(source->type())))
+            if (!MediaPlayer::supportsType(ContentType(type)))
                 goto check_again;
         }
 
@@ -2808,7 +2816,7 @@ check_again:
 
     if (canUse) {
         if (contentType)
-            *contentType = ContentType(source->type());
+            *contentType = ContentType(type);
         m_currentSourceNode = source;
         m_nextChildNodeToConsider = source->nextSibling();
         if (!m_nextChildNodeToConsider)
@@ -3400,12 +3408,13 @@ void HTMLMediaElement::stop()
 void HTMLMediaElement::suspend(ReasonForSuspension why)
 {
     LOG(Media, "HTMLMediaElement::suspend");
-    
+
     switch (why)
     {
         case DocumentWillBecomeInactive:
             stop();
             break;
+        case PageWillBeSuspended:
         case JavaScriptDebuggerPaused:
         case WillShowDialog:
             // Do nothing, we don't pause media playback in these cases.
@@ -3747,7 +3756,7 @@ void HTMLMediaElement::privateBrowsingStateDidChange()
 
 MediaControls* HTMLMediaElement::mediaControls()
 {
-    return toMediaControls(shadowRootList()->oldestShadowRoot()->firstChild());
+    return toMediaControls(shadowTree()->oldestShadowRoot()->firstChild());
 }
 
 bool HTMLMediaElement::hasMediaControls()
@@ -3755,7 +3764,7 @@ bool HTMLMediaElement::hasMediaControls()
     if (!hasShadowRoot())
         return false;
 
-    Node* node = shadowRootList()->oldestShadowRoot()->firstChild();
+    Node* node = shadowTree()->oldestShadowRoot()->firstChild();
     return node && node->isMediaControls();
 }
 
@@ -4053,5 +4062,20 @@ String HTMLMediaElement::mediaPlayerReferrer() const
     return SecurityPolicy::generateReferrerHeader(document()->referrerPolicy(), m_currentSrc, frame->loader()->outgoingReferrer());
 }
 
+String HTMLMediaElement::mediaPlayerUserAgent() const
+{
+    Frame* frame = document()->frame();
+    if (!frame)
+        return String();
+
+    return frame->loader()->userAgent(m_currentSrc);
+
+}
+
+void HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture()
+{
+    m_restrictions = NoRestrictions;
+}
+
 }
 #endif
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index 126b78f57..3f310fbc4 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -390,6 +390,7 @@ private:
 #endif
 
     virtual String mediaPlayerReferrer() const OVERRIDE;
+    virtual String mediaPlayerUserAgent() const OVERRIDE;
 
     void loadTimerFired(Timer<HTMLMediaElement>*);
     void progressEventTimerFired(Timer<HTMLMediaElement>*);
@@ -477,6 +478,8 @@ private:
 
     void changeNetworkStateFromLoadingToIdle();
 
+    void removeBehaviorsRestrictionsAfterFirstUserGesture();
+
 #if ENABLE(MICRODATA)
     virtual String itemValueText() const;
     virtual void setItemValueText(const String&, ExceptionCode&);
diff --git a/Source/WebCore/html/HTMLMediaElement.idl b/Source/WebCore/html/HTMLMediaElement.idl
index 55d06f3ca..9cb2df306 100644
--- a/Source/WebCore/html/HTMLMediaElement.idl
+++ b/Source/WebCore/html/HTMLMediaElement.idl
@@ -99,15 +99,15 @@ module html {
     [V8EnabledAtRuntime=webkitMediaSource] void webkitSourceAppend(in Uint8Array data) raises (DOMException);
 
     // Signals the end of stream.
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short EOS_NO_ERROR = 0; // End of stream reached w/o error.
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short EOS_NETWORK_ERR = 1; // A network error triggered end of stream.
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short EOS_DECODE_ERR = 2; // A decode error triggered end of stream.
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short EOS_NO_ERROR = 0; // End of stream reached w/o error.
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short EOS_NETWORK_ERR = 1; // A network error triggered end of stream.
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short EOS_DECODE_ERR = 2; // A decode error triggered end of stream.
     [V8EnabledAtRuntime=webkitMediaSource] void webkitSourceEndOfStream(in unsigned short status) raises (DOMException);
 
     // Indicates the current state of the media source.
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short SOURCE_CLOSED = 0;
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short SOURCE_OPEN = 1;
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short SOURCE_ENDED = 2;
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short SOURCE_CLOSED = 0;
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short SOURCE_OPEN = 1;
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short SOURCE_ENDED = 2;
     readonly attribute [V8EnabledAtRuntime=webkitMediaSource] unsigned short webkitSourceState;
 #endif
 
diff --git a/Source/WebCore/html/HTMLMeterElement.h b/Source/WebCore/html/HTMLMeterElement.h
index dc5e7ccf5..e2be97f71 100644
--- a/Source/WebCore/html/HTMLMeterElement.h
+++ b/Source/WebCore/html/HTMLMeterElement.h
@@ -65,6 +65,8 @@ private:
     HTMLMeterElement(const QualifiedName&, Document*, HTMLFormElement*);
     virtual ~HTMLMeterElement();
 
+    virtual bool isLabelable() const OVERRIDE { return true; }
+
     virtual bool supportsFocus() const;
 
     virtual bool recalcWillValidate() const { return false; }
diff --git a/Source/WebCore/html/HTMLOListElement.cpp b/Source/WebCore/html/HTMLOListElement.cpp
index 1f7e28dfe..816d6a8e5 100644
--- a/Source/WebCore/html/HTMLOListElement.cpp
+++ b/Source/WebCore/html/HTMLOListElement.cpp
@@ -54,11 +54,11 @@ PassRefPtr<HTMLOListElement> HTMLOListElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLOListElement(tagName, document));
 }
 
-bool HTMLOListElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLOListElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == typeAttr)
+    if (name == typeAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLOListElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLOListElement.h b/Source/WebCore/html/HTMLOListElement.h
index 9f0eafb0b..d78207d33 100644
--- a/Source/WebCore/html/HTMLOListElement.h
+++ b/Source/WebCore/html/HTMLOListElement.h
@@ -54,7 +54,7 @@ private:
     void recalculateItemCount();
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     int m_start;
diff --git a/Source/WebCore/html/HTMLObjectElement.cpp b/Source/WebCore/html/HTMLObjectElement.cpp
index 406a3eb3e..635042fee 100644
--- a/Source/WebCore/html/HTMLObjectElement.cpp
+++ b/Source/WebCore/html/HTMLObjectElement.cpp
@@ -77,11 +77,11 @@ RenderWidget* HTMLObjectElement::renderWidgetForJSBindings()
     return renderPart(); // This will return 0 if the renderer is not a RenderPart.
 }
 
-bool HTMLObjectElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLObjectElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == borderAttr)
+    if (name == borderAttr)
         return true;
-    return HTMLPlugInImageElement::isPresentationAttribute(attr);
+    return HTMLPlugInImageElement::isPresentationAttribute(name);
 }
 
 void HTMLObjectElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLObjectElement.h b/Source/WebCore/html/HTMLObjectElement.h
index 112dcc6af..a1ab97238 100644
--- a/Source/WebCore/html/HTMLObjectElement.h
+++ b/Source/WebCore/html/HTMLObjectElement.h
@@ -67,7 +67,7 @@ private:
     HTMLObjectElement(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void insertedIntoTree(bool deep);
diff --git a/Source/WebCore/html/HTMLOptGroupElement.cpp b/Source/WebCore/html/HTMLOptGroupElement.cpp
index 3213842f0..e09200062 100644
--- a/Source/WebCore/html/HTMLOptGroupElement.cpp
+++ b/Source/WebCore/html/HTMLOptGroupElement.cpp
@@ -38,15 +38,15 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-inline HTMLOptGroupElement::HTMLOptGroupElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
-    : HTMLFormControlElement(tagName, document, form)
+inline HTMLOptGroupElement::HTMLOptGroupElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
 {
     ASSERT(hasTagName(optgroupTag));
 }
 
-PassRefPtr<HTMLOptGroupElement> HTMLOptGroupElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+PassRefPtr<HTMLOptGroupElement> HTMLOptGroupElement::create(const QualifiedName& tagName, Document* document)
 {
-    return adoptRef(new HTMLOptGroupElement(tagName, document, form));
+    return adoptRef(new HTMLOptGroupElement(tagName, document));
 }
 
 bool HTMLOptGroupElement::supportsFocus() const
@@ -69,12 +69,12 @@ const AtomicString& HTMLOptGroupElement::formControlType() const
 void HTMLOptGroupElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     recalcSelectOptions();
-    HTMLFormControlElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
 void HTMLOptGroupElement::parseAttribute(Attribute* attr)
 {
-    HTMLFormControlElement::parseAttribute(attr);
+    HTMLElement::parseAttribute(attr);
     recalcSelectOptions();
 }
 
@@ -91,13 +91,13 @@ void HTMLOptGroupElement::attach()
 {
     if (parentNode()->renderStyle())
         setRenderStyle(styleForRenderer());
-    HTMLFormControlElement::attach();
+    HTMLElement::attach();
 }
 
 void HTMLOptGroupElement::detach()
 {
     m_style.clear();
-    HTMLFormControlElement::detach();
+    HTMLElement::detach();
 }
 
 void HTMLOptGroupElement::setRenderStyle(PassRefPtr<RenderStyle> newStyle)
diff --git a/Source/WebCore/html/HTMLOptGroupElement.h b/Source/WebCore/html/HTMLOptGroupElement.h
index 85d531e43..bfd6fe4dc 100644
--- a/Source/WebCore/html/HTMLOptGroupElement.h
+++ b/Source/WebCore/html/HTMLOptGroupElement.h
@@ -24,22 +24,22 @@
 #ifndef HTMLOptGroupElement_h
 #define HTMLOptGroupElement_h
 
-#include "HTMLFormControlElement.h"
+#include "HTMLElement.h"
 
 namespace WebCore {
     
 class HTMLSelectElement;
 
-class HTMLOptGroupElement : public HTMLFormControlElement {
+class HTMLOptGroupElement : public HTMLElement {
 public:
-    static PassRefPtr<HTMLOptGroupElement> create(const QualifiedName&, Document*, HTMLFormElement*);
+    static PassRefPtr<HTMLOptGroupElement> create(const QualifiedName&, Document*);
 
     HTMLSelectElement* ownerSelectElement() const;
     
     String groupLabelText() const;
 
 private:
-    HTMLOptGroupElement(const QualifiedName&, Document*, HTMLFormElement*);
+    HTMLOptGroupElement(const QualifiedName&, Document*);
 
     virtual const AtomicString& formControlType() const;
     virtual bool supportsFocus() const;
diff --git a/Source/WebCore/html/HTMLOptionElement.cpp b/Source/WebCore/html/HTMLOptionElement.cpp
index 9fef31841..1696e9bec 100644
--- a/Source/WebCore/html/HTMLOptionElement.cpp
+++ b/Source/WebCore/html/HTMLOptionElement.cpp
@@ -137,10 +137,12 @@ String HTMLOptionElement::text() const
 
 void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
 {
+    RefPtr<Node> protectFromMutationEvents(this);
+
     // Changing the text causes a recalc of a select's items, which will reset the selected
     // index to the first item if the select is single selection with a menu list. We attempt to
     // preserve the selected item.
-    HTMLSelectElement* select = ownerSelectElement();
+    RefPtr<HTMLSelectElement> select = ownerSelectElement();
     bool selectIsMenuList = select && select->usesMenuList();
     int oldSelectedIndex = selectIsMenuList ? select->selectedIndex() : -1;
 
@@ -297,7 +299,7 @@ String HTMLOptionElement::textIndentedToRespectGroupLabel() const
 
 bool HTMLOptionElement::disabled() const
 {
-    return ownElementDisabled() || (parentNode() && static_cast<HTMLFormControlElement*>(parentNode())->disabled());
+    return ownElementDisabled() || (parentNode() && parentNode()->isHTMLElement() && static_cast<HTMLElement*>(parentNode())->disabled());
 }
 
 void HTMLOptionElement::insertedIntoTree(bool deep)
diff --git a/Source/WebCore/html/HTMLOptionElement.idl b/Source/WebCore/html/HTMLOptionElement.idl
index 99681f2c1..b7b3489ea 100644
--- a/Source/WebCore/html/HTMLOptionElement.idl
+++ b/Source/WebCore/html/HTMLOptionElement.idl
@@ -25,18 +25,18 @@ module html {
         NamedConstructor=Option(in [Optional=DefaultIsNullString] DOMString data, in [Optional=DefaultIsNullString] DOMString value, in [Optional=DefaultIsUndefined] boolean defaultSelected, in [Optional=DefaultIsUndefined] boolean selected),
         ConstructorRaisesException
     ] HTMLOptionElement : HTMLElement {
+        attribute [Reflect] boolean disabled;
         readonly attribute HTMLFormElement form;
+        attribute DOMString label;
         attribute [Reflect=selected] boolean defaultSelected;
+        attribute boolean selected;
+        attribute DOMString value;
+
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         attribute DOMString text setter raises(DOMException);
 #else
         readonly attribute DOMString text;
 #endif
         readonly attribute long index;
-        attribute [Reflect] boolean disabled;
-        attribute DOMString label;
-        attribute boolean selected;
-        attribute DOMString value;
     };
-
 }
diff --git a/Source/WebCore/html/HTMLOutputElement.cpp b/Source/WebCore/html/HTMLOutputElement.cpp
index ccad10741..0e1155fd4 100644
--- a/Source/WebCore/html/HTMLOutputElement.cpp
+++ b/Source/WebCore/html/HTMLOutputElement.cpp
@@ -81,6 +81,8 @@ void HTMLOutputElement::setFor(const String& value)
 
 void HTMLOutputElement::childrenChanged(bool createdByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
+    HTMLFormControlElement::childrenChanged(createdByParser, beforeChange, afterChange, childCountDelta);
+
     if (createdByParser || m_isSetTextContentInProgress) {
         m_isSetTextContentInProgress = false;
         return;
@@ -88,7 +90,6 @@ void HTMLOutputElement::childrenChanged(bool createdByParser, Node* beforeChange
 
     if (m_isDefaultValueMode)
         m_defaultValue = textContent();
-    HTMLFormControlElement::childrenChanged(createdByParser, beforeChange, afterChange, childCountDelta);
 }
 
 void HTMLOutputElement::reset()
diff --git a/Source/WebCore/html/HTMLParagraphElement.cpp b/Source/WebCore/html/HTMLParagraphElement.cpp
index c8f6ad3ee..bc98710a1 100644
--- a/Source/WebCore/html/HTMLParagraphElement.cpp
+++ b/Source/WebCore/html/HTMLParagraphElement.cpp
@@ -39,16 +39,21 @@ inline HTMLParagraphElement::HTMLParagraphElement(const QualifiedName& tagName,
     ASSERT(hasTagName(pTag));
 }
 
+PassRefPtr<HTMLParagraphElement> HTMLParagraphElement::create(Document* document)
+{
+    return adoptRef(new HTMLParagraphElement(pTag, document));
+}
+
 PassRefPtr<HTMLParagraphElement> HTMLParagraphElement::create(const QualifiedName& tagName, Document* document)
 {
     return adoptRef(new HTMLParagraphElement(tagName, document));
 }
 
-bool HTMLParagraphElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLParagraphElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr)
+    if (name == alignAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLParagraphElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLParagraphElement.h b/Source/WebCore/html/HTMLParagraphElement.h
index 86a85a63a..736567949 100644
--- a/Source/WebCore/html/HTMLParagraphElement.h
+++ b/Source/WebCore/html/HTMLParagraphElement.h
@@ -29,12 +29,13 @@ namespace WebCore {
 
 class HTMLParagraphElement : public HTMLElement {
 public:
+    static PassRefPtr<HTMLParagraphElement> create(Document*);
     static PassRefPtr<HTMLParagraphElement> create(const QualifiedName&, Document*);
 
 private:
     HTMLParagraphElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLParamElement.cpp b/Source/WebCore/html/HTMLParamElement.cpp
index c0f919951..39df4641e 100644
--- a/Source/WebCore/html/HTMLParamElement.cpp
+++ b/Source/WebCore/html/HTMLParamElement.cpp
@@ -42,37 +42,27 @@ PassRefPtr<HTMLParamElement> HTMLParamElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLParamElement(tagName, document));
 }
 
-bool HTMLParamElement::isURLParameter(const String& name)
+String HTMLParamElement::name() const
 {
-    return equalIgnoringCase(name, "data") || equalIgnoringCase(name, "movie") || equalIgnoringCase(name, "src");
+    if (hasName())
+        return getNameAttribute();
+    return document()->isHTMLDocument() ? emptyAtom : getIdAttribute();
 }
 
-void HTMLParamElement::parseAttribute(Attribute* attr)
+String HTMLParamElement::value() const
 {
-    if (isIdAttributeName(attr->name())) {
-        // Must call base class so that hasID bit gets set.
-        HTMLElement::parseAttribute(attr);
-        if (document()->isHTMLDocument())
-            return;
-        m_name = attr->value();
-    } else if (attr->name() == nameAttr) {
-        m_name = attr->value();
-    } else if (attr->name() == valueAttr) {
-        m_value = attr->value();
-    } else
-        HTMLElement::parseAttribute(attr);
+    return fastGetAttribute(valueAttr);
+}
+
+bool HTMLParamElement::isURLParameter(const String& name)
+{
+    return equalIgnoringCase(name, "data") || equalIgnoringCase(name, "movie") || equalIgnoringCase(name, "src");
 }
 
 bool HTMLParamElement::isURLAttribute(Attribute* attr) const
 {
-    if (attr->name() == valueAttr && hasAttributes()) {
-        Attribute* nameAttribute = getAttributeItem(nameAttr);
-        if (nameAttribute) {
-            const AtomicString& value = nameAttribute->value();
-            if (isURLParameter(value))
-                return true;
-        }
-    }
+    if (attr->name() == valueAttr && isURLParameter(name()))
+        return true;
     return HTMLElement::isURLAttribute(attr);
 }
 
diff --git a/Source/WebCore/html/HTMLParamElement.h b/Source/WebCore/html/HTMLParamElement.h
index eadec5440..09e2dfdc1 100644
--- a/Source/WebCore/html/HTMLParamElement.h
+++ b/Source/WebCore/html/HTMLParamElement.h
@@ -31,24 +31,17 @@ class HTMLParamElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLParamElement> create(const QualifiedName&, Document*);
 
-    String name() const { return m_name; }
-    String value() const { return m_value; }
+    String name() const;
+    String value() const;
 
     static bool isURLParameter(const String&);
 
 private:
     HTMLParamElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
-
     virtual bool isURLAttribute(Attribute*) const;
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
-
-    // FIXME: These don't need to be stored as members and instead
-    // name() value() could use getAttribute(nameAttr/valueAttr).
-    AtomicString m_name;
-    AtomicString m_value;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLPlugInElement.cpp b/Source/WebCore/html/HTMLPlugInElement.cpp
index 8c0f302a2..299e47b2e 100644
--- a/Source/WebCore/html/HTMLPlugInElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInElement.cpp
@@ -140,11 +140,11 @@ Widget* HTMLPlugInElement::pluginWidget()
     return renderWidget->widget();
 }
 
-bool HTMLPlugInElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLPlugInElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr)
+    if (name == widthAttr || name == heightAttr || name == vspaceAttr || name == hspaceAttr || name == alignAttr)
         return true;
-    return HTMLFrameOwnerElement::isPresentationAttribute(attr);
+    return HTMLFrameOwnerElement::isPresentationAttribute(name);
 }
 
 void HTMLPlugInElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLPlugInElement.h b/Source/WebCore/html/HTMLPlugInElement.h
index 10c1ea791..22b14c4e7 100644
--- a/Source/WebCore/html/HTMLPlugInElement.h
+++ b/Source/WebCore/html/HTMLPlugInElement.h
@@ -58,7 +58,7 @@ protected:
 
     virtual void detach();
     virtual void removedFromDocument();
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     bool m_inBeforeLoadEventHandler;
diff --git a/Source/WebCore/html/HTMLPreElement.cpp b/Source/WebCore/html/HTMLPreElement.cpp
index 09c08977a..839c52a3d 100644
--- a/Source/WebCore/html/HTMLPreElement.cpp
+++ b/Source/WebCore/html/HTMLPreElement.cpp
@@ -42,11 +42,11 @@ PassRefPtr<HTMLPreElement> HTMLPreElement::create(const QualifiedName& tagName,
     return adoptRef(new HTMLPreElement(tagName, document));
 }
 
-bool HTMLPreElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLPreElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == wrapAttr)
+    if (name == wrapAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLPreElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLPreElement.h b/Source/WebCore/html/HTMLPreElement.h
index 778204898..6c21afd59 100644
--- a/Source/WebCore/html/HTMLPreElement.h
+++ b/Source/WebCore/html/HTMLPreElement.h
@@ -34,7 +34,7 @@ public:
 private:
     HTMLPreElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLProgressElement.h b/Source/WebCore/html/HTMLProgressElement.h
index dfd006799..6ec91b93d 100644
--- a/Source/WebCore/html/HTMLProgressElement.h
+++ b/Source/WebCore/html/HTMLProgressElement.h
@@ -51,6 +51,8 @@ private:
     HTMLProgressElement(const QualifiedName&, Document*, HTMLFormElement*);
     virtual ~HTMLProgressElement();
 
+    virtual bool isLabelable() const OVERRIDE { return true; }
+
     virtual bool supportsFocus() const;
 
     virtual bool recalcWillValidate() const { return false; }
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.cpp b/Source/WebCore/html/HTMLPropertiesCollection.cpp
index 6aac467ad..68045cbba 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.cpp
+++ b/Source/WebCore/html/HTMLPropertiesCollection.cpp
@@ -39,6 +39,7 @@
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "Node.h"
+#include "StaticNodeList.h"
 
 namespace WebCore {
 
@@ -172,6 +173,48 @@ PassRefPtr<DOMStringList> HTMLPropertiesCollection::names() const
     return m_propertyNames;
 }
 
+PassRefPtr<NodeList> HTMLPropertiesCollection::namedItem(const String& name) const
+{
+    if (!base()->isHTMLElement() || !toHTMLElement(base())->fastHasAttribute(itemscopeAttr))
+      return 0;
+
+    m_properties.clear();
+    Vector<RefPtr<Node> > namedItems;
+    findPropetiesOfAnItem(base());
+
+    std::sort(m_properties.begin(), m_properties.end(), compareTreeOrder);
+
+    // For each item properties, split the value of that itemprop attribute on spaces.
+    // Add element to namedItem that contains a property named name, with the order preserved.
+    for (size_t i = 0; i < m_properties.size(); ++i) {
+        DOMSettableTokenList* itemProperty = m_properties[i]->itemProp();
+        if (itemProperty->tokens().contains(name))
+            namedItems.append(m_properties[i]);
+    }
+
+    // FIXME: HTML5 specifies that this should return PropertyNodeList.
+    return namedItems.isEmpty() ? 0 : StaticNodeList::adopt(namedItems);
+}
+
+bool HTMLPropertiesCollection::hasNamedItem(const AtomicString& name) const
+{
+    if (!base()->isHTMLElement() || !toHTMLElement(base())->fastHasAttribute(itemscopeAttr))
+        return false;
+
+    m_properties.clear();
+    findPropetiesOfAnItem(base());
+
+    // For each item properties, split the value of that itemprop attribute on spaces.
+    // Return true if element contains a property named name.
+    for (size_t i = 0; i < m_properties.size(); ++i) {
+        DOMSettableTokenList* itemProperty = m_properties[i]->itemProp();
+        if (itemProperty->tokens().contains(name))
+            return true;
+    }
+
+    return false;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(MICRODATA)
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.h b/Source/WebCore/html/HTMLPropertiesCollection.h
index 2572eebc4..46434e3a9 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.h
+++ b/Source/WebCore/html/HTMLPropertiesCollection.h
@@ -50,10 +50,14 @@ public:
 
     PassRefPtr<DOMStringList> names() const;
 
+    PassRefPtr<NodeList> namedItem(const String&) const;
+    bool hasNamedItem(const AtomicString&) const;
+
 private:
     HTMLPropertiesCollection(Node*);
 
     void findPropetiesOfAnItem(Node* current) const;
+    void getNamedItems(Vector<RefPtr<Node> >&, const String&) const;
 
     mutable Vector<Node*> m_properties;
     mutable RefPtr<DOMStringList> m_propertyNames;
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.idl b/Source/WebCore/html/HTMLPropertiesCollection.idl
index 470ab2eec..ccf66422b 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.idl
+++ b/Source/WebCore/html/HTMLPropertiesCollection.idl
@@ -32,13 +32,15 @@ module html {
 
     interface [
         Conditional=MICRODATA,
-        IndexedGetter
+        IndexedGetter,
+        NamedGetter
     ] HTMLPropertiesCollection : HTMLCollection {
         readonly attribute unsigned long length;
         Node item(in unsigned long index);
 
         readonly attribute DOMStringList names;
 
-        // FIXME: override inherited namedItem()
+        // FIXME: HTML5 specifies that this should return PropertyNodeList.
+        NodeList namedItem(in DOMString name);
     };
 }
diff --git a/Source/WebCore/html/HTMLScriptElement.cpp b/Source/WebCore/html/HTMLScriptElement.cpp
index cabc21374..a1e6c8080 100644
--- a/Source/WebCore/html/HTMLScriptElement.cpp
+++ b/Source/WebCore/html/HTMLScriptElement.cpp
@@ -54,8 +54,8 @@ bool HTMLScriptElement::isURLAttribute(Attribute* attr) const
 
 void HTMLScriptElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    ScriptElement::childrenChanged();
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    ScriptElement::childrenChanged();
 }
 
 void HTMLScriptElement::parseAttribute(Attribute* attr)
@@ -82,6 +82,8 @@ void HTMLScriptElement::insertedIntoDocument()
 
 void HTMLScriptElement::setText(const String &value)
 {
+    RefPtr<Node> protectFromMutationEvents(this);
+
     ExceptionCode ec = 0;
     int numChildren = childNodeCount();
 
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index a2c31dcda..413b771a8 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -257,15 +257,15 @@ void HTMLSelectElement::setValue(const String &value)
     setSelectedIndex(-1);
 }
 
-bool HTMLSelectElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLSelectElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr) {
+    if (name == alignAttr) {
         // Don't map 'align' attribute. This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=12072
         return false;
     }
 
-    return HTMLFormControlElementWithState::isPresentationAttribute(attr);
+    return HTMLFormControlElementWithState::isPresentationAttribute(name);
 }
 
 void HTMLSelectElement::parseAttribute(Attribute* attr)
@@ -331,6 +331,13 @@ bool HTMLSelectElement::childShouldCreateRenderer(const NodeRenderingContext& ch
     return childContext.isOnEncapsulationBoundary() && HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
 }
 
+HTMLCollection* HTMLSelectElement::selectedOptions()
+{
+    if (!m_selectedOptionsCollection)
+        m_selectedOptionsCollection = HTMLCollection::create(this, SelectedOptions);
+    return m_selectedOptionsCollection.get();
+}
+
 HTMLOptionsCollection* HTMLSelectElement::options()
 {
     if (!m_optionsCollection)
diff --git a/Source/WebCore/html/HTMLSelectElement.h b/Source/WebCore/html/HTMLSelectElement.h
index 77c081e6f..3ed61961c 100644
--- a/Source/WebCore/html/HTMLSelectElement.h
+++ b/Source/WebCore/html/HTMLSelectElement.h
@@ -63,6 +63,7 @@ public:
     void setValue(const String&);
 
     HTMLOptionsCollection* options();
+    HTMLCollection* selectedOptions();
 
     void optionElementChildrenChanged();
 
@@ -117,12 +118,13 @@ private:
     virtual bool canStartSelection() const { return false; }
 
     virtual bool isEnumeratable() const { return true; }
+    virtual bool isLabelable() const OVERRIDE { return true; }
 
     virtual bool saveFormControlState(String& value) const;
     virtual void restoreFormControlState(const String&);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
 
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle *);
@@ -177,6 +179,7 @@ private:
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     OwnPtr<HTMLOptionsCollection> m_optionsCollection;
+    OwnPtr<HTMLCollection> m_selectedOptionsCollection;
 
     // m_listItems contains HTMLOptionElement, HTMLOptGroupElement, and HTMLHRElement objects.
     mutable Vector<HTMLElement*> m_listItems;
diff --git a/Source/WebCore/html/HTMLSelectElement.idl b/Source/WebCore/html/HTMLSelectElement.idl
index 4f0b82662..b86363694 100644
--- a/Source/WebCore/html/HTMLSelectElement.idl
+++ b/Source/WebCore/html/HTMLSelectElement.idl
@@ -24,37 +24,28 @@ module html {
         IndexedGetter,
         CustomIndexedSetter
     ] HTMLSelectElement : HTMLElement {
+        attribute [Reflect] boolean autofocus;
+        attribute [Reflect] boolean disabled;
+        readonly attribute HTMLFormElement form;
+        attribute boolean multiple;
+        attribute [TreatNullAs=NullString] DOMString name;
+        attribute [Reflect] boolean required;
+        attribute long size;
+
         readonly attribute DOMString type;
-        attribute long selectedIndex;
-        attribute [TreatNullAs=NullString] DOMString value;
-        
-        // Modified in DOM Level 2:
+
+        readonly attribute HTMLOptionsCollection options;
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        // DOM Level 2 changes type of length attribute to unsigned long, 
+        // for compatibility we keep DOM Level 1 definition.
         readonly attribute long length;
 #else
         attribute unsigned long length setter raises (DOMException);
 #endif
-
-        readonly attribute HTMLFormElement form;
-        readonly attribute ValidityState validity;
-        readonly attribute boolean willValidate;
-        readonly attribute DOMString validationMessage;
-        boolean checkValidity();
-        void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
-
-        // Modified in DOM Level 2:
-        readonly attribute HTMLOptionsCollection options;
-
-        attribute [Reflect] boolean disabled;
-        attribute [Reflect] boolean autofocus;
-        attribute boolean multiple;
-        attribute [TreatNullAs=NullString] DOMString name;
-        attribute [Reflect] boolean required;
-        attribute long size;
-        
-        [ObjCLegacyUnnamedParameters] void add(in [Optional=DefaultIsUndefined] HTMLElement element, 
+        Node item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
+        Node namedItem(in [Optional=DefaultIsUndefined] DOMString name);
+        [ObjCLegacyUnnamedParameters] void add(in [Optional=DefaultIsUndefined] HTMLElement element,
                                 in [Optional=DefaultIsUndefined] HTMLElement before) raises(DOMException);
-
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // In JavaScript, we support both option index and option object parameters.
         // As of this writing this cannot be auto-generated.
@@ -62,12 +53,16 @@ module html {
 #else
         void remove(in long index);
 #endif
+        readonly attribute HTMLCollection selectedOptions;
+        attribute long selectedIndex;
+        attribute [TreatNullAs=NullString] DOMString value;
+
+        readonly attribute boolean willValidate;
+        readonly attribute ValidityState validity;
+        readonly attribute DOMString validationMessage;
+        boolean checkValidity();
+        void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
 
-        // These methods are not in DOM Level 2 IDL, but are mentioned in the standard:
-        // "The contained options can be directly accessed through the select element as a collection."
-        Node item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
-        Node namedItem(in [Optional=DefaultIsUndefined] DOMString name);
         readonly attribute NodeList labels;
     };
-
 }
diff --git a/Source/WebCore/html/HTMLStyleElement.cpp b/Source/WebCore/html/HTMLStyleElement.cpp
index 2070d56ce..b91126299 100644
--- a/Source/WebCore/html/HTMLStyleElement.cpp
+++ b/Source/WebCore/html/HTMLStyleElement.cpp
@@ -26,6 +26,8 @@
 
 #include "Attribute.h"
 #include "Document.h"
+#include "Event.h"
+#include "EventSender.h"
 #include "HTMLNames.h"
 #include "RuntimeEnabledFeatures.h"
 #include "ScriptEventListener.h"
@@ -36,9 +38,17 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static StyleEventSender& styleLoadEventSender()
+{
+    DEFINE_STATIC_LOCAL(StyleEventSender, sharedLoadEventSender, (eventNames().loadEvent));
+    return sharedLoadEventSender;
+}
+
 inline HTMLStyleElement::HTMLStyleElement(const QualifiedName& tagName, Document* document, bool createdByParser)
     : HTMLElement(tagName, document)
     , StyleElement(document, createdByParser)
+    , m_firedLoad(false)
+    , m_loadedSheet(false)
 #if ENABLE(STYLE_SCOPED)
     , m_isRegisteredWithScopingNode(false)
 #endif
@@ -51,6 +61,8 @@ HTMLStyleElement::~HTMLStyleElement()
     // During tear-down, willRemove isn't called, so m_isRegisteredWithScopingNode may still be set here.
     // Therefore we can't ASSERT(!m_isRegisteredWithScopingNode).
     StyleElement::clearDocumentData(document(), this);
+
+    styleLoadEventSender().cancelEvent(this);
 }
 
 PassRefPtr<HTMLStyleElement> HTMLStyleElement::create(const QualifiedName& tagName, Document* document, bool createdByParser)
@@ -62,6 +74,10 @@ void HTMLStyleElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == titleAttr && m_sheet)
         m_sheet->setTitle(attr->value());
+    else if (attr->name() == onloadAttr)
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onerrorAttr)
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
 #if ENABLE(STYLE_SCOPED)
     else if (attr->name() == scopedAttr) {
         if (!attr->isNull() && !m_isRegisteredWithScopingNode && inDocument())
@@ -148,7 +164,10 @@ void HTMLStyleElement::insertedIntoDocument()
 void HTMLStyleElement::removedFromDocument()
 {
 #if ENABLE(STYLE_SCOPED)
-    ASSERT(!m_isRegisteredWithScopingNode);
+    // In come cases on teardown willRemove is not called - test here for unregistering again
+    // FIXME: Do we need to bother?
+    if (m_isRegisteredWithScopingNode)
+        unregisterWithScopingNode();
 #endif
     HTMLElement::removedFromDocument();
     StyleElement::removedFromDocument(document(), this);
@@ -171,8 +190,8 @@ void HTMLStyleElement::willRemove()
 
 void HTMLStyleElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    StyleElement::childrenChanged(this);
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    StyleElement::childrenChanged(this);
 }
 
 const AtomicString& HTMLStyleElement::media() const
@@ -212,6 +231,29 @@ Element* HTMLStyleElement::scopingElement() const
 }
 #endif // ENABLE(STYLE_SCOPED)
 
+void HTMLStyleElement::dispatchPendingLoadEvents()
+{
+    styleLoadEventSender().dispatchPendingEvents();
+}
+
+void HTMLStyleElement::dispatchPendingEvent(StyleEventSender* eventSender)
+{
+    ASSERT_UNUSED(eventSender, eventSender == &styleLoadEventSender());
+    if (m_loadedSheet)
+        dispatchEvent(Event::create(eventNames().loadEvent, false, false));
+    else
+        dispatchEvent(Event::create(eventNames().errorEvent, false, false));
+}
+
+void HTMLStyleElement::notifyLoadedSheetAndAllCriticalSubresources(bool errorOccurred)
+{
+    if (m_firedLoad)
+        return;
+    m_loadedSheet = !errorOccurred;
+    styleLoadEventSender().dispatchEventSoon(this);
+    m_firedLoad = true;
+}
+
 void HTMLStyleElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {    
     HTMLElement::addSubresourceAttributeURLs(urls);
diff --git a/Source/WebCore/html/HTMLStyleElement.h b/Source/WebCore/html/HTMLStyleElement.h
index 39d140067..47f6ac653 100644
--- a/Source/WebCore/html/HTMLStyleElement.h
+++ b/Source/WebCore/html/HTMLStyleElement.h
@@ -28,8 +28,12 @@
 
 namespace WebCore {
 
+class HTMLStyleElement;
 class StyleSheet;
 
+template<typename T> class EventSender;
+typedef EventSender<HTMLStyleElement> StyleEventSender;
+
 class HTMLStyleElement : public HTMLElement, private StyleElement {
 public:
     static PassRefPtr<HTMLStyleElement> create(const QualifiedName&, Document*, bool createdByParser);
@@ -48,6 +52,9 @@ public:
     bool disabled() const;
     void setDisabled(bool);
 
+    void dispatchPendingEvent(StyleEventSender*);
+    static void dispatchPendingLoadEvents();
+
 private:
     HTMLStyleElement(const QualifiedName&, Document*, bool createdByParser);
 
@@ -64,6 +71,7 @@ private:
 
     virtual bool isLoading() const { return StyleElement::isLoading(); }
     virtual bool sheetLoaded() { return StyleElement::sheetLoaded(document()); }
+    virtual void notifyLoadedSheetAndAllCriticalSubresources(bool errorOccurred);
     virtual void startLoadingDynamicSheet() { StyleElement::startLoadingDynamicSheet(document()); }
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
@@ -74,6 +82,9 @@ private:
     void registerWithScopingNode();
     void unregisterWithScopingNode();
 
+    bool m_firedLoad;
+    bool m_loadedSheet;
+
 #if ENABLE(STYLE_SCOPED)
     bool m_isRegisteredWithScopingNode;
 #endif
diff --git a/Source/WebCore/html/HTMLSummaryElement.cpp b/Source/WebCore/html/HTMLSummaryElement.cpp
index a3494af81..5557c4556 100644
--- a/Source/WebCore/html/HTMLSummaryElement.cpp
+++ b/Source/WebCore/html/HTMLSummaryElement.cpp
@@ -31,9 +31,9 @@
 #include "MouseEvent.h"
 #include "NodeRenderingContext.h"
 #include "PlatformMouseEvent.h"
-#include "RenderSummary.h"
+#include "RenderBlock.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 
 namespace WebCore {
 
@@ -45,7 +45,7 @@ public:
 
 private:
     SummaryContentElement(Document* document)
-        : HTMLContentElement(HTMLNames::divTag, document)
+        : HTMLContentElement(HTMLNames::webkitShadowContentTag, document)
     {
     }
 };
@@ -70,7 +70,7 @@ HTMLSummaryElement::HTMLSummaryElement(const QualifiedName& tagName, Document* d
 
 RenderObject* HTMLSummaryElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderSummary(this);
+    return new (arena) RenderBlock(this);
 }
 
 bool HTMLSummaryElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
@@ -120,7 +120,7 @@ bool HTMLSummaryElement::supportsFocus() const
 
 void HTMLSummaryElement::defaultEventHandler(Event* event)
 {
-    if (isMainSummary() && renderer() && renderer()->isSummary()) {
+    if (isMainSummary() && renderer()) {
         if (event->type() == eventNames().DOMActivateEvent && !isClickableControl(event->target()->toNode())) {
             if (HTMLDetailsElement* details = detailsElement())
                 details->toggleOpen();
diff --git a/Source/WebCore/html/HTMLTableCaptionElement.cpp b/Source/WebCore/html/HTMLTableCaptionElement.cpp
index c327d0f85..4e6445bb3 100644
--- a/Source/WebCore/html/HTMLTableCaptionElement.cpp
+++ b/Source/WebCore/html/HTMLTableCaptionElement.cpp
@@ -44,11 +44,11 @@ PassRefPtr<HTMLTableCaptionElement> HTMLTableCaptionElement::create(const Qualif
     return adoptRef(new HTMLTableCaptionElement(tagName, document));
 }
 
-bool HTMLTableCaptionElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTableCaptionElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr)
+    if (name == alignAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLTableCaptionElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLTableCaptionElement.h b/Source/WebCore/html/HTMLTableCaptionElement.h
index a43141f40..4d3c1d8c0 100644
--- a/Source/WebCore/html/HTMLTableCaptionElement.h
+++ b/Source/WebCore/html/HTMLTableCaptionElement.h
@@ -37,7 +37,7 @@ public:
 private:
     HTMLTableCaptionElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLTableCellElement.cpp b/Source/WebCore/html/HTMLTableCellElement.cpp
index 7664673f3..9bf0c91f4 100644
--- a/Source/WebCore/html/HTMLTableCellElement.cpp
+++ b/Source/WebCore/html/HTMLTableCellElement.cpp
@@ -75,11 +75,11 @@ int HTMLTableCellElement::cellIndex() const
     return index;
 }
 
-bool HTMLTableCellElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTableCellElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == nowrapAttr || attr->name() == widthAttr || attr->name() == heightAttr)
+    if (name == nowrapAttr || name == widthAttr || name == heightAttr)
         return true;
-    return HTMLTablePartElement::isPresentationAttribute(attr);
+    return HTMLTablePartElement::isPresentationAttribute(name);
 }
 
 void HTMLTableCellElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLTableCellElement.h b/Source/WebCore/html/HTMLTableCellElement.h
index 7ca11271f..d1f74fd91 100644
--- a/Source/WebCore/html/HTMLTableCellElement.h
+++ b/Source/WebCore/html/HTMLTableCellElement.h
@@ -54,7 +54,7 @@ private:
     HTMLTableCellElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
diff --git a/Source/WebCore/html/HTMLTableColElement.cpp b/Source/WebCore/html/HTMLTableColElement.cpp
index db75b2544..1f4a2ff6e 100644
--- a/Source/WebCore/html/HTMLTableColElement.cpp
+++ b/Source/WebCore/html/HTMLTableColElement.cpp
@@ -47,11 +47,11 @@ PassRefPtr<HTMLTableColElement> HTMLTableColElement::create(const QualifiedName&
     return adoptRef(new HTMLTableColElement(tagName, document));
 }
 
-bool HTMLTableColElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTableColElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr)
+    if (name == widthAttr)
         return true;
-    return HTMLTablePartElement::isPresentationAttribute(attr);
+    return HTMLTablePartElement::isPresentationAttribute(name);
 }
 
 void HTMLTableColElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLTableColElement.h b/Source/WebCore/html/HTMLTableColElement.h
index 960ee8448..6cff11624 100644
--- a/Source/WebCore/html/HTMLTableColElement.h
+++ b/Source/WebCore/html/HTMLTableColElement.h
@@ -43,7 +43,7 @@ private:
     HTMLTableColElement(const QualifiedName& tagName, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
 
diff --git a/Source/WebCore/html/HTMLTableElement.cpp b/Source/WebCore/html/HTMLTableElement.cpp
index 9420d9518..cf64b37da 100644
--- a/Source/WebCore/html/HTMLTableElement.cpp
+++ b/Source/WebCore/html/HTMLTableElement.cpp
@@ -30,6 +30,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
+#include "CSSValuePool.h"
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
@@ -186,13 +187,15 @@ PassRefPtr<HTMLElement> HTMLTableElement::insertRow(int index, ExceptionCode& ec
         return 0;
     }
 
-    HTMLTableRowElement* lastRow = 0;
-    HTMLTableRowElement* row = 0;
+    RefPtr<Node> protectFromMutationEvents(this);
+
+    RefPtr<HTMLTableRowElement> lastRow = 0;
+    RefPtr<HTMLTableRowElement> row = 0;
     if (index == -1)
         lastRow = HTMLTableRowsCollection::lastRow(this);
     else {
         for (int i = 0; i <= index; ++i) {
-            row = HTMLTableRowsCollection::rowAfter(this, lastRow);
+            row = HTMLTableRowsCollection::rowAfter(this, lastRow.get());
             if (!row) {
                 if (i != index) {
                     ec = INDEX_SIZE_ERR;
@@ -204,7 +207,7 @@ PassRefPtr<HTMLElement> HTMLTableElement::insertRow(int index, ExceptionCode& ec
         }
     }
 
-    ContainerNode* parent;
+    RefPtr<ContainerNode> parent;
     if (lastRow)
         parent = row ? row->parentNode() : lastRow->parentNode();
     else {
@@ -219,7 +222,7 @@ PassRefPtr<HTMLElement> HTMLTableElement::insertRow(int index, ExceptionCode& ec
     }
 
     RefPtr<HTMLTableRowElement> newRow = HTMLTableRowElement::create(document());
-    parent->insertBefore(newRow, row, ec);
+    parent->insertBefore(newRow, row.get(), ec);
     return newRow.release();
 }
 
@@ -351,11 +354,11 @@ void HTMLTableElement::collectStyleForAttribute(Attribute* attr, StylePropertySe
         HTMLElement::collectStyleForAttribute(attr, style);
 }
 
-bool HTMLTableElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTableElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == bgcolorAttr || attr->name() == backgroundAttr || attr->name() == valignAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == cellspacingAttr || attr->name() == borderAttr || attr->name() == bordercolorAttr || attr->name() == frameAttr || attr->name() == rulesAttr)
+    if (name == widthAttr || name == heightAttr || name == bgcolorAttr || name == backgroundAttr || name == valignAttr || name == vspaceAttr || name == hspaceAttr || name == alignAttr || name == cellspacingAttr || name == borderAttr || name == bordercolorAttr || name == frameAttr || name == rulesAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLTableElement::parseAttribute(Attribute* attr)
@@ -461,49 +464,40 @@ PassRefPtr<StylePropertySet> HTMLTableElement::createSharedCellStyle()
 {
     RefPtr<StylePropertySet> style = StylePropertySet::create();
 
+    CSSValuePool* cssValuePool = document()->cssValuePool().get();
+
     switch (cellBorders()) {
     case SolidBordersColsOnly:
         style->setProperty(CSSPropertyBorderLeftWidth, CSSValueThin);
         style->setProperty(CSSPropertyBorderRightWidth, CSSValueThin);
         style->setProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
         style->setProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderColor, "inherit");
+        style->setProperty(CSSPropertyBorderColor, cssValuePool->createInheritedValue());
         break;
     case SolidBordersRowsOnly:
         style->setProperty(CSSPropertyBorderTopWidth, CSSValueThin);
         style->setProperty(CSSPropertyBorderBottomWidth, CSSValueThin);
         style->setProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
         style->setProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderColor, "inherit");
+        style->setProperty(CSSPropertyBorderColor, cssValuePool->createInheritedValue());
         break;
     case SolidBorders:
-        style->setProperty(CSSPropertyBorderWidth, "1px");
-        style->setProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderColor, "inherit");
+        style->setProperty(CSSPropertyBorderWidth, cssValuePool->createValue(1, CSSPrimitiveValue::CSS_PX));
+        style->setProperty(CSSPropertyBorderStyle, cssValuePool->createIdentifierValue(CSSValueSolid));
+        style->setProperty(CSSPropertyBorderColor, cssValuePool->createInheritedValue());
         break;
     case InsetBorders:
-        style->setProperty(CSSPropertyBorderWidth, "1px");
-        style->setProperty(CSSPropertyBorderTopStyle, CSSValueInset);
-        style->setProperty(CSSPropertyBorderBottomStyle, CSSValueInset);
-        style->setProperty(CSSPropertyBorderLeftStyle, CSSValueInset);
-        style->setProperty(CSSPropertyBorderRightStyle, CSSValueInset);
-        style->setProperty(CSSPropertyBorderColor, "inherit");
+        style->setProperty(CSSPropertyBorderWidth, cssValuePool->createValue(1, CSSPrimitiveValue::CSS_PX));
+        style->setProperty(CSSPropertyBorderStyle, cssValuePool->createIdentifierValue(CSSValueInset));
+        style->setProperty(CSSPropertyBorderColor, cssValuePool->createInheritedValue());
         break;
     case NoBorders:
-        style->setProperty(CSSPropertyBorderWidth, "0");
+        style->setProperty(CSSPropertyBorderWidth, cssValuePool->createValue(0, CSSPrimitiveValue::CSS_PX));
         break;
     }
 
-    if (m_padding) {
-        String value = String::number(m_padding) + "px";
-        style->setProperty(CSSPropertyPaddingTop, value);
-        style->setProperty(CSSPropertyPaddingBottom, value);
-        style->setProperty(CSSPropertyPaddingLeft, value);
-        style->setProperty(CSSPropertyPaddingRight, value);
-    }
+    if (m_padding)
+        style->setProperty(CSSPropertyPadding, cssValuePool->createValue(m_padding, CSSPrimitiveValue::CSS_PX));
 
     return style.release();
 }
@@ -545,12 +539,6 @@ StylePropertySet* HTMLTableElement::additionalGroupStyle(bool rows)
     return columnBorderStyle;
 }
 
-void HTMLTableElement::attach()
-{
-    ASSERT(!attached());
-    HTMLElement::attach();
-}
-
 bool HTMLTableElement::isURLAttribute(Attribute *attr) const
 {
     return attr->name() == backgroundAttr || HTMLElement::isURLAttribute(attr);
diff --git a/Source/WebCore/html/HTMLTableElement.h b/Source/WebCore/html/HTMLTableElement.h
index d9b86a8fc..410c3c6fd 100644
--- a/Source/WebCore/html/HTMLTableElement.h
+++ b/Source/WebCore/html/HTMLTableElement.h
@@ -64,8 +64,6 @@ public:
     String rules() const;
     String summary() const;
 
-    virtual void attach();
-
     StylePropertySet* additionalCellStyle();
     StylePropertySet* additionalGroupStyle(bool rows);
 
@@ -73,7 +71,7 @@ private:
     HTMLTableElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual bool isURLAttribute(Attribute*) const;
 
diff --git a/Source/WebCore/html/HTMLTablePartElement.cpp b/Source/WebCore/html/HTMLTablePartElement.cpp
index 8a39260af..c6fb149f5 100644
--- a/Source/WebCore/html/HTMLTablePartElement.cpp
+++ b/Source/WebCore/html/HTMLTablePartElement.cpp
@@ -38,11 +38,11 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-bool HTMLTablePartElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTablePartElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == bgcolorAttr || attr->name() == backgroundAttr || attr->name() == bordercolorAttr || attr->name() == valignAttr || attr->name() == alignAttr || attr->name() == heightAttr)
+    if (name == bgcolorAttr || name == backgroundAttr || name == bordercolorAttr || name == valignAttr || name == alignAttr || name == heightAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLTablePartElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLTablePartElement.h b/Source/WebCore/html/HTMLTablePartElement.h
index 49f75b3d5..d07068379 100644
--- a/Source/WebCore/html/HTMLTablePartElement.h
+++ b/Source/WebCore/html/HTMLTablePartElement.h
@@ -39,7 +39,7 @@ protected:
     {
     }
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     HTMLTableElement* findParentTable() const;
diff --git a/Source/WebCore/html/HTMLTagNames.in b/Source/WebCore/html/HTMLTagNames.in
index 62ba50100..bdbf33824 100644
--- a/Source/WebCore/html/HTMLTagNames.in
+++ b/Source/WebCore/html/HTMLTagNames.in
@@ -31,7 +31,8 @@ code interfaceName=HTMLElement
 col interfaceName=HTMLTableColElement
 colgroup interfaceName=HTMLTableColElement
 command interfaceName=HTMLElement
-content interfaceName=HTMLContentElement, conditional=SHADOW_DOM
+content interfaceName=HTMLContentElement, conditional=SHADOW_DOM, runtimeConditional=shadowDOM
+webkitShadowContent interfaceName=HTMLElement, noConstructor
 datalist interfaceName=HTMLDataListElement, conditional=DATALIST
 dd interfaceName=HTMLElement
 del interfaceName=HTMLModElement
@@ -73,7 +74,7 @@ kbd interfaceName=HTMLElement
 keygen constructorNeedsFormElement
 label
 layer interfaceName=HTMLElement
-legend constructorNeedsFormElement
+legend
 li interfaceName=HTMLLIElement
 link constructorNeedsCreatedByParser
 listing interfaceName=HTMLPreElement
@@ -90,10 +91,10 @@ noframes interfaceName=HTMLElement
 nolayer interfaceName=HTMLElement
 object constructorNeedsFormElement, constructorNeedsCreatedByParser
 ol interfaceName=HTMLOListElement
-optgroup interfaceName=HTMLOptGroupElement, constructorNeedsFormElement
+optgroup interfaceName=HTMLOptGroupElement
 option constructorNeedsFormElement
 output constructorNeedsFormElement
-shadow interfaceName=HTMLShadowElement, conditional=SHADOW_DOM
+shadow interfaceName=HTMLShadowElement, conditional=SHADOW_DOM, runtimeConditional=shadowDOM
 p interfaceName=HTMLParagraphElement
 param
 plaintext interfaceName=HTMLElement
diff --git a/Source/WebCore/html/HTMLTextAreaElement.cpp b/Source/WebCore/html/HTMLTextAreaElement.cpp
index f110ef695..347eccf46 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.cpp
+++ b/Source/WebCore/html/HTMLTextAreaElement.cpp
@@ -38,7 +38,7 @@
 #include "HTMLNames.h"
 #include "RenderTextControlMultiLine.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "Text.h"
 #include "TextControlInnerElements.h"
 #include "TextIterator.h"
@@ -112,24 +112,24 @@ void HTMLTextAreaElement::restoreFormControlState(const String& state)
 
 void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
+    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     setLastChangeWasNotUserEdit();
     if (!m_isDirty)
         setNonDirtyValue(defaultValue());
     setInnerTextValue(value());
-    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
-bool HTMLTextAreaElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTextAreaElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr) {
+    if (name == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=7075
         return false;
     }
 
-    if (attr->name() == wrapAttr)
+    if (name == wrapAttr)
         return true;
-    return HTMLTextFormControlElement::isPresentationAttribute(attr);
+    return HTMLTextFormControlElement::isPresentationAttribute(name);
 }
 
 void HTMLTextAreaElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -294,7 +294,7 @@ String HTMLTextAreaElement::sanitizeUserInputValue(const String& proposedValue,
 
 HTMLElement* HTMLTextAreaElement::innerTextElement() const
 {
-    Node* node = shadowRootList()->oldestShadowRoot()->firstChild();
+    Node* node = shadowTree()->oldestShadowRoot()->firstChild();
     ASSERT(!node || node->hasTagName(divTag));
     return toHTMLElement(node);
 }
@@ -384,8 +384,9 @@ String HTMLTextAreaElement::defaultValue() const
 
 void HTMLTextAreaElement::setDefaultValue(const String& defaultValue)
 {
-    // To preserve comments, remove only the text nodes, then add a single text node.
+    RefPtr<Node> protectFromMutationEvents(this);
 
+    // To preserve comments, remove only the text nodes, then add a single text node.
     Vector<RefPtr<Node> > textNodes;
     for (Node* n = firstChild(); n; n = n->nextSibling()) {
         if (n->isTextNode())
@@ -471,7 +472,7 @@ void HTMLTextAreaElement::updatePlaceholderText()
     String placeholderText = strippedPlaceholder();
     if (placeholderText.isEmpty()) {
         if (m_placeholder) {
-            shadowRootList()->oldestShadowRoot()->removeChild(m_placeholder.get(), ec);
+            shadowTree()->oldestShadowRoot()->removeChild(m_placeholder.get(), ec);
             ASSERT(!ec);
             m_placeholder.clear();
         }
@@ -480,7 +481,7 @@ void HTMLTextAreaElement::updatePlaceholderText()
     if (!m_placeholder) {
         m_placeholder = HTMLDivElement::create(document());
         m_placeholder->setShadowPseudoId("-webkit-input-placeholder");
-        shadowRootList()->oldestShadowRoot()->insertBefore(m_placeholder, shadowRootList()->oldestShadowRoot()->firstChild()->nextSibling(), ec);
+        shadowTree()->oldestShadowRoot()->insertBefore(m_placeholder, shadowTree()->oldestShadowRoot()->firstChild()->nextSibling(), ec);
         ASSERT(!ec);
     }
     m_placeholder->setInnerText(placeholderText, ec);
diff --git a/Source/WebCore/html/HTMLTextAreaElement.h b/Source/WebCore/html/HTMLTextAreaElement.h
index 615af2585..d07c7a583 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.h
+++ b/Source/WebCore/html/HTMLTextAreaElement.h
@@ -84,6 +84,7 @@ private:
     virtual void subtreeHasChanged();
 
     virtual bool isEnumeratable() const { return true; }
+    virtual bool isLabelable() const OVERRIDE { return true; }
 
     virtual const AtomicString& formControlType() const;
 
@@ -94,7 +95,7 @@ private:
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool appendFormData(FormDataList&, bool);
diff --git a/Source/WebCore/html/HTMLTextAreaElement.idl b/Source/WebCore/html/HTMLTextAreaElement.idl
index f6ed37503..f9d80b5ad 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.idl
+++ b/Source/WebCore/html/HTMLTextAreaElement.idl
@@ -22,13 +22,11 @@
 module html {
 
     interface HTMLTextAreaElement : HTMLElement {
-        attribute [TreatNullAs=NullString] DOMString defaultValue;
-        readonly attribute HTMLFormElement form;
-        readonly attribute ValidityState validity;
+        attribute [Reflect] boolean autofocus;
         attribute long cols;
         attribute [Reflect] DOMString dirName;
         attribute [Reflect] boolean disabled;
-        attribute [Reflect] boolean autofocus;
+        readonly attribute HTMLFormElement form;
         attribute long maxLength setter raises(DOMException);
         attribute [TreatNullAs=NullString] DOMString name;
         attribute [Reflect] DOMString placeholder;
@@ -36,32 +34,34 @@ module html {
         attribute [Reflect] boolean required;
         attribute long rows;
         attribute [Reflect] DOMString wrap;
+
         readonly attribute DOMString type;
+        attribute [TreatNullAs=NullString] DOMString defaultValue;
         attribute [TreatNullAs=NullString] DOMString value;
         readonly attribute unsigned long textLength;
 
-#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        attribute [Reflect] DOMString accessKey;
-#endif
-        void select();
-
         readonly attribute boolean willValidate;
+        readonly attribute ValidityState validity;
         readonly attribute DOMString validationMessage;
         boolean checkValidity();
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
 
-        // WinIE & FireFox extension:
+        readonly attribute NodeList labels;
+
+        void select();
         attribute long selectionStart;
         attribute long selectionEnd;
         attribute DOMString selectionDirection;
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         void setSelectionRange(in long start, in long end);
 #else
-        void setSelectionRange(in [Optional=DefaultIsUndefined] long start, 
-                               in [Optional=DefaultIsUndefined] long end, 
+        void setSelectionRange(in [Optional=DefaultIsUndefined] long start,
+                               in [Optional=DefaultIsUndefined] long end,
                                in [Optional] DOMString direction);
 #endif
-        readonly attribute NodeList labels;
-    };
 
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
+    };
 }
diff --git a/Source/WebCore/html/HTMLTitleElement.cpp b/Source/WebCore/html/HTMLTitleElement.cpp
index 6e7884b8b..f4889174c 100644
--- a/Source/WebCore/html/HTMLTitleElement.cpp
+++ b/Source/WebCore/html/HTMLTitleElement.cpp
@@ -58,10 +58,10 @@ void HTMLTitleElement::removedFromDocument()
 
 void HTMLTitleElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
+    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     m_title = textWithDirection();
     if (inDocument())
         document()->setTitleElement(m_title, this);
-    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
 String HTMLTitleElement::text() const
@@ -88,12 +88,14 @@ StringWithDirection HTMLTitleElement::textWithDirection()
 
 void HTMLTitleElement::setText(const String &value)
 {
+    RefPtr<Node> protectFromMutationEvents(this);
+
     ExceptionCode ec = 0;
     int numChildren = childNodeCount();
     
     if (numChildren == 1 && firstChild()->isTextNode())
         toText(firstChild())->setData(value, ec);
-    else {  
+    else {
         // We make a copy here because entity of "value" argument can be Document::m_title,
         // which goes empty during removeChildren() invocation below,
         // which causes HTMLTitleElement::childrenChanged(), which ends up Document::setTitle().
diff --git a/Source/WebCore/html/HTMLTrackElement.idl b/Source/WebCore/html/HTMLTrackElement.idl
index cee39d3b8..0107df5a3 100644
--- a/Source/WebCore/html/HTMLTrackElement.idl
+++ b/Source/WebCore/html/HTMLTrackElement.idl
@@ -32,13 +32,13 @@ module html {
         attribute DOMString kind;
         attribute DOMString srclang;
         attribute DOMString label;
-        attribute [Reflect=default] boolean isDefault;
+        attribute [Reflect] boolean default;
 
         const unsigned short NONE = 0;
         const unsigned short LOADING = 1;
         const unsigned short LOADED = 2;
         // Reflect is used for ERROR because it conflicts with a windows define.
-        const [Reflect=TRACK_ERROR] unsigned short ERROR = 3;
+        [Reflect=TRACK_ERROR] const unsigned short ERROR = 3;
         readonly attribute unsigned short readyState;
 
         readonly attribute TextTrack track;
diff --git a/Source/WebCore/html/HTMLUListElement.cpp b/Source/WebCore/html/HTMLUListElement.cpp
index e18d2a71c..6e9a405ef 100644
--- a/Source/WebCore/html/HTMLUListElement.cpp
+++ b/Source/WebCore/html/HTMLUListElement.cpp
@@ -47,11 +47,11 @@ PassRefPtr<HTMLUListElement> HTMLUListElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLUListElement(tagName, document));
 }
 
-bool HTMLUListElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLUListElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == typeAttr)
+    if (name == typeAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLUListElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLUListElement.h b/Source/WebCore/html/HTMLUListElement.h
index ea6510da0..0f27514c6 100644
--- a/Source/WebCore/html/HTMLUListElement.h
+++ b/Source/WebCore/html/HTMLUListElement.h
@@ -35,7 +35,7 @@ public:
 private:
     HTMLUListElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLUnknownElement.h b/Source/WebCore/html/HTMLUnknownElement.h
index b1259c580..28ca8378d 100644
--- a/Source/WebCore/html/HTMLUnknownElement.h
+++ b/Source/WebCore/html/HTMLUnknownElement.h
@@ -41,6 +41,10 @@ public:
         return adoptRef(new HTMLUnknownElement(tagName, document));
     }
 
+#ifndef NDEBUG
+    virtual bool isHTMLUnknownElement() const OVERRIDE { return true; }
+#endif
+
 private:
     HTMLUnknownElement(const QualifiedName& tagName, Document* document)
         : HTMLElement(tagName, document)
@@ -48,6 +52,12 @@ private:
     }
 };
 
+inline HTMLUnknownElement* toHTMLUnknownElement(HTMLElement* element)
+{
+    ASSERT(!element || element->isHTMLUnknownElement());
+    return static_cast<HTMLUnknownElement*>(element);
+}
+
 } // namespace
 
 #endif
diff --git a/Source/WebCore/html/HTMLVideoElement.cpp b/Source/WebCore/html/HTMLVideoElement.cpp
index 64428d815..d6d74565a 100644
--- a/Source/WebCore/html/HTMLVideoElement.cpp
+++ b/Source/WebCore/html/HTMLVideoElement.cpp
@@ -105,11 +105,11 @@ void HTMLVideoElement::collectStyleForAttribute(Attribute* attr, StylePropertySe
         HTMLMediaElement::collectStyleForAttribute(attr, style);
 }
 
-bool HTMLVideoElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLVideoElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr)
+    if (name == widthAttr || name == heightAttr)
         return true;
-    return HTMLMediaElement::isPresentationAttribute(attr);
+    return HTMLMediaElement::isPresentationAttribute(name);
 }
 
 void HTMLVideoElement::parseAttribute(Attribute* attr)
diff --git a/Source/WebCore/html/HTMLVideoElement.h b/Source/WebCore/html/HTMLVideoElement.h
index 59efd882b..056b83561 100644
--- a/Source/WebCore/html/HTMLVideoElement.h
+++ b/Source/WebCore/html/HTMLVideoElement.h
@@ -76,7 +76,7 @@ private:
     virtual void attach();
     virtual void detach();
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual bool isVideo() const { return true; }
     virtual bool hasVideo() const { return player() && player()->hasVideo(); }
diff --git a/Source/WebCore/html/HiddenInputType.cpp b/Source/WebCore/html/HiddenInputType.cpp
index 951b6d826..4efb8d60f 100644
--- a/Source/WebCore/html/HiddenInputType.cpp
+++ b/Source/WebCore/html/HiddenInputType.cpp
@@ -57,7 +57,7 @@ bool HiddenInputType::saveFormControlState(String& result) const
     return true;
 }
 
-void HiddenInputType::restoreFormControlState(const String& string) const
+void HiddenInputType::restoreFormControlState(const String& string)
 {
     element()->setAttribute(valueAttr, string);
 }
diff --git a/Source/WebCore/html/HiddenInputType.h b/Source/WebCore/html/HiddenInputType.h
index 9e8982c54..40af7d75f 100644
--- a/Source/WebCore/html/HiddenInputType.h
+++ b/Source/WebCore/html/HiddenInputType.h
@@ -43,7 +43,7 @@ private:
     HiddenInputType(HTMLInputElement* element) : InputType(element) { }
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual bool saveFormControlState(String&) const OVERRIDE;
-    virtual void restoreFormControlState(const String&) const OVERRIDE;
+    virtual void restoreFormControlState(const String&) OVERRIDE;
     virtual bool supportsValidation() const OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
     virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index f34b93b5f..136638292 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -56,7 +56,7 @@
 #include "ResetInputType.h"
 #include "SearchInputType.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SubmitInputType.h"
 #include "TelephoneInputType.h"
 #include "TextInputType.h"
@@ -160,7 +160,7 @@ bool InputType::saveFormControlState(String& result) const
     return true;
 }
 
-void InputType::restoreFormControlState(const String& state) const
+void InputType::restoreFormControlState(const String& state)
 {
     element()->setValue(state);
 }
@@ -382,7 +382,7 @@ void InputType::destroyShadowSubtree()
     if (!element()->hasShadowRoot())
         return;
 
-    if (ShadowRoot* root = element()->shadowRootList()->oldestShadowRoot())
+    if (ShadowRoot* root = element()->shadowTree()->oldestShadowRoot())
         root->removeAllChildren();
 }
 
diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
index 6b0f9c15a..04b580cb8 100644
--- a/Source/WebCore/html/InputType.h
+++ b/Source/WebCore/html/InputType.h
@@ -115,7 +115,7 @@ public:
     // Form value functions
 
     virtual bool saveFormControlState(String&) const;
-    virtual void restoreFormControlState(const String&) const;
+    virtual void restoreFormControlState(const String&);
     virtual bool isFormDataAppendable() const;
     virtual bool appendFormData(FormDataList&, bool multipart) const;
 
diff --git a/Source/WebCore/html/LabelableElement.cpp b/Source/WebCore/html/LabelableElement.cpp
new file mode 100644
index 000000000..45b41b0eb
--- /dev/null
+++ b/Source/WebCore/html/LabelableElement.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2001 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "LabelableElement.h"
+
+#include "ElementRareData.h"
+#include "LabelsNodeList.h"
+#include "RenderStyle.h"
+
+namespace WebCore {
+
+LabelableElement::LabelableElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
+{
+}
+
+LabelableElement::~LabelableElement()
+{
+}
+
+PassRefPtr<NodeList> LabelableElement::labels()
+{
+    if (!isLabelable())
+        return 0;
+    if (!document())
+        return 0;
+
+    NodeListsNodeData* nodeLists = Node::ensureRareData()->ensureNodeLists(this);
+    if (nodeLists->m_labelsNodeListCache)
+        return nodeLists->m_labelsNodeListCache;
+
+    RefPtr<LabelsNodeList> list = LabelsNodeList::create(this);
+    nodeLists->m_labelsNodeListCache = list.get();
+    return list.release();
+}
+
+} // namespace Webcore
diff --git a/Source/WebCore/html/LabelableElement.h b/Source/WebCore/html/LabelableElement.h
new file mode 100644
index 000000000..918307fce
--- /dev/null
+++ b/Source/WebCore/html/LabelableElement.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LabelableElement_h
+#define LabelableElement_h
+
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+// LabelableElement represents "labelable element" defined in the HTML
+// specification, and provides the implementation of the "labels" attribute.
+class LabelableElement : public HTMLElement {
+public:
+    virtual ~LabelableElement();
+    virtual bool isLabelable() const { return false; }
+    PassRefPtr<NodeList> labels();
+
+protected:
+    LabelableElement(const QualifiedName& tagName, Document*);
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/html/PasswordInputType.cpp b/Source/WebCore/html/PasswordInputType.cpp
index c11d3c63d..88bb842b6 100644
--- a/Source/WebCore/html/PasswordInputType.cpp
+++ b/Source/WebCore/html/PasswordInputType.cpp
@@ -54,7 +54,7 @@ bool PasswordInputType::saveFormControlState(String&) const
     return false;
 }
 
-void PasswordInputType::restoreFormControlState(const String&) const
+void PasswordInputType::restoreFormControlState(const String&)
 {
     // Should never save/restore password fields.
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/html/PasswordInputType.h b/Source/WebCore/html/PasswordInputType.h
index 10680acb2..5267dde63 100644
--- a/Source/WebCore/html/PasswordInputType.h
+++ b/Source/WebCore/html/PasswordInputType.h
@@ -43,7 +43,7 @@ private:
     PasswordInputType(HTMLInputElement* element) : BaseTextInputType(element) { }
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual bool saveFormControlState(String&) const OVERRIDE;
-    virtual void restoreFormControlState(const String&) const OVERRIDE;
+    virtual void restoreFormControlState(const String&) OVERRIDE;
     virtual bool shouldUseInputMethod() const OVERRIDE;
     virtual bool shouldResetOnDocumentActivation() OVERRIDE;
     virtual bool shouldRespectListAttribute() OVERRIDE;
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index a174ce7af..4faf786e6 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -42,7 +42,7 @@
 #include "PlatformMouseEvent.h"
 #include "RenderSlider.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SliderThumbElement.h"
 #include "StepRange.h"
 #include <limits>
@@ -161,7 +161,7 @@ void RangeInputType::handleMouseDownEvent(MouseEvent* event)
     if (event->button() != LeftButton || !targetNode)
         return;
     ASSERT(element()->hasShadowRoot());
-    if (targetNode != element() && !targetNode->isDescendantOf(element()->shadowRootList()->oldestShadowRoot()))
+    if (targetNode != element() && !targetNode->isDescendantOf(element()->shadowTree()->oldestShadowRoot()))
         return;
     SliderThumbElement* thumb = sliderThumbElementOf(element());
     if (targetNode == thumb)
@@ -247,7 +247,7 @@ void RangeInputType::createShadowSubtree()
     RefPtr<HTMLElement> container = SliderContainerElement::create(document);
     container->appendChild(track.release(), ec);
     container->appendChild(TrackLimiterElement::create(document), ec);
-    element()->shadowRootList()->oldestShadowRoot()->appendChild(container.release(), ec);
+    element()->shadowTree()->oldestShadowRoot()->appendChild(container.release(), ec);
 }
 
 RenderObject* RangeInputType::createRenderer(RenderArena* arena, RenderStyle*) const
@@ -271,7 +271,7 @@ String RangeInputType::serialize(double value) const
     return serializeForNumberType(value);
 }
 
-// FIXME: Could share this with BaseButtonInputType and BaseCheckableInputType if we had a common base class.
+// FIXME: Could share this with BaseClickableWithKeyInputType and BaseCheckableInputType if we had a common base class.
 void RangeInputType::accessKeyAction(bool sendMouseEvents)
 {
     InputType::accessKeyAction(sendMouseEvents);
diff --git a/Source/WebCore/html/TextFieldInputType.cpp b/Source/WebCore/html/TextFieldInputType.cpp
index d56f47d4e..a149b6957 100644
--- a/Source/WebCore/html/TextFieldInputType.cpp
+++ b/Source/WebCore/html/TextFieldInputType.cpp
@@ -43,7 +43,7 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "TextControlInnerElements.h"
 #include "TextEvent.h"
 #include "TextIterator.h"
@@ -226,11 +226,11 @@ void TextFieldInputType::createShadowSubtree()
     ExceptionCode ec = 0;
     m_innerText = TextControlInnerTextElement::create(document);
     if (!createsContainer) {
-        element()->shadowRootList()->oldestShadowRoot()->appendChild(m_innerText, ec);
+        element()->shadowTree()->oldestShadowRoot()->appendChild(m_innerText, ec);
         return;
     }
 
-    ShadowRoot* shadowRoot = element()->shadowRootList()->oldestShadowRoot();
+    ShadowRoot* shadowRoot = element()->shadowTree()->oldestShadowRoot();
     m_container = HTMLDivElement::create(document);
     m_container->setShadowPseudoId("-webkit-textfield-decoration-container");
     shadowRoot->appendChild(m_container, ec);
@@ -392,7 +392,7 @@ void TextFieldInputType::updatePlaceholderText()
     if (!m_placeholder) {
         m_placeholder = HTMLDivElement::create(element()->document());
         m_placeholder->setShadowPseudoId("-webkit-input-placeholder");
-        element()->shadowRootList()->oldestShadowRoot()->insertBefore(m_placeholder, m_container ? m_container->nextSibling() : innerTextElement()->nextSibling(), ec);
+        element()->shadowTree()->oldestShadowRoot()->insertBefore(m_placeholder, m_container ? m_container->nextSibling() : innerTextElement()->nextSibling(), ec);
         ASSERT(!ec);
     }
     m_placeholder->setInnerText(placeholderText, ec);
diff --git a/Source/WebCore/html/ValidationMessage.cpp b/Source/WebCore/html/ValidationMessage.cpp
index 7653951b0..9700f844e 100644
--- a/Source/WebCore/html/ValidationMessage.cpp
+++ b/Source/WebCore/html/ValidationMessage.cpp
@@ -44,7 +44,7 @@
 #include "RenderObject.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "Text.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -187,7 +187,7 @@ void ValidationMessage::deleteBubbleTree(Timer<ValidationMessage>*)
         m_messageBody = 0;
         HTMLElement* host = toHTMLElement(m_element);
         ExceptionCode ec;
-        host->shadowRootList()->oldestShadowRoot()->removeChild(m_bubble.get(), ec);
+        host->shadowTree()->oldestShadowRoot()->removeChild(m_bubble.get(), ec);
         m_bubble = 0;
     }
     m_message = String();
diff --git a/Source/WebCore/html/canvas/ArrayBuffer.idl b/Source/WebCore/html/canvas/ArrayBuffer.idl
index a631b138c..26dd341bb 100644
--- a/Source/WebCore/html/canvas/ArrayBuffer.idl
+++ b/Source/WebCore/html/canvas/ArrayBuffer.idl
@@ -28,6 +28,7 @@ module html {
     interface [
         JSGenerateIsReachable=Impl,
         CustomConstructor,
+        ConstructorParameters=1,
         JSNoStaticTables
     ] ArrayBuffer {
         readonly attribute int byteLength;
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 0d195ac50..279b2a1c3 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -1365,7 +1365,7 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* sourceCanvas, const
         c->drawImageBuffer(buffer, ColorSpaceDeviceRGB, dstRect, bufferSrcRect, state().m_globalComposite);
         didDrawEntireCanvas();
     } else if (isFullCanvasCompositeMode(state().m_globalComposite)) {
-        fullCanvasCompositedDrawImage(buffer, ColorSpaceDeviceRGB, bufferSrcRect, srcRect, state().m_globalComposite);
+        fullCanvasCompositedDrawImage(buffer, ColorSpaceDeviceRGB, dstRect, bufferSrcRect, state().m_globalComposite);
         didDrawEntireCanvas();
     } else if (state().m_globalComposite == CompositeCopy) {
         clearCanvas();
@@ -1521,7 +1521,7 @@ template<class T> IntRect CanvasRenderingContext2D::calculateCompositingBufferRe
 PassOwnPtr<ImageBuffer> CanvasRenderingContext2D::createCompositingBuffer(const IntRect& bufferRect)
 {
     RenderingMode renderMode = isAccelerated() ? Accelerated : Unaccelerated;
-    return ImageBuffer::create(bufferRect.size(), ColorSpaceDeviceRGB, renderMode);
+    return ImageBuffer::create(bufferRect.size(), 1, ColorSpaceDeviceRGB, renderMode);
 }
 
 void CanvasRenderingContext2D::compositeBuffer(ImageBuffer* buffer, const IntRect& bufferRect, CompositeOperator op)
@@ -1883,7 +1883,7 @@ void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy,
     IntSize destOffset(static_cast<int>(dx), static_cast<int>(dy));
     IntRect destRect = enclosingIntRect(clipRect);
     destRect.move(destOffset);
-    destRect.intersect(IntRect(IntPoint(), buffer->size()));
+    destRect.intersect(IntRect(IntPoint(), buffer->internalSize()));
     if (destRect.isEmpty())
         return;
     IntRect sourceRect(destRect);
@@ -2028,7 +2028,7 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
     RenderStyle* computedStyle = canvas()->computedStyle();
     TextDirection direction = computedStyle ? computedStyle->direction() : LTR;
     bool isRTL = direction == RTL;
-    bool override = computedStyle ? computedStyle->unicodeBidi() == Override : false;
+    bool override = computedStyle ? isOverride(computedStyle->unicodeBidi()) : false;
 
     unsigned length = text.length();
     const UChar* string = text.characters();
@@ -2089,9 +2089,9 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         IntRect maskRect = enclosingIntRect(textRect);
 
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
-        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), ColorSpaceDeviceRGB, Accelerated);
+        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), 1, ColorSpaceDeviceRGB, Accelerated);
 #else
-        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size());
+        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), 1);
 #endif
 
         GraphicsContext* maskImageContext = maskImage->context();
diff --git a/Source/WebCore/html/canvas/CanvasStyle.cpp b/Source/WebCore/html/canvas/CanvasStyle.cpp
index 3ed1fee58..26e310ecd 100644
--- a/Source/WebCore/html/canvas/CanvasStyle.cpp
+++ b/Source/WebCore/html/canvas/CanvasStyle.cpp
@@ -69,7 +69,7 @@ RGBA32 currentColor(HTMLCanvasElement* canvas)
     if (!canvas || !canvas->inDocument())
         return Color::black;
     RGBA32 rgba = Color::black;
-    CSSParser::parseColor(rgba, canvas->ensureInlineStyleDecl()->getPropertyValue(CSSPropertyColor));
+    CSSParser::parseColor(rgba, canvas->ensureInlineStyle()->getPropertyValue(CSSPropertyColor));
     return rgba;
 }
 
diff --git a/Source/WebCore/html/canvas/DOMWindowWebGL.idl b/Source/WebCore/html/canvas/DOMWindowWebGL.idl
deleted file mode 100644
index 92056d3da..000000000
--- a/Source/WebCore/html/canvas/DOMWindowWebGL.idl
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    interface [
-        Conditional=WEBGL,
-        Supplemental=DOMWindow
-    ] DOMWindowWebGL {
-        attribute WebGLActiveInfoConstructor WebGLActiveInfo;
-        attribute WebGLBufferConstructor WebGLBuffer;
-        attribute WebGLFramebufferConstructor WebGLFramebuffer;
-        attribute WebGLProgramConstructor WebGLProgram;
-        attribute WebGLRenderbufferConstructor WebGLRenderbuffer;
-        attribute WebGLRenderingContextConstructor WebGLRenderingContext;
-        attribute WebGLShaderConstructor WebGLShader;
-        attribute WebGLTextureConstructor WebGLTexture;
-        attribute WebGLUniformLocationConstructor WebGLUniformLocation;
-    };
-
-}
diff --git a/Source/WebCore/html/canvas/DataView.idl b/Source/WebCore/html/canvas/DataView.idl
index 27bad0e47..3f4dcdf4d 100755
--- a/Source/WebCore/html/canvas/DataView.idl
+++ b/Source/WebCore/html/canvas/DataView.idl
@@ -27,6 +27,7 @@ module html {
 
     interface [
         CustomConstructor,
+        ConstructorParameters=3,
         CustomToJSObject,
         JSNoStaticTables
     ] DataView : ArrayBufferView {
diff --git a/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.cpp b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.cpp
new file mode 100644
index 000000000..26538e94e
--- /dev/null
+++ b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEBGL)
+
+#include "EXTTextureFilterAnisotropic.h"
+
+namespace WebCore {
+
+EXTTextureFilterAnisotropic::EXTTextureFilterAnisotropic(WebGLRenderingContext* context)
+    : WebGLExtension(context)
+{
+}
+
+EXTTextureFilterAnisotropic::~EXTTextureFilterAnisotropic()
+{
+}
+
+WebGLExtension::ExtensionName EXTTextureFilterAnisotropic::getName() const
+{
+    return EXTTextureFilterAnisotropicName;
+}
+
+PassOwnPtr<EXTTextureFilterAnisotropic> EXTTextureFilterAnisotropic::create(WebGLRenderingContext* context)
+{
+    return adoptPtr(new EXTTextureFilterAnisotropic(context));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.h b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.h
new file mode 100644
index 000000000..bf0d37c9c
--- /dev/null
+++ b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EXTTextureFilterAnisotropic_h
+#define EXTTextureFilterAnisotropic_h
+
+#include "WebGLExtension.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class EXTTextureFilterAnisotropic : public WebGLExtension {
+public:
+    static PassOwnPtr<EXTTextureFilterAnisotropic> create(WebGLRenderingContext*);
+
+    virtual ~EXTTextureFilterAnisotropic();
+    virtual ExtensionName getName() const;
+
+private:
+    EXTTextureFilterAnisotropic(WebGLRenderingContext*);
+};
+
+} // namespace WebCore
+
+#endif // EXTTextureFilterAnisotropic_h
diff --git a/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.idl b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.idl
new file mode 100644
index 000000000..568aa9a3d
--- /dev/null
+++ b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        Conditional=WEBGL,
+        JSGenerateIsReachable=ImplContext,
+        OmitConstructor,
+        DoNotCheckConstants
+    ] EXTTextureFilterAnisotropic {
+        const unsigned int TEXTURE_MAX_ANISOTROPY_EXT = 0x84FE;
+        const unsigned int MAX_TEXTURE_MAX_ANISOTROPY_EXT = 0x84FF;
+    };
+}
diff --git a/Source/WebCore/html/canvas/Float32Array.idl b/Source/WebCore/html/canvas/Float32Array.idl
index 5e619a7ea..55491b11b 100644
--- a/Source/WebCore/html/canvas/Float32Array.idl
+++ b/Source/WebCore/html/canvas/Float32Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Float64Array.idl b/Source/WebCore/html/canvas/Float64Array.idl
index f4c448a45..e9d7ef01a 100644
--- a/Source/WebCore/html/canvas/Float64Array.idl
+++ b/Source/WebCore/html/canvas/Float64Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Int16Array.idl b/Source/WebCore/html/canvas/Int16Array.idl
index b7ddc1e7c..8616846f9 100644
--- a/Source/WebCore/html/canvas/Int16Array.idl
+++ b/Source/WebCore/html/canvas/Int16Array.idl
@@ -26,6 +26,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Int32Array.idl b/Source/WebCore/html/canvas/Int32Array.idl
index 950437aec..3f928fe7d 100644
--- a/Source/WebCore/html/canvas/Int32Array.idl
+++ b/Source/WebCore/html/canvas/Int32Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Int8Array.idl b/Source/WebCore/html/canvas/Int8Array.idl
index da0c8f166..0d4fb8272 100644
--- a/Source/WebCore/html/canvas/Int8Array.idl
+++ b/Source/WebCore/html/canvas/Int8Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Uint16Array.idl b/Source/WebCore/html/canvas/Uint16Array.idl
index 33627bfce..72fa9b3ed 100644
--- a/Source/WebCore/html/canvas/Uint16Array.idl
+++ b/Source/WebCore/html/canvas/Uint16Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Uint32Array.idl b/Source/WebCore/html/canvas/Uint32Array.idl
index 7bb4ca39b..b56c0e53d 100644
--- a/Source/WebCore/html/canvas/Uint32Array.idl
+++ b/Source/WebCore/html/canvas/Uint32Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Uint8Array.idl b/Source/WebCore/html/canvas/Uint8Array.idl
index fbbafc320..3e4141ca6 100644
--- a/Source/WebCore/html/canvas/Uint8Array.idl
+++ b/Source/WebCore/html/canvas/Uint8Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Uint8ClampedArray.idl b/Source/WebCore/html/canvas/Uint8ClampedArray.idl
index fd006e455..6c3587a30 100644
--- a/Source/WebCore/html/canvas/Uint8ClampedArray.idl
+++ b/Source/WebCore/html/canvas/Uint8ClampedArray.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/WebGLExtension.h b/Source/WebCore/html/canvas/WebGLExtension.h
index ff482facd..a4d397029 100644
--- a/Source/WebCore/html/canvas/WebGLExtension.h
+++ b/Source/WebCore/html/canvas/WebGLExtension.h
@@ -35,6 +35,7 @@ public:
     // Extension names are needed to properly wrap instances in JavaScript objects.
     enum ExtensionName {
         WebKitWebGLLoseContextName, // WEBKIT_ prefix until extension is official
+        EXTTextureFilterAnisotropicName,
         OESTextureFloatName,
         OESStandardDerivativesName,
         OESVertexArrayObjectName,
diff --git a/Source/WebCore/html/canvas/WebGLObject.cpp b/Source/WebCore/html/canvas/WebGLObject.cpp
index 6d7b9d8cf..c71806dae 100644
--- a/Source/WebCore/html/canvas/WebGLObject.cpp
+++ b/Source/WebCore/html/canvas/WebGLObject.cpp
@@ -29,6 +29,7 @@
 
 #include "WebGLObject.h"
 
+#include "EXTTextureFilterAnisotropic.h"
 #include "OESStandardDerivatives.h"
 #include "OESTextureFloat.h"
 #include "OESVertexArrayObject.h"
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index cfb6505a9..4ded9781d 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -34,6 +34,7 @@
 #include "CheckedInt.h"
 #include "Console.h"
 #include "DOMWindow.h"
+#include "EXTTextureFilterAnisotropic.h"
 #include "ExceptionCode.h"
 #include "Extensions3D.h"
 #include "Frame.h"
@@ -82,6 +83,7 @@
 namespace WebCore {
 
 const double secondsBetweenRestoreAttempts = 1.0;
+const int maxGLErrorsAllowedToConsole = 10;
 
 namespace {
 
@@ -378,7 +380,7 @@ private:
 class WebGLRenderingContextErrorMessageCallback : public GraphicsContext3D::ErrorMessageCallback {
 public:
     explicit WebGLRenderingContextErrorMessageCallback(WebGLRenderingContext* cb) : m_context(cb) { }
-    virtual void onErrorMessage(const String& message, GC3Dint) { m_context->printWarningToConsole(message); }
+    virtual void onErrorMessage(const String& message, GC3Dint) { m_context->printGLErrorToConsole(message); }
     virtual ~WebGLRenderingContextErrorMessageCallback() { }
 private:
     WebGLRenderingContext* m_context;
@@ -401,6 +403,7 @@ PassOwnPtr<WebGLRenderingContext> WebGLRenderingContext::create(HTMLCanvasElemen
 #else
     attributes.shareResources = false;
 #endif
+    attributes.preferDiscreteGPU = true;
 
 
     RefPtr<GraphicsContext3D> context(GraphicsContext3D::create(attributes, hostWindow));
@@ -426,6 +429,7 @@ WebGLRenderingContext::WebGLRenderingContext(HTMLCanvasElement* passedCanvas, Pa
     , m_contextLostMode(SyntheticLostContext)
     , m_attributes(attributes)
     , m_synthesizedErrorsToConsole(false)
+    , m_numGLErrorsToConsoleAllowed(maxGLErrorsAllowedToConsole)
 {
     ASSERT(m_context);
     m_contextGroup = WebGLContextGroup::create();
@@ -466,6 +470,7 @@ void WebGLRenderingContext::initializeNewContext()
     m_stencilFuncMask = 0xFFFFFFFF;
     m_stencilFuncMaskBack = 0xFFFFFFFF;
     m_layerCleared = false;
+    m_numGLErrorsToConsoleAllowed = maxGLErrorsAllowedToConsole;
     
     m_clearColor[0] = m_clearColor[1] = m_clearColor[2] = m_clearColor[3] = 0;
     m_scissorEnabled = false;
@@ -2208,6 +2213,14 @@ WebGLExtension* WebGLRenderingContext::getExtension(const String& name)
     if (isContextLost())
         return 0;
 
+    if (equalIgnoringCase(name, "WEBKIT_EXT_texture_filter_anisotropic")
+        && m_context->getExtensions()->supports("GL_EXT_texture_filter_anisotropic")) {
+        if (!m_extTextureFilterAnisotropic) {
+            m_context->getExtensions()->ensureEnabled("GL_EXT_texture_filter_anisotropic");
+            m_extTextureFilterAnisotropic = EXTTextureFilterAnisotropic::create(this);
+        }
+        return m_extTextureFilterAnisotropic.get();
+    }
     if (equalIgnoringCase(name, "OES_standard_derivatives")
         && m_context->getExtensions()->supports("GL_OES_standard_derivatives")) {
         if (!m_oesStandardDerivatives) {
@@ -2519,6 +2532,11 @@ WebGLGetInfo WebGLRenderingContext::getParameter(GC3Denum pname, ExceptionCode&
         }
         synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "getParameter", "invalid parameter name, OES_vertex_array_object not enabled");
         return WebGLGetInfo();
+    case Extensions3D::MAX_TEXTURE_MAX_ANISOTROPY_EXT: // EXT_texture_filter_anisotropic
+        if (m_extTextureFilterAnisotropic)
+            return getUnsignedIntParameter(Extensions3D::MAX_TEXTURE_MAX_ANISOTROPY_EXT);
+        synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "getParameter", "invalid parameter name, EXT_texture_filter_anisotropic not enabled");
+        return WebGLGetInfo();
     default:
         synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "getParameter", "invalid parameter name");
         return WebGLGetInfo();
@@ -2680,6 +2698,8 @@ Vector<String> WebGLRenderingContext::getSupportedExtensions()
         result.append("OES_texture_float");
     if (m_context->getExtensions()->supports("GL_OES_standard_derivatives"))
         result.append("OES_standard_derivatives");
+    if (m_context->getExtensions()->supports("GL_EXT_texture_filter_anisotropic"))
+        result.append("WEBKIT_EXT_texture_filter_anisotropic");
     if (m_context->getExtensions()->supports("GL_OES_vertex_array_object"))
         result.append("OES_vertex_array_object");
     result.append("WEBKIT_WEBGL_lose_context");
@@ -2712,6 +2732,13 @@ WebGLGetInfo WebGLRenderingContext::getTexParameter(GC3Denum target, GC3Denum pn
     case GraphicsContext3D::TEXTURE_WRAP_T:
         m_context->getTexParameteriv(target, pname, &value);
         return WebGLGetInfo(static_cast<unsigned int>(value));
+    case Extensions3D::TEXTURE_MAX_ANISOTROPY_EXT: // EXT_texture_filter_anisotropic
+        if (m_extTextureFilterAnisotropic) {
+            m_context->getTexParameteriv(target, pname, &value);
+            return WebGLGetInfo(static_cast<unsigned int>(value));
+        }
+        synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "getTexParameter", "invalid parameter name, EXT_texture_filter_anisotropic not enabled");
+        return WebGLGetInfo();
     default:
         synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "getTexParameter", "invalid parameter name");
         return WebGLGetInfo();
@@ -3535,6 +3562,12 @@ void WebGLRenderingContext::texParameter(GC3Denum target, GC3Denum pname, GC3Dfl
             return;
         }
         break;
+    case Extensions3D::TEXTURE_MAX_ANISOTROPY_EXT: // EXT_texture_filter_anisotropic
+        if (!m_extTextureFilterAnisotropic) {
+            synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "texParameter", "invalid parameter, EXT_texture_filter_anisotropic not enabled");
+            return;
+        }
+        break;
     default:
         synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "texParameter", "invalid parameter name");
         return;
@@ -3716,7 +3749,7 @@ void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, Flo
     if (isContextLost() || !validateUniformParameters("uniform1fv", location, v, 1))
         return;
 
-    m_context->uniform1fv(location->location(), v->data(), v->length());
+    m_context->uniform1fv(location->location(), v->length(), v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3726,7 +3759,7 @@ void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform1fv", location, v, size, 1))
         return;
 
-    m_context->uniform1fv(location->location(), v, size);
+    m_context->uniform1fv(location->location(), size, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3751,7 +3784,7 @@ void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, Int
     if (isContextLost() || !validateUniformParameters("uniform1iv", location, v, 1))
         return;
 
-    m_context->uniform1iv(location->location(), v->data(), v->length());
+    m_context->uniform1iv(location->location(), v->length(), v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3761,7 +3794,7 @@ void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform1iv", location, v, size, 1))
         return;
 
-    m_context->uniform1iv(location->location(), v, size);
+    m_context->uniform1iv(location->location(), size, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3786,7 +3819,7 @@ void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, Flo
     if (isContextLost() || !validateUniformParameters("uniform2fv", location, v, 2))
         return;
 
-    m_context->uniform2fv(location->location(), v->data(), v->length() / 2);
+    m_context->uniform2fv(location->location(), v->length() / 2, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3796,7 +3829,7 @@ void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform2fv", location, v, size, 2))
         return;
 
-    m_context->uniform2fv(location->location(), v, size / 2);
+    m_context->uniform2fv(location->location(), size / 2, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3821,7 +3854,7 @@ void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, Int
     if (isContextLost() || !validateUniformParameters("uniform2iv", location, v, 2))
         return;
 
-    m_context->uniform2iv(location->location(), v->data(), v->length() / 2);
+    m_context->uniform2iv(location->location(), v->length() / 2, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3831,7 +3864,7 @@ void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform2iv", location, v, size, 2))
         return;
 
-    m_context->uniform2iv(location->location(), v, size / 2);
+    m_context->uniform2iv(location->location(), size / 2, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3856,7 +3889,7 @@ void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, Flo
     if (isContextLost() || !validateUniformParameters("uniform3fv", location, v, 3))
         return;
 
-    m_context->uniform3fv(location->location(), v->data(), v->length() / 3);
+    m_context->uniform3fv(location->location(), v->length() / 3, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3866,7 +3899,7 @@ void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform3fv", location, v, size, 3))
         return;
 
-    m_context->uniform3fv(location->location(), v, size / 3);
+    m_context->uniform3fv(location->location(), size / 3, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3891,7 +3924,7 @@ void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, Int
     if (isContextLost() || !validateUniformParameters("uniform3iv", location, v, 3))
         return;
 
-    m_context->uniform3iv(location->location(), v->data(), v->length() / 3);
+    m_context->uniform3iv(location->location(), v->length() / 3, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3901,7 +3934,7 @@ void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform3iv", location, v, size, 3))
         return;
 
-    m_context->uniform3iv(location->location(), v, size / 3);
+    m_context->uniform3iv(location->location(), size / 3, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3926,7 +3959,7 @@ void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, Flo
     if (isContextLost() || !validateUniformParameters("uniform4fv", location, v, 4))
         return;
 
-    m_context->uniform4fv(location->location(), v->data(), v->length() / 4);
+    m_context->uniform4fv(location->location(), v->length() / 4, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3936,7 +3969,7 @@ void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform4fv", location, v, size, 4))
         return;
 
-    m_context->uniform4fv(location->location(), v, size / 4);
+    m_context->uniform4fv(location->location(), size / 4, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3961,7 +3994,7 @@ void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, Int
     if (isContextLost() || !validateUniformParameters("uniform4iv", location, v, 4))
         return;
 
-    m_context->uniform4iv(location->location(), v->data(), v->length() / 4);
+    m_context->uniform4iv(location->location(), v->length() / 4, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3971,7 +4004,7 @@ void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform4iv", location, v, size, 4))
         return;
 
-    m_context->uniform4iv(location->location(), v, size / 4);
+    m_context->uniform4iv(location->location(), size / 4, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3980,7 +4013,7 @@ void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix2fv", location, transpose, v, 4))
         return;
-    m_context->uniformMatrix2fv(location->location(), transpose, v->data(), v->length() / 4);
+    m_context->uniformMatrix2fv(location->location(), v->length() / 4, transpose, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3989,7 +4022,7 @@ void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix2fv", location, transpose, v, size, 4))
         return;
-    m_context->uniformMatrix2fv(location->location(), transpose, v, size / 4);
+    m_context->uniformMatrix2fv(location->location(), size / 4, transpose, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3998,7 +4031,7 @@ void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix3fv", location, transpose, v, 9))
         return;
-    m_context->uniformMatrix3fv(location->location(), transpose, v->data(), v->length() / 9);
+    m_context->uniformMatrix3fv(location->location(), v->length() / 9, transpose, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -4007,7 +4040,7 @@ void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix3fv", location, transpose, v, size, 9))
         return;
-    m_context->uniformMatrix3fv(location->location(), transpose, v, size / 9);
+    m_context->uniformMatrix3fv(location->location(), size / 9, transpose, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -4016,7 +4049,7 @@ void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix4fv", location, transpose, v, 16))
         return;
-    m_context->uniformMatrix4fv(location->location(), transpose, v->data(), v->length() / 16);
+    m_context->uniformMatrix4fv(location->location(), v->length() / 16, transpose, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -4025,7 +4058,7 @@ void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix4fv", location, transpose, v, size, 16))
         return;
-    m_context->uniformMatrix4fv(location->location(), transpose, v, size / 16);
+    m_context->uniformMatrix4fv(location->location(), size / 16, transpose, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -4883,6 +4916,18 @@ bool WebGLRenderingContext::validateStencilFunc(const char* functionName, GC3Den
     }
 }
 
+void WebGLRenderingContext::printGLErrorToConsole(const String& message)
+{
+    if (!m_numGLErrorsToConsoleAllowed)
+        return;
+
+    --m_numGLErrorsToConsoleAllowed;
+    printWarningToConsole(message);
+
+    if (!m_numGLErrorsToConsoleAllowed)
+        printWarningToConsole("WebGL: too many errors, no more errors will be reported to the console for this context.");
+}
+
 void WebGLRenderingContext::printWarningToConsole(const String& message)
 {
     if (!canvas())
@@ -5315,13 +5360,13 @@ ImageBuffer* WebGLRenderingContext::LRUImageBufferCache::imageBuffer(const IntSi
         ImageBuffer* buf = m_buffers[i].get();
         if (!buf)
             break;
-        if (buf->size() != size)
+        if (buf->logicalSize() != size)
             continue;
         bubbleToFront(i);
         return buf;
     }
 
-    OwnPtr<ImageBuffer> temp = ImageBuffer::create(size);
+    OwnPtr<ImageBuffer> temp = ImageBuffer::create(size, 1);
     if (!temp)
         return 0;
     i = std::min(m_capacity - 1, i);
@@ -5366,7 +5411,7 @@ void WebGLRenderingContext::synthesizeGLError(GC3Denum error, const char* functi
 {
     if (m_synthesizedErrorsToConsole) {
       String str = String("WebGL: ") + GetErrorString(error) +  ": " + String(functionName) + ": " + String(description);
-      printWarningToConsole(str);
+      printGLErrorToConsole(str);
     }
     m_context->synthesizeGLError(error);
 }
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index be9c8cf3c..4ebd60b6e 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -40,6 +40,7 @@
 
 namespace WebCore {
 
+class EXTTextureFilterAnisotropic;
 class HTMLImageElement;
 class HTMLVideoElement;
 class ImageBuffer;
@@ -496,8 +497,10 @@ public:
     bool m_isDepthStencilSupported;
 
     bool m_synthesizedErrorsToConsole;
+    int m_numGLErrorsToConsoleAllowed;
 
     // Enabled extension objects.
+    OwnPtr<EXTTextureFilterAnisotropic> m_extTextureFilterAnisotropic;
     OwnPtr<OESTextureFloat> m_oesTextureFloat;
     OwnPtr<OESStandardDerivatives> m_oesStandardDerivatives;
     OwnPtr<OESVertexArrayObject> m_oesVertexArrayObject;
@@ -622,6 +625,9 @@ public:
     // Helper function for texParameterf and texParameteri.
     void texParameter(GC3Denum target, GC3Denum pname, GC3Dfloat parami, GC3Dint paramf, bool isFloat);
 
+    // Helper function to print GL errors to console.
+    void printGLErrorToConsole(const String&);
+
     // Helper function to print warnings to console. Currently
     // used only to warn about use of obsolete functions.
     void printWarningToConsole(const String&);
diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.cpp b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
index e551c2ff5..9fa5d3760 100644
--- a/Source/WebCore/html/parser/HTMLConstructionSite.cpp
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
@@ -194,7 +194,7 @@ void HTMLConstructionSite::dispatchDocumentElementAvailableIfNeeded()
 void HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken& token)
 {
     RefPtr<HTMLHtmlElement> element = HTMLHtmlElement::create(m_document);
-    element->parserSetAttributeMap(token.takeAttributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token.takeAttributes(), m_fragmentScriptingPermission);
     attachLater(m_attachmentRoot, element);
     m_openElements.pushHTMLHtmlElement(element);
 
@@ -208,8 +208,8 @@ void HTMLConstructionSite::mergeAttributesFromTokenIntoElement(AtomicHTMLToken&
     if (!token.attributes())
         return;
 
-    NamedNodeMap* attributes = element->ensureUpdatedAttributes();
-    for (unsigned i = 0; i < token.attributes()->length(); ++i) {
+    ElementAttributeData* attributes = element->ensureAttributeData();
+    for (unsigned i = 0; i < token.attributes()->size(); ++i) {
         Attribute* attribute = token.attributes()->attributeItem(i);
         if (!attributes->getAttributeItem(attribute->name()))
             element->setAttribute(attribute->name(), attribute->value());
@@ -336,7 +336,7 @@ void HTMLConstructionSite::insertScriptElement(AtomicHTMLToken& token)
 {
     RefPtr<HTMLScriptElement> element = HTMLScriptElement::create(scriptTag, currentNode()->document(), true);
     if (m_fragmentScriptingPermission == FragmentScriptingAllowed)
-        element->parserSetAttributeMap(token.takeAttributes(), m_fragmentScriptingPermission);
+        element->parserSetAttributes(token.takeAttributes(), m_fragmentScriptingPermission);
     attachLater(currentNode(), element);
     m_openElements.push(element.release());
 }
@@ -399,7 +399,7 @@ PassRefPtr<Element> HTMLConstructionSite::createElement(AtomicHTMLToken& token,
 {
     QualifiedName tagName(nullAtom, token.name(), namespaceURI);
     RefPtr<Element> element = currentNode()->document()->createElement(tagName, true);
-    element->parserSetAttributeMap(token.takeAttributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token.takeAttributes(), m_fragmentScriptingPermission);
     return element.release();
 }
 
@@ -410,7 +410,7 @@ PassRefPtr<Element> HTMLConstructionSite::createHTMLElement(AtomicHTMLToken& tok
     // have to pass the current form element.  We should rework form association
     // to occur after construction to allow better code sharing here.
     RefPtr<Element> element = HTMLElementFactory::createHTMLElement(tagName, currentNode()->document(), form(), true);
-    element->parserSetAttributeMap(token.takeAttributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token.takeAttributes(), m_fragmentScriptingPermission);
     ASSERT(element->isHTMLElement());
     return element.release();
 }
@@ -423,17 +423,17 @@ PassRefPtr<Element> HTMLConstructionSite::createHTMLElementFromElementRecord(HTM
 namespace {
 
 // FIXME: Move this function to the top of the file.
-inline PassOwnPtr<NamedNodeMap> cloneAttributes(Element* element)
+inline PassOwnPtr<AttributeVector> cloneAttributes(Element* element)
 {
-    NamedNodeMap* attributes = element->updatedAttributes();
+    ElementAttributeData* attributes = element->updatedAttributeData();
     if (!attributes)
         return nullptr;
 
-    OwnPtr<NamedNodeMap> newAttributes = NamedNodeMap::create();
+    OwnPtr<AttributeVector> newAttributes = AttributeVector::create();
     for (size_t i = 0; i < attributes->length(); ++i) {
         Attribute* attribute = attributes->attributeItem(i);
         RefPtr<Attribute> clone = Attribute::create(attribute->name(), attribute->value());
-        newAttributes->addAttribute(clone);
+        newAttributes->append(clone);
     }
     return newAttributes.release();
 }
diff --git a/Source/WebCore/html/parser/HTMLToken.h b/Source/WebCore/html/parser/HTMLToken.h
index c17828434..a391d3409 100644
--- a/Source/WebCore/html/parser/HTMLToken.h
+++ b/Source/WebCore/html/parser/HTMLToken.h
@@ -86,7 +86,7 @@ class AtomicHTMLToken : public AtomicMarkupTokenBase<HTMLToken> {
 public:
     AtomicHTMLToken(HTMLToken& token) : AtomicMarkupTokenBase<HTMLToken>(&token) { }
 
-    AtomicHTMLToken(HTMLTokenTypes::Type type, AtomicString name, PassOwnPtr<NamedNodeMap> attributes = nullptr)
+    AtomicHTMLToken(HTMLTokenTypes::Type type, AtomicString name, PassOwnPtr<AttributeVector> attributes = nullptr)
         : AtomicMarkupTokenBase<HTMLToken>(type, name, attributes)
     {
     }
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 3b5414913..797e583d9 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -531,7 +531,7 @@ void HTMLTreeBuilder::processDoctypeToken(AtomicHTMLToken& token)
     parseError(token);
 }
 
-void HTMLTreeBuilder::processFakeStartTag(const QualifiedName& tagName, PassOwnPtr<NamedNodeMap> attributes)
+void HTMLTreeBuilder::processFakeStartTag(const QualifiedName& tagName, PassOwnPtr<AttributeVector> attributes)
 {
     // FIXME: We'll need a fancier conversion than just "localName" for SVG/MathML tags.
     AtomicHTMLToken fakeToken(HTMLTokenTypes::StartTag, tagName.localName(), attributes);
@@ -560,11 +560,11 @@ void HTMLTreeBuilder::processFakePEndTagIfPInButtonScope()
     processEndTag(endP);
 }
 
-PassOwnPtr<NamedNodeMap> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken& token)
+PassOwnPtr<AttributeVector> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken& token)
 {
-    OwnPtr<NamedNodeMap> attributes = token.takeAttributes();
+    OwnPtr<AttributeVector> attributes = token.takeAttributes();
     if (!attributes)
-        attributes = NamedNodeMap::create();
+        attributes = AttributeVector::create();
     else {
         attributes->removeAttribute(nameAttr);
         attributes->removeAttribute(actionAttr);
@@ -572,7 +572,7 @@ PassOwnPtr<NamedNodeMap> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLTo
     }
 
     RefPtr<Attribute> mappedAttribute = Attribute::create(nameAttr, isindexTag.localName());
-    attributes->insertAttribute(mappedAttribute.release(), false);
+    attributes->insertAttribute(mappedAttribute.release());
     return attributes.release();
 }
 
@@ -679,11 +679,11 @@ void adjustAttributes(AtomicHTMLToken& token)
         mapLoweredLocalNameToName(caseMap, attrs, length);
     }
 
-    NamedNodeMap* attributes = token.attributes();
+    AttributeVector* attributes = token.attributes();
     if (!attributes)
         return;
 
-    for (unsigned x = 0; x < attributes->length(); ++x) {
+    for (unsigned x = 0; x < attributes->size(); ++x) {
         Attribute* attribute = attributes->attributeItem(x);
         const QualifiedName& casedName = caseMap->get(attribute->localName());
         if (!casedName.localName().isNull())
@@ -728,11 +728,11 @@ void adjustForeignAttributes(AtomicHTMLToken& token)
         map->add("xmlns:xlink", QualifiedName("xmlns", "xlink", XMLNSNames::xmlnsNamespaceURI));
     }
 
-    NamedNodeMap* attributes = token.attributes();
+    AttributeVector* attributes = token.attributes();
     if (!attributes)
         return;
 
-    for (unsigned x = 0; x < attributes->length(); ++x) {
+    for (unsigned x = 0; x < attributes->size(); ++x) {
         Attribute* attribute = attributes->attributeItem(x);
         const QualifiedName& name = map->get(attribute->localName());
         if (!name.localName().isNull())
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.h b/Source/WebCore/html/parser/HTMLTreeBuilder.h
index 0183d20ca..35024f888 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.h
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.h
@@ -151,7 +151,7 @@ private:
     void processCharacterBuffer(ExternalCharacterTokenBuffer&);
     inline void processCharacterBufferForInBody(ExternalCharacterTokenBuffer&);
 
-    void processFakeStartTag(const QualifiedName&, PassOwnPtr<NamedNodeMap> attributes = nullptr);
+    void processFakeStartTag(const QualifiedName&, PassOwnPtr<AttributeVector> attributes = nullptr);
     void processFakeEndTag(const QualifiedName&);
     void processFakeCharacters(const String&);
     void processFakePEndTagIfPInButtonScope();
@@ -172,7 +172,7 @@ private:
     inline bool shouldProcessTokenInForeignContent(AtomicHTMLToken&);
     void processTokenInForeignContent(AtomicHTMLToken&);
 
-    PassOwnPtr<NamedNodeMap> attributesForIsindexInput(AtomicHTMLToken&);
+    PassOwnPtr<AttributeVector> attributesForIsindexInput(AtomicHTMLToken&);
 
     HTMLElementStack::ElementRecord* furthestBlockForFormattingElement(Element*);
     void callTheAdoptionAgency(AtomicHTMLToken&);
diff --git a/Source/WebCore/html/parser/TextDocumentParser.cpp b/Source/WebCore/html/parser/TextDocumentParser.cpp
index f4601de6a..3589c3f5f 100644
--- a/Source/WebCore/html/parser/TextDocumentParser.cpp
+++ b/Source/WebCore/html/parser/TextDocumentParser.cpp
@@ -61,8 +61,8 @@ void TextDocumentParser::insertFakePreElement()
     // distrubing the line/column number calculations.
 
     RefPtr<Attribute> styleAttribute = Attribute::create("style", "word-wrap: break-word; white-space: pre-wrap;");
-    OwnPtr<NamedNodeMap> attributes = NamedNodeMap::create();
-    attributes->insertAttribute(styleAttribute.release(), false);
+    OwnPtr<AttributeVector> attributes = AttributeVector::create();
+    attributes->insertAttribute(styleAttribute.release());
     AtomicHTMLToken fakePre(HTMLTokenTypes::StartTag, preTag.localName(), attributes.release());
 
     treeBuilder()->constructTreeFromAtomicToken(fakePre);
diff --git a/Source/WebCore/html/parser/XSSAuditor.cpp b/Source/WebCore/html/parser/XSSAuditor.cpp
index 8fde1a5d7..3812cd9d5 100644
--- a/Source/WebCore/html/parser/XSSAuditor.cpp
+++ b/Source/WebCore/html/parser/XSSAuditor.cpp
@@ -313,16 +313,10 @@ void XSSAuditor::filterEndToken(HTMLToken& token)
 bool XSSAuditor::filterCharacterToken(HTMLToken& token)
 {
     ASSERT(m_scriptTagNestingLevel);
-    TextResourceDecoder* decoder = m_parser->document()->decoder();
-    if (isContainedInRequest(fullyDecodeString(m_cachedSnippet, decoder))) {
-        int start = 0;
-        int end = token.endIndex() - token.startIndex();
-        String snippet = snippetForJavaScript(snippetForRange(token, start, end));
-        if (isContainedInRequest(fullyDecodeString(snippet, decoder))) {
-            token.eraseCharacters();
-            token.appendToCharacter(' '); // Technically, character tokens can't be empty.
-            return true;
-        }
+    if (isContainedInRequest(m_cachedDecodedSnippet) && isContainedInRequest(decodedSnippetForJavaScript(token))) {
+        token.eraseCharacters();
+        token.appendToCharacter(' '); // Technically, character tokens can't be empty.
+        return true;
     }
     return false;
 }
@@ -332,11 +326,12 @@ bool XSSAuditor::filterScriptToken(HTMLToken& token)
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, scriptTag));
 
-    if (eraseAttributeIfInjected(token, srcAttr, blankURL().string(), SrcLikeAttribute))
-        return true;
-
-    m_cachedSnippet = m_parser->sourceForToken(token);
+    m_cachedDecodedSnippet = stripLeadingAndTrailingHTMLSpaces(decodedSnippetForToken(token));
     m_shouldAllowCDATA = m_parser->tokenizer()->shouldAllowCDATA();
+
+    if (isContainedInRequest(decodedSnippetForName(token)))
+        return eraseAttributeIfInjected(token, srcAttr, blankURL().string(), SrcLikeAttribute);
+
     return false;
 }
 
@@ -346,11 +341,11 @@ bool XSSAuditor::filterObjectToken(HTMLToken& token)
     ASSERT(hasName(token, objectTag));
 
     bool didBlockScript = false;
-
-    didBlockScript |= eraseAttributeIfInjected(token, dataAttr, blankURL().string(), SrcLikeAttribute);
-    didBlockScript |= eraseAttributeIfInjected(token, typeAttr);
-    didBlockScript |= eraseAttributeIfInjected(token, classidAttr);
-
+    if (isContainedInRequest(decodedSnippetForName(token))) {
+        didBlockScript |= eraseAttributeIfInjected(token, dataAttr, blankURL().string(), SrcLikeAttribute);
+        didBlockScript |= eraseAttributeIfInjected(token, typeAttr);
+        didBlockScript |= eraseAttributeIfInjected(token, classidAttr);
+    }
     return didBlockScript;
 }
 
@@ -378,11 +373,11 @@ bool XSSAuditor::filterEmbedToken(HTMLToken& token)
     ASSERT(hasName(token, embedTag));
 
     bool didBlockScript = false;
-
-    didBlockScript |= eraseAttributeIfInjected(token, codeAttr, String(), SrcLikeAttribute);
-    didBlockScript |= eraseAttributeIfInjected(token, srcAttr, blankURL().string(), SrcLikeAttribute);
-    didBlockScript |= eraseAttributeIfInjected(token, typeAttr);
-
+    if (isContainedInRequest(decodedSnippetForName(token))) {
+        didBlockScript |= eraseAttributeIfInjected(token, codeAttr, String(), SrcLikeAttribute);
+        didBlockScript |= eraseAttributeIfInjected(token, srcAttr, blankURL().string(), SrcLikeAttribute);
+        didBlockScript |= eraseAttributeIfInjected(token, typeAttr);
+    }
     return didBlockScript;
 }
 
@@ -392,10 +387,10 @@ bool XSSAuditor::filterAppletToken(HTMLToken& token)
     ASSERT(hasName(token, appletTag));
 
     bool didBlockScript = false;
-
-    didBlockScript |= eraseAttributeIfInjected(token, codeAttr, String(), SrcLikeAttribute);
-    didBlockScript |= eraseAttributeIfInjected(token, objectAttr);
-
+    if (isContainedInRequest(decodedSnippetForName(token))) {
+        didBlockScript |= eraseAttributeIfInjected(token, codeAttr, String(), SrcLikeAttribute);
+        didBlockScript |= eraseAttributeIfInjected(token, objectAttr);
+    }
     return didBlockScript;
 }
 
@@ -404,7 +399,10 @@ bool XSSAuditor::filterIframeToken(HTMLToken& token)
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, iframeTag));
 
-    return eraseAttributeIfInjected(token, srcAttr, String(), SrcLikeAttribute);
+    if (isContainedInRequest(decodedSnippetForName(token)))
+        return eraseAttributeIfInjected(token, srcAttr, String(), SrcLikeAttribute);
+
+    return false;
 }
 
 bool XSSAuditor::filterMetaToken(HTMLToken& token)
@@ -494,11 +492,17 @@ bool XSSAuditor::eraseAttributeIfInjected(HTMLToken& token, const QualifiedName&
     return false;
 }
 
-String XSSAuditor::snippetForRange(const HTMLToken& token, int start, int end)
+String XSSAuditor::decodedSnippetForToken(const HTMLToken& token)
+{
+    String snippet = m_parser->sourceForToken(token);
+    return fullyDecodeString(snippet, m_parser->document()->decoder());
+}
+
+String XSSAuditor::decodedSnippetForName(const HTMLToken& token)
 {
-    // FIXME: There's an extra allocation here that we could save by
-    //        passing the range to the parser.
-    return m_parser->sourceForToken(token).substring(start, end - start);
+    // Grab a fixed number of characters equal to the length of the token's
+    // name plus one (to account for the "<").
+    return decodedSnippetForToken(token).substring(0, token.name().size() + 1);
 }
 
 String XSSAuditor::decodedSnippetForAttribute(const HTMLToken& token, const HTMLToken::Attribute& attribute, AttributeKind treatment)
@@ -509,7 +513,7 @@ String XSSAuditor::decodedSnippetForAttribute(const HTMLToken& token, const HTML
     // FIXME: We should grab one character before the name also.
     int start = attribute.m_nameRange.m_start - token.startIndex();
     int end = attribute.m_valueRange.m_end - token.startIndex();
-    String decodedSnippet = fullyDecodeString(snippetForRange(token, start, end), m_parser->document()->decoder());
+    String decodedSnippet = fullyDecodeString(m_parser->sourceForToken(token).substring(start, end - start), m_parser->document()->decoder());
     decodedSnippet.truncate(kMaximumFragmentLengthTarget);
     if (treatment == SrcLikeAttribute) {
         int slashCount;
@@ -528,31 +532,9 @@ String XSSAuditor::decodedSnippetForAttribute(const HTMLToken& token, const HTML
     return decodedSnippet;
 }
 
-bool XSSAuditor::isContainedInRequest(const String& decodedSnippet)
-{
-    if (decodedSnippet.isEmpty())
-        return false;
-    if (m_decodedURL.find(decodedSnippet, 0, false) != notFound)
-        return true;
-    if (m_decodedHTTPBodySuffixTree && !m_decodedHTTPBodySuffixTree->mightContain(decodedSnippet))
-        return false;
-    return m_decodedHTTPBody.find(decodedSnippet, 0, false) != notFound;
-}
-
-bool XSSAuditor::isSameOriginResource(const String& url)
-{
-    // If the resource is loaded from the same URL as the enclosing page, it's
-    // probably not an XSS attack, so we reduce false positives by allowing the
-    // request. If the resource has a query string, we're more suspicious,
-    // however, because that's pretty rare and the attacker might be able to
-    // trick a server-side script into doing something dangerous with the query
-    // string.
-    KURL resourceURL(m_parser->document()->url(), url);
-    return (m_parser->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
-}
-
-String XSSAuditor::snippetForJavaScript(const String& string)
+String XSSAuditor::decodedSnippetForJavaScript(const HTMLToken& token)
 {
+    String string = m_parser->sourceForToken(token);
     size_t startPosition = 0;
     size_t endPosition = string.length();
     size_t foundPosition = notFound;
@@ -605,7 +587,30 @@ String XSSAuditor::snippetForJavaScript(const String& string)
         }
     }
 
-    return string.substring(startPosition, endPosition - startPosition);
+    return fullyDecodeString(string.substring(startPosition, endPosition - startPosition), m_parser->document()->decoder());
+}
+
+bool XSSAuditor::isContainedInRequest(const String& decodedSnippet)
+{
+    if (decodedSnippet.isEmpty())
+        return false;
+    if (m_decodedURL.find(decodedSnippet, 0, false) != notFound)
+        return true;
+    if (m_decodedHTTPBodySuffixTree && !m_decodedHTTPBodySuffixTree->mightContain(decodedSnippet))
+        return false;
+    return m_decodedHTTPBody.find(decodedSnippet, 0, false) != notFound;
+}
+
+bool XSSAuditor::isSameOriginResource(const String& url)
+{
+    // If the resource is loaded from the same URL as the enclosing page, it's
+    // probably not an XSS attack, so we reduce false positives by allowing the
+    // request. If the resource has a query string, we're more suspicious,
+    // however, because that's pretty rare and the attacker might be able to
+    // trick a server-side script into doing something dangerous with the query
+    // string.
+    KURL resourceURL(m_parser->document()->url(), url);
+    return (m_parser->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/parser/XSSAuditor.h b/Source/WebCore/html/parser/XSSAuditor.h
index 713cd0b6f..fb5ab67ac 100644
--- a/Source/WebCore/html/parser/XSSAuditor.h
+++ b/Source/WebCore/html/parser/XSSAuditor.h
@@ -72,9 +72,10 @@ private:
     bool eraseDangerousAttributesIfInjected(HTMLToken&);
     bool eraseAttributeIfInjected(HTMLToken&, const QualifiedName&, const String& replacementValue = String(), AttributeKind treatment = NormalAttribute);
 
-    String snippetForRange(const HTMLToken&, int start, int end);
-    String snippetForJavaScript(const String&);
+    String decodedSnippetForToken(const HTMLToken&);
+    String decodedSnippetForName(const HTMLToken&);
     String decodedSnippetForAttribute(const HTMLToken&, const HTMLToken::Attribute&, AttributeKind treatment = NormalAttribute);
+    String decodedSnippetForJavaScript(const HTMLToken&);
 
     bool isContainedInRequest(const String&);
     bool isSameOriginResource(const String& url);
@@ -88,7 +89,7 @@ private:
     OwnPtr<SuffixTree<ASCIICodebook> > m_decodedHTTPBodySuffixTree;
 
     State m_state;
-    String m_cachedSnippet;
+    String m_cachedDecodedSnippet;
     bool m_shouldAllowCDATA;
     unsigned m_scriptTagNestingLevel;
     bool m_notifiedClient;
diff --git a/Source/WebCore/html/shadow/ContentSelectorQuery.cpp b/Source/WebCore/html/shadow/ContentSelectorQuery.cpp
index e346d772a..0424a5fa8 100644
--- a/Source/WebCore/html/shadow/ContentSelectorQuery.cpp
+++ b/Source/WebCore/html/shadow/ContentSelectorQuery.cpp
@@ -29,23 +29,23 @@
 
 #include "CSSParser.h"
 #include "CSSSelectorList.h"
-#include "HTMLContentElement.h"
+#include "InsertionPoint.h"
 
 namespace WebCore {
 
-ContentSelectorQuery::ContentSelectorQuery(const HTMLContentElement* element)
-    : m_contentElement(element)
-    , m_selectorChecker(element->document(), !element->document()->inQuirksMode())
+ContentSelectorQuery::ContentSelectorQuery(const InsertionPoint* insertionPoint)
+    : m_insertionPoint(insertionPoint)
+    , m_selectorChecker(insertionPoint->document(), !insertionPoint->document()->inQuirksMode())
 {
     m_selectorChecker.setCollectingRulesOnly(true);
 
-    if (element->select().isNull() || element->select().isEmpty()) {
+    if (insertionPoint->select().isNull() || insertionPoint->select().isEmpty()) {
         m_isValidSelector = true;
         return;
     }
 
     CSSParser parser(true);
-    parser.parseSelector(element->select(), element->document(), m_selectorList);
+    parser.parseSelector(insertionPoint->select(), insertionPoint->document(), m_selectorList);
 
     m_isValidSelector = ContentSelectorQuery::validateSelectorList();
     if (m_isValidSelector)
@@ -63,9 +63,9 @@ bool ContentSelectorQuery::matches(Node* node) const
     if (!node)
         return false;
 
-    ASSERT(node->parentNode() == m_contentElement->shadowTreeRootNode()->shadowHost());
+    ASSERT(node->parentNode() == m_insertionPoint->shadowTreeRootNode()->shadowHost());
 
-    if (m_contentElement->select().isNull() || m_contentElement->select().isEmpty())
+    if (m_insertionPoint->select().isNull() || m_insertionPoint->select().isEmpty())
         return true;
 
     if (!m_isValidSelector)
diff --git a/Source/WebCore/html/shadow/ContentSelectorQuery.h b/Source/WebCore/html/shadow/ContentSelectorQuery.h
index 527aa4905..94fa3efcc 100644
--- a/Source/WebCore/html/shadow/ContentSelectorQuery.h
+++ b/Source/WebCore/html/shadow/ContentSelectorQuery.h
@@ -41,19 +41,19 @@ namespace WebCore {
 
 class Document;
 class Node;
-class HTMLContentElement;
+class InsertionPoint;
 
 class ContentSelectorQuery {
     WTF_MAKE_NONCOPYABLE(ContentSelectorQuery);
 public:
-    explicit ContentSelectorQuery(const HTMLContentElement*);
+    explicit ContentSelectorQuery(const InsertionPoint*);
 
     bool isValidSelector() const;
     bool matches(Node*) const;
 private:
     bool validateSelectorList();
 
-    const HTMLContentElement* m_contentElement;
+    const InsertionPoint* m_insertionPoint;
     SelectorDataList m_selectors;
     CSSSelectorList m_selectorList;
     SelectorChecker m_selectorChecker;
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.cpp b/Source/WebCore/html/shadow/HTMLContentElement.cpp
index 989acaee6..2443d155d 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.cpp
+++ b/Source/WebCore/html/shadow/HTMLContentElement.cpp
@@ -31,8 +31,9 @@
 #include "HTMLContentSelector.h"
 #include "HTMLNames.h"
 #include "QualifiedName.h"
+#include "RuntimeEnabledFeatures.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -42,10 +43,11 @@ using HTMLNames::selectAttr;
 static const QualifiedName& contentTagName()
 {
 #if ENABLE(SHADOW_DOM)
+    if (!RuntimeEnabledFeatures::shadowDOMEnabled())
+        return HTMLNames::webkitShadowContentTag;
     return HTMLNames::contentTag;
 #else
-    DEFINE_STATIC_LOCAL(QualifiedName, tagName, (nullAtom, "webkitShadowContent", HTMLNames::divTag.namespaceURI()));
-    return tagName;
+    return HTMLNames::webkitShadowContentTag;
 #endif
 }
 
@@ -68,40 +70,6 @@ HTMLContentElement::~HTMLContentElement()
 {
 }
 
-void HTMLContentElement::attach()
-{
-    ShadowRoot* root = toShadowRoot(shadowTreeRootNode());
-
-    // Before calling StyledElement::attach, selector must be calculated.
-    if (root) {
-        HTMLContentSelector* selector = root->list()->ensureSelector();
-        selector->unselect(&m_selections);
-        selector->select(this, &m_selections);
-    }
-
-    InsertionPoint::attach();
-
-    if (root) {
-        for (HTMLContentSelection* selection = m_selections.first(); selection; selection = selection->next())
-            selection->node()->attach();
-    }
-}
-
-void HTMLContentElement::detach()
-{
-    if (ShadowRoot* root = toShadowRoot(shadowTreeRootNode())) {
-        if (HTMLContentSelector* selector = root->list()->selector())
-            selector->unselect(&m_selections);
-
-        // When content element is detached, shadow tree should be recreated to re-calculate selector for
-        // other content elements.
-        root->list()->setNeedsReattachHostChildrenAndShadow();
-    }
-
-    ASSERT(m_selections.isEmpty());
-    InsertionPoint::detach();
-}
-
 const AtomicString& HTMLContentElement::select() const
 {
     return getAttribute(selectAttr);
@@ -122,7 +90,7 @@ void HTMLContentElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == selectAttr) {
         if (ShadowRoot* root = toShadowRoot(shadowTreeRootNode()))
-            root->list()->setNeedsReattachHostChildrenAndShadow();
+            root->tree()->setNeedsReattachHostChildrenAndShadow();
     } else
         InsertionPoint::parseAttribute(attr);
 }
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.h b/Source/WebCore/html/shadow/HTMLContentElement.h
index c2a1c1e36..bf143528b 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.h
+++ b/Source/WebCore/html/shadow/HTMLContentElement.h
@@ -36,45 +36,26 @@
 
 namespace WebCore {
 
-// NOTE: Current implementation doesn't support dynamic insertion/deletion of HTMLContentElement.
-// You should create HTMLContentElement during the host construction.
 class HTMLContentElement : public InsertionPoint {
 public:
     static PassRefPtr<HTMLContentElement> create(const QualifiedName&, Document*);
     static PassRefPtr<HTMLContentElement> create(Document*);
 
     virtual ~HTMLContentElement();
-    virtual void attach();
-    virtual void detach();
 
     const AtomicString& select() const;
-
-    // FIXME: Currently this constructor accepts wider query than shadow dom spec.
-    // For example, a selector query should not include contextual selectors.
-    // See https://bugs.webkit.org/show_bug.cgi?id=75946
-    // FIXME: Currently we don't support setting select value dynamically.
-    // See https://bugs.webkit.org/show_bug.cgi?id=76261
     void setSelect(const AtomicString&);
-
     virtual bool isSelectValid() const;
 
+    bool doesSelectFromHostChildren() const { return true; }
+
 protected:
     HTMLContentElement(const QualifiedName&, Document*);
 
 private:
-    virtual bool isContentElement() const { return true; }
-    virtual bool rendererIsNeeded(const NodeRenderingContext&) { return false; }
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) { return 0; }
-
     virtual void parseAttribute(Attribute*) OVERRIDE;
 };
 
-inline HTMLContentElement* toHTMLContentElement(Node* node)
-{
-    ASSERT(!node || node->isContentElement());
-    return static_cast<HTMLContentElement*>(node);
-}
-
 }
 
 #endif
diff --git a/Source/WebCore/html/shadow/HTMLContentSelector.cpp b/Source/WebCore/html/shadow/HTMLContentSelector.cpp
index 5c30ff6e1..95395bc8b 100644
--- a/Source/WebCore/html/shadow/HTMLContentSelector.cpp
+++ b/Source/WebCore/html/shadow/HTMLContentSelector.cpp
@@ -108,11 +108,12 @@ HTMLContentSelector::~HTMLContentSelector()
     ASSERT(m_candidates.isEmpty());
 }
 
-void HTMLContentSelector::select(HTMLContentElement* contentElement, HTMLContentSelectionList* selections)
+void HTMLContentSelector::select(InsertionPoint* insertionPoint, HTMLContentSelectionList* selections)
 {
     ASSERT(selections->isEmpty());
 
-    ContentSelectorQuery query(contentElement);
+    ContentSelectorQuery query(insertionPoint);
+
     for (size_t i = 0; i < m_candidates.size(); ++i) {
         Node* child = m_candidates[i].get();
         if (!child)
@@ -120,7 +121,7 @@ void HTMLContentSelector::select(HTMLContentElement* contentElement, HTMLContent
         if (!query.matches(child))
             continue;
 
-        RefPtr<HTMLContentSelection> selection = HTMLContentSelection::create(contentElement, child);
+        RefPtr<HTMLContentSelection> selection = HTMLContentSelection::create(insertionPoint, child);
 
         selections->append(selection);
         m_selectionSet.add(selection.get());
diff --git a/Source/WebCore/html/shadow/HTMLContentSelector.h b/Source/WebCore/html/shadow/HTMLContentSelector.h
index 29bd6163f..14ea057a0 100644
--- a/Source/WebCore/html/shadow/HTMLContentSelector.h
+++ b/Source/WebCore/html/shadow/HTMLContentSelector.h
@@ -130,7 +130,7 @@ public:
     HTMLContentSelector();
     ~HTMLContentSelector();
 
-    void select(HTMLContentElement*, HTMLContentSelectionList*);
+    void select(InsertionPoint*, HTMLContentSelectionList*);
     void unselect(HTMLContentSelectionList*);
     HTMLContentSelection* findFor(Node* key) const;
 
diff --git a/Source/WebCore/html/shadow/HTMLShadowElement.cpp b/Source/WebCore/html/shadow/HTMLShadowElement.cpp
index cb01cd21f..69c93629f 100644
--- a/Source/WebCore/html/shadow/HTMLShadowElement.cpp
+++ b/Source/WebCore/html/shadow/HTMLShadowElement.cpp
@@ -29,19 +29,18 @@
  */
 
 #include "config.h"
-
-#if ENABLE(SHADOW_DOM)
-
 #include "HTMLShadowElement.h"
 
 #include "HTMLNames.h"
+#include "ShadowRoot.h"
+#include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
 class Document;
 
 inline HTMLShadowElement::HTMLShadowElement(const QualifiedName& tagName, Document* document)
-    : HTMLElement(tagName, document)
+    : InsertionPoint(tagName, document)
 {
     ASSERT(hasTagName(HTMLNames::shadowTag));
 }
@@ -55,6 +54,18 @@ HTMLShadowElement::~HTMLShadowElement()
 {
 }
 
-} // namespace WebCore
+const AtomicString& HTMLShadowElement::select() const
+{
+     return nullAtom;
+}
 
-#endif // ENABLE(SHADOW_DOM)
+bool HTMLShadowElement::doesSelectFromHostChildren() const
+{
+    TreeScope* scope = treeScope();
+
+    if (scope->isShadowRoot())
+        return toShadowRoot(scope)->isOldest();
+    return false;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/html/shadow/HTMLShadowElement.h b/Source/WebCore/html/shadow/HTMLShadowElement.h
index 151c7a2ab..a4ecdb3ad 100644
--- a/Source/WebCore/html/shadow/HTMLShadowElement.h
+++ b/Source/WebCore/html/shadow/HTMLShadowElement.h
@@ -31,25 +31,25 @@
 #ifndef HTMLShadowElement_h
 #define HTMLShadowElement_h
 
-#if ENABLE(SHADOW_DOM)
-
-#include "HTMLElement.h"
+#include "InsertionPoint.h"
+#include <wtf/Forward.h>
 
 namespace WebCore {
 
-class HTMLShadowElement : public HTMLElement {
+class HTMLShadowElement : public InsertionPoint {
 public:
     static PassRefPtr<HTMLShadowElement> create(const QualifiedName&, Document*);
 
     virtual ~HTMLShadowElement();
 
+    const AtomicString& select() const;
+    bool isSelectValid() const OVERRIDE { return true; }
+    bool doesSelectFromHostChildren() const;
+
 private:
     HTMLShadowElement(const QualifiedName&, Document*);
-    virtual bool isShadowElement() const { return true; }
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(SHADOW_DOM)
-
 #endif // HTMLShadowElement_h
diff --git a/Source/WebCore/html/shadow/InsertionPoint.cpp b/Source/WebCore/html/shadow/InsertionPoint.cpp
index e99dc26d2..ebd4b28c4 100644
--- a/Source/WebCore/html/shadow/InsertionPoint.cpp
+++ b/Source/WebCore/html/shadow/InsertionPoint.cpp
@@ -31,6 +31,9 @@
 #include "config.h"
 #include "InsertionPoint.h"
 
+#include "ShadowRoot.h"
+#include "ShadowTree.h"
+
 namespace WebCore {
 
 InsertionPoint::InsertionPoint(const QualifiedName& tagName, Document* document)
@@ -43,4 +46,98 @@ InsertionPoint::~InsertionPoint()
 {
 }
 
+void InsertionPoint::attach()
+{
+    TreeScope* scope = treeScope();
+    if (scope->isShadowRoot()) {
+        ShadowRoot* root = toShadowRoot(scope);
+        if (doesSelectFromHostChildren()) {
+            distributeHostChildren(root->tree());
+            attachDistributedNode();
+        } else if (!root->olderShadowRoot()->assignedTo()) {
+            ASSERT(!root->olderShadowRoot()->attached());
+            assignShadowRoot(root->olderShadowRoot());
+            root->olderShadowRoot()->attach();
+        }
+    }
+
+    HTMLElement::attach();
+}
+
+void InsertionPoint::detach()
+{
+    if (ShadowRoot* root = toShadowRoot(shadowTreeRootNode())) {
+        ShadowTree* tree = root->tree();
+
+        if (doesSelectFromHostChildren())
+            clearDistribution(tree);
+        else if (ShadowRoot* assignedShadowRoot = assignedFrom())
+            clearAssignment(assignedShadowRoot);
+
+        // When shadow element is detached, shadow tree should be recreated to re-calculate selector for
+        // other insertion points.
+        tree->setNeedsReattachHostChildrenAndShadow();
+    }
+
+    ASSERT(m_selections.isEmpty());
+    HTMLElement::detach();
+}
+
+ShadowRoot* InsertionPoint::assignedFrom() const
+{
+    TreeScope* scope = treeScope();
+    if (!scope->isShadowRoot())
+        return 0;
+
+    ShadowRoot* olderShadowRoot = toShadowRoot(scope)->olderShadowRoot();
+    if (olderShadowRoot && olderShadowRoot->assignedTo() == this)
+        return olderShadowRoot;
+    return 0;
+}
+
+bool InsertionPoint::isShadowBoundary() const
+{
+    if (TreeScope* scope = treeScope())
+        return scope->isShadowRoot();
+    return false;
+}
+
+bool InsertionPoint::rendererIsNeeded(const NodeRenderingContext& context)
+{
+    return !isShadowBoundary() && HTMLElement::rendererIsNeeded(context);
+}
+
+inline void InsertionPoint::distributeHostChildren(ShadowTree* tree)
+{
+    HTMLContentSelector* selector = tree->ensureSelector();
+    selector->unselect(&m_selections);
+    selector->select(this, &m_selections);
+}
+
+inline void InsertionPoint::clearDistribution(ShadowTree* tree)
+{
+    if (HTMLContentSelector* selector = tree->selector())
+        selector->unselect(&m_selections);
+}
+
+inline void InsertionPoint::attachDistributedNode()
+{
+    for (HTMLContentSelection* selection = m_selections.first(); selection; selection = selection->next())
+        selection->node()->attach();
+}
+
+inline void InsertionPoint::assignShadowRoot(ShadowRoot* shadowRoot)
+{
+    shadowRoot->setAssignedTo(this);
+    m_selections.clear();
+    for (Node* node = shadowRoot->firstChild(); node; node = node->nextSibling())
+        m_selections.append(HTMLContentSelection::create(this, node));
+}
+
+inline void InsertionPoint::clearAssignment(ShadowRoot* shadowRoot)
+{
+    shadowRoot->setAssignedTo(0);
+    m_selections.clear();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/html/shadow/InsertionPoint.h b/Source/WebCore/html/shadow/InsertionPoint.h
index 292439032..b5282cddc 100644
--- a/Source/WebCore/html/shadow/InsertionPoint.h
+++ b/Source/WebCore/html/shadow/InsertionPoint.h
@@ -33,6 +33,8 @@
 
 #include "HTMLContentSelector.h"
 #include "HTMLElement.h"
+#include "HTMLNames.h"
+#include <wtf/Forward.h>
 
 namespace WebCore {
 
@@ -42,17 +44,39 @@ public:
 
     const HTMLContentSelectionList* selections() const { return &m_selections; }
     bool hasSelection() const { return m_selections.first(); }
+    bool isShadowBoundary() const;
+
+    virtual const AtomicString& select() const = 0;
+    virtual bool isSelectValid() const = 0;
+    virtual bool doesSelectFromHostChildren() const = 0;
+
+    virtual void attach();
+    virtual void detach();
+
+    virtual bool isInsertionPoint() const OVERRIDE { return true; }
+    ShadowRoot* assignedFrom() const;
 
 protected:
     InsertionPoint(const QualifiedName&, Document*);
+    virtual bool rendererIsNeeded(const NodeRenderingContext&) OVERRIDE;
+
+private:
+    void distributeHostChildren(ShadowTree*);
+    void clearDistribution(ShadowTree*);
+    void attachDistributedNode();
+
+    void assignShadowRoot(ShadowRoot*);
+    void clearAssignment(ShadowRoot*);
+
     HTMLContentSelectionList m_selections;
 };
 
 inline bool isInsertionPoint(Node* node)
 {
-    // FIXME: <shadow> should also be InsertionPoint.
-    // https://bugs.webkit.org/show_bug.cgi?id=78596
-    if (!node || node->isContentElement())
+    if (!node)
+        return true;
+
+    if (node->isHTMLElement() && toHTMLElement(node)->isInsertionPoint())
         return true;
 
     return false;
@@ -64,6 +88,13 @@ inline InsertionPoint* toInsertionPoint(Node* node)
     return static_cast<InsertionPoint*>(node);
 }
 
+inline bool isShadowBoundary(Node* node)
+{
+    if (!isInsertionPoint(node))
+        return false;
+    return toInsertionPoint(node)->isShadowBoundary();
+}
+
 } // namespace WebCore
 
 #endif // InsertionPoint_h
diff --git a/Source/WebCore/html/shadow/MediaControlElements.cpp b/Source/WebCore/html/shadow/MediaControlElements.cpp
index 1f69e3cc6..011adff79 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.cpp
+++ b/Source/WebCore/html/shadow/MediaControlElements.cpp
@@ -40,6 +40,7 @@
 #include "Frame.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
+#include "HTMLVideoElement.h"
 #include "LocalizedStrings.h"
 #include "MediaControls.h"
 #include "MouseEvent.h"
@@ -52,6 +53,7 @@
 #include "RenderView.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "Text.h"
 
 namespace WebCore {
 
@@ -107,6 +109,7 @@ inline MediaControlPanelElement::MediaControlPanelElement(Document* document)
     , m_canBeDragged(false)
     , m_isBeingDragged(false)
     , m_opaque(true)
+    , m_transitionTimer(this, &MediaControlPanelElement::transitionTimerFired)
 {
 }
 
@@ -173,6 +176,32 @@ void MediaControlPanelElement::endDrag()
     frame->eventHandler()->setCapturingMouseEventsNode(0);
 }
 
+void MediaControlPanelElement::startTimer()
+{
+    stopTimer();
+
+    // The timer is required to set the property display:'none' on the panel,
+    // such that captions are correctly displayed at the bottom of the video
+    // at the end of the fadeout transition.
+    double duration = document()->page() ? document()->page()->theme()->mediaControlsFadeOutDuration() : 0;
+    m_transitionTimer.startOneShot(duration);
+}
+
+void MediaControlPanelElement::stopTimer()
+{
+    if (m_transitionTimer.isActive())
+        m_transitionTimer.stop();
+}
+
+
+void MediaControlPanelElement::transitionTimerFired(Timer<MediaControlPanelElement>*)
+{
+    if (!m_opaque)
+        hide();
+
+    stopTimer();
+}
+
 void MediaControlPanelElement::setPosition(const LayoutPoint& position)
 {
     double left = position.x();
@@ -212,6 +241,8 @@ void MediaControlPanelElement::makeOpaque()
     setInlineStyleProperty(CSSPropertyOpacity, 1.0, CSSPrimitiveValue::CSS_NUMBER);
 
     m_opaque = true;
+
+    show();
 }
 
 void MediaControlPanelElement::makeTransparent()
@@ -224,6 +255,8 @@ void MediaControlPanelElement::makeTransparent()
     setInlineStyleProperty(CSSPropertyOpacity, 0.0, CSSPrimitiveValue::CSS_NUMBER);
 
     m_opaque = false;
+
+    startTimer();
 }
 
 void MediaControlPanelElement::defaultEventHandler(Event* event)
@@ -1165,7 +1198,6 @@ void RenderTextTrackContainerElement::layout()
 inline MediaControlTextTrackContainerElement::MediaControlTextTrackContainerElement(Document* document)
     : MediaControlElement(document)
     , m_fontSize(0)
-    , m_bottom(0)
 {
 }
 
@@ -1187,16 +1219,89 @@ const AtomicString& MediaControlTextTrackContainerElement::shadowPseudoId() cons
     return id;
 }
 
+void MediaControlTextTrackContainerElement::updateDisplay()
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(this);
+
+    // 1. If the media element is an audio element, or is another playback
+    // mechanism with no rendering area, abort these steps. There is nothing to
+    // render.
+    if (!mediaElement->isVideo())
+        return;
+
+    // 2. Let video be the media element or other playback mechanism.
+    HTMLVideoElement* video = static_cast<HTMLVideoElement*>(mediaElement);
+
+    // 3. Let output be an empty list of absolutely positioned CSS block boxes.
+    Vector<RefPtr<HTMLDivElement> > output;
+
+    // 4. If the user agent is exposing a user interface for video, add to
+    // output one or more completely transparent positioned CSS block boxes that
+    // cover the same region as the user interface.
+
+    // 5. If the last time these rules were run, the user agent was not exposing
+    // a user interface for video, but now it is, let reset be true. Otherwise,
+    // let reset be false.
+
+    // There is nothing to be done explicitly for 4th and 5th steps, as
+    // everything is handled through CSS. The caption box is on top of the
+    // controls box, in a container set with the -webkit-box display property.
+
+    // 6. Let tracks be the subset of video's list of text tracks that have as
+    // their rules for updating the text track rendering these rules for
+    // updating the display of WebVTT text tracks, and whose text track mode is
+    // showing or showing by default.
+    // 7. Let cues be an empty list of text track cues.
+    // 8. For each track track in tracks, append to cues all the cues from
+    // track's list of cues that have their text track cue active flag set.
+    CueList activeCues = video->currentlyActiveCues();
+
+    // 9. If reset is false, then, for each text track cue cue in cues: if cue's
+    // text track cue display state has a set of CSS boxes, then add those boxes
+    // to output, and remove cue from cues.
+
+    // There is nothing explicitly to be done here, as all the caching occurs
+    // within the TextTrackCue instance itself. If parameters of the cue change,
+    // the display tree is cleared.
+
+    // 10. For each text track cue cue in cues that has not yet had
+    // corresponding CSS boxes added to output, in text track cue order, run the
+    // following substeps:
+
+    // Simple renderer for now.
+    for (size_t i = 0; i < activeCues.size(); ++i) {
+        TextTrackCue* cue = activeCues[i].data();
+
+        ASSERT(cue->isActive());
+        if (!cue->track() || cue->track()->mode() != TextTrack::SHOWING)
+            continue;
+
+        RefPtr<HTMLDivElement> displayTree = cue->getDisplayTree();
+
+        // Append only new display trees.
+        if (displayTree->hasChildNodes() && !contains(displayTree.get()))
+            appendChild(displayTree, ASSERT_NO_EXCEPTION, true);
+
+        // The display tree of a cue is removed when the active flag of the cue is unset.
+
+        // FIXME(BUG 79750): Render the TextTrackCue when snap-to-lines is set.
+        // FIXME(BUG 79751): Render the TextTrackCue when snap-to-lines is not set.
+    }
+
+    // 11. Return output.
+    hasChildNodes() ? show() : hide();
+}
+
 static const float mimimumFontSize = 16;
 static const float videoHeightFontSizePercentage = .05;
 static const float trackBottomMultiplier = .9;
-    
+
 void MediaControlTextTrackContainerElement::updateSizes()
 {
     HTMLMediaElement* mediaElement = toParentMediaElement(this);
     if (!mediaElement || !mediaElement->renderer() || !mediaElement->renderer()->isVideo())
         return;
-    
+
     IntRect videoBox = toRenderVideo(mediaElement->renderer())->videoBox();
     if (m_videoDisplaySize == videoBox)
         return;
@@ -1207,33 +1312,9 @@ void MediaControlTextTrackContainerElement::updateSizes()
         m_fontSize = fontSize;
         setInlineStyleProperty(CSSPropertyFontSize, String::number(fontSize) + "px");
     }
-
-    LayoutUnit bottom = static_cast<LayoutUnit>(m_videoDisplaySize.y() + m_videoDisplaySize.height() - (m_videoDisplaySize.height() * trackBottomMultiplier));
-    if (bottom != m_bottom) {
-        m_bottom = bottom;
-        setInlineStyleProperty(CSSPropertyBottom, String::number(bottom) + "px");
-    }
 }
 
-// ----------------------------
-
-MediaControlTextTrackDisplayElement::MediaControlTextTrackDisplayElement(Document* document)
-    : MediaControlElement(document)
-{
-}
-
-PassRefPtr<MediaControlTextTrackDisplayElement> MediaControlTextTrackDisplayElement::create(Document* document)
-{
-    return adoptRef(new MediaControlTextTrackDisplayElement(document));
-}
-
-const AtomicString& MediaControlTextTrackDisplayElement::shadowPseudoId() const
-{
-    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-text-track-display"));
-    return id;
-}
-
-#endif
+#endif // ENABLE(VIDEO_TRACK)
 
 // ----------------------------
 
diff --git a/Source/WebCore/html/shadow/MediaControlElements.h b/Source/WebCore/html/shadow/MediaControlElements.h
index 8e67d0039..dce26c1c8 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.h
+++ b/Source/WebCore/html/shadow/MediaControlElements.h
@@ -68,6 +68,8 @@ enum MediaControlElementType {
     MediaVolumeSliderContainer,
     MediaVolumeSlider,
     MediaVolumeSliderThumb,
+    MediaFullScreenVolumeSlider,
+    MediaFullScreenVolumeSliderThumb,
     MediaVolumeSliderMuteButton,
     MediaTextTrackDisplayContainer,
     MediaTextTrackDisplay,
@@ -120,6 +122,10 @@ private:
     void continueDrag(const LayoutPoint& eventLocation);
     void endDrag();
 
+    void startTimer();
+    void stopTimer();
+    void transitionTimerFired(Timer<MediaControlPanelElement>*);
+
     void setPosition(const LayoutPoint&);
 
     bool m_canBeDragged;
@@ -127,6 +133,8 @@ private:
     bool m_opaque;
     LayoutPoint m_dragStartPosition;
     LayoutPoint m_dragStartEventLocation;
+
+    Timer<MediaControlPanelElement> m_transitionTimer;
 };
 
 // ----------------------------
@@ -489,9 +497,9 @@ private:
 #if ENABLE(VIDEO_TRACK)
 class MediaControlTextTrackContainerElement : public MediaControlElement {
 public:
-    
     static PassRefPtr<MediaControlTextTrackContainerElement> create(Document*);
-    
+
+    void updateDisplay();
     void updateSizes();
 
 private:
@@ -503,23 +511,9 @@ private:
 
     IntRect m_videoDisplaySize;
     float m_fontSize;
-    LayoutUnit m_bottom;
 };
 
-// ----------------------------
-
-class MediaControlTextTrackDisplayElement : public MediaControlElement {
-public:
-    static PassRefPtr<MediaControlTextTrackDisplayElement> create(Document*);
-
-private:
-    MediaControlTextTrackDisplayElement(Document*);
-
-    virtual MediaControlElementType displayType() const { return MediaTextTrackDisplay; }
-    virtual const AtomicString& shadowPseudoId() const;
-};
 #endif
-
 // ----------------------------
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/shadow/MediaControlRootElement.cpp b/Source/WebCore/html/shadow/MediaControlRootElement.cpp
index a358bd0b7..2383200f3 100644
--- a/Source/WebCore/html/shadow/MediaControlRootElement.cpp
+++ b/Source/WebCore/html/shadow/MediaControlRootElement.cpp
@@ -73,7 +73,6 @@ MediaControlRootElement::MediaControlRootElement(Document* document)
     , m_panel(0)
 #if ENABLE(VIDEO_TRACK)
     , m_textDisplayContainer(0)
-    , m_textTrackDisplay(0)
 #endif
     , m_hideFullscreenControlsTimer(this, &MediaControlRootElement::hideFullscreenControlsTimerFired)
     , m_isMouseOverControls(false)
@@ -277,8 +276,6 @@ void MediaControlRootElement::setMediaController(MediaControllerInterface* contr
 #if ENABLE(VIDEO_TRACK)
     if (m_textDisplayContainer)
         m_textDisplayContainer->setMediaController(controller);
-    if (m_textTrackDisplay)
-        m_textTrackDisplay->setMediaController(controller);
 #endif
     reset();
 }
@@ -343,6 +340,9 @@ void MediaControlRootElement::reset()
     m_playButton->updateDisplayType();
 
 #if ENABLE(FULLSCREEN_API)
+    if (m_fullScreenVolumeSlider)
+        m_fullScreenVolumeSlider->setVolume(m_mediaController->volume());
+
     if (document()->webkitIsFullScreen() && document()->webkitCurrentFullScreenElement() == toParentMediaElement(this)) {
         if (m_mediaController->isLiveStream()) {
             m_seekBackButton->hide();
@@ -601,16 +601,8 @@ void MediaControlRootElement::createTextTrackDisplay()
     RefPtr<MediaControlTextTrackContainerElement> textDisplayContainer = MediaControlTextTrackContainerElement::create(document());
     m_textDisplayContainer = textDisplayContainer.get();
 
-    RefPtr<MediaControlTextTrackDisplayElement> textDisplay = MediaControlTextTrackDisplayElement::create(document());
-    m_textDisplayContainer->hide();
-    m_textTrackDisplay = textDisplay.get();
-
-    ExceptionCode ec;
-    textDisplayContainer->appendChild(textDisplay.release(), ec, true);
-    if (ec)
-        return;
-
     // Insert it before the first controller element so it always displays behind the controls.
+    ExceptionCode ec;
     insertBefore(textDisplayContainer.release(), m_panel, ec, true);
 }
 
@@ -633,28 +625,8 @@ void MediaControlRootElement::updateTextTrackDisplay()
     if (!m_textDisplayContainer)
         createTextTrackDisplay();
 
-    CueList activeCues = toParentMediaElement(m_textDisplayContainer)->currentlyActiveCues();
-    m_textTrackDisplay->removeChildren();
-    bool nothingToDisplay = true;
-    for (size_t i = 0; i < activeCues.size(); ++i) {
-        TextTrackCue* cue = activeCues[i].data();
-        ASSERT(cue->isActive());
-        if (!cue->track() || cue->track()->mode() != TextTrack::SHOWING)
-            continue;
-
-        String cueText = cue->text();
-        if (!cueText.isEmpty()) {
-            if (!nothingToDisplay)
-                m_textTrackDisplay->appendChild(document()->createElement(HTMLNames::brTag, false), ASSERT_NO_EXCEPTION);
-            m_textTrackDisplay->appendChild(document()->createTextNode(cueText), ASSERT_NO_EXCEPTION);
-            nothingToDisplay = false;
-        }
-    }
+    m_textDisplayContainer->updateDisplay();
 
-    if (!nothingToDisplay)
-        m_textDisplayContainer->show();
-    else
-        m_textDisplayContainer->hide();
 }
 #endif
 
diff --git a/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp b/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp
index e69d818d3..663e51f80 100644
--- a/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp
+++ b/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp
@@ -58,7 +58,6 @@ MediaControlRootElementChromium::MediaControlRootElementChromium(Document* docum
     , m_panel(0)
 #if ENABLE(VIDEO_TRACK)
     , m_textDisplayContainer(0)
-    , m_textTrackDisplay(0)
 #endif
     , m_opaque(true)
     , m_isMouseOverControls(false)
@@ -158,8 +157,6 @@ void MediaControlRootElementChromium::setMediaController(MediaControllerInterfac
 #if ENABLE(VIDEO_TRACK)
     if (m_textDisplayContainer)
         m_textDisplayContainer->setMediaController(controller);
-    if (m_textTrackDisplay)
-        m_textTrackDisplay->setMediaController(controller);
 #endif
     reset();
 }
@@ -335,16 +332,8 @@ void MediaControlRootElementChromium::createTextTrackDisplay()
     RefPtr<MediaControlTextTrackContainerElement> textDisplayContainer = MediaControlTextTrackContainerElement::create(document());
     m_textDisplayContainer = textDisplayContainer.get();
 
-    RefPtr<MediaControlTextTrackDisplayElement> textDisplay = MediaControlTextTrackDisplayElement::create(document());
-    m_textDisplayContainer->hide();
-    m_textTrackDisplay = textDisplay.get();
-
-    ExceptionCode ec;
-    textDisplayContainer->appendChild(textDisplay.release(), ec, true);
-    if (ec)
-        return;
-
     // Insert it before the first controller element so it always displays behind the controls.
+    ExceptionCode ec;
     insertBefore(textDisplayContainer.release(), m_panel, ec, true);
 }
 
@@ -367,31 +356,10 @@ void MediaControlRootElementChromium::updateTextTrackDisplay()
     if (!m_textDisplayContainer)
         createTextTrackDisplay();
 
-    CueList activeCues = toParentMediaElement(m_textDisplayContainer)->currentlyActiveCues();
-    m_textTrackDisplay->removeChildren();
-    bool nothingToDisplay = true;
-    for (size_t i = 0; i < activeCues.size(); ++i) {
-        TextTrackCue* cue = activeCues[i].data();
-        ASSERT(cue->isActive());
-        if (!cue->track() || cue->track()->mode() != TextTrack::SHOWING)
-            continue;
-
-        String cueText = cue->text();
-        if (!cueText.isEmpty()) {
-            if (!nothingToDisplay)
-                m_textTrackDisplay->appendChild(document()->createElement(HTMLNames::brTag, false), ASSERT_NO_EXCEPTION);
-            m_textTrackDisplay->appendChild(document()->createTextNode(cueText), ASSERT_NO_EXCEPTION);
-            nothingToDisplay = false;
-        }
-    }
-
-    if (!nothingToDisplay)
-        m_textDisplayContainer->show();
-    else
-        m_textDisplayContainer->hide();
+    m_textDisplayContainer->updateDisplay();
 }
 #endif
-    
+
 const AtomicString& MediaControlRootElementChromium::shadowPseudoId() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls"));
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index 7558924ce..164cbfbd0 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -43,7 +43,7 @@
 #include "RenderSlider.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "StepRange.h"
 #include <wtf/MathExtras.h>
 
@@ -67,7 +67,7 @@ inline static bool hasVerticalAppearance(HTMLInputElement* input)
 SliderThumbElement* sliderThumbElementOf(Node* node)
 {
     ASSERT(node);
-    ShadowRoot* shadow = node->toInputElement()->shadowRootList()->oldestShadowRoot();
+    ShadowRoot* shadow = node->toInputElement()->shadowTree()->oldestShadowRoot();
     ASSERT(shadow);
     Node* thumb = shadow->firstChild()->firstChild()->firstChild();
     ASSERT(thumb);
@@ -91,6 +91,8 @@ void RenderSliderThumb::updateAppearance(RenderStyle* parentStyle)
         style()->setAppearance(MediaSliderThumbPart);
     else if (parentStyle->appearance() == MediaVolumeSliderPart)
         style()->setAppearance(MediaVolumeSliderThumbPart);
+    else if (parentStyle->appearance() == MediaFullScreenVolumeSliderPart)
+        style()->setAppearance(MediaFullScreenVolumeSliderThumbPart);
     if (style()->hasAppearance())
         theme()->adjustSliderThumbSize(style());
 }
@@ -142,7 +144,7 @@ void RenderSliderContainer::layout()
     Length inputHeight = input->renderer()->style()->height();
     RenderObject* trackRenderer = node()->firstChild()->renderer();
     if (!isVertical && input->renderer()->isSlider() && !inputHeight.isFixed() && !inputHeight.isPercent()) {
-        RenderObject* thumbRenderer = input->shadowRootList()->oldestShadowRoot()->firstChild()->firstChild()->firstChild()->renderer();
+        RenderObject* thumbRenderer = input->shadowTree()->oldestShadowRoot()->firstChild()->firstChild()->firstChild()->renderer();
         if (thumbRenderer) {
             style()->setHeight(thumbRenderer->style()->height());
             if (trackRenderer)
@@ -356,7 +358,7 @@ TrackLimiterElement* trackLimiterElementOf(Node* node)
 {
     ASSERT(node);
     ASSERT(node->toInputElement()->hasShadowRoot());
-    ShadowRoot* shadow = node->toInputElement()->shadowRootList()->oldestShadowRoot();
+    ShadowRoot* shadow = node->toInputElement()->shadowTree()->oldestShadowRoot();
     ASSERT(shadow);
     Node* limiter = shadow->firstChild()->lastChild();
     ASSERT(limiter);
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index 2fc35f20e..c9fb732e6 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -294,10 +294,11 @@ void SpinButtonElement::defaultEventHandler(Event* event)
             input->focus();
             input->select();
             if (renderer()) {
-                ASSERT(m_upDownState != Indeterminate);
-                input->stepUpFromRenderer(m_upDownState == Up ? 1 : -1);
-                if (renderer())
-                    startRepeatingTimer();
+                if (m_upDownState != Indeterminate) {
+                    input->stepUpFromRenderer(m_upDownState == Up ? 1 : -1);
+                    if (renderer())
+                        startRepeatingTimer();
+                }
             }
             event->setDefaultHandled();
         }
@@ -365,7 +366,8 @@ void SpinButtonElement::step(int amount)
     
 void SpinButtonElement::repeatingTimerFired(Timer<SpinButtonElement>*)
 {
-    step(m_upDownState == Up ? 1 : -1);
+    if (m_upDownState != Indeterminate)
+        step(m_upDownState == Up ? 1 : -1);
 }
 
 void SpinButtonElement::setHovered(bool flag)
diff --git a/Source/WebCore/html/track/TextTrackCue.cpp b/Source/WebCore/html/track/TextTrackCue.cpp
index 59c3f3ea0..00ebb21a9 100644
--- a/Source/WebCore/html/track/TextTrackCue.cpp
+++ b/Source/WebCore/html/track/TextTrackCue.cpp
@@ -35,8 +35,12 @@
 
 #include "TextTrackCue.h"
 
-#include "Event.h"
+#include "CSSPropertyNames.h"
+#include "CSSValueKeywords.h"
 #include "DocumentFragment.h"
+#include "Event.h"
+#include "HTMLDivElement.h"
+#include "Text.h"
 #include "TextTrack.h"
 #include "TextTrackCueList.h"
 #include "WebVTTParser.h"
@@ -46,57 +50,75 @@ namespace WebCore {
 
 static const int invalidCueIndex = -1;
 
-static const AtomicString& startKeyword()
+static const String& startKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, start, ("start"));
+    DEFINE_STATIC_LOCAL(const String, start, ("start"));
     return start;
 }
 
-static const AtomicString& middleKeyword()
+static const String& middleKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, middle, ("middle"));
+    DEFINE_STATIC_LOCAL(const String, middle, ("middle"));
     return middle;
 }
 
-static const AtomicString& endKeyword()
+static const String& endKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, end, ("end"));
+    DEFINE_STATIC_LOCAL(const String, end, ("end"));
     return end;
 }
 
-static const AtomicString& horizontalKeyword()
+static const String& horizontalKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, horizontal, ("horizontal"));
-    return horizontal;
+    return emptyString();
 }
 
-static const AtomicString& verticalKeyword()
+static const String& verticalGrowingLeftKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, vertical, ("vertical"));
+    DEFINE_STATIC_LOCAL(const String, vertical, ("rl"));
     return vertical;
 }
-static const AtomicString& verticallrKeyword()
+
+static const String& verticalGrowingRightKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, verticallr, ("vertical-lr"));
+    DEFINE_STATIC_LOCAL(const String, verticallr, ("lr"));
+    return verticallr;
+}
+
+// FIXME: remove this once https://bugs.webkit.org/show_bug.cgi?id=78706 has been fixed.
+static const String& verticalKeywordOLD()
+{
+    DEFINE_STATIC_LOCAL(const String, vertical, ("vertical"));
+    return vertical;
+}
+
+// FIXME: remove this once https://bugs.webkit.org/show_bug.cgi?id=78706 has been fixed.
+static const String& verticallrKeywordOLD()
+{
+    DEFINE_STATIC_LOCAL(const String, verticallr, ("vertical-lr"));
     return verticallr;
 }
     
+
 TextTrackCue::TextTrackCue(ScriptExecutionContext* context, const String& id, double start, double end, const String& content, const String& settings, bool pauseOnExit)
     : m_id(id)
     , m_startTime(start)
     , m_endTime(end)
     , m_content(content)
-    , m_writingDirection(Horizontal)
     , m_linePosition(-1)
     , m_textPosition(50)
     , m_cueSize(100)
     , m_cueIndex(invalidCueIndex)
+    , m_writingDirection(Horizontal)
     , m_cueAlignment(Middle)
     , m_scriptExecutionContext(context)
     , m_isActive(false)
     , m_pauseOnExit(pauseOnExit)
     , m_snapToLines(true)
+    , m_displayTreeShouldChange(true)
+    , m_displayTree(HTMLDivElement::create(static_cast<Document*>(context)))
 {
+    ASSERT(m_scriptExecutionContext->isDocument());
     parseSettings(settings);
 }
 
@@ -114,6 +136,8 @@ void TextTrackCue::cueDidChange()
 {
     if (m_track)
         m_track->cueDidChange(this);
+
+    m_displayTreeShouldChange = true;
 }
 
 TextTrack* TextTrackCue::track() const
@@ -166,35 +190,35 @@ void TextTrackCue::setPauseOnExit(bool value)
     cueDidChange();
 }
 
-const String& TextTrackCue::direction() const
+const String& TextTrackCue::vertical() const
 {
     switch (m_writingDirection) {
     case Horizontal: 
         return horizontalKeyword();
     case VerticalGrowingLeft:
-        return verticalKeyword();
+        return verticalGrowingLeftKeyword();
     case VerticalGrowingRight:
-        return verticallrKeyword();
+        return verticalGrowingRightKeyword();
     default:
         ASSERT_NOT_REACHED();
         return emptyString();
     }
 }
 
-void TextTrackCue::setDirection(const String& value, ExceptionCode& ec)
+void TextTrackCue::setVertical(const String& value, ExceptionCode& ec)
 {
-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-direction
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-vertical
     // On setting, the text track cue writing direction must be set to the value given 
     // in the first cell of the row in the table above whose second cell is a 
     // case-sensitive match for the new value, if any. If none of the values match, then
     // the user agent must instead throw a SyntaxError exception.
     
-    Direction direction = m_writingDirection;
+    WritingDirection direction = m_writingDirection;
     if (value == horizontalKeyword())
         direction = Horizontal;
-    else if (value == verticalKeyword())
+    else if (value == verticalGrowingLeftKeyword())
         direction = VerticalGrowingLeft;
-    else if (value == verticallrKeyword())
+    else if (value == verticalGrowingRightKeyword())
         direction = VerticalGrowingRight;
     else
         ec = SYNTAX_ERR;
@@ -217,9 +241,9 @@ void TextTrackCue::setSnapToLines(bool value)
     cueDidChange();
 }
 
-void TextTrackCue::setLinePosition(int position, ExceptionCode& ec)
+void TextTrackCue::setLine(int position, ExceptionCode& ec)
 {
-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-lineposition
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-line
     // On setting, if the text track cue snap-to-lines flag is not set, and the new
     // value is negative or greater than 100, then throw an IndexSizeError exception.
     if (!m_snapToLines && (position < 0 || position > 100)) {
@@ -236,9 +260,9 @@ void TextTrackCue::setLinePosition(int position, ExceptionCode& ec)
     cueDidChange();
 }
 
-void TextTrackCue::setTextPosition(int position, ExceptionCode& ec)
+void TextTrackCue::setPosition(int position, ExceptionCode& ec)
 {
-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-lineposition
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-position
     // On setting, if the new value is negative or greater than 100, then throw an IndexSizeError exception.
     // Otherwise, set the text track cue text position to the new value.
     if (position < 0 || position > 100) {
@@ -274,7 +298,7 @@ void TextTrackCue::setSize(int size, ExceptionCode& ec)
     cueDidChange();
 }
 
-const String& TextTrackCue::alignment() const
+const String& TextTrackCue::align() const
 {
     switch (m_cueAlignment) {
     case Start:
@@ -289,9 +313,9 @@ const String& TextTrackCue::alignment() const
     }
 }
 
-void TextTrackCue::setAlignment(const String& value, ExceptionCode& ec)
+void TextTrackCue::setAlign(const String& value, ExceptionCode& ec)
 {
-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-alignment
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-align
     // On setting, the text track cue alignment must be set to the value given in the 
     // first cell of the row in the table above whose second cell is a case-sensitive
     // match for the new value, if any. If none of the values match, then the user
@@ -343,15 +367,18 @@ void TextTrackCue::invalidateCueIndex()
 
 PassRefPtr<DocumentFragment> TextTrackCue::getCueAsHTML()
 {
+    RefPtr<DocumentFragment> clonedFragment;
+    Document* document;
+
     if (!m_documentFragment)
         m_documentFragment = WebVTTParser::create(0, m_scriptExecutionContext)->createDocumentFragmentFromCueText(m_content);
 
-    return m_documentFragment;
-}
+    document = static_cast<Document*>(m_scriptExecutionContext);
 
-void TextTrackCue::setCueHTML(PassRefPtr<DocumentFragment> fragment)
-{
-    m_documentFragment = fragment;
+    clonedFragment = DocumentFragment::create(document);
+    m_documentFragment->cloneChildNodes(clonedFragment.get());
+
+    return clonedFragment.release();
 }
 
 bool TextTrackCue::dispatchEvent(PassRefPtr<Event> event)
@@ -376,6 +403,63 @@ bool TextTrackCue::isActive()
 void TextTrackCue::setIsActive(bool active)
 {
     m_isActive = active;
+
+    if (!active) {
+        // Remove the display tree as soon as the cue becomes inactive.
+        ExceptionCode ec;
+        m_displayTree->remove(ec);
+    }
+}
+
+void TextTrackCue::determineDisplayParameters()
+{
+    // FIXME(BUG 79749): Determine the text direction using the BIDI algorithm.
+    // Steps 10.2, 10.3
+
+    // FIXME(BUG 79747): Determine the display parameters from the rules.
+    // Steps 10.1, 10.4 - 10.10
+}
+
+PassRefPtr<HTMLDivElement> TextTrackCue::getDisplayTree()
+{
+    if (!m_displayTreeShouldChange)
+        return m_displayTree;
+
+    // 10.1 - 10.10
+    determineDisplayParameters();
+
+    // 10.11. Apply the terms of the CSS specifications to nodes within the
+    // following constraints, thus obtaining a set of CSS boxes positioned
+    // relative to an initial containing block:
+    m_displayTree->removeChildren();
+
+    // The document tree is the tree of WebVTT Node Objects rooted at nodes.
+
+    // The children of the nodes must be wrapped in an anonymous box whose
+    // 'display' property has the value 'inline'. This is the WebVTT cue
+    // background box.
+    m_displayTree->setShadowPseudoId(AtomicString("-webkit-media-text-track-display"), ASSERT_NO_EXCEPTION);
+    m_displayTree->appendChild(getCueAsHTML(), ASSERT_NO_EXCEPTION, true);
+
+    // FIXME(BUG 79916): Runs of children of WebVTT Ruby Objects that are not
+    // WebVTT Ruby Text Objects must be wrapped in anonymous boxes whose
+    // 'display' property has the value 'ruby-base'.
+
+    // FIXME(BUG 79916): Text runs must be wrapped according to the CSS
+    // line-wrapping rules, except that additionally, regardless of the value of
+    // the 'white-space' property, lines must be wrapped at the edge of their
+    // containing blocks, even if doing so requires splitting a word where there
+    // is no line breaking opportunity. (Thus, normally text wraps as needed,
+    // but if there is a particularly long word, it does not overflow as it
+    // normally would in CSS, it is instead forcibly wrapped at the box's edge.)
+
+    // FIXME(BUG 79750, 79751): Steps 10.12 - 10.14
+
+    m_displayTreeShouldChange = false;
+
+    // 10.15. Let cue's text track cue display state have the CSS boxes in
+    // boxes.
+    return m_displayTree;
 }
 
 void TextTrackCue::parseSettings(const String& input)
@@ -405,9 +489,9 @@ void TextTrackCue::parseSettings(const String& input)
             {
             // 1-3 - Collect the next word and set the writing direction accordingly.
             String writingDirection = WebVTTParser::collectWord(input, &position);
-            if (writingDirection == verticalKeyword())
+            if (writingDirection == verticalKeywordOLD())
                 m_writingDirection = VerticalGrowingLeft;
-            else if (writingDirection == verticallrKeyword())
+            else if (writingDirection == verticallrKeywordOLD())
                 m_writingDirection = VerticalGrowingRight;
             }
             break;
diff --git a/Source/WebCore/html/track/TextTrackCue.h b/Source/WebCore/html/track/TextTrackCue.h
index b3e0f32a5..401132d96 100644
--- a/Source/WebCore/html/track/TextTrackCue.h
+++ b/Source/WebCore/html/track/TextTrackCue.h
@@ -43,6 +43,7 @@ namespace WebCore {
 class DocumentFragment;
 class ScriptExecutionContext;
 class TextTrack;
+class HTMLDivElement;
 
 class TextTrackCue : public RefCounted<TextTrackCue>, public EventTarget {
 public:
@@ -51,9 +52,6 @@ public:
         return adoptRef(new TextTrackCue(context, id, start, end, content, settings, pauseOnExit));
     }
 
-    enum Direction { Horizontal, VerticalGrowingLeft, VerticalGrowingRight };
-    enum Alignment { Start, Middle, End };
-
     virtual ~TextTrackCue();
 
     TextTrack* track() const;
@@ -71,23 +69,23 @@ public:
     bool pauseOnExit() const { return m_pauseOnExit; }
     void setPauseOnExit(bool);
 
-    const String& direction() const;
-    void setDirection(const String&, ExceptionCode&);
+    const String& vertical() const;
+    void setVertical(const String&, ExceptionCode&);
 
     bool snapToLines() const { return m_snapToLines; }
     void setSnapToLines(bool);
 
-    int linePosition() const { return m_linePosition; }
-    void setLinePosition(int, ExceptionCode&);
+    int line() const { return m_linePosition; }
+    void setLine(int, ExceptionCode&);
 
-    int textPosition() const { return m_textPosition; }
-    void setTextPosition(int, ExceptionCode&);
+    int position() const { return m_textPosition; }
+    void setPosition(int, ExceptionCode&);
 
     int size() const { return m_cueSize; }
     void setSize(int, ExceptionCode&);
 
-    const String& alignment() const;
-    void setAlignment(const String&, ExceptionCode&);
+    const String& align() const;
+    void setAlign(const String&, ExceptionCode&);
 
     const String& text() const { return m_content; }
     void setText(const String&);
@@ -96,7 +94,6 @@ public:
     void invalidateCueIndex();
 
     PassRefPtr<DocumentFragment> getCueAsHTML();
-    void setCueHTML(PassRefPtr<DocumentFragment>);
 
     virtual bool dispatchEvent(PassRefPtr<Event>);
     bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
@@ -104,6 +101,8 @@ public:
     bool isActive();
     void setIsActive(bool);
 
+    PassRefPtr<HTMLDivElement> getDisplayTree();
+
     virtual const AtomicString& interfaceName() const;
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
@@ -114,7 +113,6 @@ public:
     using RefCounted<TextTrackCue>::deref;
 
 protected:
-
     virtual EventTargetData* eventTargetData();
     virtual EventTargetData* ensureEventTargetData();
 
@@ -122,6 +120,8 @@ private:
     TextTrackCue(ScriptExecutionContext*, const String& id, double start, double end, const String& content, const String& settings, bool pauseOnExit);
 
     void parseSettings(const String&);
+    void determineDisplayParameters();
+
     void cueWillChange();
     void cueDidChange();
 
@@ -132,13 +132,17 @@ private:
     double m_startTime;
     double m_endTime;
     String m_content;
-    Direction m_writingDirection;
     int m_linePosition;
     int m_textPosition;
     int m_cueSize;
     int m_cueIndex;
 
+    enum WritingDirection { Horizontal, VerticalGrowingLeft, VerticalGrowingRight };
+    WritingDirection m_writingDirection;
+
+    enum Alignment { Start, Middle, End };
     Alignment m_cueAlignment;
+
     RefPtr<DocumentFragment> m_documentFragment;
     RefPtr<TextTrack> m_track;
 
@@ -148,6 +152,9 @@ private:
     bool m_isActive;
     bool m_pauseOnExit;
     bool m_snapToLines;
+
+    bool m_displayTreeShouldChange;
+    RefPtr<HTMLDivElement> m_displayTree;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/track/TextTrackCue.idl b/Source/WebCore/html/track/TextTrackCue.idl
index 12a827959..d552525a4 100644
--- a/Source/WebCore/html/track/TextTrackCue.idl
+++ b/Source/WebCore/html/track/TextTrackCue.idl
@@ -42,16 +42,16 @@ module html {
         attribute double endTime;
         attribute boolean pauseOnExit;
 
-        attribute DOMString direction
+        attribute DOMString vertical
             setter raises (DOMException);
         attribute boolean snapToLines;
-        attribute long linePosition
+        attribute long line
             setter raises (DOMException);
-        attribute long textPosition
+        attribute long position
             setter raises (DOMException);
         attribute long size
             setter raises (DOMException);
-        attribute DOMString alignment
+        attribute DOMString align
             setter raises (DOMException);
 
         attribute DOMString text;
@@ -71,4 +71,4 @@ module html {
             raises(EventException);
     };
 
-}
\ No newline at end of file
+}
diff --git a/Source/WebCore/html/track/TextTrackCueList.idl b/Source/WebCore/html/track/TextTrackCueList.idl
index 551840fe9..380e59a31 100644
--- a/Source/WebCore/html/track/TextTrackCueList.idl
+++ b/Source/WebCore/html/track/TextTrackCueList.idl
@@ -35,4 +35,4 @@ module html {
         TextTrackCue getCueById(in DOMString id);
     };
 
-}
\ No newline at end of file
+}
diff --git a/Source/WebCore/html/track/WebVTTParser.cpp b/Source/WebCore/html/track/WebVTTParser.cpp
index 050fb2754..dde2b2408 100644
--- a/Source/WebCore/html/track/WebVTTParser.cpp
+++ b/Source/WebCore/html/track/WebVTTParser.cpp
@@ -273,10 +273,8 @@ void WebVTTParser::createNewCue()
     if (!m_currentContent.length())
         return;
 
-    RefPtr<DocumentFragment> attachmentRoot = createDocumentFragmentFromCueText(m_currentContent.toString());
-    
     RefPtr<TextTrackCue> cue = TextTrackCue::create(m_scriptExecutionContext, m_currentId, m_currentStartTime, m_currentEndTime, m_currentContent.toString(), m_currentSettings, false);
-    cue->setCueHTML(attachmentRoot);
+
     m_cuelist.append(cue);
     if (m_client)
         m_client->newCuesParsed();
diff --git a/Source/WebCore/inspector/ContentSearchUtils.cpp b/Source/WebCore/inspector/ContentSearchUtils.cpp
index 5d678c5fe..d0e128b23 100644
--- a/Source/WebCore/inspector/ContentSearchUtils.cpp
+++ b/Source/WebCore/inspector/ContentSearchUtils.cpp
@@ -153,8 +153,8 @@ static String findMagicComment(const String& content, const String& name)
     ASSERT(pattern.m_numSubpatterns == 1);
     Vector<int, 4> matches;
     matches.resize(4);
-    int result = JSC::Yarr::interpret(bytecodePattern.get(), JSC::UString(content.impl()), 0, content.length(), matches.data());
-    if (result < 0)
+    unsigned result = JSC::Yarr::interpret(bytecodePattern.get(), JSC::UString(content.impl()), 0, content.length(), reinterpret_cast<unsigned*>(matches.data()));
+    if (result == JSC::Yarr::offsetNoMatch)
         return String();
     ASSERT(matches[2] > 0 && matches[3] > 0);
     return content.substring(matches[2], matches[3] - matches[2]);
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.cpp b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
index 70578c72a..c13fc324b 100644
--- a/Source/WebCore/inspector/DOMNodeHighlighter.cpp
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
@@ -414,7 +414,7 @@ static void getOrDrawNodeHighlight(GraphicsContext* context, HighlightData* high
             borderBox = LayoutRect(paddingBox.x() - renderBox->borderLeft(), paddingBox.y() - renderBox->borderTop(),
                     paddingBox.width() + renderBox->borderLeft() + renderBox->borderRight(), paddingBox.height() + renderBox->borderTop() + renderBox->borderBottom());
             marginBox = LayoutRect(borderBox.x() - renderBox->marginLeft(), borderBox.y() - renderBox->marginTop(),
-                    borderBox.width() + renderBox->marginLeft() + renderBox->marginRight(), borderBox.height() + renderBox->marginTop() + renderBox->marginBottom());
+                    borderBox.width() + renderBox->marginWidth(), borderBox.height() + renderBox->marginHeight());
         } else {
             RenderInline* renderInline = toRenderInline(renderer);
 
@@ -426,7 +426,7 @@ static void getOrDrawNodeHighlight(GraphicsContext* context, HighlightData* high
                     paddingBox.width() - renderInline->paddingLeft() - renderInline->paddingRight(), paddingBox.height() - renderInline->paddingTop() - renderInline->paddingBottom());
             // Ignore marginTop and marginBottom for inlines.
             marginBox = LayoutRect(borderBox.x() - renderInline->marginLeft(), borderBox.y(),
-                    borderBox.width() + renderInline->marginLeft() + renderInline->marginRight(), borderBox.height());
+                    borderBox.width() + renderInline->marginWidth(), borderBox.height());
         }
 
         FloatQuad absContentQuad = renderer->localToAbsoluteQuad(FloatRect(contentBox));
diff --git a/Source/WebCore/inspector/DOMPatchSupport.h b/Source/WebCore/inspector/DOMPatchSupport.h
index 4d040f08b..dd67a6311 100644
--- a/Source/WebCore/inspector/DOMPatchSupport.h
+++ b/Source/WebCore/inspector/DOMPatchSupport.h
@@ -44,7 +44,6 @@ namespace WebCore {
 class ContainerNode;
 class DOMEditor;
 class Document;
-class NamedNodeMap;
 class Node;
 
 #if ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index 7a0abd70f..1732a7ef3 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -218,8 +218,8 @@ bool InjectedScript::canAccessInspectedWindow() const
 
 ScriptValue InjectedScript::callFunctionWithEvalEnabled(ScriptFunctionCall& function, bool& hadException) const
 {
-    DOMWindow* domWindow = domWindowFromScriptState(m_injectedScriptObject.scriptState());
-    InspectorInstrumentationCookie cookie = domWindow && domWindow->frame() ? InspectorInstrumentation::willCallFunction(domWindow->frame()->page(), "InjectedScript", 1) : InspectorInstrumentationCookie();
+    ScriptExecutionContext* scriptExecutionContext = scriptExecutionContextFromScriptState(m_injectedScriptObject.scriptState());
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willCallFunction(scriptExecutionContext, "InjectedScript", 1);
 
     ScriptState* scriptState = m_injectedScriptObject.scriptState();
     bool evalIsDisabled = false;
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index 24ec72ec9..ba1d7bdc1 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -1298,7 +1298,8 @@
                     { "name": "xmlVersion", "type": "string", "optional": true, "description": "<code>Document</code>'s XML version in case of XML documents." },
                     { "name": "name", "type": "string", "optional": true, "description": "<code>Attr</code>'s name." },
                     { "name": "value", "type": "string", "optional": true, "description": "<code>Attr</code>'s value." },
-                    { "name": "contentDocument", "$ref": "Node", "optional": true, "description": "Content document for frame owner elements." }
+                    { "name": "contentDocument", "$ref": "Node", "optional": true, "description": "Content document for frame owner elements." },
+                    { "name": "shadowRoots", "type": "array", "optional": true, "items": { "$ref": "Node" }, "description": "Shadow root list for given element host." }
                 ],
                 "description": "DOM interaction is implemented in terms of mirror objects that represent the actual DOM nodes. DOMNode is a base node mirror type."
             },
@@ -1682,6 +1683,24 @@
                     { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node that has been removed." }
                 ],
                 "description": "Mirrors <code>DOMNodeRemoved</code> event."
+            },
+            {
+                "name": "shadowRootPushed",
+                "parameters": [
+                    { "name": "hostId", "$ref": "NodeId", "description": "Host element id." },
+                    { "name": "root", "$ref": "Node", "description": "Shadow root." }
+                ],
+                "description": "Called when shadow root is pushed into the element.",
+                "hidden": true
+            },
+            {
+                "name": "shadowRootPopped",
+                "parameters": [
+                    { "name": "hostId", "$ref": "NodeId", "description": "Host element id." },
+                    { "name": "rootId", "$ref": "NodeId", "description": "Shadow root id." }
+                ],
+                "description": "Called when shadow root is popped from the element.",
+                "hidden": true
             }
         ]
     },
diff --git a/Source/WebCore/inspector/InspectorAgent.cpp b/Source/WebCore/inspector/InspectorAgent.cpp
index 31d516603..06d146f0f 100644
--- a/Source/WebCore/inspector/InspectorAgent.cpp
+++ b/Source/WebCore/inspector/InspectorAgent.cpp
@@ -159,50 +159,6 @@ bool InspectorAgent::isMainResourceLoader(DocumentLoader* loader, const KURL& re
 }
 
 #if ENABLE(WORKERS)
-class PostWorkerNotificationToFrontendTask : public ScriptExecutionContext::Task {
-public:
-    static PassOwnPtr<PostWorkerNotificationToFrontendTask> create(PassRefPtr<InspectorWorkerResource> worker, InspectorAgent::WorkerAction action)
-    {
-        return adoptPtr(new PostWorkerNotificationToFrontendTask(worker, action));
-    }
-
-private:
-    PostWorkerNotificationToFrontendTask(PassRefPtr<InspectorWorkerResource> worker, InspectorAgent::WorkerAction action)
-        : m_worker(worker)
-        , m_action(action)
-    {
-    }
-
-    virtual void performTask(ScriptExecutionContext* scriptContext)
-    {
-        if (scriptContext->isDocument()) {
-            if (InspectorAgent* inspectorAgent = static_cast<Document*>(scriptContext)->page()->inspectorController()->m_inspectorAgent)
-                inspectorAgent->postWorkerNotificationToFrontend(*m_worker, m_action);
-        }
-    }
-
-private:
-    RefPtr<InspectorWorkerResource> m_worker;
-    InspectorAgent::WorkerAction m_action;
-};
-
-void InspectorAgent::postWorkerNotificationToFrontend(const InspectorWorkerResource& worker, InspectorAgent::WorkerAction action)
-{
-    if (!m_frontend || !m_state->getBoolean(InspectorAgentState::inspectorAgentEnabled))
-        return;
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    switch (action) {
-    case InspectorAgent::WorkerCreated:
-        m_frontend->inspector()->didCreateWorker(worker.id(), worker.url(), worker.isSharedWorker());
-        break;
-    case InspectorAgent::WorkerDestroyed:
-        m_frontend->inspector()->didDestroyWorker(worker.id());
-        break;
-    }
-#endif
-}
-
 void InspectorAgent::didCreateWorker(intptr_t id, const String& url, bool isSharedWorker)
 {
     if (!developerExtrasEnabled())
@@ -210,8 +166,10 @@ void InspectorAgent::didCreateWorker(intptr_t id, const String& url, bool isShar
 
     RefPtr<InspectorWorkerResource> workerResource(InspectorWorkerResource::create(id, url, isSharedWorker));
     m_workers.set(id, workerResource);
+#if ENABLE(JAVASCRIPT_DEBUGGER)
     if (m_inspectedPage && m_frontend && m_state->getBoolean(InspectorAgentState::inspectorAgentEnabled))
-        m_inspectedPage->mainFrame()->document()->postTask(PostWorkerNotificationToFrontendTask::create(workerResource, InspectorAgent::WorkerCreated));
+        m_frontend->inspector()->didCreateWorker(id, url, isSharedWorker);
+#endif
 }
 
 void InspectorAgent::didDestroyWorker(intptr_t id)
@@ -222,8 +180,10 @@ void InspectorAgent::didDestroyWorker(intptr_t id)
     WorkersMap::iterator workerResource = m_workers.find(id);
     if (workerResource == m_workers.end())
         return;
+#if ENABLE(JAVASCRIPT_DEBUGGER)
     if (m_inspectedPage && m_frontend && m_state->getBoolean(InspectorAgentState::inspectorAgentEnabled))
-        m_inspectedPage->mainFrame()->document()->postTask(PostWorkerNotificationToFrontendTask::create(workerResource->second, InspectorAgent::WorkerDestroyed));
+        m_frontend->inspector()->didDestroyWorker(id);
+#endif
     m_workers.remove(workerResource);
 }
 #endif // ENABLE(WORKERS)
diff --git a/Source/WebCore/inspector/InspectorAgent.h b/Source/WebCore/inspector/InspectorAgent.h
index a38be21ee..5c2861caa 100644
--- a/Source/WebCore/inspector/InspectorAgent.h
+++ b/Source/WebCore/inspector/InspectorAgent.h
@@ -83,9 +83,6 @@ public:
     void emitCommitLoadIfNeeded();
 
 #if ENABLE(WORKERS)
-    enum WorkerAction { WorkerCreated, WorkerDestroyed };
-
-    void postWorkerNotificationToFrontend(const InspectorWorkerResource&, WorkerAction);
     void didCreateWorker(intptr_t, const String& url, bool isSharedWorker);
     void didDestroyWorker(intptr_t);
 #endif
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.cpp b/Source/WebCore/inspector/InspectorCSSAgent.cpp
index 1f4f713a8..bd9c33584 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.cpp
+++ b/Source/WebCore/inspector/InspectorCSSAgent.cpp
@@ -36,6 +36,7 @@
 #include "CSSStyleRule.h"
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
+#include "ContentSecurityPolicy.h"
 #include "DOMWindow.h"
 #include "HTMLHeadElement.h"
 #include "InspectorDOMAgent.h"
@@ -46,6 +47,7 @@
 #include "Node.h"
 #include "NodeList.h"
 #include "StylePropertySet.h"
+#include "StyleRule.h"
 #include "StyleSheetList.h"
 
 #include <wtf/CurrentTime.h>
@@ -168,7 +170,7 @@ inline void SelectorProfile::startSelector(const CSSStyleRule* rule)
             url = InspectorDOMAgent::documentURLString(styleSheet->findDocument());
     }
     m_currentMatchData.url = url;
-    m_currentMatchData.lineNumber = rule->sourceLine();
+    m_currentMatchData.lineNumber = rule->styleRule()->sourceLine();
     m_currentMatchData.startTime = WTF::currentTimeMS();
 }
 
@@ -895,13 +897,15 @@ InspectorStyleSheet* InspectorCSSAgent::viaInspectorStyleSheet(Document* documen
             targetNode = document->body();
         else
             return 0;
+
+        InlineStyleOverrideScope overrideScope(document);
         targetNode->appendChild(styleElement, ec);
     }
     if (ec)
         return 0;
     StyleSheetList* styleSheets = document->styleSheets();
     StyleSheet* styleSheet = styleSheets->item(styleSheets->length() - 1);
-    if (!styleSheet->isCSSStyleSheet())
+    if (!styleSheet || !styleSheet->isCSSStyleSheet())
         return 0;
     CSSStyleSheet* cssStyleSheet = static_cast<CSSStyleSheet*>(styleSheet);
     String id = String::number(m_lastStyleSheetId++);
@@ -984,10 +988,8 @@ void InspectorCSSAgent::didRemoveDOMNode(Node* node)
     if (!node)
         return;
 
-    if (m_lastElementWithPseudoState.get() == node) {
+    if (m_lastElementWithPseudoState.get() == node)
         clearPseudoState(false);
-        return;
-    }
 
     NodeToInspectorStyleSheet::iterator it = m_nodeToInspectorStyleSheet.find(node);
     if (it == m_nodeToInspectorStyleSheet.end())
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.h b/Source/WebCore/inspector/InspectorCSSAgent.h
index e7ee76572..2f9ddf4b1 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.h
+++ b/Source/WebCore/inspector/InspectorCSSAgent.h
@@ -26,12 +26,14 @@
 #define InspectorCSSAgent_h
 
 #include "CSSSelector.h"
+#include "ContentSecurityPolicy.h"
 #include "Document.h"
 #include "InspectorBaseAgent.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorStyleSheet.h"
 #include "InspectorValues.h"
 #include "PlatformString.h"
+#include "SecurityContext.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
@@ -61,6 +63,23 @@ class InspectorCSSAgent
     , public InspectorStyleSheet::Listener {
     WTF_MAKE_NONCOPYABLE(InspectorCSSAgent);
 public:
+    class InlineStyleOverrideScope {
+    public:
+        InlineStyleOverrideScope(SecurityContext* context)
+            : m_contentSecurityPolicy(context->contentSecurityPolicy())
+        {
+            m_contentSecurityPolicy->setOverrideAllowInlineStyle(true);
+        }
+
+        ~InlineStyleOverrideScope()
+        {
+            m_contentSecurityPolicy->setOverrideAllowInlineStyle(false);
+        }
+
+    private:
+        ContentSecurityPolicy* m_contentSecurityPolicy;
+    };
+
     static CSSStyleRule* asCSSStyleRule(CSSRule*);
 
     static PassOwnPtr<InspectorCSSAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorDOMAgent* domAgent)
diff --git a/Source/WebCore/inspector/InspectorClient.h b/Source/WebCore/inspector/InspectorClient.h
index 53b55c5ea..e4da688e3 100644
--- a/Source/WebCore/inspector/InspectorClient.h
+++ b/Source/WebCore/inspector/InspectorClient.h
@@ -34,7 +34,7 @@
 namespace WebCore {
 
 class InspectorController;
-class Node;
+class Frame;
 class Page;
 
 class InspectorClient : public InspectorFrontendChannel, public InspectorStateClient {
@@ -46,6 +46,7 @@ public:
     virtual void openInspectorFrontend(InspectorController*) = 0;
     virtual void closeInspectorFrontend() = 0;
     virtual void bringFrontendToFront() = 0;
+    virtual void didResizeMainFrame(Frame*) { }
 
     virtual void highlight() = 0;
     virtual void hideHighlight() = 0;
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index c08721d9b..cc9682bf4 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -111,7 +111,7 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
     InspectorDOMStorageAgent* domStorageAgent = domStorageAgentPtr.get();
     m_agents.append(domStorageAgentPtr.release());
     m_agents.append(InspectorMemoryAgent::create(m_instrumentingAgents.get(), m_state.get(), m_page, m_domAgent));
-    m_agents.append(InspectorTimelineAgent::create(m_instrumentingAgents.get(), m_state.get()));
+    m_agents.append(InspectorTimelineAgent::create(m_instrumentingAgents.get(), m_state.get(), InspectorTimelineAgent::PageInspector));
     m_agents.append(InspectorApplicationCacheAgent::create(m_instrumentingAgents.get(), m_state.get(), pageAgent));
 
     OwnPtr<InspectorResourceAgent> resourceAgentPtr(InspectorResourceAgent::create(m_instrumentingAgents.get(), pageAgent, inspectorClient, m_state.get()));
@@ -361,7 +361,6 @@ void InspectorController::resume()
         m_debuggerAgent->resume(&error);
     }
 }
-
 #endif
 
 void InspectorController::setResourcesDataSizeLimitsFromInternals(int maximumResourcesContentSize, int maximumSingleResourceContentSize)
diff --git a/Source/WebCore/inspector/InspectorController.h b/Source/WebCore/inspector/InspectorController.h
index 5ee2330e1..98aef7776 100644
--- a/Source/WebCore/inspector/InspectorController.h
+++ b/Source/WebCore/inspector/InspectorController.h
@@ -108,6 +108,7 @@ public:
 
     void setResourcesDataSizeLimitsFromInternals(int maximumResourcesContentSize, int maximumSingleResourceContentSize);
 
+    InspectorClient* inspectorClient() const { return m_inspectorClient; }
     InspectorPageAgent* pageAgent() const { return m_pageAgent; }
 
 private:
diff --git a/Source/WebCore/inspector/InspectorCounters.cpp b/Source/WebCore/inspector/InspectorCounters.cpp
index 70697077b..d17e289da 100644
--- a/Source/WebCore/inspector/InspectorCounters.cpp
+++ b/Source/WebCore/inspector/InspectorCounters.cpp
@@ -30,6 +30,7 @@
 
 #include "config.h"
 #include "InspectorCounters.h"
+#include "ThreadGlobalData.h"
 
 #if ENABLE(INSPECTOR)
 
@@ -42,6 +43,22 @@ int InspectorCounters::counterValue(CounterType type)
     return s_counters[type];
 }
 
+ThreadLocalInspectorCounters::ThreadLocalInspectorCounters()
+{
+    for (size_t i = 0; i < CounterTypeLength; i++)
+        m_counters[i] = 0;
+}
+
+int ThreadLocalInspectorCounters::counterValue(CounterType type)
+{
+    return m_counters[type];
+}
+
+ThreadLocalInspectorCounters& ThreadLocalInspectorCounters::current()
+{
+    return threadGlobalData().inspectorCounters();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorCounters.h b/Source/WebCore/inspector/InspectorCounters.h
index 03dc11072..3becf76c1 100644
--- a/Source/WebCore/inspector/InspectorCounters.h
+++ b/Source/WebCore/inspector/InspectorCounters.h
@@ -31,6 +31,10 @@
 #ifndef InspectorCounters_h
 #define InspectorCounters_h
 
+#if !ASSERT_DISABLED
+#include <wtf/MainThread.h>
+#endif
+
 namespace WebCore {
 
 class InspectorCounters {
@@ -45,6 +49,7 @@ public:
     static inline void incrementCounter(CounterType type)
     {
 #if ENABLE(INSPECTOR)
+        ASSERT(isMainThread());
         ++s_counters[type];
 #endif
     }
@@ -52,6 +57,7 @@ public:
     static inline void decrementCounter(CounterType type)
     {
 #if ENABLE(INSPECTOR)
+        ASSERT(isMainThread());
         --s_counters[type];
 #endif
     }
@@ -68,6 +74,35 @@ private:
 #endif
 };
 
+
+#if ENABLE(INSPECTOR)
+class ThreadLocalInspectorCounters {
+public:
+    enum CounterType {
+        JSEventListenerCounter,
+        CounterTypeLength
+    };
+    ThreadLocalInspectorCounters();
+
+    inline void incrementCounter(CounterType type)
+    {
+        ++m_counters[type];
+    }
+
+    inline void decrementCounter(CounterType type)
+    {
+        --m_counters[type];
+    }
+
+    int counterValue(CounterType);
+
+    static ThreadLocalInspectorCounters& current();
+
+private:
+    int m_counters[CounterTypeLength];
+};
+#endif
+
 } // namespace WebCore
 
 #endif // !defined(InspectorCounters_h)
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.cpp b/Source/WebCore/inspector/InspectorDOMAgent.cpp
index 0dea859fa..9a3480d52 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMAgent.cpp
@@ -81,6 +81,8 @@
 #include "RenderStyleConstants.h"
 #include "ScriptEventListener.h"
 #include "Settings.h"
+#include "ShadowRoot.h"
+#include "ShadowTree.h"
 #include "StylePropertySet.h"
 #include "StyleSheetList.h"
 #include "Text.h"
@@ -335,6 +337,11 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
         unbind(frameOwner->contentDocument(), nodesMap);
     }
 
+    if (node->isElementNode() && toElement(node)->hasShadowRoot()) {
+        for (ShadowRoot* root = toElement(node)->shadowTree()->youngestShadowRoot(); root; root = root->olderShadowRoot())
+            unbind(root, nodesMap);
+    }
+
     nodesMap->remove(node);
     bool childrenRequested = m_childrenRequested.contains(id);
     if (childrenRequested) {
@@ -371,18 +378,31 @@ Element* InspectorDOMAgent::assertElement(ErrorString* errorString, int nodeId)
     return toElement(node);
 }
 
+Node* InspectorDOMAgent::assertEditableNode(ErrorString* errorString, int nodeId)
+{
+    Node* node = assertNode(errorString, nodeId);
+    if (!node)
+        return 0;
+
+    if (node->isInShadowTree()) {
+        *errorString = "Can not edit nodes from shadow trees";
+        return 0;
+    }
+
+    return node;
+}
 
-HTMLElement* InspectorDOMAgent::assertHTMLElement(ErrorString* errorString, int nodeId)
+Element* InspectorDOMAgent::assertEditableElement(ErrorString* errorString, int nodeId)
 {
     Element* element = assertElement(errorString, nodeId);
     if (!element)
         return 0;
 
-    if (!element->isHTMLElement()) {
-        *errorString = "Node is not an HTML Element";
+    if (element->isInShadowTree()) {
+        *errorString = "Can not edit elements from shadow trees";
         return 0;
     }
-    return toHTMLElement(element);
+    return element;
 }
 
 void InspectorDOMAgent::getDocument(ErrorString*, RefPtr<InspectorObject>& root)
@@ -403,7 +423,7 @@ void InspectorDOMAgent::getDocument(ErrorString*, RefPtr<InspectorObject>& root)
 void InspectorDOMAgent::pushChildNodesToFrontend(int nodeId)
 {
     Node* node = nodeForId(nodeId);
-    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE && node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) || node->isShadowRoot())
+    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE && node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE))
         return;
     if (m_childrenRequested.contains(nodeId))
         return;
@@ -534,7 +554,7 @@ int InspectorDOMAgent::boundNodeId(Node* node)
 
 void InspectorDOMAgent::setAttributeValue(ErrorString* errorString, int elementId, const String& name, const String& value)
 {
-    Element* element = assertElement(errorString, elementId);
+    Element* element = assertEditableElement(errorString, elementId);
     if (!element)
         return;
 
@@ -543,7 +563,7 @@ void InspectorDOMAgent::setAttributeValue(ErrorString* errorString, int elementI
 
 void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elementId, const String& text, const String* const name)
 {
-    Element* element = assertElement(errorString, elementId);
+    Element* element = assertEditableElement(errorString, elementId);
     if (!element)
         return;
 
@@ -588,7 +608,7 @@ void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elemen
 
 void InspectorDOMAgent::removeAttribute(ErrorString* errorString, int elementId, const String& name)
 {
-    Element* element = assertElement(errorString, elementId);
+    Element* element = assertEditableElement(errorString, elementId);
     if (!element)
         return;
 
@@ -597,7 +617,7 @@ void InspectorDOMAgent::removeAttribute(ErrorString* errorString, int elementId,
 
 void InspectorDOMAgent::removeNode(ErrorString* errorString, int nodeId)
 {
-    Node* node = assertNode(errorString, nodeId);
+    Node* node = assertEditableNode(errorString, nodeId);
     if (!node)
         return;
 
@@ -662,7 +682,7 @@ void InspectorDOMAgent::setOuterHTML(ErrorString* errorString, int nodeId, const
         return;
     }
 
-    Node* node = assertNode(errorString, nodeId);
+    Node* node = assertEditableNode(errorString, nodeId);
     if (!node)
         return;
 
@@ -690,7 +710,7 @@ void InspectorDOMAgent::setOuterHTML(ErrorString* errorString, int nodeId, const
 
 void InspectorDOMAgent::setNodeValue(ErrorString* errorString, int nodeId, const String& value)
 {
-    Node* node = assertNode(errorString, nodeId);
+    Node* node = assertEditableNode(errorString, nodeId);
     if (!node)
         return;
 
@@ -1038,17 +1058,17 @@ void InspectorDOMAgent::hideHighlight(ErrorString*)
 
 void InspectorDOMAgent::moveTo(ErrorString* errorString, int nodeId, int targetElementId, const int* const anchorNodeId, int* newNodeId)
 {
-    Node* node = assertNode(errorString, nodeId);
+    Node* node = assertEditableNode(errorString, nodeId);
     if (!node)
         return;
 
-    Element* targetElement = assertElement(errorString, targetElementId);
+    Element* targetElement = assertEditableElement(errorString, targetElementId);
     if (!targetElement)
         return;
 
     Node* anchorNode = 0;
     if (anchorNodeId && *anchorNodeId) {
-        anchorNode = assertNode(errorString, *anchorNodeId);
+        anchorNode = assertEditableNode(errorString, *anchorNodeId);
         if (!anchorNode)
             return;
         if (anchorNode->parentNode() != targetElement) {
@@ -1159,9 +1179,6 @@ PassRefPtr<InspectorObject> InspectorDOMAgent::buildObjectForNode(Node* node, in
         localName = node->localName();
         break;
     case Node::DOCUMENT_FRAGMENT_NODE:
-        if (!node->isShadowRoot())
-            break;
-        // Fall through
     case Node::DOCUMENT_NODE:
     case Node::ELEMENT_NODE:
     default:
@@ -1194,6 +1211,12 @@ PassRefPtr<InspectorObject> InspectorDOMAgent::buildObjectForNode(Node* node, in
             if (doc)
                 value->setContentDocument(buildObjectForNode(doc, 0, nodesMap));
         }
+        if (element->hasShadowRoot()) {
+            RefPtr<InspectorArray> shadowRoots = InspectorArray::create();
+            for (ShadowRoot* root = element->shadowTree()->youngestShadowRoot(); root; root = root->olderShadowRoot())
+                shadowRoots->pushObject(buildObjectForNode(root, 0, nodesMap));
+            value->setShadowRoots(shadowRoots);
+        }
     } else if (node->isDocumentNode()) {
         Document* document = static_cast<Document*>(node);
         value->setDocumentURL(documentURLString(document));
@@ -1475,6 +1498,21 @@ void InspectorDOMAgent::didInvalidateStyleAttr(Node* node)
     m_revalidateStyleAttrTask->scheduleFor(static_cast<Element*>(node));
 }
 
+void InspectorDOMAgent::didPushShadowRoot(Element* host, ShadowRoot* root)
+{
+    int hostId = m_documentNodeToIdMap.get(host);
+    if (hostId)
+        m_frontend->shadowRootPushed(hostId, buildObjectForNode(root, 0, &m_documentNodeToIdMap));
+}
+
+void InspectorDOMAgent::willPopShadowRoot(Element* host, ShadowRoot* root)
+{
+    int hostId = m_documentNodeToIdMap.get(host);
+    int rootId = m_documentNodeToIdMap.get(root);
+    if (hostId && rootId)
+        m_frontend->shadowRootPopped(hostId, rootId);
+}
+
 Node* InspectorDOMAgent::nodeForPath(const String& path)
 {
     // The path is of form "1,HTML,2,BODY,1,DIV"
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.h b/Source/WebCore/inspector/InspectorDOMAgent.h
index e45d4636a..5a15001f8 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMAgent.h
@@ -69,6 +69,7 @@ class NameNodeMap;
 class Node;
 class RevalidateStyleAttributeTask;
 class ScriptValue;
+class ShadowRoot;
 
 struct Highlight;
 struct HighlightData;
@@ -167,6 +168,8 @@ public:
     void styleAttributeInvalidated(const Vector<Element*>& elements);
     void characterDataModified(CharacterData*);
     void didInvalidateStyleAttr(Node*);
+    void didPushShadowRoot(Element* host, ShadowRoot*);
+    void willPopShadowRoot(Element* host, ShadowRoot*);
 
     Node* nodeForId(int nodeId);
     int boundNodeId(Node*);
@@ -207,8 +210,10 @@ private:
     typedef HashMap<RefPtr<Node>, int> NodeToIdMap;
     int bind(Node*, NodeToIdMap*);
     void unbind(Node*, NodeToIdMap*);
+
     Element* assertElement(ErrorString*, int nodeId);
-    HTMLElement* assertHTMLElement(ErrorString*, int nodeId);
+    Node* assertEditableNode(ErrorString*, int nodeId);
+    Element* assertEditableElement(ErrorString*, int nodeId);
 
     int pushNodePathToFrontend(Node*);
     void pushChildNodesToFrontend(int nodeId);
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
index 9841e2002..d31a0a2b3 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
@@ -138,6 +138,7 @@ void InspectorFrontendClientLocal::windowObjectCleared()
 void InspectorFrontendClientLocal::frontendLoaded()
 {
     bringToFront();
+    setDockingUnavailable(!canAttachWindow());
     m_frontendLoaded = true;
     for (Vector<String>::iterator it = m_evaluateOnLoad.begin(); it != m_evaluateOnLoad.end(); ++it)
         evaluateOnLoad(*it);
@@ -168,6 +169,11 @@ bool InspectorFrontendClientLocal::canAttachWindow()
     return minimumAttachedHeight <= maximumAttachedHeight && !isInspectorPage;
 }
 
+void InspectorFrontendClientLocal::setDockingUnavailable(bool unavailable)
+{
+    evaluateOnLoad(String::format("[\"setDockingUnavailable\", %s]", unavailable ? "true" : "false"));
+}
+
 void InspectorFrontendClientLocal::changeAttachedWindowHeight(unsigned height)
 {
     unsigned totalHeight = m_frontendPage->mainFrame()->view()->visibleHeight() + m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
@@ -205,7 +211,7 @@ void InspectorFrontendClientLocal::moveWindowBy(float x, float y)
 
 void InspectorFrontendClientLocal::setAttachedWindow(bool attached)
 {
-    evaluateAsBoolean(String::format("InspectorFrontendAPI.setAttachedWindow(%s)", attached ? "true" : "false"));
+    evaluateOnLoad(String::format("[\"setAttachedWindow\", %s]", attached ? "true" : "false"));
 }
 
 void InspectorFrontendClientLocal::restoreAttachedWindowHeight()
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.h b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
index 8292d2289..c49e5783e 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.h
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
@@ -77,6 +77,7 @@ public:
     virtual void sendMessageToBackend(const String& message);
 
     bool canAttachWindow();
+    void setDockingUnavailable(bool);
 
     static unsigned constrainedAttachedWindowHeight(unsigned preferredHeight, unsigned totalWindowHeight);
 
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.cpp b/Source/WebCore/inspector/InspectorFrontendHost.cpp
index 01705e8c3..8872abd17 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendHost.cpp
@@ -181,6 +181,11 @@ void InspectorFrontendHost::bringToFront()
         m_client->bringToFront();
 }
 
+void InspectorFrontendHost::setZoomFactor(float zoom)
+{
+    m_frontendPage->mainFrame()->setPageAndTextZoomFactors(zoom, 1);
+}
+
 void InspectorFrontendHost::inspectedURLChanged(const String& newURL)
 {
     if (m_client)
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.h b/Source/WebCore/inspector/InspectorFrontendHost.h
index 5886885be..17d9d3276 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.h
+++ b/Source/WebCore/inspector/InspectorFrontendHost.h
@@ -63,6 +63,7 @@ public:
     void requestSetDockSide(const String&);
     void closeWindow();
     void bringToFront();
+    void setZoomFactor(float);
     void inspectedURLChanged(const String&);
 
     void setAttachedWindowHeight(unsigned height);
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.idl b/Source/WebCore/inspector/InspectorFrontendHost.idl
index 5a0572035..1127c3b83 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.idl
+++ b/Source/WebCore/inspector/InspectorFrontendHost.idl
@@ -37,6 +37,7 @@ module core {
         void loaded();
         void closeWindow();
         void bringToFront();
+        void setZoomFactor(in float zoom);
         void inspectedURLChanged(in DOMString newURL);
 
         void requestAttachWindow();
diff --git a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
index d767ff656..1cac012da 100644
--- a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
+++ b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
@@ -58,6 +58,7 @@
 #include "InstrumentingAgents.h"
 #include "Page.h"
 #include "PageGroup.h"
+#include "PageGroupIndexedDatabase.h"
 #include "SecurityOrigin.h"
 
 #include <wtf/Vector.h>
@@ -633,7 +634,7 @@ static Document* assertDocument(ErrorString* errorString, const String& frameId,
 static IDBFactoryBackendInterface* assertIDBFactory(ErrorString* errorString, Document* document)
 {
     Page* page = document ? document->page() : 0;
-    IDBFactoryBackendInterface* idbFactory = page ? page->group().idbFactory() : 0;
+    IDBFactoryBackendInterface* idbFactory = page ? PageGroupIndexedDatabase::from(page->group())->factoryBackend() : 0;
 
     if (!idbFactory)
         *errorString = "No IndexedDB factory for given frame found";
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index 532eb8665..27b742c2e 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -63,6 +63,7 @@
 #include "ScriptArguments.h"
 #include "ScriptCallStack.h"
 #include "ScriptProfile.h"
+#include "StyleRule.h"
 #include "WorkerContext.h"
 #include "WorkerThread.h"
 #include "XMLHttpRequest.h"
@@ -201,6 +202,18 @@ void InspectorInstrumentation::mediaQueryResultChangedImpl(InstrumentingAgents*
         cssAgent->mediaQueryResultChanged();
 }
 
+void InspectorInstrumentation::didPushShadowRootImpl(InstrumentingAgents* instrumentingAgents, Element* host, ShadowRoot* root)
+{
+    if (InspectorDOMAgent* domAgent = instrumentingAgents->inspectorDOMAgent())
+        domAgent->didPushShadowRoot(host, root);
+}
+
+void InspectorInstrumentation::willPopShadowRootImpl(InstrumentingAgents* instrumentingAgents, Element* host, ShadowRoot* root)
+{
+    if (InspectorDOMAgent* domAgent = instrumentingAgents->inspectorDOMAgent())
+        domAgent->willPopShadowRoot(host, root);
+}
+
 void InspectorInstrumentation::mouseDidMoveOverElementImpl(InstrumentingAgents* instrumentingAgents, const HitTestResult& result, unsigned modifierFlags)
 {
     if (InspectorDOMAgent* domAgent = instrumentingAgents->inspectorDOMAgent())
@@ -369,6 +382,12 @@ void InspectorInstrumentation::didFireTimerImpl(const InspectorInstrumentationCo
         timelineAgent->didFireTimer();
 }
 
+void InspectorInstrumentation::didBeginFrameImpl(InstrumentingAgents* instrumentingAgents)
+{
+    if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent())
+        timelineAgent->didBeginFrame();
+}
+
 InspectorInstrumentationCookie InspectorInstrumentation::willLayoutImpl(InstrumentingAgents* instrumentingAgents)
 {
     int timelineAgentId = 0;
@@ -452,11 +471,11 @@ void InspectorInstrumentation::didScheduleStyleRecalculationImpl(InstrumentingAg
         resourceAgent->didScheduleStyleRecalculation(document);
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willMatchRuleImpl(InstrumentingAgents* instrumentingAgents, const CSSStyleRule* rule)
+InspectorInstrumentationCookie InspectorInstrumentation::willMatchRuleImpl(InstrumentingAgents* instrumentingAgents, const StyleRule* rule)
 {
     InspectorCSSAgent* cssAgent = instrumentingAgents->inspectorCSSAgent();
     if (cssAgent) {
-        cssAgent->willMatchRule(rule);
+        cssAgent->willMatchRule(rule->ensureCSSStyleRule());
         return InspectorInstrumentationCookie(instrumentingAgents, 1);
     }
 
@@ -470,14 +489,11 @@ void InspectorInstrumentation::didMatchRuleImpl(const InspectorInstrumentationCo
         cssAgent->didMatchRule(matched);
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willProcessRuleImpl(InstrumentingAgents* instrumentingAgents, const CSSRule* rule)
+InspectorInstrumentationCookie InspectorInstrumentation::willProcessRuleImpl(InstrumentingAgents* instrumentingAgents, const StyleRule* rule)
 {
-    if (!rule->isStyleRule())
-        return InspectorInstrumentationCookie();
-
     InspectorCSSAgent* cssAgent = instrumentingAgents->inspectorCSSAgent();
     if (cssAgent) {
-        cssAgent->willProcessRule(static_cast<const CSSStyleRule*>(rule));
+        cssAgent->willProcessRule(rule->ensureCSSStyleRule());
         return InspectorInstrumentationCookie(instrumentingAgents, 1);
     }
 
@@ -1051,6 +1067,13 @@ InstrumentingAgents* InspectorInstrumentation::instrumentingAgentsForWorkerConte
         return 0;
     return instrumentationForWorkerContext(workerContext);
 }
+
+InstrumentingAgents* InspectorInstrumentation::instrumentingAgentsForNonDocumentContext(ScriptExecutionContext* context)
+{
+    if (context->isWorkerContext())
+        return instrumentationForWorkerContext(static_cast<WorkerContext*>(context));
+    return 0;
+}
 #endif
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index 5d5c2d3d3..2ac74dac0 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -42,7 +42,6 @@
 namespace WebCore {
 
 class CSSRule;
-class CSSStyleRule;
 class CharacterData;
 class DOMFileSystem;
 class DOMWindow;
@@ -64,7 +63,9 @@ class ScriptArguments;
 class ScriptCallStack;
 class ScriptExecutionContext;
 class ScriptProfile;
+class ShadowRoot;
 class StorageArea;
+class StyleRule;
 class WorkerContext;
 class WorkerContextProxy;
 class XMLHttpRequest;
@@ -93,6 +94,8 @@ public:
     static void didInvalidateStyleAttr(Document*, Node*);
     static void frameWindowDiscarded(Frame*, DOMWindow*);
     static void mediaQueryResultChanged(Document*);
+    static void didPushShadowRoot(Element* host, ShadowRoot*);
+    static void willPopShadowRoot(Element* host, ShadowRoot*);
 
     static void mouseDidMoveOverElement(Page*, const HitTestResult&, unsigned modifierFlags);
     static bool handleMousePress(Page*);
@@ -103,7 +106,7 @@ public:
     static void didInstallTimer(ScriptExecutionContext*, int timerId, int timeout, bool singleShot);
     static void didRemoveTimer(ScriptExecutionContext*, int timerId);
 
-    static InspectorInstrumentationCookie willCallFunction(Page*, const String& scriptName, int scriptLine);
+    static InspectorInstrumentationCookie willCallFunction(ScriptExecutionContext*, const String& scriptName, int scriptLine);
     static void didCallFunction(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willChangeXHRReadyState(ScriptExecutionContext*, XMLHttpRequest* request);
     static void didChangeXHRReadyState(const InspectorInstrumentationCookie&);
@@ -117,6 +120,7 @@ public:
     static void didEvaluateScript(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willFireTimer(ScriptExecutionContext*, int timerId);
     static void didFireTimer(const InspectorInstrumentationCookie&);
+    static void didBeginFrame(Page*);
     static InspectorInstrumentationCookie willLayout(Frame*);
     static void didLayout(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willLoadXHR(ScriptExecutionContext*, XMLHttpRequest*);
@@ -126,9 +130,9 @@ public:
     static InspectorInstrumentationCookie willRecalculateStyle(Document*);
     static void didRecalculateStyle(const InspectorInstrumentationCookie&);
     static void didScheduleStyleRecalculation(Document*);
-    static InspectorInstrumentationCookie willMatchRule(Document*, const CSSStyleRule*);
+    static InspectorInstrumentationCookie willMatchRule(Document*, const StyleRule*);
     static void didMatchRule(const InspectorInstrumentationCookie&, bool matched);
-    static InspectorInstrumentationCookie willProcessRule(Document*, const CSSRule*);
+    static InspectorInstrumentationCookie willProcessRule(Document*, const StyleRule*);
     static void didProcessRule(const InspectorInstrumentationCookie&);
 
     static void applyUserAgentOverride(Frame*, String*);
@@ -243,6 +247,8 @@ private:
     static void didInvalidateStyleAttrImpl(InstrumentingAgents*, Node*);
     static void frameWindowDiscardedImpl(InstrumentingAgents*, DOMWindow*);
     static void mediaQueryResultChangedImpl(InstrumentingAgents*);
+    static void didPushShadowRootImpl(InstrumentingAgents*, Element* host, ShadowRoot*);
+    static void willPopShadowRootImpl(InstrumentingAgents*, Element* host, ShadowRoot*);
 
     static void mouseDidMoveOverElementImpl(InstrumentingAgents*, const HitTestResult&, unsigned modifierFlags);
     static bool handleMousePressImpl(InstrumentingAgents*);
@@ -267,6 +273,7 @@ private:
     static void didEvaluateScriptImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willFireTimerImpl(InstrumentingAgents*, int timerId);
     static void didFireTimerImpl(const InspectorInstrumentationCookie&);
+    static void didBeginFrameImpl(InstrumentingAgents*);
     static InspectorInstrumentationCookie willLayoutImpl(InstrumentingAgents*);
     static void didLayoutImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willLoadXHRImpl(InstrumentingAgents*, XMLHttpRequest*);
@@ -276,9 +283,9 @@ private:
     static InspectorInstrumentationCookie willRecalculateStyleImpl(InstrumentingAgents*);
     static void didRecalculateStyleImpl(const InspectorInstrumentationCookie&);
     static void didScheduleStyleRecalculationImpl(InstrumentingAgents*, Document*);
-    static InspectorInstrumentationCookie willMatchRuleImpl(InstrumentingAgents*, const CSSStyleRule*);
+    static InspectorInstrumentationCookie willMatchRuleImpl(InstrumentingAgents*, const StyleRule*);
     static void didMatchRuleImpl(const InspectorInstrumentationCookie&, bool matched);
-    static InspectorInstrumentationCookie willProcessRuleImpl(InstrumentingAgents*, const CSSRule*);
+    static InspectorInstrumentationCookie willProcessRuleImpl(InstrumentingAgents*, const StyleRule*);
     static void didProcessRuleImpl(const InspectorInstrumentationCookie&);
 
     static void applyUserAgentOverrideImpl(InstrumentingAgents*, String*);
@@ -367,6 +374,7 @@ private:
     static InstrumentingAgents* instrumentingAgentsForDocument(Document*);
 #if ENABLE(WORKERS)
     static InstrumentingAgents* instrumentingAgentsForWorkerContext(WorkerContext*);
+    static InstrumentingAgents* instrumentingAgentsForNonDocumentContext(ScriptExecutionContext*);
 #endif
 
     static bool collectingHTMLParseErrors(InstrumentingAgents*);
@@ -478,6 +486,24 @@ inline void InspectorInstrumentation::mediaQueryResultChanged(Document* document
 #endif
 }
 
+inline void InspectorInstrumentation::didPushShadowRoot(Element* host, ShadowRoot* root)
+{
+#if ENABLE(INSPECTOR)
+    FAST_RETURN_IF_NO_FRONTENDS(void());
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(host->ownerDocument()))
+        didPushShadowRootImpl(instrumentingAgents, host, root);
+#endif
+}
+
+inline void InspectorInstrumentation::willPopShadowRoot(Element* host, ShadowRoot* root)
+{
+#if ENABLE(INSPECTOR)
+    FAST_RETURN_IF_NO_FRONTENDS(void());
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(host->ownerDocument()))
+        willPopShadowRootImpl(instrumentingAgents, host, root);
+#endif
+}
+
 inline void InspectorInstrumentation::mouseDidMoveOverElement(Page* page, const HitTestResult& result, unsigned modifierFlags)
 {
 #if ENABLE(INSPECTOR)
@@ -552,16 +578,17 @@ inline void InspectorInstrumentation::didRemoveTimer(ScriptExecutionContext* con
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willCallFunction(Page* page, const String& scriptName, int scriptLine)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willCallFunction(ScriptExecutionContext* context, const String& scriptName, int scriptLine)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(InspectorInstrumentationCookie());
-    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForPage(page))
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForContext(context))
         return willCallFunctionImpl(instrumentingAgents, scriptName, scriptLine);
 #endif
     return InspectorInstrumentationCookie();
 }
 
+
 inline void InspectorInstrumentation::didCallFunction(const InspectorInstrumentationCookie& cookie)
 {
 #if ENABLE(INSPECTOR)
@@ -685,6 +712,15 @@ inline void InspectorInstrumentation::didFireTimer(const InspectorInstrumentatio
 #endif
 }
 
+inline void InspectorInstrumentation::didBeginFrame(Page* page)
+{
+#if ENABLE(INSPECTOR)
+    FAST_RETURN_IF_NO_FRONTENDS(void());
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForPage(page))
+        didBeginFrameImpl(instrumentingAgents);
+#endif
+}
+
 inline InspectorInstrumentationCookie InspectorInstrumentation::willLayout(Frame* frame)
 {
 #if ENABLE(INSPECTOR)
@@ -770,7 +806,7 @@ inline void InspectorInstrumentation::didScheduleStyleRecalculation(Document* do
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willMatchRule(Document* document, const CSSStyleRule* rule)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willMatchRule(Document* document, const StyleRule* rule)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(InspectorInstrumentationCookie());
@@ -789,7 +825,7 @@ inline void InspectorInstrumentation::didMatchRule(const InspectorInstrumentatio
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willProcessRule(Document* document, const CSSRule* rule)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willProcessRule(Document* document, const StyleRule* rule)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(InspectorInstrumentationCookie());
@@ -1218,9 +1254,15 @@ inline bool InspectorInstrumentation::collectingHTMLParseErrors(Page* page)
 
 inline InstrumentingAgents* InspectorInstrumentation::instrumentingAgentsForContext(ScriptExecutionContext* context)
 {
-    if (context && context->isDocument())
+    if (!context)
+        return 0;
+    if (context->isDocument())
         return instrumentingAgentsForPage(static_cast<Document*>(context)->page());
+#if ENABLE(WORKERS)
+    return instrumentingAgentsForNonDocumentContext(context);
+#else
     return 0;
+#endif
 }
 
 inline InstrumentingAgents* InspectorInstrumentation::instrumentingAgentsForFrame(Frame* frame)
diff --git a/Source/WebCore/inspector/InspectorPageAgent.cpp b/Source/WebCore/inspector/InspectorPageAgent.cpp
index 8e8b25abf..55384f2a2 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorPageAgent.cpp
@@ -131,20 +131,18 @@ static bool hasTextContent(CachedResource* cachedResource)
     return type == InspectorPageAgent::StylesheetResource || type == InspectorPageAgent::ScriptResource || type == InspectorPageAgent::XHRResource;
 }
 
-// static
-PassRefPtr<TextResourceDecoder> InspectorPageAgent::createDecoder(const String& mimeType, const String& textEncodingName)
+static PassRefPtr<TextResourceDecoder> createXHRTextDecoder(const String& mimeType, const String& textEncodingName)
 {
     RefPtr<TextResourceDecoder> decoder;
     if (!textEncodingName.isEmpty())
         decoder = TextResourceDecoder::create("text/plain", textEncodingName);
-    else if (mimeType == "text/plain")
-        decoder = TextResourceDecoder::create("text/plain", "ISO-8859-1");
-    else if (mimeType == "text/html")
-        decoder = TextResourceDecoder::create("text/html", "UTF-8");
-    else if (DOMImplementation::isXMLMIMEType(mimeType)) {
+    else if (DOMImplementation::isXMLMIMEType(mimeType.lower())) {
         decoder = TextResourceDecoder::create("application/xml");
         decoder->useLenientXMLDecoding();
-    }
+    } else if (equalIgnoringCase(mimeType, "text/html"))
+        decoder = TextResourceDecoder::create("text/html", "UTF-8");
+    else
+        decoder = TextResourceDecoder::create("text/plain", "UTF-8");
     return decoder;
 }
 
@@ -174,7 +172,7 @@ bool InspectorPageAgent::cachedResourceContent(CachedResource* cachedResource, S
     if (cachedResource) {
         switch (cachedResource->type()) {
         case CachedResource::CSSStyleSheet:
-            *result = static_cast<CachedCSSStyleSheet*>(cachedResource)->sheetText();
+            *result = static_cast<CachedCSSStyleSheet*>(cachedResource)->sheetText(false);
             return true;
         case CachedResource::Script:
             *result = static_cast<CachedScript*>(cachedResource)->script();
@@ -183,7 +181,7 @@ bool InspectorPageAgent::cachedResourceContent(CachedResource* cachedResource, S
             SharedBuffer* buffer = cachedResource->data();
             if (!buffer)
                 return false;
-            RefPtr<TextResourceDecoder> decoder = InspectorPageAgent::createDecoder(cachedResource->response().mimeType(), cachedResource->response().textEncodingName());
+            RefPtr<TextResourceDecoder> decoder = createXHRTextDecoder(cachedResource->response().mimeType(), cachedResource->response().textEncodingName());
             // We show content for raw resources only for certain mime types (text, html and xml). Otherwise decoder will be null.
             if (!decoder)
                 return false;
diff --git a/Source/WebCore/inspector/InspectorPageAgent.h b/Source/WebCore/inspector/InspectorPageAgent.h
index 8fd7b4208..df95ee20f 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.h
+++ b/Source/WebCore/inspector/InspectorPageAgent.h
@@ -78,7 +78,6 @@ public:
 
     static PassOwnPtr<InspectorPageAgent> create(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*, InspectorClient*);
 
-    static PassRefPtr<TextResourceDecoder> createDecoder(const String& mimeType, const String& textEncodingName);
     static bool cachedResourceContent(CachedResource*, String* result, bool* base64Encoded);
     static bool sharedBufferContent(PassRefPtr<SharedBuffer>, const String& textEncodingName, bool withBase64Encode, String* result);
     static void resourceContent(ErrorString*, Frame*, const KURL&, String* result, bool* base64Encoded);
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.cpp b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
index 08e9ea63a..388653fcd 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
@@ -50,10 +50,6 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/text/StringConcatenate.h>
 
-#if USE(JSC)
-#include "JSDOMWindow.h"
-#endif
-
 namespace WebCore {
 
 namespace ProfilerAgentState {
@@ -65,15 +61,63 @@ static const char* const UserInitiatedProfileName = "org.webkit.profiles.user-in
 static const char* const CPUProfileType = "CPU";
 static const char* const HeapProfileType = "HEAP";
 
+
+class PageProfilerAgent : public InspectorProfilerAgent {
+public:
+    PageProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage, InspectorState* state, InjectedScriptManager* injectedScriptManager)
+        : InspectorProfilerAgent(instrumentingAgents, consoleAgent, state, injectedScriptManager), m_inspectedPage(inspectedPage) { }
+    virtual ~PageProfilerAgent() { }
+
+private:
+    virtual void startProfiling(const String& title)
+    {
+        ScriptProfiler::startForPage(m_inspectedPage, title);
+    }
+
+    virtual PassRefPtr<ScriptProfile> stopProfiling(const String& title)
+    {
+        return ScriptProfiler::stopForPage(m_inspectedPage, title);
+    }
+
+    Page* m_inspectedPage;
+};
+
 PassOwnPtr<InspectorProfilerAgent> InspectorProfilerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
 {
-    return adoptPtr(new InspectorProfilerAgent(instrumentingAgents, consoleAgent, inspectedPage, inspectorState, injectedScriptManager));
+    return adoptPtr(new PageProfilerAgent(instrumentingAgents, consoleAgent, inspectedPage, inspectorState, injectedScriptManager));
+}
+
+
+#if ENABLE(WORKERS)
+class WorkerProfilerAgent : public InspectorProfilerAgent {
+public:
+    WorkerProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, WorkerContext* workerContext, InspectorState* state, InjectedScriptManager* injectedScriptManager)
+        : InspectorProfilerAgent(instrumentingAgents, consoleAgent, state, injectedScriptManager), m_workerContext(workerContext) { }
+    virtual ~WorkerProfilerAgent() { }
+
+private:
+    virtual void startProfiling(const String& title)
+    {
+        ScriptProfiler::startForWorkerContext(m_workerContext, title);
+    }
+
+    virtual PassRefPtr<ScriptProfile> stopProfiling(const String& title)
+    {
+        return ScriptProfiler::stopForWorkerContext(m_workerContext, title);
+    }
+
+    WorkerContext* m_workerContext;
+};
+
+PassOwnPtr<InspectorProfilerAgent> InspectorProfilerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, WorkerContext* workerContext, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
+{
+    return adoptPtr(new WorkerProfilerAgent(instrumentingAgents, consoleAgent, workerContext, inspectorState, injectedScriptManager));
 }
+#endif
 
-InspectorProfilerAgent::InspectorProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
+InspectorProfilerAgent::InspectorProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
     : InspectorBaseAgent<InspectorProfilerAgent>("Profiler", instrumentingAgents, inspectorState)
     , m_consoleAgent(consoleAgent)
-    , m_inspectedPage(inspectedPage)
     , m_injectedScriptManager(injectedScriptManager)
     , m_frontend(0)
     , m_enabled(false)
@@ -318,12 +362,7 @@ void InspectorProfilerAgent::start(ErrorString*)
     }
     m_recordingUserInitiatedProfile = true;
     String title = getCurrentUserInitiatedProfileName(true);
-#if USE(JSC)
-    JSC::ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
-#else
-    ScriptState* scriptState = 0;
-#endif
-    ScriptProfiler::start(scriptState, title);
+    startProfiling(title);
     addStartProfilingMessageToConsole(title, 0, String());
     toggleRecordButton(true);
     m_state->setBoolean(ProfilerAgentState::userInitiatedProfiling, true);
@@ -335,14 +374,7 @@ void InspectorProfilerAgent::stop(ErrorString*)
         return;
     m_recordingUserInitiatedProfile = false;
     String title = getCurrentUserInitiatedProfileName();
-#if USE(JSC)
-    JSC::ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
-#else
-    // Use null script state to avoid filtering by context security token.
-    // All functions from all iframes should be visible from Inspector UI.
-    ScriptState* scriptState = 0;
-#endif
-    RefPtr<ScriptProfile> profile = ScriptProfiler::stop(scriptState, title);
+    RefPtr<ScriptProfile> profile = stopProfiling(title);
     if (profile)
         addProfile(profile, 0, String());
     toggleRecordButton(false);
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.h b/Source/WebCore/inspector/InspectorProfilerAgent.h
index a5576d899..e0b05a826 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.h
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.h
@@ -52,6 +52,7 @@ class InstrumentingAgents;
 class Page;
 class ScriptHeapSnapshot;
 class ScriptProfile;
+class WorkerContext;
 
 typedef String ErrorString;
 
@@ -59,6 +60,9 @@ class InspectorProfilerAgent : public InspectorBaseAgent<InspectorProfilerAgent>
     WTF_MAKE_NONCOPYABLE(InspectorProfilerAgent); WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<InspectorProfilerAgent> create(InstrumentingAgents*, InspectorConsoleAgent*, Page*, InspectorState*, InjectedScriptManager*);
+#if ENABLE(WORKERS)
+    static PassOwnPtr<InspectorProfilerAgent> create(InstrumentingAgents*, InspectorConsoleAgent*, WorkerContext*, InspectorState*, InjectedScriptManager*);
+#endif
     virtual ~InspectorProfilerAgent();
 
     void addProfile(PassRefPtr<ScriptProfile> prpProfile, unsigned lineNumber, const String& sourceURL);
@@ -94,6 +98,11 @@ public:
 
     virtual void getObjectByHeapObjectId(ErrorString*, int id, const String* objectGroup, RefPtr<InspectorObject>& result);
 
+protected:
+    InspectorProfilerAgent(InstrumentingAgents*, InspectorConsoleAgent*, InspectorState*, InjectedScriptManager*);
+    virtual void startProfiling(const String& title) = 0;
+    virtual PassRefPtr<ScriptProfile> stopProfiling(const String& title) = 0;
+
 private:
     typedef HashMap<unsigned int, RefPtr<ScriptProfile> > ProfilesMap;
     typedef HashMap<unsigned int, RefPtr<ScriptHeapSnapshot> > HeapSnapshotsMap;
@@ -101,12 +110,10 @@ private:
     void resetFrontendProfiles();
     void restoreEnablement();
 
-    InspectorProfilerAgent(InstrumentingAgents*, InspectorConsoleAgent*, Page*, InspectorState*, InjectedScriptManager*);
     PassRefPtr<InspectorObject> createProfileHeader(const ScriptProfile& profile);
     PassRefPtr<InspectorObject> createSnapshotHeader(const ScriptHeapSnapshot& snapshot);
 
     InspectorConsoleAgent* m_consoleAgent;
-    Page* m_inspectedPage;
     InjectedScriptManager* m_injectedScriptManager;
     InspectorFrontend::Profiler* m_frontend;
     bool m_enabled;
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.cpp b/Source/WebCore/inspector/InspectorStyleSheet.cpp
index b72461e17..bf13ac917 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.cpp
+++ b/Source/WebCore/inspector/InspectorStyleSheet.cpp
@@ -30,12 +30,14 @@
 #include "CSSImportRule.h"
 #include "CSSMediaRule.h"
 #include "CSSParser.h"
+#include "CSSPropertyNames.h"
 #include "CSSPropertySourceData.h"
 #include "CSSRule.h"
 #include "CSSRuleList.h"
 #include "CSSStyleRule.h"
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
+#include "ContentSecurityPolicy.h"
 #include "Document.h"
 #include "Element.h"
 #include "HTMLHeadElement.h"
@@ -46,6 +48,7 @@
 #include "InspectorValues.h"
 #include "Node.h"
 #include "SVGNames.h"
+#include "StyleRule.h"
 #include "StyleSheetList.h"
 #include "WebKitCSSKeyframesRule.h"
 
@@ -329,6 +332,10 @@ bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText,
 
     InspectorStyleTextEditor editor(&allProperties, &m_disabledProperties, text, newLineAndWhitespaceDelimiters());
     if (overwrite) {
+        if (index >= allProperties.size()) {
+            ec = INDEX_SIZE_ERR;
+            return false;
+        }
         *oldText = allProperties.at(index).rawText;
         editor.replaceProperty(index, propertyText);
     } else
@@ -478,7 +485,10 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
                 // Parsed property overrides any property with the same name. Non-parsed property overrides
                 // previous non-parsed property with the same name (if any).
                 bool shouldInactivate = false;
-                HashMap<String, RefPtr<InspectorObject> >::iterator activeIt = propertyNameToPreviousActiveProperty.find(name);
+                CSSPropertyID propertyId = static_cast<CSSPropertyID>(cssPropertyID(name));
+                // Canonicalize property names to treat non-prefixed and vendor-prefixed property names the same (opacity vs. -webkit-opacity).
+                String canonicalPropertyName = propertyId ? String(getPropertyName(propertyId)) : name;
+                HashMap<String, RefPtr<InspectorObject> >::iterator activeIt = propertyNameToPreviousActiveProperty.find(canonicalPropertyName);
                 if (activeIt != propertyNameToPreviousActiveProperty.end()) {
                     if (propertyEntry.parsedOk)
                         shouldInactivate = true;
@@ -489,12 +499,12 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
                             shouldInactivate = true;
                     }
                 } else
-                    propertyNameToPreviousActiveProperty.set(name, property);
+                    propertyNameToPreviousActiveProperty.set(canonicalPropertyName, property);
 
                 if (shouldInactivate) {
                     activeIt->second->setString("status", "inactive");
                     activeIt->second->remove("shorthandName");
-                    propertyNameToPreviousActiveProperty.set(name, property);
+                    propertyNameToPreviousActiveProperty.set(canonicalPropertyName, property);
                 }
             } else {
                 bool implicit = m_style->isPropertyImplicit(name);
@@ -862,7 +872,7 @@ PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForRule(CSSStyleRule
     // "sourceURL" is present only for regular rules, otherwise "origin" should be used in the frontend.
     if (m_origin == "regular")
         result->setString("sourceURL", finalURL());
-    result->setNumber("sourceLine", rule->sourceLine());
+    result->setNumber("sourceLine", rule->styleRule()->sourceLine());
     result->setString("origin", m_origin);
 
     result->setObject("style", buildObjectForStyle(rule->style()));
@@ -1148,7 +1158,7 @@ void InspectorStyleSheet::revalidateStyle(CSSStyleDeclaration* pageStyle)
     for (unsigned i = 0, size = m_flatRules.size(); i < size; ++i) {
         CSSStyleRule* parsedRule = m_flatRules.at(i);
         if (parsedRule->style() == pageStyle) {
-            if (parsedRule->declaration()->asText() != pageStyle->cssText()) {
+            if (parsedRule->styleRule()->properties()->asText() != pageStyle->cssText()) {
                 // Clear the disabled properties for the invalid style here.
                 m_inspectorStyles.remove(pageStyle);
                 setStyleText(pageStyle, pageStyle->cssText());
@@ -1318,7 +1328,12 @@ bool InspectorStyleSheetForInlineStyle::setStyleText(CSSStyleDeclaration* style,
 {
     ASSERT_UNUSED(style, style == inlineStyle());
     ExceptionCode ec = 0;
-    m_element->setAttribute("style", text, ec);
+
+    {
+        InspectorCSSAgent::InlineStyleOverrideScope overrideScope(m_element->ownerDocument());
+        m_element->setAttribute("style", text, ec);
+    }
+
     m_styleText = text;
     m_isStyleTextValid = true;
     m_ruleSourceData.clear();
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.cpp b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
index ed7d143d5..7d4703731 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -60,6 +60,8 @@ static const char EventDispatch[] = "EventDispatch";
 static const char Layout[] = "Layout";
 static const char RecalculateStyles[] = "RecalculateStyles";
 static const char Paint[] = "Paint";
+static const char BeginFrame[] = "BeginFrame";
+
 static const char ParseHTML[] = "ParseHTML";
 
 static const char TimerInstall[] = "TimerInstall";
@@ -98,9 +100,9 @@ void InspectorTimelineAgent::pushGCEventRecords()
     GCEvents events = m_gcEvents;
     m_gcEvents.clear();
     for (GCEvents::iterator i = events.begin(); i != events.end(); ++i) {
-        RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(i->startTime, m_maxCallStackDepth);
+        RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(timestampFromMicroseconds(i->startTime), m_maxCallStackDepth);
         record->setObject("data", TimelineRecordFactory::createGCEventData(i->collectedBytes));
-        record->setNumber("endTime", i->endTime);
+        record->setNumber("endTime", timestampFromMicroseconds(i->endTime));
         addRecordToTimeline(record.release(), TimelineRecordType::GCEvent);
     }
 }
@@ -146,7 +148,7 @@ void InspectorTimelineAgent::start(ErrorString*, const int* maxCallStackDepth)
     else
         m_maxCallStackDepth = 5;
     m_state->setLong(TimelineAgentState::timelineMaxCallStackDepth, m_maxCallStackDepth);
-
+    m_timestampOffset = currentTime() - monotonicallyIncreasingTime();
     m_instrumentingAgents->setInspectorTimelineAgent(this);
     ScriptGCEvent::addEventListener(this);
     m_state->setBoolean(TimelineAgentState::timelineAgentEnabled, true);
@@ -170,6 +172,11 @@ void InspectorTimelineAgent::setIncludeMemoryDetails(ErrorString*, bool value)
     m_state->setBoolean(TimelineAgentState::includeMemoryDetails, value);
 }
 
+void InspectorTimelineAgent::didBeginFrame()
+{
+    appendRecord(InspectorObject::create(), TimelineRecordType::BeginFrame, true);
+}
+
 void InspectorTimelineAgent::willCallFunction(const String& scriptName, int scriptLine)
 {
     pushCurrentRecord(TimelineRecordFactory::createFunctionCallData(scriptName, scriptLine), TimelineRecordType::FunctionCall, true);
@@ -292,7 +299,7 @@ void InspectorTimelineAgent::didScheduleResourceRequest(const String& url)
 void InspectorTimelineAgent::willSendResourceRequest(unsigned long identifier, const ResourceRequest& request)
 {
     pushGCEventRecords();
-    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS(), m_maxCallStackDepth);
+    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(timestamp(), m_maxCallStackDepth);
     String requestId = IdentifiersFactory::requestId(identifier);
     record->setObject("data", TimelineRecordFactory::createResourceSendRequestData(requestId, request));
     record->setString("type", TimelineRecordType::ResourceSendRequest);
@@ -391,9 +398,9 @@ void InspectorTimelineAgent::setHeapSizeStatistic(InspectorObject* record)
 
     if (m_state->getBoolean(TimelineAgentState::includeMemoryDetails)) {
         RefPtr<InspectorObject> counters = InspectorObject::create();
-        counters->setNumber("nodes", InspectorCounters::counterValue(InspectorCounters::NodeCounter));
-        counters->setNumber("documents", InspectorCounters::counterValue(InspectorCounters::DocumentCounter));
-        counters->setNumber("jsEventListeners", InspectorCounters::counterValue(InspectorCounters::JSEventListenerCounter));
+        counters->setNumber("nodes", (m_inspectorType == PageInspector) ? InspectorCounters::counterValue(InspectorCounters::NodeCounter) : 0);
+        counters->setNumber("documents", (m_inspectorType == PageInspector) ? InspectorCounters::counterValue(InspectorCounters::DocumentCounter) : 0);
+        counters->setNumber("jsEventListeners", ThreadLocalInspectorCounters::current().counterValue(ThreadLocalInspectorCounters::JSEventListenerCounter));
         record->setObject("counters", counters.release());
     }
 }
@@ -409,23 +416,24 @@ void InspectorTimelineAgent::didCompleteCurrentRecord(const String& type)
         ASSERT(entry.type == type);
         entry.record->setObject("data", entry.data);
         entry.record->setArray("children", entry.children);
-        entry.record->setNumber("endTime", WTF::currentTimeMS());
+        entry.record->setNumber("endTime", timestamp());
         addRecordToTimeline(entry.record, type);
     }
 }
 
-InspectorTimelineAgent::InspectorTimelineAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state)
+InspectorTimelineAgent::InspectorTimelineAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorType type)
     : InspectorBaseAgent<InspectorTimelineAgent>("Timeline", instrumentingAgents, state)
     , m_frontend(0)
     , m_id(1)
     , m_maxCallStackDepth(5)
+    , m_inspectorType(type)
 {
 }
 
 void InspectorTimelineAgent::appendRecord(PassRefPtr<InspectorObject> data, const String& type, bool captureCallStack)
 {
     pushGCEventRecords();
-    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS(), captureCallStack ? m_maxCallStackDepth : 0);
+    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(timestamp(), captureCallStack ? m_maxCallStackDepth : 0);
     record->setObject("data", data);
     record->setString("type", type);
     addRecordToTimeline(record.release(), type);
@@ -434,7 +442,7 @@ void InspectorTimelineAgent::appendRecord(PassRefPtr<InspectorObject> data, cons
 void InspectorTimelineAgent::pushCurrentRecord(PassRefPtr<InspectorObject> data, const String& type, bool captureCallStack)
 {
     pushGCEventRecords();
-    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS(), captureCallStack ? m_maxCallStackDepth : 0);
+    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(timestamp(), captureCallStack ? m_maxCallStackDepth : 0);
     m_recordStack.append(TimelineRecordEntry(record.release(), data, InspectorArray::create(), type));
 }
 
@@ -444,6 +452,16 @@ void InspectorTimelineAgent::clearRecordStack()
     m_id++;
 }
 
+double InspectorTimelineAgent::timestamp()
+{
+    return timestampFromMicroseconds(WTF::monotonicallyIncreasingTime());
+}
+
+double InspectorTimelineAgent::timestampFromMicroseconds(double microseconds)
+{
+    return (microseconds + m_timestampOffset) * 1000.0;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.h b/Source/WebCore/inspector/InspectorTimelineAgent.h
index e8c34869a..ba9855a30 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.h
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.h
@@ -56,9 +56,10 @@ typedef String ErrorString;
 class InspectorTimelineAgent : public InspectorBaseAgent<InspectorTimelineAgent>, ScriptGCEventListener, public InspectorBackendDispatcher::TimelineCommandHandler {
     WTF_MAKE_NONCOPYABLE(InspectorTimelineAgent);
 public:
-    static PassOwnPtr<InspectorTimelineAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state)
+    enum InspectorType { PageInspector, WorkerInspector };
+    static PassOwnPtr<InspectorTimelineAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorType type)
     {
-        return adoptPtr(new InspectorTimelineAgent(instrumentingAgents, state));
+        return adoptPtr(new InspectorTimelineAgent(instrumentingAgents, state, type));
     }
 
     ~InspectorTimelineAgent();
@@ -82,6 +83,8 @@ public:
     void willDispatchEvent(const Event&);
     void didDispatchEvent();
 
+    void didBeginFrame();
+
     void willLayout();
     void didLayout();
 
@@ -140,7 +143,7 @@ private:
         String type;
     };
         
-    InspectorTimelineAgent(InstrumentingAgents*, InspectorState*);
+    InspectorTimelineAgent(InstrumentingAgents*, InspectorState*, InspectorType);
 
     void pushCurrentRecord(PassRefPtr<InspectorObject>, const String& type, bool captureCallStack);
     void setHeapSizeStatistic(InspectorObject* record);
@@ -153,7 +156,11 @@ private:
     void pushGCEventRecords();
     void clearRecordStack();
 
+    double timestamp();
+    double timestampFromMicroseconds(double microseconds);
+
     InspectorFrontend::Timeline* m_frontend;
+    double m_timestampOffset;
 
     Vector<TimelineRecordEntry> m_recordStack;
 
@@ -170,6 +177,7 @@ private:
     typedef Vector<GCEvent> GCEvents;
     GCEvents m_gcEvents;
     int m_maxCallStackDepth;
+    InspectorType m_inspectorType;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/NetworkResourcesData.cpp b/Source/WebCore/inspector/NetworkResourcesData.cpp
index bc519e670..61fd2c83f 100644
--- a/Source/WebCore/inspector/NetworkResourcesData.cpp
+++ b/Source/WebCore/inspector/NetworkResourcesData.cpp
@@ -29,6 +29,7 @@
 #include "config.h"
 #include "NetworkResourcesData.h"
 
+#include "DOMImplementation.h"
 #include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
 
@@ -122,6 +123,21 @@ void NetworkResourcesData::resourceCreated(const String& requestId, const String
     m_requestIdToResourceDataMap.set(requestId, new ResourceData(requestId, loaderId));
 }
 
+static PassRefPtr<TextResourceDecoder> createOtherResourceTextDecoder(const String& mimeType, const String& textEncodingName)
+{
+    RefPtr<TextResourceDecoder> decoder;
+    if (!textEncodingName.isEmpty())
+        decoder = TextResourceDecoder::create("text/plain", textEncodingName);
+    else if (DOMImplementation::isXMLMIMEType(mimeType.lower())) {
+        decoder = TextResourceDecoder::create("application/xml");
+        decoder->useLenientXMLDecoding();
+    } else if (equalIgnoringCase(mimeType, "text/html"))
+        decoder = TextResourceDecoder::create("text/html", "UTF-8");
+    else if (mimeType == "text/plain")
+        decoder = TextResourceDecoder::create("text/plain", "ISO-8859-1");
+    return decoder;
+}
+
 void NetworkResourcesData::responseReceived(const String& requestId, const String& frameId, const ResourceResponse& response)
 {
     ResourceData* resourceData = m_requestIdToResourceDataMap.get(requestId);
@@ -129,7 +145,7 @@ void NetworkResourcesData::responseReceived(const String& requestId, const Strin
         return;
     resourceData->setFrameId(frameId);
     resourceData->setUrl(response.url());
-    resourceData->setDecoder(InspectorPageAgent::createDecoder(response.mimeType(), response.textEncodingName()));
+    resourceData->setDecoder(createOtherResourceTextDecoder(response.mimeType(), response.textEncodingName()));
 }
 
 void NetworkResourcesData::setResourceType(const String& requestId, InspectorPageAgent::ResourceType type)
diff --git a/Source/WebCore/inspector/PageConsoleAgent.cpp b/Source/WebCore/inspector/PageConsoleAgent.cpp
index fcd1f3d0b..a6e7aa8b6 100644
--- a/Source/WebCore/inspector/PageConsoleAgent.cpp
+++ b/Source/WebCore/inspector/PageConsoleAgent.cpp
@@ -77,7 +77,7 @@ private:
 void PageConsoleAgent::addInspectedNode(ErrorString* errorString, int nodeId)
 {
     Node* node = m_inspectorDOMAgent->nodeForId(nodeId);
-    if (!node) {
+    if (!node || node->isInShadowTree()) {
         *errorString = "nodeId is not valid";
         return;
     }
diff --git a/Source/WebCore/inspector/WorkerInspectorController.cpp b/Source/WebCore/inspector/WorkerInspectorController.cpp
index 79db35f29..8f0ed0b80 100644
--- a/Source/WebCore/inspector/WorkerInspectorController.cpp
+++ b/Source/WebCore/inspector/WorkerInspectorController.cpp
@@ -41,8 +41,10 @@
 #include "InspectorConsoleAgent.h"
 #include "InspectorFrontend.h"
 #include "InspectorFrontendChannel.h"
+#include "InspectorProfilerAgent.h"
 #include "InspectorState.h"
 #include "InspectorStateClient.h"
+#include "InspectorTimelineAgent.h"
 #include "InstrumentingAgents.h"
 #include "WorkerConsoleAgent.h"
 #include "WorkerContext.h"
@@ -93,11 +95,14 @@ WorkerInspectorController::WorkerInspectorController(WorkerContext* workerContex
     , m_injectedScriptManager(InjectedScriptManager::createForWorker())
 {
 
+    m_runtimeAgent = WorkerRuntimeAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get(), workerContext);
+    m_consoleAgent = WorkerConsoleAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get());
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent = WorkerDebuggerAgent::create(m_instrumentingAgents.get(), m_state.get(), workerContext, m_injectedScriptManager.get());
+    m_profilerAgent = InspectorProfilerAgent::create(m_instrumentingAgents.get(), m_consoleAgent.get(), workerContext, m_state.get(), m_injectedScriptManager.get());
 #endif
-    m_runtimeAgent = WorkerRuntimeAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get(), workerContext);
-    m_consoleAgent = WorkerConsoleAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get());
+    m_timelineAgent = InspectorTimelineAgent::create(m_instrumentingAgents.get(), m_state.get(), InspectorTimelineAgent::WorkerInspector);
 
     m_injectedScriptManager->injectedScriptHost()->init(0
         , 0
@@ -125,15 +130,19 @@ void WorkerInspectorController::connectFrontend()
     m_frontend = adoptPtr(new InspectorFrontend(m_frontendChannel.get()));
     m_backendDispatcher = InspectorBackendDispatcher::create(m_frontendChannel.get());
     m_consoleAgent->registerInDispatcher(m_backendDispatcher.get());
+    m_timelineAgent->registerInDispatcher(m_backendDispatcher.get());
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->registerInDispatcher(m_backendDispatcher.get());
+    m_profilerAgent->registerInDispatcher(m_backendDispatcher.get());
 #endif
     m_runtimeAgent->registerInDispatcher(m_backendDispatcher.get());
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->setFrontend(m_frontend.get());
+    m_profilerAgent->setFrontend(m_frontend.get());
 #endif
     m_consoleAgent->setFrontend(m_frontend.get());
+    m_timelineAgent->setFrontend(m_frontend.get());
 }
 
 void WorkerInspectorController::disconnectFrontend()
@@ -147,8 +156,10 @@ void WorkerInspectorController::disconnectFrontend()
     m_state->mute();
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->clearFrontend();
+    m_profilerAgent->clearFrontend();
 #endif
     m_consoleAgent->clearFrontend();
+    m_timelineAgent->clearFrontend();
 
     m_frontend.clear();
     m_frontendChannel.clear();
@@ -162,8 +173,10 @@ void WorkerInspectorController::restoreInspectorStateFromCookie(const String& in
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->restore();
+    m_profilerAgent->restore();
 #endif
     m_consoleAgent->restore();
+    m_timelineAgent->restore();
 }
 
 void WorkerInspectorController::dispatchMessageFromFrontend(const String& message)
diff --git a/Source/WebCore/inspector/WorkerInspectorController.h b/Source/WebCore/inspector/WorkerInspectorController.h
index 4a4d4a98e..0e61e9b1c 100644
--- a/Source/WebCore/inspector/WorkerInspectorController.h
+++ b/Source/WebCore/inspector/WorkerInspectorController.h
@@ -51,9 +51,11 @@ class InspectorFrontend;
 class InspectorFrontendChannel;
 class InspectorConsoleAgent;
 class InspectorInstrumentation;
+class InspectorProfilerAgent;
 class InspectorRuntimeAgent;
 class InspectorState;
 class InspectorStateClient;
+class InspectorTimelineAgent;
 class InstrumentingAgents;
 class WorkerContext;
 
@@ -83,9 +85,11 @@ private:
     OwnPtr<InjectedScriptManager> m_injectedScriptManager;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     OwnPtr<InspectorDebuggerAgent> m_debuggerAgent;
+    OwnPtr<InspectorProfilerAgent> m_profilerAgent;
 #endif
     OwnPtr<InspectorRuntimeAgent> m_runtimeAgent;
     OwnPtr<InspectorConsoleAgent> m_consoleAgent;
+    OwnPtr<InspectorTimelineAgent> m_timelineAgent;
 
     OwnPtr<InspectorFrontendChannel> m_frontendChannel;
     OwnPtr<InspectorFrontend> m_frontend;
diff --git a/Source/WebCore/inspector/compile-front-end.sh b/Source/WebCore/inspector/compile-front-end.sh
index 17ed1039d..7ff0d5571 100755
--- a/Source/WebCore/inspector/compile-front-end.sh
+++ b/Source/WebCore/inspector/compile-front-end.sh
@@ -45,7 +45,7 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/UserMetrics.js \
         --js Source/WebCore/inspector/front-end/HandlerRegistry.js \
         --js Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js \
-    --module jsmodule_sdk:30:jsmodule_common \
+    --module jsmodule_sdk:34:jsmodule_common \
         --js Source/WebCore/inspector/front-end/InspectorBackend.js \
         --js Source/WebCore/inspector/front-end/ApplicationCacheModel.js \
         --js Source/WebCore/inspector/front-end/Color.js \
@@ -68,6 +68,10 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/Placard.js \
         --js Source/WebCore/inspector/front-end/Script.js \
         --js Source/WebCore/inspector/front-end/ScriptFormatter.js \
+        --js Source/WebCore/inspector/front-end/ScriptMapping.js \
+        --js Source/WebCore/inspector/front-end/TimelineManager.js \
+        --js Source/WebCore/inspector/front-end/TimelineModel.js \
+        --js Source/WebCore/inspector/front-end/TimelinePresentationModel.js \
         --js Source/WebCore/inspector/front-end/RawSourceCode.js \
         --js Source/WebCore/inspector/front-end/RemoteObject.js \
         --js Source/WebCore/inspector/front-end/Resource.js \
@@ -113,7 +117,7 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/Toolbar.js \
         --js Source/WebCore/inspector/front-end/UIUtils.js \
         --js Source/WebCore/inspector/front-end/View.js \
-    --module jsmodule_components:16:jsmodule_sdk,jsmodule_ui \
+    --module jsmodule_components:14:jsmodule_sdk,jsmodule_ui \
         --js Source/WebCore/inspector/front-end/ConsoleMessage.js \
         --js Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js \
         --js Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js \
@@ -127,9 +131,7 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/ObjectPropertiesSection.js \
         --js Source/WebCore/inspector/front-end/PropertiesSidebarPane.js \
         --js Source/WebCore/inspector/front-end/SourceFrame.js \
-        --js Source/WebCore/inspector/front-end/TimelineAgent.js \
         --js Source/WebCore/inspector/front-end/TimelineGrid.js \
-        --js Source/WebCore/inspector/front-end/TimelineManager.js \
     --module jsmodule_elements:3:jsmodule_components \
         --js Source/WebCore/inspector/front-end/StylesSidebarPane.js \
         --js Source/WebCore/inspector/front-end/MetricsSidebarPane.js \
diff --git a/Source/WebCore/inspector/front-end/AuditRules.js b/Source/WebCore/inspector/front-end/AuditRules.js
index 1a0dd9839..11d20966d 100644
--- a/Source/WebCore/inspector/front-end/AuditRules.js
+++ b/Source/WebCore/inspector/front-end/AuditRules.js
@@ -358,7 +358,7 @@ WebInspector.AuditRules.UnusedCssRule.prototype = {
                     var pctUnused = Math.round(100 * unusedStylesheetSize / stylesheetSize);
                     if (!summary)
                         summary = result.addChild("", true);
-                    var entry = summary.addFormatted("%s: %s (%d%%) is not used by the current page.", url, Number.bytesToString(unusedStylesheetSize), pctUnused);
+                    var entry = summary.addFormatted("%s: %s (%d%) is not used by the current page.", url, Number.bytesToString(unusedStylesheetSize), pctUnused);
 
                     for (var j = 0; j < unusedRules.length; ++j)
                         entry.addSnippet(unusedRules[j]);
@@ -370,7 +370,7 @@ WebInspector.AuditRules.UnusedCssRule.prototype = {
                     return callback(null);
 
                 var totalUnusedPercent = Math.round(100 * totalUnusedStylesheetSize / totalStylesheetSize);
-                summary.value = String.sprintf("%s (%d%%) of CSS is not used by the current page.", Number.bytesToString(totalUnusedStylesheetSize), totalUnusedPercent);
+                summary.value = String.sprintf("%s (%d%) of CSS is not used by the current page.", Number.bytesToString(totalUnusedStylesheetSize), totalUnusedPercent);
 
                 callback(result);
             }
diff --git a/Source/WebCore/inspector/front-end/BreakpointManager.js b/Source/WebCore/inspector/front-end/BreakpointManager.js
index ee1397c75..284a73e15 100644
--- a/Source/WebCore/inspector/front-end/BreakpointManager.js
+++ b/Source/WebCore/inspector/front-end/BreakpointManager.js
@@ -34,8 +34,9 @@
  * @param {function(WebInspector.Breakpoint)} breakpointAddedDelegate
  * @param {function(WebInspector.Breakpoint)} breakpointRemovedDelegate
  * @param {WebInspector.DebuggerModel} debuggerModel
+ * @param {WebInspector.MainScriptMapping} scriptMapping
  */
-WebInspector.BreakpointManager = function(breakpointStorage, breakpointAddedDelegate, breakpointRemovedDelegate, debuggerModel)
+WebInspector.BreakpointManager = function(breakpointStorage, breakpointAddedDelegate, breakpointRemovedDelegate, debuggerModel, scriptMapping)
 {
     this._breakpointStorage = breakpointStorage;
     this._breakpointAddedDelegate = breakpointAddedDelegate;
@@ -46,6 +47,7 @@ WebInspector.BreakpointManager = function(breakpointStorage, breakpointAddedDele
     this._breakpointsByUILocation = {};
 
     this._debuggerModel = debuggerModel;
+    this._scriptMapping = scriptMapping;
 
     /**
      * @type {Object.<DebuggerAgent.BreakpointId, WebInspector.Breakpoint>}
@@ -71,7 +73,7 @@ WebInspector.BreakpointManager.prototype = {
         for (var lineNumber in breakpoints) {
             var breakpoint = breakpoints[lineNumber];
             breakpoint.uiSourceCode = uiSourceCode;
-            this._materializeBreakpoint(breakpoint, uiSourceCode.rawSourceCode.sourceMapping, uiSourceCode);
+            this._materializeBreakpoint(breakpoint, uiSourceCode);
             if (breakpoint._debuggerLocation)
                 this._breakpointDebuggerLocationChanged(breakpoint);
         }
@@ -100,7 +102,7 @@ WebInspector.BreakpointManager.prototype = {
         var breakpoint = new WebInspector.Breakpoint(uiSourceCode.id, lineNumber, condition, enabled, persistent);
         breakpoint.uiSourceCode = uiSourceCode;
         this._addBreakpointToUI(breakpoint);
-        this._materializeBreakpoint(breakpoint, uiSourceCode.rawSourceCode.sourceMapping, uiSourceCode);
+        this._materializeBreakpoint(breakpoint, uiSourceCode);
     },
 
     /**
@@ -131,16 +133,15 @@ WebInspector.BreakpointManager.prototype = {
 
     /**
      * @param {WebInspector.Breakpoint} breakpoint
-     * @param {WebInspector.RawSourceCode.SourceMapping} sourceMapping
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
-    _materializeBreakpoint: function(breakpoint, sourceMapping, uiSourceCode)
+    _materializeBreakpoint: function(breakpoint, uiSourceCode)
     {
         if (!breakpoint.enabled || breakpoint._materialized)
             return;
 
         breakpoint._materialized = true;
-        var rawLocation = sourceMapping.uiLocationToRawLocation(uiSourceCode, breakpoint.lineNumber, 0);
+        var rawLocation = this._scriptMapping.uiLocationToRawLocation(uiSourceCode, breakpoint.lineNumber, 0);
         this._setBreakpointInDebugger(breakpoint, rawLocation);
     },
 
@@ -149,9 +150,9 @@ WebInspector.BreakpointManager.prototype = {
      */
     _breakpointDebuggerLocationChanged: function(breakpoint)
     {
-        if (!breakpoint.uiSourceCode)
+        var uiLocation = this._scriptMapping.rawLocationToUILocation(breakpoint._debuggerLocation);
+        if (!uiLocation)
             return;
-        var uiLocation = breakpoint.uiSourceCode.rawSourceCode.sourceMapping.rawLocationToUILocation(breakpoint._debuggerLocation);
         if (uiLocation.lineNumber === breakpoint.lineNumber)
             return;
 
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index ecdbfd308..72a9cfe93 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -478,9 +478,13 @@ WebInspector.CSSStyleDeclaration.prototype = {
         return 0;
     },
 
-    newBlankProperty: function()
+    /**
+     * @param {number=} index
+     */
+    newBlankProperty: function(index)
     {
-        return new WebInspector.CSSProperty(this, this.pastLastSourcePropertyIndex(), "", "", "", "active", true, false, false, "");
+        index = (typeof index === "undefined") ? this.pastLastSourcePropertyIndex() : index;
+        return new WebInspector.CSSProperty(this, index, "", "", "", "active", true, false, false, "");
     },
 
     insertPropertyAt: function(index, name, value, userCallback)
@@ -619,8 +623,15 @@ WebInspector.CSSProperty.prototype = {
         return this.status === "disabled";
     },
 
-    // Replaces "propertyName: propertyValue [!important];" in the stylesheet by an arbitrary propertyText.
-    setText: function(propertyText, majorChange, userCallback)
+    /**
+     * Replaces "propertyName: propertyValue [!important];" in the stylesheet by an arbitrary propertyText.
+     *
+     * @param {string} propertyText
+     * @param {boolean} majorChange
+     * @param {boolean} overwrite
+     * @param {Function=} userCallback
+     */
+    setText: function(propertyText, majorChange, overwrite, userCallback)
     {
         function enabledCallback(style)
         {
@@ -656,13 +667,19 @@ WebInspector.CSSProperty.prototype = {
 
         // An index past all the properties adds a new property to the style.
         WebInspector.cssModel._pendingCommandsMajorState.push(majorChange);
-        CSSAgent.setPropertyText(this.ownerStyle.id, this.index, propertyText, this.index < this.ownerStyle.pastLastSourcePropertyIndex(), callback.bind(this));
+        CSSAgent.setPropertyText(this.ownerStyle.id, this.index, propertyText, overwrite, callback.bind(this));
     },
 
-    setValue: function(newValue, majorChange, userCallback)
+    /**
+     * @param {string} newValue
+     * @param {boolean} majorChange
+     * @param {boolean} overwrite
+     * @param {Function=} userCallback
+     */
+    setValue: function(newValue, majorChange, overwrite, userCallback)
     {
         var text = this.name + ": " + newValue + (this.priority ? " !" + this.priority : "") + ";"
-        this.setText(text, majorChange, userCallback);
+        this.setText(text, majorChange, overwrite, userCallback);
     },
 
     setDisabled: function(disabled, userCallback)
diff --git a/Source/WebCore/inspector/front-end/ConsoleMessage.js b/Source/WebCore/inspector/front-end/ConsoleMessage.js
index f2a74efa8..1925b923a 100644
--- a/Source/WebCore/inspector/front-end/ConsoleMessage.js
+++ b/Source/WebCore/inspector/front-end/ConsoleMessage.js
@@ -286,9 +286,13 @@ WebInspector.ConsoleMessageImpl.prototype = {
         object.pushNodeToFrontend(printNode.bind(this));
     },
 
-    _formatParameterAsArray: function(arr, elem)
+    _formatParameterAsArray: function(array, elem)
     {
-        arr.getOwnProperties(this._printArray.bind(this, elem));
+        const maxFlatArrayLength = 100;
+        if (array.arrayLength() > maxFlatArrayLength)
+            this._formatParameterAsObject(array, elem);
+        else
+            array.getOwnProperties(this._printArray.bind(this, array, elem));
     },
 
     _formatParameterAsString: function(output, elem)
@@ -304,19 +308,16 @@ WebInspector.ConsoleMessageImpl.prototype = {
         elem.appendChild(document.createTextNode("\""));
     },
 
-    _printArray: function(elem, properties)
+    _printArray: function(array, elem, properties)
     {
         if (!properties)
             return;
 
         var elements = [];
-        var length = 0;
         for (var i = 0; i < properties.length; ++i) {
             var property = properties[i];
             var name = property.name;
-            if (name === "length")
-                length = parseInt(property.value.description, 10);
-            if (name == parseInt(name, 10))
+            if (!isNaN(name))
                 elements[name] = this._formatAsArrayEntry(property.value);
         }
 
@@ -331,6 +332,7 @@ WebInspector.ConsoleMessageImpl.prototype = {
             span.textContent = WebInspector.UIString("undefined × %d", index - lastNonEmptyIndex - 1);
         }
 
+        var length = array.arrayLength();
         for (var i = 0; i < length; ++i) {
             var element = elements[i];
             if (!element)
@@ -592,6 +594,14 @@ WebInspector.ConsoleMessageImpl.prototype = {
         return this._messageText;
     },
 
+    get location()
+    {
+        // FIXME(62725): stack trace line/column numbers are one-based.
+        var lineNumber = this.stackTrace ? this.stackTrace[0].lineNumber - 1 : this.line - 1;
+        var columnNumber = this.stackTrace ? this.stackTrace[0].columnNumber - 1 : 0;
+        return new WebInspector.DebuggerModel.Location(lineNumber, columnNumber);
+    },
+
     isEqual: function(msg)
     {
         if (!msg)
diff --git a/Source/WebCore/inspector/front-end/ConsoleView.js b/Source/WebCore/inspector/front-end/ConsoleView.js
index adde06982..c9d5df0c5 100644
--- a/Source/WebCore/inspector/front-end/ConsoleView.js
+++ b/Source/WebCore/inspector/front-end/ConsoleView.js
@@ -111,7 +111,7 @@ WebInspector.ConsoleView = function(hideContextSelector)
 
     this._linkifier = WebInspector.debuggerPresentationModel.createLinkifier();
 
-    this.prompt = new WebInspector.TextPromptWithHistory(this.completions.bind(this), ExpressionStopCharacters + ".");
+    this.prompt = new WebInspector.TextPromptWithHistory(this.completionsForTextPrompt.bind(this), ExpressionStopCharacters + ".");
     this.prompt.setSuggestBoxEnabled("generic-suggest");
     this.prompt.renderAsBlock();
     this.prompt.attach(this.promptElement);
@@ -342,16 +342,16 @@ WebInspector.ConsoleView.prototype = {
         this._linkifier.reset();
     },
 
-    completions: function(wordRange, force, completionsReadyCallback)
+    completionsForTextPrompt: function(textPrompt, wordRange, force, completionsReadyCallback)
     {
         // Pass less stop characters to rangeOfWord so the range will be a more complete expression.
-        var expressionRange = wordRange.startContainer.rangeOfWord(wordRange.startOffset, ExpressionStopCharacters, this.promptElement, "backward");
+        var expressionRange = wordRange.startContainer.rangeOfWord(wordRange.startOffset, ExpressionStopCharacters, textPrompt.proxyElement, "backward");
         var expressionString = expressionRange.toString();
         var prefix = wordRange.toString();
-        this._completions(expressionString, prefix, force, completionsReadyCallback);
+        this.completionsForExpression(expressionString, prefix, force, completionsReadyCallback);
     },
 
-    _completions: function(expressionString, prefix, force, completionsReadyCallback)
+    completionsForExpression: function(expressionString, prefix, force, completionsReadyCallback)
     {
         var lastIndex = expressionString.length - 1;
 
@@ -372,7 +372,7 @@ WebInspector.ConsoleView.prototype = {
             return;
         }
 
-        if (!expressionString && WebInspector.debuggerPresentationModel.paused)
+        if (!expressionString && WebInspector.debuggerPresentationModel.selectedCallFrame)
             WebInspector.debuggerPresentationModel.getSelectedCallFrameVariables(receivedPropertyNames.bind(this));
         else
             this.evalInInspectedWindow(expressionString, "completion", true, true, false, evaluated.bind(this));
@@ -409,7 +409,7 @@ WebInspector.ConsoleView.prototype = {
             }
 
             if (result.type === "object" || result.type === "function")
-                result.callFunctionJSON(getCompletions, receivedPropertyNames.bind(this));
+                result.callFunctionJSON(getCompletions, undefined, receivedPropertyNames.bind(this));
             else if (result.type === "string" || result.type === "number" || result.type === "boolean")
                 this.evalInInspectedWindow("(" + getCompletions + ")(\"" + result.type + "\")", "completion", false, true, true, receivedPropertyNamesFromEval.bind(this));
         }
@@ -592,7 +592,7 @@ WebInspector.ConsoleView.prototype = {
      */
     evalInInspectedWindow: function(expression, objectGroup, includeCommandLineAPI, doNotPauseOnExceptions, returnByValue, callback)
     {
-        if (WebInspector.debuggerPresentationModel.paused) {
+        if (WebInspector.debuggerPresentationModel.selectedCallFrame) {
             WebInspector.debuggerPresentationModel.evaluateInSelectedCallFrame(expression, objectGroup, includeCommandLineAPI, returnByValue, callback);
             return;
         }
diff --git a/Source/WebCore/inspector/front-end/DOMAgent.js b/Source/WebCore/inspector/front-end/DOMAgent.js
index 2ef016943..28a567254 100644
--- a/Source/WebCore/inspector/front-end/DOMAgent.js
+++ b/Source/WebCore/inspector/front-end/DOMAgent.js
@@ -33,11 +33,13 @@
  * @constructor
  * @param {WebInspector.DOMAgent} domAgent
  * @param {?WebInspector.DOMDocument} doc
+ * @param {boolean} isInShadowTree
  * @param {DOMAgent.Node} payload
  */
-WebInspector.DOMNode = function(domAgent, doc, payload) {
+WebInspector.DOMNode = function(domAgent, doc, isInShadowTree, payload) {
     this._domAgent = domAgent;
     this.ownerDocument = doc;
+    this._isInShadowTree = isInShadowTree;
 
     this.id = payload.nodeId;
     domAgent._idToDOMNode[this.id] = this;
@@ -46,6 +48,8 @@ WebInspector.DOMNode = function(domAgent, doc, payload) {
     this._localName = payload.localName;
     this._nodeValue = payload.nodeValue;
 
+    this._shadowRoots = [];
+
     this._attributes = [];
     this._attributesMap = {};
     if (payload.attributes)
@@ -69,6 +73,14 @@ WebInspector.DOMNode = function(domAgent, doc, payload) {
         this._renumber();
     }
 
+    if (payload.shadowRoots && WebInspector.experimentsSettings.showShadowDOM.isEnabled()) {
+        for (var i = 0; i < payload.shadowRoots.length; ++i) {
+            var root = payload.shadowRoots[i];
+            var node = new WebInspector.DOMNode(this._domAgent, this.ownerDocument, true, root);
+            this._shadowRoots.push(node);
+        }
+    }
+
     if (this._nodeType === Node.ELEMENT_NODE) {
         // HTML and BODY from internal iframes should not overwrite top-level ones.
         if (this.ownerDocument && !this.ownerDocument.documentElement && this._nodeName === "HTML")
@@ -117,7 +129,7 @@ WebInspector.DOMNode.prototype = {
      */
     hasChildNodes: function()
     {
-        return this._childNodeCount > 0;
+        return this._childNodeCount > 0 || !!this._shadowRoots.length;
     },
 
     /**
@@ -137,6 +149,14 @@ WebInspector.DOMNode.prototype = {
     },
 
     /**
+     * @return {boolean}
+     */
+    isInShadowTree: function()
+    {
+        return this._isInShadowTree;
+    },
+
+    /**
      * @return {string}
      */
     nodeNameInCorrectCase: function()
@@ -345,7 +365,7 @@ WebInspector.DOMNode.prototype = {
 
         var className = this.getAttribute("class");
         if (className) {
-            var selector = "." + className.replace(/\s+/, ".");
+            var selector = "." + className.trim().replace(/\s+/g, ".");
             return (justSelector ? selector : lowerCaseName + selector);
         }
 
@@ -400,11 +420,11 @@ WebInspector.DOMNode.prototype = {
      */
     _insertChild: function(prev, payload)
     {
-        var node = new WebInspector.DOMNode(this._domAgent, this.ownerDocument, payload);
+        var node = new WebInspector.DOMNode(this._domAgent, this.ownerDocument, this._isInShadowTree, payload);
         if (!prev) {
             if (!this.children) {
                 // First node
-                this.children = [ node ];
+                this.children = this._shadowRoots.concat([ node ]);
             } else
                 this.children.unshift(node);
         } else
@@ -432,10 +452,10 @@ WebInspector.DOMNode.prototype = {
         if (this._contentDocument)
             return;
 
-        this.children = [];
+        this.children = this._shadowRoots.slice();
         for (var i = 0; i < payloads.length; ++i) {
             var payload = payloads[i];
-            var node = new WebInspector.DOMNode(this._domAgent, this.ownerDocument, payload);
+            var node = new WebInspector.DOMNode(this._domAgent, this.ownerDocument, this._isInShadowTree, payload);
             this.children.push(node);
         }
         this._renumber();
@@ -642,7 +662,7 @@ WebInspector.DOMNode.prototype = {
  */
 WebInspector.DOMDocument = function(domAgent, payload)
 {
-    WebInspector.DOMNode.call(this, domAgent, this, payload);
+    WebInspector.DOMNode.call(this, domAgent, this, false, payload);
     this.documentURL = payload.documentURL || "";
     this.xmlVersion = payload.xmlVersion;
     this._listeners = {};
@@ -887,7 +907,7 @@ WebInspector.DOMAgent.prototype = {
      */
     _setDetachedRoot: function(payload)
     {
-        new WebInspector.DOMNode(this, null, payload);
+        new WebInspector.DOMNode(this, null, false, payload);
     },
 
     /**
@@ -944,6 +964,13 @@ WebInspector.DOMAgent.prototype = {
     },
 
     /**
+     * @param {DOMAgent.NodeId} rootId
+     */
+    _shadowRootPopped: function(rootId)
+    {
+    },
+
+    /**
      * @param {DOMAgent.Node} node
      */
     _unbind: function(node)
@@ -1253,6 +1280,24 @@ WebInspector.DOMDispatcher.prototype = {
     childNodeRemoved: function(parentNodeId, nodeId)
     {
         this._domAgent._childNodeRemoved(parentNodeId, nodeId);
+    },
+
+    /**
+     * @param {DOMAgent.NodeId} hostId
+     * @param {DOMAgent.Node} root
+     */
+    shadowRootPushed: function(hostId, root)
+    {
+        this._domAgent._childNodeInserted(hostId, 0, root);
+    },
+
+    /**
+     * @param {DOMAgent.NodeId} hostId
+     * @param {DOMAgent.NodeId} rootId
+     */
+    shadowRootPopped: function(hostId, rootId)
+    {
+        this._domAgent._childNodeRemoved(hostId, rootId);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/DatabaseQueryView.js b/Source/WebCore/inspector/front-end/DatabaseQueryView.js
index be233a173..f928ec0cd 100644
--- a/Source/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/Source/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -61,7 +61,7 @@ WebInspector.DatabaseQueryView.prototype = {
             this.prompt.moveCaretToEndOfPrompt();
     },
     
-    completions: function(wordRange, force, completionsReadyCallback)
+    completions: function(textPrompt, wordRange, force, completionsReadyCallback)
     {
         var prefix = wordRange.toString().toLowerCase();
         if (!prefix.length && !force)
diff --git a/Source/WebCore/inspector/front-end/DebuggerModel.js b/Source/WebCore/inspector/front-end/DebuggerModel.js
index 9bae2c070..c9a64bd3e 100644
--- a/Source/WebCore/inspector/front-end/DebuggerModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerModel.js
@@ -234,11 +234,11 @@ WebInspector.DebuggerModel.prototype = {
 
     /**
      * @param {DebuggerAgent.ScriptId} scriptId
-     * @return {WebInspector.Script|undefined}
+     * @return {WebInspector.Script}
      */
     scriptForSourceID: function(scriptId)
     {
-        return this._scripts[scriptId];
+        return this._scripts[scriptId] || null;
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
index 27b045758..47182ee9b 100644
--- a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
@@ -34,15 +34,16 @@
  */
 WebInspector.DebuggerPresentationModel = function()
 {
-    // FIXME: apply formatter from outside as a generic mapping.
-    this._formatter = new WebInspector.ScriptFormatter();
-    this._rawSourceCodes = [];
-    this._rawSourceCodeForScriptId = {};
-    this._rawSourceCodeForURL = {};
-    this._rawSourceCodeForDocumentURL = {};
+    this._scriptMapping = new WebInspector.MainScriptMapping();
+    this._scriptMapping.addEventListener(WebInspector.MainScriptMapping.Events.UISourceCodeListChanged, this._handleUISourceCodeListChanged, this);
+
     this._presentationCallFrames = [];
 
-    this._breakpointManager = new WebInspector.BreakpointManager(WebInspector.settings.breakpoints, this._breakpointAdded.bind(this), this._breakpointRemoved.bind(this), WebInspector.debuggerModel);
+    this._breakpointManager = new WebInspector.BreakpointManager(WebInspector.settings.breakpoints, this._breakpointAdded.bind(this), this._breakpointRemoved.bind(this), WebInspector.debuggerModel, this._scriptMapping);
+
+    this._pendingConsoleMessages = {};
+    this._consoleMessageLiveLocations = [];
+    this._presentationConsoleMessages = [];
 
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.FailedToParseScriptSource, this._failedToParseScriptSource, this);
@@ -87,7 +88,7 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     createPlacard: function(callFrame)
     {
-        return new WebInspector.DebuggerPresentationModel.CallFramePlacard(callFrame);
+        return new WebInspector.DebuggerPresentationModel.CallFramePlacard(callFrame, this);
     },
 
     /**
@@ -96,84 +97,46 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     rawLocationToUILocation: function(rawLocation)
     {
-        var rawSourceCode = this._rawSourceCodeForScriptId[rawLocation.scriptId];
-        if (!rawSourceCode.sourceMapping)
-            return null;
-        return rawSourceCode.sourceMapping.rawLocationToUILocation(rawLocation);
+        return this._scriptMapping.rawLocationToUILocation(rawLocation);
     },
 
     /**
-     * @param {WebInspector.Event} event
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
      */
-    _parsedScriptSource: function(event)
+    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
     {
-        var script = /** @type {WebInspector.Script} */ event.data;
-        this._addScript(script);
+        return this._scriptMapping.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
     },
 
     /**
-     * @param {WebInspector.Event} event
+     * @param {DebuggerAgent.Location} rawLocation
+     * @param {function(WebInspector.UILocation)} updateDelegate
+     * @return {WebInspector.LiveLocation}
      */
-    _failedToParseScriptSource: function(event)
+    createLiveLocation: function(rawLocation, updateDelegate)
     {
-        var script = /** @type {WebInspector.Script} */ event.data;
-        this._addScript(script);
+        return this._scriptMapping.createLiveLocation(rawLocation, updateDelegate);
     },
 
     /**
-     * @param {WebInspector.Script} script
-     */
-    _addScript: function(script)
-    {
-        var resource = null;
-        var isInlineScript = false;
-        if (script.isInlineScript()) {
-            resource = WebInspector.networkManager.inflightResourceForURL(script.sourceURL) || WebInspector.resourceForURL(script.sourceURL);
-            if (resource && resource.type === WebInspector.Resource.Type.Document) {
-                isInlineScript = true;
-                var rawSourceCode = this._rawSourceCodeForDocumentURL[script.sourceURL];
-                if (rawSourceCode) {
-                    rawSourceCode.addScript(script);
-                    this._bindScriptToRawSourceCode(script, rawSourceCode);
-                    return;
-                }
-            }
-        }
-
-        var compilerSourceMapping = null;
-        if (WebInspector.settings.sourceMapsEnabled.get() && script.sourceMapURL)
-            compilerSourceMapping = new WebInspector.ClosureCompilerSourceMapping(script.sourceMapURL, script.sourceURL);
-
-        var rawSourceCode = new WebInspector.RawSourceCode(script.scriptId, script, resource, this._formatter, this._formatSource, compilerSourceMapping);
-        this._rawSourceCodes.push(rawSourceCode);
-        this._bindScriptToRawSourceCode(script, rawSourceCode);
-
-        if (isInlineScript)
-            this._rawSourceCodeForDocumentURL[script.sourceURL] = rawSourceCode;
-
-        if (rawSourceCode.sourceMapping)
-            this._updateSourceMapping(rawSourceCode, null);
-        rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._sourceMappingUpdated, this);
-    },
-
-    /**
-     * @param {WebInspector.Script} script
-     * @param {WebInspector.RawSourceCode} rawSourceCode
+     * @param {WebInspector.Event} event
      */
-    _bindScriptToRawSourceCode: function(script, rawSourceCode)
+    _parsedScriptSource: function(event)
     {
-        this._rawSourceCodeForScriptId[script.scriptId] = rawSourceCode;
-        this._rawSourceCodeForURL[script.sourceURL] = rawSourceCode;
+        var script = /** @type {WebInspector.Script} */ event.data;
+        this._scriptMapping.addScript(script);
+        this._addPendingConsoleMessagesToScript(script);
     },
 
     /**
      * @param {WebInspector.Event} event
      */
-    _sourceMappingUpdated: function(event)
+    _failedToParseScriptSource: function(event)
     {
-        var rawSourceCode = /** @type {WebInspector.RawSourceCode} */ event.target;
-        var oldSourceMapping = /** @type {WebInspector.RawSourceCode.SourceMapping} */ event.data["oldSourceMapping"];
-        this._updateSourceMapping(rawSourceCode, oldSourceMapping);
+        this._parsedScriptSource(event);
     },
 
     /**
@@ -181,54 +144,45 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     uiSourceCodes: function()
     {
-        var result = [];
-        for (var i = 0; i < this._rawSourceCodes.length; ++i) {
-            if (!this._rawSourceCodes[i].sourceMapping)
-                continue;
-            var uiSourceCodeList = this._rawSourceCodes[i].sourceMapping.uiSourceCodeList();
-            for (var j = 0; j < uiSourceCodeList.length; ++j)
-                result.push(uiSourceCodeList[j]);
-        }
-        return result;
+        return this._scriptMapping.uiSourceCodeList();
     },
 
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
-     * @param {WebInspector.RawSourceCode.SourceMapping} oldSourceMapping
+     * @param {WebInspector.Event} event
      */
-    _updateSourceMapping: function(rawSourceCode, oldSourceMapping)
+    _handleUISourceCodeListChanged: function(event)
     {
-        if (oldSourceMapping) {
-            var oldUISourceCodeList = oldSourceMapping.uiSourceCodeList();
-            for (var i = 0; i < oldUISourceCodeList.length; ++i) {
-                var breakpoints = this._breakpointManager.breakpointsForUISourceCode(oldUISourceCodeList[i]);
-                for (var lineNumber in breakpoints) {
-                    var breakpoint = breakpoints[lineNumber];
-                    this._breakpointRemoved(breakpoint);
-                    delete breakpoint.uiSourceCode;
-                }
+        var removedItems = /** @type {Array.<WebInspector.UISourceCode>} */ event.data["removedItems"];
+        var addedItems = /** @type {Array.<WebInspector.UISourceCode>} */ event.data["addedItems"];
+
+        for (var i = 0; i < removedItems.length; ++i) {
+            var breakpoints = this._breakpointManager.breakpointsForUISourceCode(removedItems[i]);
+            for (var lineNumber in breakpoints) {
+                var breakpoint = breakpoints[lineNumber];
+                this._breakpointRemoved(breakpoint);
+                delete breakpoint.uiSourceCode;
             }
         }
 
-        this._restoreBreakpoints(rawSourceCode);
-        this._restoreConsoleMessages(rawSourceCode);
+        this._restoreBreakpoints(addedItems);
 
-        if (!oldSourceMapping) {
-            var uiSourceCodeList = rawSourceCode.sourceMapping.uiSourceCodeList();
-            for (var i = 0; i < uiSourceCodeList.length; ++i)
-                this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeAdded, uiSourceCodeList[i]);
+        if (!removedItems.length) {
+            for (var i = 0; i < addedItems.length; ++i)
+                this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeAdded, addedItems[i]);
+        } else if (!addedItems.length) {
+            for (var i = 0; i < addedItems.length; ++i)
+                this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeRemoved, removedItems[i]);
         } else {
-            var eventData = { uiSourceCodeList: rawSourceCode.sourceMapping.uiSourceCodeList(), oldUISourceCodeList: oldSourceMapping.uiSourceCodeList() };
+            var eventData = { uiSourceCodeList: addedItems, oldUISourceCodeList: removedItems };
             this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeReplaced, eventData);
         }
     },
 
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
+     * @param {Array.<WebInspector.UISourceCode>} uiSourceCodeList
      */
-    _restoreBreakpoints: function(rawSourceCode)
+    _restoreBreakpoints: function(uiSourceCodeList)
     {
-        var uiSourceCodeList = rawSourceCode.sourceMapping.uiSourceCodeList();
         for (var i = 0; i < uiSourceCodeList.length; ++i) {
             var uiSourceCode = uiSourceCodeList[i];
             this._breakpointManager.uiSourceCodeAdded(uiSourceCode);
@@ -236,17 +190,6 @@ WebInspector.DebuggerPresentationModel.prototype = {
             for (var lineNumber in breakpoints)
                 this._breakpointAdded(breakpoints[lineNumber]);
         }
-
-    },
-
-    /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
-     */
-    _restoreConsoleMessages: function(rawSourceCode)
-    {
-        var messages = rawSourceCode.messages;
-        for (var i = 0; i < messages.length; ++i)
-            messages[i]._presentationMessage = this._createPresentationMessage(messages[i], rawSourceCode.sourceMapping);
     },
 
     /**
@@ -255,11 +198,7 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     canEditScriptSource: function(uiSourceCode)
     {
-        if (!WebInspector.debuggerModel.canSetScriptSource() || this._formatSource)
-            return false;
-        var rawSourceCode = uiSourceCode.rawSourceCode;
-        var script = this._scriptForRawSourceCode(rawSourceCode);
-        return script && !script.lineOffset && !script.columnOffset;
+        return WebInspector.debuggerModel.canSetScriptSource() && uiSourceCode.isEditable;
     },
 
     /**
@@ -269,8 +208,8 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     setScriptSource: function(uiSourceCode, newSource, callback)
     {
-        var rawSourceCode = uiSourceCode.rawSourceCode;
-        var script = this._scriptForRawSourceCode(rawSourceCode);
+        var rawLocation = this.uiLocationToRawLocation(uiSourceCode, 0, 0);
+        var script = WebInspector.debuggerModel.scriptForSourceID(rawLocation.scriptId);
 
         /**
          * @this {WebInspector.DebuggerPresentationModel}
@@ -282,7 +221,7 @@ WebInspector.DebuggerPresentationModel.prototype = {
             if (error)
                 return;
 
-            var resource = WebInspector.resourceForURL(rawSourceCode.url);
+            var resource = WebInspector.resourceForURL(script.sourceURL);
             if (resource)
                 resource.addRevision(newSource);
 
@@ -334,13 +273,8 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     setFormatSource: function(formatSource)
     {
-        if (this._formatSource === formatSource)
-            return;
-
-        this._formatSource = formatSource;
         this._breakpointManager.reset();
-        for (var i = 0; i < this._rawSourceCodes.length; ++i)
-            this._rawSourceCodes[i].setFormatted(this._formatSource);
+        this._scriptMapping.setFormatSource(formatSource);
     },
 
     /**
@@ -352,36 +286,73 @@ WebInspector.DebuggerPresentationModel.prototype = {
         if (!message.url || !message.isErrorOrWarning())
             return;
 
-        var rawSourceCode = this._rawSourceCodeForScriptWithURL(message.url);
-        if (!rawSourceCode)
-            return;
+        var script = this._scriptForURLAndLocation(message.url, message.location);
+        if (script)
+            this._addConsoleMessageToScript(message, script);
+        else
+            this._addPendingConsoleMessage(message);
+    },
 
-        rawSourceCode.messages.push(message);
-        if (rawSourceCode.sourceMapping) {
-            message._presentationMessage = this._createPresentationMessage(message, rawSourceCode.sourceMapping);
-            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ConsoleMessageAdded, message._presentationMessage);
+    /**
+     * @param {WebInspector.ConsoleMessage} message
+     * @param {WebInspector.Script} script
+     */
+    _addConsoleMessageToScript: function(message, script)
+    {
+        function updateLocation(uiLocation)
+        {
+            var presentationMessage = new WebInspector.PresentationConsoleMessage(uiLocation.uiSourceCode, uiLocation.lineNumber, message);
+            this._presentationConsoleMessages.push(presentationMessage);
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ConsoleMessageAdded, presentationMessage);
         }
+        var rawLocation = new WebInspector.DebuggerModel.Location(message.location.lineNumber, message.location.columnNumber);
+        rawLocation.scriptId = script.scriptId;
+        var liveLocation = this.createLiveLocation(rawLocation, updateLocation.bind(this));
+        liveLocation.init();
+        this._consoleMessageLiveLocations.push(liveLocation);
     },
 
     /**
      * @param {WebInspector.ConsoleMessage} message
-     * @param {WebInspector.RawSourceCode.SourceMapping} sourceMapping
-     * @return {WebInspector.PresentationConsoleMessage}
      */
-    _createPresentationMessage: function(message, sourceMapping)
+    _addPendingConsoleMessage: function(message)
     {
-        // FIXME(62725): stack trace line/column numbers are one-based.
-        var lineNumber = message.stackTrace ? message.stackTrace[0].lineNumber - 1 : message.line - 1;
-        var columnNumber = message.stackTrace ? message.stackTrace[0].columnNumber - 1 : 0;
-        var uiLocation = sourceMapping.rawLocationToUILocation(/** @type {DebuggerAgent.Location} */ { lineNumber: lineNumber, columnNumber: columnNumber });
-        var presentationMessage = new WebInspector.PresentationConsoleMessage(uiLocation.uiSourceCode, uiLocation.lineNumber, message);
-        return presentationMessage;
+        if (!this._pendingConsoleMessages[message.url])
+            this._pendingConsoleMessages[message.url] = [];
+        this._pendingConsoleMessages[message.url].push(message);
+    },
+
+    /**
+     * @param {WebInspector.Script} script
+     */
+    _addPendingConsoleMessagesToScript: function(script)
+    {
+        var messages = this._pendingConsoleMessages[script.sourceURL];
+        if (!messages)
+            return;
+
+        var pendingMessages = [];
+        for (var i = 0; i < messages.length; i++) {
+            var message = messages[i];
+            if (script === this._scriptForURLAndLocation(message.url, message.location))
+                this._addConsoleMessageToScript(messages, script);
+            else
+                pendingMessages.push(message);
+        }
+
+        if (pendingMessages.length)
+            this._pendingConsoleMessages[script.sourceURL] = pendingMessages;
+        else
+            delete this._pendingConsoleMessages[script.sourceURL];
     },
 
     _consoleCleared: function()
     {
-        for (var i = 0; i < this._rawSourceCodes.length; ++i)
-            this._rawSourceCodes[i].messages = [];
+        this._pendingConsoleMessages = {};
+        for (var i = 0; i < this._consoleMessageLiveLocations.length; ++i)
+            this._consoleMessageLiveLocations[i].dispose();
+        this._consoleMessageLiveLocations = [];
+        this._presentationConsoleMessages = [];
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ConsoleMessagesCleared);
     },
 
@@ -391,8 +362,7 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     continueToLine: function(uiSourceCode, lineNumber)
     {
-        // FIXME: use RawSourceCode.uiLocationToRawLocation.
-        var rawLocation = uiSourceCode.rawSourceCode.sourceMapping.uiLocationToRawLocation(uiSourceCode, lineNumber, 0);
+        var rawLocation = this.uiLocationToRawLocation(uiSourceCode, lineNumber, 0);
         WebInspector.debuggerModel.continueToLocation(rawLocation);
     },
 
@@ -411,14 +381,16 @@ WebInspector.DebuggerPresentationModel.prototype = {
 
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
-     * @return {Array.<WebInspector.ConsoleMessage>}
+     * @return {Array.<WebInspector.PresentationConsoleMessage>}
      */
     messagesForUISourceCode: function(uiSourceCode)
     {
-        var rawSourceCode = uiSourceCode.rawSourceCode;
         var messages = [];
-        for (var i = 0; i < rawSourceCode.messages.length; ++i)
-            messages.push(rawSourceCode.messages[i]._presentationMessage);
+        for (var i = 0; i < this._presentationConsoleMessages.length; ++i) {
+            var message = this._presentationConsoleMessages[i];
+            if (message.uiSourceCode === uiSourceCode)
+                messages.push(message);
+        }
         return messages;
     },
 
@@ -509,15 +481,12 @@ WebInspector.DebuggerPresentationModel.prototype = {
         this._presentationCallFrames = [];
         for (var i = 0; i < callFrames.length; ++i) {
             var callFrame = callFrames[i];
-            var script = WebInspector.debuggerModel.scriptForSourceID(callFrame.location.scriptId);
-            if (!script)
-                continue;
-            var rawSourceCode = this._rawSourceCodeForScript(script);
-            this._presentationCallFrames.push(new WebInspector.PresentationCallFrame(callFrame, i, this, rawSourceCode));
+            if (WebInspector.debuggerModel.scriptForSourceID(callFrame.location.scriptId))
+                this._presentationCallFrames.push(new WebInspector.PresentationCallFrame(callFrame, i, this));
         }
         var details = WebInspector.debuggerModel.debuggerPausedDetails;
-        this.selectedCallFrame = this._presentationCallFrames[0];
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.DebuggerPaused, { callFrames: this._presentationCallFrames, details: details });
+        this.selectedCallFrame = this._presentationCallFrames[0];
     },
 
     _debuggerResumed: function()
@@ -534,16 +503,23 @@ WebInspector.DebuggerPresentationModel.prototype = {
 
     set selectedCallFrame(callFrame)
     {
-        if (this._selectedCallFrame)
-            this._selectedCallFrame.rawSourceCode.removeEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._dispatchExecutionLineChanged, this);
+        if (this._executionLineLiveLocation)
+            this._executionLineLiveLocation.dispose();
+        delete this._executionLineLiveLocation;
+
         this._selectedCallFrame = callFrame;
         if (!this._selectedCallFrame)
             return;
 
-        this._selectedCallFrame.rawSourceCode.forceUpdateSourceMapping();
+        this._scriptMapping.forceUpdateSourceMapping(callFrame._callFrame.location);
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.CallFrameSelected, callFrame);
 
-        this._selectedCallFrame.rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._dispatchExecutionLineChanged, this);
+        function updateExecutionLine(uiLocation)
+        {
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ExecutionLineChanged, uiLocation);
+        }
+        this._executionLineLiveLocation = this.createLiveLocation(callFrame._callFrame.location, updateExecutionLine.bind(this));
+        this._executionLineLiveLocation.init();
     },
 
     get selectedCallFrame()
@@ -604,77 +580,33 @@ WebInspector.DebuggerPresentationModel.prototype = {
     },
 
     /**
-     * @param {WebInspector.Event} event
-     */
-    _dispatchExecutionLineChanged: function(event)
-    {
-        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ExecutionLineChanged, this.executionLineLocation);
-    },
-
-    /**
-     * @type {WebInspector.UILocation}
-     */
-    get executionLineLocation()
-    {
-        if (!this._selectedCallFrame.rawSourceCode.sourceMapping)
-            return;
-
-        var rawLocation = this._selectedCallFrame._callFrame.location;
-        var uiLocation = this._selectedCallFrame.rawSourceCode.sourceMapping.rawLocationToUILocation(rawLocation);
-        return uiLocation;
-    },
-
-    /**
-     * @param {string} sourceURL
-     */
-    _rawSourceCodeForScriptWithURL: function(sourceURL)
-    {
-        return this._rawSourceCodeForURL[sourceURL];
-    },
-
-    /**
-     * @param {WebInspector.Script} script
-     */
-    _rawSourceCodeForScript: function(script)
-    {
-        return this._rawSourceCodeForScriptId[script.scriptId];
-    },
-
-    /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
+     * @param {string} url
+     * @param {DebuggerAgent.Location} rawLocation
+     * @return {WebInspector.Script}
      */
-    _scriptForRawSourceCode: function(rawSourceCode)
+    _scriptForURLAndLocation: function(url, rawLocation)
     {
-        /**
-         * @this {WebInspector.DebuggerPresentationModel}
-         * @param {WebInspector.Script} script
-         * @return {boolean}
-         */
-        function filter(script)
-        {
-            return script.scriptId === rawSourceCode.id;
+        var scripts = WebInspector.debuggerModel.scriptsForURL(url);
+        for (var i = 0; i < scripts.length; ++i) {
+            var script = scripts[i];
+            if (script.lineOffset > rawLocation.lineNumber || (script.lineOffset === rawLocation.lineNumber && script.columnOffset > rawLocation.columnNumber))
+                continue;
+            if (script.endLine < rawLocation.lineNumber || (script.endLine === rawLocation.lineNumber && script.endColumn <= rawLocation.columnNumber))
+                continue;
+            return script;
         }
-        return WebInspector.debuggerModel.queryScripts(filter.bind(this))[0];
+        return null;
     },
 
     _debuggerReset: function()
     {
-        for (var i = 0; i < this._rawSourceCodes.length; ++i) {
-            var rawSourceCode = this._rawSourceCodes[i];
-            if (rawSourceCode.sourceMapping) {
-                var uiSourceCodeList = rawSourceCode.sourceMapping.uiSourceCodeList();
-                for (var j = 0; j < uiSourceCodeList.length; ++j)
-                    this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeRemoved, uiSourceCodeList[j]);
-            }
-            rawSourceCode.removeAllListeners();
-        }
-        this._rawSourceCodes = [];
-        this._rawSourceCodeForScriptId = {};
-        this._rawSourceCodeForURL = {};
-        this._rawSourceCodeForDocumentURL = {};
+        this._scriptMapping.reset();
         this._presentationCallFrames = [];
         this._selectedCallFrame = null;
         this._breakpointManager.debuggerReset();
+        this._pendingConsoleMessages = {};
+        this._consoleMessageLiveLocations = [];
+        this._presentationConsoleMessages = [];
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.DebuggerReset);
     }
 }
@@ -699,14 +631,12 @@ WebInspector.PresentationConsoleMessage = function(uiSourceCode, lineNumber, ori
  * @param {DebuggerAgent.CallFrame} callFrame
  * @param {number} index
  * @param {WebInspector.DebuggerPresentationModel} model
- * @param {WebInspector.RawSourceCode} rawSourceCode
  */
-WebInspector.PresentationCallFrame = function(callFrame, index, model, rawSourceCode)
+WebInspector.PresentationCallFrame = function(callFrame, index, model)
 {
     this._callFrame = callFrame;
     this._index = index;
     this._model = model;
-    this._rawSourceCode = rawSourceCode;
 }
 
 WebInspector.PresentationCallFrame.prototype = {
@@ -743,14 +673,6 @@ WebInspector.PresentationCallFrame.prototype = {
     },
 
     /**
-     * @return {WebInspector.RawSourceCode}
-     */
-    get rawSourceCode()
-    {
-        return this._rawSourceCode;
-    },
-
-    /**
      * @param {string} code
      * @param {string} objectGroup
      * @param {boolean} includeCommandLineAPI
@@ -782,15 +704,13 @@ WebInspector.PresentationCallFrame.prototype = {
      */
     uiLocation: function(callback)
     {
-        function sourceMappingReady()
+        function locationUpdated(uiLocation)
         {
-            this._rawSourceCode.removeEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, sourceMappingReady, this);
-            callback(this._rawSourceCode.sourceMapping.rawLocationToUILocation(this._callFrame.location));
+            callback(uiLocation);
+            liveLocation.dispose();
         }
-        if (this._rawSourceCode.sourceMapping)
-            sourceMappingReady.call(this);
-        else
-            this._rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, sourceMappingReady, this);
+        var liveLocation = this._model.createLiveLocation(this._callFrame.location, locationUpdated.bind(this));
+        liveLocation.init();
     }
 }
 
@@ -798,27 +718,23 @@ WebInspector.PresentationCallFrame.prototype = {
  * @constructor
  * @extends {WebInspector.Placard}
  * @param {WebInspector.PresentationCallFrame} callFrame
+ * @param {WebInspector.DebuggerPresentationModel} model
  */
-WebInspector.DebuggerPresentationModel.CallFramePlacard = function(callFrame)
+WebInspector.DebuggerPresentationModel.CallFramePlacard = function(callFrame, model)
 {
     WebInspector.Placard.call(this, callFrame._callFrame.functionName || WebInspector.UIString("(anonymous function)"), "");
-    this._callFrame = callFrame;
-    var rawSourceCode = callFrame._rawSourceCode;
-    if (rawSourceCode.sourceMapping)
-        this._update();
-    rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._update, this);
+    this._liveLocation = model.createLiveLocation(callFrame._callFrame.location, this._update.bind(this));
+    this._liveLocation.init();
 }
 
 WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype = {
     discard: function()
     {
-        this._callFrame._rawSourceCode.removeEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._update, this);
+        this._liveLocation.dispose();
     },
 
-    _update: function()
+    _update: function(uiLocation)
     {
-        var rawSourceCode = this._callFrame._rawSourceCode;
-        var uiLocation = rawSourceCode.sourceMapping.rawLocationToUILocation(this._callFrame._callFrame.location);
         this.subtitle = WebInspector.displayNameForURL(uiLocation.uiSourceCode.url) + ":" + (uiLocation.lineNumber + 1);
     }
 }
@@ -842,10 +758,8 @@ WebInspector.DebuggerPresentationModelResourceBinding.prototype = {
      */
     canSetContent: function(resource)
     {
-        var rawSourceCode = this._presentationModel._rawSourceCodeForScriptWithURL(resource.url)
-        if (!rawSourceCode)
-            return false;
-        return this._presentationModel.canEditScriptSource(rawSourceCode.sourceMapping.uiSourceCodeList()[0]);
+        var uiSourceCode = this._uiSourceCodeForResource(resource);
+        return uiSourceCode && this._presentationModel.canEditScriptSource(uiSourceCode);
     },
 
     /**
@@ -859,13 +773,28 @@ WebInspector.DebuggerPresentationModelResourceBinding.prototype = {
         if (!majorChange)
             return;
 
-        var rawSourceCode = this._presentationModel._rawSourceCodeForScriptWithURL(resource.url);
-        if (!rawSourceCode) {
+        var uiSourceCode = this._uiSourceCodeForResource(resource);
+        if (!uiSourceCode) {
             userCallback("Resource is not editable");
             return;
         }
 
-        resource.requestContent(this._setContentWithInitialContent.bind(this, rawSourceCode.sourceMapping.uiSourceCodeList()[0], content, userCallback));
+        resource.requestContent(this._setContentWithInitialContent.bind(this, uiSourceCode, content, userCallback));
+    },
+
+    /**
+     * @param {WebInspector.Resource} resource
+     * @return {WebInspector.UISourceCode}
+     */
+    _uiSourceCodeForResource: function(resource)
+    {
+        var script = WebInspector.debuggerModel.scriptsForURL(resource.url)[0];
+        if (!script)
+            return null;
+        var rawLocation = new WebInspector.DebuggerModel.Location(0, 0);
+        rawLocation.scriptId = script.scriptId;
+        var uiLocation = this._presentationModel.rawLocationToUILocation(rawLocation);
+        return uiLocation ? uiLocation.uiSourceCode : null;
     },
 
     /**
@@ -892,6 +821,8 @@ WebInspector.DebuggerPresentationModelResourceBinding.prototype = {
     }
 }
 
+WebInspector.DebuggerPresentationModelResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
+
 /**
  * @interface
  */
@@ -901,10 +832,10 @@ WebInspector.DebuggerPresentationModel.LinkifierFormatter = function()
 
 WebInspector.DebuggerPresentationModel.LinkifierFormatter.prototype = {
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
      * @param {Element} anchor
+     * @param {WebInspector.UILocation} uiLocation
      */
-    formatRawSourceCodeAnchor: function(rawSourceCode, anchor) { },
+    formatLiveAnchor: function(anchor, uiLocation) { },
 }
 
 /**
@@ -919,13 +850,11 @@ WebInspector.DebuggerPresentationModel.DefaultLinkifierFormatter = function(maxL
 
 WebInspector.DebuggerPresentationModel.DefaultLinkifierFormatter.prototype = {
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
      * @param {Element} anchor
+     * @param {WebInspector.UILocation} uiLocation
      */
-    formatRawSourceCodeAnchor: function(rawSourceCode, anchor)
+    formatLiveAnchor: function(anchor, uiLocation)
     {
-        var uiLocation = rawSourceCode.sourceMapping.rawLocationToUILocation(anchor.rawLocation);
-
         anchor.textContent = WebInspector.formatLinkText(uiLocation.uiSourceCode.url, uiLocation.lineNumber);
 
         var text = WebInspector.formatLinkText(uiLocation.uiSourceCode.url, uiLocation.lineNumber);
@@ -946,7 +875,7 @@ WebInspector.DebuggerPresentationModel.Linkifier = function(model, formatter)
 {
     this._model = model;
     this._formatter = formatter || new WebInspector.DebuggerPresentationModel.DefaultLinkifierFormatter();
-    this._anchorsForRawSourceCode = {};
+    this._liveLocations = [];
 }
 
 WebInspector.DebuggerPresentationModel.Linkifier.prototype = {
@@ -958,82 +887,48 @@ WebInspector.DebuggerPresentationModel.Linkifier.prototype = {
      */
     linkifyLocation: function(sourceURL, lineNumber, columnNumber, classes)
     {
-        var rawSourceCode = this._model._rawSourceCodeForScriptWithURL(sourceURL);
-        if (!rawSourceCode)
+        var rawLocation = new WebInspector.DebuggerModel.Location(lineNumber, columnNumber || 0);
+        var script = this._model._scriptForURLAndLocation(sourceURL, rawLocation);
+        if (!script)
             return WebInspector.linkifyResourceAsNode(sourceURL, lineNumber, classes);
-
-        return this.linkifyRawSourceCode(rawSourceCode, lineNumber, columnNumber, classes);
+        rawLocation.scriptId = script.scriptId;
+        return this.linkifyRawLocation(rawLocation, classes);
     },
 
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
-     * @param {number=} lineNumber
-     * @param {number=} columnNumber
+     * @param {WebInspector.DebuggerModel.Location} rawLocation
      * @param {string=} classes
      */
-    linkifyRawSourceCode: function(rawSourceCode, lineNumber, columnNumber, classes)
+    linkifyRawLocation: function(rawLocation, classes)
     {
-        var anchor = WebInspector.linkifyURLAsNode(rawSourceCode.url, "", classes, false);
-        anchor.rawLocation = { lineNumber: lineNumber, columnNumber: columnNumber };
-
-        var anchors = this._anchorsForRawSourceCode[rawSourceCode.id];
-        if (!anchors) {
-            anchors = [];
-            this._anchorsForRawSourceCode[rawSourceCode.id] = anchors;
-            rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._updateSourceAnchors, this);
-        }
-
-        if (rawSourceCode.sourceMapping)
-            this._updateAnchor(rawSourceCode, anchor);
-        anchors.push(anchor);
+        var anchor = WebInspector.linkifyURLAsNode("", "", classes, false);
+        var liveLocation = this._model.createLiveLocation(rawLocation, this._updateAnchor.bind(this, anchor));
+        liveLocation.init();
+        this._liveLocations.push(liveLocation);
         return anchor;
     },
 
-    linkifyFunctionLocation: function(functionLocation, classes)
-    {
-        var rawSourceCode = this._model._rawSourceCodeForScriptId[functionLocation.scriptId];
-        if (!rawSourceCode)
-            return undefined;
-        return this.linkifyRawSourceCode(rawSourceCode, functionLocation.lineNumber, functionLocation.columnNumber, classes);
-    },
-
     reset: function()
     {
-        for (var id in this._anchorsForRawSourceCode) {
-            if (this._model._rawSourceCodeForScriptId[id]) // In case of navigation the list of rawSourceCodes is empty.
-                this._model._rawSourceCodeForScriptId[id].removeEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._updateSourceAnchors, this);
-        }
-        this._anchorsForRawSourceCode = {};
+        for (var i = 0; i < this._liveLocations.length; ++i)
+            this._liveLocations[i].dispose();
+        this._liveLocations = [];
     },
 
     /**
-     * @param {WebInspector.Event} event
-     */
-    _updateSourceAnchors: function(event)
-    {
-        var rawSourceCode = /** @type {WebInspector.RawSourceCode} */ event.target;
-        var anchors = this._anchorsForRawSourceCode[rawSourceCode.id];
-        for (var i = 0; i < anchors.length; ++i)
-            this._updateAnchor(rawSourceCode, anchors[i]);
-    },
-
-    /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
      * @param {Element} anchor
+     * @param {WebInspector.UILocation} uiLocation
      */
-    _updateAnchor: function(rawSourceCode, anchor)
+    _updateAnchor: function(anchor, uiLocation)
     {
-        var uiLocation = rawSourceCode.sourceMapping.rawLocationToUILocation(anchor.rawLocation);
         anchor.preferredPanel = "scripts";
+        anchor.href = uiLocation.uiSourceCode.url;
         anchor.uiSourceCode = uiLocation.uiSourceCode;
         anchor.lineNumber = uiLocation.lineNumber;
-
-        this._formatter.formatRawSourceCodeAnchor(rawSourceCode, anchor);
+        this._formatter.formatLiveAnchor(anchor, uiLocation);
     }
 }
 
-WebInspector.DebuggerPresentationModelResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
-
 /**
  * @type {?WebInspector.DebuggerPresentationModel}
  */
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
index d35b20350..37d985fd9 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
@@ -623,6 +623,8 @@ WebInspector.DetailedHeapshotView.prototype = {
     {
         this._currentSearchResultIndex = -1;
         this._popoverHelper.hidePopover();
+        if (this.helpPopover && this.helpPopover.visible)
+            this.helpPopover.hide();
     },
 
     onResize: function()
diff --git a/Source/WebCore/inspector/front-end/Drawer.js b/Source/WebCore/inspector/front-end/Drawer.js
index 9bf372a3e..fec9c9eb3 100644
--- a/Source/WebCore/inspector/front-end/Drawer.js
+++ b/Source/WebCore/inspector/front-end/Drawer.js
@@ -123,7 +123,7 @@ WebInspector.Drawer.prototype = {
         
         function animationFinished()
         {
-            WebInspector.inspectorView.currentPanel().statusBarResized();
+            WebInspector.inspectorView.currentPanel().doResize();
             if (this._view && this._view.afterShow)
                 this._view.afterShow();
             delete this._currentAnimation;
diff --git a/Source/WebCore/inspector/front-end/ElementsPanel.js b/Source/WebCore/inspector/front-end/ElementsPanel.js
index 535e70579..7dbc2c8ff 100644
--- a/Source/WebCore/inspector/front-end/ElementsPanel.js
+++ b/Source/WebCore/inspector/front-end/ElementsPanel.js
@@ -381,7 +381,7 @@ WebInspector.ElementsPanel.prototype = {
                 return;
             }
 
-            object.callFunctionJSON(dimensions, callback);
+            object.callFunctionJSON(dimensions, undefined, callback);
             object.release();
 
             function dimensions()
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index 1367fdef6..07817e8cc 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -1505,6 +1505,8 @@ WebInspector.ElementsTreeElement.prototype = {
         var classes = [ "webkit-html-tag" ];
         if (isClosingTag && isDistinctTreeElement)
             classes.push("close");
+        if (node.isInShadowTree())
+            classes.push("shadow");
         var tagElement = parentElement.createChild("span", classes.join(" "));
         tagElement.appendChild(document.createTextNode("<"));
         var tagNameElement = tagElement.createChild("span", isClosingTag ? "" : "webkit-html-tag-name");
@@ -1527,10 +1529,6 @@ WebInspector.ElementsTreeElement.prototype = {
         var info = {titleDOM: document.createDocumentFragment(), hasChildren: this.hasChildren};
 
         switch (node.nodeType()) {
-            case Node.DOCUMENT_FRAGMENT_NODE:
-                info.titleDOM.appendChild(document.createTextNode("Document Fragment"));
-                break;
-
             case Node.ATTRIBUTE_NODE:
                 var value = node.value || "\u200B"; // Zero width space to force showing an empty value.
                 this._buildAttributeDOM(info.titleDOM, node.name, value);
@@ -1616,10 +1614,15 @@ WebInspector.ElementsTreeElement.prototype = {
                 var cdataElement = info.titleDOM.createChild("span", "webkit-html-text-node");
                 cdataElement.appendChild(document.createTextNode("<![CDATA[" + node.nodeValue() + "]]>"));
                 break;
+            case Node.DOCUMENT_FRAGMENT_NODE:
+                var fragmentElement = info.titleDOM.createChild("span", "webkit-html-fragment");
+                fragmentElement.textContent = node.nodeNameInCorrectCase().collapseWhitespace();
+                if (node.isInShadowTree())
+                    fragmentElement.addStyleClass("shadow");
+                break;
             default:
-                var defaultElement = info.titleDOM.appendChild(document.createTextNode(node.nodeNameInCorrectCase().collapseWhitespace()));
+                info.titleDOM.appendChild(document.createTextNode(node.nodeNameInCorrectCase().collapseWhitespace()));
         }
-
         return info;
     },
 
diff --git a/Source/WebCore/inspector/front-end/ExtensionAPI.js b/Source/WebCore/inspector/front-end/ExtensionAPI.js
index 220d78bde..ce3f976cd 100644
--- a/Source/WebCore/inspector/front-end/ExtensionAPI.js
+++ b/Source/WebCore/inspector/front-end/ExtensionAPI.js
@@ -125,7 +125,7 @@ EventSinkImpl.prototype = {
         if (this._listeners.length === 0)
             extensionServer.sendRequest({ command: commands.Subscribe, type: this._type });
         this._listeners.push(callback);
-        extensionServer.registerHandler("notify-" + this._type, bind(this._dispatch, this));
+        extensionServer.registerHandler("notify-" + this._type, this._dispatch.bind(this));
     },
 
     removeListener: function(callback)
@@ -279,7 +279,7 @@ function Panels()
         return panels[name];
     }
     for (var panel in panels)
-        this.__defineGetter__(panel, bind(panelGetter, null, panel));
+        this.__defineGetter__(panel, panelGetter.bind(null, panel));
 }
 
 Panels.prototype = {
@@ -293,7 +293,7 @@ Panels.prototype = {
             icon: icon,
             page: page
         };
-        extensionServer.sendRequest(request, callback && bind(callback, this, new ExtensionPanel(id)));
+        extensionServer.sendRequest(request, callback && callback.bind(this, new ExtensionPanel(id)));
     },
 
     setOpenResourceHandler: function(callback)
@@ -495,9 +495,9 @@ function AuditResultImpl(id)
 {
     this._id = id;
 
-    this.createURL = bind(this._nodeFactory, null, "url");
-    this.createSnippet = bind(this._nodeFactory, null, "snippet");
-    this.createText = bind(this._nodeFactory, null, "text");
+    this.createURL = this._nodeFactory.bind(null, "url");
+    this.createSnippet = this._nodeFactory.bind(null, "snippet");
+    this.createText = this._nodeFactory.bind(null, "text");
 }
 
 AuditResultImpl.prototype = {
@@ -677,11 +677,11 @@ function ExtensionServerClient()
     this._lastRequestId = 0;
     this._lastObjectId = 0;
 
-    this.registerHandler("callback", bind(this._onCallback, this));
+    this.registerHandler("callback", this._onCallback.bind(this));
 
     var channel = new MessageChannel();
     this._port = channel.port1;
-    this._port.addEventListener("message", bind(this._onMessage, this), false);
+    this._port.addEventListener("message", this._onMessage.bind(this), false);
     this._port.start();
 
     top.postMessage("registerExtension", [ channel.port2 ], "*");
@@ -740,15 +740,6 @@ ExtensionServerClient.prototype = {
     }
 }
 
-/**
- * @param {...*} vararg
- */
-function bind(func, thisObject, vararg)
-{
-    var args = Array.prototype.slice.call(arguments, 2);
-    return function() { return func.apply(thisObject, args.concat(Array.prototype.slice.call(arguments, 0))); };
-}
-
 function populateInterfaceClass(interface, implementation)
 {
     for (var member in implementation) {
@@ -761,9 +752,9 @@ function populateInterfaceClass(interface, implementation)
         if (!descriptor)
             continue;
         if (typeof descriptor.value === "function")
-            interface[member] = bind(descriptor.value, implementation);
+            interface[member] = descriptor.value.bind(implementation);
         else if (typeof descriptor.get === "function")
-            interface.__defineGetter__(member, bind(descriptor.get, implementation));
+            interface.__defineGetter__(member, descriptor.get.bind(implementation));
         else
             Object.defineProperty(interface, member, descriptor);
     }
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js b/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
index 2b2823a0d..fe98f3c29 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
@@ -263,20 +263,22 @@ WebInspector.HeapSnapshotLoaderProxy.prototype = {
         delete this._onLoadCallbacks;
         this._loading = false;
         this._loaded = true;
-        function callLoadCallbacks(snapshotProxy)
-        {
-            for (var i = 0; i < loadCallbacks.length; ++i)
-                loadCallbacks[i](snapshotProxy);
-        }
+        var self = this;
         function updateStaticData(snapshotProxy)
         {
             this.dispose();
-            snapshotProxy.updateStaticData(callLoadCallbacks);
+            snapshotProxy.updateStaticData(this._callLoadCallbacks.bind(this, loadCallbacks));
         }
         this.callFactoryMethod(updateStaticData.bind(this), "finishLoading", "WebInspector.HeapSnapshotProxy");
         return true;
     },
 
+    _callLoadCallbacks: function(loadCallbacks, snapshotProxy)
+    {
+        for (var i = 0; i < loadCallbacks.length; ++i)
+            loadCallbacks[i](snapshotProxy);
+    },
+
     get loaded()
     {
         return this._loaded;
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png b/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
index a46d72888..c483e06e5 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
diff --git a/Source/WebCore/inspector/front-end/IndexedDBModel.js b/Source/WebCore/inspector/front-end/IndexedDBModel.js
index a73fc7ed3..2f075c569 100644
--- a/Source/WebCore/inspector/front-end/IndexedDBModel.js
+++ b/Source/WebCore/inspector/front-end/IndexedDBModel.js
@@ -73,7 +73,7 @@ WebInspector.IndexedDBModel.idbKeyFromKey = function(key)
         break;
     case WebInspector.IndexedDBModel.KeyTypes.ArrayType:
         idbKey = [];
-        for (var i = 0; i < key.length; ++i)
+        for (var i = 0; i < key.array.length; ++i)
             idbKey.push(WebInspector.IndexedDBModel.idbKeyFromKey(key.array[i]));
         break;
     }
diff --git a/Source/WebCore/inspector/front-end/IndexedDBViews.js b/Source/WebCore/inspector/front-end/IndexedDBViews.js
index a14b791b9..6d12c2737 100644
--- a/Source/WebCore/inspector/front-end/IndexedDBViews.js
+++ b/Source/WebCore/inspector/front-end/IndexedDBViews.js
@@ -37,14 +37,14 @@ WebInspector.IDBDatabaseView = function(database)
 {
     WebInspector.View.call(this);
     this.registerRequiredCSS("indexedDBViews.css");
-    
+
     this.element.addStyleClass("fill");
     this.element.addStyleClass("indexed-db-database-view");
-    
+
     this._headersListElement = this.element.createChild("ol", "outline-disclosure");
     this._headersTreeOutline = new TreeOutline(this._headersListElement);
     this._headersTreeOutline.expandTreeElementsWhenArrowing = true;
-    
+
     this._securityOriginTreeElement = new TreeElement("", null, false);
     this._securityOriginTreeElement.selectable = false;
     this._headersTreeOutline.appendChild(this._securityOriginTreeElement);
@@ -105,8 +105,8 @@ WebInspector.IDBDataView = function(model, databaseId, objectStore, index)
 {
     WebInspector.View.call(this);
     this.registerRequiredCSS("indexedDBViews.css");
-    
-    this._model = model; 
+
+    this._model = model;
     this._databaseId = databaseId;
     this._isIndex = !!index;
 
@@ -114,10 +114,13 @@ WebInspector.IDBDataView = function(model, databaseId, objectStore, index)
 
     var editorToolbar = this._createEditorToolbar();
     this.element.appendChild(editorToolbar);
-    
+
     this._dataGridContainer = this.element.createChild("div", "fill");
     this._dataGridContainer.addStyleClass("data-grid-container");
 
+    this._refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
+    this._refreshButton.addEventListener("click", this._refreshButtonClicked, this);
+
     this._pageSize = 50;
     this._skipCount = 0;
 
@@ -134,18 +137,18 @@ WebInspector.IDBDataView.prototype = {
         columns["number"] = {};
         columns["number"].title = WebInspector.UIString("#");
         columns["number"].width = "50px";
-        
+
         var keyPath = this._isIndex ? this._index.keyPath : this._objectStore.keyPath;
         columns["key"] = {};
-        var keyColumnTitle = WebInspector.UIString("Key") + (keyPath ? " (" + keyPath + ")" : "");
+        var keyColumnTitle = WebInspector.UIString("Key") + this._keyPathHeader(keyPath);
         columns["key"].title = keyColumnTitle;
-        
+
         if (this._isIndex) {
             columns["primaryKey"] = {};
-            var primaryKeyColumnTitle = WebInspector.UIString("Primary key") + (this._objectStore.keyPath ? " (" + this._objectStore.keyPath + ")" : "");
+            var primaryKeyColumnTitle = WebInspector.UIString("Primary key") + this._keyPathHeader(this._objectStore.keyPath);
             columns["primaryKey"].title = primaryKeyColumnTitle;
         }
-        
+
         columns["value"] = {};
         columns["value"].title = WebInspector.UIString("Value");
 
@@ -154,6 +157,16 @@ WebInspector.IDBDataView.prototype = {
     },
 
     /**
+     * @return {string}
+     */
+    _keyPathHeader: function(keyPath)
+    {
+        if (!keyPath)
+            return "";
+        return " (" + WebInspector.UIString("keyPath") + ": \"" + keyPath + "\")";
+    },
+
+    /**
      * @return {Element}
      */
     _createEditorToolbar: function()
@@ -169,7 +182,7 @@ WebInspector.IDBDataView.prototype = {
         this._pageBackButton.appendChild(document.createElement("img"));
         this._pageBackButton.addEventListener("click", this._pageBackButtonClicked.bind(this), false);
         editorToolbar.appendChild(this._pageBackButton);
-        
+
         this._pageForwardButton = editorToolbar.createChild("button", "forward-button");
         this._pageForwardButton.addStyleClass("status-bar-item");
         this._pageForwardButton.title = WebInspector.UIString("Show next page.");
@@ -177,7 +190,7 @@ WebInspector.IDBDataView.prototype = {
         this._pageForwardButton.appendChild(document.createElement("img"));
         this._pageForwardButton.addEventListener("click", this._pageForwardButtonClicked.bind(this), false);
         editorToolbar.appendChild(this._pageForwardButton);
-        
+
         this._keyInputElement = editorToolbar.createChild("input", "key-input");
         this._keyInputElement.placeholder = WebInspector.UIString("Start from key");
         this._keyInputElement.addEventListener("paste", this._keyInputChanged.bind(this));
@@ -193,18 +206,18 @@ WebInspector.IDBDataView.prototype = {
         this._skipCount = Math.max(0, this._skipCount - this._pageSize);
         this._updateData(false);
     },
-    
+
     _pageForwardButtonClicked: function()
     {
         this._skipCount = this._skipCount + this._pageSize;
         this._updateData(false);
     },
-    
+
     _keyInputChanged: function()
     {
-        window.setTimeout(this._updateData.bind(this, false), 0);        
+        window.setTimeout(this._updateData.bind(this, false), 0);
     },
-    
+
     /**
      * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
      * @param {WebInspector.IndexedDBModel.Index} index
@@ -220,9 +233,9 @@ WebInspector.IDBDataView.prototype = {
         this._dataGrid.show(this._dataGridContainer);
 
         this._skipCount = 0;
-        this._updateData(true); 
+        this._updateData(true);
     },
-    
+
     /**
      * @param {string} keyString
      */
@@ -236,7 +249,7 @@ WebInspector.IDBDataView.prototype = {
         }
         return result;
     },
-    
+
     /**
      * @return {string}
      */
@@ -255,7 +268,7 @@ WebInspector.IDBDataView.prototype = {
         var key = this._parseKey(this._keyInputElement.value);
         var pageSize = this._pageSize;
         var skipCount = this._skipCount;
-        
+
         if (!force && this._lastKey === key && this._lastPageSize === pageSize && this._lastSkipCount === skipCount)
             return;
 
@@ -277,8 +290,8 @@ WebInspector.IDBDataView.prototype = {
             for (var i = 0; i < entries.length; ++i) {
                 var data = {};
                 data["number"] = i + skipCount;
-                data["key"] = this._stringifyKey(entries[i].key);
-                data["primaryKey"] = this._stringifyKey(entries[i].primaryKey);
+                data["key"] = entries[i].key;
+                data["primaryKey"] = entries[i].primaryKey;
                 data["value"] = entries[i].value;
 
                 var primaryKey = JSON.stringify(this._isIndex ? entries[i].primaryKey : entries[i].key);
@@ -286,17 +299,27 @@ WebInspector.IDBDataView.prototype = {
                 var node = new WebInspector.IDBDataGridNode(valueTitle, data);
                 this._dataGrid.appendChild(node);
             }
-            
+
             this._pageBackButton.disabled = skipCount === 0;
             this._pageForwardButton.disabled = !hasMore;
         }
-        
+
         var idbKeyRange = key ? window.webkitIDBKeyRange.lowerBound(key) : null;
         if (this._isIndex)
             this._model.loadIndexData(this._databaseId, this._objectStore.name, this._index.name, idbKeyRange, skipCount, pageSize, callback.bind(this));
         else
             this._model.loadObjectStoreData(this._databaseId, this._objectStore.name, idbKeyRange, skipCount, pageSize, callback.bind(this));
     },
+
+    _refreshButtonClicked: function(event)
+    {
+        this._updateData(true);
+    },
+
+    get statusBarItems()
+    {
+        return [this._refreshButton.element];
+    }
 }
 
 WebInspector.IDBDataView.prototype.__proto__ = WebInspector.View.prototype;
@@ -310,7 +333,7 @@ WebInspector.IDBDataView.prototype.__proto__ = WebInspector.View.prototype;
 WebInspector.IDBDataGridNode = function(valueTitle, data)
 {
     WebInspector.DataGridNode.call(this, data, false);
-    
+
     this._valueTitle = valueTitle;
     this.selectable = false;
 }
@@ -321,13 +344,46 @@ WebInspector.IDBDataGridNode.prototype = {
      */
     createCell: function(columnIdentifier)
     {
-        if (columnIdentifier !== "value")
-            return WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
+        var cell = WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
+        var value = this.data[columnIdentifier];
         
-        var section = new WebInspector.ObjectPropertiesSection(this.data["value"], this._valueTitle)
-        section.editable = false;
-        section.skipProto = true;
-        return section.element;
+        switch (columnIdentifier) {
+        case "value":
+            cell.removeChildren();
+            this._formatValue(cell, value);
+            break;
+        case "key":
+        case "primaryKey":
+            cell.removeChildren();
+            this._formatValue(cell, new WebInspector.LocalJSONObject(value));
+            break;
+        default:
+        }
+
+        return cell;
+    },
+
+    _formatValue: function(cell, value)
+    {
+        var type = value.subtype || value.type;
+        var contents = cell.createChild("div", "source-code console-formatted-" + type);
+
+        switch (type) {
+        case "object":
+        case "array":
+            var section = new WebInspector.ObjectPropertiesSection(value, value.description)
+            section.editable = false;
+            section.skipProto = true;
+            contents.appendChild(section.element);
+            break;
+        case "string":
+            contents.addStyleClass("primitive-value");
+            contents.appendChild(document.createTextNode("\"" + value.description + "\""));
+            break;
+        default:
+            contents.addStyleClass("primitive-value");
+            contents.appendChild(document.createTextNode(value.description));
+        }
     }
 };
 
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js b/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
index 828c54032..3b02f6c2b 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
@@ -95,6 +95,11 @@ InspectorFrontendAPI = {
         WebInspector.inspectorView.setCurrentPanel(WebInspector.panels.resources);
     },
 
+    setDockingUnavailable: function(unavailable)
+    {
+        WebInspector.setDockingUnavailable(unavailable);
+    },
+
     dispatch: function(signature)
     {
         if (WebInspector.panels) {
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
index 6e9b12ea1..ac314a4eb 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
@@ -36,6 +36,7 @@ if (!window.InspectorFrontendHost) {
 WebInspector.InspectorFrontendHostStub = function()
 {
     this._attachedWindowHeight = 0;
+    this.isStub = true;
 }
 
 WebInspector.InspectorFrontendHostStub.prototype = {
@@ -136,11 +137,6 @@ WebInspector.InspectorFrontendHostStub.prototype = {
         fr.readAsDataURL(blob);
     },
 
-    canAttachWindow: function()
-    {
-        return false;
-    },
-
     sendMessageToBackend: function(message)
     {
     },
@@ -160,6 +156,10 @@ WebInspector.InspectorFrontendHostStub.prototype = {
     loadResourceSynchronously: function(url)
     {
         return "";
+    },
+
+    setZoomFactor: function(zoom)
+    {
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
index c8b9528ce..0b6fc18c2 100644
--- a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
+++ b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
@@ -169,7 +169,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         if (typeof this._executionLineNumber === "number") {
             var newExecutionLineNumber = this._lineNumberAfterEditing(this._executionLineNumber, oldRange, newRange);
             this.clearExecutionLine();
-            this.setExecutionLine(newExecutionLineNumber, true);
+            this.setExecutionLine(newExecutionLineNumber);
         }
 
         // Adjust breakpoints.
@@ -460,16 +460,13 @@ WebInspector.JavaScriptSourceFrame.prototype = {
     },
 
     /**
-     * @param {boolean=} skipRevealLine
+     * @param {number} lineNumber
      */
-    setExecutionLine: function(lineNumber, skipRevealLine)
+    setExecutionLine: function(lineNumber)
     {
         this._executionLineNumber = lineNumber;
-        if (this.loaded) {
+        if (this.loaded)
             this.textViewer.addDecoration(lineNumber, "webkit-execution-line");
-            if (!skipRevealLine)
-                this.textViewer.revealLine(lineNumber);
-        }
     },
 
     clearExecutionLine: function()
diff --git a/Source/WebCore/inspector/front-end/MemoryStatistics.js b/Source/WebCore/inspector/front-end/MemoryStatistics.js
index d9d2fbcff..c3fdfb506 100644
--- a/Source/WebCore/inspector/front-end/MemoryStatistics.js
+++ b/Source/WebCore/inspector/front-end/MemoryStatistics.js
@@ -46,27 +46,177 @@ WebInspector.MemoryStatistics = function(timelinePanel, sidebarWidth)
     this._memorySplitView.addEventListener(WebInspector.SplitView.EventTypes.Resized, this._sidebarResized.bind(this));
 
     this._canvasContainer = this._memorySplitView.mainElement;
-    this._canvas = this._canvasContainer.createChild("canvas", "fill");
+    this._canvasContainer.id = "memory-graphs-canvas-container";
+    this._currentValuesBar = this._canvasContainer.createChild("div");
+    this._currentValuesBar.id = "counter-values-bar";
+    this._canvas = this._canvasContainer.createChild("canvas");
     this._canvas.id = "memory-counters-graph";
     this._lastMarkerXPosition = 0;
 
-    this._canvasContainer.addEventListener("mouseover", this._onMouseOver.bind(this), true);
-    this._canvasContainer.addEventListener("mousemove", this._onMouseMove.bind(this), true);
-    this._canvasContainer.addEventListener("mouseout", this._onMouseOut.bind(this), true);
+    this._canvas.addEventListener("mouseover", this._onMouseOver.bind(this), true);
+    this._canvas.addEventListener("mousemove", this._onMouseMove.bind(this), true);
+    this._canvas.addEventListener("mouseout", this._onMouseOut.bind(this), true);
+    this._canvas.addEventListener("click", this._onClick.bind(this), true);
+    // We create extra timeline grid here to reuse its event dividers.
+    this._timelineGrid = new WebInspector.TimelineGrid();
+    this._canvasContainer.appendChild(this._timelineGrid.dividersElement);
 
     // Populate sidebar
-    this._counterSidebarElements = [];
-    this._documents = this._createCounterSidebarElement(WebInspector.UIString("Document count"), true);
-    this._domNodes = this._createCounterSidebarElement(WebInspector.UIString("DOM node count"), true);
-    this._listeners = this._createCounterSidebarElement(WebInspector.UIString("Event listener count"), false);
-
-    this._savedImageData = [];
-    this._graphColors = ["rgba(100,0,0,0.8)", "rgba(0,100,0,0.8)", "rgba(0,0,100,0.8)"];
+    this._memorySplitView.sidebarElement.createChild("div", "sidebar-tree sidebar-tree-section").textContent = WebInspector.UIString("COUNTERS");
+    function getDocumentCount(entry)
+    {
+        return entry.documentCount;
+    }
+    function getNodeCount(entry)
+    {
+        return entry.nodeCount;
+    }
+    function getListenerCount(entry)
+    {
+        return entry.listenerCount;
+    }
+    this._counterUI = [
+        new WebInspector.CounterUI(this, "Document Count", "Documents: %d", [100,0,0], getDocumentCount),
+        new WebInspector.CounterUI(this, "DOM Node Count", "Nodes: %d", [0,100,0], getNodeCount),
+        new WebInspector.CounterUI(this, "Event Listener Count", "Listeners: %d", [0,0,100], getListenerCount)
+    ];
 
     TimelineAgent.setIncludeMemoryDetails(true);
 }
 
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.SwatchCheckbox = function(title, color)
+{
+    this.element = document.createElement("div");
+    this._swatch = this.element.createChild("div", "swatch");
+    this.element.createChild("span", "title").textContent = title;
+    this._color = color;
+    this.checked = true;
+
+    this.element.addEventListener("click", this._toggleCheckbox.bind(this), true);
+}
+
+WebInspector.SwatchCheckbox.Events = {
+    Changed: "Changed"
+}
+
+WebInspector.SwatchCheckbox.prototype = {
+    get checked()
+    {
+        return this._checked;
+    },
+
+    set checked(v)
+    {
+        this._checked = v;
+        if (this._checked)
+            this._swatch.style.backgroundColor = this._color;
+        else
+            this._swatch.style.backgroundColor = "";
+    },
+
+    _toggleCheckbox: function(event)
+    {
+        this.checked = !this.checked;
+        this.dispatchEventToListeners(WebInspector.SwatchCheckbox.Events.Changed);
+    }
+}
+
+WebInspector.SwatchCheckbox.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ */
+WebInspector.CounterUI = function(memoryCountersPane, title, currentValueLabel, rgb, valueGetter)
+{
+    this._memoryCountersPane = memoryCountersPane;
+    this.valueGetter = valueGetter;
+    var container = memoryCountersPane._memorySplitView.sidebarElement.createChild("div", "memory-counter-sidebar-info");
+    var swatchColor = "rgb(" + rgb.join(",") + ")";
+    this._swatch = new WebInspector.SwatchCheckbox(WebInspector.UIString(title), swatchColor);
+    this._swatch.addEventListener(WebInspector.SwatchCheckbox.Events.Changed, this._toggleCounterGraph.bind(this));
+    container.appendChild(this._swatch.element);
+    this._range = this._swatch.element.createChild("span");
+
+    this._value = memoryCountersPane._currentValuesBar.createChild("span", "memory-counter-value");
+    this._value.style.color = swatchColor;
+    this._currentValueLabel = currentValueLabel;
+
+    this.graphColor = "rgba(" + rgb.join(",") + ",0.8)";
+    this.graphYValues = [];
+}
+
+WebInspector.CounterUI.prototype = {
+    _toggleCounterGraph: function(event)
+    {
+        if (this._swatch.checked)
+            this._value.removeStyleClass("hidden");
+        else
+            this._value.addStyleClass("hidden");
+        this._memoryCountersPane.refresh();
+    },
+
+    setRange: function(minValue, maxValue)
+    {
+        this._range.textContent = WebInspector.UIString("[ %d - %d ]", minValue, maxValue);
+    },
+
+    updateCurrentValue: function(countersEntry)
+    {
+        this._value.textContent =  WebInspector.UIString(this._currentValueLabel, this.valueGetter(countersEntry));
+    },
+
+    clearCurrentValueAndMarker: function(ctx)
+    {
+        this._value.textContent = "";
+        this.restoreImageUnderMarker(ctx);
+    },
+
+    get visible()
+    {
+        return this._swatch.checked;
+    },
+
+    saveImageUnderMarker: function(ctx, x, y, radius)
+    {
+        const w = radius + 1;
+        var imageData = ctx.getImageData(x - w, y - w, 2 * w, 2 * w);
+        this._imageUnderMarker = {
+            x: x - w,
+            y: y - w,
+            imageData: imageData };
+    },
+
+    restoreImageUnderMarker: function(ctx)
+    {
+        if (!this.visible)
+            return;
+        if (this._imageUnderMarker)
+            ctx.putImageData(this._imageUnderMarker.imageData, this._imageUnderMarker.x, this._imageUnderMarker.y);
+        this.discardImageUnderMarker();
+    },
+
+    discardImageUnderMarker: function()
+    {
+        delete this._imageUnderMarker;
+    }
+}
+
+
 WebInspector.MemoryStatistics.prototype = {
+    reset: function()
+    {
+        this._counters = [];
+    },
+
+    setMainTimelineGrid: function(timelineGrid)
+    {
+        this._mainTimelineGrid = timelineGrid;
+    },
+
     setTopPosition: function(top)
     {
         this._memorySplitView.element.style.top = top + "px";
@@ -93,46 +243,12 @@ WebInspector.MemoryStatistics.prototype = {
 
     _updateSize: function()
     {
-        var height = this._canvasContainer.offsetHeight;
-        this._canvas.width = this._canvasContainer.offsetWidth;
-        this._canvas.height = height;
-        this._updateSidebarSize(height);
-    },
-
-    _updateSidebarSize: function(height)
-    {
-        var length = this._counterSidebarElements.length;
-        var graphHeight =  Math.round(height / length);
-        var top = 0;
-        for (var i = 0; i < length; i++) {
-            var element = this._counterSidebarElements[i];
-            element.style.top = top + "px";
-            element.style.height = graphHeight + "px";
-            top += graphHeight;
-        }
-    },
-
-    _createCounterSidebarElement: function(title, showBottomBorder)
-    {
-        var container = this._memorySplitView.sidebarElement.createChild("div", "memory-counter-sidebar-info");
-        container.createChild("div", "title").textContent = title;
-
-        var currentValue = container.createChild("div", "counter-value");
-        currentValue.createChild("span").textContent = WebInspector.UIString("Current: ");
-        container._value = currentValue.createChild("span");
-
-        var minValue = container.createChild("div", "counter-value");
-        minValue.createChild("span").textContent = WebInspector.UIString("Min: ");
-        container._minValue = minValue.createChild("span");
+        var width = this._mainTimelineGrid.dividersElement.offsetWidth + 1;
+        this._canvasContainer.style.width = width + "px";
 
-        var maxValue = container.createChild("div", "counter-value");
-        maxValue.createChild("span").textContent = WebInspector.UIString("Max: ");
-        container._maxValue = maxValue.createChild("span");
-
-        if (showBottomBorder)
-            container.addStyleClass("bottom-border-visible");
-        this._counterSidebarElements.push(container);
-        return container;
+        var height = this._canvasContainer.offsetHeight - this._currentValuesBar.offsetHeight;
+        this._canvas.width = width;
+        this._canvas.height = height;
     },
 
     addTimlineEvent: function(event)
@@ -151,30 +267,10 @@ WebInspector.MemoryStatistics.prototype = {
         this._calculateVisibleIndexes();
         this._calculateXValues();
         this._clear();
-        var graphHeight = Math.round(this._canvas.height / 3);
-
-        function getDocumentCount(entry)
-        {
-            return entry.documentCount;
-        }
-        this._setVerticalClip(0 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getDocumentCount, this._graphColors[0], this._documents);
-        this._drawBottomBound("rgba(20,20,20,0.8)");
 
-        function getNodeCount(entry)
-        {
-            return entry.nodeCount;
-        }
-        this._setVerticalClip(1 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getNodeCount, this._graphColors[1], this._domNodes);
-        this._drawBottomBound("rgba(20,20,20,0.8)");
-
-        function getListenerCount(entry)
-        {
-            return entry.listenerCount;
-        }
-        this._setVerticalClip(2 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getListenerCount, this._graphColors[2], this._listeners);
+        this._setVerticalClip(10, this._canvas.height - 20);
+        for (var i = 0; i < this._counterUI.length; i++)
+            this._drawGraph(this._counterUI[i]);
     },
 
     _calculateVisibleIndexes: function()
@@ -205,14 +301,21 @@ WebInspector.MemoryStatistics.prototype = {
         this._maxTime = end;
     },
 
+    _onClick: function(event)
+    {
+        var x = event.x - event.target.offsetParent.offsetLeft
+        var i = this._recordIndexAt(x);
+        var counter = this._counters[i];
+        this._timelinePanel.revealRecordAt(counter.time / 1000);
+    },
+
     _onMouseOut: function(event)
     {
-        this._clearMarkers();
         delete this._markerXPosition;
 
-        this._documents._value.textContent = "";
-        this._domNodes._value.textContent = "";
-        this._listeners._value.textContent = "";
+        var ctx = this._canvas.getContext("2d");
+        for (var i = 0; i < this._counterUI.length; i++)
+            this._counterUI[i].clearCurrentValueAndMarker(ctx);
     },
 
     _onMouseOver: function(event)
@@ -235,9 +338,8 @@ WebInspector.MemoryStatistics.prototype = {
             return;
         var i = this._recordIndexAt(this._markerXPosition);
 
-        this._documents._value.textContent = this._counters[i].documentCount;
-        this._domNodes._value.textContent = this._counters[i].nodeCount;
-        this._listeners._value.textContent = this._counters[i].listenerCount;
+        for (var j = 0; j < this._counterUI.length; j++)
+            this._counterUI[j].updateCurrentValue(this._counters[i]);
 
         this._highlightCurrentPositionOnGraphs(this._markerXPosition, i);
     },
@@ -257,43 +359,38 @@ WebInspector.MemoryStatistics.prototype = {
     _highlightCurrentPositionOnGraphs: function(x, index)
     {
         var ctx = this._canvas.getContext("2d");
-        this._clearMarkers();
-        var yValues = this._counters[index].yValues;
-        for (var i = 0; i < yValues.length; i++) {
-            var y = yValues[i];
+        for (var i = 0; i < this._counterUI.length; i++) {
+            var counterUI = this._counterUI[i];
+            if (!counterUI.visible)
+                continue;
+            counterUI.restoreImageUnderMarker(ctx);
+        }
+
+        const radius = 2;
+        for (var i = 0; i < this._counterUI.length; i++) {
+            var counterUI = this._counterUI[i];
+            if (!counterUI.visible)
+                continue;
+            var y = counterUI.graphYValues[index];
+            counterUI.saveImageUnderMarker(ctx, x, y, radius);
+        }
+
+        for (var i = 0; i < this._counterUI.length; i++) {
+            var counterUI = this._counterUI[i];
+            if (!counterUI.visible)
+                continue;
+            var y = counterUI.graphYValues[index];
             ctx.beginPath();
-            const radius = 2;
-            this._saveImageUnderMarker(ctx, x, y, radius);
             ctx.arc(x, y, radius, 0, Math.PI*2, true);
             ctx.lineWidth = 1;
-            ctx.fillStyle = this._graphColors[i];
-            ctx.strokeStyle = this._graphColors[i];
+            ctx.fillStyle = counterUI.graphColor;
+            ctx.strokeStyle = counterUI.graphColor;
             ctx.fill();
             ctx.stroke();
             ctx.closePath();
         }
     },
 
-    _clearMarkers: function()
-    {
-        var ctx = this._canvas.getContext("2d");
-        for (var i = 0; i < this._savedImageData.length; i++) {
-            var entry = this._savedImageData[i];
-            ctx.putImageData(entry.imageData, entry.x, entry.y);
-        }
-        this._savedImageData = [];
-    },
-
-    _saveImageUnderMarker: function(ctx, x, y, radius)
-    {
-        const w = radius + 1;
-        var imageData = ctx.getImageData(x - w, y - w, 2 * w, 2 * w);
-        this._savedImageData.push({
-            x: x - w,
-            y: y - w,
-            imageData: imageData });
-    },
-
     visible: function()
     {
         return this._memorySplitView.isShowing();
@@ -304,12 +401,14 @@ WebInspector.MemoryStatistics.prototype = {
         var anchor = /** @type {Element|null} */ this._containerAnchor.nextSibling;
         this._memorySplitView.show(this._timelinePanel.element, anchor);
         this._updateSize();
+        this._refreshDividers();
         setTimeout(this._draw.bind(this), 0);
     },
 
     refresh: function()
     {
         this._updateSize();
+        this._refreshDividers();
         this._draw();
         this._refreshCurrentValues();
     },
@@ -319,6 +418,11 @@ WebInspector.MemoryStatistics.prototype = {
         this._memorySplitView.detach();
     },
 
+    _refreshDividers: function()
+    {
+        this._timelineGrid.updateDividers(true, this._timelinePanel.calculator, this._timelinePanel.timelinePaddingLeft);
+    },
+
     _setVerticalClip: function(originY, height)
     {
         this._originY = originY;
@@ -339,22 +443,14 @@ WebInspector.MemoryStatistics.prototype = {
         this._counters[this._maximumIndex].x = width;
     },
 
-    _drawPolyline: function(valueGetter, color, section)
+    _drawGraph: function(counterUI)
     {
         var canvas = this._canvas;
         var ctx = canvas.getContext("2d");
         var width = canvas.width;
         var height = this._clippedHeight;
         var originY = this._originY;
-
-        // Draw originalValue level
-        ctx.beginPath();
-        ctx.moveTo(0, originY + height / 2 + 0.5);
-        ctx.lineTo(width, originY + height / 2 + 0.5);
-        ctx.lineWidth = 0.1;
-        ctx.strokeStyle = "rgb(100, 100, 100)";
-        ctx.stroke();
-        ctx.closePath();
+        var valueGetter = counterUI.valueGetter;
 
         if (!this._counters.length)
             return;
@@ -369,44 +465,31 @@ WebInspector.MemoryStatistics.prototype = {
                 maxValue = value;
         }
 
-        section._minValue.textContent = minValue;
-        section._maxValue.textContent = maxValue;
+        counterUI.setRange(minValue, maxValue);
+
+        if (!counterUI.visible)
+            return;
 
-        var originalValue = valueGetter(this._counters[this._minimumIndex]);
+        var yValues = counterUI.graphYValues;
+        yValues.length = this._counters.length;
 
-        var maxYRange = Math.max(maxValue - originalValue, originalValue - minValue);
-        var yFactor = maxYRange ? height / (2 * maxYRange) : 0.5;
+        var maxYRange = maxValue - minValue;
+        var yFactor = maxYRange ? height / (maxYRange) : 1;
 
         ctx.beginPath();
-        var currentY = originY + height / 2;
+        var currentY = originY + (height - (valueGetter(this._counters[this._minimumIndex])- minValue) * yFactor);
         ctx.moveTo(0, currentY);
         for (var i = this._minimumIndex; i <= this._maximumIndex; i++) {
              var x = this._counters[i].x;
              ctx.lineTo(x, currentY);
-             currentY = originY + (height / 2 - (valueGetter(this._counters[i])- originalValue) * yFactor);
+             currentY = originY + (height - (valueGetter(this._counters[i])- minValue) * yFactor);
              ctx.lineTo(x, currentY);
 
-             this._counters[i].yValues.push(currentY);
+             yValues[i] = currentY;
         }
         ctx.lineTo(width, currentY);
         ctx.lineWidth = 1;
-        ctx.strokeStyle = color;
-        ctx.stroke();
-        ctx.closePath();
-    },
-
-    _drawBottomBound: function(color)
-    {
-        var canvas = this._canvas;
-        var width = canvas.width;
-        var y = this._originY + this._clippedHeight + 1.5;
-
-        var ctx = canvas.getContext("2d");
-        ctx.beginPath();
-        ctx.moveTo(0, y);
-        ctx.lineTo(width, y);
-        ctx.lineWidth = 0.5;
-        ctx.strokeStyle = color;
+        ctx.strokeStyle = counterUI.graphColor;
         ctx.stroke();
         ctx.closePath();
     },
@@ -414,9 +497,8 @@ WebInspector.MemoryStatistics.prototype = {
     _clear: function() {
         var ctx = this._canvas.getContext("2d");
         ctx.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);
-        for (var i = this._minimumIndex; i <= this._maximumIndex; i++)
-             this._counters[i].yValues = [];
-        this._savedImageData = [];
+        for (var i = 0; i < this._counterUI.length; i++)
+            this._counterUI[i].discardImageUnderMarker();
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
index 6467004c5..585b57e68 100644
--- a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -443,7 +443,7 @@ WebInspector.MetricsSidebarPane.prototype = {
                 continue;
 
             this.previousPropertyDataCandidate = property;
-            property.setValue(userInput, commitEditor, callback);
+            property.setValue(userInput, commitEditor, true, callback);
             return;
         }
 
diff --git a/Source/WebCore/inspector/front-end/NetworkPanel.js b/Source/WebCore/inspector/front-end/NetworkPanel.js
index 9b65a8717..88c270d4b 100644
--- a/Source/WebCore/inspector/front-end/NetworkPanel.js
+++ b/Source/WebCore/inspector/front-end/NetworkPanel.js
@@ -1451,7 +1451,7 @@ WebInspector.NetworkBaseCalculator.prototype = {
 
     computeBarGraphLabels: function(item)
     {
-        const label = this.formatValue(this._value(item));
+        const label = this.formatTime(this._value(item));
         return {left: label, right: label, tooltip: label};
     },
 
@@ -1483,7 +1483,7 @@ WebInspector.NetworkBaseCalculator.prototype = {
         return 0;
     },
 
-    formatValue: function(value)
+    formatTime: function(value)
     {
         return value.toString();
     }
@@ -1553,11 +1553,11 @@ WebInspector.NetworkTimeCalculator.prototype = {
     {
         var rightLabel = "";
         if (resource.responseReceivedTime !== -1 && resource.endTime !== -1)
-            rightLabel = this.formatValue(resource.endTime - resource.responseReceivedTime);
+            rightLabel = this.formatTime(resource.endTime - resource.responseReceivedTime);
 
         var hasLatency = resource.latency > 0;
         if (hasLatency)
-            var leftLabel = this.formatValue(resource.latency);
+            var leftLabel = this.formatTime(resource.latency);
         else
             var leftLabel = rightLabel;
 
@@ -1565,7 +1565,7 @@ WebInspector.NetworkTimeCalculator.prototype = {
             return {left: leftLabel, right: rightLabel};
 
         if (hasLatency && rightLabel) {
-            var total = this.formatValue(resource.duration);
+            var total = this.formatTime(resource.duration);
             var tooltip = WebInspector.UIString("%s latency, %s download (%s total)", leftLabel, rightLabel, total);
         } else if (hasLatency)
             var tooltip = WebInspector.UIString("%s latency", leftLabel);
@@ -1601,7 +1601,7 @@ WebInspector.NetworkTimeCalculator.prototype = {
         return didChange;
     },
 
-    formatValue: function(value)
+    formatTime: function(value)
     {
         return Number.secondsToString(value);
     },
@@ -1629,7 +1629,7 @@ WebInspector.NetworkTransferTimeCalculator = function()
 }
 
 WebInspector.NetworkTransferTimeCalculator.prototype = {
-    formatValue: function(value)
+    formatTime: function(value)
     {
         return Number.secondsToString(value);
     },
@@ -1657,7 +1657,7 @@ WebInspector.NetworkTransferDurationCalculator = function()
 }
 
 WebInspector.NetworkTransferDurationCalculator.prototype = {
-    formatValue: function(value)
+    formatTime: function(value)
     {
         return Number.secondsToString(value);
     },
diff --git a/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js b/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js
index 3a560dbf0..f4a099d86 100644
--- a/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js
+++ b/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js
@@ -73,7 +73,7 @@ WebInspector.ObjectPopoverHelper.prototype = {
                         functionName.textContent = response.name || response.inferredName || response.displayName || WebInspector.UIString("(anonymous function)");
 
                         this._linkifier = WebInspector.debuggerPresentationModel.createLinkifier();
-                        var link = this._linkifier.linkifyFunctionLocation(response.location, "function-location-link");
+                        var link = this._linkifier.linkifyRawLocation(response.location, "function-location-link");
                         if (link)
                             title.appendChild(link);
 
diff --git a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
index 20acf9133..8369a83d0 100644
--- a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -48,6 +48,8 @@ WebInspector.ObjectPropertiesSection = function(object, title, subtitle, emptyPl
     WebInspector.PropertiesSection.call(this, title, subtitle);
 }
 
+WebInspector.ObjectPropertiesSection._arrayLoadThreshold = 100;
+
 WebInspector.ObjectPropertiesSection.prototype = {
     onpopulate: function()
     {
@@ -56,17 +58,23 @@ WebInspector.ObjectPropertiesSection.prototype = {
 
     update: function()
     {
-        var self = this;
+        if (this.object.arrayLength() > WebInspector.ObjectPropertiesSection._arrayLoadThreshold) {
+            this.propertiesTreeOutline.removeChildren();
+            WebInspector.ArrayGroupingTreeElement._populateArray(this.propertiesTreeOutline, this.object, 0, this.object.arrayLength() - 1);
+            return;
+        }
+
         function callback(properties)
         {
             if (!properties)
                 return;
-            self.updateProperties(properties);
+            this.updateProperties(properties);
         }
+
         if (this.ignoreHasOwnProperty)
-            this.object.getAllProperties(callback);
+            this.object.getAllProperties(callback.bind(this));
         else
-            this.object.getOwnProperties(callback);
+            this.object.getOwnProperties(callback.bind(this));
     },
 
     updateProperties: function(properties, rootTreeElementConstructor, rootPropertyComparer)
@@ -88,11 +96,14 @@ WebInspector.ObjectPropertiesSection.prototype = {
         for (var i = 0; i < properties.length; ++i) {
             if (this.skipProto && properties[i].name === "__proto__")
                 continue;
-
             properties[i].parentObject = this.object;
-            this.propertiesTreeOutline.appendChild(new rootTreeElementConstructor(properties[i]));
         }
 
+        this.propertiesForTest = properties;
+
+        for (var i = 0; i < properties.length; ++i)
+            this.propertiesTreeOutline.appendChild(new rootTreeElementConstructor(properties[i]));
+
         if (!this.propertiesTreeOutline.children.length) {
             var title = document.createElement("div");
             title.className = "info";
@@ -100,7 +111,6 @@ WebInspector.ObjectPropertiesSection.prototype = {
             var infoElement = new TreeElement(title, null, false);
             this.propertiesTreeOutline.appendChild(infoElement);
         }
-        this.propertiesForTest = properties;
     }
 }
 
@@ -154,6 +164,7 @@ WebInspector.ObjectPropertiesSection.CompareProperties = function(propertyA, pro
 /**
  * @constructor
  * @extends {TreeElement}
+ * @param {WebInspector.RemoteObjectProperty} property
  */
 WebInspector.ObjectPropertyTreeElement = function(property)
 {
@@ -171,23 +182,34 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         if (this.children.length && !this.shouldRefreshChildren)
             return;
 
-        var callback = function(properties) {
+        if (this.property.value.arrayLength() > WebInspector.ObjectPropertiesSection._arrayLoadThreshold) {
+            this.removeChildren();
+            WebInspector.ArrayGroupingTreeElement._populateArray(this, this.property.value, 0, this.property.value.arrayLength() - 1);
+            return;
+        }
+
+        function callback(properties)
+        {
             this.removeChildren();
             if (!properties)
                 return;
 
             properties.sort(WebInspector.ObjectPropertiesSection.CompareProperties);
             for (var i = 0; i < properties.length; ++i) {
+                if (this.treeOutline.section.skipProto && properties[i].name === "__proto__")
+                    continue;
+                properties[i].parentObject = this.property.value;
                 this.appendChild(new this.treeOutline.section.treeElementConstructor(properties[i]));
             }
-        };
+        }
+
         this.property.value.getOwnProperties(callback.bind(this));
     },
 
     ondblclick: function(event)
     {
         if (this.property.writable)
-            this.startEditing();
+            this.startEditing(event);
     },
 
     onattach: function()
@@ -290,28 +312,56 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
             this.parent.shouldRefreshChildren = true;
     },
 
-    startEditing: function()
+    renderPromptAsBlock: function()
+    {
+        return false;
+    },
+
+    /**
+     * @param {Event=} event
+     */
+    elementAndValueToEdit: function(event)
+    {
+        return [this.valueElement, (typeof this.valueElement._originalTextContent === "string") ? this.valueElement._originalTextContent : undefined];
+    },
+
+    startEditing: function(event)
     {
-        if (WebInspector.isBeingEdited(this.valueElement) || !this.treeOutline.section.editable)
+        var elementAndValueToEdit = this.elementAndValueToEdit(event);
+        var elementToEdit = elementAndValueToEdit[0];
+        var valueToEdit = elementAndValueToEdit[1];
+
+        if (WebInspector.isBeingEdited(elementToEdit) || !this.treeOutline.section.editable || this._readOnly)
             return;
 
-        var context = { expanded: this.expanded };
+        // Edit original source.
+        if (typeof valueToEdit !== "undefined")
+            elementToEdit.textContent = valueToEdit;
+
+        var context = { expanded: this.expanded, elementToEdit: elementToEdit, previousContent: elementToEdit.textContent };
 
         // Lie about our children to prevent expanding on double click and to collapse subproperties.
         this.hasChildren = false;
 
         this.listItemElement.addStyleClass("editing-sub-part");
 
-        // Edit original source.
-        if (typeof this.valueElement._originalTextContent === "string")
-            this.valueElement.textContent = this.valueElement._originalTextContent;
+        this._prompt = new WebInspector.ObjectPropertyPrompt(this.editingCommitted.bind(this, null, elementToEdit.textContent, context.previousContent, context), this.editingCancelled.bind(this, null, context), this.renderPromptAsBlock());
 
-        var config = new WebInspector.EditingConfig(this.editingCommitted.bind(this), this.editingCancelled.bind(this), context);
-        WebInspector.startEditing(this.valueElement, config);
+        function blurListener()
+        {
+            this.editingCommitted(null, elementToEdit.textContent, context.previousContent, context);
+        }
+
+        var proxyElement = this._prompt.attachAndStartEditing(elementToEdit, blurListener.bind(this));
+        window.getSelection().setBaseAndExtent(elementToEdit, 0, elementToEdit, 1);
+        proxyElement.addEventListener("keydown", this._promptKeyDown.bind(this, context), false);
     },
 
     editingEnded: function(context)
     {
+        this._prompt.detach();
+        delete this._prompt;
+
         this.listItemElement.scrollLeft = 0;
         this.listItemElement.removeStyleClass("editing-sub-part");
         if (context.expanded)
@@ -320,8 +370,8 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
 
     editingCancelled: function(element, context)
     {
-        this.update();
         this.editingEnded(context);
+        this.update();
     },
 
     editingCommitted: function(element, userInput, previousContent, context)
@@ -329,9 +379,21 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         if (userInput === previousContent)
             return this.editingCancelled(element, context); // nothing changed, so cancel
 
+        this.editingEnded(context);
         this.applyExpression(userInput, true);
+    },
 
-        this.editingEnded(context);
+    _promptKeyDown: function(context, event)
+    {
+        if (isEnterKey(event)) {
+            event.stopPropagation();
+            event.preventDefault();
+            return this.editingCommitted(null, context.elementToEdit.textContent, context.previousContent, context);
+        }
+        if (event.keyIdentifier === "U+001B") { // Esc
+            event.stopPropagation();
+            return this.editingCancelled(null, context);
+        }
     },
 
     applyExpression: function(expression, updateInterface)
@@ -359,3 +421,231 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
 }
 
 WebInspector.ObjectPropertyTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {TreeElement}
+ * @param {WebInspector.RemoteObject} object
+ * @param {number} fromIndex
+ * @param {number} toIndex
+ * @param {number} propertyCount
+ */
+WebInspector.ArrayGroupingTreeElement = function(object, fromIndex, toIndex, propertyCount)
+{
+    TreeElement.call(this, String.sprintf("[%d \u2026 %d]", fromIndex, toIndex), undefined, true);
+    this._fromIndex = fromIndex;
+    this._toIndex = toIndex;
+    this._object = object;
+    this._readOnly = true;
+    this._propertyCount = propertyCount;
+    this._populated = false;
+}
+
+WebInspector.ArrayGroupingTreeElement._bucketThreshold = 20;
+
+/**
+ * @param {TreeElement|TreeOutline} treeElement
+ * @param {WebInspector.RemoteObject} object
+ * @param {number} fromIndex
+ * @param {number} toIndex
+ */
+WebInspector.ArrayGroupingTreeElement._populateArray = function(treeElement, object, fromIndex, toIndex)
+{
+    WebInspector.ArrayGroupingTreeElement._populateRanges(treeElement, object, fromIndex, toIndex, true);
+}
+
+/**
+ * @param {TreeElement|TreeOutline} treeElement
+ * @param {WebInspector.RemoteObject} object
+ * @param {number} fromIndex
+ * @param {number} toIndex
+ * @param {boolean} topLevel
+ */
+WebInspector.ArrayGroupingTreeElement._populateRanges = function(treeElement, object, fromIndex, toIndex, topLevel)
+{
+    object.callFunctionJSON(packRanges, [{value: fromIndex}, {value: toIndex}, {value: WebInspector.ArrayGroupingTreeElement._bucketThreshold}], callback.bind(this));
+
+    function packRanges(fromIndex, toIndex, bucketThreshold)
+    {
+        var count = 0;
+        for (var i = fromIndex; i <= toIndex; ++i) {
+            var value = this[i];
+            if (typeof value !== "undefined")
+                ++count;
+        }
+
+        var bucketSize;
+        if (count < bucketThreshold)
+            bucketSize = count;
+        else {
+            bucketSize = Math.ceil(count / bucketThreshold);
+            if (bucketSize < bucketThreshold)
+                bucketSize = Math.floor(Math.sqrt(count));
+        }
+
+        var ranges = [];
+        count = 0;
+        var groupStart = -1;
+        var groupEnd = 0;
+        for (var i = fromIndex; i <= toIndex; ++i) {
+            var value = this[i];
+            if (typeof value === "undefined")
+                continue;
+
+            if (groupStart === -1)
+                groupStart = i;
+
+            groupEnd = i;
+            if (++count === bucketSize) {
+                ranges.push([groupStart, groupEnd, count]);
+                count = 0;
+                groupStart = -1;
+            }
+        }
+
+        if (count > 0)
+            ranges.push([groupStart, groupEnd, count]);
+        return ranges;
+    }
+
+    function callback(ranges)
+    {
+        if (ranges.length == 1)
+            WebInspector.ArrayGroupingTreeElement._populateAsFragment(treeElement, object, ranges[0][0], ranges[0][1]);
+        else {
+            for (var i = 0; i < ranges.length; ++i) {
+                var fromIndex = ranges[i][0];
+                var toIndex = ranges[i][1];
+                var count = ranges[i][2];
+                if (fromIndex == toIndex)
+                    WebInspector.ArrayGroupingTreeElement._populateAsFragment(treeElement, object, fromIndex, toIndex);
+                else
+                    treeElement.appendChild(new WebInspector.ArrayGroupingTreeElement(object, fromIndex, toIndex, count));
+            }
+        }
+        if (topLevel)
+            WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties(treeElement, object);
+    }
+}
+
+/**
+ * @param {TreeElement|TreeOutline} treeElement
+ * @param {WebInspector.RemoteObject} object
+ * @param {number} fromIndex
+ * @param {number} toIndex
+ */
+WebInspector.ArrayGroupingTreeElement._populateAsFragment = function(treeElement, object, fromIndex, toIndex)
+{
+    object.callFunction(buildArrayFragment, [{value: fromIndex}, {value: toIndex}], processArrayFragment.bind(this));
+
+    function buildArrayFragment(fromIndex, toIndex)
+    {
+        var result = Object.create(null);
+        for (var i = fromIndex; i <= toIndex; ++i) {
+            var value = this[i];
+            if (typeof value !== "undefined")
+                result[i] = value;
+        }
+        return result;
+    }
+
+    function processArrayFragment(arrayFragment)
+    {
+        arrayFragment.getAllProperties(processProperties.bind(this));
+    }
+
+    function processProperties(properties)
+    {
+        if (!properties)
+            return;
+
+        properties.sort(WebInspector.ObjectPropertiesSection.CompareProperties);
+        for (var i = 0; i < properties.length; ++i) {
+            properties[i].parentObject = this._object;
+            var childTreeElement = new treeElement.treeOutline.section.treeElementConstructor(properties[i]);
+            childTreeElement._readOnly = true;
+            treeElement.appendChild(childTreeElement);
+        }
+    }
+}
+
+/**
+ * @param {TreeElement|TreeOutline} treeElement
+ * @param {WebInspector.RemoteObject} object
+ */
+WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties = function(treeElement, object)
+{
+    object.callFunction(buildObjectFragment, undefined, processObjectFragment.bind(this));
+
+    function buildObjectFragment()
+    {
+        var result = Object.create(this.__proto__);
+        var names = Object.getOwnPropertyNames(this);
+        for (var i = 0; i < names.length; ++i) {
+            var name = names[i];
+            if (!isNaN(name))
+                continue;
+            var descriptor = Object.getOwnPropertyDescriptor(this, name);
+            Object.defineProperty(result, name, descriptor);
+        }
+        return result;
+    }
+
+    function processObjectFragment(arrayFragment)
+    {
+        arrayFragment.getOwnProperties(processProperties.bind(this));
+    }
+
+    function processProperties(properties)
+    {
+        if (!properties)
+            return;
+
+        properties.sort(WebInspector.ObjectPropertiesSection.CompareProperties);
+        for (var i = 0; i < properties.length; ++i) {
+            properties[i].parentObject = this._object;
+            var childTreeElement = new treeElement.treeOutline.section.treeElementConstructor(properties[i]);
+            childTreeElement._readOnly = true;
+            treeElement.appendChild(childTreeElement);
+        }
+    }
+}
+
+WebInspector.ArrayGroupingTreeElement.prototype = {
+    onpopulate: function()
+    {
+        if (this._populated)
+            return;
+        
+        this._populated = true;
+
+        if (this._propertyCount >= WebInspector.ArrayGroupingTreeElement._bucketThreshold) {
+            WebInspector.ArrayGroupingTreeElement._populateRanges(this, this._object, this._fromIndex, this._toIndex, false);
+            return;
+        }
+        WebInspector.ArrayGroupingTreeElement._populateAsFragment(this, this._object, this._fromIndex, this._toIndex);
+    },
+
+    onattach: function()
+    {
+        this.listItemElement.addStyleClass("name");
+    }
+}
+
+WebInspector.ArrayGroupingTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.TextPrompt}
+ * @param {boolean=} renderAsBlock
+ */
+WebInspector.ObjectPropertyPrompt = function(commitHandler, cancelHandler, renderAsBlock)
+{
+    const ExpressionStopCharacters = " =:[({;,!+-*/&|^<>."; // Same as in ConsoleView.js + "."
+    WebInspector.TextPrompt.call(this, WebInspector.consoleView.completionsForTextPrompt.bind(WebInspector.consoleView), ExpressionStopCharacters);
+    this.setSuggestBoxEnabled("generic-suggest");
+    if (renderAsBlock)
+        this.renderAsBlock();
+}
+
+WebInspector.ObjectPropertyPrompt.prototype.__proto__ = WebInspector.TextPrompt.prototype;
diff --git a/Source/WebCore/inspector/front-end/Panel.js b/Source/WebCore/inspector/front-end/Panel.js
index 7d10e5902..c9a1c7d7c 100644
--- a/Source/WebCore/inspector/front-end/Panel.js
+++ b/Source/WebCore/inspector/front-end/Panel.js
@@ -212,6 +212,11 @@ WebInspector.Panel.prototype = {
     registerShortcut: function(key, handler)
     {
         this._shortcuts[key] = handler;
+    },
+
+    unregisterShortcut: function(key)
+    {
+        delete this._shortcuts[key];
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ProfileDataGridTree.js b/Source/WebCore/inspector/front-end/ProfileDataGridTree.js
index c30884644..7490b4bd8 100644
--- a/Source/WebCore/inspector/front-end/ProfileDataGridTree.js
+++ b/Source/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -59,17 +59,17 @@ WebInspector.ProfileDataGridNode.prototype = {
         data["calls"] = this.numberOfCalls;
 
         if (this.profileView.showSelfTimeAsPercent.get())
-            data["self"] = WebInspector.UIString("%.2f%%", this.selfPercent);
+            data["self"] = WebInspector.UIString("%.2f%", this.selfPercent);
         else
             data["self"] = formatMilliseconds(this.selfTime);
 
         if (this.profileView.showTotalTimeAsPercent.get())
-            data["total"] = WebInspector.UIString("%.2f%%", this.totalPercent);
+            data["total"] = WebInspector.UIString("%.2f%", this.totalPercent);
         else
             data["total"] = formatMilliseconds(this.totalTime);
 
         if (this.profileView.showAverageTimeAsPercent.get())
-            data["average"] = WebInspector.UIString("%.2f%%", this.averagePercent);
+            data["average"] = WebInspector.UIString("%.2f%", this.averagePercent);
         else
             data["average"] = formatMilliseconds(this.averageTime);
 
diff --git a/Source/WebCore/inspector/front-end/ProfilesPanel.js b/Source/WebCore/inspector/front-end/ProfilesPanel.js
index 3725e5df0..6d139b70a 100644
--- a/Source/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/Source/WebCore/inspector/front-end/ProfilesPanel.js
@@ -142,7 +142,8 @@ WebInspector.ProfilesPanel = function()
     this._launcherView.setUpEventListeners();
 
     this._registerProfileType(new WebInspector.CPUProfileType());
-    this._registerProfileType(new WebInspector.CSSSelectorProfileType());
+    if (!WebInspector.WorkerManager.isWorkerFrontend())
+        this._registerProfileType(new WebInspector.CSSSelectorProfileType());
     if (Capabilities.heapProfilerPresent)
         this._registerProfileType(new WebInspector.DetailedHeapshotProfileType());
 
@@ -858,7 +859,7 @@ WebInspector.ProfilesPanel.prototype = {
     _reportHeapSnapshotProgress: function(done, total)
     {
         if (this.hasTemporaryProfile(WebInspector.DetailedHeapshotProfileType.TypeId)) {
-            this._temporaryRecordingProfile.sidebarElement.subtitle = WebInspector.UIString("%.2f%%", (done / total) * 100);
+            this._temporaryRecordingProfile.sidebarElement.subtitle = WebInspector.UIString("%.2f%", (done / total) * 100);
             this._temporaryRecordingProfile.sidebarElement.wait = true;
             if (done >= total)
                 this._removeTemporaryProfile();
diff --git a/Source/WebCore/inspector/front-end/PropertiesSection.js b/Source/WebCore/inspector/front-end/PropertiesSection.js
index 935e2baa2..0611b143a 100644
--- a/Source/WebCore/inspector/front-end/PropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/PropertiesSection.js
@@ -39,8 +39,8 @@ WebInspector.PropertiesSection = function(title, subtitle)
     this.headerElement.addStyleClass("monospace");
     this.propertiesElement = document.createElement("ol");
     this.propertiesElement.className = "properties properties-tree monospace";
-    this.propertiesElement.tabIndex = 0;
-    this.propertiesTreeOutline = new TreeOutline(this.propertiesElement);
+    this.propertiesTreeOutline = new TreeOutline(this.propertiesElement, true);
+    this.propertiesTreeOutline.setFocusable(false);
     this.propertiesTreeOutline.section = this;
 
     this.element.appendChild(this.propertiesElement);
diff --git a/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js b/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
index 6a7ea64f2..b2fbc527c 100644
--- a/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
@@ -65,7 +65,7 @@ WebInspector.PropertiesSidebarPane.prototype = {
                 }
                 return result;
             }
-            object.callFunction(protoList, nodePrototypesReady.bind(this));
+            object.callFunction(protoList, undefined, nodePrototypesReady.bind(this));
             object.release();
         }
 
diff --git a/Source/WebCore/inspector/front-end/RawSourceCode.js b/Source/WebCore/inspector/front-end/RawSourceCode.js
index c7fd9aec3..3ed4c3088 100644
--- a/Source/WebCore/inspector/front-end/RawSourceCode.js
+++ b/Source/WebCore/inspector/front-end/RawSourceCode.js
@@ -51,7 +51,6 @@ WebInspector.RawSourceCode = function(id, script, resource, formatter, formatted
     this._formatted = formatted;
     this._compilerSourceMapping = compilerSourceMapping;
     this._resource = resource;
-    this.messages = [];
 
     this._useTemporaryContent = !this._compilerSourceMapping && this._resource && !this._resource.finished;
     this._hasNewScripts = true;
@@ -62,7 +61,7 @@ WebInspector.RawSourceCode = function(id, script, resource, formatter, formatted
 }
 
 WebInspector.RawSourceCode.Events = {
-    SourceMappingUpdated: "source-mapping-updated"
+    UISourceCodeListChanged: "us-source-code-list-changed"
 }
 
 WebInspector.RawSourceCode.prototype = {
@@ -76,11 +75,37 @@ WebInspector.RawSourceCode.prototype = {
     },
 
     /**
-     * @return {WebInspector.RawSourceCode.SourceMapping}
+     * @param {DebuggerAgent.Location} rawLocation
+     * @return {WebInspector.UILocation}
      */
-    get sourceMapping()
+    rawLocationToUILocation: function(rawLocation)
     {
-        return this._sourceMapping;
+        if (this._sourceMapping)
+            return this._sourceMapping.rawLocationToUILocation(rawLocation);
+        return null;
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
+     */
+    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
+    {
+        if (this._sourceMapping)
+            return this._sourceMapping.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
+        return null;
+    },
+
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    uiSourceCodeList: function()
+    {
+        if (this._sourceMapping)
+            return this._sourceMapping.uiSourceCodeList();
+        return [];
     },
 
     /**
@@ -231,8 +256,10 @@ WebInspector.RawSourceCode.prototype = {
      */
     _createUISourceCode: function(id, url, contentProvider)
     {
-        var uiSourceCode = new WebInspector.UISourceCode(id, url, this, contentProvider);
+        var uiSourceCode = new WebInspector.UISourceCode(id, url, contentProvider);
         uiSourceCode.isContentScript = this.isContentScript;
+        uiSourceCode.isEditable = this._scripts.length === 1 && !this._scripts[0].lineOffset && !this._scripts[0].columnOffset
+                                  && !this._formatted && !this._compilerSourceMapping;
         return uiSourceCode;
     },
 
@@ -241,11 +268,11 @@ WebInspector.RawSourceCode.prototype = {
      */
     _saveSourceMapping: function(sourceMapping)
     {
-        var oldSourceMapping;
+        var oldUISourceCodeList = [];
         if (this._sourceMapping)
-            oldSourceMapping = this._sourceMapping;
+            oldUISourceCodeList = this._sourceMapping.uiSourceCodeList();
         this._sourceMapping = sourceMapping;
-        this.dispatchEventToListeners(WebInspector.RawSourceCode.Events.SourceMappingUpdated, { oldSourceMapping: oldSourceMapping });
+        this.dispatchEventToListeners(WebInspector.RawSourceCode.Events.UISourceCodeListChanged, { oldUISourceCodeList: oldUISourceCodeList });
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/RemoteObject.js b/Source/WebCore/inspector/front-end/RemoteObject.js
index 55191dd44..a8262dc14 100644
--- a/Source/WebCore/inspector/front-end/RemoteObject.js
+++ b/Source/WebCore/inspector/front-end/RemoteObject.js
@@ -272,35 +272,51 @@ WebInspector.RemoteObject.prototype = {
 
     /**
      * @param {string} functionDeclaration
+     * @param {Array.<RuntimeAgent.CallArgument>} args
      * @param {function(?WebInspector.RemoteObject)} callback
      */
-    callFunction: function(functionDeclaration, callback)
+    callFunction: function(functionDeclaration, args, callback)
     {
         function mycallback(error, result, wasThrown)
         {
             callback((error || wasThrown) ? null : WebInspector.RemoteObject.fromPayload(result));
         }
 
-        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), undefined, undefined, mycallback);
+        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), args, undefined, mycallback);
     },
 
     /**
      * @param {string} functionDeclaration
+     * @param {Array.<RuntimeAgent.CallArgument>} args
      * @param {function(*)} callback
      */
-    callFunctionJSON: function(functionDeclaration, callback)
+    callFunctionJSON: function(functionDeclaration, args, callback)
     {
         function mycallback(error, result, wasThrown)
         {
             callback((error || wasThrown) ? null : result.value);
         }
 
-        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), undefined, true, mycallback);
+        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), args, true, mycallback);
     },
 
     release: function()
     {
         RuntimeAgent.releaseObject(this._objectId);
+    },
+
+    /**
+     * @return {number}
+     */
+    arrayLength: function()
+    {
+        if (this.subtype !== "array")
+            return 0;
+
+        var matches = this._description.match(/\[([0-9]+)\]/);
+        if (!matches)
+            return 0;
+        return parseInt(matches[1], 10);
     }
 }
 
@@ -364,6 +380,9 @@ WebInspector.LocalJSONObject.prototype = {
                 }
                 this._cachedDescription = this._concatenate("[", "]", formatArrayItem);
                 break;
+            case "date":
+                this._cachedDescription = "" + this._value;
+                break;
             case "null":
                 this._cachedDescription = "null";
                 break;
@@ -424,6 +443,9 @@ WebInspector.LocalJSONObject.prototype = {
         if (this._value instanceof Array)
             return "array";
 
+        if (this._value instanceof Date)
+            return "date";
+
         return undefined;
     },
 
@@ -474,5 +496,13 @@ WebInspector.LocalJSONObject.prototype = {
     isError: function()
     {
         return false;
+    },
+
+    /**
+     * @return {number}
+     */
+    arrayLength: function()
+    {
+        return this._value instanceof Array ? this._value.length : 0;
     }
 }
diff --git a/Source/WebCore/inspector/front-end/ResourceUtils.js b/Source/WebCore/inspector/front-end/ResourceUtils.js
index 501df10ea..90ffff01d 100644
--- a/Source/WebCore/inspector/front-end/ResourceUtils.js
+++ b/Source/WebCore/inspector/front-end/ResourceUtils.js
@@ -274,6 +274,11 @@ WebInspector.completeURL = function(baseURL, href)
         var path = href;
         if (path.charAt(0) !== "/") {
             var basePath = parsedURL.path;
+
+            // Trim off the query part of the basePath.
+            var questionMarkIndex = basePath.indexOf("?");
+            if (questionMarkIndex > 0)
+                basePath = basePath.substring(0, questionMarkIndex);
             // A href of "?foo=bar" implies "basePath?foo=bar".
             // With "basePath?a=b" and "?foo=bar" we should get "basePath?foo=bar".
             var prefix;
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index 219b01b75..d5649ffe1 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -1513,6 +1513,19 @@ WebInspector.IndexedDBTreeElement.prototype = {
             this._createIndexedDBModel();
     },
 
+    onattach: function()
+    {
+        WebInspector.StorageCategoryTreeElement.prototype.onattach.call(this);
+        this.listItemElement.addEventListener("contextmenu", this._handleContextMenuEvent.bind(this), true);
+    },
+
+    _handleContextMenuEvent: function(event)
+    {
+        var contextMenu = new WebInspector.ContextMenu();
+        contextMenu.appendItem(WebInspector.UIString("Refresh IndexedDB"), this.refreshIndexedDB.bind(this));
+        contextMenu.show(event);
+    },
+
     _createIndexedDBModel: function()
     {
         this._indexedDBModel = new WebInspector.IndexedDBModel();
@@ -1617,6 +1630,24 @@ WebInspector.IDBDatabaseTreeElement.prototype = {
         return "indexedDB://" + this._databaseId.securityOrigin + "/" + this._databaseId.name;
     },
 
+    onattach: function()
+    {
+        WebInspector.BaseStorageTreeElement.prototype.onattach.call(this);
+        this.listItemElement.addEventListener("contextmenu", this._handleContextMenuEvent.bind(this), true);
+    },
+
+    _handleContextMenuEvent: function(event)
+    {
+        var contextMenu = new WebInspector.ContextMenu();
+        contextMenu.appendItem(WebInspector.UIString("Refresh IndexedDB"), this._refreshIndexedDB.bind(this));
+        contextMenu.show(event);
+    },
+
+    _refreshIndexedDB: function(event)
+    {
+        this._model.refreshDatabaseNames();
+    },
+
     /**
      * @param {WebInspector.IndexedDBModel.Database} database
      */
@@ -1640,7 +1671,7 @@ WebInspector.IDBDatabaseTreeElement.prototype = {
                 delete this._idbObjectStoreTreeElements[objectStoreName];
             }
         }
-        
+
         if (this.children.length) {
             this.hasChildren = true;
             this.expand();
@@ -1648,6 +1679,13 @@ WebInspector.IDBDatabaseTreeElement.prototype = {
 
         if (this._view)
             this._view.update(database);
+        
+        this._updateTooltip();
+    },
+
+    _updateTooltip: function()
+    {
+        this.tooltip = WebInspector.UIString("Version") + ": " + this._database.version;
     },
 
     onselect: function()
@@ -1656,7 +1694,7 @@ WebInspector.IDBDatabaseTreeElement.prototype = {
         if (!this._view)
             this._view = new WebInspector.IDBDatabaseView(this._database);
 
-        this._storagePanel.showIndexedDB(this._view);        
+        this._storagePanel.showIndexedDB(this._view);
     }
 }
 
@@ -1708,7 +1746,7 @@ WebInspector.IDBObjectStoreTreeElement.prototype = {
                 delete this._idbIndexTreeElements[indexName];
             }
         }
-        
+
         if (this.children.length) {
             this.hasChildren = true;
             this.expand();
@@ -1716,6 +1754,13 @@ WebInspector.IDBObjectStoreTreeElement.prototype = {
 
         if (this._view)
             this._view.update(this._objectStore);
+        
+        this._updateTooltip();
+    },
+
+    _updateTooltip: function()
+    {
+        this.tooltip = this._objectStore.keyPath ? (WebInspector.UIString("Key path") + ": " + this._objectStore.keyPath) : "";
     },
 
     onselect: function()
@@ -1724,7 +1769,7 @@ WebInspector.IDBObjectStoreTreeElement.prototype = {
         if (!this._view)
             this._view = new WebInspector.IDBDataView(this._model, this._databaseId, this._objectStore, null);
 
-        this._storagePanel.showIndexedDB(this._view);        
+        this._storagePanel.showIndexedDB(this._view);
     }
 }
 
@@ -1760,9 +1805,22 @@ WebInspector.IDBIndexTreeElement.prototype = {
     update: function(index)
     {
         this._index = index;
-        
+
         if (this._view)
             this._view.update(this._index);
+        
+        this._updateTooltip();
+    },
+
+    _updateTooltip: function()
+    {
+        var tooltipLines = [];
+        tooltipLines.push(WebInspector.UIString("Key path") + ": " + this._index.keyPath);
+        if (this._index.unique)
+            tooltipLines.push(WebInspector.UIString("unique"));
+        if (this._index.multiEntry)
+            tooltipLines.push(WebInspector.UIString("multiEntry"));
+        this.tooltip = tooltipLines.join("\n");
     },
 
     onselect: function()
@@ -1771,7 +1829,7 @@ WebInspector.IDBIndexTreeElement.prototype = {
         if (!this._view)
             this._view = new WebInspector.IDBDataView(this._model, this._databaseId, this._objectStore, this._index);
 
-        this._storagePanel.showIndexedDB(this._view);        
+        this._storagePanel.showIndexedDB(this._view);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js b/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
index a359f34ea..c3e80e0a8 100644
--- a/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
@@ -167,10 +167,12 @@ WebInspector.ScopeVariableTreeElement.prototype = {
         var result;
 
         do {
-            if (result)
-                result = current.property.name + "." + result;
-            else
-                result = current.property.name;
+            if (current.property) {
+                if (result)
+                    result = current.property.name + "." + result;
+                else
+                    result = current.property.name;
+            }
             current = current.parent;
         } while (current && !current.root);
 
diff --git a/Source/WebCore/inspector/front-end/ScriptMapping.js b/Source/WebCore/inspector/front-end/ScriptMapping.js
new file mode 100644
index 000000000..771535bf7
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/ScriptMapping.js
@@ -0,0 +1,300 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.ScriptMapping = function()
+{
+}
+
+WebInspector.ScriptMapping.Events = {
+    UISourceCodeListChanged: "us-source-code-list-changed"
+}
+
+WebInspector.ScriptMapping.prototype = {
+    /**
+     * @param {DebuggerAgent.Location} rawLocation
+     * @return {WebInspector.UILocation}
+     */
+    rawLocationToUILocation: function(rawLocation) {},
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
+     */
+    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber) {},
+
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    uiSourceCodeList: function() {}
+}
+
+WebInspector.ScriptMapping.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.MainScriptMapping = function()
+{
+    this._rawSourceCodes = [];
+    this._rawSourceCodeForScriptId = {};
+    this._rawSourceCodeForURL = {};
+    this._rawSourceCodeForDocumentURL = {};
+    this._rawSourceCodeForUISourceCode = new Map();
+    this._formatter = new WebInspector.ScriptFormatter();
+    this._formatSource = false;
+    this._liveLocationsForScriptId = {};
+}
+
+WebInspector.MainScriptMapping.Events = {
+    UISourceCodeListChanged: "us-source-code-list-changed"
+}
+
+WebInspector.MainScriptMapping.prototype = {
+    /**
+     * @param {DebuggerAgent.Location} rawLocation
+     * @return {WebInspector.UILocation}
+     */
+    rawLocationToUILocation: function(rawLocation)
+    {
+        var rawSourceCode = this._rawSourceCodeForScriptId[rawLocation.scriptId];
+        return rawSourceCode.rawLocationToUILocation(rawLocation);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
+     */
+    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
+    {
+        var rawSourceCode = this._rawSourceCodeForUISourceCode.get(uiSourceCode);
+        return rawSourceCode.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
+    },
+
+    /**
+     * @param {DebuggerAgent.Location} rawLocation
+     * @param {function(WebInspector.UILocation)} updateDelegate
+     * @return {WebInspector.LiveLocation}
+     */
+    createLiveLocation: function(rawLocation, updateDelegate)
+    {
+        return new WebInspector.LiveLocation(this, rawLocation, updateDelegate);
+    },
+
+    _registerLiveLocation: function(scriptId, liveLocation)
+    {
+        this._liveLocationsForScriptId[scriptId].push(liveLocation)
+        liveLocation._update();
+    },
+
+    _unregisterLiveLocation: function(scriptId, liveLocation)
+    {
+        this._liveLocationsForScriptId[scriptId].remove(liveLocation);
+    },
+
+    _updateLiveLocations: function(scriptIds)
+    {
+        for (var i = 0; i < scriptIds.length; ++i) {
+            var liveLocations = this._liveLocationsForScriptId[scriptIds[i]];
+            for (var j = 0; j < liveLocations.length; ++j)
+                liveLocations[j]._update();
+        }
+    },
+
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    uiSourceCodeList: function()
+    {
+        var result = [];
+        for (var i = 0; i < this._rawSourceCodes.length; ++i) {
+            var uiSourceCodeList = this._rawSourceCodes[i].uiSourceCodeList();
+            for (var j = 0; j < uiSourceCodeList.length; ++j)
+                result.push(uiSourceCodeList[j]);
+        }
+        return result;
+    },
+
+    /**
+     * @param {WebInspector.Script} script
+     */
+    addScript: function(script)
+    {
+        this._liveLocationsForScriptId[script.scriptId] = [];
+
+        var resource = null;
+        var isInlineScript = false;
+        if (script.isInlineScript()) {
+            resource = WebInspector.networkManager.inflightResourceForURL(script.sourceURL) || WebInspector.resourceForURL(script.sourceURL);
+            if (resource && resource.type === WebInspector.Resource.Type.Document) {
+                isInlineScript = true;
+                var rawSourceCode = this._rawSourceCodeForDocumentURL[script.sourceURL];
+                if (rawSourceCode) {
+                    rawSourceCode.addScript(script);
+                    this._bindScriptToRawSourceCode(script, rawSourceCode);
+                    return;
+                }
+            }
+        }
+
+        var compilerSourceMapping = null;
+        if (WebInspector.settings.sourceMapsEnabled.get() && script.sourceMapURL)
+            compilerSourceMapping = new WebInspector.ClosureCompilerSourceMapping(script.sourceMapURL, script.sourceURL);
+
+        var rawSourceCode = new WebInspector.RawSourceCode(script.scriptId, script, resource, this._formatter, this._formatSource, compilerSourceMapping);
+        this._rawSourceCodes.push(rawSourceCode);
+        this._bindScriptToRawSourceCode(script, rawSourceCode);
+
+        if (isInlineScript)
+            this._rawSourceCodeForDocumentURL[script.sourceURL] = rawSourceCode;
+
+        if (rawSourceCode.uiSourceCodeList().length)
+            this._uiSourceCodeListChanged(rawSourceCode, [], rawSourceCode.uiSourceCodeList());
+        rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.UISourceCodeListChanged, this._handleUISourceCodeListChanged, this);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _handleUISourceCodeListChanged: function(event)
+    {
+        var rawSourceCode = /** @type {WebInspector.RawSourceCode} */ event.target;
+        var oldUISourceCodeList = /** @type {Array.<WebInspector.UISourceCode>} */ event.data["oldUISourceCodeList"];
+        this._uiSourceCodeListChanged(rawSourceCode, oldUISourceCodeList, rawSourceCode.uiSourceCodeList());
+    },
+
+    /**
+     * @param {WebInspector.RawSourceCode} rawSourceCode
+     * @param {Array.<WebInspector.UISourceCode>} removedItems
+     * @param {Array.<WebInspector.UISourceCode>} addedItems
+     */
+    _uiSourceCodeListChanged: function(rawSourceCode, removedItems, addedItems)
+    {
+        for (var i = 0; i < removedItems.length; ++i)
+            this._rawSourceCodeForUISourceCode.remove(removedItems[i]);
+        for (var i = 0; i < addedItems.length; ++i)
+            this._rawSourceCodeForUISourceCode.put(addedItems[i], rawSourceCode);
+        this.dispatchEventToListeners(WebInspector.ScriptMapping.Events.UISourceCodeListChanged, { removedItems: removedItems, addedItems: addedItems });
+
+        var scriptIds = [];
+        for (var i = 0; i < rawSourceCode._scripts.length; ++i)
+            scriptIds.push(rawSourceCode._scripts[i].scriptId);
+        this._updateLiveLocations(scriptIds);
+    },
+
+    /**
+     * @param {WebInspector.Script} script
+     * @param {WebInspector.RawSourceCode} rawSourceCode
+     */
+    _bindScriptToRawSourceCode: function(script, rawSourceCode)
+    {
+        this._rawSourceCodeForScriptId[script.scriptId] = rawSourceCode;
+        this._rawSourceCodeForURL[script.sourceURL] = rawSourceCode;
+    },
+
+    /**
+     * @param {boolean} formatSource
+     */
+    setFormatSource: function(formatSource)
+    {
+        if (this._formatSource === formatSource)
+            return;
+
+        this._formatSource = formatSource;
+        for (var i = 0; i < this._rawSourceCodes.length; ++i)
+            this._rawSourceCodes[i].setFormatted(this._formatSource);
+    },
+
+    /**
+     * @param {DebuggerAgent.Location} rawLocation
+     */
+    forceUpdateSourceMapping: function(rawLocation)
+    {
+        var rawSourceCode = this._rawSourceCodeForScriptId[rawLocation.scriptId];
+        rawSourceCode.forceUpdateSourceMapping();
+    },
+
+    reset: function()
+    {
+        for (var i = 0; i < this._rawSourceCodes.length; ++i) {
+            var rawSourceCode = this._rawSourceCodes[i];
+            this._uiSourceCodeListChanged(rawSourceCode, rawSourceCode.uiSourceCodeList(), []);
+            rawSourceCode.removeAllListeners();
+        }
+        this._rawSourceCodes = [];
+        this._rawSourceCodeForScriptId = {};
+        this._rawSourceCodeForURL = {};
+        this._rawSourceCodeForDocumentURL = {};
+        this._rawSourceCodeForUISourceCode.clear();
+        this._liveLocationsForScriptId = {};
+    }
+}
+
+WebInspector.MainScriptMapping.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @param {WebInspector.MainScriptMapping} scriptMapping
+ * @param {DebuggerAgent.Location} rawLocation
+ * @param {function(WebInspector.UILocation)} updateDelegate
+ */
+WebInspector.LiveLocation = function(scriptMapping, rawLocation, updateDelegate)
+{
+    this._scriptMapping = scriptMapping;
+    this._rawLocation = rawLocation;
+    this._updateDelegate = updateDelegate;
+}
+
+WebInspector.LiveLocation.prototype = {
+    init: function()
+    {
+        this._scriptMapping._registerLiveLocation(this._rawLocation.scriptId, this);
+    },
+
+    dispose: function()
+    {
+        this._scriptMapping._unregisterLiveLocation(this._rawLocation.scriptId, this);
+    },
+
+    _update: function()
+    {
+        var uiLocation = this._scriptMapping.rawLocationToUILocation(this._rawLocation);
+        if (uiLocation)
+            this._updateDelegate(uiLocation);
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index cd93e9ead..881ca3df3 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -35,6 +35,7 @@ WebInspector.ScriptsPanel = function(presentationModel)
     this.registerRequiredCSS("scriptsPanel.css");
 
     WebInspector.settings.pauseOnExceptionStateString = WebInspector.settings.createSetting("pauseOnExceptionStateString", WebInspector.ScriptsPanel.PauseOnExceptionsState.DontPauseOnExceptions);
+    WebInspector.settings.navigatorWasOnceHidden = WebInspector.settings.createSetting("navigatorWasOnceHidden", false);
 
     this._presentationModel = presentationModel;
 
@@ -66,6 +67,7 @@ WebInspector.ScriptsPanel = function(presentationModel)
         const minimalViewsContainerWidthPercent = 50;
         this.editorView = new WebInspector.SplitView(WebInspector.SplitView.SidebarPosition.Left, "scriptsPanelNavigatorSidebarWidth", initialNavigatorWidth);
         this.editorView.element.id = "scripts-editor-view";
+        this.editorView.element.tabIndex = 0;
 
         this.editorView.minimalSidebarWidth = Preferences.minScriptsSidebarWidth;
         this.editorView.minimalMainWidthPercent = minimalViewsContainerWidthPercent;
@@ -292,11 +294,9 @@ WebInspector.ScriptsPanel.prototype = {
 
     _consoleMessagesCleared: function()
     {
-        var uiSourceCodes = this._sourceFramesByUISourceCode;
-        for (var i = 0; i < uiSourceCodes.length; ++i) {
-            var sourceFrame = this._sourceFramesByUISourceCode.get(uiSourceCodes[i])
-            sourceFrame.clearMessages();
-        }
+        var sourceFrames = this._sourceFramesByUISourceCode.values();
+        for (var i = 0; i < sourceFrames.length; ++i)
+            sourceFrames[i].clearMessages();
     },
 
     _consoleMessageAdded: function(event)
@@ -347,9 +347,7 @@ WebInspector.ScriptsPanel.prototype = {
         this._updateDebuggerButtons();
 
         WebInspector.inspectorView.setCurrentPanel(this);
-
         this.sidebarPanes.callstack.update(callFrames);
-        this._updateCallFrame(this._presentationModel.selectedCallFrame);
 
         if (details.reason === WebInspector.DebuggerModel.BreakReason.DOM) {
             this.sidebarPanes.domBreakpoints.highlightBreakpoint(details.auxData);
@@ -606,21 +604,20 @@ WebInspector.ScriptsPanel.prototype = {
     {
         var uiLocation = event.data;
 
-        this._updateExecutionLine(uiLocation);
-    },
-
-    _updateExecutionLine: function(uiLocation)
-    {
         this._clearCurrentExecutionLine();
         if (!uiLocation)
             return;
+        var sourceFrame = this._getOrCreateSourceFrame(uiLocation.uiSourceCode);
+        sourceFrame.setExecutionLine(uiLocation.lineNumber);
+        this._executionSourceFrame = sourceFrame;
+    },
 
+    _revealExecutionLine: function(uiLocation)
+    {
         // Anonymous scripts are not added to files select by default.
         this._addUISourceCode(uiLocation.uiSourceCode);
-
         var sourceFrame = this._showFile(uiLocation.uiSourceCode);
-        sourceFrame.setExecutionLine(uiLocation.lineNumber);
-        this._executionSourceFrame = sourceFrame;
+        sourceFrame.revealLine(uiLocation.lineNumber);
     },
 
     _callFrameSelected: function(event)
@@ -630,19 +627,15 @@ WebInspector.ScriptsPanel.prototype = {
         if (!callFrame)
             return;
 
-        this._updateCallFrame(callFrame);
-    },
-
-    _updateCallFrame: function(callFrame)
-    {
         this.sidebarPanes.scopechain.update(callFrame);
         this.sidebarPanes.watchExpressions.refreshExpressions();
         this.sidebarPanes.callstack.selectedCallFrame = callFrame;
-        this._updateExecutionLine(this._presentationModel.executionLineLocation);
+        callFrame.uiLocation(this._revealExecutionLine.bind(this));
     },
 
     _editorClosed: function(event)
     {
+        this._hideNavigatorOverlay();
         var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
 
         if (this._currentUISourceCode === uiSourceCode)
@@ -657,14 +650,14 @@ WebInspector.ScriptsPanel.prototype = {
 
     _editorSelected: function(event)
     {
+        this._hideNavigatorOverlay();
         var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
         this._showFile(uiSourceCode);
     },
 
     _fileSelected: function(event)
     {
-        if (this._navigatorOverlayShown)
-            this._hideNavigatorOverlay();
+        this._hideNavigatorOverlay();
         var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
         this._showFile(uiSourceCode);
     },
@@ -956,9 +949,14 @@ WebInspector.ScriptsPanel.prototype = {
         return button;
     },
 
+    _escDownWhileNavigatorOverlayOpen: function(event)
+    {
+        this._hideNavigatorOverlay();
+    },
+
     _maybeShowNavigatorOverlay: function()
     {
-        if (this._navigator && WebInspector.settings.navigatorHidden.get() && !this._navigatorWasOnceHidden)
+        if (this._navigator && WebInspector.settings.navigatorHidden.get() && !WebInspector.settings.navigatorWasOnceHidden.get())
             this._showNavigatorOverlay();
     },
 
@@ -1011,15 +1009,15 @@ WebInspector.ScriptsPanel.prototype = {
             return;
 
         this._navigatorOverlayShown = true;
-        var sidebarOverlay = new WebInspector.SidebarOverlay(this._navigatorView, "scriptsPanelNavigatorOverlayWidth", Preferences.minScriptsSidebarWidth);
-        sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WasShown, this._navigatorOverlayWasShown, this);
-        sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WillHide, this._navigatorOverlayWillHide, this);
+        this._sidebarOverlay = new WebInspector.SidebarOverlay(this._navigatorView, "scriptsPanelNavigatorOverlayWidth", Preferences.minScriptsSidebarWidth);
+        this._sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WasShown, this._navigatorOverlayWasShown, this);
+        this._sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WillHide, this._navigatorOverlayWillHide, this);
 
         var navigatorOverlayResizeWidgetElement = document.createElement("div");
         navigatorOverlayResizeWidgetElement.addStyleClass("scripts-navigator-resizer-widget");
-        sidebarOverlay.resizerWidgetElement = navigatorOverlayResizeWidgetElement;
+        this._sidebarOverlay.resizerWidgetElement = navigatorOverlayResizeWidgetElement;
 
-        sidebarOverlay.start(this.editorView.element);
+        this._sidebarOverlay.show(this.editorView.element);
     },
 
     _hideNavigatorOverlay: function()
@@ -1027,7 +1025,7 @@ WebInspector.ScriptsPanel.prototype = {
         if (!this._navigatorOverlayShown)
             return;
 
-        WebInspector.Dialog.hide();
+        this._sidebarOverlay.hide();
     },
 
     _navigatorOverlayWasShown: function(event)
@@ -1036,15 +1034,17 @@ WebInspector.ScriptsPanel.prototype = {
         this._navigatorShowHideButton.addStyleClass("toggled-on");
         this._navigatorShowHideButton.title = WebInspector.UIString("Hide scripts navigator");
         this._navigator.focus();
+        this.registerShortcut(WebInspector.KeyboardShortcut.Keys.Esc.code, this._escDownWhileNavigatorOverlayOpen.bind(this));
     },
 
     _navigatorOverlayWillHide: function(event)
     {
         delete this._navigatorOverlayShown;
-        this._navigatorWasOnceHidden = true;
+        WebInspector.settings.navigatorWasOnceHidden.set(true);
         this.editorView.element.appendChild(this._navigatorShowHideButton);
         this._navigatorShowHideButton.removeStyleClass("toggled-on");
         this._navigatorShowHideButton.title = WebInspector.UIString("Show scripts navigator");
+        this.unregisterShortcut(WebInspector.KeyboardShortcut.Keys.Esc.code);
     },
 
     _createButtonAndRegisterShortcuts: function(buttonId, buttonTitle, handler, shortcuts, shortcutDescription)
diff --git a/Source/WebCore/inspector/front-end/ScriptsSearchScope.js b/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
index 094a8899a..92182416e 100644
--- a/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
+++ b/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
@@ -144,11 +144,9 @@ WebInspector.ScriptsSearchResultsPane.prototype = {
      */
     createAnchor: function(file, lineNumber, columnNumber)
     {
-        
-        var uiSourceCode = file;
-        var rawSourceCode = uiSourceCode.rawSourceCode;
-        var rawLocation = rawSourceCode.sourceMapping.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
-        var anchor = this._linkifier.linkifyRawSourceCode(uiSourceCode.rawSourceCode, rawLocation.lineNumber, rawLocation.columnNumber);
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ file;
+        var rawLocation = WebInspector.debuggerPresentationModel.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
+        var anchor = this._linkifier.linkifyRawLocation(rawLocation);
         anchor.removeChildren();
         return anchor;
     },
@@ -176,10 +174,10 @@ WebInspector.ScriptsSearchResultsPane.LinkifierFormatter = function()
 
 WebInspector.ScriptsSearchResultsPane.LinkifierFormatter.prototype = {
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
      * @param {Element} anchor
+     * @param {WebInspector.UILocation} uiLocation
      */
-    formatRawSourceCodeAnchor: function(rawSourceCode, anchor)
+    formatLiveAnchor: function(anchor, uiLocation)
     {
         // Empty because we don't want to ever update anchor contents after creation.
     }
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index fba3c0f25..867383945 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -90,11 +90,12 @@ WebInspector.Settings = function()
     this.dockToRight = this.createSetting("dockToRight", false);
     this.emulateTouchEvents = this.createSetting("emulateTouchEvents", false);
     this.showPaintRects = this.createSetting("showPaintRects", false);
+    this.zoomLevel = this.createSetting("zoomLevel", 0);
 
     // If there are too many breakpoints in a storage, it is likely due to a recent bug that caused
     // periodical breakpoints duplication leading to inspector slowness.
-    if (window.localStorage.breakpoints && window.localStorage.breakpoints.length > 500000)
-        delete window.localStorage.breakpoints;
+    if (this.breakpoints.get().length > 500000)
+        this.breakpoints.set([]);
 }
 
 WebInspector.Settings.prototype = {
@@ -174,11 +175,11 @@ WebInspector.ExperimentsSettings = function()
     
     // Add currently running experiments here.
     this.sourceFrameAlwaysEditable = this._createExperiment("sourceFrameAlwaysEditable", "Make resources always editable");
-    this.showMemoryCounters = this._createExperiment("showMemoryCounters", "Show memory counters in Timeline panel");
-    this.timelineStartAtZero = this._createExperiment("timelineStartAtZero", "Enable start at zero mode in Timeline panel");
+    this.timelineVerticalOverview = this._createExperiment("timelineStartAtZero", "Enable vertical overview mode in the Timeline panel");
     // FIXME: Enable http/tests/inspector/indexeddb/resources-panel.html when removed from experiments.
     this.showIndexedDB = this._createExperiment("showIndexedDB", "Show IndexedDB in Resources panel");
     this.debugCSS = this._createExperiment("debugCSS", "Load CSS via link tags for debugging");
+    this.showShadowDOM = this._createExperiment("showShadowDOM", "Show shadow DOM");
 
     this._cleanUpSetting();
 }
diff --git a/Source/WebCore/inspector/front-end/SidebarOverlay.js b/Source/WebCore/inspector/front-end/SidebarOverlay.js
index 17c93e5c8..246788ed2 100644
--- a/Source/WebCore/inspector/front-end/SidebarOverlay.js
+++ b/Source/WebCore/inspector/front-end/SidebarOverlay.js
@@ -30,15 +30,18 @@
 
 /**
  * @constructor
- * @extends {WebInspector.DialogDelegate}
+ * @extends {WebInspector.Object}
  * @param {WebInspector.View} view
  * @param {string} widthSettingName
  * @param {number} minimalWidth
  */
 WebInspector.SidebarOverlay = function(view, widthSettingName, minimalWidth)
 {
-    WebInspector.DialogDelegate.call(this);
+    WebInspector.Object.call(this);
     
+    this.element = document.createElement("div");
+    this.element.className = "sidebar-overlay";
+
     this._view = view;
     this._widthSettingName = widthSettingName;
     this._minimalWidth = minimalWidth;
@@ -59,34 +62,36 @@ WebInspector.SidebarOverlay.EventTypes = {
 
 WebInspector.SidebarOverlay.prototype = {
     /**
-     * @param {Element} element
+     * @param {Element} relativeToElement
      */
-    show: function(element)
+    show: function(relativeToElement)
     {
-        this._element = element;
-        element.addStyleClass("sidebar-overlay-dialog");
-        this._view.markAsRoot();
-        this._view.show(element);
-        this._element.appendChild(this._resizerElement);
+        relativeToElement.appendChild(this.element);
+        relativeToElement.addStyleClass("sidebar-overlay-shown");
+        this._view.show(this.element);
+        this.element.appendChild(this._resizerElement);
         if (this._resizerWidgetElement)
-            this._element.appendChild(this._resizerWidgetElement);
-
+            this.element.appendChild(this._resizerWidgetElement);
+        this.position(relativeToElement);
+        this._boundContainingElementFocused = this._containingElementFocused.bind(this);
+        relativeToElement.addEventListener("DOMFocusIn", this._boundContainingElementFocused, false);
+        
         this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WasShown, null);
     },
 
+    _containingElementFocused: function(event)
+    {
+        if (!event.target.isSelfOrDescendant(this.element))
+            this.hide();
+    },
+
     /**
-     * @param {Element} element
      * @param {Element} relativeToElement
      */
-    position: function(element, relativeToElement)
+    position: function(relativeToElement)
     {
         this._totalWidth = relativeToElement.offsetWidth;
-        
-        var offset = relativeToElement.offsetRelativeToWindow(window);
-        element.style.left = offset.x + "px";
-        element.style.top = offset.y + "px";
         this._setWidth(this._preferredWidth());
-        element.style.height = relativeToElement.offsetHeight + "px";
     },
 
     focus: function()
@@ -94,17 +99,21 @@ WebInspector.SidebarOverlay.prototype = {
         WebInspector.setCurrentFocusElement(this._view.element);
     },
 
-    willHide: function() {
-        this._view.detach();
-        this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WillHide, null);
-    },
-    
-    /**
-     * @param {Element} relativeToElement
-     */
-    start: function(relativeToElement)
+    hide: function()
     {
-        WebInspector.Dialog.show(relativeToElement, this);
+        var element = this.element.parentElement;
+        if (!element)
+            return;
+
+        this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WillHide, null);
+        
+        this._view.detach();
+        element.removeChild(this.element);
+        element.removeStyleClass("sidebar-overlay-shown");
+        this.element.removeChild(this._resizerElement);
+        if (this._resizerWidgetElement)
+            this.element.removeChild(this._resizerWidgetElement);
+        element.removeEventListener("DOMFocusIn", this._boundContainingElementFocused, false);
     },
     
     /**
@@ -117,7 +126,7 @@ WebInspector.SidebarOverlay.prototype = {
         if (this._width === width)
             return;
 
-        this._element.style.width = width + "px";
+        this.element.style.width = width + "px";
         this._resizerElement.style.left = (width - 3) + "px";
         this._width = width;
         this._view.doResize();
@@ -191,4 +200,4 @@ WebInspector.SidebarOverlay.prototype = {
     }
 }
 
-WebInspector.SidebarOverlay.prototype.__proto__ = WebInspector.DialogDelegate.prototype;
+WebInspector.SidebarOverlay.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/SourceFrame.js b/Source/WebCore/inspector/front-end/SourceFrame.js
index f66f67b63..9e225aefe 100644
--- a/Source/WebCore/inspector/front-end/SourceFrame.js
+++ b/Source/WebCore/inspector/front-end/SourceFrame.js
@@ -97,6 +97,8 @@ WebInspector.SourceFrame.prototype = {
             this._textViewer.freeCachedElements();
 
         this._clearLineHighlight();
+        this._clearLineToReveal();
+        
         if (!this._textViewer.readOnly)
             this._wasHiddenWhileEditing = true;
         this.setReadOnly(true);
@@ -185,6 +187,7 @@ WebInspector.SourceFrame.prototype = {
 
     highlightLine: function(line)
     {
+        this._clearLineToReveal();
         if (this.loaded)
             this._textViewer.highlightLine(line);
         else
@@ -199,6 +202,20 @@ WebInspector.SourceFrame.prototype = {
             delete this._lineToHighlight;
     },
 
+    revealLine: function(line)
+    {
+        this._clearLineHighlight();
+        if (this.loaded)
+            this._textViewer.revealLine(line);
+        else
+            this._lineToReveal = line;
+    },
+
+    _clearLineToReveal: function()
+    {
+        delete this._lineToReveal;
+    },
+
     _saveViewerState: function()
     {
         this._viewerState = {
@@ -250,6 +267,11 @@ WebInspector.SourceFrame.prototype = {
             delete this._lineToHighlight;
         }
 
+        if (typeof this._lineToReveal === "number") {
+            this.revealLine(this._lineToReveal);
+            delete this._lineToReveal;
+        }
+
         if (this._delayedFindSearchMatches) {
             this._delayedFindSearchMatches();
             delete this._delayedFindSearchMatches;
diff --git a/Source/WebCore/inspector/front-end/Spectrum.js b/Source/WebCore/inspector/front-end/Spectrum.js
index 3f9a58e44..550c8f009 100644
--- a/Source/WebCore/inspector/front-end/Spectrum.js
+++ b/Source/WebCore/inspector/front-end/Spectrum.js
@@ -38,6 +38,8 @@ WebInspector.Spectrum = function()
 
     this._containerElement = document.createElement('div');
     this._containerElement.className = "spectrum-container";
+    this._containerElement.tabIndex = 0;
+    this._containerElement.addEventListener("keydown", this._onKeyDown.bind(this), false);
 
     var topElement = this._containerElement.createChild("div", "spectrum-top");
     topElement.createChild("div", "spectrum-fill");
@@ -405,11 +407,16 @@ WebInspector.Spectrum.prototype = {
 
     reposition: function(element)
     {
+        if (!this._previousFocusElement)
+            this._previousFocusElement = WebInspector.currentFocusElement();
         this._popover.show(this._containerElement, element);
+        WebInspector.markBeingEdited(this._containerElement, true);    
+        WebInspector.setCurrentFocusElement(this._containerElement);
     },
 
     hide: function()
     {
+        WebInspector.markBeingEdited(this._containerElement, false);
         this._popover.hide();
 
         document.removeEventListener("mousedown", this._hideProxy, false);
@@ -417,8 +424,20 @@ WebInspector.Spectrum.prototype = {
 
         this.dispatchEventToListeners(WebInspector.Spectrum.Events.Hidden);
 
+        WebInspector.setCurrentFocusElement(this._previousFocusElement);
+        delete this._previousFocusElement;
+
         delete this.anchorElement;
+    },
+
+    _onKeyDown: function(event)
+    {
+        if (event.keyIdentifier === "Enter" || event.keyIdentifier === "U+001B") { // Escape key
+            this.hide();
+            event.stopPropagation();
+            event.preventDefault();
+        }
     }
-};
+}
 
 WebInspector.Spectrum.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/StylesSidebarPane.js b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
index dd273ae99..f76e1d63f 100644
--- a/Source/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -189,7 +189,17 @@ WebInspector.StylesSidebarPane.alteredHexNumber = function(hexString, event)
     for (var i = 0, lengthDelta = hexString.length - resultString.length; i < lengthDelta; ++i)
         resultString = "0" + resultString;
     return resultString;
-},
+}
+
+WebInspector.StylesSidebarPane.canonicalPropertyName = function(name)
+{
+    if (!name || name.length < 9 || name.charAt(0) !== "-")
+        return name;
+    var match = name.match(/(?:-webkit-|-khtml-|-apple-)(.+)/);
+    if (!match)
+        return name;
+    return match[1];
+}
 
 WebInspector.StylesSidebarPane.prototype = {
     _contextMenuEventFired: function(event)
@@ -563,26 +573,26 @@ WebInspector.StylesSidebarPane.prototype = {
                 var property = allProperties[j];
                 if (!property.isLive || !property.parsedOk)
                     continue;
-                var name = property.name;
+                var canonicalName = WebInspector.StylesSidebarPane.canonicalPropertyName(property.name);
 
                 if (!priorityUsed && property.priority.length)
                     priorityUsed = true;
 
                 // If the property name is already used by another rule then this rule's
                 // property is overloaded, so don't add it to the rule's usedProperties.
-                if (!(name in usedProperties))
-                    styleRule.usedProperties[name] = true;
+                if (!(canonicalName in usedProperties))
+                    styleRule.usedProperties[canonicalName] = true;
             }
 
             // Add all the properties found in this style to the used properties list.
             // Do this here so only future rules are affect by properties used in this rule.
-            for (var name in styleRules[i].usedProperties)
-                usedProperties[name] = true;
+            for (var canonicalName in styleRules[i].usedProperties)
+                usedProperties[canonicalName] = true;
         }
 
         if (priorityUsed) {
             // Walk the properties again and account for !important.
-            var foundPriorityProperties = [];
+            var foundPriorityProperties = {};
 
             // Walk in direct order to detect the active/most specific rule providing a priority
             // (in this case all subsequent !important values get canceled.)
@@ -596,15 +606,15 @@ WebInspector.StylesSidebarPane.prototype = {
                     var property = allProperties[j];
                     if (!property.isLive)
                         continue;
-                    var name = property.name;
+                    var canonicalName = WebInspector.StylesSidebarPane.canonicalPropertyName(property.name);
                     if (property.priority.length) {
-                        if (!(name in foundPriorityProperties))
-                            styleRules[i].usedProperties[name] = true;
+                        if (!(canonicalName in foundPriorityProperties))
+                            styleRules[i].usedProperties[canonicalName] = true;
                         else
-                            delete styleRules[i].usedProperties[name];
-                        foundPriorityProperties[name] = true;
-                    } else if (name in foundPriorityProperties)
-                        delete styleRules[i].usedProperties[name];
+                            delete styleRules[i].usedProperties[canonicalName];
+                        foundPriorityProperties[canonicalName] = true;
+                    } else if (canonicalName in foundPriorityProperties)
+                        delete styleRules[i].usedProperties[canonicalName];
                 }
             }
         }
@@ -967,6 +977,8 @@ WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable,
     var openBrace = document.createElement("span");
     openBrace.textContent = " {";
     selectorContainer.appendChild(openBrace);
+    selectorContainer.addEventListener("mousedown", this._handleEmptySpaceMouseDown.bind(this), false);
+    selectorContainer.addEventListener("click", this._handleSelectorContainerClick.bind(this), false);
 
     var closeBrace = document.createElement("div");
     closeBrace.textContent = "}";
@@ -996,6 +1008,7 @@ WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable,
     this._selectorRefElement.appendChild(this._createRuleOriginNode());
     selectorContainer.insertBefore(this._selectorRefElement, selectorContainer.firstChild);
     this.titleElement.appendChild(selectorContainer);
+    this._selectorContainer = selectorContainer;
 
     if (isInherited)
         this.element.addStyleClass("show-inherited"); // This one is related to inherited rules, not compted style.
@@ -1030,7 +1043,8 @@ WebInspector.StylePropertiesSection.prototype = {
             return false;
         }
 
-        var used = (propertyName in this._usedProperties);
+        var canonicalName = WebInspector.StylesSidebarPane.canonicalPropertyName(propertyName);
+        var used = (canonicalName in this._usedProperties);
         if (used || !shorthand)
             return !used;
 
@@ -1039,7 +1053,7 @@ WebInspector.StylePropertiesSection.prototype = {
         var longhandProperties = this.styleRule.style.getLonghandProperties(propertyName);
         for (var j = 0; j < longhandProperties.length; ++j) {
             var individualProperty = longhandProperties[j];
-            if (individualProperty.name in this._usedProperties)
+            if (WebInspector.StylesSidebarPane.canonicalPropertyName(individualProperty.name) in this._usedProperties)
                 return false;
         }
 
@@ -1162,15 +1176,31 @@ WebInspector.StylePropertiesSection.prototype = {
         return null;
     },
 
+    _checkWillCancelEditing: function()
+    {
+        var willCauseCancelEditing = this._willCauseCancelEditing;
+        delete this._willCauseCancelEditing;
+        return willCauseCancelEditing;
+    },
+
+    _handleSelectorContainerClick: function(event)
+    {
+        if (this._checkWillCancelEditing())
+            return;
+        if (event.target === this._selectorContainer)
+            this.addNewBlankProperty(0).startEditing();
+    },
+
     /**
-     * @param {number=} optionalIndex
+     * @param {number=} index
      */
-    addNewBlankProperty: function(optionalIndex)
+    addNewBlankProperty: function(index)
     {
         var style = this.styleRule.style;
-        var property = style.newBlankProperty();
+        var property = style.newBlankProperty(index);
         var item = new WebInspector.StylePropertyTreeElement(this, this._parentPane, this.styleRule, style, property, false, false, false);
-        this.propertiesTreeOutline.appendChild(item);
+        index = property.index;
+        this.propertiesTreeOutline.insertChild(item, index);
         item.listItemElement.textContent = "";
         item._newProperty = true;
         item.updateTitle();
@@ -1210,9 +1240,7 @@ WebInspector.StylePropertiesSection.prototype = {
 
     _handleEmptySpaceClick: function(event)
     {
-        var willCauseCancelEditing = this._willCauseCancelEditing;
-        delete this._willCauseCancelEditing;
-        if (willCauseCancelEditing)
+        if (this._checkWillCancelEditing())
             return;
 
         if (event.target.hasStyleClass("header") || this.element.hasStyleClass("read-only") || event.target.enclosingNodeOrSelfWithClass("media")) {
@@ -1609,14 +1637,16 @@ WebInspector.StylePropertyTreeElement.prototype = {
         this.updateTitle();
         this.listItemElement.addEventListener("mousedown", this._mouseDown.bind(this));
         this.listItemElement.addEventListener("mouseup", this._resetMouseDownElement.bind(this));
-        this.listItemElement.addEventListener("click", this._startEditing.bind(this));
+        this.listItemElement.addEventListener("click", this._mouseClick.bind(this));
     },
 
     _mouseDown: function(event)
     {
-        this._parentPane._mouseDownTreeElement = this;
-        this._parentPane._mouseDownTreeElementIsName = this._isNameElement(event.target);
-        this._parentPane._mouseDownTreeElementIsValue = this._isValueElement(event.target);
+        if (this._parentPane) {
+            this._parentPane._mouseDownTreeElement = this;
+            this._parentPane._mouseDownTreeElementIsName = this._isNameElement(event.target);
+            this._parentPane._mouseDownTreeElementIsValue = this._isValueElement(event.target);
+        }
     },
 
     _resetMouseDownElement: function()
@@ -1992,11 +2022,19 @@ WebInspector.StylePropertyTreeElement.prototype = {
         this.listItemElement.insertBefore(this.nameElement, this.listItemElement.firstChild);
     },
 
-    _startEditing: function(event)
+    _mouseClick: function(event)
     {
-        this.startEditing(event.target);
         event.stopPropagation();
         event.preventDefault();
+
+        if (event.target === this.listItemElement) {
+            if (this.section._checkWillCancelEditing())
+                return;
+            this.section.addNewBlankProperty(this.property.index + 1).startEditing();
+            return;
+        }
+
+        this.startEditing(event.target);
     },
 
     _isNameElement: function(element)
@@ -2233,6 +2271,16 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
     },
 
+    _findSibling: function(moveDirection)
+    {
+        var target = this;
+        do {
+            target = (moveDirection === "forward" ? target.nextSibling : target.previousSibling);
+        } while(target && target.inherited);
+
+        return target;
+    },
+
     editingCommitted: function(element, userInput, previousContent, context, moveDirection)
     {
         this._removePrompt();
@@ -2245,10 +2293,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         var moveToOther = (isEditingName ^ (moveDirection === "forward"));
         var abandonNewProperty = this._newProperty && !userInput && (moveToOther || isEditingName);
         if (moveDirection === "forward" && !isEditingName || moveDirection === "backward" && isEditingName) {
-            do {
-                moveTo = (moveDirection === "forward" ? moveTo.nextSibling : moveTo.previousSibling);
-            } while(moveTo && moveTo.inherited);
-
+            moveTo = moveTo._findSibling(moveDirection);
             if (moveTo)
                 moveToPropertyName = moveTo.name;
             else if (moveDirection === "forward" && (!this._newProperty || userInput))
@@ -2258,6 +2303,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
 
         // Make the Changes and trigger the moveToNextCallback after updating.
+        var moveToIndex = moveTo && this.treeOutline ? this.treeOutline.children.indexOf(moveTo) : -1;
         var blankInput = /^\s*$/.test(userInput);
         var isDataPasted = "originalName" in context;
         var isDirtyViaPaste = isDataPasted && (this.nameElement.textContent !== context.originalName || this.valueElement.textContent !== context.originalValue);
@@ -2280,8 +2326,6 @@ WebInspector.StylePropertyTreeElement.prototype = {
             moveToNextCallback.call(this, this._newProperty, false, this.treeOutline.section);
         }
 
-        var moveToIndex = moveTo && this.treeOutline ? this.treeOutline.children.indexOf(moveTo) : -1;
-
         // The Callback to start editing the next/previous property/selector.
         function moveToNextCallback(alreadyNew, valueChanged, section)
         {
@@ -2305,7 +2349,10 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 else {
                     var treeElement = moveToIndex >= 0 ? propertyElements[moveToIndex] : null;
                     if (treeElement) {
-                        treeElement.startEditing(!isEditingName ? treeElement.nameElement : treeElement.valueElement);
+                        var elementToEdit = !isEditingName ? treeElement.nameElement : treeElement.valueElement;
+                        if (alreadyNew && blankInput)
+                            elementToEdit = moveDirection === "forward" ? treeElement.nameElement : treeElement.valueElement;
+                        treeElement.startEditing(elementToEdit);
                         return;
                     } else if (!alreadyNew)
                         moveToSelector = true;
@@ -2322,7 +2369,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
             }
 
             if (abandonNewProperty) {
-                var sectionToEdit = moveDirection === "backward" ? section : section.nextEditableSibling();
+                moveTo = this._findSibling(moveDirection);
+                var sectionToEdit = (moveTo || moveDirection === "backward") ? section : section.nextEditableSibling();
                 if (sectionToEdit) {
                     if (sectionToEdit.rule)
                         sectionToEdit.startEditingSelector();
@@ -2401,6 +2449,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 return;
             }
 
+            if (this._newProperty)
+                this._newPropertyInStyle = true;
             this.style = newStyle;
             this.property = newStyle.propertyAt(this.property.index);
             this._styleRule.style = this.style;
@@ -2420,7 +2470,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
         // FIXME: this does not handle trailing comments.
         if (styleText.length && !/;\s*$/.test(styleText))
             styleText += ";";
-        this.property.setText(styleText, majorChange, callback.bind(this, userOperationFinishedCallback.bind(null, this._parentPane, updateInterface), this.originalPropertyText));
+        var overwriteProperty = !!(!this._newProperty || this._newPropertyInStyle);
+        this.property.setText(styleText, majorChange, overwriteProperty, callback.bind(this, userOperationFinishedCallback.bind(null, this._parentPane, updateInterface), this.originalPropertyText));
     },
 
     ondblclick: function()
@@ -2555,7 +2606,7 @@ WebInspector.StylesSidebarPane.CSSPropertyPrompt.prototype = {
         return false;
     },
 
-    _buildPropertyCompletions: function(wordRange, force, completionsReadyCallback)
+    _buildPropertyCompletions: function(textPrompt, wordRange, force, completionsReadyCallback)
     {
         var prefix = wordRange.toString().toLowerCase();
         if (!prefix && !force)
diff --git a/Source/WebCore/inspector/front-end/TabbedPane.js b/Source/WebCore/inspector/front-end/TabbedPane.js
index 4b24e880d..a2a390d3b 100644
--- a/Source/WebCore/inspector/front-end/TabbedPane.js
+++ b/Source/WebCore/inspector/front-end/TabbedPane.js
@@ -114,11 +114,9 @@ WebInspector.TabbedPane.prototype = {
     closeTab: function(id, userGesture)
     {
         this._innerCloseTab(id, userGesture);
-
+        this._updateTabElements();
         if (this._tabsHistory.length)
             this.selectTab(this._tabsHistory[0].id, userGesture);
-        else
-            this._updateTabElements();
     },
 
     /**
@@ -596,9 +594,7 @@ WebInspector.TabbedPaneTab.prototype = {
             tabElement.addStyleClass("measuring");
         else {
             this._tabElement = tabElement;
-            tabElement.addEventListener("click", this._tabSelected.bind(this), false);
-            if (this._closeable)
-                closeButtonSpan.addEventListener("click", this._tabClosed.bind(this), false);
+            tabElement.addEventListener("click", this._tabClicked.bind(this), false);
         }
         
         return tabElement;
@@ -612,13 +608,14 @@ WebInspector.TabbedPaneTab.prototype = {
         this._measureElement.removeChild(measuringTabElement);
     },
 
-    _tabSelected: function()
-    {
-        this._tabbedPane.selectTab(this.id, true);        
-    },
-
-    _tabClosed: function()
+    /**
+     * @param {Event} event
+     */
+    _tabClicked: function(event)
     {
-        this._tabbedPane.closeTab(this.id, true);        
+        if (this._closeable && (event.button === 1 || event.target.hasStyleClass("tabbed-pane-header-tab-close-button")))
+            this._tabbedPane.closeTab(this.id, true);
+        else
+            this._tabbedPane.selectTab(this.id, true);
     }
-}
\ No newline at end of file
+}
diff --git a/Source/WebCore/inspector/front-end/TextPrompt.js b/Source/WebCore/inspector/front-end/TextPrompt.js
index 3c43f690d..13efa331c 100644
--- a/Source/WebCore/inspector/front-end/TextPrompt.js
+++ b/Source/WebCore/inspector/front-end/TextPrompt.js
@@ -30,7 +30,7 @@
 /**
  * @constructor
  * @extends WebInspector.Object
- * @param {function(Range, boolean, function(Array.<string>=))} completions
+ * @param {function(WebInspector.TextPrompt, Range, boolean, function(Array.<string>=))} completions
  * @param {string} stopCharacters
  */
 WebInspector.TextPrompt = function(completions, stopCharacters)
@@ -383,7 +383,7 @@ WebInspector.TextPrompt.prototype = {
         }
 
         var wordPrefixRange = selectionRange.startContainer.rangeOfWord(selectionRange.startOffset, this._completionStopCharacters, this._element, "backward");
-        this._loadCompletions(wordPrefixRange, force, this._completionsReady.bind(this, selection, auto, wordPrefixRange, !!reverse));
+        this._loadCompletions(this, wordPrefixRange, force, this._completionsReady.bind(this, selection, auto, wordPrefixRange, !!reverse));
     },
 
     _boxForAnchorAtStart: function(selection, textRange)
@@ -748,7 +748,7 @@ WebInspector.TextPrompt.prototype.__proto__ = WebInspector.Object.prototype;
 /**
  * @constructor
  * @extends {WebInspector.TextPrompt}
- * @param {function(Range, boolean, function(Array.<string>=))} completions
+ * @param {function(WebInspector.TextPrompt, Range, boolean, function(Array.<string>=))} completions
  * @param {string} stopCharacters
  */
 WebInspector.TextPromptWithHistory = function(completions, stopCharacters)
diff --git a/Source/WebCore/inspector/front-end/TimelineAgent.js b/Source/WebCore/inspector/front-end/TimelineAgent.js
deleted file mode 100644
index 46ad7eae0..000000000
--- a/Source/WebCore/inspector/front-end/TimelineAgent.js
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * @constructor
- */
-WebInspector.TimelineAgent = function() {
-    // Not implemented.
-}
-
-// Must be kept in sync with InspectorTimelineAgent.h
-WebInspector.TimelineAgent.RecordType = {
-    EventDispatch: "EventDispatch",
-    Layout: "Layout",
-    RecalculateStyles: "RecalculateStyles",
-    Paint: "Paint",
-    ParseHTML: "ParseHTML",
-
-
-    TimerInstall: "TimerInstall",
-    TimerRemove: "TimerRemove",
-    TimerFire: "TimerFire",
-
-    XHRReadyStateChange: "XHRReadyStateChange",
-    XHRLoad: "XHRLoad",
-    EvaluateScript: "EvaluateScript",
-
-    TimeStamp: "TimeStamp",
-
-    MarkLoad: "MarkLoad",
-    MarkDOMContent: "MarkDOMContent",
-
-    ScheduleResourceRequest: "ScheduleResourceRequest",
-    ResourceSendRequest: "ResourceSendRequest",
-    ResourceReceiveResponse: "ResourceReceiveResponse",
-    ResourceReceivedData: "ResourceReceivedData",
-    ResourceFinish: "ResourceFinish",
-
-    FunctionCall: "FunctionCall",
-    GCEvent: "GCEvent",
-
-    RequestAnimationFrame: "RequestAnimationFrame",
-    CancelAnimationFrame: "CancelAnimationFrame",
-    FireAnimationFrame: "FireAnimationFrame"
-}
diff --git a/Source/WebCore/inspector/front-end/TimelineGrid.js b/Source/WebCore/inspector/front-end/TimelineGrid.js
index 5b7f323d6..eff40fee9 100644
--- a/Source/WebCore/inspector/front-end/TimelineGrid.js
+++ b/Source/WebCore/inspector/front-end/TimelineGrid.js
@@ -58,6 +58,11 @@ WebInspector.TimelineGrid.prototype = {
         return this._itemsGraphsElement;
     },
 
+    get dividersElement()
+    {
+        return this._dividersElement;
+    },
+
     /**
      * @param {number=} paddingLeft
      */
@@ -76,8 +81,8 @@ WebInspector.TimelineGrid.prototype = {
         var divider = this._dividersElement.firstChild;
         var dividerLabelBar = this._dividersLabelBarElement.firstChild;
 
-        var dividersLabelBarElementClientWidth = this._dividersLabelBarElement.clientWidth;
-        var clientWidth = dividersLabelBarElementClientWidth - paddingLeft;
+        var dividersElementClientWidth = this._dividersElement.clientWidth;
+        var clientWidth = dividersElementClientWidth - paddingLeft;
         for (var i = paddingLeft ? 0 : 1; i <= dividerCount; ++i) {
             if (!divider) {
                 divider = document.createElement("div");
@@ -91,7 +96,6 @@ WebInspector.TimelineGrid.prototype = {
                 dividerLabelBar._labelElement = label;
                 dividerLabelBar.appendChild(label);
                 this._dividersLabelBarElement.appendChild(dividerLabelBar);
-                dividersLabelBarElementClientWidth = this._dividersLabelBarElement.clientWidth;
             }
 
             if (i === (paddingLeft ? 0 : 1)) {
@@ -111,11 +115,11 @@ WebInspector.TimelineGrid.prototype = {
             }
 
             var left = paddingLeft + clientWidth * (i / dividerCount);
-            var percentLeft = 100 * left / dividersLabelBarElementClientWidth;
+            var percentLeft = 100 * left / dividersElementClientWidth;
             this._setDividerAndBarLeft(divider, dividerLabelBar, percentLeft);
 
             if (!isNaN(slice))
-                dividerLabelBar._labelElement.textContent = calculator.formatValue(slice * i);
+                dividerLabelBar._labelElement.textContent = calculator.formatTime(slice * i);
             else
                 dividerLabelBar._labelElement.textContent = "";
 
diff --git a/Source/WebCore/inspector/front-end/TimelineModel.js b/Source/WebCore/inspector/front-end/TimelineModel.js
new file mode 100644
index 000000000..815fe7a83
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/TimelineModel.js
@@ -0,0 +1,181 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.TimelineModel = function()
+{
+    this._records = [];
+    this._collectionEnabled = false;
+
+    WebInspector.timelineManager.addEventListener(WebInspector.TimelineManager.EventTypes.TimelineEventRecorded, this._onRecordAdded, this);
+}
+
+WebInspector.TimelineModel.RecordType = {
+    Root: "Root",
+    EventDispatch: "EventDispatch",
+
+    BeginFrame: "BeginFrame",
+    Layout: "Layout",
+    RecalculateStyles: "RecalculateStyles",
+    Paint: "Paint",
+
+    ParseHTML: "ParseHTML",
+
+    TimerInstall: "TimerInstall",
+    TimerRemove: "TimerRemove",
+    TimerFire: "TimerFire",
+
+    XHRReadyStateChange: "XHRReadyStateChange",
+    XHRLoad: "XHRLoad",
+    EvaluateScript: "EvaluateScript",
+
+    TimeStamp: "TimeStamp",
+
+    MarkLoad: "MarkLoad",
+    MarkDOMContent: "MarkDOMContent",
+
+    ScheduleResourceRequest: "ScheduleResourceRequest",
+    ResourceSendRequest: "ResourceSendRequest",
+    ResourceReceiveResponse: "ResourceReceiveResponse",
+    ResourceReceivedData: "ResourceReceivedData",
+    ResourceFinish: "ResourceFinish",
+
+    FunctionCall: "FunctionCall",
+    GCEvent: "GCEvent",
+
+    RequestAnimationFrame: "RequestAnimationFrame",
+    CancelAnimationFrame: "CancelAnimationFrame",
+    FireAnimationFrame: "FireAnimationFrame"
+}
+
+WebInspector.TimelineModel.Events = {
+    RecordAdded: "RecordAdded",
+    RecordsCleared: "RecordsCleared"
+}
+
+WebInspector.TimelineModel.prototype = {
+    startRecord: function()
+    {
+        if (this._collectionEnabled)
+            return;
+        this.reset();
+        WebInspector.timelineManager.start(30);
+        this._collectionEnabled = true;
+    },
+
+    stopRecord: function()
+    {
+        if (!this._collectionEnabled)
+            return;
+        WebInspector.timelineManager.stop();
+        this._collectionEnabled = false;
+    },
+
+    get records()
+    {
+        return this._records;
+    },
+
+    _onRecordAdded: function(event)
+    {
+        if (this._collectionEnabled)
+            this._addRecord(event.data);
+    },
+
+    _addRecord: function(record)
+    {
+        this._records.push(record);
+        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordAdded, record);
+    },
+
+    _loadNextChunk: function(data, index)
+    {
+        for (var i = 0; i < 20 && index < data.length; ++i, ++index)
+            this._addRecord(data[index]);
+
+        if (index !== data.length)
+            setTimeout(this._loadNextChunk.bind(this, data, index), 0);
+    },
+
+    loadFromFile: function(file)
+    {
+        function onLoad(e)
+        {
+            var data = JSON.parse(e.target.result);
+            this.reset();
+            this._loadNextChunk(data, 1);
+        }
+
+        function onError(e)
+        {
+            switch(e.target.error.code) {
+            case e.target.error.NOT_FOUND_ERR:
+                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: File "%s" not found.', file.name));
+            break;
+            case e.target.error.NOT_READABLE_ERR:
+                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: File "%s" is not readable', file.name));
+            break;
+            case e.target.error.ABORT_ERR:
+                break;
+            default:
+                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: An error occurred while reading the file "%s"', file.name));
+            }
+        }
+
+        var reader = new FileReader();
+        reader.onload = onLoad.bind(this);
+        reader.onerror = onError;
+        reader.readAsText(file);
+    },
+
+    saveToFile: function()
+    {
+        var records = ['[' + JSON.stringify(new String(window.navigator.appVersion))];
+        for (var i = 0; i < this._records.length; ++i)
+            records.push(JSON.stringify(this._records[i]));
+
+        records[records.length - 1] = records[records.length - 1] + "]";
+
+        var now = new Date();
+        var suggestedFileName = "TimelineRawData-" + now.toISO8601Compact() + ".json";
+        InspectorFrontendHost.saveAs(suggestedFileName, records.join(",\n"));
+    },
+
+    reset: function()
+    {
+        this._records = [];
+        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordsCleared);
+    }
+}
+
+WebInspector.TimelineModel.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
index 858742c6c..839ef15af 100644
--- a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
+++ b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -31,22 +31,29 @@
 /**
  * @constructor
  * @extends {WebInspector.Object}
+ * @implements {WebInspector.TimelinePresentationModel.Filter}
  */
 WebInspector.TimelineOverviewPane = function(presentationModel)
 {
     this.element = document.createElement("div");
-    this.element.className = "fill";
+    this.element.id = "timeline-overview-panel";
 
-    this._startAtZero = false;
+    this._windowStartTime = 0;
+    this._windowEndTime = null;
 
     this._presentationModel = presentationModel;
 
-    this.element = document.createElement("div");
-    this.element.id = "timeline-overview-panel";
-
     this._topPaneSidebarElement = document.createElement("div");
     this._topPaneSidebarElement.id = "timeline-overview-sidebar";
 
+    if (WebInspector.experimentsSettings.timelineVerticalOverview.isEnabled()) {
+        this._overviewModeSelector = new WebInspector.TimelineOverviewModeSelector(this._onOverviewModeChanged.bind(this));
+        this._overviewModeSelector.addButton(WebInspector.UIString("Show each event category as a horizontal strip in overview"),
+                                             "timeline-mode-horizontal-bars", WebInspector.TimelineOverviewPane.Mode.EventsHorizontal);
+        this._overviewModeSelector.addButton(WebInspector.UIString("Show each event as a vertical bar in overview"),
+                                             "timeline-mode-vertical-bars", WebInspector.TimelineOverviewPane.Mode.EventsVertical);
+    }
+
     var overviewTreeElement = document.createElement("ol");
     overviewTreeElement.className = "sidebar-tree";
     this._topPaneSidebarElement.appendChild(overviewTreeElement);
@@ -54,6 +61,9 @@ WebInspector.TimelineOverviewPane = function(presentationModel)
 
     var topPaneSidebarTree = new TreeOutline(overviewTreeElement);
     this._timelinesOverviewItem = new WebInspector.SidebarTreeElement("resources-time-graph-sidebar-item", WebInspector.UIString("Timelines"));
+    if (this._overviewModeSelector)
+        this._timelinesOverviewItem.statusElement = this._overviewModeSelector.element;
+
     topPaneSidebarTree.appendChild(this._timelinesOverviewItem);
     this._timelinesOverviewItem.revealAndSelect(false);
     this._timelinesOverviewItem.onselect = this._showTimelines.bind(this);
@@ -62,18 +72,25 @@ WebInspector.TimelineOverviewPane = function(presentationModel)
     topPaneSidebarTree.appendChild(this._memoryOverviewItem);
     this._memoryOverviewItem.onselect = this._showMemoryGraph.bind(this);
 
+    this._currentMode = WebInspector.TimelineOverviewPane.Mode.EventsHorizontal;
+
+    this._overviewContainer = this.element.createChild("div", "fill");
+    this._overviewContainer.id = "timeline-overview-container";
+
     this._overviewGrid = new WebInspector.TimelineGrid();
     this._overviewGrid.element.id = "timeline-overview-grid";
     this._overviewGrid.itemsGraphsElement.id = "timeline-overview-timelines";
 
+    this._overviewContainer.appendChild(this._overviewGrid.element);
+
     this._heapGraph = new WebInspector.HeapGraph();
     this._heapGraph.element.id = "timeline-overview-memory";
     this._overviewGrid.element.insertBefore(this._heapGraph.element, this._overviewGrid.itemsGraphsElement);
 
-    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this._overviewGrid.element);
+    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this._overviewContainer);
     this._overviewWindow.addEventListener(WebInspector.TimelineOverviewWindow.Events.WindowChanged, this._onWindowChanged, this);
 
-    this.element.appendChild(this._overviewGrid.element);
+    this._overviewContainer.appendChild(this._overviewGrid.element);
 
     var separatorElement = document.createElement("div");
     separatorElement.id = "timeline-overview-separator";
@@ -86,11 +103,10 @@ WebInspector.TimelineOverviewPane = function(presentationModel)
         var categoryGraph = new WebInspector.TimelineCategoryGraph(categories[category], i++ % 2);
         this._categoryGraphs[category] = categoryGraph;
         this._overviewGrid.itemsGraphsElement.appendChild(categoryGraph.graphElement);
+        categories[category].addEventListener(WebInspector.TimelineCategory.Events.VisibilityChanged, this._onCategoryVisibilityChanged, this);
     }
-    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, this._onCategoryVisibilityChanged, this);
 
     this._overviewGrid.setScrollAndDividerTop(0, 0);
-
     this._overviewCalculator = new WebInspector.TimelineOverviewCalculator();
 }
 
@@ -101,58 +117,62 @@ WebInspector.TimelineOverviewPane.WindowScrollSpeedFactor = .3;
 WebInspector.TimelineOverviewPane.ResizerOffset = 3.5; // half pixel because offset values are not rounded but ceiled
 
 WebInspector.TimelineOverviewPane.Mode = {
-    Events: "Events",
+    EventsVertical: "EventsVertical",
+    EventsHorizontal: "EventsHorizontal",
     Memory: "Memory"
 };
 
 WebInspector.TimelineOverviewPane.Events = {
-    ModeChanged: "ModeChanged"
+    ModeChanged: "ModeChanged",
+    WindowChanged: "WindowChanged"
 };
 
 WebInspector.TimelineOverviewPane.prototype = {
     _showTimelines: function()
     {
+        var newMode = this._overviewModeSelector ? this._overviewModeSelector.value : WebInspector.TimelineOverviewPane.Mode.EventsHorizontal;
+        if (this._currentMode === newMode)
+            return;
+        this._currentMode = newMode;
         this._timelinesOverviewItem.revealAndSelect(false);
         this._heapGraph.hide();
+        this._setVerticalOverview(this._currentMode === WebInspector.TimelineOverviewPane.Mode.EventsVertical);
         this._overviewGrid.itemsGraphsElement.removeStyleClass("hidden");
-        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, WebInspector.TimelineOverviewPane.Mode.Events);
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._currentMode);
     },
 
     _showMemoryGraph: function()
     {
+        this._currentMode = WebInspector.TimelineOverviewPane.Mode.Memory;
+        this._setVerticalOverview(false);
         this._memoryOverviewItem.revealAndSelect(false);
         this._heapGraph.show();
-        this._heapGraph.update(this._records);
+        this._heapGraph.update(this._presentationModel.rootRecord().children);
         this._overviewGrid.itemsGraphsElement.addStyleClass("hidden");
-        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, WebInspector.TimelineOverviewPane.Mode.Memory);
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._currentMode);
     },
 
-    /**
-     * @param {boolean} enabled
-     */
-    setStartAtZero: function(enabled)
+    _setVerticalOverview: function(enabled)
     {
-        if (this._startAtZero === enabled)
+        if (!enabled === !this._verticalOverview)
             return;
-        this._startAtZero = enabled;
         if (enabled) {
-            if (this._heapGraph.visible)
-                this._showTimelines();
-            this.element.addStyleClass("timeline-start-at-zero");
-            this._startAtZeroOverview = new WebInspector.TimelineStartAtZeroOverview(this._presentationModel);
-            this._startAtZeroOverview.show(this.element);
-            this._startAtZeroOverview.update(this._records);
+            this._verticalOverview = new WebInspector.TimelineVerticalOverview();
+            this._verticalOverview.show(this._overviewContainer);
+            this._verticalOverview.update(this._presentationModel.rootRecord().children);
         } else {
-            this.element.removeStyleClass("timeline-start-at-zero");
-            this._startAtZeroOverview.detach();
-            this._startAtZeroOverview = null;
-            this._showTimelines();
+            this._verticalOverview.detach();
+            this._overviewGrid.itemsGraphsElement.removeStyleClass("hidden");
+            this._verticalOverview = null;
         }
     },
 
-    _onWindowChanged: function()
+    _onOverviewModeChanged: function()
     {
-        this._presentationModel.setWindowPosition(this._overviewWindow.windowLeft, this._overviewWindow.windowRight);
+        // If we got this while in memory mode, we postpone actual switch until we get to the events mode.
+        if (this._currentMode === WebInspector.TimelineOverviewPane.Mode.Memory)
+            return;
+        this._showTimelines();
     },
 
     _onCategoryVisibilityChanged: function(event)
@@ -161,28 +181,8 @@ WebInspector.TimelineOverviewPane.prototype = {
         this._categoryGraphs[category.name].dimmed = category.hidden;
     },
 
-    _forAllRecords: function(recordsArray, callback)
-    {
-        if (!recordsArray)
-            return;
-        var stack = [{array: recordsArray, index: 0}];
-        while (stack.length) {
-            var entry = stack[stack.length - 1];
-            var records = entry.array;
-            if (entry.index < records.length) {
-                 var record = records[entry.index];
-                 callback(record);
-                 if (record.children)
-                     stack.push({array: record.children, index: 0});
-                 ++entry.index;
-            } else
-                stack.pop();
-        }
-    },
-
-    update: function(records, showShortEvents)
+    update: function(showShortEvents)
     {
-        this._records = records;
         this._showShortEvents = showShortEvents;
         // Clear summary bars.
         var timelines = {};
@@ -193,7 +193,15 @@ WebInspector.TimelineOverviewPane.prototype = {
 
         // Create sparse arrays with 101 cells each to fill with chunks for a given category.
         this._overviewCalculator.reset();
-        this._forAllRecords(records, this._overviewCalculator.updateBoundaries.bind(this._overviewCalculator));
+
+        function updateBoundaries(record)
+        {
+            this._overviewCalculator.updateBoundaries(record);
+            return false;
+        }
+
+        var records = this._presentationModel.rootRecord().children;
+        WebInspector.TimelinePanel.forAllRecords(records, updateBoundaries.bind(this));
 
         function markPercentagesForRecord(record)
         {
@@ -206,7 +214,7 @@ WebInspector.TimelineOverviewPane.prototype = {
             for (var j = Math.round(percentages.start); j <= end; ++j)
                 timelines[categoryName][j] = true;
         }
-        this._forAllRecords(records, markPercentagesForRecord.bind(this));
+        WebInspector.TimelinePanel.forAllRecords(records, markPercentagesForRecord.bind(this));
 
         // Convert sparse arrays to continuous segments, render graphs for each.
         for (var category in this._presentationModel.categories) {
@@ -233,8 +241,8 @@ WebInspector.TimelineOverviewPane.prototype = {
         this._heapGraph.setSize(this._overviewGrid.element.offsetWidth, 60);
         if (this._heapGraph.visible)
             this._heapGraph.update(records);
-        if (this._startAtZeroOverview)
-            this._startAtZeroOverview.update(records);
+        if (this._verticalOverview)
+            this._verticalOverview.update(records);
         this._overviewGrid.updateDividers(true, this._overviewCalculator);
     },
 
@@ -244,6 +252,8 @@ WebInspector.TimelineOverviewPane.prototype = {
         var dividers = [];
         for (var i = 0; i < records.length; ++i) {
             var record = records[i];
+            if (record.type === WebInspector.TimelineModel.RecordType.BeginFrame)
+                continue;
             var positions = this._overviewCalculator.computeBarGraphPercentages(record);
             var dividerPosition = Math.round(positions.start * 10);
             if (dividers[dividerPosition])
@@ -257,22 +267,67 @@ WebInspector.TimelineOverviewPane.prototype = {
 
     sidebarResized: function(width)
     {
-        this._overviewGrid.element.style.left = width + "px";
+        this._overviewContainer.style.left = width + "px";
         this._topPaneSidebarElement.style.width = width + "px";
     },
 
     reset: function()
     {
+        this._windowStartTime = 0;
+        this._windowEndTime = null;
         this._overviewWindow.reset();
         this._overviewCalculator.reset();
         this._overviewGrid.updateDividers(true, this._overviewCalculator);
-        if (this._startAtZeroOverview)
-            this._startAtZeroOverview.reset();
+        if (this._verticalOverview)
+            this._verticalOverview.reset();
     },
 
     scrollWindow: function(event)
     {
         this._overviewWindow.scrollWindow(event);
+    },
+
+    /**
+     * @param {WebInspector.TimelinePresentationModel.Record} record
+     */
+    accept: function(record)
+    {
+        return record.endTime >= this._windowStartTime && (typeof this._windowEndTime !== "number" || record.startTime <= this._windowEndTime);
+    },
+
+    windowStartTime: function()
+    {
+        return this._windowStartTime || this._presentationModel.minimumRecordTime();
+    },
+
+    windowEndTime: function()
+    {
+        return this._windowEndTime || this._presentationModel.maximumRecordTime();
+    },
+
+    windowLeft: function()
+    {
+        return this._overviewWindow.windowLeft;
+    },
+
+    windowRight: function()
+    {
+        return this._overviewWindow.windowRight;
+    },
+
+    _onWindowChanged: function()
+    {
+        if (this._verticalOverview) {
+            var times = this._verticalOverview.getWindowTimes(this.windowLeft(), this.windowRight());
+            this._windowStartTime = times.startTime;
+            this._windowEndTime = times.endTime;
+        } else {
+            var absoluteMin = this._presentationModel.minimumRecordTime();
+            var absoluteMax = this._presentationModel.maximumRecordTime();
+            this._windowStartTime = absoluteMin + (absoluteMax - absoluteMin) * this.windowLeft();
+            this._windowEndTime = absoluteMin + (absoluteMax - absoluteMin) * this.windowRight();
+        }
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.WindowChanged);
     }
 }
 
@@ -359,7 +414,7 @@ WebInspector.TimelineOverviewWindow.prototype = {
                 break;
             } else if (node === this._parentElement) {
                 var position = event.pageX - this._parentElement.offsetLeft;
-                this._overviewWindowSelector = new WebInspector.TimelinePanel.WindowSelector(this._parentElement, position);
+                this._overviewWindowSelector = new WebInspector.TimelineOverviewPane.WindowSelector(this._parentElement, position);
                 WebInspector.elementDragStart(null, this._windowSelectorDragging.bind(this), this._endWindowSelectorDragging.bind(this), event, "ew-resize");
                 break;
             } else if (node === this._leftResizeElement || node === this._rightResizeElement) {
@@ -496,15 +551,16 @@ WebInspector.TimelineOverviewCalculator.prototype = {
 
     updateBoundaries: function(record)
     {
+        var result = false;
         if (typeof this.minimumBoundary === "undefined" || record.startTime < this.minimumBoundary) {
             this.minimumBoundary = record.startTime;
-            return true;
+            result = true;
         }
         if (typeof this.maximumBoundary === "undefined" || record.endTime > this.maximumBoundary) {
             this.maximumBoundary = record.endTime;
-            return true;
+            result = true;
         }
-        return false;
+        return result;
     },
 
     get boundarySpan()
@@ -512,7 +568,7 @@ WebInspector.TimelineOverviewCalculator.prototype = {
         return this.maximumBoundary - this.minimumBoundary;
     },
 
-    formatValue: function(value)
+    formatTime: function(value)
     {
         return Number.secondsToString(value);
     }
@@ -565,7 +621,7 @@ WebInspector.TimelineCategoryGraph.prototype = {
 /**
  * @constructor
  */
-WebInspector.TimelinePanel.WindowSelector = function(parent, position)
+WebInspector.TimelineOverviewPane.WindowSelector = function(parent, position)
 {
     this._startPosition = position;
     this._width = parent.offsetWidth;
@@ -576,7 +632,7 @@ WebInspector.TimelinePanel.WindowSelector = function(parent, position)
     parent.appendChild(this._windowSelector);
 }
 
-WebInspector.TimelinePanel.WindowSelector.prototype = {
+WebInspector.TimelineOverviewPane.WindowSelector.prototype = {
     _createSelectorElement: function(parent, left, width, height)
     {
         var selectorElement = document.createElement("div");
@@ -662,7 +718,7 @@ WebInspector.HeapGraph.prototype = {
         var minUsedHeapSize = 100000000000;
         var minTime;
         var maxTime;
-        this._forAllRecords(records, function(r) {
+        WebInspector.TimelinePanel.forAllRecords(records, function(r) {
             maxUsedHeapSize = Math.max(maxUsedHeapSize, r.usedHeapSize || maxUsedHeapSize);
             minUsedHeapSize = Math.min(minUsedHeapSize, r.usedHeapSize || minUsedHeapSize);
 
@@ -679,7 +735,7 @@ WebInspector.HeapGraph.prototype = {
         var yFactor = height / (maxUsedHeapSize - minUsedHeapSize);
 
         var histogram = new Array(width);
-        this._forAllRecords(records, function(r) {
+        WebInspector.TimelinePanel.forAllRecords(records, function(r) {
             if (!r.usedHeapSize)
                 return;
              var x = Math.round((r.endTime - minTime) * xFactor);
@@ -728,58 +784,134 @@ WebInspector.HeapGraph.prototype = {
         ctx.fillStyle = "rgba(255,255,255,0.8)";
         ctx.fillRect(0, 0, this._canvas.width, this._canvas.height);
     },
-
-    _forAllRecords: WebInspector.TimelineOverviewPane.prototype._forAllRecords
 }
 
 /**
  * @constructor
- * @param {WebInspector.TimelinePresentationModel} model
  * @extends {WebInspector.View}
  */
-WebInspector.TimelineStartAtZeroOverview = function(model) {
+WebInspector.TimelineVerticalOverview = function() {
     WebInspector.View.call(this);
-    this._presentationModel = model;
-    this.element.className = "timeline-overview-start-at-zero fill";
-    this._overviewElement = this.element.createChild("div", "timeline-overview-start-at-zero-bars fill");
-    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this.element);
-    this._overviewWindow.addEventListener(WebInspector.TimelineOverviewWindow.Events.WindowChanged, this._onWindowChanged, this);
-    this._recordsPerBar = 1;
-    this._calculator = new WebInspector.TimelineStartAtZeroCalculator();
+    this.element = document.createElement("div");
+    this.element.className = "timeline-vertical-overview-bars fill";
+    this.reset();
 }
 
-WebInspector.TimelineStartAtZeroOverview.prototype = {
+WebInspector.TimelineVerticalOverview.prototype = {
     reset: function()
     {
         this._recordsPerBar = 1;
-        this._overviewWindow.reset();
+        this._frameMode = false;
+        this._barTimes = [];
     },
 
     update: function(records)
     {
-        this._calculator.reset();
         records = this._filterRecords(records);
-        records.forEach(this._calculator.updateBoundaries, this._calculator);
-        this._calculator.calculateWindow();
-
-        var scale = (this._overviewElement.clientHeight - 4) / this._calculator.boundarySpan;
-        this._recordsPerBar = Math.max(1, records.length * 4 / this.element.clientWidth);
-        var numberOfBars = Math.ceil(records.length / this._recordsPerBar);
-
-        this._overviewElement.removeChildren();
-        var padding = this._overviewElement.createChild("div", "padding");
-
-        for (var i = 0; i < numberOfBars; ++i) {
-            var index = Math.floor(i * this._recordsPerBar);
-            var longestRecord = records[index];
-            var stopIndex = Math.min(Math.floor((i + 1) * this._recordsPerBar), records.length);
-            for (++index; index < stopIndex; ++index) {
-                var record = records[index];
+
+        var frameCount = 0;
+        var boundarySpan = 0;
+        var lastFrameTime = records.length && records[0].startTime;
+        for (var i = 0; i < records.length; ++i) {
+            var record = records[i];
+            var duration = record.endTime - record.startTime;
+            if (boundarySpan < duration)
+                boundarySpan = duration;
+            if (record.type === WebInspector.TimelineModel.RecordType.BeginFrame || (frameCount && (i + 1 === records.length))) {
+                // if we have frames, take frame duration into account
+                if (record.startTime - lastFrameTime > boundarySpan)
+                    boundarySpan = record.startTime - lastFrameTime;
+                lastFrameTime = record.startTime;
+                ++frameCount;
+            }
+        }
+        // If we have frames, aggregate by frames; otherwise, just show top-level records.
+        var recordCount = frameCount || records.length;
+
+        const paddingTop = 4;
+        const minBarWidth = 4;
+        var scale = (this.element.clientHeight - paddingTop) / boundarySpan;
+        this._recordsPerBar = Math.max(1, recordCount * minBarWidth / this.element.clientWidth);
+        var numberOfBars = Math.ceil(recordCount / this._recordsPerBar);
+
+        this._barTimes = [];
+        this.element.removeChildren();
+        var padding = this.element.createChild("div", "padding");
+
+        var statistics = frameCount ? this._aggregateFrames(records, numberOfBars) : this._aggregateRecords(records, numberOfBars);
+        for (var i = 0; i < statistics.length; ++i)
+            this.element.insertBefore(this._buildBar(statistics[i], scale), padding);
+    },
+
+    _aggregateFrames: function(records, numberOfBars)
+    {
+        var statistics = [];
+        for (var barNumber = 0, currentRecord = 0, currentFrame = 0;
+             barNumber < numberOfBars && currentRecord < records.length; ++barNumber) {
+            var lastFrame = Math.floor((barNumber + 1) * this._recordsPerBar);
+            var barStartTime = records[currentRecord].startTime;
+            var longestFrameStatistics;
+            var longestFrameTime = 0;
+
+            for (; currentFrame < lastFrame && currentRecord < records.length; ++currentFrame) {
+                if (records[currentRecord].type === WebInspector.TimelineModel.RecordType.BeginFrame)
+                    currentRecord++;
+                var frameStatistics = {};
+                var frameInfo = this._aggregateFrameStatistics(records, currentRecord, frameStatistics);
+                currentRecord += frameInfo.recordCount;
+                if (frameInfo.totalTime > longestFrameTime) {
+                    longestFrameStatistics = frameStatistics;
+                    longestFrameTime = frameInfo.totalTime;
+                }
+            }
+            var barEndTime = records[currentRecord - 1].endTime;
+            if (longestFrameStatistics) {
+                statistics.push(longestFrameStatistics);
+                this._barTimes.push({ startTime: barStartTime, endTime: barEndTime });
+            }
+        }
+        return statistics;
+    },
+
+    _aggregateFrameStatistics: function(records, startIndex, statistics)
+    {
+        var totalTime = 0;
+        for (var index = startIndex; index < records.length; ++index) {
+            var record = records[index];
+            if (record.type === WebInspector.TimelineModel.RecordType.BeginFrame)
+                break;
+            var categories = Object.keys(record.aggregatedStats);
+            for (var i = 0; i < categories.length; ++i) {
+                var category = categories[i];
+                var value = statistics[category] || 0;
+                value += record.aggregatedStats[category];
+                totalTime += record.aggregatedStats[category];
+                statistics[category] = value;
+            }
+        }
+        return {
+            totalTime: totalTime,
+            recordCount: index - startIndex
+        }
+    },
+
+    _aggregateRecords: function(records, numberOfBars)
+    {
+        var statistics = [];
+        for (var barNumber = 0, currentRecord = 0; barNumber < numberOfBars && currentRecord < records.length; ++barNumber) {
+            var barStartTime = records[currentRecord].startTime;
+            var longestRecord = records[currentRecord];
+            var lastIndex = Math.min(Math.floor((barNumber + 1) * this._recordsPerBar), records.length);
+            for (++currentRecord; currentRecord < lastIndex; ++currentRecord) {
+                var record = records[currentRecord];
                 if (longestRecord.endTime - longestRecord.startTime < record.endTime - record.startTime)
                     longestRecord = record;
             }
-            this._overviewElement.insertBefore(this._buildBar(longestRecord, scale), padding);
+            var barEndTime = records[currentRecord - 1].endTime;
+            statistics.push(longestRecord.aggregatedStats);
+            this._barTimes.push({ startTime: barStartTime, endTime: barEndTime });
         }
+        return statistics;
     },
 
     _filterRecords: function(records)
@@ -791,40 +923,101 @@ WebInspector.TimelineStartAtZeroOverview.prototype = {
         return records.filter(filter);
     },
 
-    _buildBar: function(record, scale)
+    _buildBar: function(statistics, scale)
     {
         var outer = document.createElement("div");
         outer.className = "timeline-bar-vertical";
-        var stats = record.aggregatedStats;
-        var categories = Object.keys(stats);
+        var categories = Object.keys(statistics);
         for (var i = 0; i < categories.length; ++i) {
             var category = categories[i];
-            var duration = stats[category];
+            var duration = statistics[category];
             if (!duration)
                 continue;
             var bar = outer.createChild("div", "timeline-" + category);
-            bar.style.height = (stats[category] * scale) + "px";
+            bar.style.height = (statistics[category] * scale) + "px";
         }
         return outer;
     },
 
-    _onWindowChanged: function()
+    getWindowTimes: function(windowLeft, windowRight)
     {
-        var leftOffset = this._overviewWindow.windowLeft * this.element.clientWidth;
-        var rightOffset = this._overviewWindow.windowRight * this.element.clientWidth;
-        var bars = this._overviewElement.children;
+        var windowSpan = this.element.clientWidth
+        var leftOffset = windowLeft * windowSpan;
+        var rightOffset = windowRight * windowSpan;
+        var bars = this.element.children;
         var offset0 = bars[0] ? bars[0].offsetLeft : 4;
         var barWidth = 9;
         if (bars.length > 2) {
             var offset1 = bars[bars.length - 2].offsetLeft;
             barWidth = (offset1 - offset0) / (bars.length - 2);
         }
+        var firstBar = Math.floor(Math.max(leftOffset - offset0, 0) / barWidth);
+        var lastBar = Math.min(Math.ceil((rightOffset - offset0 - 2) / barWidth), this._barTimes.length - 1);
+        const snapToRightTolerancePixels = 3;
+        return {
+            startTime: this._barTimes[firstBar].startTime,
+            endTime: rightOffset + snapToRightTolerancePixels > windowSpan ? null : this._barTimes[lastBar].endTime
+        }
+    }
+}
 
-        var leftIndex = Math.floor((leftOffset - offset0) / barWidth * this._recordsPerBar);
-        var rightIndex = rightOffset + barWidth >= this.element.clientWidth ? null : Math.ceil((rightOffset - offset0 - 2) / barWidth * this._recordsPerBar);
+WebInspector.TimelineVerticalOverview.prototype.__proto__ = WebInspector.View.prototype;
 
-        this._presentationModel.setWindowIndices(leftIndex, rightIndex);
-    }
+/**
+ * @constructor
+ */
+WebInspector.TimelineOverviewModeSelector = function(selectCallback)
+{
+    this.element = document.createElement("div");
+    this.element.className = "timeline-overview-mode-selector";
+    this._selectCallback = selectCallback;
+
+    this._buttons = [];
+    this.element.addEventListener("click", this._onClick.bind(this), false);
 }
 
-WebInspector.TimelineStartAtZeroOverview.prototype.__proto__ = WebInspector.View.prototype;
+WebInspector.TimelineOverviewModeSelector.prototype = {
+    addButton: function(tooltip, className, value)
+    {
+        var button = this._createButton(tooltip, className, value);
+        this.element.appendChild(button);
+        this._buttons.push(button);
+        if (this._buttons.length === 1)
+            this._select(button, true);
+    },
+
+    get value()
+    {
+        return this._value;
+    },
+
+    _createButton: function(tooltip, className, value)
+    {
+        var button = document.createElement("button");
+        button.createChild("div", "glyph");
+        button.createChild("div", "glyph shadow");
+        button.className = className;
+        button.title = tooltip;
+        button.value = value;
+        return button;
+    },
+
+    _select: function(button, selected)
+    {
+        if (selected) {
+            button.addStyleClass("toggled");
+            this._value = button.value;
+        } else
+            button.removeStyleClass("toggled");
+    },
+
+    _onClick: function(event)
+    {
+        var button = event.target.enclosingNodeOrSelfWithNodeName("button");
+        if (!button)
+            return;
+        for (var i = 0; i < this._buttons.length; ++i)
+            this._select(this._buttons[i], this._buttons[i] === button);
+        this._selectCallback(button.value);
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/TimelinePanel.js b/Source/WebCore/inspector/front-end/TimelinePanel.js
index bf580cd21..e9f8d927e 100644
--- a/Source/WebCore/inspector/front-end/TimelinePanel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePanel.js
@@ -38,13 +38,9 @@ WebInspector.TimelinePanel = function()
     this.registerRequiredCSS("timelinePanel.css");
 
     this._presentationModel = new WebInspector.TimelinePresentationModel();
-    this._presentationModel.addCategory(new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"));
-    this._presentationModel.addCategory(new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"));
-    this._presentationModel.addCategory(new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)"));
-    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.WindowChanged, this._scheduleRefresh.bind(this, false));
-    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, this._scheduleRefresh.bind(this, true));
 
     this._overviewPane = new WebInspector.TimelineOverviewPane(this._presentationModel);
+    this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.WindowChanged, this._scheduleRefresh.bind(this, false));
 
     this.element.appendChild(this._overviewPane.element);
     this.element.addEventListener("contextmenu", this._contextMenu.bind(this), true);
@@ -59,14 +55,13 @@ WebInspector.TimelinePanel = function()
     this._containerElement.id = "timeline-container";
     this._containerElement.addEventListener("scroll", this._onScroll.bind(this), false);
 
-    if (WebInspector.experimentsSettings.showMemoryCounters.isEnabled()) {
-        this._timelineMemorySplitter = this.element.createChild("div");
-        this._timelineMemorySplitter.id = "timeline-memory-splitter";
-        this._timelineMemorySplitter.addEventListener("mousedown", this._startSplitterDragging.bind(this), false);
-        this._timelineMemorySplitter.addStyleClass("hidden");
-        this._memoryStatistics = new WebInspector.MemoryStatistics(this, this.splitView.preferredSidebarWidth());
-        this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._timelinesOverviewModeChanged, this);
-    }
+    this._timelineMemorySplitter = this.element.createChild("div");
+    this._timelineMemorySplitter.id = "timeline-memory-splitter";
+    this._timelineMemorySplitter.addEventListener("mousedown", this._startSplitterDragging.bind(this), false);
+    this._timelineMemorySplitter.addStyleClass("hidden");
+    this._memoryStatistics = new WebInspector.MemoryStatistics(this, this.splitView.preferredSidebarWidth());
+    this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._timelinesOverviewModeChanged, this);
+    WebInspector.settings.memoryCounterGraphsHeight = WebInspector.settings.createSetting("memoryCounterGraphsHeight", 150);
 
     var itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
     this.sidebarTree.appendChild(itemsTreeElement);
@@ -82,6 +77,7 @@ WebInspector.TimelinePanel = function()
     this._itemsGraphsElement.id = "timeline-graphs";
     this._itemsGraphsElement.addEventListener("mousewheel", this._overviewPane.scrollWindow.bind(this._overviewPane), true);
     this._containerContentElement.appendChild(this._timelineGrid.element);
+    this._memoryStatistics.setMainTimelineGrid(this._timelineGrid);
 
     this._topGapElement = document.createElement("div");
     this._topGapElement.className = "timeline-gap";
@@ -98,18 +94,13 @@ WebInspector.TimelinePanel = function()
     this._expandElements.id = "orphan-expand-elements";
     this._itemsGraphsElement.appendChild(this._expandElements);
 
-    this._rootRecord = this._createRootRecord();
-    this._sendRequestRecords = {};
-    this._scheduledResourceRequests = {};
-    this._timerRecords = {};
-    this._requestAnimationFrameRecords = {};
-
-    this._calculator = new WebInspector.TimelineCalculator();
-    var shortRecordThresholdTitle = Number.secondsToString(WebInspector.TimelinePanel.shortRecordThreshold);
+    this._calculator = new WebInspector.TimelineCalculator(this._presentationModel);
+    var shortRecordThresholdTitle = Number.secondsToString(WebInspector.TimelinePresentationModel.shortRecordThreshold);
     this._showShortRecordsTitleText = WebInspector.UIString("Show the records that are shorter than %s", shortRecordThresholdTitle);
     this._hideShortRecordsTitleText = WebInspector.UIString("Hide the records that are shorter than %s", shortRecordThresholdTitle);
     this._createStatusbarButtons();
 
+    this._verticalOverview = false;
     this._boundariesAreValid = true;
     this._scrollTop = 0;
 
@@ -129,12 +120,16 @@ WebInspector.TimelinePanel = function()
     this._model.addEventListener(WebInspector.TimelineModel.Events.RecordsCleared, this._onRecordsCleared, this);
 
     this._registerShortcuts();
-    this._linkifier = WebInspector.debuggerPresentationModel.createLinkifier();
+
+    this._allRecordsCount = 0;
+
+    this._presentationModel.addFilter(this._overviewPane);
+    this._presentationModel.addFilter(new WebInspector.TimelineCategoryFilter()); 
+    this._presentationModel.addFilter(new WebInspector.TimelineIsLongFilter(this)); 
 }
 
 // Define row height, should be in sync with styles for timeline graphs.
 WebInspector.TimelinePanel.rowHeight = 18;
-WebInspector.TimelinePanel.shortRecordThreshold = 0.015;
 
 WebInspector.TimelinePanel.prototype = {
     /**
@@ -154,6 +149,7 @@ WebInspector.TimelinePanel.prototype = {
         var top = event.pageY + this._dragOffset
         this._setSplitterPosition(top);
         event.preventDefault();
+        this._refresh();
     },
 
     /**
@@ -163,8 +159,8 @@ WebInspector.TimelinePanel.prototype = {
     {
         delete this._dragOffset;
         WebInspector.elementDragEnd(event);
-        if (this._memoryStatistics)
-            this._memoryStatistics.show();
+        this._memoryStatistics.show();
+        WebInspector.settings.memoryCounterGraphsHeight.set(this.splitView.element.offsetHeight);
     },
 
     _setSplitterPosition: function(top)
@@ -178,19 +174,6 @@ WebInspector.TimelinePanel.prototype = {
         this._memoryStatistics.setTopPosition(top);
     },
 
-    _linkifyLocation: function(url, lineNumber, columnNumber)
-    {
-        // FIXME(62725): stack trace line/column numbers are one-based.
-        lineNumber = lineNumber ? lineNumber - 1 : lineNumber;
-        columnNumber = columnNumber ? columnNumber - 1 : 0;
-        return this._linkifier.linkifyLocation(url, lineNumber, columnNumber, "timeline-details");
-    },
-
-    _linkifyCallFrame: function(callFrame)
-    {
-        return this._linkifyLocation(callFrame.url, callFrame.lineNumber, callFrame.columnNumber);
-    },
-
     get calculator()
     {
         return this._calculator;
@@ -203,12 +186,8 @@ WebInspector.TimelinePanel.prototype = {
 
     get statusBarItems()
     {
-        var statusBarItems = [ this.toggleFilterButton.element, this.toggleTimelineButton.element, this.clearButton.element, this.garbageCollectButton.element, this._glueParentButton.element ];
-
-        if (WebInspector.experimentsSettings.timelineStartAtZero.isEnabled())
-            statusBarItems.push(this.toggleStartAtZeroButton.element);
+        var statusBarItems = [ this.toggleFilterButton.element, this.toggleTimelineButton.element, this.clearButton.element, this.garbageCollectButton.element, this._glueParentButton.element, this.statusBarFilters ];
 
-        statusBarItems.push(this.statusBarFilters);
         return statusBarItems;
     },
 
@@ -217,42 +196,6 @@ WebInspector.TimelinePanel.prototype = {
         return this.element;
     },
 
-    get _recordStyles()
-    {
-        if (!this._recordStylesArray) {
-            var recordTypes = WebInspector.TimelineAgent.RecordType;
-            var categories = this._presentationModel.categories;
-
-            var recordStyles = {};
-            recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: categories["scripting"] };
-            recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: categories["rendering"] };
-            recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: categories["rendering"] };
-            recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: categories["rendering"] };
-            recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: categories["loading"] };
-            recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: categories["scripting"] };
-            recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: categories["scripting"] };
-            recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: categories["scripting"] };
-            recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: categories["scripting"] };
-            recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: categories["scripting"] };
-            recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: categories["scripting"] };
-            recordStyles[recordTypes.TimeStamp] = { title: WebInspector.UIString("Stamp"), category: categories["scripting"] };
-            recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: categories["loading"] };
-            recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: categories["loading"] };
-            recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: categories["loading"] };
-            recordStyles[recordTypes.FunctionCall] = { title: WebInspector.UIString("Function Call"), category: categories["scripting"] };
-            recordStyles[recordTypes.ResourceReceivedData] = { title: WebInspector.UIString("Receive Data"), category: categories["loading"] };
-            recordStyles[recordTypes.GCEvent] = { title: WebInspector.UIString("GC Event"), category: categories["scripting"] };
-            recordStyles[recordTypes.MarkDOMContent] = { title: WebInspector.UIString("DOMContent event"), category: categories["scripting"] };
-            recordStyles[recordTypes.MarkLoad] = { title: WebInspector.UIString("Load event"), category: categories["scripting"] };
-            recordStyles[recordTypes.ScheduleResourceRequest] = { title: WebInspector.UIString("Schedule Request"), category: categories["loading"] };
-            recordStyles[recordTypes.RequestAnimationFrame] = { title: WebInspector.UIString("Request Animation Frame"), category: categories["scripting"] };
-            recordStyles[recordTypes.CancelAnimationFrame] = { title: WebInspector.UIString("Cancel Animation Frame"), category: categories["scripting"] };
-            recordStyles[recordTypes.FireAnimationFrame] = { title: WebInspector.UIString("Animation Frame Fired"), category: categories["scripting"] };
-            this._recordStylesArray = recordStyles;
-        }
-        return this._recordStylesArray;
-    },
-
     _createStatusbarButtons: function()
     {
         this.toggleTimelineButton = new WebInspector.StatusBarButton(WebInspector.UIString("Record"), "record-profile-status-bar-item");
@@ -267,14 +210,12 @@ WebInspector.TimelinePanel.prototype = {
         this.garbageCollectButton = new WebInspector.StatusBarButton(WebInspector.UIString("Collect Garbage"), "garbage-collect-status-bar-item");
         this.garbageCollectButton.addEventListener("click", this._garbageCollectButtonClicked, this);
 
-        this.toggleStartAtZeroButton = new WebInspector.StatusBarButton(WebInspector.UIString("Display all top level events starting at zero"), "timeline-start-at-zero-status-bar-item");
-        this.toggleStartAtZeroButton.addEventListener("click", this._toggleStartAtZeroButtonClicked, this);
-
         this.recordsCounter = document.createElement("span");
         this.recordsCounter.className = "timeline-records-counter";
 
         this._glueParentButton = new WebInspector.StatusBarButton(WebInspector.UIString("Glue asynchronous events to causes"), "glue-async-status-bar-item");
         this._glueParentButton.toggled = true;
+        this._presentationModel.setGlueRecords(true);
         this._glueParentButton.addEventListener("click", this._glueParentButtonClicked, this);
 
         this.statusBarFilters = document.createElement("div");
@@ -312,7 +253,8 @@ WebInspector.TimelinePanel.prototype = {
 
     _onCategoryCheckboxClicked: function(category, event)
     {
-        this._presentationModel.setCategoryVisibility(category, event.target.checked);
+        category.hidden = !event.target.checked;
+        this._scheduleRefresh(true);
     },
 
     _registerShortcuts: function()
@@ -358,7 +300,7 @@ WebInspector.TimelinePanel.prototype = {
 
     _saveToFile: function()
     {
-        this._model._saveToFile();
+        this._model.saveToFile();
     },
 
     _loadFromFile: function()
@@ -367,13 +309,18 @@ WebInspector.TimelinePanel.prototype = {
             this.toggleTimelineButton.toggled = false;
             this._model.stopRecord();
         }
-        this._model._loadFromFile(this._fileSelectorElement.files[0]);
+        this._model.loadFromFile(this._fileSelectorElement.files[0]);
         this._createFileSelector();
     },
 
-    _updateRecordsCounter: function()
+    _rootRecord: function()
     {
-        this.recordsCounter.textContent = WebInspector.UIString("%d of %d captured records are visible", this._rootRecord._visibleRecordsCount, this._rootRecord._allRecordsCount);
+        return this._presentationModel.rootRecord();
+    },
+
+    _updateRecordsCounter: function(recordsInWindowCount)
+    {
+        this.recordsCounter.textContent = WebInspector.UIString("%d of %d captured records are visible", recordsInWindowCount, this._allRecordsCount);
     },
 
     _updateEventDividers: function()
@@ -381,8 +328,13 @@ WebInspector.TimelinePanel.prototype = {
         this._timelineGrid.removeEventDividers();
         var clientWidth = this._graphRowsElement.offsetWidth - this._expandOffset;
         var dividers = [];
+        // Only show frames if we're zoomed close enough -- otherwise they'd be to dense to be useful and will overpopulate DOM.
+        var showFrames = this.calculator.boundarySpan < 1.0 && this._verticalOverview;
+
         for (var i = 0; i < this._timeStampRecords.length; ++i) {
             var record = this._timeStampRecords[i];
+            if (record.type === WebInspector.TimelineModel.RecordType.BeginFrame && !showFrames)
+                continue;
             var positions = this._calculator.computeBarGraphWindowPosition(record, clientWidth);
             var dividerPosition = Math.round(positions.left);
             if (dividerPosition < 0 || dividerPosition >= clientWidth || dividers[dividerPosition])
@@ -399,7 +351,7 @@ WebInspector.TimelinePanel.prototype = {
     {
         var eventDivider = document.createElement("div");
         eventDivider.className = "resources-event-divider";
-        var recordTypes = WebInspector.TimelineAgent.RecordType;
+        var recordTypes = WebInspector.TimelineModel.RecordType;
 
         var eventDividerPadding = document.createElement("div");
         eventDividerPadding.className = "resources-event-divider-padding";
@@ -412,16 +364,27 @@ WebInspector.TimelinePanel.prototype = {
         else if (record.type === recordTypes.TimeStamp) {
             eventDivider.className += " resources-orange-divider";
             eventDividerPadding.title = record.data["message"];
-        }
+        } else if (record.type === recordTypes.BeginFrame)
+            eventDivider.className += " timeline-frame-divider";
+
         eventDividerPadding.appendChild(eventDivider);
         return eventDividerPadding;
     },
 
     _timelinesOverviewModeChanged: function(event)
     {
-        if (!this._memoryStatistics)
-            return;
         var shouldShowMemory = event.data === WebInspector.TimelineOverviewPane.Mode.Memory;
+        var verticalOverview = event.data === WebInspector.TimelineOverviewPane.Mode.EventsVertical;
+        if (verticalOverview !== this._verticalOverview) {
+            this._verticalOverview = verticalOverview;
+            this._glueParentButton.disabled = verticalOverview;
+            if (verticalOverview)
+                this.element.addStyleClass("timeline-vertical-overview");
+            else
+                this.element.removeStyleClass("timeline-vertical-overview");
+            this._presentationModel.setGlueRecords(this._glueParentButton.toggled && !verticalOverview);
+            this._repopulateRecords();
+        }
         if (shouldShowMemory === this._memoryStatistics.visible())
             return;
         if (!shouldShowMemory) {
@@ -429,13 +392,13 @@ WebInspector.TimelinePanel.prototype = {
             this._memoryStatistics.hide();
             this.splitView.element.style.height = "auto";
             this.splitView.element.style.bottom = "0";
-            this.onResize();
         } else {
             this._timelineMemorySplitter.removeStyleClass("hidden");
             this._memoryStatistics.show();
             this.splitView.element.style.bottom = "auto";
-            this._setSplitterPosition(600);
+            this._setSplitterPosition(WebInspector.settings.memoryCounterGraphsHeight.get());
         }
+        this._refresh();
     },
 
     _toggleTimelineButtonClicked: function()
@@ -465,134 +428,42 @@ WebInspector.TimelinePanel.prototype = {
     _glueParentButtonClicked: function()
     {
         this._glueParentButton.toggled = !this._glueParentButton.toggled;
+        this._presentationModel.setGlueRecords(this._glueParentButton.toggled);
         this._repopulateRecords();
     },
 
-    _toggleStartAtZeroButtonClicked: function()
-    {
-        var toggled = !this.toggleStartAtZeroButton.toggled
-        this._glueParentButton.disabled = toggled;
-        this.toggleStartAtZeroButton.toggled = toggled;
-        this._calculator = toggled ? new WebInspector.TimelineStartAtZeroCalculator() : new WebInspector.TimelineCalculator();
-        this._repopulateRecords();
-        this._overviewPane.setStartAtZero(toggled);
-    },
-
     _repopulateRecords: function()
     {
         this._resetPanel();
         var records = this._model.records;
         for (var i = 0; i < records.length; ++i)
-            this._innerAddRecordToTimeline(records[i], this._rootRecord);
+            this._innerAddRecordToTimeline(records[i], this._rootRecord());
         this._scheduleRefresh(false);
     },
 
-    get _startAtZero()
-    {
-        return this.toggleStartAtZeroButton.toggled;
-    },
-
     _onTimelineEventRecorded: function(event)
     {
-        this._innerAddRecordToTimeline(event.data, this._rootRecord);
+        this._innerAddRecordToTimeline(event.data, this._rootRecord());
         this._scheduleRefresh(false);
 
-        if (this._memoryStatistics && event.data["counters"])
+        if (event.data["counters"])
             this._memoryStatistics.addTimlineEvent(event);
     },
 
-    _findParentRecord: function(record)
-    {
-        if (!this._glueParentButton.toggled)
-            return null;
-
-        var recordTypes = WebInspector.TimelineAgent.RecordType;
-        var parentRecord;
-        if (record.type === recordTypes.ResourceReceiveResponse ||
-            record.type === recordTypes.ResourceFinish ||
-            record.type === recordTypes.ResourceReceivedData)
-            parentRecord = this._sendRequestRecords[record.data["requestId"]];
-        else if (record.type === recordTypes.TimerFire)
-            parentRecord = this._timerRecords[record.data["timerId"]];
-        else if (record.type === recordTypes.ResourceSendRequest)
-            parentRecord = this._scheduledResourceRequests[record.data["url"]];
-        else if (record.type === recordTypes.FireAnimationFrame)
-            parentRecord = this._requestAnimationFrameRecords[record.data["id"]];
-        return parentRecord;
-    },
-
     _innerAddRecordToTimeline: function(record, parentRecord)
     {
-        var connectedToOldRecord = false;
-        var recordTypes = WebInspector.TimelineAgent.RecordType;
-
-        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad)
-            parentRecord = null; // No bar entry for load events.
-        else if (!this._startAtZero &&
-                    (parentRecord === this._rootRecord ||
-                    record.type === recordTypes.ResourceReceiveResponse ||
-                    record.type === recordTypes.ResourceFinish ||
-                    record.type === recordTypes.ResourceReceivedData)) {
-            var newParentRecord = this._findParentRecord(record);
-            if (newParentRecord) {
-                parentRecord = newParentRecord;
-                connectedToOldRecord = true;
-            }
-        }
-
-        var children = record.children;
-        var scriptDetails;
-        if (record.data && record.data["scriptName"]) {
-            scriptDetails = {
-                scriptName: record.data["scriptName"],
-                scriptLine: record.data["scriptLine"]
-            }
-        };
-
-        if ((record.type === recordTypes.TimerFire || record.type === recordTypes.FireAnimationFrame) && children && children.length) {
-            var childRecord = children[0];
-            if (childRecord.type === recordTypes.FunctionCall) {
-                scriptDetails = {
-                    scriptName: childRecord.data["scriptName"],
-                    scriptLine: childRecord.data["scriptLine"]
-                };
-                children = childRecord.children.concat(children.slice(1));
+        var formattedRecord = this._presentationModel.addRecord(record, parentRecord);
+        ++this._allRecordsCount;
+        var recordTypes = WebInspector.TimelineModel.RecordType;
+        var timeStampRecords = this._timeStampRecords;
+        function addTimestampRecords(record)
+        {
+            if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad ||
+                record.type === recordTypes.TimeStamp || record.type === recordTypes.BeginFrame) {
+                timeStampRecords.push(record);
             }
         }
-
-        var formattedRecord = new WebInspector.TimelinePanel.FormattedRecord(record, parentRecord, this, scriptDetails);
-
-        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad) {
-            this._timeStampRecords.push(formattedRecord);
-            return;
-        }
-
-        ++this._rootRecord._allRecordsCount;
-        formattedRecord.collapsed = (parentRecord === this._rootRecord);
-
-        var childrenCount = children ? children.length : 0;
-        for (var i = 0; i < childrenCount; ++i)
-            this._innerAddRecordToTimeline(children[i], formattedRecord);
-
-        formattedRecord._calculateAggregatedStats(this._presentationModel.categories);
-
-        if (connectedToOldRecord) {
-            record = formattedRecord;
-            do {
-                var parent = record.parent;
-                if (parent._lastChildEndTime < record._lastChildEndTime)
-                    parent._lastChildEndTime = record._lastChildEndTime;
-                for (var category in formattedRecord._aggregatedStats)
-                    parent._aggregatedStats[category] += formattedRecord._aggregatedStats[category];
-                record = parent;
-            } while (record.parent);
-        } else {
-            if (parentRecord !== this._rootRecord)
-                parentRecord._selfTime -= formattedRecord.endTime - formattedRecord.startTime;
-        }
-        // Keep bar entry for mark timeline since nesting might be interesting to the user.
-        if (record.type === recordTypes.TimeStamp)
-            this._timeStampRecords.push(formattedRecord);
+        WebInspector.TimelinePanel.forAllRecords([ formattedRecord ], addTimestampRecords);
     },
 
     sidebarResized: function(event)
@@ -603,9 +474,7 @@ WebInspector.TimelinePanel.prototype = {
         this._overviewPane.sidebarResized(width);
         // Min width = <number of buttons on the left> * 31
         this.statusBarFilters.style.left = Math.max((this.statusBarItems.length + 2) * 31, width) + "px";
-
-        if (this._memoryStatistics)
-            this._memoryStatistics.setSidebarWidth(width);
+        this._memoryStatistics.setSidebarWidth(width);
     },
 
     onResize: function()
@@ -614,19 +483,9 @@ WebInspector.TimelinePanel.prototype = {
         this._scheduleRefresh(false);
     },
 
-    _createRootRecord: function()
-    {
-        var rootRecord = {};
-        rootRecord.children = [];
-        rootRecord._visibleRecordsCount = 0;
-        rootRecord._allRecordsCount = 0;
-        rootRecord._aggregatedStats = {};
-        return rootRecord;
-    },
-
     _clearPanel: function()
     {
-        this._model._reset();
+        this._model.reset();
     },
 
     _onRecordsCleared: function()
@@ -639,16 +498,12 @@ WebInspector.TimelinePanel.prototype = {
     {
         this._presentationModel.reset();
         this._timeStampRecords = [];
-        this._sendRequestRecords = {};
-        this._scheduledResourceRequests = {};
-        this._timerRecords = {};
-        this._requestAnimationFrameRecords = {};
-        this._rootRecord = this._createRootRecord();
         this._boundariesAreValid = false;
         this._overviewPane.reset();
         this._adjustScrollPosition(0);
         this._closeRecordDetails();
-        this._linkifier.reset();
+        this._allRecordsCount = 0;
+        this._memoryStatistics.reset();
     },
 
     elementsToRestoreScrollPositionsFor: function()
@@ -702,73 +557,53 @@ WebInspector.TimelinePanel.prototype = {
             delete this._refreshTimeout;
         }
 
-        this._overviewPane.update(this._rootRecord.children, this._showShortEvents);
+        this._overviewPane.update(this._showShortEvents);
 
         if (!this._boundariesAreValid)
-            this._updateBoundaries();
-        this._refreshRecords(!this._boundariesAreValid);
-        this._updateRecordsCounter();
+            this._calculator.setWindow(this._overviewPane.windowStartTime(), this._overviewPane.windowEndTime());
+
+        var recordsInWindowCount = this._refreshRecords(!this._boundariesAreValid);
+        this._updateRecordsCounter(recordsInWindowCount);
         if(!this._boundariesAreValid)
             this._updateEventDividers();
-        if (this._memoryStatistics && this._memoryStatistics.visible())
+        if (this._memoryStatistics.visible())
             this._memoryStatistics.refresh();
         this._boundariesAreValid = true;
     },
 
-    _updateBoundaries: function()
+    revealRecordAt: function(time)
     {
-        this._calculator.reset();
-        this._calculator.windowLeft = this._presentationModel.windowLeft;
-        this._calculator.windowRight = this._presentationModel.windowRight;
-
-        for (var i = 0; i < this._rootRecord.children.length; ++i)
-            this._calculator.updateBoundaries(this._rootRecord.children[i]);
-
-        this._calculator.calculateWindow();
-    },
-
-    _filterRecords: function()
-    {
-        var recordsInWindow = [];
-        var filter = this._startAtZero ? new WebInspector.TimelineStartAtZeroRecordFilter(this._presentationModel, this._rootRecord, this._showShortEvents)
-            : new WebInspector.TimelineRecordFilter(this._calculator, this._showShortEvents);
-        this._rootRecord._visibleRecordsCount = 0;
-
-        var stack = [{children: this._rootRecord.children, index: 0, parentIsCollapsed: false}];
-        while (stack.length) {
-            var entry = stack[stack.length - 1];
-            var records = entry.children;
-            if (records && entry.index < records.length) {
-                 var record = records[entry.index];
-                 ++entry.index;
-
-                 if (filter.accept(record)) {
-                     ++this._rootRecord._visibleRecordsCount;
-                     ++record.parent._invisibleChildrenCount;
-                     if (!entry.parentIsCollapsed)
-                         recordsInWindow.push(record);
-                 }
-
-                 record._invisibleChildrenCount = 0;
-
-                 stack.push({children: record.children,
-                             index: 0,
-                             parentIsCollapsed: (entry.parentIsCollapsed || record.collapsed),
-                             parentRecord: record,
-                             windowLengthBeforeChildrenTraversal: recordsInWindow.length});
-            } else {
-                stack.pop();
-                if (entry.parentRecord)
-                    entry.parentRecord._visibleChildrenCount = recordsInWindow.length - entry.windowLengthBeforeChildrenTraversal;
+        if (this._verticalOverview)
+            return;
+        var recordsInWindow = this._presentationModel.filteredRecords();
+        var recordToReveal;
+        for (var i = 0; i < recordsInWindow.length; ++i) {
+            var record = recordsInWindow[i];
+            if (record.containsTime(time)) {
+                recordToReveal = record;
+                break;
             }
+            // If there is no record containing the time than use the latest one before that time.
+            if (!recordToReveal || record.endTime < time && recordToReveal.endTime < record.endTime)
+                recordToReveal = record;
         }
 
-        return recordsInWindow;
+        // The record ends before the window left bound so scroll to the top.
+        if (!recordToReveal) {
+            this._containerElement.scrollTop = 0;
+            return;
+        }
+
+        // Expand all ancestors.
+        for (var parent = recordToReveal.parent; parent !== this._rootRecord(); parent = parent.parent)
+            parent.collapsed = false;
+        var index = recordsInWindow.indexOf(recordToReveal);
+        this._containerElement.scrollTop = index * WebInspector.TimelinePanel.rowHeight;
     },
 
     _refreshRecords: function(updateBoundaries)
     {
-        var recordsInWindow = this._filterRecords();
+        var recordsInWindow = this._presentationModel.filteredRecords();
 
         // Calculate the visible area.
         this._scrollTop = this._containerElement.scrollTop;
@@ -802,7 +637,7 @@ WebInspector.TimelinePanel.prototype = {
             var isEven = !(i % 2);
 
             if (i < startIndex) {
-                var lastChildIndex = i + record._visibleChildrenCount;
+                var lastChildIndex = i + record.visibleChildrenCount;
                 if (lastChildIndex >= startIndex && lastChildIndex < endIndex) {
                     var expandElement = new WebInspector.TimelineExpandableElement(this._expandElements);
                     expandElement._update(record, i, this._calculator.computeBarGraphWindowPosition(record, width - this._expandOffset));
@@ -841,10 +676,16 @@ WebInspector.TimelinePanel.prototype = {
         this._itemsGraphsElement.appendChild(this._expandElements);
         this.splitView.sidebarResizerElement.style.height = this.sidebarElement.clientHeight + "px";
         // Reserve some room for expand / collapse controls to the left for records that start at 0ms.
-        var timelinePaddingLeft = this._calculator.windowLeft === 0 ? this._expandOffset : 0;
         if (updateBoundaries)
-            this._timelineGrid.updateDividers(true, this._calculator, timelinePaddingLeft);
+            this._timelineGrid.updateDividers(true, this._calculator, this.timelinePaddingLeft);
         this._adjustScrollPosition((recordsInWindow.length + 1) * rowHeight);
+
+        return recordsInWindow.length;
+    },
+
+    get timelinePaddingLeft()
+    {
+        return !this._overviewPane.windowLeft() ? this._expandOffset : 0;
     },
 
     _adjustScrollPosition: function(totalHeight)
@@ -893,7 +734,7 @@ WebInspector.TimelinePanel.prototype = {
     _showPopover: function(anchor, popover)
     {
         var record = anchor.row._record;
-        popover.show(record._generatePopupContent(this._calculator, this._presentationModel.categories), anchor);
+        popover.show(record.generatePopupContent(this._calculator), anchor);
     },
 
     _closeRecordDetails: function()
@@ -906,31 +747,21 @@ WebInspector.TimelinePanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
 /**
  * @constructor
+ * @param {WebInspector.TimelinePresentationModel} presentationModel
  */
-WebInspector.TimelineCategory = function(name, title, color)
-{
-    this.name = name;
-    this.title = title;
-    this.color = color;
-}
-
-/**
- * @constructor
- */
-WebInspector.TimelineCalculator = function()
+WebInspector.TimelineCalculator = function(presentationModel)
 {
-    this.reset();
-    this.windowLeft = 0.0;
-    this.windowRight = 1.0;
+    this._presentationModel = presentationModel;
 }
 
 WebInspector.TimelineCalculator.prototype = {
     computeBarGraphPercentages: function(record)
     {
         var start = (record.startTime - this.minimumBoundary) / this.boundarySpan * 100;
-        var end = (record.startTime + record._selfTime - this.minimumBoundary) / this.boundarySpan * 100;
-        var endWithChildren = (record._lastChildEndTime - this.minimumBoundary) / this.boundarySpan * 100;
-        return {start: start, end: end, endWithChildren: endWithChildren};
+        var end = (record.startTime + record.selfTime - this.minimumBoundary) / this.boundarySpan * 100;
+        var endWithChildren = (record.lastChildEndTime - this.minimumBoundary) / this.boundarySpan * 100;
+        var cpuWidth = record.cpuTime / this.boundarySpan * 100;
+        return {start: start, end: end, endWithChildren: endWithChildren, cpuWidth: cpuWidth};
     },
 
     computeBarGraphWindowPosition: function(record, clientWidth)
@@ -943,113 +774,27 @@ WebInspector.TimelineCalculator.prototype = {
         var left = percentages.start / 100 * workingArea;
         var width = (percentages.end - percentages.start) / 100 * workingArea + minWidth;
         var widthWithChildren =  (percentages.endWithChildren - percentages.start) / 100 * workingArea;
+        var cpuWidth = percentages.cpuWidth / 100 * workingArea + minWidth;
         if (percentages.endWithChildren > percentages.end)
             widthWithChildren += borderWidth + minWidth;
-        return {left: left, width: width, widthWithChildren: widthWithChildren};
+        return {left: left, width: width, widthWithChildren: widthWithChildren, cpuWidth: cpuWidth};
     },
 
-    calculateWindow: function()
+    setWindow: function(minimumBoundary, maximumBoundary)
     {
-        this.minimumBoundary = this._absoluteMinimumBoundary + this.windowLeft * (this._absoluteMaximumBoundary - this._absoluteMinimumBoundary);
-        this.maximumBoundary = this._absoluteMinimumBoundary + this.windowRight * (this._absoluteMaximumBoundary - this._absoluteMinimumBoundary);
+        this.minimumBoundary = minimumBoundary;
+        this.maximumBoundary = maximumBoundary;
         this.boundarySpan = this.maximumBoundary - this.minimumBoundary;
     },
 
-    reset: function()
-    {
-        this._absoluteMinimumBoundary = -1;
-        this._absoluteMaximumBoundary = -1;
-    },
-
-    updateBoundaries: function(record)
-    {
-        var lowerBound = record.startTime;
-        if (this._absoluteMinimumBoundary === -1 || lowerBound < this._absoluteMinimumBoundary)
-            this._absoluteMinimumBoundary = lowerBound;
-
-        const minimumTimeFrame = 0.1;
-        const minimumDeltaForZeroSizeEvents = 0.01;
-        var upperBound = Math.max(record._lastChildEndTime + minimumDeltaForZeroSizeEvents, lowerBound + minimumTimeFrame);
-        if (this._absoluteMaximumBoundary === -1 || upperBound > this._absoluteMaximumBoundary)
-            this._absoluteMaximumBoundary = upperBound;
-    },
-
-    formatValue: function(value)
+    formatTime: function(value)
     {
-        return Number.secondsToString(value + this.minimumBoundary - this._absoluteMinimumBoundary);
+        return Number.secondsToString(value + this.minimumBoundary - this._presentationModel.minimumRecordTime());
     }
 }
 
 /**
  * @constructor
- * @extends WebInspector.TimelineCalculator
- */
-WebInspector.TimelineStartAtZeroCalculator = function()
-{
-    this.reset();
-    this.windowLeft = 0.0;
-    this.windowRight = 1.0;
-}
-
-WebInspector.TimelineStartAtZeroCalculator.prototype = {
-    computeBarGraphPercentages: function(record)
-    {
-        var scale = 100 / this.maximumBoundary;
-        return {
-            start: record._initiatorOffset * scale,
-            end: (record._initiatorOffset + record.endTime - record.startTime) * scale,
-            endWithChildren: (record._initiatorOffset + record._lastChildEndTime - record.startTime) * scale
-        };
-    },
-
-    computeBarGraphWindowPosition: function(record, clientWidth)
-    {
-        const minWidth = 5;
-        const borderWidth = 4;
-        var workingArea = clientWidth - minWidth - borderWidth;
-        var percentages = this.computeBarGraphPercentages(record);
-        var left = percentages.start / 100 * workingArea;
-        var width = (percentages.end - percentages.start) / 100 * workingArea + minWidth;
-        var widthWithChildren =  (percentages.endWithChildren - percentages.start) / 100 * workingArea;
-        if (percentages.endWithChildren > percentages.end)
-            widthWithChildren += borderWidth + minWidth;
-
-        return {left: left, width: width, widthWithChildren: widthWithChildren};
-    },
-
-    calculateWindow: function()
-    {
-        this.minimumBoundary = this._absoluteMinimumBoundary;
-        this.maximumBoundary = this._absoluteMaximumBoundary * 1.05;
-        this.boundarySpan = this.maximumBoundary >= 0 ? this.maximumBoundary : 0;
-    },
-
-    reset: function()
-    {
-        this._absoluteMinimumBoundary = -1;
-        this._absoluteMaximumBoundary = -1;
-    },
-
-    updateBoundaries: function(record)
-    {
-        var lowerBound = record.startTime;
-        if (this._absoluteMinimumBoundary === -1 || lowerBound < this._absoluteMinimumBoundary)
-            this._absoluteMinimumBoundary = lowerBound;
-
-        const minimumTimeFrame = 0.001;
-        var upperBound = Math.max(record.endTime - record.startTime, minimumTimeFrame);
-        if (this._absoluteMaximumBoundary === -1 || upperBound > this._absoluteMaximumBoundary)
-            this._absoluteMaximumBoundary = upperBound;
-    },
-
-    formatValue: function(value)
-    {
-        return Number.secondsToString(value, true);
-    }
-};
-
-/**
- * @constructor
  */
 WebInspector.TimelineRecordListRow = function()
 {
@@ -1122,6 +867,11 @@ WebInspector.TimelineRecordGraphRow = function(graphContainer, scheduleRefresh)
     this._barWithChildrenElement.row = this;
     this._barAreaElement.appendChild(this._barWithChildrenElement);
 
+    this._barCpuElement = document.createElement("div");
+    this._barCpuElement.className = "timeline-graph-bar cpu"
+    this._barCpuElement.row = this;
+    this._barAreaElement.appendChild(this._barCpuElement);
+
     this._barElement = document.createElement("div");
     this._barElement.className = "timeline-graph-bar";
     this._barElement.row = this;
@@ -1143,6 +893,8 @@ WebInspector.TimelineRecordGraphRow.prototype = {
         this._barWithChildrenElement.style.width = barPosition.widthWithChildren + "px";
         this._barElement.style.left = barPosition.left + expandOffset + "px";
         this._barElement.style.width =  barPosition.width + "px";
+        this._barCpuElement.style.left = barPosition.left + expandOffset + "px";
+        this._barCpuElement.style.width = barPosition.cpuWidth + "px";
         this._expandElement._update(record, index, barPosition);
     },
 
@@ -1159,330 +911,23 @@ WebInspector.TimelineRecordGraphRow.prototype = {
     }
 }
 
-/**
- * @constructor
- */
-WebInspector.TimelinePanel.FormattedRecord = function(record, parentRecord, panel, scriptDetails)
-{
-    this._panel = panel;
-    var recordTypes = WebInspector.TimelineAgent.RecordType;
-    var style = panel._recordStyles[record.type];
-    this.parent = parentRecord;
-    if (parentRecord)
-        parentRecord.children.push(this);
-    this.category = style.category;
-    this.title = style.title;
-    this.startTime = record.startTime / 1000;
-    this.data = record.data;
-    this.type = record.type;
-    this.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : this.startTime;
-    this._selfTime = this.endTime - this.startTime;
-    this._lastChildEndTime = this.endTime;
-    this._initiatorOffset = (parentRecord && parentRecord !== panel._rootRecord) ?
-        parentRecord._initiatorOffset + this.startTime - parentRecord.startTime : 0;
-
-    if (record.stackTrace && record.stackTrace.length)
-        this.stackTrace = record.stackTrace;
-    this.totalHeapSize = record.totalHeapSize;
-    this.usedHeapSize = record.usedHeapSize;
-    if (record.data && record.data["url"])
-        this.url = record.data["url"];
-    if (scriptDetails) {
-        this.scriptName = scriptDetails.scriptName;
-        this.scriptLine = scriptDetails.scriptLine;
-    }
-    // Make resource receive record last since request was sent; make finish record last since response received.
-    if (record.type === recordTypes.ResourceSendRequest) {
-        panel._sendRequestRecords[record.data["requestId"]] = this;
-    } else if (record.type === recordTypes.ScheduleResourceRequest) {
-        panel._scheduledResourceRequests[record.data["url"]] = this;
-    } else if (record.type === recordTypes.ResourceReceiveResponse) {
-        var sendRequestRecord = panel._sendRequestRecords[record.data["requestId"]];
-        if (sendRequestRecord) { // False if we started instrumentation in the middle of request.
-            this.url = sendRequestRecord.url;
-            // Now that we have resource in the collection, recalculate details in order to display short url.
-            sendRequestRecord._refreshDetails();
-            if (sendRequestRecord.parent !== panel._rootRecord && sendRequestRecord.parent.type === recordTypes.ScheduleResourceRequest)
-                sendRequestRecord.parent._refreshDetails();
-        }
-    } else if (record.type === recordTypes.ResourceReceivedData || record.type === recordTypes.ResourceFinish) {
-        var sendRequestRecord = panel._sendRequestRecords[record.data["requestId"]];
-        if (sendRequestRecord) // False for main resource.
-            this.url = sendRequestRecord.url;
-    } else if (record.type === recordTypes.TimerInstall) {
-        this.timeout = record.data["timeout"];
-        this.singleShot = record.data["singleShot"];
-        panel._timerRecords[record.data["timerId"]] = this;
-    } else if (record.type === recordTypes.TimerFire) {
-        var timerInstalledRecord = panel._timerRecords[record.data["timerId"]];
-        if (timerInstalledRecord) {
-            this.callSiteStackTrace = timerInstalledRecord.stackTrace;
-            this.timeout = timerInstalledRecord.timeout;
-            this.singleShot = timerInstalledRecord.singleShot;
-        }
-    } else if (record.type === recordTypes.RequestAnimationFrame) {
-        panel._requestAnimationFrameRecords[record.data["id"]] = this;
-    } else if (record.type === recordTypes.FireAnimationFrame) {
-        var requestAnimationRecord = panel._requestAnimationFrameRecords[record.data["id"]];
-        if (requestAnimationRecord)
-            this.callSiteStackTrace = requestAnimationRecord.stackTrace;
-    }
-    this._refreshDetails();
-}
-
-WebInspector.TimelinePanel.FormattedRecord.prototype = {
-    isLong: function()
-    {
-        return (this._lastChildEndTime - this.startTime) > WebInspector.TimelinePanel.shortRecordThreshold;
-    },
-
-    get children()
-    {
-        if (!this._children)
-            this._children = [];
-        return this._children;
-    },
-
-    _generateAggregatedInfo: function()
-    {
-        var cell = document.createElement("span");
-        cell.className = "timeline-aggregated-info";
-        for (var index in this._aggregatedStats) {
-            var label = document.createElement("div");
-            label.className = "timeline-aggregated-category timeline-" + index;
-            cell.appendChild(label);
-            var text = document.createElement("span");
-            text.textContent = Number.secondsToString(this._aggregatedStats[index], true);
-            cell.appendChild(text);
-        }
-        return cell;
-    },
-
-    _generatePopupContent: function(calculator, categories)
-    {
-        var contentHelper = new WebInspector.TimelinePanel.PopupContentHelper(this.title, this._panel);
-
-        if (this._children && this._children.length) {
-            contentHelper._appendTextRow(WebInspector.UIString("Self Time"), Number.secondsToString(this._selfTime, true));
-            contentHelper._appendElementRow(WebInspector.UIString("Aggregated Time"), this._generateAggregatedInfo());
-        }
-        var text = WebInspector.UIString("%s (at %s)", Number.secondsToString(this._lastChildEndTime - this.startTime, true),
-            calculator.formatValue(this.startTime - calculator.minimumBoundary));
-        contentHelper._appendTextRow(WebInspector.UIString("Duration"), text);
-
-        const recordTypes = WebInspector.TimelineAgent.RecordType;
-
-        switch (this.type) {
-            case recordTypes.GCEvent:
-                contentHelper._appendTextRow(WebInspector.UIString("Collected"), Number.bytesToString(this.data["usedHeapSizeDelta"]));
-                break;
-            case recordTypes.TimerInstall:
-            case recordTypes.TimerFire:
-            case recordTypes.TimerRemove:
-                contentHelper._appendTextRow(WebInspector.UIString("Timer ID"), this.data["timerId"]);
-                if (typeof this.timeout === "number") {
-                    contentHelper._appendTextRow(WebInspector.UIString("Timeout"), Number.secondsToString(this.timeout / 1000));
-                    contentHelper._appendTextRow(WebInspector.UIString("Repeats"), !this.singleShot);
-                }
-                break;
-            case recordTypes.FireAnimationFrame:
-                contentHelper._appendTextRow(WebInspector.UIString("Callback ID"), this.data["id"]);
-                break;
-            case recordTypes.FunctionCall:
-                contentHelper._appendLinkRow(WebInspector.UIString("Location"), this.scriptName, this.scriptLine);
-                break;
-            case recordTypes.ScheduleResourceRequest:
-            case recordTypes.ResourceSendRequest:
-            case recordTypes.ResourceReceiveResponse:
-            case recordTypes.ResourceReceivedData:
-            case recordTypes.ResourceFinish:
-                contentHelper._appendLinkRow(WebInspector.UIString("Resource"), this.url);
-                if (this.data["requestMethod"])
-                    contentHelper._appendTextRow(WebInspector.UIString("Request Method"), this.data["requestMethod"]);
-                if (typeof this.data["statusCode"] === "number")
-                    contentHelper._appendTextRow(WebInspector.UIString("Status Code"), this.data["statusCode"]);
-                if (this.data["mimeType"])
-                    contentHelper._appendTextRow(WebInspector.UIString("MIME Type"), this.data["mimeType"]);
-                break;
-            case recordTypes.EvaluateScript:
-                if (this.data && this.url)
-                    contentHelper._appendLinkRow(WebInspector.UIString("Script"), this.url, this.data["lineNumber"]);
-                break;
-            case recordTypes.Paint:
-                contentHelper._appendTextRow(WebInspector.UIString("Location"), WebInspector.UIString("(%d, %d)", this.data["x"], this.data["y"]));
-                contentHelper._appendTextRow(WebInspector.UIString("Dimensions"), WebInspector.UIString("%d × %d", this.data["width"], this.data["height"]));
-            case recordTypes.RecalculateStyles: // We don't want to see default details.
-                break;
-            default:
-                if (this.details)
-                    contentHelper._appendTextRow(WebInspector.UIString("Details"), this.details);
-                break;
-        }
-
-        if (this.scriptName && this.type !== recordTypes.FunctionCall)
-            contentHelper._appendLinkRow(WebInspector.UIString("Function Call"), this.scriptName, this.scriptLine);
-
-        if (this.usedHeapSize)
-            contentHelper._appendTextRow(WebInspector.UIString("Used Heap Size"), WebInspector.UIString("%s of %s", Number.bytesToString(this.usedHeapSize), Number.bytesToString(this.totalHeapSize)));
-
-        if (this.callSiteStackTrace && this.callSiteStackTrace.length)
-            contentHelper._appendStackTrace(WebInspector.UIString("Call Site stack"), this.callSiteStackTrace);
-
-        if (this.stackTrace)
-            contentHelper._appendStackTrace(WebInspector.UIString("Call Stack"), this.stackTrace);
-
-        return contentHelper._contentTable;
-    },
-
-    _refreshDetails: function()
-    {
-        this.details = this._getRecordDetails();
-    },
-
-    _getRecordDetails: function()
-    {
-        switch (this.type) {
-            case WebInspector.TimelineAgent.RecordType.GCEvent:
-                return WebInspector.UIString("%s collected", Number.bytesToString(this.data["usedHeapSizeDelta"]));
-            case WebInspector.TimelineAgent.RecordType.TimerFire:
-                return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : this.data["timerId"];
-            case WebInspector.TimelineAgent.RecordType.FunctionCall:
-                return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : null;
-            case WebInspector.TimelineAgent.RecordType.FireAnimationFrame:
-                return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : this.data["id"];
-            case WebInspector.TimelineAgent.RecordType.EventDispatch:
-                return this.data ? this.data["type"] : null;
-            case WebInspector.TimelineAgent.RecordType.Paint:
-                return this.data["width"] + "\u2009\u00d7\u2009" + this.data["height"];
-            case WebInspector.TimelineAgent.RecordType.TimerInstall:
-            case WebInspector.TimelineAgent.RecordType.TimerRemove:
-                return this.stackTrace ? this._panel._linkifyCallFrame(this.stackTrace[0]) : this.data["timerId"];
-            case WebInspector.TimelineAgent.RecordType.RequestAnimationFrame:
-            case WebInspector.TimelineAgent.RecordType.CancelAnimationFrame:
-                return this.stackTrace ? this._panel._linkifyCallFrame(this.stackTrace[0]) : this.data["id"];
-            case WebInspector.TimelineAgent.RecordType.ParseHTML:
-            case WebInspector.TimelineAgent.RecordType.RecalculateStyles:
-                return this.stackTrace ? this._panel._linkifyCallFrame(this.stackTrace[0]) : null;
-            case WebInspector.TimelineAgent.RecordType.EvaluateScript:
-                return this.url ? this._panel._linkifyLocation(this.url, this.data["lineNumber"], 0) : null;
-            case WebInspector.TimelineAgent.RecordType.XHRReadyStateChange:
-            case WebInspector.TimelineAgent.RecordType.XHRLoad:
-            case WebInspector.TimelineAgent.RecordType.ScheduleResourceRequest:
-            case WebInspector.TimelineAgent.RecordType.ResourceSendRequest:
-            case WebInspector.TimelineAgent.RecordType.ResourceReceivedData:
-            case WebInspector.TimelineAgent.RecordType.ResourceReceiveResponse:
-            case WebInspector.TimelineAgent.RecordType.ResourceFinish:
-                return WebInspector.displayNameForURL(this.url);
-            case WebInspector.TimelineAgent.RecordType.TimeStamp:
-                return this.data["message"];
-            default:
-                return null;
-        }
-    },
-
-    _calculateAggregatedStats: function(categories)
-    {
-        this._aggregatedStats = {};
-        for (var category in categories)
-            this._aggregatedStats[category] = 0;
-
-        if (this._children) {
-            for (var index = this._children.length; index; --index) {
-                var child = this._children[index - 1];
-                for (var category in categories)
-                    this._aggregatedStats[category] += child._aggregatedStats[category];
-            }
-        }
-        this._aggregatedStats[this.category.name] += this._selfTime;
-    },
-
-    get aggregatedStats()
-    {
-        return this._aggregatedStats;
-    }
-}
-
-/**
- * @constructor
- */
-WebInspector.TimelinePanel.PopupContentHelper = function(title, panel)
+WebInspector.TimelinePanel.forAllRecords = function(recordsArray, callback)
 {
-    this._panel = panel;
-    this._contentTable = document.createElement("table");;
-    var titleCell = this._createCell(WebInspector.UIString("%s - Details", title), "timeline-details-title");
-    titleCell.colSpan = 2;
-    var titleRow = document.createElement("tr");
-    titleRow.appendChild(titleCell);
-    this._contentTable.appendChild(titleRow);
-}
-
-WebInspector.TimelinePanel.PopupContentHelper.prototype = {
-    /**
-     * @param {string=} styleName
-     */
-    _createCell: function(content, styleName)
-    {
-        var text = document.createElement("label");
-        text.appendChild(document.createTextNode(content));
-        var cell = document.createElement("td");
-        cell.className = "timeline-details";
-        if (styleName)
-            cell.className += " " + styleName;
-        cell.textContent = content;
-        return cell;
-    },
-
-    _appendTextRow: function(title, content)
-    {
-        var row = document.createElement("tr");
-        row.appendChild(this._createCell(title, "timeline-details-row-title"));
-        row.appendChild(this._createCell(content, "timeline-details-row-data"));
-        this._contentTable.appendChild(row);
-    },
-
-    /**
-     * @param {string=} titleStyle
-     */
-    _appendElementRow: function(title, content, titleStyle)
-    {
-        var row = document.createElement("tr");
-        var titleCell = this._createCell(title, "timeline-details-row-title");
-        if (titleStyle)
-            titleCell.addStyleClass(titleStyle);
-        row.appendChild(titleCell);
-        var cell = document.createElement("td");
-        cell.className = "timeline-details";
-        cell.appendChild(content);
-        row.appendChild(cell);
-        this._contentTable.appendChild(row);
-    },
-
-    /**
-     * @param {number=} scriptLine
-     */
-    _appendLinkRow: function(title, scriptName, scriptLine)
-    {
-        var link = this._panel._linkifyLocation(scriptName, scriptLine, 0, "timeline-details");
-        this._appendElementRow(title, link);
-    },
-
-    _appendStackTrace: function(title, stackTrace)
-    {
-        this._appendTextRow("", "");
-        var framesTable = document.createElement("table");
-        for (var i = 0; i < stackTrace.length; ++i) {
-            var stackFrame = stackTrace[i];
-            var row = document.createElement("tr");
-            row.className = "timeline-details";
-            row.appendChild(this._createCell(stackFrame.functionName ? stackFrame.functionName : WebInspector.UIString("(anonymous function)"), "timeline-function-name"));
-            row.appendChild(this._createCell(" @ "));
-            var linkCell = document.createElement("td");
-            var urlElement = this._panel._linkifyCallFrame(stackFrame);
-            linkCell.appendChild(urlElement);
-            row.appendChild(linkCell);
-            framesTable.appendChild(row);
-        }
-        this._appendElementRow(title, framesTable, "timeline-stacktrace-title");
+    if (!recordsArray)
+        return;
+    var stack = [{array: recordsArray, index: 0}];
+    while (stack.length) {
+        var entry = stack[stack.length - 1];
+        var records = entry.array;
+        if (entry.index < records.length) {
+             var record = records[entry.index];
+             if (callback(record))
+                 return;
+             if (record.children)
+                 stack.push({array: record.children, index: 0});
+             ++entry.index;
+        } else
+            stack.pop();
     }
 }
 
@@ -1505,12 +950,12 @@ WebInspector.TimelineExpandableElement.prototype = {
     _update: function(record, index, barPosition)
     {
         const rowHeight = WebInspector.TimelinePanel.rowHeight;
-        if (record._visibleChildrenCount || record._invisibleChildrenCount) {
+        if (record.visibleChildrenCount || record.invisibleChildrenCount) {
             this._element.style.top = index * rowHeight + "px";
             this._element.style.left = barPosition.left + "px";
             this._element.style.width = Math.max(12, barPosition.width + 25) + "px";
             if (!record.collapsed) {
-                this._element.style.height = (record._visibleChildrenCount + 1) * rowHeight + "px";
+                this._element.style.height = (record.visibleChildrenCount + 1) * rowHeight + "px";
                 this._element.addStyleClass("timeline-expandable-expanded");
                 this._element.removeStyleClass("timeline-expandable-collapsed");
             } else {
@@ -1531,245 +976,38 @@ WebInspector.TimelineExpandableElement.prototype = {
 
 /**
  * @constructor
- * @extends {WebInspector.Object}
- */
-WebInspector.TimelineModel = function()
-{
-    this._records = [];
-    this._collectionEnabled = false;
-
-    WebInspector.timelineManager.addEventListener(WebInspector.TimelineManager.EventTypes.TimelineEventRecorded, this._onRecordAdded, this);
-}
-
-WebInspector.TimelineModel.Events = {
-    RecordAdded: "RecordAdded",
-    RecordsCleared: "RecordsCleared"
-}
-
-WebInspector.TimelineModel.prototype = {
-    startRecord: function()
-    {
-        if (this._collectionEnabled)
-            return;
-        this._reset();
-        WebInspector.timelineManager.start(30);
-        this._collectionEnabled = true;
-    },
-
-    stopRecord: function()
-    {
-        if (!this._collectionEnabled)
-            return;
-        WebInspector.timelineManager.stop();
-        this._collectionEnabled = false;
-    },
-
-    get records()
-    {
-        return this._records;
-    },
-
-    _onRecordAdded: function(event)
-    {
-        if (this._collectionEnabled)
-            this._addRecord(event.data);
-    },
-
-    _addRecord: function(record)
-    {
-        this._records.push(record);
-        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordAdded, record);
-    },
-
-    _loadNextChunk: function(data, index)
-    {
-        for (var i = 0; i < 20 && index < data.length; ++i, ++index)
-            this._addRecord(data[index]);
-
-        if (index !== data.length)
-            setTimeout(this._loadNextChunk.bind(this, data, index), 0);
-    },
-
-    _loadFromFile: function(file)
-    {
-        function onLoad(e)
-        {
-            var data = JSON.parse(e.target.result);
-            this._reset();
-            this._loadNextChunk(data, 1);
-        }
-
-        function onError(e)
-        {
-            switch(e.target.error.code) {
-            case e.target.error.NOT_FOUND_ERR:
-                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: File "%s" not found.', file.name));
-            break;
-            case e.target.error.NOT_READABLE_ERR:
-                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: File "%s" is not readable', file.name));
-            break;
-            case e.target.error.ABORT_ERR:
-                break;
-            default:
-                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: An error occurred while reading the file "%s"', file.name));
-            }
-        }
-
-        var reader = new FileReader();
-        reader.onload = onLoad.bind(this);
-        reader.onerror = onError;
-        reader.readAsText(file);
-    },
-
-    _saveToFile: function()
-    {
-        var records = ['[' + JSON.stringify(new String(window.navigator.appVersion))];
-        for (var i = 0; i < this._records.length; ++i)
-            records.push(JSON.stringify(this._records[i]));
-
-        records[records.length - 1] = records[records.length - 1] + "]";
-
-        var now = new Date();
-        var suggestedFileName = "TimelineRawData-" + now.toISO8601Compact() + ".json";
-        InspectorFrontendHost.saveAs(suggestedFileName, records.join(",\n"));
-    },
-
-    _reset: function()
-    {
-        this.stopRecord();
-        this._records = [];
-        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordsCleared);
-    }
-}
-
-WebInspector.TimelineModel.prototype.__proto__ = WebInspector.Object.prototype;
-
-/**
- * @constructor
- * @extends {WebInspector.Object}
- */
-WebInspector.TimelinePresentationModel = function()
-{
-    this._categories = {};
-    this.reset();
-}
-
-WebInspector.TimelinePresentationModel.Events = {
-    WindowChanged: "WindowChanged",
-    CategoryVisibilityChanged: "CategoryVisibilityChanged"
-}
-
-WebInspector.TimelinePresentationModel.prototype = {
-    reset: function()
-    {
-        this.windowLeft = 0.0;
-        this.windowRight = 1.0;
-        this.windowIndexLeft = 0;
-        this.windowIndexRight = null;
-    },
-
-    get categories()
-    {
-        return this._categories;
-    },
-
-    /**
-     * @param {WebInspector.TimelineCategory} category
-     */
-    addCategory: function(category)
-    {
-        this._categories[category.name] = category;
-    },
-
-    /**
-     * @param {number} left
-     * @param {number} right
-     */
-    setWindowPosition: function(left, right)
-    {
-        this.windowLeft = left;
-        this.windowRight = right;
-        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.WindowChanged);
-    },
-
-    /**
-     * @param {number} left
-     * @param {?number} right
-     */
-    setWindowIndices: function(left, right)
-    {
-        this.windowIndexLeft = left;
-        this.windowIndexRight = right;
-        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.WindowChanged);
-    },
-
-    /**
-     * @param {WebInspector.TimelineCategory} category
-     * @param {boolean} visible
-     */
-    setCategoryVisibility: function(category, visible)
-    {
-        category.hidden = !visible;
-        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, category);
-    }
-}
-
-/**
- * @constructor
- * @param {WebInspector.TimelineCalculator} calculator
- * @param {boolean} showShortEvents
+ * @implements {WebInspector.TimelinePresentationModel.Filter}
  */
-WebInspector.TimelineRecordFilter = function(calculator, showShortEvents)
+WebInspector.TimelineCategoryFilter = function()
 {
-    this._calculator = calculator;
-    this._showShortEvents = showShortEvents;
 }
 
-WebInspector.TimelineRecordFilter.prototype = {
+WebInspector.TimelineCategoryFilter.prototype = {
     /**
-     * @param {WebInspector.TimelinePanel.FormattedRecord} record
+     * @param {WebInspector.TimelinePresentationModel.Record} record
      */
     accept: function(record)
     {
-        if (record.category.hidden)
-            return false;
-        if (!this._showShortEvents && !record.isLong())
-            return false;
-        var percentages = this._calculator.computeBarGraphPercentages(record);
-        return percentages.start <= 100 && percentages.endWithChildren >= 0;
+        return !record.category.hidden && record.type !== WebInspector.TimelineModel.RecordType.BeginFrame;
     }
 }
 
 /**
+ * @param {WebInspector.TimelinePanel} panel
  * @constructor
- * @param {WebInspector.TimelinePresentationModel} model
- * @param {Object} rootRecord
- * @param {boolean} showShortEvents
+ * @implements {WebInspector.TimelinePresentationModel.Filter}
  */
-WebInspector.TimelineStartAtZeroRecordFilter = function(model, rootRecord, showShortEvents)
+WebInspector.TimelineIsLongFilter = function(panel)
 {
-    this._windowIndexLeft = model.windowIndexLeft;
-    this._windowIndexRight = model.windowIndexRight;
-    this._rootRecord = rootRecord;
-    this._topLevelRecordIndex = 0;
-    this._showShortEvents = showShortEvents;
+    this._panel = panel;
 }
 
-WebInspector.TimelineStartAtZeroRecordFilter.prototype = {
+WebInspector.TimelineIsLongFilter.prototype = {
     /**
-     * @param {WebInspector.TimelinePanel.FormattedRecord} record
+     * @param {WebInspector.TimelinePresentationModel.Record} record
      */
     accept: function(record)
     {
-        if (record.category.hidden)
-            return false;
-        if (record.parent === this._rootRecord)
-            ++this._topLevelRecordIndex;
-        if (!this._showShortEvents && !record.isLong())
-            return false;
-        return this._topLevelRecordIndex > this._windowIndexLeft &&
-            (typeof this._windowIndexRight !== "number" || this._topLevelRecordIndex <= this._windowIndexRight);
+        return this._panel._showShortEvents || record.isLong();
     }
 }
-
-WebInspector.TimelinePresentationModel.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/TimelinePresentationModel.js b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
new file mode 100644
index 000000000..5ef33cf26
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
@@ -0,0 +1,727 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.TimelinePresentationModel = function()
+{
+    this._categories = {};
+    this._addCategory(new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"));
+    this._addCategory(new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"));
+    this._addCategory(new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)"));
+    this._linkifier = WebInspector.debuggerPresentationModel.createLinkifier();
+    this._glueRecords = false;
+    this._filters = [];
+    this.reset();
+}
+
+WebInspector.TimelinePresentationModel.shortRecordThreshold = 0.015;
+
+WebInspector.TimelinePresentationModel.prototype = {
+    /**
+     * @param {WebInspector.TimelinePresentationModel.Filter} filter
+     */
+    addFilter: function(filter)
+    {
+        this._filters.push(filter);
+    },
+
+    rootRecord: function()
+    {
+        return this._rootRecord;
+    },
+
+    reset: function()
+    {
+        this._linkifier.reset();
+        this._rootRecord = new WebInspector.TimelinePresentationModel.Record(this, { type: WebInspector.TimelineModel.RecordType.Root }, null, null);
+        this._sendRequestRecords = {};
+        this._scheduledResourceRequests = {};
+        this._timerRecords = {};
+        this._requestAnimationFrameRecords = {};
+        this._minimumRecordTime = -1;
+        this._maximumRecordTime = -1;
+    },
+
+    minimumRecordTime: function()
+    {
+        return this._minimumRecordTime;
+    },
+
+    maximumRecordTime: function()
+    {
+        return this._maximumRecordTime;
+    },
+
+    addRecord: function(record, parentRecord)
+    {
+        var connectedToOldRecord = false;
+        var recordTypes = WebInspector.TimelineModel.RecordType;
+
+        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad)
+            parentRecord = null; // No bar entry for load events.
+        else {
+            var newParentRecord = this._findParentRecord(record);
+            if (newParentRecord) {
+                parentRecord = newParentRecord;
+                connectedToOldRecord = true;
+            }
+        }
+
+        var children = record.children;
+        var scriptDetails;
+        if (record.data && record.data["scriptName"]) {
+            scriptDetails = {
+                scriptName: record.data["scriptName"],
+                scriptLine: record.data["scriptLine"]
+            }
+        };
+
+        if ((record.type === recordTypes.TimerFire || record.type === recordTypes.FireAnimationFrame) && children && children.length) {
+            var childRecord = children[0];
+            if (childRecord.type === recordTypes.FunctionCall) {
+                scriptDetails = {
+                    scriptName: childRecord.data["scriptName"],
+                    scriptLine: childRecord.data["scriptLine"]
+                };
+                children = childRecord.children.concat(children.slice(1));
+            }
+        }
+
+        var formattedRecord = new WebInspector.TimelinePresentationModel.Record(this, record, parentRecord, scriptDetails);
+        this._updateBoundaries(formattedRecord);    
+
+        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad)
+            return formattedRecord;
+
+        formattedRecord.collapsed = (parentRecord === this._rootRecord);
+
+        var childrenCount = children ? children.length : 0;
+        for (var i = 0; i < childrenCount; ++i)
+            this.addRecord(children[i], formattedRecord);
+
+        formattedRecord.calculateAggregatedStats(this._categories);
+
+        if (connectedToOldRecord) {
+            record = formattedRecord;
+            do {
+                var parent = record.parent;
+                if (parent.lastChildEndTime < record.lastChildEndTime)
+                    parent.lastChildEndTime = record.lastChildEndTime;
+                for (var category in formattedRecord.aggregatedStats)
+                    parent.aggregatedStats[category] += formattedRecord.aggregatedStats[category];
+                record = parent;
+            } while (record.parent);
+        } else {
+            if (parentRecord !== this._rootRecord)
+                parentRecord.selfTime -= formattedRecord.endTime - formattedRecord.startTime;
+        }
+        return formattedRecord;
+    },
+
+    _updateBoundaries: function(formattedRecord)
+    {
+        if (this._minimumRecordTime === -1 || formattedRecord.startTime < this._minimumRecordTime)
+            this._minimumRecordTime = formattedRecord.startTime;
+        if (this._maximumRecordTime === -1 || formattedRecord.endTime > this._maximumRecordTime)
+            this._maximumRecordTime = formattedRecord.endTime;
+    },
+
+    _findParentRecord: function(record)
+    {
+        if (!this._glueRecords)
+            return null;
+        var recordTypes = WebInspector.TimelineModel.RecordType;
+        var parentRecord;
+        if (record.type === recordTypes.ResourceReceiveResponse ||
+            record.type === recordTypes.ResourceFinish ||
+            record.type === recordTypes.ResourceReceivedData)
+            parentRecord = this._sendRequestRecords[record.data["requestId"]];
+        else if (record.type === recordTypes.TimerFire)
+            parentRecord = this._timerRecords[record.data["timerId"]];
+        else if (record.type === recordTypes.ResourceSendRequest)
+            parentRecord = this._scheduledResourceRequests[record.data["url"]];
+        else if (record.type === recordTypes.FireAnimationFrame)
+            parentRecord = this._requestAnimationFrameRecords[record.data["id"]];
+        return parentRecord;
+    },
+
+    setGlueRecords: function(glue)
+    {
+        this._glueRecords = glue;
+    },
+
+    get categories()
+    {
+        return this._categories;
+    },
+
+    /**
+     * @param {WebInspector.TimelineCategory} category
+     */
+    _addCategory: function(category)
+    {
+        this._categories[category.name] = category;
+    },
+
+    get _recordStyles()
+    {
+        if (!this._recordStylesArray) {
+            var recordTypes = WebInspector.TimelineModel.RecordType;
+            var categories = this._categories;
+
+            var recordStyles = {};
+            recordStyles[recordTypes.Root] = { title: "#root", category: categories["loading"] };
+            recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: categories["scripting"] };
+            recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: categories["rendering"] };
+            recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: categories["rendering"] };
+            recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: categories["rendering"] };
+            recordStyles[recordTypes.BeginFrame] = { title: WebInspector.UIString("Frame Start"), category: categories["rendering"] };
+            recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: categories["loading"] };
+            recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: categories["scripting"] };
+            recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: categories["scripting"] };
+            recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: categories["scripting"] };
+            recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimeStamp] = { title: WebInspector.UIString("Stamp"), category: categories["scripting"] };
+            recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: categories["loading"] };
+            recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: categories["loading"] };
+            recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: categories["loading"] };
+            recordStyles[recordTypes.FunctionCall] = { title: WebInspector.UIString("Function Call"), category: categories["scripting"] };
+            recordStyles[recordTypes.ResourceReceivedData] = { title: WebInspector.UIString("Receive Data"), category: categories["loading"] };
+            recordStyles[recordTypes.GCEvent] = { title: WebInspector.UIString("GC Event"), category: categories["scripting"] };
+            recordStyles[recordTypes.MarkDOMContent] = { title: WebInspector.UIString("DOMContent event"), category: categories["scripting"] };
+            recordStyles[recordTypes.MarkLoad] = { title: WebInspector.UIString("Load event"), category: categories["scripting"] };
+            recordStyles[recordTypes.ScheduleResourceRequest] = { title: WebInspector.UIString("Schedule Request"), category: categories["loading"] };
+            recordStyles[recordTypes.RequestAnimationFrame] = { title: WebInspector.UIString("Request Animation Frame"), category: categories["scripting"] };
+            recordStyles[recordTypes.CancelAnimationFrame] = { title: WebInspector.UIString("Cancel Animation Frame"), category: categories["scripting"] };
+            recordStyles[recordTypes.FireAnimationFrame] = { title: WebInspector.UIString("Animation Frame Fired"), category: categories["scripting"] };
+            this._recordStylesArray = recordStyles;
+        }
+        return this._recordStylesArray;
+    },
+
+    filteredRecords: function()
+    {
+        function filter(record)
+        {
+            for (var i = 0; i < this._filters.length; ++i) {
+                if (!this._filters[i].accept(record))
+                    return false;
+            }
+            return true;
+        }
+        return this._filterRecords(filter.bind(this));
+    },
+
+    _filterRecords: function(filter)
+    {
+        var recordsInWindow = [];
+
+        var stack = [{children: this._rootRecord.children, index: 0, parentIsCollapsed: false}];
+        while (stack.length) {
+            var entry = stack[stack.length - 1];
+            var records = entry.children;
+            if (records && entry.index < records.length) {
+                 var record = records[entry.index];
+                 ++entry.index;
+
+                 if (filter(record)) {
+                     ++record.parent._invisibleChildrenCount;
+                     if (!entry.parentIsCollapsed)
+                         recordsInWindow.push(record);
+                 }
+
+                 record._invisibleChildrenCount = 0;
+
+                 stack.push({children: record.children,
+                             index: 0,
+                             parentIsCollapsed: (entry.parentIsCollapsed || record.collapsed),
+                             parentRecord: record,
+                             windowLengthBeforeChildrenTraversal: recordsInWindow.length});
+            } else {
+                stack.pop();
+                if (entry.parentRecord)
+                    entry.parentRecord._visibleChildrenCount = recordsInWindow.length - entry.windowLengthBeforeChildrenTraversal;
+            }
+        }
+
+        return recordsInWindow;
+    }
+}
+
+WebInspector.TimelinePresentationModel.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ */
+WebInspector.TimelinePresentationModel.Record = function(presentationModel, record, parentRecord, scriptDetails)
+{
+    this._presentationModel = presentationModel;
+    this._linkifier = this._presentationModel._linkifier;
+    this._aggregatedStats = [];
+    var recordTypes = WebInspector.TimelineModel.RecordType;
+    var style = presentationModel._recordStyles[record.type];
+    this.parent = parentRecord;
+    if (parentRecord)
+        parentRecord.children.push(this);
+    this.category = style.category;
+    this.title = style.title;
+    this.startTime = record.startTime / 1000;
+    this.data = record.data;
+    this.type = record.type;
+    this.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : this.startTime;
+    this._selfTime = this.endTime - this.startTime;
+    this._lastChildEndTime = this.endTime;
+    this._initiatorOffset = (parentRecord && parentRecord !== presentationModel._rootRecord) ?
+        parentRecord._initiatorOffset + this.startTime - parentRecord.startTime : 0;
+
+    if (record.stackTrace && record.stackTrace.length)
+        this.stackTrace = record.stackTrace;
+    this.totalHeapSize = record.totalHeapSize;
+    this.usedHeapSize = record.usedHeapSize;
+    if (record.data && record.data["url"])
+        this.url = record.data["url"];
+    if (scriptDetails) {
+        this.scriptName = scriptDetails.scriptName;
+        this.scriptLine = scriptDetails.scriptLine;
+    }
+    // Make resource receive record last since request was sent; make finish record last since response received.
+    if (record.type === recordTypes.ResourceSendRequest) {
+        presentationModel._sendRequestRecords[record.data["requestId"]] = this;
+    } else if (record.type === recordTypes.ScheduleResourceRequest) {
+        presentationModel._scheduledResourceRequests[record.data["url"]] = this;
+    } else if (record.type === recordTypes.ResourceReceiveResponse) {
+        var sendRequestRecord = presentationModel._sendRequestRecords[record.data["requestId"]];
+        if (sendRequestRecord) { // False if we started instrumentation in the middle of request.
+            this.url = sendRequestRecord.url;
+            // Now that we have resource in the collection, recalculate details in order to display short url.
+            sendRequestRecord._refreshDetails();
+            if (sendRequestRecord.parent !== presentationModel._rootRecord && sendRequestRecord.parent.type === recordTypes.ScheduleResourceRequest)
+                sendRequestRecord.parent._refreshDetails();
+        }
+    } else if (record.type === recordTypes.ResourceReceivedData || record.type === recordTypes.ResourceFinish) {
+        var sendRequestRecord = presentationModel._sendRequestRecords[record.data["requestId"]];
+        if (sendRequestRecord) // False for main resource.
+            this.url = sendRequestRecord.url;
+    } else if (record.type === recordTypes.TimerInstall) {
+        this.timeout = record.data["timeout"];
+        this.singleShot = record.data["singleShot"];
+        presentationModel._timerRecords[record.data["timerId"]] = this;
+    } else if (record.type === recordTypes.TimerFire) {
+        var timerInstalledRecord = presentationModel._timerRecords[record.data["timerId"]];
+        if (timerInstalledRecord) {
+            this.callSiteStackTrace = timerInstalledRecord.stackTrace;
+            this.timeout = timerInstalledRecord.timeout;
+            this.singleShot = timerInstalledRecord.singleShot;
+        }
+    } else if (record.type === recordTypes.RequestAnimationFrame) {
+        presentationModel._requestAnimationFrameRecords[record.data["id"]] = this;
+    } else if (record.type === recordTypes.FireAnimationFrame) {
+        var requestAnimationRecord = presentationModel._requestAnimationFrameRecords[record.data["id"]];
+        if (requestAnimationRecord)
+            this.callSiteStackTrace = requestAnimationRecord.stackTrace;
+    }
+    this._refreshDetails();
+}
+
+WebInspector.TimelinePresentationModel.Record.prototype = {
+    get lastChildEndTime()
+    {
+        return this._lastChildEndTime;
+    },
+
+    set lastChildEndTime(time)
+    {
+        this._lastChildEndTime = time;
+    },
+
+    get selfTime()
+    {
+        return this._selfTime;
+    },
+
+    set selfTime(time)
+    {
+        this._selfTime = time;
+    },
+
+    get cpuTime()
+    {
+        return this._cpuTime;
+    },
+
+    isLong: function()
+    {
+        return (this._lastChildEndTime - this.startTime) > WebInspector.TimelinePresentationModel.shortRecordThreshold;
+    },
+
+    get children()
+    {
+        if (!this._children)
+            this._children = [];
+        return this._children;
+    },
+
+    get visibleChildrenCount()
+    {
+        return this._visibleChildrenCount || 0;
+    },
+
+    get invisibleChildrenCount()
+    {
+        return this._invisibleChildrenCount || 0;
+    },
+
+    containsTime: function(time)
+    {
+        return this.startTime <= time && time <= this.endTime;
+    },
+
+    _generateAggregatedInfo: function()
+    {
+        var cell = document.createElement("span");
+        cell.className = "timeline-aggregated-info";
+        for (var index in this._aggregatedStats) {
+            var label = document.createElement("div");
+            label.className = "timeline-aggregated-category timeline-" + index;
+            cell.appendChild(label);
+            var text = document.createElement("span");
+            text.textContent = Number.secondsToString(this._aggregatedStats[index], true);
+            cell.appendChild(text);
+        }
+        return cell;
+    },
+
+    generatePopupContent: function(calculator)
+    {
+        var contentHelper = new WebInspector.TimelinePresentationModel.PopupContentHelper(this.title);
+
+        if (this._children && this._children.length) {
+            contentHelper._appendTextRow(WebInspector.UIString("Self Time"), Number.secondsToString(this._selfTime, true));
+            contentHelper._appendElementRow(WebInspector.UIString("Aggregated Time"), this._generateAggregatedInfo());
+        }
+        var text = WebInspector.UIString("%s (at %s)", Number.secondsToString(this._lastChildEndTime - this.startTime, true),
+            Number.secondsToString(this.startTime - this._presentationModel.minimumRecordTime()));
+        contentHelper._appendTextRow(WebInspector.UIString("Duration"), text);
+
+        const recordTypes = WebInspector.TimelineModel.RecordType;
+
+        switch (this.type) {
+            case recordTypes.GCEvent:
+                contentHelper._appendTextRow(WebInspector.UIString("Collected"), Number.bytesToString(this.data["usedHeapSizeDelta"]));
+                break;
+            case recordTypes.TimerInstall:
+            case recordTypes.TimerFire:
+            case recordTypes.TimerRemove:
+                contentHelper._appendTextRow(WebInspector.UIString("Timer ID"), this.data["timerId"]);
+                if (typeof this.timeout === "number") {
+                    contentHelper._appendTextRow(WebInspector.UIString("Timeout"), Number.secondsToString(this.timeout / 1000));
+                    contentHelper._appendTextRow(WebInspector.UIString("Repeats"), !this.singleShot);
+                }
+                break;
+            case recordTypes.FireAnimationFrame:
+                contentHelper._appendTextRow(WebInspector.UIString("Callback ID"), this.data["id"]);
+                break;
+            case recordTypes.FunctionCall:
+                contentHelper._appendElementRow(WebInspector.UIString("Location"), this._linkifyScriptLocation());
+                break;
+            case recordTypes.ScheduleResourceRequest:
+            case recordTypes.ResourceSendRequest:
+            case recordTypes.ResourceReceiveResponse:
+            case recordTypes.ResourceReceivedData:
+            case recordTypes.ResourceFinish:
+                contentHelper._appendElementRow(WebInspector.UIString("Resource"), this._linkifyLocation(this.url));
+                if (this.data["requestMethod"])
+                    contentHelper._appendTextRow(WebInspector.UIString("Request Method"), this.data["requestMethod"]);
+                if (typeof this.data["statusCode"] === "number")
+                    contentHelper._appendTextRow(WebInspector.UIString("Status Code"), this.data["statusCode"]);
+                if (this.data["mimeType"])
+                    contentHelper._appendTextRow(WebInspector.UIString("MIME Type"), this.data["mimeType"]);
+                break;
+            case recordTypes.EvaluateScript:
+                if (this.data && this.url)
+                    contentHelper._appendElementRow(WebInspector.UIString("Script"), this._linkifyLocation(this.url, this.data["lineNumber"]));
+                break;
+            case recordTypes.Paint:
+                contentHelper._appendTextRow(WebInspector.UIString("Location"), WebInspector.UIString("(%d, %d)", this.data["x"], this.data["y"]));
+                contentHelper._appendTextRow(WebInspector.UIString("Dimensions"), WebInspector.UIString("%d × %d", this.data["width"], this.data["height"]));
+            case recordTypes.RecalculateStyles: // We don't want to see default details.
+                break;
+            default:
+                if (this.details)
+                    contentHelper._appendTextRow(WebInspector.UIString("Details"), this.details);
+                break;
+        }
+
+        if (this.scriptName && this.type !== recordTypes.FunctionCall)
+            contentHelper._appendElementRow(WebInspector.UIString("Function Call"), this._linkifyScriptLocation());
+
+        if (this.usedHeapSize)
+            contentHelper._appendTextRow(WebInspector.UIString("Used Heap Size"), WebInspector.UIString("%s of %s", Number.bytesToString(this.usedHeapSize), Number.bytesToString(this.totalHeapSize)));
+
+        if (this.callSiteStackTrace && this.callSiteStackTrace.length)
+            contentHelper._appendStackTrace(WebInspector.UIString("Call Site stack"), this.callSiteStackTrace, this._linkifyCallFrame.bind(this));
+
+        if (this.stackTrace)
+            contentHelper._appendStackTrace(WebInspector.UIString("Call Stack"), this.stackTrace, this._linkifyCallFrame.bind(this));
+
+        return contentHelper._contentTable;
+    },
+
+    _refreshDetails: function()
+    {
+        this.details = this._getRecordDetails();
+    },
+
+    _getRecordDetails: function()
+    {
+        switch (this.type) {
+            case WebInspector.TimelineModel.RecordType.GCEvent:
+                return WebInspector.UIString("%s collected", Number.bytesToString(this.data["usedHeapSizeDelta"]));
+            case WebInspector.TimelineModel.RecordType.TimerFire:
+                return this._linkifyScriptLocation(this.data["timerId"]);
+            case WebInspector.TimelineModel.RecordType.FunctionCall:
+                return this._linkifyScriptLocation();
+            case WebInspector.TimelineModel.RecordType.FireAnimationFrame:
+                return this._linkifyScriptLocation(this.data["id"]);
+            case WebInspector.TimelineModel.RecordType.EventDispatch:
+                return this.data ? this.data["type"] : null;
+            case WebInspector.TimelineModel.RecordType.Paint:
+                return this.data["width"] + "\u2009\u00d7\u2009" + this.data["height"];
+            case WebInspector.TimelineModel.RecordType.TimerInstall:
+            case WebInspector.TimelineModel.RecordType.TimerRemove:
+                return this._linkifyTopCallFrame(this.data["timerId"]);
+            case WebInspector.TimelineModel.RecordType.RequestAnimationFrame:
+            case WebInspector.TimelineModel.RecordType.CancelAnimationFrame:
+                return this._linkifyTopCallFrame(this.data["id"]);
+            case WebInspector.TimelineModel.RecordType.ParseHTML:
+            case WebInspector.TimelineModel.RecordType.RecalculateStyles:
+                return this._linkifyTopCallFrame();
+            case WebInspector.TimelineModel.RecordType.EvaluateScript:
+                return this.url ? this._linkifyLocation(this.url, this.data["lineNumber"], 0) : null;
+            case WebInspector.TimelineModel.RecordType.XHRReadyStateChange:
+            case WebInspector.TimelineModel.RecordType.XHRLoad:
+            case WebInspector.TimelineModel.RecordType.ScheduleResourceRequest:
+            case WebInspector.TimelineModel.RecordType.ResourceSendRequest:
+            case WebInspector.TimelineModel.RecordType.ResourceReceivedData:
+            case WebInspector.TimelineModel.RecordType.ResourceReceiveResponse:
+            case WebInspector.TimelineModel.RecordType.ResourceFinish:
+                return WebInspector.displayNameForURL(this.url);
+            case WebInspector.TimelineModel.RecordType.TimeStamp:
+                return this.data["message"];
+            default:
+                return null;
+        }
+    },
+
+    /**
+     * @param {string} url
+     * @param {number=} lineNumber
+     * @param {number=} columnNumber
+     */
+    _linkifyLocation: function(url, lineNumber, columnNumber)
+    {
+        // FIXME(62725): stack trace line/column numbers are one-based.
+        lineNumber = lineNumber ? lineNumber - 1 : lineNumber;
+        columnNumber = columnNumber ? columnNumber - 1 : 0;
+        return this._linkifier.linkifyLocation(url, lineNumber, columnNumber, "timeline-details");
+    },
+
+    _linkifyCallFrame: function(callFrame)
+    {
+        return this._linkifyLocation(callFrame.url, callFrame.lineNumber, callFrame.columnNumber);
+    },
+
+    /**
+     * @param {string=} defaultValue
+     */
+    _linkifyTopCallFrame: function(defaultValue)
+    {
+        return this.stackTrace ? this._linkifyCallFrame(this.stackTrace[0]) : defaultValue;
+    },
+
+    /**
+     * @param {string=} defaultValue
+     */
+    _linkifyScriptLocation: function(defaultValue)
+    {
+        return this.scriptName ? this._linkifyLocation(this.scriptName, this.scriptLine, 0) : defaultValue;
+    },
+
+    calculateAggregatedStats: function(categories)
+    {
+        this._aggregatedStats = {};
+        for (var category in categories)
+            this._aggregatedStats[category] = 0;
+        this._cpuTime = this._selfTime;
+
+        if (this._children) {
+            for (var index = this._children.length; index; --index) {
+                var child = this._children[index - 1];
+                for (var category in categories)
+                    this._aggregatedStats[category] += child._aggregatedStats[category];
+            }
+            for (var category in this._aggregatedStats)
+                this._cpuTime += this._aggregatedStats[category];
+        }
+        this._aggregatedStats[this.category.name] += this._selfTime;
+    },
+
+    get aggregatedStats()
+    {
+        return this._aggregatedStats;
+    }
+}
+
+/**
+ * @constructor
+ */
+WebInspector.TimelinePresentationModel.PopupContentHelper = function(title)
+{
+    this._contentTable = document.createElement("table");
+    var titleCell = this._createCell(WebInspector.UIString("%s - Details", title), "timeline-details-title");
+    titleCell.colSpan = 2;
+    var titleRow = document.createElement("tr");
+    titleRow.appendChild(titleCell);
+    this._contentTable.appendChild(titleRow);
+}
+
+WebInspector.TimelinePresentationModel.PopupContentHelper.prototype = {
+    /**
+     * @param {string=} styleName
+     */
+    _createCell: function(content, styleName)
+    {
+        var text = document.createElement("label");
+        text.appendChild(document.createTextNode(content));
+        var cell = document.createElement("td");
+        cell.className = "timeline-details";
+        if (styleName)
+            cell.className += " " + styleName;
+        cell.textContent = content;
+        return cell;
+    },
+
+    _appendTextRow: function(title, content)
+    {
+        var row = document.createElement("tr");
+        row.appendChild(this._createCell(title, "timeline-details-row-title"));
+        row.appendChild(this._createCell(content, "timeline-details-row-data"));
+        this._contentTable.appendChild(row);
+    },
+
+    /**
+     * @param {string=} titleStyle
+     */
+    _appendElementRow: function(title, content, titleStyle)
+    {
+        var row = document.createElement("tr");
+        var titleCell = this._createCell(title, "timeline-details-row-title");
+        if (titleStyle)
+            titleCell.addStyleClass(titleStyle);
+        row.appendChild(titleCell);
+        var cell = document.createElement("td");
+        cell.className = "timeline-details";
+        cell.appendChild(content);
+        row.appendChild(cell);
+        this._contentTable.appendChild(row);
+    },
+
+    _appendStackTrace: function(title, stackTrace, callFrameLinkifier)
+    {
+        this._appendTextRow("", "");
+        var framesTable = document.createElement("table");
+        for (var i = 0; i < stackTrace.length; ++i) {
+            var stackFrame = stackTrace[i];
+            var row = document.createElement("tr");
+            row.className = "timeline-details";
+            row.appendChild(this._createCell(stackFrame.functionName ? stackFrame.functionName : WebInspector.UIString("(anonymous function)"), "timeline-function-name"));
+            row.appendChild(this._createCell(" @ "));
+            var linkCell = document.createElement("td");
+            var urlElement = callFrameLinkifier(stackFrame);
+            linkCell.appendChild(urlElement);
+            row.appendChild(linkCell);
+            framesTable.appendChild(row);
+        }
+        this._appendElementRow(title, framesTable, "timeline-stacktrace-title");
+    }
+}
+
+/**
+ * @interface
+ */
+WebInspector.TimelinePresentationModel.Filter = function()
+{
+}
+
+WebInspector.TimelinePresentationModel.Filter.prototype = {
+    /**
+     * @param {WebInspector.TimelinePresentationModel.Record} record
+     */
+    accept: function(record) { return false; }
+}
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.TimelineCategory = function(name, title, color)
+{
+    this.name = name;
+    this.title = title;
+    this.color = color;
+    this.hidden = false;
+}
+
+WebInspector.TimelineCategory.Events = {
+    VisibilityChanged: "VisibilityChanged"
+};
+
+WebInspector.TimelineCategory.prototype = {
+    /**
+     * @type {boolean}
+     */
+    get hidden()
+    {
+        return this._hidden;
+    },
+
+    set hidden(hidden)
+    {
+        this._hidden = hidden;
+        this.dispatchEventToListeners(WebInspector.TimelineCategory.Events.VisibilityChanged, this);
+    }
+}
+
+WebInspector.TimelineCategory.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/UISourceCode.js b/Source/WebCore/inspector/front-end/UISourceCode.js
index 87d03047b..75abbd637 100644
--- a/Source/WebCore/inspector/front-end/UISourceCode.js
+++ b/Source/WebCore/inspector/front-end/UISourceCode.js
@@ -33,16 +33,15 @@
  * @extends {WebInspector.Object}
  * @param {string} id
  * @param {string} url
- * @param {WebInspector.RawSourceCode} rawSourceCode
  * @param {WebInspector.ContentProvider} contentProvider
  */
-WebInspector.UISourceCode = function(id, url, rawSourceCode, contentProvider)
+WebInspector.UISourceCode = function(id, url, contentProvider)
 {
     this._id = id;
     this._url = url;
-    this._rawSourceCode = rawSourceCode;
     this._contentProvider = contentProvider;
     this.isContentScript = false;
+    this.isEditable = false;
     /**
      * @type Array.<function(string,string)>
      */
@@ -71,14 +70,6 @@ WebInspector.UISourceCode.prototype = {
     },
 
     /**
-     * @return {WebInspector.RawSourceCode}
-     */
-    get rawSourceCode()
-    {
-        return this._rawSourceCode;
-    },
-
-    /**
      * @param {function(string,string)} callback
      */
     requestContent: function(callback)
diff --git a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index 2887b1d62..80d479ae5 100644
--- a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -344,30 +344,25 @@ WebInspector.WatchExpressionTreeElement.prototype = {
         this.treeOutline.section.updateExpression(this, null);
     },
 
-    startEditing: function()
+    renderPromptAsBlock: function()
     {
-        if (WebInspector.isBeingEdited(this.nameElement) || !this.treeOutline.section.editable)
-            return;
-
-        this.nameElement.textContent = this.property.name.trim();
-
-        var context = { expanded: this.expanded };
-
-        // collapse temporarily, if required
-        this.hasChildren = false;
-
-        this.listItemElement.addStyleClass("editing-sub-part");
+        return true;
+    },
 
-        WebInspector.startEditing(this.nameElement, new WebInspector.EditingConfig(this.editingCommitted.bind(this), this.editingCancelled.bind(this), context));
+    /**
+     * @param {Event=} event
+     */
+    elementAndValueToEdit: function(event)
+    {
+        return [this.nameElement, this.property.name.trim()];
     },
 
     editingCancelled: function(element, context)
     {
-        if (!this.nameElement.textContent)
+        if (!context.elementToEdit.textContent)
             this.treeOutline.section.updateExpression(this, null);
 
-        this.update();
-        this.editingEnded(context);
+        WebInspector.ObjectPropertyTreeElement.prototype.editingCancelled.call(this, element, context);
     },
 
     applyExpression: function(expression, updateInterface)
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index d1031e288..57c58e651 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -118,6 +118,7 @@
     <file>Script.js</file>
     <file>ScriptFormatter.js</file>
     <file>ScriptFormatterWorker.js</file>
+    <file>ScriptMapping.js</file>
     <file>ScriptsPanel.js</file>
     <file>ScriptsNavigator.js</file>
     <file>ScriptsSearchScope.js</file>
@@ -147,8 +148,9 @@
     <file>TextEditorModel.js</file>
     <file>TextPrompt.js</file>
     <file>TextViewer.js</file>
-    <file>TimelineAgent.js</file>
     <file>TimelineManager.js</file>
+    <file>TimelineModel.js</file>
+    <file>TimelinePresentationModel.js</file>
     <file>TimelineGrid.js</file>
     <file>TimelineOverviewPane.js</file>
     <file>TimelinePanel.js</file>
diff --git a/Source/WebCore/inspector/front-end/dialog.css b/Source/WebCore/inspector/front-end/dialog.css
index 20f3ee1ad..ccfb3a443 100644
--- a/Source/WebCore/inspector/front-end/dialog.css
+++ b/Source/WebCore/inspector/front-end/dialog.css
@@ -53,24 +53,3 @@
     background-color: rgb(215, 215, 215);
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
 }
-
-.sidebar-overlay-dialog {
-    position: absolute;
-    display: -webkit-box;
-    height: 0;
-    width: 0;
-    -webkit-box-orient: vertical;
-    z-index: -1;
-    background-color: white;
-    border-right: 1px solid gray;
-    -webkit-box-shadow: rgb(90,90,90) 20px 0px 50px -25px;
-}
-
-.sidebar-overlay-resizer {
-    position: absolute;
-    top: 0;
-    bottom: 0;
-    width: 5px;
-    z-index: 500;
-    cursor: ew-resize;
-}
diff --git a/Source/WebCore/inspector/front-end/indexedDBViews.css b/Source/WebCore/inspector/front-end/indexedDBViews.css
index b5817d14e..2dc038d3e 100644
--- a/Source/WebCore/inspector/front-end/indexedDBViews.css
+++ b/Source/WebCore/inspector/front-end/indexedDBViews.css
@@ -99,3 +99,26 @@
 .indexed-db-data-view .data-grid .data-container tr:nth-last-child(1) td {
     border: 0;
 }
+
+.indexed-db-data-view .data-grid .data-container td {
+    height: 18px;
+}
+
+.indexed-db-data-view .data-grid .data-container td.value-column,
+.indexed-db-data-view .data-grid .data-container td.key-column,
+.indexed-db-data-view .data-grid .data-container td.primaryKey-column {
+    padding: 0;
+}
+
+.indexed-db-data-view .data-grid .data-container td.value-column div.primitive-value,
+.indexed-db-data-view .data-grid .data-container td.key-column div.primitive-value,
+.indexed-db-data-view .data-grid .data-container td.primaryKey-column div.primitive-value {
+    padding-left: 5px;
+    margin-top: 1px;
+}
+
+.indexed-db-data-view .data-grid .data-container td .section .header .title {
+    white-space: nowrap;
+    text-overflow: ellipsis;
+    overflow: hidden;
+}
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index 490c1f52b..628a97c28 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -522,7 +522,6 @@ select.status-bar-item:active {
     -webkit-mask-image: url(Images/statusbarButtonGlyphs.png);
 }
 
-
 button.dock-status-bar-item.status-bar-item .glyph {
     -webkit-mask-position: 0 -48px;
 }
@@ -541,7 +540,6 @@ button.settings-status-bar-item {
     -webkit-mask-position: -160px -24px;
 }
 
-
 body.port-qt #dock-status-bar-item {
     display: none
 }
@@ -895,14 +893,14 @@ body.platform-linux .monospace, body.platform-linux .source-code {
     display: none;
 }
 
-.console-formatted-object, .console-formatted-node {
+.console-formatted-object, .console-formatted-node, .console-formatted-array {
     position: relative;
     display: inline-block;
     vertical-align: top;
     color: black;
 }
 
-.console-formatted-object .section, .console-formatted-node .section {
+.console-formatted-object .section, .console-formatted-node .section, .console-formatted-array .section {
     position: static;
 }
 
@@ -1075,6 +1073,10 @@ iframe.panel.extension {
     margin-left: -12px;
 }
 
+.webkit-html-tag.shadow, .webkit-html-fragment.shadow {
+    opacity: 0.6;
+}
+
 .outline-disclosure li.parent::before {
     content: url(Images/treeRightTriangleBlack.png);
     float: left;
@@ -1375,7 +1377,7 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     padding-top: 2px;
 }
 
-.watch-expressions > li.editing-sub-part .name {
+.watch-expressions > li.editing-sub-part .text-prompt {
     display: block;
     width: 100%;
 }
@@ -1802,6 +1804,8 @@ button.edit-source-status-bar-item.toggled-on .glyph {
     height: 36px;
     padding: 0 5px 0 5px;
     white-space: nowrap;
+    overflow-x: hidden;
+    overflow-y: hidden;
     margin-top: 1px;
     line-height: 34px;
     border-top: 1px solid transparent;
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index ee56c86b2..7c20778ae 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -72,6 +72,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ResourceUtils.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
     <script type="text/javascript" src="TimelineManager.js"></script>
+    <script type="text/javascript" src="TimelineModel.js"></script>
     <script type="text/javascript" src="Database.js"></script>
     <script type="text/javascript" src="DOMStorage.js"></script>
     <script type="text/javascript" src="DOMStorageItemsView.js"></script>
@@ -167,6 +168,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DetailedHeapshotGridNodes.js"></script>
     <script type="text/javascript" src="DetailedHeapshotView.js"></script>
     <script type="text/javascript" src="DebuggerModel.js"></script>
+    <script type="text/javascript" src="ScriptMapping.js"></script>
     <script type="text/javascript" src="DebuggerPresentationModel.js"></script>
     <script type="text/javascript" src="BreakpointManager.js"></script>
     <script type="text/javascript" src="UISourceCode.js"></script>
@@ -175,7 +177,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="CompilerSourceMapping.js"></script>
     <script type="text/javascript" src="ScriptsSearchScope.js"></script>
     <script type="text/javascript" src="DOMAgent.js"></script>
-    <script type="text/javascript" src="TimelineAgent.js"></script>
+    <script type="text/javascript" src="TimelinePresentationModel.js"></script>
     <script type="text/javascript" src="TimelinePanel.js"></script>
     <script type="text/javascript" src="TimelineOverviewPane.js"></script>
     <script type="text/javascript" src="TestController.js"></script>
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index 05fa8e2e2..805b7248f 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -39,6 +39,8 @@ var WebInspector = {
 
         if (WebInspector.WorkerManager.isWorkerFrontend()) {
             this.panels.scripts = new WebInspector.ScriptsPanel(this.debuggerPresentationModel);
+            this.panels.timeline = new WebInspector.TimelinePanel();
+            this.panels.profiles = new WebInspector.ProfilesPanel();
             this.panels.console = new WebInspector.ConsolePanel();
             return;
         }
@@ -71,6 +73,7 @@ var WebInspector = {
         this._dockToggleButton = new WebInspector.StatusBarButton(this._dockButtonTitle(), "dock-status-bar-item");
         this._dockToggleButton.addEventListener("click", this._toggleAttach.bind(this), false);
         this._dockToggleButton.toggled = !this.attached;
+        WebInspector.updateDockToggleButton();
 
         this._settingsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Settings"), "settings-status-bar-item");
         this._settingsButton.addEventListener("click", this._toggleSettings.bind(this), false);
@@ -306,6 +309,30 @@ var WebInspector = {
         Capabilities[name] = result;
         if (callback)
             callback();
+    },
+
+    _zoomIn: function()
+    {
+        ++this._zoomLevel;
+        this._requestZoom();
+    },
+
+    _zoomOut: function()
+    {
+        --this._zoomLevel;
+        this._requestZoom();
+    },
+
+    _resetZoom: function()
+    {
+        this._zoomLevel = 0;
+        this._requestZoom();
+    },
+
+    _requestZoom: function()
+    {
+        WebInspector.settings.zoomLevel.set(this._zoomLevel);
+        InspectorFrontendHost.setZoomFactor(Math.pow(1.2, this._zoomLevel));
     }
 }
 
@@ -403,6 +430,10 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     if (Capabilities.nativeInstrumentationEnabled)
         this.domBreakpointsSidebarPane = new WebInspector.DOMBreakpointsSidebarPane();
 
+    this._zoomLevel = WebInspector.settings.zoomLevel.get();
+    if (this._zoomLevel)
+        this._requestZoom();
+
     this._createPanels();
     this._createGlobalStatusBarItems();
 
@@ -534,6 +565,20 @@ WebInspector.windowResize = function(event)
 WebInspector.setAttachedWindow = function(attached)
 {
     this.attached = attached;
+    WebInspector.updateDockToggleButton();
+}
+
+WebInspector.setDockingUnavailable = function(unavailable)
+{
+    this._isDockingUnavailable = unavailable;
+    WebInspector.updateDockToggleButton();
+}
+
+WebInspector.updateDockToggleButton = function()
+{
+    if (!this._dockToggleButton)
+        return;
+    this._dockToggleButton.disabled = this.attached ? false : this._isDockingUnavailable;
 }
 
 WebInspector.close = function(event)
@@ -597,8 +642,8 @@ WebInspector.openResource = function(resourceURL, inResourcesPanel)
 {
     var resource = WebInspector.resourceForURL(resourceURL);
     if (inResourcesPanel && resource) {
-        WebInspector.panels.resources.showResource(resource);
         WebInspector.showPanel("resources");
+        WebInspector.panels.resources.showResource(resource);
     } else
         InspectorFrontendHost.openInNewTab(resourceURL);
 }
@@ -680,20 +725,45 @@ WebInspector.documentKeyDown = function(event)
             }
             break;
         case "U+0052": // R key
-            if (WebInspector.isInEditMode(event))
-                return;
             if ((event.metaKey && isMac) || (event.ctrlKey && !isMac)) {
                 PageAgent.reload(event.shiftKey);
                 event.preventDefault();
             }
             break;
         case "F5":
-            if (!isMac && !WebInspector.isInEditMode(event)) {
+            if (!isMac) {
                 PageAgent.reload(event.ctrlKey || event.shiftKey);
                 event.preventDefault();
             }
             break;
     }
+
+    var isValidZoomShortcut = WebInspector.KeyboardShortcut.eventHasCtrlOrMeta(event) &&
+        !event.shiftKey &&
+        !event.altKey &&
+        !InspectorFrontendHost.isStub;
+    switch (event.keyCode) {
+        case 107: // +
+        case 187: // +
+            if (isValidZoomShortcut) {
+                WebInspector._zoomIn();
+                event.preventDefault();
+            }
+            break;
+        case 109: // -
+        case 189: // -
+            if (isValidZoomShortcut) {
+                WebInspector._zoomOut();
+                event.preventDefault();
+            }
+            break;
+        case 48: // 0
+            if (isValidZoomShortcut) {
+                WebInspector._resetZoom();
+                event.preventDefault();
+            }
+            break;
+    }
 }
 
 WebInspector.documentCanCopy = function(event)
diff --git a/Source/WebCore/inspector/front-end/inspectorCommon.css b/Source/WebCore/inspector/front-end/inspectorCommon.css
index 526843140..cb78b0311 100644
--- a/Source/WebCore/inspector/front-end/inspectorCommon.css
+++ b/Source/WebCore/inspector/front-end/inspectorCommon.css
@@ -78,10 +78,6 @@ iframe.view {
     pointer-events: none;
 }
 
-.timeline .resources-event-dividers {
-    height: 19px;
-}
-
 .resources-dividers-label-bar {
     position: absolute;
     top: 0;
diff --git a/Source/WebCore/inspector/front-end/scriptsPanel.css b/Source/WebCore/inspector/front-end/scriptsPanel.css
index b412f0207..e47abd636 100644
--- a/Source/WebCore/inspector/front-end/scriptsPanel.css
+++ b/Source/WebCore/inspector/front-end/scriptsPanel.css
@@ -282,6 +282,15 @@
     margin-right: 28px;
 }
 
+#scripts-editor-view .sidebar-overlay {
+    display: -webkit-box;
+    background-color: white;
+    border-right: 1px solid gray;
+    -webkit-box-shadow: rgb(90,90,90) 20px 0px 50px -25px;
+    display: -webkit-box;
+    -webkit-box-orient: vertical;
+}
+
 #scripts-editor-container-tabbed-pane .tabbed-pane-header {
     background-image: -webkit-gradient(linear, 0% 0%, 0% 100%, from(#F5F5F5), to(#E5E5E5));
 }
diff --git a/Source/WebCore/inspector/front-end/splitView.css b/Source/WebCore/inspector/front-end/splitView.css
index 1e8e96dac..1461eb840 100644
--- a/Source/WebCore/inspector/front-end/splitView.css
+++ b/Source/WebCore/inspector/front-end/splitView.css
@@ -66,4 +66,21 @@
     width: 5px;
     z-index: 500;
     cursor: ew-resize;
-}
\ No newline at end of file
+}
+
+.sidebar-overlay {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    z-index: 10;
+}
+
+.sidebar-overlay-resizer {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    width: 5px;
+    z-index: 500;
+    cursor: ew-resize;
+}
diff --git a/Source/WebCore/inspector/front-end/timelinePanel.css b/Source/WebCore/inspector/front-end/timelinePanel.css
index fd44d59fe..9cf26ec77 100644
--- a/Source/WebCore/inspector/front-end/timelinePanel.css
+++ b/Source/WebCore/inspector/front-end/timelinePanel.css
@@ -72,20 +72,11 @@
     border-right: 1px solid rgb(163, 163, 163);
 }
 
-.timeline-start-at-zero #timeline-overview-sidebar {
-    display: none;
-}
-
 #timeline-overview-grid {
-    position: absolute;
-    top: 0px;
-    bottom: 0px;
-    left: 200px;
-    right: 0px;
     background-color: rgb(255, 255, 255);
 }
 
-.timeline-start-at-zero #timeline-overview-grid {
+.timeline-vertical-overview #timeline-overview-grid {
     display: none;
 }
 
@@ -107,7 +98,7 @@
     z-index: 150;
 }
 
-.timeline-start-at-zero .timeline-overview-window {
+.timeline-vertical-overview .timeline-overview-window {
     bottom: 0;
 }
 
@@ -120,7 +111,7 @@
     position: absolute;
 }
 
-.timeline-start-at-zero .timeline-overview-dividers-background {
+.timeline-vertical-overview .timeline-overview-dividers-background {
     bottom: 0;
 }
 
@@ -163,7 +154,7 @@
     bottom: 0;
     right: 0;
     border-right: 0 none transparent;
-    overflow-y: auto;
+    overflow-y: scroll;
     overflow-x: hidden;
 }
 
@@ -284,7 +275,7 @@
     z-index: 160;
 }
 
-.timeline-start-at-zero #timeline-overview-memory {
+.timeline-vertical-overview #timeline-overview-memory {
     display: none;
 }
 
@@ -353,6 +344,10 @@
     opacity: 0.2;
 }
 
+.timeline-graph-bar.cpu {
+    opacity: 0.6;
+}
+
 .timeline-graph-side.even {
     background-color: rgba(0, 0, 0, 0.05);
 }
@@ -455,11 +450,7 @@
     -webkit-mask-position: -128px -48px;
 }
 
-.timeline-start-at-zero-status-bar-item .glyph {
-    -webkit-mask-position: -160px -48px;
-}
-
-.timeline-start-at-zero-status-bar-item.toggled-on .glyph {
+.timeline-vertical-overview-status-bar-item.toggled-on .glyph {
     background-color: rgb(66, 129, 235) !important;
 }
 
@@ -555,16 +546,25 @@
     border-top: 1px solid #AAA;
 }
 
+#memory-graphs-canvas-container {
+    border-right: 1px solid #AAA;
+}
+
+#memory-graphs-canvas-container .resources-dividers {
+    top: 15px;
+}
+
 #memory-graphs-container .split-view-contents {
     overflow: hidden;
 }
 
 .memory-counter-sidebar-info {
-    position: absolute;
-    top: 0;
-    left: 0;
-    right: 0;
     font-size: 11px;
+    margin: 10px;
+}
+
+.memory-counter-sidebar-info .swatch{
+    background-image: none;
 }
 
 .memory-counter-sidebar-info.bottom-border-visible {
@@ -573,18 +573,19 @@
 
 .memory-counter-sidebar-info .title {
     margin: 4px;
-    font-weight: bold;
 }
 
-.memory-counter-sidebar-info .counter-value {
+.memory-counter-value {
     margin: 4px;
+    font-size: 11px;
 }
 
-.timeline-overview-start-at-zero {
-    background-color: white;
+#counter-values-bar {
+    border-bottom: solid 1px lightgray;
+    min-height: 15px;
 }
 
-.timeline-overview-start-at-zero-bars {
+.timeline-vertical-overview-bars {
     display: -webkit-box;
     -webkit-box-align: end;
     background-color: white;
@@ -594,11 +595,11 @@
     background-color: rgba(255, 255, 255, 0.8);
 }
 
-.timeline-overview-start-at-zero-bars .padding {
+.timeline-vertical-overview-bars .padding {
     -webkit-box-flex: 100000;
 }
 
-.timeline-overview-start-at-zero-bars .timeline-bar-vertical {
+.timeline-vertical-overview-bars .timeline-bar-vertical {
     display: -webkit-box;
     -webkit-box-orient: vertical;
     -webkit-box-pack: end;
@@ -626,3 +627,77 @@
     background: -webkit-linear-gradient(left, rgb(213, 185, 236), rgb(137, 62, 200));
     border: solid 1px rgb(130, 59, 190);
 }
+
+.timeline .resources-event-divider {
+    height: 19px;
+    bottom: auto;
+}
+
+.timeline.timeline-vertical-overview .resources-divider {
+    height: 19px;
+    bottom: auto;
+}
+
+.timeline .resources-event-divider.timeline-frame-divider {
+    background-color: rgba(200, 185, 200, 0.8);
+    height: 100%;
+}
+
+.sidebar-tree-item .timeline-vertical-overview-status-bar-item {
+    position: absolute;
+    right: 10px;
+    top: 4px;
+}
+
+.timeline-overview-mode-selector {
+    float: right;
+    margin: 5px 10px 5px 10px;
+}
+
+.timeline-overview-mode-selector .glyph {
+    width: 32px;
+    height: 24px;
+    -webkit-mask-image: url(Images/statusbarButtonGlyphs.png);
+}
+
+.timeline-overview-mode-selector button {
+    width: 32px;
+    height: 24px;
+    margin: 0px;
+    border: none;
+    position: relative;
+}
+
+.timeline-overview-mode-selector button.toggled {
+    background-image: -webkit-linear-gradient(top, rgb(80, 80, 80), rgb(140, 140, 140) 3px, rgb(160, 160, 160));
+}
+
+.timeline-overview-mode-selector button:active {
+    background-image: -webkit-linear-gradient(top, rgb(60, 60, 60), rgb(100, 100, 100) 3px, rgb(120, 120, 120));
+}
+
+.sidebar-tree-item:not(.selected) .timeline-overview-mode-selector button {
+    opacity: 0.5;
+}
+
+.sidebar-tree-item:not(.selected) .timeline-overview-mode-selector button.toggled {
+    background-image: -webkit-linear-gradient(top, rgb(120, 120, 120), rgb(200, 200, 200) 3px, rgb(220, 220, 220));
+}
+
+.timeline-overview-mode-selector button:first-of-type {
+    border-top-left-radius: 3px;
+    border-bottom-left-radius: 3px;
+}
+
+.timeline-overview-mode-selector button:last-of-type {
+    border-top-right-radius: 3px;
+    border-bottom-right-radius: 3px;
+}
+
+.timeline-mode-vertical-bars .glyph {
+    -webkit-mask-position: -160px -48px;
+}
+
+.timeline-mode-horizontal-bars .glyph {
+    -webkit-mask-position: -192px -48px;
+}
diff --git a/Source/WebCore/inspector/front-end/treeoutline.js b/Source/WebCore/inspector/front-end/treeoutline.js
index 528f41b7e..7cd0c7830 100644
--- a/Source/WebCore/inspector/front-end/treeoutline.js
+++ b/Source/WebCore/inspector/front-end/treeoutline.js
@@ -28,8 +28,9 @@
 
 /**
  * @constructor
+ * @param {boolean=} nonFocusable
  */
-function TreeOutline(listNode)
+function TreeOutline(listNode, nonFocusable)
 {
     /**
      * @type {Array.<TreeElement>}
@@ -48,7 +49,7 @@ function TreeOutline(listNode)
     this.searchable = false;
     this.searchInputElement = null;
 
-    this._childrenListNode.tabIndex = 0;
+    this.setFocusable(!nonFocusable);
     this._childrenListNode.addEventListener("keydown", this._treeKeyDown.bind(this), true);
     this._childrenListNode.addEventListener("keypress", this._treeKeyPress.bind(this), true);
     
@@ -56,6 +57,14 @@ function TreeOutline(listNode)
     this._expandedStateMap = new Map();
 }
 
+TreeOutline.prototype.setFocusable = function(focusable)
+{
+    if (focusable)
+        this._childrenListNode.setAttribute("tabIndex", 0);
+    else
+        this._childrenListNode.removeAttribute("tabIndex");
+}
+
 TreeOutline.prototype.appendChild = function(child)
 {
     var insertionIndex;
diff --git a/Source/WebCore/inspector/front-end/utilities.js b/Source/WebCore/inspector/front-end/utilities.js
index 663317c2a..28f6105b0 100644
--- a/Source/WebCore/inspector/front-end/utilities.js
+++ b/Source/WebCore/inspector/front-end/utilities.js
@@ -758,7 +758,7 @@ String.sprintf = function(format, var_arg)
     return String.vsprintf(format, Array.prototype.slice.call(arguments, 1));
 }
 
-String.tokenizeFormatString = function(format)
+String.tokenizeFormatString = function(format, formatters)
 {
     var tokens = [];
     var substitutionIndex = 0;
@@ -773,22 +773,22 @@ String.tokenizeFormatString = function(format)
         tokens.push({ type: "specifier", specifier: specifier, precision: precision, substitutionIndex: substitutionIndex });
     }
 
+    function isDigit(c)
+    {
+        return !!/[0-9]/.exec(c);
+    }
+
     var index = 0;
     for (var precentIndex = format.indexOf("%", index); precentIndex !== -1; precentIndex = format.indexOf("%", index)) {
         addStringToken(format.substring(index, precentIndex));
         index = precentIndex + 1;
 
-        if (format[index] === "%") {
-            addStringToken("%");
-            ++index;
-            continue;
-        }
-
-        if (!isNaN(format[index])) {
+        if (isDigit(format[index])) {
             // The first character is a number, it might be a substitution index.
             var number = parseInt(format.substring(index), 10);
-            while (!isNaN(format[index]))
+            while (isDigit(format[index]))
                 ++index;
+
             // If the number is greater than zero and ends with a "$",
             // then this is a substitution index.
             if (number > 0 && format[index] === "$") {
@@ -805,10 +805,17 @@ String.tokenizeFormatString = function(format)
             precision = parseInt(format.substring(index), 10);
             if (isNaN(precision))
                 precision = 0;
-            while (!isNaN(format[index]))
+
+            while (isDigit(format[index]))
                 ++index;
         }
 
+        if (!(format[index] in formatters)) {
+            addStringToken(format.substring(precentIndex, index + 1));
+            ++index;
+            continue;
+        }
+
         addSpecifierToken(format[index], precision, substitutionIndex);
 
         ++substitutionIndex;
@@ -865,7 +872,7 @@ String.format = function(format, substitutions, formatters, initialValue, append
     }
 
     var result = initialValue;
-    var tokens = String.tokenizeFormatString(format);
+    var tokens = String.tokenizeFormatString(format, formatters);
     var usedSubstitutionIndexes = {};
 
     for (var i = 0; i < tokens.length; ++i) {
@@ -1207,11 +1214,11 @@ Map.prototype = {
         delete this._map[key.__identifier];
     },
     
-    keys: function()
+    values: function()
     {
         var result = [];
-        for (var key in this._map)
-            result.push(key);
+        for (var objectIdentifier in this._map)
+            result.push(this._map[objectIdentifier]);
         return result;
     },
     
diff --git a/Source/WebCore/loader/DocumentLoadTiming.cpp b/Source/WebCore/loader/DocumentLoadTiming.cpp
index a2f5ecbb9..874a90882 100644
--- a/Source/WebCore/loader/DocumentLoadTiming.cpp
+++ b/Source/WebCore/loader/DocumentLoadTiming.cpp
@@ -72,6 +72,12 @@ void DocumentLoadTiming::markNavigationStart(Frame* frame)
     }
 }
 
+void DocumentLoadTiming::setNavigationStart(double navigationStart)
+{
+    ASSERT(m_referenceMonotonicTime && m_referenceWallTime);
+    m_navigationStart = navigationStart;
+}
+
 void DocumentLoadTiming::addRedirect(const KURL& redirectingUrl, const KURL& redirectedUrl)
 {
     m_redirectCount++;
diff --git a/Source/WebCore/loader/DocumentLoadTiming.h b/Source/WebCore/loader/DocumentLoadTiming.h
index 0e64a182b..6e664b68b 100644
--- a/Source/WebCore/loader/DocumentLoadTiming.h
+++ b/Source/WebCore/loader/DocumentLoadTiming.h
@@ -38,6 +38,7 @@ public:
     DocumentLoadTiming();
 
     void markNavigationStart(Frame*);
+    void setNavigationStart(double);
     void addRedirect(const KURL& redirectingUrl, const KURL& redirectedUrl);
     double convertMonotonicTimeToDocumentTime(double monotonicTime) const;
 
diff --git a/Source/WebCore/loader/DocumentWriter.cpp b/Source/WebCore/loader/DocumentWriter.cpp
index 9ce3effd6..654d4e526 100644
--- a/Source/WebCore/loader/DocumentWriter.cpp
+++ b/Source/WebCore/loader/DocumentWriter.cpp
@@ -58,6 +58,7 @@ DocumentWriter::DocumentWriter(Frame* frame)
     : m_frame(frame)
     , m_hasReceivedSomeData(false)
     , m_encodingWasChosenByUser(false)
+    , m_state(NotStartedWritingState)
 {
 }
 
@@ -154,6 +155,8 @@ void DocumentWriter::begin(const KURL& urlReference, bool dispatch, Document* ow
 
     if (m_frame->view() && m_frame->loader()->client()->hasHTMLView())
         m_frame->view()->setContentsSize(IntSize());
+
+    m_state = StartedWritingState;
 }
 
 TextResourceDecoder* DocumentWriter::createDecoderIfNeeded()
@@ -203,6 +206,15 @@ void DocumentWriter::reportDataReceived()
 
 void DocumentWriter::addData(const char* bytes, size_t length)
 {
+    // Check that we're inside begin()/end().
+    // FIXME: Change these to ASSERT once https://bugs.webkit.org/show_bug.cgi?id=80427 has
+    // been resolved.
+    if (m_state == NotStartedWritingState)
+        CRASH();
+    if (m_state == FinishedWritingState)
+        CRASH();
+
+    ASSERT(m_parser);
     m_parser->appendBytes(this, bytes, length);
 }
 
@@ -219,6 +231,10 @@ void DocumentWriter::endIfNotLoadingMainResource()
     if (m_frame->loader()->isLoadingMainResource() || !m_frame->page() || !m_frame->document())
         return;
 
+    // The parser is guaranteed to be released after this point. begin() would
+    // have to be called again before we can start writing more data.
+    m_state = FinishedWritingState;
+
     // http://bugs.webkit.org/show_bug.cgi?id=10854
     // The frame's last ref may be removed and it can be deleted by checkCompleted(), 
     // so we'll add a protective refcount
@@ -243,7 +259,7 @@ void DocumentWriter::setEncoding(const String& name, bool userChosen)
 
 void DocumentWriter::setDocumentWasLoadedAsPartOfNavigation()
 {
-    ASSERT(!m_parser->isStopped());
+    ASSERT(m_parser && !m_parser->isStopped());
     m_parser->setDocumentWasLoadedAsPartOfNavigation();
 }
 
diff --git a/Source/WebCore/loader/DocumentWriter.h b/Source/WebCore/loader/DocumentWriter.h
index bf8d95f7f..34bf83016 100644
--- a/Source/WebCore/loader/DocumentWriter.h
+++ b/Source/WebCore/loader/DocumentWriter.h
@@ -53,7 +53,6 @@ public:
     void begin(const KURL&, bool dispatchWindowObjectAvailable = true, Document* ownerDocument = 0);
     void addData(const char* bytes, size_t length);
     void end();
-    void endIfNotLoadingMainResource();
     
     void setFrame(Frame* frame) { m_frame = frame; }
 
@@ -71,6 +70,7 @@ public:
 private:
     PassRefPtr<Document> createDocument(const KURL&);
     void clear();
+    void endIfNotLoadingMainResource();
 
     Frame* m_frame;
 
@@ -81,6 +81,13 @@ private:
     String m_encoding;
     RefPtr<TextResourceDecoder> m_decoder;
     RefPtr<DocumentParser> m_parser;
+
+    enum WriterState {
+        NotStartedWritingState,
+        StartedWritingState,
+        FinishedWritingState,
+    };
+    WriterState m_state;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index 8c4f00a52..3fc204dc2 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -151,9 +151,9 @@ public:
     virtual bool hasOpenedPopup() const OVERRIDE { return false; }
     virtual PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const { return adoptRef(new EmptyPopupMenu()); }
     virtual PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const { return adoptRef(new EmptySearchPopupMenu()); }
-
-#if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() { }
+#if ENABLE(PAGE_POPUP)
+    virtual PagePopup* openPagePopup(PagePopupClient*, const IntRect&) OVERRIDE { return 0; }
+    virtual void closePagePopup(PagePopup*) OVERRIDE { }
 #endif
 
 #if ENABLE(REGISTER_PROTOCOL_HANDLER)
@@ -398,7 +398,7 @@ public:
     virtual void registerForIconNotification(bool) { }
 
 #if USE(V8)
-    virtual void didCreateScriptContext(v8::Handle<v8::Context>, int worldId) { }
+    virtual void didCreateScriptContext(v8::Handle<v8::Context>, int extensionGroup, int worldId) { }
     virtual void willReleaseScriptContext(v8::Handle<v8::Context>, int worldId) { }
     virtual bool allowScriptExtension(const String& extensionName, int extensionGroup, int worldId) { return false; }
 #endif
@@ -498,7 +498,7 @@ public:
 
     virtual NSString* userVisibleString(NSURL*) { return 0; }
     virtual DocumentFragment* documentFragmentFromAttributedString(NSAttributedString*, Vector<RefPtr<ArchiveResource> >&) { return 0; };
-    virtual void setInsertionPasteboard(NSPasteboard*) { };
+    virtual void setInsertionPasteboard(const String&) { };
     virtual NSURL* canonicalizeURL(NSURL*) { return 0; }
     virtual NSURL* canonicalizeURLString(NSString*) { return 0; }
 #endif
@@ -566,6 +566,10 @@ public:
 #if PLATFORM(MAC)
     virtual void searchWithSpotlight() { }
 #endif
+
+#if USE(ACCESSIBILITY_CONTEXT_MENUS)
+    virtual void showContextMenu() { }
+#endif
 };
 #endif // ENABLE(CONTEXT_MENUS)
 
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 5635539d7..6776ad793 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -46,6 +46,7 @@
 #include "ChromeClient.h"
 #include "Console.h"
 #include "ContentSecurityPolicy.h"
+#include "DatabaseContext.h"
 #include "DOMImplementation.h"
 #include "DOMWindow.h"
 #include "Document.h"
@@ -250,7 +251,6 @@ void FrameLoader::setDefersLoading(bool defers)
 
 void FrameLoader::changeLocation(SecurityOrigin* securityOrigin, const KURL& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool refresh)
 {
-    RefPtr<Frame> protect(m_frame);
     urlSelected(FrameLoadRequest(securityOrigin, ResourceRequest(url, referrer, refresh ? ReloadIgnoringCacheData : UseProtocolCachePolicy), "_self"),
         0, lockHistory, lockBackForwardList, MaybeSendReferrer, ReplaceDocumentIfJavaScriptURL);
 }
@@ -267,6 +267,7 @@ void FrameLoader::urlSelected(const FrameLoadRequest& passedRequest, PassRefPtr<
 {
     ASSERT(!m_suppressOpenerInNewFrame);
 
+    RefPtr<Frame> protect(m_frame);
     FrameLoadRequest frameRequest(passedRequest);
 
     if (m_frame->script()->executeIfJavaScriptURL(frameRequest.resourceRequest().url(), shouldReplaceDocumentIfJavaScriptURL))
@@ -418,7 +419,8 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy)
         doc->setReadyState(Document::Complete);
 
 #if ENABLE(SQL_DATABASE)
-        doc->stopDatabases(0);
+        // FIXME: Should the DatabaseContext watch for something like ActiveDOMObject::stop() rather than being special-cased here?
+        DatabaseContext::stopDatabases(doc, 0);
 #endif
     }
 
@@ -736,6 +738,7 @@ void FrameLoader::checkCompleted()
 
     // OK, completed.
     m_isComplete = true;
+    m_requestedHistoryItem = 0;
     m_frame->document()->setReadyState(Document::Complete);
 
     RefPtr<Frame> protect(m_frame);
@@ -2023,7 +2026,7 @@ void FrameLoader::open(CachedFrameBase& cachedFrame)
     KURL url = cachedFrame.url();
 
     // FIXME: I suspect this block of code doesn't do anything.
-    if (url.protocolInHTTPFamily() && !url.host().isEmpty() && url.path().isEmpty())
+    if (url.protocolIsInHTTPFamily() && !url.host().isEmpty() && url.path().isEmpty())
         url.setPath("/");
 
     m_hasReceivedFirstData = false;
@@ -2552,7 +2555,7 @@ void FrameLoader::addExtraFieldsToRequest(ResourceRequest& request, FrameLoadTyp
     }
 
     // The remaining modifications are only necessary for HTTP and HTTPS.
-    if (!request.url().isEmpty() && !request.url().protocolInHTTPFamily())
+    if (!request.url().isEmpty() && !request.url().protocolIsInHTTPFamily())
         return;
 
     applyUserAgent(request);
@@ -3171,6 +3174,7 @@ void FrameLoader::loadDifferentDocumentItem(HistoryItem* item, FrameLoadType loa
 // Loads content into this frame, as specified by history item
 void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
 {
+    m_requestedHistoryItem = item;
     HistoryItem* currentItem = history()->currentItem();
     bool sameDocumentNavigation = currentItem && item->shouldDoSameDocumentNavigationTo(currentItem);
 
diff --git a/Source/WebCore/loader/FrameLoader.h b/Source/WebCore/loader/FrameLoader.h
index 218028c64..df357d6cd 100644
--- a/Source/WebCore/loader/FrameLoader.h
+++ b/Source/WebCore/loader/FrameLoader.h
@@ -119,6 +119,7 @@ public:
 
     void open(CachedFrameBase&);
     void loadItem(HistoryItem*, FrameLoadType);
+    HistoryItem* requestedHistoryItem() const { return m_requestedHistoryItem.get(); }
 
     static void reportLocalLoadFailed(Frame*, const String& url);
 
@@ -437,6 +438,7 @@ private:
 #endif
 
     KURL m_previousUrl;
+    RefPtr<HistoryItem> m_requestedHistoryItem;
 };
 
 // This function is called by createWindow() in JSDOMWindowBase.cpp, for example, for
diff --git a/Source/WebCore/loader/FrameLoaderClient.h b/Source/WebCore/loader/FrameLoaderClient.h
index 8efa55538..235c41c83 100644
--- a/Source/WebCore/loader/FrameLoaderClient.h
+++ b/Source/WebCore/loader/FrameLoaderClient.h
@@ -280,7 +280,7 @@ namespace WebCore {
         virtual void didPerformFirstNavigation() const = 0; // "Navigation" here means a transition from one page to another that ends up in the back/forward list.
 
 #if USE(V8)
-        virtual void didCreateScriptContext(v8::Handle<v8::Context>, int worldId) = 0;
+        virtual void didCreateScriptContext(v8::Handle<v8::Context>, int extensionGroup, int worldId) = 0;
         virtual void willReleaseScriptContext(v8::Handle<v8::Context>, int worldId) = 0;
         virtual bool allowScriptExtension(const String& extensionName, int extensionGroup, int worldId) = 0;
 #endif
diff --git a/Source/WebCore/loader/HistoryController.cpp b/Source/WebCore/loader/HistoryController.cpp
index 379b6d357..e44ba1e86 100644
--- a/Source/WebCore/loader/HistoryController.cpp
+++ b/Source/WebCore/loader/HistoryController.cpp
@@ -200,9 +200,10 @@ void HistoryController::restoreDocumentState()
     
     if (!itemToRestore)
         return;
-
-    LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->uniqueName().string().utf8().data(), itemToRestore);
-    doc->setStateForNewFormElements(itemToRestore->documentState());
+    if (m_frame->loader()->requestedHistoryItem() == m_currentItem.get() && !m_frame->loader()->documentLoader()->isClientRedirect()) {
+        LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->uniqueName().string().utf8().data(), itemToRestore);
+        doc->setStateForNewFormElements(itemToRestore->documentState());
+    }
 }
 
 void HistoryController::invalidateCurrentItemCachedPage()
diff --git a/Source/WebCore/loader/ResourceLoadScheduler.cpp b/Source/WebCore/loader/ResourceLoadScheduler.cpp
index 86cf0a1a2..8004d8f2e 100644
--- a/Source/WebCore/loader/ResourceLoadScheduler.cpp
+++ b/Source/WebCore/loader/ResourceLoadScheduler.cpp
@@ -54,7 +54,7 @@ static const unsigned maxRequestsInFlightPerHost = 10000;
 
 ResourceLoadScheduler::HostInformation* ResourceLoadScheduler::hostForURL(const KURL& url, CreateHostPolicy createHostPolicy)
 {
-    if (!url.protocolInHTTPFamily())
+    if (!url.protocolIsInHTTPFamily())
         return m_nonHTTPProtocolHost;
 
     m_hosts.checkConsistency();
@@ -126,7 +126,7 @@ void ResourceLoadScheduler::scheduleLoad(ResourceLoader* resourceLoader, Resourc
     bool hadRequests = host->hasRequests();
     host->schedule(resourceLoader, priority);
 
-    if (priority > ResourceLoadPriorityLow || !resourceLoader->url().protocolInHTTPFamily() || (priority == ResourceLoadPriorityLow && !hadRequests)) {
+    if (priority > ResourceLoadPriorityLow || !resourceLoader->url().protocolIsInHTTPFamily() || (priority == ResourceLoadPriorityLow && !hadRequests)) {
         // Try to request important resources immediately.
         servePendingRequests(host, priority);
         return;
diff --git a/Source/WebCore/loader/ResourceLoader.cpp b/Source/WebCore/loader/ResourceLoader.cpp
index 4ec26cc0c..d8fe7dab0 100644
--- a/Source/WebCore/loader/ResourceLoader.cpp
+++ b/Source/WebCore/loader/ResourceLoader.cpp
@@ -31,8 +31,8 @@
 #include "ResourceLoader.h"
 
 #include "ApplicationCacheHost.h"
+#include "AsyncFileStream.h"
 #include "DocumentLoader.h"
-#include "FileStreamProxy.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
@@ -113,6 +113,7 @@ bool ResourceLoader::init(const ResourceRequest& r)
     
     ResourceRequest clientRequest(r);
     
+    m_defersLoading = m_frame->page()->defersLoading();
     if (m_options.securityCheck == DoSecurityCheck && !m_frame->document()->securityOrigin()->canDisplay(clientRequest.url())) {
         FrameLoader::reportLocalLoadFailed(m_frame.get(), clientRequest.url().string());
         releaseResources();
@@ -559,8 +560,8 @@ void ResourceLoader::willCacheResponse(ResourceHandle*, CacheStoragePolicy& poli
 #if ENABLE(BLOB)
 AsyncFileStream* ResourceLoader::createAsyncFileStream(FileStreamClient* client)
 {
-    // It is OK to simply return a pointer since FileStreamProxy::create adds an extra ref.
-    return FileStreamProxy::create(m_frame->document()->scriptExecutionContext(), client).get();
+    // It is OK to simply return a pointer since AsyncFileStream::create adds an extra ref.
+    return AsyncFileStream::create(m_frame->document()->scriptExecutionContext(), client).get();
 }
 #endif
 
diff --git a/Source/WebCore/loader/appcache/ApplicationCache.cpp b/Source/WebCore/loader/appcache/ApplicationCache.cpp
index 589587d30..63cd7bbbf 100644
--- a/Source/WebCore/loader/appcache/ApplicationCache.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCache.cpp
@@ -117,7 +117,7 @@ ApplicationCacheResource* ApplicationCache::resourceForURL(const String& url)
 
 bool ApplicationCache::requestIsHTTPOrHTTPSGet(const ResourceRequest& request)
 {
-    if (!request.url().protocolInHTTPFamily())
+    if (!request.url().protocolIsInHTTPFamily())
         return false;
     
     if (!equalIgnoringCase(request.httpMethod(), "GET"))
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheAllInOne.cpp b/Source/WebCore/loader/appcache/ApplicationCacheAllInOne.cpp
new file mode 100644
index 000000000..f0e13625f
--- /dev/null
+++ b/Source/WebCore/loader/appcache/ApplicationCacheAllInOne.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "ApplicationCache.cpp"
+#include "ApplicationCacheGroup.cpp"
+#include "ApplicationCacheHost.cpp"
+#include "ApplicationCacheResource.cpp"
+#include "ApplicationCacheStorage.cpp"
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 013a78ddd..e6229c44d 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -490,6 +490,22 @@ PassRefPtr<ResourceHandle> ApplicationCacheGroup::createResourceHandle(const KUR
         }
     }
 
+#if PLATFORM(BLACKBERRY)
+    ResourceRequest::TargetType target = ResourceRequest::TargetIsUnspecified;
+    if (newestCachedResource) {
+        const String& mimeType = newestCachedResource->response().mimeType();
+        if (!mimeType.isEmpty())
+            target = ResourceRequest::targetTypeFromMimeType(mimeType);
+    }
+    if (target == ResourceRequest::TargetIsUnspecified) {
+        String mimeType = mimeTypeFromDataURL(url);
+        if (!mimeType.isEmpty())
+            target = ResourceRequest::targetTypeFromMimeType(mimeType);
+    }
+
+    request.setTargetType(target);
+#endif
+
     RefPtr<ResourceHandle> handle = ResourceHandle::create(m_frame->loader()->networkingContext(), request, this, false, true);
 #if ENABLE(INSPECTOR)
     // Because willSendRequest only gets called during redirects, we initialize
diff --git a/Source/WebCore/loader/cache/CachedRawResource.cpp b/Source/WebCore/loader/cache/CachedRawResource.cpp
index 196d7a90d..8df8fb61c 100644
--- a/Source/WebCore/loader/cache/CachedRawResource.cpp
+++ b/Source/WebCore/loader/cache/CachedRawResource.cpp
@@ -74,9 +74,10 @@ void CachedRawResource::didAddClient(CachedResourceClient* c)
         return;
     CachedRawResourceClient* client = static_cast<CachedRawResourceClient*>(c);
     client->responseReceived(this, m_response);
-    if (!hasClient(c) || !m_data)
+    if (!hasClient(c))
         return;
-    client->dataReceived(this, m_data->data(), m_data->size());
+    if (m_data)
+        client->dataReceived(this, m_data->data(), m_data->size());
     if (!hasClient(c))
        return;
     CachedResource::didAddClient(client);
diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
index 78a71c187..a74dbd6aa 100755
--- a/Source/WebCore/loader/cache/CachedResource.cpp
+++ b/Source/WebCore/loader/cache/CachedResource.cpp
@@ -91,7 +91,7 @@ static ResourceLoadPriority defaultPriorityForResourceType(CachedResource::Type
     return ResourceLoadPriorityLow;
 }
 
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
 static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource::Type type)
 {
     switch (type) {
@@ -191,7 +191,7 @@ void CachedResource::load(CachedResourceLoader* cachedResourceLoader, const Reso
     m_options = options;
     m_loading = true;
 
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
     if (m_resourceRequest.targetType() == ResourceRequest::TargetIsUnspecified)
         m_resourceRequest.setTargetType(cachedResourceTypeToTargetType(type()));
 #endif
@@ -299,7 +299,7 @@ double CachedResource::currentAge() const
 double CachedResource::freshnessLifetime() const
 {
     // Cache non-http resources liberally
-    if (!m_response.url().protocolInHTTPFamily())
+    if (!m_response.url().protocolIsInHTTPFamily())
         return std::numeric_limits<double>::max();
 
     // RFC2616 13.2.4
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index aaf753eb8..7dc24f9c4 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -330,8 +330,8 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
             printAccessDeniedMessage(url);
             return false;
         }
-        break;
 #endif
+        break;
     }
 
     switch (type) {
diff --git a/Source/WebCore/loader/cache/CachedShader.cpp b/Source/WebCore/loader/cache/CachedShader.cpp
index 16d780adc..b8d7c5f9a 100644
--- a/Source/WebCore/loader/cache/CachedShader.cpp
+++ b/Source/WebCore/loader/cache/CachedShader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/loader/cache/CachedShader.h b/Source/WebCore/loader/cache/CachedShader.h
index cc38f58b4..d1de14d77 100644
--- a/Source/WebCore/loader/cache/CachedShader.h
+++ b/Source/WebCore/loader/cache/CachedShader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/loader/cache/MemoryCache.cpp b/Source/WebCore/loader/cache/MemoryCache.cpp
index f46889fd0..6796c12fb 100644
--- a/Source/WebCore/loader/cache/MemoryCache.cpp
+++ b/Source/WebCore/loader/cache/MemoryCache.cpp
@@ -77,7 +77,7 @@ KURL MemoryCache::removeFragmentIdentifierIfNeeded(const KURL& originalURL)
     // Strip away fragment identifier from HTTP URLs.
     // Data URLs must be unmodified. For file and custom URLs clients may expect resources 
     // to be unique even when they differ by the fragment identifier only.
-    if (!originalURL.protocolInHTTPFamily())
+    if (!originalURL.protocolIsInHTTPFamily())
         return originalURL;
     KURL url = originalURL;
     url.removeFragmentIdentifier();
diff --git a/Source/WebCore/loader/cache/MemoryCache.h b/Source/WebCore/loader/cache/MemoryCache.h
index a937d96d2..0ad79fce9 100644
--- a/Source/WebCore/loader/cache/MemoryCache.h
+++ b/Source/WebCore/loader/cache/MemoryCache.h
@@ -162,6 +162,12 @@ public:
     void removeResourcesWithOrigin(SecurityOrigin*);
     void getOriginsWithCache(SecurityOriginSet& origins);
 
+    unsigned minDeadCapacity() const { return m_minDeadCapacity; }
+    unsigned maxDeadCapacity() const { return m_maxDeadCapacity; }
+    unsigned capacity() const { return m_capacity; }
+    unsigned liveSize() const { return m_liveSize; }
+    unsigned deadSize() const { return m_deadSize; }
+
 private:
     MemoryCache();
     ~MemoryCache(); // Not implemented to make sure nobody accidentally calls delete -- WebCore does not delete singletons.
diff --git a/Source/WebCore/loader/icon/IconController.cpp b/Source/WebCore/loader/icon/IconController.cpp
index 2e5638cb0..b4a72c63b 100644
--- a/Source/WebCore/loader/icon/IconController.cpp
+++ b/Source/WebCore/loader/icon/IconController.cpp
@@ -257,7 +257,7 @@ IconURL IconController::defaultURL(IconType iconType)
 {
     // Don't return a favicon iconURL unless we're http or https
     KURL documentURL = m_frame->document()->url();
-    if (!documentURL.protocolInHTTPFamily())
+    if (!documentURL.protocolIsInHTTPFamily())
         return IconURL();
 
     KURL url;
diff --git a/Source/WebCore/loader/icon/IconDatabase.h b/Source/WebCore/loader/icon/IconDatabase.h
index f4abb8b13..e4d8ca73a 100644
--- a/Source/WebCore/loader/icon/IconDatabase.h
+++ b/Source/WebCore/loader/icon/IconDatabase.h
@@ -63,7 +63,10 @@ class SQLTransaction;
 // For builds with IconDatabase disabled, they'll just use a default derivation of IconDatabaseBase. Which does nothing.
 class IconDatabase : public IconDatabaseBase {
 public:
+    static PassOwnPtr<IconDatabase> create() { return adoptPtr(new IconDatabase); }
     static void delayDatabaseCleanup() { }
+    static void allowDatabaseCleanup() { }
+    static void checkIntegrityBeforeOpening() { }
     static String defaultDatabaseFilename() { return "WebpageIcons.db"; }
 };
 #else 
diff --git a/Source/WebCore/mathml/MathMLAllInOne.cpp b/Source/WebCore/mathml/MathMLAllInOne.cpp
new file mode 100644
index 000000000..76b54a9e4
--- /dev/null
+++ b/Source/WebCore/mathml/MathMLAllInOne.cpp
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "MathMLElement.cpp"
+#include "MathMLInlineContainerElement.cpp"
+#include "MathMLMathElement.cpp"
+#include "MathMLTextElement.cpp"
diff --git a/Source/WebCore/mathml/MathMLElement.cpp b/Source/WebCore/mathml/MathMLElement.cpp
index 4c00defa3..44a1ac3d8 100644
--- a/Source/WebCore/mathml/MathMLElement.cpp
+++ b/Source/WebCore/mathml/MathMLElement.cpp
@@ -48,11 +48,11 @@ PassRefPtr<MathMLElement> MathMLElement::create(const QualifiedName& tagName, Do
     return adoptRef(new MathMLElement(tagName, document));
 }
 
-bool MathMLElement::isPresentationAttribute(Attribute* attr) const
+bool MathMLElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == mathbackgroundAttr || attr->name() == mathsizeAttr || attr->name() == mathcolorAttr || attr->name() == fontsizeAttr || attr->name() == backgroundAttr || attr->name() == colorAttr || attr->name() == fontstyleAttr || attr->name() == fontweightAttr || attr->name() == fontfamilyAttr)
+    if (name == mathbackgroundAttr || name == mathsizeAttr || name == mathcolorAttr || name == fontsizeAttr || name == backgroundAttr || name == colorAttr || name == fontstyleAttr || name == fontweightAttr || name == fontfamilyAttr)
         return true;
-    return StyledElement::isPresentationAttribute(attr);
+    return StyledElement::isPresentationAttribute(name);
 }
 
 void MathMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -79,7 +79,7 @@ void MathMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet*
     else if (attr->name() == fontfamilyAttr)
         addPropertyToAttributeStyle(style, CSSPropertyFontFamily, attr->value());
     else {
-        ASSERT(!isPresentationAttribute(attr));
+        ASSERT(!isPresentationAttribute(attr->name()));
         StyledElement::collectStyleForAttribute(attr, style);
     }
 }
diff --git a/Source/WebCore/mathml/MathMLElement.h b/Source/WebCore/mathml/MathMLElement.h
index 4b092513f..753537bc3 100644
--- a/Source/WebCore/mathml/MathMLElement.h
+++ b/Source/WebCore/mathml/MathMLElement.h
@@ -42,10 +42,16 @@ protected:
 
 private:    
     virtual bool isMathMLElement() const { return true; }
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
-    
+
+inline MathMLElement* toMathMLElement(Element* element)
+{
+    ASSERT(!element || element->isMathMLElement());
+    return static_cast<MathMLElement*>(element);
+}
+
 }
 
 #endif // ENABLE(MATHML)
diff --git a/Source/WebCore/mediastream/DOMWindowMediaStream.idl b/Source/WebCore/mediastream/DOMWindowMediaStream.idl
deleted file mode 100644
index 589878abe..000000000
--- a/Source/WebCore/mediastream/DOMWindowMediaStream.idl
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    interface [
-        Conditional=MEDIA_STREAM,
-        Supplemental=DOMWindow
-    ] DOMWindowMediaStream {
-        attribute [V8EnabledAtRuntime] PeerConnectionConstructor webkitPeerConnection;
-        attribute MediaStreamEventConstructor MediaStreamEvent;
-    };
-
-}
diff --git a/Source/WebCore/notifications/Notification.cpp b/Source/WebCore/notifications/Notification.cpp
index 74964dc77..5de0e527c 100644
--- a/Source/WebCore/notifications/Notification.cpp
+++ b/Source/WebCore/notifications/Notification.cpp
@@ -39,8 +39,8 @@
 #include "ErrorEvent.h"
 #include "EventNames.h"
 #include "NotificationCenter.h"
+#include "NotificationClient.h"
 #include "NotificationContents.h"
-#include "NotificationPresenter.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "ThreadableLoader.h"
@@ -59,8 +59,8 @@ Notification::Notification(const KURL& url, ScriptExecutionContext* context, Exc
     , m_state(Idle)
     , m_notificationCenter(provider)
 {
-    ASSERT(m_notificationCenter->presenter());
-    if (m_notificationCenter->presenter()->checkPermission(context) != NotificationPresenter::PermissionAllowed) {
+    ASSERT(m_notificationCenter->client());
+    if (m_notificationCenter->client()->checkPermission(context) != NotificationClient::PermissionAllowed) {
         ec = SECURITY_ERR;
         return;
     }
@@ -80,8 +80,8 @@ Notification::Notification(const NotificationContents& contents, ScriptExecution
     , m_state(Idle)
     , m_notificationCenter(provider)
 {
-    ASSERT(m_notificationCenter->presenter());
-    if (m_notificationCenter->presenter()->checkPermission(context) != NotificationPresenter::PermissionAllowed) {
+    ASSERT(m_notificationCenter->client());
+    if (m_notificationCenter->client()->checkPermission(context) != NotificationClient::PermissionAllowed) {
         ec = SECURITY_ERR;
         return;
     }
@@ -127,19 +127,19 @@ void Notification::show()
         // handling of ondisplay may rely on that.
         if (m_state == Idle) {
             m_state = Showing;
-            if (m_notificationCenter->presenter())
-                m_notificationCenter->presenter()->show(this);
+            if (m_notificationCenter->client())
+                m_notificationCenter->client()->show(this);
         }
     } else
         startLoading();
 #elif PLATFORM(MAC)
-    if (m_state == Idle && m_notificationCenter->presenter()) {
-        m_notificationCenter->presenter()->show(this);
+    if (m_state == Idle && m_notificationCenter->client()) {
+        m_notificationCenter->client()->show(this);
         m_state = Showing;
     }
 #else
     // prevent double-showing
-    if (m_state == Idle && m_notificationCenter->presenter() && m_notificationCenter->presenter()->show(this))
+    if (m_state == Idle && m_notificationCenter->client() && m_notificationCenter->client()->show(this))
         m_state = Showing;
 #endif
 }
@@ -154,8 +154,8 @@ void Notification::cancel()
         stopLoading();
         break;
     case Showing:
-        if (m_notificationCenter->presenter())
-            m_notificationCenter->presenter()->cancel(this);
+        if (m_notificationCenter->client())
+            m_notificationCenter->client()->cancel(this);
         break;
     case Cancelled:
         break;
@@ -175,8 +175,8 @@ EventTargetData* Notification::ensureEventTargetData()
 void Notification::contextDestroyed()
 {
     ActiveDOMObject::contextDestroyed();
-    if (m_notificationCenter->presenter())
-        m_notificationCenter->presenter()->notificationObjectDestroyed(this);
+    if (m_notificationCenter->client())
+        m_notificationCenter->client()->notificationObjectDestroyed(this);
 }
 
 void Notification::startLoading()
@@ -234,7 +234,7 @@ void Notification::didFailRedirectCheck()
 void Notification::finishLoading()
 {
     if (m_state == Loading) {
-        if (m_notificationCenter->presenter() && m_notificationCenter->presenter()->show(this))
+        if (m_notificationCenter->client() && m_notificationCenter->client()->show(this))
             m_state = Showing;
     }
     unsetPendingActivity(this);
diff --git a/Source/WebCore/notifications/NotificationCenter.cpp b/Source/WebCore/notifications/NotificationCenter.cpp
index 71146af8d..ff6044531 100644
--- a/Source/WebCore/notifications/NotificationCenter.cpp
+++ b/Source/WebCore/notifications/NotificationCenter.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -35,46 +36,46 @@
 #include "NotificationCenter.h"
 
 #include "Document.h"
-#include "NotificationPresenter.h"
+#include "NotificationClient.h"
 #include "VoidCallback.h"
 #include "WorkerContext.h"
 
 namespace WebCore {
 
-PassRefPtr<NotificationCenter> NotificationCenter::create(ScriptExecutionContext* context, NotificationPresenter* presenter)
+PassRefPtr<NotificationCenter> NotificationCenter::create(ScriptExecutionContext* context, NotificationClient* client)
 {
-    RefPtr<NotificationCenter> notificationCenter(adoptRef(new NotificationCenter(context, presenter)));
+    RefPtr<NotificationCenter> notificationCenter(adoptRef(new NotificationCenter(context, client)));
     notificationCenter->suspendIfNeeded();
     return notificationCenter.release();
 }
 
-NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter)
+NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationClient* client)
     : ActiveDOMObject(context, this)
-    , m_notificationPresenter(presenter) {}
+    , m_client(client) { }
 
 int NotificationCenter::checkPermission()
 {
-    if (!presenter() || !scriptExecutionContext())
-        return NotificationPresenter::PermissionDenied;
-    return m_notificationPresenter->checkPermission(scriptExecutionContext());
+    if (!client() || !scriptExecutionContext())
+        return NotificationClient::PermissionDenied;
+    return m_client->checkPermission(scriptExecutionContext());
 }
 
 void NotificationCenter::requestPermission(PassRefPtr<VoidCallback> callback)
 {
-    if (!presenter() || !scriptExecutionContext())
+    if (!client() || !scriptExecutionContext())
         return;
-    m_notificationPresenter->requestPermission(scriptExecutionContext(), callback);
+    m_client->requestPermission(scriptExecutionContext(), callback);
 }
 
 void NotificationCenter::disconnectFrame()
 {
     // Can be 0 if iframe was transferred into another page. In this case
     // this method is invoked more then once.
-    if (!m_notificationPresenter)
+    if (!m_client)
         return;
-    m_notificationPresenter->cancelRequestsForPermission(scriptExecutionContext());
-    m_notificationPresenter->clearNotifications(scriptExecutionContext());
-    m_notificationPresenter = 0;
+    m_client->cancelRequestsForPermission(scriptExecutionContext());
+    m_client->clearNotifications(scriptExecutionContext());
+    m_client = 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/notifications/NotificationCenter.h b/Source/WebCore/notifications/NotificationCenter.h
index 402ccba93..2cccc0dfc 100644
--- a/Source/WebCore/notifications/NotificationCenter.h
+++ b/Source/WebCore/notifications/NotificationCenter.h
@@ -45,16 +45,16 @@
 
 namespace WebCore {
 
-class NotificationPresenter;
+class NotificationClient;
 class VoidCallback;
 
 class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject {
 public:
-    static PassRefPtr<NotificationCenter> create(ScriptExecutionContext*, NotificationPresenter*);
+    static PassRefPtr<NotificationCenter> create(ScriptExecutionContext*, NotificationClient*);
 
     PassRefPtr<Notification> createHTMLNotification(const String& URI, ExceptionCode& ec)
     {
-        if (!presenter()) {
+        if (!client()) {
             ec = INVALID_STATE_ERR;
             return 0;
         }
@@ -67,7 +67,7 @@ public:
 
     PassRefPtr<Notification> createNotification(const String& iconURI, const String& title, const String& body, ExceptionCode& ec)
     {
-        if (!presenter()) {
+        if (!client()) {
             ec = INVALID_STATE_ERR;
             return 0;
         }
@@ -75,7 +75,7 @@ public:
         return Notification::create(contents, scriptExecutionContext(), ec, this);
     }
 
-    NotificationPresenter* presenter() const { return m_notificationPresenter; }
+    NotificationClient* client() const { return m_client; }
 
     int checkPermission();
     void requestPermission(PassRefPtr<VoidCallback>);
@@ -83,9 +83,9 @@ public:
     void disconnectFrame();
 
 private:
-    NotificationCenter(ScriptExecutionContext*, NotificationPresenter*);
+    NotificationCenter(ScriptExecutionContext*, NotificationClient*);
 
-    NotificationPresenter* m_notificationPresenter;
+    NotificationClient* m_client;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/notifications/NotificationPresenter.h b/Source/WebCore/notifications/NotificationClient.h
index 1935384dc..c1b339b34 100644
--- a/Source/WebCore/notifications/NotificationPresenter.h
+++ b/Source/WebCore/notifications/NotificationClient.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,11 +29,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef NotificationPresenter_h
-#define NotificationPresenter_h
+#ifndef NotificationClient_h
+#define NotificationClient_h
 
-#include <wtf/PassRefPtr.h>
 #include "VoidCallback.h"
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
@@ -43,7 +43,7 @@ class KURL;
 class Page;
 class ScriptExecutionContext;
 
-class NotificationPresenter {
+class NotificationClient {
 
 public:
     enum Permission {
@@ -82,11 +82,11 @@ public:
     virtual Permission checkPermission(ScriptExecutionContext*) = 0;
 
 protected:
-    virtual ~NotificationPresenter() { }
+    virtual ~NotificationClient() { }
 };
 
-void provideNotification(Page*, NotificationPresenter*);
+void provideNotification(Page*, NotificationClient*);
 
 } // namespace WebCore
 
-#endif // NotificationPresenter_h
+#endif // NotificationClient_h
diff --git a/Source/WebCore/notifications/NotificationController.cpp b/Source/WebCore/notifications/NotificationController.cpp
index cbdc3ea45..df235d3c4 100644
--- a/Source/WebCore/notifications/NotificationController.cpp
+++ b/Source/WebCore/notifications/NotificationController.cpp
@@ -28,12 +28,12 @@
 
 #if ENABLE(NOTIFICATIONS)
 
-#include "NotificationPresenter.h"
+#include "NotificationClient.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-NotificationController::NotificationController(Page* page, NotificationPresenter* client)
+NotificationController::NotificationController(Page* page, NotificationClient* client)
     : m_page(page)
     , m_client(client)
 {
@@ -45,12 +45,12 @@ NotificationController::~NotificationController()
         m_client->notificationControllerDestroyed();
 }
 
-PassOwnPtr<NotificationController> NotificationController::create(Page* page, NotificationPresenter* client)
+PassOwnPtr<NotificationController> NotificationController::create(Page* page, NotificationClient* client)
 {
     return adoptPtr(new NotificationController(page, client));
 }
 
-NotificationPresenter* NotificationController::clientFrom(Page* page)
+NotificationClient* NotificationController::clientFrom(Page* page)
 {
     if (NotificationController* controller = NotificationController::from(page))
         return controller->client();
@@ -63,9 +63,9 @@ const AtomicString& NotificationController::supplementName()
     return name;
 }
 
-void provideNotification(Page* page, NotificationPresenter* client)
+void provideNotification(Page* page, NotificationClient* client)
 {
-    PageSupplement::provideTo(page, NotificationController::supplementName(), NotificationController::create(page, client));
+    NotificationController::provideTo(page, NotificationController::supplementName(), NotificationController::create(page, client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/notifications/NotificationController.h b/Source/WebCore/notifications/NotificationController.h
index 33a95d516..7e9d597e3 100644
--- a/Source/WebCore/notifications/NotificationController.h
+++ b/Source/WebCore/notifications/NotificationController.h
@@ -28,33 +28,31 @@
 
 #if ENABLE(NOTIFICATIONS)
 
-#include "PageSupplement.h"
+#include "Page.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
-class NotificationPresenter;
-class Page;
+class NotificationClient;
 
-class NotificationController : public PageSupplement {
+class NotificationController : public Supplement<Page> {
     WTF_MAKE_NONCOPYABLE(NotificationController);
 public:
     ~NotificationController();
 
-    static PassOwnPtr<NotificationController> create(Page*, NotificationPresenter*);
+    static PassOwnPtr<NotificationController> create(Page*, NotificationClient*);
     static const AtomicString& supplementName();
-    static NotificationController* from(Frame* frame) { return static_cast<NotificationController*>(PageSupplement::from(frame, supplementName())); }
-    static NotificationController* from(Page* page) { return static_cast<NotificationController*>(PageSupplement::from(page, supplementName())); }
-    static NotificationPresenter* clientFrom(Page*);
+    static NotificationController* from(Page* page) { return static_cast<NotificationController*>(Supplement<Page>::from(page, supplementName())); }
+    static NotificationClient* clientFrom(Page*);
 
-    NotificationPresenter* client() { return m_client; }
+    NotificationClient* client() { return m_client; }
     
 private:
-    NotificationController(Page*, NotificationPresenter*);
+    NotificationController(Page*, NotificationClient*);
 
     Page* m_page;
-    NotificationPresenter* m_client;
+    NotificationClient* m_client;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/Chrome.cpp b/Source/WebCore/page/Chrome.cpp
index 5e0122ddd..ade262d7c 100644
--- a/Source/WebCore/page/Chrome.cpp
+++ b/Source/WebCore/page/Chrome.cpp
@@ -555,13 +555,6 @@ PassRefPtr<SearchPopupMenu> Chrome::createSearchPopupMenu(PopupMenuClient* clien
     return m_client->createSearchPopupMenu(client);
 }
 
-#if ENABLE(CONTEXT_MENUS)
-void Chrome::showContextMenu()
-{
-    m_client->showContextMenu();
-}
-#endif
-
 bool Chrome::requiresFullscreenForVideoPlayback()
 {
     return m_client->requiresFullscreenForVideoPlayback();
diff --git a/Source/WebCore/page/Chrome.h b/Source/WebCore/page/Chrome.h
index c6704c97a..841eb50c0 100644
--- a/Source/WebCore/page/Chrome.h
+++ b/Source/WebCore/page/Chrome.h
@@ -173,10 +173,6 @@ namespace WebCore {
         PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const;
         PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const;
 
-#if ENABLE(CONTEXT_MENUS)
-        void showContextMenu();
-#endif
-
     private:
         Chrome(Page*, ChromeClient*);
 
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index 33b1c4b87..26d74ab21 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -58,6 +58,8 @@ namespace WebCore {
     class NavigationAction;
     class Node;
     class Page;
+    class PagePopup;
+    class PagePopupClient;
     class PopupMenuClient;
     class SecurityOrigin;
     class GraphicsContext3D;
@@ -306,9 +308,11 @@ namespace WebCore {
         virtual bool hasOpenedPopup() const = 0;
         virtual PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const = 0;
         virtual PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const = 0;
-
-#if ENABLE(CONTEXT_MENUS)
-        virtual void showContextMenu() = 0;
+#if ENABLE(PAGE_POPUP)
+        // Creates a PagePopup object, and shows it beside originBoundsInRootView.
+        // The return value can be 0.
+        virtual PagePopup* openPagePopup(PagePopupClient*, const IntRect& originBoundsInRootView) = 0;
+        virtual void closePagePopup(PagePopup*) = 0;
 #endif
 
         virtual void postAccessibilityNotification(AccessibilityObject*, AXObjectCache::AXNotification) { }
diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
index 9602cf759..83b62465b 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.cpp
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -487,6 +487,7 @@ ContentSecurityPolicy::ContentSecurityPolicy(ScriptExecutionContext* scriptExecu
     , m_scriptExecutionContext(scriptExecutionContext)
     , m_reportOnly(false)
     , m_haveSandboxPolicy(false)
+    , m_overrideInlineStyleAllowed(false)
 {
 }
 
@@ -622,7 +623,7 @@ bool ContentSecurityPolicy::allowInlineScript() const
 bool ContentSecurityPolicy::allowInlineStyle() const
 {
     DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to apply inline style because of Content-Security-Policy.\n"));
-    return checkInlineAndReportViolation(operativeDirective(m_styleSrc.get()), consoleMessage);
+    return m_overrideInlineStyleAllowed || checkInlineAndReportViolation(operativeDirective(m_styleSrc.get()), consoleMessage);
 }
 
 bool ContentSecurityPolicy::allowEval() const
@@ -679,6 +680,11 @@ bool ContentSecurityPolicy::allowConnectFromSource(const KURL& url) const
     return checkSourceAndReportViolation(operativeDirective(m_connectSrc.get()), url, type);
 }
 
+void ContentSecurityPolicy::setOverrideAllowInlineStyle(bool value)
+{
+    m_overrideInlineStyleAllowed = value;
+}
+
 // policy            = directive-list
 // directive-list    = [ directive *( ";" [ directive ] ) ]
 //
diff --git a/Source/WebCore/page/ContentSecurityPolicy.h b/Source/WebCore/page/ContentSecurityPolicy.h
index fa7632465..5ceeb685e 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.h
+++ b/Source/WebCore/page/ContentSecurityPolicy.h
@@ -70,6 +70,8 @@ public:
     bool allowMediaFromSource(const KURL&) const;
     bool allowConnectFromSource(const KURL&) const;
 
+    void setOverrideAllowInlineStyle(bool);
+
 private:
     explicit ContentSecurityPolicy(ScriptExecutionContext*);
 
@@ -107,6 +109,7 @@ private:
     OwnPtr<CSPDirective> m_mediaSrc;
     OwnPtr<CSPDirective> m_connectSrc;
     bool m_haveSandboxPolicy;
+    bool m_overrideInlineStyleAllowed;
     Vector<KURL> m_reportURLs;
 };
 
diff --git a/Source/WebCore/page/ContextMenuClient.h b/Source/WebCore/page/ContextMenuClient.h
index c9389c058..310349bb2 100644
--- a/Source/WebCore/page/ContextMenuClient.h
+++ b/Source/WebCore/page/ContextMenuClient.h
@@ -60,6 +60,10 @@ namespace WebCore {
 #if PLATFORM(MAC)
         virtual void searchWithSpotlight() = 0;
 #endif
+
+#if USE(ACCESSIBILITY_CONTEXT_MENUS)
+        virtual void showContextMenu() = 0;
+#endif
     };
 }
 
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index 98b29817f..c5156753b 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -58,6 +58,7 @@
 #include "NavigationAction.h"
 #include "Node.h"
 #include "Page.h"
+#include "PlatformEvent.h"
 #include "RenderLayer.h"
 #include "RenderObject.h"
 #include "ReplaceSelectionCommand.h"
@@ -1270,6 +1271,17 @@ void ContextMenuController::checkOrEnableIfNeeded(ContextMenuItem& item) const
     item.setEnabled(shouldEnable);
 }
 
+#if USE(ACCESSIBILITY_CONTEXT_MENUS)
+void ContextMenuController::showContextMenuAt(Frame* frame, const IntPoint& clickPoint)
+{
+    // Simulate a click in the middle of the accessibility object.
+    PlatformMouseEvent mouseEvent(clickPoint, clickPoint, RightButton, PlatformEvent::MousePressed, 1, false, false, false, false, currentTime());
+    bool handled = frame->eventHandler()->sendContextMenuEvent(mouseEvent);
+    if (handled && client())
+        client()->showContextMenu();
+}
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(CONTEXT_MENUS)
diff --git a/Source/WebCore/page/ContextMenuController.h b/Source/WebCore/page/ContextMenuController.h
index 3588f0371..fdae946d1 100644
--- a/Source/WebCore/page/ContextMenuController.h
+++ b/Source/WebCore/page/ContextMenuController.h
@@ -65,6 +65,10 @@ namespace WebCore {
         void setHitTestResult(const HitTestResult& result) { m_hitTestResult = result; }
         const HitTestResult& hitTestResult() { return m_hitTestResult; }
 
+#if USE(ACCESSIBILITY_CONTEXT_MENUS)
+        void showContextMenuAt(Frame*, const IntPoint& clickPoint);
+#endif
+
     private:
         ContextMenuController(Page*, ContextMenuClient*);
 
diff --git a/Source/WebCore/page/DOMSelection.idl b/Source/WebCore/page/DOMSelection.idl
index cd4b5938a..1f7d3da3f 100644
--- a/Source/WebCore/page/DOMSelection.idl
+++ b/Source/WebCore/page/DOMSelection.idl
@@ -33,7 +33,7 @@ module window {
     // https://developer.mozilla.org/En/DOM/Selection
     interface [
         JSGenerateIsReachable=ImplFrame,
-        OmitConstructor
+        InterfaceName=Selection
     ] DOMSelection {
         readonly attribute Node anchorNode;
         readonly attribute long anchorOffset;
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 051bbf0db..eec969ff6 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -65,8 +65,6 @@
 #include "FrameView.h"
 #include "HTMLFrameOwnerElement.h"
 #include "History.h"
-#include "IDBFactory.h"
-#include "IDBFactoryBackendInterface.h"
 #include "InspectorInstrumentation.h"
 #include "KURL.h"
 #include "Location.h"
@@ -420,9 +418,6 @@ DOMWindow::~DOMWindow()
 #if ENABLE(NOTIFICATIONS)
     ASSERT(!m_notifications);
 #endif
-#if ENABLE(INDEXED_DATABASE)
-    ASSERT(!m_idbFactory);
-#endif
 #if ENABLE(BLOB)
     ASSERT(!m_domURL);
 #endif
@@ -463,6 +458,11 @@ void DOMWindow::setSecurityOrigin(SecurityOrigin* securityOrigin)
     m_securityOrigin = securityOrigin;
 }
 
+Page* DOMWindow::page()
+{
+    return frame() ? frame()->page() : 0;
+}
+
 void DOMWindow::frameDestroyed()
 {
     FrameDestructionObserver::frameDestroyed();
@@ -526,9 +526,6 @@ void DOMWindow::clear()
     // the rest of the DOMWindowProperties.
     resetNotifications();
 #endif
-#if ENABLE(INDEXED_DATABASE)
-    m_idbFactory = 0;
-#endif
 #if ENABLE(BLOB)
     m_domURL = 0;
 #endif
@@ -719,7 +716,7 @@ NotificationCenter* DOMWindow::webkitNotifications() const
     if (!page)
         return 0;
 
-    NotificationPresenter* provider = NotificationController::clientFrom(page);
+    NotificationClient* provider = NotificationController::clientFrom(page);
     if (provider) 
         m_notifications = NotificationCenter::create(document, provider);    
       
@@ -735,13 +732,6 @@ void DOMWindow::resetNotifications()
 }
 #endif
 
-#if ENABLE(INDEXED_DATABASE)
-void DOMWindow::setIDBFactory(PassRefPtr<IDBFactory> idbFactory)
-{
-    m_idbFactory = idbFactory;
-}
-#endif
-
 void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     MessagePortArray ports;
@@ -1494,10 +1484,10 @@ bool DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<Event
         addBeforeUnloadEventListener(this);
 #if ENABLE(DEVICE_ORIENTATION)
     else if (eventType == eventNames().devicemotionEvent) {
-        if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+        if (DeviceMotionController* controller = DeviceMotionController::from(page()))
             controller->addListener(this);
     } else if (eventType == eventNames().deviceorientationEvent) {
-        if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+        if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
             controller->addListener(this);
     }
 #endif
@@ -1521,10 +1511,10 @@ bool DOMWindow::removeEventListener(const AtomicString& eventType, EventListener
         removeBeforeUnloadEventListener(this);
 #if ENABLE(DEVICE_ORIENTATION)
     else if (eventType == eventNames().devicemotionEvent) {
-        if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+        if (DeviceMotionController* controller = DeviceMotionController::from(page()))
             controller->removeListener(this);
     } else if (eventType == eventNames().deviceorientationEvent) {
-        if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+        if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
             controller->removeListener(this);
     }
 #endif
@@ -1579,9 +1569,9 @@ void DOMWindow::removeAllEventListeners()
     EventTarget::removeAllEventListeners();
 
 #if ENABLE(DEVICE_ORIENTATION)
-    if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+    if (DeviceMotionController* controller = DeviceMotionController::from(page()))
         controller->removeAllListeners(this);
-    if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+    if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
         controller->removeAllListeners(this);
 #endif
 
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index 9fa6a5caf..cdfd322d8 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -30,6 +30,7 @@
 #include "EventTarget.h"
 #include "FrameDestructionObserver.h"
 #include "KURL.h"
+#include "Supplementable.h"
 
 namespace WebCore {
 
@@ -56,6 +57,7 @@ namespace WebCore {
     class Navigator;
     class Node;
     class NotificationCenter;
+    class Page;
     class Performance;
     class PostMessageTimer;
     class ScheduledAction;
@@ -79,7 +81,7 @@ namespace WebCore {
 
     enum SetLocationLocking { LockHistoryBasedOnGestureState, LockHistoryAndBackForwardList };
 
-    class DOMWindow : public RefCounted<DOMWindow>, public EventTarget, public FrameDestructionObserver {
+    class DOMWindow : public RefCounted<DOMWindow>, public EventTarget, public FrameDestructionObserver, public Supplementable<DOMWindow> {
     public:
         static PassRefPtr<DOMWindow> create(Frame* frame) { return adoptRef(new DOMWindow(frame)); }
         virtual ~DOMWindow();
@@ -355,7 +357,7 @@ namespace WebCore {
 #if ENABLE(NOTIFICATIONS)
         NotificationCenter* webkitNotifications() const;
         // Renders webkitNotifications object safely inoperable, disconnects
-        // if from embedder-provided NotificationPresenter.
+        // if from embedder-provided NotificationClient.
         void resetNotifications();
 #endif
 
@@ -392,14 +394,11 @@ namespace WebCore {
         // by the document that is currently active in m_frame.
         bool isCurrentlyDisplayedInFrame() const;
 
-#if ENABLE(INDEXED_DATABASE)
-        IDBFactory* idbFactory() { return m_idbFactory.get(); }
-        void setIDBFactory(PassRefPtr<IDBFactory>);
-#endif
-
     private:
         explicit DOMWindow(Frame*);
 
+        Page* page();
+
         virtual void frameDestroyed() OVERRIDE;
         virtual void willDetachPage() OVERRIDE;
 
@@ -442,11 +441,6 @@ namespace WebCore {
 
         mutable RefPtr<Storage> m_sessionStorage;
         mutable RefPtr<Storage> m_localStorage;
-
-#if ENABLE(INDEXED_DATABASE)
-        mutable RefPtr<IDBFactory> m_idbFactory;
-#endif
-
         mutable RefPtr<DOMApplicationCache> m_applicationCache;
 
 #if ENABLE(NOTIFICATIONS)
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index 2d8691642..14086bf20 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -45,7 +45,7 @@ module window {
     ] DOMWindow {
         // DOM Level 0
         attribute [Replaceable] Screen screen;
-        attribute [Replaceable, DoNotCheckSecurityOnGetter, JSCustomGetter] History history;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter] History history;
         attribute [Replaceable] BarInfo locationbar;
         attribute [Replaceable] BarInfo menubar;
         attribute [Replaceable] BarInfo personalbar;
@@ -56,7 +56,7 @@ module window {
         attribute [Replaceable] Navigator clientInformation;
         readonly attribute Crypto crypto;
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
-        attribute [DoNotCheckSecurity, JSCustom, V8CustomSetter, V8Unforgeable] Location location;
+        attribute [DoNotCheckSecurity, CustomSetter, V8Unforgeable] Location location;
 #endif
         attribute [Replaceable, CustomGetter, V8CustomSetter] Event event;
 
@@ -393,9 +393,99 @@ module window {
         attribute ProcessingInstructionConstructor ProcessingInstruction;
         attribute [Conditional=SHADOW_DOM, V8EnabledAtRuntime=shadowDOM] ShadowRootConstructor WebKitShadowRoot;
 
+        attribute DOMSelectionConstructor Selection;
         attribute DOMWindowConstructor Window;
 
-        // FIXME: Should these Canvas constructors move to html/DOMWindowHTML with the rest of canvas?
+        attribute HTMLDocumentConstructor HTMLDocument;
+        attribute HTMLElementConstructor HTMLElement;
+        attribute HTMLAnchorElementConstructor HTMLAnchorElement;
+        attribute HTMLAppletElementConstructor HTMLAppletElement;
+        attribute HTMLAreaElementConstructor HTMLAreaElement;
+        attribute HTMLBRElementConstructor HTMLBRElement;
+        attribute HTMLBaseElementConstructor HTMLBaseElement;
+        attribute HTMLBaseFontElementConstructor HTMLBaseFontElement;
+        attribute HTMLBodyElementConstructor HTMLBodyElement;
+        attribute HTMLButtonElementConstructor HTMLButtonElement;
+        attribute HTMLCanvasElementConstructor HTMLCanvasElement;
+        attribute HTMLDListElementConstructor HTMLDListElement;
+        attribute HTMLDirectoryElementConstructor HTMLDirectoryElement;
+        attribute HTMLDivElementConstructor HTMLDivElement;
+        attribute HTMLEmbedElementConstructor HTMLEmbedElement;
+        attribute HTMLFieldSetElementConstructor HTMLFieldSetElement;
+        attribute HTMLFontElementConstructor HTMLFontElement;
+        attribute HTMLFormElementConstructor HTMLFormElement;
+        attribute HTMLFrameElementConstructor HTMLFrameElement;
+        attribute HTMLFrameSetElementConstructor HTMLFrameSetElement;
+        attribute HTMLHRElementConstructor HTMLHRElement;
+        attribute HTMLHeadElementConstructor HTMLHeadElement;
+        attribute HTMLHeadingElementConstructor HTMLHeadingElement;
+        attribute HTMLHtmlElementConstructor HTMLHtmlElement;
+        attribute HTMLIFrameElementConstructor HTMLIFrameElement;
+        attribute HTMLImageElementConstructor HTMLImageElement;
+        attribute HTMLInputElementConstructor HTMLInputElement;
+        attribute HTMLKeygenElementConstructor HTMLKeygenElement;
+        attribute HTMLLIElementConstructor HTMLLIElement;
+        attribute HTMLLabelElementConstructor HTMLLabelElement;
+        attribute HTMLLegendElementConstructor HTMLLegendElement;
+        attribute HTMLLinkElementConstructor HTMLLinkElement;
+        attribute HTMLMapElementConstructor HTMLMapElement;
+        attribute HTMLMarqueeElementConstructor HTMLMarqueeElement;
+        attribute HTMLMenuElementConstructor HTMLMenuElement;
+        attribute HTMLMetaElementConstructor HTMLMetaElement;
+#if defined(ENABLE_METER_TAG) && ENABLE_METER_TAG
+        attribute HTMLMeterElementConstructor HTMLMeterElement;
+#endif
+        attribute HTMLModElementConstructor HTMLModElement;
+        attribute HTMLOListElementConstructor HTMLOListElement;
+        attribute HTMLObjectElementConstructor HTMLObjectElement;
+        attribute HTMLOptGroupElementConstructor HTMLOptGroupElement;
+        attribute HTMLOptionElementConstructor HTMLOptionElement;
+        attribute HTMLOutputElementConstructor HTMLOutputElement;
+        attribute HTMLParagraphElementConstructor HTMLParagraphElement;
+        attribute HTMLParamElementConstructor HTMLParamElement;
+        attribute HTMLPreElementConstructor HTMLPreElement;
+#if defined(ENABLE_PROGRESS_TAG) && ENABLE_PROGRESS_TAG
+        attribute HTMLProgressElementConstructor HTMLProgressElement;
+#endif
+        attribute HTMLQuoteElementConstructor HTMLQuoteElement;
+        attribute HTMLScriptElementConstructor HTMLScriptElement;
+        attribute HTMLSelectElementConstructor HTMLSelectElement;
+        attribute HTMLSpanElementConstructor HTMLSpanElement;
+        attribute HTMLStyleElementConstructor HTMLStyleElement;
+        attribute HTMLTableCaptionElementConstructor HTMLTableCaptionElement;
+        attribute HTMLTableCellElementConstructor HTMLTableCellElement;
+        attribute HTMLTableColElementConstructor HTMLTableColElement;
+        attribute HTMLTableElementConstructor HTMLTableElement;
+        attribute HTMLTableRowElementConstructor HTMLTableRowElement;
+        attribute HTMLTableSectionElementConstructor HTMLTableSectionElement;
+        attribute HTMLTextAreaElementConstructor HTMLTextAreaElement;
+        attribute HTMLTitleElementConstructor HTMLTitleElement;
+        attribute HTMLUListElementConstructor HTMLUListElement;
+
+        attribute HTMLCollectionConstructor HTMLCollection;
+        attribute HTMLAllCollectionConstructor HTMLAllCollection;
+        attribute [Conditional=MICRODATA] HTMLPropertiesCollectionConstructor HTMLPropertiesCollection;
+        attribute HTMLUnknownElementConstructor HTMLUnknownElement;
+
+        attribute [JSCustomGetter, CustomConstructor] HTMLImageElementConstructorConstructor Image; // Usable with new operator
+        attribute [JSCustomGetter] HTMLOptionElementConstructorConstructor Option; // Usable with new operator
+
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] HTMLTrackElementConstructor HTMLTrackElement;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackConstructor TextTrack;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueConstructor TextTrackCue; // Usable with the new operator
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueListConstructor TextTrackCueList;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackListConstructor TextTrackList;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TrackEventConstructor TrackEvent;
+
+        attribute [JSCustomGetter, Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructorConstructor Audio; // Usable with the new operator
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructor HTMLAudioElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLMediaElementConstructor HTMLMediaElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLVideoElementConstructor HTMLVideoElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaErrorConstructor MediaError;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] TimeRangesConstructor TimeRanges;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLSourceElementConstructor HTMLSourceElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaControllerConstructor MediaController;
+
         attribute CanvasPatternConstructor CanvasPattern;
         attribute CanvasGradientConstructor CanvasGradient;
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
@@ -403,6 +493,16 @@ module window {
         attribute ImageDataConstructor ImageData;
         attribute TextMetricsConstructor TextMetrics;
 
+        attribute [Conditional=WEBGL] WebGLActiveInfoConstructor WebGLActiveInfo;
+        attribute [Conditional=WEBGL] WebGLBufferConstructor WebGLBuffer;
+        attribute [Conditional=WEBGL] WebGLFramebufferConstructor WebGLFramebuffer;
+        attribute [Conditional=WEBGL] WebGLProgramConstructor WebGLProgram;
+        attribute [Conditional=WEBGL] WebGLRenderbufferConstructor WebGLRenderbuffer;
+        attribute [Conditional=WEBGL] WebGLRenderingContextConstructor WebGLRenderingContext;
+        attribute [Conditional=WEBGL] WebGLShaderConstructor WebGLShader;
+        attribute [Conditional=WEBGL] WebGLTextureConstructor WebGLTexture;
+        attribute [Conditional=WEBGL] WebGLUniformLocationConstructor WebGLUniformLocation;
+
         attribute DOMStringMapConstructor DOMStringMap;
 
         attribute ArrayBufferConstructor ArrayBuffer; // Usable with new operator
@@ -437,6 +537,7 @@ module window {
         attribute WebKitAnimationEventConstructor WebKitAnimationEvent;
         attribute WebKitTransitionEventConstructor WebKitTransitionEvent;
         attribute WheelEventConstructor WheelEvent;
+        attribute XMLHttpRequestProgressEventConstructor XMLHttpRequestProgressEvent;
         attribute [Conditional=DEVICE_ORIENTATION, V8EnabledAtRuntime] DeviceMotionEventConstructor DeviceMotionEvent;
         attribute [Conditional=DEVICE_ORIENTATION, V8EnabledAtRuntime] DeviceOrientationEventConstructor DeviceOrientationEvent;
         attribute [Conditional=TOUCH_EVENTS] TouchEventConstructor TouchEvent;
@@ -456,6 +557,9 @@ module window {
 
         attribute ClipboardConstructor Clipboard;
 
+        attribute [Conditional=WORKERS] WorkerConstructor Worker; // Usable with the new operator
+        attribute [Conditional=SHARED_WORKERS, JSCustomGetter, V8EnabledAtRuntime] SharedWorkerConstructor SharedWorker; // Usable with the new operator
+
         attribute FileConstructor File;
         attribute FileListConstructor FileList;
         attribute BlobConstructor Blob;
@@ -466,6 +570,16 @@ module window {
 
         attribute EventSourceConstructor EventSource; // Usable with new the operator
 
+        // Mozilla has a separate XMLDocument object for XML documents. 
+        // We just use Document for this.
+        attribute DocumentConstructor XMLDocument;
+        attribute DOMParserConstructor DOMParser;
+        attribute XMLSerializerConstructor XMLSerializer;
+        attribute XMLHttpRequestConstructor XMLHttpRequest; // Usable with the new operator
+        attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
+        attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
+        attribute [Conditional=XSLT] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
+
 #if defined(ENABLE_CHANNEL_MESSAGING) && ENABLE_CHANNEL_MESSAGING
         attribute MessagePortConstructor MessagePort;
         attribute MessageChannelConstructor MessageChannel; // Usable with the new operator
@@ -491,6 +605,164 @@ module window {
         attribute XPathResultConstructor XPathResult;
         attribute XPathExceptionConstructor XPathException;
 
+        attribute [Conditional=SVG] SVGZoomEventConstructor SVGZoomEvent;
+
+#if defined(ENABLE_SVG) && ENABLE_SVG
+        // Expose all implemented SVG 1.1 interfaces, excluding the SVG MI interfaces:
+        // SVGAnimatedPathData, SVGAnimatedPoints, SVGExternalResourcesRequired,
+        // SVGFilterPrimitiveStandardAttributes, SVGFitToViewBox, SVGLangSpace, SVGLocatable
+        // SVGStylable, SVGTests, SVGTransformable, SVGURIReference, SVGZoomAndPan
+        attribute SVGAElementConstructor SVGAElement;
+        attribute SVGAngleConstructor SVGAngle;
+        attribute SVGAnimatedAngleConstructor SVGAnimatedAngle;
+        attribute SVGAnimatedBooleanConstructor SVGAnimatedBoolean;
+        attribute SVGAnimatedEnumerationConstructor SVGAnimatedEnumeration;
+        attribute SVGAnimatedIntegerConstructor SVGAnimatedInteger;
+        attribute SVGAnimatedLengthConstructor SVGAnimatedLength;
+        attribute SVGAnimatedLengthListConstructor SVGAnimatedLengthList;
+        attribute SVGAnimatedNumberConstructor SVGAnimatedNumber;
+        attribute SVGAnimatedNumberListConstructor SVGAnimatedNumberList;
+        attribute SVGAnimatedPreserveAspectRatioConstructor SVGAnimatedPreserveAspectRatio;
+        attribute SVGAnimatedRectConstructor SVGAnimatedRect;
+        attribute SVGAnimatedStringConstructor SVGAnimatedString;
+        attribute SVGAnimatedTransformListConstructor SVGAnimatedTransformList;
+        attribute SVGCircleElementConstructor SVGCircleElement;
+        attribute SVGClipPathElementConstructor SVGClipPathElement;
+        attribute SVGColorConstructor SVGColor;
+        attribute SVGCursorElementConstructor SVGCursorElement;
+//      attribute SVGCSSRuleConstructor SVGCSSRule;
+        attribute SVGDefsElementConstructor SVGDefsElement;
+        attribute SVGDescElementConstructor SVGDescElement;
+        attribute SVGDocumentConstructor SVGDocument;
+        attribute SVGElementConstructor SVGElement;
+        attribute SVGElementInstanceConstructor SVGElementInstance;
+        attribute SVGElementInstanceListConstructor SVGElementInstanceList;
+        attribute SVGEllipseElementConstructor SVGEllipseElement;
+        attribute SVGForeignObjectElementConstructor SVGForeignObjectElement;
+        attribute SVGExceptionConstructor SVGException;
+        attribute SVGGElementConstructor SVGGElement;
+        attribute SVGGradientElementConstructor SVGGradientElement;
+        attribute SVGImageElementConstructor SVGImageElement;
+        attribute SVGLengthConstructor SVGLength;
+        attribute SVGLengthListConstructor SVGLengthList;
+        attribute SVGLinearGradientElementConstructor SVGLinearGradientElement;
+        attribute SVGLineElementConstructor SVGLineElement;
+        attribute SVGMarkerElementConstructor SVGMarkerElement;
+        attribute SVGMaskElementConstructor SVGMaskElement;
+        attribute SVGMatrixConstructor SVGMatrix;
+        attribute SVGMetadataElementConstructor SVGMetadataElement;
+        attribute SVGNumberConstructor SVGNumber;
+        attribute SVGNumberListConstructor SVGNumberList;
+        attribute SVGPaintConstructor SVGPaint;
+        attribute SVGPathElementConstructor SVGPathElement;
+        attribute SVGPathSegConstructor SVGPathSeg;
+        attribute SVGPathSegArcAbsConstructor SVGPathSegArcAbs;
+        attribute SVGPathSegArcRelConstructor SVGPathSegArcRel;
+        attribute SVGPathSegClosePathConstructor SVGPathSegClosePath;
+        attribute SVGPathSegCurvetoCubicAbsConstructor SVGPathSegCurvetoCubicAbs;
+        attribute SVGPathSegCurvetoCubicRelConstructor SVGPathSegCurvetoCubicRel;
+        attribute SVGPathSegCurvetoCubicSmoothAbsConstructor SVGPathSegCurvetoCubicSmoothAbs;
+        attribute SVGPathSegCurvetoCubicSmoothRelConstructor SVGPathSegCurvetoCubicSmoothRel;
+        attribute SVGPathSegCurvetoQuadraticAbsConstructor SVGPathSegCurvetoQuadraticAbs;
+        attribute SVGPathSegCurvetoQuadraticRelConstructor SVGPathSegCurvetoQuadraticRel;
+        attribute SVGPathSegCurvetoQuadraticSmoothAbsConstructor SVGPathSegCurvetoQuadraticSmoothAbs;
+        attribute SVGPathSegCurvetoQuadraticSmoothRelConstructor SVGPathSegCurvetoQuadraticSmoothRel;
+        attribute SVGPathSegLinetoAbsConstructor SVGPathSegLinetoAbs;
+        attribute SVGPathSegLinetoHorizontalAbsConstructor SVGPathSegLinetoHorizontalAbs;
+        attribute SVGPathSegLinetoHorizontalRelConstructor SVGPathSegLinetoHorizontalRel;
+        attribute SVGPathSegLinetoRelConstructor SVGPathSegLinetoRel;
+        attribute SVGPathSegLinetoVerticalAbsConstructor SVGPathSegLinetoVerticalAbs;
+        attribute SVGPathSegLinetoVerticalRelConstructor SVGPathSegLinetoVerticalRel;
+        attribute SVGPathSegListConstructor SVGPathSegList;
+        attribute SVGPathSegMovetoAbsConstructor SVGPathSegMovetoAbs;
+        attribute SVGPathSegMovetoRelConstructor SVGPathSegMovetoRel;
+        attribute SVGPatternElementConstructor SVGPatternElement;
+        attribute SVGPointConstructor SVGPoint;
+        attribute SVGPointListConstructor SVGPointList;
+        attribute SVGPolygonElementConstructor SVGPolygonElement;
+        attribute SVGPolylineElementConstructor SVGPolylineElement;
+        attribute SVGPreserveAspectRatioConstructor SVGPreserveAspectRatio;
+        attribute SVGRadialGradientElementConstructor SVGRadialGradientElement;
+        attribute SVGRectConstructor SVGRect;
+        attribute SVGRectElementConstructor SVGRectElement;
+        attribute SVGRenderingIntentConstructor SVGRenderingIntent;
+        attribute SVGScriptElementConstructor SVGScriptElement;
+        attribute SVGStopElementConstructor SVGStopElement;
+        attribute SVGStringListConstructor SVGStringList;
+        attribute SVGStyleElementConstructor SVGStyleElement;
+        attribute SVGSVGElementConstructor SVGSVGElement;
+        attribute SVGSwitchElementConstructor SVGSwitchElement;
+        attribute SVGSymbolElementConstructor SVGSymbolElement;
+        attribute SVGTextContentElementConstructor SVGTextContentElement;
+        attribute SVGTextElementConstructor SVGTextElement;
+        attribute SVGTextPathElementConstructor SVGTextPathElement;
+        attribute SVGTextPositioningElementConstructor SVGTextPositioningElement;
+        attribute SVGTitleElementConstructor SVGTitleElement;
+        attribute SVGTransformConstructor SVGTransform;
+        attribute SVGTransformListConstructor SVGTransformList;
+        attribute SVGTRefElementConstructor SVGTRefElement;
+        attribute SVGTSpanElementConstructor SVGTSpanElement;
+        attribute SVGUnitTypesConstructor SVGUnitTypes;
+        attribute SVGUseElementConstructor SVGUseElement;
+        attribute SVGViewElementConstructor SVGViewElement;
+//      attribute SVGViewSpecConstructor SVGViewSpec;
+
+        attribute SVGAnimateColorElementConstructor SVGAnimateColorElement;
+        attribute SVGAnimateElementConstructor SVGAnimateElement;
+        attribute SVGAnimateMotionElementConstructor SVGAnimateMotionElement;
+        attribute SVGAnimateTransformElementConstructor SVGAnimateTransformElement;
+        attribute SVGMPathElementConstructor SVGMPathElement;
+        attribute SVGSetElementConstructor SVGSetElement;
+
+#if defined(ENABLE_SVG_FONTS) && ENABLE_SVG_FONTS
+        attribute SVGAltGlyphDefElementConstructor SVGAltGlyphDefElement;
+        attribute SVGAltGlyphElementConstructor SVGAltGlyphElement;
+        attribute SVGAltGlyphItemElementConstructor SVGAltGlyphItemElement;
+//      attribute SVGDefinitionSrcElementConstructor SVGDefinitionSrcElement;
+        attribute SVGFontElementConstructor SVGFontElement;
+        attribute SVGFontFaceElementConstructor SVGFontFaceElement;
+        attribute SVGFontFaceFormatElementConstructor SVGFontFaceFormatElement;
+        attribute SVGFontFaceNameElementConstructor SVGFontFaceNameElement;
+        attribute SVGFontFaceSrcElementConstructor SVGFontFaceSrcElement;
+        attribute SVGFontFaceUriElementConstructor SVGFontFaceUriElement;
+        attribute SVGGlyphElementConstructor SVGGlyphElement;
+        attribute SVGGlyphRefElementConstructor SVGGlyphRefElement;
+        attribute SVGHKernElementConstructor SVGHKernElement;
+        attribute SVGMissingGlyphElementConstructor SVGMissingGlyphElement;
+        attribute SVGVKernElementConstructor SVGVKernElement;
+#endif
+
+#if defined(ENABLE_FILTERS) && ENABLE_FILTERS
+        attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
+        attribute SVGFEBlendElementConstructor SVGFEBlendElement;
+        attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
+        attribute SVGFEComponentTransferElementConstructor SVGFEComponentTransferElement;
+        attribute SVGFECompositeElementConstructor SVGFECompositeElement;
+        attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
+        attribute SVGFEDiffuseLightingElementConstructor SVGFEDiffuseLightingElement;
+        attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
+        attribute SVGFEDistantLightElementConstructor SVGFEDistantLightElement;
+        attribute SVGFEDropShadowElementConstructor SVGFEDropShadowElement;
+        attribute SVGFEFloodElementConstructor SVGFEFloodElement;
+        attribute SVGFEFuncAElementConstructor SVGFEFuncAElement;
+        attribute SVGFEFuncBElementConstructor SVGFEFuncBElement;
+        attribute SVGFEFuncGElementConstructor SVGFEFuncGElement;
+        attribute SVGFEFuncRElementConstructor SVGFEFuncRElement;
+        attribute SVGFEGaussianBlurElementConstructor SVGFEGaussianBlurElement;
+        attribute SVGFEImageElementConstructor SVGFEImageElement;
+        attribute SVGFEMergeElementConstructor SVGFEMergeElement;
+        attribute SVGFEMergeNodeElementConstructor SVGFEMergeNodeElement;
+        attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
+        attribute SVGFEOffsetElementConstructor SVGFEOffsetElement;
+        attribute SVGFEPointLightElementConstructor SVGFEPointLightElement;
+        attribute SVGFESpecularLightingElementConstructor SVGFESpecularLightingElement;
+        attribute SVGFESpotLightElementConstructor SVGFESpotLightElement;
+        attribute SVGFETileElementConstructor SVGFETileElement;
+        attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
+        attribute SVGFilterElementConstructor SVGFilterElement;
+#endif
+#endif
+
         attribute DOMFormDataConstructor FormData;
 
         attribute [Conditional=BLOB|FILE_SYSTEM] FileErrorConstructor FileError;
diff --git a/Source/WebCore/page/DragClient.h b/Source/WebCore/page/DragClient.h
index 1d9b25bdb..b72d73da2 100644
--- a/Source/WebCore/page/DragClient.h
+++ b/Source/WebCore/page/DragClient.h
@@ -35,7 +35,6 @@
 OBJC_CLASS DOMElement;
 OBJC_CLASS NSURL;
 OBJC_CLASS NSString;
-OBJC_CLASS NSPasteboard;
 #endif
 
 namespace WebCore {
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 4891aad0b..247fe3943 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -424,6 +424,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
     ASSERT(dragData);
     ASSERT(!m_isHandlingDrag);
 
+    RefPtr<HTMLInputElement> fileInput = m_fileInputElementUnderMouse;
     if (m_fileInputElementUnderMouse) {
         m_fileInputElementUnderMouse->setCanReceiveDroppedFiles(false);
         m_fileInputElementUnderMouse = 0;
@@ -456,18 +457,13 @@ bool DragController::concludeEditDrag(DragData* dragData)
         return true;
     }
 
-    if (!m_page->dragController()->canProcessDrag(dragData)) {
-        m_page->dragCaretController()->clear();
-        return false;
-    }
-
-    if (HTMLInputElement* fileInput = asFileInput(element)) {
+    if (dragData->containsFiles() && fileInput) {
+        // fileInput should be the element we hit tested for, unless it was made
+        // display:none in a drop event handler.
+        ASSERT(fileInput == element || !fileInput->renderer());
         if (fileInput->disabled())
             return false;
 
-        if (!dragData->containsFiles())
-            return false;
-
         Vector<String> filenames;
         dragData->asFilenames(filenames);
         if (filenames.isEmpty())
@@ -477,6 +473,11 @@ bool DragController::concludeEditDrag(DragData* dragData)
         return true;
     }
 
+    if (!m_page->dragController()->canProcessDrag(dragData)) {
+        m_page->dragCaretController()->clear();
+        return false;
+    }
+
     VisibleSelection dragCaret = m_page->dragCaretController()->caretPosition();
     m_page->dragCaretController()->clear();
     RefPtr<Range> range = dragCaret.toNormalizedRange();
diff --git a/Source/WebCore/page/EditorClient.h b/Source/WebCore/page/EditorClient.h
index 2bb4f5129..1f0954f19 100644
--- a/Source/WebCore/page/EditorClient.h
+++ b/Source/WebCore/page/EditorClient.h
@@ -37,7 +37,6 @@
 
 #if PLATFORM(MAC)
 OBJC_CLASS NSAttributedString;
-OBJC_CLASS NSPasteboard;
 OBJC_CLASS NSString;
 OBJC_CLASS NSURL;
 #endif
@@ -117,7 +116,7 @@ public:
 #if PLATFORM(MAC)
     virtual NSString* userVisibleString(NSURL*) = 0;
     virtual DocumentFragment* documentFragmentFromAttributedString(NSAttributedString*, Vector< RefPtr<ArchiveResource> >&) = 0;
-    virtual void setInsertionPasteboard(NSPasteboard*) = 0;
+    virtual void setInsertionPasteboard(const String& pasteboardName) = 0;
     virtual NSURL* canonicalizeURL(NSURL*) = 0;
     virtual NSURL* canonicalizeURLString(NSString*) = 0;
 #endif
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 4f0ddeee3..1738db896 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -83,6 +83,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/TemporaryChange.h>
 
 #if ENABLE(GESTURE_EVENTS)
 #include "PlatformGestureEvent.h"
@@ -126,7 +127,11 @@ using namespace SVGNames;
 // When the autoscroll or the panScroll is triggered when do the scroll every 0.05s to make it smooth
 const double autoscrollInterval = 0.05;
 
-const double fakeMouseMoveInterval = 0.1;
+// The amount of time to wait before sending a fake mouse event, triggered
+// during a scroll. The short interval is used if the content responds to the mouse events quickly enough,
+// otherwise the long interval is used.
+const double fakeMouseMoveShortInterval = 0.1;
+const double fakeMouseMoveLongInterval = 0.250;
 
 enum NoCursorChangeType { NoCursorChange };
 
@@ -143,6 +148,24 @@ private:
     Cursor m_cursor;
 };
 
+class MaximumDurationTracker {
+public:
+    explicit MaximumDurationTracker(double *maxDuration)
+        : m_maxDuration(maxDuration)
+        , m_start(monotonicallyIncreasingTime())
+    {
+    }
+
+    ~MaximumDurationTracker()
+    {
+        *m_maxDuration = max(*m_maxDuration, monotonicallyIncreasingTime() - m_start);
+    }
+
+private:
+    double* m_maxDuration;
+    double m_start;
+};
+
 #if ENABLE(TOUCH_EVENTS)
 class SyntheticTouchPoint : public PlatformTouchPoint {
 public:
@@ -210,29 +233,28 @@ public:
 };
 #endif
 
-static inline bool scrollNode(float delta, WheelEvent::Granularity granularity, ScrollDirection positiveDirection, ScrollDirection negativeDirection, Node* node, Node** stopNode)
+static inline ScrollGranularity wheelGranularityToScrollGranularity(WheelEvent::Granularity granularity)
+{
+    switch (granularity) {
+    case WheelEvent::Page:
+        return ScrollByPage;
+    case WheelEvent::Line:
+        return ScrollByLine;
+    case WheelEvent::Pixel:
+        return ScrollByPixel;
+    }
+    return ScrollByPixel;
+}
+
+static inline bool scrollNode(float delta, ScrollGranularity granularity, ScrollDirection positiveDirection, ScrollDirection negativeDirection, Node* node, Node** stopNode)
 {
     if (!delta)
         return false;
-    
     if (!node->renderer())
         return false;
-    
-    // Find the nearest enclosing box.
     RenderBox* enclosingBox = node->renderer()->enclosingBox();
-
     float absDelta = delta > 0 ? delta : -delta;
-    
-    if (granularity == WheelEvent::Page)
-        return enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, absDelta, stopNode);
-
-    if (granularity == WheelEvent::Line)
-        return enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByLine, absDelta, stopNode);
-
-    if (granularity == WheelEvent::Pixel)
-        return enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, absDelta, stopNode);
-        
-    return false;
+    return enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, granularity, absDelta, stopNode);
 }
 
 #if !PLATFORM(MAC)
@@ -289,6 +311,8 @@ EventHandler::EventHandler(Frame* frame)
 #if ENABLE(TOUCH_EVENTS)
     , m_touchPressed(false)
 #endif
+    , m_maxMouseMovedDuration(0)
+    , m_baseEventType(PlatformEvent::NoType)
 {
 }
 
@@ -335,6 +359,10 @@ void EventHandler::clear()
 #if ENABLE(TOUCH_EVENTS)
     m_originatingTouchPointTargets.clear();
 #endif
+    m_maxMouseMovedDuration = 0;
+#if ENABLE(GESTURE_EVENTS)
+    m_baseEventType = PlatformEvent::NoType;
+#endif
 }
 
 void EventHandler::nodeWillBeRemoved(Node* nodeToBeRemoved)
@@ -1261,8 +1289,8 @@ OptionalCursor EventHandler::selectCursor(const MouseEventWithHitTestResults& ev
     const Cursor& iBeam = horizontalText ? iBeamCursor() : verticalTextCursor();
 
     // During selection, use an I-beam no matter what we're over.
-    // If you're capturing mouse events for a particular node, don't treat this as a selection.
-    if (m_mousePressed && m_mouseDownMayStartSelect && m_frame->selection()->isCaretOrRange() && !m_capturingMouseEventsNode)
+    // If a drag may be starting or we're capturing mouse events for a particular node, don't treat this as a selection.
+    if (m_mousePressed && m_mouseDownMayStartSelect && !m_mouseDownMayStartDrag && m_frame->selection()->isCaretOrRange() && !m_capturingMouseEventsNode)
         return iBeam;
 
     if (renderer) {
@@ -1635,8 +1663,10 @@ static RenderLayer* layerForNode(Node* node)
 
 bool EventHandler::mouseMoved(const PlatformMouseEvent& event)
 {
+    MaximumDurationTracker maxDurationTracker(&m_maxMouseMovedDuration);
     RefPtr<FrameView> protector(m_frame->view());
 
+
 #if ENABLE(TOUCH_EVENTS)
     // FIXME: this should be moved elsewhere to also be able to dispatch touchcancel events.
     bool defaultPrevented = dispatchSyntheticTouchEventIfEnabled(event);
@@ -2287,7 +2317,7 @@ bool EventHandler::handleWheelEvent(const PlatformWheelEvent& e)
     // Instead, the handlers should know convert vertical scrolls
     // appropriately.
     PlatformWheelEvent event = e;
-    if (shouldTurnVerticalTicksIntoHorizontal(result))
+    if (m_baseEventType != PlatformEvent::NoType && shouldTurnVerticalTicksIntoHorizontal(result))
         event = event.copyTurningVerticalTicksIntoHorizontalTicks();
 
     if (node) {
@@ -2313,20 +2343,21 @@ bool EventHandler::handleWheelEvent(const PlatformWheelEvent& e)
     
     return view->wheelEvent(event);
 }
-    
+
 void EventHandler::defaultWheelEventHandler(Node* startNode, WheelEvent* wheelEvent)
 {
     if (!startNode || !wheelEvent)
         return;
     
     Node* stopNode = m_previousWheelScrolledNode.get();
+    ScrollGranularity granularity = m_baseEventType == PlatformEvent::GestureScrollEnd ? ScrollByPixelVelocity : wheelGranularityToScrollGranularity(wheelEvent->granularity());
     
     // Break up into two scrolls if we need to.  Diagonal movement on 
     // a MacBook pro is an example of a 2-dimensional mouse wheel event (where both deltaX and deltaY can be set).
-    if (scrollNode(wheelEvent->rawDeltaX(), wheelEvent->granularity(), ScrollLeft, ScrollRight, startNode, &stopNode))
+    if (scrollNode(wheelEvent->rawDeltaX(), granularity, ScrollLeft, ScrollRight, startNode, &stopNode))
         wheelEvent->setDefaultHandled();
     
-    if (scrollNode(wheelEvent->rawDeltaY(), wheelEvent->granularity(), ScrollUp, ScrollDown, startNode, &stopNode))
+    if (scrollNode(wheelEvent->rawDeltaY(), granularity, ScrollUp, ScrollDown, startNode, &stopNode))
         wheelEvent->setDefaultHandled();
     
     if (!m_useLatchedWheelEventNode)
@@ -2336,41 +2367,60 @@ void EventHandler::defaultWheelEventHandler(Node* startNode, WheelEvent* wheelEv
 #if ENABLE(GESTURE_EVENTS)
 bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
 {
-    // FIXME: This should hit test and go to the correct subframe rather than 
-    // always sending gestures to the main frame only. We should also ensure
-    // that if a frame gets a gesture begin gesture, it gets the corresponding
-    // end gesture as well.
+    // FIXME: A more general scroll system (https://bugs.webkit.org/show_bug.cgi?id=80596) will
+    // eliminate the need for this.
+    TemporaryChange<PlatformEvent::Type> baseEventType(m_baseEventType, gestureEvent.type());
 
     switch (gestureEvent.type()) {
     case PlatformEvent::GestureTapDown:
+        // FIXME: Stop animation here.
         break;
-    case PlatformEvent::GestureTap: {
-        // FIXME: Refactor this code to not hit test multiple times once hit testing has been corrected as suggested above.
-        PlatformMouseEvent fakeMouseMove(gestureEvent.position(), gestureEvent.globalPosition(), NoButton, PlatformEvent::MouseMoved, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
-        PlatformMouseEvent fakeMouseDown(gestureEvent.position(), gestureEvent.globalPosition(), LeftButton, PlatformEvent::MousePressed, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
-        PlatformMouseEvent fakeMouseUp(gestureEvent.position(), gestureEvent.globalPosition(), LeftButton, PlatformEvent::MouseReleased, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
-        mouseMoved(fakeMouseMove);
-        handleMousePressEvent(fakeMouseDown);
-        handleMouseReleaseEvent(fakeMouseUp);
-        return true;
-    }
-    case PlatformEvent::GestureScrollUpdate: {
-        const float tickDivisor = (float)WheelEvent::tickMultiplier;
-        // FIXME: Replace this interim implementation once the above fixme has been addressed.
-        IntPoint point(gestureEvent.position().x(), gestureEvent.position().y());
-        IntPoint globalPoint(gestureEvent.globalPosition().x(), gestureEvent.globalPosition().y());
-        PlatformWheelEvent syntheticWheelEvent(point, globalPoint, gestureEvent.deltaX(), gestureEvent.deltaY(), gestureEvent.deltaX() / tickDivisor, gestureEvent.deltaY() / tickDivisor, ScrollByPixelWheelEvent, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey());
-        handleWheelEvent(syntheticWheelEvent);
-        return true;
-    }
+    case PlatformEvent::GestureTap:
+        return handleGestureTap(gestureEvent);
+    case PlatformEvent::GestureScrollUpdate:
+        return handleGestureScrollUpdate(gestureEvent);
     case PlatformEvent::GestureDoubleTap:
+        break;
     case PlatformEvent::GestureScrollBegin:
+        return handleGestureScrollCore(gestureEvent, ScrollByPixelWheelEvent, false);
     case PlatformEvent::GestureScrollEnd:
-        break;
+        return handleGestureScrollCore(gestureEvent, ScrollByPixelVelocityWheelEvent, true);
     default:
         ASSERT_NOT_REACHED();
     }
-    return true;
+
+    return false;
+}
+
+bool EventHandler::handleGestureTap(const PlatformGestureEvent& gestureEvent)
+{
+    // FIXME: Refactor this code to not hit test multiple times.
+    bool defaultPrevented = false;
+    PlatformMouseEvent fakeMouseMove(gestureEvent.position(), gestureEvent.globalPosition(), NoButton, PlatformEvent::MouseMoved, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
+    PlatformMouseEvent fakeMouseDown(gestureEvent.position(), gestureEvent.globalPosition(), LeftButton, PlatformEvent::MousePressed, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
+    PlatformMouseEvent fakeMouseUp(gestureEvent.position(), gestureEvent.globalPosition(), LeftButton, PlatformEvent::MouseReleased, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
+    mouseMoved(fakeMouseMove);
+    defaultPrevented |= handleMousePressEvent(fakeMouseDown);
+    defaultPrevented |= handleMouseReleaseEvent(fakeMouseUp);
+    return defaultPrevented;
+}
+
+bool EventHandler::handleGestureScrollUpdate(const PlatformGestureEvent& gestureEvent)
+{
+    return handleGestureScrollCore(gestureEvent, ScrollByPixelWheelEvent, true);
+}
+
+bool EventHandler::handleGestureScrollCore(const PlatformGestureEvent& gestureEvent, PlatformWheelEventGranularity granularity, bool latchedWheel)
+{
+    TemporaryChange<bool> latched(m_useLatchedWheelEventNode, latchedWheel);
+    const float tickDivisor = (float)WheelEvent::tickMultiplier;
+    IntPoint point(gestureEvent.position().x(), gestureEvent.position().y());
+    IntPoint globalPoint(gestureEvent.globalPosition().x(), gestureEvent.globalPosition().y());
+    PlatformWheelEvent syntheticWheelEvent(point, globalPoint,
+        gestureEvent.deltaX(), gestureEvent.deltaY(), gestureEvent.deltaX() / tickDivisor, gestureEvent.deltaY() / tickDivisor,
+        granularity,
+        gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey());
+    return handleWheelEvent(syntheticWheelEvent);
 }
 #endif
 
@@ -2488,8 +2538,18 @@ void EventHandler::dispatchFakeMouseMoveEventSoon()
     if (m_mousePressed)
         return;
 
-    if (!m_fakeMouseMoveEventTimer.isActive())
-        m_fakeMouseMoveEventTimer.startOneShot(fakeMouseMoveInterval);
+    // If the content has ever taken longer than fakeMouseMoveShortInterval we
+    // reschedule the timer and use a longer time. This will cause the content
+    // to receive these moves only after the user is done scrolling, reducing
+    // pauses during the scroll.
+    if (m_maxMouseMovedDuration > fakeMouseMoveShortInterval) {
+        if (m_fakeMouseMoveEventTimer.isActive())
+            m_fakeMouseMoveEventTimer.stop();
+        m_fakeMouseMoveEventTimer.startOneShot(fakeMouseMoveLongInterval);
+    } else {
+        if (!m_fakeMouseMoveEventTimer.isActive())
+            m_fakeMouseMoveEventTimer.startOneShot(fakeMouseMoveShortInterval);
+    }
 }
 
 void EventHandler::dispatchFakeMouseMoveEventSoonInQuad(const FloatQuad& quad)
@@ -2498,11 +2558,10 @@ void EventHandler::dispatchFakeMouseMoveEventSoonInQuad(const FloatQuad& quad)
     if (!view)
         return;
 
-    if (m_mousePressed || !quad.containsPoint(view->windowToContents(m_currentMousePosition)))
+    if (!quad.containsPoint(view->windowToContents(m_currentMousePosition)))
         return;
 
-    if (!m_fakeMouseMoveEventTimer.isActive())
-        m_fakeMouseMoveEventTimer.startOneShot(fakeMouseMoveInterval);
+    dispatchFakeMouseMoveEventSoon();
 }
 
 void EventHandler::cancelFakeMouseMoveEvent()
diff --git a/Source/WebCore/page/EventHandler.h b/Source/WebCore/page/EventHandler.h
index 7733a0f65..2edba90ab 100644
--- a/Source/WebCore/page/EventHandler.h
+++ b/Source/WebCore/page/EventHandler.h
@@ -31,6 +31,7 @@
 #include "FocusDirection.h"
 #include "HitTestRequest.h"
 #include "PlatformMouseEvent.h"
+#include "PlatformWheelEvent.h"
 #include "ScrollTypes.h"
 #include "TextEventInputType.h"
 #include "TextGranularity.h"
@@ -162,6 +163,8 @@ public:
 
 #if ENABLE(GESTURE_EVENTS)
     bool handleGestureEvent(const PlatformGestureEvent&);
+    bool handleGestureTap(const PlatformGestureEvent&);
+    bool handleGestureScrollUpdate(const PlatformGestureEvent&);
 #endif
 
 #if ENABLE(CONTEXT_MENUS)
@@ -345,6 +348,10 @@ private:
     bool isKeyEventAllowedInFullScreen(const PlatformKeyboardEvent&) const;
 #endif
 
+#if ENABLE(GESTURE_EVENTS)
+    bool handleGestureScrollCore(const PlatformGestureEvent&, PlatformWheelEventGranularity, bool latchedWheel);
+#endif
+
     Frame* m_frame;
 
     bool m_mousePressed;
@@ -429,6 +436,8 @@ private:
     TouchTargetMap m_originatingTouchPointTargets;
     bool m_touchPressed;
 #endif
+    double m_maxMouseMovedDuration;
+    PlatformEvent::Type m_baseEventType;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/EventSource.idl b/Source/WebCore/page/EventSource.idl
index 9b7fe38dc..48df3ebe8 100644
--- a/Source/WebCore/page/EventSource.idl
+++ b/Source/WebCore/page/EventSource.idl
@@ -33,7 +33,6 @@ module window {
 
     interface [
         ActiveDOMObject,
-        ConstructorParameters=1,
         Constructor(in DOMString scriptUrl),
         CallWith=ScriptExecutionContext,
         ConstructorRaisesException,
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index aa98c0249..fb16df021 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -54,7 +54,7 @@
 #include "ScrollAnimator.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SpatialNavigation.h"
 #include "Widget.h"
 #include "htmlediting.h" // For firstPositionInOrBeforeNode
@@ -155,7 +155,7 @@ void FocusController::setFocused(bool focused)
 
 static inline ShadowRoot* shadowRoot(Node* node)
 {
-    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->youngestShadowRoot() : 0;
+    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowTree()->youngestShadowRoot() : 0;
 }
 
 static inline bool isTreeScopeOwner(Node* node)
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index ee3c068c8..ad9cab8e9 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -166,6 +166,7 @@ inline Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoader
     , m_inViewSourceMode(false)
     , m_isDisconnected(false)
     , m_excludeFromTextSearch(false)
+    , m_activeDOMObjectsAndAnimationsSuspendedCount(0)
 {
     ASSERT(page);
     AtomicString::init();
@@ -196,6 +197,11 @@ inline Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoader
 #ifndef NDEBUG
     frameCounter.increment();
 #endif
+
+    // Pause future ActiveDOMObjects if this frame is being created while the page is in a paused state.
+    Frame* parent = parentFromOwnerElement(ownerElement);
+    if (parent && parent->activeDOMObjectsAndAnimationsSuspended())
+        suspendActiveDOMObjectsAndAnimations();
 }
 
 PassRefPtr<Frame> Frame::create(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient* client)
@@ -306,6 +312,13 @@ void Frame::setDocument(PassRefPtr<Document> newDoc)
         notifyChromeClientWheelEventHandlerCountChanged();
         notifyChromeClientTouchEventHandlerCountChanged();
     }
+
+    // Suspend document if this frame was created in suspended state.
+    if (m_doc && activeDOMObjectsAndAnimationsSuspended()) {
+        m_doc->suspendScriptedAnimationControllerCallbacks();
+        m_animationController.suspendAnimationsForDocument(m_doc.get());
+        m_doc->suspendActiveDOMObjects(ActiveDOMObject::PageWillBeSuspended);
+    }
 }
 
 #if ENABLE(ORIENTATION_EVENTS)
@@ -1011,6 +1024,38 @@ float Frame::frameScaleFactor() const
     return page->pageScaleFactor();
 }
 
+void Frame::suspendActiveDOMObjectsAndAnimations()
+{
+    bool wasSuspended = activeDOMObjectsAndAnimationsSuspended();
+
+    m_activeDOMObjectsAndAnimationsSuspendedCount++;
+
+    if (wasSuspended)
+        return;
+
+    if (document()) {
+        document()->suspendScriptedAnimationControllerCallbacks();
+        animation()->suspendAnimationsForDocument(document());
+        document()->suspendActiveDOMObjects(ActiveDOMObject::PageWillBeSuspended);
+    }
+}
+
+void Frame::resumeActiveDOMObjectsAndAnimations()
+{
+    ASSERT(activeDOMObjectsAndAnimationsSuspended());
+
+    m_activeDOMObjectsAndAnimationsSuspendedCount--;
+
+    if (activeDOMObjectsAndAnimationsSuspended())
+        return;
+
+    if (document()) {
+        document()->resumeActiveDOMObjects();
+        animation()->resumeAnimationsForDocument(document());
+        document()->resumeScriptedAnimationControllerCallbacks();
+    }
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 void Frame::deviceOrPageScaleFactorChanged()
 {
@@ -1094,7 +1139,7 @@ DragImageRef Frame::nodeImage(Node* node)
     LayoutRect topLevelRect;
     IntRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
-    OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size()));
+    OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size(), 1, ColorSpaceDeviceRGB));
     if (!buffer)
         return 0;
     buffer->context()->translate(-paintingRect.x(), -paintingRect.y());
@@ -1117,7 +1162,7 @@ DragImageRef Frame::dragImageForSelection()
 
     IntRect paintingRect = enclosingIntRect(selection()->bounds());
 
-    OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size()));
+    OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size(), 1, ColorSpaceDeviceRGB));
     if (!buffer)
         return 0;
     buffer->context()->translate(-paintingRect.x(), -paintingRect.y());
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
index e06c0dfc7..e25c90f84 100644
--- a/Source/WebCore/page/Frame.h
+++ b/Source/WebCore/page/Frame.h
@@ -188,13 +188,16 @@ namespace WebCore {
         String searchForLabelsAboveCell(RegularExpression*, HTMLTableCellElement*, size_t* resultDistanceFromStartOfCell);
         String searchForLabelsBeforeElement(const Vector<String>& labels, Element*, size_t* resultDistance, bool* resultIsInCellAbove);
         String matchLabelsAgainstElement(const Vector<String>& labels, Element*);
-        
+
 #if PLATFORM(MAC)
         NSImage* selectionImage(bool forceBlackText = false) const;
         NSImage* rangeImage(Range*, bool forceBlackText = false) const;
         NSImage* snapshotDragImage(Node*, NSRect* imageRect, NSRect* elementRect) const;
         NSImage* imageFromRect(NSRect) const;
 #endif
+        void suspendActiveDOMObjectsAndAnimations();
+        void resumeActiveDOMObjectsAndAnimations();
+        bool activeDOMObjectsAndAnimationsSuspended() const { return m_activeDOMObjectsAndAnimationsSuspendedCount > 0; }
 
         // Should only be called on the main frame of a page.
         void notifyChromeClientWheelEventHandlerCountChanged() const;
@@ -257,6 +260,7 @@ namespace WebCore {
         OwnPtr<TiledBackingStore> m_tiledBackingStore;
 #endif
 
+        int m_activeDOMObjectsAndAnimationsSuspendedCount;
     };
 
     inline void Frame::init()
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 024c484f0..5ecbca363 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -49,6 +49,8 @@
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInImageElement.h"
+#include "InspectorClient.h"
+#include "InspectorController.h"
 #include "InspectorInstrumentation.h"
 #include "OverflowEvent.h"
 #include "RenderArena.h"
@@ -407,10 +409,13 @@ void FrameView::setFrameRect(const IntRect& newRect)
 }
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
-void FrameView::scheduleAnimation()
+bool FrameView::scheduleAnimation()
 {
-    if (hostWindow())
+    if (hostWindow()) {
         hostWindow()->scheduleAnimation();
+        return true;
+    }
+    return false;
 }
 #endif
 
@@ -626,13 +631,6 @@ void FrameView::calculateScrollbarModesForLayout(ScrollbarMode& hMode, Scrollbar
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#if ENABLE(FULLSCREEN_API)
-static bool isDocumentRunningFullScreenAnimation(Document* document)
-{
-    return document->webkitIsFullScreen() && document->fullScreenRenderer() && document->isAnimatingFullScreen();
-}
-#endif
-
 void FrameView::updateCompositingLayers()
 {
     RenderView* root = rootRenderer(this);
@@ -642,12 +640,6 @@ void FrameView::updateCompositingLayers()
     // This call will make sure the cached hasAcceleratedCompositing is updated from the pref
     root->compositor()->cacheAcceleratedCompositingFlags();
     root->compositor()->updateCompositingLayers(CompositingUpdateAfterLayoutOrStyleChange);
-    
-#if ENABLE(FULLSCREEN_API)
-    Document* document = m_frame->document();
-    if (isDocumentRunningFullScreenAnimation(document))
-        root->compositor()->updateCompositingLayers(CompositingUpdateAfterLayoutOrStyleChange, document->fullScreenRenderer()->layer());
-#endif
 }
 
 void FrameView::clearBackingStores()
@@ -722,20 +714,6 @@ bool FrameView::syncCompositingStateForThisFrame(Frame* rootFrameForSync)
 
     root->compositor()->flushPendingLayerChanges(rootFrameForSync == m_frame);
 
-#if ENABLE(FULLSCREEN_API)
-    // The fullScreenRenderer's graphicsLayer has been re-parented, and the above recursive syncCompositingState
-    // call will not cause the subtree under it to repaint.  Explicitly call the syncCompositingState on 
-    // the fullScreenRenderer's graphicsLayer here:
-    Document* document = m_frame->document();
-    if (isDocumentRunningFullScreenAnimation(document)) {
-        RenderLayerBacking* backing = document->fullScreenRenderer()->layer()->backing();
-        if (GraphicsLayer* fullScreenLayer = backing->graphicsLayer()) {
-            // FIXME: Passing frameRect() is correct only when RenderLayerCompositor uses a ScrollLayer (as in WebKit2)
-            // otherwise, the passed clip rect needs to take scrolling into account
-            fullScreenLayer->syncCompositingState(frameRect());
-        }
-    }
-#endif
     return true;
 }
 
@@ -2103,6 +2081,8 @@ void FrameView::unscheduleRelayout()
 #if ENABLE(REQUEST_ANIMATION_FRAME)
 void FrameView::serviceScriptedAnimations(DOMTimeStamp time)
 {
+    serviceScrollAnimations();
+
     Vector<AnimationController*> animations;
     for (Frame* frame = m_frame.get(); frame; frame = frame->tree()->traverseNext())
         frame->animation()->serviceAnimations();
@@ -2331,8 +2311,20 @@ void FrameView::performPostLayoutTasks()
         bool resized = !m_firstLayout && (currentSize != m_lastLayoutSize || currentZoomFactor != m_lastZoomFactor);
         m_lastLayoutSize = currentSize;
         m_lastZoomFactor = currentZoomFactor;
-        if (resized)
+        if (resized) {
             m_frame->eventHandler()->sendResizeEvent();
+
+#if ENABLE(INSPECTOR)
+            if (InspectorInstrumentation::hasFrontends()) {
+                if (Page* page = m_frame->page()) {
+                    if (page->mainFrame() == m_frame) {
+                        if (InspectorClient* inspectorClient = page->inspectorController()->inspectorClient())
+                            inspectorClient->didResizeMainFrame(m_frame.get());
+                    }
+                }
+            }
+#endif
+        }
     }
 }
 
@@ -2702,6 +2694,9 @@ void FrameView::paintScrollCorner(GraphicsContext* context, const IntRect& corne
     }
 
     if (m_scrollCorner) {
+        bool needsBackgorund = m_frame->page() && m_frame->page()->mainFrame() == m_frame;
+        if (needsBackgorund)
+            context->fillRect(cornerRect, baseBackgroundColor(), ColorSpaceDeviceRGB);
         m_scrollCorner->paintIntoRect(context, cornerRect.location(), cornerRect);
         return;
     }
@@ -2709,6 +2704,18 @@ void FrameView::paintScrollCorner(GraphicsContext* context, const IntRect& corne
     ScrollView::paintScrollCorner(context, cornerRect);
 }
 
+void FrameView::paintScrollbar(GraphicsContext* context, Scrollbar* bar, const IntRect& rect)
+{
+    bool needsBackgorund = bar->isCustomScrollbar() && (m_frame->page() && m_frame->page()->mainFrame() == m_frame);
+    if (needsBackgorund) {
+        IntRect toFill = bar->frameRect();
+        toFill.intersect(rect);
+        context->fillRect(toFill, baseBackgroundColor(), ColorSpaceDeviceRGB);
+    }
+
+    ScrollView::paintScrollbar(context, bar, rect);
+}
+
 Color FrameView::documentBackgroundColor() const
 {
     // <https://bugs.webkit.org/show_bug.cgi?id=59540> We blend the background color of
@@ -3024,11 +3031,15 @@ void FrameView::enableAutoSizeMode(bool enable, const IntSize& minSize, const In
     m_minAutoSize = minSize;
     m_maxAutoSize = maxSize;
 
-    if (!m_shouldAutoSize)
-        return;
-
     setNeedsLayout();
     scheduleRelayout();
+    if (m_shouldAutoSize)
+        return;
+
+    // Since autosize mode forces the scrollbar mode, change them to being auto.
+    setVerticalScrollbarLock(false);
+    setHorizontalScrollbarLock(false);
+    setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
 }
 
 void FrameView::forceLayout(bool allowSubtree)
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index cfd35a36c..1f90bc3b8 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -69,7 +69,7 @@ public:
     virtual void setFrameRect(const IntRect&);
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
-    void scheduleAnimation();
+    virtual bool scheduleAnimation();
 #endif
 
     Frame* frame() const { return m_frame.get(); }
@@ -99,6 +99,7 @@ public:
     bool isInLayout() const { return m_inLayout; }
 
     RenderObject* layoutRoot(bool onlyDuringLayout = false) const;
+    void clearLayoutRoot() { m_layoutRoot = 0; }
     int layoutCount() const { return m_layoutCount; }
 
     bool needsLayout() const;
@@ -229,6 +230,7 @@ public:
 
     virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
     virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
+    virtual void paintScrollbar(GraphicsContext*, Scrollbar*, const IntRect&) OVERRIDE;
 
     Color documentBackgroundColor() const;
 
diff --git a/Source/WebCore/page/Navigator.cpp b/Source/WebCore/page/Navigator.cpp
index 76328a7a5..49e362b1e 100644
--- a/Source/WebCore/page/Navigator.cpp
+++ b/Source/WebCore/page/Navigator.cpp
@@ -51,17 +51,6 @@ Navigator::~Navigator()
 {
 }
 
-void Navigator::provideSupplement(const AtomicString& name, PassOwnPtr<NavigatorSupplement> supplement)
-{
-    ASSERT(!m_suppliments.get(name.impl()));
-    m_suppliments.set(name.impl(), supplement);
-}
-
-NavigatorSupplement* Navigator::requireSupplement(const AtomicString& name)
-{
-    return m_suppliments.get(name.impl());
-}
-
 // If this function returns true, we need to hide the substring "4." that would otherwise
 // appear in the appVersion string. This is to avoid problems with old versions of a
 // library called OpenCube QuickMenu, which as of this writing is still being used on
diff --git a/Source/WebCore/page/Navigator.h b/Source/WebCore/page/Navigator.h
index 750eeaa57..b362b16f8 100644
--- a/Source/WebCore/page/Navigator.h
+++ b/Source/WebCore/page/Navigator.h
@@ -22,7 +22,7 @@
 
 #include "DOMWindowProperty.h"
 #include "NavigatorBase.h"
-#include "NavigatorSupplement.h"
+#include "Supplementable.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
@@ -39,7 +39,7 @@ class PluginData;
 
 typedef int ExceptionCode;
 
-class Navigator : public NavigatorBase, public RefCounted<Navigator>, public DOMWindowProperty {
+class Navigator : public NavigatorBase, public RefCounted<Navigator>, public DOMWindowProperty, public Supplementable<Navigator> {
 public:
     static PassRefPtr<Navigator> create(Frame* frame) { return adoptRef(new Navigator(frame)); }
     virtual ~Navigator();
@@ -60,15 +60,9 @@ public:
     // Relinquishes the storage lock, if one exists.
     void getStorageUpdates();
 
-    void provideSupplement(const AtomicString&, PassOwnPtr<NavigatorSupplement>);
-    NavigatorSupplement* requireSupplement(const AtomicString&);
-
 private:
     explicit Navigator(Frame*);
 
-    typedef HashMap<AtomicStringImpl*, OwnPtr<NavigatorSupplement> > NavigatorSupplementMap;
-    NavigatorSupplementMap m_suppliments;
-
     mutable RefPtr<DOMPluginArray> m_plugins;
     mutable RefPtr<DOMMimeTypeArray> m_mimeTypes;
 #if ENABLE(POINTER_LOCK)
diff --git a/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp b/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
index a773b57dd..8635b9075 100644
--- a/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
+++ b/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
@@ -142,4 +142,4 @@ void NavigatorRegisterProtocolHandler::registerProtocolHandler(Navigator* naviga
 
 } // namespace WebCore
 
-#endif // ENABLE(WEB_INTENTS)
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
diff --git a/Source/WebCore/page/Page.cpp b/Source/WebCore/page/Page.cpp
index 1bad0a47b..7b6b9fe78 100644
--- a/Source/WebCore/page/Page.cpp
+++ b/Source/WebCore/page/Page.cpp
@@ -1009,28 +1009,45 @@ PageVisibilityState Page::visibilityState() const
 }
 #endif
 
+// FIXME: gPaintedObjectCounterThreshold is no longer used for calculating relevant repainted areas,
+// and it should be removed. For the time being, it is useful because it allows us to avoid doing
+// any of this work for ports that don't make sure of didNewFirstVisuallyNonEmptyLayout. We should
+// remove this when we resolve <rdar://problem/10791680> Need to merge didFirstVisuallyNonEmptyLayout 
+// and didNewFirstVisuallyNonEmptyLayout
 static uint64_t gPaintedObjectCounterThreshold = 0;
 
+// These are magical constants that might be tweaked over time.
+static double gMinimumPaintedAreaRatio = 0.1;
+static double gMaximumUnpaintedAreaRatio = 0.04;
+
 void Page::setRelevantRepaintedObjectsCounterThreshold(uint64_t threshold)
 {
     gPaintedObjectCounterThreshold = threshold;
 }
 
+bool Page::isCountingRelevantRepaintedObjects() const
+{
+    return m_isCountingRelevantRepaintedObjects && gPaintedObjectCounterThreshold > 0;
+}
+
 void Page::startCountingRelevantRepaintedObjects()
 {
     m_isCountingRelevantRepaintedObjects = true;
 
-    // Clear the HashSet in case we didn't hit the threshold last time.
-    m_relevantPaintedRenderObjects.clear();
+    // Reset everything in case we didn't hit the threshold last time.
+    resetRelevantPaintedObjectCounter();
 }
 
-void Page::addRelevantRepaintedObject(RenderObject* object, const IntRect& objectPaintRect)
+void Page::resetRelevantPaintedObjectCounter()
 {
-    if (!m_isCountingRelevantRepaintedObjects)
-        return;
+    m_relevantUnpaintedRenderObjects.clear();
+    m_relevantPaintedRegion = Region();
+    m_relevantUnpaintedRegion = Region();
+}
 
-    // We don't need to do anything if there is no counter threshold.
-    if (!gPaintedObjectCounterThreshold)
+void Page::addRelevantRepaintedObject(RenderObject* object, const IntRect& objectPaintRect)
+{
+    if (!isCountingRelevantRepaintedObjects())
         return;
 
     // The objects are only relevant if they are being painted within the viewRect().
@@ -1039,25 +1056,56 @@ void Page::addRelevantRepaintedObject(RenderObject* object, const IntRect& objec
             return;
     }
 
-    m_relevantPaintedRenderObjects.add(object);
+    // If this object was previously counted as an unpainted object, remove it from that HashSet
+    // and corresponding Region. FIXME: This doesn't do the right thing if the objects overlap.
+    if (m_relevantUnpaintedRenderObjects.contains(object)) {
+        m_relevantUnpaintedRenderObjects.remove(object);
+        m_relevantUnpaintedRegion.subtract(objectPaintRect);
+    }
+
+    m_relevantPaintedRegion.unite(objectPaintRect);
+
+    RenderView* view = object->view();
+    if (!view)
+        return;
+    
+    float viewArea = view->viewRect().width() * view->viewRect().height();
+    float ratioOfViewThatIsPainted = m_relevantPaintedRegion.totalArea() / viewArea;
+    float ratioOfViewThatIsUnpainted = m_relevantUnpaintedRegion.totalArea() / viewArea;
 
-    if (m_relevantPaintedRenderObjects.size() == static_cast<int>(gPaintedObjectCounterThreshold)) {
+    if (ratioOfViewThatIsPainted > gMinimumPaintedAreaRatio && ratioOfViewThatIsUnpainted < gMaximumUnpaintedAreaRatio) {
         m_isCountingRelevantRepaintedObjects = false;
-        m_relevantPaintedRenderObjects.clear();
+        resetRelevantPaintedObjectCounter();
         if (Frame* frame = mainFrame())
             frame->loader()->didNewFirstVisuallyNonEmptyLayout();
     }
 }
 
-void Page::provideSupplement(const AtomicString& name, PassOwnPtr<PageSupplement> supplement)
+void Page::addRelevantUnpaintedObject(RenderObject* object, const IntRect& objectPaintRect)
 {
-    ASSERT(!m_supplements.get(name.impl()));
-    m_supplements.set(name.impl(), supplement);
+    if (!isCountingRelevantRepaintedObjects())
+        return;
+
+    // The objects are only relevant if they are being painted within the viewRect().
+    if (RenderView* view = object->view()) {
+        if (!objectPaintRect.intersects(pixelSnappedIntRect(view->viewRect())))
+            return;
+    }
+
+    m_relevantUnpaintedRenderObjects.add(object);
+    m_relevantUnpaintedRegion.unite(objectPaintRect);
+}
+
+void Page::suspendActiveDOMObjectsAndAnimations()
+{
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
+        frame->suspendActiveDOMObjectsAndAnimations();
 }
 
-PageSupplement* Page::requireSupplement(const AtomicString& name)
+void Page::resumeActiveDOMObjectsAndAnimations()
 {
-    return m_supplements.get(name.impl());
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
+        frame->resumeActiveDOMObjectsAndAnimations();
 }
 
 Page::PageClients::PageClients()
diff --git a/Source/WebCore/page/Page.h b/Source/WebCore/page/Page.h
index 685eed7e7..cdf7fe619 100644
--- a/Source/WebCore/page/Page.h
+++ b/Source/WebCore/page/Page.h
@@ -24,10 +24,11 @@
 #include "FrameLoaderTypes.h"
 #include "FindOptions.h"
 #include "LayoutTypes.h"
-#include "PageSupplement.h"
 #include "PageVisibilityState.h"
 #include "PlatformScreen.h"
 #include "PlatformString.h"
+#include "Region.h"
+#include "Supplementable.h"
 #include "ViewportArguments.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -89,7 +90,7 @@ namespace WebCore {
 
     float deviceScaleFactor(Frame*);
 
-    class Page {
+    class Page : public Supplementable<Page> {
         WTF_MAKE_NONCOPYABLE(Page);
         friend class Settings;
     public:
@@ -320,19 +321,19 @@ namespace WebCore {
 
         PlatformDisplayID displayID() const { return m_displayID; }
 
+        bool isCountingRelevantRepaintedObjects() const;
         void setRelevantRepaintedObjectsCounterThreshold(uint64_t);
         void startCountingRelevantRepaintedObjects();
+        void resetRelevantPaintedObjectCounter();
         void addRelevantRepaintedObject(RenderObject*, const IntRect& objectPaintRect);
+        void addRelevantUnpaintedObject(RenderObject*, const IntRect& objectPaintRect);
 
-        void provideSupplement(const AtomicString&, PassOwnPtr<PageSupplement>);
-        PageSupplement* requireSupplement(const AtomicString&);
+        void suspendActiveDOMObjectsAndAnimations();
+        void resumeActiveDOMObjectsAndAnimations();
 
     private:
         void initGroup();
 
-        typedef HashMap<AtomicStringImpl*, OwnPtr<PageSupplement> > PageSupplementMap;
-        PageSupplementMap m_supplements;
-
 #if ASSERT_DISABLED
         void checkFrameCountConsistency() const { }
 #else
@@ -424,7 +425,9 @@ namespace WebCore {
 #endif
         PlatformDisplayID m_displayID;
 
-        HashSet<RenderObject*> m_relevantPaintedRenderObjects;
+        HashSet<RenderObject*> m_relevantUnpaintedRenderObjects;
+        Region m_relevantPaintedRegion;
+        Region m_relevantUnpaintedRegion;
         bool m_isCountingRelevantRepaintedObjects;
     };
 
diff --git a/Source/WebCore/page/PageGroup.cpp b/Source/WebCore/page/PageGroup.cpp
index 97ca5467b..731e1fc07 100644
--- a/Source/WebCore/page/PageGroup.cpp
+++ b/Source/WebCore/page/PageGroup.cpp
@@ -31,7 +31,6 @@
 #include "Document.h"
 #include "Frame.h"
 #include "GroupSettings.h"
-#include "IDBFactoryBackendInterface.h"
 #include "Page.h"
 #include "PageCache.h"
 #include "SecurityOrigin.h"
@@ -261,17 +260,6 @@ StorageNamespace* PageGroup::localStorage()
     return m_localStorage.get();
 }
 
-#if ENABLE(INDEXED_DATABASE)
-IDBFactoryBackendInterface* PageGroup::idbFactory()
-{
-    // Do not add page setting based access control here since this object is shared by all pages in
-    // the group and having per-page controls is misleading.
-    if (!m_factoryBackend)
-        m_factoryBackend = IDBFactoryBackendInterface::create();
-    return m_factoryBackend.get();
-}
-#endif
-
 void PageGroup::addUserScriptToWorld(DOMWrapperWorld* world, const String& source, const KURL& url,
                                      PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
                                      UserScriptInjectionTime injectionTime, UserContentInjectedFrames injectedFrames)
diff --git a/Source/WebCore/page/PageGroup.h b/Source/WebCore/page/PageGroup.h
index d391049f6..1362d17e2 100644
--- a/Source/WebCore/page/PageGroup.h
+++ b/Source/WebCore/page/PageGroup.h
@@ -29,6 +29,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include "LinkHash.h"
+#include "Supplementable.h"
 #include "UserScript.h"
 #include "UserStyleSheet.h"
 #include <wtf/text/StringHash.h>
@@ -42,7 +43,7 @@ namespace WebCore {
     class SecurityOrigin;
     class StorageNamespace;
 
-    class PageGroup {
+    class PageGroup : public Supplementable<PageGroup> {
         WTF_MAKE_NONCOPYABLE(PageGroup); WTF_MAKE_FAST_ALLOCATED;
     public:
         PageGroup(const String& name);
@@ -81,11 +82,6 @@ namespace WebCore {
         StorageNamespace* localStorage();
         bool hasLocalStorage() { return m_localStorage; }
 
-#if ENABLE(INDEXED_DATABASE)
-        IDBFactoryBackendInterface* idbFactory();
-        bool hasIDBFactory() { return m_factoryBackend; }
-#endif
-
         void addUserScriptToWorld(DOMWrapperWorld*, const String& source, const KURL&,
                                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
                                   UserScriptInjectionTime, UserContentInjectedFrames);
@@ -122,9 +118,6 @@ namespace WebCore {
 
         unsigned m_identifier;
         RefPtr<StorageNamespace> m_localStorage;
-#if ENABLE(INDEXED_DATABASE)
-        RefPtr<IDBFactoryBackendInterface> m_factoryBackend;
-#endif
 
         OwnPtr<UserScriptMap> m_userScripts;
         OwnPtr<UserStyleSheetMap> m_userStyleSheets;
diff --git a/Source/WebCore/websockets/DOMWindowWebSocket.idl b/Source/WebCore/page/PagePopup.h
index fd9a18db4..26713cb82 100644
--- a/Source/WebCore/websockets/DOMWindowWebSocket.idl
+++ b/Source/WebCore/page/PagePopup.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc.  All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,16 +28,19 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-module window {
+#ifndef PagePopup_h
+#define PagePopup_h
 
-    interface [
-        Conditional=WEB_SOCKETS,
-        Supplemental=DOMWindow
-    ] DOMWindowWebSocket {
-#if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
-        attribute CloseEventConstructor CloseEvent;
-        attribute [JSCustomGetter, V8EnabledAtRuntime] WebSocketConstructor WebSocket; // Usable with the new operator
-#endif
-    };
+#if ENABLE(PAGE_POPUP)
+namespace WebCore {
+
+// A PagePopup object is created by ChromeClient::openPagePopup(), and deleted
+// by ChromeClient::closePagePopup().
+class PagePopup {
+protected:
+    virtual ~PagePopup() { }
+};
 
 }
+#endif
+#endif
diff --git a/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp b/Source/WebCore/page/PagePopupClient.h
index e9b9336f3..450c2d730 100644
--- a/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp
+++ b/Source/WebCore/page/PagePopupClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,41 +28,40 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "V8Element.h"
+#ifndef PagePopupClient_h
+#define PagePopupClient_h
 
-#include "Attr.h"
-#include "Document.h"
-#include "Element.h"
-#include "ExceptionCode.h"
-#include "HTMLFrameElementBase.h"
-#include "HTMLNames.h"
-#include "Node.h"
+#if ENABLE(PAGE_POPUP)
 
-#include "V8Attr.h"
-#include "V8Binding.h"
-#include "V8BindingState.h"
-#include "V8HTMLElement.h"
-#include "V8Proxy.h"
+#include "IntSize.h"
+#include <wtf/text/WTFString.h>
 
-#if ENABLE(SVG)
-#include "V8SVGElement.h"
-#endif
+namespace WebCore {
 
-#include <wtf/RefPtr.h>
+class DocumentWriter;
 
-namespace WebCore {
+class PagePopupClient {
+public:
+    virtual IntSize contentSize() = 0;
+
+    // Provide an HTML source through the specified DocumentWriter. The HTML
+    // source is rendered in a PagePopup.
+    // The content HTML supports:
+    //  - No <select> popups
+    //  - No window.resizeBy() and resizeTo()
+    //  - window.setValueAndClosePopup(number, string).
+    virtual void writeDocument(DocumentWriter&) = 0;
+
+    // This is called by the content HTML of a PagePopup.
+    // An implementation of this function should call ChromeClient::closePagePopup().
+    virtual void setValueAndClosePopup(int numValue, const String& stringValue) = 0;
+
+    // This is called whenever a PagePopup was closed.
+    virtual void didClosePopup() = 0;
+
+    virtual ~PagePopupClient() { }
+};
 
-v8::Handle<v8::Value> toV8(Element* impl, bool forceNewObject)
-{
-    if (!impl)
-        return v8::Null();
-    if (impl->isHTMLElement())
-        return toV8(toHTMLElement(impl), forceNewObject);
-#if ENABLE(SVG)
-    if (impl->isSVGElement())
-        return toV8(static_cast<SVGElement*>(impl), forceNewObject);
-#endif
-    return V8Element::wrap(impl, forceNewObject);
 }
-} // namespace WebCore
+#endif
+#endif
diff --git a/Source/WebCore/page/PageSerializer.cpp b/Source/WebCore/page/PageSerializer.cpp
index 64d901b7a..9d50211cc 100644
--- a/Source/WebCore/page/PageSerializer.cpp
+++ b/Source/WebCore/page/PageSerializer.cpp
@@ -52,6 +52,7 @@
 #include "Page.h"
 #include "StyleCachedImage.h"
 #include "StyleImage.h"
+#include "StyleRule.h"
 #include "Text.h"
 #include "TextEncoding.h"
 #include <wtf/text/CString.h>
@@ -227,7 +228,7 @@ void PageSerializer::serializeFrame(Frame* frame)
         Element* element = toElement(node);
         // We have to process in-line style as it might contain some resources (typically background images).
         if (element->isStyledElement())
-            retrieveResourcesForCSSDeclaration(static_cast<StyledElement*>(element)->inlineStyleDecl(), document);
+            retrieveResourcesForProperties(static_cast<StyledElement*>(element)->inlineStyle(), document);
 
         if (element->hasTagName(HTMLNames::imgTag)) {
             HTMLImageElement* imageElement = static_cast<HTMLImageElement*>(element);
@@ -275,7 +276,7 @@ void PageSerializer::serializeCSSStyleSheet(CSSStyleSheet* styleSheet, const KUR
             // FIXME: Add support for font face rule. It is not clear to me at this point if the actual otf/eot file can
             // be retrieved from the CSSFontFaceRule object.
         } else if (rule->isStyleRule())
-            retrieveResourcesForCSSRule(static_cast<CSSStyleRule*>(rule), document);
+            retrieveResourcesForRule(static_cast<CSSStyleRule*>(rule)->styleRule(), document);
     }
 
     if (url.isValid() && !m_resourceURLs.contains(url)) {
@@ -302,12 +303,12 @@ void PageSerializer::addImageToResources(CachedImage* image, RenderObject* image
     m_resourceURLs.add(url);
 }
 
-void PageSerializer::retrieveResourcesForCSSRule(CSSStyleRule* rule, Document* document)
+void PageSerializer::retrieveResourcesForRule(StyleRule* rule, Document* document)
 {
-    retrieveResourcesForCSSDeclaration(rule->declaration(), document);
+    retrieveResourcesForProperties(rule->properties(), document);
 }
 
-void PageSerializer::retrieveResourcesForCSSDeclaration(StylePropertySet* styleDeclaration, Document* document)
+void PageSerializer::retrieveResourcesForProperties(const StylePropertySet* styleDeclaration, Document* document)
 {
     if (!styleDeclaration)
         return;
diff --git a/Source/WebCore/page/PageSerializer.h b/Source/WebCore/page/PageSerializer.h
index a900f150a..4e81579e2 100644
--- a/Source/WebCore/page/PageSerializer.h
+++ b/Source/WebCore/page/PageSerializer.h
@@ -41,13 +41,13 @@
 namespace WebCore {
 
 class CachedImage;
-class CSSStyleRule;
 class CSSStyleSheet;
 class Document;
 class Frame;
 class Page;
 class RenderObject;
 class StylePropertySet;
+class StyleRule;
 
 // This class is used to serialize a page contents back to text (typically HTML).
 // It serializes all the page frames and retrieves resources such as images and CSS stylesheets.
@@ -78,8 +78,8 @@ private:
     void serializeCSSStyleSheet(CSSStyleSheet*, const KURL&);
 
     void addImageToResources(CachedImage*, RenderObject*, const KURL&);
-    void retrieveResourcesForCSSDeclaration(StylePropertySet*, Document*);
-    void retrieveResourcesForCSSRule(CSSStyleRule*, Document*);
+    void retrieveResourcesForProperties(const StylePropertySet*, Document*);
+    void retrieveResourcesForRule(StyleRule*, Document*);
 
     Vector<Resource>* m_resources;
     ListHashSet<KURL> m_resourceURLs;
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index ec50f88c8..1e6a75ce9 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -115,8 +115,9 @@ Settings::Settings(Page* page)
     , m_minimumLogicalFontSize(0)
     , m_defaultFontSize(0)
     , m_defaultFixedFontSize(0)
+    , m_defaultDeviceScaleFactor(1)
     , m_validationMessageTimerMagnification(50)
-    , m_minimumAccelerated2dCanvasSize(128 * 128)
+    , m_minimumAccelerated2dCanvasSize(257 * 256)
     , m_layoutFallbackWidth(980)
     , m_deviceDPI(240)
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
@@ -363,6 +364,11 @@ void Settings::setDefaultFixedFontSize(int defaultFontSize)
     m_page->setNeedsRecalcStyleInAllFrames();
 }
 
+void Settings::setDefaultDeviceScaleFactor(int defaultDeviceScaleFactor)
+{
+    m_defaultDeviceScaleFactor = defaultDeviceScaleFactor;
+}
+
 void Settings::setLoadsImagesAutomatically(bool loadsImagesAutomatically)
 {
     m_loadsImagesAutomatically = loadsImagesAutomatically;
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index d3906f1e5..32aabd843 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -103,6 +103,9 @@ namespace WebCore {
         void setDefaultFixedFontSize(int);
         int defaultFixedFontSize() const { return m_defaultFixedFontSize; }
 
+        void setDefaultDeviceScaleFactor(int);
+        int defaultDeviceScaleFactor() const { return m_defaultDeviceScaleFactor; }
+
         // Unlike areImagesEnabled, this only suppresses the network load of
         // the image URL.  A cached image will still be rendered if requested.
         void setLoadsImagesAutomatically(bool);
@@ -562,6 +565,7 @@ namespace WebCore {
         int m_minimumLogicalFontSize;
         int m_defaultFontSize;
         int m_defaultFixedFontSize;
+        int m_defaultDeviceScaleFactor;
         int m_validationMessageTimerMagnification;
         int m_minimumAccelerated2dCanvasSize;
         int m_layoutFallbackWidth;
diff --git a/Source/WebCore/page/SpeechInput.cpp b/Source/WebCore/page/SpeechInput.cpp
index 4d7290c3f..0128ef8a4 100644
--- a/Source/WebCore/page/SpeechInput.cpp
+++ b/Source/WebCore/page/SpeechInput.cpp
@@ -125,7 +125,7 @@ const AtomicString& SpeechInput::supplementName()
 
 void provideSpeechInputTo(Page* page, SpeechInputClient* client)
 {
-    PageSupplement::provideTo(page, SpeechInput::supplementName(), SpeechInput::create(client));
+    SpeechInput::provideTo(page, SpeechInput::supplementName(), SpeechInput::create(client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/SpeechInput.h b/Source/WebCore/page/SpeechInput.h
index bab9e3643..01148f3e5 100644
--- a/Source/WebCore/page/SpeechInput.h
+++ b/Source/WebCore/page/SpeechInput.h
@@ -33,7 +33,7 @@
 
 #if ENABLE(INPUT_SPEECH)
 
-#include "PageSupplement.h"
+#include "Page.h"
 #include "SpeechInputListener.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -49,15 +49,14 @@ class SpeechInputListener;
 // speech recognition engine. It provides methods for the input elements to activate speech
 // recognition and methods for the speech recognition engine to return back the results.
 class SpeechInput : public SpeechInputListener,
-                    public PageSupplement {
+                    public Supplement<Page> {
     WTF_MAKE_NONCOPYABLE(SpeechInput);
 public:
     virtual ~SpeechInput();
 
     static PassOwnPtr<SpeechInput> create(SpeechInputClient*);
     static const AtomicString& supplementName();
-    static SpeechInput* from(Frame* frame) { return static_cast<SpeechInput*>(PageSupplement::from(frame, supplementName())); }
-    static SpeechInput* from(Page* page) { return static_cast<SpeechInput*>(PageSupplement::from(page, supplementName())); }
+    static SpeechInput* from(Page* page) { return static_cast<SpeechInput*>(Supplement<Page>::from(page, supplementName())); }
 
     // Generates a unique ID for the given listener to be used for speech requests.
     // This should be the first call made by listeners before anything else.
diff --git a/Source/WebCore/page/animation/AnimationController.cpp b/Source/WebCore/page/animation/AnimationController.cpp
index 4930b54f4..812d18d86 100644
--- a/Source/WebCore/page/animation/AnimationController.cpp
+++ b/Source/WebCore/page/animation/AnimationController.cpp
@@ -115,19 +115,6 @@ double AnimationControllerPrivate::updateAnimations(SetChanged callSetChanged/*
     return timeToNextService;
 }
 
-void AnimationControllerPrivate::updateAnimationTimerForRenderer(RenderObject* renderer)
-{
-    double timeToNextService = 0;
-
-    RefPtr<CompositeAnimation> compAnim = m_compositeAnimations.get(renderer);
-    if (!compAnim->suspended() && compAnim->hasAnimations())
-        timeToNextService = compAnim->timeToNextService();
-
-    if (m_animationTimer.isActive())
-        m_animationTimer.stop();
-    m_animationTimer.startOneShot(timeToNextService);
-}
-
 void AnimationControllerPrivate::updateAnimationTimer(SetChanged callSetChanged/* = DoNotCallSetChanged*/)
 {
     double timeToNextService = updateAnimations(callSetChanged);
@@ -530,7 +517,7 @@ PassRefPtr<RenderStyle> AnimationController::updateAnimations(RenderObject* rend
     RefPtr<RenderStyle> blendedStyle = rendererAnimations->animate(renderer, oldStyle, newStyle);
 
     if (renderer->parent() || newStyle->animations() || (oldStyle && oldStyle->animations())) {
-        m_data->updateAnimationTimerForRenderer(renderer);
+        m_data->updateAnimationTimer();
 #if ENABLE(REQUEST_ANIMATION_FRAME)
         if (FrameView* view = renderer->document()->view())
             view->scheduleAnimation();
diff --git a/Source/WebCore/page/animation/AnimationControllerPrivate.h b/Source/WebCore/page/animation/AnimationControllerPrivate.h
index 8f3ee7f6c..2c2051eff 100644
--- a/Source/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/Source/WebCore/page/animation/AnimationControllerPrivate.h
@@ -108,8 +108,6 @@ public:
     void animationWillBeRemoved(AnimationBase*);
 
     PassRefPtr<WebKitAnimationList> animationsForRenderer(RenderObject*) const;
-
-    void updateAnimationTimerForRenderer(RenderObject*);
     
 private:
     void animationTimerFired(Timer<AnimationControllerPrivate>*);
diff --git a/Source/WebCore/page/blackberry/FrameBlackBerry.cpp b/Source/WebCore/page/blackberry/FrameBlackBerry.cpp
deleted file mode 100644
index 64bb1bb53..000000000
--- a/Source/WebCore/page/blackberry/FrameBlackBerry.cpp
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
- * Copyright (C) 2010, 2011 Research In Motion Limited. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include "config.h"
-#include "Frame.h"
-
-#include "NotImplemented.h"
-
-namespace WebCore {
-
-DragImageRef Frame::dragImageForSelection()
-{
-    notImplemented();
-    return 0;
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
index 5c14d995d..df2961bd8 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
@@ -53,6 +53,7 @@ namespace WebCore {
 
 ScrollingCoordinator::ScrollingCoordinator(Page* page)
     : m_page(page)
+    , m_forceMainThreadScrollLayerPositionUpdates(false)
 #if ENABLE(THREADED_SCROLLING)
     , m_scrollingTreeState(ScrollingTreeState::create())
     , m_scrollingTree(ScrollingTree::create(this))
@@ -265,7 +266,14 @@ void ScrollingCoordinator::updateMainFrameScrollPosition(const IntPoint& scrollP
 void ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint& scrollPosition)
 {
 #if USE(ACCELERATED_COMPOSITING)
+    ASSERT(isMainThread());
+
+    if (!m_page)
+        return;
+
     FrameView* frameView = m_page->mainFrame()->view();
+    if (!frameView)
+        return;
 
     // Make sure to update the main frame scroll position before changing the scroll layer position,
     // otherwise we'll introduce jittering on pages with slow repaint objects (like background-attachment: fixed).
@@ -279,6 +287,22 @@ void ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition(c
 #endif
 }
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+void ScrollingCoordinator::handleWheelEventPhase(PlatformWheelEventPhase phase)
+{
+    ASSERT(isMainThread());
+
+    if (!m_page)
+        return;
+
+    FrameView* frameView = m_page->mainFrame()->view();
+    if (!frameView)
+        return;
+
+    frameView->scrollAnimator()->handleWheelEventPhase(phase);
+}
+#endif
+
 void ScrollingCoordinator::recomputeWheelEventHandlerCount()
 {
     unsigned wheelEventHandlerCount = 0;
@@ -294,7 +318,16 @@ void ScrollingCoordinator::updateShouldUpdateScrollLayerPositionOnMainThread()
     FrameView* frameView = m_page->mainFrame()->view();
 
     // FIXME: Having fixed objects on the page should not trigger the slow path.
-    setShouldUpdateScrollLayerPositionOnMainThread(frameView->hasSlowRepaintObjects() || frameView->hasFixedObjects());
+    setShouldUpdateScrollLayerPositionOnMainThread(m_forceMainThreadScrollLayerPositionUpdates || frameView->hasSlowRepaintObjects() || frameView->hasFixedObjects());
+}
+
+void ScrollingCoordinator::setForceMainThreadScrollLayerPositionUpdates(bool forceMainThreadScrollLayerPositionUpdates)
+{
+    if (m_forceMainThreadScrollLayerPositionUpdates == forceMainThreadScrollLayerPositionUpdates)
+        return;
+
+    m_forceMainThreadScrollLayerPositionUpdates = forceMainThreadScrollLayerPositionUpdates;
+    updateShouldUpdateScrollLayerPositionOnMainThread();
 }
 
 #if ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.h b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
index 00b289fe2..ff5440041 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.h
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
@@ -28,6 +28,7 @@
 
 #include "GraphicsLayer.h"
 #include "IntRect.h"
+#include "PlatformWheelEvent.h"
 #include "ScrollTypes.h"
 #include "Timer.h"
 #include <wtf/Forward.h>
@@ -46,7 +47,6 @@ namespace WebCore {
 class FrameView;
 class GraphicsLayer;
 class Page;
-class PlatformWheelEvent;
 class Region;
 class ScrollingCoordinatorPrivate;
 class ScrollingTreeState;
@@ -107,6 +107,14 @@ public:
     // Dispatched by the scrolling tree whenever the main frame scroll position changes and the scroll layer position needs to be updated as well.
     void updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint&);
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+    // Dispatched by the scrolling tree during handleWheelEvent. This is required as long as scrollbars are painted on the main thread.
+    void handleWheelEventPhase(PlatformWheelEventPhase);
+#endif
+
+    // Force all scroll layer position updates to happen on the main thread.
+    void setForceMainThreadScrollLayerPositionUpdates(bool);
+
 private:
     explicit ScrollingCoordinator(Page*);
 
@@ -123,6 +131,8 @@ private:
 
     Page* m_page;
 
+    bool m_forceMainThreadScrollLayerPositionUpdates;
+
 #if ENABLE(THREADED_SCROLLING)
     void scheduleTreeStateCommit();
 
diff --git a/Source/WebCore/page/scrolling/ScrollingThread.cpp b/Source/WebCore/page/scrolling/ScrollingThread.cpp
index f92969cc5..4d804677f 100644
--- a/Source/WebCore/page/scrolling/ScrollingThread.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingThread.cpp
@@ -85,8 +85,6 @@ void ScrollingThread::threadCallback(void* scrollingThread)
 
 void ScrollingThread::threadBody()
 {
-    ASSERT(isCurrentThread());
-
     initializeRunLoop();
 }
 
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.cpp b/Source/WebCore/page/scrolling/ScrollingTree.cpp
index d58c62bd3..9d63fae81 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingTree.cpp
@@ -174,6 +174,16 @@ void ScrollingTree::updateMainFrameScrollPositionAndScrollLayerPosition(const In
     callOnMainThread(bind(&ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition, m_scrollingCoordinator.get(), scrollPosition));
 }
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+void ScrollingTree::handleWheelEventPhase(PlatformWheelEventPhase phase)
+{
+    if (!m_scrollingCoordinator)
+        return;
+
+    callOnMainThread(bind(&ScrollingCoordinator::handleWheelEventPhase, m_scrollingCoordinator.get(), phase));
+}
+#endif
+
 bool ScrollingTree::canGoBack()
 {
     MutexLocker lock(m_swipeStateMutex);
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.h b/Source/WebCore/page/scrolling/ScrollingTree.h
index 00d2584c0..65e2ad98b 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.h
+++ b/Source/WebCore/page/scrolling/ScrollingTree.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(THREADED_SCROLLING)
 
+#include "PlatformWheelEvent.h"
 #include "Region.h"
 #include <wtf/Functional.h>
 #include <wtf/OwnPtr.h>
@@ -39,7 +40,6 @@
 namespace WebCore {
 
 class IntPoint;
-class PlatformWheelEvent;
 class ScrollingCoordinator;
 class ScrollingTreeNode;
 class ScrollingTreeState;
@@ -80,6 +80,10 @@ public:
     void updateMainFrameScrollPosition(const IntPoint& scrollPosition);
     void updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint& scrollPosition);
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+    void handleWheelEventPhase(PlatformWheelEventPhase);
+#endif
+
     bool canGoBack();
     bool canGoForward();
 
diff --git a/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
index e590138a6..9504dfa86 100644
--- a/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
+++ b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
@@ -27,8 +27,15 @@
 
 #include "ScrollingCoordinator.h"
 
+#include "Frame.h"
+#include "FrameView.h"
 #include "LayerChromium.h"
 #include "Region.h"
+#include "RenderLayerCompositor.h"
+#include "RenderView.h"
+#include "ScrollbarLayerChromium.h"
+#include "ScrollbarTheme.h"
+#include "cc/CCProxy.h"
 
 namespace WebCore {
 
@@ -58,14 +65,61 @@ ScrollingCoordinator::~ScrollingCoordinator()
     delete m_private;
 }
 
-void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView*, GraphicsLayer* horizontalScrollbarLayer)
+static GraphicsLayer* scrollLayerForFrameView(FrameView* frameView)
 {
-    // FIXME: Implement!
+#if USE(ACCELERATED_COMPOSITING)
+    Frame* frame = frameView->frame();
+    if (!frame)
+        return 0;
+
+    RenderView* renderView = frame->contentRenderer();
+    if (!renderView)
+        return 0;
+    return renderView->compositor()->scrollLayer();
+#else
+    return 0;
+#endif
 }
 
-void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView*, GraphicsLayer* verticalScrollbarLayer)
+static void scrollbarLayerDidChange(Scrollbar* scrollbar, LayerChromium* scrollLayer, GraphicsLayer* scrollbarGraphicsLayer)
 {
-    // FIXME: Implement!
+    ASSERT(scrollbar);
+    ASSERT(scrollLayer);
+    ASSERT(scrollbarGraphicsLayer);
+
+    if (scrollbar->isCustomScrollbar() || !CCProxy::hasImplThread()) {
+        scrollbarGraphicsLayer->setContentsToMedia(0);
+        scrollbarGraphicsLayer->setDrawsContent(true);
+        return;
+    }
+
+    RefPtr<ScrollbarLayerChromium> scrollbarLayer = ScrollbarLayerChromium::create(scrollbar, scrollLayer->id());
+    scrollbarGraphicsLayer->setContentsToMedia(scrollbarLayer.get());
+    scrollbarGraphicsLayer->setDrawsContent(false);
+}
+
+void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView* frameView, GraphicsLayer* horizontalScrollbarLayer)
+{
+    if (!horizontalScrollbarLayer || !coordinatesScrollingForFrameView(frameView))
+        return;
+
+    LayerChromium* scrollLayer = m_private->scrollLayer();
+    if (!scrollLayer) // FIXME: sometimes we get called before setScrollLayer, workaround by finding the scroll layout ourselves.
+        scrollLayer = scrollLayerForFrameView(frameView)->platformLayer();
+
+    scrollbarLayerDidChange(frameView->horizontalScrollbar(), scrollLayer, horizontalScrollbarLayer);
+}
+
+void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView* frameView, GraphicsLayer* verticalScrollbarLayer)
+{
+    if (!verticalScrollbarLayer || !coordinatesScrollingForFrameView(frameView))
+        return;
+
+    LayerChromium* scrollLayer = m_private->scrollLayer();
+    if (!scrollLayer) // FIXME: sometimes we get called before setScrollLayer, workaround by finding the scroll layout ourselves.
+        scrollLayer = scrollLayerForFrameView(frameView)->platformLayer();
+
+    scrollbarLayerDidChange(frameView->verticalScrollbar(), scrollLayer, verticalScrollbarLayer);
 }
 
 void ScrollingCoordinator::setScrollLayer(GraphicsLayer* scrollLayer)
@@ -73,9 +127,10 @@ void ScrollingCoordinator::setScrollLayer(GraphicsLayer* scrollLayer)
     m_private->setScrollLayer(scrollLayer ? scrollLayer->platformLayer() : 0);
 }
 
-void ScrollingCoordinator::setNonFastScrollableRegion(const Region&)
+void ScrollingCoordinator::setNonFastScrollableRegion(const Region& region)
 {
-    // FIXME: Implement!
+    if (LayerChromium* layer = m_private->scrollLayer())
+        layer->setNonFastScrollableRegion(region);
 }
 
 void ScrollingCoordinator::setScrollParameters(ScrollElasticity horizontalScrollElasticity, ScrollElasticity verticalScrollElasticity,
@@ -93,7 +148,8 @@ void ScrollingCoordinator::setWheelEventHandlerCount(unsigned wheelEventHandlerC
 
 void ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(bool should)
 {
-    // FIXME: Implement!
+    if (LayerChromium* layer = m_private->scrollLayer())
+        layer->setShouldScrollOnMainThread(should);
 }
 
 }
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
index 94335b0b2..dbe821338 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
@@ -32,6 +32,7 @@
 #import "FrameView.h"
 #import "Page.h"
 #import "ScrollingThread.h"
+#import "ScrollingTree.h"
 #import "ScrollingTreeState.h"
 #import <QuartzCore/QuartzCore.h>
 #import <wtf/Functional.h>
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm
index a6a768113..064696e42 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm
@@ -45,6 +45,8 @@ void ScrollingThread::initializeRunLoop()
         m_initializeRunLoopCondition.broadcast();
     }
 
+    ASSERT(isCurrentThread());
+
     CFRunLoopRun();
 }
 
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
index 97b3d22bc..f056ff9f0 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
@@ -76,6 +76,7 @@ private:
     RetainPtr<CFRunLoopTimerRef> m_snapRubberbandTimer;
 
     RetainPtr<CALayer> m_scrollLayer;
+    IntPoint m_probableMainThreadScrollPosition;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
index 966b2e18f..a9e54b574 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
@@ -60,11 +60,19 @@ void ScrollingTreeNodeMac::update(ScrollingTreeState* state)
 
     if (state->changedProperties() & (ScrollingTreeState::ScrollLayer | ScrollingTreeState::ContentsSize | ScrollingTreeState::ViewportRect))
         updateMainFramePinState(scrollPosition());
+
+    if ((state->changedProperties() & ScrollingTreeState::ShouldUpdateScrollLayerPositionOnMainThread) && shouldUpdateScrollLayerPositionOnMainThread()) {
+        // We're transitioning to the slow "update scroll layer position on the main thread" mode.
+        // Initialize the probable main thread scroll position with the current scroll layer position.
+        CGPoint scrollLayerPosition = m_scrollLayer.get().position;
+        m_probableMainThreadScrollPosition = IntPoint(-scrollLayerPosition.x, -scrollLayerPosition.y);
+    }
 }
 
 void ScrollingTreeNodeMac::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
 {
     m_scrollElasticityController.handleWheelEvent(wheelEvent);
+    scrollingTree()->handleWheelEventPhase(wheelEvent.phase());
 }
 
 void ScrollingTreeNodeMac::setScrollPosition(const IntPoint& scrollPosition)
@@ -72,6 +80,7 @@ void ScrollingTreeNodeMac::setScrollPosition(const IntPoint& scrollPosition)
     updateMainFramePinState(scrollPosition);
 
     if (shouldUpdateScrollLayerPositionOnMainThread()) {
+        m_probableMainThreadScrollPosition = scrollPosition;
         scrollingTree()->updateMainFrameScrollPositionAndScrollLayerPosition(scrollPosition);
         return;
     }
@@ -214,6 +223,9 @@ void ScrollingTreeNodeMac::stopSnapRubberbandTimer()
 
 IntPoint ScrollingTreeNodeMac::scrollPosition() const
 {
+    if (shouldUpdateScrollLayerPositionOnMainThread())
+        return m_probableMainThreadScrollPosition;
+
     CGPoint scrollLayerPosition = m_scrollLayer.get().position;
     return IntPoint(-scrollLayerPosition.x, -scrollLayerPosition.y);
 }
diff --git a/Source/WebCore/platform/ActivePlatformGestureAnimation.cpp b/Source/WebCore/platform/ActivePlatformGestureAnimation.cpp
new file mode 100644
index 000000000..7f6e7c2c9
--- /dev/null
+++ b/Source/WebCore/platform/ActivePlatformGestureAnimation.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "ActivePlatformGestureAnimation.h"
+
+#include "PlatformGestureCurve.h"
+#include "PlatformGestureCurveTarget.h"
+
+namespace WebCore {
+
+PassOwnPtr<ActivePlatformGestureAnimation> ActivePlatformGestureAnimation::create(double startTime, PassOwnPtr<PlatformGestureCurve> curve, PlatformGestureCurveTarget* target)
+{
+    return adoptPtr(new ActivePlatformGestureAnimation(startTime, curve, target));
+}
+
+ActivePlatformGestureAnimation::~ActivePlatformGestureAnimation()
+{
+}
+
+ActivePlatformGestureAnimation::ActivePlatformGestureAnimation(double startTime, PassOwnPtr<PlatformGestureCurve> curve, PlatformGestureCurveTarget* target)
+    : m_startTime(startTime)
+    , m_curve(curve)
+    , m_target(target)
+{
+}
+
+bool ActivePlatformGestureAnimation::animate(double time)
+{
+    // All PlatformGestureCurves assume zero-based time, so we subtract
+    // the animation start time before passing to the curve.
+    return m_curve->apply(time - m_startTime, m_target);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/ActivePlatformGestureAnimation.h b/Source/WebCore/platform/ActivePlatformGestureAnimation.h
new file mode 100644
index 000000000..aae40de7b
--- /dev/null
+++ b/Source/WebCore/platform/ActivePlatformGestureAnimation.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ActivePlatformGestureAnimation_h
+#define ActivePlatformGestureAnimation_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class PlatformGestureCurve;
+class PlatformGestureCurveTarget;
+
+// Implements a gesture animation (fling scroll, etc.) using a curve with a generic interface
+// to define the animation parameters as a function of time, and applies the animation
+// to a target, again via a generic interface. It is assumed that animate() is called
+// on a more-or-less regular basis by the owner.
+class ActivePlatformGestureAnimation {
+    WTF_MAKE_NONCOPYABLE(ActivePlatformGestureAnimation);
+public:
+    static PassOwnPtr<ActivePlatformGestureAnimation> create(double startTime, PassOwnPtr<PlatformGestureCurve>, PlatformGestureCurveTarget*);
+    ~ActivePlatformGestureAnimation();
+
+    bool animate(double time);
+
+private:
+    // Assumes a valid PlatformGestureCurveTarget that outlives the animation.
+    ActivePlatformGestureAnimation(double startTime, PassOwnPtr<PlatformGestureCurve>, PlatformGestureCurveTarget*);
+
+    double m_startTime;
+    OwnPtr<PlatformGestureCurve> m_curve;
+    PlatformGestureCurveTarget* m_target;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/AsyncFileSystem.h b/Source/WebCore/platform/AsyncFileSystem.h
index bbef6a4e3..7792101c5 100644
--- a/Source/WebCore/platform/AsyncFileSystem.h
+++ b/Source/WebCore/platform/AsyncFileSystem.h
@@ -140,6 +140,13 @@ public:
     // AsyncFileSystemCallbacks::didFail() is called otherwise.
     virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>) = 0;
 
+    // Creates a snapshot file and read its metadata for a new File object.
+    // In local filesystem cases the backend may simply return the metadata of the file itself (as well as readMetadata does),
+    // while in remote filesystem case the backend may download the file into a temporary snapshot file and return the metadata of the temporary file.
+    // AsyncFileSystemCallbacks::didReadMetadata() is called when the metadata for the snapshot file is successfully returned.
+    // AsyncFileSystemCallbacks::didFail() is called otherwise.
+    virtual void createSnapshotFileAndReadMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>) = 0;
+
     Type type() const { return m_type; }
 
 protected:
diff --git a/Source/WebCore/platform/AsyncFileSystemCallbacks.h b/Source/WebCore/platform/AsyncFileSystemCallbacks.h
index cee8d90d0..d8a85e747 100644
--- a/Source/WebCore/platform/AsyncFileSystemCallbacks.h
+++ b/Source/WebCore/platform/AsyncFileSystemCallbacks.h
@@ -33,36 +33,35 @@
 
 #if ENABLE(FILE_SYSTEM)
 
+#include "AsyncFileSystem.h"
+#include "AsyncFileWriter.h"
+#include "FileMetadata.h"
 #include "PlatformString.h"
 
 namespace WebCore {
 
-class AsyncFileSystem;
-class AsyncFileWriter;
-struct FileMetadata;
-
 class AsyncFileSystemCallbacks {
     WTF_MAKE_NONCOPYABLE(AsyncFileSystemCallbacks);
 public:
-    AsyncFileSystemCallbacks() { }    
+    AsyncFileSystemCallbacks() { }
 
     // Called when a requested operation is completed successfully.
-    virtual void didSucceed() = 0;
+    virtual void didSucceed() { ASSERT_NOT_REACHED(); }
 
     // Called when a requested file system is opened.
-    virtual void didOpenFileSystem(const String& name, PassOwnPtr<AsyncFileSystem>) = 0;
+    virtual void didOpenFileSystem(const String& name, PassOwnPtr<AsyncFileSystem>) { ASSERT_NOT_REACHED(); }
 
     // Called when a file metadata is read successfully.
-    virtual void didReadMetadata(const FileMetadata&) = 0;
+    virtual void didReadMetadata(const FileMetadata&) { ASSERT_NOT_REACHED(); }
 
     // Called when a directory entry is read.
-    virtual void didReadDirectoryEntry(const String& name, bool isDirectory) = 0;
+    virtual void didReadDirectoryEntry(const String& name, bool isDirectory) { ASSERT_NOT_REACHED(); }
 
-    // Called after a chunk of directory entries have been read (i.e. indicates it's good time to call back to the application).  If hasMore is true there can be more chunks.
-    virtual void didReadDirectoryEntries(bool hasMore) = 0;
+    // Called after a chunk of directory entries have been read (i.e. indicates it's good time to call back to the application). If hasMore is true there can be more chunks.
+    virtual void didReadDirectoryEntries(bool hasMore) { ASSERT_NOT_REACHED(); }
 
     // Called when an AsyncFileWrter has been created successfully.
-    virtual void didCreateFileWriter(PassOwnPtr<AsyncFileWriter> writer, long long length) = 0;
+    virtual void didCreateFileWriter(PassOwnPtr<AsyncFileWriter>, long long length) { ASSERT_NOT_REACHED(); }
 
     // Called when there was an error.
     virtual void didFail(int code) = 0;
diff --git a/Source/WebCore/platform/CalculationValue.cpp b/Source/WebCore/platform/CalculationValue.cpp
index b9e38581a..57413fbfe 100755
--- a/Source/WebCore/platform/CalculationValue.cpp
+++ b/Source/WebCore/platform/CalculationValue.cpp
@@ -31,6 +31,43 @@
 #include "config.h"
 #include "CalculationValue.h"
 
+#include <limits>
+
 namespace WebCore {
 
+float CalcExpressionBinaryOperation::evaluate(float maxValue) const
+{
+    float left = m_leftSide->evaluate(maxValue);
+    float right = m_rightSide->evaluate(maxValue);
+    switch (m_operator) {
+    case CalcAdd:
+        return left + right;
+    case CalcSubtract:
+        return left - right;
+    case CalcMultiply:
+        return left * right;
+    case CalcDivide:
+        if (!right)
+            return std::numeric_limits<float>::quiet_NaN();
+        return left / right;
+    }
+    ASSERT_NOT_REACHED();
+    return std::numeric_limits<float>::quiet_NaN();
+}
+
+PassRefPtr<CalculationValue> CalculationValue::create(PassOwnPtr<CalcExpressionNode> value, CalculationPermittedValueRange range)
+{
+    return adoptRef(new CalculationValue(value, range));
+}
+
+float CalculationValue::evaluate(float maxValue) const
+{
+    float result = m_value->evaluate(maxValue);
+    // FIXME calc https://webkit.org/b/80411 : result is NaN when there is a division 
+    // by zero which isn't found at parse time. 
+    if (isnan(result))
+        return 0;
+    return m_isNonNegative && result < 0 ? 0 : result;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/CalculationValue.h b/Source/WebCore/platform/CalculationValue.h
index d89445e80..c55845542 100755
--- a/Source/WebCore/platform/CalculationValue.h
+++ b/Source/WebCore/platform/CalculationValue.h
@@ -50,6 +50,80 @@ enum CalculationPermittedValueRange {
     CalculationRangeAll,
     CalculationRangeNonNegative
 };
+        
+class CalcExpressionNode {
+public:
+    virtual ~CalcExpressionNode()
+    {
+    }
+    
+    virtual float evaluate(float maxValue) const = 0;
+};
+    
+class CalculationValue : public RefCounted<CalculationValue> {
+public:
+    static PassRefPtr<CalculationValue> create(PassOwnPtr<CalcExpressionNode> value, CalculationPermittedValueRange);
+    float evaluate(float maxValue) const;
+    
+private:
+    CalculationValue(PassOwnPtr<CalcExpressionNode> value, CalculationPermittedValueRange range)
+        : m_value(value)
+        , m_isNonNegative(range == CalculationRangeNonNegative)
+    {
+    }
+    
+    OwnPtr<CalcExpressionNode> m_value;
+    bool m_isNonNegative;
+};
+
+class CalcExpressionNumber : public CalcExpressionNode {
+public:
+    explicit CalcExpressionNumber(float value)
+        : m_value(value)
+    {
+    }
+
+    virtual float evaluate(float) const 
+    {
+        return m_value;
+    }
+    
+private:
+    float m_value;
+};
+
+class CalcExpressionLength : public CalcExpressionNode {
+public:
+    explicit CalcExpressionLength(Length length)
+        : m_length(length)
+    {
+    }
+
+    virtual float evaluate(float maxValue) const
+    {
+        return m_length.calcFloatValue(maxValue);
+    }
+    
+private:
+    Length m_length;
+};
+
+class CalcExpressionBinaryOperation : public CalcExpressionNode {
+public:
+    CalcExpressionBinaryOperation(PassOwnPtr<CalcExpressionNode> leftSide, PassOwnPtr<CalcExpressionNode> rightSide, CalcOperator op)
+        : m_leftSide(leftSide)
+        , m_rightSide(rightSide)
+        , m_operator(op)
+    {
+    }
+
+    virtual float evaluate(float) const;
+
+private:
+    OwnPtr<CalcExpressionNode> m_leftSide;
+    OwnPtr<CalcExpressionNode> m_rightSide;
+    CalcOperator m_operator;
+};
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/ContextMenu.cpp b/Source/WebCore/platform/ContextMenu.cpp
index a51d81839..014d58f87 100644
--- a/Source/WebCore/platform/ContextMenu.cpp
+++ b/Source/WebCore/platform/ContextMenu.cpp
@@ -38,7 +38,7 @@ static const ContextMenuItem* findItemWithAction(unsigned action, const Vector<C
 {
     for (size_t i = 0; i < items.size(); ++i) {
         const ContextMenuItem& item = items[i];
-        if (item.action() == action)
+        if (item.action() == static_cast<ContextMenuAction>(action))
             return &item;
         if (item.type() != SubmenuType)
             continue;
diff --git a/Source/WebCore/platform/DragData.h b/Source/WebCore/platform/DragData.h
index ff818de4a..6737b8f16 100644
--- a/Source/WebCore/platform/DragData.h
+++ b/Source/WebCore/platform/DragData.h
@@ -46,8 +46,6 @@ typedef id <NSDraggingInfo> DragDataRef;
 typedef void* DragDataRef;
 #endif
 
-OBJC_CLASS NSPasteboard;
-
 #elif PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QMimeData;
diff --git a/Source/WebCore/platform/FileStream.cpp b/Source/WebCore/platform/FileStream.cpp
index 5c77e082b..e0b29e042 100644
--- a/Source/WebCore/platform/FileStream.cpp
+++ b/Source/WebCore/platform/FileStream.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "FileStream.h"
 
@@ -147,4 +147,4 @@ bool FileStream::truncate(long long)
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
diff --git a/Source/WebCore/platform/FileStream.h b/Source/WebCore/platform/FileStream.h
index c369eb094..baa3948dc 100644
--- a/Source/WebCore/platform/FileStream.h
+++ b/Source/WebCore/platform/FileStream.h
@@ -31,7 +31,7 @@
 #ifndef FileStream_h
 #define FileStream_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "FileSystem.h"
 #include <wtf/Forward.h>
@@ -95,6 +95,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // FileStream_h
diff --git a/Source/WebCore/platform/FileStreamClient.h b/Source/WebCore/platform/FileStreamClient.h
index 4066d9f65..b4539a631 100644
--- a/Source/WebCore/platform/FileStreamClient.h
+++ b/Source/WebCore/platform/FileStreamClient.h
@@ -31,33 +31,28 @@
 #ifndef FileStreamClient_h
 #define FileStreamClient_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 namespace WebCore {
 
 class FileStreamClient {
 public:
-    // For reading.
-    virtual void didRead(int) { }
-
-    // For writing.
-    virtual void didWrite(int) { }
-    virtual void didTruncate(bool) { }
+    virtual void didOpen(bool) { } // false signals failure.
+    virtual void didStop() { }
+    virtual void didGetSize(long long) { } // -1 signals failure.
+    virtual void didRead(int) { } // -1 signals failure.
+    virtual void didWrite(int) { } // -1 signals failure.
+    virtual void didTruncate(bool) { } // false signals failure.
 
     // FIXME: To be removed when we switch to using BlobData.
     virtual void didStart() { }
 
-    // For both reading and writing.
-    virtual void didOpen(bool) { }
-    virtual void didStop() { }
-    virtual void didGetSize(long long) { }
-
 protected:
     virtual ~FileStreamClient() { }
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // FileStreamClient_h
diff --git a/Source/WebCore/platform/FileSystem.h b/Source/WebCore/platform/FileSystem.h
index 9168ea6bb..a202fa036 100644
--- a/Source/WebCore/platform/FileSystem.h
+++ b/Source/WebCore/platform/FileSystem.h
@@ -194,6 +194,10 @@ String encodeForFileName(const String&);
 RetainPtr<CFURLRef> pathAsURL(const String&);
 #endif
 
+#if PLATFORM(MAC)
+void setMetadataURL(String& URLString, const String& referrer, const String& path);
+#endif
+
 #if PLATFORM(GTK)
 String filenameToString(const char*);
 String filenameForDisplay(const String&);
diff --git a/Source/WebCore/platform/KURL.cpp b/Source/WebCore/platform/KURL.cpp
index a3812c6a2..ad5feea3b 100644
--- a/Source/WebCore/platform/KURL.cpp
+++ b/Source/WebCore/platform/KURL.cpp
@@ -30,7 +30,9 @@
 #include "TextEncoding.h"
 #include <stdio.h>
 #include <wtf/HashMap.h>
+#if !USE(WTFURL)
 #include <wtf/HexNumber.h>
+#endif
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringBuilder.h>
@@ -66,7 +68,7 @@ static inline bool isLetterMatchIgnoringCase(UChar character, char lowercaseLett
     return (character | 0x20) == lowercaseLetter;
 }
 
-#if !USE(GOOGLEURL)
+#if !USE(GOOGLEURL) && !USE(WTFURL)
 
 static const char wsScheme[] = {'w', 's'};
 static const char ftpScheme[] = {'f', 't', 'p'};
@@ -634,33 +636,6 @@ bool KURL::hasFragmentIdentifier() const
     return m_fragmentEnd != m_queryEnd;
 }
 
-void KURL::copyParsedQueryTo(ParsedURLParameters& parameters) const
-{
-    const UChar* pos = m_string.characters() + m_pathEnd + 1;
-    const UChar* end = m_string.characters() + m_queryEnd;
-    while (pos < end) {
-        const UChar* parameterStart = pos;
-        while (pos < end && *pos != '&')
-            ++pos;
-        const UChar* parameterEnd = pos;
-        if (pos < end) {
-            ASSERT(*pos == '&');
-            ++pos;
-        }
-        if (parameterStart == parameterEnd)
-            continue;
-        const UChar* nameStart = parameterStart;
-        const UChar* equalSign = parameterStart;
-        while (equalSign < parameterEnd && *equalSign != '=')
-            ++equalSign;
-        if (equalSign == nameStart)
-            continue;
-        String name(nameStart, equalSign - nameStart);
-        String value = equalSign == parameterEnd ? String() : String(equalSign + 1, parameterEnd - equalSign - 1);
-        parameters.set(name, value);
-    }
-}
-
 String KURL::baseAsString() const
 {
     return m_string.left(m_pathAfterLastSlash);
@@ -872,54 +847,6 @@ void KURL::setPath(const String& s)
     parse(m_string.left(m_portEnd) + encodeWithURLEscapeSequences(path) + m_string.substring(m_pathEnd));
 }
 
-String KURL::deprecatedString() const
-{
-    if (!m_isValid)
-        return m_string;
-
-    StringBuilder result;
-
-    result.append(protocol());
-    result.append(':');
-
-    StringBuilder authority;
-
-    if (m_hostEnd != m_passwordEnd) {
-        if (m_userEnd != m_userStart) {
-            authority.append(user());
-            authority.append('@');
-        }
-        authority.append(host());
-        if (hasPort()) {
-            authority.append(':');
-            authority.append(String::number(port()));
-        }
-    }
-
-    if (!authority.isEmpty()) {
-        result.append('/');
-        result.append('/');
-        result.append(authority.characters(), authority.length());
-    } else if (protocolIs("file")) {
-        result.append('/');
-        result.append('/');
-    }
-
-    result.append(path());
-
-    if (m_pathEnd != m_queryEnd) {
-        result.append('?');
-        result.append(query());
-    }
-
-    if (m_fragmentEnd != m_queryEnd) {
-        result.append('#');
-        result.append(fragmentIdentifier());
-    }
-
-    return result.toString();
-}
-
 String decodeURLEscapeSequences(const String& string)
 {
     return decodeEscapeSequences<URLEscapeSequence>(string, UTF8Encoding());
@@ -1796,7 +1723,7 @@ void KURL::print() const
 }
 #endif
 
-#endif // !USE(GOOGLEURL)
+#endif // !USE(GOOGLEURL) && !USE(WTFURL)
 
 String KURL::strippedForUseAsReferrer() const
 {
@@ -1961,17 +1888,4 @@ String mimeTypeFromDataURL(const String& url)
     return "";
 }
 
-bool protocolIsInHTTPFamily(const String& url)
-{
-    unsigned length = url.length();
-    const UChar* characters = url.characters();
-    return length > 4
-        && isLetterMatchIgnoringCase(characters[0], 'h')
-        && isLetterMatchIgnoringCase(characters[1], 't')
-        && isLetterMatchIgnoringCase(characters[2], 't')
-        && isLetterMatchIgnoringCase(characters[3], 'p')
-        && (characters[4] == ':'
-            || (isLetterMatchIgnoringCase(characters[4], 's') && length > 5 && characters[5] == ':'));
-}
-
 }
diff --git a/Source/WebCore/platform/KURL.h b/Source/WebCore/platform/KURL.h
index a464dc3de..3cba090aa 100644
--- a/Source/WebCore/platform/KURL.h
+++ b/Source/WebCore/platform/KURL.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,7 @@
 #ifndef KURL_h
 #define KURL_h
 
+#include "KURLWTFURLImpl.h"
 #include "PlatformString.h"
 #include <wtf/HashMap.h>
 
@@ -56,8 +57,6 @@ namespace WebCore {
 class TextEncoding;
 struct KURLHash;
 
-typedef HashMap<String, String> ParsedURLParameters;
-
 enum ParsedURLStringTag { ParsedURLString };
 
 class KURL {
@@ -71,10 +70,16 @@ public:
     KURL(ParsedURLStringTag, const String&);
 #if USE(GOOGLEURL)
     KURL(WTF::HashTableDeletedValueType) : m_url(WTF::HashTableDeletedValue) { }
+#elif USE(WTFURL)
+    KURL(WTF::HashTableDeletedValueType) : m_urlImpl(WTF::HashTableDeletedValue) { }
 #else
     KURL(WTF::HashTableDeletedValueType) : m_string(WTF::HashTableDeletedValue) { }
 #endif
+#if !USE(WTFURL)
     bool isHashTableDeletedValue() const { return string().isHashTableDeletedValue(); }
+#else
+    bool isHashTableDeletedValue() const { return m_urlImpl.isHashTableDeletedValue(); }
+#endif
 
     // Resolves the relative URL with the given base URL. If provided, the
     // TextEncoding is used to encode non-ASCII characers. The base URL can be
@@ -121,6 +126,9 @@ public:
 
 #if USE(GOOGLEURL)
     const String& string() const { return m_url.string(); }
+#elif USE(WTFURL)
+    // FIXME: Split this in URLString and InvalidURLString, get rid of the implicit conversions.
+    const String& string() const;
 #else
     const String& string() const { return m_string; }
 #endif
@@ -137,13 +145,8 @@ public:
     String fragmentIdentifier() const;
     bool hasFragmentIdentifier() const;
 
-    void copyParsedQueryTo(ParsedURLParameters&) const;
-
     String baseAsString() const;
 
-    // This function is only used by location.href. It's likely we shouldn't
-    // use it for that purpose, but more study is necessary before we remove it.
-    String deprecatedString() const;
     String fileSystemPath() const;
 
     // Returns true if the current URL's protocol is the same as the null-
@@ -225,9 +228,6 @@ public:
     void print() const;
 #endif
 
-    // FIXME: Remove this after changing all callers to use protocolIsInHTTPFamily.
-    bool protocolInHTTPFamily() const { return protocolIsInHTTPFamily(); }
-
 private:
     void invalidate();
     bool isHierarchical() const;
@@ -235,6 +235,8 @@ private:
 #if USE(GOOGLEURL)
     friend class KURLGooglePrivate;
     KURLGooglePrivate m_url;
+#elif USE(WTFURL)
+    RefPtr<KURLWTFURLImpl> m_urlImpl;
 #else  // !USE(GOOGLEURL)
     void init(const KURL&, const String&, const TextEncoding&);
     void copyToBuffer(Vector<char, 512>& buffer) const;
@@ -280,7 +282,6 @@ const KURL& blankURL();
 // This is especially important because valid javascript URLs are not necessarily considered valid by KURL.
 
 bool protocolIs(const String& url, const char* protocol);
-bool protocolIsInHTTPFamily(const String& url);
 bool protocolIsJavaScript(const String& url);
 
 bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
@@ -330,7 +331,7 @@ inline bool operator!=(const String& a, const KURL& b)
     return a != b.string();
 }
 
-#if !USE(GOOGLEURL)
+#if !USE(GOOGLEURL) && !USE(WTFURL)
 
 // Inline versions of some non-GoogleURL functions so we can get inlining
 // without having to have a lot of ugly ifdefs in the class definition.
@@ -385,7 +386,7 @@ inline unsigned KURL::pathAfterLastSlash() const
     return m_pathAfterLastSlash;
 }
 
-#endif  // !USE(GOOGLEURL)
+#endif // !USE(GOOGLEURL) && !USE(WTFURL)
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/KURLGoogle.cpp b/Source/WebCore/platform/KURLGoogle.cpp
index 0507a2412..e34410024 100644
--- a/Source/WebCore/platform/KURLGoogle.cpp
+++ b/Source/WebCore/platform/KURLGoogle.cpp
@@ -578,34 +578,6 @@ bool KURL::hasFragmentIdentifier() const
     return m_url.m_parsed.ref.len >= 0;
 }
 
-void KURL::copyParsedQueryTo(ParsedURLParameters& parameters) const
-{
-    String query = m_url.componentString(m_url.m_parsed.query);
-    const UChar* pos = query.characters();
-    const UChar* end = query.characters() + query.length();
-    while (pos < end) {
-        const UChar* parameterStart = pos;
-        while (pos < end && *pos != '&')
-            ++pos;
-        const UChar* parameterEnd = pos;
-        if (pos < end) {
-            ASSERT(*pos == '&');
-            ++pos;
-        }
-        if (parameterStart == parameterEnd)
-            continue;
-        const UChar* nameStart = parameterStart;
-        const UChar* equalSign = parameterStart;
-        while (equalSign < parameterEnd && *equalSign != '=')
-            ++equalSign;
-        if (equalSign == nameStart)
-            continue;
-        String name(nameStart, equalSign - nameStart);
-        String value = equalSign == parameterEnd ? String() : String(equalSign + 1, parameterEnd - equalSign - 1);
-        parameters.set(name, value);
-    }
-}
-
 String KURL::baseAsString() const
 {
     // FIXME: There is probably a more efficient way to do this?
@@ -799,16 +771,6 @@ void KURL::setPath(const String& path)
     m_url.replaceComponents(replacements);
 }
 
-// On Mac, this just seems to return the same URL, but with "/foo/bar" for
-// file: URLs instead of file:///foo/bar. We don't bother with any of this,
-// at least for now.
-String KURL::deprecatedString() const
-{
-    if (!m_url.m_isValid)
-        return String();
-    return m_url.string();
-}
-
 String decodeURLEscapeSequences(const String& str)
 {
     return decodeURLEscapeSequences(str, UTF8Encoding());
diff --git a/Source/WebCore/platform/KURLWTFURL.cpp b/Source/WebCore/platform/KURLWTFURL.cpp
new file mode 100644
index 000000000..4ff13d948
--- /dev/null
+++ b/Source/WebCore/platform/KURLWTFURL.cpp
@@ -0,0 +1,377 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "KURL.h"
+
+#if USE(WTFURL)
+
+using namespace WTF;
+
+namespace WebCore {
+
+static const unsigned maximumValidPortNumber = 0xFFFE;
+static const unsigned invalidPortNumber = 0xFFFF;
+
+static inline void detach(RefPtr<KURLWTFURLImpl>& urlImpl)
+{
+    if (!urlImpl)
+        return;
+
+    if (urlImpl->hasOneRef())
+        return;
+
+    urlImpl = urlImpl->copy();
+}
+
+KURL::KURL(ParsedURLStringTag, const String& urlString)
+    : m_urlImpl(adoptRef(new KURLWTFURLImpl()))
+{
+    m_urlImpl->m_parsedURL = ParsedURL(urlString);
+    ASSERT(m_urlImpl->m_parsedURL.isValid());
+}
+
+KURL::KURL(const KURL&, const String&)
+{
+    // FIXME: Add WTFURL Implementation.
+}
+
+KURL::KURL(const KURL&, const String&, const TextEncoding&)
+{
+    // FIXME: Add WTFURL Implementation.
+}
+
+KURL KURL::copy() const
+{
+    KURL other;
+    if (!isNull())
+        other.m_urlImpl = m_urlImpl->copy();
+    return other;
+}
+
+bool KURL::isNull() const
+{
+    return !m_urlImpl;
+}
+
+// FIXME: Can we get rid of the concept of EmptyURL? Can an null URL be enough?
+// If we cannot get rid of the concept, we should make a shared empty URL.
+bool KURL::isEmpty() const
+{
+    return !m_urlImpl
+           || (!m_urlImpl->m_parsedURL.isValid() && m_urlImpl->m_invalidUrlString.isEmpty());
+}
+
+bool KURL::isValid() const
+{
+    if (!m_urlImpl)
+        return false;
+
+    bool isParsedURLValid = m_urlImpl->m_parsedURL.isValid();
+#ifndef NDEBUG
+    if (isParsedURLValid)
+        ASSERT_WITH_MESSAGE(m_urlImpl->m_invalidUrlString.isNull(), "A valid URL should never have a valid invalidUrlString.");
+#endif
+    return isParsedURLValid;
+}
+
+const String &KURL::string() const
+{
+    if (isNull()) {
+        DEFINE_STATIC_LOCAL(const String, nullString, ());
+        return nullString;
+    }
+
+    if (!m_urlImpl->m_invalidUrlString.isNull()) {
+        ASSERT(!isValid());
+        return m_urlImpl->m_invalidUrlString;
+    }
+
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.spec().string();
+}
+
+String KURL::protocol() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.scheme();
+}
+
+String KURL::host() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.host();
+}
+
+bool KURL::hasPort() const
+{
+    ASSERT(isValid());
+    return !m_urlImpl->m_parsedURL.port().isNull();
+}
+
+unsigned short KURL::port() const
+{
+    ASSERT(isValid());
+
+    String portString = m_urlImpl->m_parsedURL.port();
+    bool ok = false;
+    unsigned portValue = portString.toUIntStrict(&ok);
+
+    if (!ok || portValue > maximumValidPortNumber)
+        return invalidPortNumber;
+
+    return static_cast<unsigned short>(portValue);
+}
+
+String KURL::user() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.username();
+}
+
+String KURL::pass() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.password();
+}
+
+bool KURL::hasPath() const
+{
+    ASSERT(isValid());
+    return !path().isEmpty();
+}
+
+String KURL::path() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.path();
+}
+
+String KURL::lastPathComponent() const
+{
+    ASSERT(isValid());
+
+    String pathString = path();
+    size_t index = pathString.reverseFind('/');
+
+    if (index == notFound)
+        return pathString;
+
+    return pathString.substring(index + 1);
+}
+
+String KURL::query() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.query();
+}
+
+bool KURL::hasFragmentIdentifier() const
+{
+    ASSERT(isValid());
+    return !fragmentIdentifier().isNull();
+}
+
+String KURL::fragmentIdentifier() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.fragment();
+}
+
+// FIXME: track an fix the bad use of this method.
+String KURL::baseAsString() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.baseAsString();
+}
+
+// FIXME: Get rid of this function from KURL.
+String KURL::fileSystemPath() const
+{
+    return String();
+}
+
+bool KURL::protocolIs(const char* testProtocol) const
+{
+    ASSERT(isValid());
+    return WebCore::protocolIs(protocol(), testProtocol);
+}
+
+bool KURL::protocolIsInHTTPFamily() const
+{
+    return protocolIs("http") || protocolIs("https");
+}
+
+bool KURL::setProtocol(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+    return false;
+}
+
+void KURL::setHost(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::removePort()
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setPort(unsigned short)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setHostAndPort(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setUser(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setPass(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setPath(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setQuery(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setFragmentIdentifier(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::removeFragmentIdentifier()
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+unsigned KURL::hostStart() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+unsigned KURL::hostEnd() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+unsigned KURL::pathStart() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+unsigned KURL::pathEnd() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+unsigned KURL::pathAfterLastSlash() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+void KURL::invalidate()
+{
+    m_urlImpl = nullptr;
+}
+
+bool KURL::isHierarchical() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return false;
+}
+
+bool protocolIs(const String&, const char*)
+{
+    // FIXME: Add WTFURL Implementation.
+    return false;
+}
+
+bool equalIgnoringFragmentIdentifier(const KURL&, const KURL&)
+{
+    // FIXME: Add WTFURL Implementation.
+    return false;
+}
+
+bool protocolHostAndPortAreEqual(const KURL& a, const KURL& b)
+{
+    if (!a.isValid() || !b.isValid())
+        return false;
+
+    return a.protocol() == b.protocol()
+           && a.host() == b.host()
+           && a.port() == b.port();
+}
+
+String encodeWithURLEscapeSequences(const String&)
+{
+    // FIXME: Add WTFURL Implementation.
+    return String();
+}
+
+String decodeURLEscapeSequences(const String&)
+{
+    // FIXME: Add WTFURL Implementation.
+    return String();
+}
+
+String decodeURLEscapeSequences(const String&, const TextEncoding&)
+{
+    // FIXME: Add WTFURL Implementation.
+    return String();
+}
+
+}
+
+#endif // USE(WTFURL)
diff --git a/Source/WebCore/platform/KURLWTFURLImpl.h b/Source/WebCore/platform/KURLWTFURLImpl.h
new file mode 100644
index 000000000..379c492ad
--- /dev/null
+++ b/Source/WebCore/platform/KURLWTFURLImpl.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef KURLWTFURLImpl_h
+#define KURLWTFURLImpl_h
+
+#if USE(WTFURL)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
+#include <wtf/url/api/ParsedURL.h>
+
+namespace WebCore {
+
+class KURLWTFURLImpl : public RefCounted<KURLWTFURLImpl> {
+public:
+    WTF::ParsedURL m_parsedURL;
+    String m_invalidUrlString;
+
+    PassRefPtr<KURLWTFURLImpl> copy() const;
+};
+
+inline PassRefPtr<KURLWTFURLImpl> KURLWTFURLImpl::copy() const
+{
+    RefPtr<KURLWTFURLImpl> clone = adoptRef(new KURLWTFURLImpl);
+    clone->m_parsedURL = m_parsedURL.isolatedCopy();
+    clone->m_invalidUrlString = m_invalidUrlString.isolatedCopy();
+    return clone.release();
+}
+
+} // namespace WebCore
+
+#endif // USE(WTFURL)
+
+#endif // KURLWTFURLImpl_h
diff --git a/Source/WebCore/platform/Length.cpp b/Source/WebCore/platform/Length.cpp
index a6bc01939..5166c0d16 100644
--- a/Source/WebCore/platform/Length.cpp
+++ b/Source/WebCore/platform/Length.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "Length.h"
 
+#include "CalculationValue.h"
 #include "PlatformString.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
@@ -148,6 +149,88 @@ PassOwnArrayPtr<Length> newLengthArray(const String& string, int& len)
 
     return r.release();
 }
+        
+class CalculationValueHandleMap {
+public:
+    CalculationValueHandleMap() 
+        : m_index(1) 
+    {
+    }
+    
+    int insert(PassRefPtr<CalculationValue> calcValue)
+    {
+        ASSERT(m_index);
+        // FIXME calc(): https://bugs.webkit.org/show_bug.cgi?id=80489
+        // This monotonically increasing handle generation scheme is potentially wasteful
+        // of the handle space. Consider reusing empty handles.
+        while (m_map.contains(m_index))
+            m_index++;
+        
+        m_map.set(m_index, calcValue);       
+        
+        return m_index;
+    }
+
+    void remove(int index)
+    {
+        ASSERT(m_map.contains(index));
+        m_map.remove(index);
+    }
+    
+    PassRefPtr<CalculationValue> get(int index)
+    {
+        ASSERT(m_map.contains(index));
+        return m_map.get(index);
+    }
+    
+private:        
+    int m_index;
+    HashMap<int, RefPtr<CalculationValue> > m_map;
+};
+    
+static CalculationValueHandleMap& calcHandles()
+{
+    DEFINE_STATIC_LOCAL(CalculationValueHandleMap, handleMap, ());
+    return handleMap;
+}
+
+Length::Length(PassRefPtr<CalculationValue> calc)
+    : m_quirk(false)
+    , m_type(Calculated)
+    , m_isFloat(false)
+{
+    m_intValue = calcHandles().insert(calc);
+}
+    
+PassRefPtr<CalculationValue> Length::calculationValue() const
+{
+    ASSERT(isCalculated());
+    return calcHandles().get(calculationHandle());
+}
+    
+void Length::incrementCalculatedRef() const
+{
+    ASSERT(isCalculated());
+    calculationValue()->ref();
+}
+
+void Length::decrementCalculatedRef() const
+{
+    ASSERT(isCalculated());
+    RefPtr<CalculationValue> calcLength = calculationValue();
+    if (calcLength->hasOneRef())
+        calcHandles().remove(calculationHandle());
+    calcLength->deref();
+}    
+
+float Length::nonNanCalculatedValue(int maxValue) const
+{
+    ASSERT(isCalculated());
+    float result = calculationValue()->evaluate(maxValue);
+    if (isnan(result))
+        return 0;
+    return result;
+}
 
 class SameSizeAsLength {
     int32_t value;
diff --git a/Source/WebCore/platform/Length.h b/Source/WebCore/platform/Length.h
index 53b0260c2..2bcf93262 100644
--- a/Source/WebCore/platform/Length.h
+++ b/Source/WebCore/platform/Length.h
@@ -26,6 +26,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/FastAllocBase.h>
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 #include <wtf/MathExtras.h>
 #include <wtf/PassOwnArrayPtr.h>
 
@@ -34,8 +35,10 @@ namespace WebCore {
 const int intMaxForLength = 0x7ffffff; // max value for a 28-bit int
 const int intMinForLength = (-0x7ffffff - 1); // min value for a 28-bit int
 
-enum LengthType { Auto, Relative, Percent, Fixed, Intrinsic, MinIntrinsic, Undefined };
-
+enum LengthType { Auto, Relative, Percent, Fixed, Intrinsic, MinIntrinsic, Calculated, Undefined };
+ 
+class CalculationValue;    
+    
 struct Length {
     WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -65,11 +68,35 @@ public:
         m_floatValue = static_cast<float>(v);    
     }
 
+    explicit Length(PassRefPtr<CalculationValue>);
+
+    Length(const Length& length)
+    {
+        initFromLength(length);
+    }
+    
+    Length& operator=(const Length& length)
+    {
+        initFromLength(length);
+        return *this;
+    }
+    
+    ~Length()
+    {
+        if (isCalculated())
+            decrementCalculatedRef();
+    }  
+    
     bool operator==(const Length& o) const { return (m_type == o.m_type) && (m_quirk == o.m_quirk) && (isUndefined() || (getFloatValue() == o.getFloatValue())); }
     bool operator!=(const Length& o) const { return !(*this == o); }
 
     const Length& operator*=(float v)
-    {        
+    {       
+        if (isCalculated()) {
+            ASSERT_NOT_REACHED();
+            return *this;
+        }
+        
         if (m_isFloat)
             m_floatValue = static_cast<float>(m_floatValue * v);
         else        
@@ -80,6 +107,10 @@ public:
     
     int value() const
     {
+        if (isCalculated()) {
+            ASSERT_NOT_REACHED();
+            return 0;
+        }
         return getIntValue();
     }
 
@@ -89,6 +120,8 @@ public:
         return getFloatValue();
     }
 
+    PassRefPtr<CalculationValue> calculationValue() const;
+
     LengthType type() const { return static_cast<LengthType>(m_type); }
     bool quirk() const { return m_quirk; }
 
@@ -106,6 +139,10 @@ public:
 
     void setValue(int value)
     {
+        if (isCalculated()) {
+            ASSERT_NOT_REACHED();
+            return;
+        }
         setValue(Fixed, value);
     }
 
@@ -121,13 +158,12 @@ public:
         *this = Length(value, Fixed);
     }
 
-    // Note: May only be called for Fixed, Percent and Auto lengths.
-    // Other types will ASSERT in order to catch invalid length calculations.
     int calcValue(int maxValue, bool roundPercentages = false) const
     {
         switch (type()) {
             case Fixed:
             case Percent:
+            case Calculated:
                 return calcMinValue(maxValue, roundPercentages);
             case Auto:
                 return maxValue;
@@ -152,6 +188,8 @@ public:
                     return static_cast<int>(round(maxValue * percent() / 100.0f));
                 // Don't remove the extra cast to float. It is needed for rounding on 32-bit Intel machines that use the FPU stack.
                 return static_cast<int>(static_cast<float>(maxValue * percent() / 100.0f));
+            case Calculated:
+                return nonNanCalculatedValue(maxValue);
             case Auto:
                 return 0;
             case Relative:
@@ -174,6 +212,8 @@ public:
                 return static_cast<float>(maxValue * percent() / 100.0f);
             case Auto:
                 return static_cast<float>(maxValue);
+            case Calculated:
+                return nonNanCalculatedValue(maxValue);                
             case Relative:
             case Intrinsic:
             case MinIntrinsic:
@@ -186,21 +226,43 @@ public:
     }
 
     bool isUndefined() const { return type() == Undefined; }
+
+    // FIXME calc: https://bugs.webkit.org/show_bug.cgi?id=80357. A calculated Length 
+    // always contains a percentage, and without a maxValue passed to these functions
+    // it's impossible to determine the sign or zero-ness. We assume all calc values
+    // are positive and non-zero for now.    
     bool isZero() const 
     {
         ASSERT(!isUndefined());
+        if (isCalculated())
+            return false;
+            
         return m_isFloat ? !m_floatValue : !m_intValue;
     }
+    bool isPositive() const
+    {
+        if (isUndefined())
+            return false;
+        if (isCalculated())
+            return true;
+                
+        return getFloatValue() > 0;
+    }
+    bool isNegative() const
+    {
+        if (isUndefined() || isCalculated())
+            return false;
+            
+        return getFloatValue() < 0;
+    }
     
-    bool isPositive() const { return isUndefined() ? false : getFloatValue() > 0; }
-    bool isNegative() const { return isUndefined() ? false : getFloatValue() < 0; }
-
     bool isAuto() const { return type() == Auto; }
     bool isRelative() const { return type() == Relative; }
-    bool isPercent() const { return type() == Percent; }
+    bool isPercent() const { return type() == Percent || type() == Calculated; }
     bool isFixed() const { return type() == Fixed; }
     bool isIntrinsicOrAuto() const { return type() == Auto || type() == MinIntrinsic || type() == Intrinsic; }
-    bool isSpecified() const { return type() == Fixed || type() == Percent; }
+    bool isSpecified() const { return type() == Fixed || type() == Percent || type() == Calculated; }
+    bool isCalculated() const { return type() == Calculated; }
 
     Length blend(const Length& from, double progress) const
     {
@@ -239,6 +301,30 @@ private:
         return m_isFloat ? m_floatValue : m_intValue;
     }
 
+    void initFromLength(const Length &length) 
+    {
+        m_quirk = length.m_quirk;
+        m_type = length.m_type;
+        m_isFloat = length.m_isFloat;
+        
+        if (m_isFloat)
+            m_floatValue = length.m_floatValue;
+        else
+            m_intValue = length.m_intValue;
+        
+        if (isCalculated())
+            incrementCalculatedRef();
+    }
+    
+    float nonNanCalculatedValue(int maxValue) const;
+    int calculationHandle() const
+    {
+        ASSERT(isCalculated());
+        return getIntValue();
+    }
+    void incrementCalculatedRef() const;
+    void decrementCalculatedRef() const;    
+    
     union {
         int m_intValue;
         float m_floatValue;
diff --git a/Source/WebCore/platform/LocalizedStrings.cpp b/Source/WebCore/platform/LocalizedStrings.cpp
index 0383de6f7..27d17f03f 100644
--- a/Source/WebCore/platform/LocalizedStrings.cpp
+++ b/Source/WebCore/platform/LocalizedStrings.cpp
@@ -48,13 +48,22 @@ namespace WebCore {
 //  2) It doesn't handle the %2$d syntax.
 // Note that because |format| is used as the second parameter to va_start, it cannot be a reference
 // type according to section 18.7/3 of the C++ N1905 standard.
-static String formatLocalizedString(String format, ...)
+static String formatLocalizedString(const String& format, ...)
 {
 #if USE(CF)
     va_list arguments;
     va_start(arguments, format);
     RetainPtr<CFStringRef> formatCFString(AdoptCF, format.createCFString());
+
+#if COMPILER(CLANG)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wformat-nonliteral"
+#endif
     RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormatAndArguments(0, 0, formatCFString.get(), arguments));
+#if COMPILER(CLANG)
+#pragma clang diagnostic pop
+#endif
+
     va_end(arguments);
     return result.get();
 #else
diff --git a/Source/WebCore/platform/MIMETypeRegistry.cpp b/Source/WebCore/platform/MIMETypeRegistry.cpp
index b5f2d4551..8e1e8e8aa 100644
--- a/Source/WebCore/platform/MIMETypeRegistry.cpp
+++ b/Source/WebCore/platform/MIMETypeRegistry.cpp
@@ -39,7 +39,7 @@
 #include <ApplicationServices/ApplicationServices.h>
 #include <wtf/RetainPtr.h>
 #endif
-#if PLATFORM(QT)
+#if PLATFORM(QT) && USE(QT_IMAGE_DECODER)
 #include <qimagereader.h>
 #include <qimagewriter.h>
 #endif
@@ -229,7 +229,7 @@ static void initializeSupportedImageMIMETypes()
     supportedImageMIMETypes->remove("application/pdf");
     supportedImageMIMETypes->remove("application/postscript");
 
-#elif PLATFORM(QT)
+#elif PLATFORM(QT) && USE(QT_IMAGE_DECODER)
     QList<QByteArray> formats = QImageReader::supportedImageFormats();
     for (size_t i = 0; i < static_cast<size_t>(formats.size()); ++i) {
 #if ENABLE(SVG)
@@ -289,7 +289,7 @@ static void initializeSupportedImageMIMETypesForEncoding()
     supportedImageMIMETypesForEncoding->add("image/jpeg");
     supportedImageMIMETypesForEncoding->add("image/gif");
 #endif
-#elif PLATFORM(QT)
+#elif PLATFORM(QT) && USE(QT_IMAGE_DECODER)
     QList<QByteArray> formats = QImageWriter::supportedImageFormats();
     for (int i = 0; i < formats.size(); ++i) {
         String mimeType = MIMETypeRegistry::getMIMETypeForExtension(formats.at(i).constData());
diff --git a/Source/WebCore/platform/Pasteboard.h b/Source/WebCore/platform/Pasteboard.h
index 17dadd072..f12c854b7 100644
--- a/Source/WebCore/platform/Pasteboard.h
+++ b/Source/WebCore/platform/Pasteboard.h
@@ -44,7 +44,6 @@
 
 #if PLATFORM(MAC)
 OBJC_CLASS NSFileWrapper;
-OBJC_CLASS NSPasteboard;
 OBJC_CLASS NSArray;
 #endif
 
diff --git a/Source/WebCore/platform/PlatformGestureCurve.h b/Source/WebCore/platform/PlatformGestureCurve.h
new file mode 100644
index 000000000..922199147
--- /dev/null
+++ b/Source/WebCore/platform/PlatformGestureCurve.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformGestureCurve_h
+#define PlatformGestureCurve_h
+
+namespace WebCore {
+
+class PlatformGestureCurveTarget;
+
+// Abstract interface for curves used by ActivePlatformGestureAnimation. A
+// PlatformGestureCurve defines the animation parameters as a function of time
+// (zero-based), and applies the parameters directly to the target of the
+// animation.
+class PlatformGestureCurve {
+public:
+    virtual ~PlatformGestureCurve() { }
+
+    // Returns false if curve has finished and can no longer be applied.
+    virtual bool apply(double time, PlatformGestureCurveTarget*) = 0;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/PlatformGestureCurveTarget.h b/Source/WebCore/platform/PlatformGestureCurveTarget.h
new file mode 100644
index 000000000..bfb0aebcd
--- /dev/null
+++ b/Source/WebCore/platform/PlatformGestureCurveTarget.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformGestureCurveTarget_h
+#define PlatformGestureCurveTarget_h
+
+namespace WebCore {
+
+class IntPoint;
+
+class PlatformGestureCurveTarget {
+public:
+    virtual void setScrollIncrement(const IntPoint&) = 0;
+    // FIXME: add interfaces for setScroll(), setPageScaleAndScroll(), etc.
+
+protected:
+    virtual ~PlatformGestureCurveTarget() { }
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/PlatformWheelEvent.h b/Source/WebCore/platform/PlatformWheelEvent.h
index 64e0f2463..084b45553 100644
--- a/Source/WebCore/platform/PlatformWheelEvent.h
+++ b/Source/WebCore/platform/PlatformWheelEvent.h
@@ -64,7 +64,8 @@ namespace WebCore {
     // up and down (you get the same behavior as if the user was clicking in a scrollbar track to page up or page down).
     enum PlatformWheelEventGranularity {
         ScrollByPageWheelEvent,
-        ScrollByPixelWheelEvent
+        ScrollByPixelWheelEvent,
+        ScrollByPixelVelocityWheelEvent
     };
 
 #if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
diff --git a/Source/WebCore/platform/RunLoop.h b/Source/WebCore/platform/RunLoop.h
index 1f19c836d..f08a04224 100644
--- a/Source/WebCore/platform/RunLoop.h
+++ b/Source/WebCore/platform/RunLoop.h
@@ -37,10 +37,6 @@
 
 #if PLATFORM(GTK)
 #include <wtf/gobject/GRefPtr.h>
-typedef struct _GSource GSource;
-typedef struct _GMainLoop GMainLoop;
-typedef struct _GMainContext GMainContext;
-typedef int gboolean;
 #endif
 
 namespace WebCore {
@@ -155,10 +151,12 @@ private:
 #elif PLATFORM(GTK)
 public:
     static gboolean queueWork(RunLoop*);
-    GMainLoop* mainLoop();
+    GMainLoop* innermostLoop();
+    void pushNestedMainLoop(GMainLoop*);
+    void popNestedMainLoop();
 private:
-    GMainContext* m_runLoopContext;
-    GMainLoop* m_runLoopMain;
+    GRefPtr<GMainContext> m_runLoopContext;
+    Vector<GRefPtr<GMainLoop> > m_runLoopMainLoops;
 #endif
 };
 
diff --git a/Source/WebCore/platform/SchemeRegistry.cpp b/Source/WebCore/platform/SchemeRegistry.cpp
index d5d36f151..b25ce1a0d 100644
--- a/Source/WebCore/platform/SchemeRegistry.cpp
+++ b/Source/WebCore/platform/SchemeRegistry.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  */
 #include "config.h"
@@ -100,16 +100,14 @@ static URLSchemesMap& canDisplayOnlyIfCanRequestSchemes()
 {
     DEFINE_STATIC_LOCAL(URLSchemesMap, canDisplayOnlyIfCanRequestSchemes, ());
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
-    if (canDisplayOnlyIfCanRequestSchemes.isEmpty()) {
 #if ENABLE(BLOB)
+    if (canDisplayOnlyIfCanRequestSchemes.isEmpty()) {
         canDisplayOnlyIfCanRequestSchemes.add("blob");
-#endif
 #if ENABLE(FILE_SYSTEM)
         canDisplayOnlyIfCanRequestSchemes.add("filesystem");
 #endif
     }
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
     return canDisplayOnlyIfCanRequestSchemes;
 }
@@ -155,7 +153,7 @@ static URLSchemesMap& schemesAllowingDatabaseAccessInPrivateBrowsing()
 
 static URLSchemesMap& CORSEnabledSchemes()
 {
-    // FIXME: http://bugs.webkit.org/show_bug.cgi?id=77160  
+    // FIXME: http://bugs.webkit.org/show_bug.cgi?id=77160
     DEFINE_STATIC_LOCAL(URLSchemesMap, CORSEnabledSchemes, ());
 
     if (CORSEnabledSchemes.isEmpty()) {
@@ -251,7 +249,7 @@ void SchemeRegistry::registerAsCanDisplayOnlyIfCanRequest(const String& scheme)
     canDisplayOnlyIfCanRequestSchemes().add(scheme);
 }
 
-void SchemeRegistry::registerURLSchemeAsNotAllowingJavascriptURLs(const String& scheme) 
+void SchemeRegistry::registerURLSchemeAsNotAllowingJavascriptURLs(const String& scheme)
 {
     notAllowingJavascriptURLsSchemes().add(scheme);
 }
diff --git a/Source/WebCore/platform/ScrollAnimator.cpp b/Source/WebCore/platform/ScrollAnimator.cpp
index d4ded3483..1cd4ff1e9 100644
--- a/Source/WebCore/platform/ScrollAnimator.cpp
+++ b/Source/WebCore/platform/ScrollAnimator.cpp
@@ -98,6 +98,12 @@ bool ScrollAnimator::handleWheelEvent(const PlatformWheelEvent& e)
         || (deltaY < 0 && maxForwardScrollDelta.height() > 0)
         || (deltaY > 0 && maxBackwardScrollDelta.height() > 0)) {
         handled = true;
+        if (e.granularity() == ScrollByPixelVelocityWheelEvent) {
+            scroll(VerticalScrollbar, ScrollByPixelVelocity, 0, -deltaY);
+            scroll(HorizontalScrollbar, ScrollByPixelVelocity, 0, -deltaX);
+            return handled;
+        }
+
         if (deltaY) {
             if (e.granularity() == ScrollByPageWheelEvent) {
                 bool negative = deltaY < 0;
@@ -118,10 +124,15 @@ bool ScrollAnimator::handleWheelEvent(const PlatformWheelEvent& e)
             scroll(HorizontalScrollbar, ScrollByPixel, horizontalScrollbar->pixelStep(), -deltaX);
         }
     }
-
     return handled;
 }
 
+void ScrollAnimator::setCurrentPosition(const FloatPoint& position)
+{
+    m_currentPosX = position.x();
+    m_currentPosY = position.y();
+}
+
 FloatPoint ScrollAnimator::currentPosition() const
 {
     return FloatPoint(m_currentPosX, m_currentPosY);
diff --git a/Source/WebCore/platform/ScrollAnimator.h b/Source/WebCore/platform/ScrollAnimator.h
index 814d674e3..a3c4ca7e0 100644
--- a/Source/WebCore/platform/ScrollAnimator.h
+++ b/Source/WebCore/platform/ScrollAnimator.h
@@ -31,20 +31,16 @@
 #ifndef ScrollAnimator_h
 #define ScrollAnimator_h
 
+#include "PlatformWheelEvent.h"
 #include "ScrollTypes.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
 class FloatPoint;
-class PlatformWheelEvent;
 class ScrollableArea;
 class Scrollbar;
 
-#if ENABLE(GESTURE_EVENTS)
-class PlatformGestureEvent;
-#endif
-
 class ScrollAnimator {
 public:
     static PassOwnPtr<ScrollAnimator> create(ScrollableArea*);
@@ -65,9 +61,15 @@ public:
 
     virtual bool handleWheelEvent(const PlatformWheelEvent&);
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+    virtual void handleWheelEventPhase(PlatformWheelEventPhase) { }
+#endif
+
+    void setCurrentPosition(const FloatPoint&);
     FloatPoint currentPosition() const;
 
     virtual void cancelAnimations() { }
+    virtual void serviceScrollAnimations() { }
 
     virtual void contentAreaWillPaint() const { }
     virtual void mouseEnteredContentArea() const { }
diff --git a/Source/WebCore/platform/ScrollAnimatorNone.cpp b/Source/WebCore/platform/ScrollAnimatorNone.cpp
index 083a18a70..96844f7eb 100644
--- a/Source/WebCore/platform/ScrollAnimatorNone.cpp
+++ b/Source/WebCore/platform/ScrollAnimatorNone.cpp
@@ -235,9 +235,12 @@ void ScrollAnimatorNone::PerAxisData::reset()
 
 bool ScrollAnimatorNone::PerAxisData::updateDataFromParameters(float step, float multiplier, float scrollableSize, double currentTime, Parameters* parameters)
 {
-    if (!m_startTime)
+    float delta = step * multiplier;
+    if (!m_startTime || !delta || (delta < 0) != (m_desiredPosition - *m_currentPosition < 0)) {
         m_desiredPosition = *m_currentPosition;
-    float newPosition = m_desiredPosition + (step * multiplier);
+        m_startTime = 0;
+    }
+    float newPosition = m_desiredPosition + delta;
 
     if (newPosition < 0 || newPosition > scrollableSize)
         newPosition = max(min(newPosition, scrollableSize), 0.0f);
@@ -375,7 +378,10 @@ ScrollAnimatorNone::ScrollAnimatorNone(ScrollableArea* scrollableArea)
     : ScrollAnimator(scrollableArea)
     , m_horizontalData(this, &m_currentPosX, scrollableArea->visibleWidth())
     , m_verticalData(this, &m_currentPosY, scrollableArea->visibleHeight())
-    , m_animationTimer(this, &ScrollAnimatorNone::animationTimerFired)
+    , m_animationActive(false)
+    , m_firstVelocity(0)
+    , m_firstVelocitySet(false)
+    , m_firstVelocityIsVertical(false)
 {
 }
 
@@ -384,6 +390,11 @@ ScrollAnimatorNone::~ScrollAnimatorNone()
     stopAnimationTimerIfNeeded();
 }
 
+void ScrollAnimatorNone::fireUpAnAnimation(FloatPoint fp)
+{
+    UNUSED_PARAM(fp);
+}
+
 bool ScrollAnimatorNone::scroll(ScrollbarOrientation orientation, ScrollGranularity granularity, float step, float multiplier)
 {
     if (!m_scrollableArea->scrollAnimatorEnabled())
@@ -409,8 +420,21 @@ bool ScrollAnimatorNone::scroll(ScrollbarOrientation orientation, ScrollGranular
     case ScrollByPixel:
         parameters = Parameters(true, 11 * kTickTime, 2 * kTickTime, Cubic, 3 * kTickTime, Cubic, 3 * kTickTime, Quadratic, 1.25);
         break;
-    default:
-        break;
+    case ScrollByPixelVelocity:
+        // FIXME: Generalize the scroll interface to support a richer set of parameters.
+        if (m_firstVelocitySet) {
+            float x = m_firstVelocityIsVertical ? multiplier : m_firstVelocity;
+            float y = m_firstVelocityIsVertical ? m_firstVelocity : multiplier;
+            FloatPoint fp(x, y);
+            fireUpAnAnimation(fp);
+            m_firstVelocitySet = false;
+            m_firstVelocityIsVertical = false;
+        } else {
+            m_firstVelocitySet = true;
+            m_firstVelocityIsVertical = orientation == VerticalScrollbar;
+            m_firstVelocity = multiplier;
+        }
+        return true;
     }
 
     // If the individual input setting is disabled, bail.
@@ -422,9 +446,9 @@ bool ScrollAnimatorNone::scroll(ScrollbarOrientation orientation, ScrollGranular
 
     PerAxisData& data = (orientation == VerticalScrollbar) ? m_verticalData : m_horizontalData;
     bool needToScroll = data.updateDataFromParameters(step, multiplier, scrollableSize, WTF::monotonicallyIncreasingTime(), &parameters);
-    if (needToScroll && !m_animationTimer.isActive()) {
+    if (needToScroll && !animationTimerActive()) {
         m_startTime = data.m_startTime;
-        animationTimerFired(&m_animationTimer);
+        animationTimerFired();
     }
     return needToScroll;
 }
@@ -444,6 +468,17 @@ void ScrollAnimatorNone::scrollToOffsetWithoutAnimation(const FloatPoint& offset
     notifyPositionChanged();
 }
 
+void ScrollAnimatorNone::cancelAnimations()
+{
+    m_animationActive = false;
+}
+
+void ScrollAnimatorNone::serviceScrollAnimations()
+{
+    if (m_animationActive)
+        animationTimerFired();
+}
+
 void ScrollAnimatorNone::willEndLiveResize()
 {
     updateVisibleLengths();
@@ -465,7 +500,7 @@ void ScrollAnimatorNone::updateVisibleLengths()
     m_verticalData.updateVisibleLength(scrollableArea()->visibleHeight());
 }
 
-void ScrollAnimatorNone::animationTimerFired(Timer<ScrollAnimatorNone>* timer)
+void ScrollAnimatorNone::animationTimerFired()
 {
 #if PLATFORM(CHROMIUM)
     TRACE_EVENT("ScrollAnimatorNone::animationTimerFired", this, 0);
@@ -473,17 +508,18 @@ void ScrollAnimatorNone::animationTimerFired(Timer<ScrollAnimatorNone>* timer)
 
     double currentTime = WTF::monotonicallyIncreasingTime();
     double deltaToNextFrame = ceil((currentTime - m_startTime) * kFrameRate) / kFrameRate - (currentTime - m_startTime);
+    currentTime += deltaToNextFrame;
 
     bool continueAnimation = false;
-    if (m_horizontalData.m_startTime && m_horizontalData.animateScroll(currentTime + deltaToNextFrame))
+    if (m_horizontalData.m_startTime && m_horizontalData.animateScroll(currentTime))
         continueAnimation = true;
-    if (m_verticalData.m_startTime && m_verticalData.animateScroll(currentTime + deltaToNextFrame))
+    if (m_verticalData.m_startTime && m_verticalData.animateScroll(currentTime))
         continueAnimation = true;
 
-    if (continueAnimation) {
-        double nextTimerInterval = max(kMinimumTimerInterval, deltaToNextFrame);
-        timer->startOneShot(nextTimerInterval);
-    }
+    if (continueAnimation)
+        startNextTimer();
+    else
+        m_animationActive = false;
 
 #if PLATFORM(CHROMIUM)
     TRACE_EVENT("ScrollAnimatorNone::notifyPositionChanged", this, 0);
@@ -491,10 +527,21 @@ void ScrollAnimatorNone::animationTimerFired(Timer<ScrollAnimatorNone>* timer)
     notifyPositionChanged();
 }
 
+void ScrollAnimatorNone::startNextTimer()
+{
+    if (scrollableArea()->scheduleAnimation())
+        m_animationActive = true;
+}
+
+bool ScrollAnimatorNone::animationTimerActive()
+{
+    return m_animationActive;
+}
+
 void ScrollAnimatorNone::stopAnimationTimerIfNeeded()
 {
-    if (m_animationTimer.isActive())
-        m_animationTimer.stop();
+    if (animationTimerActive())
+        m_animationActive = false;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollAnimatorNone.h b/Source/WebCore/platform/ScrollAnimatorNone.h
index 4d69a7c4a..495e0cdda 100644
--- a/Source/WebCore/platform/ScrollAnimatorNone.h
+++ b/Source/WebCore/platform/ScrollAnimatorNone.h
@@ -33,6 +33,11 @@
 
 #if ENABLE(SMOOTH_SCROLLING)
 
+#if !ENABLE(REQUEST_ANIMATION_FRAME)
+#error "SMOOTH_SCROLLING requires REQUEST_ANIMATION_FRAME to be enabled."
+#endif
+
+#include "FloatPoint.h"
 #include "ScrollAnimator.h"
 #include "Timer.h"
 
@@ -50,6 +55,9 @@ public:
     virtual bool scroll(ScrollbarOrientation, ScrollGranularity, float step, float multiplier);
     virtual void scrollToOffsetWithoutAnimation(const FloatPoint&);
 
+    virtual void cancelAnimations();
+    virtual void serviceScrollAnimations();
+
     virtual void willEndLiveResize();
     virtual void didAddVerticalScrollbar(Scrollbar*);
     virtual void didAddHorizontalScrollbar(Scrollbar*);
@@ -126,15 +134,23 @@ protected:
         int m_visibleLength;
     };
 
-    void animationTimerFired(Timer<ScrollAnimatorNone>*);
+    void startNextTimer();
+    void animationTimerFired();
+
     void stopAnimationTimerIfNeeded();
+    bool animationTimerActive();
     void updateVisibleLengths();
+    virtual void fireUpAnAnimation(FloatPoint);
 
     PerAxisData m_horizontalData;
     PerAxisData m_verticalData;
 
     double m_startTime;
-    Timer<ScrollAnimatorNone> m_animationTimer;
+    bool m_animationActive;
+
+    float m_firstVelocity;
+    bool m_firstVelocitySet;
+    bool m_firstVelocityIsVertical;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollTypes.h b/Source/WebCore/platform/ScrollTypes.h
index a02198d0b..087b50d1e 100644
--- a/Source/WebCore/platform/ScrollTypes.h
+++ b/Source/WebCore/platform/ScrollTypes.h
@@ -105,7 +105,8 @@ namespace WebCore {
         ScrollByLine,
         ScrollByPage,
         ScrollByDocument,
-        ScrollByPixel
+        ScrollByPixel,
+        ScrollByPixelVelocity
     };
 
     enum ScrollElasticity {
diff --git a/Source/WebCore/platform/ScrollView.cpp b/Source/WebCore/platform/ScrollView.cpp
index 4d14805ef..6af2aa696 100644
--- a/Source/WebCore/platform/ScrollView.cpp
+++ b/Source/WebCore/platform/ScrollView.cpp
@@ -844,8 +844,8 @@ void ScrollView::setFrameRect(const IntRect& newRect)
     frameRectsChanged();
 
     updateScrollbars(scrollOffset());
-    
-    if (!m_useFixedLayout)
+
+    if (!m_useFixedLayout && oldRect.size() != newRect.size())
         contentsResized();
 }
 
@@ -970,6 +970,11 @@ void ScrollView::paintScrollCorner(GraphicsContext* context, const IntRect& corn
     ScrollbarTheme::theme()->paintScrollCorner(this, context, cornerRect);
 }
 
+void ScrollView::paintScrollbar(GraphicsContext* context, Scrollbar* bar, const IntRect& rect)
+{
+    bar->paint(context, rect);
+}
+
 void ScrollView::invalidateScrollCornerRect(const IntRect& rect)
 {
     invalidateRect(rect);
@@ -982,13 +987,13 @@ void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
         && !layerForHorizontalScrollbar()
 #endif
                                       )
-        m_horizontalScrollbar->paint(context, rect);
+        paintScrollbar(context, m_horizontalScrollbar.get(), rect);
     if (m_verticalScrollbar
 #if USE(ACCELERATED_COMPOSITING)
         && !layerForVerticalScrollbar()
 #endif
                                     )
-        m_verticalScrollbar->paint(context, rect);
+        paintScrollbar(context, m_verticalScrollbar.get(), rect);
 
 #if USE(ACCELERATED_COMPOSITING)
     if (layerForScrollCorner())
@@ -1000,7 +1005,10 @@ void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
 void ScrollView::paintPanScrollIcon(GraphicsContext* context)
 {
     static Image* panScrollIcon = Image::loadPlatformResource("panIcon").leakRef();
-    context->drawImage(panScrollIcon, ColorSpaceDeviceRGB, m_panScrollIconPoint);
+    IntPoint iconGCPoint = m_panScrollIconPoint;
+    if (parent())
+        iconGCPoint = parent()->windowToContents(iconGCPoint);
+    context->drawImage(panScrollIcon, ColorSpaceDeviceRGB, iconGCPoint);
 }
 
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
diff --git a/Source/WebCore/platform/ScrollView.h b/Source/WebCore/platform/ScrollView.h
index 70511f16f..4c1b5de5c 100644
--- a/Source/WebCore/platform/ScrollView.h
+++ b/Source/WebCore/platform/ScrollView.h
@@ -272,6 +272,7 @@ public:
     virtual bool scrollbarCornerPresent() const;
     virtual IntRect scrollCornerRect() const;
     virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
+    virtual void paintScrollbar(GraphicsContext*, Scrollbar*, const IntRect&);
 
     virtual IntRect convertFromScrollbarToContainingView(const Scrollbar*, const IntRect&) const;
     virtual IntRect convertFromContainingViewToScrollbar(const Scrollbar*, const IntRect&) const;
diff --git a/Source/WebCore/platform/ScrollableArea.cpp b/Source/WebCore/platform/ScrollableArea.cpp
index 58ad24205..871760304 100644
--- a/Source/WebCore/platform/ScrollableArea.cpp
+++ b/Source/WebCore/platform/ScrollableArea.cpp
@@ -101,9 +101,11 @@ bool ScrollableArea::scroll(ScrollDirection direction, ScrollGranularity granula
     case ScrollByPixel:
         step = scrollbar->pixelStep();
         break;
+    case ScrollByPixelVelocity:
+        break;
     }
 
-    if (direction == ScrollUp || direction == ScrollLeft)
+    if (granularity != ScrollByPixelVelocity && (direction == ScrollUp || direction == ScrollLeft))
         multiplier = -multiplier;
 
     return scrollAnimator()->scroll(orientation, granularity, step, multiplier);
@@ -124,6 +126,12 @@ void ScrollableArea::scrollToOffsetWithoutAnimation(ScrollbarOrientation orienta
 
 void ScrollableArea::notifyScrollPositionChanged(const IntPoint& position)
 {
+    scrollPositionChanged(position);
+    scrollAnimator()->setCurrentPosition(position);
+}
+
+void ScrollableArea::scrollPositionChanged(const IntPoint& position)
+{
     // Tell the derived class to scroll its contents.
     setScrollOffset(position);
 
@@ -169,7 +177,7 @@ void ScrollableArea::setScrollOffsetFromAnimation(const IntPoint& offset)
     if (requestScrollPositionUpdate(offset))
         return;
 
-    notifyScrollPositionChanged(offset);
+    scrollPositionChanged(offset);
 }
 
 void ScrollableArea::willStartLiveResize()
@@ -286,11 +294,13 @@ void ScrollableArea::invalidateScrollbar(Scrollbar* scrollbar, const IntRect& re
     if (scrollbar == horizontalScrollbar()) {
         if (GraphicsLayer* graphicsLayer = layerForHorizontalScrollbar()) {
             graphicsLayer->setNeedsDisplay();
+            graphicsLayer->setContentsNeedsDisplay();
             return;
         }
     } else if (scrollbar == verticalScrollbar()) {
         if (GraphicsLayer* graphicsLayer = layerForVerticalScrollbar()) {
             graphicsLayer->setNeedsDisplay();
+            graphicsLayer->setContentsNeedsDisplay();
             return;
         }
     }
@@ -336,4 +346,9 @@ bool ScrollableArea::hasLayerForScrollCorner() const
 #endif
 }
 
+void ScrollableArea::serviceScrollAnimations()
+{
+    scrollAnimator()->serviceScrollAnimations();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollableArea.h b/Source/WebCore/platform/ScrollableArea.h
index 8244ce833..617873afd 100644
--- a/Source/WebCore/platform/ScrollableArea.h
+++ b/Source/WebCore/platform/ScrollableArea.h
@@ -156,6 +156,11 @@ public:
     // NOTE: Only called from Internals for testing.
     void setScrollOffsetFromInternals(const IntPoint&);
 
+    // Let subclasses provide a way of asking for and servicing scroll
+    // animations.
+    virtual bool scheduleAnimation() { return false; }
+    void serviceScrollAnimations();
+
 protected:
     ScrollableArea();
     virtual ~ScrollableArea();
@@ -179,6 +184,8 @@ protected:
     bool hasLayerForScrollCorner() const;
 
 private:
+    void scrollPositionChanged(const IntPoint&);
+    
     // NOTE: Only called from the ScrollAnimator.
     friend class ScrollAnimator;
     void setScrollOffsetFromAnimation(const IntPoint&);
diff --git a/Source/WebCore/platform/Scrollbar.cpp b/Source/WebCore/platform/Scrollbar.cpp
index 3b9c195cf..dfd46497a 100644
--- a/Source/WebCore/platform/Scrollbar.cpp
+++ b/Source/WebCore/platform/Scrollbar.cpp
@@ -112,6 +112,27 @@ Scrollbar::~Scrollbar()
     m_theme->unregisterScrollbar(this);
 }
 
+ScrollbarOverlayStyle Scrollbar::scrollbarOverlayStyle() const
+{
+    return m_scrollableArea ? ScrollbarOverlayStyleDefault : m_scrollableArea->scrollbarOverlayStyle();
+}
+
+void Scrollbar::getTickmarks(Vector<IntRect>& tickmarks) const
+{
+    if (m_scrollableArea)
+        m_scrollableArea->getTickmarks(tickmarks);
+}
+
+bool Scrollbar::isScrollableAreaActive() const
+{
+    return m_scrollableArea && m_scrollableArea->isActive();
+}
+
+bool Scrollbar::isScrollViewScrollbar() const
+{
+    return parent() && parent()->isFrameView() && static_cast<FrameView*>(parent())->isScrollViewScrollbar(this);
+}
+
 void Scrollbar::offsetDidChange()
 {
     ASSERT(m_scrollableArea);
@@ -434,7 +455,7 @@ bool Scrollbar::mouseDown(const PlatformMouseEvent& evt)
 
 void Scrollbar::setFrameRect(const IntRect& rect)
 {
-    // Get our window resizer rect and see if we overlap.  Adjust to avoid the overlap
+    // Get our window resizer rect and see if we overlap. Adjust to avoid the overlap
     // if necessary.
     IntRect adjustedRect(rect);
     bool overlapsResizer = false;
diff --git a/Source/WebCore/platform/Scrollbar.h b/Source/WebCore/platform/Scrollbar.h
index 39ac25465..171413a85 100644
--- a/Source/WebCore/platform/Scrollbar.h
+++ b/Source/WebCore/platform/Scrollbar.h
@@ -26,6 +26,7 @@
 #ifndef Scrollbar_h
 #define Scrollbar_h
 
+#include "ScrollbarThemeClient.h"
 #include "ScrollTypes.h"
 #include "Timer.h"
 #include "Widget.h"
@@ -40,13 +41,60 @@ class PlatformMouseEvent;
 class ScrollableArea;
 class ScrollbarTheme;
 
-class Scrollbar : public Widget {
+class Scrollbar : public Widget,
+                  public ScrollbarThemeClient {
+
 public:
     // Must be implemented by platforms that can't simply use the Scrollbar base class.  Right now the only platform that is not using the base class is GTK.
     static PassRefPtr<Scrollbar> createNativeScrollbar(ScrollableArea*, ScrollbarOrientation orientation, ScrollbarControlSize size);
 
     virtual ~Scrollbar();
 
+    // ScrollbarThemeClient implementation.
+    virtual int x() const { return Widget::x(); }
+    virtual int y() const { return Widget::y(); }
+    virtual int width() const { return Widget::width(); }
+    virtual int height() const { return Widget::height(); }
+    virtual IntSize size() const { return Widget::size(); }
+    virtual IntPoint location() const { return Widget::location(); }
+
+    virtual ScrollView* parent() const { return Widget::parent(); }
+    virtual ScrollView* root() const { return Widget::root(); }
+
+    virtual void setFrameRect(const IntRect&);
+    virtual IntRect frameRect() const { return Widget::frameRect(); }
+
+    virtual void invalidate() { Widget::invalidate(); }
+    virtual void invalidateRect(const IntRect&);
+
+    virtual ScrollbarOverlayStyle scrollbarOverlayStyle() const;
+    virtual void getTickmarks(Vector<IntRect>&) const;
+    virtual bool isScrollableAreaActive() const;
+    virtual bool isScrollViewScrollbar() const;
+
+    virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint) { return Widget::convertFromContainingWindow(windowPoint); }
+
+    virtual bool isCustomScrollbar() const { return false; }
+    virtual ScrollbarOrientation orientation() const { return m_orientation; }
+
+    virtual int value() const { return lroundf(m_currentPos); }
+    virtual float currentPos() const { return m_currentPos; }
+    virtual int visibleSize() const { return m_visibleSize; }
+    virtual int totalSize() const { return m_totalSize; }
+    virtual int maximum() const { return m_totalSize - m_visibleSize; }
+    virtual ScrollbarControlSize controlSize() const { return m_controlSize; }
+
+    virtual int lineStep() const { return m_lineStep; }
+    virtual int pageStep() const { return m_pageStep; }
+
+    virtual ScrollbarPart pressedPart() const { return m_pressedPart; }
+    virtual ScrollbarPart hoveredPart() const { return m_hoveredPart; }
+
+    virtual void styleChanged() { }
+
+    virtual bool enabled() const { return m_enabled; }
+    virtual void setEnabled(bool);
+
     // Called by the ScrollableArea when the scroll offset changes.
     void offsetDidChange();
 
@@ -57,34 +105,18 @@ public:
     void disconnectFromScrollableArea() { m_scrollableArea = 0; }
     ScrollableArea* scrollableArea() const { return m_scrollableArea; }
 
-    virtual bool isCustomScrollbar() const { return false; }
-    ScrollbarOrientation orientation() const { return m_orientation; }
-
-    int value() const { return lroundf(m_currentPos); }
-    float currentPos() const { return m_currentPos; }
     int pressedPos() const { return m_pressedPos; }
-    int visibleSize() const { return m_visibleSize; }
-    int totalSize() const { return m_totalSize; }
-    int maximum() const { return m_totalSize - m_visibleSize; }        
-    ScrollbarControlSize controlSize() const { return m_controlSize; }
 
-    int lineStep() const { return m_lineStep; }
-    int pageStep() const { return m_pageStep; }
     float pixelStep() const { return m_pixelStep; }
 
-    ScrollbarPart pressedPart() const { return m_pressedPart; }
-    ScrollbarPart hoveredPart() const { return m_hoveredPart; }
     virtual void setHoveredPart(ScrollbarPart);
     virtual void setPressedPart(ScrollbarPart);
 
     void setSteps(int lineStep, int pageStep, int pixelsPerStep = 1);
     void setProportion(int visibleSize, int totalSize);
     void setPressedPos(int p) { m_pressedPos = p; }
-    
-    virtual void paint(GraphicsContext*, const IntRect& damageRect);
 
-    bool enabled() const { return m_enabled; }
-    virtual void setEnabled(bool e);
+    virtual void paint(GraphicsContext*, const IntRect& damageRect);
 
     virtual bool isOverlayScrollbar() const;
     bool shouldParticipateInHitTesting();
@@ -97,7 +129,7 @@ public:
     bool mouseMoved(const PlatformMouseEvent&);
     void mouseEntered();
     bool mouseExited();
-    
+
     // Used by some platform scrollbars to know when they've been released from capture.
     bool mouseUp(const PlatformMouseEvent&);
 
@@ -106,18 +138,13 @@ public:
     ScrollbarTheme* theme() const { return m_theme; }
 
     virtual void setParent(ScrollView*);
-    virtual void setFrameRect(const IntRect&);
 
-    virtual void invalidateRect(const IntRect&);
-    
     bool suppressInvalidation() const { return m_suppressInvalidation; }
     void setSuppressInvalidation(bool s) { m_suppressInvalidation = s; }
 
-    virtual void styleChanged() { }
-
     virtual IntRect convertToContainingView(const IntRect&) const;
     virtual IntRect convertFromContainingView(const IntRect&) const;
-    
+
     virtual IntPoint convertToContainingView(const IntPoint&) const;
     virtual IntPoint convertFromContainingView(const IntPoint&) const;
 
@@ -160,7 +187,7 @@ protected:
 
     Timer<Scrollbar> m_scrollTimer;
     bool m_overlapsResizer;
-    
+
     bool m_suppressInvalidation;
 
 private:
diff --git a/Source/WebCore/platform/ScrollbarTheme.h b/Source/WebCore/platform/ScrollbarTheme.h
index 2a83d5385..5fe45b1a4 100644
--- a/Source/WebCore/platform/ScrollbarTheme.h
+++ b/Source/WebCore/platform/ScrollbarTheme.h
@@ -33,7 +33,7 @@
 namespace WebCore {
 
 class PlatformMouseEvent;
-class Scrollbar;
+class ScrollbarThemeClient;
 class ScrollView;
 
 #if USE(ACCELERATED_COMPOSITING) && ENABLE(RUBBER_BANDING)
@@ -46,10 +46,10 @@ public:
     ScrollbarTheme() { }
     virtual ~ScrollbarTheme() {};
 
-    virtual void updateEnabledState(Scrollbar*) { };
+    virtual void updateEnabledState(ScrollbarThemeClient*) { };
 
-    virtual bool paint(Scrollbar*, GraphicsContext*, const IntRect& /*damageRect*/) { return false; }
-    virtual ScrollbarPart hitTest(Scrollbar*, const PlatformMouseEvent&) { return NoPart; }
+    virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& /*damageRect*/) { return false; }
+    virtual ScrollbarPart hitTest(ScrollbarThemeClient*, const PlatformMouseEvent&) { return NoPart; }
     
     virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar) { return 0; }
 
@@ -57,13 +57,13 @@ public:
 
     virtual bool supportsControlTints() const { return false; }
     virtual bool usesOverlayScrollbars() const { return false; }
-    virtual void updateScrollbarOverlayStyle(Scrollbar*) { }
+    virtual void updateScrollbarOverlayStyle(ScrollbarThemeClient*) { }
 
     virtual void themeChanged() {}
     
     virtual bool invalidateOnMouseEnterExit() { return false; }
 
-    void invalidateParts(Scrollbar* scrollbar, ScrollbarControlPartMask mask)
+    void invalidateParts(ScrollbarThemeClient* scrollbar, ScrollbarControlPartMask mask)
     {
         if (mask & BackButtonStartPart)
             invalidatePart(scrollbar, BackButtonStartPart);
@@ -81,7 +81,7 @@ public:
             invalidatePart(scrollbar, ForwardButtonEndPart);
     }
 
-    virtual void invalidatePart(Scrollbar*, ScrollbarPart) {}
+    virtual void invalidatePart(ScrollbarThemeClient*, ScrollbarPart) { }
 
     virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { defaultPaintScrollCorner(context, cornerRect); }
     static void defaultPaintScrollCorner(GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white, ColorSpaceDeviceRGB); }
@@ -93,21 +93,21 @@ public:
     virtual void setUpContentShadowLayer(GraphicsLayer*) { }
 #endif
 
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&) { return false; }
-    virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&) { return false; }
-    virtual bool shouldDragDocumentInsteadOfThumb(Scrollbar*, const PlatformMouseEvent&) { return false; }
-    virtual int thumbPosition(Scrollbar*) { return 0; } // The position of the thumb relative to the track.
-    virtual int thumbLength(Scrollbar*) { return 0; } // The length of the thumb along the axis of the scrollbar.
-    virtual int trackPosition(Scrollbar*) { return 0; } // The position of the track relative to the scrollbar.
-    virtual int trackLength(Scrollbar*) { return 0; } // The length of the track along the axis of the scrollbar.
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&) { return false; }
+    virtual bool shouldSnapBackToDragOrigin(ScrollbarThemeClient*, const PlatformMouseEvent&) { return false; }
+    virtual bool shouldDragDocumentInsteadOfThumb(ScrollbarThemeClient*, const PlatformMouseEvent&) { return false; }
+    virtual int thumbPosition(ScrollbarThemeClient*) { return 0; } // The position of the thumb relative to the track.
+    virtual int thumbLength(ScrollbarThemeClient*) { return 0; } // The length of the thumb along the axis of the scrollbar.
+    virtual int trackPosition(ScrollbarThemeClient*) { return 0; } // The position of the track relative to the scrollbar.
+    virtual int trackLength(ScrollbarThemeClient*) { return 0; } // The length of the track along the axis of the scrollbar.
 
     virtual int maxOverlapBetweenPages() { return std::numeric_limits<int>::max(); }
 
     virtual double initialAutoscrollTimerDelay() { return 0.25; }
     virtual double autoscrollTimerDelay() { return 0.05; }
 
-    virtual void registerScrollbar(Scrollbar*) {}
-    virtual void unregisterScrollbar(Scrollbar*) {}
+    virtual void registerScrollbar(ScrollbarThemeClient*) { }
+    virtual void unregisterScrollbar(ScrollbarThemeClient*) { }
 
     virtual bool isMockTheme() const { return false; }
 
diff --git a/Source/WebCore/platform/ScrollbarThemeClient.h b/Source/WebCore/platform/ScrollbarThemeClient.h
new file mode 100644
index 000000000..871c52e90
--- /dev/null
+++ b/Source/WebCore/platform/ScrollbarThemeClient.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScrollbarThemeClient_h
+#define ScrollbarThemeClient_h
+
+#include "IntPoint.h"
+#include "IntRect.h"
+#include "IntSize.h"
+#include "ScrollTypes.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class ScrollView;
+
+class ScrollbarThemeClient {
+public:
+    virtual int x() const = 0;
+    virtual int y() const = 0;
+    virtual int width() const = 0;
+    virtual int height() const = 0;
+    virtual IntSize size() const = 0;
+    virtual IntPoint location() const = 0;
+
+    virtual ScrollView* parent() const = 0;
+    virtual ScrollView* root() const = 0;
+
+    virtual void setFrameRect(const IntRect&) = 0;
+    virtual IntRect frameRect() const = 0;
+
+    virtual void invalidate() = 0;
+    virtual void invalidateRect(const IntRect&) = 0;
+
+    virtual ScrollbarOverlayStyle scrollbarOverlayStyle() const = 0;
+    virtual void getTickmarks(Vector<IntRect>&) const = 0;
+    virtual bool isScrollableAreaActive() const = 0;
+    virtual bool isScrollViewScrollbar() const = 0;
+
+    virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint) = 0;
+
+    virtual bool isCustomScrollbar() const = 0;
+    virtual ScrollbarOrientation orientation() const = 0;
+
+    virtual int value() const = 0;
+    virtual float currentPos() const = 0;
+    virtual int visibleSize() const = 0;
+    virtual int totalSize() const = 0;
+    virtual int maximum() const = 0;
+    virtual ScrollbarControlSize controlSize() const = 0;
+
+    virtual int lineStep() const = 0;
+    virtual int pageStep() const = 0;
+
+    virtual ScrollbarPart pressedPart() const = 0;
+    virtual ScrollbarPart hoveredPart() const = 0;
+
+    virtual void styleChanged() = 0;
+
+    virtual bool enabled() const = 0;
+    virtual void setEnabled(bool) = 0;
+
+protected:
+    virtual ~ScrollbarThemeClient() { }
+};
+
+} // namespace WebCore
+
+#endif // ScollbarThemeClient_h
diff --git a/Source/WebCore/platform/ScrollbarThemeComposite.cpp b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
index 62fd5e5d2..9d833742f 100644
--- a/Source/WebCore/platform/ScrollbarThemeComposite.cpp
+++ b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
@@ -33,15 +33,14 @@
 #include "GraphicsContext.h"
 #include "Page.h"
 #include "PlatformMouseEvent.h"
-#include "Scrollbar.h"
-#include "ScrollableArea.h"
+#include "ScrollbarThemeClient.h"
 #include "Settings.h"
 
 using namespace std;
 
 namespace WebCore {
 
-bool ScrollbarThemeComposite::paint(Scrollbar* scrollbar, GraphicsContext* graphicsContext, const IntRect& damageRect)
+bool ScrollbarThemeComposite::paint(ScrollbarThemeClient* scrollbar, GraphicsContext* graphicsContext, const IntRect& damageRect)
 {
     // Create the ScrollbarControlPartMask based on the damageRect
     ScrollbarControlPartMask scrollMask = NoPart;
@@ -116,7 +115,7 @@ bool ScrollbarThemeComposite::paint(Scrollbar* scrollbar, GraphicsContext* graph
     return true;
 }
 
-ScrollbarPart ScrollbarThemeComposite::hitTest(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
+ScrollbarPart ScrollbarThemeComposite::hitTest(ScrollbarThemeClient* scrollbar, const PlatformMouseEvent& evt)
 {
     ScrollbarPart result = NoPart;
     if (!scrollbar->enabled())
@@ -155,7 +154,7 @@ ScrollbarPart ScrollbarThemeComposite::hitTest(Scrollbar* scrollbar, const Platf
     return result;
 }
 
-void ScrollbarThemeComposite::invalidatePart(Scrollbar* scrollbar, ScrollbarPart part)
+void ScrollbarThemeComposite::invalidatePart(ScrollbarThemeClient* scrollbar, ScrollbarPart part)
 {
     if (part == NoPart)
         return;
@@ -195,7 +194,7 @@ void ScrollbarThemeComposite::invalidatePart(Scrollbar* scrollbar, ScrollbarPart
     scrollbar->invalidateRect(result);
 }
 
-void ScrollbarThemeComposite::splitTrack(Scrollbar* scrollbar, const IntRect& unconstrainedTrackRect, IntRect& beforeThumbRect, IntRect& thumbRect, IntRect& afterThumbRect)
+void ScrollbarThemeComposite::splitTrack(ScrollbarThemeClient* scrollbar, const IntRect& unconstrainedTrackRect, IntRect& beforeThumbRect, IntRect& thumbRect, IntRect& afterThumbRect)
 {
     // This function won't even get called unless we're big enough to have some combination of these three rects where at least
     // one of them is non-empty.
@@ -215,7 +214,7 @@ void ScrollbarThemeComposite::splitTrack(Scrollbar* scrollbar, const IntRect& un
 
 // Returns the size represented by track taking into account scrolling past
 // the end of the document.
-static float usedTotalSize(Scrollbar* scrollbar)
+static float usedTotalSize(ScrollbarThemeClient* scrollbar)
 {
     float overhangAtStart = -scrollbar->currentPos();
     float overhangAtEnd = scrollbar->currentPos() + scrollbar->visibleSize() - scrollbar->totalSize();
@@ -223,7 +222,7 @@ static float usedTotalSize(Scrollbar* scrollbar)
     return scrollbar->totalSize() + overhang;
 }
 
-int ScrollbarThemeComposite::thumbPosition(Scrollbar* scrollbar)
+int ScrollbarThemeComposite::thumbPosition(ScrollbarThemeClient* scrollbar)
 {
     if (scrollbar->enabled()) {
         float size = usedTotalSize(scrollbar) - scrollbar->visibleSize();
@@ -236,7 +235,7 @@ int ScrollbarThemeComposite::thumbPosition(Scrollbar* scrollbar)
     return 0;
 }
 
-int ScrollbarThemeComposite::thumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeComposite::thumbLength(ScrollbarThemeClient* scrollbar)
 {
     if (!scrollbar->enabled())
         return 0;
@@ -250,18 +249,18 @@ int ScrollbarThemeComposite::thumbLength(Scrollbar* scrollbar)
     return length;
 }
 
-int ScrollbarThemeComposite::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeComposite::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return scrollbarThickness(scrollbar->controlSize());
 }
 
-int ScrollbarThemeComposite::trackPosition(Scrollbar* scrollbar)
+int ScrollbarThemeComposite::trackPosition(ScrollbarThemeClient* scrollbar)
 {
     IntRect constrainedTrackRect = constrainTrackRectToTrackPieces(scrollbar, trackRect(scrollbar));
     return (scrollbar->orientation() == HorizontalScrollbar) ? constrainedTrackRect.x() - scrollbar->x() : constrainedTrackRect.y() - scrollbar->y();
 }
 
-int ScrollbarThemeComposite::trackLength(Scrollbar* scrollbar)
+int ScrollbarThemeComposite::trackLength(ScrollbarThemeClient* scrollbar)
 {
     IntRect constrainedTrackRect = constrainTrackRectToTrackPieces(scrollbar, trackRect(scrollbar));
     return (scrollbar->orientation() == HorizontalScrollbar) ? constrainedTrackRect.width() : constrainedTrackRect.height();
diff --git a/Source/WebCore/platform/ScrollbarThemeComposite.h b/Source/WebCore/platform/ScrollbarThemeComposite.h
index 11b3bd470..8f629133e 100644
--- a/Source/WebCore/platform/ScrollbarThemeComposite.h
+++ b/Source/WebCore/platform/ScrollbarThemeComposite.h
@@ -32,40 +32,40 @@ namespace WebCore {
 
 class ScrollbarThemeComposite : public ScrollbarTheme {
 public:
-    virtual bool paint(Scrollbar*, GraphicsContext* context, const IntRect& damageRect);
+    virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& damageRect);
 
-    virtual ScrollbarPart hitTest(Scrollbar*, const PlatformMouseEvent&);
+    virtual ScrollbarPart hitTest(ScrollbarThemeClient*, const PlatformMouseEvent&);
 
-    virtual void invalidatePart(Scrollbar*, ScrollbarPart);
+    virtual void invalidatePart(ScrollbarThemeClient*, ScrollbarPart);
 
-    virtual int thumbPosition(Scrollbar*);
-    virtual int thumbLength(Scrollbar*);
-    virtual int trackPosition(Scrollbar*);
-    virtual int trackLength(Scrollbar*);
+    virtual int thumbPosition(ScrollbarThemeClient*);
+    virtual int thumbLength(ScrollbarThemeClient*);
+    virtual int trackPosition(ScrollbarThemeClient*);
+    virtual int trackLength(ScrollbarThemeClient*);
 
     virtual void paintScrollCorner(ScrollView*, GraphicsContext*, const IntRect& cornerRect);
     virtual void paintOverhangAreas(ScrollView*, GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
 
 protected:
-    virtual bool hasButtons(Scrollbar*) = 0;
-    virtual bool hasThumb(Scrollbar*) = 0;
+    virtual bool hasButtons(ScrollbarThemeClient*) = 0;
+    virtual bool hasThumb(ScrollbarThemeClient*) = 0;
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false) = 0;
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false) = 0;
-    virtual IntRect trackRect(Scrollbar*, bool painting = false) = 0;
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false) = 0;
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false) = 0;
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false) = 0;
 
-    virtual void splitTrack(Scrollbar*, const IntRect& track, IntRect& startTrack, IntRect& thumb, IntRect& endTrack);
+    virtual void splitTrack(ScrollbarThemeClient*, const IntRect& track, IntRect& startTrack, IntRect& thumb, IntRect& endTrack);
     
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
 
-    virtual void paintScrollbarBackground(GraphicsContext*, Scrollbar*) {}
-    virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&) {}
-    virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart) {}
-    virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart) {}
-    virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&) {}
-    virtual void paintTickmarks(GraphicsContext*, Scrollbar*, const IntRect&) {}
+    virtual void paintScrollbarBackground(GraphicsContext*, ScrollbarThemeClient*) { }
+    virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
+    virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart) { }
+    virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart) { }
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
+    virtual void paintTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
 
-    virtual IntRect constrainTrackRectToTrackPieces(Scrollbar*, const IntRect& rect) { return rect; }
+    virtual IntRect constrainTrackRectToTrackPieces(ScrollbarThemeClient*, const IntRect& rect) { return rect; }
 };
 
 }
diff --git a/Source/WebCore/platform/SharedBuffer.cpp b/Source/WebCore/platform/SharedBuffer.cpp
index 5b5953edc..ee6a29fd5 100644
--- a/Source/WebCore/platform/SharedBuffer.cpp
+++ b/Source/WebCore/platform/SharedBuffer.cpp
@@ -65,12 +65,20 @@ SharedBuffer::SharedBuffer()
 SharedBuffer::SharedBuffer(const char* data, int size)
     : m_size(0)
 {
+    // FIXME: Use unsigned consistently, and check for invalid casts when calling into SharedBuffer from other code.
+    if (size < 0)
+        CRASH();
+
     append(data, size);
 }
 
 SharedBuffer::SharedBuffer(const unsigned char* data, int size)
     : m_size(0)
 {
+    // FIXME: Use unsigned consistently, and check for invalid casts when calling into SharedBuffer from other code.
+    if (size < 0)
+        CRASH();
+
     append(reinterpret_cast<const char*>(data), size);
 }
     
diff --git a/Source/WebCore/platform/Supplementable.h b/Source/WebCore/platform/Supplementable.h
new file mode 100644
index 000000000..84dc906e2
--- /dev/null
+++ b/Source/WebCore/platform/Supplementable.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2012 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Supplementable_h
+#define Supplementable_h
+
+#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/AtomicString.h>
+#include <wtf/text/AtomicStringHash.h>
+
+namespace WebCore {
+
+template<typename T>
+class Supplementable;
+
+template<typename T>
+class Supplement {
+public:
+    virtual ~Supplement() { }
+
+    static void provideTo(Supplementable<T>* host, const AtomicString& key, PassOwnPtr<Supplement<T> > supplement)
+    {
+        host->provideSupplement(key, supplement);
+    }
+
+    static Supplement<T>* from(Supplementable<T>* host, const AtomicString& key)
+    {
+        return host ? host->requireSupplement(key) : 0;
+    }
+};
+
+template<typename T>
+class Supplementable {
+public:
+    void provideSupplement(const AtomicString& key, PassOwnPtr<Supplement<T> > supplement)
+    {
+        ASSERT(!m_supplements.get(key.impl()));
+        m_supplements.set(key, supplement);
+    }
+
+    Supplement<T>* requireSupplement(const AtomicString& key)
+    {
+        return m_supplements.get(key);
+    }
+
+private:
+    typedef HashMap<AtomicString, OwnPtr<Supplement<T> > > SupplementMap;
+    SupplementMap m_supplements;
+};
+
+} // namespace WebCore
+
+#endif // Supplementable_h
diff --git a/Source/WebCore/platform/ThemeTypes.h b/Source/WebCore/platform/ThemeTypes.h
index bdef724eb..f2515fc1a 100644
--- a/Source/WebCore/platform/ThemeTypes.h
+++ b/Source/WebCore/platform/ThemeTypes.h
@@ -48,7 +48,7 @@ typedef unsigned ControlStates;
 enum ControlPart {
     NoControlPart, CheckboxPart, RadioPart, PushButtonPart, SquareButtonPart, ButtonPart,
     ButtonBevelPart, DefaultButtonPart, InnerSpinButtonPart, InputSpeechButtonPart, ListButtonPart, ListboxPart, ListItemPart,
-    MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
+    MediaFullscreenButtonPart, MediaFullScreenVolumeSliderPart, MediaFullScreenVolumeSliderThumbPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
     MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart, MediaToggleClosedCaptionsButtonPart,
     MediaSliderPart, MediaSliderThumbPart, MediaVolumeSliderContainerPart, MediaVolumeSliderPart, MediaVolumeSliderThumbPart,
     MediaVolumeSliderMuteButtonPart, MediaControlsBackgroundPart, MediaControlsFullscreenBackgroundPart, MediaCurrentTimePart, MediaTimeRemainingPart,
diff --git a/Source/WebCore/platform/ThreadGlobalData.cpp b/Source/WebCore/platform/ThreadGlobalData.cpp
index 166eb47ba..da846f8db 100644
--- a/Source/WebCore/platform/ThreadGlobalData.cpp
+++ b/Source/WebCore/platform/ThreadGlobalData.cpp
@@ -29,6 +29,7 @@
 
 #include "DOMImplementation.h"
 #include "EventNames.h"
+#include "InspectorCounters.h"
 #include "ThreadTimers.h"
 #include <wtf/MainThread.h>
 #include <wtf/UnusedParam.h>
@@ -70,6 +71,9 @@ ThreadGlobalData::ThreadGlobalData()
 #if PLATFORM(MAC)
     , m_cachedConverterTEC(adoptPtr(new TECConverterWrapper))
 #endif
+#if ENABLE(INSPECTOR)
+    , m_inspectorCounters(adoptPtr(new ThreadLocalInspectorCounters()))
+#endif
 {
     // This constructor will have been called on the main thread before being called on
     // any other thread, and is only called once per thread - this makes this a convenient
@@ -93,6 +97,10 @@ void ThreadGlobalData::destroy()
     m_cachedConverterICU.clear();
 #endif
 
+#if ENABLE(INSPECTOR)
+    m_inspectorCounters.clear();
+#endif
+
     m_eventNames.clear();
     m_threadTimers.clear();
     m_xmlTypeRegExp.clear();
diff --git a/Source/WebCore/platform/ThreadGlobalData.h b/Source/WebCore/platform/ThreadGlobalData.h
index bb9f1a8e1..42f05afe3 100644
--- a/Source/WebCore/platform/ThreadGlobalData.h
+++ b/Source/WebCore/platform/ThreadGlobalData.h
@@ -42,6 +42,7 @@ using WTF::ThreadSpecific;
 namespace WebCore {
 
     class EventNames;
+    class ThreadLocalInspectorCounters;
     class ThreadTimers;
     class XMLMIMETypeRegExp;
 
@@ -67,6 +68,10 @@ namespace WebCore {
         TECConverterWrapper& cachedConverterTEC() { return *m_cachedConverterTEC; }
 #endif
 
+#if ENABLE(INSPECTOR)
+        ThreadLocalInspectorCounters& inspectorCounters() { return *m_inspectorCounters; }
+#endif
+
     private:
         OwnPtr<EventNames> m_eventNames;
         OwnPtr<ThreadTimers> m_threadTimers;
@@ -84,6 +89,10 @@ namespace WebCore {
         OwnPtr<TECConverterWrapper> m_cachedConverterTEC;
 #endif
 
+#if ENABLE(INSPECTOR)
+        OwnPtr<ThreadLocalInspectorCounters> m_inspectorCounters;
+#endif
+
 #if ENABLE(WORKERS)
         static ThreadSpecific<ThreadGlobalData>* staticData;
 #else
diff --git a/Source/WebCore/platform/TouchFlingPlatformGestureCurve.cpp b/Source/WebCore/platform/TouchFlingPlatformGestureCurve.cpp
new file mode 100644
index 000000000..076099583
--- /dev/null
+++ b/Source/WebCore/platform/TouchFlingPlatformGestureCurve.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "TouchFlingPlatformGestureCurve.h"
+
+#include "PlatformGestureCurveTarget.h"
+#include <math.h>
+
+namespace WebCore {
+
+using namespace std;
+
+PassOwnPtr<PlatformGestureCurve> TouchFlingPlatformGestureCurve::create(const FloatPoint& velocity)
+{
+    return adoptPtr(new TouchFlingPlatformGestureCurve(velocity));
+}
+
+TouchFlingPlatformGestureCurve::TouchFlingPlatformGestureCurve(const FloatPoint& velocity)
+    : m_velocity(velocity)
+    , m_timeScaleFactor(1000 / max(1.f, max(fabs(velocity.x()), fabs(velocity.y()))))
+{
+    ASSERT(velocity != FloatPoint::zero());
+}
+
+TouchFlingPlatformGestureCurve::~TouchFlingPlatformGestureCurve()
+{
+}
+
+bool TouchFlingPlatformGestureCurve::apply(double time, PlatformGestureCurveTarget* target)
+{
+    // Here we implement a cubic bezier curve with parameters [1 1 0 0] which gives
+    // v(0) = 1, a(0) = 0, v(1) = 0, a(1) = 0. The curve is scaled by the initial
+    // velocity, and the time parameter is re-scaled so that larger initial velocities
+    // lead to longer initial animations. This should allow the animation to smoothly
+    // continue the velocity at the end of the GestureScroll, and smoothly come to a rest
+    // at the end. Finally, we have integrated the curve so we can deal with displacement
+    // as a function of time, and not velocity.
+    // Finally, we place a constant velocity from ts = 0 .. 0.5, and run the Bezier curve
+    // from ts = 0.5 .. 1.5 to give a longer run-out.
+    time *= m_timeScaleFactor;
+
+    float displacement;
+    if (time <= 0.5)
+        displacement = time;
+    else if (time <= 1.5) {
+        double t = time - 0.5;
+        displacement = t * (1 + t * t * (0.5 * t - 1)) + 0.5;
+    } else
+        displacement = 1.0;
+
+    // Keep track of integer portion of scroll thus far, and prepare increment.
+    IntPoint scroll(displacement * m_velocity.x(), displacement * m_velocity.y());
+    IntPoint scrollIncrement(scroll - m_cumulativeScroll);
+    m_cumulativeScroll = scroll;
+
+    if (time < 1.5 || scrollIncrement != IntPoint::zero()) {
+        target->setScrollIncrement(scrollIncrement);
+        return true;
+    }
+
+    return false;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/TouchFlingPlatformGestureCurve.h b/Source/WebCore/platform/TouchFlingPlatformGestureCurve.h
new file mode 100644
index 000000000..fd52bc4ec
--- /dev/null
+++ b/Source/WebCore/platform/TouchFlingPlatformGestureCurve.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TouchFlingPlatformGestureCurve_h
+#define TouchFlingPlatformGestureCurve_h
+
+#include "FloatPoint.h"
+#include "PlatformGestureCurve.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class PlatformGestureCurveTarget;
+
+// Implementation of PlatformGestureCurve suitable for touch pad/screen-based
+// fling scroll. Starts with a flat velocity profile based on 'velocity', which
+// tails off to zero. Time is scaled to that duration of the fling is proportional
+// the initial velocity.
+class TouchFlingPlatformGestureCurve : public PlatformGestureCurve {
+public:
+    static PassOwnPtr<PlatformGestureCurve> create(const FloatPoint& velocity);
+    virtual ~TouchFlingPlatformGestureCurve();
+
+    virtual bool apply(double time, PlatformGestureCurveTarget*);
+
+private:
+    explicit TouchFlingPlatformGestureCurve(const FloatPoint& velocity);
+
+    FloatPoint m_velocity;
+    float m_timeScaleFactor;
+    IntPoint m_cumulativeScroll;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/WheelFlingPlatformGestureCurve.cpp b/Source/WebCore/platform/WheelFlingPlatformGestureCurve.cpp
new file mode 100644
index 000000000..fab57cd5f
--- /dev/null
+++ b/Source/WebCore/platform/WheelFlingPlatformGestureCurve.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WheelFlingPlatformGestureCurve.h"
+
+#include "PlatformGestureCurveTarget.h"
+#include <math.h>
+
+namespace WebCore {
+
+PassOwnPtr<PlatformGestureCurve> WheelFlingPlatformGestureCurve::create(const FloatPoint& velocity)
+{
+    return adoptPtr(new WheelFlingPlatformGestureCurve(velocity));
+}
+
+WheelFlingPlatformGestureCurve::WheelFlingPlatformGestureCurve(const FloatPoint& velocity)
+    : m_velocity(velocity)
+{
+    ASSERT(velocity != FloatPoint::zero());
+}
+
+WheelFlingPlatformGestureCurve::~WheelFlingPlatformGestureCurve()
+{
+}
+
+bool WheelFlingPlatformGestureCurve::apply(double time, PlatformGestureCurveTarget* target)
+{
+    // Use a Rayleigh distribution for the curve. This simulates a velocity profile
+    // that starts at 0, increases to a maximum, then decreases again smoothly. By
+    // using the cumulative distribution function (CDF) instead of the point-mass function,
+    // we can isolate timing jitter by remembering the CDF value at the last tick. Since
+    // the CDF maxes out at 1, scale it by the input velocity.
+    //
+    // CDF -> F(x; sigma) = 1 - exp{-x^2/2\sigma^2}
+    // ref: http://en.wikipedia.org/wiki/Rayleigh_distribution
+    // FIXME: consider making the value of sigma settable in the constructor.
+    static double twoSigmaSquaredInverse = 16; // sigma = 0.25
+    float cdf = 1 - exp(-time * time * twoSigmaSquaredInverse);
+    IntPoint scroll(cdf * m_velocity.x(), cdf * m_velocity.y());
+    IntPoint scrollIncrement(scroll - m_cumulativeScroll);
+    m_cumulativeScroll = scroll;
+
+    if (cdf < 0.5 || scrollIncrement != IntPoint::zero()) {
+        target->setScrollIncrement(scrollIncrement);
+        return true;
+    }
+
+    return false;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/WheelFlingPlatformGestureCurve.h b/Source/WebCore/platform/WheelFlingPlatformGestureCurve.h
new file mode 100644
index 000000000..b72146165
--- /dev/null
+++ b/Source/WebCore/platform/WheelFlingPlatformGestureCurve.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WheelFlingPlatformGestureCurve_h
+#define WheelFlingPlatformGestureCurve_h
+
+#include "FloatPoint.h"
+#include "PlatformGestureCurve.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class PlatformGestureCurveTarget;
+
+// Implementation of PlatformGestureCurve suitable for mouse wheel-based fling
+// scroll. A Rayleigh distribtution curve is used to define the velocity profile,
+// so velocity starts at zero, accelerates to a maximum proportional to 'velocity',
+// then gently tails off to zero again.
+class WheelFlingPlatformGestureCurve : public PlatformGestureCurve {
+public:
+    static PassOwnPtr<PlatformGestureCurve> create(const FloatPoint& velocity);
+    virtual ~WheelFlingPlatformGestureCurve();
+
+    virtual bool apply(double time, PlatformGestureCurveTarget*);
+
+private:
+    WheelFlingPlatformGestureCurve(const FloatPoint& velocity);
+
+    FloatPoint m_velocity;
+    IntPoint m_cumulativeScroll;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/audio/AudioUtilities.cpp b/Source/WebCore/platform/audio/AudioUtilities.cpp
index 7ec833ccd..57c00528b 100644
--- a/Source/WebCore/platform/audio/AudioUtilities.cpp
+++ b/Source/WebCore/platform/audio/AudioUtilities.cpp
@@ -49,11 +49,9 @@ float linearToDecibels(float linear)
     return 20 * log10f(linear);
 }
 
-float discreteTimeConstantForSampleRate(float timeConstant, float sampleRate)
+double discreteTimeConstantForSampleRate(double timeConstant, double sampleRate)
 {
-    // hardcoded value is temporary build fix for Windows.
-    // FIXME: replace hardcode 2.718282 with M_E until the correct MathExtras.h solution is determined.
-    return 1 - powf(1 / 2.718282f, 1 / (sampleRate * timeConstant));
+    return 1 - exp(-1 / (sampleRate * timeConstant));
 }
 
 size_t timeToSampleFrame(double time, double sampleRate)
diff --git a/Source/WebCore/platform/audio/AudioUtilities.h b/Source/WebCore/platform/audio/AudioUtilities.h
index ed2945fb6..c191e871c 100644
--- a/Source/WebCore/platform/audio/AudioUtilities.h
+++ b/Source/WebCore/platform/audio/AudioUtilities.h
@@ -36,7 +36,7 @@ float decibelsToLinear(float);
 // timeConstant is the time it takes a first-order linear time-invariant system
 // to reach the value 1 - 1/e (around 63.2%) given a step input response.
 // discreteTimeConstantForSampleRate() will return the discrete time-constant for the specific sampleRate.
-float discreteTimeConstantForSampleRate(float timeConstant, float sampleRate);
+double discreteTimeConstantForSampleRate(double timeConstant, double sampleRate);
 
 // Convert the time to a sample frame at the given sample rate.
 size_t timeToSampleFrame(double time, double sampleRate);
diff --git a/Source/WebCore/platform/audio/Biquad.cpp b/Source/WebCore/platform/audio/Biquad.cpp
index cfee9cfd9..d6799c69d 100644
--- a/Source/WebCore/platform/audio/Biquad.cpp
+++ b/Source/WebCore/platform/audio/Biquad.cpp
@@ -53,22 +53,35 @@ Biquad::Biquad()
     m_outputBuffer.allocate(kBufferSize + 2);
 #endif
 
+#if USE(WEBAUDIO_IPP)
+    int bufferSize;
+    ippsIIRGetStateSize64f_BiQuad_32f(1, &bufferSize);
+    m_ippInternalBuffer = ippsMalloc_8u(bufferSize);
+#endif // USE(WEBAUDIO_IPP)
+
     // Initialize as pass-thru (straight-wire, no filter effect)
-    m_b0 = 1;
-    m_b1 = 0;
-    m_b2 = 0;
-    m_a1 = 0;
-    m_a2 = 0;
+    setNormalizedCoefficients(1, 0, 0, 1, 0, 0);
 
     reset(); // clear filter memory
 }
 
+Biquad::~Biquad()
+{
+#if USE(WEBAUDIO_IPP)
+    ippsFree(m_ippInternalBuffer);
+#endif // USE(WEBAUDIO_IPP)
+}
+
 void Biquad::process(const float* sourceP, float* destP, size_t framesToProcess)
 {
 #if OS(DARWIN)
     // Use vecLib if available
     processFast(sourceP, destP, framesToProcess);
-#else
+
+#elif USE(WEBAUDIO_IPP)
+    ippsIIR64f_32f(sourceP, destP, static_cast<int>(framesToProcess), m_biquadState);
+#else // USE(WEBAUDIO_IPP)
+
     int n = framesToProcess;
 
     // Create local copies of member variables
@@ -171,8 +184,6 @@ void Biquad::processSliceFast(double* sourceP, double* destP, double* coefficien
 
 void Biquad::reset()
 {
-    m_x1 = m_x2 = m_y1 = m_y2 = 0;
-
 #if OS(DARWIN)
     // Two extra samples for filter history
     double* inputP = m_inputBuffer.data();
@@ -182,89 +193,88 @@ void Biquad::reset()
     double* outputP = m_outputBuffer.data();
     outputP[0] = 0;
     outputP[1] = 0;
+
+#elif USE(WEBAUDIO_IPP)
+    int bufferSize;
+    ippsIIRGetStateSize64f_BiQuad_32f(1, &bufferSize);
+    ippsZero_8u(m_ippInternalBuffer, bufferSize);
+
+#else
+    m_x1 = m_x2 = m_y1 = m_y2 = 0;
 #endif
 }
 
 void Biquad::setLowpassParams(double cutoff, double resonance)
 {
-    resonance = std::max(0.0, resonance); // can't go negative
     // Limit cutoff to 0 to 1.
     cutoff = std::max(0.0, std::min(cutoff, 1.0));
     
-    double g = pow(10.0, 0.05 * resonance);
-    double d = sqrt((4 - sqrt(16 - 16 / (g * g))) / 2);
-
     if (cutoff == 1) {
         // When cutoff is 1, the z-transform is 1.
-        m_b0 = 1;
-        m_b1 = 0;
-        m_b2 = 0;
-        m_a1 = 0;
-        m_a2 = 0;
+        setNormalizedCoefficients(1, 0, 0,
+                                  1, 0, 0);
     } else if (cutoff > 0) {
         // Compute biquad coefficients for lowpass filter
+        resonance = std::max(0.0, resonance); // can't go negative
+        double g = pow(10.0, 0.05 * resonance);
+        double d = sqrt((4 - sqrt(16 - 16 / (g * g))) / 2);
+
         double theta = piDouble * cutoff;
         double sn = 0.5 * d * sin(theta);
         double beta = 0.5 * (1 - sn) / (1 + sn);
         double gamma = (0.5 + beta) * cos(theta);
         double alpha = 0.25 * (0.5 + beta - gamma);
 
-        m_b0 = 2 * alpha;
-        m_b1 = 2 * 2 * alpha;
-        m_b2 = 2 * alpha;
-        m_a1 = 2 * -gamma;
-        m_a2 = 2 * beta;
+        double b0 = 2 * alpha;
+        double b1 = 2 * 2 * alpha;
+        double b2 = 2 * alpha;
+        double a1 = 2 * -gamma;
+        double a2 = 2 * beta;
+
+        setNormalizedCoefficients(b0, b1, b2, 1, a1, a2);
     } else {
         // When cutoff is zero, nothing gets through the filter, so set
         // coefficients up correctly.
-        m_b0 = 0;
-        m_b1 = 0;
-        m_b2 = 0;
-        m_a1 = 0;
-        m_a2 = 0;
+        setNormalizedCoefficients(0, 0, 0,
+                                  1, 0, 0);
     }
 }
 
 void Biquad::setHighpassParams(double cutoff, double resonance)
 {
-    resonance = std::max(0.0, resonance); // can't go negative
-
     // Limit cutoff to 0 to 1.
     cutoff = std::max(0.0, std::min(cutoff, 1.0));
 
-    double g = pow(10.0, 0.05 * resonance);
-    double d = sqrt((4 - sqrt(16 - 16 / (g * g))) / 2);
-
     if (cutoff == 1) {
         // The z-transform is 0.
-        m_b0 = 0;
-        m_b1 = 0;
-        m_b2 = 0;
-        m_a1 = 0;
-        m_a2 = 0;
+        setNormalizedCoefficients(0, 0, 0,
+                                  1, 0, 0);
     } else if (cutoff > 0) {
         // Compute biquad coefficients for highpass filter
+        resonance = std::max(0.0, resonance); // can't go negative
+        double g = pow(10.0, 0.05 * resonance);
+        double d = sqrt((4 - sqrt(16 - 16 / (g * g))) / 2);
+
         double theta = piDouble * cutoff;
         double sn = 0.5 * d * sin(theta);
         double beta = 0.5 * (1 - sn) / (1 + sn);
         double gamma = (0.5 + beta) * cos(theta);
         double alpha = 0.25 * (0.5 + beta + gamma);
 
-        m_b0 = 2 * alpha;
-        m_b1 = 2 * -2 * alpha;
-        m_b2 = 2 * alpha;
-        m_a1 = 2 * -gamma;
-        m_a2 = 2 * beta;
+        double b0 = 2 * alpha;
+        double b1 = 2 * -2 * alpha;
+        double b2 = 2 * alpha;
+        double a1 = 2 * -gamma;
+        double a2 = 2 * beta;
+
+        setNormalizedCoefficients(b0, b1, b2, 1, a1, a2);
     } else {
       // When cutoff is zero, we need to be careful because the above
       // gives a quadratic divided by the same quadratic, with poles
       // and zeros on the unit circle in the same place. When cutoff
       // is zero, the z-transform is 1.
-      m_b0 = 1;
-      m_b1 = 0;
-      m_b2 = 0;
-      m_a1 = 0;
-      m_a2 = 0;
+        setNormalizedCoefficients(1, 0, 0,
+                                  1, 0, 0);
     }
 }
 
@@ -277,6 +287,19 @@ void Biquad::setNormalizedCoefficients(double b0, double b1, double b2, double a
     m_b2 = b2 * a0Inverse;
     m_a1 = a1 * a0Inverse;
     m_a2 = a2 * a0Inverse;
+
+#if USE(WEBAUDIO_IPP)
+    Ipp64f taps[6];
+    taps[0] = m_b0;
+    taps[1] = m_b1;
+    taps[2] = m_b2;
+    taps[3] = 1;
+    taps[4] = m_a1;
+    taps[5] = m_a2;
+    m_biquadState = 0;
+
+    ippsIIRInit64f_BiQuad_32f(&m_biquadState, taps, 1, 0, m_ippInternalBuffer);
+#endif // USE(WEBAUDIO_IPP)
 }
 
 void Biquad::setLowShelfParams(double frequency, double dbGain)
@@ -501,16 +524,17 @@ void Biquad::setBandpassParams(double frequency, double Q)
 
 void Biquad::setZeroPolePairs(const Complex &zero, const Complex &pole)
 {
-    m_b0 = 1;
-    m_b1 = -2 * zero.real();
+    double b0 = 1;
+    double b1 = -2 * zero.real();
 
     double zeroMag = abs(zero);
-    m_b2 = zeroMag * zeroMag;
+    double b2 = zeroMag * zeroMag;
 
-    m_a1 = -2 * pole.real();
+    double a1 = -2 * pole.real();
 
     double poleMag = abs(pole);
-    m_a2 = poleMag * poleMag;
+    double a2 = poleMag * poleMag;
+    setNormalizedCoefficients(b0, b1, b2, 1, a1, a2);
 }
 
 void Biquad::setAllpassPole(const Complex &pole)
diff --git a/Source/WebCore/platform/audio/Biquad.h b/Source/WebCore/platform/audio/Biquad.h
index 78381158b..494c03092 100644
--- a/Source/WebCore/platform/audio/Biquad.h
+++ b/Source/WebCore/platform/audio/Biquad.h
@@ -34,6 +34,10 @@
 #include <wtf/Complex.h>
 #include <wtf/Platform.h>
  
+#if USE(WEBAUDIO_IPP)
+#include <ipps.h>
+#endif // USE(WEBAUDIO_IPP)
+
 namespace WebCore {
 
 // A basic biquad (two-zero / two-pole digital filter)
@@ -44,7 +48,7 @@ namespace WebCore {
 class Biquad {
 public:   
     Biquad();
-    virtual ~Biquad() { }
+    virtual ~Biquad();
 
     void process(const float* sourceP, float* destP, size_t framesToProcess);
 
@@ -89,18 +93,23 @@ private:
     double m_a1;
     double m_a2;
 
-    // Filter memory
-    double m_x1; // input delayed by 1 sample
-    double m_x2; // input delayed by 2 samples
-    double m_y1; // output delayed by 1 sample
-    double m_y2; // output delayed by 2 samples
-
 #if OS(DARWIN)
     void processFast(const float* sourceP, float* destP, size_t framesToProcess);
     void processSliceFast(double* sourceP, double* destP, double* coefficientsP, size_t framesToProcess);
 
     AudioDoubleArray m_inputBuffer;
     AudioDoubleArray m_outputBuffer;
+
+#elif USE(WEBAUDIO_IPP)
+    IppsIIRState64f_32f* m_biquadState;
+    Ipp8u* m_ippInternalBuffer;
+
+#else
+    // Filter memory
+    double m_x1; // input delayed by 1 sample
+    double m_x2; // input delayed by 2 samples
+    double m_y1; // output delayed by 1 sample
+    double m_y2; // output delayed by 2 samples
 #endif
 };
 
diff --git a/Source/WebCore/platform/audio/DynamicsCompressor.cpp b/Source/WebCore/platform/audio/DynamicsCompressor.cpp
index d0f27b05f..c943b9801 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressor.cpp
+++ b/Source/WebCore/platform/audio/DynamicsCompressor.cpp
@@ -42,6 +42,7 @@ using namespace AudioUtilities;
     
 DynamicsCompressor::DynamicsCompressor(float sampleRate, unsigned numberOfChannels)
     : m_numberOfChannels(numberOfChannels)
+    , m_sampleRate(sampleRate)
     , m_compressor(sampleRate, numberOfChannels)
 {
     // Uninitialized state - for parameter recalculation.
@@ -53,12 +54,20 @@ DynamicsCompressor::DynamicsCompressor(float sampleRate, unsigned numberOfChanne
     initializeParameters();
 }
 
+void DynamicsCompressor::setParameterValue(unsigned parameterID, float value)
+{
+    ASSERT(parameterID < ParamLast);
+    if (parameterID < ParamLast)
+        m_parameters[parameterID] = value;
+}
+
 void DynamicsCompressor::initializeParameters()
 {
     // Initializes compressor to default values.
     
     m_parameters[ParamThreshold] = -24; // dB
-    m_parameters[ParamHeadroom] = 21; // dB
+    m_parameters[ParamKnee] = 30; // dB
+    m_parameters[ParamRatio] = 12; // unit-less
     m_parameters[ParamAttack] = 0.003f; // seconds
     m_parameters[ParamRelease] = 0.250f; // seconds
     m_parameters[ParamPreDelay] = 0.006f; // seconds
@@ -74,6 +83,7 @@ void DynamicsCompressor::initializeParameters()
     m_parameters[ParamFilterAnchor] = 15000 / nyquist();
     
     m_parameters[ParamPostGain] = 0; // dB
+    m_parameters[ParamReduction] = 0; // dB
 
     // Linear crossfade (0 -> 1).
     m_parameters[ParamEffectBlend] = 1;
@@ -180,7 +190,8 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
     }
 
     float dbThreshold = parameterValue(ParamThreshold);
-    float dbHeadroom = parameterValue(ParamHeadroom);
+    float dbKnee = parameterValue(ParamKnee);
+    float ratio = parameterValue(ParamRatio);
     float attackTime = parameterValue(ParamAttack);
     float releaseTime = parameterValue(ParamRelease);
     float preDelayTime = parameterValue(ParamPreDelay);
@@ -206,7 +217,8 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
                          framesToProcess,
 
                          dbThreshold,
-                         dbHeadroom,
+                         dbKnee,
+                         ratio,
                          attackTime,
                          releaseTime,
                          preDelayTime,
@@ -218,6 +230,9 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
                          releaseZone3,
                          releaseZone4
                          );
+                         
+    // Update the compression amount.                     
+    setParameterValue(ParamReduction, m_compressor.meteringGain());
 
     // Apply de-emphasis filter.
     for (unsigned i = 0; i < numberOfChannels; ++i) {
diff --git a/Source/WebCore/platform/audio/DynamicsCompressor.h b/Source/WebCore/platform/audio/DynamicsCompressor.h
index d949f3068..b35294d6a 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressor.h
+++ b/Source/WebCore/platform/audio/DynamicsCompressor.h
@@ -48,7 +48,8 @@ class DynamicsCompressor {
 public:
     enum {
         ParamThreshold,
-        ParamHeadroom,
+        ParamKnee,
+        ParamRatio,
         ParamAttack,
         ParamRelease,
         ParamPreDelay,
@@ -61,6 +62,7 @@ public:
         ParamFilterStageRatio,
         ParamFilterAnchor,
         ParamEffectBlend,
+        ParamReduction,
         ParamLast
     };
 
@@ -70,6 +72,7 @@ public:
     void reset();
     void setNumberOfChannels(unsigned);
 
+    void setParameterValue(unsigned parameterID, float value);
     float parameterValue(unsigned parameterID);
 
     float sampleRate() const { return m_sampleRate; }
diff --git a/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp b/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
index 3e943d120..9d4e30cfb 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
+++ b/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
@@ -45,25 +45,30 @@ using namespace AudioUtilities;
 
 // Metering hits peaks instantly, but releases this fast (in seconds).
 const float meteringReleaseTimeConstant = 0.325f;
-    
-// Exponential saturation curve.
-static float saturate(float x, float k)
-{
-    return 1 - exp(-k * x);
-}
+
+const float uninitializedValue = -1;
 
 DynamicsCompressorKernel::DynamicsCompressorKernel(float sampleRate, unsigned numberOfChannels)
     : m_sampleRate(sampleRate)
     , m_lastPreDelayFrames(DefaultPreDelayFrames)
     , m_preDelayReadIndex(0)
     , m_preDelayWriteIndex(DefaultPreDelayFrames)
+    , m_ratio(uninitializedValue)
+    , m_slope(uninitializedValue)
+    , m_linearThreshold(uninitializedValue)
+    , m_dbThreshold(uninitializedValue)
+    , m_dbKnee(uninitializedValue)
+    , m_kneeThreshold(uninitializedValue)
+    , m_kneeThresholdDb(uninitializedValue)
+    , m_ykneeThresholdDb(uninitializedValue)
+    , m_K(uninitializedValue)
 {
     setNumberOfChannels(numberOfChannels);
 
     // Initializes most member variables
     reset();
-    
-    m_meteringReleaseK = discreteTimeConstantForSampleRate(meteringReleaseTimeConstant, sampleRate);
+
+    m_meteringReleaseK = static_cast<float>(discreteTimeConstantForSampleRate(meteringReleaseTimeConstant, sampleRate));
 }
 
 void DynamicsCompressorKernel::setNumberOfChannels(unsigned numberOfChannels)
@@ -82,7 +87,7 @@ void DynamicsCompressorKernel::setPreDelayTime(float preDelayTime)
     unsigned preDelayFrames = preDelayTime * sampleRate();
     if (preDelayFrames > MaxPreDelayFrames - 1)
         preDelayFrames = MaxPreDelayFrames - 1;
-        
+
     if (m_lastPreDelayFrames != preDelayFrames) {
         m_lastPreDelayFrames = preDelayFrames;
         for (unsigned i = 0; i < m_preDelayBuffers.size(); ++i)
@@ -93,13 +98,117 @@ void DynamicsCompressorKernel::setPreDelayTime(float preDelayTime)
     }
 }
 
+// Exponential curve for the knee.
+// It is 1st derivative matched at m_linearThreshold and asymptotically approaches the value m_linearThreshold + 1 / k.
+float DynamicsCompressorKernel::kneeCurve(float x, float k)
+{
+    // Linear up to threshold.
+    if (x < m_linearThreshold)
+        return x;
+
+    return m_linearThreshold + (1 - expf(-k * (x - m_linearThreshold))) / k;
+}
+
+// Full compression curve with constant ratio after knee.
+float DynamicsCompressorKernel::saturate(float x, float k)
+{
+    float y;
+
+    if (x < m_kneeThreshold)
+        y = kneeCurve(x, k);
+    else {
+        // Constant ratio after knee.
+        float xDb = linearToDecibels(x);
+        float yDb = m_ykneeThresholdDb + m_slope * (xDb - m_kneeThresholdDb);
+
+        y = decibelsToLinear(yDb);
+    }
+
+    return y;
+}
+
+// Approximate 1st derivative with input and output expressed in dB.
+// This slope is equal to the inverse of the compression "ratio".
+// In other words, a compression ratio of 20 would be a slope of 1/20.
+float DynamicsCompressorKernel::slopeAt(float x, float k)
+{
+    if (x < m_linearThreshold)
+        return 1;
+
+    float x2 = x * 1.001;
+
+    float xDb = linearToDecibels(x);
+    float x2Db = linearToDecibels(x2);
+
+    float yDb = linearToDecibels(kneeCurve(x, k));
+    float y2Db = linearToDecibels(kneeCurve(x2, k));
+
+    float m = (y2Db - yDb) / (x2Db - xDb);
+
+    return m;
+}
+
+float DynamicsCompressorKernel::kAtSlope(float desiredSlope)
+{
+    float xDb = m_dbThreshold + m_dbKnee;
+    float x = decibelsToLinear(xDb);
+
+    // Approximate k given initial values.
+    float minK = 0.1;
+    float maxK = 10000;
+    float k = 5;
+
+    for (int i = 0; i < 15; ++i) {
+        // A high value for k will more quickly asymptotically approach a slope of 0.
+        float slope = slopeAt(x, k);
+
+        if (slope < desiredSlope) {
+            // k is too high.
+            maxK = k;
+        } else {
+            // k is too low.
+            minK = k;
+        }
+
+        // Re-calculate based on geometric mean.
+        k = sqrtf(minK * maxK);
+    }
+
+    return k;
+}
+
+float DynamicsCompressorKernel::updateStaticCurveParameters(float dbThreshold, float dbKnee, float ratio)
+{
+    if (dbThreshold != m_dbThreshold || dbKnee != m_dbKnee || ratio != m_ratio) {
+        // Threshold and knee.
+        m_dbThreshold = dbThreshold;
+        m_linearThreshold = decibelsToLinear(dbThreshold);
+        m_dbKnee = dbKnee;
+
+        // Compute knee parameters.
+        m_ratio = ratio;
+        m_slope = 1 / m_ratio;
+
+        float k = kAtSlope(1 / m_ratio);
+
+        m_kneeThresholdDb = dbThreshold + dbKnee;
+        m_kneeThreshold = decibelsToLinear(m_kneeThresholdDb);
+
+        m_ykneeThresholdDb = linearToDecibels(kneeCurve(m_kneeThreshold, k));
+
+        m_K = k;
+    }
+    return m_K;
+}
+
 void DynamicsCompressorKernel::process(float* sourceChannels[],
                                        float* destinationChannels[],
                                        unsigned numberOfChannels,
                                        unsigned framesToProcess,
 
                                        float dbThreshold,
-                                       float dbHeadroom,
+                                       float dbKnee,
+                                       float ratio,
                                        float attackTime,
                                        float releaseTime,
                                        float preDelayTime,
@@ -119,17 +228,12 @@ void DynamicsCompressorKernel::process(float* sourceChannels[],
     float dryMix = 1 - effectBlend;
     float wetMix = effectBlend;
 
-    // Threshold and headroom.
-    float linearThreshold = decibelsToLinear(dbThreshold);
-    float linearHeadroom = decibelsToLinear(dbHeadroom);
+    float k = updateStaticCurveParameters(dbThreshold, dbKnee, ratio);
 
     // Makeup gain.
-    float maximum = 1.05f * linearHeadroom * linearThreshold;
-    float kk = (maximum - linearThreshold);
-    float inverseKK = 1 / kk;
-
-    float fullRangeGain = (linearThreshold + kk * saturate(1 - linearThreshold, 1));
+    float fullRangeGain = saturate(1, k);
     float fullRangeMakeupGain = 1 / fullRangeGain;
+
     // Empirical/perceptual tuning.
     fullRangeMakeupGain = powf(fullRangeMakeupGain, 0.6f);
 
@@ -141,7 +245,7 @@ void DynamicsCompressorKernel::process(float* sourceChannels[],
 
     // Release parameters.
     float releaseFrames = sampleRate * releaseTime;
-    
+
     // Detector release time.
     float satReleaseTime = 0.0025f;
     float satReleaseFrames = satReleaseTime * sampleRate;
@@ -170,7 +274,7 @@ void DynamicsCompressorKernel::process(float* sourceChannels[],
     // y calculates adaptive release frames depending on the amount of compression.
 
     setPreDelayTime(preDelayTime);
-    
+
     const int nDivisionFrames = 32;
 
     const int nDivisions = framesToProcess / nDivisionFrames;
@@ -285,9 +389,10 @@ void DynamicsCompressorKernel::process(float* sourceChannels[],
                 float absInput = scaledInput > 0 ? scaledInput : -scaledInput;
 
                 // Put through shaping curve.
-                // This is linear up to the threshold, then exponentially approaches the maximum (headroom amount above threshold).
-                // The transition from the threshold to the exponential portion is smooth (1st derivative matched).
-                float shapedInput = absInput < linearThreshold ? absInput : linearThreshold + kk * saturate(absInput - linearThreshold, inverseKK);
+                // This is linear up to the threshold, then enters a "knee" portion followed by the "ratio" portion.
+                // The transition from the threshold to the knee is smooth (1st derivative matched).
+                // The transition from the knee to the ratio portion is smooth (1st derivative matched).
+                float shapedInput = saturate(absInput, k);
 
                 float attenuation = absInput <= 0.0001f ? 1 : shapedInput / absInput;
 
diff --git a/Source/WebCore/platform/audio/DynamicsCompressorKernel.h b/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
index da8e4c8be..645425104 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
+++ b/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
@@ -49,7 +49,8 @@ public:
                  unsigned framesToProcess,
 
                  float dbThreshold,
-                 float dbHeadroom,
+                 float dbKnee,
+                 float ratio,
                  float attackTime,
                  float releaseTime,
                  float preDelayTime,
@@ -68,6 +69,8 @@ public:
 
     float sampleRate() const { return m_sampleRate; }
 
+    float meteringGain() const { return m_meteringGain; }
+
 protected:
     float m_sampleRate;
 
@@ -90,6 +93,35 @@ protected:
     int m_preDelayWriteIndex;
 
     float m_maxAttackCompressionDiffDb;
+
+    // Static compression curve.
+    float kneeCurve(float x, float k);
+    float saturate(float x, float k);
+    float slopeAt(float x, float k);
+    float kAtSlope(float desiredSlope);
+
+    float updateStaticCurveParameters(float dbThreshold, float dbKnee, float ratio);
+
+    // Amount of input change in dB required for 1 dB of output change.
+    // This applies to the portion of the curve above m_kneeThresholdDb (see below).
+    float m_ratio;
+    float m_slope; // Inverse ratio.
+
+    // The input to output change below the threshold is linear 1:1.
+    float m_linearThreshold;
+    float m_dbThreshold;
+
+    // m_dbKnee is the number of dB above the threshold before we enter the "ratio" portion of the curve.
+    // m_kneeThresholdDb = m_dbThreshold + m_dbKnee
+    // The portion between m_dbThreshold and m_kneeThresholdDb is the "soft knee" portion of the curve
+    // which transitions smoothly from the linear portion to the ratio portion.
+    float m_dbKnee;
+    float m_kneeThreshold;
+    float m_kneeThresholdDb;
+    float m_ykneeThresholdDb;
+
+    // Internal parameter for the knee portion of the curve.
+    float m_K;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/audio/VectorMath.cpp b/Source/WebCore/platform/audio/VectorMath.cpp
index 5693c1b89..60be4e0c1 100644
--- a/Source/WebCore/platform/audio/VectorMath.cpp
+++ b/Source/WebCore/platform/audio/VectorMath.cpp
@@ -117,7 +117,7 @@ void vsma(const float* sourceP, int sourceStride, const float* scale, float* des
     if ((sourceStride == 1) && (destStride == 1)) {
         float k = *scale;
 
-        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed seperately.
+        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed separately.
         while ((reinterpret_cast<uintptr_t>(sourceP) & 0x0F) && n) {
             *destP += k * *sourceP;
             sourceP++;
@@ -125,9 +125,9 @@ void vsma(const float* sourceP, int sourceStride, const float* scale, float* des
             n--;
         }
 
-        // Now the sourceP address aligned and start to apply SSE.
+        // Now the sourceP is aligned, use SSE.
         int tailFrames = n % 4;
-        float* endP = destP + n - tailFrames;
+        const float* endP = destP + n - tailFrames;
 
         __m128 pSource;
         __m128 dest;
@@ -172,7 +172,7 @@ void vsmul(const float* sourceP, int sourceStride, const float* scale, float* de
         int n = framesToProcess;
         float k = *scale;
 
-        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed seperately.
+        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed separately.
         while ((reinterpret_cast<size_t>(sourceP) & 0x0F) && n) {
             *destP = k * *sourceP;
             sourceP++;
@@ -237,7 +237,7 @@ void vadd(const float* source1P, int sourceStride1, const float* source2P, int s
 
         int n = framesToProcess;
 
-        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed seperately.
+        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed separately.
         while ((reinterpret_cast<size_t>(source1P) & 0x0F) && n) {
             *destP = *source1P + *source2P;
             source1P++;
@@ -335,8 +335,7 @@ void vmul(const float* source1P, int sourceStride1, const float* source2P, int s
 
 #ifdef __SSE2__
     if ((sourceStride1 == 1) && (sourceStride2 == 1) && (destStride == 1)) {
-
-        // If the source1P address is not 16-byte aligned, the first several frames (at most three) should be processed seperately.
+        // If the source1P address is not 16-byte aligned, the first several frames (at most three) should be processed separately.
         while ((reinterpret_cast<uintptr_t>(source1P) & 0x0F) && n) {
             *destP = *source1P * *source2P;
             source1P++;
@@ -347,7 +346,7 @@ void vmul(const float* source1P, int sourceStride1, const float* source2P, int s
 
         // Now the source1P address aligned and start to apply SSE.
         int tailFrames = n % 4;
-        float* endP = destP + n - tailFrames;
+        const float* endP = destP + n - tailFrames;
         __m128 pSource1;
         __m128 pSource2;
         __m128 dest;
@@ -430,9 +429,40 @@ void zvmul(const float* real1P, const float* imag1P, const float* real2P, const
 
 void vsvesq(const float* sourceP, int sourceStride, float* sumP, size_t framesToProcess)
 {
-    // FIXME: optimize for SSE
     int n = framesToProcess;
     float sum = 0;
+
+#ifdef __SSE2__ 
+    if (sourceStride == 1) { 
+        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed separately. 
+        while ((reinterpret_cast<uintptr_t>(sourceP) & 0x0F) && n) { 
+            float sample = *sourceP; 
+            sum += sample * sample; 
+            sourceP++; 
+            n--; 
+        } 
+ 
+        // Now the sourceP is aligned, use SSE.
+        int tailFrames = n % 4; 
+        const float* endP = sourceP + n - tailFrames; 
+        __m128 source; 
+        __m128 mSum = _mm_setzero_ps(); 
+ 
+        while (sourceP < endP) { 
+            source = _mm_load_ps(sourceP); 
+            source = _mm_mul_ps(source, source); 
+            mSum = _mm_add_ps(mSum, source); 
+            sourceP += 4; 
+        } 
+ 
+        // Summarize the SSE results. 
+        const float* groupSumP = reinterpret_cast<float*>(&mSum); 
+        sum += groupSumP[0] + groupSumP[1] + groupSumP[2] + groupSumP[3]; 
+ 
+        n = tailFrames; 
+    } 
+#endif
+
     while (n--) {
         float sample = *sourceP;
         sum += sample * sample;
@@ -445,9 +475,45 @@ void vsvesq(const float* sourceP, int sourceStride, float* sumP, size_t framesTo
 
 void vmaxmgv(const float* sourceP, int sourceStride, float* maxP, size_t framesToProcess)
 {
-    // FIXME: optimize for SSE
     int n = framesToProcess;
     float max = 0;
+
+#ifdef __SSE2__
+    if (sourceStride == 1) {
+        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed separately.
+        while ((reinterpret_cast<uintptr_t>(sourceP) & 0x0F) && n) {
+            max = std::max(max, fabsf(*sourceP));
+            sourceP++;
+            n--;
+        }
+
+        // Now the sourceP is aligned, use SSE.
+        int tailFrames = n % 4;
+        const float* endP = sourceP + n - tailFrames;
+        __m128 source;
+        __m128 mMax = _mm_setzero_ps();
+        int mask = 0x7FFFFFFF;
+        __m128 mMask = _mm_set1_ps(*reinterpret_cast<float*>(&mask));
+
+        while (sourceP < endP) {
+            source = _mm_load_ps(sourceP);
+            // Calculate the absolute value by anding source with mask, the sign bit is set to 0.
+            source = _mm_and_ps(source, mMask);
+            mMax = _mm_max_ps(mMax, source);
+            sourceP += 4;
+        }
+
+        // Get max from the SSE results.
+        const float* groupMaxP = reinterpret_cast<float*>(&mMax);
+        max = std::max(max, groupMaxP[0]);
+        max = std::max(max, groupMaxP[1]);
+        max = std::max(max, groupMaxP[2]);
+        max = std::max(max, groupMaxP[3]);
+
+        n = tailFrames;
+    }
+#endif
+
     while (n--) {
         max = std::max(max, fabsf(*sourceP));
         sourceP += sourceStride;
diff --git a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
index b224d5cb0..66b7710d1 100644
--- a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
@@ -19,7 +19,6 @@
 #include "config.h"
 #include "ClipboardBlackBerry.h"
 
-#include "DOMStringList.h"
 #include "FileList.h"
 #include "NotImplemented.h"
 
@@ -56,9 +55,8 @@ void ClipboardBlackBerry::clearAllData()
     BlackBerry::Platform::Clipboard::clearClipboard();
 }
 
-String ClipboardBlackBerry::getData(const String& type, bool& success) const
+String ClipboardBlackBerry::getData(const String& type) const
 {
-    success = true;
     return String::fromUTF8(BlackBerry::Platform::Clipboard::readClipboardByType(type.utf8().data()).c_str());
 }
 
@@ -73,14 +71,14 @@ bool ClipboardBlackBerry::setData(const String& type, const String& text)
     return true;
 }
 
-PassRefPtr<DOMStringList> ClipboardBlackBerry::types() const
+HashSet<String> ClipboardBlackBerry::types() const
 {
     // We use hardcoded list here since there seems to be no API to get the list.
-    RefPtr<DOMStringList> ret = DOMStringList::create();
-    ret->append("text/plain");
-    ret->append("text/html");
-    ret->append("text/url");
-    return ret.release();
+    HashSet<String> ret;
+    ret.add("text/plain");
+    ret.add("text/html");
+    ret.add("text/url");
+    return ret;
 }
 
 PassRefPtr<FileList> ClipboardBlackBerry::files() const
diff --git a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
index 255d6aa28..fed1627e0 100644
--- a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
+++ b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
@@ -32,11 +32,11 @@ public:
 
     void clearData(const String& type);
     void clearAllData();
-    String getData(const String& type, bool& success) const;
+    String getData(const String& type) const;
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual PassRefPtr<DOMStringList> types() const;
+    virtual HashSet<String> types() const;
     virtual PassRefPtr<FileList> files() const;
     virtual DragImageRef createDragImage(IntPoint&) const;
     virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*);
diff --git a/Source/WebCore/platform/blackberry/CookieManager.cpp b/Source/WebCore/platform/blackberry/CookieManager.cpp
index d79380fd9..34b9ff05f 100644
--- a/Source/WebCore/platform/blackberry/CookieManager.cpp
+++ b/Source/WebCore/platform/blackberry/CookieManager.cpp
@@ -120,7 +120,7 @@ CookieManager::~CookieManager()
 static bool cookieSorter(ParsedCookie* a, ParsedCookie* b)
 {
     if (a->path().length() == b->path().length())
-        return a->creationTime() <= b->creationTime();
+        return a->creationTime() < b->creationTime();
     return a->path().length() > b->path().length();
 }
 
@@ -218,6 +218,41 @@ String CookieManager::getCookie(const KURL& url, CookieFilter filter) const
     return cookieStringBuilder.toString();
 }
 
+String CookieManager::generateHtmlFragmentForCookies()
+{
+    CookieLog("CookieManager - generateHtmlFragmentForCookies\n");
+
+    Vector<ParsedCookie*> cookieCandidates;
+    for (HashMap<String, CookieMap*>::iterator it = m_managerMap.begin(); it != m_managerMap.end(); ++it)
+        it->second->getAllChildCookies(&cookieCandidates);
+
+    String result;
+    ParsedCookie* cookie = 0;
+    result.append(String("<table style=\"word-wrap:break-word\" cellSpacing=\"0\" cellPadding=\"0\" border=\"1\"><tr><th>Domain</th><th>Path</th><th>Protocol</th><th>Name</th><th>Value</th><th>Secure</th><th>HttpOnly</th><th>Session</th></tr>"));
+    for (size_t i = 0; i < cookieCandidates.size(); ++i) {
+        cookie = cookieCandidates[i];
+        result.append(String("<tr><td align=\"center\">"));
+        result.append(cookie->domain());
+        result.append(String("<td align=\"center\">"));
+        result.append(cookie->path());
+        result.append(String("<td align=\"center\">"));
+        result.append(cookie->protocol());
+        result.append(String("<td align=\"center\">"));
+        result.append(cookie->name());
+        result.append(String("<td align=\"center\" style= \"word-break:break-all\">"));
+        result.append(cookie->value());
+        result.append(String("<td align=\"center\">"));
+        result.append(String(cookie->isSecure() ? "Yes" : "No"));
+        result.append(String("<td align=\"center\">"));
+        result.append(String(cookie->isHttpOnly() ? "Yes" : "No"));
+        result.append(String("<td align=\"center\">"));
+        result.append(String(cookie->isSession() ? "Yes" : "No"));
+        result.append(String("</td></tr>"));
+    }
+    result.append(String("</table>"));
+    return result;
+}
+
 void CookieManager::getRawCookies(Vector<ParsedCookie*> &stackOfCookies, const KURL& requestURL, CookieFilter filter) const
 {
     CookieLog("CookieManager - getRawCookies - processing url with domain - %s & protocol: %s & path: %s\n", requestURL.host().utf8().data(), requestURL.protocol().utf8().data(), requestURL.path().utf8().data());
@@ -300,7 +335,7 @@ void CookieManager::getRawCookies(Vector<ParsedCookie*> &stackOfCookies, const K
         }
     }
 
-    std::sort(stackOfCookies.begin(), stackOfCookies.end(), cookieSorter);
+    std::stable_sort(stackOfCookies.begin(), stackOfCookies.end(), cookieSorter);
 }
 
 void CookieManager::removeAllCookies(BackingStoreRemovalPolicy backingStoreRemoval)
@@ -370,32 +405,59 @@ void CookieManager::checkAndTreatCookie(ParsedCookie* candidateCookie, BackingSt
         if (postToBackingStore == BackingStoreCookieEntry)
             m_cookieBackingStore->remove(candidateCookie);
         else if (curMap) {
-            bool cookieAlreadyExists = curMap->existsCookie(candidateCookie);
-            if (cookieAlreadyExists) {
-                CookieLog("CookieManager - expired cookie exists in memory");
-                ParsedCookie* expired = curMap->removeCookie(candidateCookie);
-                // Cookie is useless, Remove the cookie from the backingstore if it exists
-                // Backup check for BackingStoreCookieEntry incase someone incorrectly uses this enum
-                if (postToBackingStore != BackingStoreCookieEntry && !expired->isSession()) {
-                    CookieLog("CookieManager - expired cookie is nonsession, deleting from db");
-                    m_cookieBackingStore->remove(expired);
-                }
-                delete expired;
+            // RemoveCookie will return 0 if the cookie doesn't exist.
+            ParsedCookie* expired = curMap->removeCookie(candidateCookie);
+            // Cookie is useless, Remove the cookie from the backingstore if it exists.
+            // Backup check for BackingStoreCookieEntry incase someone incorrectly uses this enum.
+            if (expired && postToBackingStore != BackingStoreCookieEntry && !expired->isSession()) {
+                CookieLog("CookieManager - expired cookie is nonsession, deleting from db");
+                m_cookieBackingStore->remove(expired);
             }
+            delete expired;
+
         } else
             delete candidateCookie;
     } else {
         ASSERT(curMap);
-        bool cookieAlreadyExists = curMap->existsCookie(candidateCookie);
-        if (cookieAlreadyExists)
-            update(curMap, candidateCookie, postToBackingStore);
-        else
-            addCookieToMap(curMap, candidateCookie, postToBackingStore);
+        addCookieToMap(curMap, candidateCookie, postToBackingStore);
     }
 }
 
 void CookieManager::addCookieToMap(CookieMap* targetMap, ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore)
 {
+    ParsedCookie* prevCookie = targetMap->addOrReplaceCookie(candidateCookie);
+    if (prevCookie) {
+
+        CookieLog("CookieManager - updating new cookie - %s.\n", candidateCookie->toString().utf8().data());
+
+        // A cookie was replaced in targetMap.
+        // If old cookie is non-session and new one is, we have to delete it from backingstore
+        // If new cookie is non-session and old one is, we have to add it to backingstore
+        // If both sessions are non-session, then we update it in the backingstore
+        bool newIsSession = candidateCookie->isSession();
+        bool oldIsSession = prevCookie->isSession();
+
+        if (postToBackingStore == RemoveFromBackingStore) {
+            if (!newIsSession && !oldIsSession)
+                m_cookieBackingStore->update(candidateCookie);
+            else if (newIsSession && !oldIsSession) {
+                // Must manually decrease the counter because it was not counted when
+                // the cookie was removed in cookieVector.
+                removedCookie();
+                m_cookieBackingStore->remove(prevCookie);
+            } else if (!newIsSession && oldIsSession) {
+                // Must manually increase the counter because it was not counted when
+                // the cookie was added in cookieVector.
+                addedCookie();
+                m_cookieBackingStore->insert(candidateCookie);
+            }
+        }
+        delete prevCookie;
+        return;
+    }
+
+    CookieLog("CookieManager - adding new cookie - %s.\n", candidateCookie->toString().utf8().data());
+
     ParsedCookie* oldestCookie = 0;
     // Check if we have not reached the per cookie domain limit.
     // If that is not true, we check if the global limit has been reached if backingstore mode is on
@@ -408,18 +470,14 @@ void CookieManager::addCookieToMap(CookieMap* targetMap, ParsedCookie* candidate
     //    then it means the global count will never exceed the limit
 
     CookieLimitLog("CookieManager - local count: %d  global count: %d", targetMap->count(), m_count);
-    if (targetMap->count() >= s_maxCookieCountPerHost) {
+    if (targetMap->count() > s_maxCookieCountPerHost) {
         CookieLog("CookieManager - deleting oldest cookie from this map due to domain count.\n");
         oldestCookie = targetMap->removeOldestCookie();
-    } else if (m_count >= s_globalMaxCookieCount && (postToBackingStore != DoNotRemoveFromBackingStore)) {
+    } else if (m_count > s_globalMaxCookieCount && (postToBackingStore != DoNotRemoveFromBackingStore)) {
         CookieLimitLog("CookieManager - Global limit reached, initiate cookie limit clean up.");
         initiateCookieLimitCleanUp();
     }
 
-    CookieLog("CookieManager - adding new cookie - %s.\n", candidateCookie->toString().utf8().data());
-
-    targetMap->addCookie(candidateCookie);
-
     // Only add non session cookie to the backing store.
     if (postToBackingStore == RemoveFromBackingStore) {
         if (oldestCookie && !oldestCookie->isSession()) {
@@ -433,38 +491,6 @@ void CookieManager::addCookieToMap(CookieMap* targetMap, ParsedCookie* candidate
         delete oldestCookie;
 }
 
-void CookieManager::update(CookieMap* targetMap, ParsedCookie* newCookie, BackingStoreRemovalPolicy postToBackingStore)
-{
-    // If old cookie is non-session and new one is, we have to delete it from backingstore
-    // If new cookie is non-session and old one is, we have to add it to backingstore
-    // If both sessions are non-session, then we update it in the backingstore
-
-    CookieLog("CookieManager - updating new cookie - %s.\n", newCookie->toString().utf8().data());
-
-    ParsedCookie* oldCookie = targetMap->updateCookie(newCookie);
-
-    ASSERT(oldCookie);
-
-    if (postToBackingStore == RemoveFromBackingStore) {
-        bool newIsSession = newCookie->isSession();
-        bool oldIsSession = oldCookie->isSession();
-        if (!newIsSession && !oldIsSession)
-            m_cookieBackingStore->update(newCookie);
-        else if (newIsSession && !oldIsSession) {
-            // Must manually decrease the counter because it was not counted when
-            // the cookie was removed in cookieMap.
-            removedCookie();
-            m_cookieBackingStore->remove(oldCookie);
-        } else if (!newIsSession && oldIsSession) {
-            // Must manually increase the counter because it was not counted when
-            // the cookie was added in cookieMap.
-            addedCookie();
-            m_cookieBackingStore->insert(newCookie);
-        }
-    }
-    delete oldCookie;
-}
-
 void CookieManager::getBackingStoreCookies()
 {
     // This method should be called just after having created the cookieManager
diff --git a/Source/WebCore/platform/blackberry/CookieManager.h b/Source/WebCore/platform/blackberry/CookieManager.h
index b97b9f962..4dcd3f477 100644
--- a/Source/WebCore/platform/blackberry/CookieManager.h
+++ b/Source/WebCore/platform/blackberry/CookieManager.h
@@ -103,6 +103,7 @@ public:
     CookieStorageAcceptPolicy cookiePolicy() const { return m_policy; }
     void setPrivateMode(const bool);
 
+    String generateHtmlFragmentForCookies();
     String getCookie(const KURL& requestURL, CookieFilter) const;
 
     // Returns all cookies that are associated with the specified URL as raw cookies.
@@ -120,8 +121,7 @@ private:
 
     bool shouldRejectForSecurityReason(const ParsedCookie*, const KURL&);
 
-    void addCookieToMap(CookieMap*, ParsedCookie*, BackingStoreRemovalPolicy);
-    void update(CookieMap*, ParsedCookie*, BackingStoreRemovalPolicy);
+    void addCookieToMap(CookieMap* targetMap, ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore);
 
     CookieMap* findOrCreateCookieMap(CookieMap* protocolMap, const String& domain, bool findOnly);
 
diff --git a/Source/WebCore/platform/blackberry/CookieMap.cpp b/Source/WebCore/platform/blackberry/CookieMap.cpp
index 4c6d541ad..b217b2e48 100644
--- a/Source/WebCore/platform/blackberry/CookieMap.cpp
+++ b/Source/WebCore/platform/blackberry/CookieMap.cpp
@@ -54,45 +54,35 @@ CookieMap::~CookieMap()
     deleteAllCookiesAndDomains();
 }
 
-bool CookieMap::existsCookie(const ParsedCookie* cookie) const
+ParsedCookie* CookieMap::addOrReplaceCookie(ParsedCookie* cookie)
 {
-    String key = cookie->name() + cookie->path();
-    return m_cookieMap.contains(key);
-}
-
-void CookieMap::addCookie(ParsedCookie* cookie)
-{
-    String key = cookie->name() + cookie->path();
-
     CookieLog("CookieMap - Attempting to add cookie - %s", cookie->name().utf8().data());
 
-    ASSERT(!m_cookieMap.contains(key));
-    m_cookieMap.add(key, cookie);
+    ParsedCookie* prevCookie = 0;
+    size_t cookieCount = m_cookieVector.size();
+    for (size_t i = 0; i < cookieCount; i++) {
+        if (m_cookieVector[i]->name() == cookie->name() && m_cookieVector[i]->path() == cookie->path()) {
+            prevCookie = m_cookieVector[i];
+            m_cookieVector[i] = cookie;
+            if (prevCookie == m_oldestCookie)
+                updateOldestCookie();
+            return prevCookie;
+        }
+    }
+
+    m_cookieVector.append(cookie);
     if (!cookie->isSession())
         cookieManager().addedCookie();
     if (!m_oldestCookie || m_oldestCookie->lastAccessed() > cookie->lastAccessed())
         m_oldestCookie = cookie;
+    return 0;
 }
 
-ParsedCookie* CookieMap::updateCookie(ParsedCookie* newCookie)
-{
-    String key = newCookie->name() + newCookie->path();
-    ParsedCookie* oldCookie = m_cookieMap.take(key);
-    ASSERT(oldCookie);
-    m_cookieMap.add(key, newCookie);
-    if (oldCookie == m_oldestCookie)
-        updateOldestCookie();
-    return oldCookie;
-}
-
-ParsedCookie* CookieMap::removeCookie(const ParsedCookie* cookie)
+ParsedCookie* CookieMap::removeCookieAtIndex(int position, const ParsedCookie* cookie)
 {
-    // Find a previous entry for deletion
-    String key = cookie->name() + cookie->path();
-    ParsedCookie* prevCookie = m_cookieMap.take(key);
-
-    if (!prevCookie)
-        return 0;
+    ASSERT(0 <= position && position < m_cookieVector.size());
+    ParsedCookie* prevCookie = m_cookieVector[position];
+    m_cookieVector.remove(position);
 
     if (prevCookie == m_oldestCookie)
         updateOldestCookie();
@@ -109,6 +99,16 @@ ParsedCookie* CookieMap::removeCookie(const ParsedCookie* cookie)
     return prevCookie;
 }
 
+ParsedCookie* CookieMap::removeCookie(const ParsedCookie* cookie)
+{
+    size_t cookieCount = m_cookieVector.size();
+    for (size_t position = 0; position < cookieCount; ++position) {
+        if (m_cookieVector[position]->name() == cookie->name() && m_cookieVector[position]->path() == cookie->path())
+            return removeCookieAtIndex(position, cookie);
+    }
+    return 0;
+}
+
 CookieMap* CookieMap::getSubdomainMap(const String& subdomain)
 {
 #if ENABLE_COOKIE_DEBUG
@@ -126,19 +126,22 @@ void CookieMap::addSubdomainMap(const String& subdomain, CookieMap* newDomain)
 
 void CookieMap::getAllCookies(Vector<ParsedCookie*>* stackOfCookies)
 {
-    CookieLog("CookieMap - Attempting to copy Map:%s cookies with %d cookies into vectors", m_name.utf8().data(), m_cookieMap.size());
+    CookieLog("CookieMap - Attempting to copy Map:%s cookies with %d cookies into vectors", m_name.utf8().data(), m_cookieVector.size());
+
+    stackOfCookies->reserveCapacity(stackOfCookies->size() + m_cookieVector.size());
 
-    Vector<ParsedCookie*> newCookies;
-    copyValuesToVector(m_cookieMap, newCookies);
-    for (size_t i = 0; i < newCookies.size(); i++) {
-        ParsedCookie* newCookie = newCookies[i];
+    size_t position = 0;
+    while (position < m_cookieVector.size()) {
+        ParsedCookie* newCookie = m_cookieVector[position];
         if (newCookie->hasExpired()) {
             // Notice that we don't delete from backingstore. These expired cookies will be
             // deleted when manager loads the backingstore again.
-            ParsedCookie* expired = removeCookie(newCookie);
+            ParsedCookie* expired = removeCookieAtIndex(position, newCookie);
             delete expired;
-        } else
+        } else {
             stackOfCookies->append(newCookie);
+            position++;
+        }
     }
 
     CookieLog("CookieMap - stack of cookies now have %d cookies in it", (*stackOfCookies).size());
@@ -177,15 +180,16 @@ ParsedCookie* CookieMap::removeOldestCookie()
 
 void CookieMap::updateOldestCookie()
 {
-    if (!m_cookieMap.size())
+    size_t size = m_cookieVector.size();
+    if (!size) {
         m_oldestCookie = 0;
-    else {
-        HashMap<String, ParsedCookie*>::iterator it = m_cookieMap.begin();
-        m_oldestCookie = it->second;
-        ++it;
-        for (; it != m_cookieMap.end(); ++it)
-            if (m_oldestCookie->lastAccessed() > it->second->lastAccessed())
-                m_oldestCookie = it->second;
+        return;
+    }
+
+    m_oldestCookie = m_cookieVector[0];
+    for (size_t i = 1; i < size; ++i) {
+        if (m_oldestCookie->lastAccessed() > m_cookieVector[i]->lastAccessed())
+            m_oldestCookie = m_cookieVector[i];
     }
 }
 
@@ -193,8 +197,8 @@ void CookieMap::deleteAllCookiesAndDomains()
 {
     deleteAllValues(m_subdomains);
     m_subdomains.clear();
-    deleteAllValues(m_cookieMap);
-    m_cookieMap.clear();
+    deleteAllValues(m_cookieVector);
+    m_cookieVector.clear();
 
     m_oldestCookie = 0;
 }
diff --git a/Source/WebCore/platform/blackberry/CookieMap.h b/Source/WebCore/platform/blackberry/CookieMap.h
index 73ba13fac..86968576d 100644
--- a/Source/WebCore/platform/blackberry/CookieMap.h
+++ b/Source/WebCore/platform/blackberry/CookieMap.h
@@ -51,17 +51,14 @@ public:
     CookieMap(const String& name = "");
     ~CookieMap();
 
-    unsigned int count() const { return m_cookieMap.size(); }
+    unsigned int count() const { return m_cookieVector.size(); }
     const String& getName() const { return m_name; }
 
-    void addCookie(ParsedCookie*);
-
     // Returning the original cookie object so manager can keep a reference to the updates in the database queue.
-    ParsedCookie* updateCookie(ParsedCookie*);
+    ParsedCookie* addOrReplaceCookie(ParsedCookie*);
 
     // Need to return the reference to the removed cookie so manager can deal with it (garbage collect).
     ParsedCookie* removeCookie(const ParsedCookie*);
-    bool existsCookie(const ParsedCookie*) const;
 
     // Returns a map with that given subdomain.
     CookieMap* getSubdomainMap(const String&);
@@ -74,11 +71,9 @@ public:
 
 private:
     void updateOldestCookie();
+    ParsedCookie* removeCookieAtIndex(int position, const ParsedCookie*);
 
-    // The key is the tuple (name, path).
-    // The spec asks to have also domain, which is implied by choosing the CookieMap relevant to the domain.
-    HashMap<String, ParsedCookie*> m_cookieMap;
-
+    Vector<ParsedCookie*> m_cookieVector;
     // The key is a subsection of the domain.
     // ex: if inserting accounts.google.com & this cookiemap is "com", this subdomain map will contain "google"
     // the "google" cookiemap will contain "accounts" in its subdomain map.
diff --git a/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp b/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
index a93e38109..7f5bef726 100644
--- a/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
@@ -21,6 +21,7 @@
 
 #include "IntSize.h"
 #include "NotImplemented.h"
+#include "PlatformString.h"
 #include <BlackBerryPlatformClient.h>
 #include <LocalizeResource.h>
 #include <wtf/Vector.h>
@@ -56,8 +57,7 @@ String submitButtonDefaultLabel()
 
 String inputElementAltText()
 {
-    notImplemented();
-    return String();
+    return String::fromUTF8(s_resource.getString(BlackBerry::Platform::SUBMIT_BUTTON_LABEL));
 }
 
 static String platformLanguage()
@@ -369,10 +369,9 @@ String searchMenuClearRecentSearchesText()
     return String();
 }
 
-String imageTitle(String const&, IntSize const&)
+String imageTitle(String const& filename, IntSize const& size)
 {
-    notImplemented();
-    return String();
+    return filename + " (" + String::number(size.width()) + "x" + String::number(size.height()) + ")";
 }
 
 String AXButtonActionVerb()
@@ -577,4 +576,9 @@ String defaultDetailsSummaryText()
     return String::fromUTF8(s_resource.getString(BlackBerry::Platform::DETAILS_SUMMARY));
 }
 
+String fileButtonNoFilesSelectedLabel()
+{
+    return String::fromUTF8(s_resource.getString(BlackBerry::Platform::FILE_BUTTON_NO_FILE_SELECTED_LABEL));
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp b/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp
index ba48f1cc6..71e48d01a 100644
--- a/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp
@@ -97,6 +97,9 @@ static const ExtensionMap extensionMap[] = {
     { "m3u8", "application/vnd.apple.mpegurl" },
     { "m3url", "audio/mpegurl" },
     { "m3u", "audio/mpegurl" },
+    { "flac", "audio/x-flac" },
+    { "ogg", "audio/ogg" },
+    { "oga", "audio/ogg" },
     // FIXME: wince also maps ttf and otf to text/plain. Should we do that too?
     { 0, 0 }
 };
diff --git a/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp b/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp
index 9365a6c43..98a420592 100644
--- a/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp
@@ -56,6 +56,11 @@ void Pasteboard::writeImage(Node*, KURL const&, String const&)
     notImplemented();
 }
 
+void Pasteboard::writeClipboard(Clipboard*)
+{
+    notImplemented();
+}
+
 void Pasteboard::writeSelection(Range* selectedRange, bool, Frame* frame)
 {
     std::string text = frame->editor()->selectedText().utf8().data();
diff --git a/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp b/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
index d26e55664..5ccc2aa39 100644
--- a/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
@@ -43,12 +43,12 @@ int screenDepth(Widget*)
 
 FloatRect screenAvailableRect(Widget* widget)
 {
-    return FloatRect(FloatPoint(), FloatSize(IntSize(BlackBerry::Platform::Graphics::Screen::size())));
+    return FloatRect(FloatPoint(), FloatSize(IntSize(BlackBerry::Platform::Graphics::Screen::primaryScreen()->size())));
 }
 
 FloatRect screenRect(Widget* widget)
 {
-    return FloatRect(FloatPoint(), FloatSize(IntSize(BlackBerry::Platform::Graphics::Screen::size())));
+    return FloatRect(FloatPoint(), FloatSize(IntSize(BlackBerry::Platform::Graphics::Screen::primaryScreen()->size())));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp b/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp
index 3e79d1032..5f5dbbcb2 100644
--- a/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp
@@ -40,6 +40,11 @@ static PlatformEvent::Type touchEventType(BlackBerry::Platform::TouchEvent* even
     case BlackBerry::Platform::TouchEvent::TouchCancel:
         return PlatformEvent::TouchCancel;
     }
+
+    ASSERT_NOT_REACHED();
+    // Returning TouchCancel just to satisfy the compiler's wish to return a valid type in a non-void function.
+    // This code should not be reached.
+    return PlatformEvent::TouchCancel;
 }
 
 PlatformTouchEvent::PlatformTouchEvent(BlackBerry::Platform::TouchEvent* event)
diff --git a/Source/WebCore/platform/blackberry/RunLoopBlackBerry.cpp b/Source/WebCore/platform/blackberry/RunLoopBlackBerry.cpp
new file mode 100644
index 000000000..e820788d6
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/RunLoopBlackBerry.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 ProFUSION embedded systems. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RunLoop.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+RunLoop::RunLoop()
+{
+    notImplemented();
+}
+
+RunLoop::~RunLoop()
+{
+    notImplemented();
+}
+
+void RunLoop::wakeUp()
+{
+    notImplemented();
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/cf/KURLCFNet.cpp b/Source/WebCore/platform/cf/KURLCFNet.cpp
index b3a58652b..fd8084b90 100644
--- a/Source/WebCore/platform/cf/KURLCFNet.cpp
+++ b/Source/WebCore/platform/cf/KURLCFNet.cpp
@@ -33,6 +33,8 @@ using namespace std;
 
 namespace WebCore {
 
+#if !USE(WTFURL)
+
 typedef Vector<char, 512> CharBuffer;
 
 CFURLRef createCFURLFromBuffer(const CharBuffer&);
@@ -91,4 +93,21 @@ String KURL::fileSystemPath() const
     return RetainPtr<CFStringRef>(AdoptCF, CFURLCopyFileSystemPath(cfURL.get(), pathStyle)).get();
 }
 #endif
+
+#else // USE(WTFURL)
+
+KURL::KURL(CFURLRef)
+{
+    // FIXME: Add WTFURL Implementation.
+    invalidate();
+}
+
+CFURLRef KURL::createCFURL() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+#endif // USE(WTFURL)
+
 }
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
index d6b73e5f0..c1b7aa281 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
@@ -101,36 +101,36 @@ bool ChromiumDataObject::hasData() const
         || m_fileContent;
 }
 
-PassRefPtr<DOMStringList> ChromiumDataObject::types() const
+HashSet<String> ChromiumDataObject::types() const
 {
-    RefPtr<DOMStringList> results = DOMStringList::create();
-
     if (m_storageMode == Pasteboard) {
         bool ignoredContainsFilenames;
-        HashSet<String> hashedResults = PlatformSupport::clipboardReadAvailableTypes(
-            currentPasteboardBuffer(), &ignoredContainsFilenames);
-        for (HashSet<String>::const_iterator it = hashedResults.begin(); it != hashedResults.end(); ++it)
-          results->append(*it);
-        return results.release();
+        return PlatformSupport::clipboardReadAvailableTypes(currentPasteboardBuffer(),
+                                                            &ignoredContainsFilenames);
     }
 
+    HashSet<String> results;
+
     if (!m_plainText.isEmpty()) {
-        results->append(mimeTypeText);
-        results->append(mimeTypeTextPlain);
+        results.add(mimeTypeText);
+        results.add(mimeTypeTextPlain);
     }
 
     if (!m_uriList.isEmpty())
-        results->append(mimeTypeTextURIList);
+        results.add(mimeTypeTextURIList);
 
     if (!m_textHtml.isEmpty())
-        results->append(mimeTypeTextHTML);
+        results.add(mimeTypeTextHTML);
+
+    if (!m_downloadMetadata.isEmpty())
+        results.add(mimeTypeDownloadURL);
 
     for (HashMap<String, String>::const_iterator::Keys it = m_customData.begin().keys();
          it != m_customData.end().keys(); ++it) {
-        results->append(*it);
+        results.add(*it);
     }
 
-    return results.release();
+    return results;
 }
 
 String ChromiumDataObject::getData(const String& type, bool& success) const
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.h b/Source/WebCore/platform/chromium/ChromiumDataObject.h
index 9a6f562d1..7e675bf93 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.h
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.h
@@ -31,11 +31,11 @@
 #ifndef ChromiumDataObject_h
 #define ChromiumDataObject_h
 
-#include "DOMStringList.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "SharedBuffer.h"
 #include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/text/StringHash.h>
@@ -75,7 +75,7 @@ public:
 
     bool hasData() const;
 
-    PassRefPtr<DOMStringList> types() const;
+    HashSet<String> types() const;
     String getData(const String& type, bool& success) const;
     bool setData(const String& type, const String& data);
 
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.cpp b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
index 1b1536e35..e238b2dfd 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -31,7 +31,6 @@
 #include "ChromiumDataObject.h"
 #include "ClipboardMimeTypes.h"
 #include "ClipboardUtilitiesChromium.h"
-#include "DOMStringList.h"
 #include "DataTransferItemChromium.h"
 #include "DataTransferItemListChromium.h"
 #include "Document.h"
@@ -263,16 +262,16 @@ void ClipboardChromium::clearAllData()
     m_dataObject->clearAll();
 }
 
-String ClipboardChromium::getData(const String& type, bool& success) const
+String ClipboardChromium::getData(const String& type) const
 {
-    success = false;
+    bool ignoredSuccess = false;
     if (policy() != ClipboardReadable || !m_dataObject)
         return String();
 
     if (isForCopyAndPaste() && platformClipboardChanged())
         return String();
 
-    return m_dataObject->getData(normalizeType(type), success);
+    return m_dataObject->getData(normalizeType(type), ignoredSuccess);
 }
 
 bool ClipboardChromium::setData(const String& type, const String& data)
@@ -290,20 +289,21 @@ bool ClipboardChromium::platformClipboardChanged() const
 }
 
 // extensions beyond IE's API
-PassRefPtr<DOMStringList> ClipboardChromium::types() const
+HashSet<String> ClipboardChromium::types() const
 {
+    HashSet<String> results;
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return DOMStringList::create();
+        return results;
 
     if (!m_dataObject)
-        return DOMStringList::create();
+        return results;
 
-    RefPtr<DOMStringList> results = m_dataObject->types();
+    results = m_dataObject->types();
 
     if (m_dataObject->containsFilenames())
-        results->append(mimeTypeFiles);
+        results.add(mimeTypeFiles);
 
-    return results.release();
+    return results;
 }
 
 PassRefPtr<FileList> ClipboardChromium::files() const
@@ -518,9 +518,9 @@ void ClipboardChromium::mayUpdateItems(Vector<RefPtr<DataTransferItem> >& items)
 
     if (isForCopyAndPaste() && policy() == ClipboardReadable) {
         // Iterate through the types and add them.
-        RefPtr<DOMStringList> types = m_dataObject->types();
-        for (size_t i = 0; i < types->length(); ++i)
-            items.append(DataTransferItemChromium::createFromPasteboard(this, scriptExecutionContext, types->item(i)));
+        HashSet<String> types = m_dataObject->types();
+        for (HashSet<String>::const_iterator it = types.begin(); it != types.end(); ++it)
+            items.append(DataTransferItemChromium::createFromPasteboard(this, scriptExecutionContext, *it));
         return;
     }
 
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.h b/Source/WebCore/platform/chromium/ClipboardChromium.h
index ae9eb711b..3777ad5c9 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.h
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.h
@@ -58,12 +58,12 @@ namespace WebCore {
 
         virtual void clearData(const String& type);
         void clearAllData();
-        String getData(const String& type, bool& success) const;
+        String getData(const String& type) const;
         bool setData(const String& type, const String& data);
         bool platformClipboardChanged() const;
 
         // extensions beyond IE's API
-        virtual PassRefPtr<DOMStringList> types() const;
+        virtual HashSet<String> types() const;
         virtual PassRefPtr<FileList> files() const;
 
         void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/chromium/DragDataChromium.cpp b/Source/WebCore/platform/chromium/DragDataChromium.cpp
index a7a853559..3d94a19b2 100644
--- a/Source/WebCore/platform/chromium/DragDataChromium.cpp
+++ b/Source/WebCore/platform/chromium/DragDataChromium.cpp
@@ -45,19 +45,19 @@ namespace WebCore {
 
 static bool containsHTML(const ChromiumDataObject* dropData)
 {
-    return dropData->types()->contains(mimeTypeTextHTML);
+    return dropData->types().contains(mimeTypeTextHTML);
 }
 
 bool DragData::containsURL(Frame*, FilenameConversionPolicy filenamePolicy) const
 {
-    return m_platformDragData->types()->contains(mimeTypeTextURIList)
+    return m_platformDragData->types().contains(mimeTypeTextURIList)
         || (filenamePolicy == ConvertFilenames && m_platformDragData->containsFilenames());
 }
 
 String DragData::asURL(Frame*, FilenameConversionPolicy filenamePolicy, String* title) const
 {
     String url;
-    if (m_platformDragData->types()->contains(mimeTypeTextURIList)) {
+    if (m_platformDragData->types().contains(mimeTypeTextURIList)) {
         bool ignoredSuccess;
         url = m_platformDragData->getData(mimeTypeURL, ignoredSuccess);
         if (title)
@@ -87,7 +87,7 @@ void DragData::asFilenames(Vector<String>& result) const
 
 bool DragData::containsPlainText() const
 {
-    return m_platformDragData->types()->contains(mimeTypeTextPlain);
+    return m_platformDragData->types().contains(mimeTypeTextPlain);
 }
 
 String DragData::asPlainText(Frame*) const
@@ -108,8 +108,8 @@ bool DragData::canSmartReplace() const
     // This is allowed whenever the drag data contains a 'range' (ie.,
     // ClipboardWin::writeRange is called).  For example, dragging a link
     // should not result in a space being added.
-    return m_platformDragData->types()->contains(mimeTypeTextPlain)
-        && !m_platformDragData->types()->contains(mimeTypeTextURIList);
+    return m_platformDragData->types().contains(mimeTypeTextPlain)
+        && !m_platformDragData->types().contains(mimeTypeTextURIList);
 }
 
 bool DragData::containsCompatibleContent() const
@@ -141,7 +141,7 @@ PassRefPtr<DocumentFragment> DragData::asFragment(Frame* frame, PassRefPtr<Range
         //    return fragment;
     }
 
-    if (m_platformDragData->types()->contains(mimeTypeTextHTML)) {
+    if (m_platformDragData->types().contains(mimeTypeTextHTML)) {
         bool ignoredSuccess;
         RefPtr<DocumentFragment> fragment = createFragmentFromMarkup(frame->document(),
             m_platformDragData->getData(mimeTypeTextHTML, ignoredSuccess), m_platformDragData->htmlBaseUrl(), FragmentScriptingNotAllowed);
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
index f8cb28154..682d82d5b 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
@@ -39,14 +39,14 @@
 
 namespace WebCore {
 
-bool ScrollbarThemeChromium::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeChromium::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     // This method is just called as a paint-time optimization to see if
     // painting the thumb can be skipped.  We don't have to be exact here.
     return thumbLength(scrollbar) > 0;
 }
 
-IntRect ScrollbarThemeChromium::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeChromium::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // Windows and Linux just have single arrows.
     if (part == BackButtonEndPart)
@@ -56,7 +56,7 @@ IntRect ScrollbarThemeChromium::backButtonRect(Scrollbar* scrollbar, ScrollbarPa
     return IntRect(scrollbar->x(), scrollbar->y(), size.width(), size.height());
 }
 
-IntRect ScrollbarThemeChromium::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeChromium::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // Windows and Linux just have single arrows.
     if (part == ForwardButtonStartPart)
@@ -74,7 +74,7 @@ IntRect ScrollbarThemeChromium::forwardButtonRect(Scrollbar* scrollbar, Scrollba
     return IntRect(x, y, size.width(), size.height());
 }
 
-IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
+IntRect ScrollbarThemeChromium::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     IntSize bs = buttonSize(scrollbar);
     // The buttons at the top and bottom of the scrollbar are square, so the
@@ -92,14 +92,14 @@ IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
     return IntRect(scrollbar->x(), scrollbar->y() + bs.height(), thickness, scrollbar->height() - 2 * bs.height());
 }
 
-void ScrollbarThemeChromium::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeChromium::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     // Just assume a forward track part.  We only paint the track as a single piece when there is no thumb.
     if (!hasThumb(scrollbar))
         paintTrackPiece(context, scrollbar, rect, ForwardTrackPart);
 }
 
-void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     if (scrollbar->orientation() != VerticalScrollbar)
         return;
@@ -109,7 +109,7 @@ void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, Scrollbar*
 
     // Get the tickmarks for the frameview.
     Vector<IntRect> tickmarks;
-    scrollbar->scrollableArea()->getTickmarks(tickmarks);
+    scrollbar->getTickmarks(tickmarks);
     if (!tickmarks.size())
         return;
 
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.h
index 117812569..cf671dd98 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.h
@@ -41,17 +41,17 @@ namespace WebCore {
     // Windows and Linux.
     class ScrollbarThemeChromium : public ScrollbarThemeComposite {
     protected:
-        virtual bool hasButtons(Scrollbar*) { return true; }
-        virtual bool hasThumb(Scrollbar*);
+        virtual bool hasButtons(ScrollbarThemeClient*) { return true; }
+        virtual bool hasThumb(ScrollbarThemeClient*);
 
-        virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-        virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-        virtual IntRect trackRect(Scrollbar*, bool painting = false);
+        virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+        virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+        virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
 
-        virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-        virtual void paintTickmarks(GraphicsContext*, Scrollbar*, const IntRect&);
+        virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+        virtual void paintTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
 
-        virtual IntSize buttonSize(Scrollbar*) = 0;
+        virtual IntSize buttonSize(ScrollbarThemeClient*) = 0;
     };
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
index 1dbefa649..e1e55a1fc 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
@@ -57,7 +57,7 @@ int ScrollbarThemeChromiumAndroid::scrollbarThickness(ScrollbarControlSize contr
     return scrollbarThicknessValue;
 }
 
-void ScrollbarThemeChromiumAndroid::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
+void ScrollbarThemeChromiumAndroid::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
 {
     // Paint black background in DumpRenderTree, otherwise the pixels in the scrollbar area depend
     // on their previous state, which makes the dumped result undetermined.
@@ -65,12 +65,12 @@ void ScrollbarThemeChromiumAndroid::paintScrollbarBackground(GraphicsContext* co
         context->fillRect(scrollbar->frameRect(), Color::black, ColorSpaceDeviceRGB);
 }
 
-bool ScrollbarThemeChromiumAndroid::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeChromiumAndroid::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     return true;
 }
 
-IntSize ScrollbarThemeChromiumAndroid::buttonSize(Scrollbar* scrollbar)
+IntSize ScrollbarThemeChromiumAndroid::buttonSize(ScrollbarThemeClient* scrollbar)
 {
     if (scrollbar->orientation() == VerticalScrollbar)
         return IntSize(scrollbarThicknessValue, buttonLength);
@@ -78,7 +78,7 @@ IntSize ScrollbarThemeChromiumAndroid::buttonSize(Scrollbar* scrollbar)
     return IntSize(buttonLength, scrollbarThicknessValue);
 }
 
-int ScrollbarThemeChromiumAndroid::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeChromiumAndroid::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return 2 * scrollbarThickness(scrollbar->controlSize());
 }
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
index f07c90167..f3db80e52 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
@@ -35,10 +35,10 @@ public:
     virtual int scrollbarThickness(ScrollbarControlSize);
 
 protected:
-    virtual void paintScrollbarBackground(GraphicsContext*, Scrollbar*);
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
-    virtual IntSize buttonSize(Scrollbar*);
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual void paintScrollbarBackground(GraphicsContext*, ScrollbarThemeClient*);
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
+    virtual IntSize buttonSize(ScrollbarThemeClient*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
index ec68407e9..6b4dafc37 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
@@ -50,7 +50,7 @@ int ScrollbarThemeChromiumLinux::scrollbarThickness(ScrollbarControlSize control
     return scrollbarSize.width();
 }
 
-void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart partType)
+void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart partType)
 {
     PlatformSupport::ThemePaintState state = scrollbar->hoveredPart() == partType ? PlatformSupport::StateHover : PlatformSupport::StateNormal;
     IntRect alignRect = trackRect(scrollbar, false);
@@ -67,7 +67,7 @@ void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, Scrollbar
         &extraParams);
 }
 
-void ScrollbarThemeChromiumLinux::paintButton(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeChromiumLinux::paintButton(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     PlatformSupport::ThemePart paintPart;
     PlatformSupport::ThemePaintState state = PlatformSupport::StateNormal;
@@ -102,7 +102,7 @@ void ScrollbarThemeChromiumLinux::paintButton(GraphicsContext* gc, Scrollbar* sc
     PlatformSupport::paintThemePart(gc, paintPart, state, rect, 0);
 }
 
-void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     PlatformSupport::ThemePaintState state;
 
@@ -120,12 +120,12 @@ void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scr
         0);
 }
 
-bool ScrollbarThemeChromiumLinux::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeChromiumLinux::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     return (evt.shiftKey() && evt.button() == LeftButton) || (evt.button() == MiddleButton);
 }
 
-IntSize ScrollbarThemeChromiumLinux::buttonSize(Scrollbar* scrollbar)
+IntSize ScrollbarThemeChromiumLinux::buttonSize(ScrollbarThemeClient* scrollbar)
 {
     if (scrollbar->orientation() == VerticalScrollbar) {
         IntSize size = PlatformSupport::getThemePartSize(PlatformSupport::PartScrollbarUpArrow);
@@ -137,7 +137,7 @@ IntSize ScrollbarThemeChromiumLinux::buttonSize(Scrollbar* scrollbar)
     return IntSize(scrollbar->width() < 2 * size.width() ? scrollbar->width() / 2 : size.width(), size.height());
 }
 
-int ScrollbarThemeChromiumLinux::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeChromiumLinux::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     if (scrollbar->orientation() == VerticalScrollbar) {
         IntSize size = PlatformSupport::getThemePartSize(PlatformSupport::PartScrollbarVerticalThumb);
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.h
index 8e802e734..330d03fb0 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.h
@@ -39,12 +39,12 @@ namespace WebCore {
         virtual int scrollbarThickness(ScrollbarControlSize);
 
     protected:
-        virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-        virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-        virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
-        virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
-        virtual IntSize buttonSize(Scrollbar*);
-        virtual int minimumThumbLength(Scrollbar*);
+        virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+        virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+        virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+        virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
+        virtual IntSize buttonSize(ScrollbarThemeClient*);
+        virtual int minimumThumbLength(ScrollbarThemeClient*);
     };
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
index 41a198e3f..19346e723 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
@@ -36,12 +36,12 @@ public:
     ScrollbarThemeChromiumMac();
     virtual ~ScrollbarThemeChromiumMac();
 
-    virtual bool paint(Scrollbar*, GraphicsContext* context, const IntRect& damageRect);
+    virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& damageRect);
 
     virtual void paintOverhangAreas(ScrollView*, GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
     
 private:
-    void paintGivenTickmarks(GraphicsContext*, Scrollbar*, const IntRect&, const Vector<IntRect>&);
+    void paintGivenTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, const Vector<IntRect>&);
 
     RefPtr<Pattern> m_overhangPattern;
 };
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
index 459a58b07..d02b42125 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
@@ -61,11 +61,11 @@ ScrollbarThemeChromiumMac::~ScrollbarThemeChromiumMac()
 {
 }
 
-static PlatformSupport::ThemePaintState scrollbarStateToThemeState(Scrollbar* scrollbar)
+static PlatformSupport::ThemePaintState scrollbarStateToThemeState(ScrollbarThemeClient* scrollbar)
 {
     if (!scrollbar->enabled())
         return PlatformSupport::StateDisabled;
-    if (!scrollbar->scrollableArea()->isActive())
+    if (!scrollbar->isScrollableAreaActive())
         return PlatformSupport::StateInactive;
     if (scrollbar->pressedPart() == ThumbPart)
         return PlatformSupport::StatePressed;
@@ -94,11 +94,11 @@ static void scrollbarPainterPaintTrack(ScrollbarPainter scrollbarPainter, bool e
 //     - drawing using PlatformSupport functions
 //     - drawing tickmarks
 //     - Skia specific changes
-bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* context, const IntRect& damageRect)
+bool ScrollbarThemeChromiumMac::paint(ScrollbarThemeClient* scrollbar, GraphicsContext* context, const IntRect& damageRect)
 {
     // Get the tickmarks for the frameview.
     Vector<IntRect> tickmarks;
-    scrollbar->scrollableArea()->getTickmarks(tickmarks);
+    scrollbar->getTickmarks(tickmarks);
 
     if (isScrollbarOverlayAPIAvailable()) {
         float value = 0;
@@ -188,7 +188,7 @@ bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* con
     if (!scrollbar->enabled())
         trackInfo.enableState = kThemeTrackDisabled;
     else
-        trackInfo.enableState = scrollbar->scrollableArea()->isActive() ? kThemeTrackActive : kThemeTrackInactive;
+        trackInfo.enableState = scrollbar->isScrollableAreaActive() ? kThemeTrackActive : kThemeTrackInactive;
 
     if (!hasButtons(scrollbar))
         trackInfo.enableState = kThemeTrackNothingToScroll;
@@ -243,7 +243,7 @@ bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* con
     if (hasThumb(scrollbar)) {
         PlatformSupport::ThemePaintScrollbarInfo scrollbarInfo;
         scrollbarInfo.orientation = scrollbar->orientation() == HorizontalScrollbar ? PlatformSupport::ScrollbarOrientationHorizontal : PlatformSupport::ScrollbarOrientationVertical;
-        scrollbarInfo.parent = scrollbar->parent() && scrollbar->parent()->isFrameView() && static_cast<FrameView*>(scrollbar->parent())->isScrollViewScrollbar(scrollbar) ? PlatformSupport::ScrollbarParentScrollView : PlatformSupport::ScrollbarParentRenderLayer;
+        scrollbarInfo.parent = scrollbar->isScrollViewScrollbar() ? PlatformSupport::ScrollbarParentScrollView : PlatformSupport::ScrollbarParentRenderLayer;
         scrollbarInfo.maxValue = scrollbar->maximum();
         scrollbarInfo.currentValue = scrollbar->currentPos();
         scrollbarInfo.visibleSize = scrollbar->visibleSize();
@@ -263,7 +263,7 @@ bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* con
     return true;
 }
 
-void ScrollbarThemeChromiumMac::paintGivenTickmarks(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, const Vector<IntRect>& tickmarks)
+void ScrollbarThemeChromiumMac::paintGivenTickmarks(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, const Vector<IntRect>& tickmarks)
 {
     if (scrollbar->orientation() != VerticalScrollbar)
         return;
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
index f435839d8..a08198347 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
@@ -73,7 +73,7 @@ bool ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit()
     return windowsVersion() >= WindowsVista;
 }
 
-bool ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
+bool ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin(ScrollbarThemeClient* scrollbar, const PlatformMouseEvent& evt)
 {
     // Find the rect within which we shouldn't snap, by expanding the track rect
     // in both dimensions.
@@ -91,7 +91,7 @@ bool ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar,
     return !rect.contains(mousePosition);
 }
 
-void ScrollbarThemeChromiumWin::paintTrackPiece(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart partType)
+void ScrollbarThemeChromiumWin::paintTrackPiece(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart partType)
 {
     bool horz = scrollbar->orientation() == HorizontalScrollbar;
 
@@ -113,7 +113,7 @@ void ScrollbarThemeChromiumWin::paintTrackPiece(GraphicsContext* gc, Scrollbar*
         alignRect);
 }
 
-void ScrollbarThemeChromiumWin::paintButton(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeChromiumWin::paintButton(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     bool horz = scrollbar->orientation() == HorizontalScrollbar;
 
@@ -131,7 +131,7 @@ void ScrollbarThemeChromiumWin::paintButton(GraphicsContext* gc, Scrollbar* scro
         rect);
 }
 
-void ScrollbarThemeChromiumWin::paintThumb(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeChromiumWin::paintThumb(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     bool horz = scrollbar->orientation() == HorizontalScrollbar;
 
@@ -152,7 +152,7 @@ void ScrollbarThemeChromiumWin::paintThumb(GraphicsContext* gc, Scrollbar* scrol
         rect);
 }
 
-int ScrollbarThemeChromiumWin::getThemeState(Scrollbar* scrollbar, ScrollbarPart part) const
+int ScrollbarThemeChromiumWin::getThemeState(ScrollbarThemeClient* scrollbar, ScrollbarPart part) const
 {
     // When dragging the thumb, draw thumb pressed and other segments normal
     // regardless of where the cursor actually is.  See also four places in
@@ -171,7 +171,7 @@ int ScrollbarThemeChromiumWin::getThemeState(Scrollbar* scrollbar, ScrollbarPart
     return (scrollbar->pressedPart() == part) ? SCRBS_PRESSED : SCRBS_NORMAL;
 }
 
-int ScrollbarThemeChromiumWin::getThemeArrowState(Scrollbar* scrollbar, ScrollbarPart part) const
+int ScrollbarThemeChromiumWin::getThemeArrowState(ScrollbarThemeClient* scrollbar, ScrollbarPart part) const
 {
     // We could take advantage of knowing the values in the state enum to write
     // some simpler code, but treating the state enum as a black box seems
@@ -221,7 +221,7 @@ int ScrollbarThemeChromiumWin::getThemeArrowState(Scrollbar* scrollbar, Scrollba
     return (scrollbar->pressedPart() == part) ? ABS_DOWNPRESSED : ABS_DOWNNORMAL;
 }
 
-int ScrollbarThemeChromiumWin::getClassicThemeState(Scrollbar* scrollbar, ScrollbarPart part) const
+int ScrollbarThemeChromiumWin::getClassicThemeState(ScrollbarThemeClient* scrollbar, ScrollbarPart part) const
 {
     // When dragging the thumb, draw the buttons normal even when hovered.
     if (scrollbar->pressedPart() == ThumbPart)
@@ -235,12 +235,12 @@ int ScrollbarThemeChromiumWin::getClassicThemeState(Scrollbar* scrollbar, Scroll
     return (scrollbar->pressedPart() == part) ? (DFCS_PUSHED | DFCS_FLAT) : 0;
 }
 
-bool ScrollbarThemeChromiumWin::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeChromiumWin::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     return evt.shiftKey() && evt.button() == LeftButton;
 }
 
-IntSize ScrollbarThemeChromiumWin::buttonSize(Scrollbar* scrollbar)
+IntSize ScrollbarThemeChromiumWin::buttonSize(ScrollbarThemeClient* scrollbar)
 {
     // Our desired rect is essentially thickness by thickness.
 
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.h
index 69cfa131c..ac8881f93 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.h
@@ -38,19 +38,19 @@ namespace WebCore {
     public:
         virtual int scrollbarThickness(ScrollbarControlSize);
         virtual bool invalidateOnMouseEnterExit();
-        virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&);
+        virtual bool shouldSnapBackToDragOrigin(ScrollbarThemeClient*, const PlatformMouseEvent&);
 
     protected:
-        virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-        virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-        virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
-        virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
-        virtual IntSize buttonSize(Scrollbar*);
+        virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+        virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+        virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+        virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
+        virtual IntSize buttonSize(ScrollbarThemeClient*);
 
     private:
-        int getThemeState(Scrollbar*, ScrollbarPart) const;
-        int getThemeArrowState(Scrollbar*, ScrollbarPart) const;
-        int getClassicThemeState(Scrollbar*, ScrollbarPart) const;
+        int getThemeState(ScrollbarThemeClient*, ScrollbarPart) const;
+        int getThemeArrowState(ScrollbarThemeClient*, ScrollbarPart) const;
+        int getClassicThemeState(ScrollbarThemeClient*, ScrollbarPart) const;
     };
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/efl/ClipboardEfl.cpp b/Source/WebCore/platform/efl/ClipboardEfl.cpp
index 60152726a..884d387e5 100644
--- a/Source/WebCore/platform/efl/ClipboardEfl.cpp
+++ b/Source/WebCore/platform/efl/ClipboardEfl.cpp
@@ -21,7 +21,6 @@
 #include "config.h"
 #include "ClipboardEfl.h"
 
-#include "DOMStringList.h"
 #include "DataTransferItemList.h"
 #include "Editor.h"
 #include "FileList.h"
@@ -65,10 +64,9 @@ void ClipboardEfl::clearAllData()
     notImplemented();
 }
 
-String ClipboardEfl::getData(const String&, bool &success) const
+String ClipboardEfl::getData(const String&) const
 {
     notImplemented();
-    success = false;
     return String();
 }
 
@@ -78,10 +76,10 @@ bool ClipboardEfl::setData(const String&, const String&)
     return false;
 }
 
-PassRefPtr<DOMStringList> ClipboardEfl::types() const
+HashSet<String> ClipboardEfl::types() const
 {
     notImplemented();
-    return DOMStringList::create();
+    return HashSet<String>();
 }
 
 PassRefPtr<FileList> ClipboardEfl::files() const
diff --git a/Source/WebCore/platform/efl/ClipboardEfl.h b/Source/WebCore/platform/efl/ClipboardEfl.h
index 56455190f..3da598ecb 100644
--- a/Source/WebCore/platform/efl/ClipboardEfl.h
+++ b/Source/WebCore/platform/efl/ClipboardEfl.h
@@ -36,10 +36,10 @@ public:
 
     void clearData(const String&);
     void clearAllData();
-    String getData(const String&, bool&) const;
+    String getData(const String&) const;
     bool setData(const String&, const String&);
 
-    PassRefPtr<DOMStringList> types() const;
+    HashSet<String> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     IntPoint dragLocation() const;
diff --git a/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp b/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
index 2c42bbf7f..35ef84ccb 100644
--- a/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
+++ b/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
@@ -166,7 +166,7 @@ static void createWindowsKeyMap()
     }
 }
 
-String keyIdentifierForEvasKeyName(String& keyName)
+String keyIdentifierForEvasKeyName(const String& keyName)
 {
     if (keyMap().isEmpty())
         createKeyMap();
@@ -177,7 +177,18 @@ String keyIdentifierForEvasKeyName(String& keyName)
     return keyName;
 }
 
-int windowsKeyCodeForEvasKeyName(String& keyName)
+String singleCharacterString(const String& keyName)
+{
+    if (keyName == "Return")
+        return String("\r");
+    if (keyName == "BackSpace")
+        return String("\x8");
+    if (keyName == "Tab")
+        return String("\t");
+    return keyName;
+}
+
+int windowsKeyCodeForEvasKeyName(const String& keyName)
 {
     if (windowsKeyMap().isEmpty())
         createWindowsKeyMap();
diff --git a/Source/WebCore/platform/efl/EflKeyboardUtilities.h b/Source/WebCore/platform/efl/EflKeyboardUtilities.h
index d79170b29..ad36327f4 100644
--- a/Source/WebCore/platform/efl/EflKeyboardUtilities.h
+++ b/Source/WebCore/platform/efl/EflKeyboardUtilities.h
@@ -34,8 +34,9 @@ class String;
 
 namespace WebCore {
 
-WTF::String keyIdentifierForEvasKeyName(WTF::String&);
-int windowsKeyCodeForEvasKeyName(WTF::String&);
+WTF::String keyIdentifierForEvasKeyName(const WTF::String&);
+WTF::String singleCharacterString(const WTF::String&);
+int windowsKeyCodeForEvasKeyName(const WTF::String&);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp b/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
index 63963e95e..656564d2c 100644
--- a/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
+++ b/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
@@ -42,29 +42,30 @@ namespace WebCore {
 
 PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Down* event)
     : PlatformEvent(PlatformEvent::KeyDown, evas_key_modifier_is_set(event->modifiers, "Shift"), evas_key_modifier_is_set(event->modifiers, "Control"), evas_key_modifier_is_set(event->modifiers, "Alt"), evas_key_modifier_is_set(event->modifiers, "Meta"), currentTime())
-    , m_text(String::fromUTF8(event->string))
-    , m_unmodifiedText(String::fromUTF8(event->string))
+    , m_text(singleCharacterString(String::fromUTF8(event->string)))
+    , m_unmodifiedText(singleCharacterString(String::fromUTF8(event->string)))
+    , m_keyIdentifier(keyIdentifierForEvasKeyName(String(event->key)))
+    , m_windowsVirtualKeyCode(windowsKeyCodeForEvasKeyName(String(event->key)))
+    , m_nativeVirtualKeyCode(0)
+    , m_macCharCode(0)
+    , m_autoRepeat(false)
+    , m_isKeypad(false)
+    , m_isSystemKey(false)
 {
-    String keyName = String(event->key);
-    m_keyIdentifier = keyIdentifierForEvasKeyName(keyName);
-    m_windowsVirtualKeyCode = windowsKeyCodeForEvasKeyName(keyName);
-
-    // FIXME:
-    m_isKeypad = false;
-    m_autoRepeat = false;
 }
 
 PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Up* event)
     : PlatformEvent(PlatformEvent::KeyUp, evas_key_modifier_is_set(event->modifiers, "Shift"), evas_key_modifier_is_set(event->modifiers, "Control"), evas_key_modifier_is_set(event->modifiers, "Alt"), evas_key_modifier_is_set(event->modifiers, "Meta"), currentTime())
-    , m_text(String::fromUTF8(event->string))
+    , m_text(singleCharacterString(String::fromUTF8(event->string)))
+    , m_unmodifiedText(singleCharacterString(String::fromUTF8(event->string)))
+    , m_keyIdentifier(keyIdentifierForEvasKeyName(String(event->key)))
+    , m_windowsVirtualKeyCode(windowsKeyCodeForEvasKeyName(String(event->key)))
+    , m_nativeVirtualKeyCode(0)
+    , m_macCharCode(0)
+    , m_autoRepeat(false)
+    , m_isKeypad(false)
+    , m_isSystemKey(false)
 {
-    String keyName = String(event->key);
-    m_keyIdentifier = keyIdentifierForEvasKeyName(keyName);
-    m_windowsVirtualKeyCode = windowsKeyCodeForEvasKeyName(keyName);
-
-    // FIXME:
-    m_isKeypad = false;
-    m_autoRepeat = false;
 }
 
 void PlatformKeyboardEvent::disambiguateKeyDownEvent(Type type, bool)
diff --git a/Source/WebCore/platform/efl/RunLoopEfl.cpp b/Source/WebCore/platform/efl/RunLoopEfl.cpp
new file mode 100644
index 000000000..e820788d6
--- /dev/null
+++ b/Source/WebCore/platform/efl/RunLoopEfl.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 ProFUSION embedded systems. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RunLoop.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+RunLoop::RunLoop()
+{
+    notImplemented();
+}
+
+RunLoop::~RunLoop()
+{
+    notImplemented();
+}
+
+void RunLoop::wakeUp()
+{
+    notImplemented();
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/efl/ScrollbarThemeEfl.cpp b/Source/WebCore/platform/efl/ScrollbarThemeEfl.cpp
index 62df005d6..240b50147 100644
--- a/Source/WebCore/platform/efl/ScrollbarThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/ScrollbarThemeEfl.cpp
@@ -49,11 +49,11 @@ int ScrollbarThemeEfl::scrollbarThickness(ScrollbarControlSize controlSize)
     return 0; // we paint on top
 }
 
-void ScrollbarThemeEfl::registerScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeEfl::registerScrollbar(ScrollbarThemeClient* scrollbar)
 {
 }
 
-void ScrollbarThemeEfl::unregisterScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeEfl::unregisterScrollbar(ScrollbarThemeClient* scrollbar)
 {
 }
 
diff --git a/Source/WebCore/platform/efl/ScrollbarThemeEfl.h b/Source/WebCore/platform/efl/ScrollbarThemeEfl.h
index 0fe16881e..28c163ed3 100644
--- a/Source/WebCore/platform/efl/ScrollbarThemeEfl.h
+++ b/Source/WebCore/platform/efl/ScrollbarThemeEfl.h
@@ -39,8 +39,8 @@ public:
 
     virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
 
-    virtual void registerScrollbar(Scrollbar* scrollbar);
-    virtual void unregisterScrollbar(Scrollbar* scrollbar);
+    virtual void registerScrollbar(ScrollbarThemeClient*);
+    virtual void unregisterScrollbar(ScrollbarThemeClient*);
 };
 
 }
diff --git a/Source/WebCore/platform/efl/SharedBufferEfl.cpp b/Source/WebCore/platform/efl/SharedBufferEfl.cpp
index a4337a0b2..9e7646d1c 100644
--- a/Source/WebCore/platform/efl/SharedBufferEfl.cpp
+++ b/Source/WebCore/platform/efl/SharedBufferEfl.cpp
@@ -61,10 +61,10 @@ PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String& fi
         return 0;
     }
 
-    fread(result->m_buffer.data(), 1, fileStat.st_size, file);
+    const size_t bytesRead = fread(result->m_buffer.data(), 1, fileStat.st_size, file);
     fclose(file);
 
-    return result.release();
+    return bytesRead == static_cast<unsigned>(fileStat.st_size) ? result.release() : 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp b/Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp
index 0350da0fc..708dcd065 100644
--- a/Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp
+++ b/Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp
@@ -95,7 +95,7 @@ void CrossfadeGeneratedImage::draw(GraphicsContext* context, const FloatRect& ds
 
 void CrossfadeGeneratedImage::drawPattern(GraphicsContext* context, const FloatRect& srcRect, const AffineTransform& patternTransform, const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator compositeOp, const FloatRect& dstRect)
 {
-    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size, ColorSpaceDeviceRGB, context->isAcceleratedContext() ? Accelerated : Unaccelerated);
+    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size, 1, ColorSpaceDeviceRGB, context->isAcceleratedContext() ? Accelerated : Unaccelerated);
     if (!imageBuffer)
         return;
 
diff --git a/Source/WebCore/platform/graphics/Extensions3D.h b/Source/WebCore/platform/graphics/Extensions3D.h
index ffc5f527c..7c1004991 100644
--- a/Source/WebCore/platform/graphics/Extensions3D.h
+++ b/Source/WebCore/platform/graphics/Extensions3D.h
@@ -65,6 +65,7 @@ public:
     //   GL_EXT_texture_compression_s3tc
     //   GL_OES_compressed_ETC1_RGB8_texture
     //   GL_IMG_texture_compression_pvrtc
+    //   EXT_texture_filter_anisotropic
 
     // Takes full name of extension; for example,
     // "GL_EXT_texture_format_BGRA8888".
@@ -135,6 +136,10 @@ public:
         COMPRESSED_RGB_PVRTC_2BPPV1_IMG = 0x8C01,
         COMPRESSED_RGBA_PVRTC_4BPPV1_IMG = 0x8C02,
         COMPRESSED_RGBA_PVRTC_2BPPV1_IMG = 0x8C03,
+
+        // GL_EXT_texture_filter_anisotropic
+        TEXTURE_MAX_ANISOTROPY_EXT = 0x84FE,
+        MAX_TEXTURE_MAX_ANISOTROPY_EXT = 0x84FF,
     };
 
     // GL_ARB_robustness
diff --git a/Source/WebCore/platform/graphics/FloatPoint.h b/Source/WebCore/platform/graphics/FloatPoint.h
index 094304d83..a601a9dff 100644
--- a/Source/WebCore/platform/graphics/FloatPoint.h
+++ b/Source/WebCore/platform/graphics/FloatPoint.h
@@ -31,6 +31,14 @@
 #include "IntPoint.h"
 #include <wtf/MathExtras.h>
 
+#if PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class FloatPoint;
+}
+}
+#endif
+
 #if USE(CG) || USE(SKIA_ON_MAC_CHROMIUM)
 typedef struct CGPoint CGPoint;
 #endif
@@ -156,6 +164,11 @@ public:
     operator QPointF() const;
 #endif
 
+#if PLATFORM(BLACKBERRY)
+    FloatPoint(const BlackBerry::Platform::FloatPoint&);
+    operator BlackBerry::Platform::FloatPoint() const;
+#endif
+
 #if USE(SKIA)
     operator SkPoint() const;
     FloatPoint(const SkPoint&);
diff --git a/Source/WebCore/platform/graphics/FloatRect.h b/Source/WebCore/platform/graphics/FloatRect.h
index 4d4eadfd0..66b29f84b 100644
--- a/Source/WebCore/platform/graphics/FloatRect.h
+++ b/Source/WebCore/platform/graphics/FloatRect.h
@@ -52,6 +52,14 @@ QT_END_NAMESPACE
 class wxRect2DDouble;
 #endif
 
+#if PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class FloatRect;
+}
+}
+#endif
+
 #if USE(SKIA)
 struct SkRect;
 #endif
@@ -181,6 +189,11 @@ public:
     void fitToPoints(const FloatPoint& p0, const FloatPoint& p1, const FloatPoint& p2);
     void fitToPoints(const FloatPoint& p0, const FloatPoint& p1, const FloatPoint& p2, const FloatPoint& p3);
 
+#if PLATFORM(BLACKBERRY)
+    FloatRect(const BlackBerry::Platform::FloatRect&);
+    operator BlackBerry::Platform::FloatRect() const;
+#endif
+
 #if USE(CG) || USE(SKIA_ON_MAC_CHROMIUM)
     FloatRect(const CGRect&);
     operator CGRect() const;
diff --git a/Source/WebCore/platform/graphics/FloatSize.h b/Source/WebCore/platform/graphics/FloatSize.h
index 2b5545030..3b35510be 100644
--- a/Source/WebCore/platform/graphics/FloatSize.h
+++ b/Source/WebCore/platform/graphics/FloatSize.h
@@ -31,6 +31,14 @@
 #include "IntPoint.h"
 #include <wtf/MathExtras.h>
 
+#if PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class FloatSize;
+}
+}
+#endif
+
 #if USE(CG) || (PLATFORM(WX) && OS(DARWIN)) || USE(SKIA_ON_MAC_CHROMIUM)
 typedef struct CGSize CGSize;
 #endif
@@ -106,6 +114,11 @@ public:
         return FloatSize(m_height, m_width);
     }
 
+#if PLATFORM(BLACKBERRY)
+    FloatSize(const BlackBerry::Platform::FloatSize&);
+    operator BlackBerry::Platform::FloatSize() const;
+#endif
+
 #if USE(CG) || (PLATFORM(WX) && OS(DARWIN)) || USE(SKIA_ON_MAC_CHROMIUM)
     explicit FloatSize(const CGSize&); // don't do this implicitly since it's lossy
     operator CGSize() const;
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutRect.h b/Source/WebCore/platform/graphics/FractionalLayoutRect.h
index e16655517..e64feb8b1 100644
--- a/Source/WebCore/platform/graphics/FractionalLayoutRect.h
+++ b/Source/WebCore/platform/graphics/FractionalLayoutRect.h
@@ -65,6 +65,13 @@ public:
     FractionalLayoutUnit width() const { return m_size.width(); }
     FractionalLayoutUnit height() const { return m_size.height(); }
 
+    int pixelSnappedX() const { return x().round(); }
+    int pixelSnappedY() const { return y().round(); }
+    int pixelSnappedWidth() const { return snapSizeToPixel(width(), x()); }
+    int pixelSnappedHeight() const { return snapSizeToPixel(height(), y()); }
+    int pixelSnappedMaxX() const { return pixelSnappedX() + pixelSnappedWidth(); }
+    int pixelSnappedMaxY() const { return pixelSnappedY() + pixelSnappedHeight(); }
+
     void setX(FractionalLayoutUnit x) { m_location.setX(x); }
     void setY(FractionalLayoutUnit y) { m_location.setY(y); }
     void setWidth(FractionalLayoutUnit width) { m_size.setWidth(width); }
diff --git a/Source/WebCore/platform/graphics/GraphicsContext.cpp b/Source/WebCore/platform/graphics/GraphicsContext.cpp
index f77b8a138..8f7f4cd1c 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsContext.cpp
@@ -487,7 +487,7 @@ void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const
         image->draw(this, FloatRect(dest.location(), FloatSize(tw, th)), FloatRect(src.location(), FloatSize(tsw, tsh)), styleColorSpace, op);
 }
 
-void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& rect, const IntPoint& srcPoint, const IntSize& tileSize, CompositeOperator op, bool useLowQualityScale)
+void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& destRect, const IntPoint& srcPoint, const IntSize& tileSize, CompositeOperator op, bool useLowQualityScale)
 {
     if (paintingDisabled() || !image)
         return;
@@ -495,10 +495,10 @@ void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, c
     if (useLowQualityScale) {
         InterpolationQuality previousInterpolationQuality = imageInterpolationQuality();
         setImageInterpolationQuality(InterpolationLow);
-        image->drawTiled(this, rect, srcPoint, tileSize, styleColorSpace, op);
+        image->drawTiled(this, destRect, srcPoint, tileSize, styleColorSpace, op);
         setImageInterpolationQuality(previousInterpolationQuality);
     } else
-        image->drawTiled(this, rect, srcPoint, tileSize, styleColorSpace, op);
+        image->drawTiled(this, destRect, srcPoint, tileSize, styleColorSpace, op);
 }
 
 void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& dest, const IntRect& srcRect,
@@ -553,14 +553,14 @@ void GraphicsContext::drawImageBuffer(ImageBuffer* image, ColorSpace styleColorS
     float th = dest.height();
 
     if (tsw == -1)
-        tsw = image->width();
+        tsw = image->logicalSize().width();
     if (tsh == -1)
-        tsh = image->height();
+        tsh = image->logicalSize().height();
 
     if (tw == -1)
-        tw = image->width();
+        tw = image->logicalSize().width();
     if (th == -1)
-        th = image->height();
+        th = image->logicalSize().height();
 
     if (useLowQualityScale) {
         InterpolationQuality previousInterpolationQuality = imageInterpolationQuality();
@@ -754,7 +754,7 @@ PassOwnPtr<ImageBuffer> GraphicsContext::createCompatibleBuffer(const IntSize& s
     AffineTransform transform = getCTM();
     IntSize scaledSize(static_cast<int>(ceil(size.width() * transform.xScale())), static_cast<int>(ceil(size.height() * transform.yScale())));
 
-    OwnPtr<ImageBuffer> buffer = ImageBuffer::create(scaledSize, ColorSpaceDeviceRGB, isAcceleratedContext() ? Accelerated : Unaccelerated);
+    OwnPtr<ImageBuffer> buffer = ImageBuffer::create(scaledSize, 1, ColorSpaceDeviceRGB, isAcceleratedContext() ? Accelerated : Unaccelerated);
     if (!buffer)
         return nullptr;
 
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index 17ae9845f..455ffe2bc 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -26,13 +26,14 @@
 #ifndef GraphicsContext3D_h
 #define GraphicsContext3D_h
 
+#include "IntRect.h"
 #include "GraphicsLayer.h"
 #include "GraphicsTypes3D.h"
 #include "PlatformString.h"
-
 #include <wtf/HashMap.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/RefCounted.h>
 
 // FIXME: Find a better way to avoid the name confliction for NO_ERROR.
 #if ((PLATFORM(CHROMIUM) && OS(WINDOWS)) || PLATFORM(WIN) || (PLATFORM(QT) && OS(WINDOWS)))
@@ -442,6 +443,7 @@ public:
             , preserveDrawingBuffer(false)
             , noExtensions(false)
             , shareResources(true)
+            , preferDiscreteGPU(false)
         {
         }
 
@@ -454,6 +456,7 @@ public:
         bool preserveDrawingBuffer;
         bool noExtensions;
         bool shareResources;
+        bool preferDiscreteGPU;
     };
 
     enum RenderStyle {
@@ -756,26 +759,25 @@ public:
     void texParameteri(GC3Denum target, GC3Denum pname, GC3Dint param);
     void texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, const void* pixels);
 
-    // FIXME: change the argument orders to match OpenGL's.
     void uniform1f(GC3Dint location, GC3Dfloat x);
-    void uniform1fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size);
+    void uniform1fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform1i(GC3Dint location, GC3Dint x);
-    void uniform1iv(GC3Dint location, GC3Dint* v, GC3Dsizei size);
-    void uniform2f(GC3Dint location, GC3Dfloat x, float y);
-    void uniform2fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size);
+    void uniform1iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniform2f(GC3Dint location, GC3Dfloat x, GC3Dfloat y);
+    void uniform2fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform2i(GC3Dint location, GC3Dint x, GC3Dint y);
-    void uniform2iv(GC3Dint location, GC3Dint* v, GC3Dsizei size);
+    void uniform2iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
     void uniform3f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z);
-    void uniform3fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size);
+    void uniform3fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform3i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z);
-    void uniform3iv(GC3Dint location, GC3Dint* v, GC3Dsizei size);
+    void uniform3iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
     void uniform4f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w);
-    void uniform4fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size);
+    void uniform4fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform4i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z, GC3Dint w);
-    void uniform4iv(GC3Dint location, GC3Dint* v, GC3Dsizei size);
-    void uniformMatrix2fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size);
-    void uniformMatrix3fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size);
-    void uniformMatrix4fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size);
+    void uniform4iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniformMatrix2fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix3fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix4fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
 
     void useProgram(Platform3DObject);
     void validateProgram(Platform3DObject);
@@ -913,7 +915,7 @@ public:
 #endif
 
     bool reshapeFBOs(const IntSize&);
-    void resolveMultisamplingIfNecessary(const IntRect&);
+    void resolveMultisamplingIfNecessary(const IntRect& = IntRect());
 
     int m_currentWidth, m_currentHeight;
     bool isResourceSafe();
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.h b/Source/WebCore/platform/graphics/GraphicsLayer.h
index dabbdaf1e..b41ea0618 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.h
@@ -343,7 +343,8 @@ public:
     virtual void setNeedsDisplay() = 0;
     // mark the given rect (in layer coords) as needing dispay. Never goes deep.
     virtual void setNeedsDisplayInRect(const FloatRect&) = 0;
-    
+    virtual bool needsDisplay() const { return false; }
+
     virtual void setContentsNeedsDisplay() { };
 
     // Set that the position/size of the contents (image or video).
@@ -428,7 +429,7 @@ public:
     bool usingTiledLayer() const { return m_usingTiledLayer; }
 
     // Called whenever the visible rect of the given GraphicsLayer changed.
-    virtual void visibleRectChanged() { }
+    virtual void visibleRectChanged(const IntRect&) { }
 
 #if PLATFORM(QT) || PLATFORM(GTK)
     // This allows several alternative GraphicsLayer implementations in the same port,
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.cpp b/Source/WebCore/platform/graphics/ImageBuffer.cpp
index 5391c3815..e4a9fd857 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.cpp
+++ b/Source/WebCore/platform/graphics/ImageBuffer.cpp
@@ -71,7 +71,7 @@ void ImageBuffer::transformColorSpace(ColorSpace srcColorSpace, ColorSpace dstCo
 
 inline void ImageBuffer::genericConvertToLuminanceMask()
 {
-    IntRect luminanceRect(IntPoint(), size());
+    IntRect luminanceRect(IntPoint(), internalSize());
     RefPtr<ByteArray> srcPixelArray = getUnmultipliedImageData(luminanceRect);
     
     unsigned pixelArrayLength = srcPixelArray->length();
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.h b/Source/WebCore/platform/graphics/ImageBuffer.h
index f97dc7939..53e86db48 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.h
+++ b/Source/WebCore/platform/graphics/ImageBuffer.h
@@ -31,6 +31,7 @@
 #include "AffineTransform.h"
 #include "ColorSpace.h"
 #include "FloatRect.h"
+#include "GraphicsContext.h"
 #if USE(ACCELERATED_COMPOSITING)
 #include "GraphicsLayer.h"
 #endif
@@ -46,7 +47,6 @@
 
 namespace WebCore {
 
-    class GraphicsContext;
     class Image;
     class ImageData;
     class IntPoint;
@@ -77,23 +77,29 @@ namespace WebCore {
         WTF_MAKE_NONCOPYABLE(ImageBuffer); WTF_MAKE_FAST_ALLOCATED;
     public:
         // Will return a null pointer on allocation failure.
-        static PassOwnPtr<ImageBuffer> create(const IntSize& size, ColorSpace colorSpace = ColorSpaceDeviceRGB, RenderingMode renderingMode = Unaccelerated, DeferralMode deferralMode = NonDeferred)
+        static PassOwnPtr<ImageBuffer> create(const IntSize& size, float resolutionScale = 1, ColorSpace colorSpace = ColorSpaceDeviceRGB, RenderingMode renderingMode = Unaccelerated, DeferralMode deferralMode = NonDeferred)
         {
             bool success = false;
-            OwnPtr<ImageBuffer> buf = adoptPtr(new ImageBuffer(size, colorSpace, renderingMode, deferralMode, success));
-            if (success)
-                return buf.release();
-            return nullptr;
+            float scaledWidth = ceilf(resolutionScale * size.width());
+            float scaledHeight = ceilf(resolutionScale * size.height());
+            IntSize internalSize(scaledWidth, scaledHeight);
+
+            OwnPtr<ImageBuffer> buf = adoptPtr(new ImageBuffer(internalSize, colorSpace, renderingMode, deferralMode, success));
+            if (!success)
+                return nullptr;
+
+            buf->m_logicalSize = size;
+            buf->m_resolutionScale = resolutionScale;
+            buf->context()->scale(FloatSize(resolutionScale, resolutionScale));
+            return buf.release();
         }
 
         ~ImageBuffer();
 
-        const IntSize& size() const { return m_size; }
-        int width() const { return m_size.width(); }
-        int height() const { return m_size.height(); }
-        
-        size_t dataSize() const;
-        
+        // The actual resolution of the backing store
+        const IntSize& internalSize() const { return m_size; }
+        const IntSize& logicalSize() const { return m_logicalSize; }
+
         GraphicsContext* context() const;
 
         PassRefPtr<Image> copyImage(BackingStoreCopy = CopyBackingStore) const;
@@ -111,7 +117,7 @@ namespace WebCore {
         void transformColorSpace(ColorSpace srcColorSpace, ColorSpace dstColorSpace);
         void platformTransformColorSpace(const Vector<int>&);
 #else
-        AffineTransform baseTransform() const { return AffineTransform(1, 0, 0, -1, 0, m_size.height()); }
+        AffineTransform baseTransform() const { return AffineTransform(1, 0, 0, -1, 0, internalSize().height()); }
 #endif
 #if USE(ACCELERATED_COMPOSITING)
         PlatformLayer* platformLayer() const;
@@ -121,7 +127,6 @@ namespace WebCore {
 #if USE(CG)
         NativeImagePtr copyNativeImage(BackingStoreCopy = CopyBackingStore) const;
 #endif
-
         void clip(GraphicsContext*, const FloatRect&) const;
 
         void draw(GraphicsContext*, ColorSpace, const FloatRect& destRect, const FloatRect& srcRect = FloatRect(0, 0, -1, -1), CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
@@ -136,8 +141,9 @@ namespace WebCore {
 
     private:
         ImageBufferData m_data;
-
         IntSize m_size;
+        IntSize m_logicalSize;
+        float m_resolutionScale;
         OwnPtr<GraphicsContext> m_context;
 
 #if !USE(CG)
diff --git a/Source/WebCore/platform/graphics/ImageSource.h b/Source/WebCore/platform/graphics/ImageSource.h
index 7ce7e08b6..1d0220257 100644
--- a/Source/WebCore/platform/graphics/ImageSource.h
+++ b/Source/WebCore/platform/graphics/ImageSource.h
@@ -92,6 +92,10 @@ typedef cairo_surface_t* NativeImagePtr;
 typedef WebCore::NativeImageSkia* NativeImagePtr;
 #elif OS(WINCE)
 typedef RefPtr<SharedBitmap> NativeImagePtr;
+#elif PLATFORM(BLACKBERRY)
+class ImageDecoder;
+typedef ImageDecoder* NativeImageSourcePtr;
+typedef void* NativeImagePtr;
 #endif
 #endif
 
diff --git a/Source/WebCore/platform/graphics/IntRect.h b/Source/WebCore/platform/graphics/IntRect.h
index 3ea8229f4..600c21d0d 100644
--- a/Source/WebCore/platform/graphics/IntRect.h
+++ b/Source/WebCore/platform/graphics/IntRect.h
@@ -53,6 +53,12 @@ typedef struct _GdkRectangle GdkRectangle;
 #endif
 #elif PLATFORM(EFL)
 typedef struct _Eina_Rectangle Eina_Rectangle;
+#elif PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class IntRect;
+}
+}
 #endif
 
 #if USE(CAIRO)
@@ -97,6 +103,15 @@ public:
     int width() const { return m_size.width(); }
     int height() const { return m_size.height(); }
 
+    // FIXME: These methods are here only to ease the transition to sub-pixel layout. They should
+    // be removed when we close http://webkit.org/b/60318
+    int pixelSnappedX() const { return m_location.x(); }
+    int pixelSnappedY() const { return m_location.y(); }
+    int pixelSnappedMaxX() const { return x() + width(); }
+    int pixelSnappedMaxY() const { return y() + height(); }
+    int pixelSnappedWidth() const { return m_size.width(); }
+    int pixelSnappedHeight() const { return m_size.height(); }
+
     void setX(int x) { m_location.setX(x); }
     void setY(int y) { m_location.setY(y); }
     void setWidth(int width) { m_size.setWidth(width); }
@@ -214,6 +229,11 @@ public:
     operator NSRect() const;
 #endif
 
+#if PLATFORM(BLACKBERRY)
+    IntRect(const BlackBerry::Platform::IntRect&);
+    operator BlackBerry::Platform::IntRect() const;
+#endif
+
 private:
     IntPoint m_location;
     IntSize m_size;
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.cpp b/Source/WebCore/platform/graphics/MediaPlayer.cpp
index 9813eeee1..ed6a13fa8 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/Source/WebCore/platform/graphics/MediaPlayer.cpp
@@ -937,6 +937,14 @@ String MediaPlayer::referrer() const
     return m_mediaPlayerClient->mediaPlayerReferrer();
 }
 
+String MediaPlayer::userAgent() const
+{
+    if (!m_mediaPlayerClient)
+        return String();
+    
+    return m_mediaPlayerClient->mediaPlayerUserAgent();
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.h b/Source/WebCore/platform/graphics/MediaPlayer.h
index 2ccfb72ac..bc10fc306 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.h
+++ b/Source/WebCore/platform/graphics/MediaPlayer.h
@@ -169,6 +169,7 @@ public:
 #endif
 
     virtual String mediaPlayerReferrer() const { return String(); }
+    virtual String mediaPlayerUserAgent() const { return String(); }
 };
 
 class MediaPlayer {
@@ -336,6 +337,7 @@ public:
 #endif
 
     String referrer() const;
+    String userAgent() const;
 
 private:
     MediaPlayer(MediaPlayerClient*);
diff --git a/Source/WebCore/platform/graphics/Pattern.cpp b/Source/WebCore/platform/graphics/Pattern.cpp
index c2c3de08b..43f1507d2 100644
--- a/Source/WebCore/platform/graphics/Pattern.cpp
+++ b/Source/WebCore/platform/graphics/Pattern.cpp
@@ -37,6 +37,7 @@ Pattern::Pattern(PassRefPtr<Image> image, bool repeatX, bool repeatY)
     , m_repeatY(repeatY)
 #if USE(SKIA)
     , m_pattern(0)
+    , m_externalMemoryAllocated(0)
 #endif
 {
     ASSERT(m_tileImage);
diff --git a/Source/WebCore/platform/graphics/Pattern.h b/Source/WebCore/platform/graphics/Pattern.h
index db3661231..0909584a0 100644
--- a/Source/WebCore/platform/graphics/Pattern.h
+++ b/Source/WebCore/platform/graphics/Pattern.h
@@ -95,6 +95,9 @@ private:
     bool m_repeatY;
     AffineTransform m_patternSpaceTransformation;
     PlatformPatternPtr m_pattern;
+#if USE(SKIA)
+    size_t m_externalMemoryAllocated;
+#endif
 };
 
 } //namespace
diff --git a/Source/WebCore/platform/graphics/Region.cpp b/Source/WebCore/platform/graphics/Region.cpp
index 789556496..3f093ebdc 100644
--- a/Source/WebCore/platform/graphics/Region.cpp
+++ b/Source/WebCore/platform/graphics/Region.cpp
@@ -77,6 +77,31 @@ bool Region::contains(const IntPoint& point) const
     return contains(IntRect(point, IntSize(1, 1)));
 }
 
+bool Region::intersects(const Region& region) const
+{
+    if (!m_bounds.intersects(region.m_bounds))
+        return false;
+
+    // FIXME: this could be optimized.
+    Region tempRegion(*this);
+    tempRegion.intersect(region);
+    return !tempRegion.isEmpty();
+}
+
+unsigned Region::totalArea() const
+{
+    Vector<IntRect> rects = this->rects();
+    size_t size = rects.size();
+    unsigned totalArea = 0;
+
+    for (size_t i = 0; i < size; ++i) {
+        IntRect rect = rects[i];
+        totalArea += (rect.width() * rect.height());
+    }
+
+    return totalArea;
+}
+
 Region::Shape::Shape()
 {
 }
diff --git a/Source/WebCore/platform/graphics/Region.h b/Source/WebCore/platform/graphics/Region.h
index 8bc839578..a87269567 100644
--- a/Source/WebCore/platform/graphics/Region.h
+++ b/Source/WebCore/platform/graphics/Region.h
@@ -52,6 +52,11 @@ public:
 
     bool contains(const IntPoint&) const;
 
+    // Returns true if the query region intersects any part of this region.
+    bool intersects(const Region&) const;
+
+    unsigned totalArea() const;
+
 #ifndef NDEBUG
     void dump() const;
 #endif
diff --git a/Source/WebCore/platform/graphics/ShadowBlur.cpp b/Source/WebCore/platform/graphics/ShadowBlur.cpp
index 0f207f83d..3b8a956b0 100644
--- a/Source/WebCore/platform/graphics/ShadowBlur.cpp
+++ b/Source/WebCore/platform/graphics/ShadowBlur.cpp
@@ -73,14 +73,14 @@ public:
         m_bufferInUse = true;
 #endif
         // We do not need to recreate the buffer if the current buffer is large enough.
-        if (m_imageBuffer && m_imageBuffer->width() >= size.width() && m_imageBuffer->height() >= size.height())
+        if (m_imageBuffer && m_imageBuffer->logicalSize().width() >= size.width() && m_imageBuffer->logicalSize().height() >= size.height())
             return m_imageBuffer.get();
 
         // Round to the nearest 32 pixels so we do not grow the buffer for similar sized requests.
         IntSize roundedSize(roundUpToMultipleOf32(size.width()), roundUpToMultipleOf32(size.height()));
 
         clearScratchBuffer();
-        m_imageBuffer = ImageBuffer::create(roundedSize);
+        m_imageBuffer = ImageBuffer::create(roundedSize, 1);
         return m_imageBuffer.get();
     }
 
@@ -440,7 +440,7 @@ void ShadowBlur::drawShadowBuffer(GraphicsContext* graphicsContext)
 
     GraphicsContextStateSaver stateSaver(*graphicsContext);
 
-    IntSize bufferSize = m_layerImage->size();
+    IntSize bufferSize = m_layerImage->internalSize();
     if (bufferSize != m_layerSize) {
         // The rect passed to clipToImageBuffer() has to be the size of the entire buffer,
         // but we may not have cleared it all, so clip to the filled part first.
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.cpp b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
index acf4c8957..9bd424c94 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.cpp
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
@@ -1,5 +1,5 @@
 /*
- Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ Copyright (C) 2010-2012 Nokia Corporation and/or its subsidiary(-ies)
  
  This library is free software; you can redistribute it and/or
  modify it under the terms of the GNU Library General Public
@@ -26,7 +26,7 @@
 #include "TiledBackingStoreClient.h"
 
 namespace WebCore {
-    
+
 static const int defaultTileDimension = 512;
 
 static IntPoint innerBottomRight(const IntRect& rect)
@@ -38,8 +38,8 @@ static IntPoint innerBottomRight(const IntRect& rect)
 TiledBackingStore::TiledBackingStore(TiledBackingStoreClient* client, PassOwnPtr<TiledBackingStoreBackend> backend)
     : m_client(client)
     , m_backend(backend)
-    , m_tileBufferUpdateTimer(new TileTimer(this, &TiledBackingStore::tileBufferUpdateTimerFired))
-    , m_tileCreationTimer(new TileTimer(this, &TiledBackingStore::tileCreationTimerFired))
+    , m_tileBufferUpdateTimer(this, &TiledBackingStore::tileBufferUpdateTimerFired)
+    , m_backingStoreUpdateTimer(this, &TiledBackingStore::backingStoreUpdateTimerFired)
     , m_tileSize(defaultTileDimension, defaultTileDimension)
     , m_tileCreationDelay(0.01)
     , m_coverAreaMultiplier(2.0f)
@@ -52,15 +52,13 @@ TiledBackingStore::TiledBackingStore(TiledBackingStoreClient* client, PassOwnPtr
 
 TiledBackingStore::~TiledBackingStore()
 {
-    delete m_tileBufferUpdateTimer;
-    delete m_tileCreationTimer;
 }
 
 void TiledBackingStore::setTileSize(const IntSize& size)
 {
     m_tileSize = size;
     m_tiles.clear();
-    startTileCreationTimer();
+    startBackingStoreUpdateTimer();
 }
 
 void TiledBackingStore::setTileCreationDelay(double delay)
@@ -68,25 +66,25 @@ void TiledBackingStore::setTileCreationDelay(double delay)
     m_tileCreationDelay = delay;
 }
 
-void TiledBackingStore::coverWithTilesIfNeeded(const FloatPoint& panningTrajectoryVector)
+void TiledBackingStore::coverWithTilesIfNeeded(const FloatPoint& trajectoryVector)
 {
-    IntRect visibleRect = visibleContentsRect();
-    if (m_visibleRectTrajectoryVector == panningTrajectoryVector && m_previousVisibleRect == visibleRect)
+    IntRect visibleRect = this->visibleRect();
+    if (m_trajectoryVector == trajectoryVector && m_visibleRect == visibleRect)
         return;
 
-    m_visibleRectTrajectoryVector = panningTrajectoryVector;
-    m_previousVisibleRect = visibleRect;
+    m_trajectoryVector = trajectoryVector;
+    m_visibleRect = visibleRect;
 
-    startTileCreationTimer();
+    startBackingStoreUpdateTimer();
 }
 
 void TiledBackingStore::invalidate(const IntRect& contentsDirtyRect)
 {
-    IntRect dirtyRect(mapFromContents(contentsDirtyRect));
-    
+    IntRect dirtyRect(intersection(mapFromContents(contentsDirtyRect), m_keepRect));
+
     Tile::Coordinate topLeft = tileCoordinateForPoint(dirtyRect.location());
     Tile::Coordinate bottomRight = tileCoordinateForPoint(innerBottomRight(dirtyRect));
-    
+
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
         for (unsigned xCoordinate = topLeft.x(); xCoordinate <= bottomRight.x(); ++xCoordinate) {
             RefPtr<Tile> currentTile = tileAt(Tile::Coordinate(xCoordinate, yCoordinate));
@@ -103,7 +101,7 @@ void TiledBackingStore::updateTileBuffers()
 {
     if (!m_client->tiledBackingStoreUpdatesAllowed() || m_contentsFrozen)
         return;
-    
+
     m_client->tiledBackingStorePaintBegin();
 
     Vector<IntRect> paintedArea;
@@ -114,7 +112,7 @@ void TiledBackingStore::updateTileBuffers()
             continue;
         dirtyTiles.append(it->second);
     }
-    
+
     if (dirtyTiles.isEmpty()) {
         m_client->tiledBackingStorePaintEnd(paintedArea);
         return;
@@ -136,13 +134,13 @@ void TiledBackingStore::updateTileBuffers()
 void TiledBackingStore::paint(GraphicsContext* context, const IntRect& rect)
 {
     context->save();
-    
+
     // Assumes the backing store is painted with the scale transform applied.
     // Since tile content is already scaled, first revert the scaling from the painter.
     context->scale(FloatSize(1.f / m_contentsScale, 1.f / m_contentsScale));
-    
+
     IntRect dirtyRect = mapFromContents(rect);
-    
+
     Tile::Coordinate topLeft = tileCoordinateForPoint(dirtyRect.location());
     Tile::Coordinate bottomRight = tileCoordinateForPoint(innerBottomRight(dirtyRect));
 
@@ -164,7 +162,7 @@ void TiledBackingStore::paint(GraphicsContext* context, const IntRect& rect)
     context->restore();
 }
 
-IntRect TiledBackingStore::visibleContentsRect() const
+IntRect TiledBackingStore::visibleRect() const
 {
     return mapFromContents(intersection(m_client->tiledBackingStoreVisibleRect(), m_client->tiledBackingStoreContentsRect()));
 }
@@ -180,26 +178,24 @@ void TiledBackingStore::setContentsScale(float scale)
         return;
     commitScaleChange();
 }
-    
+
 void TiledBackingStore::commitScaleChange()
 {
     m_contentsScale = m_pendingScale;
     m_pendingScale = 0;
     m_tiles.clear();
-    createTiles();
+    coverWithTilesIfNeeded();
 }
 
 double TiledBackingStore::tileDistance(const IntRect& viewport, const Tile::Coordinate& tileCoordinate) const
 {
     if (viewport.intersects(tileRectForCoordinate(tileCoordinate)))
         return 0;
-    
+
     IntPoint viewCenter = viewport.location() + IntSize(viewport.width() / 2, viewport.height() / 2);
     Tile::Coordinate centerCoordinate = tileCoordinateForPoint(viewCenter);
-    
-    // Manhattan distance, biased so that vertical distances are shorter.
-    const double horizontalBias = 1.3;
-    return abs(centerCoordinate.y() - tileCoordinate.y()) + horizontalBias * abs(centerCoordinate.x() - tileCoordinate.x());
+
+    return std::max(abs(centerCoordinate.y() - tileCoordinate.y()), abs(centerCoordinate.x() - tileCoordinate.x()));
 }
 
 // Returns a ratio between 0.0f and 1.0f of the surface of contentsRect covered by rendered tiles.
@@ -215,7 +211,7 @@ float TiledBackingStore::coverageRatio(const WebCore::IntRect& contentsRect) con
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
         for (unsigned xCoordinate = topLeft.x(); xCoordinate <= bottomRight.x(); ++xCoordinate) {
             Tile::Coordinate currentCoordinate(xCoordinate, yCoordinate);
-            RefPtr<Tile> currentTile = tileAt(Tile::Coordinate(xCoordinate, yCoordinate));
+            RefPtr<Tile> currentTile = tileAt(currentCoordinate);
             if (currentTile && currentTile->isReadyToPaint()) {
                 IntRect coverRect = intersection(dirtyRect, currentTile->rect());
                 coverArea += coverRect.width() * coverRect.height();
@@ -227,35 +223,46 @@ float TiledBackingStore::coverageRatio(const WebCore::IntRect& contentsRect) con
 
 bool TiledBackingStore::visibleAreaIsCovered() const
 {
-    return coverageRatio(visibleContentsRect()) == 1.0f;
+    return coverageRatio(visibleRect()) == 1.0f;
 }
 
 void TiledBackingStore::createTiles()
 {
-    if (m_contentsFrozen)
+    // Guard here as as these can change before the timer fires.
+    if (isBackingStoreUpdatesSuspended())
         return;
-    
-    IntRect visibleRect = visibleContentsRect();
-    m_previousVisibleRect = visibleRect;
+
+    // Update our backing store geometry.
+    const IntRect previousRect = m_rect;
+    m_rect = mapFromContents(m_client->tiledBackingStoreContentsRect());
+
+    const IntRect visibleRect = this->visibleRect();
+    m_visibleRect = visibleRect;
 
     if (visibleRect.isEmpty())
         return;
 
-    // Resize tiles on edges in case the contents size has changed.
-    bool didResizeTiles = resizeEdgeTiles();
-
     IntRect keepRect;
     IntRect coverRect;
     computeCoverAndKeepRect(visibleRect, coverRect, keepRect);
 
-    dropTilesOutsideRect(keepRect);
-    
-    // Search for the tile position closest to the viewport center that does not yet contain a tile. 
+    setKeepRect(keepRect);
+
+    // Resize tiles at the edge in case the contents size has changed, but only do so
+    // after having dropped tiles outside the keep rect.
+    bool didResizeTiles = false;
+    if (previousRect != m_rect)
+        didResizeTiles = resizeEdgeTiles();
+
+    // Search for the tile position closest to the viewport center that does not yet contain a tile.
     // Which position is considered the closest depends on the tileDistance function.
     double shortestDistance = std::numeric_limits<double>::infinity();
     Vector<Tile::Coordinate> tilesToCreate;
     unsigned requiredTileCount = 0;
 
+    // Cover areas (in tiles) with minimum distance from the visible rect. If the visible rect is
+    // not covered already it will be covered first in one go, due to the distance being 0 for tiles
+    // inside the visible rect.
     Tile::Coordinate topLeft = tileCoordinateForPoint(coverRect.location());
     Tile::Coordinate bottomRight = tileCoordinateForPoint(innerBottomRight(coverRect));
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
@@ -264,7 +271,6 @@ void TiledBackingStore::createTiles()
             if (tileAt(currentCoordinate))
                 continue;
             ++requiredTileCount;
-            // Distance is 0 for all tiles inside the visibleRect.
             double distance = tileDistance(visibleRect, currentCoordinate);
             if (distance > shortestDistance)
                 continue;
@@ -284,18 +290,18 @@ void TiledBackingStore::createTiles()
     }
     requiredTileCount -= tilesToCreateCount;
 
-    // Paint the content of the newly created tiles.
+    // Paint the content of the newly created tiles or resized tiles.
     if (tilesToCreateCount || didResizeTiles)
         updateTileBuffers();
 
     // Re-call createTiles on a timer to cover the visible area with the newest shortest distance.
     if (requiredTileCount)
-        m_tileCreationTimer->startOneShot(m_tileCreationDelay);
+        m_backingStoreUpdateTimer.startOneShot(m_tileCreationDelay);
 }
 
 void TiledBackingStore::adjustForContentsRect(IntRect& rect) const
 {
-    IntRect bounds = contentsRect();
+    IntRect bounds = m_rect;
     IntSize candidateSize = rect.size();
 
     // We will try to keep the cover and keep rect the same size at all time, which
@@ -334,7 +340,7 @@ void TiledBackingStore::computeCoverAndKeepRect(const IntRect& visibleRect, IntR
         coverRect.inflateY(visibleRect.height() * (m_coverAreaMultiplier - 1) / 2);
         keepRect = coverRect;
 
-        float trajectoryVectorNorm = sqrt(pow(m_visibleRectTrajectoryVector.x(), 2) + pow(m_visibleRectTrajectoryVector.y(), 2));
+        float trajectoryVectorNorm = sqrt(pow(m_trajectoryVector.x(), 2) + pow(m_trajectoryVector.y(), 2));
         if (trajectoryVectorNorm) {
             // A null trajectory vector (no motion) means that tiles for the coverArea will be created.
             // A non-null trajectory vector will shrink the covered rect to visibleRect plus its expansion from its
@@ -350,8 +356,8 @@ void TiledBackingStore::computeCoverAndKeepRect(const IntRect& visibleRect, IntR
 
             // Unite the visible rect with a "ghost" of the visible rect moved in the direction of the trajectory vector.
             coverRect = visibleRect;
-            coverRect.move(coverRect.width() * m_visibleRectTrajectoryVector.x() / trajectoryVectorNorm * trajectoryVectorMultiplier,
-                           coverRect.height() * m_visibleRectTrajectoryVector.y() / trajectoryVectorNorm * trajectoryVectorMultiplier);
+            coverRect.move(coverRect.width() * m_trajectoryVector.x() / trajectoryVectorNorm * trajectoryVectorMultiplier,
+                           coverRect.height() * m_trajectoryVector.y() / trajectoryVectorNorm * trajectoryVectorMultiplier);
 
             coverRect.unite(visibleRect);
         }
@@ -367,10 +373,19 @@ void TiledBackingStore::computeCoverAndKeepRect(const IntRect& visibleRect, IntR
     adjustForContentsRect(keepRect);
 }
 
+bool TiledBackingStore::isBackingStoreUpdatesSuspended() const
+{
+    return m_contentsFrozen;
+}
+
+bool TiledBackingStore::isTileBufferUpdatesSuspended() const
+{
+    return m_contentsFrozen || !m_client->tiledBackingStoreUpdatesAllowed();
+}
+
 bool TiledBackingStore::resizeEdgeTiles()
 {
     bool wasResized = false;
-
     Vector<Tile::Coordinate> tilesToRemove;
     TileMap::iterator end = m_tiles.end();
     for (TileMap::iterator it = m_tiles.begin(); it != end; ++it) {
@@ -390,8 +405,10 @@ bool TiledBackingStore::resizeEdgeTiles()
     return wasResized;
 }
 
-void TiledBackingStore::dropTilesOutsideRect(const IntRect& keepRect)
+void TiledBackingStore::setKeepRect(const IntRect& keepRect)
 {
+    // Drop tiles outside the new keepRect.
+
     FloatRect keepRectF = keepRect;
 
     Vector<Tile::Coordinate> toRemove;
@@ -405,11 +422,13 @@ void TiledBackingStore::dropTilesOutsideRect(const IntRect& keepRect)
     unsigned removeCount = toRemove.size();
     for (unsigned n = 0; n < removeCount; ++n)
         removeTile(toRemove[n]);
+
+    m_keepRect = keepRect;
 }
 
 void TiledBackingStore::removeAllNonVisibleTiles()
 {
-    dropTilesOutsideRect(visibleContentsRect());
+    setKeepRect(visibleRect());
 }
 
 PassRefPtr<Tile> TiledBackingStore::tileAt(const Tile::Coordinate& coordinate) const
@@ -443,11 +462,6 @@ IntRect TiledBackingStore::mapFromContents(const IntRect& rect) const
         rect.height() * m_contentsScale));
 }
 
-IntRect TiledBackingStore::contentsRect() const
-{
-    return mapFromContents(m_client->tiledBackingStoreContentsRect());
-}
-
 IntRect TiledBackingStore::tileRectForCoordinate(const Tile::Coordinate& coordinate) const
 {
     IntRect rect(coordinate.x() * m_tileSize.width(),
@@ -455,10 +469,10 @@ IntRect TiledBackingStore::tileRectForCoordinate(const Tile::Coordinate& coordin
                  m_tileSize.width(),
                  m_tileSize.height());
 
-    rect.intersect(contentsRect());
+    rect.intersect(m_rect);
     return rect;
 }
-    
+
 Tile::Coordinate TiledBackingStore::tileCoordinateForPoint(const IntPoint& point) const
 {
     int x = point.x() / m_tileSize.width();
@@ -466,27 +480,26 @@ Tile::Coordinate TiledBackingStore::tileCoordinateForPoint(const IntPoint& point
     return Tile::Coordinate(std::max(x, 0), std::max(y, 0));
 }
 
-
 void TiledBackingStore::startTileBufferUpdateTimer()
 {
-    if (m_tileBufferUpdateTimer->isActive() || !m_client->tiledBackingStoreUpdatesAllowed() || m_contentsFrozen)
+    if (m_tileBufferUpdateTimer.isActive() || isTileBufferUpdatesSuspended())
         return;
-    m_tileBufferUpdateTimer->startOneShot(0);
+    m_tileBufferUpdateTimer.startOneShot(0);
 }
 
-void TiledBackingStore::tileBufferUpdateTimerFired(TileTimer*)
+void TiledBackingStore::tileBufferUpdateTimerFired(Timer<TiledBackingStore>*)
 {
     updateTileBuffers();
 }
 
-void TiledBackingStore::startTileCreationTimer()
+void TiledBackingStore::startBackingStoreUpdateTimer()
 {
-    if (m_tileCreationTimer->isActive() || m_contentsFrozen)
+    if (m_backingStoreUpdateTimer.isActive() || isBackingStoreUpdatesSuspended())
         return;
-    m_tileCreationTimer->startOneShot(0);
+    m_backingStoreUpdateTimer.startOneShot(0);
 }
 
-void TiledBackingStore::tileCreationTimerFired(TileTimer*)
+void TiledBackingStore::backingStoreUpdateTimerFired(Timer<TiledBackingStore>*)
 {
     createTiles();
 }
@@ -506,7 +519,7 @@ void TiledBackingStore::setContentsFrozen(bool freeze)
     if (m_pendingScale)
         commitScaleChange();
     else {
-        startTileCreationTimer();
+        startBackingStoreUpdateTimer();
         startTileBufferUpdateTimer();
     }
 }
@@ -516,7 +529,7 @@ void TiledBackingStore::setSupportsAlpha(bool a)
     if (a == supportsAlpha())
         return;
     m_supportsAlpha = a;
-    invalidate(contentsRect());
+    invalidate(m_rect);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.h b/Source/WebCore/platform/graphics/TiledBackingStore.h
index ea5607b16..3c6ac9350 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.h
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.h
@@ -1,5 +1,5 @@
 /*
- Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ Copyright (C) 2010-2012 Nokia Corporation and/or its subsidiary(-ies)
  
  This library is free software; you can redistribute it and/or
  modify it under the terms of the GNU Library General Public
@@ -80,27 +80,27 @@ public:
 
 private:
     void startTileBufferUpdateTimer();
-    void startTileCreationTimer();
+    void startBackingStoreUpdateTimer();
 
-    typedef Timer<TiledBackingStore> TileTimer;
-
-    void tileBufferUpdateTimerFired(TileTimer*);
-    void tileCreationTimerFired(TileTimer*);
+    void tileBufferUpdateTimerFired(Timer<TiledBackingStore>*);
+    void backingStoreUpdateTimerFired(Timer<TiledBackingStore>*);
 
     void createTiles();
     void computeCoverAndKeepRect(const IntRect& visibleRect, IntRect& coverRect, IntRect& keepRect) const;
 
+    bool isBackingStoreUpdatesSuspended() const;
+    bool isTileBufferUpdatesSuspended() const;
+
     void commitScaleChange();
 
     bool resizeEdgeTiles();
-    void dropTilesOutsideRect(const IntRect&);
+    void setKeepRect(const IntRect&);
 
     PassRefPtr<Tile> tileAt(const Tile::Coordinate&) const;
     void setTile(const Tile::Coordinate& coordinate, PassRefPtr<Tile> tile);
     void removeTile(const Tile::Coordinate& coordinate);
 
-    IntRect contentsRect() const;
-    IntRect visibleContentsRect() const;
+    IntRect visibleRect() const;
 
     float coverageRatio(const IntRect&) const;
     void adjustForContentsRect(IntRect&) const;
@@ -114,15 +114,19 @@ private:
     typedef HashMap<Tile::Coordinate, RefPtr<Tile> > TileMap;
     TileMap m_tiles;
 
-    TileTimer* m_tileBufferUpdateTimer;
-    TileTimer* m_tileCreationTimer;
+    Timer<TiledBackingStore> m_tileBufferUpdateTimer;
+    Timer<TiledBackingStore> m_backingStoreUpdateTimer;
 
     IntSize m_tileSize;
     double m_tileCreationDelay;
     float m_coverAreaMultiplier;
-    FloatPoint m_visibleRectTrajectoryVector;
-    
-    IntRect m_previousVisibleRect;
+
+    FloatPoint m_trajectoryVector;
+    IntRect m_visibleRect;
+
+    IntRect m_keepRect;
+    IntRect m_rect;
+
     float m_contentsScale;
     float m_pendingScale;
 
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
index 0b30b2ec9..d8f1fe8dc 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
@@ -261,12 +261,18 @@ void MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL(const String& url)
     [options.get() setObject:[NSNumber numberWithInt:AVAssetReferenceRestrictionForbidRemoteReferenceToLocal | AVAssetReferenceRestrictionForbidLocalReferenceToRemote] forKey:AVURLAssetReferenceRestrictionsKey];
 
 #if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+    RetainPtr<NSMutableDictionary> headerFields(AdoptNS, [[NSMutableDictionary alloc] init]);
+
     String referrer = player()->referrer();
-    if (!referrer.isEmpty()) {
-        RetainPtr<NSMutableDictionary> headerFields(AdoptNS, [[NSMutableDictionary alloc] init]);
+    if (!referrer.isEmpty())
         [headerFields.get() setObject:referrer forKey:@"Referer"];
+
+    String userAgent = player()->userAgent();
+    if (!userAgent.isEmpty())
+        [headerFields.get() setObject:userAgent forKey:@"User-Agent"];
+
+    if ([headerFields.get() count])
         [options.get() setObject:headerFields.get() forKey:@"AVURLAssetHTTPHeaderFieldsKey"];
-    }
 #endif
 
     NSURL *cocoaURL = KURL(ParsedURLString, url);
diff --git a/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.cpp
new file mode 100644
index 000000000..4d2032679
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "CanvasLayerWebKitThread.h"
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(SKIA_GPU_CANVAS)
+
+#include "HTMLCanvasElement.h"
+#include "PlatformContextSkia.h"
+
+#include <BlackBerryPlatformGraphics.h>
+#include <GLES2/gl2.h>
+#include <GrGLTexture.h>
+#include <SkGpuDevice.h>
+
+namespace WebCore {
+
+CanvasLayerWebKitThread::CanvasLayerWebKitThread(HTMLCanvasElement* canvas)
+    : LayerWebKitThread(Layer, 0)
+{
+    setCanvas(canvas);
+}
+
+CanvasLayerWebKitThread::~CanvasLayerWebKitThread()
+{
+    if (m_texID) {
+        BlackBerry::Platform::Graphics::makeSharedResourceContextCurrent(BlackBerry::Platform::Graphics::GLES2);
+        glDeleteTextures(1, &m_texID);
+    }
+}
+
+void CanvasLayerWebKitThread::setCanvas(HTMLCanvasElement* canvas)
+{
+    m_canvas = canvas;
+    setNeedsTexture(isDrawable() && canvas);
+    setLayerProgramShader(LayerProgramShaderRGBA);
+    setNeedsDisplay();
+}
+
+void CanvasLayerWebKitThread::setNeedsDisplay()
+{
+    m_needsDisplay = true;
+    setNeedsCommit();
+}
+
+void CanvasLayerWebKitThread::updateTextureContentsIfNeeded()
+{
+    if (!m_needsDisplay)
+        return;
+
+    m_needsDisplay = false;
+
+    if (!m_canvas || !m_canvas->drawingContext())
+        return;
+
+    SkGpuDevice* gpuDevice = static_cast<SkGpuDevice*>(m_canvas->drawingContext()->platformContext()->canvas()->getDevice());
+    gpuDevice->makeRenderTargetCurrent();
+    // We know this is a GrGLTexture
+    if (GrGLTexture* deviceTexture = (GrGLTexture*)gpuDevice->accessTexture()) {
+        m_texWidth = deviceTexture->allocWidth();
+        m_texHeight = deviceTexture->allocHeight();
+    }
+
+    GLint previousTexture;
+    glGetIntegerv(GL_TEXTURE_BINDING_2D, &previousTexture);
+
+    if (!m_texID) {
+        glGenTextures(1, &m_texID);
+        glBindTexture(GL_TEXTURE_2D, m_texID);
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, m_canvas->width(), m_canvas->height(), 0, GL_RGBA, GL_UNSIGNED_BYTE, 0);
+
+        createFrontBufferLock();
+    }
+
+    pthread_mutex_lock(m_frontBufferLock);
+    glBindTexture(GL_TEXTURE_2D, m_texID);
+    glCopyTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, 0, 0, m_texWidth, m_texHeight, 0);
+    glBindTexture(GL_TEXTURE_2D, previousTexture);
+    pthread_mutex_unlock(m_frontBufferLock);
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(SKIA_GPU_CANVAS)
diff --git a/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.h b/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.h
new file mode 100644
index 000000000..9a731ce82
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef CanvasLayerWebKitThread_h
+#define CanvasLayerWebKitThread_h
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(SKIA_GPU_CANVAS)
+
+#include "LayerWebKitThread.h"
+
+namespace WebCore {
+
+class HTMLCanvasElement;
+
+class CanvasLayerWebKitThread : public LayerWebKitThread {
+public:
+    static PassRefPtr<CanvasLayerWebKitThread> create(HTMLCanvasElement* canvas)
+    {
+        return adoptRef(new CanvasLayerWebKitThread(canvas));
+    }
+
+    virtual ~CanvasLayerWebKitThread();
+
+    void setCanvas(HTMLCanvasElement*);
+
+    virtual void setNeedsDisplay();
+
+protected:
+    virtual void updateTextureContentsIfNeeded();
+
+private:
+    CanvasLayerWebKitThread(HTMLCanvasElement*);
+    bool m_needsDisplay;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(SKIA_GPU_CANVAS)
+
+#endif // CanvasLayerWebKitThread_h
diff --git a/Source/WebCore/platform/graphics/blackberry/DrawingBufferBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/DrawingBufferBlackBerry.cpp
new file mode 100644
index 000000000..c53108c00
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/DrawingBufferBlackBerry.cpp
@@ -0,0 +1,130 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DrawingBuffer.h"
+
+#include "GraphicsContext3D.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "LayerWebKitThread.h"
+#endif
+
+namespace WebCore {
+
+struct DrawingBufferInternal {
+    unsigned offscreenColorTexture;
+#if USE(ACCELERATED_COMPOSITING)
+    RefPtr<LayerWebKitThread> platformLayer;
+#endif
+};
+
+static unsigned generateColorTexture(GraphicsContext3D* context, const IntSize& size)
+{
+    unsigned offscreenColorTexture = context->createTexture();
+    if (!offscreenColorTexture)
+        return 0;
+
+    context->bindTexture(GraphicsContext3D::TEXTURE_2D, offscreenColorTexture);
+    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::NEAREST);
+    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::NEAREST);
+    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
+    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
+    context->texImage2D(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, size.width(), size.height(), 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, 0);
+    context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, offscreenColorTexture, 0);
+    return offscreenColorTexture;
+}
+
+DrawingBuffer::DrawingBuffer(GraphicsContext3D* context, const IntSize& size)
+    : m_context(context)
+    , m_size(size)
+    , m_fbo(context->createFramebuffer())
+{
+    m_internal = adoptPtr(new DrawingBufferInternal);
+
+    context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_fbo);
+    m_internal->offscreenColorTexture = generateColorTexture(context, size);
+}
+
+DrawingBuffer::~DrawingBuffer()
+{
+    if (!m_context)
+        return;
+
+    m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_fbo);
+    m_context->deleteTexture(m_internal->offscreenColorTexture);
+
+    clear();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void DrawingBuffer::publishToPlatformLayer()
+{
+    if (!m_context)
+        return;
+
+    if (m_callback)
+        m_callback->willPublish();
+
+    // FIXME: We do the copy in the canvas' (child) context so that it executes in the correct order relative to
+    // other commands in the child context. This ensures that the parent texture always contains a complete
+    // frame and not some intermediate result. However, there is no synchronization to ensure that this copy
+    // happens before the compositor draws. This means we might draw stale frames sometimes. Ideally this
+    // would insert a fence into the child command stream that the compositor could wait for.
+    m_context->makeContextCurrent();
+    m_context->flush();
+}
+#endif
+
+bool DrawingBuffer::reset(const IntSize& newSize)
+{
+    if (!m_context)
+        return false;
+
+    if (m_size == newSize)
+        return false;
+
+    m_size = newSize;
+
+    m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_internal->offscreenColorTexture);
+    m_context->texImage2D(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, m_size.width(), m_size.height(), 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, 0);
+
+    return true;
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* DrawingBuffer::platformLayer()
+{
+    return m_internal->platformLayer.get();
+}
+#endif
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp
new file mode 100644
index 000000000..56a585e04
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEBGL)
+
+#include "GraphicsContext3D.h"
+
+#include "BitmapImageSingleFrameSkia.h"
+#include "Extensions3DOpenGL.h"
+#include "GraphicsContext.h"
+#include "WebGLLayerWebKitThread.h"
+
+#include <BlackBerryPlatformGraphics.h>
+
+namespace WebCore {
+
+PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(Attributes attribs, HostWindow* hostWindow, RenderStyle renderStyle)
+{
+    // This implementation doesn't currently support rendering directly to a window.
+    if (renderStyle == RenderDirectlyToHostWindow)
+        return 0;
+
+    return adoptRef(new GraphicsContext3D(attribs, hostWindow, false));
+}
+
+GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, bool renderDirectlyToHostWindow)
+    : m_currentWidth(0)
+    , m_currentHeight(0)
+    , m_hostWindow(hostWindow)
+    , m_context(BlackBerry::Platform::Graphics::createWebGLContext())
+    , m_extensions(adoptPtr(new Extensions3DOpenGL(this)))
+    , m_attrs(attrs)
+    , m_texture(0)
+    , m_fbo(0)
+    , m_depthStencilBuffer(0)
+    , m_boundFBO(0)
+    , m_activeTexture(GL_TEXTURE0)
+    , m_boundTexture0(0)
+    , m_multisampleFBO(0)
+    , m_multisampleDepthStencilBuffer(0)
+    , m_multisampleColorBuffer(0)
+{
+    if (!renderDirectlyToHostWindow) {
+#if USE(ACCELERATED_COMPOSITING)
+        m_compositingLayer = WebGLLayerWebKitThread::create();
+#endif
+        makeContextCurrent();
+
+        Extensions3D* extensions = getExtensions();
+        if (!extensions->supports("GL_IMG_multisampled_render_to_texture"))
+            m_attrs.antialias = false;
+
+        // Create a texture to render into.
+        ::glGenTextures(1, &m_texture);
+        ::glBindTexture(GL_TEXTURE_2D, m_texture);
+        ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+        ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+        ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+        ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+        ::glBindTexture(GL_TEXTURE_2D, 0);
+
+        // Create an FBO.
+        ::glGenFramebuffers(1, &m_fbo);
+        ::glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glGenRenderbuffers(1, &m_depthStencilBuffer);
+        m_boundFBO = m_fbo;
+
+#if USE(ACCELERATED_COMPOSITING)
+        static_cast<WebGLLayerWebKitThread*>(m_compositingLayer.get())->setWebGLContext(this);
+#endif
+    }
+
+    // FIXME: If GraphicsContext3D is created with renderDirectlyToHostWindow == true,
+    // makeContextCurrent() will make the shared context current.
+    makeContextCurrent();
+
+    // FIXME: Do we need to enable GL_VERTEX_PROGRAM_POINT_SIZE with GL ES2? See PR #120141.
+
+    ::glClearColor(0, 0, 0, 0);
+}
+
+GraphicsContext3D::~GraphicsContext3D()
+{
+    if (m_texture) {
+        makeContextCurrent();
+        ::glDeleteTextures(1, &m_texture);
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glDeleteRenderbuffers(1, &m_depthStencilBuffer);
+        ::glDeleteFramebuffers(1, &m_fbo);
+    }
+
+    BlackBerry::Platform::Graphics::destroyWebGLContext(m_context);
+}
+
+bool GraphicsContext3D::paintsIntoCanvasBuffer() const
+{
+    // See PR #120141.
+    return true;
+}
+
+bool GraphicsContext3D::makeContextCurrent()
+{
+    BlackBerry::Platform::Graphics::useWebGLContext(m_context);
+    return true;
+}
+
+bool GraphicsContext3D::isGLES2Compliant() const
+{
+    return true;
+}
+
+bool GraphicsContext3D::isGLES2NPOTStrict() const
+{
+    return true;
+}
+
+bool GraphicsContext3D::isErrorGeneratedOnOutOfBoundsAccesses() const
+{
+    return false;
+}
+
+Platform3DObject GraphicsContext3D::platformTexture() const
+{
+    return m_texture;
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* GraphicsContext3D::platformLayer() const
+{
+    return m_compositingLayer.get();
+}
+#endif
+
+void GraphicsContext3D::paintToCanvas(const unsigned char* imagePixels, int imageWidth, int imageHeight, int canvasWidth, int canvasHeight,
+       GraphicsContext* context, bool flipY)
+{
+    // Reorder pixels into BGRA format.
+    unsigned char* tempPixels = new unsigned char[imageWidth * imageHeight * 4];
+
+    if (flipY) {
+        for (int y = 0; y < imageHeight; y++) {
+            const unsigned char *srcRow = imagePixels + (imageWidth * 4 * y);
+            unsigned char *destRow = tempPixels + (imageWidth * 4 * (imageHeight - y - 1));
+            for (int i = 0; i < imageWidth * 4; i += 4) {
+                destRow[i + 0] = srcRow[i + 2];
+                destRow[i + 1] = srcRow[i + 1];
+                destRow[i + 2] = srcRow[i + 0];
+                destRow[i + 3] = srcRow[i + 3];
+            }
+        }
+    } else {
+        for (int i = 0; i < imageWidth * imageHeight * 4; i += 4) {
+            tempPixels[i + 0] = imagePixels[i + 2];
+            tempPixels[i + 1] = imagePixels[i + 1];
+            tempPixels[i + 2] = imagePixels[i + 0];
+            tempPixels[i + 3] = imagePixels[i + 3];
+        }
+    }
+
+    SkBitmap canvasBitmap;
+
+    canvasBitmap.setConfig(SkBitmap::kARGB_8888_Config, canvasWidth, canvasHeight);
+    canvasBitmap.allocPixels(0, 0);
+    bool rc = canvasBitmap.copyPixelsFrom(static_cast<void*>(const_cast<unsigned char*>(tempPixels)), imageWidth * imageHeight * 4);
+    delete [] tempPixels;
+
+    FloatRect src(0, 0, canvasWidth, canvasHeight);
+    FloatRect dst(0, 0, imageWidth, imageHeight);
+
+    RefPtr<BitmapImageSingleFrameSkia> bitmapImage = BitmapImageSingleFrameSkia::create(canvasBitmap, false);
+    if (rc)
+        context->drawImage(bitmapImage.get(), ColorSpaceDeviceRGB, dst, src, CompositeCopy, false);
+}
+
+void GraphicsContext3D::setContextLostCallback(PassOwnPtr<ContextLostCallback>)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL)
+
diff --git a/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp
new file mode 100644
index 000000000..135257a03
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp
@@ -0,0 +1,886 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+/** FIXME
+ * This file borrows code heavily from platform/graphics/win/GraphicsLayerCACF.cpp
+ * (and hence it includes both copyrights)
+ * Ideally the common code (mostly the code that keeps track of the layer hierarchy)
+ * should be kept separate and shared between platforms. It would be a well worthwhile
+ * effort once the Windows implementation (binaries and headers) of CoreAnimation is
+ * checked in to the WebKit repository. Until then only Apple can make this happen.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayerBlackBerry.h"
+
+#include "FloatConversion.h"
+#include "FloatRect.h"
+#include "Image.h"
+#include "LayerAnimation.h"
+#include "LayerWebKitThread.h"
+
+namespace WebCore {
+
+static void setLayerBorderColor(LayerWebKitThread& layer, const Color& color)
+{
+    layer.setBorderColor(color);
+}
+
+static void clearBorderColor(LayerWebKitThread& layer)
+{
+    layer.setBorderColor(Color::transparent);
+}
+
+static void setLayerBackgroundColor(LayerWebKitThread& layer, const Color& color)
+{
+    layer.setBackgroundColor(color);
+}
+
+static void clearLayerBackgroundColor(LayerWebKitThread& layer)
+{
+    layer.setBackgroundColor(Color::transparent);
+}
+
+PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
+{
+    return adoptPtr(new GraphicsLayerBlackBerry(client));
+}
+
+GraphicsLayerBlackBerry::GraphicsLayerBlackBerry(GraphicsLayerClient* client)
+    : GraphicsLayer(client)
+    , m_suspendTime(0)
+    , m_contentsLayerPurpose(NoContentsLayer)
+    , m_contentsLayerHasBackgroundColor(false)
+{
+    m_layer = LayerWebKitThread::create(LayerData::Layer, this);
+
+    updateDebugIndicators();
+}
+
+GraphicsLayerBlackBerry::~GraphicsLayerBlackBerry()
+{
+    if (m_layer)
+        m_layer->setOwner(0);
+    if (m_contentsLayer)
+        m_contentsLayer->setOwner(0);
+    if (m_transformLayer)
+        m_transformLayer->setOwner(0);
+}
+
+void GraphicsLayerBlackBerry::setName(const String& inName)
+{
+    String name = String::format("GraphicsLayerBlackBerry(%p) GraphicsLayer(%p) ", m_layer.get(), this) + inName;
+    GraphicsLayer::setName(name);
+}
+
+bool GraphicsLayerBlackBerry::setChildren(const Vector<GraphicsLayer*>& children)
+{
+    bool childrenChanged = GraphicsLayer::setChildren(children);
+    // FIXME: GraphicsLayer::setChildren calls addChild() for each sublayer, which
+    // will end up calling updateSublayerList() N times.
+    if (childrenChanged)
+        updateSublayerList();
+
+    return childrenChanged;
+}
+
+void GraphicsLayerBlackBerry::addChild(GraphicsLayer* childLayer)
+{
+    GraphicsLayer::addChild(childLayer);
+    updateSublayerList();
+}
+
+void GraphicsLayerBlackBerry::addChildAtIndex(GraphicsLayer* childLayer, int index)
+{
+    GraphicsLayer::addChildAtIndex(childLayer, index);
+    updateSublayerList();
+}
+
+void GraphicsLayerBlackBerry::addChildBelow(GraphicsLayer* childLayer, GraphicsLayer* sibling)
+{
+    GraphicsLayer::addChildBelow(childLayer, sibling);
+    updateSublayerList();
+}
+
+void GraphicsLayerBlackBerry::addChildAbove(GraphicsLayer* childLayer, GraphicsLayer *sibling)
+{
+    GraphicsLayer::addChildAbove(childLayer, sibling);
+    updateSublayerList();
+}
+
+bool GraphicsLayerBlackBerry::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
+{
+    if (!GraphicsLayer::replaceChild(oldChild, newChild))
+        return false;
+
+    updateSublayerList();
+    return true;
+}
+
+void GraphicsLayerBlackBerry::removeFromParent()
+{
+    GraphicsLayer::removeFromParent();
+    layerForSuperlayer()->removeFromSuperlayer();
+}
+
+void GraphicsLayerBlackBerry::setPosition(const FloatPoint& point)
+{
+    GraphicsLayer::setPosition(point);
+    updateLayerPosition();
+}
+
+void GraphicsLayerBlackBerry::setAnchorPoint(const FloatPoint3D& point)
+{
+    if (point == m_anchorPoint)
+        return;
+
+    GraphicsLayer::setAnchorPoint(point);
+    updateAnchorPoint();
+}
+
+void GraphicsLayerBlackBerry::setSize(const FloatSize& size)
+{
+    if (size == m_size)
+        return;
+
+    GraphicsLayer::setSize(size);
+    updateLayerSize();
+}
+
+void GraphicsLayerBlackBerry::setTransform(const TransformationMatrix& transform)
+{
+    if (transform == m_transform)
+        return;
+
+    GraphicsLayer::setTransform(transform);
+    updateTransform();
+}
+
+void GraphicsLayerBlackBerry::setChildrenTransform(const TransformationMatrix& transform)
+{
+    if (transform == m_childrenTransform)
+        return;
+
+    GraphicsLayer::setChildrenTransform(transform);
+    updateChildrenTransform();
+}
+
+void GraphicsLayerBlackBerry::setPreserves3D(bool preserves3D)
+{
+    if (preserves3D == m_preserves3D)
+        return;
+
+    GraphicsLayer::setPreserves3D(preserves3D);
+    updateLayerPreserves3D();
+}
+
+void GraphicsLayerBlackBerry::setMasksToBounds(bool masksToBounds)
+{
+    if (masksToBounds == m_masksToBounds)
+        return;
+
+    GraphicsLayer::setMasksToBounds(masksToBounds);
+    updateMasksToBounds();
+}
+
+void GraphicsLayerBlackBerry::setDrawsContent(bool drawsContent)
+{
+    // Note carefully this early-exit is only correct because we also properly initialize
+    // LayerWebKitThread::isDrawable() whenever m_contentsLayer is set to a new layer in setupContentsLayer().
+    if (drawsContent == m_drawsContent)
+        return;
+
+    GraphicsLayer::setDrawsContent(drawsContent);
+    updateLayerIsDrawable();
+}
+
+void GraphicsLayerBlackBerry::setContentsVisible(bool contentsVisible)
+{
+    // Note carefully this early-exit is only correct because we also properly initialize
+    // LayerWebKitThread::isDrawable() whenever m_contentsLayer is set to a new layer in setupContentsLayer().
+    if (contentsVisible == m_contentsVisible)
+        return;
+
+    GraphicsLayer::setContentsVisible(contentsVisible);
+    updateLayerIsDrawable();
+}
+
+void GraphicsLayerBlackBerry::setMaskLayer(GraphicsLayer* maskLayer)
+{
+    if (maskLayer == m_maskLayer)
+        return;
+
+    GraphicsLayer::setMaskLayer(maskLayer);
+
+    LayerWebKitThread* maskLayerWebKit = m_maskLayer ? m_maskLayer->platformLayer() : 0;
+    if (maskLayerWebKit)
+        maskLayerWebKit->setIsMask(true);
+    m_layer->setMaskLayer(maskLayerWebKit);
+}
+
+void GraphicsLayerBlackBerry::setReplicatedByLayer(GraphicsLayer* layer)
+{
+    GraphicsLayerBlackBerry* layerWebKit = static_cast<GraphicsLayerBlackBerry*>(layer);
+    GraphicsLayer::setReplicatedByLayer(layer);
+    LayerWebKitThread* replicaLayer = layerWebKit ? layerWebKit->primaryLayer() : 0;
+    primaryLayer()->setReplicaLayer(replicaLayer);
+}
+
+void GraphicsLayerBlackBerry::setFixedPosition(bool fixed)
+{
+    if (fixed == m_fixedPosition)
+        return;
+
+    GraphicsLayer::setFixedPosition(fixed);
+    updateFixedPosition();
+}
+
+void GraphicsLayerBlackBerry::setHasFixedContainer(bool hasFixedContainer)
+{
+    if (hasFixedContainer == m_hasFixedContainer)
+        return;
+
+    GraphicsLayer::setHasFixedContainer(hasFixedContainer);
+    updateHasFixedContainer();
+}
+
+void GraphicsLayerBlackBerry::setHasFixedAncestorInDOMTree(bool hasFixedAncestorInDOMTree)
+{
+    if (hasFixedAncestorInDOMTree == m_hasFixedAncestorInDOMTree)
+        return;
+
+    GraphicsLayer::setHasFixedAncestorInDOMTree(hasFixedAncestorInDOMTree);
+    updateHasFixedAncestorInDOMTree();
+}
+
+void GraphicsLayerBlackBerry::setBackgroundColor(const Color& color)
+{
+    if (m_backgroundColorSet && m_backgroundColor == color)
+        return;
+
+    GraphicsLayer::setBackgroundColor(color);
+
+    m_contentsLayerHasBackgroundColor = true;
+    updateLayerBackgroundColor();
+}
+
+void GraphicsLayerBlackBerry::clearBackgroundColor()
+{
+    if (!m_backgroundColorSet)
+        return;
+
+    GraphicsLayer::clearBackgroundColor();
+    clearLayerBackgroundColor(*m_contentsLayer);
+}
+
+void GraphicsLayerBlackBerry::setContentsOpaque(bool opaque)
+{
+    if (m_contentsOpaque == opaque)
+        return;
+
+    GraphicsLayer::setContentsOpaque(opaque);
+    updateContentsOpaque();
+}
+
+void GraphicsLayerBlackBerry::setBackfaceVisibility(bool visible)
+{
+    if (m_backfaceVisibility == visible)
+        return;
+
+    GraphicsLayer::setBackfaceVisibility(visible);
+    updateBackfaceVisibility();
+}
+
+void GraphicsLayerBlackBerry::setOpacity(float opacity)
+{
+    float clampedOpacity = clampTo(opacity, 0.0f, 1.0f);
+
+    if (m_opacity == clampedOpacity)
+        return;
+
+    GraphicsLayer::setOpacity(clampedOpacity);
+    primaryLayer()->setOpacity(opacity);
+}
+
+void GraphicsLayerBlackBerry::setContentsNeedsDisplay()
+{
+    if (m_contentsLayer)
+        m_contentsLayer->setNeedsDisplay();
+}
+
+void GraphicsLayerBlackBerry::setNeedsDisplay()
+{
+    if (drawsContent())
+        m_layer->setNeedsDisplay();
+}
+
+void GraphicsLayerBlackBerry::setNeedsDisplayInRect(const FloatRect& rect)
+{
+    if (drawsContent())
+        m_layer->setNeedsDisplayInRect(rect);
+}
+
+void GraphicsLayerBlackBerry::setContentsRect(const IntRect& rect)
+{
+    if (rect == m_contentsRect)
+        return;
+
+    GraphicsLayer::setContentsRect(rect);
+    updateContentsRect();
+}
+
+static PassRefPtr<LayerAnimation> removeAnimationByIdAndProperty(int id, AnimatedPropertyID property, Vector<RefPtr<LayerAnimation> >& list)
+{
+    for (size_t i = 0; i < list.size(); ++i) {
+        if (list[i]->id() == id && list[i]->property() == property) {
+            RefPtr<LayerAnimation> layerAnimation = list[i];
+            list.remove(i);
+            return layerAnimation;
+        }
+    }
+
+    return PassRefPtr<LayerAnimation>();
+}
+
+static PassRefPtr<LayerAnimation> removeAnimationByName(const String& animationName, Vector<RefPtr<LayerAnimation> >& list)
+{
+    for (size_t i = 0; i < list.size(); ++i) {
+        if (list[i]->name() == animationName) {
+            RefPtr<LayerAnimation> layerAnimation = list[i];
+            list.remove(i);
+            return layerAnimation;
+        }
+    }
+
+    return PassRefPtr<LayerAnimation>();
+}
+
+bool GraphicsLayerBlackBerry::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, const String& animationName, double timeOffset)
+{
+    // This is what GraphicsLayerCA checks for.
+    if (!animation || animation->isEmptyOrZeroDuration() || values.size() < 2)
+        return false;
+
+    // We only support these two kinds of properties at the moment.
+    if (values.property() != AnimatedPropertyWebkitTransform && values.property() != AnimatedPropertyOpacity)
+        return false;
+
+    // Remove any running animation for the same property.
+    // FIXME: Maybe this is superstition, I got the idea from GraphicsLayerQt
+    // WebCore might be adding an animation with the same name, but for a different property
+    removeAnimationByIdAndProperty(LayerAnimation::idFromAnimation(animation), values.property(), m_runningAnimations);
+    removeAnimationByIdAndProperty(LayerAnimation::idFromAnimation(animation), values.property(), m_suspendedAnimations);
+
+    RefPtr<LayerAnimation> layerAnimation = LayerAnimation::create(values, boxSize, animation, animationName, timeOffset);
+
+#if DEBUG_LAYER_ANIMATION
+    fprintf(stderr, "LayerAnimation 0x%08x: Adding animation %s for property %d\n", layerAnimation.get(), animationName.latin1().data(), values.property());
+#endif
+
+    m_runningAnimations.append(layerAnimation);
+
+    updateAnimations();
+
+    return true;
+}
+
+void GraphicsLayerBlackBerry::pauseAnimation(const String& animationName, double timeOffset)
+{
+    // WebCore might have added several animations with the same name, but for different properties
+
+    while (RefPtr<LayerAnimation> animation = removeAnimationByName(animationName, m_runningAnimations)) {
+#if DEBUG_LAYER_ANIMATION
+        fprintf(stderr, "LayerAnimation 0x%08x: Pausing animation %s\n", animation.get(), animation->name().latin1().data());
+#endif
+
+        // LayerAnimation is readonly. Create a new animation with the same data except for timeOffset.
+        // WebCore will adjust the timeOffset for paused animations so it can be used to calculate the
+        // progress for the paused animation without knowing the exact timestamp when the animation was
+        // paused.
+        // If an animation was started with a timeOffset dt_orig and paused dt_pause seconds later, the
+        // cloned animation will have a timeOffset of dt_pause + dt_orig.
+        animation = animation->clone(timeOffset);
+        m_suspendedAnimations.append(animation);
+
+#if DEBUG_LAYER_ANIMATION
+        fprintf(stderr, "LayerAnimation 0x%08x: Paused animation %s\n", animation.get(), animation->name().latin1().data());
+#endif
+    };
+
+    updateAnimations();
+}
+
+void GraphicsLayerBlackBerry::removeAnimation(const String& animationName)
+{
+    // WebCore might have added several animations with the same name, but for different properties
+
+#if DEBUG_LAYER_ANIMATION
+    fprintf(stderr, "LayerAnimation: Removing animation %s\n", animationName.latin1().data());
+#endif
+
+    while (removeAnimationByName(animationName, m_runningAnimations)) { }
+    while (removeAnimationByName(animationName, m_suspendedAnimations)) { }
+
+    updateAnimations();
+}
+
+void GraphicsLayerBlackBerry::suspendAnimations(double time)
+{
+#if DEBUG_LAYER_ANIMATION
+    fprintf(stderr, "LayerAnimation: Suspending animations\n");
+#endif
+    m_suspendTime = time;
+}
+
+void GraphicsLayerBlackBerry::resumeAnimations()
+{
+#if DEBUG_LAYER_ANIMATION
+    fprintf(stderr, "LayerAnimation: Resuming animations\n");
+#endif
+    m_suspendTime = 0;
+}
+
+void GraphicsLayerBlackBerry::setContentsToImage(Image* image)
+{
+    bool childrenChanged = false;
+    if (image) {
+        m_contentsLayerPurpose = ContentsLayerForImage;
+        if (!m_contentsLayer)
+            childrenChanged = true;
+    } else {
+        m_contentsLayerPurpose = NoContentsLayer;
+        if (m_contentsLayer)
+            childrenChanged = true;
+    }
+
+    updateContentsImage(image);
+
+    if (childrenChanged)
+        updateSublayerList();
+}
+
+void GraphicsLayerBlackBerry::updateContentsImage(Image* image)
+{
+    if (image) {
+        if (!m_contentsLayer.get()) {
+            RefPtr<LayerWebKitThread> imageLayer = LayerWebKitThread::create(LayerData::Layer, this);
+
+            setupContentsLayer(imageLayer.get());
+            m_contentsLayer = imageLayer;
+            // m_contentsLayer will be parented by updateSublayerList.
+        }
+        m_contentsLayer->setContents(image);
+
+        updateContentsRect();
+    } else {
+        // No image. m_contentsLayer will be removed via updateSublayerList.
+        m_contentsLayer = 0;
+    }
+}
+
+void GraphicsLayerBlackBerry::setContentsToCanvas(PlatformLayer* platformLayer)
+{
+    bool childrenChanged = false;
+    if (platformLayer) {
+        platformLayer->setOwner(this);
+        if (m_contentsLayer.get() != platformLayer) {
+            setupContentsLayer(platformLayer);
+            m_contentsLayer = platformLayer;
+            m_contentsLayerPurpose = ContentsLayerForCanvas;
+            childrenChanged = true;
+        }
+        m_contentsLayer->setNeedsDisplay();
+        updateContentsRect();
+    } else {
+        if (m_contentsLayer) {
+            childrenChanged = true;
+
+            // The old contents layer will be removed via updateSublayerList.
+            m_contentsLayer = 0;
+        }
+    }
+
+    if (childrenChanged)
+        updateSublayerList();
+}
+
+void GraphicsLayerBlackBerry::setContentsToMedia(PlatformLayer* layer)
+{
+    bool childrenChanged = false;
+    if (layer) {
+        if (!m_contentsLayer.get() || m_contentsLayerPurpose != ContentsLayerForVideo) {
+            setupContentsLayer(layer);
+            m_contentsLayer = layer;
+            m_contentsLayerPurpose = ContentsLayerForVideo;
+            childrenChanged = true;
+        }
+        layer->setOwner(this);
+        layer->setNeedsDisplay();
+        updateContentsRect();
+    } else {
+        if (m_contentsLayer) {
+            childrenChanged = true;
+
+            // The old contents layer will be removed via updateSublayerList.
+            m_contentsLayer = 0;
+        }
+    }
+
+    if (childrenChanged)
+        updateSublayerList();
+}
+
+PlatformLayer* GraphicsLayerBlackBerry::hostLayerForSublayers() const
+{
+    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+}
+
+PlatformLayer* GraphicsLayerBlackBerry::layerForSuperlayer() const
+{
+    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+}
+
+PlatformLayer* GraphicsLayerBlackBerry::platformLayer() const
+{
+    return primaryLayer();
+}
+
+void GraphicsLayerBlackBerry::setDebugBackgroundColor(const Color& color)
+{
+    if (color.isValid())
+        setLayerBackgroundColor(*m_layer, color);
+    else
+        clearLayerBackgroundColor(*m_layer);
+}
+
+void GraphicsLayerBlackBerry::setDebugBorder(const Color& color, float borderWidth)
+{
+    if (color.isValid()) {
+        setLayerBorderColor(*m_layer, color);
+        m_layer->setBorderWidth(borderWidth);
+    } else {
+        clearBorderColor(*m_layer);
+        m_layer->setBorderWidth(0);
+    }
+}
+
+void GraphicsLayerBlackBerry::updateSublayerList()
+{
+    Vector<RefPtr<LayerWebKitThread> > newSublayers;
+
+    if (m_transformLayer) {
+        // Add the primary layer first. Even if we have negative z-order children, the primary layer always comes behind.
+        newSublayers.append(m_layer.get());
+    } else if (m_contentsLayer) {
+        // FIXME: add the contents layer in the correct order with negative z-order children.
+        // This does not cause visible rendering issues because currently contents layers are only used
+        // for replaced elements that don't have children.
+        newSublayers.append(m_contentsLayer.get());
+    }
+
+    const Vector<GraphicsLayer*>& childLayers = children();
+    size_t numChildren = childLayers.size();
+    for (size_t i = 0; i < numChildren; ++i) {
+        GraphicsLayerBlackBerry* curChild = static_cast<GraphicsLayerBlackBerry*>(childLayers[i]);
+
+        LayerWebKitThread* childLayer = curChild->layerForSuperlayer();
+        newSublayers.append(childLayer);
+    }
+
+    for (size_t i = 0; i < newSublayers.size(); ++i)
+        newSublayers[i]->removeFromSuperlayer();
+
+    if (m_transformLayer) {
+        m_transformLayer->setSublayers(newSublayers);
+
+        if (m_contentsLayer) {
+            // If we have a transform layer, then the contents layer is parented in the
+            // primary layer (which is itself a child of the transform layer).
+            m_layer->removeAllSublayers();
+            m_layer->addSublayer(m_contentsLayer);
+        }
+    } else
+        m_layer->setSublayers(newSublayers);
+}
+
+void GraphicsLayerBlackBerry::updateLayerPosition()
+{
+    // Position is offset on the layer by the layer anchor point.
+    FloatPoint layerPosition(m_position.x() + m_anchorPoint.x() * m_size.width(),
+                             m_position.y() + m_anchorPoint.y() * m_size.height());
+
+    primaryLayer()->setPosition(layerPosition);
+}
+
+void GraphicsLayerBlackBerry::updateLayerSize()
+{
+    IntSize layerSize(m_size.width(), m_size.height());
+    if (m_transformLayer) {
+        m_transformLayer->setBounds(layerSize);
+        // The anchor of the contents layer is always at 0.5, 0.5, so the position is center-relative.
+        FloatPoint centerPoint(m_size.width() / 2, m_size.height() / 2);
+        m_layer->setPosition(centerPoint);
+    }
+
+    m_layer->setBounds(layerSize);
+
+    // Note that we don't resize m_contentsLayer. It's up the caller to do that.
+
+    // If we've changed the bounds, we need to recalculate the position
+    // of the layer, taking anchor point into account.
+    updateLayerPosition();
+}
+
+void GraphicsLayerBlackBerry::updateAnchorPoint()
+{
+    primaryLayer()->setAnchorPoint(FloatPoint(m_anchorPoint.x(), m_anchorPoint.y()));
+    primaryLayer()->setAnchorPointZ(m_anchorPoint.z());
+    updateLayerPosition();
+}
+
+void GraphicsLayerBlackBerry::updateTransform()
+{
+    primaryLayer()->setTransform(m_transform);
+}
+
+void GraphicsLayerBlackBerry::updateChildrenTransform()
+{
+    primaryLayer()->setSublayerTransform(m_childrenTransform);
+}
+
+void GraphicsLayerBlackBerry::updateMasksToBounds()
+{
+    m_layer->setMasksToBounds(m_masksToBounds);
+    updateDebugIndicators();
+}
+
+void GraphicsLayerBlackBerry::updateContentsOpaque()
+{
+    m_layer->setOpaque(m_contentsOpaque);
+}
+
+void GraphicsLayerBlackBerry::updateBackfaceVisibility()
+{
+    m_layer->setDoubleSided(m_backfaceVisibility);
+}
+
+void GraphicsLayerBlackBerry::updateLayerPreserves3D()
+{
+    if (m_preserves3D && !m_transformLayer) {
+        // Create the transform layer.
+        m_transformLayer = LayerWebKitThread::create(LayerData::TransformLayer, this);
+
+        // Copy the position from this layer.
+        updateLayerPosition();
+        updateLayerSize();
+        updateAnchorPoint();
+        updateTransform();
+        updateChildrenTransform();
+        updateAnimations();
+
+        m_layer->setPosition(FloatPoint(m_size.width() / 2.0f, m_size.height() / 2.0f));
+
+        m_layer->setAnchorPoint(FloatPoint(0.5f, 0.5f));
+        TransformationMatrix identity;
+        m_layer->setTransform(identity);
+
+        // Set the old layer to opacity of 1. Further down we will set the opacity on the transform layer.
+        m_layer->setOpacity(1);
+
+        // Move this layer to be a child of the transform layer.
+        if (m_layer->superlayer())
+            m_layer->superlayer()->replaceSublayer(m_layer.get(), m_transformLayer.get());
+        m_transformLayer->addSublayer(m_layer.get());
+
+        m_transformLayer->setPreserves3D(true);
+        m_layer->setPreserves3D(true);
+
+        updateSublayerList();
+    } else if (!m_preserves3D && m_transformLayer) {
+        // Relace the transformLayer in the parent with this layer.
+        m_layer->removeFromSuperlayer();
+        if (m_transformLayer->superlayer())
+            m_transformLayer->superlayer()->replaceSublayer(m_transformLayer.get(), m_layer.get());
+
+        // Release the transform layer.
+        m_transformLayer = 0;
+
+        updateLayerPosition();
+        updateLayerSize();
+        updateAnchorPoint();
+        updateTransform();
+        updateChildrenTransform();
+        updateAnimations();
+
+        m_layer->setPreserves3D(false);
+
+        updateSublayerList();
+    }
+
+    updateOpacityOnLayer();
+}
+
+void GraphicsLayerBlackBerry::updateLayerIsDrawable()
+{
+    // For the rest of the accelerated compositor code, there is no reason to make a
+    // distinction between drawsContent and contentsVisible. So, for m_layer, these two
+    // flags are combined here. m_contentsLayer shouldn't receive the drawsContent flag
+    // so it is only given contentsVisible.
+    m_layer->setDrawable(m_drawsContent && m_contentsVisible);
+
+    if (m_contentsLayer)
+        m_contentsLayer->setDrawable(m_contentsVisible);
+
+    if (m_drawsContent)
+        m_layer->setNeedsDisplay();
+
+    updateDebugIndicators();
+}
+
+void GraphicsLayerBlackBerry::updateFixedPosition()
+{
+    m_layer->setFixedPosition(m_fixedPosition);
+}
+
+void GraphicsLayerBlackBerry::updateHasFixedContainer()
+{
+    m_layer->setHasFixedContainer(m_hasFixedContainer);
+}
+
+void GraphicsLayerBlackBerry::updateHasFixedAncestorInDOMTree()
+{
+    m_layer->setHasFixedAncestorInDOMTree(m_hasFixedAncestorInDOMTree);
+}
+
+void GraphicsLayerBlackBerry::updateLayerBackgroundColor()
+{
+    if (!m_contentsLayer)
+        return;
+
+    // We never create the contents layer just for background color yet.
+    if (m_backgroundColorSet)
+        setLayerBackgroundColor(*m_contentsLayer, m_backgroundColor);
+    else
+        clearLayerBackgroundColor(*m_contentsLayer);
+}
+
+void GraphicsLayerBlackBerry::updateAnimations()
+{
+    // When there is a transform layer, the transform must be set on that layer
+    // instead of the content layer. Opacity can be set on the transform layer or the
+    // layer with equal outcome, but currently it is also set on the transform
+    // layer. Since we only accelerate animations of these two properties, it
+    // is safe to move all accelerated animations to the transform layer, and
+    // remove them from the layer proper.
+    // So the following code, while it looks strange, is correct:
+    // we transfer all animations to the transform layer if it exists.
+    // FIXME: If other properties become animated, it may not be equivalent to
+    // move them to the transform layer. Then this code needs to be revisited
+    // to only move the transform animations to the transform layer.
+    primaryLayer()->setRunningAnimations(m_runningAnimations);
+    primaryLayer()->setSuspendedAnimations(m_suspendedAnimations);
+
+    // We need to move the animations to the transform layer if there is one.
+    if (m_transformLayer) {
+        m_layer->setRunningAnimations(Vector<RefPtr<LayerAnimation> >());
+        m_layer->setSuspendedAnimations(Vector<RefPtr<LayerAnimation> >());
+    }
+}
+
+void GraphicsLayerBlackBerry::updateContentsVideo()
+{
+    // FIXME: Implement
+}
+
+void GraphicsLayerBlackBerry::updateContentsRect()
+{
+    if (!m_contentsLayer)
+        return;
+
+    m_contentsLayer->setPosition(m_contentsRect.location());
+    m_contentsLayer->setBounds(m_contentsRect.size());
+}
+
+void GraphicsLayerBlackBerry::setupContentsLayer(LayerWebKitThread* contentsLayer)
+{
+    if (contentsLayer == m_contentsLayer)
+        return;
+
+    if (m_contentsLayer) {
+        m_contentsLayer->removeFromSuperlayer();
+        m_contentsLayer = 0;
+    }
+
+    if (contentsLayer) {
+        m_contentsLayer = contentsLayer;
+
+        m_contentsLayer->setAnchorPoint(FloatPoint::zero());
+
+        // It is necessary to update setDrawable as soon as we receive the new contentsLayer, for
+        // the correctness of early exit conditions in setDrawsContent() and setContentsVisible().
+        m_contentsLayer->setDrawable(m_contentsVisible);
+
+        // Insert the content layer first. Video elements require this, because they have
+        // shadow content that must display in front of the video.
+        m_layer->insertSublayer(m_contentsLayer.get(), 0);
+
+        updateContentsRect();
+
+        if (showDebugBorders()) {
+            setLayerBorderColor(*m_contentsLayer, Color(0, 0, 128, 180));
+            m_contentsLayer->setBorderWidth(1);
+        }
+    }
+    updateDebugIndicators();
+}
+
+// This function simply mimics the operation of GraphicsLayerCA
+void GraphicsLayerBlackBerry::updateOpacityOnLayer()
+{
+    primaryLayer()->setOpacity(m_opacity);
+}
+
+bool GraphicsLayerBlackBerry::contentsVisible(const IntRect& contentRect) const
+{
+    if (!m_client)
+        return false;
+
+    return m_client->contentsVisible(this, contentRect);
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.h b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.h
new file mode 100644
index 000000000..ef7cddaeb
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.h
@@ -0,0 +1,179 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GraphicsLayerBlackBerry_h
+#define GraphicsLayerBlackBerry_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayer.h"
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class LayerAnimation;
+class LayerWebKitThread;
+
+class GraphicsLayerBlackBerry : public GraphicsLayer {
+public:
+    GraphicsLayerBlackBerry(GraphicsLayerClient*);
+    virtual ~GraphicsLayerBlackBerry();
+
+    virtual void setName(const String&);
+
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
+    virtual void addChild(GraphicsLayer*);
+    virtual void addChildAtIndex(GraphicsLayer*, int index);
+    virtual void addChildAbove(GraphicsLayer*, GraphicsLayer* sibling);
+    virtual void addChildBelow(GraphicsLayer*, GraphicsLayer* sibling);
+    virtual bool replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild);
+
+    virtual void removeFromParent();
+
+    virtual void setPosition(const FloatPoint&);
+    virtual void setAnchorPoint(const FloatPoint3D&);
+    virtual void setSize(const FloatSize&);
+
+    virtual void setTransform(const TransformationMatrix&);
+
+    virtual void setChildrenTransform(const TransformationMatrix&);
+
+    virtual void setPreserves3D(bool);
+    virtual void setMasksToBounds(bool);
+    virtual void setDrawsContent(bool);
+    virtual void setContentsVisible(bool);
+    virtual void setMaskLayer(GraphicsLayer*);
+    virtual void setReplicatedByLayer(GraphicsLayer*);
+    virtual void setFixedPosition(bool);
+    virtual void setHasFixedContainer(bool);
+    virtual void setHasFixedAncestorInDOMTree(bool);
+
+    virtual void setBackgroundColor(const Color&);
+    virtual void clearBackgroundColor();
+
+    virtual void setContentsOpaque(bool);
+    virtual void setBackfaceVisibility(bool);
+
+    virtual void setOpacity(float);
+
+    virtual void setNeedsDisplay();
+    virtual void setNeedsDisplayInRect(const FloatRect&);
+
+    virtual void setContentsNeedsDisplay();
+
+    virtual void setContentsRect(const IntRect&);
+
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, const String& animationName, double timeOffset);
+    virtual void pauseAnimation(const String& animationName, double timeOffset);
+    virtual void removeAnimation(const String& animationName);
+
+    virtual void suspendAnimations(double time);
+    virtual void resumeAnimations();
+
+    virtual void setContentsToImage(Image*);
+    virtual void setContentsToMedia(PlatformLayer*);
+    virtual void setContentsToCanvas(PlatformLayer*);
+
+    virtual PlatformLayer* platformLayer() const;
+
+    virtual void setDebugBackgroundColor(const Color&);
+    virtual void setDebugBorder(const Color&, float borderWidth);
+
+    void notifySyncRequired()
+    {
+        if (m_client)
+            m_client->notifySyncRequired(this);
+    }
+
+    void notifyAnimationStarted(double time)
+    {
+        if (m_client)
+            m_client->notifyAnimationStarted(this, time);
+    }
+
+    bool contentsVisible(const IntRect& contentRect) const;
+
+private:
+    void updateOpacityOnLayer();
+
+    LayerWebKitThread* primaryLayer() const  { return m_transformLayer.get() ? m_transformLayer.get() : m_layer.get(); }
+    LayerWebKitThread* hostLayerForSublayers() const;
+    LayerWebKitThread* layerForSuperlayer() const;
+
+    void updateSublayerList();
+    void updateLayerPosition();
+    void updateLayerSize();
+    void updateAnchorPoint();
+    void updateTransform();
+    void updateChildrenTransform();
+    void updateMasksToBounds();
+    void updateContentsOpaque();
+    void updateBackfaceVisibility();
+    void updateLayerPreserves3D();
+    void updateLayerIsDrawable();
+    void updateFixedPosition();
+    void updateHasFixedContainer();
+    void updateHasFixedAncestorInDOMTree();
+    void updateLayerBackgroundColor();
+    void updateAnimations();
+
+    void updateContentsImage(Image*);
+    void updateContentsVideo();
+    void updateContentsRect();
+
+    void setupContentsLayer(LayerWebKitThread*);
+    LayerWebKitThread* contentsLayer() const { return m_contentsLayer.get(); }
+
+    RefPtr<LayerWebKitThread> m_layer;
+    RefPtr<LayerWebKitThread> m_transformLayer;
+    RefPtr<LayerWebKitThread> m_contentsLayer;
+
+    Vector<RefPtr<LayerAnimation> > m_runningAnimations;
+    Vector<RefPtr<LayerAnimation> > m_suspendedAnimations;
+    double m_suspendTime;
+
+    enum ContentsLayerPurpose {
+        NoContentsLayer = 0,
+        ContentsLayerForImage,
+        ContentsLayerForVideo,
+        ContentsLayerForCanvas,
+    };
+
+    ContentsLayerPurpose m_contentsLayerPurpose;
+    bool m_contentsLayerHasBackgroundColor : 1;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/blackberry/InstrumentedPlatformCanvas.h b/Source/WebCore/platform/graphics/blackberry/InstrumentedPlatformCanvas.h
new file mode 100644
index 000000000..1629ff107
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/InstrumentedPlatformCanvas.h
@@ -0,0 +1,292 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef InstrumentedPlatformCanvas_h
+#define InstrumentedPlatformCanvas_h
+
+#include <skia/ext/platform_canvas.h>
+
+#define DEBUG_SKIA_DRAWING 0
+#if DEBUG_SKIA_DRAWING
+#define WRAPCANVAS_LOG_ENTRY(...) do { \
+    fprintf(stderr, "%s ", __FUNCTION__); \
+    fprintf(stderr, __VA_ARGS__); \
+    fprintf(stderr, "\n"); \
+} while (0)
+#else
+#define WRAPCANVAS_LOG_ENTRY(...) ((void)0)
+#endif
+
+namespace WebCore {
+
+class InstrumentedPlatformCanvas : public skia::PlatformCanvas {
+public:
+    InstrumentedPlatformCanvas(int width, int height, bool is_opaque, SkDeviceFactory* factory)
+        : skia::PlatformCanvas(width, height, is_opaque, factory)
+        , m_size(width, height)
+        , m_isSolidColor(true)
+        , m_solidColor(0, 0, 0, 0)
+    {
+    }
+
+    virtual ~InstrumentedPlatformCanvas() { }
+
+    bool isSolidColor() const { return m_isSolidColor; }
+    Color solidColor() const { return m_solidColor; }
+
+    // overrides from SkCanvas
+    virtual int save(SaveFlags flags)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::save(flags);
+    }
+
+    virtual int saveLayer(const SkRect* bounds, const SkPaint* paint, SaveFlags flags)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        return skia::PlatformCanvas::saveLayer(bounds, paint, flags);
+    }
+
+    virtual void restore()
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        skia::PlatformCanvas::restore();
+    }
+
+    virtual bool translate(SkScalar dx, SkScalar dy)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::translate(dx, dy);
+    }
+
+    virtual bool scale(SkScalar sx, SkScalar sy)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::scale(sx, sy);
+    }
+
+    virtual bool rotate(SkScalar degrees)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::rotate(degrees);
+    }
+
+    virtual bool skew(SkScalar sx, SkScalar sy)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::skew(sx, sy);
+    }
+
+    virtual bool concat(const SkMatrix& matrix)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::concat(matrix);
+    }
+
+    virtual void setMatrix(const SkMatrix& matrix)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        skia::PlatformCanvas::setMatrix(matrix);
+    }
+
+    virtual bool clipRect(const SkRect& rect, SkRegion::Op op)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::clipRect(rect, op);
+    }
+
+    virtual bool clipPath(const SkPath& path, SkRegion::Op op) 
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        return skia::PlatformCanvas::clipPath(path, op);
+    }
+
+    virtual bool clipRegion(const SkRegion& region, SkRegion::Op op)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        return skia::PlatformCanvas::clipRegion(region, op);
+    }
+
+    virtual void clear(SkColor color)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = true;
+        m_solidColor = Color(color);
+        skia::PlatformCanvas::clear(color);
+    }
+
+    virtual void drawPaint(const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPaint(paint);
+    }
+
+    virtual void drawPoints(PointMode mode, size_t count, const SkPoint pts[],
+            const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPoints(mode, count, pts, paint);
+    }
+
+    virtual void drawRect(const SkRect& rect, const SkPaint& paint)
+    {
+        IntRect rectToDraw(rect);
+        WRAPCANVAS_LOG_ENTRY("rect = (x=%d,y=%d,width=%d,height=%d)", rectToDraw.x(), rectToDraw.y(), rectToDraw.width(), rectToDraw.height());
+        IntRect canvasRect(IntPoint(), m_size);
+        if (m_isSolidColor && getTotalMatrix().rectStaysRect() && getTotalClip().contains(canvasRect)) {
+            const SkMatrix& matrix = getTotalMatrix();
+            SkRect mapped;
+            matrix.mapRect(&mapped, rect);
+            if (mapped.contains(canvasRect)) {
+                Color color = solidColor(paint);
+                m_isSolidColor = color.isValid();
+                m_solidColor = color;
+             } else
+                 m_isSolidColor = false;
+        } else
+            m_isSolidColor = false;
+        skia::PlatformCanvas::drawRect(rect, paint);
+    }
+
+    virtual void drawPath(const SkPath& path, const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPath(path, paint);
+    }
+
+    virtual void drawBitmap(const SkBitmap& bitmap, SkScalar left,
+            SkScalar top, const SkPaint* paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawBitmap(bitmap, left, top, paint);
+    }
+
+    virtual void drawBitmapRect(const SkBitmap& bitmap, const SkIRect* src,
+            const SkRect& dst, const SkPaint* paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawBitmapRect(bitmap, src, dst, paint);
+    }
+
+    virtual void drawBitmapMatrix(const SkBitmap& bitmap,
+            const SkMatrix& matrix, const SkPaint* paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawBitmapMatrix(bitmap, matrix, paint);
+    }
+
+    virtual void drawSprite(const SkBitmap& bitmap, int left, int top,
+            const SkPaint* paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawSprite(bitmap, left, top, paint);
+    }
+
+    virtual void drawText(const void* text, size_t byteLength, SkScalar x,
+            SkScalar y, const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawText(text, byteLength, x, y, paint);
+    }
+
+    virtual void drawPosText(const void* text, size_t byteLength,
+            const SkPoint pos[], const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPosText(text, byteLength, pos, paint);
+    }
+
+    virtual void drawPosTextH(const void* text, size_t byteLength,
+            const SkScalar xpos[], SkScalar constY, const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPosTextH(text, byteLength, xpos, constY, paint);
+    }
+
+    virtual void drawTextOnPath(const void* text, size_t byteLength,
+            const SkPath& path, const SkMatrix* matrix, const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawTextOnPath(text, byteLength, path, matrix, paint);
+    }
+
+    virtual void drawPicture(SkPicture& picture)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPicture(picture);
+    }
+
+    virtual void drawVertices(VertexMode mode, int vertexCount,
+            const SkPoint vertices[], const SkPoint texs[],
+            const SkColor colors[], SkXfermode* xfermode,
+            const uint16_t indices[], int indexCount, const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawVertices(mode, vertexCount, vertices, texs, colors, xfermode, indices, indexCount, paint);
+    }
+
+    virtual void drawData(const void* data, size_t size)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawData(data, size);
+    }
+
+private:
+    Color solidColor(const SkPaint& paint)
+    {
+        if (paint.getStyle() != SkPaint::kFill_Style)
+            return Color();
+        if (paint.getLooper() || paint.getShader())
+            return Color();
+
+        SkXfermode::Mode mode;
+        SkXfermode::AsMode(paint.getXfermode(), &mode);
+        if (mode == SkXfermode::kClear_Mode)
+            return Color(0, 0, 0, 0);
+
+        if ((mode == SkXfermode::kSrcOver_Mode && paint.getAlpha() == 255) || mode == SkXfermode::kSrc_Mode)
+            return Color(paint.getColor());
+        return Color();
+    }
+
+    IntSize m_size;
+    bool m_isSolidColor;
+    Color m_solidColor;
+    SkPaint m_solidPaint;
+};
+
+} // namespace WebCore
+
+#endif // InstrumentedPlatformCanvas_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerData.h b/Source/WebCore/platform/graphics/blackberry/LayerData.h
new file mode 100644
index 000000000..57746fa64
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerData.h
@@ -0,0 +1,232 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef LayerData_h
+#define LayerData_h
+
+#include "Color.h"
+#include "FloatPoint.h"
+#include "FloatRect.h"
+#include "IntRect.h"
+#include "LayerAnimation.h"
+#include "PlatformString.h"
+#include "TransformationMatrix.h"
+#include <wtf/HashMap.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+
+namespace WebCore {
+
+class HTMLCanvasElement;
+class PluginView;
+#if ENABLE(VIDEO)
+class MediaPlayer;
+#endif
+
+class LayerData {
+public:
+    enum LayerType { Layer, TransformLayer, WebGLLayer };
+    enum FilterType { Linear, Nearest, Trilinear, Lanczos };
+    enum LayerProgramShader { LayerProgramShaderRGBA = 0,
+                              LayerProgramShaderBGRA,
+                              NumberOfLayerProgramShaders };
+
+    LayerData(LayerType type)
+        : m_layerType(type)
+        , m_anchorPoint(0.5, 0.5)
+        , m_backgroundColor(0, 0, 0, 0)
+        , m_borderColor(0, 0, 0, 0)
+        , m_opacity(1.0)
+        , m_anchorPointZ(0.0)
+        , m_borderWidth(0.0)
+        , m_layerProgramShader(LayerProgramShaderBGRA)
+        , m_pluginView(0)
+#if ENABLE(VIDEO)
+        , m_mediaPlayer(0)
+#endif
+        , m_texID(0)
+        , m_texWidth(0)
+        , m_texHeight(0)
+        , m_canvas(0)
+        , m_frontBufferLock(0)
+        , m_suspendTime(0)
+        , m_doubleSided(true)
+        , m_masksToBounds(false)
+        , m_opaque(true)
+        , m_preserves3D(false)
+        , m_needsDisplayOnBoundsChange(false)
+        , m_needsTexture(false)
+        , m_isFixedPosition(false)
+        , m_hasFixedContainer(false)
+        , m_hasFixedAncestorInDOMTree(false)
+        , m_isVisible(true)
+    {
+    }
+
+    virtual ~LayerData()
+    {
+    }
+
+    FloatPoint anchorPoint() const { return m_anchorPoint; }
+
+    float anchorPointZ() const { return m_anchorPointZ; }
+
+    Color backgroundColor() const { return m_backgroundColor; }
+
+    Color borderColor() const { return m_borderColor; }
+
+    float borderWidth() const { return m_borderWidth; }
+
+    IntSize bounds() const { return m_bounds; }
+
+    bool doubleSided() const { return m_doubleSided; }
+
+    FloatRect frame() const { return m_frame; }
+
+    bool masksToBounds() const { return m_masksToBounds; }
+
+    float opacity() const { return m_opacity; }
+
+    bool opaque() const { return m_opaque; }
+
+    FloatPoint position() const { return m_position; }
+
+    // This is currently only used for perspective transform, see GraphicsLayer::setChildrenTransform()
+    const TransformationMatrix& sublayerTransform() const { return m_sublayerTransform; }
+
+    const TransformationMatrix& transform() const { return m_transform; }
+
+    bool preserves3D() const { return m_preserves3D; }
+
+    unsigned getTextureID() const { return m_texID; }
+    void setTextureID(unsigned int value) { m_texID = value; }
+
+    bool needsTexture() const { return m_layerType == WebGLLayer ? true : m_needsTexture; }
+
+    LayerProgramShader layerProgramShader() const { return m_layerProgramShader; }
+
+    bool isFixedPosition() const { return m_isFixedPosition; }
+    bool hasFixedContainer() const { return m_hasFixedContainer; }
+    bool hasFixedAncestorInDOMTree() const { return m_hasFixedAncestorInDOMTree; }
+
+    PluginView* pluginView() const { return m_pluginView; }
+
+    IntRect holePunchRect() const { return m_holePunchRect; }
+    bool hasHolePunchRect() const { return !m_holePunchRect.isEmpty(); }
+
+#if ENABLE(VIDEO)
+    MediaPlayer* mediaPlayer() const { return m_mediaPlayer; }
+#endif
+
+    HTMLCanvasElement* canvas() const { return m_canvas; }
+
+    void replicate(LayerData *to) const { *to = *this; }
+
+    LayerType layerType() const { return m_layerType; }
+
+    bool includeVisibility() const
+    {
+        if (pluginView())
+            return true;
+
+#if ENABLE(VIDEO)
+        if (mediaPlayer())
+            return true;
+#endif
+
+        return false;
+    }
+
+protected:
+    LayerType m_layerType;
+
+    IntSize m_bounds;
+    FloatPoint m_position;
+    FloatPoint m_anchorPoint;
+    Color m_backgroundColor;
+    Color m_borderColor;
+
+    FloatRect m_frame;
+    TransformationMatrix m_transform;
+    TransformationMatrix m_sublayerTransform;
+
+    float m_opacity;
+    float m_anchorPointZ;
+    float m_borderWidth;
+
+    LayerProgramShader m_layerProgramShader;
+
+    PluginView* m_pluginView;
+#if ENABLE(VIDEO)
+    MediaPlayer* m_mediaPlayer;
+    IntRect m_holePunchClipRect;
+#endif
+    IntRect m_holePunchRect;
+
+    unsigned m_texID;
+    unsigned m_texWidth;
+    unsigned m_texHeight;
+
+    HTMLCanvasElement* m_canvas;
+
+    pthread_mutex_t* m_frontBufferLock;
+
+    Vector<RefPtr<LayerAnimation> > m_runningAnimations;
+    Vector<RefPtr<LayerAnimation> > m_suspendedAnimations;
+    double m_suspendTime;
+
+    unsigned m_doubleSided : 1;
+    unsigned m_masksToBounds : 1;
+    unsigned m_opaque : 1;
+    unsigned m_preserves3D : 1;
+    unsigned m_needsDisplayOnBoundsChange : 1;
+
+    unsigned m_needsTexture : 1;
+    unsigned m_isFixedPosition : 1;
+    unsigned m_hasFixedContainer : 1;
+    unsigned m_hasFixedAncestorInDOMTree : 1;
+
+    // The following is only available for media (video) and plugin layers.
+    unsigned m_isVisible : 1;
+
+    // CAUTION: all the data members are copied from one instance to another
+    // i.e. from one thread to another in the replicate method.
+    // Beware of adding any member data e.g. of type String whose default
+    // assignment operator doesn't behave properly if the two String instances
+    // are owned by different threads.
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // LayerData_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerMessage.h b/Source/WebCore/platform/graphics/blackberry/LayerMessage.h
new file mode 100644
index 000000000..1687a1f02
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerMessage.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef LayerMessage_h
+#define LayerMessage_h
+
+#include <BlackBerryPlatformExecutableMessage.h>
+#include <BlackBerryPlatformMessage.h>
+#include <BlackBerryPlatformMessageClient.h>
+
+typedef BlackBerry::Platform::Message PlatformMessage;
+
+namespace WebCore {
+
+inline bool isCompositingThread()
+{
+    return BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread();
+}
+
+inline pthread_t compositingThread()
+{
+    return BlackBerry::Platform::userInterfaceThreadMessageClient()->threadIdentifier();
+}
+
+inline bool isWebKitThread()
+{
+    return BlackBerry::Platform::webKitThreadMessageClient()->isCurrentThread();
+}
+
+inline pthread_t webKitThread()
+{
+    return BlackBerry::Platform::webKitThreadMessageClient()->threadIdentifier();
+}
+
+inline void dispatchCompositingMessage(PlatformMessage* msg)
+{
+    BlackBerry::Platform::userInterfaceThreadMessageClient()->dispatchMessage(msg);
+}
+
+inline void dispatchSyncCompositingMessage(PlatformMessage* msg)
+{
+    BlackBerry::Platform::userInterfaceThreadMessageClient()->dispatchSyncMessage(msg);
+}
+
+enum PlatformMessagePriority { PlatformMessagePriorityLow = -1, PlatformMessagePriorityNormal = 0, PlatformMessagePriorityHigh = 1 };
+
+inline void dispatchWebKitMessage(PlatformMessage* msg, PlatformMessagePriority priority = PlatformMessagePriorityNormal)
+{
+    if (priority != PlatformMessagePriorityNormal)
+        msg->setPriority(BlackBerry::Platform::webKitThreadMessageClient()->threadPriority() + priority);
+    BlackBerry::Platform::webKitThreadMessageClient()->dispatchMessage(msg);
+}
+
+} // namespace WebCore
+
+#endif // LayerMessage_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp
new file mode 100644
index 000000000..4012e46f7
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp
@@ -0,0 +1,1108 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerRenderer.h"
+
+#include "LayerCompositingThread.h"
+#include "PlatformString.h"
+#include "TextureCacheCompositingThread.h"
+
+#include <BlackBerryPlatformLog.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/text/CString.h>
+
+#define ENABLE_SCISSOR 1
+
+#define DEBUG_SHADER_COMPILATION 0
+#define DEBUG_DIRTY_LAYERS 0 // Show dirty layers as red.
+#define DEBUG_LAYER_ANIMATIONS 0 // Show running animations as green.
+#define DEBUG_VIDEO_CLIPPING 0
+
+using BlackBerry::Platform::Graphics::GLES2Context;
+using namespace std;
+
+namespace WebCore {
+
+static void checkGLError()
+{
+#ifndef NDEBUG
+    if (GLenum error = glGetError())
+        LOG_ERROR("GL Error: 0x%x " , error);
+#endif
+}
+
+static GLuint loadShader(GLenum type, const char* shaderSource)
+{
+    GLuint shader = glCreateShader(type);
+    if (!shader)
+        return 0;
+    glShaderSource(shader, 1, &shaderSource, 0);
+    glCompileShader(shader);
+    GLint compiled;
+    glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+    if (!compiled) {
+#if DEBUG_SHADER_COMPILATION
+        char infoLog[2048];
+        GLsizei length;
+        glGetShaderInfoLog(shader, 2048, &length, infoLog);
+        fprintf(stderr, "Failed to compile shader: %s", infoLog);
+#endif
+        glDeleteShader(shader);
+        return 0;
+    }
+    return shader;
+}
+
+static GLuint loadShaderProgram(const char* vertexShaderSource, const char* fragmentShaderSource)
+{
+    GLuint vertexShader;
+    GLuint fragmentShader;
+    GLuint programObject;
+    GLint linked;
+    vertexShader = loadShader(GL_VERTEX_SHADER, vertexShaderSource);
+    if (!vertexShader)
+        return 0;
+    fragmentShader = loadShader(GL_FRAGMENT_SHADER, fragmentShaderSource);
+    if (!fragmentShader) {
+        glDeleteShader(vertexShader);
+        return 0;
+    }
+    programObject = glCreateProgram();
+    if (programObject) {
+        glAttachShader(programObject, vertexShader);
+        glAttachShader(programObject, fragmentShader);
+        glLinkProgram(programObject);
+        glGetProgramiv(programObject, GL_LINK_STATUS, &linked);
+        if (!linked) {
+            glDeleteProgram(programObject);
+            programObject = 0;
+        }
+    }
+    glDeleteShader(vertexShader);
+    glDeleteShader(fragmentShader);
+    return programObject;
+}
+
+static TransformationMatrix orthoMatrix(float left, float right, float bottom, float top, float nearZ, float farZ)
+{
+    float deltaX = right - left;
+    float deltaY = top - bottom;
+    float deltaZ = farZ - nearZ;
+    TransformationMatrix ortho;
+    if (!deltaX || !deltaY || !deltaZ)
+        return ortho;
+    ortho.setM11(2.0f / deltaX);
+    ortho.setM41(-(right + left) / deltaX);
+    ortho.setM22(2.0f / deltaY);
+    ortho.setM42(-(top + bottom) / deltaY);
+    ortho.setM33(-2.0f / deltaZ);
+    ortho.setM43(-(nearZ + farZ) / deltaZ);
+    return ortho;
+}
+
+static Vector<LayerCompositingThread*> rawPtrVectorFromRefPtrVector(const Vector<RefPtr<LayerCompositingThread> >& sublayers)
+{
+    Vector<LayerCompositingThread*> sublayerList;
+    for (size_t i = 0; i < sublayers.size(); i++)
+        sublayerList.append(sublayers[i].get());
+
+    return sublayerList;
+}
+
+PassOwnPtr<LayerRenderer> LayerRenderer::create(GLES2Context* context)
+{
+    return adoptPtr(new LayerRenderer(context));
+}
+
+LayerRenderer::LayerRenderer(GLES2Context* context)
+    : m_colorProgramObject(0)
+    , m_checkerProgramObject(0)
+    , m_positionLocation(0)
+    , m_texCoordLocation(1)
+    , m_fbo(0)
+    , m_currentLayerRendererSurface(0)
+    , m_clearSurfaceOnDrawLayers(true)
+    , m_context(context)
+    , m_needsCommit(false)
+{
+    for (int i = 0; i < LayerData::NumberOfLayerProgramShaders; ++i)
+        m_layerProgramObject[i] = 0;
+
+    m_hardwareCompositing = initializeSharedGLObjects();
+}
+
+LayerRenderer::~LayerRenderer()
+{
+    makeContextCurrent();
+    if (m_fbo)
+        glDeleteFramebuffers(1, &m_fbo);
+    glDeleteProgram(m_colorProgramObject);
+    glDeleteProgram(m_checkerProgramObject);
+    for (int i = 0; i < LayerData::NumberOfLayerProgramShaders; ++i)
+        glDeleteProgram(m_layerProgramObject[i]);
+    if (m_hardwareCompositing) {
+        // Free up all GL textures.
+        while (m_layers.begin() != m_layers.end()) {
+            LayerSet::iterator iter = m_layers.begin();
+            (*iter)->deleteTextures();
+            (*iter)->setLayerRenderer(0);
+            removeLayer(*iter);
+        }
+
+        textureCacheCompositingThread()->clear();
+    }
+}
+
+void LayerRenderer::releaseLayerResources()
+{
+    if (m_hardwareCompositing) {
+        makeContextCurrent();
+        // Free up all GL textures.
+        for (LayerSet::iterator iter = m_layers.begin(); iter != m_layers.end(); ++iter)
+            (*iter)->deleteTextures();
+
+        textureCacheCompositingThread()->clear();
+    }
+}
+
+static inline bool compareLayerZ(const LayerCompositingThread* a, const LayerCompositingThread* b)
+{
+    const TransformationMatrix& transformA = a->drawTransform();
+    const TransformationMatrix& transformB = b->drawTransform();
+
+    return transformA.m43() < transformB.m43();
+}
+
+// Re-composites all sublayers.
+void LayerRenderer::drawLayers(const FloatRect& visibleRect, const IntRect& layoutRect, const IntSize& contentsSize, const IntRect& dstRect)
+{
+    ASSERT(m_hardwareCompositing);
+
+    bool wasEmpty = m_lastRenderingResults.isEmpty();
+    m_lastRenderingResults = LayerRenderingResults();
+    m_lastRenderingResults.wasEmpty = wasEmpty;
+
+    if (!m_rootLayer)
+        return;
+
+    // These parameters are used to calculate position of fixed position elements
+    m_visibleRect = visibleRect;
+    m_layoutRect = layoutRect;
+    m_contentsSize = contentsSize;
+
+    // WebKit uses row vectors which are multiplied by the matrix on the left (i.e. v*M)
+    // Transformations are composed on the left so that M1.xform(M2) means M2*M1
+    // We therefore start with our (othogonal) projection matrix, which will be applied
+    // as the last transformation.
+    TransformationMatrix matrix = orthoMatrix(0, visibleRect.width(), visibleRect.height(), 0, -1000, 1000);
+    matrix.translate3d(-visibleRect.x(), -visibleRect.y(), 0);
+
+    // OpenGL window coordinates origin is at the lower left corner of the surface while
+    // WebKit uses upper left as the origin of the window coordinate system. The passed in 'dstRect'
+    // is in WebKit window coordinate system. Here we setup the viewport to the corresponding value
+    // in OpenGL window coordinates.
+    int viewportY = std::max(0, m_context->surfaceSize().height() - dstRect.maxY());
+    m_viewport = IntRect(dstRect.x(), viewportY, dstRect.width(), dstRect.height());
+
+    double animationTime = currentTime();
+
+#if DEBUG_VIDEO_CLIPPING
+    // Invoking updateLayersRecursive() which will call LayerCompositingThread::setDrawTransform().
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelInfo, "LayerRenderer::drawLayers() visible=(x=%.2f,y=%.2f,width=%.2f,height=%.2f), layout=(x=%d,y=%d,width=%d,height=%d), contents=(%dx%d), dst=(x=%d,y=%d,width=%d,height=%d).",
+        visibleRect.x(), visibleRect.y(), visibleRect.width(), visibleRect.height(),
+        layoutRect.x(), layoutRect.y(), layoutRect.width(), layoutRect.height(),
+        contentsSize.width(), contentsSize.height(),
+        dstRect.x(), dstRect.y(), dstRect.width(), dstRect.height());
+#endif
+
+    Vector<RefPtr<LayerCompositingThread> > surfaceLayers;
+    const Vector<RefPtr<LayerCompositingThread> >& sublayers = m_rootLayer->getSublayers();
+    for (size_t i = 0; i < sublayers.size(); i++) {
+        float opacity = 1;
+        FloatRect clipRect(-1, -1, 2, 2);
+        updateLayersRecursive(sublayers[i].get(), matrix, surfaceLayers, opacity, clipRect, animationTime);
+    }
+
+    // Decompose the dirty rect into a set of non-overlaping rectangles
+    // (they need to not overlap so that the blending code doesn't draw any region twice).
+    for (int i = 0; i < LayerRenderingResults::NumberOfDirtyRects; ++i) {
+        BlackBerry::Platform::IntRectRegion region(BlackBerry::Platform::IntRect(m_lastRenderingResults.dirtyRect(i)));
+        m_lastRenderingResults.dirtyRegion = BlackBerry::Platform::IntRectRegion::unionRegions(m_lastRenderingResults.dirtyRegion, region);
+    }
+
+    // If we won't draw anything, don't touch the OpenGL APIs.
+    if (m_lastRenderingResults.isEmpty() && wasEmpty)
+        return;
+
+    // Okay, we're going to do some drawing.
+    makeContextCurrent();
+
+    glEnableVertexAttribArray(m_positionLocation);
+    glEnableVertexAttribArray(m_texCoordLocation);
+    glActiveTexture(GL_TEXTURE0);
+    glDisable(GL_DEPTH_TEST);
+    glDisable(GL_CULL_FACE);
+    glEnable(GL_STENCIL_TEST);
+
+    // If culling is enabled then we will cull the backface.
+    glCullFace(GL_BACK);
+    // The orthographic projection is setup such that Y starts at zero and
+    // increases going down the page which flips the winding order of triangles.
+    // The layer quads are drawn in clock-wise order so the front face is CCW.
+    glFrontFace(GL_CCW);
+
+    // The shader used to render layers returns pre-multiplied alpha colors
+    // so we need to send the blending mode appropriately.
+    glEnable(GL_BLEND);
+    glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
+
+    // Update the parameters for the checkerboard drawing.
+    glUseProgram(m_checkerProgramObject);
+    float bitmapScale = static_cast<float>(m_layoutRect.width()) / static_cast<float>(m_visibleRect.width());
+    glUniform1f(m_checkerScaleLocation, bitmapScale);
+    float scale = static_cast<float>(dstRect.width()) / static_cast<float>(m_visibleRect.width());
+    glUniform2f(m_checkerOriginLocation, m_visibleRect.x()*scale, m_visibleRect.y()*scale);
+    glUniform1f(m_checkerSurfaceHeightLocation, m_context->surfaceSize().height());
+
+    checkGLError();
+
+    // If some layers should be drawed on temporary surfaces, we should do it first.
+    drawLayersOnSurfaces(surfaceLayers);
+
+#if ENABLE_SCISSOR
+    m_scissorRect = m_viewport;
+    glEnable(GL_SCISSOR_TEST);
+    glScissor(m_scissorRect.x(), m_scissorRect.y(), m_scissorRect.width(), m_scissorRect.height());
+#endif
+
+    glClearStencil(0);
+    if (m_clearSurfaceOnDrawLayers) {
+        glClearColor(0, 0, 0, 0);
+        glClear(GL_COLOR_BUFFER_BIT | GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT);
+    }
+
+    // Don't render the root layer, the BlackBerry port uses the BackingStore to draw the
+    // root layer.
+    for (size_t i = 0; i < sublayers.size(); i++) {
+        int currentStencilValue = 0;
+        FloatRect clipRect(-1, -1, 2, 2);
+        compositeLayersRecursive(sublayers[i].get(), currentStencilValue, clipRect);
+    }
+
+    m_context->swapBuffers();
+
+#if ENABLE_SCISSOR
+    glDisable(GL_SCISSOR_TEST);
+#endif
+    glDisable(GL_STENCIL_TEST);
+
+    LayerSet::iterator iter = m_layersLockingTextureResources.begin();
+    for (; iter != m_layersLockingTextureResources.end(); ++iter)
+        (*iter)->releaseTextureResources();
+
+    m_layersLockingTextureResources.clear();
+
+    if (m_needsCommit) {
+        m_needsCommit = false;
+        m_rootLayer->scheduleCommit();
+    }
+
+    textureCacheCompositingThread()->collectGarbage();
+}
+
+bool LayerRenderer::useSurface(LayerRendererSurface* surface)
+{
+    if (m_currentLayerRendererSurface == surface)
+        return true;
+
+    m_currentLayerRendererSurface = surface;
+    if (!surface) {
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        glViewport(m_viewport.x(), m_viewport.y(), m_viewport.width(), m_viewport.height());
+        return true;
+    }
+
+    surface->ensureTexture();
+
+    if (!m_fbo)
+        glGenFramebuffers(1, &m_fbo);
+    glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+    glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, surface->texture()->textureId(), 0);
+
+#ifndef NDEBUG
+    GLenum status = glCheckFramebufferStatus(GL_FRAMEBUFFER);
+    if (status != GL_FRAMEBUFFER_COMPLETE) {
+        fprintf(stderr, "glCheckFramebufferStatus error %x\n", status);
+        return false;
+    }
+#endif
+
+    glViewport(0, 0, surface->size().width(), surface->size().height());
+    return true;
+}
+
+void LayerRenderer::drawLayersOnSurfaces(const Vector<RefPtr<LayerCompositingThread> >& surfaceLayers)
+{
+    for (int i = surfaceLayers.size() - 1; i >= 0; i--) {
+        LayerCompositingThread* layer = surfaceLayers[i].get();
+        LayerRendererSurface* surface = layer->layerRendererSurface();
+        if (!surface || !useSurface(surface))
+            continue;
+
+        glDisable(GL_SCISSOR_TEST);
+        glClearColor(0, 0, 0, 0);
+        glClear(GL_COLOR_BUFFER_BIT);
+
+        int currentStencilValue = 0;
+        FloatRect clipRect(-1, -1, 2, 2);
+        compositeLayersRecursive(surfaceLayers[i].get(), currentStencilValue, clipRect);
+    }
+
+    // If there are layers drawed on surfaces, we need to switch to default framebuffer.
+    // Otherwise, we just need to set viewport.
+    if (surfaceLayers.size())
+        useSurface(0);
+    else
+        glViewport(m_viewport.x(), m_viewport.y(), m_viewport.width(), m_viewport.height());
+}
+
+void LayerRenderer::setRootLayer(LayerCompositingThread* layer)
+{
+    m_rootLayer = layer;
+}
+
+void LayerRenderer::addLayer(LayerCompositingThread* layer)
+{
+    m_layers.add(layer);
+}
+
+bool LayerRenderer::removeLayer(LayerCompositingThread* layer)
+{
+    LayerSet::iterator iter = m_layers.find(layer);
+    if (iter == m_layers.end())
+        return false;
+    m_layers.remove(layer);
+    return true;
+}
+
+void LayerRenderer::addLayerToReleaseTextureResourcesList(LayerCompositingThread* layer)
+{
+    m_layersLockingTextureResources.add(layer);
+}
+
+// Transform normalized device coordinates to window coordinates
+// as specified in the OpenGL ES 2.0 spec section 2.12.1.
+IntRect LayerRenderer::toOpenGLWindowCoordinates(const FloatRect& r) const
+{
+    float vw2 = m_viewport.width() / 2.0;
+    float vh2 = m_viewport.height() / 2.0;
+    float ox = m_viewport.x() + vw2;
+    float oy = m_viewport.y() + vh2;
+    return enclosingIntRect(FloatRect(r.x() * vw2 + ox, r.y() * vh2 + oy, r.width() * vw2, r.height() * vh2));
+}
+
+// Transform normalized device coordinates to window coordinates as WebKit understands them.
+//
+// The OpenGL surface may be larger than the WebKit window, and OpenGL window coordinates
+// have origin in bottom left while WebKit window coordinates origin is in top left.
+// The viewport is setup to cover the upper portion of the larger OpenGL surface.
+IntRect LayerRenderer::toWebKitWindowCoordinates(const FloatRect& r) const
+{
+    float vw2 = m_viewport.width() / 2.0;
+    float vh2 = m_viewport.height() / 2.0;
+    float ox = m_viewport.x() + vw2;
+    float oy = m_context->surfaceSize().height() - (m_viewport.y() + vh2);
+    return enclosingIntRect(FloatRect(r.x() * vw2 + ox, -(r.y()+r.height()) * vh2 + oy, r.width() * vw2, r.height() * vh2));
+}
+
+// Similar to toWebKitWindowCoordinates except that this also takes any zoom into account.
+IntRect LayerRenderer::toWebKitDocumentCoordinates(const FloatRect& r) const
+{
+    // The zoom is the ratio between visibleRect (or layoutRect) and dstRect parameters which are passed to drawLayers
+    float zoom = m_visibleRect.width() / m_viewport.width();
+    // Could assert here that it doesn't matter whether we choose width or height in the above statement:
+    // because both rectangles should have very similar shapes (subject only to pixel rounding error).
+
+    IntRect result = toWebKitWindowCoordinates(r);
+    result.scale(zoom);
+    return result;
+}
+
+// Draws a debug border around the layer's bounds.
+void LayerRenderer::drawDebugBorder(LayerCompositingThread* layer)
+{
+    Color borderColor = layer->borderColor();
+
+#if DEBUG_DIRTY_LAYERS
+    if (layer->isDirty())
+        borderColor = Color(0xFF, 0x00, 0x00, 0xFF);
+#endif
+
+#if DEBUG_LAYER_ANIMATIONS
+    if (layer->hasRunningAnimations())
+        borderColor =  Color(0x00, 0xFF, 0x00, 0xFF);
+#endif
+
+    if (!borderColor.alpha())
+        return;
+
+    glUseProgram(m_colorProgramObject);
+    glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, &layer->getTransformedBounds());
+    glUniform4f(m_colorColorLocation, borderColor.red() / 255.0, borderColor.green() / 255.0, borderColor.blue() / 255.0, 1);
+
+    glLineWidth(layer->borderWidth());
+    glDrawArrays(GL_LINE_LOOP, 0, 4);
+}
+
+// Clears a rectangle inside the layer's bounds.
+void LayerRenderer::drawHolePunchRect(LayerCompositingThread* layer)
+{
+    glUseProgram(m_colorProgramObject);
+    glUniform4f(m_colorColorLocation, 0, 0, 0, 0);
+
+    glBlendFunc(GL_ONE, GL_ZERO);
+    FloatQuad hole = layer->getTransformedHolePunchRect();
+    glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, &hole);
+    glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+    checkGLError();
+    glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
+
+    IntRect holeWC = toWebKitWindowCoordinates(hole.boundingBox());
+    m_lastRenderingResults.addHolePunchRect(holeWC);
+}
+
+void LayerRenderer::updateLayersRecursive(LayerCompositingThread* layer, const TransformationMatrix& matrix, Vector<RefPtr<LayerCompositingThread> >& surfaceLayers, float opacity, FloatRect clipRect, double currentTime)
+{
+
+    // The contract for LayerCompositingThread::setLayerRenderer is it must be set if the layer has been rendered.
+    // So do it now, before we render it in compositeLayersRecursive.
+    layer->setLayerRenderer(this);
+    if (layer->maskLayer())
+        layer->maskLayer()->setLayerRenderer(this);
+    if (layer->replicaLayer()) {
+        LayerCompositingThread* replica = layer->replicaLayer();
+        replica->setLayerRenderer(this);
+        if (replica->maskLayer())
+            replica->maskLayer()->setLayerRenderer(this);
+    }
+
+    // This might cause the layer to recompute some attributes.
+    m_lastRenderingResults.needsAnimationFrame |= layer->updateAnimations(currentTime);
+
+    // Compute the new matrix transformation that will be applied to this layer and
+    // all its sublayers. It's important to remember that the layer's position
+    // is the position of the layer's anchor point. Also, the coordinate system used
+    // assumes that the origin is at the lower left even though the coordinates the browser
+    // gives us for the layers are for the upper left corner. The Y flip happens via
+    // the orthographic projection applied at render time.
+    // The transformation chain for the layer is (using the Matrix x Vector order):
+    // M = M[p] * Tr[l] * M[l] * Tr[c]
+    // Where M[p] is the parent matrix passed down to the function
+    //       Tr[l] is the translation matrix locating the layer's anchor point
+    //       Tr[c] is the translation offset between the anchor point and the center of the layer
+    //       M[l] is the layer's matrix (applied at the anchor point)
+    // This transform creates a coordinate system whose origin is the center of the layer.
+    // Note that the final matrix used by the shader for the layer is P * M * S . This final product
+    // is computed in drawTexturedQuad().
+    // Where: P is the projection matrix
+    //        M is the layer's matrix computed above
+    //        S is the scale adjustment (to scale up to the layer size)
+    IntSize bounds = layer->bounds();
+    FloatPoint anchorPoint = layer->anchorPoint();
+    FloatPoint position = layer->position();
+
+    // Layer whose hasFixedContainer is true will get scrolled relative to
+    // the fixed positioned parent.
+    if (!layer->hasFixedContainer() && (layer->isFixedPosition() || layer->hasFixedAncestorInDOMTree())) {
+        // The basic idea here is to set visible y to the value we want, and
+        // layout y to the value WebCore layouted the fixed element to.
+        float maximumScrollY = m_contentsSize.height() - m_visibleRect.height();
+        float visibleY = max(0.0f, m_visibleRect.y());
+        float layoutY = max(0.0f, min(maximumScrollY, (float)m_layoutRect.y()));
+
+        // For stuff located on the lower half of the screen, we zoom relative to bottom.
+        // This trick allows us to display fixed positioned elements aligned to top or
+        // bottom correctly when panning and zooming, without actually knowing the
+        // numeric values of the top and bottom CSS attributes.
+        // In fact, the position is the location of the anchor, so to find the top left
+        // we have to subtract the anchor times the bounds. The anchor defaults to
+        // (0.5, 0.5) for most layers.
+        if (position.y() - anchorPoint.y() * bounds.height() > layoutY + m_layoutRect.height() / 2) {
+            visibleY = min<float>(m_contentsSize.height(), m_visibleRect.y() + m_visibleRect.height());
+            layoutY = min(m_contentsSize.height(), max(0, m_layoutRect.y()) + m_layoutRect.height());
+        }
+
+        position.setY(position.y() + (visibleY - layoutY));
+    }
+
+    // Offset between anchor point and the center of the quad.
+    float centerOffsetX = (0.5 - anchorPoint.x()) * bounds.width();
+    float centerOffsetY = (0.5 - anchorPoint.y()) * bounds.height();
+
+    // M = M[p]
+    TransformationMatrix localMatrix = matrix;
+    // M = M[p] * Tr[l]
+    localMatrix.translate3d(position.x(), position.y(), layer->anchorPointZ());
+    // M = M[p] * Tr[l] * M[l]
+    localMatrix.multiply(layer->transform());
+    // M = M[p] * Tr[l] * M[l] * Tr[c]
+    localMatrix.translate3d(centerOffsetX, centerOffsetY, -layer->anchorPointZ());
+
+    // Calculate the layer's opacity.
+    opacity *= layer->opacity();
+
+    bool useLayerRendererSurface = layer->maskLayer() || layer->replicaLayer();
+    if (!useLayerRendererSurface) {
+        layer->setDrawOpacity(opacity);
+        layer->clearLayerRendererSurface();
+    } else {
+        if (!layer->layerRendererSurface())
+            layer->createLayerRendererSurface();
+
+        LayerRendererSurface* surface = layer->layerRendererSurface();
+
+        layer->setDrawOpacity(1.0);
+        surface->setDrawOpacity(opacity);
+
+        surface->setDrawTransform(localMatrix);
+        if (layer->replicaLayer()) {
+            TransformationMatrix replicaMatrix = localMatrix;
+            replicaMatrix.translate3d(-0.5 * bounds.width(), -0.5 * bounds.height(), 0);
+            replicaMatrix.translate3d(layer->replicaLayer()->position().x(), layer->replicaLayer()->position().y(), 0);
+            replicaMatrix.multiply(layer->replicaLayer()->transform());
+            replicaMatrix.translate3d(centerOffsetX, centerOffsetY, 0);
+            surface->setReplicaDrawTransform(replicaMatrix);
+        }
+
+        IntRect drawRect = IntRect(IntPoint(), bounds);
+        surface->setContentRect(drawRect);
+
+        TransformationMatrix projectionMatrix = orthoMatrix(drawRect.x(), drawRect.maxX(), drawRect.y(), drawRect.maxY(), -1000, 1000);
+        // The origin of the new surface is the upper left corner of the layer.
+        TransformationMatrix drawTransform;
+        drawTransform.translate3d(0.5 * bounds.width(), 0.5 * bounds.height(), 0);
+        // This layer will start using new transformation.
+        localMatrix = projectionMatrix * drawTransform;
+
+        surfaceLayers.append(layer);
+    }
+
+    layer->setDrawTransform(localMatrix);
+
+#if ENABLE(VIDEO)
+    bool layerVisible = clipRect.intersects(layer->getDrawRect()) || layer->mediaPlayer();
+#else
+    bool layerVisible = clipRect.intersects(layer->getDrawRect());
+#endif
+
+    if (layer->needsTexture() && layerVisible) {
+        IntRect dirtyRect = toWebKitWindowCoordinates(intersection(layer->getDrawRect(), clipRect));
+        m_lastRenderingResults.addDirtyRect(dirtyRect);
+    }
+
+    if (layer->masksToBounds())
+        clipRect.intersect(layer->getDrawRect());
+
+    // Flatten to 2D if the layer doesn't preserve 3D.
+    if (!layer->preserves3D()) {
+        localMatrix.setM13(0);
+        localMatrix.setM23(0);
+        localMatrix.setM31(0);
+        localMatrix.setM32(0);
+        // This corresponds to the depth range specified in the original orthographic projection matrix
+        localMatrix.setM33(0.001);
+        localMatrix.setM34(0);
+        localMatrix.setM43(0);
+    }
+
+    // Apply the sublayer transform.
+    localMatrix.multiply(layer->sublayerTransform());
+
+    // The origin of the sublayers is actually the bottom left corner of the layer
+    // (or top left when looking it it from the browser's pespective) instead of the center.
+    // The matrix passed down to the sublayers is therefore:
+    // M[s] = M * Tr[-center]
+    localMatrix.translate3d(-bounds.width() * 0.5, -bounds.height() * 0.5, 0);
+
+    const Vector<RefPtr<LayerCompositingThread> >& sublayers = layer->getSublayers();
+    for (size_t i = 0; i < sublayers.size(); i++)
+        updateLayersRecursive(sublayers[i].get(), localMatrix, surfaceLayers, opacity, clipRect, currentTime);
+}
+
+static bool hasRotationalComponent(const TransformationMatrix& m)
+{
+    return m.m12() || m.m13() || m.m23() || m.m21() || m.m31() || m.m32();
+}
+
+bool LayerRenderer::layerAlreadyOnSurface(LayerCompositingThread* layer) const
+{
+    return layer->layerRendererSurface() && layer->layerRendererSurface() != m_currentLayerRendererSurface;
+}
+
+static void collect3DPreservingLayers(Vector<LayerCompositingThread*>& layers)
+{
+    for (size_t i = 0; i < layers.size(); ++i) {
+        LayerCompositingThread* layer = layers[i];
+        if (!layer->preserves3D() || !layer->getSublayers().size())
+            continue;
+
+        Vector<LayerCompositingThread*> sublayers = rawPtrVectorFromRefPtrVector(layer->getSublayers());
+        collect3DPreservingLayers(sublayers);
+        layers.insert(i+1, sublayers);
+        i += sublayers.size();
+    }
+}
+
+void LayerRenderer::compositeLayersRecursive(LayerCompositingThread* layer, int stencilValue, FloatRect clipRect)
+{
+    FloatRect rect;
+    if (layerAlreadyOnSurface(layer))
+        rect = layer->layerRendererSurface()->drawRect();
+    else
+        rect = layer->getDrawRect();
+
+#if ENABLE(VIDEO)
+    bool layerVisible = clipRect.intersects(rect) || layer->mediaPlayer();
+#else
+    bool layerVisible = clipRect.intersects(rect);
+#endif
+
+    layer->setVisible(layerVisible);
+
+    glStencilFunc(GL_EQUAL, stencilValue, 0xff);
+    glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP);
+
+    // Note that there are two types of layers:
+    // 1. Layers that have their own GraphicsContext and can draw their contents on demand (layer->drawsContent() == true).
+    // 2. Layers that are just containers of images/video/etc that don't own a GraphicsContext (layer->contents() == true).
+
+    // Even non-visible layers need to perform their texture jobs, or they will
+    // pile up and waste memory.
+    if (layer->needsTexture())
+        layer->updateTextureContentsIfNeeded();
+    if (layer->maskLayer() && layer->maskLayer()->needsTexture())
+        layer->maskLayer()->updateTextureContentsIfNeeded();
+    if (layer->replicaLayer()) {
+        LayerCompositingThread* replica = layer->replicaLayer();
+        if (replica->needsTexture())
+            replica->updateTextureContentsIfNeeded();
+        if (replica->maskLayer() && replica->maskLayer()->needsTexture())
+            replica->maskLayer()->updateTextureContentsIfNeeded();
+    }
+
+    if ((layer->needsTexture() || layer->layerRendererSurface()) && layerVisible) {
+        updateScissorIfNeeded(clipRect);
+
+        if (layer->doubleSided())
+            glDisable(GL_CULL_FACE);
+        else
+            glEnable(GL_CULL_FACE);
+
+        if (layer->hasVisibleHolePunchRect())
+            drawHolePunchRect(layer);
+
+        // Draw the surface onto another surface or screen.
+        bool drawSurface = layerAlreadyOnSurface(layer);
+        // The texture format for the surface is RGBA.
+        LayerData::LayerProgramShader shader = drawSurface ? LayerData::LayerProgramShaderRGBA : layer->layerProgramShader();
+
+        if (!drawSurface) {
+            glUseProgram(m_layerProgramObject[shader]);
+            glUniform1f(m_alphaLocation[shader], layer->drawOpacity());
+            layer->drawTextures(m_positionLocation, m_texCoordLocation, m_visibleRect);
+        } else {
+            // Draw the reflection if it exists.
+            if (layer->replicaLayer()) {
+                // If this layer and its reflection both have mask, we need another temporary surface.
+                // Since this use case should be rare, currently it's not handled and the mask for
+                // the reflection is applied only when this layer has no mask.
+                LayerCompositingThread* mask = layer->maskLayer();
+                if (!mask && layer->replicaLayer())
+                    mask = layer->replicaLayer()->maskLayer();
+
+                glUseProgram(mask ? m_layerMaskProgramObject[shader] : m_layerProgramObject[shader]);
+                glUniform1f(mask ? m_maskAlphaLocation[shader] : m_alphaLocation[shader], layer->layerRendererSurface()->drawOpacity());
+                layer->drawSurface(layer->layerRendererSurface()->replicaDrawTransform(), mask, m_positionLocation, m_texCoordLocation);
+            }
+
+            glUseProgram(layer->maskLayer() ? m_layerMaskProgramObject[shader] : m_layerProgramObject[shader]);
+            glUniform1f(layer->maskLayer() ? m_maskAlphaLocation[shader] : m_alphaLocation[shader], layer->layerRendererSurface()->drawOpacity());
+            layer->drawSurface(layer->layerRendererSurface()->drawTransform(), layer->maskLayer(), m_positionLocation, m_texCoordLocation);
+        }
+
+        if (layer->hasMissingTextures()) {
+            glDisable(GL_BLEND);
+            glUseProgram(m_checkerProgramObject);
+            layer->drawMissingTextures(m_positionLocation, m_texCoordLocation, m_visibleRect);
+            glEnable(GL_BLEND);
+            glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
+        }
+    }
+
+    // Draw the debug border if there is one.
+    drawDebugBorder(layer);
+
+    // The texture for the LayerRendererSurface can be released after the surface was drawed on another surface.
+    if (layerAlreadyOnSurface(layer)) {
+        layer->layerRendererSurface()->releaseTexture();
+        return;
+    }
+
+    // If we need to mask to bounds but the transformation has a rotational component
+    // to it, scissoring is not enough and we need to use the stencil buffer for clipping.
+#if ENABLE_SCISSOR
+    bool stencilClip = layer->masksToBounds() && hasRotationalComponent(layer->drawTransform());
+#else
+    bool stencilClip = layer->masksToBounds();
+#endif
+
+    if (stencilClip) {
+        glStencilFunc(GL_EQUAL, stencilValue, 0xff);
+        glStencilOp(GL_KEEP, GL_INCR, GL_INCR);
+
+        updateScissorIfNeeded(clipRect);
+        glUseProgram(m_colorProgramObject);
+        glColorMask(GL_FALSE, GL_FALSE, GL_FALSE, GL_FALSE);
+        glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, &layer->getTransformedBounds());
+        glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+        glColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+    }
+
+    if (layer->masksToBounds())
+        clipRect.intersect(layer->getDrawRect());
+
+    // Here, we need to sort the whole subtree of layers with preserve-3d. It
+    // affects all children, and the children of any children with preserve-3d,
+    // and so on.
+    Vector<LayerCompositingThread*> sublayers = rawPtrVectorFromRefPtrVector(layer->getSublayers());
+
+    bool preserves3D = layer->preserves3D();
+    bool superlayerPreserves3D = layer->superlayer() && layer->superlayer()->preserves3D();
+
+    // Collect and render all sublayers with preserves-3D.
+    // If the superlayer preserves 3D, we've already collected and rendered its
+    // children, so bail.
+    if (preserves3D && !superlayerPreserves3D) {
+        collect3DPreservingLayers(sublayers);
+        std::stable_sort(sublayers.begin(), sublayers.end(), compareLayerZ);
+    }
+
+    int newStencilValue = stencilClip ? stencilValue+1 : stencilValue;
+    for (size_t i = 0; i < sublayers.size(); i++) {
+        LayerCompositingThread* sublayer = sublayers[i];
+        // The root of the 3d-preserving subtree has collected all
+        // 3d-preserving layers and their children and will render them all in
+        // the right order.
+        if (preserves3D && superlayerPreserves3D)
+            continue;
+
+         compositeLayersRecursive(sublayer, newStencilValue, clipRect);
+    }
+
+    if (stencilClip) {
+        glStencilFunc(GL_LEQUAL, stencilValue, 0xff);
+        glStencilOp(GL_KEEP, GL_REPLACE, GL_REPLACE);
+
+        updateScissorIfNeeded(clipRect);
+        glUseProgram(m_colorProgramObject);
+        glColorMask(GL_FALSE, GL_FALSE, GL_FALSE, GL_FALSE);
+        glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, &layer->getTransformedBounds());
+        glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+        glColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+    }
+}
+
+void LayerRenderer::updateScissorIfNeeded(const FloatRect& clipRect)
+{
+#if ENABLE_SCISSOR
+    IntRect clipRectWC = toOpenGLWindowCoordinates(clipRect);
+    if (m_scissorRect == clipRectWC)
+        return;
+
+    m_scissorRect = clipRectWC;
+    glScissor(m_scissorRect.x(), m_scissorRect.y(), m_scissorRect.width(), m_scissorRect.height());
+#endif
+}
+
+bool LayerRenderer::makeContextCurrent()
+{
+    return m_context->makeCurrent();
+}
+
+// Binds the given attribute name to a common location across all three programs
+// used by the compositor. This allows the code to bind the attributes only once
+// even when switching between programs.
+void LayerRenderer::bindCommonAttribLocation(int location, const char* attribName)
+{
+    for (int i = 0; i < LayerData::NumberOfLayerProgramShaders; ++i) {
+        glBindAttribLocation(m_layerProgramObject[i], location, attribName);
+        glBindAttribLocation(m_layerMaskProgramObject[i], location, attribName);
+    }
+
+    glBindAttribLocation(m_colorProgramObject, location, attribName);
+    glBindAttribLocation(m_checkerProgramObject, location, attribName);
+}
+
+bool LayerRenderer::initializeSharedGLObjects()
+{
+    // Shaders for drawing the layer contents.
+    char vertexShaderString[] =
+        "attribute vec4 a_position;   \n"
+        "attribute vec2 a_texCoord;   \n"
+        "varying vec2 v_texCoord;     \n"
+        "void main()                  \n"
+        "{                            \n"
+        "  gl_Position = a_position;  \n"
+        "  v_texCoord = a_texCoord;   \n"
+        "}                            \n";
+
+    char fragmentShaderStringRGBA[] =
+        "varying mediump vec2 v_texCoord;                           \n"
+        "uniform lowp sampler2D s_texture;                          \n"
+        "uniform lowp float alpha;                                  \n"
+        "void main()                                                \n"
+        "{                                                          \n"
+        "  gl_FragColor = texture2D(s_texture, v_texCoord) * alpha; \n"
+        "}                                                          \n";
+
+    char fragmentShaderStringBGRA[] =
+        "varying mediump vec2 v_texCoord;                                \n"
+        "uniform lowp sampler2D s_texture;                               \n"
+        "uniform lowp float alpha;                                       \n"
+        "void main()                                                     \n"
+        "{                                                               \n"
+        "  gl_FragColor = texture2D(s_texture, v_texCoord).bgra * alpha; \n"
+        "}                                                               \n";
+
+    char fragmentShaderStringMaskRGBA[] =
+        "varying mediump vec2 v_texCoord;                           \n"
+        "uniform lowp sampler2D s_texture;                          \n"
+        "uniform lowp sampler2D s_mask;                             \n"
+        "uniform lowp float alpha;                                  \n"
+        "void main()                                                \n"
+        "{                                                          \n"
+        "  lowp vec4 texColor = texture2D(s_texture, v_texCoord);   \n"
+        "  lowp vec4 maskColor = texture2D(s_mask, v_texCoord);     \n"
+        "  gl_FragColor = vec4(texColor.x, texColor.y, texColor.z, texColor.w) * alpha * maskColor.w;           \n"
+        "}                                                          \n";
+
+    char fragmentShaderStringMaskBGRA[] =
+        "varying mediump vec2 v_texCoord;                                \n"
+        "uniform lowp sampler2D s_texture;                               \n"
+        "uniform lowp sampler2D s_mask;                                  \n"
+        "uniform lowp float alpha;                                       \n"
+        "void main()                                                     \n"
+        "{                                                               \n"
+        "  lowp vec4 texColor = texture2D(s_texture, v_texCoord).bgra;             \n"
+        "  lowp vec4 maskColor = texture2D(s_mask, v_texCoord).bgra;          \n"
+        "  gl_FragColor = vec4(texColor.x, texColor.y, texColor.z, texColor.w) * alpha * maskColor.w;         \n"
+        "}                                                               \n";
+
+
+    // Shaders for drawing the debug borders around the layers.
+    char colorVertexShaderString[] =
+        "attribute vec4 a_position;   \n"
+        "void main()                  \n"
+        "{                            \n"
+        "   gl_Position = a_position; \n"
+        "}                            \n";
+
+    char colorFragmentShaderString[] =
+        "uniform lowp vec4 color;     \n"
+        "void main()                  \n"
+        "{                            \n"
+        "  gl_FragColor = color;      \n"
+        "}                            \n";
+
+    // FIXME: get screen size, get light/dark color, use
+    // string manipulation methods to insert those constants into
+    // the shader source.
+    static Color lightColor(0xfb, 0xfd, 0xff);
+    // checkerboardColorDark()
+    static Color darkColor(0xe8, 0xee, 0xf7);
+    int checkerSize = 20;
+    String tmp(
+        "uniform mediump float scale;                  \n"
+        "uniform mediump vec2 origin;                  \n"
+        "uniform mediump float surfaceHeight;          \n"
+        "void main()                                   \n"
+        "{                                             \n"
+        "  const mediump float grid = GRID;            \n"
+        "  const lowp vec4 lightColor = LIGHT_COLOR;   \n"
+        "  const lowp vec4 darkColor = DARK_COLOR;     \n"
+        "  mediump float tmp = grid * scale;           \n"
+        "  gl_FragColor = mod(floor((gl_FragCoord.x + origin.x) / tmp) + floor((surfaceHeight - gl_FragCoord.y + origin.y) / tmp), 2.0) > 0.99 \n"
+        "    ? lightColor : darkColor;                 \n"
+        "}                                             \n");
+
+    // Let WTF::String be our preprocessor
+    tmp.replace("LIGHT_COLOR", String::format("vec4(%.4f, %.4f, %.4f, 1.0)", lightColor.red() / 255.0, lightColor.green() / 255.0, lightColor.blue() / 255.0));
+    tmp.replace("DARK_COLOR", String::format("vec4(%.4f, %.4f, %.4f, 1.0)", darkColor.red() / 255.0, darkColor.green() / 255.0, darkColor.blue() / 255.0));
+    tmp.replace("GRID", String::format("%.3f", (float)checkerSize));
+    CString checkerFragmentShaderString = tmp.latin1();
+
+    makeContextCurrent();
+
+    m_layerProgramObject[LayerData::LayerProgramShaderRGBA] =
+        loadShaderProgram(vertexShaderString, fragmentShaderStringRGBA);
+    if (!m_layerProgramObject[LayerData::LayerProgramShaderRGBA]) {
+        LOG_ERROR("Failed to create shader program for RGBA layers");
+        return false;
+    }
+
+    m_layerProgramObject[LayerData::LayerProgramShaderBGRA] =
+        loadShaderProgram(vertexShaderString, fragmentShaderStringBGRA);
+    if (!m_layerProgramObject[LayerData::LayerProgramShaderBGRA]) {
+        LOG_ERROR("Failed to create shader program for BGRA layers");
+        return false;
+    }
+
+    m_layerMaskProgramObject[LayerData::LayerProgramShaderRGBA] =
+        loadShaderProgram(vertexShaderString, fragmentShaderStringMaskRGBA);
+    if (!m_layerMaskProgramObject[LayerData::LayerProgramShaderRGBA]) {
+        LOG_ERROR("Failed to create shader mask program for RGBA layers");
+        return false;
+    }
+
+    m_layerMaskProgramObject[LayerData::LayerProgramShaderBGRA] =
+        loadShaderProgram(vertexShaderString, fragmentShaderStringMaskBGRA);
+    if (!m_layerMaskProgramObject[LayerData::LayerProgramShaderBGRA]) {
+        LOG_ERROR("Failed to create shader mask program for BGRA layers");
+        return false;
+    }
+
+    m_colorProgramObject = loadShaderProgram(colorVertexShaderString, colorFragmentShaderString);
+    if (!m_colorProgramObject) {
+        LOG_ERROR("Failed to create shader program for debug borders");
+        return false;
+    }
+
+    m_checkerProgramObject = loadShaderProgram(colorVertexShaderString, checkerFragmentShaderString.data());
+    if (!m_checkerProgramObject) {
+        LOG_ERROR("Failed to create shader program for checkerboard pattern");
+        return false;
+    }
+
+    // Specify the attrib location for the position and make it the same for all three programs to
+    // avoid binding re-binding the vertex attributes.
+    bindCommonAttribLocation(m_positionLocation, "a_position");
+    bindCommonAttribLocation(m_texCoordLocation, "a_texCoord");
+
+    checkGLError();
+
+    // Re-link the shaders to get the new attrib location to take effect.
+    for (int i = 0; i < LayerData::NumberOfLayerProgramShaders; ++i) {
+        glLinkProgram(m_layerProgramObject[i]);
+        glLinkProgram(m_layerMaskProgramObject[i]);
+    }
+
+    glLinkProgram(m_colorProgramObject);
+    glLinkProgram(m_checkerProgramObject);
+
+    checkGLError();
+
+    // Get locations of uniforms for the layer content shader program.
+    for (int i = 0; i < LayerData::NumberOfLayerProgramShaders; ++i) {
+        m_samplerLocation[i] = glGetUniformLocation(m_layerProgramObject[i], "s_texture");
+        m_alphaLocation[i] = glGetUniformLocation(m_layerProgramObject[i], "alpha");
+        glUseProgram(m_layerProgramObject[i]);
+        glUniform1i(m_samplerLocation[i], 0);
+        m_maskSamplerLocation[i] = glGetUniformLocation(m_layerMaskProgramObject[i], "s_texture");
+        m_maskSamplerLocationMask[i] = glGetUniformLocation(m_layerMaskProgramObject[i], "s_mask");
+        m_maskAlphaLocation[i] = glGetUniformLocation(m_layerMaskProgramObject[i], "alpha");
+        glUseProgram(m_layerMaskProgramObject[i]);
+        glUniform1i(m_maskSamplerLocation[i], 0);
+        glUniform1i(m_maskSamplerLocationMask[i], 1);
+    }
+
+    // Get locations of uniforms for the debug border shader program.
+    m_colorColorLocation = glGetUniformLocation(m_colorProgramObject, "color");
+
+    // Get locations of uniforms for the checkerboard shader program.
+    m_checkerScaleLocation = glGetUniformLocation(m_checkerProgramObject, "scale");
+    m_checkerOriginLocation = glGetUniformLocation(m_checkerProgramObject, "origin");
+    m_checkerSurfaceHeightLocation = glGetUniformLocation(m_checkerProgramObject, "surfaceHeight");
+
+    return true;
+}
+
+IntRect LayerRenderingResults::holePunchRect(unsigned index) const
+{
+    if (index >= m_holePunchRects.size())
+        return IntRect();
+
+    return m_holePunchRects.at(index);
+}
+
+void LayerRenderingResults::addHolePunchRect(const IntRect& rect)
+{
+#if DEBUG_VIDEO_CLIPPING
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelInfo, "LayerRenderingResults::addHolePunchRect (x=%d,y=%d,width=%d,height=%d).", rect.x(), rect.y(), rect.width(), rect.height());
+#endif
+    if (!rect.isEmpty())
+        m_holePunchRects.append(rect);
+}
+
+void LayerRenderingResults::addDirtyRect(const IntRect& rect)
+{
+    IntRect dirtyUnion[NumberOfDirtyRects];
+    int smallestIncrease = INT_MAX;
+    int modifiedRect = 0;
+    for (int i = 0; i < NumberOfDirtyRects; ++i) {
+        dirtyUnion[i] = m_dirtyRects[i];
+        dirtyUnion[i].unite(rect);
+        int increase = dirtyUnion[i].width()*dirtyUnion[i].height() - m_dirtyRects[i].width()*m_dirtyRects[i].height();
+        if (increase < smallestIncrease) {
+            smallestIncrease = increase;
+            modifiedRect = i;
+        }
+    }
+
+    m_dirtyRects[modifiedRect] = dirtyUnion[modifiedRect];
+}
+
+bool LayerRenderingResults::isEmpty() const
+{
+    for (int i = 0; i < NumberOfDirtyRects; ++i) {
+        if (!m_dirtyRects[i].isEmpty())
+            return false;
+    }
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h
new file mode 100644
index 000000000..fe5ea0011
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef LayerRenderer_h
+#define LayerRenderer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "IntRect.h"
+#include "LayerData.h"
+#include "TransformationMatrix.h"
+
+#include <BlackBerryPlatformGLES2Context.h>
+#include <BlackBerryPlatformIntRectRegion.h>
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class LayerCompositingThread;
+class LayerRendererSurface;
+
+class LayerRenderingResults {
+public:
+    LayerRenderingResults() : wasEmpty(true), needsAnimationFrame(false) { }
+
+    void addHolePunchRect(const IntRect&);
+    IntRect holePunchRect(size_t index) const;
+    size_t holePunchRectSize() { return m_holePunchRects.size(); }
+
+    static const int NumberOfDirtyRects = 3;
+    const IntRect& dirtyRect(int i) const { return m_dirtyRects[i]; }
+    void addDirtyRect(const IntRect& dirtyRect);
+    bool isEmpty() const;
+
+    bool wasEmpty;
+
+    BlackBerry::Platform::IntRectRegion dirtyRegion;
+
+    bool needsAnimationFrame;
+
+private:
+    Vector<IntRect> m_holePunchRects; // Rects are in compositing surface coordinates.
+    IntRect m_dirtyRects[NumberOfDirtyRects];
+};
+
+// Class that handles drawing of composited render layers using GL.
+class LayerRenderer {
+    WTF_MAKE_NONCOPYABLE(LayerRenderer);
+public:
+    static PassOwnPtr<LayerRenderer> create(BlackBerry::Platform::Graphics::GLES2Context*);
+
+    LayerRenderer(BlackBerry::Platform::Graphics::GLES2Context*);
+    ~LayerRenderer();
+
+    void releaseLayerResources();
+
+    // Recomposites all the layers. Returns true if it needs more draw.
+    void drawLayers(const FloatRect& visibleRect, const IntRect& layoutRect, const IntSize& contentsSize, const IntRect& dstRect);
+
+    void setRootLayer(LayerCompositingThread*);
+    LayerCompositingThread* rootLayer() { return m_rootLayer.get(); }
+
+    // Keep track of layers that need cleanup when the LayerRenderer is destroyed
+    void addLayer(LayerCompositingThread*);
+    bool removeLayer(LayerCompositingThread*);
+
+    // Keep track of layers that need to release their textures when we swap buffers
+    void addLayerToReleaseTextureResourcesList(LayerCompositingThread*);
+
+    bool hardwareCompositing() const { return m_hardwareCompositing; }
+
+    void setClearSurfaceOnDrawLayers(bool clear) { m_clearSurfaceOnDrawLayers = clear; }
+    bool clearSurfaceOnDrawLayers() const { return m_clearSurfaceOnDrawLayers; }
+
+    BlackBerry::Platform::Graphics::GLES2Context* context() const { return m_context; }
+
+    const LayerRenderingResults& lastRenderingResults() const { return m_lastRenderingResults; }
+
+    // Schedule a commit on the WebKit thread at the end of rendering
+    // Used when a layer discovers during rendering that it needs a commit.
+    void setNeedsCommit() { m_needsCommit = true; }
+
+    IntRect toWebKitDocumentCoordinates(const FloatRect&) const;
+
+    // If the layer has already been drawed on a surface.
+    bool layerAlreadyOnSurface(LayerCompositingThread*) const;
+
+private:
+    void updateLayersRecursive(LayerCompositingThread*, const TransformationMatrix& parentMatrix, Vector<RefPtr<LayerCompositingThread> >& surfaceLayers, float opacity, FloatRect clipRect, double currentTime);
+    void compositeLayersRecursive(LayerCompositingThread*, int stencilValue, FloatRect clipRect);
+    void updateScissorIfNeeded(const FloatRect& clipRect);
+
+    bool useSurface(LayerRendererSurface*);
+    void drawLayersOnSurfaces(const Vector<RefPtr<LayerCompositingThread> >& surfaceLayers);
+
+    void drawDebugBorder(LayerCompositingThread*);
+    void drawHolePunchRect(LayerCompositingThread*);
+
+    IntRect toOpenGLWindowCoordinates(const FloatRect&) const;
+    IntRect toWebKitWindowCoordinates(const FloatRect&) const;
+
+    void bindCommonAttribLocation(int location, const char* attribName);
+
+    bool makeContextCurrent();
+
+    bool initializeSharedGLObjects();
+
+    // GL shader program object IDs.
+    unsigned m_layerProgramObject[LayerData::NumberOfLayerProgramShaders];
+    unsigned m_layerMaskProgramObject[LayerData::NumberOfLayerProgramShaders];
+    unsigned m_colorProgramObject;
+    unsigned m_checkerProgramObject;
+
+    // Shader uniform and attribute locations.
+    const int m_positionLocation;
+    const int m_texCoordLocation;
+    int m_samplerLocation[LayerData::NumberOfLayerProgramShaders];
+    int m_alphaLocation[LayerData::NumberOfLayerProgramShaders];
+    int m_maskSamplerLocation[LayerData::NumberOfLayerProgramShaders];
+    int m_maskSamplerLocationMask[LayerData::NumberOfLayerProgramShaders];
+    int m_maskAlphaLocation[LayerData::NumberOfLayerProgramShaders];
+
+    int m_colorColorLocation;
+    int m_checkerScaleLocation;
+    int m_checkerOriginLocation;
+    int m_checkerSurfaceHeightLocation;
+
+    // Current draw configuration.
+    FloatRect m_visibleRect;
+    IntRect m_layoutRect;
+    IntSize m_contentsSize;
+
+    IntRect m_viewport;
+    IntRect m_scissorRect;
+
+    RefPtr<LayerCompositingThread> m_rootLayer;
+
+    unsigned m_fbo;
+    LayerRendererSurface* m_currentLayerRendererSurface;
+
+    bool m_hardwareCompositing;
+    bool m_clearSurfaceOnDrawLayers;
+
+    // Map associating layers with textures ids used by the GL compositor.
+    typedef HashSet<LayerCompositingThread*> LayerSet;
+    LayerSet m_layers;
+    LayerSet m_layersLockingTextureResources;
+
+    BlackBerry::Platform::Graphics::GLES2Context* m_context;
+
+    LayerRenderingResults m_lastRenderingResults;
+    bool m_needsCommit;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.cpp b/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.cpp
new file mode 100644
index 000000000..dea1dd002
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerRendererSurface.h"
+
+#include "LayerCompositingThread.h"
+#include "LayerRenderer.h"
+#include "TextureCacheCompositingThread.h"
+
+namespace WebCore {
+
+LayerRendererSurface::LayerRendererSurface(LayerRenderer* renderer, LayerCompositingThread* owner)
+    : m_ownerLayer(owner)
+    , m_layerRenderer(renderer)
+    , m_opacity(1.0)
+{
+}
+
+LayerRendererSurface::~LayerRendererSurface()
+{
+}
+
+void LayerRendererSurface::setContentRect(const IntRect& contentRect)
+{
+    m_contentRect = contentRect;
+    m_size = contentRect.size();
+}
+
+FloatRect LayerRendererSurface::drawRect() const
+{
+    float bx = m_size.width() / 2.0;
+    float by = m_size.height() / 2.0;
+
+    FloatQuad transformedBounds;
+    transformedBounds.setP1(m_drawTransform.mapPoint(FloatPoint(-bx, -by)));
+    transformedBounds.setP2(m_drawTransform.mapPoint(FloatPoint(-bx, by)));
+    transformedBounds.setP3(m_drawTransform.mapPoint(FloatPoint(bx, by)));
+    transformedBounds.setP4(m_drawTransform.mapPoint(FloatPoint(bx, -by)));
+
+    FloatRect rect = transformedBounds.boundingBox();
+
+    if (m_ownerLayer->replicaLayer()) {
+        FloatQuad bounds;
+        bounds.setP1(m_replicaDrawTransform.mapPoint(FloatPoint(-bx, -by)));
+        bounds.setP2(m_replicaDrawTransform.mapPoint(FloatPoint(-bx, by)));
+        bounds.setP3(m_replicaDrawTransform.mapPoint(FloatPoint(bx, by)));
+        bounds.setP4(m_replicaDrawTransform.mapPoint(FloatPoint(bx, -by)));
+        rect.unite(bounds.boundingBox());
+    }
+
+    return rect;
+}
+
+bool LayerRendererSurface::ensureTexture()
+{
+    if (!m_texture)
+        m_texture = textureCacheCompositingThread()->createTexture();
+
+    return m_texture->protect(m_size);
+}
+
+void LayerRendererSurface::releaseTexture()
+{
+    m_texture->unprotect();
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.h b/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.h
new file mode 100644
index 000000000..20bcfad6c
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef LayerRendererSurface_h
+#define LayerRendererSurface_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "FloatRect.h"
+#include "IntRect.h"
+#include "IntSize.h"
+#include "Texture.h"
+#include "TransformationMatrix.h"
+
+namespace WebCore {
+
+class LayerCompositingThread;
+class LayerRenderer;
+
+class LayerRendererSurface {
+    WTF_MAKE_NONCOPYABLE(LayerRendererSurface);
+public:
+    LayerRendererSurface(LayerRenderer*, LayerCompositingThread* owner);
+    ~LayerRendererSurface();
+
+    IntSize size() const { return m_size; }
+
+    FloatRect contentRect() const { return m_contentRect; }
+    void setContentRect(const IntRect&);
+    FloatRect clipRect() const { return m_clipRect; }
+    void setClipRect(const FloatRect& rect) { m_clipRect = rect; }
+
+    void setDrawTransform(const TransformationMatrix& matrix) { m_drawTransform = matrix; }
+    const TransformationMatrix& drawTransform() const { return m_drawTransform; }
+    void setReplicaDrawTransform(const TransformationMatrix& matrix) { m_replicaDrawTransform = matrix; }
+    const TransformationMatrix& replicaDrawTransform() const { return m_replicaDrawTransform; }
+
+    FloatRect drawRect() const;
+
+    bool ensureTexture();
+    void releaseTexture();
+    Texture* texture() const { return m_texture.get(); }
+
+    float drawOpacity() { return m_opacity; }
+    void setDrawOpacity(float opacity) { m_opacity = opacity; }
+
+private:
+    RefPtr<Texture> m_texture;
+
+    FloatRect m_contentRect;
+    FloatRect m_clipRect;
+
+    TransformationMatrix m_surfaceMatrix;
+    TransformationMatrix m_drawTransform;
+    TransformationMatrix m_replicaDrawTransform;
+
+    LayerCompositingThread* m_ownerLayer;
+    LayerRenderer* m_layerRenderer;
+
+    float m_opacity;
+
+    IntSize m_size;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // LayerRendererSurface_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTile.cpp b/Source/WebCore/platform/graphics/blackberry/LayerTile.cpp
new file mode 100644
index 000000000..f21ea948e
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTile.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerTile.h"
+
+#include "TextureCacheCompositingThread.h"
+
+namespace WebCore {
+
+LayerTile::LayerTile()
+    : m_contentsDirty(false)
+{
+}
+
+LayerTile::~LayerTile()
+{
+    // Make sure to unprotect the texture if needed.
+    setVisible(false);
+}
+
+void LayerTile::setContents(const SkBitmap& contents, const IntRect& tileRect, const TileIndex& index, bool isOpaque)
+{
+    setTexture(textureCacheCompositingThread()->textureForTiledContents(contents, tileRect, index, isOpaque));
+}
+
+void LayerTile::setContentsToColor(const Color& color)
+{
+    setTexture(textureCacheCompositingThread()->textureForColor(color));
+}
+
+void LayerTile::updateContents(const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tileRect)
+{
+    setTexture(textureCacheCompositingThread()->updateContents(m_texture, contents, dirtyRect, tileRect));
+}
+
+void LayerTile::discardContents()
+{
+    setTexture(0);
+}
+
+void LayerTile::setVisible(bool visible)
+{
+    if (visible == m_visible)
+        return;
+
+    m_visible = visible;
+
+    if (!m_texture)
+        return;
+
+    // Protect the texture from being evicted from cache
+    // if we are visible.
+    if (visible)
+        m_texture->protect();
+    else
+        m_texture->unprotect();
+}
+
+void LayerTile::setTexture(PassRefPtr<Texture> texture)
+{
+    // Clear this flag regardless of the value of the texture parameter.
+    // If it's 0, isDirty() will return true anyway.
+    // If it's the same texture, perhaps there was no more detailed texture
+    // available than the one we already had, and keeping the dirty flag will
+    // result in an endless loop of updating to the same texture.
+    m_contentsDirty = false;
+
+    if (texture == m_texture)
+        return;
+
+    // Move protection over to the new texture.
+    if (m_visible) {
+        if (m_texture)
+            m_texture->unprotect();
+        if (texture)
+            texture->protect();
+    }
+
+    m_texture = texture;
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTile.h b/Source/WebCore/platform/graphics/blackberry/LayerTile.h
new file mode 100644
index 000000000..0eddcdaae
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTile.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef LayerTile_h
+#define LayerTile_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "Texture.h"
+
+#include <wtf/RefPtr.h>
+
+class SkBitmap;
+
+namespace WebCore {
+
+class Color;
+class IntRect;
+class TileIndex;
+
+class LayerTileData {
+public:
+    LayerTileData()
+        : m_visible(false)
+    {
+    }
+
+    bool isVisible() const { return m_visible; }
+
+protected:
+    bool m_visible;
+};
+
+class LayerTile : public LayerTileData {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    LayerTile();
+    ~LayerTile();
+
+    Texture* texture() const { return m_texture.get(); }
+
+    bool isVisible() const { return m_visible; }
+    void setVisible(bool);
+
+    bool isDirty() const { return m_contentsDirty || !m_texture || m_texture->isDirty(); }
+
+    bool hasTexture() const { return m_texture && m_texture->hasTexture(); }
+
+    void setContents(const SkBitmap& contents, const IntRect& tileRect, const TileIndex&, bool isOpaque);
+    void setContentsToColor(const Color&);
+    void updateContents(const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tileRect);
+    void discardContents();
+
+    // The current texture is an accurate preview of this layer, but a more
+    // detailed texture could be obtained by repainting the layer. Used when
+    // zoom level changes.
+    void setContentsDirty() { m_contentsDirty = true; }
+
+private:
+    void setTexture(PassRefPtr<Texture>);
+
+    // Never assign to m_texture directly, use setTexture() above.
+    RefPtr<Texture> m_texture;
+    bool m_contentsDirty;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // Texture_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTileIndex.h b/Source/WebCore/platform/graphics/blackberry/LayerTileIndex.h
new file mode 100644
index 000000000..4df008728
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTileIndex.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef LayerTileIndex_h
+#define LayerTileIndex_h
+
+#include <limits>
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+class TileIndex {
+public:
+    TileIndex()
+        : m_i(std::numeric_limits<unsigned>::max())
+        , m_j(std::numeric_limits<unsigned>::max())
+    {
+    }
+    TileIndex(unsigned i, unsigned j)
+        : m_i(i)
+        , m_j(j)
+    {
+    }
+    ~TileIndex() { }
+
+    unsigned i() const { return m_i; }
+    unsigned j() const { return m_j; }
+    void setIndex(unsigned i, unsigned j)
+    {
+        m_i = i;
+        m_j = j;
+    }
+
+private:
+    unsigned m_i;
+    unsigned m_j;
+};
+
+inline bool operator==(const TileIndex& a, const TileIndex& b)
+{
+    return a.i() == b.i() && a.j() == b.j();
+}
+
+inline bool operator!=(const TileIndex& a, const TileIndex& b)
+{
+    return a.i() != b.i() || a.j() != b.j();
+}
+
+}
+
+namespace WTF {
+
+template<> struct IntHash<WebCore::TileIndex> {
+    static unsigned hash(const WebCore::TileIndex& key) { return intHash((static_cast<uint64_t>(key.i()) << 32 | key.j())); }
+    static bool equal(const WebCore::TileIndex& a, const WebCore::TileIndex& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+template<> struct DefaultHash<WebCore::TileIndex> {
+    typedef IntHash<WebCore::TileIndex> Hash;
+};
+
+template<> struct HashTraits<WebCore::TileIndex> : GenericHashTraits<WebCore::TileIndex> {
+    static const bool emptyValueIsZero = false;
+    static const bool needsDestruction = false;
+    static WebCore::TileIndex emptyValue() { return WebCore::TileIndex(); }
+    static void constructDeletedValue(WebCore::TileIndex& slot)
+    {
+        new (&slot) WebCore::TileIndex(std::numeric_limits<unsigned>::max() - 1, std::numeric_limits<unsigned>::max() - 1);
+    }
+    static bool isDeletedValue(const WebCore::TileIndex& value)
+    {
+        return value.i() == std::numeric_limits<unsigned>::max() - 1 && value.j() == std::numeric_limits<unsigned>::max() - 1;
+    }
+};
+
+} // namespace WTF
+
+#endif // LayerTileIndex_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTiler.cpp b/Source/WebCore/platform/graphics/blackberry/LayerTiler.cpp
new file mode 100644
index 000000000..3dad399d6
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTiler.cpp
@@ -0,0 +1,747 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerTiler.h"
+
+#include "BitmapImage.h"
+#include "LayerCompositingThread.h"
+#include "LayerMessage.h"
+#include "LayerWebKitThread.h"
+#include "NativeImageSkia.h"
+#include "TextureCacheCompositingThread.h"
+
+#include <BlackBerryPlatformScreen.h>
+#include <GLES2/gl2.h>
+
+using namespace std;
+
+namespace WebCore {
+
+// This is used to make the viewport as used in texture visibility calculations
+// slightly larger so textures are uploaded before becoming really visible.
+const float viewportInflationFactor = 1.1f;
+
+// The tileMultiplier indicates how many tiles will fit in the largest dimension
+// of the screen, if drawn using identity transform.
+// We use half the screen size as tile size, to reduce the texture upload time
+// for small repaint rects. Compared to using screen size directly, this should
+// make most small invalidations 16x faster, unless they're unfortunate enough
+// to intersect two or more tiles, where it would be 8x-1x faster.
+const int tileMultiplier = 4;
+
+static void transformPoint(float x, float y, const TransformationMatrix& m, float* result)
+{
+    // Squash the Z coordinate so that layers aren't clipped against the near and
+    // far plane. Note that the perspective is maintained as we're still passing
+    // down the W coordinate.
+    result[0] = x * m.m11() + y * m.m21() + m.m41();
+    result[1] = x * m.m12() + y * m.m22() + m.m42();
+    result[2] = 0;
+    result[3] = x * m.m14() + y * m.m24() + m.m44();
+}
+
+static IntSize defaultTileSize()
+{
+    static IntSize screenSize = BlackBerry::Platform::Graphics::Screen::primaryScreen()->nativeSize();
+    static int dim = max(screenSize.width(), screenSize.height()) / tileMultiplier;
+    return IntSize(dim, dim);
+}
+
+LayerTiler::LayerTiler(LayerWebKitThread* layer)
+    : m_layer(layer)
+    , m_tilingDisabled(false)
+    , m_contentsDirty(false)
+    , m_tileSize(defaultTileSize())
+    , m_clearTextureJobs(false)
+    , m_hasMissingTextures(false)
+    , m_contentsScale(0.0)
+{
+}
+
+LayerTiler::~LayerTiler()
+{
+    // Someone should have called LayerTiler::deleteTextures()
+    // before now. We can't call it here because we have no
+    // OpenGL context.
+    ASSERT(m_tilesCompositingThread.isEmpty());
+}
+
+void LayerTiler::layerWebKitThreadDestroyed()
+{
+    m_layer = 0;
+}
+
+void LayerTiler::layerCompositingThreadDestroyed()
+{
+    ASSERT(isCompositingThread());
+}
+
+void LayerTiler::setNeedsDisplay(const FloatRect& dirtyRect)
+{
+    m_dirtyRect.unite(dirtyRect);
+    m_contentsDirty = true;
+}
+
+void LayerTiler::setNeedsDisplay()
+{
+    m_dirtyRect.setLocation(FloatPoint::zero());
+    m_dirtyRect.setSize(m_layer->bounds());
+    m_contentsDirty = true;
+}
+
+void LayerTiler::updateTextureContentsIfNeeded(double scale)
+{
+    updateTileSize();
+
+    HashSet<TileIndex> renderJobs;
+    {
+        MutexLocker locker(m_renderJobsMutex);
+        if (!m_contentsDirty && m_renderJobs.isEmpty())
+            return;
+        renderJobs = m_renderJobs;
+    }
+
+    bool isZoomJob = false;
+    if (scale != m_contentsScale) {
+        // The first time around, it does not count as a zoom job.
+        if (m_contentsScale)
+            isZoomJob = true;
+        m_contentsScale = scale;
+    }
+
+    IntRect dirtyRect = enclosingIntRect(m_dirtyRect);
+    IntSize requiredTextureSize;
+
+    if (m_layer->drawsContent()) {
+        // Layer contents must be drawn into a canvas.
+        IntRect untransformedDirtyRect(dirtyRect);
+        IntRect boundsRect(IntPoint::zero(), m_layer->bounds());
+        IntRect untransformedBoundsRect(boundsRect);
+        requiredTextureSize = boundsRect.size();
+
+        if (scale != 1.0) {
+            TransformationMatrix matrix;
+            matrix.scale(scale);
+
+            dirtyRect = matrix.mapRect(untransformedDirtyRect);
+            requiredTextureSize = matrix.mapRect(IntRect(IntPoint::zero(), requiredTextureSize)).size();
+            boundsRect = matrix.mapRect(untransformedBoundsRect);
+        }
+
+        if (requiredTextureSize != m_pendingTextureSize)
+            dirtyRect = boundsRect;
+        else {
+            // Clip the dirtyRect to the size of the layer to avoid drawing
+            // outside the bounds of the backing texture.
+            dirtyRect.intersect(boundsRect);
+        }
+    } else if (m_layer->contents()) {
+        // Layer is a container, and it contains an Image.
+        requiredTextureSize = m_layer->contents()->size();
+        dirtyRect = IntRect(IntPoint::zero(), requiredTextureSize);
+    }
+
+    // If we need display because we no longer need to be displayed, due to texture size becoming 0 x 0,
+    // or if we're re-rendering the whole thing anyway, clear old texture jobs.
+    HashSet<TileIndex> finishedJobs;
+    if (requiredTextureSize.isEmpty() || dirtyRect == IntRect(IntPoint::zero(), requiredTextureSize)) {
+        {
+            MutexLocker locker(m_renderJobsMutex);
+            m_renderJobs.clear();
+        }
+        clearTextureJobs();
+    } else if (!renderJobs.isEmpty()) {
+        if (Image* image = m_layer->contents()) {
+            bool isOpaque = false;
+            if (image->isBitmapImage())
+                isOpaque = !static_cast<BitmapImage*>(image)->currentFrameHasAlpha();
+            if (NativeImagePtr nativeImage = image->nativeImageForCurrentFrame()) {
+                SkBitmap bitmap = SkBitmap(*nativeImage);
+                addTextureJob(TextureJob::setContents(bitmap, isOpaque));
+            }
+        } else {
+            // There might still be some pending render jobs due to visibility changes.
+            for (HashSet<TileIndex>::iterator it = renderJobs.begin(); it != renderJobs.end(); ++it) {
+                {
+                    // Check if the job has been cancelled.
+                    MutexLocker locker(m_renderJobsMutex);
+                    if (!m_renderJobs.contains(*it))
+                        continue;
+                    m_renderJobs.remove(*it);
+                }
+
+                IntRect tileRect = rectForTile(*it, requiredTextureSize);
+                if (tileRect.isEmpty())
+                    continue;
+
+                bool isSolidColor = false;
+                Color color;
+                SkBitmap bitmap = m_layer->paintContents(tileRect, scale, &isSolidColor, &color);
+                // bitmap can be null here. Make requiredTextureSize empty so that we
+                // will not try to update and draw the layer.
+                if (!bitmap.isNull()) {
+                    if (isSolidColor)
+                        addTextureJob(TextureJob::setContentsToColor(color, *it));
+                    else
+                        addTextureJob(TextureJob::updateContents(bitmap, tileRect));
+                }
+
+                finishedJobs.add(*it);
+            }
+        }
+    }
+
+    bool didResize = false;
+    if (m_pendingTextureSize != requiredTextureSize) {
+        didResize = true;
+        m_pendingTextureSize = requiredTextureSize;
+        addTextureJob(TextureJob::resizeContents(m_pendingTextureSize));
+    }
+    m_contentsDirty = false;
+    m_dirtyRect = FloatRect();
+
+    if (dirtyRect.isEmpty() || requiredTextureSize.isEmpty())
+        return;
+
+    if (Image* image = m_layer->contents()) {
+        bool isOpaque = false;
+        if (image->isBitmapImage())
+            isOpaque = !static_cast<BitmapImage*>(image)->currentFrameHasAlpha();
+        // No point in tiling an image layer, the image is already stored as an SkBitmap
+        NativeImagePtr nativeImage = m_layer->contents()->nativeImageForCurrentFrame();
+        if (nativeImage) {
+            SkBitmap bitmap = SkBitmap(*nativeImage);
+            addTextureJob(TextureJob::setContents(bitmap, isOpaque));
+        }
+        return;
+    }
+
+    IntPoint topLeft = dirtyRect.minXMinYCorner();
+    IntPoint bottomRight = dirtyRect.maxXMaxYCorner(); // This is actually a pixel below and to the right of the dirtyRect.
+
+    IntSize tileMaximumSize = tileSize();
+    bool wasOneTile = m_tilesWebKitThread.size() == 1;
+    bool isOneTile = m_pendingTextureSize.width() <= tileMaximumSize.width() && m_pendingTextureSize.height() <= tileMaximumSize.height();
+    IntPoint origin = originOfTile(indexOfTile(topLeft));
+    IntRect tileRect;
+    for (tileRect.setX(origin.x()); tileRect.x() < bottomRight.x(); tileRect.setX(tileRect.x() + tileMaximumSize.width())) {
+        for (tileRect.setY(origin.y()); tileRect.y() < bottomRight.y(); tileRect.setY(tileRect.y() + tileMaximumSize.height())) {
+            tileRect.setWidth(min(requiredTextureSize.width() - tileRect.x(), tileMaximumSize.width()));
+            tileRect.setHeight(min(requiredTextureSize.height() - tileRect.y(), tileMaximumSize.height()));
+
+            IntRect localDirtyRect(dirtyRect);
+            localDirtyRect.intersect(tileRect);
+            if (localDirtyRect.isEmpty())
+                continue;
+
+            TileIndex index = indexOfTile(tileRect.location());
+
+            // If we already did this as part of one of the render jobs due to
+            // visibility changes, don't render that tile again.
+            if (finishedJobs.contains(index))
+                continue;
+
+            if (!shouldPerformRenderJob(index, !isZoomJob)) {
+                // Avoid checkerboarding unless the layer is resized. When
+                // resized, the contents are likely to change appearance, for
+                // example due to aspect ratio change. However, if it is a
+                // resize due to zooming, the aspect ratio and content will
+                // stay the same, and we can keep the old texture content as a
+                // preview.
+                // FIXME: the zoom preview only works if we don't re-tile the
+                // layer. We need to store texture coordinates in
+                // WebCore::Texture to be able to fix that.
+                if (didResize && !(isZoomJob && wasOneTile && isOneTile))
+                    addTextureJob(TextureJob::discardContents(tileRect));
+                else
+                    addTextureJob(TextureJob::dirtyContents(tileRect));
+                continue;
+            }
+
+            // Just in case a new job for this tile has just been inserted by compositing thread.
+            removeRenderJob(index);
+
+            // FIXME: We are always drawing whole tiles at the moment, because
+            // we currently can't keep track of which part of a tile is
+            // rendered and which is not. Sending only a subrectangle of a tile
+            // to the compositing thread might cause it to be uploaded using
+            // glTexImage, if the texture was previously evicted from the cache.
+            // The result would be that a subrectangle of the tile was stretched
+            // to fit the tile geometry, appearing as a glaring misrendering of
+            // the web page.
+            bool isSolidColor = false;
+            Color color;
+            SkBitmap bitmap = m_layer->paintContents(tileRect, scale, &isSolidColor, &color);
+            // bitmap can be null here. Make requiredTextureSize empty so that we
+            // will not try to update and draw the layer.
+            if (!bitmap.isNull()) {
+                if (isSolidColor)
+                    addTextureJob(TextureJob::setContentsToColor(color, index));
+                else
+                    addTextureJob(TextureJob::updateContents(bitmap, tileRect));
+            }
+        }
+    }
+}
+
+bool LayerTiler::shouldPerformRenderJob(const TileIndex& index, bool allowPrefill)
+{
+    // If the visibility information was propagated from the compositing
+    // thread, use that information.
+    // However, we are about to commit new layer properties that may make
+    // currently hidden layers visible. To avoid false negatives, we only allow
+    // the current state to be used to accept render jobs, not to reject them.
+    if (m_tilesWebKitThread.get(index).isVisible())
+        return true;
+
+    // Tiles that are not currently visible on the compositing thread may still
+    // deserve to be rendered if they should be prefilled...
+    if (allowPrefill && !m_tilesWebKitThread.contains(index) && shouldPrefillTile(index))
+        return true;
+
+    // Or if they are visible according to the state that's about to be
+    // committed. We do a visibility test using the current transform state.
+    IntRect contentRect = rectForTile(index, m_pendingTextureSize);
+    return m_layer->contentsVisible(contentRect);
+}
+
+void LayerTiler::addTextureJob(const TextureJob& job)
+{
+    m_pendingTextureJobs.append(job);
+}
+
+void LayerTiler::clearTextureJobs()
+{
+    // Clear any committed texture jobs on next invocation of LayerTiler::commitPendingTextureUploads().
+    m_clearTextureJobs = true;
+
+    removeUpdateContentsJobs(m_pendingTextureJobs);
+}
+
+void LayerTiler::commitPendingTextureUploads()
+{
+    if (m_clearTextureJobs) {
+        removeUpdateContentsJobs(m_textureJobs);
+        m_clearTextureJobs = false;
+    }
+
+    for (Vector<TextureJob>::iterator it = m_pendingTextureJobs.begin(); it != m_pendingTextureJobs.end(); ++it)
+        m_textureJobs.append(*it);
+    m_pendingTextureJobs.clear();
+}
+
+void LayerTiler::layerVisibilityChanged(bool visible)
+{
+    // For visible layers, we handle the tile-level visibility
+    // in the draw loop, see LayerTiler::drawTextures().
+    if (visible)
+        return;
+
+    {
+        // All tiles are invisible now.
+        MutexLocker locker(m_renderJobsMutex);
+        m_renderJobs.clear();
+    }
+
+    for (TileMap::iterator it = m_tilesCompositingThread.begin(); it != m_tilesCompositingThread.end(); ++it) {
+        TileIndex index = (*it).first;
+        LayerTile* tile = (*it).second;
+        tile->setVisible(false);
+    }
+}
+
+void LayerTiler::uploadTexturesIfNeeded()
+{
+    TileJobsMap tileJobsMap;
+    Deque<TextureJob>::const_iterator textureJobIterEnd = m_textureJobs.end();
+    for (Deque<TextureJob>::const_iterator textureJobIter = m_textureJobs.begin(); textureJobIter != textureJobIterEnd; ++textureJobIter)
+        processTextureJob(*textureJobIter, tileJobsMap);
+
+    TileJobsMap::const_iterator tileJobsIterEnd = tileJobsMap.end();
+    for (TileJobsMap::const_iterator tileJobsIter = tileJobsMap.begin(); tileJobsIter != tileJobsIterEnd; ++tileJobsIter) {
+        IntPoint origin = originOfTile(tileJobsIter->first);
+
+        LayerTile* tile = m_tilesCompositingThread.get(tileJobsIter->first);
+        if (!tile) {
+            if (origin.x() >= m_requiredTextureSize.width() || origin.y() >= m_requiredTextureSize.height())
+                continue;
+            tile = new LayerTile();
+            m_tilesCompositingThread.add(tileJobsIter->first, tile);
+        }
+
+        IntRect tileRect(origin, tileSize());
+        tileRect.setWidth(min(m_requiredTextureSize.width() - tileRect.x(), tileRect.width()));
+        tileRect.setHeight(min(m_requiredTextureSize.height() - tileRect.y(), tileRect.height()));
+
+        performTileJob(tile, *tileJobsIter->second, tileRect);
+    }
+
+    m_textureJobs.clear();
+}
+
+void LayerTiler::processTextureJob(const TextureJob& job, TileJobsMap& tileJobsMap)
+{
+    if (job.m_type == TextureJob::ResizeContents) {
+        IntSize pendingTextureSize = job.m_dirtyRect.size();
+        if (pendingTextureSize.width() < m_requiredTextureSize.width() || pendingTextureSize.height() < m_requiredTextureSize.height())
+            pruneTextures();
+
+        m_requiredTextureSize = pendingTextureSize;
+        return;
+    }
+
+    if (job.m_type == TextureJob::SetContentsToColor) {
+        addTileJob(job.m_index, job, tileJobsMap);
+        return;
+     }
+
+    IntSize tileMaximumSize = tileSize();
+    IntPoint topLeft = job.m_dirtyRect.minXMinYCorner();
+    IntPoint bottomRight = job.m_dirtyRect.maxXMaxYCorner(); // This is actually a pixel below and to the right of the dirtyRect.
+    IntPoint origin = originOfTile(indexOfTile(topLeft));
+    IntRect tileRect;
+    for (tileRect.setX(origin.x()); tileRect.x() < bottomRight.x(); tileRect.setX(tileRect.x() + tileMaximumSize.width())) {
+        for (tileRect.setY(origin.y()); tileRect.y() < bottomRight.y(); tileRect.setY(tileRect.y() + tileMaximumSize.height()))
+            addTileJob(indexOfTile(tileRect.location()), job, tileJobsMap);
+    }
+}
+
+void LayerTiler::addTileJob(const TileIndex& index, const TextureJob& job, TileJobsMap& tileJobsMap)
+{
+    // HashMap::add always returns a valid iterator even the key already exists.
+    pair<TileJobsMap::iterator, bool> result = tileJobsMap.add(index, &job);
+
+    // Successfully added the new job.
+    if (result.second)
+        return;
+
+    // In this case we leave the previous job.
+    if (job.m_type == TextureJob::DirtyContents && result.first->second->m_type == TextureJob::DiscardContents)
+        return;
+
+    // Override the previous job.
+    result.first->second = &job;
+}
+
+void LayerTiler::performTileJob(LayerTile* tile, const TextureJob& job, const IntRect& tileRect)
+{
+    switch (job.m_type) {
+    case TextureJob::SetContentsToColor:
+        tile->setContentsToColor(job.m_color);
+        return;
+    case TextureJob::SetContents:
+        tile->setContents(job.m_contents, tileRect, indexOfTile(tileRect.location()), job.m_isOpaque);
+        return;
+    case TextureJob::UpdateContents:
+        tile->updateContents(job.m_contents, job.m_dirtyRect, tileRect);
+        return;
+    case TextureJob::DiscardContents:
+        tile->discardContents();
+        return;
+    case TextureJob::DirtyContents:
+        tile->setContentsDirty();
+        return;
+    case TextureJob::Unknown:
+    case TextureJob::ResizeContents:
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+void LayerTiler::drawTextures(LayerCompositingThread* layer, int pos, int texCoord)
+{
+    drawTexturesInternal(layer, pos, texCoord, false /* drawMissing */);
+}
+
+void LayerTiler::drawMissingTextures(LayerCompositingThread* layer, int pos, int texCoord)
+{
+    drawTexturesInternal(layer, pos, texCoord, true /* drawMissing */);
+}
+
+void LayerTiler::drawTexturesInternal(LayerCompositingThread* layer, int positionLocation, int texCoordLocation, bool drawMissing)
+{
+    const TransformationMatrix& drawTransform = layer->drawTransform();
+    IntSize bounds = layer->bounds();
+
+    float texcoords[4 * 2] = { 0, 0,  0, 1,  1, 1,  1, 0 };
+    float vertices[4 * 4];
+
+    glVertexAttribPointer(positionLocation, 4, GL_FLOAT, GL_FALSE, 0, vertices);
+    glVertexAttribPointer(texCoordLocation, 2, GL_FLOAT, GL_FALSE, 0, texcoords);
+
+    m_hasMissingTextures = false;
+
+    int maxw = tileSize().width();
+    int maxh = tileSize().height();
+    float sx = static_cast<float>(bounds.width()) / m_requiredTextureSize.width();
+    float sy = static_cast<float>(bounds.height()) / m_requiredTextureSize.height();
+
+    bool needsDisplay = false;
+
+    bool blending = !drawMissing;
+
+    IntRect tileRect;
+    for (tileRect.setX(0); tileRect.x() < m_requiredTextureSize.width(); tileRect.setX(tileRect.x() + maxw)) {
+        for (tileRect.setY(0); tileRect.y() < m_requiredTextureSize.height(); tileRect.setY(tileRect.y() + maxh)) {
+            TileIndex index = indexOfTile(tileRect.location());
+            LayerTile* tile = m_tilesCompositingThread.get(index);
+            if (!tile) {
+                tile = new LayerTile();
+                m_tilesCompositingThread.add(index, tile);
+            }
+
+            float x = index.i() * maxw * sx;
+            float y = index.j() * maxh * sy;
+            float w = min(bounds.width() - x, maxw * sx);
+            float h = min(bounds.height() - y, maxh * sy);
+            float ox = x - bounds.width() / 2.0;
+            float oy = y - bounds.height() / 2.0;
+
+            // We apply the transformation by hand, since we need the z coordinate
+            // as well (to do perspective correct texturing) and we don't need
+            // to divide by w by hand, the GPU will do that for us
+            transformPoint(ox, oy, drawTransform, &vertices[0]);
+            transformPoint(ox, oy + h, drawTransform, &vertices[4]);
+            transformPoint(ox + w, oy + h, drawTransform, &vertices[8]);
+            transformPoint(ox + w, oy, drawTransform, &vertices[12]);
+
+            // Inflate the rect somewhat to attempt to make textures render before they show
+            // up on screen.
+            float d = viewportInflationFactor;
+            FloatRect rect(-d, -d, 2 * d, 2 * d);
+            FloatQuad quad(FloatPoint(vertices[0] / vertices[3], vertices[1] / vertices[3]),
+                           FloatPoint(vertices[4] / vertices[7], vertices[5] / vertices[7]),
+                           FloatPoint(vertices[8] / vertices[11], vertices[9] / vertices[11]),
+                           FloatPoint(vertices[12] / vertices[15], vertices[13] / vertices[15]));
+            bool visible = quad.boundingBox().intersects(rect);
+
+            bool wasVisible = tile->isVisible();
+            tile->setVisible(visible);
+
+            // This method is called in two passes. The first pass draws all
+            // visible tiles with textures.
+            // If a visible tile has no texture, set the m_hasMissingTextures
+            // flag, to indicate that we need a second pass.
+            // The second "drawMissing" pass draws all visible tiles without
+            // textures as checkerboard.
+            // However, don't draw brand new tiles as checkerboard. The checker-
+            // board indicates that a tile has dirty contents, but that's not
+            // the case if it's brand new.
+            if (visible) {
+                bool hasTexture = tile->hasTexture();
+                if (!hasTexture)
+                    m_hasMissingTextures = true;
+
+                if (hasTexture && !drawMissing) {
+                    Texture* texture = tile->texture();
+                    if (texture->isOpaque() && layer->drawOpacity() == 1.0f && !layer->maskLayer()) {
+                        if (blending) {
+                            blending = false;
+                            glDisable(GL_BLEND);
+                        }
+                    } else if (!blending) {
+                        blending = true;
+                        glEnable(GL_BLEND);
+                        glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
+                    }
+
+                    textureCacheCompositingThread()->textureAccessed(texture);
+                    glBindTexture(GL_TEXTURE_2D, texture->textureId());
+                }
+
+                if (hasTexture != drawMissing)
+                    glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+
+                if (tile->isDirty()) {
+                    addRenderJob(index);
+                    needsDisplay = true;
+                }
+            } else if (wasVisible)
+                removeRenderJob(index);
+        }
+    }
+
+    // Return early for the drawMissing case, don't flag us as needing commit.
+    if (drawMissing)
+        return;
+
+    // Switch on blending again (we know that drawMissing == false).
+    if (!blending) {
+        glEnable(GL_BLEND);
+        glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
+    }
+
+    // If we schedule a commit, visibility will be updated, and display will
+    // happen if there are any visible and dirty textures.
+    if (needsDisplay)
+        layer->setNeedsCommit();
+}
+
+void LayerTiler::addRenderJob(const TileIndex& index)
+{
+    ASSERT(isCompositingThread());
+
+    MutexLocker locker(m_renderJobsMutex);
+    m_renderJobs.add(index);
+}
+
+void LayerTiler::removeRenderJob(const TileIndex& index)
+{
+    MutexLocker locker(m_renderJobsMutex);
+    m_renderJobs.remove(index);
+}
+
+void LayerTiler::deleteTextures()
+{
+    // Since textures are deleted by a synchronous message
+    // from WebKit thread to compositing thread, we don't need
+    // any synchronization mechanism here, even though we are
+    // touching some WebKit thread state.
+    m_tilesWebKitThread.clear();
+
+    if (m_tilesCompositingThread.size()) {
+        for (TileMap::iterator it = m_tilesCompositingThread.begin(); it != m_tilesCompositingThread.end(); ++it)
+            (*it).second->discardContents();
+        m_tilesCompositingThread.clear();
+
+        m_contentsDirty = true;
+    }
+
+    // For various reasons, e.g. page cache, someone may try
+    // to render us after the textures were deleted.
+    m_pendingTextureSize = IntSize();
+    m_requiredTextureSize = IntSize();
+}
+
+void LayerTiler::pruneTextures()
+{
+    // Prune tiles that are no longer needed.
+    Vector<TileIndex> tilesToDelete;
+    for (TileMap::iterator it = m_tilesCompositingThread.begin(); it != m_tilesCompositingThread.end(); ++it) {
+        TileIndex index = (*it).first;
+
+        IntPoint origin = originOfTile(index);
+        if (origin.x() >= m_requiredTextureSize.width() || origin.y() >= m_requiredTextureSize.height())
+            tilesToDelete.append(index);
+    }
+
+    for (Vector<TileIndex>::iterator it = tilesToDelete.begin(); it != tilesToDelete.end(); ++it) {
+        LayerTile* tile = m_tilesCompositingThread.take(*it);
+        tile->discardContents();
+        delete tile;
+    }
+}
+
+void LayerTiler::updateTileSize()
+{
+    IntSize size = m_tilingDisabled ? m_layer->bounds() : defaultTileSize();
+    const IntSize maxTextureSize(2048, 2048);
+    size = size.shrunkTo(maxTextureSize);
+
+    if (m_tileSize == size || size.isEmpty())
+        return;
+
+    // Invalidate the whole layer if tile size changes.
+    setNeedsDisplay();
+    m_tileSize = size;
+}
+
+void LayerTiler::disableTiling(bool disable)
+{
+    if (m_tilingDisabled == disable)
+        return;
+
+    m_tilingDisabled = disable;
+    updateTileSize();
+}
+
+bool LayerTiler::shouldPrefillTile(const TileIndex& index)
+{
+    // For now, we use the heuristic of prefilling the first screenful of tiles.
+    // This gives the correct result only for layers with identity transform,
+    // which is why it's called a heuristic here. This is needed for the case
+    // where the developer actually designed their web page around the use of
+    // accelerated compositing, and expects even offscreen layers to have content.
+    // We oblige them to some degree by prefilling a screenful of tiles.
+    // This is redundant in some other scenarios, i.e. when an offscreen layer
+    // is composited only because of overlapping a flash ad or something like
+    // that, but we're willing to make this tradeoff.
+
+    // Since the tileMultiplier indicates how many tiles fit on the screen,
+    // the following formula can be used:
+    return index.i() < static_cast<unsigned>(tileMultiplier) && index.j() < static_cast<unsigned>(tileMultiplier);
+}
+
+TileIndex LayerTiler::indexOfTile(const WebCore::IntPoint& origin)
+{
+    int offsetX = origin.x();
+    int offsetY = origin.y();
+    if (offsetX)
+        offsetX = offsetX / tileSize().width();
+    if (offsetY)
+        offsetY = offsetY / tileSize().height();
+    return TileIndex(offsetX, offsetY);
+}
+
+IntPoint LayerTiler::originOfTile(const TileIndex& index)
+{
+    return IntPoint(index.i() * tileSize().width(), index.j() * tileSize().height());
+}
+
+IntRect LayerTiler::rectForTile(const TileIndex& index, const IntSize& bounds)
+{
+    IntPoint origin = originOfTile(index);
+    IntSize offset(origin.x(), origin.y());
+    IntSize size = tileSize().shrunkTo(bounds - offset);
+    return IntRect(origin, size);
+}
+
+bool LayerTiler::hasDirtyTiles() const
+{
+    for (TileMap::const_iterator it = m_tilesCompositingThread.begin(); it != m_tilesCompositingThread.end(); ++it) {
+        const LayerTile* tile = (*it).second;
+        if (tile->isDirty())
+            return true;
+    }
+
+    return false;
+}
+
+void LayerTiler::bindContentsTexture()
+{
+    ASSERT(m_tilesCompositingThread.size() == 1);
+    if (m_tilesCompositingThread.size() != 1)
+        return;
+
+    const LayerTile* tile = m_tilesCompositingThread.begin()->second;
+
+    ASSERT(tile->hasTexture());
+    if (!tile->hasTexture())
+        return;
+
+    glBindTexture(GL_TEXTURE_2D, tile->texture()->textureId());
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTiler.h b/Source/WebCore/platform/graphics/blackberry/LayerTiler.h
new file mode 100644
index 000000000..eda9e61d3
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTiler.h
@@ -0,0 +1,205 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef LayerTiler_h
+#define LayerTiler_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "Color.h"
+#include "FloatRect.h"
+#include "IntRect.h"
+#include "LayerTile.h"
+#include "LayerTileIndex.h"
+
+#include <SkBitmap.h>
+#include <wtf/Deque.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/ThreadSafeRefCounted.h>
+
+namespace WebCore {
+
+class LayerCompositingThread;
+class LayerWebKitThread;
+
+class LayerTiler : public ThreadSafeRefCounted<LayerTiler> {
+public:
+    TileIndex indexOfTile(const IntPoint& origin);
+    IntPoint originOfTile(const TileIndex&);
+    IntRect rectForTile(const TileIndex&, const IntSize& bounds);
+
+    static PassRefPtr<LayerTiler> create(LayerWebKitThread* layer)
+    {
+        return adoptRef(new LayerTiler(layer));
+    }
+
+    virtual ~LayerTiler();
+
+    // WebKit thread
+    LayerWebKitThread* layer() const { return m_layer; }
+    void layerWebKitThreadDestroyed();
+    void setNeedsDisplay(const FloatRect& dirtyRect);
+    void setNeedsDisplay();
+    void updateTextureContentsIfNeeded(double scale);
+    void disableTiling(bool);
+
+    // Compositing thread
+    void layerCompositingThreadDestroyed();
+    void uploadTexturesIfNeeded();
+    void drawTextures(LayerCompositingThread*, int positionLocation, int texCoordLocation);
+    bool hasMissingTextures() const { return m_hasMissingTextures; }
+    void drawMissingTextures(LayerCompositingThread*, int positionLocation, int texCoordLocation);
+    void deleteTextures();
+    void commitPendingTextureUploads();
+    void layerVisibilityChanged(bool visible);
+    bool hasDirtyTiles() const;
+    void bindContentsTexture();
+
+    // Thread safe
+    void addRenderJob(const TileIndex&);
+    void removeRenderJob(const TileIndex&);
+
+private:
+    struct TextureJob {
+        enum Type { Unknown, SetContents, SetContentsToColor, UpdateContents, DiscardContents, ResizeContents, DirtyContents };
+
+        TextureJob()
+            : m_type(Unknown)
+        {
+        }
+
+        TextureJob(Type type, const IntSize& newSize)
+            : m_type(type)
+            , m_isOpaque(false)
+            , m_dirtyRect(IntPoint::zero(), newSize)
+        {
+            ASSERT(type == ResizeContents);
+        }
+
+        TextureJob(Type type, const IntRect& dirtyRect)
+            : m_type(type)
+            , m_isOpaque(false)
+            , m_dirtyRect(dirtyRect)
+        {
+            ASSERT(type == DiscardContents || type == DirtyContents);
+        }
+
+        TextureJob(Type type, const SkBitmap& contents, const IntRect& dirtyRect, bool isOpaque = false)
+            : m_type(type)
+            , m_contents(contents)
+            , m_isOpaque(isOpaque)
+            , m_dirtyRect(dirtyRect)
+        {
+            ASSERT(type == UpdateContents || type == SetContents);
+            ASSERT(!contents.isNull());
+        }
+
+        TextureJob(Type type, const Color& color, const TileIndex& index)
+            : m_type(type)
+            , m_isOpaque(false)
+            , m_color(color)
+            , m_index(index)
+        {
+            ASSERT(type == SetContentsToColor);
+        }
+
+        static TextureJob setContents(const SkBitmap& contents, bool isOpaque) { return TextureJob(SetContents, contents, IntRect(IntPoint::zero(), IntSize(contents.width(), contents.height())), isOpaque); }
+        static TextureJob setContentsToColor(const Color& color, const TileIndex& index) { return TextureJob(SetContentsToColor, color, index); }
+        static TextureJob updateContents(const SkBitmap& contents, const IntRect& dirtyRect) { return TextureJob(UpdateContents, contents, dirtyRect); }
+        static TextureJob discardContents(const IntRect& dirtyRect) { return TextureJob(DiscardContents, dirtyRect); }
+        static TextureJob resizeContents(const IntSize& newSize) { return TextureJob(ResizeContents, newSize); }
+        static TextureJob dirtyContents(const IntRect& dirtyRect) { return TextureJob(DirtyContents, dirtyRect); }
+
+        bool isNull() { return m_type == Unknown; }
+
+        Type m_type;
+        SkBitmap m_contents;
+        bool m_isOpaque;
+        IntRect m_dirtyRect;
+        Color m_color;
+        TileIndex m_index;
+    };
+
+    typedef HashMap<TileIndex, LayerTile*> TileMap;
+    typedef HashMap<TileIndex, LayerTileData> VisibilityMap;
+    typedef HashMap<TileIndex, const TextureJob*> TileJobsMap;
+
+    IntSize tileSize() const { return m_tileSize; }
+    void updateTileSize();
+
+    LayerTiler(LayerWebKitThread*);
+
+    // WebKit thread
+    void addTextureJob(const TextureJob&);
+    void clearTextureJobs();
+    bool shouldPerformRenderJob(const TileIndex&, bool allowPrefill);
+    bool shouldPrefillTile(const TileIndex&);
+
+    // Compositing thread
+    void updateTileContents(const TextureJob&, const IntRect&);
+    void addTileJob(const TileIndex&, const TextureJob&, TileJobsMap&);
+    void performTileJob(LayerTile*, const TextureJob&, const IntRect&);
+    void processTextureJob(const TextureJob&, TileJobsMap&);
+    void drawTexturesInternal(LayerCompositingThread*, int positionLocation, int texCoordLocation, bool missing);
+    void pruneTextures();
+    void visibilityChanged(bool needsDisplay);
+
+    // Clear all pending update content texture jobs
+    template<typename T>
+    static void removeUpdateContentsJobs(T& jobs)
+    {
+        // Clear all pending update content jobs
+        T list;
+        for (typename T::iterator it = jobs.begin(); it != jobs.end(); ++it) {
+            if ((*it).m_type != TextureJob::UpdateContents)
+                list.append(*it);
+        }
+        jobs = list;
+    }
+
+    LayerWebKitThread* m_layer;
+
+    TileMap m_tilesCompositingThread;
+
+    VisibilityMap m_tilesWebKitThread;
+
+    bool m_tilingDisabled;
+
+    bool m_contentsDirty;
+    FloatRect m_dirtyRect;
+
+    IntSize m_pendingTextureSize; // Resized, but not committed yet.
+    IntSize m_requiredTextureSize;
+    IntSize m_tileSize;
+
+    bool m_clearTextureJobs;
+    Vector<TextureJob> m_pendingTextureJobs; // Added, but not committed yet.
+    Deque<TextureJob> m_textureJobs;
+    bool m_hasMissingTextures;
+
+    HashSet<TileIndex> m_renderJobs;
+    Mutex m_renderJobsMutex;
+    double m_contentsScale;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // LayerTiler_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp
new file mode 100644
index 000000000..6cadf359d
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp
@@ -0,0 +1,457 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerWebKitThread.h"
+
+#include "GraphicsContext.h"
+#include "InstrumentedPlatformCanvas.h"
+#include "LayerCompositingThread.h"
+#include "LayerMessage.h"
+#include "PlatformContextSkia.h"
+#include "RenderLayerBacking.h"
+#include "TransformationMatrix.h"
+
+#include <BlackBerryPlatformGraphics.h>
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+using namespace std;
+
+PassRefPtr<LayerWebKitThread> LayerWebKitThread::create(LayerType type, GraphicsLayerBlackBerry* owner)
+{
+    return adoptRef(new LayerWebKitThread(type, owner));
+}
+
+LayerWebKitThread::LayerWebKitThread(LayerType type, GraphicsLayerBlackBerry* owner)
+    : LayerData(type)
+    , m_owner(owner)
+    , m_superlayer(0)
+    , m_contents(0)
+    , m_scale(1.0)
+    , m_isDrawable(false)
+    , m_isMask(false)
+{
+    m_tiler = LayerTiler::create(this);
+    m_layerCompositingThread = LayerCompositingThread::create(type, m_tiler);
+}
+
+LayerWebKitThread::~LayerWebKitThread()
+{
+    m_layerCompositingThread->clearAnimations();
+
+    if (m_frontBufferLock)
+        pthread_mutex_destroy(m_frontBufferLock);
+
+    m_tiler->layerWebKitThreadDestroyed();
+
+    // Our superlayer should be holding a reference to us so there should be no
+    // way for us to be destroyed while we still have a superlayer.
+    ASSERT(!superlayer());
+
+    // Remove the superlayer reference from all sublayers.
+    removeAllSublayers();
+}
+
+SkBitmap LayerWebKitThread::paintContents(const IntRect& contentsRect, double scale, bool* isSolidColor, Color* color)
+{
+    // Don't try to allocate image data bigger than this. This should be big
+    // enough to accomodate a huge iScroll use case.
+    // FIXME: This is a hack to work around a crash bug on maps.bing.com where
+    // a (visually empty) layer becomes too big.
+    static const int maximumBitmapSizeInBytes = 40 * 1024 * 1024;
+    static const int bytesPerPixel = 4;
+
+    if (isSolidColor)
+        *isSolidColor = false;
+
+    if (contentsRect.width() * contentsRect.height() * bytesPerPixel > maximumBitmapSizeInBytes)
+        return SkBitmap();
+
+    SkBitmap bitmap;
+
+    // Keep the canvas alive until we're done extracting its pixels
+    OwnPtr<InstrumentedPlatformCanvas> canvas;
+
+    if (drawsContent()) { // Layer contents must be drawn into a canvas.
+        IntRect untransformedContentsRect = contentsRect;
+
+        canvas = adoptPtr(new InstrumentedPlatformCanvas(contentsRect.width(), contentsRect.height(), false, 0));
+        PlatformContextSkia skiaContext(canvas.get());
+
+        GraphicsContext graphicsContext(&skiaContext);
+        graphicsContext.translate(-contentsRect.x(), -contentsRect.y());
+
+        if (scale != 1.0) {
+            TransformationMatrix matrix;
+            matrix.scale(1.0 / scale);
+            untransformedContentsRect = matrix.mapRect(contentsRect);
+
+            // We extract from the contentsRect but draw a slightly larger region than
+            // we were told to, in order to avoid pixels being rendered only partially.
+            const int atLeastOneDevicePixel = static_cast<int>(ceilf(1.0 / scale));
+            untransformedContentsRect.inflate(atLeastOneDevicePixel);
+
+            graphicsContext.scale(FloatSize(scale, scale));
+        }
+
+        // RenderLayerBacking doesn't always clip, so we need to do this by ourselves.
+        graphicsContext.clip(untransformedContentsRect);
+        m_owner->paintGraphicsLayerContents(graphicsContext, untransformedContentsRect);
+
+        bitmap = canvas->getDevice()->accessBitmap(false);
+        if (isSolidColor) {
+            *isSolidColor = canvas->isSolidColor();
+            if (color)
+                *color = canvas->solidColor();
+        }
+    }
+
+    ASSERT(!bitmap.isNull());
+
+    // FIXME: do we need to support more image configurations?
+    ASSERT(bitmap.config() == SkBitmap::kARGB_8888_Config);
+    if (bitmap.config() != SkBitmap::kARGB_8888_Config)
+        return SkBitmap();
+
+    return bitmap;
+}
+
+bool LayerWebKitThread::contentsVisible(const IntRect& contentsRect) const
+{
+    if (!m_owner)
+        return false;
+
+    return m_owner->contentsVisible(contentsRect);
+}
+
+void LayerWebKitThread::createFrontBufferLock()
+{
+    pthread_mutexattr_t mutexAttributes;
+    pthread_mutexattr_init(&mutexAttributes);
+    m_frontBufferLock = new pthread_mutex_t;
+    pthread_mutex_init(m_frontBufferLock, &mutexAttributes);
+}
+
+void LayerWebKitThread::updateTextureContentsIfNeeded()
+{
+    m_tiler->updateTextureContentsIfNeeded(m_isMask ? 1.0 : contentsScale());
+}
+
+void LayerWebKitThread::setContents(Image* contents)
+{
+    // Check if the image has changed.
+    if (m_contents == contents)
+        return;
+    m_contents = contents;
+    setNeedsTexture(m_isDrawable && (this->contents() || drawsContent() || pluginView()));
+
+    if (m_contents)
+        setNeedsDisplay();
+    else
+        setNeedsCommit();
+}
+
+void LayerWebKitThread::setDrawable(bool isDrawable)
+{
+    if (m_isDrawable == isDrawable)
+        return;
+
+    m_isDrawable = isDrawable;
+
+    setNeedsTexture(m_isDrawable && (drawsContent() || contents() || pluginView() || mediaPlayer() || canvas()));
+    setNeedsCommit();
+}
+
+void LayerWebKitThread::setNeedsCommit()
+{
+    // Call notifySyncRequired(), which in this implementation plumbs through to
+    // call scheduleRootLayerCommit() on the WebView, which will cause us to commit
+    // changes done on the WebKit thread for display on the Compositing thread.
+    if (m_owner)
+        m_owner->notifySyncRequired();
+}
+
+void LayerWebKitThread::notifyAnimationStarted(double time)
+{
+    if (m_owner)
+        m_owner->notifyAnimationStarted(time);
+}
+
+void LayerWebKitThread::commitOnWebKitThread(double scale)
+{
+    // Updating texture contents require the latest visibility info.
+    updateTextureContents(scale);
+
+    // Make sure all animations are started at the same time
+    // to avoid showing animations out-of-sync.
+    // Do this after updating texture contents, because that can be a slow
+    // operation.
+    startAnimations(currentTime());
+}
+
+void LayerWebKitThread::startAnimations(double time)
+{
+    for (size_t i = 0; i < m_runningAnimations.size(); ++i) {
+        if (!m_runningAnimations[i]->startTime()) {
+            m_runningAnimations[i]->setStartTime(time);
+            notifyAnimationStarted(time);
+        }
+    }
+
+    size_t listSize = m_sublayers.size();
+    for (size_t i = 0; i < listSize; i++)
+        m_sublayers[i]->startAnimations(time);
+}
+
+void LayerWebKitThread::updateTextureContents(double scale)
+{
+    if (m_scale != scale) {
+        m_scale = scale;
+
+        // Only web content can redraw at the new scale.
+        // Canvas, images, video etc can't.
+        if (drawsContent())
+            setNeedsDisplay();
+    }
+
+    updateTextureContentsIfNeeded();
+
+    if (includeVisibility()) {
+        // The RenderLayerBacking cast looks unsafe given that there are two classes
+        // derived from GraphicsLayerClient but this code is only reachable for
+        // things that produce RenderLayerBacking derivatives; i.e., plugins and media.
+        RenderLayer* renderLayer(static_cast<RenderLayerBacking*>(m_owner->client())->owningLayer());
+        bool isVisible(renderLayer->hasVisibleContent() || renderLayer->hasVisibleDescendant());
+        if (m_isVisible != isVisible) {
+            m_isVisible = isVisible;
+            setNeedsCommit();
+        }
+    }
+
+    size_t listSize = m_sublayers.size();
+    for (size_t i = 0; i < listSize; i++)
+        m_sublayers[i]->updateTextureContents(scale);
+
+    if (maskLayer())
+        maskLayer()->updateTextureContents(scale);
+
+    if (replicaLayer())
+        replicaLayer()->updateTextureContents(scale);
+}
+
+void LayerWebKitThread::commitOnCompositingThread()
+{
+    FloatPoint oldPosition = m_position;
+    m_position += m_absoluteOffset;
+    // Copy the base variables from this object into m_layerCompositingThread
+    replicate(m_layerCompositingThread.get());
+    m_position = oldPosition;
+    updateLayerHierarchy();
+    m_tiler->commitPendingTextureUploads();
+
+    size_t listSize = m_sublayers.size();
+    for (size_t i = 0; i < listSize; i++)
+        m_sublayers[i]->commitOnCompositingThread();
+
+    if (maskLayer()) {
+        maskLayer()->commitOnCompositingThread();
+        layerCompositingThread()->setMaskLayer(maskLayer()->layerCompositingThread());
+    } else
+        layerCompositingThread()->setMaskLayer(0);
+
+    if (replicaLayer()) {
+        replicaLayer()->commitOnCompositingThread();
+        layerCompositingThread()->setReplicaLayer(replicaLayer()->layerCompositingThread());
+    } else
+        layerCompositingThread()->setReplicaLayer(0);
+}
+
+void LayerWebKitThread::addSublayer(PassRefPtr<LayerWebKitThread> sublayer)
+{
+    insertSublayer(sublayer, numSublayers());
+}
+
+void LayerWebKitThread::insertSublayer(PassRefPtr<LayerWebKitThread> sublayer, size_t index)
+{
+    index = min(index, m_sublayers.size());
+    sublayer->removeFromSuperlayer();
+    sublayer->setSuperlayer(this);
+    m_sublayers.insert(index, sublayer);
+
+    setNeedsCommit();
+}
+
+void LayerWebKitThread::removeFromSuperlayer()
+{
+    if (m_superlayer)
+        m_superlayer->removeSublayer(this);
+}
+
+void LayerWebKitThread::removeSublayer(LayerWebKitThread* sublayer)
+{
+    int foundIndex = indexOfSublayer(sublayer);
+    if (foundIndex == -1)
+        return;
+
+    sublayer->setSuperlayer(0);
+    m_sublayers.remove(foundIndex);
+
+    setNeedsCommit();
+}
+
+void LayerWebKitThread::replaceSublayer(LayerWebKitThread* reference, PassRefPtr<LayerWebKitThread> newLayer)
+{
+    ASSERT_ARG(reference, reference);
+    ASSERT_ARG(reference, reference->superlayer() == this);
+
+    if (reference == newLayer)
+        return;
+
+    int referenceIndex = indexOfSublayer(reference);
+    if (referenceIndex == -1) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    reference->removeFromSuperlayer();
+
+    if (newLayer) {
+        newLayer->removeFromSuperlayer();
+        insertSublayer(newLayer, referenceIndex);
+    }
+}
+
+int LayerWebKitThread::indexOfSublayer(const LayerWebKitThread* reference)
+{
+    for (size_t i = 0; i < m_sublayers.size(); i++) {
+        if (m_sublayers[i] == reference)
+            return i;
+    }
+    return -1;
+}
+
+void LayerWebKitThread::setBounds(const IntSize& size)
+{
+    if (m_bounds == size)
+        return;
+
+    bool firstResize = !m_bounds.width() && !m_bounds.height() && size.width() && size.height();
+
+    m_bounds = size;
+
+    boundsChanged();
+
+    if (firstResize)
+        setNeedsDisplay();
+    else
+        setNeedsCommit();
+}
+
+void LayerWebKitThread::setFrame(const FloatRect& rect)
+{
+    if (rect == m_frame)
+      return;
+
+    m_frame = rect;
+    setNeedsDisplay();
+}
+
+const LayerWebKitThread* LayerWebKitThread::rootLayer() const
+{
+    const LayerWebKitThread* layer = this;
+    LayerWebKitThread* superlayer = layer->superlayer();
+
+    while (superlayer) {
+        layer = superlayer;
+        superlayer = superlayer->superlayer();
+    }
+    return layer;
+}
+
+void LayerWebKitThread::removeAllSublayers()
+{
+    while (m_sublayers.size()) {
+        RefPtr<LayerWebKitThread> layer = m_sublayers[0].get();
+        ASSERT(layer->superlayer());
+        layer->removeFromSuperlayer();
+    }
+    setNeedsCommit();
+}
+
+void LayerWebKitThread::setSublayers(const Vector<RefPtr<LayerWebKitThread> >& sublayers)
+{
+    if (sublayers == m_sublayers)
+        return;
+
+    removeAllSublayers();
+    size_t listSize = sublayers.size();
+    for (size_t i = 0; i < listSize; i++)
+        addSublayer(sublayers[i]);
+}
+
+void LayerWebKitThread::setNeedsDisplayInRect(const FloatRect& dirtyRect)
+{
+    m_tiler->setNeedsDisplay(dirtyRect);
+    setNeedsCommit(); // FIXME: Replace this with a more targeted message for dirty rect handling with plugin content?
+}
+
+void LayerWebKitThread::setNeedsDisplay()
+{
+    m_tiler->setNeedsDisplay();
+    setNeedsCommit(); // FIXME: Replace this with a more targeted message for dirty rect handling with plugin content?
+}
+
+void LayerWebKitThread::updateLayerHierarchy()
+{
+    m_layerCompositingThread->setSuperlayer(superlayer() ? superlayer()->m_layerCompositingThread.get() : 0);
+
+    Vector<RefPtr<LayerCompositingThread> > sublayers;
+    size_t listSize = m_sublayers.size();
+    for (size_t i = 0; i < listSize; i++)
+        sublayers.append(m_sublayers[i]->m_layerCompositingThread.get());
+    m_layerCompositingThread->setSublayers(sublayers);
+}
+
+void LayerWebKitThread::setIsMask(bool isMask)
+{
+    m_isMask = isMask;
+    if (isMask)
+        m_tiler->disableTiling(true);
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.h b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.h
new file mode 100644
index 000000000..f4c7441cd
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.h
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef LayerWebKitThread_h
+#define LayerWebKitThread_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayerBlackBerry.h"
+#include "LayerData.h"
+#include "LayerTiler.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+class SkBitmap;
+
+namespace WebCore {
+
+class LayerCompositingThread;
+
+class LayerWebKitThread : public RefCounted<LayerWebKitThread>, public LayerData {
+public:
+    static PassRefPtr<LayerWebKitThread> create(LayerType, GraphicsLayerBlackBerry* owner = 0);
+
+    virtual ~LayerWebKitThread();
+
+    void addSublayer(PassRefPtr<LayerWebKitThread>);
+    void insertSublayer(PassRefPtr<LayerWebKitThread>, size_t index);
+    void replaceSublayer(LayerWebKitThread* reference, PassRefPtr<LayerWebKitThread> newLayer);
+    void removeFromSuperlayer();
+
+    void setAnchorPoint(const FloatPoint& anchorPoint) { m_anchorPoint = anchorPoint; setNeedsCommit(); }
+
+    void setAnchorPointZ(float anchorPointZ) { m_anchorPointZ = anchorPointZ; setNeedsCommit(); }
+
+    void setBackgroundColor(const Color& color) { m_backgroundColor = color; setNeedsCommit(); }
+
+    void setBorderColor(const Color& color) { m_borderColor = color; setNeedsCommit(); }
+
+    void setBorderWidth(float width) { m_borderWidth = width; setNeedsCommit(); }
+
+    void setBounds(const IntSize&);
+
+    void setDoubleSided(bool doubleSided) { m_doubleSided = doubleSided; setNeedsCommit(); }
+
+    void setFrame(const FloatRect&);
+
+    void setMasksToBounds(bool masksToBounds) { m_masksToBounds = masksToBounds; }
+
+    void setMaskLayer(LayerWebKitThread* maskLayer) { m_maskLayer = maskLayer; }
+    LayerWebKitThread* maskLayer() const { return m_maskLayer.get(); }
+    void setIsMask(bool);
+
+    void setReplicaLayer(LayerWebKitThread* layer) { m_replicaLayer = layer; }
+    LayerWebKitThread* replicaLayer() { return m_replicaLayer.get(); }
+
+    // FIXME: Move to a new subclass, ContentLayerWebKitThread. This is only used for layers that draw content
+    void setNeedsDisplayInRect(const FloatRect& dirtyRect);
+
+    virtual void setNeedsDisplay();
+
+    void setNeedsDisplayOnBoundsChange(bool needsDisplay) { m_needsDisplayOnBoundsChange = needsDisplay; }
+
+    void setOpacity(float opacity) { m_opacity = opacity; setNeedsCommit(); }
+
+    void setOpaque(bool opaque) { m_opaque = opaque; setNeedsCommit(); }
+
+    void setPosition(const FloatPoint& position) { m_position = position; setNeedsCommit(); }
+
+    const LayerWebKitThread* rootLayer() const;
+
+    void removeAllSublayers();
+
+    void setSublayers(const Vector<RefPtr<LayerWebKitThread> >&);
+
+    const Vector<RefPtr<LayerWebKitThread> >& getSublayers() const { return m_sublayers; }
+
+    void setSublayerTransform(const TransformationMatrix& transform) { m_sublayerTransform = transform; setNeedsCommit(); }
+
+    LayerWebKitThread* superlayer() const { return m_superlayer; }
+
+    void setTransform(const TransformationMatrix& transform) { m_transform = transform; setNeedsCommit(); }
+
+    void setPreserves3D(bool preserves3D) { m_preserves3D = preserves3D; setNeedsCommit(); }
+
+    void setFixedPosition(bool fixed) { m_isFixedPosition = fixed; setNeedsCommit(); }
+    void setHasFixedContainer(bool fixed) { m_hasFixedContainer = fixed; setNeedsCommit(); }
+    void setHasFixedAncestorInDOMTree(bool fixed) { m_hasFixedAncestorInDOMTree = fixed; setNeedsCommit(); }
+
+    void setContents(Image*);
+    Image* contents() const { return m_contents.get(); }
+
+    void setOwner(GraphicsLayerBlackBerry* owner) { m_owner = owner; }
+
+    bool drawsContent() const { return m_owner && m_owner->drawsContent(); }
+    void setDrawable(bool);
+
+    void commitOnWebKitThread(double scale);
+    void commitOnCompositingThread();
+    LayerCompositingThread* layerCompositingThread() const { return m_layerCompositingThread.get(); }
+
+    // Only used when this layer is the root layer of a frame.
+    void setAbsoluteOffset(const FloatSize& offset) { m_absoluteOffset = offset; }
+
+    double contentsScale() const { return m_scale; }
+
+    SkBitmap paintContents(const IntRect& transformedContentsRect, double scale, bool* isSolidColor = 0, Color* = 0);
+    bool contentsVisible(const IntRect& contentsRect) const;
+
+    void setNeedsCommit();
+    void notifyAnimationStarted(double time);
+
+    void setRunningAnimations(const Vector<RefPtr<LayerAnimation> >& animations) { m_runningAnimations = animations; setNeedsCommit(); }
+    void setSuspendedAnimations(const Vector<RefPtr<LayerAnimation> >& animations) { m_suspendedAnimations = animations; setNeedsCommit(); }
+
+protected:
+    LayerWebKitThread(LayerType, GraphicsLayerBlackBerry* owner);
+
+    void setNeedsTexture(bool needsTexture) { m_needsTexture = needsTexture; }
+    void setLayerProgramShader(LayerData::LayerProgramShader shader) { m_layerProgramShader = shader; }
+    void createFrontBufferLock();
+    bool isDrawable() const { return m_isDrawable; }
+
+    void startAnimations(double time);
+    void updateVisibility();
+    void updateTextureContents(double scale);
+
+    virtual void boundsChanged() { }
+    virtual void updateTextureContentsIfNeeded();
+
+private:
+    void updateLayerHierarchy();
+
+    void setSuperlayer(LayerWebKitThread* superlayer) { m_superlayer = superlayer; }
+
+    size_t numSublayers() const
+    {
+        return m_sublayers.size();
+    }
+
+    // Returns the index of the sublayer or -1 if not found.
+    int indexOfSublayer(const LayerWebKitThread*);
+
+    // This should only be called from removeFromSuperlayer.
+    void removeSublayer(LayerWebKitThread*);
+
+    GraphicsLayerBlackBerry* m_owner;
+
+    Vector<RefPtr<LayerWebKitThread> > m_sublayers;
+    LayerWebKitThread* m_superlayer;
+    RefPtr<LayerWebKitThread> m_maskLayer;
+    RefPtr<LayerWebKitThread> m_replicaLayer;
+
+    RefPtr<Image> m_contents;
+
+    RefPtr<LayerCompositingThread> m_layerCompositingThread;
+    RefPtr<LayerTiler> m_tiler;
+    FloatSize m_absoluteOffset;
+    double m_scale; // Scale applies only to content layers
+    bool m_isDrawable;
+    bool m_isMask;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
new file mode 100644
index 000000000..1d8bd3af5
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
@@ -0,0 +1,803 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if ENABLE(VIDEO)
+#include "MediaPlayerPrivateBlackBerry.h"
+
+#include "CookieManager.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#include "HostWindow.h"
+#include "NotImplemented.h"
+#include "PlatformContextSkia.h"
+#include "RenderBox.h"
+#include "TimeRanges.h"
+#include "WebPageClient.h"
+
+#include <BlackBerryPlatformClient.h>
+#include <set>
+#include <string>
+#include <wtf/text/CString.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "NativeImageSkia.h"
+#include "VideoLayerWebKitThread.h"
+#include <GLES2/gl2.h>
+#endif
+
+using namespace std;
+using namespace BlackBerry::Platform;
+
+namespace WebCore {
+
+// Static callback functions for factory
+PassOwnPtr<MediaPlayerPrivateInterface> MediaPlayerPrivate::create(MediaPlayer* player)
+{
+    return adoptPtr(new MediaPlayerPrivate(player));
+}
+
+void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
+{
+    registrar(create, getSupportedTypes, supportsType, 0, 0, 0);
+}
+
+void MediaPlayerPrivate::getSupportedTypes(HashSet<String>& types)
+{
+    set<string> supported = MMRPlayer::allSupportedMimeTypes();
+    set<string>::iterator i = supported.begin();
+    for (; i != supported.end(); i++)
+        types.add(i->c_str());
+}
+
+MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
+{
+    if (type.isNull() || type.isEmpty()) {
+        LOG(Media, "MediaPlayer does not support type; type is null or empty.");
+        return MediaPlayer::IsNotSupported;
+    }
+
+    // spec says we should not return "probably" if the codecs string is empty
+    if (MMRPlayer::mimeTypeSupported(type.ascii().data())) {
+        LOG(Media, "MediaPlayer supports type; cache contains type '%s'.", type.ascii().data());
+        return codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported;
+    }
+    LOG(Media, "MediaPlayer does not support type; cache doesn't contain type '%s'.", type.ascii().data());
+    return MediaPlayer::IsNotSupported;
+}
+
+void MediaPlayerPrivate::notifyAppActivatedEvent(bool activated)
+{
+    MMRPlayer::notifyAppActivatedEvent(activated);
+}
+
+void MediaPlayerPrivate::setCertificatePath(const String& caPath)
+{
+    MMRPlayer::setCertificatePath(string(caPath.utf8().data()));
+}
+
+MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
+    : m_webCorePlayer(player)
+#if USE(ACCELERATED_COMPOSITING)
+    , m_platformPlayer(new MMRPlayer(this, true))
+#else
+    , m_platformPlayer(new MMRPlayer(this, false))
+#endif
+    , m_networkState(MediaPlayer::Empty)
+    , m_readyState(MediaPlayer::HaveNothing)
+    , m_fullscreenWebPageClient(0)
+#if USE(ACCELERATED_COMPOSITING)
+    , m_bufferingTimer(this, &MediaPlayerPrivate::bufferingTimerFired)
+    , m_showBufferingImage(false)
+    , m_mediaIsBuffering(false)
+#endif
+    , m_userDrivenSeekTimer(this, &MediaPlayerPrivate::userDrivenSeekTimerFired)
+    , m_lastSeekTime(0)
+{
+}
+
+MediaPlayerPrivate::~MediaPlayerPrivate()
+{
+    if (isFullscreen()) {
+        HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+        element->exitFullscreen();
+    }
+#if USE(ACCELERATED_COMPOSITING)
+    // Remove media player from platform layer.
+    if (m_platformLayer)
+        static_cast<VideoLayerWebKitThread*>(m_platformLayer.get())->setMediaPlayer(0);
+#endif
+
+    delete m_platformPlayer;
+}
+
+void MediaPlayerPrivate::load(const String& url)
+{
+    String modifiedUrl(url);
+
+    if (modifiedUrl.startsWith("local://")) {
+        KURL kurl = KURL(KURL(), modifiedUrl);
+        kurl.setProtocol("file");
+        String tempPath(BlackBerry::Platform::Client::get()->getApplicationLocalDirectory().c_str());
+        tempPath.append(kurl.path());
+        kurl.setPath(tempPath);
+        modifiedUrl = kurl.string();
+    }
+    if (modifiedUrl.startsWith("file://")) {
+        // The QNX Multimedia Framework cannot handle filenames containing URL escape sequences.
+        modifiedUrl = decodeURLEscapeSequences(modifiedUrl);
+    }
+
+    String cookiePairs;
+    if (!url.isEmpty())
+        cookiePairs = cookieManager().getCookie(KURL(ParsedURLString, url.utf8().data()), WithHttpOnlyCookies);
+    if (!cookiePairs.isEmpty() && cookiePairs.utf8().data())
+        m_platformPlayer->load(modifiedUrl.utf8().data(), userAgent(modifiedUrl).utf8().data(), cookiePairs.utf8().data());
+    else
+        m_platformPlayer->load(modifiedUrl.utf8().data(), userAgent(modifiedUrl).utf8().data(), 0);
+}
+
+void MediaPlayerPrivate::cancelLoad()
+{
+    m_platformPlayer->cancelLoad();
+}
+
+void MediaPlayerPrivate::prepareToPlay()
+{
+    m_platformPlayer->prepareToPlay();
+}
+
+void MediaPlayerPrivate::play()
+{
+    m_platformPlayer->play();
+}
+
+void MediaPlayerPrivate::pause()
+{
+    m_platformPlayer->pause();
+}
+
+bool MediaPlayerPrivate::supportsFullscreen() const
+{
+    return true;
+}
+
+IntSize MediaPlayerPrivate::naturalSize() const
+{
+    // Cannot return empty size, otherwise paint() will never get called.
+    // Also, the values here will affect the aspect ratio of the output rectangle that will
+    // be used for renderering the video, so we must take PAR into account.
+    // Now, hope that metadata has been provided before this gets called if this is a video.
+    double pixelWidth = static_cast<double>(m_platformPlayer->pixelWidth());
+    double pixelHeight = static_cast<double>(m_platformPlayer->pixelHeight());
+    if (!m_platformPlayer->pixelWidth() || !m_platformPlayer->pixelHeight())
+        pixelWidth = pixelHeight = 1.0;
+
+    // Use floating point arithmetic to eliminate the chance of integer
+    // overflow. PAR numbers can be 5 digits or more.
+    double adjustedSourceWidth = static_cast<double>(m_platformPlayer->sourceWidth()) * pixelWidth / pixelHeight;
+    return IntSize(static_cast<int>(adjustedSourceWidth + 0.5), m_platformPlayer->sourceHeight());
+}
+
+bool MediaPlayerPrivate::hasVideo() const
+{
+    return m_platformPlayer->hasVideo();
+}
+
+bool MediaPlayerPrivate::hasAudio() const
+{
+    return m_platformPlayer->hasAudio();
+}
+
+void MediaPlayerPrivate::setVisible(bool)
+{
+    notImplemented();
+}
+
+float MediaPlayerPrivate::duration() const
+{
+    return m_platformPlayer->duration();
+}
+
+float MediaPlayerPrivate::currentTime() const
+{
+    return m_userDrivenSeekTimer.isActive() ? m_lastSeekTime: m_platformPlayer->currentTime();
+}
+
+static const double SeekSubmissionDelay = 0.1; // Reasonable throttling value.
+
+void MediaPlayerPrivate::seek(float time)
+{
+    m_lastSeekTime = time;
+    if (!m_userDrivenSeekTimer.isActive())
+        m_userDrivenSeekTimer.startOneShot(SeekSubmissionDelay);
+}
+
+void MediaPlayerPrivate::userDrivenSeekTimerFired(Timer<MediaPlayerPrivate>*)
+{
+    m_platformPlayer->seek(m_lastSeekTime);
+}
+
+bool MediaPlayerPrivate::seeking() const
+{
+    return false;
+}
+
+void MediaPlayerPrivate::setRate(float rate)
+{
+    m_platformPlayer->setRate(rate);
+}
+
+bool MediaPlayerPrivate::paused() const
+{
+    return m_platformPlayer->paused();
+}
+
+void MediaPlayerPrivate::setVolume(float volume)
+{
+    m_platformPlayer->setVolume(volume);
+}
+
+MediaPlayer::NetworkState MediaPlayerPrivate::networkState() const
+{
+    return m_networkState;
+}
+
+MediaPlayer::ReadyState MediaPlayerPrivate::readyState() const
+{
+    return m_readyState;
+}
+
+float MediaPlayerPrivate::maxTimeSeekable() const
+{
+    return m_platformPlayer->maxTimeSeekable();
+}
+
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
+{
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+    if (float bufferLoaded = m_platformPlayer->bufferLoaded())
+        timeRanges->add(0, bufferLoaded);
+    return timeRanges.release();
+}
+
+unsigned MediaPlayerPrivate::bytesLoaded() const
+{
+    notImplemented();
+    return 0;
+}
+
+void MediaPlayerPrivate::setSize(const IntSize&)
+{
+    notImplemented();
+}
+
+void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    // Only process paint calls coming via the accelerated compositing code
+    // path, where we get called with a null graphics context. See
+    // LayerCompositingThread::drawTextures(). Ignore calls from the regular
+    // rendering path.
+    if (!context)
+        m_platformPlayer->notifyOutputUpdate(BlackBerry::Platform::IntRect(rect.x(), rect.y(), rect.width(), rect.height()));
+    return;
+#endif
+
+    if (!hasVideo() || context->paintingDisabled() || !m_webCorePlayer->visible())
+        return;
+
+    PlatformGraphicsContext* graphics = context->platformContext();
+    ASSERT(graphics);
+
+    BlackBerry::Platform::IntRect platformRect(rect.x(), rect.y(), rect.width(), rect.height());
+    IntRect clippedRect = frameView()->windowClipRect();
+    BlackBerry::Platform::IntRect platformWindowClipRect(clippedRect.x(), clippedRect.y(), clippedRect.width(), clippedRect.height());
+    m_platformPlayer->paint(graphics->canvas(), platformRect, platformWindowClipRect);
+}
+
+bool MediaPlayerPrivate::hasAvailableVideoFrame() const
+{
+    return m_platformPlayer->hasAvailableVideoFrame();
+}
+
+bool MediaPlayerPrivate::hasSingleSecurityOrigin() const
+{
+    return false;
+}
+
+MediaPlayer::MovieLoadType MediaPlayerPrivate::movieLoadType() const
+{
+    return static_cast<MediaPlayer::MovieLoadType>(m_platformPlayer->movieLoadType());
+}
+
+// This function returns the user agent string associated with the
+// frame loader client of our HTMLMediaElement. The call below will
+// end up in FrameLoaderClientBlackBerry::userAgent().
+String MediaPlayerPrivate::userAgent(const String& url) const
+{
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+    Document* topdoc = element->document()->topDocument();
+    ASSERT(topdoc->frame());
+    ASSERT(topdoc->frame()->loader());
+    if (topdoc->frame())
+        return topdoc->frame()->loader()->userAgent(KURL(KURL(), url));
+    return String();
+}
+
+void MediaPlayerPrivate::resizeSourceDimensions()
+{
+    if (!m_webCorePlayer)
+        return;
+
+    HTMLMediaElement* client = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+
+    if (!client || !client->isVideo())
+        return;
+
+    RenderObject* o = client->renderer();
+    if (!o)
+        return;
+
+    // If we have an HTMLVideoElement but the source has no video, then we need to resize the media element.
+    if (!hasVideo()) {
+        IntRect rect = o->enclosingBox()->contentBoxRect();
+
+        static const int playbookMinAudioElementWidth = 300;
+        static const int playbookMinAudioElementHeight = 32;
+        // If the rect dimensions are less than the allowed minimum, use the minimum instead.
+        int newWidth = max(rect.width(), playbookMinAudioElementWidth);
+        int newHeight = max(rect.height(), playbookMinAudioElementHeight);
+
+        char attrString[12];
+
+        sprintf(attrString, "%d", newWidth);
+        client->setAttribute(HTMLNames::widthAttr, attrString);
+
+        sprintf(attrString, "%d", newHeight);
+        client->setAttribute(HTMLNames::heightAttr, attrString);
+    }
+
+    // If we don't know what the width and height of the video source is, then we need to set it to something sane.
+    if (m_platformPlayer->sourceWidth() && m_platformPlayer->sourceHeight())
+        return;
+    IntRect rect = o->enclosingBox()->contentBoxRect();
+    m_platformPlayer->setSourceDimension(rect.width(), rect.height());
+}
+
+void MediaPlayerPrivate::setFullscreenWebPageClient(BlackBerry::WebKit::WebPageClient* client)
+{
+    if (m_fullscreenWebPageClient == client)
+        return;
+
+    m_fullscreenWebPageClient = client;
+    m_platformPlayer->toggleFullscreen(client);
+
+    // The following repaint is needed especially if video is paused and
+    // fullscreen is exiting, so that a MediaPlayerPrivate::paint() is
+    // triggered and the code in outputUpdate() sets the correct window
+    // rectangle.
+    if (!client)
+        m_webCorePlayer->repaint();
+}
+
+BlackBerry::Platform::Graphics::Window* MediaPlayerPrivate::getWindow()
+{
+    return m_platformPlayer->getWindow();
+}
+
+BlackBerry::Platform::Graphics::Window* MediaPlayerPrivate::getPeerWindow(const char* uniqueID) const
+{
+    return m_platformPlayer->getPeerWindow(uniqueID);
+}
+
+int MediaPlayerPrivate::getWindowPosition(unsigned& x, unsigned& y, unsigned& width, unsigned& height) const
+{
+    return m_platformPlayer->getWindowPosition(x, y, width, height);
+}
+
+const char* MediaPlayerPrivate::mmrContextName()
+{
+    return m_platformPlayer->mmrContextName();
+}
+
+float MediaPlayerPrivate::percentLoaded()
+{
+    if (!m_platformPlayer->duration())
+        return 0;
+
+    float buffered = 0;
+    RefPtr<TimeRanges> timeRanges = this->buffered();
+    for (unsigned i = 0; i < timeRanges->length(); ++i) {
+        ExceptionCode ignoredException;
+        float start = timeRanges->start(i, ignoredException);
+        float end = timeRanges->end(i, ignoredException);
+        buffered += end - start;
+    }
+
+    float loaded = buffered / m_platformPlayer->duration();
+    return loaded;
+}
+
+unsigned MediaPlayerPrivate::sourceWidth()
+{
+    return m_platformPlayer->sourceWidth();
+}
+
+unsigned MediaPlayerPrivate::sourceHeight()
+{
+    return m_platformPlayer->sourceHeight();
+}
+
+void MediaPlayerPrivate::setAllowPPSVolumeUpdates(bool allow)
+{
+    return m_platformPlayer->setAllowPPSVolumeUpdates(allow);
+}
+
+void MediaPlayerPrivate::updateStates()
+{
+    MediaPlayer::NetworkState oldNetworkState = m_networkState;
+    MediaPlayer::ReadyState oldReadyState = m_readyState;
+
+    MMRPlayer::Error currentError = m_platformPlayer->error();
+
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+
+    if (currentError != MMRPlayer::MediaOK) {
+        m_readyState = MediaPlayer::HaveNothing;
+        if (currentError == MMRPlayer::MediaDecodeError)
+            m_networkState = MediaPlayer::DecodeError;
+        else if (currentError == MMRPlayer::MediaMetaDataError
+            || currentError == MMRPlayer::MediaAudioReceiveError
+            || currentError == MMRPlayer::MediaVideoReceiveError)
+            m_networkState = MediaPlayer::NetworkError;
+    } else {
+        switch (m_platformPlayer->mediaState()) {
+        case MMRPlayer::MMRPlayStateIdle:
+            m_networkState = MediaPlayer::Idle;
+            break;
+        case MMRPlayer::MMRPlayStatePlaying:
+            m_networkState = MediaPlayer::Loading;
+            break;
+        case MMRPlayer::MMRPlayStateStopped:
+            m_networkState = MediaPlayer::Idle;
+            break;
+        case MMRPlayer::MMRPlayStateUnknown:
+        default:
+            break;
+        }
+
+        switch (m_platformPlayer->state()) {
+        case MMRPlayer::MP_STATE_IDLE:
+#if USE(ACCELERATED_COMPOSITING)
+            setBuffering(false);
+            m_mediaIsBuffering = false;
+#endif
+            if (isFullscreen())
+                element->exitFullscreen();
+            break;
+        case MMRPlayer::MP_STATE_ACTIVE:
+#if USE(ACCELERATED_COMPOSITING)
+            m_showBufferingImage = false;
+            m_mediaIsBuffering = false;
+#endif
+            break;
+        case MMRPlayer::MP_STATE_UNSUPPORTED:
+            break;
+        default:
+            break;
+        }
+        if ((duration() || movieLoadType() == MediaPlayer::LiveStream)
+            && m_readyState != MediaPlayer::HaveEnoughData)
+            m_readyState = MediaPlayer::HaveEnoughData;
+    }
+
+    if (m_readyState != oldReadyState) {
+        m_webCorePlayer->readyStateChanged();
+#if USE(ACCELERATED_COMPOSITING)
+        // Create platform layer for video.
+        if (!m_platformLayer)
+            m_platformLayer = VideoLayerWebKitThread::create(m_webCorePlayer);
+#endif
+    }
+    if (m_networkState != oldNetworkState)
+        m_webCorePlayer->networkStateChanged();
+}
+
+// IMMRPlayerListener callbacks implementation
+void MediaPlayerPrivate::onStateChanged(MMRPlayer::MpState)
+{
+    updateStates();
+}
+
+void MediaPlayerPrivate::onMediaStatusChanged(MMRPlayer::MMRPlayState)
+{
+    updateStates();
+}
+
+void MediaPlayerPrivate::onError(MMRPlayer::Error type)
+{
+    updateStates();
+}
+
+void MediaPlayerPrivate::onDurationChanged(float duration)
+{
+    updateStates();
+    m_webCorePlayer->durationChanged();
+}
+
+void MediaPlayerPrivate::onTimeChanged(float)
+{
+    m_webCorePlayer->timeChanged();
+}
+
+void MediaPlayerPrivate::onPauseStateChanged()
+{
+    if (!isFullscreen())
+        return;
+
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+    // Paused state change not due to local controller.
+    if (m_platformPlayer->isPaused())
+        element->pause();
+    else {
+        // The HMI fullscreen widget has resumed play. Check if the
+        // pause timeout occurred.
+        m_platformPlayer->processPauseTimeoutIfNecessary();
+        element->play();
+    }
+}
+
+void MediaPlayerPrivate::onRateChanged(float)
+{
+    m_webCorePlayer->rateChanged();
+}
+
+void MediaPlayerPrivate::onVolumeChanged(float volume)
+{
+    m_webCorePlayer->volumeChanged(volume);
+}
+
+void MediaPlayerPrivate::onRepaint()
+{
+    m_webCorePlayer->repaint();
+}
+
+void MediaPlayerPrivate::onSizeChanged()
+{
+    resizeSourceDimensions();
+    if (hasVideo())
+        m_webCorePlayer->sizeChanged();
+}
+
+void MediaPlayerPrivate::onPlayNotified()
+{
+    if (HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient()))
+        element->play();
+}
+
+void MediaPlayerPrivate::onPauseNotified()
+{
+    if (HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient()))
+        element->pause();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void MediaPlayerPrivate::onBuffering(bool flag)
+{
+    setBuffering(flag);
+}
+#endif
+
+int MediaPlayerPrivate::showErrorDialog(MMRPlayer::Error type)
+{
+    using namespace BlackBerry::WebKit;
+
+    WebPageClient::AlertType atype;
+    switch (type) {
+    case MMRPlayer::MediaOK:
+        atype = WebPageClient::MediaOK;
+        break;
+    case MMRPlayer::MediaDecodeError:
+        atype = WebPageClient::MediaDecodeError;
+        break;
+    case MMRPlayer::MediaMetaDataError:
+        atype = WebPageClient::MediaMetaDataError;
+        break;
+    case MMRPlayer::MediaMetaDataTimeoutError:
+        atype = WebPageClient::MediaMetaDataTimeoutError;
+        break;
+    case MMRPlayer::MediaNoMetaDataError:
+        atype = WebPageClient::MediaNoMetaDataError;
+        break;
+    case MMRPlayer::MediaVideoReceiveError:
+        atype = WebPageClient::MediaVideoReceiveError;
+        break;
+    case MMRPlayer::MediaAudioReceiveError:
+        atype = WebPageClient::MediaAudioReceiveError;
+        break;
+    case MMRPlayer::MediaInvalidError:
+        atype = WebPageClient::MediaInvalidError;
+        break;
+    default:
+        LOG(Media, "Alert type does not exist.");
+        return -1;
+    }
+
+    int rc = 0;
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+    Document* topdoc = element->document()->topDocument();
+    if (topdoc->view() && topdoc->view()->hostWindow())
+        rc = topdoc->view()->hostWindow()->platformPageClient()->showAlertDialog(atype);
+    return rc;
+}
+
+FrameView* MediaPlayerPrivate::frameView() const
+{
+    // We previously used m_webCorePlayer->frameView(), but this method returns
+    // a null frameView until quite late in the media player initialization,
+    // and starting quite early in the media player destruction (because
+    // it may be set to zero by the destructor in RenderVideo.cpp before
+    // our destructor is called, leaving us unable to clean up child windows
+    // in mmrDisconnect).
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+    return element->document()->view();
+}
+
+BlackBerry::Platform::Graphics::Window* MediaPlayerPrivate::platformWindow()
+{
+    if (frameView() && frameView()->hostWindow())
+        return frameView()->hostWindow()->platformPageClient()->platformWindow();
+    return 0;
+}
+
+bool MediaPlayerPrivate::isFullscreen() const
+{
+    return m_fullscreenWebPageClient;
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+static const double BufferingAnimationDelay = 1.0 / 24;
+static char* s_bufferingImageData = 0;
+static int s_bufferingImageWidth = 0;
+static int s_bufferingImageHeight = 0;
+
+PlatformMedia MediaPlayerPrivate::platformMedia() const
+{
+    PlatformMedia pm;
+    pm.type = PlatformMedia::QNXMediaPlayerType;
+    pm.media.qnxMediaPlayer = const_cast<MediaPlayerPrivate*>(this);
+    return pm;
+}
+
+PlatformLayer* MediaPlayerPrivate::platformLayer() const
+{
+    if (m_platformLayer)
+        return m_platformLayer.get();
+    return 0;
+}
+
+static void loadBufferingImageData()
+{
+    static bool loaded = false;
+    if (!loaded) {
+        static Image* bufferingIcon = Image::loadPlatformResource("vidbuffer").leakRef();
+        NativeImageSkia* nativeImage = bufferingIcon->nativeImageForCurrentFrame();
+        if (!nativeImage)
+            return;
+
+        if (!nativeImage->isDataComplete())
+            return;
+
+        loaded = true;
+        nativeImage->lockPixels();
+
+        int bufSize = nativeImage->width() * nativeImage->height() * 4;
+        s_bufferingImageWidth = nativeImage->width();
+        s_bufferingImageHeight = nativeImage->height();
+        s_bufferingImageData = static_cast<char*>(malloc(bufSize));
+        memcpy(s_bufferingImageData, nativeImage->getPixels(), bufSize);
+
+        nativeImage->unlockPixels();
+        bufferingIcon->deref();
+    }
+}
+
+void MediaPlayerPrivate::bufferingTimerFired(Timer<MediaPlayerPrivate>*)
+{
+    if (m_showBufferingImage) {
+        if (!isFullscreen() && m_platformLayer)
+            m_platformLayer->setNeedsDisplay();
+        m_bufferingTimer.startOneShot(BufferingAnimationDelay);
+    }
+}
+
+void MediaPlayerPrivate::setBuffering(bool buffering)
+{
+    if (!hasVideo())
+        buffering = false; // Buffering animation not visible for audio.
+    if (buffering != m_showBufferingImage) {
+        m_showBufferingImage = buffering;
+        if (buffering) {
+            loadBufferingImageData();
+            m_bufferingTimer.startOneShot(BufferingAnimationDelay);
+        } else
+            m_bufferingTimer.stop();
+
+        if (m_platformLayer)
+            m_platformLayer->setNeedsDisplay();
+    }
+}
+
+static unsigned int allocateTextureId()
+{
+    unsigned int texid;
+    glGenTextures(1, &texid);
+    glBindTexture(GL_TEXTURE_2D, texid);
+    // Do basic linear filtering on resize.
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    // NPOT textures in GL ES only work when the wrap mode is set to GL_CLAMP_TO_EDGE.
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+    return texid;
+}
+
+void MediaPlayerPrivate::drawBufferingAnimation(const TransformationMatrix& matrix, int positionLocation, int texCoordLocation)
+{
+    if (m_showBufferingImage && s_bufferingImageData && !isFullscreen()) {
+        TransformationMatrix renderMatrix = matrix;
+
+        // Rotate the buffering indicator so that it takes 1 second to do 1 revolution.
+        timespec time;
+        clock_gettime(CLOCK_REALTIME, &time);
+        renderMatrix.rotate(time.tv_nsec / 1000000000.0 * 360.0);
+
+        static bool initialized = false;
+        static unsigned int texId = allocateTextureId();
+        glBindTexture(GL_TEXTURE_2D, texId);
+        if (!initialized) {
+            initialized = true;
+            glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, s_bufferingImageWidth, s_bufferingImageHeight,
+                0, GL_RGBA, GL_UNSIGNED_BYTE, s_bufferingImageData);
+            free(s_bufferingImageData);
+        }
+
+        float texcoords[] = { 0, 0,  0, 1,  1, 1,  1, 0 };
+        FloatPoint vertices[4];
+        float bx = s_bufferingImageWidth / 2.0;
+        float by = s_bufferingImageHeight / 2.0;
+        vertices[0] = renderMatrix.mapPoint(FloatPoint(-bx, -by));
+        vertices[1] = renderMatrix.mapPoint(FloatPoint(-bx, by));
+        vertices[2] = renderMatrix.mapPoint(FloatPoint(bx, by));
+        vertices[3] = renderMatrix.mapPoint(FloatPoint(bx, -by));
+
+        glVertexAttribPointer(positionLocation, 2, GL_FLOAT, GL_FALSE, 0, vertices);
+        glVertexAttribPointer(texCoordLocation, 2, GL_FLOAT, GL_FALSE, 0, texcoords);
+        glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+    }
+}
+#endif
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
new file mode 100644
index 000000000..5b7f43299
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef MediaPlayerPrivateBlackBerry_h
+#define MediaPlayerPrivateBlackBerry_h
+
+#if ENABLE(VIDEO)
+#include "MediaPlayerPrivate.h"
+
+#include <BlackBerryPlatformMMRPlayer.h>
+
+namespace BlackBerry {
+namespace WebKit {
+class WebPageClient;
+}
+}
+
+namespace WebCore {
+
+class MediaPlayerPrivate : public MediaPlayerPrivateInterface, public BlackBerry::Platform::IMMRPlayerListener {
+public:
+    virtual ~MediaPlayerPrivate();
+
+    static PassOwnPtr<MediaPlayerPrivateInterface> create(MediaPlayer*);
+    static void registerMediaEngine(MediaEngineRegistrar);
+    static void getSupportedTypes(HashSet<String>&);
+    static MediaPlayer::SupportsType supportsType(const String&, const String&);
+    static void notifyAppActivatedEvent(bool);
+    static void setCertificatePath(const String&);
+
+    virtual void load(const String& url);
+    virtual void cancelLoad();
+
+    virtual void prepareToPlay();
+#if USE(ACCELERATED_COMPOSITING)
+    virtual PlatformMedia platformMedia() const;
+    virtual PlatformLayer* platformLayer() const;
+    void drawBufferingAnimation(const TransformationMatrix&, int positionLocation, int texCoordLocation);
+#endif
+
+    virtual void play();
+    virtual void pause();
+
+    virtual bool supportsFullscreen() const;
+
+    virtual IntSize naturalSize() const;
+
+    virtual bool hasVideo() const;
+    virtual bool hasAudio() const;
+
+    virtual void setVisible(bool);
+
+    virtual float duration() const;
+
+    virtual float currentTime() const;
+    virtual void seek(float time);
+    virtual bool seeking() const;
+
+    virtual void setRate(float);
+
+    virtual bool paused() const;
+
+    virtual void setVolume(float);
+
+    virtual MediaPlayer::NetworkState networkState() const;
+    virtual MediaPlayer::ReadyState readyState() const;
+
+    virtual float maxTimeSeekable() const;
+    virtual PassRefPtr<TimeRanges> buffered() const;
+
+    virtual unsigned bytesLoaded() const;
+
+    virtual void setSize(const IntSize&);
+
+    virtual void paint(GraphicsContext*, const IntRect&);
+
+    virtual bool hasAvailableVideoFrame() const;
+
+#if USE(ACCELERATED_COMPOSITING)
+    // Whether accelerated rendering is supported by the media engine for the current media.
+    virtual bool supportsAcceleratedRendering() const { return true; }
+    // Called when the rendering system flips the into or out of accelerated rendering mode.
+    virtual void acceleratedRenderingStateChanged() { }
+#endif
+
+    virtual bool hasSingleSecurityOrigin() const;
+
+    virtual MediaPlayer::MovieLoadType movieLoadType() const;
+
+    void resizeSourceDimensions();
+    void setFullscreenWebPageClient(BlackBerry::WebKit::WebPageClient*);
+    BlackBerry::Platform::Graphics::Window* getWindow();
+    BlackBerry::Platform::Graphics::Window* getPeerWindow(const char*) const;
+    int getWindowPosition(unsigned& x, unsigned& y, unsigned& width, unsigned& height) const;
+    const char* mmrContextName();
+    float percentLoaded();
+    unsigned sourceWidth();
+    unsigned sourceHeight();
+    void setAllowPPSVolumeUpdates(bool);
+
+    // IMMRPlayerListener implementation.
+    virtual void onStateChanged(BlackBerry::Platform::MMRPlayer::MpState);
+    virtual void onMediaStatusChanged(BlackBerry::Platform::MMRPlayer::MMRPlayState);
+    virtual void onError(BlackBerry::Platform::MMRPlayer::Error);
+    virtual void onDurationChanged(float);
+    virtual void onTimeChanged(float);
+    virtual void onRateChanged(float);
+    virtual void onVolumeChanged(float);
+    virtual void onPauseStateChanged();
+    virtual void onRepaint();
+    virtual void onSizeChanged();
+    virtual void onPlayNotified();
+    virtual void onPauseNotified();
+#if USE(ACCELERATED_COMPOSITING)
+    virtual void onBuffering(bool);
+#endif
+
+    virtual bool isFullscreen() const;
+    virtual int showErrorDialog(BlackBerry::Platform::MMRPlayer::Error);
+    virtual BlackBerry::Platform::Graphics::Window* platformWindow();
+
+private:
+    MediaPlayerPrivate(MediaPlayer*);
+
+    FrameView* frameView() const;
+    void updateStates();
+    String userAgent(const String&) const;
+
+    MediaPlayer* m_webCorePlayer;
+    BlackBerry::Platform::MMRPlayer* m_platformPlayer;
+
+    mutable MediaPlayer::NetworkState m_networkState;
+    MediaPlayer::ReadyState m_readyState;
+
+    BlackBerry::WebKit::WebPageClient* m_fullscreenWebPageClient;
+#if USE(ACCELERATED_COMPOSITING)
+    void bufferingTimerFired(Timer<MediaPlayerPrivate>*);
+    void setBuffering(bool);
+
+    Timer<MediaPlayerPrivate> m_bufferingTimer;
+    RefPtr<PlatformLayer> m_platformLayer;
+    bool m_showBufferingImage;
+    bool m_mediaIsBuffering;
+#endif
+
+    void userDrivenSeekTimerFired(Timer<MediaPlayerPrivate>*);
+    Timer<MediaPlayerPrivate> m_userDrivenSeekTimer;
+    float m_lastSeekTime;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
+#endif // MediaPlayerPrivateBlackBerry_h
diff --git a/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.cpp
new file mode 100644
index 000000000..c22254cb7
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "PluginLayerWebKitThread.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerCompositingThread.h"
+#include "PluginView.h"
+
+namespace WebCore {
+
+PluginLayerWebKitThread::PluginLayerWebKitThread(PluginView* pluginView)
+    : LayerWebKitThread(Layer, 0)
+    , m_needsDisplay(false)
+{
+    setPluginView(pluginView);
+}
+
+PluginLayerWebKitThread::~PluginLayerWebKitThread()
+{
+}
+
+void PluginLayerWebKitThread::setPluginView(PluginView* pluginView)
+{
+    m_pluginView = pluginView;
+    setNeedsTexture(isDrawable() && pluginView);
+    setLayerProgramShader(LayerProgramShaderRGBA);
+
+    if (m_pluginView)
+        setNeedsDisplay();
+    else {
+        // We can't afford to wait until the next commit
+        // to set the m_pluginView to 0 in the impl, because it is
+        // about to be destroyed.
+        layerCompositingThread()->setPluginView(0);
+        setNeedsCommit();
+    }
+}
+
+void PluginLayerWebKitThread::setHolePunchRect(const IntRect& rect)
+{
+    m_holePunchRect = rect;
+    setNeedsCommit();
+}
+
+void PluginLayerWebKitThread::setNeedsDisplay()
+{
+    m_needsDisplay = true;
+    setNeedsCommit();
+}
+
+void PluginLayerWebKitThread::updateTextureContentsIfNeeded()
+{
+    if (!m_needsDisplay)
+        return;
+
+    m_needsDisplay = false;
+
+    if (!m_pluginView)
+        return;
+
+    m_pluginView->updateBuffer(IntRect(IntPoint::zero(), m_pluginView->size()));
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.h b/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.h
new file mode 100644
index 000000000..87b9c831f
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef PluginLayerWebKitThread_h
+#define PluginLayerWebKitThread_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerWebKitThread.h"
+
+namespace WebCore {
+
+class PluginView;
+
+class PluginLayerWebKitThread : public LayerWebKitThread {
+public:
+    static PassRefPtr<PluginLayerWebKitThread> create(PluginView* pluginView)
+    {
+        return adoptRef(new PluginLayerWebKitThread(pluginView));
+    }
+
+    virtual ~PluginLayerWebKitThread();
+
+    void setPluginView(PluginView*);
+    void setHolePunchRect(const IntRect&);
+
+    virtual void setNeedsDisplay();
+
+protected:
+    virtual void updateTextureContentsIfNeeded();
+
+private:
+    PluginLayerWebKitThread(PluginView*);
+    bool m_needsDisplay;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // PluginLayerWebKitThread_h
diff --git a/Source/WebCore/platform/graphics/blackberry/Texture.cpp b/Source/WebCore/platform/graphics/blackberry/Texture.cpp
new file mode 100644
index 000000000..1324d1536
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/Texture.cpp
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "Texture.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "Color.h"
+#include "IntRect.h"
+#include "TextureCacheCompositingThread.h"
+
+#include <GLES2/gl2.h>
+#include <SkBitmap.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/OwnArrayPtr.h>
+
+#define DEBUG_TEXTURE_UPLOADS 0
+
+namespace WebCore {
+
+static void copyImageData(unsigned char* dst, int dstStride, int dstX, int dstY,
+                    const unsigned char* src, int srcStride, int srcX, int srcY, int width, int height)
+{
+    dst += (dstY * dstStride) + (Texture::bytesPerPixel() * dstX);
+    src += (srcY * srcStride) + (Texture::bytesPerPixel() * srcX);
+    int length = Texture::bytesPerPixel() * width;
+
+    for (int y = 0; y < height; ++y) {
+        memcpy(dst, src, length);
+        dst += dstStride;
+        src += srcStride;
+    }
+}
+
+Texture::Texture(bool isColor)
+    : m_protectionCount(0)
+    , m_textureId(0)
+    , m_isColor(isColor)
+    , m_isOpaque(false)
+{
+    textureCacheCompositingThread()->install(this);
+}
+
+Texture::~Texture()
+{
+    textureCacheCompositingThread()->textureDestroyed(this);
+}
+
+void Texture::updateContents(const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tile, bool isOpaque)
+{
+    IntRect tileDirtyRect(dirtyRect);
+
+    tileDirtyRect.intersect(tile);
+    if (tileDirtyRect.isEmpty())
+        return;
+
+    m_isOpaque = isOpaque;
+
+    int stride = bytesPerPixel() * contents.width();
+    int x = tileDirtyRect.x() - dirtyRect.x();
+    int y = tileDirtyRect.y() - dirtyRect.y();
+    SkAutoLockPixels lock(contents);
+    unsigned char* pixels = static_cast<unsigned char*>(contents.getPixels());
+    pixels += (y * stride) + (bytesPerPixel() * x);
+    if (!pixels)
+        return;
+
+    bool subImage = tile.size() == m_size;
+    IntSize size = subImage ? tileDirtyRect.size() : tile.size();
+    IntSize contentsSize(IntSize(contents.width(), contents.height()));
+
+#if DEBUG_TEXTURE_UPLOADS
+    fprintf(stderr, "%s\n", subImage ? "SUBIMAGE" : "IMAGE");
+    fprintf(stderr, "  tile = (x=%d,y=%d,width=%d,height=%d), m_size = (%dx%d)\n", tile.x(), tile.y(), tile.width(), tile.height(), m_size.width(), m_size.height());
+    fprintf(stderr, "  tileDirtyRect = (x=%d,y=%d,width=%d,height=%d), contents.size() = (%dx%d)\n", tileDirtyRect.x(), tileDirtyRect.y(), tileDirtyRect.width(), tileDirtyRect.height(), contentsSize.width(), contentsSize.height());
+    IntSize sizeBeforeShunk = size;
+#endif
+
+    size = size.shrunkTo(contentsSize);
+
+#if DEBUG_TEXTURE_UPLOADS
+    if (size != sizeBeforeShunk)
+        fprintf(stderr, "  SHRUNK!!!!\n");
+#endif
+
+    if (!hasTexture()) {
+        // We may have been evicted by the TextureCacheCompositingThread,
+        // attempt to install us again.
+        if (!textureCacheCompositingThread()->install(this))
+            return;
+    }
+
+    glBindTexture(GL_TEXTURE_2D, m_textureId);
+
+    ASSERT(size.width() >= 0);
+    bool doesTileStrideEqualTextureStride = contents.width() == size.width();
+
+    OwnArrayPtr<unsigned char> tmp;
+    if (!doesTileStrideEqualTextureStride) {
+#if defined(GL_UNPACK_ROW_LENGTH)
+        glPixelStorei(GL_UNPACK_ROW_LENGTH, contents.width());
+#else
+        tmp = adoptArrayPtr(new unsigned char[size.width() * size.height() * bytesPerPixel()]);
+        copyImageData(tmp.get(), bytesPerPixel() * size.width(), 0, 0,
+                      pixels, stride, 0, 0,
+                      size.width(), size.height());
+        pixels = tmp.get();
+#endif
+    }
+
+    if (subImage) {
+#if DEBUG_TEXTURE_UPLOADS
+        fprintf(stderr, "glTexSubImage2D(%d, %d, %d, %d)\n", tileDirtyRect.x() - tile.x(), tileDirtyRect.y() - tile.y(),
+                        size.width(), size.height());
+        double t = currentTime();
+#endif
+        glTexSubImage2D(GL_TEXTURE_2D, 0,
+                        tileDirtyRect.x() - tile.x(), tileDirtyRect.y() - tile.y(),
+                        size.width(), size.height(),
+                        GL_RGBA, GL_UNSIGNED_BYTE, pixels);
+#if DEBUG_TEXTURE_UPLOADS
+        t = currentTime() - t;
+        fprintf(stderr, "    time = %f s (%d bytes)\n", t, size.width()*size.height()*4);
+#endif
+    } else {
+#if DEBUG_TEXTURE_UPLOADS
+        fprintf(stderr, "glTexImage2D(%d, %d)\n", size.width(), size.height());
+        double t = currentTime();
+#endif
+        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, size.width(), size.height(), 0, GL_RGBA, GL_UNSIGNED_BYTE, pixels);
+#if DEBUG_TEXTURE_UPLOADS
+        t = currentTime() - t;
+        fprintf(stderr, "    time = %f s (%d bytes)\n", t, size.width()*size.height()*4);
+#endif
+    }
+
+#if defined(GL_UNPACK_ROW_LENGTH)
+    if (!doesTileStrideEqualTextureStride)
+        glPixelStorei(GL_UNPACK_ROW_LENGTH, 0);
+#endif
+
+    IntSize oldSize = m_size;
+    m_size = tile.size();
+    if (m_size != oldSize)
+        textureCacheCompositingThread()->textureResized(this, oldSize);
+}
+
+void Texture::setContentsToColor(const Color& color)
+{
+    m_isOpaque = !color.hasAlpha();
+    RGBA32 rgba = color.rgb();
+    glBindTexture(GL_TEXTURE_2D, m_textureId);
+    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, 1, 1, 0, GL_RGBA, GL_UNSIGNED_BYTE, &rgba);
+
+    IntSize oldSize = m_size;
+    m_size = IntSize(1, 1);
+    if (m_size != oldSize)
+        textureCacheCompositingThread()->textureResized(this, oldSize);
+}
+
+bool Texture::protect(const IntSize& size)
+{
+    if (!hasTexture()) {
+        // We may have been evicted by the TextureCacheCompositingThread,
+        // attempt to install us again.
+        if (!textureCacheCompositingThread()->install(this))
+            return false;
+    }
+
+    ++m_protectionCount;
+
+    if (m_size == size)
+        return true;
+
+    IntSize oldSize = m_size;
+    m_size = size;
+    textureCacheCompositingThread()->textureResized(this, oldSize);
+
+    glBindTexture(GL_TEXTURE_2D, m_textureId);
+    glTexImage2D(GL_TEXTURE_2D, 0 , GL_RGBA, size.width(), size.height(), 0, GL_RGBA, GL_UNSIGNED_BYTE, 0);
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/Texture.h b/Source/WebCore/platform/graphics/blackberry/Texture.h
new file mode 100644
index 000000000..4e996d0d3
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/Texture.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef Texture_h
+#define Texture_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "IntSize.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+class SkBitmap;
+
+namespace WebCore {
+
+class Color;
+class IntRect;
+class TextureCacheCompositingThread;
+
+// Texture encapsulates a volatile texture - at any time, the underlying OpenGL
+// texture may be deleted by the TextureCacheCompositingThread. The user must
+// check using Texture::isDirty() immediately before using it, every time.
+// The only way to prevent eviction this is to call Texture::protect().
+// If the texture isDirty(), you must updateContents() before you can use it.
+class Texture : public RefCounted<Texture> {
+public:
+    static PassRefPtr<Texture> create(bool isColor = false)
+    {
+        return adoptRef(new Texture(isColor));
+    }
+
+    ~Texture();
+
+    unsigned textureId() const { return m_textureId; }
+
+    bool isDirty() const { return !m_textureId; }
+    bool hasTexture() const { return m_textureId; }
+
+    bool isColor() const { return m_isColor; }
+    bool isOpaque() const { return m_isOpaque; }
+
+    bool isProtected() const { return m_protectionCount > 0; }
+    void protect() { ++m_protectionCount; }
+    void unprotect() { --m_protectionCount; }
+    bool protect(const IntSize&);
+
+    void updateContents(const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tile, bool isOpaque = false);
+    void setContentsToColor(const Color&);
+
+    IntSize size() const { return m_size; }
+    int width() const { return m_size.width(); }
+    int height() const { return m_size.height(); }
+    static int bytesPerPixel() { return 4; }
+
+private:
+    friend class TextureCacheCompositingThread;
+
+    Texture(bool isColor = false);
+
+    void setTextureId(unsigned id)
+    {
+        m_textureId = id;
+
+        // We assume it is a newly allocated texture,
+        // and thus empty, or 0, which would of course
+        // be empty.
+        m_size = IntSize();
+    }
+
+    int m_protectionCount;
+    unsigned m_textureId;
+    IntSize m_size;
+    bool m_isColor;
+    bool m_isOpaque;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // Texture_h
diff --git a/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.cpp b/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.cpp
new file mode 100644
index 000000000..fe0c3da49
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.cpp
@@ -0,0 +1,301 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "TextureCacheCompositingThread.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "IntRect.h"
+
+#include <GLES2/gl2.h>
+#include <SkBitmap.h>
+
+#define DEBUG_TEXTURE_MEMORY_USAGE 0
+
+namespace WebCore {
+
+static const int defaultMemoryLimit = 64 * 1024 * 1024; // Measured in bytes.
+
+// Used to protect a newly created texture from being immediately evicted
+// before someone has a chance to protect it for legitimate reasons.
+class TextureProtector {
+public:
+    TextureProtector(Texture* texture)
+        : m_texture(texture)
+    {
+        m_texture->protect();
+    }
+
+    ~TextureProtector()
+    {
+        m_texture->unprotect();
+    }
+
+private:
+    Texture* m_texture;
+};
+
+TextureCacheCompositingThread::TextureCacheCompositingThread()
+    : m_memoryUsage(0)
+    , m_memoryLimit(defaultMemoryLimit)
+{
+}
+
+unsigned TextureCacheCompositingThread::allocateTextureId()
+{
+    unsigned texid;
+    glGenTextures(1, &texid);
+    glBindTexture(GL_TEXTURE_2D, texid);
+    if (!glIsTexture(texid))
+        return 0;
+
+    // Do basic linear filtering on resize.
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    // NPOT textures in GL ES only work when the wrap mode is set to GL_CLAMP_TO_EDGE.
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+    return texid;
+}
+
+void TextureCacheCompositingThread::freeTextureId(unsigned id)
+{
+    if (id)
+        glDeleteTextures(1, &id);
+}
+
+void TextureCacheCompositingThread::collectGarbage()
+{
+    int delta = 0;
+
+    for (Garbage::iterator it = m_garbage.begin(); it != m_garbage.end(); ++it) {
+        ZombieTexture& zombie = *it;
+        freeTextureId(zombie.id);
+        delta += zombie.size.width() * zombie.size.height() * Texture::bytesPerPixel();
+    }
+    m_garbage.clear();
+
+    if (delta)
+        decMemoryUsage(delta);
+}
+
+void TextureCacheCompositingThread::textureResized(Texture* texture, const IntSize& oldSize)
+{
+    int delta = (texture->width() * texture->height() - oldSize.width() * oldSize.height()) * Texture::bytesPerPixel();
+    incMemoryUsage(delta);
+    if (delta > 0)
+        prune();
+}
+
+void TextureCacheCompositingThread::textureDestroyed(Texture* texture)
+{
+    if (texture->isColor()) {
+        m_garbage.append(ZombieTexture(texture));
+        return;
+    }
+
+    evict(m_textures.find(texture));
+}
+
+bool TextureCacheCompositingThread::install(Texture* texture)
+{
+    if (!texture)
+        return true;
+
+    if (!texture->hasTexture()) {
+        unsigned textureId = allocateTextureId();
+        if (!textureId)
+            return false;
+
+        texture->setTextureId(textureId);
+    }
+
+    if (!texture->isColor()) {
+        if (!m_textures.contains(texture))
+            m_textures.add(texture);
+    }
+
+    return true;
+}
+
+void TextureCacheCompositingThread::evict(const TextureSet::iterator& it)
+{
+    if (it == m_textures.end())
+        return;
+
+    Texture* texture = *it;
+    if (texture->hasTexture())
+        m_garbage.append(ZombieTexture(texture));
+
+    texture->setTextureId(0);
+
+    m_textures.remove(it);
+}
+
+void TextureCacheCompositingThread::textureAccessed(Texture* texture)
+{
+    if (texture->isColor())
+        return;
+
+    TextureSet::iterator it = m_textures.find(texture);
+    if (it == m_textures.end())
+        return;
+
+    m_textures.remove(it);
+    m_textures.add(texture);
+}
+
+TextureCacheCompositingThread* textureCacheCompositingThread()
+{
+    static TextureCacheCompositingThread* staticCache = new TextureCacheCompositingThread;
+    return staticCache;
+}
+
+void TextureCacheCompositingThread::prune(size_t limit)
+{
+    while (m_memoryUsage > limit) {
+        bool found = false;
+        for (TextureSet::iterator it = m_textures.begin(); it != m_textures.end(); ++it) {
+            Texture* texture = *it;
+            if (texture->isProtected())
+                continue;
+            evict(it);
+            found = true;
+            break;
+        }
+        if (!found)
+            break;
+    }
+}
+
+void TextureCacheCompositingThread::clear()
+{
+    m_cache.clear();
+    m_colors.clear();
+    collectGarbage();
+}
+
+void TextureCacheCompositingThread::setMemoryUsage(size_t memoryUsage)
+{
+    m_memoryUsage = memoryUsage;
+#if DEBUG_TEXTURE_MEMORY_USAGE
+    fprintf(stderr, "Texture memory usage %u kB\n", m_memoryUsage / 1024);
+#endif
+}
+
+PassRefPtr<Texture> TextureCacheCompositingThread::textureForTiledContents(const SkBitmap& contents, const IntRect& tileRect, const TileIndex& index, bool isOpaque)
+{
+    HashMap<ContentsKey, TextureMap>::iterator it = m_cache.add(key(contents), TextureMap()).first;
+    TextureMap& map = (*it).second;
+
+    TextureMap::iterator jt = map.add(index, RefPtr<Texture>()).first;
+    RefPtr<Texture> texture = (*jt).second;
+    if (!texture) {
+        texture = createTexture();
+#if DEBUG_TEXTURE_MEMORY_USAGE
+        fprintf(stderr, "Creating texture 0x%x for 0x%x+%d @ (%d, %d)\n", texture.get(), contents.pixelRef(), contents.pixelRefOffset(), index.i(), index.j());
+#endif
+        map.set(index, texture);
+    }
+
+    // Protect newly created texture from being evicted.
+    TextureProtector protector(texture.get());
+
+    IntSize contentsSize(contents.width(), contents.height());
+    IntRect dirtyRect(IntPoint(), contentsSize);
+    if (tileRect.size() != texture->size()) {
+#if DEBUG_TEXTURE_MEMORY_USAGE
+        fprintf(stderr, "Updating texture 0x%x for 0x%x+%d @ (%d, %d)\n", texture.get(), contents.pixelRef(), contents.pixelRefOffset(), index.i(), index.j());
+#endif
+        texture->updateContents(contents, dirtyRect, tileRect, isOpaque);
+    }
+    return texture.release();
+}
+
+PassRefPtr<Texture> TextureCacheCompositingThread::textureForColor(const Color& color)
+{
+    // Just to make sure we don't get fooled by some malicious web page
+    // into caching millions of color textures.
+    if (m_colors.size() > 100)
+        m_colors.clear();
+
+    ColorTextureMap::iterator it = m_colors.find(color);
+    RefPtr<Texture> texture;
+    if (it == m_colors.end()) {
+        texture = Texture::create(true /* isColor */);
+#if DEBUG_TEXTURE_MEMORY_USAGE
+        fprintf(stderr, "Creating texture 0x%x for color 0x%x\n", texture.get(), color.rgb());
+#endif
+        m_colors.set(color, texture);
+    } else
+        texture = (*it).second;
+
+    // Color textures can't be evicted, so no need for TextureProtector.
+
+    if (texture->size() != IntSize(1, 1))
+        texture->setContentsToColor(color);
+
+    return texture.release();
+}
+
+PassRefPtr<Texture> TextureCacheCompositingThread::updateContents(const RefPtr<Texture>& textureIn, const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tileRect)
+{
+    RefPtr<Texture> texture(textureIn);
+
+    // If the texture was 0, or needs to transition from a solid color texture to a contents texture,
+    // create a new texture.
+    if (!texture || texture->isColor())
+        texture = createTexture();
+
+    // Protect newly created texture from being evicted.
+    TextureProtector protector(texture.get());
+
+    texture->updateContents(contents, dirtyRect, tileRect);
+
+    return texture.release();
+}
+
+TextureCacheCompositingThread::ContentsKey TextureCacheCompositingThread::key(const SkBitmap& contents)
+{
+    // The pixelRef is an address, and addresses can be reused by the allocator
+    // so it's unsuitable to use as a key. Instead, grab the generation, which
+    // is globally unique according to the current implementation in
+    // SkPixelRef.cpp.
+    uint32_t generation = contents.getGenerationID();
+
+    // If the generation is equal to the deleted value, use something else that
+    // is unlikely to correspond to a generation currently in use or soon to be
+    // in use.
+    uint32_t deletedValue = 0;
+    HashTraits<uint32_t>::constructDeletedValue(deletedValue);
+    if (generation == deletedValue) {
+        // This strategy works as long as the deleted value is -1.
+        ASSERT(deletedValue == static_cast<uint32_t>(-1));
+        generation = deletedValue / 2;
+    }
+
+    // Now the generation alone does not uniquely identify the texture contents.
+    // The same pixelref can be reused in another bitmap but with a different
+    // offset (somewhat contrived, but possible).
+    return std::make_pair(generation, contents.pixelRefOffset());
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.h b/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.h
new file mode 100644
index 000000000..82905b991
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.h
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef TextureCacheCompositingThread_h
+#define TextureCacheCompositingThread_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "Color.h"
+#include "LayerTileIndex.h"
+#include "Texture.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/ListHashSet.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class IntRect;
+
+// A LRU cache for OpenGL textures.
+class TextureCacheCompositingThread {
+    WTF_MAKE_NONCOPYABLE(TextureCacheCompositingThread);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    friend TextureCacheCompositingThread* textureCacheCompositingThread();
+
+    // Creates a new texture managed by this cache.
+    PassRefPtr<Texture> createTexture()
+    {
+        return Texture::create();
+    }
+
+    // Retrieve a texture from the cache.
+    PassRefPtr<Texture> textureForTiledContents(const SkBitmap& contents, const IntRect& tileRect, const TileIndex&, bool isOpaque);
+    PassRefPtr<Texture> textureForColor(const Color&);
+
+    // Update contents of an existing texture, or create a new one if texture is 0.
+    PassRefPtr<Texture> updateContents(const RefPtr<Texture>&, const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tileRect);
+
+    size_t memoryUsage() const { return m_memoryUsage; }
+    size_t memoryLimit() const { return m_memoryLimit; }
+    void setMemoryLimit(size_t limit) { m_memoryLimit = limit; }
+
+    // Evict unprotected textures until we reach the limit provided.
+    void prune(size_t limit);
+    void prune() { prune(memoryLimit()); }
+
+    // Evict all textures from the cache.
+    void clear();
+
+    // Update the LRU list.
+    void textureAccessed(Texture*);
+
+    // Deleting destroyed textures is provided as a separate method, because
+    // there might not be an OpenGL context current when the texture destructor
+    // was called. Calling this makes sure to free any such textures.
+    void collectGarbage();
+
+    void textureDestroyed(Texture*);
+    void textureResized(Texture*, const IntSize& oldSize);
+
+    // Undo the effects of eviction, if possible.
+    bool install(Texture*);
+
+private:
+    struct ZombieTexture {
+        explicit ZombieTexture(Texture* texture)
+            : id(texture->textureId())
+            , size(texture->size())
+        {
+        }
+
+        unsigned id;
+        IntSize size;
+    };
+    typedef ListHashSet<Texture* > TextureSet;
+    typedef std::pair<uint32_t, size_t> ContentsKey;
+    typedef HashMap<TileIndex, RefPtr<Texture> > TextureMap;
+    typedef Vector<ZombieTexture> Garbage;
+
+    TextureCacheCompositingThread();
+    ~TextureCacheCompositingThread();
+
+    unsigned allocateTextureId();
+    void freeTextureId(unsigned id);
+
+    void incMemoryUsage(int delta) { setMemoryUsage(memoryUsage() + delta); }
+    void decMemoryUsage(int delta) { setMemoryUsage(memoryUsage() - delta); }
+    void setMemoryUsage(size_t);
+
+    ContentsKey key(const SkBitmap& contents);
+
+    void evict(const TextureSet::iterator&);
+
+    // LRU set of weak pointers to textures.
+    TextureSet m_textures;
+    size_t m_memoryUsage;
+    size_t m_memoryLimit;
+
+    // Map of refCounted pointers to textures.
+    HashMap<ContentsKey, TextureMap> m_cache;
+    struct ColorHash {
+        static unsigned hash(const Color& key) { return WTF::intHash(key.rgb()); }
+        static bool equal(const Color& a, const Color& b) { return a == b; }
+        static const bool safeToCompareToEmptyOrDeleted = true;
+    };
+    struct ColorHashTraits : WTF::GenericHashTraits<Color> {
+        static const bool emptyValueIsZero = true;
+        // The deleted value is an invalid color with an RGB value of 0xFFFFFFFF.
+        // Such values do not naturally occur as colors.
+        // And empty value is an invalid color with an RGB value of 0x0.
+        static void constructDeletedValue(Color& slot) { new (&slot) Color(); *reinterpret_cast<RGBA32*>(&slot) = Color::white; }
+        static bool isDeletedValue(const Color& value) { return !value.isValid() && value.rgb() == Color::white; }
+    };
+    typedef HashMap<Color, RefPtr<Texture>, ColorHash, ColorHashTraits> ColorTextureMap;
+    ColorTextureMap m_colors;
+    Garbage m_garbage;
+};
+
+TextureCacheCompositingThread* textureCacheCompositingThread();
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // TextureCacheCompositingThread_h
diff --git a/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.cpp
new file mode 100644
index 000000000..7492871d2
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.cpp
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(VIDEO)
+#include "VideoLayerWebKitThread.h"
+
+#include "FrameView.h"
+#include "LayerCompositingThread.h"
+#include "MediaPlayer.h"
+
+#include <BlackBerryPlatformLog.h>
+
+#define DEBUG_VIDEO_CLIPPING 0
+
+namespace WebCore {
+
+VideoLayerWebKitThread::VideoLayerWebKitThread(MediaPlayer* mediaPlayer)
+    : LayerWebKitThread(Layer, 0)
+{
+    setMediaPlayer(mediaPlayer);
+}
+
+VideoLayerWebKitThread::~VideoLayerWebKitThread()
+{
+}
+
+void VideoLayerWebKitThread::setMediaPlayer(MediaPlayer* mediaPlayer)
+{
+    m_mediaPlayer = mediaPlayer;
+
+    // This is a bit of a misnomer, since we don't need an actual GL texture.
+    // However, the LayerRenderer will only process layers that "need textures"
+    setNeedsTexture(isDrawable() && (contents() || drawsContent() || this->mediaPlayer()));
+
+    if (!m_mediaPlayer) {
+        // We can't afford to wait until the next commit to set the m_mediaPlayer
+        // to 0 in the impl, because it is about to be destroyed.
+        layerCompositingThread()->setMediaPlayer(0);
+
+        // Clear hole punch rect.
+        setHolePunchRect(IntRect());
+    }
+
+    setNeedsCommit();
+}
+
+void VideoLayerWebKitThread::setHolePunchRect(const IntRect& rect)
+{
+    m_holePunchRect = rect;
+#if DEBUG_VIDEO_CLIPPING
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelInfo, "VideoLayerWebKitThread m_holePunchRect=(x=%d,y=%d,width=%d,height=%d).", m_holePunchRect.x(), m_holePunchRect.y(), m_holePunchRect.width(), m_holePunchRect.height());
+#endif
+    setNeedsCommit();
+}
+
+void VideoLayerWebKitThread::setNeedsDisplay()
+{
+    // We don't really need display per se, but some code may depend on
+    // setNeedsDisplay() to call setNeedsCommit()
+    setNeedsCommit();
+}
+
+void VideoLayerWebKitThread::boundsChanged()
+{
+    if (!mediaPlayer())
+        return;
+
+    // For video layers, the entire layer should be hole punched
+    // Hole punch rectangle size is equal to the size of this layer.
+    // Note that although we know the *size* of this layer, we won't know the position of this layer
+    // until the LayerCompositingThread::setDrawTransform method is called from the LayerRenderer.
+    setHolePunchRect(IntRect(IntPoint::zero(), m_bounds));
+
+    // Also set a clipping rectangle for this hole punch rectangle.
+    if (FrameView* frameView = mediaPlayer()->frameView())
+        m_holePunchClipRect = frameView->windowClipRect();
+    else
+        m_holePunchClipRect = holePunchRect();
+
+#if DEBUG_VIDEO_CLIPPING
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelInfo, "VideoLayerWebKitThread m_holePunchClipRect=(x=%d,y=%d,width=%d,height=%d).", m_holePunchClipRect.x(), m_holePunchClipRect.y(), m_holePunchClipRect.width(), m_holePunchClipRect.height());
+#endif
+}
+
+void VideoLayerWebKitThread::updateTextureContentsIfNeeded()
+{
+    // There are no texture contents, video is shown in a special screen window
+    // behind the web page.
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(VIDEO)
diff --git a/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.h b/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.h
new file mode 100644
index 000000000..e64732a9b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef VideoLayerWebKitThread_h
+#define VideoLayerWebKitThread_h
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(VIDEO)
+
+#include "LayerWebKitThread.h"
+
+namespace WebCore {
+
+class MediaPlayer;
+
+class VideoLayerWebKitThread : public LayerWebKitThread {
+public:
+    static PassRefPtr<VideoLayerWebKitThread> create(MediaPlayer* mediaPlayer)
+    {
+        return adoptRef(new VideoLayerWebKitThread(mediaPlayer));
+    }
+
+    virtual ~VideoLayerWebKitThread();
+
+    void setMediaPlayer(MediaPlayer*);
+
+    virtual void setNeedsDisplay();
+
+protected:
+    void setHolePunchRect(const IntRect&);
+
+    virtual void boundsChanged();
+    virtual void updateTextureContentsIfNeeded();
+
+private:
+    VideoLayerWebKitThread(MediaPlayer*);
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(VIDEO)
+
+#endif // VideoLayerWebKitThread_h
diff --git a/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.cpp
new file mode 100644
index 000000000..a26f5ffee
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "WebGLLayerWebKitThread.h"
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(WEBGL)
+
+#include "GraphicsContext3D.h"
+#include <pthread.h>
+
+namespace WebCore {
+
+WebGLLayerWebKitThread::WebGLLayerWebKitThread()
+    : LayerWebKitThread(WebGLLayer, 0)
+    , m_webGLContext(0)
+    , m_needsDisplay(false)
+{
+    setLayerProgramShader(LayerProgramShaderRGBA);
+}
+
+WebGLLayerWebKitThread::~WebGLLayerWebKitThread()
+{
+    if (m_frontBufferLock)
+        pthread_mutex_destroy(m_frontBufferLock);
+}
+
+void WebGLLayerWebKitThread::setNeedsDisplay()
+{
+    m_needsDisplay = true;
+    setNeedsCommit();
+}
+
+void WebGLLayerWebKitThread::updateTextureContentsIfNeeded()
+{
+    // FIXME: Does WebGLLayer always need display? Or can we just return immediately if (!m_needsDisplay)?
+    m_needsDisplay = false;
+
+    if (!m_frontBufferLock)
+        createFrontBufferLock();
+
+    // Lock copied GL texture so that the UI thread won't access it while we are drawing into it.
+    pthread_mutex_lock(m_frontBufferLock);
+    m_webGLContext->prepareTexture();
+    pthread_mutex_unlock(m_frontBufferLock);
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.h b/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.h
new file mode 100644
index 000000000..6bcb48658
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebGLLayerWebKitThread_h
+#define WebGLLayerWebKitThread_h
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(WEBGL)
+
+#include "LayerWebKitThread.h"
+
+namespace WebCore {
+
+class GraphicsContext3D;
+
+class WebGLLayerWebKitThread : public LayerWebKitThread {
+public:
+    static PassRefPtr<WebGLLayerWebKitThread> create()
+    {
+        return adoptRef(new WebGLLayerWebKitThread());
+    }
+
+    virtual ~WebGLLayerWebKitThread();
+
+    void setWebGLContext(GraphicsContext3D* context) { m_webGLContext = context; }
+
+    virtual void setNeedsDisplay();
+
+protected:
+    virtual void updateTextureContentsIfNeeded();
+
+private:
+    WebGLLayerWebKitThread();
+
+    GraphicsContext3D* m_webGLContext;
+    bool m_needsDisplay;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(WEBGL)
+
+#endif // WebGLLayerWebKitThread_h
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index f6e714b2a..47235367c 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -243,6 +243,18 @@ static bool animationHasStepsTimingFunction(const KeyframeValueList& valueList,
     return false;
 }
 
+#if ENABLE(CSS_FILTERS)
+static inline bool supportsAcceleratedFilterAnimations()
+{
+// <rdar://problem/10907251> - WebKit2 doesn't support CA animations of CI filters on Lion and below
+#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+    return true;
+#else
+    return false;
+#endif
+}
+#endif
+
 PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
 {
     return adoptPtr(new GraphicsLayerCA(client));
@@ -661,8 +673,10 @@ bool GraphicsLayerCA::addAnimation(const KeyframeValueList& valueList, const Int
     if (valueList.property() == AnimatedPropertyWebkitTransform)
         createdAnimations = createTransformAnimationsFromKeyframes(valueList, anim, animationName, timeOffset, boxSize);
 #if ENABLE(CSS_FILTERS)
-    else if (valueList.property() == AnimatedPropertyWebkitFilter)
-        createdAnimations = createFilterAnimationsFromKeyframes(valueList, anim, animationName, timeOffset);
+    else if (valueList.property() == AnimatedPropertyWebkitFilter) {
+        if (supportsAcceleratedFilterAnimations())
+            createdAnimations = createFilterAnimationsFromKeyframes(valueList, anim, animationName, timeOffset);
+    }
 #endif
     else
         createdAnimations = createAnimationFromKeyframes(valueList, anim, animationName, timeOffset);
@@ -859,9 +873,9 @@ void GraphicsLayerCA::syncCompositingStateForThisLayerOnly()
     commitLayerChangesAfterSublayers();
 }
 
-void GraphicsLayerCA::visibleRectChanged()
+void GraphicsLayerCA::visibleRectChanged(const IntRect& visibleRect)
 {
-    m_layer->visibleRectChanged();
+    m_layer->visibleRectChanged(visibleRect);
 }
 
 void GraphicsLayerCA::recursiveCommitChanges(const TransformState& state, float pageScaleFactor, const FloatPoint& positionRelativeToBase, bool affectedByPageScale)
@@ -1763,7 +1777,7 @@ void GraphicsLayerCA::updateContentsNeedsDisplay()
 
 bool GraphicsLayerCA::createAnimationFromKeyframes(const KeyframeValueList& valueList, const Animation* animation, const String& animationName, double timeOffset)
 {
-    ASSERT(valueList.property() != AnimatedPropertyWebkitTransform && valueList.property() != AnimatedPropertyWebkitFilter);
+    ASSERT(valueList.property() != AnimatedPropertyWebkitTransform && (!supportsAcceleratedFilterAnimations() || valueList.property() != AnimatedPropertyWebkitFilter));
     
     bool isKeyframe = valueList.size() > 2;
     bool valuesOK;
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
index 77dafc523..cce1ffd06 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
@@ -103,6 +103,7 @@ public:
 
     virtual void setNeedsDisplay();
     virtual void setNeedsDisplayInRect(const FloatRect&);
+    virtual bool needsDisplay() const OVERRIDE { return !m_dirtyRects.isEmpty(); }
     virtual void setContentsNeedsDisplay();
     
     virtual void setContentsRect(const IntRect&);
@@ -134,7 +135,7 @@ public:
     virtual void syncCompositingState(const FloatRect&);
     virtual void syncCompositingStateForThisLayerOnly();
 
-    virtual void visibleRectChanged() OVERRIDE;
+    virtual void visibleRectChanged(const IntRect&) OVERRIDE;
 
     bool allowTiledLayer() const { return m_allowTiledLayer; }
     virtual void setAllowTiledLayer(bool b);
diff --git a/Source/WebCore/platform/graphics/ca/PlatformCALayer.h b/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
index 582a0f74a..3aff7c261 100644
--- a/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
+++ b/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
@@ -203,7 +203,7 @@ public:
     float contentsScale() const;
     void setContentsScale(float);
 
-    void visibleRectChanged();
+    void visibleRectChanged(const IntRect&);
 
 #if PLATFORM(WIN)
     HashMap<String, RefPtr<PlatformCAAnimation> >& animations() { return m_animations; }
diff --git a/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm b/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
index c52f20dd9..e124a1647 100644
--- a/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
@@ -956,13 +956,13 @@ void PlatformCALayer::setContentsScale(float value)
 #endif
 }
 
-void PlatformCALayer::visibleRectChanged()
+void PlatformCALayer::visibleRectChanged(const IntRect& visibleRect)
 {
     if (m_layerType != LayerTypeTileCacheLayer)
         return;
 
     WebTileCacheLayer *tileCacheLayer = static_cast<WebTileCacheLayer *>(m_layer.get());
-    [tileCacheLayer visibleRectChanged];
+    [tileCacheLayer visibleRectChanged:visibleRect];
 }
 
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.h b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
index 675b85af6..714d3c90b 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.h
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
@@ -56,13 +56,14 @@ public:
     void setNeedsDisplay();
     void setNeedsDisplayInRect(const IntRect&);
     void drawLayer(WebTileLayer*, CGContextRef);
-    void setContentsScale(CGFloat);
+
+    void setScale(CGFloat);
 
     bool acceleratesDrawing() const { return m_acceleratesDrawing; }
     void setAcceleratesDrawing(bool);
 
     CALayer *tileContainerLayer() const { return m_tileContainerLayer.get(); }
-    void visibleRectChanged();
+    void visibleRectChanged(const IntRect&);
 
     float tileDebugBorderWidth() const { return m_tileDebugBorderWidth; }
     void setTileDebugBorderWidth(float);
@@ -75,7 +76,6 @@ private:
 
     TileCache(WebTileCacheLayer*, const IntSize& tileSize);
 
-    FloatRect visibleRect() const;
     IntRect bounds() const;
 
     IntRect rectForTileIndex(const TileIndex&) const;
@@ -93,12 +93,15 @@ private:
     WebTileCacheLayer* m_tileCacheLayer;
     RetainPtr<CALayer> m_tileContainerLayer;
     const IntSize m_tileSize;
+    IntRect m_visibleRect;
 
     typedef HashMap<TileIndex, RetainPtr<WebTileLayer> > TileMap;
     TileMap m_tiles;
     Timer<TileCache> m_tileRevalidationTimer;
     IntRect m_tileCoverageRect;
 
+    CGFloat m_scale;
+
     bool m_acceleratesDrawing;
 
     RetainPtr<CGColorRef> m_tileDebugBorderColor;
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
index a74ff7215..fbb5ddc71 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
@@ -54,6 +54,7 @@ TileCache::TileCache(WebTileCacheLayer* tileCacheLayer, const IntSize& tileSize)
     , m_tileContainerLayer(adoptCF([[CALayer alloc] init]))
     , m_tileSize(tileSize)
     , m_tileRevalidationTimer(this, &TileCache::tileRevalidationTimerFired)
+    , m_scale(1)
     , m_acceleratesDrawing(false)
     , m_tileDebugBorderWidth(0)
 {
@@ -90,10 +91,13 @@ void TileCache::setNeedsDisplayInRect(const IntRect& rect)
     if (m_tiles.isEmpty())
         return;
 
+    FloatRect scaledRect(rect);
+    scaledRect.scale(m_scale);
+
     // Find the tiles that need to be invalidated.
     TileIndex topLeft;
     TileIndex bottomRight;
-    getTileIndexRangeForRect(intersection(rect, m_tileCoverageRect), topLeft, bottomRight);
+    getTileIndexRangeForRect(intersection(enclosingIntRect(scaledRect), m_tileCoverageRect), topLeft, bottomRight);
 
     for (int y = topLeft.y(); y <= bottomRight.y(); ++y) {
         for (int x = topLeft.x(); x <= bottomRight.x(); ++x) {
@@ -126,6 +130,7 @@ void TileCache::drawLayer(WebTileLayer* layer, CGContextRef context)
 
     CGPoint layerOrigin = [layer frame].origin;
     CGContextTranslateCTM(context, -layerOrigin.x, -layerOrigin.y);
+    CGContextScaleCTM(context, m_scale, m_scale);
     drawLayerContents(context, layer, platformLayer);
 
     CGContextRestoreGState(context);
@@ -162,19 +167,22 @@ void TileCache::drawLayer(WebTileLayer* layer, CGContextRef context)
     CGContextRestoreGState(context);
 }
 
-void TileCache::setContentsScale(CGFloat contentsScale)
+void TileCache::setScale(CGFloat scale)
 {
+    if (m_scale == scale)
+        return;
+
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    for (TileMap::const_iterator it = m_tiles.begin(), end = m_tiles.end(); it != end; ++it) {
-        [it->second.get() setContentsScale:contentsScale];
+    m_scale = scale;
+    [m_tileContainerLayer.get() setTransform:CATransform3DMakeScale(1 / m_scale, 1 / m_scale, 1)];
+
+    revalidateTiles();
+
+    for (TileMap::const_iterator it = m_tiles.begin(), end = m_tiles.end(); it != end; ++it)
         [it->second.get() setNeedsDisplay];
-    }
 
     PlatformCALayer* platformLayer = PlatformCALayer::platformCALayer(m_tileCacheLayer);
     platformLayer->owner()->platformCALayerDidCreateTiles();
-    revalidateTiles();
-#else
-    UNUSED_PARAM(contentsScale);
 #endif
 }
 
@@ -193,9 +201,13 @@ void TileCache::setAcceleratesDrawing(bool acceleratesDrawing)
 #endif
 }
 
-void TileCache::visibleRectChanged()
+void TileCache::visibleRectChanged(const IntRect& visibleRect)
 {
-    scheduleTileRevalidation();
+    if (m_visibleRect == visibleRect)
+        return;
+
+    m_visibleRect = visibleRect;
+    revalidateTiles();
 }
 
 void TileCache::setTileDebugBorderWidth(float borderWidth)
@@ -218,28 +230,6 @@ void TileCache::setTileDebugBorderColor(CGColorRef borderColor)
         [it->second.get() setBorderColor:m_tileDebugBorderColor.get()];
 }
 
-FloatRect TileCache::visibleRect() const
-{
-    CGRect rect = [m_tileCacheLayer bounds];
-
-    CALayer *layer = m_tileCacheLayer;
-    CALayer *superlayer = [layer superlayer];
-
-    while (superlayer) {
-        CGRect rectInSuperlayerCoordinates = [superlayer convertRect:rect fromLayer:layer];
-
-        if ([superlayer masksToBounds])
-            rect = CGRectIntersection([superlayer bounds], rectInSuperlayerCoordinates);
-        else
-            rect = rectInSuperlayerCoordinates;
-
-        layer = superlayer;
-        superlayer = [layer superlayer];
-    }
-
-    return [m_tileCacheLayer convertRect:rect fromLayer:layer];
-}
-
 IntRect TileCache::bounds() const
 {
     return IntRect(IntPoint(), IntSize([m_tileCacheLayer bounds].size));
@@ -252,7 +242,9 @@ IntRect TileCache::rectForTileIndex(const TileIndex& tileIndex) const
 
 void TileCache::getTileIndexRangeForRect(const IntRect& rect, TileIndex& topLeft, TileIndex& bottomRight)
 {
-    IntRect clampedRect = intersection(rect, bounds());
+    IntRect clampedRect = bounds();
+    clampedRect.scale(m_scale);
+    clampedRect.intersect(rect);
 
     topLeft.setX(max(clampedRect.x() / m_tileSize.width(), 0));
     topLeft.setY(max(clampedRect.y() / m_tileSize.height(), 0));
@@ -275,10 +267,17 @@ void TileCache::tileRevalidationTimerFired(Timer<TileCache>*)
 
 void TileCache::revalidateTiles()
 {
-    IntRect tileCoverageRect = enclosingIntRect(visibleRect());
-    if (tileCoverageRect.isEmpty())
+    // If the underlying PlatformLayer has been destroyed, but the WebTileCacheLayer hasn't
+    // platformLayer will be null here.
+    PlatformCALayer* platformLayer = PlatformCALayer::platformCALayer(m_tileCacheLayer);
+    if (!platformLayer)
         return;
 
+    if (m_visibleRect.isEmpty() || bounds().isEmpty())
+        return;
+
+    IntRect tileCoverageRect = m_visibleRect;
+
     // Inflate the coverage rect so that it covers 2x of the visible width and 3x of the visible height.
     // These values were chosen because it's more common to have tall pages and to scroll vertically,
     // so we keep more tiles above and below the current area.
@@ -343,7 +342,6 @@ void TileCache::revalidateTiles()
     if (!didCreateNewTiles)
         return;
 
-    PlatformCALayer* platformLayer = PlatformCALayer::platformCALayer(m_tileCacheLayer);
     platformLayer->owner()->platformCALayerDidCreateTiles();
 }
 
@@ -363,7 +361,6 @@ RetainPtr<WebTileLayer> TileCache::createTileLayer()
     [layer.get() setEdgeAntialiasingMask:0];
 
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    [layer.get() setContentsScale:[m_tileCacheLayer contentsScale]];
     [layer.get() setAcceleratesDrawing:m_acceleratesDrawing];
 #endif
 
diff --git a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.h b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.h
index 5dc64983e..208884bf7 100644
--- a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.h
+++ b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.h
@@ -27,6 +27,7 @@
 #import <wtf/OwnPtr.h>
 
 namespace WebCore {
+    class IntRect;
     class TileCache;
 }
 
@@ -35,6 +36,6 @@ namespace WebCore {
 }
 
 - (CALayer *)tileContainerLayer;
-- (void)visibleRectChanged;
+- (void)visibleRectChanged:(const WebCore::IntRect&)visibleRect;
 
 @end
diff --git a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
index f992c270c..83abb72a8 100644
--- a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
@@ -58,6 +58,22 @@ using namespace WebCore;
     [super dealloc];
 }
 
+- (id)initWithLayer:(id)layer
+{
+    UNUSED_PARAM(layer);
+
+    ASSERT_NOT_REACHED();
+    return nil;
+}
+
+- (id<CAAction>)actionForKey:(NSString *)key
+{
+    UNUSED_PARAM(key);
+    
+    // Disable all animations.
+    return nil;
+}
+
 - (void)setBounds:(CGRect)bounds
 {
     [super setBounds:bounds];
@@ -87,16 +103,7 @@ using namespace WebCore;
 
 - (void)setContentsScale:(CGFloat)contentsScale
 {
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    CGFloat oldContentsScale = [self contentsScale];
-
-    [super setContentsScale:contentsScale];
-
-    if (contentsScale != oldContentsScale)
-        _tileCache->setContentsScale(contentsScale);
-#else
-    UNUSED_PARAM(contentsScale);
-#endif
+    _tileCache->setScale(contentsScale);
 }
 
 - (CALayer *)tileContainerLayer
@@ -104,9 +111,9 @@ using namespace WebCore;
     return _tileCache->tileContainerLayer();
 }
 
-- (void)visibleRectChanged
+- (void)visibleRectChanged:(const IntRect&)visibleRect
 {
-    _tileCache->visibleRectChanged();
+    _tileCache->visibleRectChanged(visibleRect);
 }
 
 - (CGColorRef)borderColor
diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
index 633d4e321..ca73001d5 100644
--- a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
@@ -633,7 +633,7 @@ void PlatformCALayer::setContentsScale(float)
 {
 }
 
-void PlatformCALayer::visibleRectChanged()
+void PlatformCALayer::visibleRectChanged(const IntRect&)
 {
 }
 
diff --git a/Source/WebCore/platform/graphics/cairo/GLContext.h b/Source/WebCore/platform/graphics/cairo/GLContext.h
new file mode 100644
index 000000000..0a39cec58
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cairo/GLContext.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free
+ *  Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301 USA
+ */
+
+#ifndef GLContext_h
+#define GLContext_h
+
+#include "GraphicsContext3D.h"
+#include "Widget.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+
+#if defined(XP_UNIX)
+typedef struct __GLXcontextRec* GLXContext;
+typedef struct _XDisplay Display;
+typedef struct __GLXcontextRec *GLXContext;
+typedef unsigned long GLXPbuffer;
+typedef unsigned long GLXPixmap;
+typedef unsigned char GLubyte;
+typedef unsigned long Pixmap;
+typedef unsigned long XID;
+typedef void* ContextKeyType;
+#endif
+
+namespace WebCore {
+
+class GLContext {
+    WTF_MAKE_NONCOPYABLE(GLContext);
+public:
+    static GLContext* createSharingContext(GLContext* shareContext);
+    static GLContext* getContextForWidget(PlatformWidget);
+    static GLContext* getCurrent();
+    static void removeActiveContext(GLContext*);
+    static void removeActiveContextForWidget(PlatformWidget);
+
+    virtual ~GLContext();
+    bool makeContextCurrent();
+    void swapBuffers();
+    bool canRenderToDefaultFramebuffer();
+
+#if ENABLE(WEBGL)
+    PlatformGraphicsContext3D platformContext();
+#endif
+
+private:
+    static void addActiveContext(GLContext*);
+    static void cleanupActiveContextsAtExit();
+
+#if defined(XP_UNIX)
+    GLContext(GLXContext);
+    GLContext(GLXContext, Pixmap, GLXPixmap);
+    static GLContext* createContext(XID, GLXContext sharingContext = 0);
+    static GLContext* createWindowContext(XID window, GLXContext sharingContext);
+    static GLContext* createPbufferContext(GLXContext sharingContext);
+    static GLContext* createPixmapContext(GLXContext sharingContext);
+
+    GLXContext m_context;
+    Display* m_display;
+
+    XID m_window;
+    GLXPbuffer m_pbuffer;
+    Pixmap m_pixmap;
+    GLXPixmap m_glxPixmap;
+#endif
+};
+
+}
+
+#endif // GLContext_h
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
index f542fb9ed..ad7db41d3 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
@@ -27,7 +27,6 @@
 
 #include "config.h"
 #include "GraphicsContext3D.h"
-#include "PlatformContextCairo.h"
 
 #if ENABLE(WEBGL)
 
@@ -35,9 +34,12 @@
 #include "GraphicsContext3DPrivate.h"
 #include "Image.h"
 #include "OpenGLShims.h"
+#include "PlatformContextCairo.h"
 #include "RefPtrCairo.h"
 #include "ShaderLang.h"
 #include <cairo.h>
+#include <wtf/NotFound.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
@@ -48,16 +50,20 @@ PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attri
     if (renderStyle == RenderDirectlyToHostWindow)
         return 0;
 
-    OwnPtr<GraphicsContext3DPrivate> priv = GraphicsContext3DPrivate::create();
-    if (!priv)
+    static bool initialized = false;
+    static bool success = true;
+    if (!initialized) {
+        success = initializeOpenGLShims();
+        initialized = true;
+    }
+    if (!success)
         return 0;
 
     RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attributes, hostWindow, false));
-    context->m_private = priv.release();
     return context.release();
 }
 
-GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, HostWindow*, bool)
+GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, bool)
     : m_currentWidth(0)
     , m_currentHeight(0)
     , m_attrs(attributes)
@@ -68,8 +74,9 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, H
     , m_multisampleFBO(0)
     , m_multisampleDepthStencilBuffer(0)
     , m_multisampleColorBuffer(0)
+    , m_private(GraphicsContext3DPrivate::create(this, hostWindow))
 {
-    GraphicsContext3DPrivate::addActiveGraphicsContext(this);
+    makeContextCurrent();
 
     validateAttributes();
 
@@ -123,10 +130,6 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, H
 
 GraphicsContext3D::~GraphicsContext3D()
 {
-    GraphicsContext3DPrivate::removeActiveGraphicsContext(this);
-    if (!m_private->m_context)
-        return;
-
     makeContextCurrent();
     ::glDeleteTextures(1, &m_texture);
     if (m_attrs.antialias) {
@@ -228,10 +231,9 @@ bool GraphicsContext3D::makeContextCurrent()
         return false;
     return m_private->makeContextCurrent();
 }
-
 PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D()
 {
-    return m_private->m_context;
+    return m_private->platformContext();
 }
 
 bool GraphicsContext3D::isGLES2Compliant() const
@@ -242,7 +244,7 @@ bool GraphicsContext3D::isGLES2Compliant() const
 #if USE(ACCELERATED_COMPOSITING)
 PlatformLayer* GraphicsContext3D::platformLayer() const
 {
-    return 0;
+    return m_private.get();
 }
 #endif
 
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp
new file mode 100644
index 000000000..69eef6efc
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2011, 2012 Igalia S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free
+ *  Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301 USA
+ */
+
+#include "config.h"
+#include "GraphicsContext3DPrivate.h"
+
+#if ENABLE(WEBGL)
+
+#include "HostWindow.h"
+#include "NotImplemented.h"
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER) && USE(TEXTURE_MAPPER_GL)
+#include <texmap/TextureMapperGL.h>
+#endif
+
+namespace WebCore {
+
+PassOwnPtr<GraphicsContext3DPrivate> GraphicsContext3DPrivate::create(GraphicsContext3D* context, HostWindow* window)
+{
+    return adoptPtr(new GraphicsContext3DPrivate(context, window));
+}
+
+GraphicsContext3DPrivate::GraphicsContext3DPrivate(GraphicsContext3D* context, HostWindow* window)
+    : m_context(context)
+    , m_window(window)
+#if PLATFORM(GTK)
+    , m_glContext(GLContext::createSharingContext(GLContext::getContextForWidget(m_window->platformPageClient())))
+#else
+    , m_glContext(GLContext::createContext(0, 0))
+#endif
+{
+}
+
+GraphicsContext3DPrivate::~GraphicsContext3DPrivate()
+{
+    GLContext::removeActiveContext(m_glContext);
+}
+
+bool GraphicsContext3DPrivate::makeContextCurrent()
+{
+    return m_glContext ? m_glContext->makeContextCurrent() : false;
+}
+
+PlatformGraphicsContext3D GraphicsContext3DPrivate::platformContext()
+{
+    return m_glContext ? m_glContext->platformContext() : 0;
+}
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+void GraphicsContext3DPrivate::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, BitmapTexture* mask)
+{
+    if (!m_glContext)
+        return;
+
+    if (textureMapper->accelerationMode() != TextureMapper::OpenGLMode) {
+        notImplemented();
+        return;
+    }
+
+    if (m_context->m_attrs.antialias && m_context->m_boundFBO == m_context->m_multisampleFBO) {
+        GLContext* previousActiveContext = GLContext::getCurrent();
+
+        if (previousActiveContext != m_glContext)
+            m_context->makeContextCurrent();
+
+        m_context->resolveMultisamplingIfNecessary();
+
+        if (previousActiveContext && previousActiveContext != m_glContext)
+            previousActiveContext->makeContextCurrent();
+    }
+
+    TextureMapperGL* texmapGL = static_cast<TextureMapperGL*>(textureMapper);
+    TextureMapperGL::Flags flags = TextureMapperGL::ShouldFlipTexture | (m_context->m_attrs.alpha ? TextureMapperGL::SupportsBlending : 0);
+    texmapGL->drawTexture(m_context->m_texture, flags, FloatSize(1, 1), targetRect, matrix, opacity, mask);
+}
+#endif // USE(ACCELERATED_COMPOSITING)
+
+} // namespace WebCore
+
+#endif // ENABLE_WEBGL
diff --git a/Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.h b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.h
index 33a500d0a..717fd1d8d 100644
--- a/Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.h
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.h
@@ -20,39 +20,37 @@
 #ifndef GraphicsContext3DPrivate_h
 #define GraphicsContext3DPrivate_h
 
+#include "GLContext.h"
+#include "GraphicsContext3D.h"
 #include <wtf/PassOwnPtr.h>
 
-typedef struct __GLXcontextRec *GLXContext;
-typedef unsigned long GLXPbuffer;
-typedef unsigned long GLXPixmap;
-typedef unsigned char GLubyte;
-typedef unsigned long Pixmap;
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#include "TextureMapper.h"
+#endif
 
 namespace WebCore {
 
-class GraphicsContext3D;
-
-class GraphicsContext3DPrivate {
+class GraphicsContext3DPrivate
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+    : public TextureMapperPlatformLayer
+#endif
+{
 public:
-    static PassOwnPtr<GraphicsContext3DPrivate> create();
+    static PassOwnPtr<GraphicsContext3DPrivate> create(GraphicsContext3D*, HostWindow*);
     ~GraphicsContext3DPrivate();
     bool makeContextCurrent();
+    PlatformGraphicsContext3D platformContext();
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+    virtual void paintToTextureMapper(TextureMapper*, const FloatRect& target, const TransformationMatrix&, float opacity, BitmapTexture* mask);
+#endif
 
 private:
-    friend class GraphicsContext3D;
-    static GraphicsContext3DPrivate* createPbufferContext();
-    static GraphicsContext3DPrivate* createPixmapContext();
-    GraphicsContext3DPrivate(GLXContext, GLXPbuffer);
-    GraphicsContext3DPrivate(GLXContext, Pixmap, GLXPixmap);
-
-    static void addActiveGraphicsContext(GraphicsContext3D*);
-    static void removeActiveGraphicsContext(GraphicsContext3D*);
-    static void cleanupActiveContextsAtExit();
-
-    GLXContext m_context;
-    GLXPbuffer m_pbuffer;
-    Pixmap m_pixmap;
-    GLXPixmap m_glxPixmap;
+    GraphicsContext3DPrivate(GraphicsContext3D*, HostWindow*);
+
+    GraphicsContext3D* m_context;
+    HostWindow* m_window;
+    GLContext* m_glContext;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index 7ae5024a6..96df0938f 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -76,11 +76,6 @@ ImageBuffer::~ImageBuffer()
     cairo_surface_destroy(m_data.m_surface);
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    return m_size.width() * m_size.height() * 4;
-}
-
 GraphicsContext* ImageBuffer::context() const
 {
     return m_context.get();
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index 4b6192f16..09caf5dae 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -73,6 +73,24 @@ extern "C" {
 using namespace std;
 
 namespace WebCore {
+    
+static CGColorSpaceRef createLinearSRGBColorSpace()
+{
+    // If we fail to load the linearized sRGB ICC profile, fall back to DeviceRGB.
+    CGColorSpaceRef linearSRGBSpace = deviceRGBColorSpaceRef();
+    
+    CFBundleRef webCoreBundle = CFBundleGetBundleWithIdentifier(CFSTR("com.apple.WebCore"));
+    RetainPtr<CFURLRef> iccProfileURL(CFBundleCopyResourceURL(webCoreBundle, CFSTR("linearSRGB"), CFSTR("icc"), 0));
+    CFDataRef iccProfileData;
+    
+    if (iccProfileURL && CFURLCreateDataAndPropertiesFromResource(0, iccProfileURL.get(), &iccProfileData, 0, 0, 0))
+        linearSRGBSpace = CGColorSpaceCreateWithICCProfile(iccProfileData);
+    
+    if (iccProfileData)
+        CFRelease(iccProfileData);
+    
+    return linearSRGBSpace;
+}
 
 static void setCGFillColor(CGContextRef context, const Color& color, ColorSpace colorSpace)
 {
@@ -103,12 +121,12 @@ CGColorSpaceRef sRGBColorSpaceRef()
 
 CGColorSpaceRef linearRGBColorSpaceRef()
 {
-    // FIXME: Windows should be able to use kCGColorSpaceGenericRGBLinear, this is tracked by http://webkit.org/b/31363.
+    // FIXME: Windows should be able to use linear sRGB, this is tracked by http://webkit.org/b/80000.
 #if PLATFORM(WIN)
     return deviceRGBColorSpaceRef();
 #else
-    static CGColorSpaceRef linearRGBSpace = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGBLinear);
-    return linearRGBSpace;
+    static CGColorSpaceRef linearSRGBSpace = createLinearSRGBColorSpace();
+    return linearSRGBSpace;
 #endif
 }
 
diff --git a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
index e9f77f301..646bd365d 100644
--- a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
@@ -108,7 +108,7 @@ static void releaseImageData(void*, const void* data, size_t)
 }
 
 ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace imageColorSpace, RenderingMode renderingMode, DeferralMode, bool& success)
-    : m_data(size)
+    : m_data(size) // NOTE: The input here isn't important as ImageBufferDataCG's constructor just ignores it.
     , m_size(size)
 {
     success = false;  // Make early return mean failure.
@@ -121,8 +121,8 @@ ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace imageColorSpace, Render
 
     // Prevent integer overflows
     m_data.m_bytesPerRow = 4 * width;
-    Checked<size_t, RecordOverflow> dataSize = height * m_data.m_bytesPerRow;
-    if (dataSize.hasOverflowed())
+    Checked<size_t, RecordOverflow> numBytes = height * m_data.m_bytesPerRow;
+    if (numBytes.hasOverflowed())
         return;
 
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
@@ -162,7 +162,7 @@ ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace imageColorSpace, Render
         m_data.m_bitmapInfo = kCGImageAlphaPremultipliedLast;
         cgContext.adoptCF(CGBitmapContextCreate(m_data.m_data, width.unsafeGet(), height.unsafeGet(), 8, m_data.m_bytesPerRow.unsafeGet(), m_data.m_colorSpace, m_data.m_bitmapInfo));
         // Create a live image that wraps the data.
-        m_data.m_dataProvider.adoptCF(CGDataProviderCreateWithData(0, m_data.m_data, dataSize.unsafeGet(), releaseImageData));
+        m_data.m_dataProvider.adoptCF(CGDataProviderCreateWithData(0, m_data.m_data, numBytes.unsafeGet(), releaseImageData));
     }
 
     if (!cgContext)
@@ -182,11 +182,6 @@ ImageBuffer::~ImageBuffer()
 {
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    return m_size.height() * m_data.m_bytesPerRow.unsafeGet();
-}
-
 GraphicsContext* ImageBuffer::context() const
 {
 #if defined(BUILDING_ON_LION)
@@ -222,7 +217,7 @@ NativeImagePtr ImageBuffer::copyNativeImage(BackingStoreCopy copyBehavior) const
     if (!m_context->isAcceleratedContext()) {
         switch (copyBehavior) {
         case DontCopyBackingStore:
-            image = CGImageCreate(m_size.width(), m_size.height(), 8, 32, m_data.m_bytesPerRow.unsafeGet(), m_data.m_colorSpace, m_data.m_bitmapInfo, m_data.m_dataProvider.get(), 0, true, kCGRenderingIntentDefault);
+            image = CGImageCreate(internalSize().width(), internalSize().height(), 8, 32, m_data.m_bytesPerRow.unsafeGet(), m_data.m_colorSpace, m_data.m_bitmapInfo, m_data.m_dataProvider.get(), 0, true, kCGRenderingIntentDefault);
             break;
         case CopyBackingStore:
             image = CGBitmapContextCreateImage(context()->platformContext());
@@ -255,28 +250,34 @@ void ImageBuffer::draw(GraphicsContext* destContext, ColorSpace styleColorSpace,
     else
         image.adoptCF(copyNativeImage(DontCopyBackingStore));
 
-    destContext->drawNativeImage(image.get(), m_size, colorSpace, destRect, srcRect, op);
+    FloatRect adjustedSrcRect = srcRect;
+    adjustedSrcRect.scale(m_resolutionScale, m_resolutionScale);
+    destContext->drawNativeImage(image.get(), internalSize(), colorSpace, destRect, adjustedSrcRect, op);
 }
 
 void ImageBuffer::drawPattern(GraphicsContext* destContext, const FloatRect& srcRect, const AffineTransform& patternTransform, const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator op, const FloatRect& destRect)
 {
+    FloatRect adjustedSrcRect = srcRect;
+    adjustedSrcRect.scale(m_resolutionScale, m_resolutionScale);
+
     if (!m_context->isAcceleratedContext()) {
         if (destContext == m_context || destContext->isAcceleratedContext()) {
             RefPtr<Image> copy = copyImage(CopyBackingStore); // Drawing into our own buffer, need to deep copy.
-            copy->drawPattern(destContext, srcRect, patternTransform, phase, styleColorSpace, op, destRect);
+            copy->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect);
         } else {
             RefPtr<Image> imageForRendering = copyImage(DontCopyBackingStore);
-            imageForRendering->drawPattern(destContext, srcRect, patternTransform, phase, styleColorSpace, op, destRect);
+            imageForRendering->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect);
         }
     } else {
         RefPtr<Image> copy = copyImage(CopyBackingStore);
-        copy->drawPattern(destContext, srcRect, patternTransform, phase, styleColorSpace, op, destRect);
+        copy->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect);
     }
 }
 
 void ImageBuffer::clip(GraphicsContext* contextToClip, const FloatRect& rect) const
 {
     CGContextRef platformContextToClip = contextToClip->platformContext();
+    // FIXME: This image needs to be grayscale to be used as an alpha mask here.
     RetainPtr<CGImageRef> image(AdoptCF, copyNativeImage(DontCopyBackingStore));
     CGContextTranslateCTM(platformContextToClip, rect.x(), rect.y() + rect.height());
     CGContextScaleCTM(platformContextToClip, 1, -1);
@@ -293,7 +294,7 @@ PassRefPtr<ByteArray> ImageBuffer::getUnmultipliedImageData(const IntRect& rect)
         m_data.m_lastFlushTime = currentTimeMS();
 #endif
     }
-    return m_data.getData(rect, m_size, m_context->isAcceleratedContext(), true);
+    return m_data.getData(rect, internalSize(), m_context->isAcceleratedContext(), true);
 }
 
 PassRefPtr<ByteArray> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
@@ -304,23 +305,24 @@ PassRefPtr<ByteArray> ImageBuffer::getPremultipliedImageData(const IntRect& rect
         m_data.m_lastFlushTime = currentTimeMS();
 #endif
     }
-    return m_data.getData(rect, m_size, m_context->isAcceleratedContext(), false);
+    return m_data.getData(rect, internalSize(), m_context->isAcceleratedContext(), false);
 }
 
 void ImageBuffer::putByteArray(Multiply multiplied, ByteArray* source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint)
 {
     if (!m_context->isAcceleratedContext()) {
-        m_data.putData(source, sourceSize, sourceRect, destPoint, m_size, m_context->isAcceleratedContext(), multiplied == Unmultiplied);
+        m_data.putData(source, sourceSize, sourceRect, destPoint, internalSize(), m_context->isAcceleratedContext(), multiplied == Unmultiplied);
         return;
     }
 
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
     // Make a copy of the source to ensure the bits don't change before being drawn
     IntSize sourceCopySize(sourceRect.width(), sourceRect.height());
-    OwnPtr<ImageBuffer> sourceCopy = ImageBuffer::create(sourceCopySize, ColorSpaceDeviceRGB, Unaccelerated);
+    OwnPtr<ImageBuffer> sourceCopy = ImageBuffer::create(sourceCopySize, 1, ColorSpaceDeviceRGB, Unaccelerated);
     if (!sourceCopy)
         return;
-    sourceCopy->m_data.putData(source, sourceSize, sourceRect, IntPoint(-sourceRect.x(), -sourceRect.y()), sourceCopy->size(), sourceCopy->context()->isAcceleratedContext(), multiplied == Unmultiplied);
+
+    sourceCopy->m_data.putData(source, sourceSize, sourceRect, IntPoint(-sourceRect.x(), -sourceRect.y()), sourceCopy->internalSize(), sourceCopy->context()->isAcceleratedContext(), multiplied == Unmultiplied);
 
     // Set up context for using drawImage as a direct bit copy
     CGContextRef destContext = context()->platformContext();
@@ -333,7 +335,7 @@ void ImageBuffer::putByteArray(Multiply multiplied, ByteArray* source, const Int
     CGContextSetShadowWithColor(destContext, CGSizeZero, 0, 0);
 
     // Draw the image in CG coordinate space
-    IntPoint destPointInCGCoords(destPoint.x() + sourceRect.x(), m_size.height() - (destPoint.y()+sourceRect.y()) - sourceRect.height());
+    IntPoint destPointInCGCoords(destPoint.x() + sourceRect.x(), internalSize().height() - (destPoint.y()+sourceRect.y()) - sourceRect.height());
     IntRect destRectInCGCoords(destPointInCGCoords, sourceCopySize);
     RetainPtr<CGImageRef> sourceCopyImage(AdoptCF, sourceCopy->copyNativeImage());
     CGContextDrawImage(destContext, destRectInCGCoords, sourceCopyImage.get());
@@ -418,21 +420,20 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
 
     if (CFEqual(uti.get(), jpegUTI())) {
         // JPEGs don't have an alpha channel, so we have to manually composite on top of black.
-        arr = getPremultipliedImageData(IntRect(IntPoint(0, 0), m_size));
+        arr = getPremultipliedImageData(IntRect(IntPoint(0, 0), internalSize()));
 
         unsigned char *data = arr->data();
-        for (int i = 0; i < width() * height(); i++)
+        for (int i = 0; i < internalSize().width() * internalSize().height(); i++)
             data[i * 4 + 3] = 255; // The image is already premultiplied, so we just need to make it opaque.
 
         RetainPtr<CGDataProviderRef> dataProvider;
     
-        dataProvider.adoptCF(CGDataProviderCreateWithData(0, data,
-                                                          4 * width() * height(), 0));
+        dataProvider.adoptCF(CGDataProviderCreateWithData(0, data, 4 * internalSize().width() * internalSize().height(), 0));
     
         if (!dataProvider)
             return "data:,";
 
-        image.adoptCF(CGImageCreate(width(), height(), 8, 32, 4 * width(),
+        image.adoptCF(CGImageCreate(internalSize().width(), internalSize().height(), 8, 32, 4 * internalSize().width(),
                                     CGColorSpaceCreateDeviceRGB(), kCGBitmapByteOrderDefault | kCGImageAlphaLast,
                                     dataProvider.get(), 0, false, kCGRenderingIntentDefault));
     } else
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
index 9b912a44f..426c6568a 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
@@ -27,7 +27,6 @@
 #include "config.h"
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
 
 #include "BitmapSkPictureCanvasLayerTextureUpdater.h"
 
@@ -110,5 +109,4 @@ void BitmapSkPictureCanvasLayerTextureUpdater::updateTextureRect(GraphicsContext
 }
 
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
index 838b4b3e7..0aeae0cd4 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
@@ -28,8 +28,6 @@
 #define BitmapSkPictureCanvasLayerTextureUpdater_h
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
-
 #include "LayerTextureSubImage.h"
 #include "PlatformColor.h"
 #include "SkBitmap.h"
@@ -70,6 +68,5 @@ private:
     LayerTextureSubImage m_texSubImage;
 };
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
 #endif // BitmapSkPictureCanvasLayerTextureUpdater_h
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
index d8b4bbe08..5c79f0743 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
@@ -75,13 +75,12 @@ void Canvas2DLayerChromium::setTextureId(unsigned textureId)
     setNeedsCommit();
 }
 
-void Canvas2DLayerChromium::contentChanged()
+void Canvas2DLayerChromium::setNeedsDisplayRect(const FloatRect& dirtyRect)
 {
+    LayerChromium::setNeedsDisplayRect(dirtyRect);
+
     if (layerTreeHost())
         layerTreeHost()->startRateLimiter(m_context);
-
-    m_updateRect = FloatRect(FloatPoint(), contentBounds());
-    setNeedsDisplay();
 }
 
 bool Canvas2DLayerChromium::drawsContent() const
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
index 11a1a9539..035a2b37e 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
@@ -52,7 +52,7 @@ public:
 
     void setTextureId(unsigned);
 
-    virtual void contentChanged();
+    virtual void setNeedsDisplayRect(const FloatRect&);
 
     virtual bool drawsContent() const;
     virtual void paintContentsIfDirty(const Region& occludedScreenSpace);
diff --git a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
index 181ba4e58..d533699af 100644
--- a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
@@ -45,7 +45,7 @@ CanvasLayerChromium::CanvasLayerChromium()
 {
 }
 
-PassRefPtr<CCLayerImpl> CanvasLayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> CanvasLayerChromium::createCCLayerImpl()
 {
     return CCCanvasLayerImpl::create(m_layerId);
 }
diff --git a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
index 9e8ce7d8c..722cc1a66 100644
--- a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
@@ -41,7 +41,7 @@ namespace WebCore {
 // Base class for WebGL and accelerated 2d canvases.
 class CanvasLayerChromium : public LayerChromium {
 public:
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
 
 protected:
     CanvasLayerChromium();
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index aa7fb5cf4..7a66984bd 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -93,7 +93,7 @@ bool ContentLayerChromium::drawsContent() const
     return TiledLayerChromium::drawsContent() && m_delegate;
 }
 
-void ContentLayerChromium::paintContentsIfDirty(const Region& /* occludedScreenSpace */)
+void ContentLayerChromium::paintContentsIfDirty(const Region& occludedScreenSpace)
 {
     updateTileSizeAndTilingOption();
     createTextureUpdaterIfNeeded();
@@ -105,11 +105,11 @@ void ContentLayerChromium::paintContentsIfDirty(const Region& /* occludedScreenS
     if (drawsContent())
         layerRect = visibleLayerRect();
 
-    prepareToUpdate(layerRect);
+    prepareToUpdate(layerRect, occludedScreenSpace);
     m_needsDisplay = false;
 }
 
-void ContentLayerChromium::idlePaintContentsIfDirty()
+void ContentLayerChromium::idlePaintContentsIfDirty(const Region& occludedScreenSpace)
 {
     if (!drawsContent())
         return;
@@ -118,7 +118,7 @@ void ContentLayerChromium::idlePaintContentsIfDirty()
     if (layerRect.isEmpty())
         return;
 
-    prepareToUpdateIdle(layerRect);
+    prepareToUpdateIdle(layerRect, occludedScreenSpace);
     if (needsIdlePaint(layerRect))
         setNeedsCommit();
 }
@@ -127,13 +127,11 @@ void ContentLayerChromium::createTextureUpdaterIfNeeded()
 {
     if (m_textureUpdater)
         return;
-#if USE(SKIA)
     if (layerTreeHost()->settings().acceleratePainting)
         m_textureUpdater = FrameBufferSkPictureCanvasLayerTextureUpdater::create(ContentLayerPainter::create(m_delegate));
     else if (layerTreeHost()->settings().perTilePainting)
         m_textureUpdater = BitmapSkPictureCanvasLayerTextureUpdater::create(ContentLayerPainter::create(m_delegate), layerTreeHost()->layerRendererCapabilities().usingMapSub);
     else
-#endif // USE(SKIA)
         m_textureUpdater = BitmapCanvasLayerTextureUpdater::create(ContentLayerPainter::create(m_delegate), layerTreeHost()->layerRendererCapabilities().usingMapSub);
     m_textureUpdater->setOpaque(opaque());
 
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
index 3e8686d0a..fa5901e2a 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
@@ -60,7 +60,7 @@ public:
 
     virtual bool drawsContent() const;
     virtual void paintContentsIfDirty(const Region& occludedScreenSpace);
-    virtual void idlePaintContentsIfDirty();
+    virtual void idlePaintContentsIfDirty(const Region& occludedScreenSpace);
 
     virtual void setOpaque(bool);
 
diff --git a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
index 19dfa2f00..be217d9c1 100644
--- a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
@@ -27,7 +27,6 @@
 #include "config.h"
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
 
 #include "FrameBufferSkPictureCanvasLayerTextureUpdater.h"
 
@@ -99,30 +98,30 @@ LayerTextureUpdater::SampledTexelFormat FrameBufferSkPictureCanvasLayerTextureUp
 
 void FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect(GraphicsContext3D* context, TextureAllocator* allocator, ManagedTexture* texture, const IntRect& sourceRect, const IntRect& destRect)
 {
-    // Make sure SKIA uses the correct GL context.
+    // Make sure ganesh uses the correct GL context.
     context->makeContextCurrent();
-    // Notify SKIA to sync its internal GL state.
+    // Notify ganesh to sync its internal GL state.
     context->grContext()->resetContext();
 
     // Create an accelerated canvas to draw on.
     OwnPtr<SkCanvas> canvas = createAcceleratedCanvas(context, allocator, texture);
 
-    canvas->clipRect(SkRect(destRect));
     // The compositor expects the textures to be upside-down so it can flip
     // the final composited image. Ganesh renders the image upright so we
     // need to do a y-flip.
     canvas->translate(0.0, texture->size().height());
     canvas->scale(1.0, -1.0);
+    // Only the region corresponding to destRect on the texture must be updated.
+    canvas->clipRect(SkRect(destRect));
     // Translate the origin of contentRect to that of destRect.
     // Note that destRect is defined relative to sourceRect.
     canvas->translate(contentRect().x() - sourceRect.x() + destRect.x(),
                       contentRect().y() - sourceRect.y() + destRect.y());
     drawPicture(canvas.get());
 
-    // Flush SKIA context so that all the rendered stuff appears on the texture.
+    // Flush ganesh context so that all the rendered stuff appears on the texture.
     context->grContext()->flush();
 }
 
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
index 4a10c858e..5039ba902 100644
--- a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
@@ -28,7 +28,6 @@
 #define FrameBufferSkPictureCanvasLayerTextureUpdater_h
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
 
 #include "SkPictureCanvasLayerTextureUpdater.h"
 
@@ -63,6 +62,5 @@ private:
     explicit FrameBufferSkPictureCanvasLayerTextureUpdater(PassOwnPtr<LayerPainterChromium>);
 };
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
 #endif // FrameBufferSkPictureCanvasLayerTextureUpdater_h
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index cdecf5917..4c81853b8 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -62,7 +62,8 @@
 using namespace std;
 
 namespace {
-static int s_nextGroupId = 0;
+static int s_nextGroupId = 1;
+static int s_nextAnimationId = 1;
 }
 
 namespace WebCore {
@@ -77,6 +78,7 @@ GraphicsLayerChromium::GraphicsLayerChromium(GraphicsLayerClient* client)
     , m_contentsLayerPurpose(NoContentsLayer)
     , m_contentsLayerHasBackgroundColor(false)
     , m_inSetChildren(false)
+    , m_pageScaleChanged(false)
 {
     m_layer = ContentLayerChromium::create(this);
 
@@ -88,11 +90,20 @@ GraphicsLayerChromium::~GraphicsLayerChromium()
     if (m_layer) {
         m_layer->clearDelegate();
         m_layer->clearRenderSurface();
+        // Primary layer may have at one point been m_layer. Be sure to reset
+        // the delegate, just in case.
+        m_layer->setLayerAnimationDelegate(0);
     }
+
     if (m_contentsLayer)
         m_contentsLayer->clearRenderSurface();
-    if (m_transformLayer)
+
+    if (m_transformLayer) {
         m_transformLayer->clearRenderSurface();
+        // Primary layer may have switched from m_layer to m_transformLayer.
+        // Be sure to reset the delegate, just in case.
+        m_transformLayer->setLayerAnimationDelegate(0);
+    }
 }
 
 void GraphicsLayerChromium::setName(const String& inName)
@@ -106,11 +117,11 @@ void GraphicsLayerChromium::setName(const String& inName)
 void GraphicsLayerChromium::updateNames()
 {
     if (m_layer)
-        m_layer->setName("Layer for " + m_nameBase);
+        m_layer->setDebugName("Layer for " + m_nameBase);
     if (m_transformLayer)
-        m_transformLayer->setName("TransformLayer for " + m_nameBase);
+        m_transformLayer->setDebugName("TransformLayer for " + m_nameBase);
     if (m_contentsLayer)
-        m_contentsLayer->setName("ContentsLayer for " + m_nameBase);
+        m_contentsLayer->setDebugName("ContentsLayer for " + m_nameBase);
 }
 
 bool GraphicsLayerChromium::setChildren(const Vector<GraphicsLayer*>& children)
@@ -191,6 +202,10 @@ void GraphicsLayerChromium::setSize(const FloatSize& size)
 
     GraphicsLayer::setSize(clampedSize);
     updateLayerSize();
+
+    if (m_pageScaleChanged && m_layer)
+        m_layer->setNeedsDisplay();
+    m_pageScaleChanged = false;
 }
 
 void GraphicsLayerChromium::setTransform(const TransformationMatrix& transform)
@@ -279,8 +294,6 @@ void GraphicsLayerChromium::setMaskLayer(GraphicsLayer* maskLayer)
     GraphicsLayer::setMaskLayer(maskLayer);
 
     LayerChromium* maskLayerChromium = m_maskLayer ? m_maskLayer->platformLayer() : 0;
-    if (maskLayerChromium)
-        maskLayerChromium->setIsMask(true);
     m_layer->setMaskLayer(maskLayerChromium);
 }
 
@@ -308,10 +321,8 @@ void GraphicsLayerChromium::setReplicatedByLayer(GraphicsLayer* layer)
 
 void GraphicsLayerChromium::setContentsNeedsDisplay()
 {
-    if (m_contentsLayer) {
+    if (m_contentsLayer)
         m_contentsLayer->setNeedsDisplay();
-        m_contentsLayer->contentChanged();
-    }
 }
 
 void GraphicsLayerChromium::setNeedsDisplay()
@@ -371,7 +382,6 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
             m_contentsLayerPurpose = ContentsLayerForCanvas;
             childrenChanged = true;
         }
-        m_contentsLayer->setNeedsDisplay();
         updateContentsRect();
     } else {
         if (m_contentsLayer) {
@@ -388,27 +398,28 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
 
 bool GraphicsLayerChromium::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, const String& animationName, double timeOffset)
 {
-    return m_layer->addAnimation(values, boxSize, animation, mapAnimationNameToId(animationName), s_nextGroupId++, timeOffset);
+    primaryLayer()->setLayerAnimationDelegate(this);
+    return primaryLayer()->addAnimation(values, boxSize, animation, mapAnimationNameToId(animationName), s_nextGroupId++, timeOffset);
 }
 
 void GraphicsLayerChromium::pauseAnimation(const String& animationName, double timeOffset)
 {
-    m_layer->pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
+    primaryLayer()->pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
 }
 
 void GraphicsLayerChromium::removeAnimation(const String& animationName)
 {
-    m_layer->removeAnimation(mapAnimationNameToId(animationName));
+    primaryLayer()->removeAnimation(mapAnimationNameToId(animationName));
 }
 
 void GraphicsLayerChromium::suspendAnimations(double time)
 {
-    m_layer->suspendAnimations(time);
+    primaryLayer()->suspendAnimations(time);
 }
 
 void GraphicsLayerChromium::resumeAnimations()
 {
-    m_layer->resumeAnimations();
+    primaryLayer()->resumeAnimations();
 }
 
 void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
@@ -420,7 +431,6 @@ void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
             m_contentsLayerPurpose = ContentsLayerForVideo;
             childrenChanged = true;
         }
-        layer->setNeedsDisplay();
         updateContentsRect();
     } else {
         if (m_contentsLayer) {
@@ -566,6 +576,7 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
         // Create the transform layer.
         m_transformLayer = LayerChromium::create();
         m_transformLayer->setPreserves3D(true);
+        m_transformLayer->setLayerAnimationDelegate(this);
 
         // Copy the position from this layer.
         updateLayerPosition();
@@ -598,6 +609,7 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
             m_transformLayer->parent()->replaceChild(m_transformLayer.get(), m_layer.get());
 
         // Release the transform layer.
+        m_transformLayer->setLayerAnimationDelegate(0);
         m_transformLayer = 0;
 
         updateLayerPosition();
@@ -709,8 +721,10 @@ float GraphicsLayerChromium::contentsScale() const
 void GraphicsLayerChromium::deviceOrPageScaleFactorChanged()
 {
     updateContentsScale();
-    if (m_layer)
-        m_layer->pageScaleChanged();
+    // Invalidations are clamped to the layer's bounds but we receive the scale changed notification before receiving
+    // the new layer bounds. When the scale changes, we really want to invalidate the post-scale layer bounds, so we
+    // remember that the scale has changed and then invalidate the full layer bounds when we receive the new size.
+    m_pageScaleChanged = true;
 }
 
 void GraphicsLayerChromium::paintContents(GraphicsContext& context, const IntRect& clip)
@@ -720,8 +734,29 @@ void GraphicsLayerChromium::paintContents(GraphicsContext& context, const IntRec
 
 int GraphicsLayerChromium::mapAnimationNameToId(const String& animationName)
 {
-    // FIXME: need to maintain a name to id mapping in this class.
-    return 0;
+    if (animationName.isEmpty())
+        return 0;
+
+    if (!m_animationIdMap.contains(animationName))
+        m_animationIdMap.add(animationName, s_nextAnimationId++);
+
+    return m_animationIdMap.find(animationName)->second;
+}
+
+void GraphicsLayerChromium::notifyAnimationStarted(double startTime)
+{
+    if (m_client)
+        m_client->notifyAnimationStarted(this, startTime);
+}
+
+void GraphicsLayerChromium::notifyAnimationFinished(int animationId)
+{
+    for (AnimationIdMap::iterator idIter = m_animationIdMap.begin(); idIter != m_animationIdMap.end(); ++idIter) {
+        if (idIter->second == animationId) {
+            m_animationIdMap.remove(idIter);
+            return;
+        }
+    }
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
index eb3146bbd..4cca82a88 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
@@ -37,12 +37,15 @@
 #include "LayerChromium.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
+#include "cc/CCLayerAnimationDelegate.h"
+
+#include <wtf/HashMap.h>
 
 namespace WebCore {
 
 class LayerChromium;
 
-class GraphicsLayerChromium : public GraphicsLayer, public ContentLayerDelegate {
+class GraphicsLayerChromium : public GraphicsLayer, public ContentLayerDelegate, public CCLayerAnimationDelegate {
 public:
     GraphicsLayerChromium(GraphicsLayerClient*);
     virtual ~GraphicsLayerChromium();
@@ -94,6 +97,7 @@ public:
     virtual void setContentsToImage(Image*);
     virtual void setContentsToMedia(PlatformLayer*);
     virtual void setContentsToCanvas(PlatformLayer*);
+    virtual bool hasContentsLayer() const { return m_contentsLayer; }
 
     virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, const String&, double timeOffset);
     virtual void pauseAnimation(const String& animationName, double timeOffset);
@@ -110,10 +114,16 @@ public:
     // ContentLayerDelegate implementation.
     virtual void paintContents(GraphicsContext&, const IntRect& clip);
 
+    // CCLayerAnimationDelegate implementation.
+    virtual void notifyAnimationStarted(double startTime);
+    virtual void notifyAnimationFinished(int animationId);
+
     // Exposed for tests.
     LayerChromium* contentsLayer() const { return m_contentsLayer.get(); }
 
 private:
+    typedef HashMap<String, int> AnimationIdMap;
+
     LayerChromium* primaryLayer() const  { return m_transformLayer.get() ? m_transformLayer.get() : m_layer.get(); }
     LayerChromium* hostLayerForChildren() const;
     LayerChromium* layerForParent() const;
@@ -156,6 +166,9 @@ private:
     ContentsLayerPurpose m_contentsLayerPurpose;
     bool m_contentsLayerHasBackgroundColor : 1;
     bool m_inSetChildren;
+    bool m_pageScaleChanged;
+
+    AnimationIdMap m_animationIdMap;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
index 1e44e8702..611ab2a6a 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
@@ -158,7 +158,7 @@ void ImageLayerChromium::setContents(Image* contents)
     setNeedsDisplay();
 }
 
-void ImageLayerChromium::paintContentsIfDirty(const Region& /* occludedScreenSpace */)
+void ImageLayerChromium::paintContentsIfDirty(const Region& occludedScreenSpace)
 {
     createTextureUpdaterIfNeeded();
     if (m_needsDisplay) {
@@ -168,7 +168,7 @@ void ImageLayerChromium::paintContentsIfDirty(const Region& /* occludedScreenSpa
         m_needsDisplay = false;
     }
 
-    prepareToUpdate(visibleLayerRect());
+    prepareToUpdate(visibleLayerRect(), occludedScreenSpace);
 }
 
 void ImageLayerChromium::createTextureUpdaterIfNeeded()
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
index 2127b857c..deafd37e7 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
@@ -37,10 +37,6 @@
 #include "ContentLayerChromium.h"
 #include "PlatformImage.h"
 
-#if USE(CG)
-#include <wtf/RetainPtr.h>
-#endif
-
 namespace WebCore {
 
 class Image;
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 8eeda68a4..f973880fd 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -33,16 +33,15 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "LayerChromium.h"
 
-#include "cc/CCLayerAnimationController.h"
-#include "cc/CCLayerImpl.h"
-#include "cc/CCLayerTreeHost.h"
-#if USE(SKIA)
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
-#endif
-#include "Region.h"
 #include "RenderLayerBacking.h"
 #include "TextStream.h"
+#include "cc/CCAnimationEvents.h"
+#include "cc/CCLayerAnimationController.h"
+#include "cc/CCLayerAnimationDelegate.h"
+#include "cc/CCLayerImpl.h"
+#include "cc/CCLayerTreeHost.h"
 #include "skia/ext/platform_canvas.h"
 
 namespace WebCore {
@@ -62,7 +61,9 @@ LayerChromium::LayerChromium()
     , m_parent(0)
     , m_layerAnimationController(CCLayerAnimationController::create())
     , m_scrollable(false)
+    , m_shouldScrollOnMainThread(false)
     , m_haveWheelEventHandlers(false)
+    , m_nonFastScrollableRegionChanged(false)
     , m_anchorPoint(0.5, 0.5)
     , m_backgroundColor(0, 0, 0, 0)
     , m_backgroundCoversViewport(false)
@@ -81,7 +82,7 @@ LayerChromium::LayerChromium()
     , m_drawOpacity(0)
     , m_targetRenderSurface(0)
     , m_contentsScale(1.0)
-    , m_pageScaleDirty(false)
+    , m_layerAnimationDelegate(0)
 {
 }
 
@@ -141,6 +142,24 @@ bool LayerChromium::hasActiveAnimation() const
     return m_layerAnimationController->hasActiveAnimation();
 }
 
+void LayerChromium::setAnimationEvent(const CCAnimationEvent& event, double wallClockTime)
+{
+    switch (event.type()) {
+
+    case CCAnimationEvent::Started: {
+        m_layerAnimationDelegate->notifyAnimationStarted(wallClockTime);
+        break;
+    }
+
+    case CCAnimationEvent::Finished: {
+        const CCAnimationFinishedEvent* finishedEvent = event.toAnimationFinishedEvent();
+        m_layerAnimationDelegate->notifyAnimationFinished(finishedEvent->animationId());
+        break;
+    }
+
+    }
+}
+
 void LayerChromium::setIsNonCompositedContent(bool isNonCompositedContent)
 {
     m_isNonCompositedContent = isNonCompositedContent;
@@ -255,12 +274,10 @@ void LayerChromium::setBounds(const IntSize& size)
 
     m_bounds = size;
 
-    if (firstResize || m_pageScaleDirty)
+    if (firstResize)
         setNeedsDisplay();
     else
         setNeedsCommit();
-
-    m_pageScaleDirty = false;
 }
 
 const LayerChromium* LayerChromium::rootLayer() const
@@ -337,8 +354,10 @@ void LayerChromium::setMaskLayer(LayerChromium* maskLayer)
     if (m_maskLayer)
         m_maskLayer->setLayerTreeHost(0);
     m_maskLayer = maskLayer;
-    if (m_maskLayer)
+    if (m_maskLayer) {
         m_maskLayer->setLayerTreeHost(m_layerTreeHost.get());
+        m_maskLayer->setIsMask(true);
+    }
     setNeedsCommit();
 }
 
@@ -418,6 +437,14 @@ void LayerChromium::setScrollable(bool scrollable)
     setNeedsCommit();
 }
 
+void LayerChromium::setShouldScrollOnMainThread(bool shouldScrollOnMainThread)
+{
+    if (m_shouldScrollOnMainThread == shouldScrollOnMainThread)
+        return;
+    m_shouldScrollOnMainThread = shouldScrollOnMainThread;
+    setNeedsCommit();
+}
+
 void LayerChromium::setHaveWheelEventHandlers(bool haveWheelEventHandlers)
 {
     if (m_haveWheelEventHandlers == haveWheelEventHandlers)
@@ -426,6 +453,15 @@ void LayerChromium::setHaveWheelEventHandlers(bool haveWheelEventHandlers)
     setNeedsCommit();
 }
 
+void LayerChromium::setNonFastScrollableRegion(const Region& region)
+{
+    if (m_nonFastScrollableRegion == region)
+        return;
+    m_nonFastScrollableRegion = region;
+    m_nonFastScrollableRegionChanged = true;
+    setNeedsCommit();
+}
+
 void LayerChromium::setDoubleSided(bool doubleSided)
 {
     if (m_doubleSided == doubleSided)
@@ -448,13 +484,10 @@ LayerChromium* LayerChromium::parent() const
     return m_parent;
 }
 
-void LayerChromium::setName(const String& name)
-{
-    m_name = name;
-}
-
 void LayerChromium::setNeedsDisplayRect(const FloatRect& dirtyRect)
 {
+    m_updateRect.unite(dirtyRect);
+
     // Simply mark the contents as dirty. For non-root layers, the call to
     // setNeedsCommit will schedule a fresh compositing pass.
     // For the root layer, setNeedsCommit has no effect.
@@ -474,14 +507,21 @@ void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     layer->setContentBounds(contentBounds());
     layer->setDebugBorderColor(m_debugBorderColor);
     layer->setDebugBorderWidth(m_debugBorderWidth);
+    layer->setDebugName(m_debugName.isolatedCopy()); // We have to use isolatedCopy() here to safely pass ownership to another thread.
     layer->setDoubleSided(m_doubleSided);
     layer->setDrawsContent(drawsContent());
     layer->setFilters(filters());
     layer->setIsNonCompositedContent(m_isNonCompositedContent);
     layer->setMasksToBounds(m_masksToBounds);
     layer->setScrollable(m_scrollable);
+    layer->setShouldScrollOnMainThread(m_shouldScrollOnMainThread);
     layer->setHaveWheelEventHandlers(m_haveWheelEventHandlers);
-    layer->setName(m_name);
+    // Copying a Region is more expensive than most layer properties, since it involves copying two Vectors that may be
+    // arbitrarily large depending on page content, so we only push the property if it's changed.
+    if (m_nonFastScrollableRegionChanged) {
+        layer->setNonFastScrollableRegion(m_nonFastScrollableRegion);
+        m_nonFastScrollableRegionChanged = false;
+    }
     layer->setOpaque(m_opaque);
     layer->setOpacity(m_opacity);
     layer->setPosition(m_position);
@@ -505,7 +545,7 @@ void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     m_updateRect = FloatRect();
 }
 
-PassRefPtr<CCLayerImpl> LayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> LayerChromium::createCCLayerImpl()
 {
     return CCLayerImpl::create(m_layerId);
 }
@@ -522,41 +562,19 @@ void LayerChromium::setDebugBorderWidth(float width)
     setNeedsCommit();
 }
 
-void LayerChromium::setContentsScale(float contentsScale)
+void LayerChromium::setDebugName(const String& debugName)
 {
-    if (!needsContentsScale() || m_contentsScale == contentsScale)
-        return;
-    m_contentsScale = contentsScale;
-    setNeedsDisplay();
+    m_debugName = debugName;
+    setNeedsCommit();
 }
 
-TransformationMatrix LayerChromium::contentToScreenSpaceTransform() const
-{
-    IntSize boundsInLayerSpace = bounds();
-    IntSize boundsInContentSpace = contentBounds();
-
-    TransformationMatrix transform = screenSpaceTransform();
 
-    // Scale from content space to layer space
-    transform.scaleNonUniform(boundsInLayerSpace.width() / static_cast<double>(boundsInContentSpace.width()),
-                              boundsInLayerSpace.height() / static_cast<double>(boundsInContentSpace.height()));
-
-    return transform;
-}
-
-void LayerChromium::addSelfToOccludedScreenSpace(Region& occludedScreenSpace)
+void LayerChromium::setContentsScale(float contentsScale)
 {
-    if (!opaque() || drawOpacity() != 1 || !isPaintedAxisAlignedInScreen())
+    if (!needsContentsScale() || m_contentsScale == contentsScale)
         return;
-
-    FloatRect targetRect = contentToScreenSpaceTransform().mapRect(FloatRect(visibleLayerRect()));
-    occludedScreenSpace.unite(enclosedIntRect(targetRect));
-}
-
-bool LayerChromium::isPaintedAxisAlignedInScreen() const
-{
-    FloatQuad quad = contentToScreenSpaceTransform().mapQuad(FloatQuad(visibleLayerRect()));
-    return quad.isRectilinear();
+    m_contentsScale = contentsScale;
+    setNeedsDisplay();
 }
 
 void LayerChromium::createRenderSurface()
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index 897647d2d..86fdf9515 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -39,11 +39,13 @@
 #include "GraphicsContext.h"
 #include "PlatformString.h"
 #include "ProgramBinding.h"
+#include "Region.h"
 #include "RenderSurfaceChromium.h"
 #include "ShaderChromium.h"
 #include "TransformationMatrix.h"
 
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
@@ -52,12 +54,14 @@
 
 namespace WebCore {
 
+class CCAnimationEvent;
 class CCLayerAnimationController;
+class CCLayerAnimationDelegate;
 class CCLayerImpl;
 class CCLayerTreeHost;
 class CCTextureUpdater;
 class GraphicsContext3D;
-class Region;
+class ScrollbarLayerChromium;
 
 // Base class for composited layers. Special layer types are derived from
 // this class.
@@ -96,9 +100,6 @@ public:
     void setMasksToBounds(bool);
     bool masksToBounds() const { return m_masksToBounds; }
 
-    void setName(const String&);
-    const String& name() const { return m_name; }
-
     void setMaskLayer(LayerChromium*);
     LayerChromium* maskLayer() const { return m_maskLayer.get(); }
 
@@ -131,7 +132,9 @@ public:
     const IntPoint& scrollPosition() const { return m_scrollPosition; }
 
     void setScrollable(bool);
+    void setShouldScrollOnMainThread(bool);
     void setHaveWheelEventHandlers(bool);
+    void setNonFastScrollableRegion(const Region&);
 
     IntSize scrollDelta() const { return IntSize(); }
 
@@ -159,17 +162,17 @@ public:
     // These methods typically need to be overwritten by derived classes.
     virtual bool drawsContent() const { return m_isDrawable; }
     virtual void paintContentsIfDirty(const Region& /* occludedScreenSpace */) { }
-    virtual void idlePaintContentsIfDirty() { }
+    virtual void idlePaintContentsIfDirty(const Region& /* occludedScreenSpace */) { }
     virtual void updateCompositorResources(GraphicsContext3D*, CCTextureUpdater&) { }
     virtual void setIsMask(bool) { }
     virtual void unreserveContentsTexture() { }
     virtual void bindContentsTexture() { }
-    virtual void pageScaleChanged() { m_pageScaleDirty = true; }
     virtual void protectVisibleTileTextures() { }
     virtual bool needsContentsScale() const { return false; }
 
     void setDebugBorderColor(const Color&);
     void setDebugBorderWidth(float);
+    void setDebugName(const String&);
 
     virtual void pushPropertiesTo(CCLayerImpl*);
 
@@ -198,14 +201,8 @@ public:
     float contentsScale() const { return m_contentsScale; }
     void setContentsScale(float);
 
-    TransformationMatrix contentToScreenSpaceTransform() const;
-
-    // Adds any opaque visible pixels to the occluded region.
-    virtual void addSelfToOccludedScreenSpace(Region& occludedScreenSpace);
-
     // Returns true if any of the layer's descendants has content to draw.
     bool descendantDrawsContent();
-    virtual void contentChanged() { }
 
     CCLayerTreeHost* layerTreeHost() const { return m_layerTreeHost.get(); }
 
@@ -224,8 +221,17 @@ public:
 
     CCLayerAnimationController* layerAnimationController() { return m_layerAnimationController.get(); }
     void setLayerAnimationController(PassOwnPtr<CCLayerAnimationController>);
+
+    void setLayerAnimationDelegate(CCLayerAnimationDelegate* layerAnimationDelegate) { m_layerAnimationDelegate = layerAnimationDelegate; }
+
     bool hasActiveAnimation() const;
 
+    void setAnimationEvent(const CCAnimationEvent&, double wallClockTime);
+
+    virtual Region opaqueContentsRegion() const { return Region(); };
+
+    virtual ScrollbarLayerChromium* toScrollbarLayerChromium() { return 0; }
+
 protected:
     friend class CCLayerImpl;
     friend class LayerTilerChromium;
@@ -233,8 +239,6 @@ protected:
 
     LayerChromium();
 
-    bool isPaintedAxisAlignedInScreen() const;
-
     void setNeedsCommit();
 
     // This flag is set when layer need repainting/updating.
@@ -249,7 +253,7 @@ protected:
     RefPtr<LayerChromium> m_maskLayer;
 
     // Constructs a CCLayerImpl of the correct runtime type for this LayerChromium type.
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
     int m_layerId;
 
 private:
@@ -276,13 +280,17 @@ private:
     IntRect m_visibleLayerRect;
     IntPoint m_scrollPosition;
     bool m_scrollable;
+    bool m_shouldScrollOnMainThread;
     bool m_haveWheelEventHandlers;
+    Region m_nonFastScrollableRegion;
+    bool m_nonFastScrollableRegionChanged;
     FloatPoint m_position;
     FloatPoint m_anchorPoint;
     Color m_backgroundColor;
     bool m_backgroundCoversViewport;
     Color m_debugBorderColor;
     float m_debugBorderWidth;
+    String m_debugName;
     float m_opacity;
     FilterOperations m_filters;
     float m_anchorPointZ;
@@ -311,9 +319,9 @@ private:
     IntRect m_drawableContentRect;
     float m_contentsScale;
 
-    String m_name;
-
     bool m_pageScaleDirty;
+
+    CCLayerAnimationDelegate* m_layerAnimationDelegate;
 };
 
 void sortLayers(Vector<RefPtr<LayerChromium> >::iterator, Vector<RefPtr<LayerChromium> >::iterator, void*);
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index 542b3ad1c..4ed89fd9e 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -64,13 +64,9 @@
 #include "cc/CCSolidColorDrawQuad.h"
 #include "cc/CCTileDrawQuad.h"
 #include "cc/CCVideoDrawQuad.h"
-#if USE(SKIA)
 #include "Extensions3D.h"
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
-#elif USE(CG)
-#include <CoreGraphics/CGBitmapContext.h>
-#endif
 #include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
 
@@ -114,7 +110,6 @@ static TransformationMatrix screenMatrix(int x, int y, int width, int height)
     return screen;
 }
 
-#if USE(SKIA)
 bool contextSupportsAcceleratedPainting(GraphicsContext3D* context)
 {
     WebCore::Extensions3D* extensions = context->getExtensions();
@@ -133,7 +128,21 @@ bool contextSupportsAcceleratedPainting(GraphicsContext3D* context)
 
     return true;
 }
+
+bool needsLionIOSurfaceReadbackWorkaround()
+{
+#if OS(DARWIN)
+    static SInt32 systemVersion = 0;
+    if (!systemVersion) {
+        if (Gestalt(gestaltSystemVersion, &systemVersion) != noErr)
+            return false;
+    }
+
+    return systemVersion >= 0x1070;
+#else
+    return false;
 #endif
+}
 
 } // anonymous namespace
 
@@ -160,18 +169,18 @@ private:
 };
 
 
-PassOwnPtr<LayerRendererChromium> LayerRendererChromium::create(CCLayerTreeHostImpl* owner, PassRefPtr<GraphicsContext3D> context)
+PassOwnPtr<LayerRendererChromium> LayerRendererChromium::create(LayerRendererChromiumClient* client, PassRefPtr<GraphicsContext3D> context)
 {
-    OwnPtr<LayerRendererChromium> layerRenderer(adoptPtr(new LayerRendererChromium(owner, context)));
+    OwnPtr<LayerRendererChromium> layerRenderer(adoptPtr(new LayerRendererChromium(client, context)));
     if (!layerRenderer->initialize())
         return nullptr;
 
     return layerRenderer.release();
 }
 
-LayerRendererChromium::LayerRendererChromium(CCLayerTreeHostImpl* owner,
+LayerRendererChromium::LayerRendererChromium(LayerRendererChromiumClient* client,
                                              PassRefPtr<GraphicsContext3D> context)
-    : m_owner(owner)
+    : m_client(client)
     , m_currentRenderSurface(0)
     , m_offscreenFramebufferId(0)
     , m_context(context)
@@ -181,15 +190,34 @@ LayerRendererChromium::LayerRendererChromium(CCLayerTreeHostImpl* owner,
 {
 }
 
+class ContextLostCallbackAdapter : public GraphicsContext3D::ContextLostCallback {
+public:
+    static PassOwnPtr<ContextLostCallbackAdapter> create(LayerRendererChromiumClient* client)
+    {
+        return adoptPtr(new ContextLostCallbackAdapter(client));
+    }
+
+    virtual void onContextLost()
+    {
+        m_client->didLoseContext();
+    }
+
+private:
+    explicit ContextLostCallbackAdapter(LayerRendererChromiumClient* client)
+        : m_client(client) { }
+
+    LayerRendererChromiumClient* m_client;
+};
+
 bool LayerRendererChromium::initialize()
 {
     if (!m_context->makeContextCurrent())
         return false;
 
-#if USE(SKIA)
+    m_context->setContextLostCallback(ContextLostCallbackAdapter::create(m_client));
+
     if (settings().acceleratePainting && contextSupportsAcceleratedPainting(m_context.get()))
         m_capabilities.usingAcceleratedPainting = true;
-#endif
 
     WebCore::Extensions3D* extensions = m_context->getExtensions();
     m_capabilities.contextHasCachedFrontBuffer = extensions->supports("GL_CHROMIUM_front_buffer_cached");
@@ -285,6 +313,9 @@ void LayerRendererChromium::setVisible(bool visible)
 {
     if (!visible)
         releaseRenderSurfaceTextures();
+
+    // TODO: Replace setVisibilityCHROMIUM with an extension to explicitly manage front/backbuffers
+    // crbug.com/116049
     if (m_capabilities.usingSetVisibility) {
         Extensions3DChromium* extensions3DChromium = static_cast<Extensions3DChromium*>(m_context->getExtensions());
         extensions3DChromium->setVisibilityCHROMIUM(visible);
@@ -448,7 +479,7 @@ void LayerRendererChromium::drawDebugBorderQuad(const CCDebugBorderDrawQuad* qua
     renderMatrix.translate(0.5 * layerRect.width() + layerRect.x(), 0.5 * layerRect.height() + layerRect.y());
     renderMatrix.scaleNonUniform(layerRect.width(), layerRect.height());
     LayerRendererChromium::toGLMatrix(&glMatrix[0], projectionMatrix() * renderMatrix);
-    GLC(context(), context()->uniformMatrix4fv(program->vertexShader().matrixLocation(), false, &glMatrix[0], 1));
+    GLC(context(), context()->uniformMatrix4fv(program->vertexShader().matrixLocation(), 1, false, &glMatrix[0]));
 
     GLC(context(), context()->uniform4f(program->fragmentShader().colorLocation(), quad->color().red() / 255.0, quad->color().green() / 255.0, quad->color().blue() / 255.0, quad->color().alpha() / 255.0));
 
@@ -603,7 +634,7 @@ void LayerRendererChromium::drawTileQuad(const CCTileDrawQuad* quad)
         float edge[24];
         deviceLayerEdges.toFloatArray(edge);
         deviceLayerBounds.toFloatArray(&edge[12]);
-        GLC(context(), context()->uniform3fv(uniforms.edgeLocation, edge, 8));
+        GLC(context(), context()->uniform3fv(uniforms.edgeLocation, 8, edge));
 
         GLC(context(), context()->uniform4f(uniforms.vertexTexTransformLocation, vertexTexTranslateX, vertexTexTranslateY, vertexTexScaleX, vertexTexScaleY));
         GLC(context(), context()->uniform4f(uniforms.fragmentTexTransformLocation, fragmentTexTranslateX, fragmentTexTranslateY, fragmentTexScaleX, fragmentTexScaleY));
@@ -722,8 +753,8 @@ void LayerRendererChromium::drawYUV(const CCVideoDrawQuad* quad)
     GLC(context(), context()->uniform1i(program->fragmentShader().uTextureLocation(), 2));
     GLC(context(), context()->uniform1i(program->fragmentShader().vTextureLocation(), 3));
 
-    GLC(context(), context()->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 0, const_cast<float*>(CCVideoLayerImpl::yuv2RGB), 1));
-    GLC(context(), context()->uniform3fv(program->fragmentShader().yuvAdjLocation(), const_cast<float*>(CCVideoLayerImpl::yuvAdjust), 1));
+    GLC(context(), context()->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 1, 0, const_cast<float*>(CCVideoLayerImpl::yuv2RGB)));
+    GLC(context(), context()->uniform3fv(program->fragmentShader().yuvAdjLocation(), 1, const_cast<float*>(CCVideoLayerImpl::yuvAdjust)));
 
     const IntSize& bounds = quad->quadRect().size();
     drawTexturedQuad(quad->layerTransform(), bounds.width(), bounds.height(), quad->opacity(), FloatQuad(),
@@ -775,7 +806,7 @@ void LayerRendererChromium::drawStreamTexture(const CCVideoDrawQuad* quad)
     const CCVideoLayerImpl::StreamTextureProgram* program = streamTextureLayerProgram();
     GLC(context(), context()->useProgram(program->program()));
     ASSERT(quad->matrix());
-    GLC(context(), context()->uniformMatrix4fv(program->vertexShader().texMatrixLocation(), false, const_cast<float*>(quad->matrix()), 1));
+    GLC(context(), context()->uniformMatrix4fv(program->vertexShader().texMatrixLocation(), 1, false, const_cast<float*>(quad->matrix())));
 
     drawSingleTextureVideoQuad(quad, program, 1, quad->frame()->textureId(), Extensions3DChromium::GL_TEXTURE_EXTERNAL_OES);
 }
@@ -990,7 +1021,7 @@ void LayerRendererChromium::drawTexturedQuad(const TransformationMatrix& drawMat
     // Apply the projection matrix before sending the transform over to the shader.
     toGLMatrix(&glMatrix[0], m_projectionMatrix * renderMatrix);
 
-    GLC(m_context, m_context->uniformMatrix4fv(matrixLocation, false, &glMatrix[0], 1));
+    GLC(m_context, m_context->uniformMatrix4fv(matrixLocation, 1, false, &glMatrix[0]));
 
     if (quadLocation != -1) {
         float point[8];
@@ -1002,7 +1033,7 @@ void LayerRendererChromium::drawTexturedQuad(const TransformationMatrix& drawMat
         point[5] = quad.p3().y();
         point[6] = quad.p4().x();
         point[7] = quad.p4().y();
-        GLC(m_context, m_context->uniform2fv(quadLocation, point, 4));
+        GLC(m_context, m_context->uniform2fv(quadLocation, 4, point));
     }
 
     if (alphaLocation != -1)
@@ -1039,7 +1070,7 @@ void LayerRendererChromium::swapBuffers(const IntRect& subBuffer)
 
 void LayerRendererChromium::onSwapBuffersComplete()
 {
-    m_owner->onSwapBuffersComplete();
+    m_client->onSwapBuffersComplete();
 }
 
 void LayerRendererChromium::getFramebufferPixels(void *pixels, const IntRect& rect)
@@ -1051,8 +1082,44 @@ void LayerRendererChromium::getFramebufferPixels(void *pixels, const IntRect& re
 
     makeContextCurrent();
 
-    GLC(m_context.get(), m_context->readPixels(rect.x(), rect.y(), rect.width(), rect.height(),
-                                         GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, pixels));
+    bool doWorkaround = needsLionIOSurfaceReadbackWorkaround();
+
+    Platform3DObject temporaryTexture = NullPlatform3DObject;
+    Platform3DObject temporaryFBO = NullPlatform3DObject;
+    GraphicsContext3D* context = m_context.get();
+
+    if (doWorkaround) {
+        // On Mac OS X 10.7, calling glReadPixels against an FBO whose color attachment is an
+        // IOSurface-backed texture causes corruption of future glReadPixels calls, even those on
+        // different OpenGL contexts. It is believed that this is the root cause of top crasher
+        // http://crbug.com/99393. <rdar://problem/10949687>
+
+        temporaryTexture = context->createTexture();
+        GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, temporaryTexture));
+        GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR));
+        GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR));
+        GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE));
+        GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE));
+        // Copy the contents of the current (IOSurface-backed) framebuffer into a temporary texture.
+        GLC(context, context->copyTexImage2D(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, 0, 0, rect.maxX(), rect.maxY(), 0));
+        temporaryFBO = context->createFramebuffer();
+        // Attach this texture to an FBO, and perform the readback from that FBO.
+        GLC(context, context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, temporaryFBO));
+        GLC(context, context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, temporaryTexture, 0));
+
+        ASSERT(context->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) == GraphicsContext3D::FRAMEBUFFER_COMPLETE);
+    }
+
+    GLC(context, context->readPixels(rect.x(), rect.y(), rect.width(), rect.height(),
+                                     GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, pixels));
+
+    if (doWorkaround) {
+        // Clean up.
+        GLC(context, context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, 0));
+        GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, 0));
+        GLC(context, context->deleteFramebuffer(temporaryFBO));
+        GLC(context, context->deleteTexture(temporaryTexture));
+    }
 }
 
 ManagedTexture* LayerRendererChromium::getOffscreenLayerTexture()
@@ -1424,12 +1491,12 @@ void LayerRendererChromium::cleanupSharedObjects()
         m_tilerProgram->cleanup(m_context.get());
     if (m_tilerProgramOpaque)
         m_tilerProgramOpaque->cleanup(m_context.get());
-    if (m_tilerProgramAA)
-        m_tilerProgramAA->cleanup(m_context.get());
     if (m_tilerProgramSwizzle)
         m_tilerProgramSwizzle->cleanup(m_context.get());
     if (m_tilerProgramSwizzleOpaque)
         m_tilerProgramSwizzleOpaque->cleanup(m_context.get());
+    if (m_tilerProgramAA)
+        m_tilerProgramAA->cleanup(m_context.get());
     if (m_tilerProgramSwizzleAA)
         m_tilerProgramSwizzleAA->cleanup(m_context.get());
     if (m_canvasLayerProgram)
@@ -1438,18 +1505,24 @@ void LayerRendererChromium::cleanupSharedObjects()
         m_pluginLayerProgram->cleanup(m_context.get());
     if (m_pluginLayerProgramFlip)
         m_pluginLayerProgramFlip->cleanup(m_context.get());
+    if (m_pluginLayerTexRectProgram)
+        m_pluginLayerTexRectProgram->cleanup(m_context.get());
+    if (m_pluginLayerTexRectProgramFlip)
+        m_pluginLayerTexRectProgramFlip->cleanup(m_context.get());
     if (m_renderSurfaceMaskProgram)
         m_renderSurfaceMaskProgram->cleanup(m_context.get());
-    if (m_renderSurfaceMaskProgramAA)
-        m_renderSurfaceMaskProgramAA->cleanup(m_context.get());
     if (m_renderSurfaceProgram)
         m_renderSurfaceProgram->cleanup(m_context.get());
+    if (m_renderSurfaceMaskProgramAA)
+        m_renderSurfaceMaskProgramAA->cleanup(m_context.get());
     if (m_renderSurfaceProgramAA)
         m_renderSurfaceProgramAA->cleanup(m_context.get());
     if (m_videoLayerRGBAProgram)
         m_videoLayerRGBAProgram->cleanup(m_context.get());
     if (m_videoLayerYUVProgram)
         m_videoLayerYUVProgram->cleanup(m_context.get());
+    if (m_videoLayerNativeTextureProgram)
+        m_videoLayerNativeTextureProgram->cleanup(m_context.get());
     if (m_streamTextureLayerProgram)
         m_streamTextureLayerProgram->cleanup(m_context.get());
 
@@ -1457,19 +1530,22 @@ void LayerRendererChromium::cleanupSharedObjects()
     m_headsUpDisplayProgram.clear();
     m_tilerProgram.clear();
     m_tilerProgramOpaque.clear();
-    m_tilerProgramAA.clear();
     m_tilerProgramSwizzle.clear();
     m_tilerProgramSwizzleOpaque.clear();
+    m_tilerProgramAA.clear();
     m_tilerProgramSwizzleAA.clear();
     m_canvasLayerProgram.clear();
     m_pluginLayerProgram.clear();
     m_pluginLayerProgramFlip.clear();
+    m_pluginLayerTexRectProgram.clear();
+    m_pluginLayerTexRectProgramFlip.clear();
     m_renderSurfaceMaskProgram.clear();
-    m_renderSurfaceMaskProgramAA.clear();
     m_renderSurfaceProgram.clear();
+    m_renderSurfaceMaskProgramAA.clear();
     m_renderSurfaceProgramAA.clear();
     m_videoLayerRGBAProgram.clear();
     m_videoLayerYUVProgram.clear();
+    m_videoLayerNativeTextureProgram.clear();
     m_streamTextureLayerProgram.clear();
     if (m_offscreenFramebufferId)
         GLC(m_context.get(), m_context->deleteFramebuffer(m_offscreenFramebufferId));
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index ee9895ae1..91fcf6a51 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -42,7 +42,7 @@
 #include "VideoLayerChromium.h"
 #include "cc/CCCanvasLayerImpl.h"
 #include "cc/CCHeadsUpDisplay.h"
-#include "cc/CCLayerTreeHostImpl.h"
+#include "cc/CCLayerTreeHost.h"
 #include "cc/CCPluginLayerImpl.h"
 #include "cc/CCVideoLayerImpl.h"
 #include <wtf/HashMap.h>
@@ -51,43 +51,47 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/Vector.h>
 
-#if USE(CG)
-#include <CoreGraphics/CGContext.h>
-#include <wtf/RetainPtr.h>
-#endif
-
 namespace WebCore {
 
 class CCHeadsUpDisplay;
 class CCLayerImpl;
-class CCLayerTreeHostImpl;
 class CCRenderPass;
 class GeometryBinding;
 class GraphicsContext3D;
 class TrackingTextureAllocator;
 class LayerRendererSwapBuffersCompleteCallbackAdapter;
 
+class LayerRendererChromiumClient {
+public:
+    virtual const IntSize& viewportSize() const = 0;
+    virtual const CCSettings& settings() const = 0;
+    virtual CCLayerImpl* rootLayer() = 0;
+    virtual const CCLayerImpl* rootLayer() const = 0;
+    virtual void didLoseContext() = 0;
+    virtual void onSwapBuffersComplete() = 0;
+};
+
 // Class that handles drawing of composited render layers using GL.
 class LayerRendererChromium {
     WTF_MAKE_NONCOPYABLE(LayerRendererChromium);
 public:
-    static PassOwnPtr<LayerRendererChromium> create(CCLayerTreeHostImpl*, PassRefPtr<GraphicsContext3D>);
+    static PassOwnPtr<LayerRendererChromium> create(LayerRendererChromiumClient*, PassRefPtr<GraphicsContext3D>);
 
     // Must be called in order to allow the LayerRendererChromium to destruct
     void close();
 
     ~LayerRendererChromium();
 
-    const CCSettings& settings() const { return m_owner->settings(); }
+    const CCSettings& settings() const { return m_client->settings(); }
     const LayerRendererCapabilities& capabilities() const { return m_capabilities; }
 
-    CCLayerImpl* rootLayer() { return m_owner->rootLayer(); }
-    const CCLayerImpl* rootLayer() const { return m_owner->rootLayer(); }
+    CCLayerImpl* rootLayer() { return m_client->rootLayer(); }
+    const CCLayerImpl* rootLayer() const { return m_client->rootLayer(); }
 
     GraphicsContext3D* context();
     bool contextSupportsMapSub() const { return m_capabilities.usingMapSub; }
 
-    const IntSize& viewportSize() { return m_owner->viewportSize(); }
+    const IntSize& viewportSize() { return m_client->viewportSize(); }
     int viewportWidth() { return viewportSize().width(); }
     int viewportHeight() { return viewportSize().height(); }
 
@@ -156,7 +160,7 @@ public:
                           int matrixLocation, int alphaLocation, int quadLocation);
 
 private:
-    LayerRendererChromium(CCLayerTreeHostImpl*, PassRefPtr<GraphicsContext3D>);
+    LayerRendererChromium(LayerRendererChromiumClient*, PassRefPtr<GraphicsContext3D>);
     bool initialize();
 
     void drawQuad(const CCDrawQuad*, const FloatRect& surfaceDamageRect);
@@ -200,7 +204,7 @@ private:
     friend class LayerRendererSwapBuffersCompleteCallbackAdapter;
     void onSwapBuffersComplete();
 
-    CCLayerTreeHostImpl* m_owner;
+    LayerRendererChromiumClient* m_client;
 
     LayerRendererCapabilities m_capabilities;
 
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp
index a6b25c534..c5e38d6aa 100644
--- a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp
+++ b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp
@@ -29,14 +29,10 @@
 
 #include "GraphicsContext.h"
 
-#if USE(SKIA)
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
 #include "SkColorPriv.h"
 #include "skia/ext/platform_canvas.h"
-#elif USE(CG)
-#include <CoreGraphics/CGBitmapContext.h>
-#endif
 
 namespace WebCore {
 
@@ -71,62 +67,39 @@ void PlatformCanvas::createBackingCanvas()
     if (m_size.isEmpty())
         return;
 
-#if USE(SKIA)
     m_skiaCanvas = adoptPtr(skia::CreateBitmapCanvas(m_size.width(), m_size.height(), m_opaque));
-#elif USE(CG)
-    size_t bufferSize = m_size.width() * m_size.height() * 4;
-    m_pixelData = adoptArrayPtr(new uint8_t[bufferSize]);
-    memset(m_pixelData.get(), 0, bufferSize);
-#endif
 }
 
 PlatformCanvas::AutoLocker::AutoLocker(PlatformCanvas* canvas)
     : m_canvas(canvas)
-    , m_pixels(0)
 {
-#if USE(SKIA)
     if (m_canvas->m_skiaCanvas) {
         m_bitmap = &m_canvas->m_skiaCanvas->getDevice()->accessBitmap(false);
         m_bitmap->lockPixels();
-
-        if (m_bitmap->config() == SkBitmap::kARGB_8888_Config)
-            m_pixels = static_cast<uint8_t*>(m_bitmap->getPixels());
     } else
         m_bitmap = 0;
-#elif USE(CG)
-    if (canvas->m_pixelData)
-        m_pixels = &canvas->m_pixelData[0];
-#endif
 }
 
 PlatformCanvas::AutoLocker::~AutoLocker()
 {
-#if USE(SKIA)
     if (m_bitmap)
         m_bitmap->unlockPixels();
-#endif
+}
+
+const uint8_t* PlatformCanvas::AutoLocker::pixels() const
+{
+    if (m_bitmap && m_bitmap->config() == SkBitmap::kARGB_8888_Config)
+        return static_cast<const uint8_t*>(m_bitmap->getPixels());
+    return 0;
 }
 
 PlatformCanvas::Painter::Painter(PlatformCanvas* canvas, PlatformCanvas::Painter::TextOption option)
 {
-#if USE(SKIA)
     m_skiaContext = adoptPtr(new PlatformContextSkia(canvas->m_skiaCanvas.get()));
 
     m_skiaContext->setDrawingToImageBuffer(option == GrayscaleText);
 
     m_context = adoptPtr(new GraphicsContext(reinterpret_cast<PlatformGraphicsContext*>(m_skiaContext.get())));
-#elif USE(CG)
-
-    m_colorSpace = CGColorSpaceCreateDeviceRGB();
-    size_t rowBytes = canvas->size().width() * 4;
-    m_contextCG = CGBitmapContextCreate(canvas->m_pixelData.get(),
-                                        canvas->size().width(), canvas->size().height(), 8, rowBytes,
-                                        m_colorSpace.get(),
-                                        kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host);
-    CGContextTranslateCTM(m_contextCG.get(), 0, canvas->size().height());
-    CGContextScaleCTM(m_contextCG.get(), 1, -1);
-    m_context = adoptPtr(new GraphicsContext(m_contextCG.get()));
-#endif
     context()->save();
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h
index fdee71b9f..865f3d521 100644
--- a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h
+++ b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h
@@ -31,25 +31,13 @@
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 
-#if USE(CG)
-#include <CoreGraphics/CGColorSpace.h>
-#include <CoreGraphics/CGContext.h>
-#include <wtf/OwnArrayPtr.h>
-#include <wtf/RetainPtr.h>
-#endif
-
-#if USE(SKIA)
 class SkBitmap;
 class SkCanvas;
-#endif
 
 namespace WebCore {
 
 class GraphicsContext;
-
-#if USE(SKIA)
 class PlatformContextSkia;
-#endif
 
 // A 2D buffer of pixels with an associated GraphicsContext.
 class PlatformCanvas {
@@ -65,13 +53,10 @@ public:
         explicit AutoLocker(PlatformCanvas*);
         ~AutoLocker();
 
-        const uint8_t* pixels() const { return m_pixels; }
+        const uint8_t* pixels() const;
     private:
         PlatformCanvas* m_canvas;
-#if USE(SKIA)
         const SkBitmap* m_bitmap;
-#endif
-        uint8_t* m_pixels;
     };
 
     // Scoped lock class to get temporary access to paint into this canvas.
@@ -88,12 +73,7 @@ public:
         PlatformContextSkia* skiaContext() const { return m_skiaContext.get(); }
     private:
         OwnPtr<GraphicsContext> m_context;
-#if USE(SKIA)
         OwnPtr<PlatformContextSkia> m_skiaContext;
-#elif USE(CG)
-        RetainPtr<CGColorSpaceRef> m_colorSpace;
-        RetainPtr<CGContextRef> m_contextCG;
-#endif
     };
 
     void resize(const IntSize&);
@@ -105,11 +85,7 @@ public:
 private:
     void createBackingCanvas();
 
-#if USE(SKIA)
     OwnPtr<SkCanvas> m_skiaCanvas;
-#elif USE(CG)
-    OwnArrayPtr<uint8_t> m_pixelData;
-#endif
     IntSize m_size;
     bool m_opaque;
 };
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformColor.h b/Source/WebCore/platform/graphics/chromium/PlatformColor.h
index 2eca5b7d9..ab6545dce 100644
--- a/Source/WebCore/platform/graphics/chromium/PlatformColor.h
+++ b/Source/WebCore/platform/graphics/chromium/PlatformColor.h
@@ -28,10 +28,7 @@
 
 #include "Extensions3D.h"
 #include "GraphicsContext3D.h"
-
-#if USE(SKIA)
 #include "SkTypes.h" 
-#endif
 
 namespace WebCore {
 
@@ -39,11 +36,7 @@ class PlatformColor {
 public:
     static GraphicsContext3D::SourceDataFormat format()
     {
-#if USE(SKIA)
         return SK_B32_SHIFT ? GraphicsContext3D::SourceFormatRGBA8 : GraphicsContext3D::SourceFormatBGRA8;
-#elif USE(CG)
-        return GraphicsContext3D::SourceFormatBGRA8;
-#endif
     }
 
     // Returns the most efficient texture format for this platform.
diff --git a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
index 079ad2ede..97703957f 100644
--- a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
@@ -52,18 +52,7 @@ PluginLayerChromium::PluginLayerChromium()
 {
 }
 
-void PluginLayerChromium::updateCompositorResources(GraphicsContext3D* rendererContext, CCTextureUpdater&)
-{
-    if (!m_needsDisplay)
-        return;
-
-    // PluginLayers are updated externally (outside of the compositor).
-    // |m_dirtyRect| covers the region that has changed since the last composite.
-    m_updateRect = m_dirtyRect;
-    m_dirtyRect = FloatRect();
-}
-
-PassRefPtr<CCLayerImpl> PluginLayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> PluginLayerChromium::createCCLayerImpl()
 {
     return CCPluginLayerImpl::create(m_layerId);
 }
@@ -110,11 +99,5 @@ void PluginLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     pluginLayer->setIOSurfaceProperties(m_ioSurfaceWidth, m_ioSurfaceHeight, m_ioSurfaceId);
 }
 
-void PluginLayerChromium::invalidateRect(const FloatRect& dirtyRect)
-{
-    setNeedsDisplayRect(dirtyRect);
-    m_dirtyRect.unite(dirtyRect);
-}
-
 }
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
index 84365695b..224da814f 100644
--- a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
@@ -37,9 +37,8 @@ namespace WebCore {
 class PluginLayerChromium : public LayerChromium {
 public:
     static PassRefPtr<PluginLayerChromium> create();
-    virtual void updateCompositorResources(GraphicsContext3D*, CCTextureUpdater&);
 
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
 
     // Code path for plugins which supply their own texture ID.
     void setTextureId(unsigned textureId);
@@ -55,8 +54,6 @@ public:
 
     virtual void pushPropertiesTo(CCLayerImpl*);
 
-    void invalidateRect(const FloatRect& dirtyRect);
-
 protected:
     PluginLayerChromium();
 
@@ -67,7 +64,6 @@ private:
     int m_ioSurfaceWidth;
     int m_ioSurfaceHeight;
     uint32_t m_ioSurfaceId;
-    FloatRect m_dirtyRect;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp
new file mode 100644
index 000000000..4f7ef9320
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "ScrollbarLayerChromium.h"
+
+#include "Scrollbar.h"
+#include "cc/CCScrollbarLayerImpl.h"
+
+namespace WebCore {
+
+PassOwnPtr<CCLayerImpl> ScrollbarLayerChromium::createCCLayerImpl()
+{
+    return CCScrollbarLayerImpl::create(id());
+}
+
+PassRefPtr<ScrollbarLayerChromium> ScrollbarLayerChromium::create(Scrollbar* scrollbar, int scrollLayerId)
+{
+    return adoptRef(new ScrollbarLayerChromium(scrollbar, scrollLayerId));
+}
+
+ScrollbarLayerChromium::ScrollbarLayerChromium(Scrollbar* scrollbar, int scrollLayerId)
+    : m_scrollbar(scrollbar)
+    , m_scrollLayerId(scrollLayerId)
+    , m_scrollbarOverlayStyle(scrollbar->scrollbarOverlayStyle())
+    , m_isScrollableAreaActive(scrollbar->isScrollableAreaActive())
+    , m_isScrollViewScrollbar(scrollbar->isScrollViewScrollbar())
+    , m_orientation(scrollbar->orientation())
+    , m_controlSize(scrollbar->controlSize())
+{
+}
+
+void ScrollbarLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
+{
+    LayerChromium::pushPropertiesTo(layer);
+
+    CCScrollbarLayerImpl* scrollbarLayer = static_cast<CCScrollbarLayerImpl*>(layer);
+
+    scrollbarLayer->setScrollbarOverlayStyle(m_scrollbarOverlayStyle);
+
+    Vector<IntRect> tickmarks;
+    m_scrollbar->getTickmarks(tickmarks);
+    scrollbarLayer->setTickmarks(tickmarks);
+
+    scrollbarLayer->setIsScrollableAreaActive(m_isScrollableAreaActive);
+    scrollbarLayer->setIsScrollViewScrollbar(m_isScrollViewScrollbar);
+
+    scrollbarLayer->setOrientation(m_orientation);
+
+    scrollbarLayer->setControlSize(m_controlSize);
+
+    scrollbarLayer->setPressedPart(m_scrollbar->pressedPart());
+    scrollbarLayer->setHoveredPart(m_scrollbar->hoveredPart());
+
+    scrollbarLayer->setEnabled(m_scrollbar->enabled());
+}
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h
new file mode 100644
index 000000000..ad2539e25
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef ScrollbarLayerChromium_h
+#define ScrollbarLayerChromium_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerChromium.h"
+#include "ScrollTypes.h"
+
+namespace WebCore {
+
+class Scrollbar;
+
+class ScrollbarLayerChromium : public LayerChromium {
+public:
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
+    static PassRefPtr<ScrollbarLayerChromium> create(Scrollbar*, int scrollLayerId);
+
+    virtual void pushPropertiesTo(CCLayerImpl*);
+
+    int scrollLayerId() const { return m_scrollLayerId; }
+    virtual ScrollbarLayerChromium* toScrollbarLayerChromium() { return this; }
+
+protected:
+    ScrollbarLayerChromium(Scrollbar*, int scrollLayerId);
+
+private:
+    RefPtr<Scrollbar> m_scrollbar;
+    int m_scrollLayerId;
+
+    ScrollbarOverlayStyle m_scrollbarOverlayStyle;
+    bool m_isScrollableAreaActive;
+    bool m_isScrollViewScrollbar;
+
+    ScrollbarOrientation m_orientation;
+
+    ScrollbarControlSize m_controlSize;
+};
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
index 9499ac7fd..2bd760a99 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
@@ -29,10 +29,7 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "PlatformString.h"
-
-#if USE(SKIA)
 #include "SkColorPriv.h"
-#endif
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp
index 35cd35ad3..5ae7ee6a9 100644
--- a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp
@@ -27,7 +27,6 @@
 #include "config.h"
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
 
 #include "SkPictureCanvasLayerTextureUpdater.h"
 
@@ -75,5 +74,4 @@ void SkPictureCanvasLayerTextureUpdater::setOpaque(bool opaque)
 }
 
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
index ecdefa411..ff839fe32 100644
--- a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
@@ -28,7 +28,6 @@
 #define SkPictureCanvasLayerTextureUpdater_h
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
 
 #include "CanvasLayerTextureUpdater.h"
 #include "SkPicture.h"
@@ -66,6 +65,5 @@ private:
 };
 
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
 #endif // SkPictureCanvasLayerTextureUpdater_h
diff --git a/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.cpp
index ed13546ba..0dc77ada8 100644
--- a/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.cpp
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-PassRefPtr<CCLayerImpl> SolidColorLayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> SolidColorLayerChromium::createCCLayerImpl()
 {
     return CCSolidColorLayerImpl::create(id());
 }
diff --git a/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h b/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h
index 1d14890bd..94a54a0ac 100644
--- a/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h
@@ -38,7 +38,7 @@ class LayerTilerChromium;
 // setBackgroundColor() on the base class.
 class SolidColorLayerChromium : public LayerChromium {
 public:
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
     static PassRefPtr<SolidColorLayerChromium> create();
 
     virtual ~SolidColorLayerChromium();
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
index a9cf7d6fd..0259a23d3 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
@@ -35,6 +35,7 @@
 #include "MathExtras.h"
 #include "Region.h"
 #include "TextStream.h"
+#include "TraceEvent.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCTextureUpdater.h"
 #include "cc/CCTiledLayerImpl.h"
@@ -67,10 +68,10 @@ public:
         m_updateRect = m_dirtyRect;
         m_dirtyRect = IntRect();
     }
+    bool isDirtyForCurrentFrame() { return !m_dirtyRect.isEmpty() && m_updateRect.isEmpty(); }
 
     IntRect m_dirtyRect;
     IntRect m_updateRect;
-    IntRect m_opaqueRect;
     bool m_partialUpdate;
 private:
     explicit UpdatableTile(PassOwnPtr<LayerTextureUpdater::Texture> texture)
@@ -97,7 +98,7 @@ TiledLayerChromium::~TiledLayerChromium()
 {
 }
 
-PassRefPtr<CCLayerImpl> TiledLayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> TiledLayerChromium::createCCLayerImpl()
 {
     return CCTiledLayerImpl::create(id());
 }
@@ -263,10 +264,10 @@ void TiledLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
             invalidTiles.append(tile);
             continue;
         }
-        if (tile->isDirty())
+        if (tile->isDirtyForCurrentFrame())
             continue;
 
-        tiledLayer->pushTileProperties(i, j, tile->managedTexture()->textureId(), tile->m_opaqueRect);
+        tiledLayer->pushTileProperties(i, j, tile->managedTexture()->textureId(), tile->opaqueRect());
     }
     for (Vector<UpdatableTile*>::const_iterator iter = invalidTiles.begin(); iter != invalidTiles.end(); ++iter)
         m_tiler->takeTile((*iter)->i(), (*iter)->j());
@@ -396,17 +397,23 @@ bool TiledLayerChromium::tileNeedsBufferedUpdate(UpdatableTile* tile)
     return true;
 }
 
-void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int right, int bottom)
+// FIXME: This gets rolled into CCOcclusionTracker when we stop passing around Region objects.
+static inline TransformationMatrix contentToLayerTransform(const IntSize& boundsInLayerSpace, const IntSize& boundsInContentSpace)
 {
-    // Reset m_updateRect for all tiles.
-    for (CCLayerTilingData::TileMap::const_iterator iter = m_tiler->tiles().begin(); iter != m_tiler->tiles().end(); ++iter) {
-        UpdatableTile* tile = static_cast<UpdatableTile*>(iter->second.get());
-        tile->m_updateRect = IntRect();
-        tile->m_partialUpdate = false;
-    }
+    TransformationMatrix transform;
+    // Scale from content space to layer space
+    transform.scaleNonUniform(boundsInLayerSpace.width() / static_cast<double>(boundsInContentSpace.width()),
+                              boundsInLayerSpace.height() / static_cast<double>(boundsInContentSpace.height()));
+    return transform;
+}
 
+void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int right, int bottom, const Region& occludedScreenSpace)
+{
     createTextureUpdaterIfNeeded();
 
+    // Tiles are in the layer's content space, the occluded region is in screen space.
+    TransformationMatrix contentToScreenSpace = screenSpaceTransform() * contentToLayerTransform(bounds(), contentBounds());
+
     // Create tiles as needed, expanding a dirty rect to contain all
     // the dirty regions currently being drawn. All dirty tiles that are to be painted
     // get their m_updateRect set to m_dirtyRect and m_dirtyRect cleared. This way if
@@ -418,6 +425,15 @@ void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int
             if (!tile)
                 tile = createTile(i, j);
 
+            // When not idle painting, if the visible region of the tile is occluded, don't reserve a texture or mark it for update.
+            // If any part of the tile is visible, then we need to paint it so the tile is pushed to the impl thread.
+            // This will also avoid painting the tile in the next loop, below.
+            if (!idle) {
+                IntRect visibleTileRect = intersection(m_tiler->tileBounds(i, j), visibleLayerRect());
+                if (occludedScreenSpace.contains(contentToScreenSpace.mapRect(visibleTileRect)))
+                    continue;
+            }
+
             // FIXME: Decide if partial update should be allowed based on cost
             // of update. https://bugs.webkit.org/show_bug.cgi?id=77376
             if (tileOnlyNeedsPartialUpdate(tile) && layerTreeHost() && layerTreeHost()->requestPartialTextureUpdate())
@@ -425,8 +441,10 @@ void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int
             else if (tileNeedsBufferedUpdate(tile) && layerTreeHost())
                 layerTreeHost()->deleteTextureAfterCommit(tile->managedTexture()->steal());
 
-            if (!tile->managedTexture()->isValid(m_tiler->tileSize(), m_textureFormat))
+            if (!tile->managedTexture()->isValid(m_tiler->tileSize(), m_textureFormat)) {
+                // Sets the dirty rect to a full-sized tile with border texels.
                 tile->m_dirtyRect = m_tiler->tileRect(tile);
+            }
 
             if (!tile->managedTexture()->reserve(m_tiler->tileSize(), m_textureFormat)) {
                 m_skipsIdlePaint = true;
@@ -474,24 +492,24 @@ void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int
 
             IntRect tileRect = m_tiler->tileBounds(i, j);
 
+            // Use m_updateRect as copyAndClearDirty above moved the existing dirty rect to m_updateRect if the tile isn't culled.
+            const IntRect& dirtyRect = tile->m_updateRect;
+            if (dirtyRect.isEmpty())
+                continue;
+
             // Save what was painted opaque in the tile. Keep the old area if the paint didn't touch it, and didn't paint some
             // other part of the tile opaque.
             IntRect tilePaintedRect = intersection(tileRect, m_paintRect);
             IntRect tilePaintedOpaqueRect = intersection(tileRect, paintedOpaqueRect);
             if (!tilePaintedRect.isEmpty()) {
-                IntRect paintInsideTileOpaqueRect = intersection(tile->m_opaqueRect, tilePaintedRect);
+                IntRect paintInsideTileOpaqueRect = intersection(tile->opaqueRect(), tilePaintedRect);
                 bool paintInsideTileOpaqueRectIsNonOpaque = !tilePaintedOpaqueRect.contains(paintInsideTileOpaqueRect);
-                bool opaquePaintNotInsideTileOpaqueRect = !tilePaintedOpaqueRect.isEmpty() && !tile->m_opaqueRect.contains(tilePaintedOpaqueRect);
+                bool opaquePaintNotInsideTileOpaqueRect = !tilePaintedOpaqueRect.isEmpty() && !tile->opaqueRect().contains(tilePaintedOpaqueRect);
 
                 if (paintInsideTileOpaqueRectIsNonOpaque || opaquePaintNotInsideTileOpaqueRect)
-                    tile->m_opaqueRect = tilePaintedOpaqueRect;
+                    tile->setOpaqueRect(tilePaintedOpaqueRect);
             }
 
-            // Use m_updateRect as copyAndClearDirty above moved the existing dirty rect to m_updateRect.
-            const IntRect& dirtyRect = tile->m_updateRect;
-            if (dirtyRect.isEmpty())
-                continue;
-
             // sourceRect starts as a full-sized tile with border texels included.
             IntRect sourceRect = m_tiler->tileRect(tile);
             sourceRect.intersect(dirtyRect);
@@ -535,38 +553,26 @@ void TiledLayerChromium::reserveTextures()
     }
 }
 
-void TiledLayerChromium::addSelfToOccludedScreenSpace(Region& occludedScreenSpace)
+Region TiledLayerChromium::opaqueContentsRegion() const
 {
-    if (m_skipsDraw || drawOpacity() != 1 || !isPaintedAxisAlignedInScreen())
-        return;
+    if (m_skipsDraw)
+        return Region();
 
-    if (opaque()) {
-        LayerChromium::addSelfToOccludedScreenSpace(occludedScreenSpace);
-        return;
-    }
-
-    IntRect visibleRect = visibleLayerRect();
-    TransformationMatrix contentTransform = contentToScreenSpaceTransform();
+    return m_tiler->opaqueRegionInLayerRect(visibleLayerRect());
+}
 
-    // FIXME: Create/Use a FloatRegion for the occludedScreenSpace, instead of a Region based on ints, to avoid this step and get better accuracy between layers in target space.
-    Region tileRegion;
-    int left, top, right, bottom;
-    m_tiler->layerRectToTileIndices(visibleLayerRect(), left, top, right, bottom);
-    for (int j = top; j <= bottom; ++j) {
-        for (int i = left; i <= right; ++i) {
-            UpdatableTile* tile = tileAt(i, j);
-            if (tile) {
-                IntRect visibleTileOpaqueRect = intersection(visibleRect, tile->m_opaqueRect);
-                FloatRect screenRect = contentTransform.mapRect(FloatRect(visibleTileOpaqueRect));
-                IntRect screenIntRect = enclosedIntRect(screenRect);
-                if (!screenIntRect.isEmpty())
-                    occludedScreenSpace.unite(screenIntRect);
-            }
-        }
+void TiledLayerChromium::resetUpdateState()
+{
+    // Reset m_updateRect for all tiles.
+    CCLayerTilingData::TileMap::const_iterator end = m_tiler->tiles().end();
+    for (CCLayerTilingData::TileMap::const_iterator iter = m_tiler->tiles().begin(); iter != end; ++iter) {
+        UpdatableTile* tile = static_cast<UpdatableTile*>(iter->second.get());
+        tile->m_updateRect = IntRect();
+        tile->m_partialUpdate = false;
     }
 }
 
-void TiledLayerChromium::prepareToUpdate(const IntRect& layerRect)
+void TiledLayerChromium::prepareToUpdate(const IntRect& layerRect, const Region& occludedScreenSpace)
 {
     m_skipsDraw = false;
     m_skipsIdlePaint = false;
@@ -575,16 +581,18 @@ void TiledLayerChromium::prepareToUpdate(const IntRect& layerRect)
 
     updateBounds();
 
+    resetUpdateState();
+
     if (layerRect.isEmpty() || !m_tiler->numTiles())
         return;
 
     int left, top, right, bottom;
     m_tiler->layerRectToTileIndices(layerRect, left, top, right, bottom);
 
-    prepareToUpdateTiles(false, left, top, right, bottom);
+    prepareToUpdateTiles(false, left, top, right, bottom, occludedScreenSpace);
 }
 
-void TiledLayerChromium::prepareToUpdateIdle(const IntRect& layerRect)
+void TiledLayerChromium::prepareToUpdateIdle(const IntRect& layerRect, const Region& occludedScreenSpace)
 {
     // Abort if we have already prepared a paint or run out of memory.
     if (m_skipsIdlePaint || !m_paintRect.isEmpty())
@@ -602,33 +610,39 @@ void TiledLayerChromium::prepareToUpdateIdle(const IntRect& layerRect)
     IntRect idlePaintLayerRect = idlePaintRect(layerRect);
     protectTileTextures(idlePaintLayerRect);
 
-    // Expand outwards until we find a dirty row or column to update.
     int left, top, right, bottom;
     m_tiler->layerRectToTileIndices(layerRect, left, top, right, bottom);
+
+    // Prepaint anything that was occluded but inside the layer's visible region.
+    prepareToUpdateTiles(true, left, top, right, bottom, occludedScreenSpace);
+    if (!m_paintRect.isEmpty() || m_skipsIdlePaint)
+        return;
+
+    // Expand outwards until we find a dirty row or column to update.
     int prepaintLeft, prepaintTop, prepaintRight, prepaintBottom;
     m_tiler->layerRectToTileIndices(idlePaintLayerRect, prepaintLeft, prepaintTop, prepaintRight, prepaintBottom);
     while (!m_skipsIdlePaint && (left > prepaintLeft || top > prepaintTop || right < prepaintRight || bottom < prepaintBottom)) {
         if (bottom < prepaintBottom) {
             ++bottom;
-            prepareToUpdateTiles(true, left, bottom, right, bottom);
+            prepareToUpdateTiles(true, left, bottom, right, bottom, occludedScreenSpace);
             if (!m_paintRect.isEmpty() || m_skipsIdlePaint)
                 break;
         }
         if (top > prepaintTop) {
             --top;
-            prepareToUpdateTiles(true, left, top, right, top);
+            prepareToUpdateTiles(true, left, top, right, top, occludedScreenSpace);
             if (!m_paintRect.isEmpty() || m_skipsIdlePaint)
                 break;
         }
         if (left > prepaintLeft) {
             --left;
-            prepareToUpdateTiles(true, left, top, left, bottom);
+            prepareToUpdateTiles(true, left, top, left, bottom, occludedScreenSpace);
             if (!m_paintRect.isEmpty() || m_skipsIdlePaint)
                 break;
         }
         if (right < prepaintRight) {
             ++right;
-            prepareToUpdateTiles(true, right, top, right, bottom);
+            prepareToUpdateTiles(true, right, top, right, bottom, occludedScreenSpace);
             if (!m_paintRect.isEmpty() || m_skipsIdlePaint)
                 break;
         }
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
index 2d9995367..6ff901dfd 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
@@ -66,7 +66,7 @@ public:
 
     virtual void reserveTextures();
 
-    virtual void addSelfToOccludedScreenSpace(Region& occludedScreenSpace);
+    virtual Region opaqueContentsRegion() const;
 
 protected:
     TiledLayerChromium();
@@ -86,11 +86,14 @@ protected:
     // Set invalidations to be potentially repainted during update().
     void invalidateRect(const IntRect& layerRect);
 
+    // Reset state on tiles that will be used for updating the layer.
+    void resetUpdateState();
+
     // Prepare data needed to update textures that intersect with layerRect.
-    void prepareToUpdate(const IntRect& layerRect);
+    void prepareToUpdate(const IntRect& layerRect, const Region& occludedTargetSpace);
 
     // Same as above, but this will try to paint additional surrounding content if idle.
-    void prepareToUpdateIdle(const IntRect& layerRect);
+    void prepareToUpdateIdle(const IntRect& layerRect, const Region& occludedTargetSpace);
 
     // After preparing an update, returns true if more pre-painting is needed.
     bool needsIdlePaint(const IntRect& layerRect);
@@ -102,7 +105,7 @@ protected:
     virtual TextureManager* textureManager() const;
 
 private:
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
 
     void createTilerIfNeeded();
     void setTilingOption(TilingOption);
@@ -110,7 +113,7 @@ private:
     bool tileOnlyNeedsPartialUpdate(UpdatableTile*);
     bool tileNeedsBufferedUpdate(UpdatableTile*);
 
-    void prepareToUpdateTiles(bool idle, int left, int top, int right, int bottom);
+    void prepareToUpdateTiles(bool idle, int left, int top, int right, int bottom, const Region& occludedTargetSpace);
     IntRect idlePaintRect(const IntRect& visibleLayerRect);
 
     UpdatableTile* tileAt(int, int) const;
diff --git a/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp b/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
index fb749255e..432ca78bd 100644
--- a/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
@@ -109,7 +109,7 @@ class TransparencyWin::OwnedBuffers {
 public:
     OwnedBuffers(const IntSize& size, bool needReferenceBuffer)
     {
-        m_destBitmap = ImageBuffer::create(size);
+        m_destBitmap = ImageBuffer::create(size, 1);
 
         if (needReferenceBuffer) {
             m_referenceBitmap.setConfig(SkBitmap::kARGB_8888_Config, size.width(), size.height());
@@ -127,7 +127,7 @@ public:
     // Returns whether the current layer will fix a buffer of the given size.
     bool canHandleSize(const IntSize& size) const
     {
-        return m_destBitmap->size().width() >= size.width() && m_destBitmap->size().height() >= size.height();
+        return m_destBitmap->internalSize().width() >= size.width() && m_destBitmap->internalSize().height() >= size.height();
     }
 
 private:
diff --git a/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp b/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp
index d0fd0ce52..07f04b372 100644
--- a/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp
@@ -28,68 +28,88 @@
 #include "TreeSynchronizer.h"
 
 #include "LayerChromium.h"
+#include "ScrollbarLayerChromium.h"
 #include "cc/CCLayerImpl.h"
+#include "cc/CCScrollbarLayerImpl.h"
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-void TreeSynchronizer::addCCLayerImplsToMapRecursive(CCLayerImplMap& map, CCLayerImpl* ccLayerImpl)
+PassOwnPtr<CCLayerImpl> TreeSynchronizer::synchronizeTrees(LayerChromium* layerChromiumRoot, PassOwnPtr<CCLayerImpl> oldCCLayerImplRoot)
 {
-    map.set(ccLayerImpl->id(), ccLayerImpl);
+    OwnPtrCCLayerImplMap oldLayers;
+    RawPtrCCLayerImplMap newLayers;
 
-    const Vector<RefPtr<CCLayerImpl> >& children = ccLayerImpl->children();
+    collectExistingCCLayerImplRecursive(oldLayers, oldCCLayerImplRoot);
+
+    OwnPtr<CCLayerImpl> newTree = synchronizeTreeRecursive(newLayers, oldLayers, layerChromiumRoot);
+
+    updateScrollbarLayerPointersRecursive(newLayers, layerChromiumRoot);
+
+    return newTree.release();
+}
+
+void TreeSynchronizer::collectExistingCCLayerImplRecursive(OwnPtrCCLayerImplMap& oldLayers, PassOwnPtr<CCLayerImpl> popCCLayerImpl)
+{
+    OwnPtr<CCLayerImpl> ccLayerImpl = popCCLayerImpl;
+
+    if (!ccLayerImpl)
+        return;
+
+    Vector<OwnPtr<CCLayerImpl> >& children = ccLayerImpl->m_children;
     for (size_t i = 0; i < children.size(); ++i)
-        addCCLayerImplsToMapRecursive(map, children[i].get());
+        collectExistingCCLayerImplRecursive(oldLayers, children[i].release());
 
-    if (CCLayerImpl* maskLayer = ccLayerImpl->maskLayer())
-        addCCLayerImplsToMapRecursive(map, maskLayer);
+    collectExistingCCLayerImplRecursive(oldLayers, ccLayerImpl->m_maskLayer.release());
+    collectExistingCCLayerImplRecursive(oldLayers, ccLayerImpl->m_replicaLayer.release());
 
-    if (CCLayerImpl* replicaLayer = ccLayerImpl->replicaLayer())
-        addCCLayerImplsToMapRecursive(map, replicaLayer);
+    int id = ccLayerImpl->id();
+    oldLayers.set(id, ccLayerImpl.release());
 }
 
-PassRefPtr<CCLayerImpl> TreeSynchronizer::synchronizeTreeRecursive(LayerChromium* layer, CCLayerImplMap& map)
+PassOwnPtr<CCLayerImpl> TreeSynchronizer::reuseOrCreateCCLayerImpl(RawPtrCCLayerImplMap& newLayers, OwnPtrCCLayerImplMap& oldLayers, LayerChromium* layer)
 {
-    RefPtr<CCLayerImpl> ccLayerImpl;
-    CCLayerImplMap::iterator it = map.find(layer->id());
-    if (it != map.end()) {
-        ccLayerImpl = it->second; // We already have an entry for this, we just need to reparent it.
-        ccLayerImpl->clearChildList();
-    } else {
+    OwnPtr<CCLayerImpl> ccLayerImpl = oldLayers.take(layer->id());
+
+    if (!ccLayerImpl)
         ccLayerImpl = layer->createCCLayerImpl();
-        map.set(layer->id(), ccLayerImpl); // Add it to the map so other layers referencing this one can pick it up.
-    }
 
+    newLayers.set(layer->id(), ccLayerImpl.get());
+    return ccLayerImpl.release();
+}
+
+PassOwnPtr<CCLayerImpl> TreeSynchronizer::synchronizeTreeRecursive(RawPtrCCLayerImplMap& newLayers, OwnPtrCCLayerImplMap& oldLayers, LayerChromium* layer)
+{
+    if (!layer)
+        return nullptr;
+
+    OwnPtr<CCLayerImpl> ccLayerImpl = reuseOrCreateCCLayerImpl(newLayers, oldLayers, layer);
+
+    ccLayerImpl->clearChildList();
     const Vector<RefPtr<LayerChromium> >& children = layer->children();
     for (size_t i = 0; i < children.size(); ++i)
-        ccLayerImpl->addChild(synchronizeTreeRecursive(children[i].get(), map));
-
-    if (LayerChromium* maskLayer = layer->maskLayer())
-        ccLayerImpl->setMaskLayer(synchronizeTreeRecursive(maskLayer, map));
-    else
-        ccLayerImpl->setMaskLayer(0);
+        ccLayerImpl->addChild(synchronizeTreeRecursive(newLayers, oldLayers, children[i].get()));
 
-    if (LayerChromium* replicaLayer = layer->replicaLayer())
-        ccLayerImpl->setReplicaLayer(synchronizeTreeRecursive(replicaLayer, map));
-    else
-        ccLayerImpl->setReplicaLayer(0);
+    ccLayerImpl->setMaskLayer(synchronizeTreeRecursive(newLayers, oldLayers, layer->maskLayer()));
+    ccLayerImpl->setReplicaLayer(synchronizeTreeRecursive(newLayers, oldLayers, layer->replicaLayer()));
 
     layer->pushPropertiesTo(ccLayerImpl.get());
     return ccLayerImpl.release();
 }
 
-PassRefPtr<CCLayerImpl> TreeSynchronizer::synchronizeTrees(LayerChromium* layerChromiumRoot, PassRefPtr<CCLayerImpl> prpOldCCLayerImplRoot)
+void TreeSynchronizer::updateScrollbarLayerPointersRecursive(const RawPtrCCLayerImplMap& newLayers, LayerChromium* layer)
 {
-    RefPtr<CCLayerImpl> oldCCLayerImplRoot = prpOldCCLayerImplRoot;
-    // Build a map from layer IDs to CCLayerImpls so we can reuse layers from the old tree.
-    CCLayerImplMap map;
-    if (oldCCLayerImplRoot)
-        addCCLayerImplsToMapRecursive(map, oldCCLayerImplRoot.get());
+    const Vector<RefPtr<LayerChromium> >& children = layer->children();
+    for (size_t i = 0; i < children.size(); ++i)
+        updateScrollbarLayerPointersRecursive(newLayers, children[i].get());
 
-    // Recursively build the new layer tree.
-    RefPtr<CCLayerImpl> newCCLayerImplRoot = synchronizeTreeRecursive(layerChromiumRoot, map);
+    ScrollbarLayerChromium* scrollbarLayer = layer->toScrollbarLayerChromium();
+    if (!scrollbarLayer)
+        return;
 
-    return newCCLayerImplRoot.release();
+    CCScrollbarLayerImpl* ccScrollbarLayerImpl = static_cast<CCScrollbarLayerImpl*>(newLayers.get(scrollbarLayer->id()));
+    ASSERT(ccScrollbarLayerImpl);
+    ccScrollbarLayerImpl->setScrollLayer(newLayers.get(scrollbarLayer->scrollLayerId()));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.h b/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.h
index a4e494217..1dbeb8bed 100644
--- a/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.h
+++ b/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.h
@@ -28,7 +28,8 @@
 
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
-#include <wtf/PassRefPtr.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -40,16 +41,19 @@ WTF_MAKE_NONCOPYABLE(TreeSynchronizer);
 public:
     // Accepts a LayerChromium tree and returns a reference to a CCLayerImpl tree that duplicates the structure
     // of the LayerChromium tree, reusing the CCLayerImpls in the tree provided by oldCCLayerImplRoot if possible.
-    static PassRefPtr<CCLayerImpl> synchronizeTrees(LayerChromium* layerRoot, PassRefPtr<CCLayerImpl> oldCCLayerImplRoot);
+    static PassOwnPtr<CCLayerImpl> synchronizeTrees(LayerChromium* layerRoot, PassOwnPtr<CCLayerImpl> oldCCLayerImplRoot);
 
 private:
     TreeSynchronizer(); // Not instantiable.
 
-    typedef HashMap<int, RefPtr<CCLayerImpl> > CCLayerImplMap;
+    typedef HashMap<int, OwnPtr<CCLayerImpl> > OwnPtrCCLayerImplMap;
+    typedef HashMap<int, CCLayerImpl*> RawPtrCCLayerImplMap;
 
     // Declared as static member functions so they can access functions on LayerChromium as a friend class.
-    static void addCCLayerImplsToMapRecursive(CCLayerImplMap&, CCLayerImpl*);
-    static PassRefPtr<CCLayerImpl> synchronizeTreeRecursive(LayerChromium*, CCLayerImplMap&);
+    static PassOwnPtr<CCLayerImpl> reuseOrCreateCCLayerImpl(RawPtrCCLayerImplMap& newLayers, OwnPtrCCLayerImplMap& oldLayers, LayerChromium*);
+    static void collectExistingCCLayerImplRecursive(OwnPtrCCLayerImplMap& oldLayers, PassOwnPtr<CCLayerImpl>);
+    static PassOwnPtr<CCLayerImpl> synchronizeTreeRecursive(RawPtrCCLayerImplMap& newLayers, OwnPtrCCLayerImplMap& oldLayers, LayerChromium*);
+    static void updateScrollbarLayerPointersRecursive(const RawPtrCCLayerImplMap& newLayers, LayerChromium*);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
index 3b44eda38..e6911981e 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
@@ -52,17 +52,11 @@ VideoLayerChromium::~VideoLayerChromium()
 {
 }
 
-PassRefPtr<CCLayerImpl> VideoLayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> VideoLayerChromium::createCCLayerImpl()
 {
     return CCVideoLayerImpl::create(m_layerId, m_provider);
 }
 
-void VideoLayerChromium::contentChanged()
-{
-    m_updateRect = FloatRect(FloatPoint(), contentBounds());
-    setNeedsDisplay();
-}
-
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
index 65cf5c668..1f2e92012 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
@@ -48,9 +48,7 @@ public:
     static PassRefPtr<VideoLayerChromium> create(VideoFrameProvider* = 0);
     virtual ~VideoLayerChromium();
 
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
-
-    void contentChanged();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
 
 private:
     explicit VideoLayerChromium(VideoFrameProvider*);
diff --git a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
index 74db7f13e..e3e19e258 100644
--- a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
@@ -54,6 +54,7 @@ WebGLLayerChromium::WebGLLayerChromium()
     , m_textureId(0)
     , m_textureChanged(true)
     , m_textureUpdated(false)
+    , m_contextLost(false)
     , m_drawingBuffer(0)
 {
 }
@@ -66,17 +67,23 @@ WebGLLayerChromium::~WebGLLayerChromium()
 
 bool WebGLLayerChromium::drawsContent() const
 {
-    return LayerChromium::drawsContent() && context() && (context()->getExtensions()->getGraphicsResetStatusARB() == GraphicsContext3D::NO_ERROR);
+    return LayerChromium::drawsContent() && !m_contextLost;
 }
 
-void WebGLLayerChromium::updateCompositorResources(GraphicsContext3D* rendererContext, CCTextureUpdater&)
+void WebGLLayerChromium::paintContentsIfDirty(const Region&)
 {
-    if (!drawsContent())
+    if (!drawsContent() || !m_needsDisplay || !m_textureUpdated)
         return;
 
-    if (!m_needsDisplay)
-        return;
+    drawingBuffer()->publishToPlatformLayer();
+    context()->markLayerComposited();
+    m_needsDisplay = false;
+    m_textureUpdated = false;
+    m_contextLost = context()->getExtensions()->getGraphicsResetStatusARB() != GraphicsContext3D::NO_ERROR;
+}
 
+void WebGLLayerChromium::updateCompositorResources(GraphicsContext3D* rendererContext, CCTextureUpdater&)
+{
     if (m_textureChanged) {
         rendererContext->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textureId);
         // Set the min-mag filters to linear and wrap modes to GL_CLAMP_TO_EDGE
@@ -87,15 +94,6 @@ void WebGLLayerChromium::updateCompositorResources(GraphicsContext3D* rendererCo
         rendererContext->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
         m_textureChanged = false;
     }
-    // Update the contents of the texture used by the compositor.
-    if (m_needsDisplay && m_textureUpdated) {
-        // publishToPlatformLayer prepares the contents of the off-screen render target for use by the compositor.
-        drawingBuffer()->publishToPlatformLayer();
-        context()->markLayerComposited();
-        m_updateRect = FloatRect(FloatPoint(), bounds());
-        m_needsDisplay = false;
-        m_textureUpdated = false;
-    }
 }
 
 void WebGLLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
@@ -110,26 +108,35 @@ void WebGLLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
 
 bool WebGLLayerChromium::paintRenderedResultsToCanvas(ImageBuffer* imageBuffer)
 {
-    if (m_textureUpdated || !layerRendererContext() || !drawsContent())
+    if (m_textureUpdated || !m_drawingBuffer || !drawsContent())
         return false;
 
     IntSize framebufferSize = context()->getInternalFramebufferSize();
-    ASSERT(layerRendererContext());
 
-    // This would ideally be done in the webgl context, but that isn't possible yet.
-    Platform3DObject framebuffer = layerRendererContext()->createFramebuffer();
-    layerRendererContext()->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, framebuffer);
-    layerRendererContext()->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_textureId, 0);
+    // Since we're using the same context as WebGL, we have to restore any state we change (in this case, just the framebuffer binding).
+    // FIXME: The WebGLRenderingContext tracks the current framebuffer binding, it would be slightly more efficient to use this value
+    // rather than querying it off of the context.
+    GC3Dint previousFramebuffer = 0;
+    context()->getIntegerv(GraphicsContext3D::FRAMEBUFFER_BINDING, &previousFramebuffer);
+
+    Platform3DObject framebuffer = context()->createFramebuffer();
+    context()->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, framebuffer);
+    context()->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_textureId, 0);
 
-    Extensions3DChromium* extensions = static_cast<Extensions3DChromium*>(layerRendererContext()->getExtensions());
+    Extensions3DChromium* extensions = static_cast<Extensions3DChromium*>(context()->getExtensions());
     extensions->paintFramebufferToCanvas(framebuffer, framebufferSize.width(), framebufferSize.height(), !context()->getContextAttributes().premultipliedAlpha, imageBuffer);
-    layerRendererContext()->deleteFramebuffer(framebuffer);
+    context()->deleteFramebuffer(framebuffer);
+
+    context()->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, previousFramebuffer);
     return true;
 }
 
-void WebGLLayerChromium::contentChanged()
+void WebGLLayerChromium::setNeedsDisplayRect(const FloatRect& dirtyRect)
 {
+    LayerChromium::setNeedsDisplayRect(dirtyRect);
+
     m_textureUpdated = true;
+
     // If WebGL commands are issued outside of a the animation callbacks, then use
     // call rateLimitOffscreenContextCHROMIUM() to keep the context from getting too far ahead.
     if (layerTreeHost())
@@ -161,6 +168,7 @@ void WebGLLayerChromium::setDrawingBuffer(DrawingBuffer* drawingBuffer)
     GraphicsContext3D::Attributes attributes = context()->getContextAttributes();
     m_hasAlpha = attributes.alpha;
     m_premultipliedAlpha = attributes.premultipliedAlpha;
+    m_contextLost = context()->getExtensions()->getGraphicsResetStatusARB() != GraphicsContext3D::NO_ERROR;
 }
 
 GraphicsContext3D* WebGLLayerChromium::context() const
@@ -171,15 +179,6 @@ GraphicsContext3D* WebGLLayerChromium::context() const
     return 0;
 }
 
-GraphicsContext3D* WebGLLayerChromium::layerRendererContext()
-{
-    // FIXME: In the threaded case, paintRenderedResultsToCanvas must be
-    // refactored to be asynchronous. Currently this is unimplemented.
-    if (!layerTreeHost() || CCProxy::hasImplThread())
-        return 0;
-    return layerTreeHost()->context();
-}
-
 }
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
index 4dc68a330..af138fa1e 100644
--- a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
@@ -53,9 +53,10 @@ public:
     void setTextureId(unsigned textureId) { m_textureId = textureId; }
 
     virtual bool drawsContent() const;
+    virtual void paintContentsIfDirty(const Region&);
     virtual void updateCompositorResources(GraphicsContext3D*, CCTextureUpdater&);
     virtual void pushPropertiesTo(CCLayerImpl*);
-    virtual void contentChanged();
+    virtual void setNeedsDisplayRect(const FloatRect&);
     bool paintRenderedResultsToCanvas(ImageBuffer*);
 
     GraphicsContext3D* context() const;
@@ -66,13 +67,12 @@ private:
     WebGLLayerChromium();
     friend class WebGLLayerChromiumRateLimitTask;
 
-    GraphicsContext3D* layerRendererContext();
-
     bool m_hasAlpha;
     bool m_premultipliedAlpha;
     unsigned m_textureId;
     bool m_textureChanged;
     bool m_textureUpdated;
+    bool m_contextLost;
 
     // The DrawingBuffer holding the WebGL contents for this layer.
     // A reference is not held here, because the DrawingBuffer already holds
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp
new file mode 100644
index 000000000..556e46b4e
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCActiveGestureAnimation.h"
+
+#include "cc/CCGestureCurve.h"
+
+namespace WebCore {
+
+PassOwnPtr<CCActiveGestureAnimation> CCActiveGestureAnimation::create(double startTime, PassOwnPtr<CCGestureCurve> curve, CCGestureCurveTarget* target)
+{
+    return adoptPtr(new CCActiveGestureAnimation(startTime, curve, target));
+}
+
+CCActiveGestureAnimation::CCActiveGestureAnimation(double startTime, PassOwnPtr<CCGestureCurve> curve, CCGestureCurveTarget* target)
+    : m_startTime(startTime)
+    , m_gestureCurve(curve)
+    , m_gestureCurveTarget(target)
+{
+}
+
+CCActiveGestureAnimation::~CCActiveGestureAnimation()
+{
+}
+
+bool CCActiveGestureAnimation::animate(double time)
+{
+    // CCGestureCurves used zero-based time, so subtract start-time.
+    return m_gestureCurve->apply(time - m_startTime, m_gestureCurveTarget);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.h b/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.h
new file mode 100644
index 000000000..c71b225df
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCActiveGestureAnimation_h
+#define CCActiveGestureAnimation_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class CCGestureCurve;
+class CCGestureCurveTarget;
+
+class CCActiveGestureAnimation {
+    WTF_MAKE_NONCOPYABLE(CCActiveGestureAnimation);
+public:
+    static PassOwnPtr<CCActiveGestureAnimation> create(double startTime, PassOwnPtr<CCGestureCurve>, CCGestureCurveTarget*);
+    ~CCActiveGestureAnimation();
+
+    bool animate(double time);
+
+private:
+    CCActiveGestureAnimation(double startTime, PassOwnPtr<CCGestureCurve>, CCGestureCurveTarget*);
+
+    double m_startTime;
+    OwnPtr<CCGestureCurve> m_gestureCurve;
+    CCGestureCurveTarget* m_gestureCurveTarget;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.cpp
new file mode 100644
index 000000000..9f41844ca
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCAnimationEvents.h"
+
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+CCAnimationEvent::CCAnimationEvent(int layerId)
+    : m_layerId(layerId)
+{
+}
+
+CCAnimationEvent::~CCAnimationEvent()
+{
+}
+
+const CCAnimationStartedEvent* CCAnimationEvent::toAnimationStartedEvent() const
+{
+    ASSERT(type() == Started);
+    return static_cast<const CCAnimationStartedEvent*>(this);
+}
+
+const CCAnimationFinishedEvent* CCAnimationEvent::toAnimationFinishedEvent() const
+{
+    ASSERT(type() == Finished);
+    return static_cast<const CCAnimationFinishedEvent*>(this);
+}
+
+PassOwnPtr<CCAnimationStartedEvent> CCAnimationStartedEvent::create(int layerId)
+{
+    return adoptPtr(new CCAnimationStartedEvent(layerId));
+}
+
+CCAnimationStartedEvent::CCAnimationStartedEvent(int layerId)
+    : CCAnimationEvent(layerId)
+{
+}
+
+CCAnimationStartedEvent::~CCAnimationStartedEvent()
+{
+}
+
+CCAnimationEvent::Type CCAnimationStartedEvent::type() const
+{
+    return Started;
+}
+
+PassOwnPtr<CCAnimationFinishedEvent> CCAnimationFinishedEvent::create(int layerId, int animationId)
+{
+    return adoptPtr(new CCAnimationFinishedEvent(layerId, animationId));
+}
+
+CCAnimationFinishedEvent::CCAnimationFinishedEvent(int layerId, int animationId)
+    : CCAnimationEvent(layerId)
+    , m_animationId(animationId)
+{
+}
+
+CCAnimationFinishedEvent::~CCAnimationFinishedEvent()
+{
+}
+
+CCAnimationEvent::Type CCAnimationFinishedEvent::type() const
+{
+    return Finished;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h
index b21a79e31..da94e1e27 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h
@@ -25,20 +25,65 @@
 #ifndef CCAnimationEvents_h
 #define CCAnimationEvents_h
 
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
+class CCAnimationStartedEvent;
+class CCAnimationFinishedEvent;
+
+class CCAnimationEvent {
+public:
+    enum Type { Started, Finished };
+
+    virtual ~CCAnimationEvent();
+
+    virtual Type type() const = 0;
+
+    int layerId() const { return m_layerId; }
+
+    const CCAnimationStartedEvent* toAnimationStartedEvent() const;
+    const CCAnimationFinishedEvent* toAnimationFinishedEvent() const;
+
+protected:
+    CCAnimationEvent(int layerId);
+
+private:
+    int m_layerId;
+};
+
+// Indicates that an animation has started on a particular layer.
+class CCAnimationStartedEvent : public CCAnimationEvent {
+public:
+    static PassOwnPtr<CCAnimationStartedEvent> create(int layerId);
+
+    virtual ~CCAnimationStartedEvent();
+
+    virtual Type type() const;
+
+private:
+    explicit CCAnimationStartedEvent(int layerId);
+};
+
 // Indicates that an animation has started on a particular layer.
-struct CCAnimationStartedEvent {
-    CCAnimationStartedEvent(int layerID, double time)
-        : layerID(layerID)
-        , time(time) { }
-    int layerID;
-    double time;
+class CCAnimationFinishedEvent : public CCAnimationEvent {
+public:
+    static PassOwnPtr<CCAnimationFinishedEvent> create(int layerId, int animationId);
+
+    virtual ~CCAnimationFinishedEvent();
+
+    virtual Type type() const;
+
+    int animationId() const { return m_animationId; }
+
+private:
+    CCAnimationFinishedEvent(int layerId, int animationId);
+
+    int m_animationId;
 };
 
-typedef Vector<CCAnimationStartedEvent> CCAnimationEventsVector;
+typedef Vector<OwnPtr<CCAnimationEvent> > CCAnimationEventsVector;
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
index 9126a7d44..c96af246e 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
@@ -34,9 +34,9 @@ namespace WebCore {
 
 class CCCanvasLayerImpl : public CCLayerImpl {
 public:
-    static PassRefPtr<CCCanvasLayerImpl> create(int id)
+    static PassOwnPtr<CCCanvasLayerImpl> create(int id)
     {
-        return adoptRef(new CCCanvasLayerImpl(id));
+        return adoptPtr(new CCCanvasLayerImpl(id));
     }
     virtual ~CCCanvasLayerImpl();
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp
index 2d6f43f31..6a062caca 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp
@@ -56,7 +56,7 @@ CCDamageTracker::~CCDamageTracker()
 {
 }
 
-void CCDamageTracker::updateDamageTrackingState(const Vector<RefPtr<CCLayerImpl> >& layerList, int targetSurfaceLayerID, CCLayerImpl* targetSurfaceMaskLayer)
+void CCDamageTracker::updateDamageTrackingState(const Vector<CCLayerImpl*>& layerList, int targetSurfaceLayerID, CCLayerImpl* targetSurfaceMaskLayer)
 {
     //
     // This function computes the "damage rect" of a target surface, and updates the state
@@ -130,7 +130,7 @@ void CCDamageTracker::updateDamageTrackingState(const Vector<RefPtr<CCLayerImpl>
 
     // If the target surface already knows its entire region is damaged, we can return early.
     // FIXME: this should go away, or will be cleaner, after refactoring into RenderPass/RenderSchedule.
-    CCLayerImpl* layer = layerList[0].get();
+    CCLayerImpl* layer = layerList[0];
     CCRenderSurface* targetSurface = layer->targetRenderSurface();
 
     if (m_forceFullDamageNextUpdate || targetSurface->surfacePropertyChangedOnlyFromDescendant()) {
@@ -161,12 +161,12 @@ void CCDamageTracker::saveRectForNextFrame(int layerID, const FloatRect& targetS
     m_nextRectHistory->set(layerID, targetSpaceRect);
 }
 
-FloatRect CCDamageTracker::trackDamageFromActiveLayers(const Vector<RefPtr<CCLayerImpl> >& layerList, int targetSurfaceLayerID)
+FloatRect CCDamageTracker::trackDamageFromActiveLayers(const Vector<CCLayerImpl*>& layerList, int targetSurfaceLayerID)
 {
     FloatRect damageRect = FloatRect();
 
     for (unsigned layerIndex = 0; layerIndex < layerList.size(); ++layerIndex) {
-        CCLayerImpl* layer = layerList[layerIndex].get();
+        CCLayerImpl* layer = layerList[layerIndex];
 
         if (CCLayerTreeHostCommon::renderSurfaceContributesToTarget<CCLayerImpl>(layer, targetSurfaceLayerID))
             extendDamageForRenderSurface(layer, damageRect);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
index d428f26d1..7a629c478 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
@@ -44,13 +44,13 @@ public:
     ~CCDamageTracker();
 
     void forceFullDamageNextUpdate() { m_forceFullDamageNextUpdate = true; }
-    void updateDamageTrackingState(const Vector<RefPtr<CCLayerImpl> >& layerList, int targetSurfaceLayerID, CCLayerImpl* targetSurfaceMaskLayer);
+    void updateDamageTrackingState(const Vector<CCLayerImpl*>& layerList, int targetSurfaceLayerID, CCLayerImpl* targetSurfaceMaskLayer);
     const FloatRect& currentDamageRect() { return m_currentDamageRect; }
 
 private:
     CCDamageTracker();
 
-    FloatRect trackDamageFromActiveLayers(const Vector<RefPtr<CCLayerImpl> >& layerList, int targetSurfaceLayerID);
+    FloatRect trackDamageFromActiveLayers(const Vector<CCLayerImpl*>& layerList, int targetSurfaceLayerID);
     FloatRect trackDamageFromSurfaceMask(CCLayerImpl* targetSurfaceMaskLayer);
     FloatRect trackDamageFromLeftoverRects();
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCGestureCurve.h b/Source/WebCore/platform/graphics/chromium/cc/CCGestureCurve.h
new file mode 100644
index 000000000..3ef935b6a
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCGestureCurve.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCGestureCurve_h
+#define CCGestureCurve_h
+
+namespace WebCore {
+
+class IntPoint;
+
+class CCGestureCurveTarget {
+public:
+    virtual void setScrollIncrement(const IntPoint&) = 0;
+    // FIXME: add interfaces for setScroll(), setPageScaleAndScroll(), etc.
+
+protected:
+    virtual ~CCGestureCurveTarget() { }
+};
+
+class CCGestureCurve {
+public:
+    virtual ~CCGestureCurve() { }
+
+    virtual bool apply(double time, CCGestureCurveTarget*) = 0;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h b/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
index 6c055994c..33721f1df 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
@@ -72,8 +72,8 @@ public:
     virtual void startPageScaleAnimation(const IntSize& targetPosition,
                                          bool anchorPoint,
                                          float pageScale,
-                                         double startTimeMs,
-                                         double durationMs) = 0;
+                                         double startTime,
+                                         double duration) = 0;
 
 protected:
     CCInputHandlerClient() { }
@@ -87,7 +87,7 @@ public:
     virtual ~CCInputHandler() { }
 
     virtual int identifier() const = 0;
-    virtual void willDraw(double frameDisplayTimeMs) = 0;
+    virtual void willDraw(double monotonicTime) = 0;
 
 protected:
     CCInputHandler() { }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp
index b615c736c..ae41fe069 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp
@@ -42,31 +42,173 @@ namespace WebCore {
 namespace {
 
 template <class Keyframe>
-bool keyframesAreSorted(const Vector<Keyframe>& keyframes)
+void insertKeyframe(PassOwnPtr<Keyframe> popKeyframe, Vector<OwnPtr<Keyframe> >& keyframes)
 {
-    if (!keyframes.size())
-        return true;
-
-    for (size_t i = 0; i < keyframes.size() - 1; ++i) {
-        if (keyframes[i].time > keyframes[i+1].time)
-            return false;
+    OwnPtr<Keyframe> keyframe = popKeyframe;
+
+    // Usually, the keyframes will be added in order, so this loop would be unnecessary and
+    // we should skip it if possible.
+    if (!keyframes.isEmpty() && keyframe->time() < keyframes.last()->time()) {
+        for (size_t i = 0; i < keyframes.size(); ++i) {
+            if (keyframe->time() < keyframes[i]->time()) {
+                keyframes.insert(i, keyframe.release());
+                return;
+            }
+        }
     }
 
-    return true;
+    keyframes.append(keyframe.release());
+}
+
+PassOwnPtr<CCTimingFunction> cloneTimingFunction(const CCTimingFunction* timingFunction)
+{
+    ASSERT(timingFunction);
+    OwnPtr<CCAnimationCurve> curve(timingFunction->clone());
+    return adoptPtr(static_cast<CCTimingFunction*>(curve.leakPtr()));
 }
 
 } // namespace
 
-PassOwnPtr<CCKeyframedFloatAnimationCurve> CCKeyframedFloatAnimationCurve::create(const Vector<CCFloatKeyframe>& keyframes)
+CCKeyframe::CCKeyframe(double time, PassOwnPtr<CCTimingFunction> timingFunction)
+    : m_time(time)
+    , m_timingFunction(timingFunction)
+{
+}
+
+CCKeyframe::~CCKeyframe()
+{
+}
+
+double CCKeyframe::time() const
+{
+    return m_time;
+}
+
+const CCTimingFunction* CCKeyframe::timingFunction() const
+{
+    return m_timingFunction.get();
+}
+
+PassOwnPtr<CCFloatKeyframe> CCFloatKeyframe::create(double time, float value, PassOwnPtr<CCTimingFunction> timingFunction)
+{
+    return adoptPtr(new CCFloatKeyframe(time, value, timingFunction));
+}
+
+CCFloatKeyframe::CCFloatKeyframe(double time, float value, PassOwnPtr<CCTimingFunction> timingFunction)
+    : CCKeyframe(time, timingFunction)
+    , m_value(value)
+{
+}
+
+CCFloatKeyframe::~CCFloatKeyframe()
+{
+}
+
+float CCFloatKeyframe::value() const
 {
-    if (!keyframes.size() || !keyframesAreSorted(keyframes))
-        return nullptr;
+    return m_value;
+}
 
-    return adoptPtr(new CCKeyframedFloatAnimationCurve(keyframes));
+PassOwnPtr<CCFloatKeyframe> CCFloatKeyframe::clone() const
+{
+    return CCFloatKeyframe::create(time(), value(), timingFunction() ? cloneTimingFunction(timingFunction()) : nullptr);
 }
 
-CCKeyframedFloatAnimationCurve::CCKeyframedFloatAnimationCurve(const Vector<CCFloatKeyframe>& keyframes)
-    : m_keyframes(keyframes)
+PassOwnPtr<CCTransformKeyframe> CCTransformKeyframe::create(double time, const TransformOperations& value, PassOwnPtr<CCTimingFunction> timingFunction)
+{
+    return adoptPtr(new CCTransformKeyframe(time, value, timingFunction));
+}
+
+CCTransformKeyframe::CCTransformKeyframe(double time, const TransformOperations& value, PassOwnPtr<CCTimingFunction> timingFunction)
+    : CCKeyframe(time, timingFunction)
+    , m_value(value)
+{
+}
+
+CCTransformKeyframe::~CCTransformKeyframe()
+{
+}
+
+const TransformOperations& CCTransformKeyframe::value() const
+{
+    return m_value;
+}
+
+PassOwnPtr<CCTransformKeyframe> CCTransformKeyframe::clone() const
+{
+    // We need to do a deep copy the m_value may contain ref pointers to TransformOperation objects.
+    TransformOperations operations;
+    for (size_t j = 0; j < m_value.size(); ++j) {
+        TransformOperation::OperationType operationType = m_value.operations()[j]->getOperationType();
+        switch (operationType) {
+        case TransformOperation::SCALE_X:
+        case TransformOperation::SCALE_Y:
+        case TransformOperation::SCALE_Z:
+        case TransformOperation::SCALE_3D:
+        case TransformOperation::SCALE: {
+            ScaleTransformOperation* transform = static_cast<ScaleTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(ScaleTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
+            break;
+        }
+        case TransformOperation::TRANSLATE_X:
+        case TransformOperation::TRANSLATE_Y:
+        case TransformOperation::TRANSLATE_Z:
+        case TransformOperation::TRANSLATE_3D:
+        case TransformOperation::TRANSLATE: {
+            TranslateTransformOperation* transform = static_cast<TranslateTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(TranslateTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
+            break;
+        }
+        case TransformOperation::ROTATE_X:
+        case TransformOperation::ROTATE_Y:
+        case TransformOperation::ROTATE_3D:
+        case TransformOperation::ROTATE: {
+            RotateTransformOperation* transform = static_cast<RotateTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(RotateTransformOperation::create(transform->x(), transform->y(), transform->z(), transform->angle(), operationType));
+            break;
+        }
+        case TransformOperation::SKEW_X:
+        case TransformOperation::SKEW_Y:
+        case TransformOperation::SKEW: {
+            SkewTransformOperation* transform = static_cast<SkewTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(SkewTransformOperation::create(transform->angleX(), transform->angleY(), operationType));
+            break;
+        }
+        case TransformOperation::MATRIX: {
+            MatrixTransformOperation* transform = static_cast<MatrixTransformOperation*>(m_value.operations()[j].get());
+            TransformationMatrix m = transform->matrix();
+            operations.operations().append(MatrixTransformOperation::create(m.a(), m.b(), m.c(), m.d(), m.e(), m.f()));
+            break;
+        }
+        case TransformOperation::MATRIX_3D: {
+            Matrix3DTransformOperation* transform = static_cast<Matrix3DTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(Matrix3DTransformOperation::create(transform->matrix()));
+            break;
+        }
+        case TransformOperation::PERSPECTIVE: {
+            PerspectiveTransformOperation* transform = static_cast<PerspectiveTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(PerspectiveTransformOperation::create(transform->perspective()));
+            break;
+        }
+        case TransformOperation::IDENTITY: {
+            operations.operations().append(IdentityTransformOperation::create());
+            break;
+        }
+        case TransformOperation::NONE:
+            // Do nothing.
+            break;
+        } // switch
+    } // for each operation
+
+    return CCTransformKeyframe::create(time(), operations, timingFunction() ? cloneTimingFunction(timingFunction()) : nullptr);
+}
+
+PassOwnPtr<CCKeyframedFloatAnimationCurve> CCKeyframedFloatAnimationCurve::create()
+{
+    return adoptPtr(new CCKeyframedFloatAnimationCurve);
+}
+
+CCKeyframedFloatAnimationCurve::CCKeyframedFloatAnimationCurve()
 {
 }
 
@@ -74,159 +216,110 @@ CCKeyframedFloatAnimationCurve::~CCKeyframedFloatAnimationCurve()
 {
 }
 
+void CCKeyframedFloatAnimationCurve::addKeyframe(PassOwnPtr<CCFloatKeyframe> keyframe)
+{
+    insertKeyframe(keyframe, m_keyframes);
+}
+
 double CCKeyframedFloatAnimationCurve::duration() const
 {
-    return m_keyframes.last().time - m_keyframes.first().time;
+    return m_keyframes.last()->time() - m_keyframes.first()->time();
 }
 
 PassOwnPtr<CCAnimationCurve> CCKeyframedFloatAnimationCurve::clone() const
 {
-    return adoptPtr(new CCKeyframedFloatAnimationCurve(*this));
+    OwnPtr<CCKeyframedFloatAnimationCurve> toReturn(CCKeyframedFloatAnimationCurve::create());
+    for (size_t i = 0; i < m_keyframes.size(); ++i)
+        toReturn->addKeyframe(m_keyframes[i]->clone());
+    return toReturn.release();
 }
 
 float CCKeyframedFloatAnimationCurve::getValue(double t) const
 {
-    if (t <= m_keyframes.first().time)
-        return m_keyframes.first().value;
+    if (t <= m_keyframes.first()->time())
+        return m_keyframes.first()->value();
 
-    if (t >= m_keyframes.last().time)
-        return m_keyframes.last().value;
+    if (t >= m_keyframes.last()->time())
+        return m_keyframes.last()->value();
 
     size_t i = 0;
     for (; i < m_keyframes.size() - 1; ++i) {
-        if (t < m_keyframes[i+1].time)
+        if (t < m_keyframes[i+1]->time())
             break;
     }
 
-    float progress = static_cast<float>((t - m_keyframes[i].time) / (m_keyframes[i+1].time - m_keyframes[i].time));
-    // FIXME: apply timing function here.
-    return m_keyframes[i].value + (m_keyframes[i+1].value - m_keyframes[i].value) * progress;
+    float progress = static_cast<float>((t - m_keyframes[i]->time()) / (m_keyframes[i+1]->time() - m_keyframes[i]->time()));
+
+    if (m_keyframes[i]->timingFunction())
+        progress = m_keyframes[i]->timingFunction()->getValue(progress);
+
+    return m_keyframes[i]->value() + (m_keyframes[i+1]->value() - m_keyframes[i]->value()) * progress;
 }
 
-PassOwnPtr<CCKeyframedTransformAnimationCurve> CCKeyframedTransformAnimationCurve::create(const Vector<CCTransformKeyframe>& keyframes)
+PassOwnPtr<CCKeyframedTransformAnimationCurve> CCKeyframedTransformAnimationCurve::create()
 {
-    if (!keyframes.size() || !keyframesAreSorted(keyframes))
-        return nullptr;
+    return adoptPtr(new CCKeyframedTransformAnimationCurve);
+}
 
-    return adoptPtr(new CCKeyframedTransformAnimationCurve(keyframes));
+CCKeyframedTransformAnimationCurve::CCKeyframedTransformAnimationCurve()
+{
 }
 
-CCKeyframedTransformAnimationCurve::CCKeyframedTransformAnimationCurve(const Vector<CCTransformKeyframe>& keyframes)
-    : m_keyframes(keyframes)
+CCKeyframedTransformAnimationCurve::~CCKeyframedTransformAnimationCurve()
 {
 }
 
-CCKeyframedTransformAnimationCurve::~CCKeyframedTransformAnimationCurve() { }
+void CCKeyframedTransformAnimationCurve::addKeyframe(PassOwnPtr<CCTransformKeyframe> keyframe)
+{
+    insertKeyframe(keyframe, m_keyframes);
+}
 
 double CCKeyframedTransformAnimationCurve::duration() const
 {
-    return m_keyframes.last().time - m_keyframes.first().time;
+    return m_keyframes.last()->time() - m_keyframes.first()->time();
 }
 
 PassOwnPtr<CCAnimationCurve> CCKeyframedTransformAnimationCurve::clone() const
 {
-    Vector<CCTransformKeyframe> keyframes;
-    // We need to do a deep copy of all of the keyframes since they contain ref
-    // pointers to TransformOperation objects.
-    for (size_t i = 0; i < m_keyframes.size(); ++i) {
-        CCTransformKeyframe keyframe(m_keyframes[i].time);
-        for (size_t j = 0; j < m_keyframes[i].value.size(); ++j) {
-            TransformOperation::OperationType operationType = m_keyframes[i].value.operations()[j]->getOperationType();
-            switch (operationType) {
-            case TransformOperation::SCALE_X:
-            case TransformOperation::SCALE_Y:
-            case TransformOperation::SCALE_Z:
-            case TransformOperation::SCALE_3D:
-            case TransformOperation::SCALE: {
-                ScaleTransformOperation* transform = static_cast<ScaleTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(ScaleTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
-                break;
-            }
-            case TransformOperation::TRANSLATE_X:
-            case TransformOperation::TRANSLATE_Y:
-            case TransformOperation::TRANSLATE_Z:
-            case TransformOperation::TRANSLATE_3D:
-            case TransformOperation::TRANSLATE: {
-                TranslateTransformOperation* transform = static_cast<TranslateTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(TranslateTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
-                break;
-            }
-            case TransformOperation::ROTATE_X:
-            case TransformOperation::ROTATE_Y:
-            case TransformOperation::ROTATE_3D:
-            case TransformOperation::ROTATE: {
-                RotateTransformOperation* transform = static_cast<RotateTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(RotateTransformOperation::create(transform->x(), transform->y(), transform->z(), transform->angle(), operationType));
-                break;
-            }
-            case TransformOperation::SKEW_X:
-            case TransformOperation::SKEW_Y:
-            case TransformOperation::SKEW: {
-                SkewTransformOperation* transform = static_cast<SkewTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(SkewTransformOperation::create(transform->angleX(), transform->angleY(), operationType));
-                break;
-            }
-            case TransformOperation::MATRIX: {
-                MatrixTransformOperation* transform = static_cast<MatrixTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                TransformationMatrix m = transform->matrix();
-                keyframe.value.operations().append(MatrixTransformOperation::create(m.a(), m.b(), m.c(), m.d(), m.e(), m.f()));
-                break;
-            }
-            case TransformOperation::MATRIX_3D: {
-                Matrix3DTransformOperation* transform = static_cast<Matrix3DTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(Matrix3DTransformOperation::create(transform->matrix()));
-                break;
-            }
-            case TransformOperation::PERSPECTIVE: {
-                PerspectiveTransformOperation* transform = static_cast<PerspectiveTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(PerspectiveTransformOperation::create(transform->perspective()));
-                break;
-            }
-            case TransformOperation::IDENTITY: {
-                keyframe.value.operations().append(IdentityTransformOperation::create());
-                break;
-            }
-            case TransformOperation::NONE:
-                // Do nothing.
-                break;
-            } // switch
-        } // for each operation
-        keyframes.append(keyframe);
-    }
-    return CCKeyframedTransformAnimationCurve::create(keyframes);
+    OwnPtr<CCKeyframedTransformAnimationCurve> toReturn(CCKeyframedTransformAnimationCurve::create());
+    for (size_t i = 0; i < m_keyframes.size(); ++i)
+        toReturn->addKeyframe(m_keyframes[i]->clone());
+    return toReturn.release();
 }
 
 TransformationMatrix CCKeyframedTransformAnimationCurve::getValue(double t, const IntSize& layerSize) const
 {
     TransformationMatrix transformMatrix;
 
-    if (t <= m_keyframes.first().time) {
-        m_keyframes.first().value.apply(layerSize, transformMatrix);
+    if (t <= m_keyframes.first()->time()) {
+        m_keyframes.first()->value().apply(layerSize, transformMatrix);
         return transformMatrix;
     }
 
-    if (t >= m_keyframes.last().time) {
-        m_keyframes.last().value.apply(layerSize, transformMatrix);
+    if (t >= m_keyframes.last()->time()) {
+        m_keyframes.last()->value().apply(layerSize, transformMatrix);
         return transformMatrix;
     }
 
     size_t i = 0;
     for (; i < m_keyframes.size() - 1; ++i) {
-        if (t < m_keyframes[i+1].time)
+        if (t < m_keyframes[i+1]->time())
             break;
     }
 
-    // FIXME: apply timing function here.
-    double progress = (t - m_keyframes[i].time) / (m_keyframes[i+1].time - m_keyframes[i].time);
+    double progress = (t - m_keyframes[i]->time()) / (m_keyframes[i+1]->time() - m_keyframes[i]->time());
+
+    if (m_keyframes[i]->timingFunction())
+        progress = m_keyframes[i]->timingFunction()->getValue(progress);
 
-    if (m_keyframes[i].value.operationsMatch(m_keyframes[i+1].value)) {
-        for (size_t j = 0; j < m_keyframes[i+1].value.size(); ++j)
-            m_keyframes[i+1].value.operations()[j]->blend(m_keyframes[i].value.at(j), progress)->apply(transformMatrix, layerSize);
+    if (m_keyframes[i]->value().operationsMatch(m_keyframes[i+1]->value())) {
+        for (size_t j = 0; j < m_keyframes[i+1]->value().size(); ++j)
+            m_keyframes[i+1]->value().operations()[j]->blend(m_keyframes[i]->value().at(j), progress)->apply(transformMatrix, layerSize);
     } else {
         TransformationMatrix source;
 
-        m_keyframes[i].value.apply(layerSize, source);
-        m_keyframes[i+1].value.apply(layerSize, transformMatrix);
+        m_keyframes[i]->value().apply(layerSize, source);
+        m_keyframes[i+1]->value().apply(layerSize, transformMatrix);
 
         transformMatrix.blend(source, progress);
     }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h
index 1c4d64adb..c3073bf08 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h
@@ -27,46 +27,66 @@
 
 #include "TransformOperations.h"
 #include "cc/CCAnimationCurve.h"
+#include "cc/CCTimingFunction.h"
 
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-struct CCFloatKeyframe {
-    CCFloatKeyframe(double time, float value)
-        : time(time)
-        , value(value)
-    {
-    }
+class CCKeyframe {
+public:
+    double time() const;
+    const CCTimingFunction* timingFunction() const;
+
+protected:
+    CCKeyframe(double time, PassOwnPtr<CCTimingFunction>);
+    virtual ~CCKeyframe();
 
-    double time;
-    float value;
+private:
+    double m_time;
+    OwnPtr<CCTimingFunction> m_timingFunction;
 };
 
-struct CCTransformKeyframe {
-    explicit CCTransformKeyframe(double time)
-        : time(time)
-    {
-    }
+class CCFloatKeyframe : public CCKeyframe {
+public:
+    static PassOwnPtr<CCFloatKeyframe> create(double time, float value, PassOwnPtr<CCTimingFunction>);
+    virtual ~CCFloatKeyframe();
+
+    float value() const;
 
-    CCTransformKeyframe(double time, const TransformOperations& value)
-        : time(time)
-        , value(value)
-    {
-    }
+    PassOwnPtr<CCFloatKeyframe> clone() const;
 
-    double time;
-    TransformOperations value;
+private:
+    CCFloatKeyframe(double time, float value, PassOwnPtr<CCTimingFunction>);
+
+    float m_value;
+};
+
+class CCTransformKeyframe : public CCKeyframe {
+public:
+    static PassOwnPtr<CCTransformKeyframe> create(double time, const TransformOperations& value, PassOwnPtr<CCTimingFunction>);
+    virtual ~CCTransformKeyframe();
+
+    const TransformOperations& value() const;
+
+    PassOwnPtr<CCTransformKeyframe> clone() const;
+
+private:
+    CCTransformKeyframe(double time, const TransformOperations& value, PassOwnPtr<CCTimingFunction>);
+
+    TransformOperations m_value;
 };
 
 class CCKeyframedFloatAnimationCurve : public CCFloatAnimationCurve {
 public:
     // It is required that the keyframes be sorted by time.
-    static PassOwnPtr<CCKeyframedFloatAnimationCurve> create(const Vector<CCFloatKeyframe>& keyframes);
+    static PassOwnPtr<CCKeyframedFloatAnimationCurve> create();
 
     virtual ~CCKeyframedFloatAnimationCurve();
 
+    void addKeyframe(PassOwnPtr<CCFloatKeyframe>);
+
     // CCAnimationCurve implementation
     virtual double duration() const;
     virtual PassOwnPtr<CCAnimationCurve> clone() const;
@@ -75,20 +95,22 @@ public:
     virtual float getValue(double t) const;
 
 private:
-    explicit CCKeyframedFloatAnimationCurve(const Vector<CCFloatKeyframe>&);
+    CCKeyframedFloatAnimationCurve();
 
     // Always sorted in order of increasing time. No two keyframes have the
     // same time.
-    Vector<CCFloatKeyframe> m_keyframes;
+    Vector<OwnPtr<CCFloatKeyframe> > m_keyframes;
 };
 
 class CCKeyframedTransformAnimationCurve : public CCTransformAnimationCurve {
 public:
     // It is required that the keyframes be sorted by time.
-    static PassOwnPtr<CCKeyframedTransformAnimationCurve> create(const Vector<CCTransformKeyframe>& keyframes);
+    static PassOwnPtr<CCKeyframedTransformAnimationCurve> create();
 
     virtual ~CCKeyframedTransformAnimationCurve();
 
+    void addKeyframe(PassOwnPtr<CCTransformKeyframe>);
+
     // CCAnimationCurve implementation
     virtual double duration() const;
     virtual PassOwnPtr<CCAnimationCurve> clone() const;
@@ -97,11 +119,11 @@ public:
     virtual TransformationMatrix getValue(double t, const IntSize&) const;
 
 private:
-    explicit CCKeyframedTransformAnimationCurve(const Vector<CCTransformKeyframe>&);
+    CCKeyframedTransformAnimationCurve();
 
     // Always sorted in order of increasing time. No two keyframes have the
     // same time.
-    Vector<CCTransformKeyframe> m_keyframes;
+    Vector<OwnPtr<CCTransformKeyframe> > m_keyframes;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
index d9e72efc4..335d3a58e 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
@@ -37,16 +37,16 @@ namespace WebCore {
 
 namespace {
 
-template <typename Keyframe, typename Value>
-void appendKeyframe(Vector<Keyframe>& keyframes, double keyTime, const Value* value)
+template <class Value, class Keyframe, class Curve>
+void appendKeyframe(Curve& curve, double keyTime, const Value* value, PassOwnPtr<CCTimingFunction> timingFunction)
 {
-    keyframes.append(Keyframe(keyTime, value->value()));
+    curve.addKeyframe(Keyframe::create(keyTime, value->value(), timingFunction));
 }
 
 template <>
-void appendKeyframe<CCTransformKeyframe, TransformAnimationValue>(Vector<CCTransformKeyframe>& keyframes, double keyTime, const TransformAnimationValue* value)
+void appendKeyframe<TransformAnimationValue, CCTransformKeyframe, CCKeyframedTransformAnimationCurve>(CCKeyframedTransformAnimationCurve& curve, double keyTime, const TransformAnimationValue* value, PassOwnPtr<CCTimingFunction> timingFunction)
 {
-    keyframes.append(CCTransformKeyframe(keyTime, *value->value()));
+    curve.addKeyframe(CCTransformKeyframe::create(keyTime, *value->value(), timingFunction));
 }
 
 template <class Value, class Keyframe, class Curve>
@@ -64,21 +64,33 @@ PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& val
     if (animation && animation->isFillModeSet() && (animation->fillsForwards() || animation->fillsBackwards()))
         return nullptr;
 
+    OwnPtr<Curve> curve = Curve::create();
     Vector<Keyframe> keyframes;
 
     for (size_t i = 0; i < valueList.size(); i++) {
         const Value* originalValue = static_cast<const Value*>(valueList.at(i));
 
-        // FIXME: add support for timing functions.
-        if (originalValue->timingFunction() && originalValue->timingFunction()->type() != TimingFunction::LinearFunction)
-            return nullptr;
+        OwnPtr<CCTimingFunction> timingFunction;
+        if (originalValue->timingFunction()) {
+            switch (originalValue->timingFunction()->type()) {
+            case TimingFunction::StepsFunction:
+                // FIXME: add support for steps timing function.
+                return nullptr;
+            case TimingFunction::LinearFunction:
+                // Don't set the timing function. Keyframes are interpolated linearly if there is no timing function.
+                break;
+            case TimingFunction::CubicBezierFunction:
+                const CubicBezierTimingFunction* originalTimingFunction = static_cast<const CubicBezierTimingFunction*>(originalValue->timingFunction());
+                timingFunction = CCCubicBezierTimingFunction::create(originalTimingFunction->x1(), originalTimingFunction->y1(), originalTimingFunction->x2(), originalTimingFunction->y2());
+                break;
+            } // switch
+        } else
+            timingFunction = CCEaseTimingFunction::create();
 
         double duration = (animation && animation->isDurationSet()) ? animation->duration() : 1;
-        appendKeyframe(keyframes, originalValue->keyTime() * duration, originalValue);
+        appendKeyframe<Value, Keyframe, Curve>(*curve, originalValue->keyTime() * duration, originalValue, timingFunction.release());
     }
 
-    OwnPtr<Curve> curve = Curve::create(keyframes);
-
     OwnPtr<CCActiveAnimation> anim = CCActiveAnimation::create(curve.release(), animationId, groupId, targetProperty);
 
     ASSERT(anim.get());
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
index 2096ce398..f09dcfae0 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
@@ -49,15 +49,15 @@ CCLayerAnimationControllerImpl::~CCLayerAnimationControllerImpl()
 {
 }
 
-void CCLayerAnimationControllerImpl::animate(double frameBeginTimeSecs, CCAnimationEventsVector& events)
+void CCLayerAnimationControllerImpl::animate(double monotonicTime, CCAnimationEventsVector& events)
 {
-    startAnimationsWaitingForNextTick(frameBeginTimeSecs, events);
-    startAnimationsWaitingForStartTime(frameBeginTimeSecs, events);
-    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs, events);
-    resolveConflicts(frameBeginTimeSecs);
-    tickAnimations(frameBeginTimeSecs);
-    purgeFinishedAnimations();
-    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs, events);
+    startAnimationsWaitingForNextTick(monotonicTime, events);
+    startAnimationsWaitingForStartTime(monotonicTime, events);
+    startAnimationsWaitingForTargetAvailability(monotonicTime, events);
+    resolveConflicts(monotonicTime);
+    tickAnimations(monotonicTime);
+    purgeFinishedAnimations(events);
+    startAnimationsWaitingForTargetAvailability(monotonicTime, events);
 }
 
 void CCLayerAnimationControllerImpl::add(PassOwnPtr<CCActiveAnimation> anim)
@@ -83,28 +83,28 @@ bool CCLayerAnimationControllerImpl::hasActiveAnimation() const
     return false;
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick(double now, CCAnimationEventsVector& events)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick(double monotonicTime, CCAnimationEventsVector& events)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
         if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForNextTick) {
-            m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
-            m_activeAnimations[i]->setStartTime(now);
-            events.append(CCAnimationStartedEvent(m_client->id(), now));
+            m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, monotonicTime);
+            m_activeAnimations[i]->setStartTime(monotonicTime);
+            events.append(CCAnimationStartedEvent::create(m_client->id()));
         }
     }
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime(double now, CCAnimationEventsVector& events)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime(double monotonicTime, CCAnimationEventsVector& events)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
-        if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForStartTime && m_activeAnimations[i]->startTime() <= now) {
-            m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
-            events.append(CCAnimationStartedEvent(m_client->id(), now));
+        if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForStartTime && m_activeAnimations[i]->startTime() <= monotonicTime) {
+            m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, monotonicTime);
+            events.append(CCAnimationStartedEvent::create(m_client->id()));
         }
     }
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability(double now, CCAnimationEventsVector& events)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability(double monotonicTime, CCAnimationEventsVector& events)
 {
     // First collect running properties.
     TargetProperties blockedProperties;
@@ -134,13 +134,13 @@ void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability
 
             // If the intersection is null, then we are free to start the animations in the group.
             if (nullIntersection) {
-                m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
-                m_activeAnimations[i]->setStartTime(now);
-                events.append(CCAnimationStartedEvent(m_client->id(), now));
+                m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, monotonicTime);
+                m_activeAnimations[i]->setStartTime(monotonicTime);
+                events.append(CCAnimationStartedEvent::create(m_client->id()));
                 for (size_t j = i + 1; j < m_activeAnimations.size(); ++j) {
                     if (m_activeAnimations[i]->group() == m_activeAnimations[j]->group()) {
-                        m_activeAnimations[j]->setRunState(CCActiveAnimation::Running, now);
-                        m_activeAnimations[j]->setStartTime(now);
+                        m_activeAnimations[j]->setRunState(CCActiveAnimation::Running, monotonicTime);
+                        m_activeAnimations[j]->setStartTime(monotonicTime);
                     }
                 }
             }
@@ -148,7 +148,7 @@ void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability
     }
 }
 
-void CCLayerAnimationControllerImpl::resolveConflicts(double now)
+void CCLayerAnimationControllerImpl::resolveConflicts(double monotonicTime)
 {
     // Find any animations that are animating the same property and resolve the
     // confict. We could eventually blend, but for now we'll just abort the
@@ -160,16 +160,16 @@ void CCLayerAnimationControllerImpl::resolveConflicts(double now)
             for (size_t j = i + 1; j < m_activeAnimations.size(); ++j) {
                 if (m_activeAnimations[j]->runState() == CCActiveAnimation::Running && m_activeAnimations[i]->targetProperty() == m_activeAnimations[j]->targetProperty()) {
                     if (m_activeAnimations[i]->startTime() > m_activeAnimations[j]->startTime())
-                        m_activeAnimations[j]->setRunState(CCActiveAnimation::Aborted, now);
+                        m_activeAnimations[j]->setRunState(CCActiveAnimation::Aborted, monotonicTime);
                     else
-                        m_activeAnimations[i]->setRunState(CCActiveAnimation::Aborted, now);
+                        m_activeAnimations[i]->setRunState(CCActiveAnimation::Aborted, monotonicTime);
                 }
             }
         }
     }
 }
 
-void CCLayerAnimationControllerImpl::purgeFinishedAnimations()
+void CCLayerAnimationControllerImpl::purgeFinishedAnimations(CCAnimationEventsVector& events)
 {
     // Each iteration, m_activeAnimations.size() decreases or i increments,
     // guaranteeing progress towards loop termination.
@@ -186,6 +186,7 @@ void CCLayerAnimationControllerImpl::purgeFinishedAnimations()
             }
         }
         if (allAnimsWithSameIdAreFinished) {
+            events.append(CCAnimationFinishedEvent::create(m_client->id(), m_activeAnimations[i]->id()));
             m_finishedAnimations.append(m_activeAnimations[i]->signature());
             m_activeAnimations.remove(i);
         } else
@@ -193,18 +194,19 @@ void CCLayerAnimationControllerImpl::purgeFinishedAnimations()
     }
 }
 
-void CCLayerAnimationControllerImpl::tickAnimations(double now)
+void CCLayerAnimationControllerImpl::tickAnimations(double monotonicTime)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
         if (m_activeAnimations[i]->runState() == CCActiveAnimation::Running) {
-            double trimmed = m_activeAnimations[i]->trimTimeToCurrentIteration(now);
+            double trimmed = m_activeAnimations[i]->trimTimeToCurrentIteration(monotonicTime);
+
             switch (m_activeAnimations[i]->targetProperty()) {
 
             case CCActiveAnimation::Transform: {
                 const CCTransformAnimationCurve* transformAnimationCurve = m_activeAnimations[i]->curve()->toTransformAnimationCurve();
                 const TransformationMatrix matrix = transformAnimationCurve->getValue(trimmed, m_client->bounds());
-                if (m_activeAnimations[i]->isFinishedAt(now))
-                    m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, now);
+                if (m_activeAnimations[i]->isFinishedAt(monotonicTime))
+                    m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, monotonicTime);
 
                 m_client->setTransform(matrix);
                 break;
@@ -213,8 +215,8 @@ void CCLayerAnimationControllerImpl::tickAnimations(double now)
             case CCActiveAnimation::Opacity: {
                 const CCFloatAnimationCurve* floatAnimationCurve = m_activeAnimations[i]->curve()->toFloatAnimationCurve();
                 const float opacity = floatAnimationCurve->getValue(trimmed);
-                if (m_activeAnimations[i]->isFinishedAt(now))
-                    m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, now);
+                if (m_activeAnimations[i]->isFinishedAt(monotonicTime))
+                    m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, monotonicTime);
 
                 m_client->setOpacity(opacity);
                 break;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
index 296066de0..6ac00e7ae 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
@@ -61,7 +61,7 @@ public:
 
     virtual ~CCLayerAnimationControllerImpl();
 
-    void animate(double frameBeginTimeSecs, CCAnimationEventsVector&);
+    void animate(double monotonicTime, CCAnimationEventsVector&);
 
     void add(PassOwnPtr<CCActiveAnimation>);
 
@@ -78,13 +78,13 @@ private:
     // The animator is owned by the layer.
     explicit CCLayerAnimationControllerImpl(CCLayerAnimationControllerImplClient*);
 
-    void startAnimationsWaitingForNextTick(double now, CCAnimationEventsVector&);
-    void startAnimationsWaitingForStartTime(double now, CCAnimationEventsVector&);
-    void startAnimationsWaitingForTargetAvailability(double now, CCAnimationEventsVector&);
-    void resolveConflicts(double now);
-    void purgeFinishedAnimations();
+    void startAnimationsWaitingForNextTick(double monotonicTime, CCAnimationEventsVector&);
+    void startAnimationsWaitingForStartTime(double monotonicTime, CCAnimationEventsVector&);
+    void startAnimationsWaitingForTargetAvailability(double monotonicTime, CCAnimationEventsVector&);
+    void resolveConflicts(double monotonicTime);
+    void purgeFinishedAnimations(CCAnimationEventsVector&);
 
-    void tickAnimations(double now);
+    void tickAnimations(double monotonicTime);
 
     CCLayerAnimationControllerImplClient* m_client;
     Vector<OwnPtr<CCActiveAnimation> > m_activeAnimations;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationDelegate.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationDelegate.h
new file mode 100644
index 000000000..a764cc37b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationDelegate.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCLayerAnimationDelegate_h
+#define CCLayerAnimationDelegate_h
+
+namespace WebCore {
+
+// This class is used to send notifications when layer animations begin or end.
+class CCLayerAnimationDelegate {
+public:
+    virtual void notifyAnimationStarted(double time) = 0;
+    virtual void notifyAnimationFinished(int animationId) = 0;
+};
+
+} // namespace WebCore
+
+#endif // CCLayerAnimationDelegate_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index 0589dca8a..8f6078097 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -42,10 +42,13 @@ namespace WebCore {
 
 CCLayerImpl::CCLayerImpl(int id)
     : m_parent(0)
+    , m_maskLayerId(-1)
+    , m_replicaLayerId(-1)
     , m_layerId(id)
     , m_anchorPoint(0.5, 0.5)
     , m_anchorPointZ(0)
     , m_scrollable(false)
+    , m_shouldScrollOnMainThread(false)
     , m_haveWheelEventHandlers(false)
     , m_backgroundCoversViewport(false)
     , m_doubleSided(true)
@@ -73,7 +76,7 @@ CCLayerImpl::~CCLayerImpl()
     ASSERT(CCProxy::isImplThread());
 }
 
-void CCLayerImpl::addChild(PassRefPtr<CCLayerImpl> child)
+void CCLayerImpl::addChild(PassOwnPtr<CCLayerImpl> child)
 {
     child->setParent(this);
     m_children.append(child);
@@ -83,13 +86,16 @@ void CCLayerImpl::removeFromParent()
 {
     if (!m_parent)
         return;
-    for (size_t i = 0; i < m_parent->m_children.size(); ++i) {
-        if (m_parent->m_children[i].get() == this) {
-            m_parent->m_children.remove(i);
-            break;
+
+    CCLayerImpl* parent = m_parent;
+    m_parent = 0;
+
+    for (size_t i = 0; i < parent->m_children.size(); ++i) {
+        if (parent->m_children[i].get() == this) {
+            parent->m_children.remove(i);
+            return;
         }
     }
-    m_parent = 0;
 }
 
 void CCLayerImpl::removeAllChildren()
@@ -188,12 +194,6 @@ void CCLayerImpl::scrollBy(const IntSize& scroll)
     noteLayerPropertyChangedForSubtree();
 }
 
-void CCLayerImpl::cleanupResources()
-{
-    if (renderSurface())
-        renderSurface()->cleanupResources();
-}
-
 const IntRect CCLayerImpl::getDrawRect() const
 {
     // Form the matrix used by the shader to map the corners of the layer's
@@ -244,7 +244,7 @@ void CCLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
     ts << "drawsContent: " << (m_drawsContent ? "yes" : "no") << "\n";
 }
 
-void sortLayers(Vector<RefPtr<CCLayerImpl> >::iterator first, Vector<RefPtr<CCLayerImpl> >::iterator end, CCLayerSorter* layerSorter)
+void sortLayers(Vector<CCLayerImpl*>::iterator first, Vector<CCLayerImpl*>::iterator end, CCLayerSorter* layerSorter)
 {
     TRACE_EVENT("LayerRendererChromium::sortLayers", 0, 0);
     layerSorter->sort(first, end);
@@ -260,7 +260,7 @@ String CCLayerImpl::layerTreeAsText() const
 void CCLayerImpl::dumpLayer(TextStream& ts, int indent) const
 {
     writeIndent(ts, indent);
-    ts << layerTypeAsString() << "(" << m_name << ")\n";
+    ts << layerTypeAsString() << "(" << m_debugName << ")\n";
     dumpLayerProperties(ts, indent+2);
     if (m_replicaLayer) {
         writeIndent(ts, indent+2);
@@ -319,21 +319,27 @@ void CCLayerImpl::setBounds(const IntSize& bounds)
         m_layerPropertyChanged = true;
 }
 
-void CCLayerImpl::setMaskLayer(PassRefPtr<CCLayerImpl> maskLayer)
+void CCLayerImpl::setMaskLayer(PassOwnPtr<CCLayerImpl> maskLayer)
 {
-    if (m_maskLayer == maskLayer)
+    m_maskLayer = maskLayer;
+
+    int newLayerId = m_maskLayer ? m_maskLayer->id() : -1;
+    if (newLayerId == m_maskLayerId)
         return;
 
-    m_maskLayer = maskLayer;
+    m_maskLayerId = newLayerId;
     noteLayerPropertyChangedForSubtree();
 }
 
-void CCLayerImpl::setReplicaLayer(PassRefPtr<CCLayerImpl> replicaLayer)
+void CCLayerImpl::setReplicaLayer(PassOwnPtr<CCLayerImpl> replicaLayer)
 {
-    if (m_replicaLayer == replicaLayer)
+    m_replicaLayer = replicaLayer;
+
+    int newLayerId = m_replicaLayer ? m_replicaLayer->id() : -1;
+    if (newLayerId == m_replicaLayerId)
         return;
 
-    m_replicaLayer = replicaLayer;
+    m_replicaLayerId = newLayerId;
     noteLayerPropertyChangedForSubtree();
 }
 
@@ -523,6 +529,10 @@ void CCLayerImpl::setDoubleSided(bool doubleSided)
     noteLayerPropertyChangedForSubtree();
 }
 
+void CCLayerImpl::didLoseContext()
+{
+}
+
 }
 
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index c7a4f0856..f1c7b4ee5 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -30,6 +30,7 @@
 #include "FilterOperations.h"
 #include "FloatRect.h"
 #include "IntRect.h"
+#include "Region.h"
 #include "TextStream.h"
 #include "TransformationMatrix.h"
 #include "cc/CCLayerAnimationControllerImpl.h"
@@ -46,11 +47,11 @@ class CCLayerSorter;
 class LayerChromium;
 class LayerRendererChromium;
 
-class CCLayerImpl : public RefCounted<CCLayerImpl>, public CCLayerAnimationControllerImplClient {
+class CCLayerImpl : public CCLayerAnimationControllerImplClient {
 public:
-    static PassRefPtr<CCLayerImpl> create(int id)
+    static PassOwnPtr<CCLayerImpl> create(int id)
     {
-        return adoptRef(new CCLayerImpl(id));
+        return adoptPtr(new CCLayerImpl(id));
     }
 
     // CCLayerAnimationControllerImplClient implementation.
@@ -65,15 +66,15 @@ public:
 
     // Tree structure.
     CCLayerImpl* parent() const { return m_parent; }
-    const Vector<RefPtr<CCLayerImpl> >& children() const { return m_children; }
-    void addChild(PassRefPtr<CCLayerImpl>);
+    const Vector<OwnPtr<CCLayerImpl> >& children() const { return m_children; }
+    void addChild(PassOwnPtr<CCLayerImpl>);
     void removeFromParent();
     void removeAllChildren();
 
-    void setMaskLayer(PassRefPtr<CCLayerImpl>);
+    void setMaskLayer(PassOwnPtr<CCLayerImpl>);
     CCLayerImpl* maskLayer() const { return m_maskLayer.get(); }
 
-    void setReplicaLayer(PassRefPtr<CCLayerImpl>);
+    void setReplicaLayer(PassOwnPtr<CCLayerImpl>);
     CCLayerImpl* replicaLayer() const { return m_replicaLayer.get(); }
 
 #ifndef NDEBUG
@@ -96,8 +97,6 @@ public:
     // Returns true if any of the layer's descendants has content to draw.
     bool descendantDrawsContent();
 
-    void cleanupResources();
-
     void setAnchorPoint(const FloatPoint&);
     const FloatPoint& anchorPoint() const { return m_anchorPoint; }
 
@@ -134,9 +133,6 @@ public:
     void setSublayerTransform(const TransformationMatrix&);
     const TransformationMatrix& sublayerTransform() const { return m_sublayerTransform; }
 
-    void setName(const String& name) { m_name = name; }
-    const String& name() const { return m_name; }
-
     // Debug layer border - visual effect only, do not change geometry/clipping/etc.
     void setDebugBorderColor(Color);
     Color debugBorderColor() const { return m_debugBorderColor; }
@@ -144,6 +140,10 @@ public:
     float debugBorderWidth() const { return m_debugBorderWidth; }
     bool hasDebugBorders() const;
 
+    // Debug layer name.
+    void setDebugName(const String& debugName) { m_debugName = debugName; }
+    String debugName() const { return m_debugName; }
+
     CCRenderSurface* renderSurface() const { return m_renderSurface.get(); }
     void createRenderSurface();
     void clearRenderSurface() { m_renderSurface.clear(); }
@@ -181,9 +181,15 @@ public:
     bool scrollable() const { return m_scrollable; }
     void setScrollable(bool scrollable) { m_scrollable = scrollable; }
 
+    bool shouldScrollOnMainThread() const { return m_shouldScrollOnMainThread; }
+    void setShouldScrollOnMainThread(bool shouldScrollOnMainThread) { m_shouldScrollOnMainThread = shouldScrollOnMainThread; }
+
     bool haveWheelEventHandlers() const { return m_haveWheelEventHandlers; }
     void setHaveWheelEventHandlers(bool haveWheelEventHandlers) { m_haveWheelEventHandlers = haveWheelEventHandlers; }
 
+    const Region& nonFastScrollableRegion() const { return m_nonFastScrollableRegion; }
+    void setNonFastScrollableRegion(const Region& region) { m_nonFastScrollableRegion = region; }
+
     const IntRect& visibleLayerRect() const { return m_visibleLayerRect; }
     void setVisibleLayerRect(const IntRect& visibleLayerRect) { m_visibleLayerRect = visibleLayerRect; }
 
@@ -209,6 +215,13 @@ public:
 
     CCLayerAnimationControllerImpl* layerAnimationController() { return m_layerAnimationController.get(); }
 
+    virtual Region opaqueContentsRegion() const { return Region(); };
+
+    // Indicates that the context previously used to render this layer
+    // was lost and that a new one has been created. Won't be called
+    // until the new context has been created successfully.
+    virtual void didLoseContext();
+
 protected:
     explicit CCLayerImpl(int);
 
@@ -236,9 +249,12 @@ private:
 
     // Properties internal to CCLayerImpl
     CCLayerImpl* m_parent;
-    Vector<RefPtr<CCLayerImpl> > m_children;
-    RefPtr<CCLayerImpl> m_maskLayer;
-    RefPtr<CCLayerImpl> m_replicaLayer;
+    Vector<OwnPtr<CCLayerImpl> > m_children;
+    // m_maskLayer can be temporarily stolen during tree sync, we need this ID to confirm newly assigned layer is still the previous one
+    int m_maskLayerId;
+    OwnPtr<CCLayerImpl> m_maskLayer;
+    int m_replicaLayerId; // ditto
+    OwnPtr<CCLayerImpl> m_replicaLayer;
     int m_layerId;
 
     // Properties synchronized from the associated LayerChromium.
@@ -248,7 +264,9 @@ private:
     IntSize m_contentBounds;
     IntPoint m_scrollPosition;
     bool m_scrollable;
+    bool m_shouldScrollOnMainThread;
     bool m_haveWheelEventHandlers;
+    Region m_nonFastScrollableRegion;
     Color m_backgroundColor;
     bool m_backgroundCoversViewport;
 
@@ -282,8 +300,6 @@ private:
     int m_debugID;
 #endif
 
-    String m_name;
-
     // Render surface this layer draws into. This is a surface that can belong
     // either to this layer (if m_targetRenderSurface == m_renderSurface) or
     // to an ancestor of this layer. The target render surface determines the
@@ -299,6 +315,9 @@ private:
     Color m_debugBorderColor;
     float m_debugBorderWidth;
 
+    // Debug layer name.
+    String m_debugName;
+
     FilterOperations m_filters;
 
     TransformationMatrix m_drawTransform;
@@ -324,7 +343,7 @@ private:
     OwnPtr<CCLayerAnimationControllerImpl> m_layerAnimationController;
 };
 
-void sortLayers(Vector<RefPtr<CCLayerImpl> >::iterator first, Vector<RefPtr<CCLayerImpl> >::iterator end, CCLayerSorter*);
+void sortLayers(Vector<CCLayerImpl*>::iterator first, Vector<CCLayerImpl*>::iterator end, CCLayerSorter*);
 
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
index 97d6d185a..2d6d2f7f7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
@@ -35,8 +35,8 @@
 
 namespace WebCore {
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     it.m_targetRenderSurfaceLayerIndex = 0;
     it.m_currentLayerIndex = CCLayerIteratorValue::LayerIndexRepresentingTargetRenderSurface;
@@ -44,15 +44,15 @@ void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerType, Rende
     m_highestTargetRenderSurfaceLayer = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
     it.m_currentLayerIndex = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     // If the current layer has a RS, move to its layer list. Otherwise, visit the next layer in the current RS layer list.
     if (it.currentLayerRepresentsContributingRenderSurface()) {
@@ -85,23 +85,23 @@ void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerType, Render
     }
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     it.m_targetRenderSurfaceLayerIndex = 0;
     it.m_currentLayerIndex = it.targetRenderSurfaceChildren().size() - 1;
     goToHighestInSubtree(it);
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
     it.m_currentLayerIndex = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     // Moves to the previous layer in the current RS layer list. Then we check if the
     // new current layer has its own RS, in which case there are things in that RS layer list that are higher, so
@@ -128,8 +128,8 @@ void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerType, Render
     }
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     if (it.currentLayerRepresentsTargetRenderSurface())
         return;
@@ -147,23 +147,23 @@ void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<L
 }
 
 // Declare each of the above functions for LayerChromium and CCLayerImpl classes so that they are linked.
-template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront> &);
-template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront>&);
-template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront>&);
-
-template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
-template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
-template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
-
-template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
-
-template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, BackToFront> &);
+template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, BackToFront>&);
+
+template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, BackToFront>&);
+
+template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, FrontToBack>&);
+
+template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, FrontToBack>&);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
index be985e153..d89bd6912 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
@@ -92,15 +92,15 @@ struct CCLayerIteratorValue {
 };
 
 // An iterator class for walking over layers in the RenderSurface-Layer tree.
-template <typename LayerType, typename RenderSurfaceType, typename IteratorActionType>
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename IteratorActionType>
 class CCLayerIterator {
-    typedef CCLayerIterator<LayerType, RenderSurfaceType, IteratorActionType> CCLayerIteratorType;
+    typedef CCLayerIterator<LayerType, LayerList, RenderSurfaceType, IteratorActionType> CCLayerIteratorType;
 
 public:
     CCLayerIterator() : m_renderSurfaceLayerList(0) { }
 
-    static CCLayerIteratorType begin(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, true); }
-    static CCLayerIteratorType end(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, false); }
+    static CCLayerIteratorType begin(const LayerList* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, true); }
+    static CCLayerIteratorType end(const LayerList* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, false); }
 
     CCLayerIteratorType& operator++() { m_actions.next(*this); return *this; }
     bool operator==(const CCLayerIterator& other) const
@@ -117,10 +117,10 @@ public:
     bool representsContributingRenderSurface() const { return !representsTargetRenderSurface() && currentLayerRepresentsContributingRenderSurface(); }
     bool representsItself() const { return !representsTargetRenderSurface() && !representsContributingRenderSurface(); }
 
-    LayerType* targetRenderSurfaceLayer() const { return (*m_renderSurfaceLayerList)[m_targetRenderSurfaceLayerIndex].get(); }
+    LayerType* targetRenderSurfaceLayer() const { return getRawPtr((*m_renderSurfaceLayerList)[m_targetRenderSurfaceLayerIndex]); }
 
 private:
-    CCLayerIterator(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList, bool start)
+    CCLayerIterator(const LayerList* renderSurfaceLayerList, bool start)
         : m_renderSurfaceLayerList(renderSurfaceLayerList)
     {
         if (start && !renderSurfaceLayerList->isEmpty())
@@ -129,16 +129,19 @@ private:
             m_actions.end(*this);
     }
 
-    inline LayerType* currentLayer() const { return currentLayerRepresentsTargetRenderSurface() ? targetRenderSurfaceLayer() : targetRenderSurfaceChildren()[m_currentLayerIndex].get(); }
+    inline static LayerChromium* getRawPtr(const RefPtr<LayerChromium>& ptr) { return ptr.get(); }
+    inline static CCLayerImpl* getRawPtr(CCLayerImpl* ptr) { return ptr; }
+
+    inline LayerType* currentLayer() const { return currentLayerRepresentsTargetRenderSurface() ? targetRenderSurfaceLayer() : getRawPtr(targetRenderSurfaceChildren()[m_currentLayerIndex]); }
 
     inline bool currentLayerRepresentsContributingRenderSurface() const { return CCLayerTreeHostCommon::renderSurfaceContributesToTarget<LayerType>(currentLayer(), targetRenderSurfaceLayer()->id()); }
     inline bool currentLayerRepresentsTargetRenderSurface() const { return m_currentLayerIndex == CCLayerIteratorValue::LayerIndexRepresentingTargetRenderSurface; }
 
     inline RenderSurfaceType* targetRenderSurface() const { return targetRenderSurfaceLayer()->renderSurface(); }
-    inline const Vector<RefPtr<LayerType> >& targetRenderSurfaceChildren() const { return targetRenderSurface()->layerList(); }
+    inline const LayerList& targetRenderSurfaceChildren() const { return targetRenderSurface()->layerList(); }
 
     IteratorActionType m_actions;
-    const Vector<RefPtr<LayerType> >* m_renderSurfaceLayerList;
+    const LayerList* m_renderSurfaceLayerList;
 
     // The iterator's current position.
 
@@ -161,14 +164,14 @@ struct CCLayerIteratorActions {
     // Walks layers sorted by z-order from back to front.
     class BackToFront {
     public:
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void begin(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void end(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void next(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
     private:
         int m_highestTargetRenderSurfaceLayer;
@@ -177,18 +180,18 @@ struct CCLayerIteratorActions {
     // Walks layers sorted by z-order from front to back
     class FrontToBack {
     public:
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void begin(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void end(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void next(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
     private:
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void goToHighestInSubtree(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void goToHighestInSubtree(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
     };
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp
index 752855447..c434a1d95 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp
@@ -295,7 +295,7 @@ void CCLayerSorter::createGraphNodes(LayerList::iterator first, LayerList::itera
     float minZ = FLT_MAX;
     float maxZ = -FLT_MAX;
     for (LayerList::const_iterator it = first; it < last; it++) {
-        m_nodes.append(GraphNode(it->get()));
+        m_nodes.append(GraphNode(*it));
         GraphNode& node = m_nodes.at(m_nodes.size() - 1);
         CCRenderSurface* renderSurface = node.layer->renderSurface();
         if (!node.layer->drawsContent() && !renderSurface)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.h
index 2c30d5dae..8ab9b7581 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.h
@@ -39,7 +39,7 @@ class CCLayerSorter {
 public:
     CCLayerSorter();
 
-    typedef Vector<RefPtr<CCLayerImpl> > LayerList;
+    typedef Vector<CCLayerImpl*> LayerList;
 
     void sort(LayerList::iterator first, LayerList::iterator last);
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
index cfefbd2b8..19d0251dc 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
@@ -112,6 +112,24 @@ IntRect CCLayerTilingData::tileRect(const Tile* tile) const
     return tileRect;
 }
 
+Region CCLayerTilingData::opaqueRegionInLayerRect(const IntRect& layerRect) const
+{
+    Region opaqueRegion;
+    int left, top, right, bottom;
+    layerRectToTileIndices(layerRect, left, top, right, bottom);
+    for (int j = top; j <= bottom; ++j) {
+        for (int i = left; i <= right; ++i) {
+            Tile* tile = tileAt(i, j);
+            if (!tile)
+                continue;
+
+            IntRect tileOpaqueRect = intersection(layerRect, tile->opaqueRect());
+            opaqueRegion.unite(tileOpaqueRect);
+        }
+    }
+    return opaqueRegion;
+}
+
 void CCLayerTilingData::setBounds(const IntSize& size)
 {
     m_tilingData.setTotalSize(size.width(), size.height());
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
index 869d42e15..9e18695e8 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
@@ -30,6 +30,7 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "IntRect.h"
+#include "Region.h"
 #include "TilingData.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
@@ -69,9 +70,13 @@ public:
         int i() const { return m_i; }
         int j() const { return m_j; }
         void moveTo(int i, int j) { m_i = i; m_j = j; }
+
+        const IntRect& opaqueRect() const { return m_opaqueRect; }
+        void setOpaqueRect(const IntRect& opaqueRect) { m_opaqueRect = opaqueRect; }
     private:
         int m_i;
         int m_j;
+        IntRect m_opaqueRect;
     };
     // Default hash key traits for integers disallow 0 and -1 as a key, so
     // use a custom hash trait which disallows -1 and -2 instead.
@@ -96,6 +101,8 @@ public:
     void layerRectToTileIndices(const IntRect&, int &left, int &top, int &right, int &bottom) const;
     IntRect tileRect(const Tile*) const;
 
+    Region opaqueRegionInLayerRect(const IntRect&) const;
+
     void reset();
 
 protected:
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
index 501ee17de..34bce1181 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
@@ -35,6 +35,7 @@
 #include "cc/CCLayerIterator.h"
 #include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCLayerTreeHostImpl.h"
+#include "cc/CCOcclusionTracker.h"
 #include "cc/CCSingleThreadProxy.h"
 #include "cc/CCThread.h"
 #include "cc/CCThreadProxy.h"
@@ -66,6 +67,9 @@ CCLayerTreeHost::CCLayerTreeHost(CCLayerTreeHostClient* client, const CCSettings
     , m_client(client)
     , m_frameNumber(0)
     , m_layerRendererInitialized(false)
+    , m_contextLost(false)
+    , m_numTimesRecreateShouldFail(0)
+    , m_numFailedRecreateAttempts(0)
     , m_settings(settings)
     , m_visible(true)
     , m_pageScaleFactor(1)
@@ -114,7 +118,7 @@ void CCLayerTreeHost::initializeLayerRenderer()
     TRACE_EVENT("CCLayerTreeHost::initializeLayerRenderer", this, 0);
     if (!m_proxy->initializeLayerRenderer()) {
         // Uh oh, better tell the client that we can't do anything with this context.
-        m_client->didRecreateGraphicsContext(false);
+        m_client->didRecreateContext(false);
         return;
     }
 
@@ -131,6 +135,40 @@ void CCLayerTreeHost::initializeLayerRenderer()
     m_layerRendererInitialized = true;
 }
 
+CCLayerTreeHost::RecreateResult CCLayerTreeHost::recreateContext()
+{
+    TRACE_EVENT0("cc", "CCLayerTreeHost::recreateContext");
+    ASSERT(m_contextLost);
+
+    bool recreated = false;
+    if (!m_numTimesRecreateShouldFail)
+        recreated = m_proxy->recreateContext();
+    else
+        m_numTimesRecreateShouldFail--;
+
+    if (recreated) {
+        m_client->didRecreateContext(true);
+        m_contextLost = false;
+        return RecreateSucceeded;
+    }
+
+    // Tolerate a certain number of recreation failures to work around races
+    // in the context-lost machinery.
+    m_numFailedRecreateAttempts++;
+    if (m_numFailedRecreateAttempts < 5) {
+        // FIXME: The single thread does not self-schedule context
+        // recreation. So force another recreation attempt to happen by requesting
+        // another commit.
+        if (!CCProxy::hasImplThread())
+            setNeedsCommit();
+        return RecreateFailedButTryAgain;
+    }
+
+    // We have tried too many times to recreate the context. Tell the host to fall
+    // back to software rendering.
+    m_client->didRecreateContext(false);
+    return RecreateFailedAndGaveUp;
+}
 
 void CCLayerTreeHost::deleteContentsTexturesOnImplThread(TextureAllocator* allocator)
 {
@@ -169,13 +207,11 @@ void CCLayerTreeHost::finishCommitOnImplThread(CCLayerTreeHostImpl* hostImpl)
 {
     ASSERT(CCProxy::isImplThread());
 
-    // Synchronize trees, if one exists at all...
-    if (rootLayer()) {
-        hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->rootLayer()));
-        // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+    hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->releaseRootLayer()));
+
+    // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+    if (rootLayer())
         hostImpl->setNeedsAnimateLayers();
-    } else
-        hostImpl->setRootLayer(0);
 
     hostImpl->setSourceFrameNumber(frameNumber());
     hostImpl->setViewportSize(viewportSize());
@@ -191,9 +227,9 @@ void CCLayerTreeHost::commitComplete()
     m_contentsTextureManager->unprotectAllTextures();
 }
 
-PassRefPtr<GraphicsContext3D> CCLayerTreeHost::createLayerTreeHostContext3D()
+PassRefPtr<GraphicsContext3D> CCLayerTreeHost::createContext()
 {
-    return m_client->createLayerTreeHostContext3D();
+    return m_client->createContext();
 }
 
 PassOwnPtr<CCLayerTreeHostImpl> CCLayerTreeHost::createLayerTreeHostImpl(CCLayerTreeHostImplClient* client)
@@ -201,15 +237,18 @@ PassOwnPtr<CCLayerTreeHostImpl> CCLayerTreeHost::createLayerTreeHostImpl(CCLayer
     return CCLayerTreeHostImpl::create(m_settings, client);
 }
 
-void CCLayerTreeHost::didRecreateGraphicsContext(bool success)
+void CCLayerTreeHost::didLoseContext()
 {
-    m_client->didRecreateGraphicsContext(success);
+    TRACE_EVENT("CCLayerTreeHost::didLoseContext", 0, this);
+    ASSERT(CCProxy::isMainThread());
+    m_contextLost = true;
+    m_numFailedRecreateAttempts = 0;
+    setNeedsCommit();
 }
 
 // Temporary hack until WebViewImpl context creation gets simplified
 GraphicsContext3D* CCLayerTreeHost::context()
 {
-    ASSERT(!CCProxy::hasImplThread());
     return m_proxy->context();
 }
 
@@ -220,6 +259,10 @@ bool CCLayerTreeHost::compositeAndReadback(void *pixels, const IntRect& rect)
         if (!m_layerRendererInitialized)
             return false;
     }
+    if (m_contextLost) {
+        if (recreateContext() != RecreateSucceeded)
+            return false;
+    }
     m_triggerIdlePaints = false;
     bool ret = m_proxy->compositeAndReadback(pixels, rect);
     m_triggerIdlePaints = true;
@@ -259,10 +302,10 @@ void CCLayerTreeHost::setNeedsRedraw()
         m_client->scheduleComposite();
 }
 
-void CCLayerTreeHost::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events)
+void CCLayerTreeHost::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events, double wallClockTime)
 {
     ASSERT(CCThreadProxy::isMainThread());
-    // FIXME: need to walk the tree.
+    setAnimationEventsRecursive(*events, m_rootLayer.get(), wallClockTime);
 }
 
 void CCLayerTreeHost::setRootLayer(PassRefPtr<LayerChromium> rootLayer)
@@ -309,10 +352,7 @@ void CCLayerTreeHost::setVisible(bool visible)
 
     m_visible = visible;
 
-    if (!m_layerRendererInitialized)
-        return;
-
-    if (!visible) {
+    if (!visible && m_layerRendererInitialized) {
         m_contentsTextureManager->reduceMemoryToLimit(TextureManager::lowLimitBytes(viewportSize()));
         m_contentsTextureManager->unprotectAllTextures();
     }
@@ -326,6 +366,9 @@ void CCLayerTreeHost::setVisible(bool visible)
 void CCLayerTreeHost::didBecomeInvisibleOnImplThread(CCLayerTreeHostImpl* hostImpl)
 {
     ASSERT(CCProxy::isImplThread());
+    if (!m_layerRendererInitialized)
+        return;
+
     if (m_proxy->layerRendererCapabilities().contextHasCachedFrontBuffer)
         contentsTextureManager()->evictAndDeleteAllTextures(hostImpl->contentsTextureAllocator());
     else {
@@ -337,16 +380,15 @@ void CCLayerTreeHost::didBecomeInvisibleOnImplThread(CCLayerTreeHostImpl* hostIm
     // If the frontbuffer is cached, then clobber the impl tree. Otherwise,
     // push over the tree changes.
     if (m_proxy->layerRendererCapabilities().contextHasCachedFrontBuffer) {
-        hostImpl->setRootLayer(0);
+        hostImpl->setRootLayer(nullptr);
         return;
     }
 
-    if (rootLayer()) {
-        hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->rootLayer()));
-        // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+    hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->releaseRootLayer()));
+
+    // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+    if (rootLayer())
         hostImpl->setNeedsAnimateLayers();
-    } else
-        hostImpl->setRootLayer(0);
 }
 
 void CCLayerTreeHost::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
@@ -354,9 +396,11 @@ void CCLayerTreeHost::startPageScaleAnimation(const IntSize& targetPosition, boo
     m_proxy->startPageScaleAnimation(targetPosition, useAnchor, scale, durationSec);
 }
 
-void CCLayerTreeHost::loseCompositorContext(int numTimes)
+void CCLayerTreeHost::loseContext(int numTimes)
 {
-    m_proxy->loseCompositorContext(numTimes);
+    TRACE_EVENT1("cc", "CCLayerTreeHost::loseCompositorContext", "numTimes", numTimes);
+    m_numTimesRecreateShouldFail = numTimes - 1;
+    m_proxy->loseContext();
 }
 
 TextureManager* CCLayerTreeHost::contentsTextureManager() const
@@ -378,6 +422,10 @@ bool CCLayerTreeHost::updateLayers()
         if (!m_layerRendererInitialized)
             return false;
     }
+    if (m_contextLost) {
+        if (recreateContext() != RecreateSucceeded)
+            return false;
+    }
 
     if (!rootLayer())
         return true;
@@ -440,7 +488,7 @@ void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer)
 void CCLayerTreeHost::reserveTextures()
 {
     // Use BackToFront since it's cheap and this isn't order-dependent.
-    typedef CCLayerIterator<LayerChromium, RenderSurfaceChromium, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
+    typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&m_updateList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&m_updateList); it != end; ++it) {
@@ -458,7 +506,7 @@ void CCLayerTreeHost::paintContentsIfDirty(LayerChromium* layer, PaintType paint
     if (PaintVisible == paintType)
         layer->paintContentsIfDirty(occludedScreenSpace);
     else
-        layer->idlePaintContentsIfDirty();
+        layer->idlePaintContentsIfDirty(occludedScreenSpace);
 }
 
 void CCLayerTreeHost::paintMaskAndReplicaForRenderSurface(LayerChromium* renderSurfaceLayer, PaintType paintType)
@@ -486,90 +534,36 @@ void CCLayerTreeHost::paintMaskAndReplicaForRenderSurface(LayerChromium* renderS
     }
 }
 
-struct RenderSurfaceRegion {
-    RenderSurfaceChromium* surface;
-    Region occludedInScreen;
-};
-
-// Add the surface to the top of the stack and copy the occlusion from the old top of the stack to the new.
-static void enterTargetRenderSurface(Vector<RenderSurfaceRegion>& stack, RenderSurfaceChromium* newTarget)
-{
-    if (stack.isEmpty()) {
-        stack.append(RenderSurfaceRegion());
-        stack.last().surface = newTarget;
-    } else if (stack.last().surface != newTarget) {
-        // If we are entering a subtree that is going to move pixels around, then the occlusion we've computed
-        // so far won't apply to the pixels we're drawing here in the same way. We discard the occlusion thus
-        // far to be safe, and ensure we don't cull any pixels that are moved such that they become visible.
-        const RenderSurfaceChromium* oldAncestorThatMovesPixels = stack.last().surface->nearestAncestorThatMovesPixels();
-        const RenderSurfaceChromium* newAncestorThatMovesPixels = newTarget->nearestAncestorThatMovesPixels();
-        bool enteringSubtreeThatMovesPixels = newAncestorThatMovesPixels && newAncestorThatMovesPixels != oldAncestorThatMovesPixels;
-
-        stack.append(RenderSurfaceRegion());
-        stack.last().surface = newTarget;
-        int lastIndex = stack.size() - 1;
-        if (!enteringSubtreeThatMovesPixels)
-            stack[lastIndex].occludedInScreen = stack[lastIndex - 1].occludedInScreen;
-    }
-}
-
-// Pop the top of the stack off, push on the new surface, and merge the old top's occlusion into the new top surface.
-static void leaveTargetRenderSurface(Vector<RenderSurfaceRegion>& stack, RenderSurfaceChromium* newTarget)
-{
-    int lastIndex = stack.size() - 1;
-    bool surfaceWillBeAtTopAfterPop = stack.size() > 1 && stack[lastIndex - 1].surface == newTarget;
-
-    if (surfaceWillBeAtTopAfterPop) {
-        // Merge the top of the stack down.
-        stack[lastIndex - 1].occludedInScreen.unite(stack[lastIndex].occludedInScreen);
-        stack.removeLast();
-    } else {
-        // Replace the top of the stack with the new pushed surface. Copy the occluded region to the top.
-        stack.last().surface = newTarget;
-    }
-}
-
 void CCLayerTreeHost::paintLayerContents(const LayerList& renderSurfaceLayerList, PaintType paintType)
 {
     // Use FrontToBack to allow for testing occlusion and performing culling during the tree walk.
-    typedef CCLayerIterator<LayerChromium, RenderSurfaceChromium, CCLayerIteratorActions::FrontToBack> CCLayerIteratorType;
+    typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::FrontToBack> CCLayerIteratorType;
 
-    // The stack holds occluded regions for subtrees in the RenderSurface-Layer tree, so that when we leave a subtree we may
-    // apply a mask to it, but not to the parts outside the subtree.
-    // - The first time we see a new subtree under a target, we add that target to the top of the stack. This can happen as a layer representing itself, or as a target surface.
-    // - When we visit a target surface, we apply its mask to its subtree, which is at the top of the stack.
-    // - When we visit a layer representing itself, we add its occlusion to the current subtree, which is at the top of the stack.
-    // - When we visit a layer representing a contributing surface, the current target will never be the top of the stack since we just came from the contributing surface.
-    // We merge the occlusion at the top of the stack with the new current subtree. This new target is pushed onto the stack if not already there.
-    Vector<RenderSurfaceRegion> targetSurfaceStack;
+    CCOcclusionTracker occlusionTracker(IntRect(IntPoint(), viewportSize()));
+    occlusionTracker.setUsePaintTracking(false); // FIXME: Remove this to turn on paint tracking for paint culling
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&renderSurfaceLayerList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&renderSurfaceLayerList); it != end; ++it) {
         if (it.representsTargetRenderSurface()) {
             ASSERT(it->renderSurface()->drawOpacity());
 
-            enterTargetRenderSurface(targetSurfaceStack, it->renderSurface());
+            occlusionTracker.finishedTargetRenderSurface(*it, it->renderSurface());
             paintMaskAndReplicaForRenderSurface(*it, paintType);
-            // FIXME: add the replica layer to the current occlusion
-
-            if (it->maskLayer() || it->renderSurface()->drawOpacity() < 1 || it->renderSurface()->filters().hasFilterThatAffectsOpacity())
-                targetSurfaceStack.last().occludedInScreen = Region();
         } else if (it.representsItself()) {
             ASSERT(!it->bounds().isEmpty());
 
-            enterTargetRenderSurface(targetSurfaceStack, it->targetRenderSurface());
-            paintContentsIfDirty(*it, paintType, targetSurfaceStack.last().occludedInScreen);
-            it->addSelfToOccludedScreenSpace(targetSurfaceStack.last().occludedInScreen);
-        } else {
-            leaveTargetRenderSurface(targetSurfaceStack, it.targetRenderSurfaceLayer()->renderSurface());
-        }
+            occlusionTracker.enterTargetRenderSurface(it->targetRenderSurface());
+            paintContentsIfDirty(*it, paintType, occlusionTracker.currentOcclusionInScreenSpace());
+            occlusionTracker.markOccludedBehindLayer(*it);
+        } else
+            occlusionTracker.leaveToTargetRenderSurface(it.targetRenderSurfaceLayer()->renderSurface());
     }
 }
 
 void CCLayerTreeHost::updateCompositorResources(GraphicsContext3D* context, CCTextureUpdater& updater)
 {
     // Use BackToFront since it's cheap and this isn't order-dependent.
-    typedef CCLayerIterator<LayerChromium, RenderSurfaceChromium, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
+    typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&m_updateList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&m_updateList); it != end; ++it) {
@@ -647,4 +641,15 @@ void CCLayerTreeHost::deleteTextureAfterCommit(PassOwnPtr<ManagedTexture> textur
     m_deleteTextureAfterCommitList.append(texture);
 }
 
+void CCLayerTreeHost::setAnimationEventsRecursive(const CCAnimationEventsVector& events, LayerChromium* layer, double wallClockTime)
+{
+    for (size_t eventIndex = 0; eventIndex < events.size(); ++eventIndex) {
+        if (layer->id() == events[eventIndex]->layerId())
+            layer->setAnimationEvent(*events[eventIndex], wallClockTime);
+    }
+
+    for (size_t childIndex = 0; childIndex < layer->children().size(); ++childIndex)
+        setAnimationEventsRecursive(events, layer->children()[childIndex].get(), wallClockTime);
 }
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
index 1662f50c3..d5262262d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
@@ -55,8 +55,8 @@ public:
     virtual void updateAnimations(double frameBeginTime) = 0;
     virtual void layout() = 0;
     virtual void applyScrollAndScale(const IntSize& scrollDelta, float pageScale) = 0;
-    virtual PassRefPtr<GraphicsContext3D> createLayerTreeHostContext3D() = 0;
-    virtual void didRecreateGraphicsContext(bool success) = 0;
+    virtual PassRefPtr<GraphicsContext3D> createContext() = 0;
+    virtual void didRecreateContext(bool success) = 0;
     virtual void didCommitAndDrawFrame() = 0;
     virtual void didCompleteSwapBuffers() = 0;
 
@@ -130,13 +130,21 @@ public:
     void beginCommitOnImplThread(CCLayerTreeHostImpl*);
     void finishCommitOnImplThread(CCLayerTreeHostImpl*);
     void commitComplete();
-    PassRefPtr<GraphicsContext3D> createLayerTreeHostContext3D();
+    PassRefPtr<GraphicsContext3D> createContext();
     virtual PassOwnPtr<CCLayerTreeHostImpl> createLayerTreeHostImpl(CCLayerTreeHostImplClient*);
     void didBecomeInvisibleOnImplThread(CCLayerTreeHostImpl*);
-    void didRecreateGraphicsContext(bool success);
+    void didLoseContext();
+    enum RecreateResult {
+        RecreateSucceeded,
+        RecreateFailedButTryAgain,
+        RecreateFailedAndGaveUp,
+    };
+    RecreateResult recreateContext();
     void didCommitAndDrawFrame() { m_client->didCommitAndDrawFrame(); }
     void didCompleteSwapBuffers() { m_client->didCompleteSwapBuffers(); }
     void deleteContentsTexturesOnImplThread(TextureAllocator*);
+    // Returns false if we should abort this frame due to initialization failure.
+    bool updateLayers();
 
     CCLayerTreeHostClient* client() { return m_client; }
 
@@ -145,6 +153,8 @@ public:
     // Only used when compositing on the main thread.
     void composite();
 
+    // NOTE: The returned value can only be used to make GL calls or make the
+    // context current on the thread the compositor is running on!
     GraphicsContext3D* context();
 
     // Composites and attempts to read back the result into the provided
@@ -159,14 +169,14 @@ public:
     const LayerRendererCapabilities& layerRendererCapabilities() const;
 
     // Test only hook
-    void loseCompositorContext(int numTimes);
+    void loseContext(int numTimes);
 
     void setNeedsAnimate();
     // virtual for testing
     virtual void setNeedsCommit();
     void setNeedsRedraw();
 
-    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>);
+    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime);
 
     LayerChromium* rootLayer() { return m_rootLayer.get(); }
     const LayerChromium* rootLayer() const { return m_rootLayer.get(); }
@@ -185,9 +195,6 @@ public:
     bool visible() const { return m_visible; }
     void setVisible(bool);
 
-    // Returns false if we should abort this frame due to initialization failure.
-    bool updateLayers();
-
     void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
 
     void updateCompositorResources(GraphicsContext3D*, CCTextureUpdater&);
@@ -218,6 +225,8 @@ private:
     void reserveTextures();
     void clearPendingUpdate();
 
+    void setAnimationEventsRecursive(const CCAnimationEventsVector&, LayerChromium*, double wallClockTime);
+
     int m_compositorIdentifier;
 
     bool m_animating;
@@ -228,6 +237,9 @@ private:
 
     OwnPtr<CCProxy> m_proxy;
     bool m_layerRendererInitialized;
+    bool m_contextLost;
+    int m_numTimesRecreateShouldFail;
+    int m_numFailedRecreateAttempts;
 
     RefPtr<LayerChromium> m_rootLayer;
     OwnPtr<TextureManager> m_contentsTextureManager;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
index 4fc869400..c86d74d86 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
@@ -149,11 +149,9 @@ static bool subtreeShouldRenderToSeparateSurface(LayerType* layer, bool axisAlig
 
 // Recursively walks the layer tree starting at the given node and computes all the
 // necessary transformations, clipRects, render surfaces, etc.
-template<typename LayerType, typename RenderSurfaceType, typename LayerSorter>
-static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, LayerType* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, RenderSurfaceType* nearestAncestorThatMovesPixels, Vector<RefPtr<LayerType> >& renderSurfaceLayerList, Vector<RefPtr<LayerType> >& layerList, LayerSorter* layerSorter, int maxTextureSize)
+template<typename LayerType, typename LayerList, typename RenderSurfaceType, typename LayerSorter>
+static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, LayerType* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, RenderSurfaceType* nearestAncestorThatMovesPixels, LayerList& renderSurfaceLayerList, LayerList& layerList, LayerSorter* layerSorter, int maxTextureSize)
 {
-    typedef Vector<RefPtr<LayerType> > LayerList;
-
     // This function computes the new matrix transformations recursively for this
     // layer and all its descendants. It also computes the appropriate render surfaces.
     // Some important points to remember:
@@ -390,7 +388,7 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
 
     for (size_t i = 0; i < layer->children().size(); ++i) {
         LayerType* child = layer->children()[i].get();
-        bool drawsContent = calculateDrawTransformsAndVisibilityInternal<LayerType, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, nearestAncestorThatMovesPixels, renderSurfaceLayerList, descendants, layerSorter, maxTextureSize);
+        bool drawsContent = calculateDrawTransformsAndVisibilityInternal<LayerType, LayerList, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, nearestAncestorThatMovesPixels, renderSurfaceLayerList, descendants, layerSorter, maxTextureSize);
 
         if (drawsContent) {
             if (child->renderSurface()) {
@@ -495,11 +493,11 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
 // FIXME: Instead of using the following function to set visibility rects on a second
 // tree pass, revise calculateVisibleLayerRect() so that this can be done in a single
 // pass inside calculateDrawTransformsAndVisibilityInternal<>().
-template<typename LayerType, typename RenderSurfaceType>
-static void walkLayersAndCalculateVisibleLayerRects(const Vector<RefPtr<LayerType> >& renderSurfaceLayerList)
+template<typename LayerType, typename LayerList, typename RenderSurfaceType>
+static void walkLayersAndCalculateVisibleLayerRects(const LayerList& renderSurfaceLayerList)
 {
     // Use BackToFront since it's cheap and this isn't order-dependent.
-    typedef CCLayerIterator<LayerType, RenderSurfaceType, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
+    typedef CCLayerIterator<LayerType, LayerList, RenderSurfaceType, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&renderSurfaceLayerList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&renderSurfaceLayerList); it != end; ++it) {
@@ -512,14 +510,14 @@ static void walkLayersAndCalculateVisibleLayerRects(const Vector<RefPtr<LayerTyp
 
 void CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(LayerChromium* layer, LayerChromium* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, Vector<RefPtr<LayerChromium> >& layerList, int maxTextureSize)
 {
-    WebCore::calculateDrawTransformsAndVisibilityInternal<LayerChromium, RenderSurfaceChromium, void*>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, 0, maxTextureSize);
-    walkLayersAndCalculateVisibleLayerRects<LayerChromium, RenderSurfaceChromium>(renderSurfaceLayerList);
+    WebCore::calculateDrawTransformsAndVisibilityInternal<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, void>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, 0, maxTextureSize);
+    walkLayersAndCalculateVisibleLayerRects<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium>(renderSurfaceLayerList);
 }
 
-void CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(CCLayerImpl* layer, CCLayerImpl* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<CCLayerImpl> >& renderSurfaceLayerList, Vector<RefPtr<CCLayerImpl> >& layerList, CCLayerSorter* layerSorter, int maxTextureSize)
+void CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(CCLayerImpl* layer, CCLayerImpl* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList, CCLayerSorter* layerSorter, int maxTextureSize)
 {
-    calculateDrawTransformsAndVisibilityInternal<CCLayerImpl, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, layerSorter, maxTextureSize);
-    walkLayersAndCalculateVisibleLayerRects<CCLayerImpl, CCRenderSurface>(renderSurfaceLayerList);
+    calculateDrawTransformsAndVisibilityInternal<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, layerSorter, maxTextureSize);
+    walkLayersAndCalculateVisibleLayerRects<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface>(renderSurfaceLayerList);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h
index 2e0cbcf2c..df23cd01f 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h
@@ -43,7 +43,7 @@ public:
     template<typename LayerType> static IntRect calculateVisibleLayerRect(LayerType*);
 
     static void calculateDrawTransformsAndVisibility(LayerChromium*, LayerChromium* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, Vector<RefPtr<LayerChromium> >& layerList, int maxTextureSize);
-    static void calculateDrawTransformsAndVisibility(CCLayerImpl*, CCLayerImpl* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<CCLayerImpl> >& renderSurfaceLayerList, Vector<RefPtr<CCLayerImpl> >& layerList, CCLayerSorter*, int maxTextureSize);
+    static void calculateDrawTransformsAndVisibility(CCLayerImpl*, CCLayerImpl* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList, CCLayerSorter*, int maxTextureSize);
 
     template<typename LayerType> static bool renderSurfaceContributesToTarget(LayerType*, int targetSurfaceLayerID);
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
index d30c68c37..002e7826d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
@@ -31,6 +31,7 @@
 #include "LayerRendererChromium.h"
 #include "TraceEvent.h"
 #include "cc/CCDamageTracker.h"
+#include "cc/CCDelayBasedTimeSource.h"
 #include "cc/CCLayerIterator.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostCommon.h"
@@ -39,8 +40,48 @@
 #include "cc/CCThreadTask.h"
 #include <wtf/CurrentTime.h>
 
+namespace {
+const double lowFrequencyAnimationInterval = 1;
+} // namespace
+
 namespace WebCore {
 
+class CCLayerTreeHostImplTimeSourceAdapter : public CCTimeSourceClient {
+    WTF_MAKE_NONCOPYABLE(CCLayerTreeHostImplTimeSourceAdapter);
+public:
+    static PassOwnPtr<CCLayerTreeHostImplTimeSourceAdapter> create(CCLayerTreeHostImpl* layerTreeHostImpl, PassRefPtr<CCDelayBasedTimeSource> timeSource)
+    {
+        return adoptPtr(new CCLayerTreeHostImplTimeSourceAdapter(layerTreeHostImpl, timeSource));
+    }
+    virtual ~CCLayerTreeHostImplTimeSourceAdapter()
+    {
+        m_timeSource->setClient(0);
+        m_timeSource->setActive(false);
+    }
+
+    virtual void onTimerTick()
+    {
+        m_layerTreeHostImpl->animate(monotonicallyIncreasingTime(), currentTime());
+    }
+
+    void setActive(bool active)
+    {
+        if (active != m_timeSource->active())
+            m_timeSource->setActive(active);
+    }
+
+private:
+    CCLayerTreeHostImplTimeSourceAdapter(CCLayerTreeHostImpl* layerTreeHostImpl, PassRefPtr<CCDelayBasedTimeSource> timeSource)
+        : m_layerTreeHostImpl(layerTreeHostImpl)
+        , m_timeSource(timeSource)
+    {
+        m_timeSource->setClient(this);
+    }
+
+    CCLayerTreeHostImpl* m_layerTreeHostImpl;
+    RefPtr<CCDelayBasedTimeSource> m_timeSource;
+};
+
 PassOwnPtr<CCLayerTreeHostImpl> CCLayerTreeHostImpl::create(const CCSettings& settings, CCLayerTreeHostImplClient* client)
 {
     return adoptPtr(new CCLayerTreeHostImpl(settings, client));
@@ -50,6 +91,7 @@ CCLayerTreeHostImpl::CCLayerTreeHostImpl(const CCSettings& settings, CCLayerTree
     : m_client(client)
     , m_sourceFrameNumber(-1)
     , m_frameNumber(0)
+    , m_scrollLayerImpl(0)
     , m_settings(settings)
     , m_visible(true)
     , m_pageScale(1)
@@ -59,6 +101,7 @@ CCLayerTreeHostImpl::CCLayerTreeHostImpl(const CCSettings& settings, CCLayerTree
     , m_maxPageScale(0)
     , m_needsAnimateLayers(false)
     , m_pinchGestureActive(false)
+    , m_timeSourceClientAdapter(CCLayerTreeHostImplTimeSourceAdapter::create(this, CCDelayBasedTimeSource::create(lowFrequencyAnimationInterval * 1000.0, CCProxy::currentThread())))
 {
     ASSERT(CCProxy::isImplThread());
 }
@@ -96,13 +139,13 @@ GraphicsContext3D* CCLayerTreeHostImpl::context()
     return m_layerRenderer ? m_layerRenderer->context() : 0;
 }
 
-void CCLayerTreeHostImpl::animate(double frameBeginTimeMs)
+void CCLayerTreeHostImpl::animate(double monotonicTime, double wallClockTime)
 {
-    animatePageScale(frameBeginTimeMs);
-    animateLayers(frameBeginTimeMs);
+    animatePageScale(monotonicTime);
+    animateLayers(monotonicTime, wallClockTime);
 }
 
-void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTimeMs, double durationMs)
+void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTime, double duration)
 {
     if (!m_scrollLayerImpl)
         return;
@@ -113,15 +156,15 @@ void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition,
     IntSize scaledContentSize = contentSize();
     scaledContentSize.scale(m_pageScaleDelta);
 
-    m_pageScaleAnimation = CCPageScaleAnimation::create(scrollTotal, scaleTotal, m_viewportSize, scaledContentSize, startTimeMs);
+    m_pageScaleAnimation = CCPageScaleAnimation::create(scrollTotal, scaleTotal, m_viewportSize, scaledContentSize, startTime);
 
     if (anchorPoint) {
         IntSize windowAnchor(targetPosition);
         windowAnchor.scale(scaleTotal / pageScale);
         windowAnchor -= scrollTotal;
-        m_pageScaleAnimation->zoomWithAnchor(windowAnchor, pageScale, durationMs);
+        m_pageScaleAnimation->zoomWithAnchor(windowAnchor, pageScale, duration);
     } else
-        m_pageScaleAnimation->zoomTo(targetPosition, pageScale, durationMs);
+        m_pageScaleAnimation->zoomTo(targetPosition, pageScale, duration);
 
     m_client->setNeedsRedrawOnImplThread();
     m_client->setNeedsCommitOnImplThread();
@@ -134,7 +177,7 @@ void CCLayerTreeHostImpl::trackDamageForAllSurfaces(CCLayerImpl* rootDrawLayer,
     // damage rect. The root damage rect is then used to scissor each surface.
 
     for (int surfaceIndex = renderSurfaceLayerList.size() - 1; surfaceIndex >= 0 ; --surfaceIndex) {
-        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex].get();
+        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex];
         CCRenderSurface* renderSurface = renderSurfaceLayer->renderSurface();
         ASSERT(renderSurface);
         renderSurface->damageTracker()->updateDamageTrackingState(renderSurface->layerList(), renderSurfaceLayer->id(), renderSurfaceLayer->maskLayer());
@@ -198,7 +241,7 @@ void CCLayerTreeHostImpl::calculateRenderPasses(CCRenderPassList& passes, CCLaye
     m_rootDamageRect = rootLayer()->renderSurface()->damageTracker()->currentDamageRect();
 
     for (int surfaceIndex = renderSurfaceLayerList.size() - 1; surfaceIndex >= 0 ; --surfaceIndex) {
-        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex].get();
+        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex];
         CCRenderSurface* renderSurface = renderSurfaceLayer->renderSurface();
 
         OwnPtr<CCRenderPass> pass = CCRenderPass::create(renderSurface);
@@ -210,7 +253,7 @@ void CCLayerTreeHostImpl::calculateRenderPasses(CCRenderPassList& passes, CCLaye
 
         const CCLayerList& layerList = renderSurface->layerList();
         for (unsigned layerIndex = 0; layerIndex < layerList.size(); ++layerIndex) {
-            CCLayerImpl* layer = layerList[layerIndex].get();
+            CCLayerImpl* layer = layerList[layerIndex];
             if (layer->visibleLayerRect().isEmpty())
                 continue;
 
@@ -233,20 +276,27 @@ void CCLayerTreeHostImpl::optimizeRenderPasses(CCRenderPassList& passes)
 
     bool haveDamageRect = layerRendererCapabilities().usingPartialSwap;
 
+    // FIXME: compute overdraw metrics only occasionally, not every frame.
+    CCOverdrawCounts overdrawCounts;
     for (unsigned i = 0; i < passes.size(); ++i) {
-        FloatRect damageRect = passes[i]->targetSurface()->damageTracker()->currentDamageRect();
-        passes[i]->optimizeQuads(haveDamageRect, damageRect);
+        FloatRect damageRect = passes[i]->surfaceDamageRect();
+        passes[i]->optimizeQuads(haveDamageRect, damageRect, &overdrawCounts);
     }
+
+    float normalization = 1000.f / (m_layerRenderer->viewportWidth() * m_layerRenderer->viewportHeight());
+    PlatformSupport::histogramCustomCounts("Renderer4.pixelOverdrawOpaque", static_cast<int>(normalization * overdrawCounts.m_pixelsDrawnOpaque), 100, 1000000, 50);
+    PlatformSupport::histogramCustomCounts("Renderer4.pixelOverdrawTransparent", static_cast<int>(normalization * overdrawCounts.m_pixelsDrawnTransparent), 100, 1000000, 50);
+    PlatformSupport::histogramCustomCounts("Renderer4.pixelOverdrawCulled", static_cast<int>(normalization * overdrawCounts.m_pixelsCulled), 100, 1000000, 50);
 }
 
-void CCLayerTreeHostImpl::animateLayersRecursive(CCLayerImpl* current, double frameBeginTimeSecs, CCAnimationEventsVector& events, bool& didAnimate, bool& needsAnimateLayers)
+void CCLayerTreeHostImpl::animateLayersRecursive(CCLayerImpl* current, double monotonicTime, double wallClockTime, CCAnimationEventsVector& events, bool& didAnimate, bool& needsAnimateLayers)
 {
     bool subtreeNeedsAnimateLayers = false;
 
     CCLayerAnimationControllerImpl* currentController = current->layerAnimationController();
 
     bool hadActiveAnimation = currentController->hasActiveAnimation();
-    currentController->animate(frameBeginTimeSecs, events);
+    currentController->animate(monotonicTime, events);
     bool startedAnimation = events.size() > 0;
 
     // We animated if we either ticked a running animation, or started a new animation.
@@ -259,7 +309,7 @@ void CCLayerTreeHostImpl::animateLayersRecursive(CCLayerImpl* current, double fr
 
     for (size_t i = 0; i < current->children().size(); ++i) {
         bool childNeedsAnimateLayers = false;
-        animateLayersRecursive(current->children()[i].get(), frameBeginTimeSecs, events, didAnimate, childNeedsAnimateLayers);
+        animateLayersRecursive(current->children()[i].get(), monotonicTime, wallClockTime, events, didAnimate, childNeedsAnimateLayers);
         if (childNeedsAnimateLayers)
             subtreeNeedsAnimateLayers = true;
     }
@@ -294,7 +344,7 @@ void CCLayerTreeHostImpl::drawLayers()
     for (size_t i = 0; i < passes.size(); ++i)
         m_layerRenderer->drawRenderPass(passes[i].get());
 
-    typedef CCLayerIterator<CCLayerImpl, CCRenderSurface, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
+    typedef CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&renderSurfaceLayerList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&renderSurfaceLayerList); it != end; ++it) {
@@ -311,7 +361,8 @@ void CCLayerTreeHostImpl::drawLayers()
 
 void CCLayerTreeHostImpl::finishAllRendering()
 {
-    m_layerRenderer->finish();
+    if (m_layerRenderer)
+        m_layerRenderer->finish();
 }
 
 bool CCLayerTreeHostImpl::isContextLost()
@@ -331,10 +382,15 @@ TextureAllocator* CCLayerTreeHostImpl::contentsTextureAllocator() const
 
 void CCLayerTreeHostImpl::swapBuffers()
 {
-    ASSERT(m_layerRenderer && !isContextLost());
+    ASSERT(m_layerRenderer);
     m_layerRenderer->swapBuffers(enclosingIntRect(m_rootDamageRect));
 }
 
+void CCLayerTreeHostImpl::didLoseContext()
+{
+    m_client->didLoseContextOnImplThread();
+}
+
 void CCLayerTreeHostImpl::onSwapBuffersComplete()
 {
     m_client->onSwapBuffersCompleteOnImplThread();
@@ -342,7 +398,7 @@ void CCLayerTreeHostImpl::onSwapBuffersComplete()
 
 void CCLayerTreeHostImpl::readback(void* pixels, const IntRect& rect)
 {
-    ASSERT(m_layerRenderer && !isContextLost());
+    ASSERT(m_layerRenderer);
     m_layerRenderer->getFramebufferPixels(pixels, rect);
 }
 
@@ -363,7 +419,7 @@ static CCLayerImpl* findScrollLayer(CCLayerImpl* layer)
     return 0;
 }
 
-void CCLayerTreeHostImpl::setRootLayer(PassRefPtr<CCLayerImpl> layer)
+void CCLayerTreeHostImpl::setRootLayer(PassOwnPtr<CCLayerImpl> layer)
 {
     m_rootLayerImpl = layer;
 
@@ -377,8 +433,18 @@ void CCLayerTreeHostImpl::setVisible(bool visible)
         return;
     m_visible = visible;
 
-    if (m_layerRenderer)
-        m_layerRenderer->setVisible(visible);
+    if (!m_layerRenderer)
+        return;
+
+    m_layerRenderer->setVisible(visible);
+
+    // Reset the damage tracker because the front/back buffers may have been damaged by the GPU
+    // process on visibility change.
+    if (visible && m_layerRenderer->capabilities().usingPartialSwap)
+        setFullRootLayerDamage();
+
+    const bool shouldTickInBackground = !visible && m_needsAnimateLayers;
+    m_timeSourceClientAdapter->setActive(shouldTickInBackground);
 }
 
 bool CCLayerTreeHostImpl::initializeLayerRenderer(PassRefPtr<GraphicsContext3D> context)
@@ -386,10 +452,16 @@ bool CCLayerTreeHostImpl::initializeLayerRenderer(PassRefPtr<GraphicsContext3D>
     OwnPtr<LayerRendererChromium> layerRenderer;
     layerRenderer = LayerRendererChromium::create(this, context);
 
-    if (m_layerRenderer)
+    if (m_layerRenderer) {
         m_layerRenderer->close();
+        sendDidLoseContextRecursive(m_rootLayerImpl.get());
+    }
 
     m_layerRenderer = layerRenderer.release();
+
+    if (!m_visible && m_layerRenderer)
+         m_layerRenderer->setVisible(m_visible);
+
     return m_layerRenderer;
 }
 
@@ -470,6 +542,10 @@ void CCLayerTreeHostImpl::updateMaxScrollPosition()
         return;
 
     FloatSize viewBounds = m_viewportSize;
+    if (CCLayerImpl* clipLayer = m_scrollLayerImpl->parent()) {
+        if (clipLayer->masksToBounds())
+            viewBounds = clipLayer->bounds();
+    }
     viewBounds.scale(1 / m_pageScaleDelta);
 
     IntSize maxScroll = contentSize() - expandedIntSize(viewBounds);
@@ -487,7 +563,7 @@ void CCLayerTreeHostImpl::setNeedsRedraw()
     m_client->setNeedsRedrawOnImplThread();
 }
 
-CCInputHandlerClient::ScrollStatus CCLayerTreeHostImpl::scrollBegin(const IntPoint& point, CCInputHandlerClient::ScrollInputType type)
+CCInputHandlerClient::ScrollStatus CCLayerTreeHostImpl::scrollBegin(const IntPoint& viewportPoint, CCInputHandlerClient::ScrollInputType type)
 {
     // TODO: Check for scrollable sublayers.
     if (!m_scrollLayerImpl || !m_scrollLayerImpl->scrollable()) {
@@ -495,6 +571,17 @@ CCInputHandlerClient::ScrollStatus CCLayerTreeHostImpl::scrollBegin(const IntPoi
         return ScrollIgnored;
     }
 
+    if (m_scrollLayerImpl->shouldScrollOnMainThread()) {
+        TRACE_EVENT("scrollBegin Failed shouldScrollOnMainThread", this, 0);
+        return ScrollFailed;
+    }
+
+    IntPoint scrollLayerContentPoint(m_scrollLayerImpl->screenSpaceTransform().inverse().mapPoint(viewportPoint));
+    if (m_scrollLayerImpl->nonFastScrollableRegion().contains(scrollLayerContentPoint)) {
+        TRACE_EVENT("scrollBegin Failed nonFastScrollableRegion", this, 0);
+        return ScrollFailed;
+    }
+
     if (type == CCInputHandlerClient::Wheel && m_scrollLayerImpl->haveWheelEventHandlers()) {
         TRACE_EVENT("scrollBegin Failed wheelEventHandlers", this, 0);
         return ScrollFailed;
@@ -643,26 +730,26 @@ void CCLayerTreeHostImpl::setFullRootLayerDamage()
     }
 }
 
-void CCLayerTreeHostImpl::animatePageScale(double frameBeginTimeMs)
+void CCLayerTreeHostImpl::animatePageScale(double monotonicTime)
 {
     if (!m_pageScaleAnimation)
         return;
 
     IntSize scrollTotal = toSize(m_scrollLayerImpl->scrollPosition() + m_scrollLayerImpl->scrollDelta());
 
-    setPageScaleDelta(m_pageScaleAnimation->pageScaleAtTime(frameBeginTimeMs) / m_pageScale);
-    IntSize nextScroll = m_pageScaleAnimation->scrollOffsetAtTime(frameBeginTimeMs);
+    setPageScaleDelta(m_pageScaleAnimation->pageScaleAtTime(monotonicTime) / m_pageScale);
+    IntSize nextScroll = m_pageScaleAnimation->scrollOffsetAtTime(monotonicTime);
     nextScroll.scale(1 / m_pageScaleDelta);
     m_scrollLayerImpl->scrollBy(nextScroll - scrollTotal);
     m_client->setNeedsRedrawOnImplThread();
 
-    if (m_pageScaleAnimation->isAnimationCompleteAtTime(frameBeginTimeMs)) {
+    if (m_pageScaleAnimation->isAnimationCompleteAtTime(monotonicTime)) {
         m_pageScaleAnimation.clear();
         m_client->setNeedsCommitOnImplThread();
     }
 }
 
-void CCLayerTreeHostImpl::animateLayers(double frameBeginTimeMs)
+void CCLayerTreeHostImpl::animateLayers(double monotonicTime, double wallClockTime)
 {
     if (!m_settings.threadedAnimationEnabled || !m_needsAnimateLayers || !m_rootLayerImpl)
         return;
@@ -672,13 +759,28 @@ void CCLayerTreeHostImpl::animateLayers(double frameBeginTimeMs)
     OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
 
     bool didAnimate = false;
-    animateLayersRecursive(m_rootLayerImpl.get(), frameBeginTimeMs / 1000, *events, didAnimate, m_needsAnimateLayers);
+    animateLayersRecursive(m_rootLayerImpl.get(), monotonicTime, wallClockTime, *events, didAnimate, m_needsAnimateLayers);
 
     if (!events->isEmpty())
-        m_client->postAnimationEventsToMainThreadOnImplThread(events.release());
+        m_client->postAnimationEventsToMainThreadOnImplThread(events.release(), wallClockTime);
 
     if (didAnimate)
         m_client->setNeedsRedrawOnImplThread();
+
+    const bool shouldTickInBackground = m_needsAnimateLayers && !m_visible;
+    m_timeSourceClientAdapter->setActive(shouldTickInBackground);
+}
+
+void CCLayerTreeHostImpl::sendDidLoseContextRecursive(CCLayerImpl* current)
+{
+    if (!current)
+        return;
+
+    current->didLoseContext();
+    sendDidLoseContextRecursive(current->maskLayer());
+    sendDidLoseContextRecursive(current->replicaLayer());
+    for (size_t i = 0; i < current->children().size(); ++i)
+        sendDidLoseContextRecursive(current->children()[i].get());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
index e438db0c4..1cfd0fb67 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
@@ -25,6 +25,7 @@
 #ifndef CCLayerTreeHostImpl_h
 #define CCLayerTreeHostImpl_h
 
+#include "LayerRendererChromium.h"
 #include "cc/CCAnimationEvents.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCLayerSorter.h"
@@ -39,6 +40,7 @@ namespace WebCore {
 class CCCompletionEvent;
 class CCPageScaleAnimation;
 class CCLayerImpl;
+class CCLayerTreeHostImplTimeSourceAdapter;
 class LayerRendererChromium;
 class TextureAllocator;
 struct LayerRendererCapabilities;
@@ -47,14 +49,15 @@ class TransformationMatrix;
 // CCLayerTreeHost->CCProxy callback interface.
 class CCLayerTreeHostImplClient {
 public:
+    virtual void didLoseContextOnImplThread() = 0;
     virtual void onSwapBuffersCompleteOnImplThread() = 0;
     virtual void setNeedsRedrawOnImplThread() = 0;
     virtual void setNeedsCommitOnImplThread() = 0;
-    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>) = 0;
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) = 0;
 };
 
 // CCLayerTreeHostImpl owns the CCLayerImpl tree as well as associated rendering state
-class CCLayerTreeHostImpl : public CCInputHandlerClient {
+class CCLayerTreeHostImpl : public CCInputHandlerClient, LayerRendererChromiumClient {
     WTF_MAKE_NONCOPYABLE(CCLayerTreeHostImpl);
 public:
     static PassOwnPtr<CCLayerTreeHostImpl> create(const CCSettings&, CCLayerTreeHostImplClient*);
@@ -68,14 +71,23 @@ public:
     virtual void pinchGestureBegin();
     virtual void pinchGestureUpdate(float, const IntPoint&);
     virtual void pinchGestureEnd();
-    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTimeMs, double durationMs);
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTime, double duration);
 
     // Virtual for testing.
     virtual void beginCommit();
     virtual void commitComplete();
-    virtual void animate(double frameDisplayTimeMs);
+    virtual void animate(double monotonicTime, double wallClockTime);
     virtual void drawLayers();
 
+    // LayerRendererChromiumClient implementation
+    virtual const IntSize& viewportSize() const { return m_viewportSize; }
+    virtual const CCSettings& settings() const { return m_settings; }
+    virtual CCLayerImpl* rootLayer() { return m_rootLayerImpl.get(); }
+    virtual const CCLayerImpl* rootLayer() const  { return m_rootLayerImpl.get(); }
+    virtual void didLoseContext();
+    virtual void onSwapBuffersComplete();
+
+    // Implementation
     bool canDraw();
     GraphicsContext3D* context();
 
@@ -89,14 +101,13 @@ public:
     TextureAllocator* contentsTextureAllocator() const;
 
     void swapBuffers();
-    void onSwapBuffersComplete();
 
     void readback(void* pixels, const IntRect&);
 
-    CCLayerImpl* rootLayer() const { return m_rootLayerImpl.get(); }
-    void setRootLayer(PassRefPtr<CCLayerImpl>);
+    void setRootLayer(PassOwnPtr<CCLayerImpl>);
+    PassOwnPtr<CCLayerImpl> releaseRootLayer() { return m_rootLayerImpl.release(); }
 
-    CCLayerImpl* scrollLayer() const { return m_scrollLayerImpl.get(); }
+    CCLayerImpl* scrollLayer() const { return m_scrollLayerImpl; }
 
     bool visible() const { return m_visible; }
     void setVisible(bool);
@@ -105,13 +116,10 @@ public:
     void setSourceFrameNumber(int frameNumber) { m_sourceFrameNumber = frameNumber; }
 
     void setViewportSize(const IntSize&);
-    const IntSize& viewportSize() const { return m_viewportSize; }
 
     void setPageScaleFactorAndLimits(float pageScale, float minPageScale, float maxPageScale);
     float pageScale() const { return m_pageScale; }
 
-    const CCSettings& settings() const { return m_settings; }
-
     PassOwnPtr<CCScrollAndScaleSet> processScrollDeltas();
 
     // Where possible, redraws are scissored to a damage region calculated from changes to
@@ -126,17 +134,17 @@ public:
 protected:
     CCLayerTreeHostImpl(const CCSettings&, CCLayerTreeHostImplClient*);
 
-    void animatePageScale(double frameBeginTimeMs);
+    void animatePageScale(double monotonicTime);
 
     // Virtual for testing.
-    virtual void animateLayers(double frameBeginTimeMs);
+    virtual void animateLayers(double monotonicTime, double wallClockTime);
 
     CCLayerTreeHostImplClient* m_client;
     int m_sourceFrameNumber;
     int m_frameNumber;
 
 private:
-    typedef Vector<RefPtr<CCLayerImpl> > CCLayerList;
+    typedef Vector<CCLayerImpl*> CCLayerList;
 
     void computeDoubleTapZoomDeltas(CCScrollAndScaleSet* scrollInfo);
     void computePinchZoomDeltas(CCScrollAndScaleSet* scrollInfo);
@@ -149,12 +157,13 @@ private:
     void trackDamageForAllSurfaces(CCLayerImpl* rootDrawLayer, const CCLayerList& renderSurfaceLayerList);
     void calculateRenderPasses(CCRenderPassList&, CCLayerList& renderSurfaceLayerList);
     void optimizeRenderPasses(CCRenderPassList&);
-    void animateLayersRecursive(CCLayerImpl*, double frameBeginTimeSecs, CCAnimationEventsVector&, bool& didAnimate, bool& needsAnimateLayers);
+    void animateLayersRecursive(CCLayerImpl*, double monotonicTime, double wallClockTime, CCAnimationEventsVector&, bool& didAnimate, bool& needsAnimateLayers);
     IntSize contentSize() const;
+    void sendDidLoseContextRecursive(CCLayerImpl*);
 
     OwnPtr<LayerRendererChromium> m_layerRenderer;
-    RefPtr<CCLayerImpl> m_rootLayerImpl;
-    RefPtr<CCLayerImpl> m_scrollLayerImpl;
+    OwnPtr<CCLayerImpl> m_rootLayerImpl;
+    CCLayerImpl* m_scrollLayerImpl;
     CCSettings m_settings;
     IntSize m_viewportSize;
     bool m_visible;
@@ -171,6 +180,9 @@ private:
 
     OwnPtr<CCPageScaleAnimation> m_pageScaleAnimation;
 
+    // This is used for ticking animations slowly when hidden.
+    OwnPtr<CCLayerTreeHostImplTimeSourceAdapter> m_timeSourceClientAdapter;
+
     CCLayerSorter m_layerSorter;
 
     FloatRect m_rootDamageRect;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
index c5611ac27..f1c933882 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
@@ -39,6 +39,22 @@ using namespace std;
 namespace WebCore {
 
 template<typename LayerType, typename RenderSurfaceType>
+CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace)
+    : m_scissorRectInScreenSpace(scissorRectInScreenSpace)
+    , m_surfaceDamageClient(0)
+    , m_usePaintTracking(true) // FIXME: Remove this when paint tracking is on for paint culling.
+{
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, const DamageClientType* surfaceDamageClient)
+    : m_scissorRectInScreenSpace(scissorRectInScreenSpace)
+    , m_surfaceDamageClient(surfaceDamageClient)
+    , m_usePaintTracking(true) // FIXME: Remove this when paint tracking is on for paint culling.
+{
+}
+
+template<typename LayerType, typename RenderSurfaceType>
 void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::enterTargetRenderSurface(const RenderSurfaceType* newTarget)
 {
     if (!m_stack.isEmpty() && m_stack.last().surface == newTarget)
@@ -170,8 +186,9 @@ static inline TransformationMatrix contentToTargetSurfaceTransform(const LayerTy
     return transform;
 }
 
+// FIXME: Remove usePaintTracking when paint tracking is on for paint culling.
 template<typename LayerType>
-static inline Region computeOcclusionBehindLayer(const LayerType* layer, const TransformationMatrix& transform)
+static inline Region computeOcclusionBehindLayer(const LayerType* layer, const TransformationMatrix& transform, bool usePaintTracking)
 {
     Region opaqueRegion;
 
@@ -182,7 +199,14 @@ static inline Region computeOcclusionBehindLayer(const LayerType* layer, const T
 
     if (layer->opaque())
         opaqueRegion = enclosedIntRect(unoccludedQuad.boundingBox());
-    // FIXME: Capture opaque paints: else opaqueRegion = layer->opaqueContentsRegion(transform);
+    else if (usePaintTracking && transform.isIdentity())
+        opaqueRegion = layer->opaqueContentsRegion();
+    else if (usePaintTracking) {
+        Region contentRegion = layer->opaqueContentsRegion();
+        Vector<IntRect> contentRects = contentRegion.rects();
+        for (size_t i = 0; i < contentRects.size(); ++i)
+            opaqueRegion.unite(enclosedIntRect(transform.mapRect(FloatRect(contentRects[i]))));
+    }
     return opaqueRegion;
 }
 
@@ -191,6 +215,8 @@ void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::markOccludedBehindLay
 {
     ASSERT(!m_stack.isEmpty());
     ASSERT(layer->targetRenderSurface() == m_stack.last().surface);
+    if (m_stack.isEmpty())
+        return;
 
     if (layer->drawOpacity() != 1)
         return;
@@ -198,45 +224,31 @@ void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::markOccludedBehindLay
     TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
     TransformationMatrix contentToTargetSurface = contentToTargetSurfaceTransform<LayerType>(layer);
 
-    m_stack.last().occlusionInScreen.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToScreenSpace));
-    m_stack.last().occlusionInTarget.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToTargetSurface));
+    // FIXME: Remove m_usePaintTracking when paint tracking is on for paint culling.
+    m_stack.last().occlusionInScreen.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToScreenSpace, m_usePaintTracking));
+    m_stack.last().occlusionInTarget.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToTargetSurface, m_usePaintTracking));
 }
 
-static inline bool testContentRectOccluded(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const Region& occlusion)
+static inline bool testContentRectOccluded(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const IntRect& scissorRect, const Region& occlusion)
 {
-    FloatQuad transformedQuad = contentSpaceTransform.mapQuad(FloatQuad(contentRect));
-    return occlusion.contains(transformedQuad.enclosingBoundingBox());
+    FloatRect transformedRect = contentSpaceTransform.mapRect(FloatRect(contentRect));
+    // Take the enclosingIntRect, as we want to include partial pixels in the test.
+    IntRect targetRect = intersection(enclosingIntRect(transformedRect), scissorRect);
+    return targetRect.isEmpty() || occlusion.contains(targetRect);
 }
 
 template<typename LayerType, typename RenderSurfaceType>
 bool CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::occluded(const LayerType* layer, const IntRect& contentRect) const
 {
+    ASSERT(!m_stack.isEmpty());
     if (m_stack.isEmpty())
         return false;
 
     ASSERT(layer->targetRenderSurface() == m_stack.last().surface);
 
-    if (testContentRectOccluded(contentRect, contentToScreenSpaceTransform<LayerType>(layer), m_stack.last().occlusionInScreen))
+    if (testContentRectOccluded(contentRect, contentToScreenSpaceTransform<LayerType>(layer), m_scissorRectInScreenSpace, m_stack.last().occlusionInScreen))
         return true;
-    if (testContentRectOccluded(contentRect, contentToTargetSurfaceTransform<LayerType>(layer), m_stack.last().occlusionInTarget))
-        return true;
-    return false;
-}
-
-template<typename LayerType, typename RenderSurfaceType>
-bool CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::surfaceOccluded(const LayerType* layer, const IntRect& surfaceContentRect) const
-{
-    // A surface is not occluded by layers drawing into itself, so we need to use occlusion from one spot down on the stack.
-    if (m_stack.size() < 2)
-        return false;
-
-    ASSERT(layer->renderSurface());
-    ASSERT(layer->renderSurface() == m_stack.last().surface);
-
-    TransformationMatrix surfaceContentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
-
-    const StackObject& secondLast = m_stack[m_stack.size()-2];
-    if (testContentRectOccluded(surfaceContentRect, surfaceContentToScreenSpace, secondLast.occlusionInScreen))
+    if (testContentRectOccluded(contentRect, contentToTargetSurfaceTransform<LayerType>(layer), layerScissorRectInTargetSurface(layer), m_stack.last().occlusionInTarget))
         return true;
     return false;
 }
@@ -256,22 +268,20 @@ static inline IntRect rectSubtractRegion(const IntRect& rect, const Region& regi
     return boundsRect;
 }
 
-static IntRect computeUnoccludedContentRect(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const Region& occlusion)
+static inline IntRect computeUnoccludedContentRect(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const IntRect& scissorRect, const Region& occlusion)
 {
-    FloatQuad transformedQuad = contentSpaceTransform.mapQuad(FloatQuad(contentRect));
-    if (!transformedQuad.isRectilinear())
-        return contentRect;
-    // Take the enclosingIntRect at each step here, as we want to contain any unoccluded partial pixels in the resulting IntRect.
-    IntRect shrunkRect = rectSubtractRegion(enclosingIntRect(transformedQuad.boundingBox()), occlusion);
+    FloatRect transformedRect = contentSpaceTransform.mapRect(FloatRect(contentRect));
+    // Take the enclosingIntRect at each step, as we want to contain any unoccluded partial pixels in the resulting IntRect.
+    IntRect shrunkRect = rectSubtractRegion(intersection(enclosingIntRect(transformedRect), scissorRect), occlusion);
     IntRect unoccludedRect = enclosingIntRect(contentSpaceTransform.inverse().mapRect(FloatRect(shrunkRect)));
-    // The use of enclosingIntRect, with floating point rounding, can give us a result that is not a sub-rect of contentRect, but our
-    // return value should be a sub-rect.
+    // The rect back in content space is a bounding box and may extend outside of the original contentRect, so clamp it to the contentRectBounds.
     return intersection(unoccludedRect, contentRect);
 }
 
 template<typename LayerType, typename RenderSurfaceType>
 IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::unoccludedContentRect(const LayerType* layer, const IntRect& contentRect) const
 {
+    ASSERT(!m_stack.isEmpty());
     if (m_stack.isEmpty())
         return contentRect;
 
@@ -281,31 +291,24 @@ IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::unoccludedContentR
     TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
     TransformationMatrix contentToTargetSurface = contentToTargetSurfaceTransform<LayerType>(layer);
 
-    IntRect unoccludedInScreen = computeUnoccludedContentRect(contentRect, contentToScreenSpace, m_stack.last().occlusionInScreen);
-    IntRect unoccludedInTarget = computeUnoccludedContentRect(contentRect, contentToTargetSurface, m_stack.last().occlusionInTarget);
+    IntRect unoccludedInScreen = computeUnoccludedContentRect(contentRect, contentToScreenSpace, m_scissorRectInScreenSpace, m_stack.last().occlusionInScreen);
+    if (unoccludedInScreen.isEmpty())
+        return IntRect();
+    IntRect unoccludedInTarget = computeUnoccludedContentRect(contentRect, contentToTargetSurface, layerScissorRectInTargetSurface(layer), m_stack.last().occlusionInTarget);
 
     return intersection(unoccludedInScreen, unoccludedInTarget);
 }
 
 template<typename LayerType, typename RenderSurfaceType>
-IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::surfaceUnoccludedContentRect(const LayerType* layer, const IntRect& surfaceContentRect) const
+IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::layerScissorRectInTargetSurface(const LayerType* layer) const
 {
-    // A surface is not occluded by layers drawing into itself, so we need to use occlusion from one spot down on the stack.
-    if (m_stack.size() < 2)
-        return surfaceContentRect;
-
-    ASSERT(layer->renderSurface());
-    ASSERT(layer->renderSurface() == m_stack.last().surface);
-
-    // We want to return a rect that contains all the visible parts of |contentRect| in both screen space and in the target surface.
-    // So we find the visible parts of |contentRect| in each space, and take the intersection.
-
-    TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
-
-    const StackObject& secondLast = m_stack[m_stack.size()-2];
-    IntRect unoccludedInScreen = computeUnoccludedContentRect(surfaceContentRect, contentToScreenSpace, secondLast.occlusionInScreen);
-
-    return unoccludedInScreen;
+    const RenderSurfaceType* targetSurface = m_stack.last().surface;
+    FloatRect totalScissor = targetSurface->contentRect();
+    if (m_surfaceDamageClient)
+        totalScissor.intersect(m_surfaceDamageClient->damageRect(targetSurface));
+    if (!layer->clipRect().isEmpty())
+        totalScissor.intersect(layer->clipRect());
+    return enclosingIntRect(totalScissor);
 }
 
 template<typename LayerType, typename RenderSurfaceType>
@@ -324,27 +327,29 @@ const Region& CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::currentOcclu
 
 
 // Declare the possible functions here for the linker.
+template CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace);
+template CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, const CCOcclusionTrackerDamageClient* surfaceDamageClient);
 template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::enterTargetRenderSurface(const RenderSurfaceChromium* newTarget);
 template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::finishedTargetRenderSurface(const LayerChromium* owningLayer, const RenderSurfaceChromium* finishedTarget);
 template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::leaveToTargetRenderSurface(const RenderSurfaceChromium* newTarget);
 template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::markOccludedBehindLayer(const LayerChromium*);
 template bool CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::occluded(const LayerChromium*, const IntRect& contentRect) const;
-template bool CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::surfaceOccluded(const LayerChromium*, const IntRect& surfaceContentRect) const;
 template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::unoccludedContentRect(const LayerChromium*, const IntRect& contentRect) const;
-template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::surfaceUnoccludedContentRect(const LayerChromium*, const IntRect& surfaceContentRect) const;
 template const Region& CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::currentOcclusionInScreenSpace() const;
 template const Region& CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::currentOcclusionInTargetSurface() const;
+template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::layerScissorRectInTargetSurface(const LayerChromium*) const;
 
+template CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace);
+template CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, const CCOcclusionTrackerDamageClientImpl* surfaceDamageClient);
 template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::enterTargetRenderSurface(const CCRenderSurface* newTarget);
 template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::finishedTargetRenderSurface(const CCLayerImpl* owningLayer, const CCRenderSurface* finishedTarget);
 template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::leaveToTargetRenderSurface(const CCRenderSurface* newTarget);
 template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::markOccludedBehindLayer(const CCLayerImpl*);
 template bool CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::occluded(const CCLayerImpl*, const IntRect& contentRect) const;
-template bool CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::surfaceOccluded(const CCLayerImpl*, const IntRect& surfaceContentRect) const;
 template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::unoccludedContentRect(const CCLayerImpl*, const IntRect& contentRect) const;
-template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::surfaceUnoccludedContentRect(const CCLayerImpl*, const IntRect& surfaceContentRect) const;
 template const Region& CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::currentOcclusionInScreenSpace() const;
 template const Region& CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::currentOcclusionInTargetSurface() const;
+template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::layerScissorRectInTargetSurface(const CCLayerImpl*) const;
 
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
index d1c833e1a..19fc2c1dd 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
@@ -36,6 +36,15 @@ class CCRenderSurface;
 class LayerChromium;
 class RenderSurfaceChromium;
 
+template<typename RenderSurfaceType>
+class CCOcclusionTrackerDamageClientBase {
+public:
+    virtual FloatRect damageRect(const RenderSurfaceType*) const = 0;
+};
+
+typedef CCOcclusionTrackerDamageClientBase<RenderSurfaceChromium> CCOcclusionTrackerDamageClient;
+typedef CCOcclusionTrackerDamageClientBase<CCRenderSurface> CCOcclusionTrackerDamageClientImpl;
+
 // This class is used to track occlusion of layers while traversing them in a front-to-back order. As each layer is visited, one of the
 // methods in this class is called to notify it about the current target surface.
 // Then, occlusion in the content space of the current layer may be queried, via methods such as occluded() and unoccludedContentRect().
@@ -43,8 +52,11 @@ class RenderSurfaceChromium;
 // Finally, once finished with the layer, occlusion behind the layer should be marked by calling markOccludedBehindLayer().
 template<typename LayerType, typename RenderSurfaceType>
 class CCOcclusionTrackerBase {
+    WTF_MAKE_NONCOPYABLE(CCOcclusionTrackerBase);
+    typedef CCOcclusionTrackerDamageClientBase<RenderSurfaceType> DamageClientType;
 public:
-    CCOcclusionTrackerBase() { }
+    CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace);
+    CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, const DamageClientType*);
 
     // Called when visiting a layer representing itself. If the target was not already current, then this indicates we have entered a new surface subtree.
     void enterTargetRenderSurface(const RenderSurfaceType* newTarget);
@@ -65,10 +77,8 @@ public:
     // Gives an unoccluded sub-rect of |contentRect| in the content space of the layer. Used when considering occlusion for a layer that paints/draws something.
     IntRect unoccludedContentRect(const LayerType*, const IntRect& contentRect) const;
 
-    // Returns true if the given rect in content space for the RenderSurface owned by the layer is fully occluded in either screen space or the layer's target surface.
-    bool surfaceOccluded(const LayerType*, const IntRect& contentRect) const;
-    // Gives an unoccluded sub-rect of |contentRect| in the content space of the RenderSurface owned by the layer. Used when considering occlusion for a target surface.
-    IntRect surfaceUnoccludedContentRect(const LayerType*, const IntRect& contentRect) const;
+    // FIXME: Remove this when paint tracking is on for paint culling.
+    void setUsePaintTracking(bool use) { m_usePaintTracking = use; }
 
     // FIXME: Remove these in future, they are to make CLs for transitioning to this easier.
     const Region& currentOcclusionInScreenSpace() const;
@@ -90,8 +100,13 @@ protected:
     // We merge the occlusion at the top of the stack with the new current subtree. This new target is pushed onto the stack if not already there.
     Vector<StackObject, 1> m_stack;
 
+    // Allow tests to override this.
+    virtual IntRect layerScissorRectInTargetSurface(const LayerType*) const;
+
 private:
-    WTF_MAKE_NONCOPYABLE(CCOcclusionTrackerBase);
+    IntRect m_scissorRectInScreenSpace;
+    const DamageClientType* m_surfaceDamageClient;
+    bool m_usePaintTracking; // FIXME: Remove this when paint tracking is on for paint culling.
 };
 
 typedef CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium> CCOcclusionTracker;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.cpp
index 33b6f22fb..49a125d23 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.cpp
@@ -22,7 +22,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -36,13 +36,13 @@
 
 namespace WebCore {
 
-PassOwnPtr<CCPageScaleAnimation> CCPageScaleAnimation::create(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTimeMs)
+PassOwnPtr<CCPageScaleAnimation> CCPageScaleAnimation::create(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTime)
 {
-    return adoptPtr(new CCPageScaleAnimation(scrollStart, pageScaleStart, windowSize, contentSize, startTimeMs));
+    return adoptPtr(new CCPageScaleAnimation(scrollStart, pageScaleStart, windowSize, contentSize, startTime));
 }
 
 
-CCPageScaleAnimation::CCPageScaleAnimation(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTimeMs)
+CCPageScaleAnimation::CCPageScaleAnimation(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTime)
     : m_scrollStart(scrollStart)
     , m_pageScaleStart(pageScaleStart)
     , m_windowSize(windowSize)
@@ -50,11 +50,11 @@ CCPageScaleAnimation::CCPageScaleAnimation(const IntSize& scrollStart, float pag
     , m_anchorMode(false)
     , m_scrollEnd(scrollStart)
     , m_pageScaleEnd(pageScaleStart)
-    , m_startTimeMs(startTimeMs)
+    , m_startTime(startTime)
 {
 }
 
-void CCPageScaleAnimation::zoomTo(const IntSize& finalScroll, float finalPageScale, double durationMs)
+void CCPageScaleAnimation::zoomTo(const IntSize& finalScroll, float finalPageScale, double duration)
 {
     if (m_pageScaleStart != finalPageScale) {
         // For uniform-looking zooming, infer the anchor (point that remains in
@@ -78,18 +78,18 @@ void CCPageScaleAnimation::zoomTo(const IntSize& finalScroll, float finalPageSca
         float ratioY = (startRect.y() - endRect.y()) / (endRect.height() - startRect.height());
 
         IntSize anchor(m_windowSize.width() * ratioX, m_windowSize.height() * ratioY);
-        zoomWithAnchor(anchor, finalPageScale, durationMs);
+        zoomWithAnchor(anchor, finalPageScale, duration);
     } else {
         // If this is a pure translation, then there exists no anchor. Linearly
         // interpolate the scroll offset instead.
         m_scrollEnd = finalScroll;
         m_pageScaleEnd = finalPageScale;
-        m_durationMs = durationMs;
+        m_duration = duration;
         m_anchorMode = false;
     }
 }
 
-void CCPageScaleAnimation::zoomWithAnchor(const IntSize& anchor, float finalPageScale, double durationMs)
+void CCPageScaleAnimation::zoomWithAnchor(const IntSize& anchor, float finalPageScale, double duration)
 {
     m_scrollEnd = m_scrollStart + anchor;
     m_scrollEnd.scale(finalPageScale / m_pageScaleStart);
@@ -103,31 +103,31 @@ void CCPageScaleAnimation::zoomWithAnchor(const IntSize& anchor, float finalPage
 
     m_anchor = anchor;
     m_pageScaleEnd = finalPageScale;
-    m_durationMs = durationMs;
+    m_duration = duration;
     m_anchorMode = true;
 }
 
-IntSize CCPageScaleAnimation::scrollOffsetAtTime(double timeMs) const
+IntSize CCPageScaleAnimation::scrollOffsetAtTime(double time) const
 {
-    return scrollOffsetAtRatio(progressRatioForTime(timeMs));
+    return scrollOffsetAtRatio(progressRatioForTime(time));
 }
 
-float CCPageScaleAnimation::pageScaleAtTime(double timeMs) const
+float CCPageScaleAnimation::pageScaleAtTime(double time) const
 {
-    return pageScaleAtRatio(progressRatioForTime(timeMs));
+    return pageScaleAtRatio(progressRatioForTime(time));
 }
 
-bool CCPageScaleAnimation::isAnimationCompleteAtTime(double timeMs) const
+bool CCPageScaleAnimation::isAnimationCompleteAtTime(double time) const
 {
-    return timeMs >= endTimeMs();
+    return time >= endTime();
 }
 
-float CCPageScaleAnimation::progressRatioForTime(double timeMs) const
+float CCPageScaleAnimation::progressRatioForTime(double time) const
 {
-    if (isAnimationCompleteAtTime(timeMs))
+    if (isAnimationCompleteAtTime(time))
         return 1;
 
-    return (timeMs - m_startTimeMs) / m_durationMs;
+    return (time - m_startTime) / m_duration;
 }
 
 IntSize CCPageScaleAnimation::scrollOffsetAtRatio(float ratio) const
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.h b/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.h
index f4b1bf47a..d9acb4911 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.h
@@ -39,39 +39,39 @@ public:
     // Construct with the starting page scale and scroll offset (which is in
     // pageScaleStart space). The window size is the user-viewable area
     // in pixels.
-    static PassOwnPtr<CCPageScaleAnimation> create(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTimeMs);
+    static PassOwnPtr<CCPageScaleAnimation> create(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTime);
 
     // The following methods initialize the animation. Call one of them
     // immediately after construction to set the final scroll and page scale.
 
     // Zoom while explicitly specifying the top-left scroll position. The
     // scroll offset is in finalPageScale coordinates.
-    void zoomTo(const IntSize& finalScroll, float finalPageScale, double durationMs);
+    void zoomTo(const IntSize& finalScroll, float finalPageScale, double duration);
 
     // Zoom based on a specified onscreen anchor, which will remain at the same
     // position on the screen throughout the animation. The anchor is in local
     // space relative to scrollStart.
-    void zoomWithAnchor(const IntSize& anchor, float finalPageScale, double durationMs);
+    void zoomWithAnchor(const IntSize& anchor, float finalPageScale, double duration);
 
     // Call these functions while the animation is in progress to output the
     // current state.
-    IntSize scrollOffsetAtTime(double timeMs) const;
-    float pageScaleAtTime(double timeMs) const;
-    bool isAnimationCompleteAtTime(double timeMs) const;
+    IntSize scrollOffsetAtTime(double time) const;
+    float pageScaleAtTime(double time) const;
+    bool isAnimationCompleteAtTime(double time) const;
 
     // The following methods return state which is invariant throughout the
     // course of the animation.
-    double startTimeMs() const { return m_startTimeMs; }
-    double durationMs() const { return m_durationMs; }
-    double endTimeMs() const { return m_startTimeMs + m_durationMs; }
+    double startTime() const { return m_startTime; }
+    double duration() const { return m_duration; }
+    double endTime() const { return m_startTime + m_duration; }
     const IntSize& finalScrollOffset() const { return m_scrollEnd; }
     float finalPageScale() const { return m_pageScaleEnd; }
 
 protected:
-    CCPageScaleAnimation(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTimeMs);
+    CCPageScaleAnimation(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTime);
 
 private:
-    float progressRatioForTime(double timeMs) const;
+    float progressRatioForTime(double time) const;
     IntSize scrollOffsetAtRatio(float ratio) const;
     float pageScaleAtRatio(float ratio) const;
 
@@ -85,8 +85,8 @@ private:
     IntSize m_scrollEnd;
     float m_pageScaleEnd;
 
-    double m_startTimeMs;
-    double m_durationMs;
+    double m_startTime;
+    double m_duration;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
index 5e4aca6d9..74538168e 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
@@ -53,7 +53,9 @@ CCPluginLayerImpl::CCPluginLayerImpl(int id)
 
 CCPluginLayerImpl::~CCPluginLayerImpl()
 {
-    cleanupResources();
+    // FIXME: it seems there is no layer renderer / GraphicsContext3D available here. Ideally we
+    // would like to delete m_ioSurfaceTextureId.
+    m_ioSurfaceTextureId = 0;
 }
 
 void CCPluginLayerImpl::willDraw(LayerRendererChromium* layerRenderer)
@@ -101,6 +103,16 @@ void CCPluginLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
     CCLayerImpl::dumpLayerProperties(ts, indent);
 }
 
+void CCPluginLayerImpl::didLoseContext()
+{
+    if (m_ioSurfaceId) {
+        // We don't have a valid texture ID in the new context; however,
+        // the IOSurface is still valid.
+        m_ioSurfaceTextureId = 0;
+        m_ioSurfaceChanged = true;
+    }
+}
+
 void CCPluginLayerImpl::setIOSurfaceProperties(int width, int height, uint32_t ioSurfaceId)
 {
     if (m_ioSurfaceId != ioSurfaceId)
@@ -111,13 +123,6 @@ void CCPluginLayerImpl::setIOSurfaceProperties(int width, int height, uint32_t i
     m_ioSurfaceId = ioSurfaceId;
 }
 
-void CCPluginLayerImpl::cleanupResources()
-{
-    // FIXME: it seems there is no layer renderer / GraphicsContext3D available here. Ideally we
-    // would like to delete m_ioSurfaceTextureId.
-    m_ioSurfaceTextureId = 0;
-}
-
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
index 39a95951d..370e09d94 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
@@ -35,9 +35,9 @@ namespace WebCore {
 
 class CCPluginLayerImpl : public CCLayerImpl {
 public:
-    static PassRefPtr<CCPluginLayerImpl> create(int id)
+    static PassOwnPtr<CCPluginLayerImpl> create(int id)
     {
-        return adoptRef(new CCPluginLayerImpl(id));
+        return adoptPtr(new CCPluginLayerImpl(id));
     }
     virtual ~CCPluginLayerImpl();
 
@@ -50,6 +50,7 @@ public:
     typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderRGBATexRectFlipAlpha> TexRectProgramFlip;
 
     virtual void dumpLayerProperties(TextStream&, int indent) const;
+    virtual void didLoseContext();
 
     void setTextureId(unsigned id) { m_textureId = id; }
     void setFlipped(bool flipped) { m_flipped = flipped; }
@@ -61,8 +62,6 @@ private:
 
     virtual const char* layerTypeAsString() const { return "PluginLayer"; }
 
-    void cleanupResources();
-
     unsigned m_textureId;
     bool m_flipped;
     FloatRect m_uvRect;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
index e4d601451..9ebb71dc7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
@@ -69,28 +69,38 @@ CCThread* CCProxy::implThread()
     return s_implThread;
 }
 
+CCThread* CCProxy::currentThread()
+{
+    ThreadIdentifier currentThreadIdentifier = WTF::currentThread();
+    if (s_mainThread && s_mainThread->threadID() == currentThreadIdentifier)
+        return s_mainThread;
+    if (s_implThread && s_implThread->threadID() == currentThreadIdentifier)
+        return s_implThread;
+    return 0;
+}
+
 #ifndef NDEBUG
 bool CCProxy::isMainThread()
 {
     ASSERT(s_mainThread);
-    if (implThreadIsOverridden && currentThread() == threadIDOverridenToBeImplThread)
+    if (implThreadIsOverridden && WTF::currentThread() == threadIDOverridenToBeImplThread)
         return false;
-    return currentThread() == s_mainThread->threadID();
+    return WTF::currentThread() == s_mainThread->threadID();
 }
 
 bool CCProxy::isImplThread()
 {
     WTF::ThreadIdentifier implThreadID = s_implThread ? s_implThread->threadID() : 0;
-    if (implThreadIsOverridden && currentThread() == threadIDOverridenToBeImplThread)
+    if (implThreadIsOverridden && WTF::currentThread() == threadIDOverridenToBeImplThread)
         return true;
-    return currentThread() == implThreadID;
+    return WTF::currentThread() == implThreadID;
 }
 
 void CCProxy::setCurrentThreadIsImplThread(bool isImplThread)
 {
     implThreadIsOverridden = isImplThread;
     if (isImplThread)
-        threadIDOverridenToBeImplThread = currentThread();
+        threadIDOverridenToBeImplThread = WTF::currentThread();
 }
 #endif
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
index b4358aadd..016226ca5 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
@@ -53,6 +53,9 @@ public:
     static void setImplThread(CCThread*);
     static CCThread* implThread();
 
+    // Returns 0 if the current thread is neither the main thread nor the impl thread.
+    static CCThread* currentThread();
+
     virtual ~CCProxy();
 
     virtual bool compositeAndReadback(void *pixels, const IntRect&) = 0;
@@ -70,6 +73,10 @@ public:
     // Attempts to initialize the layer renderer. Returns false if the context isn't usable for compositing.
     virtual bool initializeLayerRenderer() = 0;
 
+    // Attempts to recreate the context and layer renderer after a context lost. Returns false if the renderer couldn't be
+    // reinitialized.
+    virtual bool recreateContext() = 0;
+
     virtual int compositorIdentifier() const = 0;
 
     virtual const LayerRendererCapabilities& layerRendererCapabilities() const = 0;
@@ -95,7 +102,7 @@ public:
     virtual GraphicsContext3D* context() = 0;
 
     // Testing hooks
-    virtual void loseCompositorContext(int numTimes) = 0;
+    virtual void loseContext() = 0;
 
 #ifndef NDEBUG
     static void setCurrentThreadIsImplThread(bool);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
index 4f6435dc0..1c4a499cc 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
@@ -75,7 +75,22 @@ static IntRect rectSubtractRegion(const Region& region, const IntRect& rect)
     return rect;
 }
 
-void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList, bool haveDamageRect, const FloatRect& damageRect)
+static float wedgeProduct(const FloatPoint& p1, const FloatPoint& p2)
+{
+    return p1.x() * p2.y() - p1.y() * p2.x();
+}
+
+// Computes area of quads that are possibly non-rectangular. Can
+// be easily extended to polygons.
+static float quadArea(const FloatQuad& quad)
+{
+    return fabs(0.5 * (wedgeProduct(quad.p1(), quad.p2()) +
+                   wedgeProduct(quad.p2(), quad.p3()) +
+                   wedgeProduct(quad.p3(), quad.p4()) +
+                   wedgeProduct(quad.p4(), quad.p1())));
+}
+
+void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList, bool haveDamageRect, const FloatRect& damageRect, CCOverdrawCounts* overdrawMetrics)
 {
     if (!quadList.size())
         return;
@@ -96,21 +111,43 @@ void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList, bool haveDamageRect,
 
         IntRect transformedVisibleQuadRect = rectSubtractRegion(opaqueCoverageThusFar, transformedQuadRect);
         bool keepQuad = !transformedVisibleQuadRect.isEmpty();
-        if (!keepQuad)
-            continue;
 
         // See if we can reduce the number of pixels to draw by reducing the size of the draw
         // quad - we do this by changing its visible rect.
-        if (transformedVisibleQuadRect != transformedQuadRect && drawQuad->isLayerAxisAlignedIntRect())
-            drawQuad->setQuadVisibleRect(drawQuad->quadTransform().inverse().mapRect(transformedVisibleQuadRect));
-
-        // When adding rect to opaque region, deflate it to stay conservative.
-        if (drawQuad->isLayerAxisAlignedIntRect() && !drawQuad->opaqueRect().isEmpty()) {
-            FloatRect floatOpaqueRect = drawQuad->quadTransform().mapRect(FloatRect(drawQuad->opaqueRect()));
-            opaqueCoverageThusFar.unite(Region(enclosedIntRect(floatOpaqueRect)));
+        bool didReduceQuadSize = false;
+        if (keepQuad) {
+            if (transformedVisibleQuadRect != transformedQuadRect && drawQuad->isLayerAxisAlignedIntRect()) {
+                drawQuad->setQuadVisibleRect(drawQuad->quadTransform().inverse().mapRect(transformedVisibleQuadRect));
+                didReduceQuadSize = true;
+            }
+
+            // When adding rect to opaque region, deflate it to stay conservative.
+            if (drawQuad->isLayerAxisAlignedIntRect() && !drawQuad->opaqueRect().isEmpty()) {
+                FloatRect floatOpaqueRect = drawQuad->quadTransform().mapRect(FloatRect(drawQuad->opaqueRect()));
+                opaqueCoverageThusFar.unite(Region(enclosedIntRect(floatOpaqueRect)));
+            }
+
+            culledList.append(quadList[i].release());
         }
 
-        culledList.append(quadList[i].release());
+        if (overdrawMetrics) {
+            // We compute the area of the transformed quad, as this should be in pixels.
+            float area = quadArea(drawQuad->quadTransform().mapQuad(FloatQuad(drawQuad->quadRect())));
+            if (keepQuad) {
+                if (didReduceQuadSize) {
+                    float visibleQuadRectArea = quadArea(drawQuad->quadTransform().mapQuad(FloatQuad(drawQuad->quadVisibleRect())));
+                    overdrawMetrics->m_pixelsCulled += area - visibleQuadRectArea;
+                    area = visibleQuadRectArea;
+                }
+                IntRect visibleOpaqueRect(drawQuad->quadVisibleRect());
+                visibleOpaqueRect.intersect(drawQuad->opaqueRect());
+                FloatQuad visibleOpaqueQuad = drawQuad->quadTransform().mapQuad(FloatQuad(visibleOpaqueRect));
+                float opaqueArea = quadArea(visibleOpaqueQuad);
+                overdrawMetrics->m_pixelsDrawnOpaque += opaqueArea;
+                overdrawMetrics->m_pixelsDrawnTransparent += area - opaqueArea;
+            } else
+                overdrawMetrics->m_pixelsCulled += area;
+        }
     }
     quadList.clear(); // Release anything that remains.
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
index 3cc315ec4..89582573b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
@@ -32,7 +32,9 @@ namespace WebCore {
 
 class CCQuadCuller {
 public:
-    static void cullOccludedQuads(CCQuadList&, bool haveDamageRect, const FloatRect& damageRect);
+    // Passing 0 for CCOverdrawCounts* is valid, and disable the extra computation
+    // done to estimate over draw statistics.
+    static void cullOccludedQuads(CCQuadList&, bool haveDamageRect, const FloatRect& damageRect, CCOverdrawCounts*);
 
 private:
     // Make non-instantiable.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
index da4b2222c..bd877ec30 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
@@ -65,9 +65,9 @@ void CCRenderPass::appendQuadsForRenderSurfaceLayer(CCLayerImpl* layer)
     m_sharedQuadStateList.append(sharedQuadState.release());
 }
 
-void CCRenderPass::optimizeQuads(bool haveDamageRect, const FloatRect& damageRect)
+void CCRenderPass::optimizeQuads(bool haveDamageRect, const FloatRect& damageRect, CCOverdrawCounts* overdraw)
 {
-    CCQuadCuller::cullOccludedQuads(m_quadList, haveDamageRect, damageRect);
+    CCQuadCuller::cullOccludedQuads(m_quadList, haveDamageRect, damageRect, overdraw);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
index 11fbd4016..2affce541 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
@@ -38,6 +38,22 @@ class CCSharedQuadState;
 
 typedef Vector<OwnPtr<CCDrawQuad> > CCQuadList;
 
+struct CCOverdrawCounts {
+    CCOverdrawCounts()
+       : m_pixelsDrawnOpaque(0)
+       , m_pixelsDrawnTransparent(0)
+       , m_pixelsCulled(0)
+    {
+    }
+    // Count of pixels that are opaque (and thus occlude). Ideally this is no more
+    // than wiewport width x height.
+    float m_pixelsDrawnOpaque;
+    // Count of pixels that are possibly transparent, and cannot occlude.
+    float m_pixelsDrawnTransparent;
+    // Count of pixels not drawn as they are occluded by somthing opaque.
+    float m_pixelsCulled;
+};
+
 class CCRenderPass {
     WTF_MAKE_NONCOPYABLE(CCRenderPass);
 public:
@@ -46,7 +62,8 @@ public:
     void appendQuadsForLayer(CCLayerImpl*);
     void appendQuadsForRenderSurfaceLayer(CCLayerImpl*);
 
-    void optimizeQuads(bool haveDamageRect, const FloatRect& damageRect);
+    // Passing in 0 for CCOverdrawCounts is valid, and disables performing overdraw calculations.
+    void optimizeQuads(bool haveDamageRect, const FloatRect& damageRect, CCOverdrawCounts*);
 
     const CCQuadList& quadList() const { return m_quadList; }
     CCRenderSurface* targetSurface() const { return m_targetSurface; }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
index 169999808..25ac8fa9b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
@@ -58,15 +58,6 @@ CCRenderSurface::CCRenderSurface(CCLayerImpl* owningLayer)
 
 CCRenderSurface::~CCRenderSurface()
 {
-    cleanupResources();
-}
-
-void CCRenderSurface::cleanupResources()
-{
-    if (!m_contentsTexture)
-        return;
-
-    m_contentsTexture.clear();
 }
 
 FloatRect CCRenderSurface::drawableContentRect() const
@@ -216,7 +207,7 @@ void CCRenderSurface::drawSurface(LayerRendererChromium* layerRenderer, CCLayerI
         float edge[24];
         layerQuad.toFloatArray(edge);
         deviceRect.toFloatArray(&edge[12]);
-        GLC(context3D, context3D->uniform3fv(shaderEdgeLocation, edge, 8));
+        GLC(context3D, context3D->uniform3fv(shaderEdgeLocation, 8, edge));
     }
 
     // Map device space quad to layer space.
@@ -239,7 +230,7 @@ SkBitmap CCRenderSurface::applyFilters(LayerRendererChromium* layerRenderer)
 
 String CCRenderSurface::name() const
 {
-    return String::format("RenderSurface(id=%i,owner=%s)", m_owningLayer->id(), m_owningLayer->name().utf8().data());
+    return String::format("RenderSurface(id=%i,owner=%s)", m_owningLayer->id(), m_owningLayer->debugName().utf8().data());
 }
 
 static void writeIndent(TextStream& ts, int indent)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
index 1bcec9260..141ed2d24 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
@@ -55,7 +55,7 @@ public:
 
     bool prepareContentsTexture(LayerRendererChromium*);
     void releaseContentsTexture();
-    void cleanupResources();
+
     void draw(LayerRendererChromium*, const FloatRect& surfaceDamageRect);
 
     String name() const;
@@ -95,7 +95,7 @@ public:
     bool skipsDraw() const { return m_skipsDraw; }
 
     void clearLayerList() { m_layerList.clear(); }
-    Vector<RefPtr<CCLayerImpl> >& layerList() { return m_layerList; }
+    Vector<CCLayerImpl*>& layerList() { return m_layerList; }
 
     void setMaskLayer(CCLayerImpl* maskLayer) { m_maskLayer = maskLayer; }
 
@@ -133,7 +133,7 @@ private:
     TransformationMatrix m_originTransform;
     FilterOperations m_filters;
     IntRect m_clipRect;
-    Vector<RefPtr<CCLayerImpl> > m_layerList;
+    Vector<CCLayerImpl*> m_layerList;
 
     // The nearest ancestor target surface that will contain the contents of this surface, and that is going
     // to move pixels within the surface (such as with a blur). This can point to itself.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
index 8580467f0..633f21d47 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
@@ -86,10 +86,19 @@ void CCScheduler::didSwapBuffersComplete()
     m_frameRateController->didFinishFrame();
 }
 
-void CCScheduler::didSwapBuffersAbort()
+void CCScheduler::didLoseContext()
 {
-    TRACE_EVENT("CCScheduler::didSwapBuffersAbort", this, 0);
+    TRACE_EVENT("CCScheduler::didLoseContext", this, 0);
     m_frameRateController->didAbortAllPendingFrames();
+    m_stateMachine.didLoseContext();
+    processScheduledActions();
+}
+
+void CCScheduler::didRecreateContext()
+{
+    TRACE_EVENT("CCScheduler::didRecreateContext", this, 0);
+    m_stateMachine.didRecreateContext();
+    processScheduledActions();
 }
 
 void CCScheduler::beginFrame()
@@ -151,6 +160,9 @@ void CCScheduler::processScheduledActions()
             m_client->scheduledActionDrawAndSwap();
             m_frameRateController->didBeginFrame();
             break;
+        case CCSchedulerStateMachine::ACTION_BEGIN_CONTEXT_RECREATION:
+            m_client->scheduledActionBeginContextRecreation();
+            break;
         }
     } while (action != CCSchedulerStateMachine::ACTION_NONE);
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
index 7310581b1..f8ba21f99 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
@@ -44,6 +44,7 @@ public:
     virtual void scheduledActionDrawAndSwap() = 0;
     virtual void scheduledActionUpdateMoreResources() = 0;
     virtual void scheduledActionCommit() = 0;
+    virtual void scheduledActionBeginContextRecreation() = 0;
 
 protected:
     virtual ~CCSchedulerClient() { }
@@ -71,7 +72,9 @@ public:
 
     void setMaxFramesPending(int);
     void didSwapBuffersComplete();
-    void didSwapBuffersAbort();
+
+    void didLoseContext();
+    void didRecreateContext();
 
     bool commitPending() const { return m_stateMachine.commitPending(); }
     bool redrawPending() const { return m_stateMachine.redrawPending(); }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp
index d1aa5ccdc..054a4edd7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp
@@ -38,27 +38,60 @@ CCSchedulerStateMachine::CCSchedulerStateMachine()
     , m_updateMoreResourcesPending(false)
     , m_insideVSync(false)
     , m_visible(false)
-    , m_canDraw(true) { }
+    , m_canDraw(true)
+    , m_contextState(CONTEXT_ACTIVE)
+{
+}
+
+bool CCSchedulerStateMachine::hasDrawnThisFrame() const
+{
+    return m_currentFrameNumber == m_lastFrameNumberWhereDrawWasCalled;
+}
+
+bool CCSchedulerStateMachine::shouldDraw() const
+{
+    if (m_needsForcedRedraw)
+        return true;
+
+    if (!m_needsRedraw)
+        return false;
+    if (!m_insideVSync)
+        return false;
+    if (!m_visible)
+        return false;
+    if (hasDrawnThisFrame())
+        return false;
+    if (!m_canDraw)
+        return false;
+    if (m_contextState != CONTEXT_ACTIVE)
+        return false;
+    return true;
+}
 
 CCSchedulerStateMachine::Action CCSchedulerStateMachine::nextAction() const
 {
-    bool canDraw = m_currentFrameNumber != m_lastFrameNumberWhereDrawWasCalled;
-    bool shouldDraw = (m_needsRedraw && m_insideVSync && m_visible && canDraw && m_canDraw) || m_needsForcedRedraw;
+
     switch (m_commitState) {
     case COMMIT_STATE_IDLE:
-        if (shouldDraw)
+        if (m_contextState != CONTEXT_ACTIVE && m_needsForcedRedraw)
+            return ACTION_DRAW;
+        if (m_contextState == CONTEXT_LOST)
+            return ACTION_BEGIN_CONTEXT_RECREATION;
+        if (m_contextState == CONTEXT_RECREATING)
+            return ACTION_NONE;
+        if (shouldDraw())
             return ACTION_DRAW;
         if (m_needsCommit && m_visible)
             return ACTION_BEGIN_FRAME;
         return ACTION_NONE;
 
     case COMMIT_STATE_FRAME_IN_PROGRESS:
-        if (shouldDraw)
+        if (shouldDraw())
             return ACTION_DRAW;
         return ACTION_NONE;
 
     case COMMIT_STATE_UPDATING_RESOURCES:
-        if (shouldDraw)
+        if (shouldDraw())
             return ACTION_DRAW;
         if (!m_updateMoreResourcesPending)
             return ACTION_BEGIN_UPDATE_MORE_RESOURCES;
@@ -68,7 +101,7 @@ CCSchedulerStateMachine::Action CCSchedulerStateMachine::nextAction() const
         return ACTION_COMMIT;
 
     case COMMIT_STATE_WAITING_FOR_FIRST_DRAW:
-        if (shouldDraw)
+        if (shouldDraw() || m_contextState == CONTEXT_LOST)
             return ACTION_DRAW;
         // COMMIT_STATE_WAITING_FOR_FIRST_DRAW wants to enforce a draw. If m_canDraw is false,
         // proceed to the next step (similar as in COMMIT_STATE_IDLE).
@@ -115,12 +148,18 @@ void CCSchedulerStateMachine::updateState(Action action)
             m_commitState = COMMIT_STATE_IDLE;
         }
         return;
+
+    case ACTION_BEGIN_CONTEXT_RECREATION:
+        ASSERT(m_commitState == COMMIT_STATE_IDLE);
+        ASSERT(m_contextState == CONTEXT_LOST);
+        m_contextState = CONTEXT_RECREATING;
+        return;
     }
 }
 
 bool CCSchedulerStateMachine::vsyncCallbackNeeded() const
 {
-    if (!m_visible) {
+    if (!m_visible || m_contextState != CONTEXT_ACTIVE) {
         if (m_needsForcedRedraw)
             return true;
 
@@ -176,4 +215,18 @@ void CCSchedulerStateMachine::beginUpdateMoreResourcesComplete(bool morePending)
         m_commitState = COMMIT_STATE_READY_TO_COMMIT;
 }
 
+void CCSchedulerStateMachine::didLoseContext()
+{
+    if (m_contextState == CONTEXT_LOST || m_contextState == CONTEXT_RECREATING)
+        return;
+    m_contextState = CONTEXT_LOST;
+}
+
+void CCSchedulerStateMachine::didRecreateContext()
+{
+    ASSERT(m_contextState == CONTEXT_RECREATING);
+    m_contextState = CONTEXT_ACTIVE;
+    setNeedsCommit();
+}
+
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h
index 7de718846..22fcdf422 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h
@@ -51,6 +51,11 @@ public:
         COMMIT_STATE_WAITING_FOR_FIRST_DRAW,
     };
 
+    enum ContextState {
+        CONTEXT_ACTIVE,
+        CONTEXT_LOST,
+        CONTEXT_RECREATING,
+    };
     bool commitPending() const
     {
         return m_commitState != COMMIT_STATE_IDLE;
@@ -64,6 +69,7 @@ public:
         ACTION_BEGIN_UPDATE_MORE_RESOURCES,
         ACTION_COMMIT,
         ACTION_DRAW,
+        ACTION_BEGIN_CONTEXT_RECREATION
     };
     Action nextAction() const;
     void updateState(Action);
@@ -107,7 +113,13 @@ public:
     // when such behavior would be undesirable.
     void setCanDraw(bool can) { m_canDraw = can; }
 
+    void didLoseContext();
+    void didRecreateContext();
+
 protected:
+    bool shouldDraw() const;
+    bool hasDrawnThisFrame() const;
+
     CommitState m_commitState;
 
     int m_currentFrameNumber;
@@ -119,6 +131,7 @@ protected:
     bool m_insideVSync;
     bool m_visible;
     bool m_canDraw;
+    ContextState m_contextState;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
new file mode 100644
index 000000000..872a35832
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
@@ -0,0 +1,284 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "CCScrollbarLayerImpl.h"
+
+#include "CCTileDrawQuad.h"
+#include "LayerRendererChromium.h"
+#include "ManagedTexture.h"
+#include "PlatformCanvas.h"
+#include "ScrollbarTheme.h"
+
+namespace WebCore {
+
+PassOwnPtr<CCScrollbarLayerImpl> CCScrollbarLayerImpl::create(int id)
+{
+    return adoptPtr(new CCScrollbarLayerImpl(id));
+}
+
+CCScrollbarLayerImpl::CCScrollbarLayerImpl(int id)
+    : CCLayerImpl(id)
+    , m_scrollLayer(0)
+    , m_scrollbar(this)
+{
+}
+
+void CCScrollbarLayerImpl::willDraw(LayerRendererChromium* layerRenderer)
+{
+    if (bounds().isEmpty() || contentBounds().isEmpty())
+        return;
+
+    if (!m_texture)
+        m_texture = ManagedTexture::create(layerRenderer->renderSurfaceTextureManager());
+
+    IntSize textureSize = contentBounds();
+    if (!m_texture->reserve(textureSize, GraphicsContext3D::RGBA))
+        return;
+
+    PlatformCanvas canvas;
+    canvas.resize(textureSize);
+    {
+        PlatformCanvas::Painter painter(&canvas, PlatformCanvas::Painter::GrayscaleText);
+        paint(painter.context());
+    }
+
+    {
+        PlatformCanvas::AutoLocker locker(&canvas);
+        GraphicsContext3D* context = layerRenderer->context();
+        m_texture->bindTexture(context, layerRenderer->renderSurfaceTextureAllocator());
+
+        // FIXME: Skia uses BGRA actually, we correct that with the swizzle pixel shader.
+        GLC(context, context->texImage2D(GraphicsContext3D::TEXTURE_2D, 0, m_texture->format(), canvas.size().width(), canvas.size().height(), 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, locker.pixels()));
+    }
+}
+
+void CCScrollbarLayerImpl::appendQuads(CCQuadList& quadList, const CCSharedQuadState* sharedQuadState)
+{
+    if (!m_texture->isReserved())
+        return;
+
+    IntRect quadRect(IntPoint(), bounds());
+    quadList.append(CCTileDrawQuad::create(sharedQuadState, quadRect, quadRect, m_texture->textureId(), IntPoint(), m_texture->size(), GraphicsContext3D::NEAREST, true, true, true, true, true));
+}
+
+void CCScrollbarLayerImpl::didDraw()
+{
+    m_texture->unreserve();
+}
+
+void CCScrollbarLayerImpl::paint(GraphicsContext* context)
+{
+    ScrollbarTheme* theme = ScrollbarTheme::theme(); // FIXME: should make impl-side clone if needed
+
+    context->clearRect(IntRect(IntPoint(), contentBounds()));
+    theme->paint(&m_scrollbar, context, IntRect(IntPoint(), contentBounds()));
+}
+
+
+int CCScrollbarLayerImpl::CCScrollbar::x() const
+{
+    return frameRect().x();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::y() const
+{
+    return frameRect().y();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::width() const
+{
+    return frameRect().width();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::height() const
+{
+    return frameRect().height();
+}
+
+IntSize CCScrollbarLayerImpl::CCScrollbar::size() const
+{
+    return frameRect().size();
+}
+
+IntPoint CCScrollbarLayerImpl::CCScrollbar::location() const
+{
+    return frameRect().location();
+}
+
+ScrollView* CCScrollbarLayerImpl::CCScrollbar::parent() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+ScrollView* CCScrollbarLayerImpl::CCScrollbar::root() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::setFrameRect(const IntRect&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+IntRect CCScrollbarLayerImpl::CCScrollbar::frameRect() const
+{
+    return IntRect(IntPoint(), m_owner->contentBounds());
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::invalidate()
+{
+    invalidateRect(frameRect());
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::invalidateRect(const IntRect&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+ScrollbarOverlayStyle CCScrollbarLayerImpl::CCScrollbar::scrollbarOverlayStyle() const
+{
+    return m_owner->m_scrollbarOverlayStyle;
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::getTickmarks(Vector<IntRect>& tickmarks) const
+{
+    tickmarks = m_owner->m_tickmarks;
+}
+
+bool CCScrollbarLayerImpl::CCScrollbar::isScrollableAreaActive() const
+{
+    return m_owner->m_isScrollableAreaActive;
+}
+
+bool CCScrollbarLayerImpl::CCScrollbar::isScrollViewScrollbar() const
+{
+    return m_owner->m_isScrollViewScrollbar;
+}
+
+IntPoint CCScrollbarLayerImpl::CCScrollbar::convertFromContainingWindow(const IntPoint& windowPoint)
+{
+    ASSERT_NOT_REACHED();
+    return windowPoint;
+}
+
+bool CCScrollbarLayerImpl::CCScrollbar::isCustomScrollbar() const
+{
+    return false;
+}
+
+ScrollbarOrientation CCScrollbarLayerImpl::CCScrollbar::orientation() const
+{
+    return m_owner->m_orientation;
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::value() const
+{
+    if (!m_owner->m_scrollLayer)
+        return 0;
+    if (orientation() == HorizontalScrollbar)
+        return m_owner->m_scrollLayer->scrollPosition().x() + m_owner->m_scrollLayer->scrollDelta().width();
+    return m_owner->m_scrollLayer->scrollPosition().y() + m_owner->m_scrollLayer->scrollDelta().height();
+}
+
+float CCScrollbarLayerImpl::CCScrollbar::currentPos() const
+{
+    return value();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::visibleSize() const
+{
+    return totalSize() - maximum();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::totalSize() const
+{
+    if (!m_owner->m_scrollLayer || !m_owner->m_scrollLayer->children().size())
+        return 0;
+    // Copy & paste from CCLayerTreeHostImpl...
+    // FIXME: Hardcoding the first child here is weird. Think of
+    // a cleaner way to get the contentBounds on the Impl side.
+    if (orientation() == HorizontalScrollbar)
+        return m_owner->m_scrollLayer->children()[0]->contentBounds().width();
+    return m_owner->m_scrollLayer->children()[0]->contentBounds().height();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::maximum() const
+{
+    if (!m_owner->m_scrollLayer)
+        return 0;
+    if (orientation() == HorizontalScrollbar)
+        return m_owner->m_scrollLayer->maxScrollPosition().width();
+    return m_owner->m_scrollLayer->maxScrollPosition().height();
+}
+
+ScrollbarControlSize CCScrollbarLayerImpl::CCScrollbar::controlSize() const
+{
+    return m_owner->m_controlSize;
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::lineStep() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::pageStep() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+ScrollbarPart CCScrollbarLayerImpl::CCScrollbar::pressedPart() const
+{
+    return m_owner->m_pressedPart;
+}
+
+ScrollbarPart CCScrollbarLayerImpl::CCScrollbar::hoveredPart() const
+{
+    return m_owner->m_hoveredPart;
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::styleChanged()
+{
+}
+
+bool CCScrollbarLayerImpl::CCScrollbar::enabled() const
+{
+    return m_owner->m_enabled;
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::setEnabled(bool)
+{
+    ASSERT_NOT_REACHED();
+}
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
new file mode 100644
index 000000000..f6f005360
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCScrollbarLayerImpl_h
+#define CCScrollbarLayerImpl_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "CCLayerImpl.h"
+#include "ManagedTexture.h"
+#include "ScrollbarThemeClient.h"
+
+namespace WebCore {
+
+class GraphicsContext;
+class ScrollView;
+
+class CCScrollbarLayerImpl : public CCLayerImpl {
+public:
+    static PassOwnPtr<CCScrollbarLayerImpl> create(int id);
+
+    void setScrollbarOverlayStyle(ScrollbarOverlayStyle scrollbarOverlayStyle) { m_scrollbarOverlayStyle = scrollbarOverlayStyle; }
+    void setTickmarks(const Vector<IntRect>& tickmarks) { m_tickmarks = tickmarks; }
+    void setIsScrollableAreaActive(bool isScrollableAreaActive) { m_isScrollableAreaActive = isScrollableAreaActive; }
+    void setIsScrollViewScrollbar(bool isScrollViewScrollbar) { m_isScrollViewScrollbar = isScrollViewScrollbar; }
+
+    void setOrientation(ScrollbarOrientation orientation) { m_orientation = orientation; }
+
+    void setControlSize(ScrollbarControlSize controlSize) { m_controlSize = controlSize; }
+
+    void setPressedPart(ScrollbarPart pressedPart) { m_pressedPart = pressedPart; }
+    void setHoveredPart(ScrollbarPart hoveredPart) { m_hoveredPart = hoveredPart; }
+
+    void setEnabled(bool enabled) { m_enabled = enabled; }
+
+
+    CCLayerImpl* scrollLayer() const { return m_scrollLayer; }
+    void setScrollLayer(CCLayerImpl* scrollLayer) { m_scrollLayer = scrollLayer; }
+
+    virtual void willDraw(LayerRendererChromium*);
+    virtual void appendQuads(CCQuadList&, const CCSharedQuadState*);
+    virtual void didDraw();
+
+protected:
+    explicit CCScrollbarLayerImpl(int id);
+
+private:
+    void paint(GraphicsContext*);
+
+    CCLayerImpl* m_scrollLayer;
+    OwnPtr<ManagedTexture> m_texture;
+
+    // nested class only to avoid namespace problem
+    class CCScrollbar : public ScrollbarThemeClient {
+    public:
+        explicit CCScrollbar(CCScrollbarLayerImpl* owner) : m_owner(owner) { }
+
+        // ScrollbarThemeClient implementation
+        virtual int x() const;
+        virtual int y() const;
+        virtual int width() const;
+        virtual int height() const;
+        virtual IntSize size() const;
+        virtual IntPoint location() const;
+
+        virtual ScrollView* parent() const;
+        virtual ScrollView* root() const;
+
+        virtual void setFrameRect(const IntRect&);
+        virtual IntRect frameRect() const;
+
+        virtual void invalidate();
+        virtual void invalidateRect(const IntRect&);
+
+        virtual ScrollbarOverlayStyle scrollbarOverlayStyle() const;
+        virtual void getTickmarks(Vector<IntRect>&) const;
+        virtual bool isScrollableAreaActive() const;
+        virtual bool isScrollViewScrollbar() const;
+
+        virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint);
+
+        virtual bool isCustomScrollbar() const;
+        virtual ScrollbarOrientation orientation() const;
+
+        virtual int value() const;
+        virtual float currentPos() const;
+        virtual int visibleSize() const;
+        virtual int totalSize() const;
+        virtual int maximum() const;
+        virtual ScrollbarControlSize controlSize() const;
+
+        virtual int lineStep() const;
+        virtual int pageStep() const;
+
+        virtual ScrollbarPart pressedPart() const;
+        virtual ScrollbarPart hoveredPart() const;
+
+        virtual void styleChanged();
+
+        virtual bool enabled() const;
+        virtual void setEnabled(bool);
+
+    private:
+        CCScrollbarLayerImpl* m_owner;
+
+    };
+    CCScrollbar m_scrollbar;
+
+    ScrollbarOverlayStyle m_scrollbarOverlayStyle;
+    Vector<IntRect> m_tickmarks;
+    bool m_isScrollableAreaActive;
+    bool m_isScrollViewScrollbar;
+
+    ScrollbarOrientation m_orientation;
+
+    ScrollbarControlSize m_controlSize;
+
+    ScrollbarPart m_pressedPart;
+    ScrollbarPart m_hoveredPart;
+
+    bool m_enabled;
+};
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
index ea8c40f12..b6fc76b52 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
@@ -45,11 +45,9 @@ PassOwnPtr<CCProxy> CCSingleThreadProxy::create(CCLayerTreeHost* layerTreeHost)
 
 CCSingleThreadProxy::CCSingleThreadProxy(CCLayerTreeHost* layerTreeHost)
     : m_layerTreeHost(layerTreeHost)
+    , m_contextLost(false)
     , m_compositorIdentifier(-1)
     , m_layerRendererInitialized(false)
-    , m_numFailedRecreateAttempts(0)
-    , m_graphicsContextLost(false)
-    , m_timesRecreateShouldFail(0)
     , m_nextFrameIsNewlyCommittedFrame(false)
 {
     TRACE_EVENT("CCSingleThreadProxy::CCSingleThreadProxy", this, 0);
@@ -74,11 +72,6 @@ bool CCSingleThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect
     TRACE_EVENT("CCSingleThreadProxy::compositeAndReadback", this, 0);
     ASSERT(CCProxy::isMainThread());
 
-    if (!recreateContextIfNeeded()) {
-        TRACE_EVENT("compositeAndReadback_EarlyOut_ContextLost", this, 0);
-        return false;
-    }
-
     if (!commitIfNeeded())
         return false;
 
@@ -90,12 +83,15 @@ bool CCSingleThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect
     if (m_layerTreeHostImpl->isContextLost())
         return false;
 
+    m_layerTreeHostImpl->swapBuffers();
+    didSwapFrame();
+
     return true;
 }
 
-void CCSingleThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
+void CCSingleThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double duration)
 {
-    m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime() * 1000.0, durationSec * 1000.0);
+    m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime(), duration);
 }
 
 GraphicsContext3D* CCSingleThreadProxy::context()
@@ -125,7 +121,7 @@ bool CCSingleThreadProxy::isStarted() const
 bool CCSingleThreadProxy::initializeContext()
 {
     ASSERT(CCProxy::isMainThread());
-    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createLayerTreeHostContext3D();
+    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createContext();
     if (!context)
         return false;
     ASSERT(context->hasOneRef());
@@ -148,6 +144,33 @@ bool CCSingleThreadProxy::initializeLayerRenderer()
     }
 }
 
+bool CCSingleThreadProxy::recreateContext()
+{
+    TRACE_EVENT0("cc", "CCSingleThreadProxy::recreateContext");
+    ASSERT(CCProxy::isMainThread());
+    ASSERT(m_contextLost);
+
+    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createContext();
+    if (!context)
+        return false;
+
+    ASSERT(context->hasOneRef());
+    bool initialized;
+    {
+        DebugScopedSetImplThread impl;
+        m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
+        initialized = m_layerTreeHostImpl->initializeLayerRenderer(context);
+        if (initialized) {
+            m_layerRendererCapabilitiesForMainThread = m_layerTreeHostImpl->layerRendererCapabilities();
+        }
+    }
+
+    if (initialized)
+        m_contextLost = false;
+
+    return initialized;
+}
+
 const LayerRendererCapabilities& CCSingleThreadProxy::layerRendererCapabilities() const
 {
     ASSERT(m_layerRendererInitialized);
@@ -155,10 +178,11 @@ const LayerRendererCapabilities& CCSingleThreadProxy::layerRendererCapabilities(
     return m_layerRendererCapabilitiesForMainThread;
 }
 
-void CCSingleThreadProxy::loseCompositorContext(int numTimes)
+void CCSingleThreadProxy::loseContext()
 {
-    m_graphicsContextLost = true;
-    m_timesRecreateShouldFail = numTimes - 1;
+    ASSERT(CCProxy::isMainThread());
+    m_layerTreeHost->didLoseContext();
+    m_contextLost = true;
 }
 
 void CCSingleThreadProxy::setNeedsAnimate()
@@ -212,12 +236,14 @@ void CCSingleThreadProxy::setNeedsRedraw()
 
 void CCSingleThreadProxy::setVisible(bool visible)
 {
+    m_layerTreeHostImpl->setVisible(visible);
+
     if (!visible) {
         DebugScopedSetImplThread impl;
         m_layerTreeHost->didBecomeInvisibleOnImplThread(m_layerTreeHostImpl.get());
-        m_layerTreeHostImpl->setVisible(false);
         return;
     }
+
     setNeedsCommit();
 }
 
@@ -233,72 +259,23 @@ void CCSingleThreadProxy::stop()
     m_layerTreeHost = 0;
 }
 
-void CCSingleThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events)
+void CCSingleThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events, double wallClockTime)
 {
     ASSERT(CCProxy::isImplThread());
     DebugScopedSetMainThread main;
-    m_layerTreeHost->setAnimationEvents(events);
+    m_layerTreeHost->setAnimationEvents(events, wallClockTime);
 }
 
 // Called by the legacy scheduling path (e.g. where render_widget does the scheduling)
 void CCSingleThreadProxy::compositeImmediately()
 {
-    if (!recreateContextIfNeeded())
-        return;
-
     if (!commitIfNeeded())
         return;
 
-    if (doComposite())
+    if (doComposite()) {
         m_layerTreeHostImpl->swapBuffers();
-}
-
-bool CCSingleThreadProxy::recreateContextIfNeeded()
-{
-    ASSERT(CCProxy::isMainThread());
-
-    if (!m_graphicsContextLost && m_layerTreeHostImpl->isContextLost()) {
-        m_graphicsContextLost = true;
-        m_numFailedRecreateAttempts = 0;
-    }
-
-    if (!m_graphicsContextLost)
-        return true;
-    RefPtr<GraphicsContext3D> context;
-    if (!m_timesRecreateShouldFail)
-        context = m_layerTreeHost->createLayerTreeHostContext3D();
-    else
-        m_timesRecreateShouldFail--;
-
-    if (context) {
-        ASSERT(context->hasOneRef());
-        bool ok;
-        {
-            DebugScopedSetImplThread impl;
-            m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
-            ok = m_layerTreeHostImpl->initializeLayerRenderer(context);
-            if (ok)
-                m_layerRendererCapabilitiesForMainThread = m_layerTreeHostImpl->layerRendererCapabilities();
-        }
-        if (ok) {
-            m_layerTreeHost->didRecreateGraphicsContext(true);
-            m_graphicsContextLost = false;
-            return true;
-        }
+        didSwapFrame();
     }
-
-    // Tolerate a certain number of recreation failures to work around races
-    // in the context-lost machinery.
-    m_numFailedRecreateAttempts++;
-    if (m_numFailedRecreateAttempts < 5) {
-        setNeedsCommit();
-        return false;
-    }
-
-    // We have tried too many times to recreate the context. Tell the host to fall
-    // back to software rendering.
-    m_layerTreeHost->didRecreateGraphicsContext(false);
-    return false;
 }
 
 bool CCSingleThreadProxy::commitIfNeeded()
@@ -314,34 +291,31 @@ bool CCSingleThreadProxy::commitIfNeeded()
 
 bool CCSingleThreadProxy::doComposite()
 {
-    ASSERT(!m_graphicsContextLost);
-
+    ASSERT(!m_contextLost);
     {
       DebugScopedSetImplThread impl;
-      double frameDisplayTimeMs = monotonicallyIncreasingTime() * 1000.0;
-      m_layerTreeHostImpl->animate(frameDisplayTimeMs);
+      double monotonicTime = monotonicallyIncreasingTime();
+      double wallClockTime = currentTime();
+
+      m_layerTreeHostImpl->animate(monotonicTime, wallClockTime);
       m_layerTreeHostImpl->drawLayers();
     }
 
     if (m_layerTreeHostImpl->isContextLost()) {
-        // Trying to recover the context right here will not work if GPU process
-        // died. This is because GpuChannelHost::OnErrorMessage will only be
-        // called at the next iteration of the message loop, reverting our
-        // recovery attempts here. Instead, we detach the root layer from the
-        // renderer, recreate the renderer at the next message loop iteration
-        // and request a repaint yet again.
-        m_graphicsContextLost = true;
-        m_numFailedRecreateAttempts = 0;
-        setNeedsCommit();
+        m_contextLost = true;
+        m_layerTreeHost->didLoseContext();
         return false;
     }
 
+    return true;
+}
+
+void CCSingleThreadProxy::didSwapFrame()
+{
     if (m_nextFrameIsNewlyCommittedFrame) {
         m_nextFrameIsNewlyCommittedFrame = false;
         m_layerTreeHost->didCommitAndDrawFrame();
     }
-
-    return true;
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
index 71b5e99b2..ebbd96e2c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
@@ -43,15 +43,16 @@ public:
 
     // CCProxy implementation
     virtual bool compositeAndReadback(void *pixels, const IntRect&);
-    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double duration);
     virtual GraphicsContext3D* context();
     virtual void finishAllRendering();
     virtual bool isStarted() const;
     virtual bool initializeContext();
     virtual bool initializeLayerRenderer();
+    virtual bool recreateContext();
     virtual int compositorIdentifier() const { return m_compositorIdentifier; }
     virtual const LayerRendererCapabilities& layerRendererCapabilities() const;
-    virtual void loseCompositorContext(int numTimes);
+    virtual void loseContext();
     virtual void setNeedsAnimate();
     virtual void setNeedsCommit();
     virtual void setNeedsRedraw();
@@ -61,23 +62,26 @@ public:
     virtual size_t maxPartialTextureUpdates() const { return std::numeric_limits<size_t>::max(); }
 
     // CCLayerTreeHostImplClient implementation
+    virtual void didLoseContextOnImplThread() { }
     virtual void onSwapBuffersCompleteOnImplThread() { ASSERT_NOT_REACHED(); }
     virtual void setNeedsRedrawOnImplThread() { m_layerTreeHost->setNeedsCommit(); }
     virtual void setNeedsCommitOnImplThread() { m_layerTreeHost->setNeedsCommit(); }
-    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>);
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime);
 
     // Called by the legacy path where RenderWidget does the scheduling.
     void compositeImmediately();
 
 private:
     explicit CCSingleThreadProxy(CCLayerTreeHost*);
-    bool recreateContextIfNeeded();
+
     bool commitIfNeeded();
     void doCommit();
     bool doComposite();
+    void didSwapFrame();
 
     // Accessed on main thread only.
     CCLayerTreeHost* m_layerTreeHost;
+    bool m_contextLost;
     int m_compositorIdentifier;
 
     // Holds on to the context between initializeContext() and initializeLayerRenderer() calls. Shouldn't
@@ -89,9 +93,6 @@ private:
     bool m_layerRendererInitialized;
     LayerRendererCapabilities m_layerRendererCapabilitiesForMainThread;
 
-    int m_numFailedRecreateAttempts;
-    bool m_graphicsContextLost;
-    int m_timesRecreateShouldFail; // Used during testing.
     bool m_nextFrameIsNewlyCommittedFrame;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.h
index c7edc18b2..2e7441666 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.h
@@ -35,9 +35,9 @@ class LayerRendererChromium;
 
 class CCSolidColorLayerImpl : public CCLayerImpl {
 public:
-    static PassRefPtr<CCSolidColorLayerImpl> create(int id)
+    static PassOwnPtr<CCSolidColorLayerImpl> create(int id)
     {
-        return adoptRef(new CCSolidColorLayerImpl(id));
+        return adoptPtr(new CCSolidColorLayerImpl(id));
     }
     virtual ~CCSolidColorLayerImpl();
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
index 75ef13623..8454e21ff 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
@@ -59,6 +59,7 @@ PassOwnPtr<CCProxy> CCThreadProxy::create(CCLayerTreeHost* layerTreeHost)
 CCThreadProxy::CCThreadProxy(CCLayerTreeHost* layerTreeHost)
     : m_animateRequested(false)
     , m_commitRequested(false)
+    , m_contextLost(false)
     , m_layerTreeHost(layerTreeHost)
     , m_compositorIdentifier(-1)
     , m_layerRendererInitialized(false)
@@ -133,17 +134,17 @@ void CCThreadProxy::requestReadbackOnImplThread(ReadbackRequest* request)
     m_schedulerOnImplThread->setNeedsForcedRedraw();
 }
 
-void CCThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
+void CCThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double duration)
 {
     ASSERT(CCProxy::isMainThread());
-    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::requestStartPageScaleAnimationOnImplThread, targetPosition, useAnchor, scale, durationSec));
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::requestStartPageScaleAnimationOnImplThread, targetPosition, useAnchor, scale, duration));
 }
 
-void CCThreadProxy::requestStartPageScaleAnimationOnImplThread(IntSize targetPosition, bool useAnchor, float scale, double durationSec)
+void CCThreadProxy::requestStartPageScaleAnimationOnImplThread(IntSize targetPosition, bool useAnchor, float scale, double duration)
 {
     ASSERT(CCProxy::isImplThread());
     if (m_layerTreeHostImpl)
-        m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime() * 1000.0, durationSec * 1000.0);
+        m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime(), duration);
 }
 
 GraphicsContext3D* CCThreadProxy::context()
@@ -170,7 +171,7 @@ bool CCThreadProxy::isStarted() const
 bool CCThreadProxy::initializeContext()
 {
     TRACE_EVENT("CCThreadProxy::initializeContext", this, 0);
-    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createLayerTreeHostContext3D();
+    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createContext();
     if (!context)
         return false;
     ASSERT(context->hasOneRef());
@@ -193,9 +194,9 @@ bool CCThreadProxy::initializeLayerRenderer()
     bool initializeSucceeded = false;
     LayerRendererCapabilities capabilities;
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::initializeLayerRendererOnImplThread,
-                                          AllowCrossThreadAccess(&completion),
-                                          AllowCrossThreadAccess(&initializeSucceeded),
-                                          AllowCrossThreadAccess(&capabilities)));
+                                                       AllowCrossThreadAccess(&completion),
+                                                       AllowCrossThreadAccess(&initializeSucceeded),
+                                                       AllowCrossThreadAccess(&capabilities)));
     completion.wait();
 
     if (initializeSucceeded) {
@@ -205,6 +206,39 @@ bool CCThreadProxy::initializeLayerRenderer()
     return initializeSucceeded;
 }
 
+bool CCThreadProxy::recreateContext()
+{
+    TRACE_EVENT0("cc", "CCThreadProxy::recreateContext");
+    ASSERT(isMainThread());
+
+    // Try to create the context.
+    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createContext();
+    if (!context)
+        return false;
+    ASSERT(context->hasOneRef());
+
+    // Leak the context pointer so we can transfer ownership of it to the other side...
+    GraphicsContext3D* contextPtr = context.release().leakRef();
+    ASSERT(contextPtr->hasOneRef());
+
+    // Make a blocking call to recreateContextOnImplThread. The results of that
+    // call are pushed into the recreateSucceeded and capabilities local
+    // variables.
+    CCCompletionEvent completion;
+    bool recreateSucceeded = false;
+    LayerRendererCapabilities capabilities;
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::recreateContextOnImplThread,
+                                                       AllowCrossThreadAccess(&completion),
+                                                       AllowCrossThreadAccess(contextPtr),
+                                                       AllowCrossThreadAccess(&recreateSucceeded),
+                                                       AllowCrossThreadAccess(&capabilities)));
+    completion.wait();
+
+    if (recreateSucceeded)
+        m_layerRendererCapabilitiesMainThreadCopy = capabilities;
+    return recreateSucceeded;
+}
+
 int CCThreadProxy::compositorIdentifier() const
 {
     ASSERT(isMainThread());
@@ -217,9 +251,9 @@ const LayerRendererCapabilities& CCThreadProxy::layerRendererCapabilities() cons
     return m_layerRendererCapabilitiesMainThreadCopy;
 }
 
-void CCThreadProxy::loseCompositorContext(int numTimes)
+void CCThreadProxy::loseContext()
 {
-    ASSERT_NOT_REACHED();
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::didLoseContextOnImplThread));
 }
 
 void CCThreadProxy::setNeedsAnimate()
@@ -244,6 +278,13 @@ void CCThreadProxy::setNeedsCommit()
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setNeedsCommitOnImplThread));
 }
 
+void CCThreadProxy::didLoseContextOnImplThread()
+{
+    ASSERT(isImplThread());
+    TRACE_EVENT0("cc", "CCThreadProxy::didLoseContextOnImplThread");
+    m_schedulerOnImplThread->didLoseContext();
+}
+
 void CCThreadProxy::onSwapBuffersCompleteOnImplThread()
 {
     ASSERT(isImplThread());
@@ -259,11 +300,11 @@ void CCThreadProxy::setNeedsCommitOnImplThread()
     m_schedulerOnImplThread->setNeedsCommit();
 }
 
-void CCThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events)
+void CCThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events, double wallClockTime)
 {
     ASSERT(isImplThread());
     TRACE_EVENT("CCThreadProxy::postAnimationEventsToMainThreadOnImplThread", this, 0);
-    m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::setAnimationEvents, events));
+    m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::setAnimationEvents, events, wallClockTime));
 }
 
 void CCThreadProxy::setNeedsRedraw()
@@ -511,6 +552,12 @@ void CCThreadProxy::scheduledActionCommit()
     m_commitCompletionEventOnImplThread = 0;
 }
 
+void CCThreadProxy::scheduledActionBeginContextRecreation()
+{
+    ASSERT(isImplThread());
+    m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::beginContextRecreation));
+}
+
 void CCThreadProxy::scheduledActionDrawAndSwap()
 {
     TRACE_EVENT("CCThreadProxy::scheduledActionDrawAndSwap", this, 0);
@@ -519,26 +566,23 @@ void CCThreadProxy::scheduledActionDrawAndSwap()
         return;
 
     // FIXME: compute the frame display time more intelligently
-    double frameDisplayTimeMs = monotonicallyIncreasingTime() * 1000.0;
+    double monotonicTime = monotonicallyIncreasingTime();
+    double wallClockTime = currentTime();
 
-    m_inputHandlerOnImplThread->willDraw(frameDisplayTimeMs);
-    m_layerTreeHostImpl->animate(frameDisplayTimeMs);
+    m_inputHandlerOnImplThread->willDraw(monotonicTime);
+    m_layerTreeHostImpl->animate(monotonicTime, wallClockTime);
     m_layerTreeHostImpl->drawLayers();
 
     // Check for a pending compositeAndReadback.
     if (m_readbackRequestOnImplThread) {
-      m_layerTreeHostImpl->readback(m_readbackRequestOnImplThread->pixels, m_readbackRequestOnImplThread->rect);
-      m_readbackRequestOnImplThread->success = !m_layerTreeHostImpl->isContextLost();
-      m_readbackRequestOnImplThread->completion.signal();
-      m_readbackRequestOnImplThread = 0;
+        m_layerTreeHostImpl->readback(m_readbackRequestOnImplThread->pixels, m_readbackRequestOnImplThread->rect);
+        m_readbackRequestOnImplThread->success = !m_layerTreeHostImpl->isContextLost();
+        m_readbackRequestOnImplThread->completion.signal();
+        m_readbackRequestOnImplThread = 0;
     }
 
     m_layerTreeHostImpl->swapBuffers();
 
-    // FIXME: handle case where m_layerTreeHostImpl->isContextLost.
-    // FIXME: pass didSwapBuffersAbort if m_layerTreeHostImpl->isContextLost.
-    ASSERT(!m_layerTreeHostImpl->isContextLost());
-
     // Process any finish request
     if (m_finishAllRenderingCompletionEventOnImplThread) {
         m_layerTreeHostImpl->finishAllRendering();
@@ -569,12 +613,55 @@ void CCThreadProxy::didCompleteSwapBuffers()
     m_layerTreeHost->didCompleteSwapBuffers();
 }
 
-void CCThreadProxy::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events)
+void CCThreadProxy::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events, double wallClockTime)
 {
+    TRACE_EVENT0("cc", "CCThreadProxy::setAnimationEvents");
     ASSERT(isMainThread());
     if (!m_layerTreeHost)
         return;
-    m_layerTreeHost->setAnimationEvents(events);
+    m_layerTreeHost->setAnimationEvents(events, wallClockTime);
+}
+
+class CCThreadProxyContextRecreationTimer : public CCTimer, CCTimerClient {
+public:
+    static PassOwnPtr<CCThreadProxyContextRecreationTimer> create(CCThreadProxy* proxy) { return adoptPtr(new CCThreadProxyContextRecreationTimer(proxy)); }
+
+    virtual void onTimerFired()
+    {
+        m_proxy->tryToRecreateContext();
+    }
+
+    enum Recreation { RecreationTickRateMs = 30 };
+
+private:
+    explicit CCThreadProxyContextRecreationTimer(CCThreadProxy* proxy)
+        : CCTimer(CCProxy::mainThread(), this)
+        , m_proxy(proxy)
+    {
+    }
+
+    CCThreadProxy* m_proxy;
+};
+
+void CCThreadProxy::beginContextRecreation()
+{
+    TRACE_EVENT0("cc", "CCThreadProxy::beginContextRecreation");
+    ASSERT(isMainThread());
+    ASSERT(!m_contextRecreationTimer);
+    m_contextRecreationTimer = CCThreadProxyContextRecreationTimer::create(this);
+    m_layerTreeHost->didLoseContext();
+    m_contextRecreationTimer->startOneShot(CCThreadProxyContextRecreationTimer::RecreationTickRateMs);
+}
+
+void CCThreadProxy::tryToRecreateContext()
+{
+    ASSERT(isMainThread());
+    ASSERT(m_layerTreeHost);
+    CCLayerTreeHost::RecreateResult result = m_layerTreeHost->recreateContext();
+    if (result == CCLayerTreeHost::RecreateFailedButTryAgain)
+        m_contextRecreationTimer->startOneShot(CCThreadProxyContextRecreationTimer::RecreationTickRateMs);
+    else if (result == CCLayerTreeHost::RecreateSucceeded)
+        m_contextRecreationTimer.clear();
 }
 
 void CCThreadProxy::initializeImplOnImplThread(CCCompletionEvent* completion)
@@ -637,4 +724,17 @@ size_t CCThreadProxy::maxPartialTextureUpdates() const
     return textureUpdatesPerFrame;
 }
 
+void CCThreadProxy::recreateContextOnImplThread(CCCompletionEvent* completion, GraphicsContext3D* contextPtr, bool* recreateSucceeded, LayerRendererCapabilities* capabilities)
+{
+    TRACE_EVENT0("cc", "CCThreadProxy::recreateContextOnImplThread");
+    ASSERT(isImplThread());
+    m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
+    *recreateSucceeded = m_layerTreeHostImpl->initializeLayerRenderer(adoptRef(contextPtr));
+    if (*recreateSucceeded) {
+        *capabilities = m_layerTreeHostImpl->layerRendererCapabilities();
+        m_schedulerOnImplThread->didRecreateContext();
+    }
+    completion->signal();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
index 330ef51ca..057691213 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
@@ -31,6 +31,7 @@
 #include "cc/CCProxy.h"
 #include "cc/CCScheduler.h"
 #include "cc/CCThread.h"
+#include "cc/CCTimer.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -41,6 +42,7 @@ class CCScheduler;
 class CCScopedThreadProxy;
 class CCTextureUpdater;
 class CCThread;
+class CCThreadProxyContextRecreationTimer;
 
 class CCThreadProxy : public CCProxy, CCLayerTreeHostImplClient, CCSchedulerClient {
 public:
@@ -50,15 +52,16 @@ public:
 
     // CCProxy implementation
     virtual bool compositeAndReadback(void *pixels, const IntRect&);
-    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double duration);
     virtual GraphicsContext3D* context();
     virtual void finishAllRendering();
     virtual bool isStarted() const;
     virtual bool initializeContext();
     virtual bool initializeLayerRenderer();
+    virtual bool recreateContext();
     virtual int compositorIdentifier() const;
     virtual const LayerRendererCapabilities& layerRendererCapabilities() const;
-    virtual void loseCompositorContext(int numTimes);
+    virtual void loseContext();
     virtual void setNeedsAnimate();
     virtual void setNeedsCommit();
     virtual void setNeedsRedraw();
@@ -68,10 +71,11 @@ public:
     virtual size_t maxPartialTextureUpdates() const;
 
     // CCLayerTreeHostImplClient implementation
+    virtual void didLoseContextOnImplThread();
     virtual void onSwapBuffersCompleteOnImplThread();
     virtual void setNeedsRedrawOnImplThread();
     virtual void setNeedsCommitOnImplThread();
-    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>);
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime);
 
     // CCSchedulerClient implementation
     virtual bool canDraw();
@@ -80,15 +84,19 @@ public:
     virtual void scheduledActionDrawAndSwap();
     virtual void scheduledActionUpdateMoreResources();
     virtual void scheduledActionCommit();
+    virtual void scheduledActionBeginContextRecreation();
 
 private:
     explicit CCThreadProxy(CCLayerTreeHost*);
+    friend class CCThreadProxyContextRecreationTimer;
 
     // Called on main thread
     void beginFrameAndCommit(int sequenceNumber, double frameBeginTime, PassOwnPtr<CCScrollAndScaleSet>);
     void didCommitAndDrawFrame();
     void didCompleteSwapBuffers();
-    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>);
+    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime);
+    void beginContextRecreation();
+    void tryToRecreateContext();
 
     // Called on impl thread
     struct ReadbackRequest {
@@ -109,10 +117,13 @@ private:
     void setVisibleOnImplThread(CCCompletionEvent*, bool visible);
     void layerTreeHostClosedOnImplThread(CCCompletionEvent*);
     void setFullRootLayerDamageOnImplThread();
+    void recreateContextOnImplThread(CCCompletionEvent*, GraphicsContext3D*, bool* recreateSucceeded, LayerRendererCapabilities*);
 
     // Accessed on main thread only.
     bool m_animateRequested;
     bool m_commitRequested;
+    bool m_contextLost;
+    OwnPtr<CCThreadProxyContextRecreationTimer> m_contextRecreationTimer;
     CCLayerTreeHost* m_layerTreeHost;
     int m_compositorIdentifier;
     bool m_layerRendererInitialized;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
index 47d0a708c..e8d2a6c45 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
@@ -52,14 +52,10 @@ public:
     Platform3DObject textureId() const { return m_textureId; }
     void setTextureId(Platform3DObject textureId) { m_textureId = textureId; }
 
-    const IntRect& opaqueRect() const { return m_opaqueRect; }
-    void setOpaqueRect(const IntRect& opaqueRect) { m_opaqueRect = opaqueRect; }
-
 private:
     DrawableTile() : m_textureId(0) { }
 
     Platform3DObject m_textureId;
-    IntRect m_opaqueRect;
 };
 
 CCTiledLayerImpl::CCTiledLayerImpl(int id)
@@ -203,6 +199,14 @@ void CCTiledLayerImpl::pushTileProperties(int i, int j, Platform3DObject texture
     tile->setOpaqueRect(opaqueRect);
 }
 
+Region CCTiledLayerImpl::opaqueContentsRegion() const
+{
+    if (m_skipsDraw)
+        return Region();
+
+    return m_tiler->opaqueRegionInLayerRect(visibleLayerRect());
+}
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
index 7ad71599b..84fe47621 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
@@ -37,9 +37,9 @@ class DrawableTile;
 
 class CCTiledLayerImpl : public CCLayerImpl {
 public:
-    static PassRefPtr<CCTiledLayerImpl> create(int id)
+    static PassOwnPtr<CCTiledLayerImpl> create(int id)
     {
-        return adoptRef(new CCTiledLayerImpl(id));
+        return adoptPtr(new CCTiledLayerImpl(id));
     }
     virtual ~CCTiledLayerImpl();
 
@@ -56,6 +56,8 @@ public:
     void setContentsSwizzled(bool contentsSwizzled) { m_contentsSwizzled = contentsSwizzled; }
     bool contentsSwizzled() const { return m_contentsSwizzled; }
 
+    virtual Region opaqueContentsRegion() const;
+
     typedef ProgramBinding<VertexShaderTile, FragmentShaderRGBATexAlpha> Program;
     // Shader program that swaps red and blue components of texture.
     // Used when texture format does not match native color format.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.cpp
new file mode 100644
index 000000000..decc00c8f
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCTimingFunction.h"
+
+#include <wtf/OwnPtr.h>
+
+namespace {
+const double epsilon = 1e-6;
+} // namespace
+
+namespace WebCore {
+
+CCTimingFunction::CCTimingFunction()
+{
+}
+
+CCTimingFunction::~CCTimingFunction()
+{
+}
+
+double CCTimingFunction::duration() const
+{
+    return 1.0;
+}
+
+PassOwnPtr<CCCubicBezierTimingFunction> CCCubicBezierTimingFunction::create(double x1, double y1, double x2, double y2)
+{
+    return adoptPtr(new CCCubicBezierTimingFunction(x1, y1, x2, y2));
+}
+
+CCCubicBezierTimingFunction::CCCubicBezierTimingFunction(double x1, double y1, double x2, double y2)
+    : m_curve(x1, y1, x2, y2)
+{
+}
+
+CCCubicBezierTimingFunction::~CCCubicBezierTimingFunction()
+{
+}
+
+float CCCubicBezierTimingFunction::getValue(double x) const
+{
+    UnitBezier temp(m_curve);
+    return static_cast<float>(temp.solve(x, epsilon));
+}
+
+PassOwnPtr<CCAnimationCurve> CCCubicBezierTimingFunction::clone() const
+{
+    return adoptPtr(new CCCubicBezierTimingFunction(*this));
+}
+
+// These numbers come from http://www.w3.org/TR/css3-transitions/#transition-timing-function_tag.
+PassOwnPtr<CCTimingFunction> CCEaseTimingFunction::create()
+{
+    return CCCubicBezierTimingFunction::create(0.25, 0.1, 0.25, 1);
+}
+
+PassOwnPtr<CCTimingFunction> CCEaseInTimingFunction::create()
+{
+    return CCCubicBezierTimingFunction::create(0.42, 0, 1.0, 1);
+}
+
+PassOwnPtr<CCTimingFunction> CCEaseOutTimingFunction::create()
+{
+    return CCCubicBezierTimingFunction::create(0, 0, 0.58, 1);
+}
+
+PassOwnPtr<CCTimingFunction> CCEaseInOutTimingFunction::create()
+{
+    return CCCubicBezierTimingFunction::create(0.42, 0, 0.58, 1);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.h b/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.h
new file mode 100644
index 000000000..77e5c43c5
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCTimingFunction_h
+#define CCTimingFunction_h
+
+#include "UnitBezier.h"
+#include "cc/CCAnimationCurve.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+// See http://www.w3.org/TR/css3-transitions/.
+class CCTimingFunction : public CCFloatAnimationCurve {
+public:
+    virtual ~CCTimingFunction();
+
+    // Partial implementation of CCFloatAnimationCurve.
+    virtual double duration() const;
+
+protected:
+    CCTimingFunction();
+};
+
+class CCCubicBezierTimingFunction : public CCTimingFunction {
+public:
+    static PassOwnPtr<CCCubicBezierTimingFunction> create(double x1, double y1, double x2, double y2);
+    virtual ~CCCubicBezierTimingFunction();
+
+    // Partial implementation of CCFloatAnimationCurve.
+    virtual float getValue(double time) const;
+    virtual PassOwnPtr<CCAnimationCurve> clone() const;
+
+protected:
+    CCCubicBezierTimingFunction(double x1, double y1, double x2, double y2);
+
+    UnitBezier m_curve;
+};
+
+class CCEaseTimingFunction {
+public:
+    static PassOwnPtr<CCTimingFunction> create();
+};
+
+class CCEaseInTimingFunction {
+public:
+    static PassOwnPtr<CCTimingFunction> create();
+};
+
+class CCEaseOutTimingFunction {
+public:
+    static PassOwnPtr<CCTimingFunction> create();
+};
+
+class CCEaseInOutTimingFunction {
+public:
+    static PassOwnPtr<CCTimingFunction> create();
+};
+
+} // namespace WebCore
+
+#endif // CCTimingFunction_h
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
index 35f269f50..fd53e41d3 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
@@ -34,6 +34,7 @@
 #include "LayerRendererChromium.h"
 #include "NotImplemented.h"
 #include "ProgramBinding.h"
+#include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCProxy.h"
 #include "cc/CCVideoDrawQuad.h"
 #include <wtf/text/WTFString.h>
@@ -89,7 +90,6 @@ CCVideoLayerImpl::~CCVideoLayerImpl()
     }
     for (unsigned i = 0; i < MaxPlanes; ++i)
         m_textures[i].m_texture.clear();
-    cleanupResources();
 }
 
 void CCVideoLayerImpl::stopUsingProvider()
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
index caa72dfb9..4c4e23102 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
@@ -43,9 +43,9 @@ template<class VertexShader, class FragmentShader> class ProgramBinding;
 class CCVideoLayerImpl : public CCLayerImpl
                        , public VideoFrameProvider::Client {
 public:
-    static PassRefPtr<CCVideoLayerImpl> create(int id, VideoFrameProvider* provider)
+    static PassOwnPtr<CCVideoLayerImpl> create(int id, VideoFrameProvider* provider)
     {
-        return adoptRef(new CCVideoLayerImpl(id, provider));
+        return adoptPtr(new CCVideoLayerImpl(id, provider));
     }
     virtual ~CCVideoLayerImpl();
 
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
new file mode 100644
index 000000000..e5601c8f8
--- /dev/null
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
@@ -0,0 +1,860 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(WEBGL) || USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsContext3DPrivate.h"
+
+#include "ImageData.h"
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, RenderStyle renderStyle)
+{
+    bool renderDirectlyToEvasGLObject = (renderStyle == RenderDirectlyToHostWindow);
+
+    OwnPtr<GraphicsContext3DPrivate> internal = GraphicsContext3DPrivate::create(attrs, hostWindow, renderDirectlyToEvasGLObject);
+    if (!internal)
+        return 0;
+
+    RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attrs, hostWindow, renderDirectlyToEvasGLObject));
+    context->m_private = internal.release();
+    return context.release();
+}
+
+GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, bool renderDirectlyToHostWindow)
+    : m_currentWidth(0)
+    , m_currentHeight(0)
+{
+}
+
+GraphicsContext3D::~GraphicsContext3D()
+{
+}
+
+PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D() const
+{
+    return m_private->platformGraphicsContext3D();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* GraphicsContext3D::platformLayer() const
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
+bool GraphicsContext3D::makeContextCurrent()
+{
+    return m_private->makeContextCurrent();
+}
+
+bool GraphicsContext3D::isGLES2Compliant() const
+{
+    return m_private->isGLES2Compliant();
+}
+
+void GraphicsContext3D::activeTexture(GC3Denum texture)
+{
+    m_private->activeTexture(texture);
+}
+
+void GraphicsContext3D::attachShader(Platform3DObject program, Platform3DObject shader)
+{
+    m_private->attachShader(program, shader);
+}
+
+void GraphicsContext3D::bindAttribLocation(Platform3DObject program, GC3Duint index, const String& name)
+{
+    m_private->bindAttribLocation(program, index, name);
+}
+
+void GraphicsContext3D::bindBuffer(GC3Denum target, Platform3DObject buffer)
+{
+    m_private->bindBuffer(target, buffer);
+}
+
+void GraphicsContext3D::bindFramebuffer(GC3Denum target, Platform3DObject buffer)
+{
+    m_private->bindFramebuffer(target, buffer);
+}
+
+void GraphicsContext3D::bindRenderbuffer(GC3Denum target, Platform3DObject renderbuffer)
+{
+    m_private->bindRenderbuffer(target, renderbuffer);
+}
+
+void GraphicsContext3D::bindTexture(GC3Denum target, Platform3DObject texture)
+{
+    m_private->bindTexture(target, texture);
+}
+
+void GraphicsContext3D::blendColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha)
+{
+    m_private->blendColor(red, green, blue, alpha);
+}
+
+void GraphicsContext3D::blendEquation(GC3Denum mode)
+{
+    m_private->blendEquation(mode);
+}
+
+void GraphicsContext3D::blendEquationSeparate(GC3Denum modeRGB, GC3Denum modeAlpha)
+{
+    m_private->blendEquationSeparate(modeRGB, modeAlpha);
+}
+
+void GraphicsContext3D::blendFunc(GC3Denum srcFactor, GC3Denum dstFactor)
+{
+    m_private->blendFunc(srcFactor, dstFactor);
+}
+
+void GraphicsContext3D::blendFuncSeparate(GC3Denum srcRGB, GC3Denum dstRGB, GC3Denum srcAlpha, GC3Denum dstAlpha)
+{
+    m_private->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+}
+
+void GraphicsContext3D::bufferData(GC3Denum target, GC3Dsizeiptr size, GC3Denum usage)
+{
+    m_private->bufferData(target, size, 0, usage);
+}
+
+void GraphicsContext3D::bufferData(GC3Denum target, GC3Dsizeiptr size, const void* data, GC3Denum usage)
+{
+    m_private->bufferData(target, size, data, usage);
+}
+
+void GraphicsContext3D::bufferSubData(GC3Denum target, GC3Dintptr offset, GC3Dsizeiptr size, const void* data)
+{
+    m_private->bufferSubData(target, offset, size, data);
+}
+
+GC3Denum GraphicsContext3D::checkFramebufferStatus(GC3Denum target)
+{
+    return m_private->checkFramebufferStatus(target);
+}
+
+void GraphicsContext3D::clear(GC3Dbitfield mask)
+{
+    m_private->clear(mask);
+}
+
+void GraphicsContext3D::clearColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha)
+{
+    m_private->clearColor(red, green, blue, alpha);
+}
+
+void GraphicsContext3D::clearDepth(GC3Dclampf depth)
+{
+    m_private->clearDepth(depth);
+}
+
+void GraphicsContext3D::clearStencil(GC3Dint clearValue)
+{
+    m_private->clearStencil(clearValue);
+}
+
+void GraphicsContext3D::colorMask(GC3Dboolean red, GC3Dboolean green, GC3Dboolean blue, GC3Dboolean alpha)
+{
+    m_private->colorMask(red, green, blue, alpha);
+}
+
+void GraphicsContext3D::compileShader(Platform3DObject shader)
+{
+    m_private->compileShader(shader);
+}
+
+void GraphicsContext3D::copyTexImage2D(GC3Denum target, GC3Dint level, GC3Denum internalformat, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Dint border)
+{
+    m_private->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+}
+
+void GraphicsContext3D::copyTexSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    m_private->copyTexSubImage2D(target, level, xOffset, yOffset, x, y, width, height);
+}
+
+void GraphicsContext3D::cullFace(GC3Denum mode)
+{
+    m_private->cullFace(mode);
+}
+
+void GraphicsContext3D::depthFunc(GC3Denum func)
+{
+    m_private->depthFunc(func);
+}
+
+void GraphicsContext3D::depthMask(GC3Dboolean flag)
+{
+    m_private->depthMask(flag);
+}
+
+void GraphicsContext3D::depthRange(GC3Dclampf zNear, GC3Dclampf zFar)
+{
+    m_private->depthRange(zNear, zFar);
+}
+
+void GraphicsContext3D::detachShader(Platform3DObject program, Platform3DObject shader)
+{
+    m_private->detachShader(program, shader);
+}
+
+void GraphicsContext3D::disable(GC3Denum cap)
+{
+    m_private->disable(cap);
+}
+
+void GraphicsContext3D::disableVertexAttribArray(GC3Duint index)
+{
+    m_private->disableVertexAttribArray(index);
+}
+
+void GraphicsContext3D::drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei count)
+{
+    m_private->drawArrays(mode, first, count);
+}
+
+void GraphicsContext3D::drawElements(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset)
+{
+    m_private->drawElements(mode, count, type, offset);
+}
+
+void GraphicsContext3D::enable(GC3Denum cap)
+{
+    m_private->enable(cap);
+}
+
+void GraphicsContext3D::enableVertexAttribArray(GC3Duint index)
+{
+    m_private->enableVertexAttribArray(index);
+}
+
+void GraphicsContext3D::finish()
+{
+    m_private->finish();
+}
+
+void GraphicsContext3D::flush()
+{
+    m_private->flush();
+}
+
+void GraphicsContext3D::framebufferRenderbuffer(GC3Denum target, GC3Denum attachment, GC3Denum renderbufferTarget, Platform3DObject buffer)
+{
+    m_private->framebufferRenderbuffer(target, attachment, renderbufferTarget, buffer);
+}
+
+void GraphicsContext3D::framebufferTexture2D(GC3Denum target, GC3Denum attachment, GC3Denum texTarget, Platform3DObject texture, GC3Dint level)
+{
+    m_private->framebufferTexture2D(target, attachment, texTarget, texture, level);
+}
+
+void GraphicsContext3D::frontFace(GC3Denum mode)
+{
+    m_private->frontFace(mode);
+}
+
+void GraphicsContext3D::generateMipmap(GC3Denum target)
+{
+    m_private->generateMipmap(target);
+}
+
+bool GraphicsContext3D::getActiveAttrib(Platform3DObject program, GC3Duint index, ActiveInfo& info)
+{
+    return m_private->getActiveAttrib(program, index, info);
+}
+
+bool GraphicsContext3D::getActiveUniform(Platform3DObject program, GC3Duint index, ActiveInfo& info)
+{
+    return m_private->getActiveUniform(program, index, info);
+}
+
+void GraphicsContext3D::getAttachedShaders(Platform3DObject program, GC3Dsizei maxCount, GC3Dsizei* count, Platform3DObject* shaders)
+{
+    m_private->getAttachedShaders(program, maxCount, count, shaders);
+}
+
+int GraphicsContext3D::getAttribLocation(Platform3DObject program, const String& name)
+{
+    return m_private->getAttribLocation(program, name);
+}
+
+void GraphicsContext3D::getBooleanv(GC3Denum paramName, GC3Dboolean* value)
+{
+    m_private->getBooleanv(paramName, value);
+}
+
+void GraphicsContext3D::getBufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getBufferParameteriv(target, paramName, value);
+}
+
+GraphicsContext3D::Attributes GraphicsContext3D::getContextAttributes()
+{
+    return m_private->getContextAttributes();
+}
+
+GC3Denum GraphicsContext3D::getError()
+{
+    return m_private->getError();
+}
+
+void GraphicsContext3D::getFloatv(GC3Denum paramName, GC3Dfloat* value)
+{
+    m_private->getFloatv(paramName, value);
+}
+
+void GraphicsContext3D::getFramebufferAttachmentParameteriv(GC3Denum target, GC3Denum attachment, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getFramebufferAttachmentParameteriv(target, attachment, paramName, value);
+}
+
+void GraphicsContext3D::getIntegerv(GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getIntegerv(paramName, value);
+}
+
+void GraphicsContext3D::getProgramiv(Platform3DObject program, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getProgramiv(program, paramName, value);
+}
+
+String GraphicsContext3D::getProgramInfoLog(Platform3DObject program)
+{
+    return m_private->getProgramInfoLog(program);
+}
+
+void GraphicsContext3D::getRenderbufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getRenderbufferParameteriv(target, paramName, value);
+}
+
+void GraphicsContext3D::getShaderiv(Platform3DObject shader, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getShaderiv(shader, paramName, value);
+}
+
+String GraphicsContext3D::getShaderInfoLog(Platform3DObject shader)
+{
+    return m_private->getShaderInfoLog(shader);
+}
+
+String GraphicsContext3D::getShaderSource(Platform3DObject shader)
+{
+    return m_private->getShaderSource(shader);
+}
+
+String GraphicsContext3D::getString(GC3Denum name)
+{
+    return m_private->getString(name);
+}
+
+void GraphicsContext3D::getTexParameterfv(GC3Denum target, GC3Denum paramName, GC3Dfloat* value)
+{
+    m_private->getTexParameterfv(target, paramName, value);
+}
+
+void GraphicsContext3D::getTexParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getTexParameteriv(target, paramName, value);
+}
+
+void GraphicsContext3D::getUniformfv(Platform3DObject program, GC3Dint location, GC3Dfloat* value)
+{
+    m_private->getUniformfv(program, location, value);
+}
+
+void GraphicsContext3D::getUniformiv(Platform3DObject program, GC3Dint location, GC3Dint* value)
+{
+    m_private->getUniformiv(program, location, value);
+}
+
+GC3Dint GraphicsContext3D::getUniformLocation(Platform3DObject program, const String& name)
+{
+    return m_private->getUniformLocation(program, name);
+}
+
+void GraphicsContext3D::getVertexAttribfv(GC3Duint index, GC3Denum paramName, GC3Dfloat* value)
+{
+    m_private->getVertexAttribfv(index, paramName, value);
+}
+
+void GraphicsContext3D::getVertexAttribiv(GC3Duint index, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getVertexAttribiv(index, paramName, value);
+}
+
+long GraphicsContext3D::getVertexAttribOffset(GC3Duint index, GC3Denum paramName)
+{
+    return m_private->getVertexAttribOffset(index, paramName);
+}
+
+void GraphicsContext3D::hint(GC3Denum target, GC3Denum mode)
+{
+    m_private->hint(target, mode);
+}
+
+GC3Dboolean GraphicsContext3D::isBuffer(Platform3DObject obj)
+{
+    return m_private->isBuffer(obj);
+}
+
+GC3Dboolean GraphicsContext3D::isEnabled(GC3Denum cap)
+{
+    return m_private->isEnabled(cap);
+}
+
+GC3Dboolean GraphicsContext3D::isFramebuffer(Platform3DObject obj)
+{
+    return m_private->isFramebuffer(obj);
+}
+
+GC3Dboolean GraphicsContext3D::isProgram(Platform3DObject obj)
+{
+    return m_private->isProgram(obj);
+}
+
+GC3Dboolean GraphicsContext3D::isRenderbuffer(Platform3DObject obj)
+{
+    return m_private->isRenderbuffer(obj);
+}
+
+GC3Dboolean GraphicsContext3D::isShader(Platform3DObject obj)
+{
+    return m_private->isShader(obj);
+}
+
+GC3Dboolean GraphicsContext3D::isTexture(Platform3DObject obj)
+{
+    return m_private->isTexture(obj);
+}
+
+void GraphicsContext3D::lineWidth(GC3Dfloat width)
+{
+    m_private->lineWidth(width);
+}
+
+void GraphicsContext3D::linkProgram(Platform3DObject program)
+{
+    m_private->linkProgram(program);
+}
+
+void GraphicsContext3D::pixelStorei(GC3Denum paramName, GC3Dint param)
+{
+    m_private->pixelStorei(paramName, param);
+}
+
+void GraphicsContext3D::polygonOffset(GC3Dfloat factor, GC3Dfloat units)
+{
+    m_private->polygonOffset(factor, units);
+}
+
+void GraphicsContext3D::readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, void* data)
+{
+    m_private->readPixels(x, y, width, height, format, type, data);
+}
+
+void GraphicsContext3D::releaseShaderCompiler()
+{
+    notImplemented();
+}
+
+void GraphicsContext3D::renderbufferStorage(GC3Denum target, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height)
+{
+    m_private->renderbufferStorage(target, internalformat, width, height);
+}
+
+void GraphicsContext3D::sampleCoverage(GC3Dclampf value, GC3Dboolean invert)
+{
+    m_private->sampleCoverage(value, invert);
+}
+
+void GraphicsContext3D::scissor(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    m_private->scissor(x, y, width, height);
+}
+
+void GraphicsContext3D::shaderSource(Platform3DObject program, const String& string)
+{
+    m_private->shaderSource(program, string);
+}
+
+void GraphicsContext3D::stencilFunc(GC3Denum func, GC3Dint ref, GC3Duint mask)
+{
+    m_private->stencilFunc(func, ref, mask);
+}
+
+void GraphicsContext3D::stencilFuncSeparate(GC3Denum face, GC3Denum func, GC3Dint ref, GC3Duint mask)
+{
+    m_private->stencilFuncSeparate(face, func, ref, mask);
+}
+
+void GraphicsContext3D::stencilMask(GC3Duint mask)
+{
+    m_private->stencilMask(mask);
+}
+
+void GraphicsContext3D::stencilMaskSeparate(GC3Denum face, GC3Duint mask)
+{
+    m_private->stencilMaskSeparate(face, mask);
+}
+
+void GraphicsContext3D::stencilOp(GC3Denum fail, GC3Denum zfail, GC3Denum zpass)
+{
+    m_private->stencilOp(fail, zfail, zpass);
+}
+
+void GraphicsContext3D::stencilOpSeparate(GC3Denum face, GC3Denum fail, GC3Denum zfail, GC3Denum zpass)
+{
+    m_private->stencilOpSeparate(face, fail, zfail, zpass);
+}
+
+bool GraphicsContext3D::texImage2D(GC3Denum target, GC3Dint level, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height, GC3Dint border, GC3Denum format, GC3Denum type, const void* pixels)
+{
+    return m_private->texImage2D(target, level, internalformat, width, height, border, format, type, pixels);
+}
+
+void GraphicsContext3D::texParameterf(GC3Denum target, GC3Denum paramName, GC3Dfloat param)
+{
+    m_private->texParameterf(target, paramName, param);
+}
+
+void GraphicsContext3D::texParameteri(GC3Denum target, GC3Denum paramName, GC3Dint param)
+{
+    m_private->texParameteri(target, paramName, param);
+}
+
+void GraphicsContext3D::texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, const void* pixels)
+{
+    m_private->texSubImage2D(target, level, xOffset, yOffset, width, height, format, type, pixels);
+}
+
+void GraphicsContext3D::uniform1f(GC3Dint location, GC3Dfloat x)
+{
+    m_private->uniform1f(location, x);
+}
+
+void GraphicsContext3D::uniform1fv(GC3Dint location, GGC3Dsizei size, C3Dfloat* v)
+{
+    m_private->uniform1fv(location, size, v);
+}
+
+void GraphicsContext3D::uniform1i(GC3Dint location, GC3Dint x)
+{
+    m_private->uniform1i(location, x);
+}
+
+void GraphicsContext3D::uniform1iv(GC3Dint location, GGC3Dsizei size, C3Dint* v)
+{
+    m_private->uniform1iv(location, size, v);
+}
+
+void GraphicsContext3D::uniform2f(GC3Dint location, GC3Dfloat x, float y)
+{
+    m_private->uniform2f(location, x, y);
+}
+
+void GraphicsContext3D::uniform2fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
+{
+    m_private->uniform2fv(location, size, v);
+}
+
+void GraphicsContext3D::uniform2i(GC3Dint location, GC3Dint x, GC3Dint y)
+{
+    m_private->uniform2i(location, x, y);
+}
+
+void GraphicsContext3D::uniform2iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
+{
+    m_private->uniform2iv(location, size, v);
+}
+
+void GraphicsContext3D::uniform3f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z)
+{
+    m_private->uniform3f(location, x, y, z);
+}
+
+void GraphicsContext3D::uniform3fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
+{
+    m_private->uniform3fv(location, size, v);
+}
+
+void GraphicsContext3D::uniform3i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z)
+{
+    m_private->uniform3i(location, x, y, z);
+}
+
+void GraphicsContext3D::uniform3iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
+{
+    m_private->uniform3iv(location, size, v);
+}
+
+void GraphicsContext3D::uniform4f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w)
+{
+    m_private->uniform4f(location, x, y, z, w);
+}
+
+void GraphicsContext3D::uniform4fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
+{
+    m_private->uniform4fv(location, size, v);
+}
+
+void GraphicsContext3D::uniform4i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z, GC3Dint w)
+{
+    m_private->uniform4i(location, x, y, z, w);
+}
+
+void GraphicsContext3D::uniform4iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
+{
+    m_private->uniform4iv(location, size, v);
+}
+
+void GraphicsContext3D::uniformMatrix2fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    m_private->uniformMatrix2fv(location, size, transpose, value);
+}
+
+void GraphicsContext3D::uniformMatrix3fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    m_private->uniformMatrix3fv(location, size, transpose, value);
+}
+
+void GraphicsContext3D::uniformMatrix4fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    m_private->uniformMatrix4fv(location, size, transpose, value);
+}
+
+void GraphicsContext3D::useProgram(Platform3DObject program)
+{
+    m_private->useProgram(program);
+}
+
+void GraphicsContext3D::validateProgram(Platform3DObject program)
+{
+    m_private->validateProgram(program);
+}
+
+void GraphicsContext3D::vertexAttrib1f(GC3Duint index, GC3Dfloat x)
+{
+    m_private->vertexAttrib1f(index, x);
+}
+
+void GraphicsContext3D::vertexAttrib1fv(GC3Duint index, GC3Dfloat* values)
+{
+    m_private->vertexAttrib1fv(index, values);
+}
+
+void GraphicsContext3D::vertexAttrib2f(GC3Duint index, GC3Dfloat x, GC3Dfloat y)
+{
+    m_private->vertexAttrib2f(index, x, y);
+}
+
+void GraphicsContext3D::vertexAttrib2fv(GC3Duint index, GC3Dfloat* values)
+{
+    m_private->vertexAttrib2fv(index, values);
+}
+
+void GraphicsContext3D::vertexAttrib3f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z)
+{
+    m_private->vertexAttrib3f(index, x, y, z);
+}
+
+void GraphicsContext3D::vertexAttrib3fv(GC3Duint index, GC3Dfloat* values)
+{
+    m_private->vertexAttrib3fv(index, values);
+}
+
+void GraphicsContext3D::vertexAttrib4f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w)
+{
+    m_private->vertexAttrib4f(index, x, y, z, w);
+}
+
+void GraphicsContext3D::vertexAttrib4fv(GC3Duint index, GC3Dfloat* values)
+{
+    m_private->vertexAttrib4fv(index, values);
+}
+
+void GraphicsContext3D::vertexAttribPointer(GC3Duint index, GC3Dint size, GC3Denum type, GC3Dboolean normalized, GC3Dsizei stride, GC3Dintptr offset)
+{
+    m_private->vertexAttribPointer(index, size, type, normalized, stride, offset);
+}
+
+void GraphicsContext3D::viewport(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    m_private->viewport(x, y, width, height);
+}
+
+void GraphicsContext3D::reshape(int width, int height)
+{
+    notImplemented();
+}
+
+void GraphicsContext3D::markContextChanged()
+{
+    notImplemented();
+}
+
+void GraphicsContext3D::markLayerComposited()
+{
+    notImplemented();
+}
+
+bool GraphicsContext3D::layerComposited() const
+{
+    notImplemented();
+    return false;
+}
+
+void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context, DrawingBuffer* drawingBuffer)
+{
+    notImplemented();
+}
+
+PassRefPtr<ImageData> GraphicsContext3D::paintRenderingResultsToImageData(DrawingBuffer* drawingBuffer)
+{
+    notImplemented();
+    return 0;
+}
+
+bool GraphicsContext3D::paintCompositedResultsToCanvas(CanvasRenderingContext*)
+{
+    return false;
+}
+
+Platform3DObject GraphicsContext3D::createBuffer()
+{
+    return m_private->createBuffer();
+}
+
+Platform3DObject GraphicsContext3D::createFramebuffer()
+{
+    return m_private->createFramebuffer();
+}
+
+Platform3DObject GraphicsContext3D::createProgram()
+{
+    return m_private->createProgram();
+}
+
+Platform3DObject GraphicsContext3D::createRenderbuffer()
+{
+    return m_private->createRenderbuffer();
+}
+
+Platform3DObject GraphicsContext3D::createShader(GC3Denum type)
+{
+    return m_private->createShader(type);
+}
+
+Platform3DObject GraphicsContext3D::createTexture()
+{
+    return m_private->createTexture();
+}
+
+void GraphicsContext3D::deleteBuffer(Platform3DObject buffer)
+{
+    m_private->deleteBuffer(buffer);
+}
+
+void GraphicsContext3D::deleteFramebuffer(Platform3DObject buffer)
+{
+    m_private->deleteFramebuffer(buffer);
+}
+
+void GraphicsContext3D::deleteProgram(Platform3DObject program)
+{
+    m_private->deleteProgram(program);
+}
+
+void GraphicsContext3D::deleteRenderbuffer(Platform3DObject buffer)
+{
+    m_private->deleteRenderbuffer(buffer);
+}
+
+void GraphicsContext3D::deleteShader(Platform3DObject shader)
+{
+    m_private->deleteShader(shader);
+}
+
+void GraphicsContext3D::deleteTexture(Platform3DObject texture)
+{
+    m_private->deleteTexture(texture);
+}
+
+void GraphicsContext3D::synthesizeGLError(GC3Denum error)
+{
+    m_private->synthesizeGLError(error);
+}
+
+Extensions3D* GraphicsContext3D::getExtensions()
+{
+    return m_private->getExtensions();
+}
+
+IntSize GraphicsContext3D::getInternalFramebufferSize() const
+{
+    notImplemented();
+    return IntSize();
+}
+
+void GraphicsContext3D::setContextLostCallback(PassOwnPtr<ContextLostCallback>)
+{
+    notImplemented();
+}
+
+bool GraphicsContext3D::getImageData(Image* image, GC3Denum format, GC3Denum type, bool premultiplyAlpha,
+                                     bool ignoreGammaAndColorProfile, Vector<uint8_t>& outputVector)
+{
+    notImplemented();
+    return false;
+}
+
+void GraphicsContext3D::validateAttributes()
+{
+    notImplemented();
+}
+
+void GraphicsContext3D::readRenderingResults(unsigned char* pixels, int pixelsSize)
+{
+    notImplemented();
+}
+
+bool GraphicsContext3D::reshapeFBOs(const IntSize&)
+{
+    notImplemented();
+}
+
+void GraphicsContext3D::resolveMultisamplingIfNecessary(const IntRect&)
+{
+    notImplemented();
+}
+
+bool GraphicsContext3D::isResourceSafe()
+{
+    notImplemented();
+    return false;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp
new file mode 100644
index 000000000..08153f004
--- /dev/null
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp
@@ -0,0 +1,1124 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(WEBGL) || USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsContext3DPrivate.h"
+
+#include "HostWindow.h"
+#include "NotImplemented.h"
+#include "PageClientEfl.h"
+
+#include <wtf/OwnArrayPtr.h>
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+PassOwnPtr<GraphicsContext3DPrivate> GraphicsContext3DPrivate::create(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, bool renderDirectlyToHostWindow)
+{
+    OwnPtr<GraphicsContext3DPrivate> internal = adoptPtr(new GraphicsContext3DPrivate());
+
+    if (!internal->initialize(attributes, hostWindow, renderDirectlyToHostWindow))
+        return nullptr;
+
+    return internal.release();
+}
+
+GraphicsContext3DPrivate::GraphicsContext3DPrivate()
+    : m_boundFBO(0)
+    , m_boundTexture(0)
+    , m_boundArrayBuffer(0)
+    , m_evasGL(0)
+    , m_context(0)
+    , m_surface(0)
+    , m_api(0)
+{
+}
+
+GraphicsContext3DPrivate::~GraphicsContext3DPrivate()
+{
+    if (!m_evasGL)
+        return;
+
+    if (m_surface)
+        evas_gl_surface_destroy(m_evasGL, m_surface);
+
+    if (m_context)
+        evas_gl_context_destroy(m_evasGL, m_context);
+
+    evas_gl_free(m_evasGL);
+}
+
+bool GraphicsContext3DPrivate::initialize(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, bool renderDirectlyToHostWindow)
+{
+    PageClientEfl* pageClient = static_cast<PageClientEfl*>(hostWindow->platformPageClient());
+
+    Evas* evas = evas_object_evas_get(pageClient->view());
+
+    // Create a new Evas_GL object for gl rendering on efl.
+    m_evasGL = evas_gl_new(evas);
+    if (!m_evasGL)
+        return false;
+
+    // Get the API for rendering using OpenGL.
+    // This returns a structure that contains all the OpenGL functions we can use to render in Evas
+    m_api = evas_gl_api_get(m_evasGL);
+    if (!m_api)
+        return false;
+
+    Evas_GL_Context* shareContext = 0;
+
+#if USE(ACCELERATED_COMPOSITING)
+    // GC3D with RenderOffscreen style for WebGL has to be shared with AC's context when AC is enabled.
+    if (!renderDirectlyToHostWindow) {
+        GraphicsContext3D* context = pageClient->acceleratedCompositingContext();
+        if (context)
+            shareContext = static_cast<Evas_GL_Context*>(context->platformGraphicsContext3D());
+    }
+#endif
+
+    // Create a context
+    m_context = evas_gl_context_create(m_evasGL, shareContext);
+    if (!m_context)
+        return false;
+
+    // Create a surface
+    if (!createSurface(pageClient, renderDirectlyToHostWindow))
+        return false;
+
+    return makeContextCurrent();
+}
+
+bool GraphicsContext3DPrivate::createSurface(PageClientEfl* pageClient, bool renderDirectlyToHostWindow)
+{
+    // If RenderStyle is RenderOffscreen, we will be rendering to a FBO,
+    // so Evas_GL_Surface has a 1x1 dummy surface.
+    int x = 0;
+    int y = 0;
+    int width = 1;
+    int height = 1;
+
+    // But, in case of RenderDirectlyToHostWindow, we have to render to a render target surface with the same size as our webView.
+    if (renderDirectlyToHostWindow)
+        evas_object_geometry_get(pageClient->view(), &x, &y, &width, &height);
+
+    Evas_GL_Config config = {
+        EVAS_GL_RGBA_8888,
+        EVAS_GL_DEPTH_BIT_8,
+        EVAS_GL_STENCIL_NONE, // FIXME: set EVAS_GL_STENCIL_BIT_8 after fixing Evas_GL bug.
+        EVAS_GL_OPTIONS_NONE
+    };
+
+    // Create a new Evas_GL_Surface object
+    m_surface = evas_gl_surface_create(m_evasGL, &config, width, height);
+    if (!m_surface)
+        return false;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (renderDirectlyToHostWindow) {
+        Evas_Native_Surface nativeSurface;
+        // Fill in the Native Surface information from the given Evas GL surface.
+        evas_gl_native_surface_get(m_evasGL, m_surface, &nativeSurface);
+
+        // Create and specially set up a evas_object which act as the render targer surface.
+        if (!pageClient->createEvasObjectForAcceleratedCompositing(&nativeSurface, x, y, width, height))
+            return false;
+    }
+#endif
+    return true;
+}
+
+PlatformGraphicsContext3D GraphicsContext3DPrivate::platformGraphicsContext3D() const
+{
+    return m_context;
+}
+
+bool GraphicsContext3DPrivate::makeContextCurrent()
+{
+    return evas_gl_make_current(m_evasGL, m_surface, m_context);
+}
+
+bool GraphicsContext3DPrivate::isGLES2Compliant() const
+{
+    return true;
+}
+
+void GraphicsContext3DPrivate::activeTexture(GC3Denum texture)
+{
+    makeContextCurrent();
+    m_api->glActiveTexture(texture);
+}
+
+void GraphicsContext3DPrivate::attachShader(Platform3DObject program, Platform3DObject shader)
+{
+    makeContextCurrent();
+    m_api->glAttachShader(program, shader);
+}
+
+void GraphicsContext3DPrivate::bindAttribLocation(Platform3DObject program, GC3Duint index, const String& name)
+{
+    makeContextCurrent();
+    m_api->glBindAttribLocation(program, index, name.utf8().data());
+}
+
+void GraphicsContext3DPrivate::bindBuffer(GC3Denum target, Platform3DObject buffer)
+{
+    makeContextCurrent();
+    m_api->glBindBuffer(target, buffer);
+
+    if (target == GL_ARRAY_BUFFER)
+        m_boundArrayBuffer = buffer;
+}
+
+void GraphicsContext3DPrivate::bindFramebuffer(GC3Denum target, Platform3DObject framebuffer)
+{
+    makeContextCurrent();
+
+    if (framebuffer != m_boundFBO) {
+        m_api->glBindFramebuffer(target, framebuffer);
+        m_boundFBO = framebuffer;
+    }
+}
+
+void GraphicsContext3DPrivate::bindRenderbuffer(GC3Denum target, Platform3DObject buffer)
+{
+    makeContextCurrent();
+    m_api->glBindRenderbuffer(target, buffer);
+}
+
+void GraphicsContext3DPrivate::bindTexture(GC3Denum target, Platform3DObject texture)
+{
+    makeContextCurrent();
+    m_api->glBindTexture(target, texture);
+    m_boundTexture = texture;
+}
+
+void GraphicsContext3DPrivate::blendColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha)
+{
+    makeContextCurrent();
+    m_api->glBlendColor(red, green, blue, alpha);
+}
+
+void GraphicsContext3DPrivate::blendEquation(GC3Denum mode)
+{
+    makeContextCurrent();
+    m_api->glBlendEquation(mode);
+}
+
+void GraphicsContext3DPrivate::blendEquationSeparate(GC3Denum modeRGB, GC3Denum modeAlpha)
+{
+    makeContextCurrent();
+    m_api->glBlendEquationSeparate(modeRGB, modeAlpha);
+}
+
+void GraphicsContext3DPrivate::blendFunc(GC3Denum srcFactor, GC3Denum dstFactor)
+{
+    makeContextCurrent();
+    m_api->glBlendFunc(srcFactor, dstFactor);
+}
+
+void GraphicsContext3DPrivate::blendFuncSeparate(GC3Denum srcRGB, GC3Denum dstRGB, GC3Denum srcAlpha, GC3Denum dstAlpha)
+{
+    makeContextCurrent();
+    m_api->glBlendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+}
+
+void GraphicsContext3DPrivate::bufferData(GC3Denum target, GC3Dsizeiptr size, const void* data, GC3Denum usage)
+{
+    makeContextCurrent();
+    m_api->glBufferData(target, size, data, usage);
+}
+
+void GraphicsContext3DPrivate::bufferSubData(GC3Denum target, GC3Dintptr offset, GC3Dsizeiptr size, const void* data)
+{
+    makeContextCurrent();
+    m_api->glBufferSubData(target, offset, size, data);
+}
+
+GC3Denum GraphicsContext3DPrivate::checkFramebufferStatus(GC3Denum target)
+{
+    makeContextCurrent();
+    return m_api->glCheckFramebufferStatus(target);
+}
+
+void GraphicsContext3DPrivate::clear(GC3Dbitfield mask)
+{
+    makeContextCurrent();
+    m_api->glClear(mask);
+}
+
+void GraphicsContext3DPrivate::clearColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha)
+{
+    makeContextCurrent();
+    m_api->glClearColor(red, green, blue, alpha);
+}
+
+void GraphicsContext3DPrivate::clearDepth(GC3Dclampf depth)
+{
+    makeContextCurrent();
+    m_api->glClearDepthf(depth);
+}
+
+void GraphicsContext3DPrivate::clearStencil(GC3Dint clearValue)
+{
+    makeContextCurrent();
+    m_api->glClearStencil(clearValue);
+}
+
+void GraphicsContext3DPrivate::colorMask(GC3Dboolean red, GC3Dboolean green, GC3Dboolean blue, GC3Dboolean alpha)
+{
+    makeContextCurrent();
+    m_api->glColorMask(red, green, blue, alpha);
+}
+
+void GraphicsContext3DPrivate::compileShader(Platform3DObject shader)
+{
+    makeContextCurrent();
+    m_api->glCompileShader(shader);
+}
+
+void GraphicsContext3DPrivate::copyTexImage2D(GC3Denum target, GC3Dint level, GC3Denum internalFormat, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Dint border)
+{
+    makeContextCurrent();
+    m_api->glCopyTexImage2D(target, level, internalFormat, x, y, width, height, border);
+}
+
+void GraphicsContext3DPrivate::copyTexSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    makeContextCurrent();
+    m_api->glCopyTexSubImage2D(target, level, xOffset, yOffset, x, y, width, height);
+}
+
+void GraphicsContext3DPrivate::cullFace(GC3Denum mode)
+{
+    makeContextCurrent();
+    m_api->glCullFace(mode);
+}
+
+void GraphicsContext3DPrivate::depthFunc(GC3Denum func)
+{
+    makeContextCurrent();
+    m_api->glDepthFunc(func);
+}
+
+void GraphicsContext3DPrivate::depthMask(GC3Dboolean flag)
+{
+    makeContextCurrent();
+    m_api->glDepthMask(flag);
+}
+
+void GraphicsContext3DPrivate::depthRange(GC3Dclampf zNear, GC3Dclampf zFar)
+{
+    makeContextCurrent();
+    m_api->glDepthRangef(zNear, zFar);
+}
+
+void GraphicsContext3DPrivate::detachShader(Platform3DObject program, Platform3DObject shader)
+{
+    makeContextCurrent();
+    m_api->glDetachShader(program, shader);
+}
+
+void GraphicsContext3DPrivate::disable(GC3Denum cap)
+{
+    makeContextCurrent();
+    m_api->glDisable(cap);
+}
+
+void GraphicsContext3DPrivate::disableVertexAttribArray(GC3Duint index)
+{
+    makeContextCurrent();
+    m_api->glDisableVertexAttribArray(index);
+}
+
+void GraphicsContext3DPrivate::drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei count)
+{
+    makeContextCurrent();
+    m_api->glDrawArrays(mode, first, count);
+}
+
+void GraphicsContext3DPrivate::drawElements(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset)
+{
+    makeContextCurrent();
+    m_api->glDrawElements(mode, count, type, reinterpret_cast<GLvoid*>(static_cast<intptr_t>(offset)));
+}
+
+void GraphicsContext3DPrivate::enable(GC3Denum cap)
+{
+    makeContextCurrent();
+    m_api->glEnable(cap);
+}
+
+void GraphicsContext3DPrivate::enableVertexAttribArray(GC3Duint index)
+{
+    makeContextCurrent();
+    m_api->glEnableVertexAttribArray(index);
+}
+
+void GraphicsContext3DPrivate::finish()
+{
+    makeContextCurrent();
+    m_api->glFinish();
+}
+
+void GraphicsContext3DPrivate::flush()
+{
+    makeContextCurrent();
+    m_api->glFlush();
+}
+
+void GraphicsContext3DPrivate::framebufferRenderbuffer(GC3Denum target, GC3Denum attachment, GC3Denum renderbufferTarget, Platform3DObject renderbuffer)
+{
+    makeContextCurrent();
+    m_api->glFramebufferRenderbuffer(target, attachment, renderbufferTarget, renderbuffer);
+}
+
+void GraphicsContext3DPrivate::framebufferTexture2D(GC3Denum target, GC3Denum attachment, GC3Denum texTarget, Platform3DObject texture, GC3Dint level)
+{
+    makeContextCurrent();
+    m_api->glFramebufferTexture2D(target, attachment, texTarget, texture, level);
+}
+
+void GraphicsContext3DPrivate::frontFace(GC3Denum mode)
+{
+    makeContextCurrent();
+    m_api->glFrontFace(mode);
+}
+
+void GraphicsContext3DPrivate::generateMipmap(GC3Denum target)
+{
+    makeContextCurrent();
+    m_api->glGenerateMipmap(target);
+}
+
+bool GraphicsContext3DPrivate::getActiveAttrib(Platform3DObject program, GC3Duint index, ActiveInfo& info)
+{
+    if (!program) {
+        synthesizeGLError(GL_INVALID_VALUE);
+        return false;
+    }
+
+    makeContextCurrent();
+
+    GLint maxNameLength = 0;
+    m_api->glGetProgramiv(program, GL_ACTIVE_ATTRIBUTE_MAX_LENGTH, &maxNameLength);
+    if (!maxNameLength)
+        return false;
+
+    OwnArrayPtr<char> name = adoptArrayPtr(new char[maxNameLength]);
+    if (!name) {
+        synthesizeGLError(GL_OUT_OF_MEMORY);
+        return false;
+    }
+
+    GLsizei length = 0;
+    GLint size = 0;
+    GLenum type = 0;
+    m_api->glGetActiveAttrib(program, index, maxNameLength, &length, &size, &type, name.get());
+    if (!length)
+        return false;
+
+    info.name = String::fromUTF8(name.get(), length);
+    info.type = type;
+    info.size = size;
+    return true;
+}
+
+bool GraphicsContext3DPrivate::getActiveUniform(Platform3DObject program, GC3Duint index, ActiveInfo& info)
+{
+    if (!program) {
+        synthesizeGLError(GL_INVALID_VALUE);
+        return false;
+    }
+
+    makeContextCurrent();
+
+    GLint maxNameLength = 0;
+    m_api->glGetProgramiv(program, GL_ACTIVE_UNIFORM_MAX_LENGTH, &maxNameLength);
+    if (!maxNameLength)
+        return false;
+
+    OwnArrayPtr<char> name = adoptArrayPtr(new char[maxNameLength]);
+    if (!name) {
+        synthesizeGLError(GL_OUT_OF_MEMORY);
+        return false;
+    }
+
+    GLsizei length = 0;
+    GLint size = 0;
+    GLenum type = 0;
+    m_api->glGetActiveUniform(program, index, maxNameLength, &length, &size, &type, name.get());
+    if (!length)
+        return false;
+
+    info.name = String::fromUTF8(name.get(), length);
+    info.type = type;
+    info.size = size;
+    return true;
+}
+
+void GraphicsContext3DPrivate::getAttachedShaders(Platform3DObject program, GC3Dsizei maxCount, GC3Dsizei* count, Platform3DObject* shaders)
+{
+    makeContextCurrent();
+    m_api->glGetAttachedShaders(program, maxCount, count, shaders);
+}
+
+int GraphicsContext3DPrivate::getAttribLocation(Platform3DObject program, const String& name)
+{
+    makeContextCurrent();
+    return m_api->glGetAttribLocation(program, name.utf8().data());
+}
+
+void GraphicsContext3DPrivate::getBooleanv(GC3Denum paramName, GC3Dboolean* value)
+{
+    makeContextCurrent();
+    m_api->glGetBooleanv(paramName, value);
+}
+
+void GraphicsContext3DPrivate::getBufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetBufferParameteriv(target, paramName, value);
+}
+
+GraphicsContext3D::Attributes GraphicsContext3DPrivate::getContextAttributes()
+{
+    return m_attributes;
+}
+
+GC3Denum GraphicsContext3DPrivate::getError()
+{
+    if (!m_syntheticErrors.isEmpty()) {
+        GC3Denum error = m_syntheticErrors.first();
+        m_syntheticErrors.remove(m_syntheticErrors.begin());
+        return error;
+    }
+
+    makeContextCurrent();
+    return m_api->glGetError();
+}
+
+void GraphicsContext3DPrivate::getFloatv(GC3Denum paramName, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glGetFloatv(paramName, value);
+}
+
+void GraphicsContext3DPrivate::getFramebufferAttachmentParameteriv(GC3Denum target, GC3Denum attachment, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetFramebufferAttachmentParameteriv(target, attachment, paramName, value);
+}
+
+void GraphicsContext3DPrivate::getIntegerv(GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetIntegerv(paramName, value);
+}
+
+void GraphicsContext3DPrivate::getProgramiv(Platform3DObject program, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetProgramiv(program, paramName, value);
+}
+
+String GraphicsContext3DPrivate::getProgramInfoLog(Platform3DObject program)
+{
+    makeContextCurrent();
+
+    GLint logLength = 0;
+    m_api->glGetProgramiv(program, GraphicsContext3D::INFO_LOG_LENGTH, &logLength);
+    if (!logLength)
+        return String();
+
+    OwnArrayPtr<char> log = adoptArrayPtr(new char[logLength]);
+    if (!log)
+        return String();
+
+    GLint returnedLogLength = 0;
+    m_api->glGetProgramInfoLog(program, logLength, &returnedLogLength, log.get());
+    ASSERT(logLength == returnedLogLength + 1);
+
+    String result = String::fromUTF8(log.get(), returnedLogLength);
+    return result;
+}
+
+void GraphicsContext3DPrivate::getRenderbufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetRenderbufferParameteriv(target, paramName, value);
+}
+
+void GraphicsContext3DPrivate::getShaderiv(Platform3DObject shader, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetShaderiv(shader, paramName, value);
+}
+
+String GraphicsContext3DPrivate::getShaderInfoLog(Platform3DObject shader)
+{
+    makeContextCurrent();
+
+    GLint logLength = 0;
+    m_api->glGetShaderiv(shader, GraphicsContext3D::INFO_LOG_LENGTH, &logLength);
+    if (logLength <= 1)
+        return String();
+
+    OwnArrayPtr<char> log = adoptArrayPtr(new char[logLength]);
+    if (!log)
+        return String();
+
+    GLint returnedLogLength = 0;
+    m_api->glGetShaderInfoLog(shader, logLength, &returnedLogLength, log.get());
+    ASSERT(logLength == returnedLogLength + 1);
+
+    String result = String::fromUTF8(log.get(), returnedLogLength);
+    return result;
+}
+
+String GraphicsContext3DPrivate::getShaderSource(Platform3DObject shader)
+{
+    makeContextCurrent();
+
+    GLint logLength = 0;
+    m_api->glGetShaderiv(shader, GL_SHADER_SOURCE_LENGTH, &logLength);
+    if (logLength <= 1)
+        return String();
+
+    OwnArrayPtr<char> log = adoptArrayPtr(new char[logLength]);
+    if (!log)
+        return String();
+
+    GLint returnedLogLength = 0;
+    m_api->glGetShaderSource(shader, logLength, &returnedLogLength, log.get());
+    ASSERT(logLength == returnedLogLength + 1);
+
+    String result = String::fromUTF8(log.get(), returnedLogLength);
+    return result;
+}
+
+String GraphicsContext3DPrivate::getString(GC3Denum name)
+{
+    makeContextCurrent();
+    return String(reinterpret_cast<const char*>(m_api->glGetString(name)));
+}
+
+void GraphicsContext3DPrivate::getTexParameterfv(GC3Denum target, GC3Denum paramName, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glGetTexParameterfv(target, paramName, value);
+}
+
+void GraphicsContext3DPrivate::getTexParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetTexParameteriv(target, paramName, value);
+}
+
+void GraphicsContext3DPrivate::getUniformfv(Platform3DObject program, GC3Dint location, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glGetUniformfv(program, location, value);
+}
+
+void GraphicsContext3DPrivate::getUniformiv(Platform3DObject program, GC3Dint location, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetUniformiv(program, location, value);
+}
+
+GC3Dint GraphicsContext3DPrivate::getUniformLocation(Platform3DObject program, const String& name)
+{
+    makeContextCurrent();
+    return m_api->glGetUniformLocation(program, name.utf8().data());
+}
+
+void GraphicsContext3DPrivate::getVertexAttribfv(GC3Duint index, GC3Denum paramName, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glGetVertexAttribfv(index, paramName, value);
+}
+
+void GraphicsContext3DPrivate::getVertexAttribiv(GC3Duint index, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetVertexAttribiv(index, paramName, value);
+}
+
+GC3Dsizeiptr GraphicsContext3DPrivate::getVertexAttribOffset(GC3Duint index, GC3Denum paramName)
+{
+    makeContextCurrent();
+    void* pointer = 0;
+    m_api->glGetVertexAttribPointerv(index, paramName, &pointer);
+    return reinterpret_cast<GC3Dsizeiptr>(pointer);
+}
+
+void GraphicsContext3DPrivate::hint(GC3Denum target, GC3Denum mode)
+{
+    makeContextCurrent();
+    m_api->glHint(target, mode);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isBuffer(Platform3DObject buffer)
+{
+    makeContextCurrent();
+    return m_api->glIsBuffer(buffer);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isEnabled(GC3Denum cap)
+{
+    makeContextCurrent();
+    return m_api->glIsEnabled(cap);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isFramebuffer(Platform3DObject framebuffer)
+{
+    makeContextCurrent();
+    return m_api->glIsFramebuffer(framebuffer);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isProgram(Platform3DObject program)
+{
+    makeContextCurrent();
+    return m_api->glIsProgram(program);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isRenderbuffer(Platform3DObject renderbuffer)
+{
+    makeContextCurrent();
+    return m_api->glIsRenderbuffer(renderbuffer);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isShader(Platform3DObject shader)
+{
+    makeContextCurrent();
+    return m_api->glIsShader(shader);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isTexture(Platform3DObject texture)
+{
+    makeContextCurrent();
+    return m_api->glIsTexture(texture);
+}
+
+void GraphicsContext3DPrivate::lineWidth(GC3Dfloat width)
+{
+    makeContextCurrent();
+    m_api->glLineWidth(width);
+}
+
+void GraphicsContext3DPrivate::linkProgram(Platform3DObject program)
+{
+    makeContextCurrent();
+    m_api->glLinkProgram(program);
+}
+
+void GraphicsContext3DPrivate::pixelStorei(GC3Denum paramName, GC3Dint param)
+{
+    makeContextCurrent();
+    m_api->glPixelStorei(paramName, param);
+}
+
+void GraphicsContext3DPrivate::polygonOffset(GC3Dfloat factor, GC3Dfloat units)
+{
+    makeContextCurrent();
+    m_api->glPolygonOffset(factor, units);
+}
+
+void GraphicsContext3DPrivate::readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, void* data)
+{
+    makeContextCurrent();
+
+    m_api->glFlush();
+    m_api->glReadPixels(x, y, width, height, format, type, data);
+}
+
+void GraphicsContext3DPrivate::renderbufferStorage(GC3Denum target, GC3Denum internalFormat, GC3Dsizei width, GC3Dsizei height)
+{
+    makeContextCurrent();
+    m_api->glRenderbufferStorage(target, internalFormat, width, height);
+}
+
+void GraphicsContext3DPrivate::sampleCoverage(GC3Dclampf value, GC3Dboolean invert)
+{
+    makeContextCurrent();
+    m_api->glSampleCoverage(value, invert);
+}
+
+void GraphicsContext3DPrivate::scissor(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    makeContextCurrent();
+    m_api->glScissor(x, y, width, height);
+}
+
+void GraphicsContext3DPrivate::shaderSource(Platform3DObject shader, const String& string)
+{
+    makeContextCurrent();
+    const char* str = string.utf8().data();
+    int length = string.length();
+    m_api->glShaderSource(shader, 1, &str, &length);
+}
+
+void GraphicsContext3DPrivate::stencilFunc(GC3Denum func, GC3Dint ref, GC3Duint mask)
+{
+    makeContextCurrent();
+    m_api->glStencilFunc(func, ref, mask);
+}
+
+void GraphicsContext3DPrivate::stencilFuncSeparate(GC3Denum face, GC3Denum func, GC3Dint ref, GC3Duint mask)
+{
+    makeContextCurrent();
+    m_api->glStencilFuncSeparate(face, func, ref, mask);
+}
+
+void GraphicsContext3DPrivate::stencilMask(GC3Duint mask)
+{
+    makeContextCurrent();
+    m_api->glStencilMask(mask);
+}
+
+void GraphicsContext3DPrivate::stencilMaskSeparate(GC3Denum face, GC3Duint mask)
+{
+    makeContextCurrent();
+    m_api->glStencilMaskSeparate(face, mask);
+}
+
+void GraphicsContext3DPrivate::stencilOp(GC3Denum fail, GC3Denum zFail, GC3Denum zPass)
+{
+    makeContextCurrent();
+    m_api->glStencilOp(fail, zFail, zPass);
+}
+
+void GraphicsContext3DPrivate::stencilOpSeparate(GC3Denum face, GC3Denum fail, GC3Denum zFail, GC3Denum zPass)
+{
+    makeContextCurrent();
+    m_api->glStencilOpSeparate(face, fail, zFail, zPass);
+}
+
+bool GraphicsContext3DPrivate::texImage2D(GC3Denum target, GC3Dint level, GC3Denum internalFormat, GC3Dsizei width, GC3Dsizei height, GC3Dint border, GC3Denum format, GC3Denum type, const void* pixels)
+{
+    makeContextCurrent();
+    m_api->glTexImage2D(target, level, internalFormat, width, height, border, format, type, pixels);
+    return true;
+}
+
+void GraphicsContext3DPrivate::texParameterf(GC3Denum target, GC3Denum paramName, GC3Dfloat param)
+{
+    makeContextCurrent();
+    m_api->glTexParameterf(target, paramName, param);
+}
+
+void GraphicsContext3DPrivate::texParameteri(GC3Denum target, GC3Denum paramName, GC3Dint param)
+{
+    makeContextCurrent();
+    m_api->glTexParameteri(target, paramName, param);
+}
+
+void GraphicsContext3DPrivate::texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, const void* pixels)
+{
+    makeContextCurrent();
+    m_api->glTexSubImage2D(target, level, xOffset, yOffset, width, height, format, type, pixels);
+}
+
+void GraphicsContext3DPrivate::uniform1f(GC3Dint location, GC3Dfloat x)
+{
+    makeContextCurrent();
+    m_api->glUniform1f(location, x);
+}
+
+void GraphicsContext3DPrivate::uniform1fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
+{
+    makeContextCurrent();
+    m_api->glUniform1fv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform1i(GC3Dint location, GC3Dint x)
+{
+    makeContextCurrent();
+    m_api->glUniform1i(location, x);
+}
+
+void GraphicsContext3DPrivate::uniform1iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
+{
+    makeContextCurrent();
+    m_api->glUniform1iv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform2f(GC3Dint location, GC3Dfloat x, GC3Dfloat y)
+{
+    makeContextCurrent();
+    m_api->glUniform2f(location, x, y);
+}
+
+void GraphicsContext3DPrivate::uniform2fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
+{
+    makeContextCurrent();
+    m_api->glUniform2fv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform2i(GC3Dint location, GC3Dint x, GC3Dint y)
+{
+    makeContextCurrent();
+    m_api->glUniform2i(location, x, y);
+}
+
+void GraphicsContext3DPrivate::uniform2iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
+{
+    makeContextCurrent();
+    m_api->glUniform2iv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform3f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z)
+{
+    makeContextCurrent();
+    m_api->glUniform3f(location, x, y, z);
+}
+
+void GraphicsContext3DPrivate::uniform3fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
+{
+    makeContextCurrent();
+    m_api->glUniform3fv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform3i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z)
+{
+    makeContextCurrent();
+    m_api->glUniform3i(location, x, y, z);
+}
+
+void GraphicsContext3DPrivate::uniform3iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
+{
+    makeContextCurrent();
+    m_api->glUniform3iv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform4f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w)
+{
+    makeContextCurrent();
+    m_api->glUniform4f(location, x, y, z, w);
+}
+
+void GraphicsContext3DPrivate::uniform4fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
+{
+    makeContextCurrent();
+    m_api->glUniform4fv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform4i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z, GC3Dint w)
+{
+    makeContextCurrent();
+    m_api->glUniform4i(location, x, y, z, w);
+}
+
+void GraphicsContext3DPrivate::uniform4iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
+{
+    makeContextCurrent();
+    m_api->glUniform4iv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniformMatrix2fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glUniformMatrix2fv(location, size, transpose, value);
+}
+
+void GraphicsContext3DPrivate::uniformMatrix3fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glUniformMatrix3fv(location, size, transpose, value);
+}
+
+void GraphicsContext3DPrivate::uniformMatrix4fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glUniformMatrix4fv(location, size, transpose, value);
+}
+
+void GraphicsContext3DPrivate::useProgram(Platform3DObject program)
+{
+    makeContextCurrent();
+    m_api->glUseProgram(program);
+}
+
+void GraphicsContext3DPrivate::validateProgram(Platform3DObject program)
+{
+    makeContextCurrent();
+    m_api->glValidateProgram(program);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib1f(GC3Duint index, GC3Dfloat x)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib1f(index, x);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib1fv(GC3Duint index, GC3Dfloat* values)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib1fv(index, values);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib2f(GC3Duint index, GC3Dfloat x, GC3Dfloat y)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib2f(index, x, y);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib2fv(GC3Duint index, GC3Dfloat* values)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib2fv(index, values);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib3f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib3f(index, x, y, z);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib3fv(GC3Duint index, GC3Dfloat* values)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib3fv(index, values);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib4f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib4f(index, x, y, z, w);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib4fv(GC3Duint index, GC3Dfloat* values)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib4fv(index, values);
+}
+
+void GraphicsContext3DPrivate::vertexAttribPointer(GC3Duint index, GC3Dint size, GC3Denum type, GC3Dboolean normalized, GC3Dsizei stride, GC3Dintptr offset)
+{
+    makeContextCurrent();
+
+    if (m_boundArrayBuffer <= 0)
+        return;
+
+    m_api->glVertexAttribPointer(index, size, type, normalized, stride, reinterpret_cast<GLvoid*>(static_cast<intptr_t>(offset)));
+}
+
+void GraphicsContext3DPrivate::viewport(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    makeContextCurrent();
+    m_api->glViewport(x, y, width, height);
+}
+
+Platform3DObject GraphicsContext3DPrivate::createBuffer()
+{
+    makeContextCurrent();
+    Platform3DObject buffer = 0;
+    m_api->glGenBuffers(1, &buffer);
+    return buffer;
+}
+
+Platform3DObject GraphicsContext3DPrivate::createFramebuffer()
+{
+    makeContextCurrent();
+    Platform3DObject buffer = 0;
+    m_api->glGenFramebuffers(1, &buffer);
+    return buffer;
+}
+
+Platform3DObject GraphicsContext3DPrivate::createProgram()
+{
+    makeContextCurrent();
+    return m_api->glCreateProgram();
+}
+
+Platform3DObject GraphicsContext3DPrivate::createRenderbuffer()
+{
+    makeContextCurrent();
+    Platform3DObject buffer;
+    m_api->glGenRenderbuffers(1, &buffer);
+    return buffer;
+}
+
+Platform3DObject GraphicsContext3DPrivate::createShader(GC3Denum shaderType)
+{
+    makeContextCurrent();
+    return m_api->glCreateShader(shaderType);
+}
+
+Platform3DObject GraphicsContext3DPrivate::createTexture()
+{
+    makeContextCurrent();
+    Platform3DObject texture;
+    m_api->glGenTextures(1, &texture);
+    return texture;
+}
+
+void GraphicsContext3DPrivate::deleteBuffer(Platform3DObject buffer)
+{
+    makeContextCurrent();
+    m_api->glDeleteBuffers(1, &buffer);
+}
+
+void GraphicsContext3DPrivate::deleteFramebuffer(Platform3DObject framebuffer)
+{
+    makeContextCurrent();
+    m_api->glDeleteFramebuffers(1, &framebuffer);
+}
+
+void GraphicsContext3DPrivate::deleteProgram(Platform3DObject program)
+{
+    makeContextCurrent();
+    m_api->glDeleteProgram(program);
+}
+
+void GraphicsContext3DPrivate::deleteRenderbuffer(Platform3DObject renderbuffer)
+{
+    makeContextCurrent();
+    m_api->glDeleteRenderbuffers(1, &renderbuffer);
+}
+
+void GraphicsContext3DPrivate::deleteShader(Platform3DObject shader)
+{
+    makeContextCurrent();
+    m_api->glDeleteShader(shader);
+}
+
+void GraphicsContext3DPrivate::deleteTexture(Platform3DObject texture)
+{
+    makeContextCurrent();
+    m_api->glDeleteTextures(1, &texture);
+}
+
+void GraphicsContext3DPrivate::synthesizeGLError(GC3Denum error)
+{
+    m_syntheticErrors.add(error);
+}
+
+Extensions3D* GraphicsContext3DPrivate::getExtensions()
+{
+    notImplemented();
+    return 0;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL) || USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.h b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.h
new file mode 100644
index 000000000..d02b87845
--- /dev/null
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.h
@@ -0,0 +1,227 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef GraphicsContext3DPrivate_h
+#define GraphicsContext3DPrivate_h
+
+#include "GraphicsContext3D.h"
+
+#include <Evas_GL.h>
+
+namespace WebCore {
+
+class PageClientEfl;
+
+class GraphicsContext3DPrivate {
+public:
+    static PassOwnPtr<GraphicsContext3DPrivate> create(GraphicsContext3D::Attributes attrs, HostWindow*, bool renderDirectlyToEvasGLObject);
+    ~GraphicsContext3DPrivate();
+
+    PlatformGraphicsContext3D platformGraphicsContext3D() const;
+
+#if USE(ACCELERATED_COMPOSITING)
+    PlatformLayer* platformLayer() const;
+#endif
+
+    bool makeContextCurrent();
+
+    bool isGLES2Compliant() const;
+
+    void activeTexture(GC3Denum texture);
+    void attachShader(Platform3DObject program, Platform3DObject shader);
+    void bindAttribLocation(Platform3DObject, GC3Duint index, const String& name);
+    void bindBuffer(GC3Denum target, Platform3DObject);
+    void bindFramebuffer(GC3Denum target, Platform3DObject);
+    void bindRenderbuffer(GC3Denum target, Platform3DObject);
+    void bindTexture(GC3Denum target, Platform3DObject);
+    void blendColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha);
+    void blendEquation(GC3Denum mode);
+    void blendEquationSeparate(GC3Denum modeRGB, GC3Denum modeAlpha);
+    void blendFunc(GC3Denum srcFactor, GC3Denum dstFactor);
+    void blendFuncSeparate(GC3Denum srcRGB, GC3Denum dstRGB, GC3Denum srcAlpha, GC3Denum dstAlpha);
+
+    void bufferData(GC3Denum target, GC3Dsizeiptr, const void* data, GC3Denum usage);
+    void bufferSubData(GC3Denum target, GC3Dintptr offset, GC3Dsizeiptr, const void* data);
+
+    GC3Denum checkFramebufferStatus(GC3Denum target);
+    void clear(GC3Dbitfield mask);
+    void clearColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha);
+    void clearDepth(GC3Dclampf depth);
+    void clearStencil(GC3Dint clearValue);
+    void colorMask(GC3Dboolean red, GC3Dboolean green, GC3Dboolean blue, GC3Dboolean alpha);
+    void compileShader(Platform3DObject);
+
+    void copyTexImage2D(GC3Denum target, GC3Dint level, GC3Denum internalFormat, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Dint border);
+    void copyTexSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height);
+    void cullFace(GC3Denum mode);
+    void depthFunc(GC3Denum func);
+    void depthMask(GC3Dboolean flag);
+    void depthRange(GC3Dclampf zNear, GC3Dclampf zFar);
+    void detachShader(Platform3DObject, Platform3DObject);
+    void disable(GC3Denum cap);
+    void disableVertexAttribArray(GC3Duint index);
+    void drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei count);
+    void drawElements(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset);
+
+    void enable(GC3Denum cap);
+    void enableVertexAttribArray(GC3Duint index);
+    void finish();
+    void flush();
+    void framebufferRenderbuffer(GC3Denum target, GC3Denum attachment, GC3Denum renderbufferTarget, Platform3DObject);
+    void framebufferTexture2D(GC3Denum target, GC3Denum attachment, GC3Denum texTarget, Platform3DObject, GC3Dint level);
+    void frontFace(GC3Denum mode);
+    void generateMipmap(GC3Denum target);
+
+    bool getActiveAttrib(Platform3DObject program, GC3Duint index, ActiveInfo&);
+    bool getActiveUniform(Platform3DObject program, GC3Duint index, ActiveInfo&);
+    void getAttachedShaders(Platform3DObject program, GC3Dsizei maxCount, GC3Dsizei* count, Platform3DObject* shaders);
+    GC3Dint getAttribLocation(Platform3DObject, const String& name);
+    void getBooleanv(GC3Denum paramName, GC3Dboolean* value);
+    void getBufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value);
+    GraphicsContext3D::Attributes getContextAttributes();
+    GC3Denum getError();
+    void getFloatv(GC3Denum paramName, GC3Dfloat* value);
+    void getFramebufferAttachmentParameteriv(GC3Denum target, GC3Denum attachment, GC3Denum paramName, GC3Dint* value);
+    void getIntegerv(GC3Denum paramName, GC3Dint* value);
+    void getProgramiv(Platform3DObject program, GC3Denum paramName, GC3Dint* value);
+    String getProgramInfoLog(Platform3DObject);
+    void getRenderbufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value);
+    void getShaderiv(Platform3DObject, GC3Denum paramName, GC3Dint* value);
+    String getShaderInfoLog(Platform3DObject);
+
+    String getShaderSource(Platform3DObject);
+    String getString(GC3Denum name);
+    void getTexParameterfv(GC3Denum target, GC3Denum paramName, GC3Dfloat* value);
+    void getTexParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value);
+    void getUniformfv(Platform3DObject program, GC3Dint location, GC3Dfloat* value);
+    void getUniformiv(Platform3DObject program, GC3Dint location, GC3Dint* value);
+    GC3Dint getUniformLocation(Platform3DObject, const String& name);
+    void getVertexAttribfv(GC3Duint index, GC3Denum paramName, GC3Dfloat* value);
+    void getVertexAttribiv(GC3Duint index, GC3Denum paramName, GC3Dint* value);
+    GC3Dsizeiptr getVertexAttribOffset(GC3Duint index, GC3Denum paramName);
+
+    void hint(GC3Denum target, GC3Denum mode);
+    GC3Dboolean isBuffer(Platform3DObject);
+    GC3Dboolean isEnabled(GC3Denum cap);
+    GC3Dboolean isFramebuffer(Platform3DObject);
+    GC3Dboolean isProgram(Platform3DObject);
+    GC3Dboolean isRenderbuffer(Platform3DObject);
+    GC3Dboolean isShader(Platform3DObject);
+    GC3Dboolean isTexture(Platform3DObject);
+    void lineWidth(GC3Dfloat);
+    void linkProgram(Platform3DObject);
+    void pixelStorei(GC3Denum paramName, GC3Dint param);
+    void polygonOffset(GC3Dfloat factor, GC3Dfloat units);
+
+    void readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, void* data);
+
+    void renderbufferStorage(GC3Denum target, GC3Denum internalFormat, GC3Dsizei width, GC3Dsizei height);
+    void sampleCoverage(GC3Dclampf value, GC3Dboolean invert);
+    void scissor(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height);
+    void shaderSource(Platform3DObject, const String&);
+    void stencilFunc(GC3Denum func, GC3Dint ref, GC3Duint mask);
+    void stencilFuncSeparate(GC3Denum face, GC3Denum func, GC3Dint ref, GC3Duint mask);
+    void stencilMask(GC3Duint mask);
+    void stencilMaskSeparate(GC3Denum face, GC3Duint mask);
+    void stencilOp(GC3Denum fail, GC3Denum zFail, GC3Denum zPass);
+    void stencilOpSeparate(GC3Denum face, GC3Denum fail, GC3Denum zFail, GC3Denum zPass);
+
+    bool texImage2D(GC3Denum target, GC3Dint level, GC3Denum internalFormat, GC3Dsizei width, GC3Dsizei height, GC3Dint border, GC3Denum format, GC3Denum type, const void* pixels);
+    void texParameterf(GC3Denum target, GC3Denum paramName, GC3Dfloat param);
+    void texParameteri(GC3Denum target, GC3Denum paramName, GC3Dint param);
+    void texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, const void* pixels);
+
+    void uniform1f(GC3Dint location, GC3Dfloat x);
+    void uniform1fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
+    void uniform1i(GC3Dint location, GC3Dint x);
+    void uniform1iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniform2f(GC3Dint location, GC3Dfloat x, float y);
+    void uniform2fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
+    void uniform2i(GC3Dint location, GC3Dint x, GC3Dint y);
+    void uniform2iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniform3f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z);
+    void uniform3fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
+    void uniform3i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z);
+    void uniform3iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniform4f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w);
+    void uniform4fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
+    void uniform4i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z, GC3Dint w);
+    void uniform4iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniformMatrix2fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix3fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix4fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+
+    void useProgram(Platform3DObject);
+    void validateProgram(Platform3DObject);
+
+    void vertexAttrib1f(GC3Duint index, GC3Dfloat x);
+    void vertexAttrib1fv(GC3Duint index, GC3Dfloat* values);
+    void vertexAttrib2f(GC3Duint index, GC3Dfloat x, GC3Dfloat y);
+    void vertexAttrib2fv(GC3Duint index, GC3Dfloat* values);
+    void vertexAttrib3f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z);
+    void vertexAttrib3fv(GC3Duint index, GC3Dfloat* values);
+    void vertexAttrib4f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w);
+    void vertexAttrib4fv(GC3Duint index, GC3Dfloat* values);
+    void vertexAttribPointer(GC3Duint index, GC3Dint size, GC3Denum type, GC3Dboolean normalized,
+                             GC3Dsizei stride, GC3Dintptr offset);
+
+    void viewport(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height);
+
+    Platform3DObject createBuffer();
+    Platform3DObject createFramebuffer();
+    Platform3DObject createProgram();
+    Platform3DObject createRenderbuffer();
+    Platform3DObject createShader(GC3Denum);
+    Platform3DObject createTexture();
+
+    void deleteBuffer(Platform3DObject);
+    void deleteFramebuffer(Platform3DObject);
+    void deleteProgram(Platform3DObject);
+    void deleteRenderbuffer(Platform3DObject);
+    void deleteShader(Platform3DObject);
+    void deleteTexture(Platform3DObject);
+
+    void synthesizeGLError(GC3Denum error);
+
+    Extensions3D* getExtensions();
+
+private:
+    GraphicsContext3DPrivate();
+
+    bool initialize(GraphicsContext3D::Attributes attrs, HostWindow*, bool renderDirectlyToHostWindow);
+
+    bool createSurface(PageClientEfl*, bool renderDirectlyToEvasGLObject);
+
+    GraphicsContext3D::Attributes m_attributes;
+
+    Platform3DObject m_boundFBO;
+    Platform3DObject m_boundTexture;
+    Platform3DObject m_boundArrayBuffer;
+
+    ListHashSet<GC3Denum> m_syntheticErrors;
+
+    Evas_GL* m_evasGL;
+    Evas_GL_Context* m_context;
+    Evas_GL_Surface* m_surface;
+    Evas_GL_API* m_api;
+};
+
+} // namespace WebCore
+
+#endif // GraphicsLayerEfl_h
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
index 40ec330d4..c3a986815 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
index b557d3eaf..46f37f361 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h b/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h
index 36568d59a..0ade173f2 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp
index 93af2b73a..c05a40f62 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
index 66eb2c8b1..4d8392682 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterParameter.h b/Source/WebCore/platform/graphics/filters/CustomFilterParameter.h
index cd8cb8805..e9c062952 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterParameter.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterParameter.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
index d257f3f83..130441a1c 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
index 8c9056d39..84e6c205a 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgramClient.h b/Source/WebCore/platform/graphics/filters/CustomFilterProgramClient.h
index 488247d9f..3b0b7c054 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgramClient.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgramClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp
index cacfeb615..8ef66cfa3 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterShader.h b/Source/WebCore/platform/graphics/filters/CustomFilterShader.h
index 6141c18c7..af35bb1cf 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterShader.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterShader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/FEComposite.cpp b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
index fbc2c1671..5be22f8e2 100644
--- a/Source/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -116,6 +116,14 @@ bool FEComposite::setK4(float k4)
     return true;
 }
 
+void FEComposite::correctFilterResultIfNeeded()
+{
+    if (m_type != FECOMPOSITE_OPERATOR_ARITHMETIC)
+        return;
+
+    forceValidPreMultipliedPixels();
+}
+
 template <int b1, int b2, int b3, int b4>
 static inline void computeArithmeticPixels(unsigned char* source, unsigned char* destination, int pixelArrayLength,
                                     float k1, float k2, float k3, float k4)
diff --git a/Source/WebCore/platform/graphics/filters/FEComposite.h b/Source/WebCore/platform/graphics/filters/FEComposite.h
index 35f2505e3..24ba3078f 100644
--- a/Source/WebCore/platform/graphics/filters/FEComposite.h
+++ b/Source/WebCore/platform/graphics/filters/FEComposite.h
@@ -59,6 +59,8 @@ public:
     float k4() const;
     bool setK4(float);
 
+    virtual void correctFilterResultIfNeeded() OVERRIDE;
+
     virtual void platformApplySoftware();
     virtual void dump();
     
@@ -66,6 +68,9 @@ public:
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
+protected:
+    virtual bool requiresValidPreMultipliedPixels() OVERRIDE { return m_type != FECOMPOSITE_OPERATOR_ARITHMETIC; }
+
 private:
     FEComposite(Filter*, const CompositeOperationType&, float, float, float, float);
 
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
index 95f51fc9b..9bf2495c0 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -229,7 +229,7 @@ void FECustomFilter::bindProgramAndBuffers(ByteArray* srcPixelArray)
         orthogonalProjectionMatrix(projectionMatrix, -0.5, 0.5, -0.5, 0.5);
         float glProjectionMatrix[16];
         projectionMatrix.toColumnMajorFloatArray(glProjectionMatrix);
-        m_context->uniformMatrix4fv(m_shader->projectionMatrixLocation(), false, &glProjectionMatrix[0], 1);
+        m_context->uniformMatrix4fv(m_shader->projectionMatrixLocation(), 1, false, &glProjectionMatrix[0]);
     }
     
     m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_mesh->verticesBufferObject());
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.h b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
index 1fa2d292a..c977c8591 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.h
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/FEDropShadow.cpp b/Source/WebCore/platform/graphics/filters/FEDropShadow.cpp
index 5944feca5..3dd5a2763 100644
--- a/Source/WebCore/platform/graphics/filters/FEDropShadow.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEDropShadow.cpp
@@ -103,7 +103,7 @@ void FEDropShadow::platformApplySoftware()
     ShadowBlur contextShadow(blurRadius, offset, m_shadowColor, ColorSpaceDeviceRGB);
 
     // TODO: Direct pixel access to ImageBuffer would avoid copying the ImageData.
-    IntRect shadowArea(IntPoint(), resultImage->size());
+    IntRect shadowArea(IntPoint(), resultImage->internalSize());
     RefPtr<ByteArray> srcPixelArray = resultImage->getPremultipliedImageData(shadowArea);
 
     contextShadow.blurLayerImage(srcPixelArray->data(), shadowArea.size(), 4 * shadowArea.size().width());
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
index f972c98a4..9bf1689f7 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -102,6 +102,11 @@ void FilterEffect::apply()
             return;
     }
     determineAbsolutePaintRect();
+
+    if (requiresValidPreMultipliedPixels()) {
+        for (unsigned i = 0; i < size; ++i)
+            inputEffect(i)->correctFilterResultIfNeeded();
+    }
     
     // Add platform specific apply functions here and return earlier.
 #if USE(SKIA)
@@ -111,6 +116,35 @@ void FilterEffect::apply()
     platformApplySoftware();
 }
 
+void FilterEffect::forceValidPreMultipliedPixels()
+{
+    // Must operate on pre-multiplied results; other formats cannot have invalid pixels.
+    if (!m_premultipliedImageResult)
+        return;
+
+    ByteArray* imageArray = m_premultipliedImageResult.get();
+    unsigned char* pixelData = imageArray->data();
+    int pixelArrayLength = imageArray->length();
+
+    // We must have four bytes per pixel, and complete pixels
+    ASSERT(!(pixelArrayLength % 4));
+    int numPixels = pixelArrayLength / 4;
+
+    // Iterate over each pixel, checking alpha and adjusting color components if necessary
+    while (--numPixels >= 0) {
+        // Alpha is the 4th byte in a pixel
+        unsigned char a = *(pixelData + 3);
+        // Clamp each component to alpha, and increment the pixel location
+        for (int i = 0; i < 3; ++i) {
+            if (*pixelData > a)
+                *pixelData = a;
+            ++pixelData;
+        }
+        // Increment for alpha
+        ++pixelData;
+    }
+}
+
 void FilterEffect::clearResult()
 {
     if (m_imageBufferResult)
@@ -127,7 +161,7 @@ ImageBuffer* FilterEffect::asImageBuffer()
         return 0;
     if (m_imageBufferResult)
         return m_imageBufferResult.get();
-    m_imageBufferResult = ImageBuffer::create(m_absolutePaintRect.size(), ColorSpaceLinearRGB, m_filter->renderingMode());
+    m_imageBufferResult = ImageBuffer::create(m_absolutePaintRect.size(), 1, ColorSpaceLinearRGB, m_filter->renderingMode());
     IntRect destinationRect(IntPoint(), m_absolutePaintRect.size());
     if (m_premultipliedImageResult)
         m_imageBufferResult->putByteArray(Premultiplied, m_premultipliedImageResult.get(), destinationRect.size(), destinationRect, IntPoint());
@@ -264,7 +298,7 @@ ImageBuffer* FilterEffect::createImageBufferResult()
     ASSERT(!hasResult());
     if (m_absolutePaintRect.isEmpty())
         return 0;
-    m_imageBufferResult = ImageBuffer::create(m_absolutePaintRect.size(), ColorSpaceLinearRGB, m_filter->renderingMode());
+    m_imageBufferResult = ImageBuffer::create(m_absolutePaintRect.size(), 1, ColorSpaceLinearRGB, m_filter->renderingMode());
     if (!m_imageBufferResult)
         return 0;
     ASSERT(m_imageBufferResult->context());
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.h b/Source/WebCore/platform/graphics/filters/FilterEffect.h
index 1bae4ca0a..8b4ad6f92 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.h
@@ -86,6 +86,11 @@ public:
 
     void apply();
     
+    // Correct any invalid pixels, if necessary, in the result of a filter operation.
+    // This method is used to ensure valid pixel values on filter inputs and the final result.
+    // Only the arithmetic composite filter ever needs to perform correction.
+    virtual void correctFilterResultIfNeeded() { }
+
     virtual void platformApplySoftware() = 0;
 #if USE(SKIA)
     virtual bool platformApplySkia() { return false; }
@@ -131,6 +136,13 @@ protected:
     ByteArray* createUnmultipliedImageResult();
     ByteArray* createPremultipliedImageResult();
 
+    // Return true if the filter will only operate correctly on valid RGBA values, with
+    // alpha in [0,255] and each color component in [0, alpha].
+    virtual bool requiresValidPreMultipliedPixels() { return true; }
+
+    // If a pre-multiplied image, check every pixel for validity and correct if necessary.
+    void forceValidPreMultipliedPixels();
+
 private:
     OwnPtr<ImageBuffer> m_imageBufferResult;
     RefPtr<ByteArray> m_unmultipliedImageResult;
diff --git a/Source/WebCore/platform/graphics/glx/GLContextGLX.cpp b/Source/WebCore/platform/graphics/glx/GLContextGLX.cpp
new file mode 100644
index 000000000..cdced6832
--- /dev/null
+++ b/Source/WebCore/platform/graphics/glx/GLContextGLX.cpp
@@ -0,0 +1,308 @@
+/*
+ * Copyright (C) 2011, 2012 Igalia, S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "GLContext.h"
+
+#if ENABLE(WEBGL) || USE(TEXTURE_MAPPER_GL)
+#include "GraphicsContext3D.h"
+#include "OpenGLShims.h"
+#include <GL/glx.h>
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+// We do not want to call glXMakeContextCurrent using different Display pointers,
+// because it might lead to crashes in some drivers (fglrx). We use a shared display
+// pointer here.
+static Display* gSharedDisplay = 0;
+static Display* sharedDisplay()
+{
+    if (!gSharedDisplay)
+        gSharedDisplay = XOpenDisplay(0);
+    return gSharedDisplay;
+}
+
+// Because of driver bugs, exiting the program when there are active pbuffers
+// can crash the X server (this has been observed with the official Nvidia drivers).
+// We need to ensure that we clean everything up on exit. There are several reasons
+// that GraphicsContext3Ds will still be alive at exit, including user error (memory
+// leaks) and the page cache. In any case, we don't want the X server to crash.
+typedef Vector<GLContext*> ActiveContextList;
+static ActiveContextList& activeContextList()
+{
+    DEFINE_STATIC_LOCAL(ActiveContextList, activeContexts, ());
+    return activeContexts;
+}
+
+void GLContext::addActiveContext(GLContext* context)
+{
+    static bool addedAtExitHandler = false;
+    if (!addedAtExitHandler) {
+        atexit(&GLContext::cleanupActiveContextsAtExit);
+        addedAtExitHandler = true;
+    }
+    activeContextList().append(context);
+}
+
+void GLContext::removeActiveContext(GLContext* context)
+{
+    ActiveContextList& contextList = activeContextList();
+    size_t i = contextList.find(context);
+    if (i != notFound)
+        contextList.remove(i);
+}
+
+void GLContext::cleanupActiveContextsAtExit()
+{
+    ActiveContextList& contextList = activeContextList();
+    for (size_t i = 0; i < contextList.size(); ++i)
+        delete contextList[i];
+
+    if (!gSharedDisplay)
+        return;
+    XCloseDisplay(gSharedDisplay);
+    gSharedDisplay = 0;
+}
+
+GLContext* GLContext::getCurrent()
+{
+    ActiveContextList& contextList = activeContextList();
+    GLXContext current = glXGetCurrentContext();
+    for (size_t i = 0; i < contextList.size(); ++i) {
+        if (current == contextList[i]->m_context)
+            return contextList[i];
+    }
+    return 0;
+}
+
+GLContext* GLContext::createSharingContext(GLContext* sharingContext)
+{
+    return createContext(0, sharingContext ? sharingContext->m_context : 0);
+}
+
+GLContext* GLContext::createWindowContext(XID window, GLXContext sharingContext)
+{
+    Display* display = sharedDisplay();
+    XWindowAttributes attributes;
+    if (!XGetWindowAttributes(display, window, &attributes))
+        return 0;
+
+    XVisualInfo visualInfo;
+    visualInfo.visualid = XVisualIDFromVisual(attributes.visual);
+
+    int numReturned = 0;
+    XVisualInfo* visualInfoList = XGetVisualInfo(display, VisualIDMask, &visualInfo, &numReturned);
+    GLXContext context = glXCreateContext(display, visualInfoList, sharingContext, True);
+    XFree(visualInfoList);
+
+    if (!context)
+        return 0;
+
+    // GLXPbuffer and XID are both the same types underneath, so we have to share
+    // a constructor here with the window path.
+    GLContext* contextWrapper = new GLContext(context);
+    contextWrapper->m_window = window;
+    return contextWrapper;
+}
+
+GLContext* GLContext::createPbufferContext(GLXContext sharingContext)
+{
+    int fbConfigAttributes[] = {
+        GLX_DRAWABLE_TYPE, GLX_PBUFFER_BIT,
+        GLX_RENDER_TYPE, GLX_RGBA_BIT,
+        GLX_RED_SIZE, 1,
+        GLX_GREEN_SIZE, 1,
+        GLX_BLUE_SIZE, 1,
+        GLX_ALPHA_SIZE, 1,
+        GLX_DOUBLEBUFFER, GL_FALSE,
+        0
+    };
+
+    int returnedElements;
+    Display* display = sharedDisplay();
+    GLXFBConfig* configs = glXChooseFBConfig(display, 0, fbConfigAttributes, &returnedElements);
+    if (!returnedElements) {
+        XFree(configs);
+        return 0;
+    }
+
+    // We will be rendering to a texture, so our pbuffer does not need to be large.
+    static const int pbufferAttributes[] = { GLX_PBUFFER_WIDTH, 1, GLX_PBUFFER_HEIGHT, 1, 0 };
+    GLXPbuffer pbuffer = glXCreatePbuffer(display, configs[0], pbufferAttributes);
+    if (!pbuffer) {
+        XFree(configs);
+        return 0;
+    }
+
+    GLXContext context = glXCreateNewContext(display, configs[0], GLX_RGBA_TYPE, sharingContext, GL_TRUE);
+    XFree(configs);
+    if (!context)
+        return 0;
+
+    // GLXPbuffer and XID are both the same types underneath, so we have to share
+    // a constructor here with the window path.
+    GLContext* contextWrapper = new GLContext(context);
+    contextWrapper->m_pbuffer = pbuffer;
+    return contextWrapper;
+}
+
+GLContext* GLContext::createPixmapContext(GLXContext sharingContext)
+{
+    static int visualAttributes[] = {
+        GLX_RGBA,
+        GLX_RED_SIZE, 1,
+        GLX_GREEN_SIZE, 1,
+        GLX_BLUE_SIZE, 1,
+        GLX_ALPHA_SIZE, 1,
+        0
+    };
+
+    Display* display = sharedDisplay();
+    XVisualInfo* visualInfo = glXChooseVisual(display, DefaultScreen(display), visualAttributes);
+    if (!visualInfo)
+        return 0;
+
+    GLXContext context = glXCreateContext(display, visualInfo, sharingContext, GL_TRUE);
+    if (!context) {
+        XFree(visualInfo);
+        return 0;
+    }
+
+    Pixmap pixmap = XCreatePixmap(display, DefaultRootWindow(display), 1, 1, visualInfo->depth);
+    if (!pixmap) {
+        XFree(visualInfo);
+        return 0;
+    }
+
+    GLXPixmap glxPixmap = glXCreateGLXPixmap(display, visualInfo, pixmap);
+    if (!glxPixmap) {
+        XFreePixmap(display, pixmap);
+        XFree(visualInfo);
+        return 0;
+    }
+
+    return new GLContext(context, pixmap, glxPixmap);
+}
+
+GLContext* GLContext::createContext(XID window, GLXContext sharingContext)
+{
+    if (!sharedDisplay())
+        return 0;
+
+    static bool initialized = false;
+    static bool success = true;
+    if (!initialized) {
+        success = initializeOpenGLShims();
+        initialized = true;
+    }
+    if (!success)
+        return 0;
+
+    GLContext* context = window ? createWindowContext(window, sharingContext) : 0;
+    if (!context)
+        context = createPbufferContext(sharingContext);
+    if (!context)
+        context = createPixmapContext(sharingContext);
+    if (!context)
+        return 0;
+
+    return context;
+}
+
+GLContext::GLContext(GLXContext context)
+    : m_context(context)
+    , m_window(0)
+    , m_pbuffer(0)
+    , m_pixmap(0)
+    , m_glxPixmap(0)
+{
+    addActiveContext(this);
+}
+
+GLContext::GLContext(GLXContext context, Pixmap pixmap, GLXPixmap glxPixmap)
+    : m_context(context)
+    , m_window(0)
+    , m_pbuffer(0)
+    , m_pixmap(pixmap)
+    , m_glxPixmap(glxPixmap)
+{
+    addActiveContext(this);
+}
+
+GLContext::~GLContext()
+{
+    if (m_context) {
+        // This may be necessary to prevent crashes with NVidia's closed source drivers. Originally
+        // from Mozilla's 3D canvas implementation at: http://bitbucket.org/ilmari/canvas3d/
+        glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, 0);
+        glXMakeCurrent(m_display, None, None);
+        glXDestroyContext(m_display, m_context);
+    }
+
+    if (m_pbuffer) {
+        glXDestroyPbuffer(sharedDisplay(), m_pbuffer);
+        m_pbuffer = 0;
+    }
+    if (m_glxPixmap) {
+        glXDestroyGLXPixmap(sharedDisplay(), m_glxPixmap);
+        m_glxPixmap = 0;
+    }
+    if (m_pixmap) {
+        XFreePixmap(sharedDisplay(), m_pixmap);
+        m_pixmap = 0;
+    }
+    removeActiveContext(this);
+}
+
+bool GLContext::canRenderToDefaultFramebuffer()
+{
+    return m_window;
+}
+
+bool GLContext::makeContextCurrent()
+{
+    ASSERT(m_context && (m_window || m_pbuffer || m_glxPixmap));
+    if (glXGetCurrentContext() == m_context)
+        return true;
+
+    if (m_window)
+        return glXMakeCurrent(sharedDisplay(), m_window, m_context);
+
+    if (m_pbuffer)
+        return glXMakeCurrent(sharedDisplay(), m_pbuffer, m_context);
+
+    return ::glXMakeCurrent(sharedDisplay(), m_glxPixmap, m_context);
+}
+
+void GLContext::swapBuffers()
+{
+    if (m_window)
+        glXSwapBuffers(sharedDisplay(), m_window);
+}
+
+#if ENABLE(WEBGL)
+PlatformGraphicsContext3D GLContext::platformContext()
+{
+    return m_context;
+}
+#endif
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL) || && USE(TEXTURE_MAPPER_GL)
diff --git a/Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.cpp b/Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.cpp
deleted file mode 100644
index a628a4bd6..000000000
--- a/Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.cpp
+++ /dev/null
@@ -1,252 +0,0 @@
-/*
- * Copyright (C) 2011 Igalia S.L.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free
- *  Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301 USA
- */
-
-#include "config.h"
-#include "GraphicsContext3DPrivate.h"
-
-#if ENABLE(WEBGL)
-
-#include "GraphicsContext3D.h"
-#include "OpenGLShims.h"
-#include <GL/glx.h>
-#include <dlfcn.h>
-
-// We do not want to call glXMakeContextCurrent using different Display pointers,
-// because it might lead to crashes in some drivers (fglrx). We use a shared display
-// pointer here.
-static Display* gSharedDisplay = 0;
-static Display* sharedDisplay()
-{
-    if (!gSharedDisplay)
-        gSharedDisplay = XOpenDisplay(0);
-    return gSharedDisplay;
-}
-
-namespace WebCore {
-
-// Because of driver bugs, exiting the program when there are active pbuffers
-// can crash the X server (this has been observed with the official Nvidia drivers).
-// We need to ensure that we clean everything up on exit. There are several reasons
-// that GraphicsContext3Ds will still be alive at exit, including user error (memory
-// leaks) and the page cache. In any case, we don't want the X server to crash.
-static bool cleaningUpAtExit = false;
-static Vector<GraphicsContext3D*>& activeGraphicsContexts()
-{
-    DEFINE_STATIC_LOCAL(Vector<GraphicsContext3D*>, contexts, ());
-    return contexts;
-}
-
-void GraphicsContext3DPrivate::addActiveGraphicsContext(GraphicsContext3D* context)
-{
-    static bool addedAtExitHandler = false;
-    if (!addedAtExitHandler) {
-        atexit(&GraphicsContext3DPrivate::cleanupActiveContextsAtExit);
-        addedAtExitHandler = true;
-    }
-    activeGraphicsContexts().append(context);
-}
-
-void GraphicsContext3DPrivate::removeActiveGraphicsContext(GraphicsContext3D* context)
-{
-    if (cleaningUpAtExit)
-        return;
-
-    Vector<GraphicsContext3D*>& contexts = activeGraphicsContexts();
-    size_t location = contexts.find(context);
-    if (location != WTF::notFound)
-        contexts.remove(location);
-}
-
-void GraphicsContext3DPrivate::cleanupActiveContextsAtExit()
-{
-    cleaningUpAtExit = true;
-
-    Vector<GraphicsContext3D*>& contexts = activeGraphicsContexts();
-    for (size_t i = 0; i < contexts.size(); i++)
-        contexts[i]->~GraphicsContext3D();
-
-    if (!gSharedDisplay)
-        return;
-    XCloseDisplay(gSharedDisplay);
-    gSharedDisplay = 0;
-}
-
-PassOwnPtr<GraphicsContext3DPrivate> GraphicsContext3DPrivate::create()
-{
-    if (!sharedDisplay())
-        return nullptr;
-
-    static bool initialized = false;
-    static bool success = true;
-    if (!initialized) {
-        success = initializeOpenGLShims();
-        initialized = true;
-    }
-    if (!success)
-        return nullptr;
-
-    GraphicsContext3DPrivate* internal = createPbufferContext();
-    if (!internal)
-        internal = createPixmapContext();
-    if (!internal)
-        return nullptr;
-
-    // The GraphicsContext3D constructor requires that this context is the current OpenGL context.
-    internal->makeContextCurrent();
-    return adoptPtr(internal);
-}
-
-GraphicsContext3DPrivate* GraphicsContext3DPrivate::createPbufferContext()
-{
-    int fbConfigAttributes[] = {
-        GLX_DRAWABLE_TYPE, GLX_PBUFFER_BIT,
-        GLX_RENDER_TYPE, GLX_RGBA_BIT,
-        GLX_RED_SIZE, 1,
-        GLX_GREEN_SIZE, 1,
-        GLX_BLUE_SIZE, 1,
-        GLX_ALPHA_SIZE, 1,
-        GLX_DEPTH_SIZE, 1,
-        GLX_STENCIL_SIZE, 1,
-        GLX_SAMPLE_BUFFERS, 1,
-        GLX_DOUBLEBUFFER, GL_FALSE,
-        GLX_SAMPLES, 4,
-        0
-    };
-    int returnedElements;
-    GLXFBConfig* configs = glXChooseFBConfig(sharedDisplay(), 0, fbConfigAttributes, &returnedElements);
-    if (!configs) {
-        fbConfigAttributes[20] = 0; // Attempt without anti-aliasing.
-        configs = glXChooseFBConfig(sharedDisplay(), 0, fbConfigAttributes, &returnedElements);
-    }
-    if (!returnedElements) {
-        XFree(configs);
-        return 0;
-    }
-
-    // We will be rendering to a texture, so our pbuffer does not need to be large.
-    static const int pbufferAttributes[] = { GLX_PBUFFER_WIDTH, 1, GLX_PBUFFER_HEIGHT, 1, 0 };
-    GLXPbuffer pbuffer = glXCreatePbuffer(sharedDisplay(), configs[0], pbufferAttributes);
-    if (!pbuffer) {
-        XFree(configs);
-        return 0;
-    }
-
-    GLXContext context = glXCreateNewContext(sharedDisplay(), configs[0], GLX_RGBA_TYPE, 0, GL_TRUE);
-    XFree(configs);
-    if (!context)
-        return 0;
-    return new GraphicsContext3DPrivate(context, pbuffer);
-}
-
-GraphicsContext3DPrivate* GraphicsContext3DPrivate::createPixmapContext()
-{
-    static int visualAttributes[] = {
-        GLX_RGBA,
-        GLX_RED_SIZE, 1,
-        GLX_GREEN_SIZE, 1,
-        GLX_BLUE_SIZE, 1,
-        GLX_ALPHA_SIZE, 1,
-        GLX_DOUBLEBUFFER,
-        0
-    };
-
-    XVisualInfo* visualInfo = glXChooseVisual(sharedDisplay(), DefaultScreen(sharedDisplay()), visualAttributes);
-    if (!visualInfo)
-        return 0;
- 
-    GLXContext context = glXCreateContext(sharedDisplay(), visualInfo, 0, GL_TRUE);
-    if (!context) {
-        XFree(visualInfo);
-        return 0;
-    }
-
-    Pixmap pixmap = XCreatePixmap(sharedDisplay(), DefaultRootWindow(sharedDisplay()), 1, 1, visualInfo->depth);
-    if (!pixmap) {
-        XFree(visualInfo);
-        return 0;
-    }
-
-    GLXPixmap glxPixmap = glXCreateGLXPixmap(sharedDisplay(), visualInfo, pixmap);
-    if (!glxPixmap) {
-        XFreePixmap(sharedDisplay(), pixmap);
-        XFree(visualInfo);
-        return 0;
-    }
-
-    return new GraphicsContext3DPrivate(context, pixmap, glxPixmap);
-}
-
-GraphicsContext3DPrivate::GraphicsContext3DPrivate(GLXContext context, GLXPbuffer pbuffer)
-    : m_context(context)
-    , m_pbuffer(pbuffer)
-    , m_pixmap(0)
-    , m_glxPixmap(0)
-{
-}
-
-GraphicsContext3DPrivate::GraphicsContext3DPrivate(GLXContext context, Pixmap pixmap, GLXPixmap glxPixmap)
-    : m_context(context)
-    , m_pbuffer(0)
-    , m_pixmap(pixmap)
-    , m_glxPixmap(glxPixmap)
-{
-}
-
-GraphicsContext3DPrivate::~GraphicsContext3DPrivate()
-{
-    if (m_context) {
-        // This may be necessary to prevent crashes with NVidia's closed source drivers. Originally
-        // from Mozilla's 3D canvas implementation at: http://bitbucket.org/ilmari/canvas3d/
-        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, 0);
-
-        ::glXMakeContextCurrent(sharedDisplay(), 0, 0, 0);
-        ::glXDestroyContext(sharedDisplay(), m_context);
-        m_context = 0;
-    }
-
-    if (m_pbuffer) {
-        ::glXDestroyPbuffer(sharedDisplay(), m_pbuffer);
-        m_pbuffer = 0;
-    }
-    if (m_glxPixmap) {
-        glXDestroyGLXPixmap(sharedDisplay(), m_glxPixmap);
-        m_glxPixmap = 0;
-    }
-    if (m_pixmap) {
-        XFreePixmap(sharedDisplay(), m_pixmap);
-        m_pixmap = 0;
-    }
-}
-
-bool GraphicsContext3DPrivate::makeContextCurrent()
-{
-    if (::glXGetCurrentContext() == m_context)
-        return true;
-    if (!m_context)
-        return false;
-    if (m_pbuffer)
-        return ::glXMakeCurrent(sharedDisplay(), m_pbuffer, m_context);
-
-    ASSERT(m_glxPixmap);
-    return ::glXMakeCurrent(sharedDisplay(), m_glxPixmap, m_context);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE_WEBGL
diff --git a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
index a77345caa..24af3d8c9 100644
--- a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
+++ b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
@@ -38,6 +38,7 @@ GraphicsContext3D* SharedGraphicsContext3D::get()
     attributes.antialias = false;
     attributes.canRecoverFromContextLoss = false; // Canvas contexts can not handle lost contexts.
     attributes.shareResources = true;
+    attributes.preferDiscreteGPU = true;
     static GraphicsContext3D* context = GraphicsContext3D::create(attributes, 0).leakRef();
     if (context && !context->makeContextCurrent())
         context = 0;
diff --git a/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp
index 2427c06b2..b8538707c 100644
--- a/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp
@@ -19,6 +19,7 @@
 
 #include "config.h"
 #include "GRefPtrGStreamer.h"
+#include "GStreamerVersioning.h"
 
 #if USE(GSTREAMER)
 #include <gst/gstelement.h>
@@ -33,10 +34,8 @@ template <> GRefPtr<GstElement> adoptGRef(GstElement* ptr)
 
 template <> GstElement* refGPtr<GstElement>(GstElement* ptr)
 {
-    if (ptr) {
-        gst_object_ref(GST_OBJECT(ptr));
-        gst_object_sink(GST_OBJECT(ptr));
-    }
+    if (ptr)
+        webkitGstObjectRefSink(GST_OBJECT(ptr));
 
     return ptr;
 }
@@ -55,10 +54,9 @@ template <> GRefPtr<GstPad> adoptGRef(GstPad* ptr)
 
 template <> GstPad* refGPtr<GstPad>(GstPad* ptr)
 {
-    if (ptr) {
-        gst_object_ref(GST_OBJECT(ptr));
-        gst_object_sink(GST_OBJECT(ptr));
-    }
+    if (ptr)
+        webkitGstObjectRefSink(GST_OBJECT(ptr));
+
     return ptr;
 }
 
@@ -76,10 +74,9 @@ template <> GRefPtr<GstPadTemplate> adoptGRef(GstPadTemplate* ptr)
 
 template <> GstPadTemplate* refGPtr<GstPadTemplate>(GstPadTemplate* ptr)
 {
-    if (ptr) {
-        gst_object_ref(GST_OBJECT(ptr));
-        gst_object_sink(GST_OBJECT(ptr));
-    }
+    if (ptr)
+        webkitGstObjectRefSink(GST_OBJECT(ptr));
+
     return ptr;
 }
 
@@ -111,10 +108,8 @@ template <> GRefPtr<GstTask> adoptGRef(GstTask* ptr)
 
 template <> GstTask* refGPtr<GstTask>(GstTask* ptr)
 {
-    if (ptr) {
-        gst_object_ref(GST_OBJECT(ptr));
-        gst_object_sink(GST_OBJECT(ptr));
-    }
+    if (ptr)
+        webkitGstObjectRefSink(GST_OBJECT(ptr));
 
     return ptr;
 }
diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp b/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp
index 45363422a..fa088df2a 100644
--- a/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 #include "GStreamerGWorld.h"
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include "GRefPtrGStreamer.h"
 #include <gst/gst.h>
@@ -216,4 +216,4 @@ void GStreamerGWorld::setWindowOverlay(GstMessage* message)
 }
 
 }
-#endif // USE(GSTREAMER)
+#endif // ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h b/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h
index 74ca84cdb..e7862dea5 100644
--- a/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h
@@ -20,7 +20,7 @@
 
 #ifndef GStreamerGWorld_h
 #define GStreamerGWorld_h
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include "GOwnPtr.h"
 #include "PlatformVideoWindow.h"
@@ -65,5 +65,5 @@ private:
 };
 
 }
-#endif // USE(GSTREAMER)
+#endif // ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 #endif
diff --git a/Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.cpp b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.cpp
index 5c4e69756..d4238c1e5 100644
--- a/Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2011 Igalia S.L.
+ * Copyright (C) 2012 Igalia, S.L.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -18,39 +18,33 @@
  */
 
 #include "config.h"
-#include "WebFullScreenManagerGtk.h"
 
-#if ENABLE(FULLSCREEN_API)
+#include "GStreamerVersioning.h"
 
-#include <WebCore/NotImplemented.h>
-
-namespace WebKit {
-
-WebFullScreenManagerGtk::WebFullScreenManagerGtk(WebPage* page)
-    : WebFullScreenManager(page)
+void webkitGstObjectRefSink(GstObject* gstObject)
 {
+#ifdef GST_API_VERSION_1
+    gst_object_ref_sink(gstObject);
+#else
+    gst_object_ref(gstObject);
+    gst_object_sink(gstObject);
+#endif
 }
 
-PassRefPtr<WebFullScreenManager> WebFullScreenManager::create(WebPage* page)
+GstCaps* webkitGstElementGetPadCaps(GstElement* element, const char* direction)
 {
-    return adoptRef(new WebFullScreenManagerGtk(page));
+    GstPad* pad = gst_element_get_static_pad(element, direction);
+    if (!pad)
+        return 0;
+
+    GstCaps* caps;
+#ifdef GST_API_VERSION_1
+    caps = gst_pad_get_current_caps(pad);
+    if (!caps)
+        caps = gst_pad_query_caps(pad, 0);
+#else
+    caps = GST_PAD_CAPS(pad);
+#endif
+    gst_object_unref(GST_OBJECT(pad));
+    return caps;
 }
-
-void WebFullScreenManagerGtk::setRootFullScreenLayer(WebCore::GraphicsLayer* layer)
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerGtk::beginEnterFullScreenAnimation(float duration)
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerGtk::beginExitFullScreenAnimation(float duration)
-{
-    notImplemented();
-}
-
-} // namespace WebKit
-
-#endif // ENABLE(FULLSCREEN_API)
diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h
new file mode 100644
index 000000000..faadc2667
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2012 Igalia, S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef GStreamerVersioning_h
+#define GStreamerVersioning_h
+
+#include <gst/gst.h>
+
+void webkitGstObjectRefSink(GstObject*);
+GstCaps* webkitGstElementGetPadCaps(GstElement*, const char*);
+
+#endif // GStreamerVersioning_h
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index fd90fa9a6..03066dc97 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -30,8 +30,8 @@
 #include "Document.h"
 #include "Frame.h"
 #include "FrameView.h"
-#include "GRefPtrGStreamer.h"
 #include "GStreamerGWorld.h"
+#include "GStreamerVersioning.h"
 #include "GraphicsContext.h"
 #include "GraphicsTypes.h"
 #include "ImageGStreamer.h"
@@ -46,12 +46,17 @@
 #include "WebKitWebSourceGStreamer.h"
 #include <GOwnPtr.h>
 #include <gst/gst.h>
-#include <gst/interfaces/streamvolume.h>
 #include <gst/video/video.h>
 #include <limits>
 #include <math.h>
 #include <wtf/text/CString.h>
 
+#ifdef GST_API_VERSION_1
+#include <gst/audio/streamvolume.h>
+#else
+#include <gst/interfaces/streamvolume.h>
+#endif
+
 // GstPlayFlags flags from playbin2. It is the policy of GStreamer to
 // not publicly expose element-specific enums. That's why this
 // GstPlayFlags enum has been copied here.
@@ -67,6 +72,12 @@ typedef enum {
     GST_PLAY_FLAG_BUFFERING     = 0x000000100
 } GstPlayFlags;
 
+#ifdef GST_API_VERSION_1
+static const char* gPlaybinName = "playbin";
+#else
+static const char* gPlaybinName = "playbin2";
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -186,7 +197,7 @@ bool MediaPlayerPrivateGStreamer::isAvailable()
     if (!doGstInit())
         return false;
 
-    GstElementFactory* factory = gst_element_factory_find("playbin2");
+    GstElementFactory* factory = gst_element_factory_find(gPlaybinName);
     if (factory) {
         gst_object_unref(GST_OBJECT(factory));
         return true;
@@ -250,11 +261,6 @@ MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer()
         m_mediaLocations = 0;
     }
 
-    if (m_source) {
-        gst_object_unref(m_source);
-        m_source = 0;
-    }
-
     if (m_videoSinkBin) {
         gst_object_unref(m_videoSinkBin);
         m_videoSinkBin = 0;
@@ -400,7 +406,12 @@ float MediaPlayerPrivateGStreamer::duration() const
     GstFormat timeFormat = GST_FORMAT_TIME;
     gint64 timeLength = 0;
 
-    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeFormat != GST_FORMAT_TIME || static_cast<guint64>(timeLength) == GST_CLOCK_TIME_NONE) {
+#ifdef GST_API_VERSION_1
+    bool failure = !gst_element_query_duration(m_playBin, timeFormat, &timeLength) || static_cast<guint64>(timeLength) == GST_CLOCK_TIME_NONE;
+#else
+    bool failure = !gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeFormat != GST_FORMAT_TIME || static_cast<guint64>(timeLength) == GST_CLOCK_TIME_NONE;
+#endif
+    if (failure) {
         LOG_VERBOSE(Media, "Time duration query failed.");
         return numeric_limits<float>::infinity();
     }
@@ -489,12 +500,10 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
     if (!hasVideo())
         return IntSize();
 
-    GRefPtr<GstPad> pad = adoptGRef(gst_element_get_static_pad(m_webkitVideoSink, "sink"));
-    if (!pad)
+    GstCaps* caps = webkitGstElementGetPadCaps(m_webkitVideoSink, "sink");
+    if (!caps)
         return IntSize();
 
-    guint64 width = 0, height = 0;
-    GstCaps* caps = GST_PAD_CAPS(pad.get());
     int pixelAspectRatioNumerator, pixelAspectRatioDenominator;
     int displayWidth, displayHeight, displayAspectRatioGCD;
     int originalWidth = 0, originalHeight = 0;
@@ -506,11 +515,23 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
 
     // Get the video PAR and original size, if this fails the
     // video-sink has likely not yet negotiated its caps.
+#ifdef GST_API_VERSION_1
+    GstVideoInfo info;
+    if (!gst_video_info_from_caps(&info, caps))
+        return IntSize();
+
+    originalWidth = GST_VIDEO_INFO_WIDTH(&info);
+    originalHeight = GST_VIDEO_INFO_HEIGHT(&info);
+    pixelAspectRatioNumerator = GST_VIDEO_INFO_PAR_N(&info);
+    pixelAspectRatioDenominator = GST_VIDEO_INFO_PAR_D(&info);
+#else
+    // Get the video PAR and original size.
     if (!GST_IS_CAPS(caps) || !gst_caps_is_fixed(caps)
         || !gst_video_format_parse_caps(caps, 0, &originalWidth, &originalHeight)
         || !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
                                                     &pixelAspectRatioDenominator))
         return IntSize();
+#endif
 
     LOG_VERBOSE(Media, "Original video size: %dx%d", originalWidth, originalHeight);
     LOG_VERBOSE(Media, "Pixel aspect ratio: %d/%d", pixelAspectRatioNumerator, pixelAspectRatioDenominator);
@@ -525,6 +546,7 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
     displayHeight /= displayAspectRatioGCD;
 
     // Apply DAR to original video size. This is the same behavior as in xvimagesink's setcaps function.
+    guint64 width = 0, height = 0;
     if (!(originalHeight % displayHeight)) {
         LOG_VERBOSE(Media, "Keeping video original height");
         width = gst_util_uint64_scale_int(originalHeight, displayWidth, displayHeight);
@@ -929,27 +951,42 @@ unsigned MediaPlayerPrivateGStreamer::totalBytes() const
 
     GstFormat fmt = GST_FORMAT_BYTES;
     gint64 length = 0;
-    if (gst_element_query_duration(m_source, &fmt, &length)) {
+#ifdef GST_API_VERSION_1
+    if (gst_element_query_duration(m_source.get(), fmt, &length)) {
+#else
+    if (gst_element_query_duration(m_source.get(), &fmt, &length)) {
+#endif
         LOG_VERBOSE(Media, "totalBytes %" G_GINT64_FORMAT, length);
         return static_cast<unsigned>(length);
     }
 
     // Fall back to querying the source pads manually.
     // See also https://bugzilla.gnome.org/show_bug.cgi?id=638749
-    GstIterator* iter = gst_element_iterate_src_pads(m_source);
+    GstIterator* iter = gst_element_iterate_src_pads(m_source.get());
     bool done = false;
     while (!done) {
+#ifdef GST_API_VERSION_1
+        GValue item = {0, };
+        switch (gst_iterator_next(iter, &item)) {
+        case GST_ITERATOR_OK: {
+            GstPad* pad = static_cast<GstPad*>(g_value_get_object(&item));
+            gint64 padLength = 0;
+            if (gst_pad_query_duration(pad, fmt, &padLength) && padLength > length)
+                length = padLength;
+            break;
+        }
+#else
         gpointer data;
 
         switch (gst_iterator_next(iter, &data)) {
         case GST_ITERATOR_OK: {
             GRefPtr<GstPad> pad = adoptGRef(GST_PAD_CAST(data));
             gint64 padLength = 0;
-            if (gst_pad_query_duration(pad.get(), &fmt, &padLength)
-                && padLength > length)
+            if (gst_pad_query_duration(pad.get(), &fmt, &padLength) && padLength > length)
                 length = padLength;
             break;
         }
+#endif
         case GST_ITERATOR_RESYNC:
             gst_iterator_resync(iter);
             break;
@@ -959,7 +996,12 @@ unsigned MediaPlayerPrivateGStreamer::totalBytes() const
             done = true;
             break;
         }
+
+#ifdef GST_API_VERSION_1
+        g_value_unset(&item);
+#endif
     }
+
     gst_iterator_free(iter);
 
     LOG_VERBOSE(Media, "totalBytes %" G_GINT64_FORMAT, length);
@@ -988,7 +1030,7 @@ unsigned MediaPlayerPrivateGStreamer::audioDecodedByteCount() const
     GstQuery* query = gst_query_new_position(GST_FORMAT_BYTES);
     gint64 position = 0;
 
-    if (m_webkitAudioSink && gst_element_query(m_webkitAudioSink, query))
+    if (m_webkitAudioSink && gst_element_query(m_webkitAudioSink.get(), query))
         gst_query_parse_position(query, 0, &position);
 
     gst_query_unref(query);
@@ -1012,30 +1054,23 @@ void MediaPlayerPrivateGStreamer::updateAudioSink()
     if (!m_playBin)
         return;
 
-    GRefPtr<GstElement> element;
     GstElement* sinkPtr = 0;
 
     g_object_get(m_playBin, "audio-sink", &sinkPtr, NULL);
-    element = adoptGRef(sinkPtr);
+    m_webkitAudioSink = adoptGRef(sinkPtr);
 
-    gst_object_replace(reinterpret_cast<GstObject**>(&m_webkitAudioSink),
-                       reinterpret_cast<GstObject*>(element.get()));
 }
 
 
 void MediaPlayerPrivateGStreamer::sourceChanged()
 {
-    GRefPtr<GstElement> element;
     GstElement* srcPtr = 0;
 
     g_object_get(m_playBin, "source", &srcPtr, NULL);
-    element = adoptGRef(srcPtr);
-
-    gst_object_replace(reinterpret_cast<GstObject**>(&m_source),
-                       reinterpret_cast<GstObject*>(element.get()));
+    m_source = adoptGRef(srcPtr);
 
-    if (WEBKIT_IS_WEB_SRC(element.get()))
-        webKitWebSrcSetMediaPlayer(WEBKIT_WEB_SRC(element.get()), m_player);
+    if (WEBKIT_IS_WEB_SRC(m_source.get()))
+        webKitWebSrcSetMediaPlayer(WEBKIT_WEB_SRC(m_source.get()), m_player);
 }
 
 void MediaPlayerPrivateGStreamer::cancelLoad()
@@ -1536,6 +1571,12 @@ static HashSet<String> mimeTypeCache()
                     cached = true;
                 }
 
+                if (g_str_equal(name, "audio/x-flac")) {
+                    cache.add(String("audio/flac"));
+                    cache.add(String("audio/x-flac"));
+                    cached = true;
+                }
+
                 if (g_str_equal(name, "audio/mpeg")) {
                     cache.add(String(name));
                     cache.add(String("audio/x-mpeg"));
@@ -1644,8 +1685,10 @@ bool MediaPlayerPrivateGStreamer::supportsFullscreen() const
 PlatformMedia MediaPlayerPrivateGStreamer::platformMedia() const
 {
     PlatformMedia p;
+#ifndef GST_API_VERSION_1
     p.type = PlatformMedia::GStreamerGWorldType;
     p.media.gstreamerGWorld = m_gstGWorld.get();
+#endif
     return p;
 }
 
@@ -1671,9 +1714,11 @@ void MediaPlayerPrivateGStreamer::setPreload(MediaPlayer::Preload preload)
 void MediaPlayerPrivateGStreamer::createGSTPlayBin()
 {
     ASSERT(!m_playBin);
-    m_playBin = gst_element_factory_make("playbin2", "play");
+    m_playBin = gst_element_factory_make(gPlaybinName, "play");
 
+#ifndef GST_API_VERSION_1
     m_gstGWorld = GStreamerGWorld::createGWorld(m_playBin);
+#endif
 
     GstBus* bus = gst_pipeline_get_bus(GST_PIPELINE(m_playBin));
     gst_bus_add_signal_watch(bus);
@@ -1692,7 +1737,10 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
 
     g_signal_connect(m_webkitVideoSink, "repaint-requested", G_CALLBACK(mediaPlayerPrivateRepaintCallback), this);
 
+
+#ifndef GST_API_VERSION_1
     m_videoSinkBin = gst_bin_new("sink");
+
     GstElement* videoTee = gst_element_factory_make("tee", "videoTee");
     GstElement* queue = gst_element_factory_make("queue", 0);
 
@@ -1710,6 +1758,7 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
     GRefPtr<GstPad> srcPad = adoptGRef(gst_element_get_request_pad(videoTee, "src%d"));
     GRefPtr<GstPad> sinkPad = adoptGRef(gst_element_get_static_pad(queue, "sink"));
     gst_pad_link(srcPad.get(), sinkPad.get());
+#endif
 
     GstElement* actualVideoSink = 0;
     m_fpsSink = gst_element_factory_make("fpsdisplaysink", "sink");
@@ -1728,7 +1777,9 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
 
             if (g_object_class_find_property(G_OBJECT_GET_CLASS(m_fpsSink), "video-sink")) {
                 g_object_set(m_fpsSink, "video-sink", m_webkitVideoSink, NULL);
+#ifndef GST_API_VERSION_1
                 gst_bin_add(GST_BIN(m_videoSinkBin), m_fpsSink);
+#endif
                 actualVideoSink = m_fpsSink;
             } else
                 m_fpsSink = 0;
@@ -1737,12 +1788,15 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
     }
 
     if (!m_fpsSink) {
+#ifndef GST_API_VERSION_1
         gst_bin_add(GST_BIN(m_videoSinkBin), m_webkitVideoSink);
+#endif
         actualVideoSink = m_webkitVideoSink;
     }
 
     ASSERT(actualVideoSink);
 
+#ifndef GST_API_VERSION_1
     // Faster elements linking.
     gst_element_link_pads_full(queue, "src", actualVideoSink, "sink", GST_PAD_LINK_CHECK_NOTHING);
 
@@ -1752,10 +1806,13 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
 
     // Set the bin as video sink of playbin.
     g_object_set(m_playBin, "video-sink", m_videoSinkBin, NULL);
+#else
+    g_object_set(m_playBin, "video-sink", actualVideoSink, NULL);
+#endif
 
-    pad = adoptGRef(gst_element_get_static_pad(m_webkitVideoSink, "sink"));
-    if (pad)
-        g_signal_connect(pad.get(), "notify::caps", G_CALLBACK(mediaPlayerPrivateVideoSinkCapsChangedCallback), this);
+    GRefPtr<GstPad> videoSinkPad = adoptGRef(gst_element_get_static_pad(m_webkitVideoSink, "sink"));
+    if (videoSinkPad)
+        g_signal_connect(videoSinkPad.get(), "notify::caps", G_CALLBACK(mediaPlayerPrivateVideoSinkCapsChangedCallback), this);
 
 }
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
index b08881483..1b0ff26e6 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
@@ -24,12 +24,13 @@
 #define MediaPlayerPrivateGStreamer_h
 #if ENABLE(VIDEO) && USE(GSTREAMER)
 
-#include <wtf/Forward.h>
+#include "GRefPtrGStreamer.h"
 #include "MediaPlayerPrivate.h"
 #include "Timer.h"
 
 #include <glib.h>
 #include <gst/gst.h>
+#include <wtf/Forward.h>
 
 typedef struct _WebKitVideoSink WebKitVideoSink;
 typedef struct _GstBuffer GstBuffer;
@@ -154,7 +155,7 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             GstElement* m_webkitVideoSink;
             GstElement* m_videoSinkBin;
             GstElement* m_fpsSink;
-            GstElement* m_source;
+            GRefPtr<GstElement> m_source;
             float m_seekTime;
             bool m_changingRate;
             float m_endTime;
@@ -180,14 +181,16 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             MediaPlayer::Preload m_preload;
             bool m_delayingLoad;
             bool m_mediaDurationKnown;
+#ifndef GST_API_VERSION_1
             RefPtr<GStreamerGWorld> m_gstGWorld;
+#endif
             guint m_volumeTimerHandler;
             guint m_muteTimerHandler;
             bool m_hasVideo;
             bool m_hasAudio;
             guint m_audioTimerHandler;
             guint m_videoTimerHandler;
-            GstElement* m_webkitAudioSink;
+            GRefPtr<GstElement> m_webkitAudioSink;
     };
 }
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h
index 1d36c1ec5..2f8d365ff 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h
@@ -19,7 +19,7 @@
 
 #ifndef PlatformVideoWindow_h
 #define PlatformVideoWindow_h
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include "Widget.h"
 #include <wtf/PassRefPtr.h>
@@ -61,5 +61,5 @@ class PlatformVideoWindow : public RefCounted<PlatformVideoWindow> {
     };
 }
 
-#endif // USE(GSTREAMER)
+#endif // USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 #endif
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp
index 009771675..4a3d10d8a 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 #include "PlatformVideoWindow.h"
-#if USE(GSTREAMER)
+#if USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include "NotImplemented.h"
 
@@ -39,4 +39,4 @@ void PlatformVideoWindow::prepareForOverlay(GstMessage*)
 {
 }
 
-#endif // USE(GSTREAMER)
+#endif // USE(GSTREAMER) && !defined(GST_API_VERSION_1)
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp
index ee688c540..b83881112 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 #include "PlatformVideoWindow.h"
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include <gtk/gtk.h>
 
@@ -65,5 +65,5 @@ PlatformVideoWindow::~PlatformVideoWindow()
 void PlatformVideoWindow::prepareForOverlay(GstMessage*)
 {
 }
-#endif // USE(GSTREAMER)
+#endif // ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowMac.mm b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowMac.mm
index e98cf9bc8..952fb7f61 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowMac.mm
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowMac.mm
@@ -20,7 +20,7 @@
 #include "config.h"
 #include "PlatformVideoWindow.h"
 
-#if USE(GSTREAMER)
+#if USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include <gst/gst.h>
 
@@ -46,4 +46,4 @@ void PlatformVideoWindow::prepareForOverlay(GstMessage* message)
     }
 }
 
-#endif // USE(GSTREAMER)
+#endif // USE(GSTREAMER) && !defined(GST_API_VERSION_1)
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
index 06a792505..506a59d1f 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
@@ -19,6 +19,7 @@
 
 #include "config.h"
 #include "PlatformVideoWindow.h"
+#if ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include "HTMLVideoElement.h"
 #include "PlatformVideoWindowPrivate.h"
@@ -150,3 +151,4 @@ PlatformVideoWindow::~PlatformVideoWindow()
 void PlatformVideoWindow::prepareForOverlay(GstMessage*)
 {
 }
+#endif // ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
diff --git a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
index 2fc00581a..2a0af0c86 100644
--- a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
@@ -580,7 +580,7 @@ static gboolean webKitWebSrcSetUri(GstURIHandler* handler, const gchar* uri, GEr
 
     KURL url(KURL(), uri);
 
-    if (!url.isValid() || !url.protocolInHTTPFamily()) {
+    if (!url.isValid() || !url.protocolIsInHTTPFamily()) {
         g_set_error(error, GST_URI_ERROR, GST_URI_ERROR_BAD_URI, "Invalid URI '%s'", uri);
         return FALSE;
     }
@@ -624,7 +624,7 @@ static gboolean webKitWebSrcSetUri(GstURIHandler* handler, const gchar* uri)
 
     KURL url(KURL(), uri);
 
-    if (!url.isValid() || !url.protocolInHTTPFamily()) {
+    if (!url.isValid() || !url.protocolIsInHTTPFamily()) {
         GST_ERROR_OBJECT(src, "Invalid URI '%s'", uri);
         return FALSE;
     }
diff --git a/Source/WebCore/platform/graphics/gtk/GLContextGtk.cpp b/Source/WebCore/platform/graphics/gtk/GLContextGtk.cpp
new file mode 100644
index 000000000..6b2461a03
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gtk/GLContextGtk.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Igalia, S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "GLContext.h"
+
+#include <gdk/gdk.h>
+#include <gdk/gdkx.h>
+#include <gtk/gtk.h>
+
+namespace WebCore {
+
+typedef HashMap<GtkWidget*, OwnPtr<GLContext> > WindowContextMap;
+static WindowContextMap& windowContextsMap()
+{
+    DEFINE_STATIC_LOCAL(WindowContextMap, windowContexts, ());
+    return windowContexts;
+}
+
+static void shutdownGLContext(GtkWidget* widget, void*)
+{
+    WindowContextMap& windowContexts = windowContextsMap();
+    WindowContextMap::iterator i = windowContexts.find(widget);
+    if (i != windowContexts.end())
+        windowContexts.remove(i);
+}
+
+GLContext* GLContext::getContextForWidget(GtkWidget* widget)
+{
+    ASSERT(widget);
+
+    WindowContextMap& windowContexts = windowContextsMap();
+    WindowContextMap::iterator i = windowContextsMap().find(widget);
+    if (i != windowContexts.end())
+        return i->second.get();
+
+    // It's important that this context doesn't hang around after the window
+    // is unmapped, so we make sure to clean it up once that happens.
+    if (!g_signal_handler_find(widget, G_SIGNAL_MATCH_FUNC, 0, 0, 0, reinterpret_cast<void*>(shutdownGLContext), 0))
+        g_signal_connect(widget, "unmap", G_CALLBACK(shutdownGLContext), 0);
+
+    // If this GDK window doesn't have its own native window then, we don't want
+    // to use it for rendering, since we'll be drawing over some other widget's area.
+    GdkWindow* gdkWindow = gtk_widget_get_window(widget);
+    GLContext* context = gdkWindow && gdk_window_has_native(gdkWindow) ?  createContext(GDK_WINDOW_XID(gdkWindow)) : createContext(0);
+
+    if (!context)
+        return 0;
+
+    windowContexts.set(widget, adoptPtr(context));
+    return context;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/gtk/WindowGLContext.h b/Source/WebCore/platform/graphics/gtk/WindowGLContext.h
deleted file mode 100644
index 962356835..000000000
--- a/Source/WebCore/platform/graphics/gtk/WindowGLContext.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2012 Igalia S.L.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free
- *  Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301 USA
- */
-
-#ifndef WindowGLContext_h
-#define WindowGLContext_h
-
-#include <wtf/Noncopyable.h>
-#include <wtf/PassOwnPtr.h>
-
-#if defined(XP_UNIX)
-typedef struct __GLXcontextRec* GLXContext;
-typedef struct _XDisplay Display;
-#endif
-
-namespace WebCore {
-
-class WindowGLContext {
-    WTF_MAKE_NONCOPYABLE(WindowGLContext);
-public:
-    static PassOwnPtr<WindowGLContext> createContextWithGdkWindow(GdkWindow*);
-    virtual ~WindowGLContext();
-    void startDrawing();
-    void finishDrawing();
-
-private:
-    WindowGLContext(GdkWindow*);
-    GdkWindow* m_window;
-
-#if defined(XP_UNIX)
-    GLXContext m_context;
-    Display* m_display;
-    bool m_needToCloseDisplay;
-#endif
-};
-
-}
-
-#endif // WindowGLContext_h
diff --git a/Source/WebCore/platform/graphics/gtk/WindowGLContextGLX.cpp b/Source/WebCore/platform/graphics/gtk/WindowGLContextGLX.cpp
deleted file mode 100644
index c16a4f41b..000000000
--- a/Source/WebCore/platform/graphics/gtk/WindowGLContextGLX.cpp
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright (C) 2012 Igalia, S.L.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include "config.h"
-#include "WindowGLContext.h"
-
-#include <GL/glx.h>
-#include <gdk/gdk.h>
-#include <gdk/gdkx.h>
-#include <wtf/OwnPtr.h>
-
-namespace WebCore {
-
-PassOwnPtr<WindowGLContext> WindowGLContext::createContextWithGdkWindow(GdkWindow* window)
-{
-    OwnPtr<WindowGLContext> context = adoptPtr(new WindowGLContext(window));
-    if (!context->m_context)
-        return nullptr;
-    return context.release();
-}
-
-WindowGLContext::WindowGLContext(GdkWindow* window)
-    : m_window(window)
-    , m_context(0)
-    , m_display(0)
-    , m_needToCloseDisplay(0)
-{
-    GdkDisplay* gdkDisplay = gdk_window_get_display(m_window);
-    if (gdkDisplay)
-        m_display = GDK_DISPLAY_XDISPLAY(gdkDisplay);
-    else {
-        m_display = XOpenDisplay(0);
-        m_needToCloseDisplay = true;
-    }
-
-    XWindowAttributes attributes;
-    if (!XGetWindowAttributes(m_display, GDK_WINDOW_XID(m_window), &attributes))
-        return;
-
-    XVisualInfo visualInfo;
-    visualInfo.visualid = XVisualIDFromVisual(attributes.visual);
-
-    int numReturned = 0;
-    XVisualInfo* visualInfoList = XGetVisualInfo(m_display, VisualIDMask, &visualInfo, &numReturned);
-    m_context = glXCreateContext(m_display, visualInfoList, 0, True);
-    XFree(visualInfoList);
-}
-
-WindowGLContext::~WindowGLContext()
-{
-    if (!m_context)
-        return;
-    glXMakeCurrent(m_display, None, None);
-    glXDestroyContext(m_display, m_context);
-
-    if (m_needToCloseDisplay)
-        XCloseDisplay(m_display);
-}
-
-void WindowGLContext::startDrawing()
-{
-    glXMakeCurrent(m_display, GDK_WINDOW_XID(m_window), m_context);
-}
-
-void WindowGLContext::finishDrawing()
-{
-    glXSwapBuffers(m_display, GDK_WINDOW_XID(m_window));
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
index 29c061238..5002fdf6f 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
@@ -42,8 +42,12 @@ namespace WebCore {
 
 HarfBuzzShaperBase::HarfBuzzShaperBase(const Font* font, const TextRun& run)
     : m_font(font)
+    , m_normalizedBufferLength(0)
     , m_run(run)
     , m_wordSpacingAdjustment(font->wordSpacing())
+    , m_padding(0)
+    , m_padPerWordBreak(0)
+    , m_padError(0)
     , m_letterSpacing(font->letterSpacing())
 {
 }
@@ -64,7 +68,7 @@ static void normalizeSpacesAndMirrorChars(const UChar* source, UChar* destinatio
         else if (normalizeMode == HarfBuzzShaperBase::NormalizeMirrorChars)
             character = u_charMirror(character);
         U16_APPEND(destination, position, length, character, error);
-        ASSERT(!error);
+        ASSERT_UNUSED(error, !error);
         position = nextPosition;
     }
 }
diff --git a/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp b/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp
index b0838e153..edf630892 100644
--- a/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp
+++ b/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp
@@ -48,13 +48,13 @@ static CVReturn displayLinkCallback(CVDisplayLinkRef, const CVTimeStamp* now, co
  
 DisplayRefreshMonitor::~DisplayRefreshMonitor()
 {
-    cancelCallOnMainThread(DisplayRefreshMonitor::refreshDisplayOnMainThread, this);
-    
     if (m_displayLink) {
         CVDisplayLinkStop(m_displayLink);
         CVDisplayLinkRelease(m_displayLink);
         m_displayLink = 0;
     }
+
+    cancelCallOnMainThread(DisplayRefreshMonitor::refreshDisplayOnMainThread, this);
 }
 
 bool DisplayRefreshMonitor::requestRefreshCallback()
diff --git a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index 54c03f879..8f4a9193e 100644
--- a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -57,7 +57,7 @@ const float smallCapsFontSizeMultiplier = 0.7f;
 static bool fontHasVerticalGlyphs(CTFontRef ctFont)
 {
     // The check doesn't look neat but this is what AppKit does for vertical writing...
-    RetainPtr<CFArrayRef> tableTags(AdoptCF, CTFontCopyAvailableTables(ctFont, kCTFontTableOptionExcludeSynthetic));
+    RetainPtr<CFArrayRef> tableTags(AdoptCF, CTFontCopyAvailableTables(ctFont, kCTFontTableOptionNoOptions));
     CFIndex numTables = CFArrayGetCount(tableTags.get());
     for (CFIndex index = 0; index < numTables; ++index) {
         CTFontTableTag tag = (CTFontTableTag)(uintptr_t)CFArrayGetValueAtIndex(tableTags.get(), index);
@@ -72,7 +72,6 @@ static bool initFontData(SimpleFontData* fontData)
     if (!fontData->platformData().cgFont())
         return false;
 
-
     return true;
 }
 
diff --git a/Source/WebCore/platform/graphics/mac/WebLayer.mm b/Source/WebCore/platform/graphics/mac/WebLayer.mm
index 277104148..1dbd72b37 100644
--- a/Source/WebCore/platform/graphics/mac/WebLayer.mm
+++ b/Source/WebCore/platform/graphics/mac/WebLayer.mm
@@ -35,6 +35,7 @@
 #import <objc/objc-runtime.h>
 #import <QuartzCore/QuartzCore.h>
 #import <wtf/UnusedParam.h>
+#import "WebCoreSystemInterface.h"
 
 @interface CALayer(WebCoreCALayerPrivate)
 - (void)reloadValueForKeyPath:(NSString *)keyPath;
@@ -76,9 +77,25 @@ void drawLayerContents(CGContextRef context, CALayer *layer, WebCore::PlatformCA
     
     // It's important to get the clip from the context, because it may be significantly
     // smaller than the layer bounds (e.g. tiled layers)
-    CGRect clipBounds = CGContextGetClipBoundingBox(context);
+    FloatRect clipBounds = CGContextGetClipBoundingBox(context);
+
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    __block GraphicsContext* ctx = &graphicsContext;
+
+    wkCALayerEnumerateRectsBeingDrawnWithBlock(layer, context, ^(CGRect rect){
+        FloatRect rectBeingDrawn(rect);
+        rectBeingDrawn.intersect(clipBounds);
+        
+        GraphicsContextStateSaver stateSaver(*ctx);
+        ctx->clip(rectBeingDrawn);
+        
+        layerContents->platformCALayerPaintContents(*ctx, enclosingIntRect(rectBeingDrawn));
+    });
+
+#else
     IntRect clip(enclosingIntRect(clipBounds));
     layerContents->platformCALayerPaintContents(graphicsContext, clip);
+#endif
 
     [NSGraphicsContext restoreGraphicsState];
 
@@ -194,14 +211,14 @@ void drawLayerContents(CGContextRef context, CALayer *layer, WebCore::PlatformCA
     CGRect aBounds = [self bounds];
     CGPoint aPos = [self position];
 
-    NSString* selfString = [NSString stringWithFormat:@"%@<%@ 0x%08x> \"%@\" bounds(%.1f, %.1f, %.1f, %.1f) pos(%.1f, %.1f), sublayers=%d masking=%d",
+    NSString* selfString = [NSString stringWithFormat:@"%@<%@ 0x%p> \"%@\" bounds(%.1f, %.1f, %.1f, %.1f) pos(%.1f, %.1f), sublayers=%lu masking=%d",
             inPrefix,
             [self class],
             self,
             [self name],
             aBounds.origin.x, aBounds.origin.y, aBounds.size.width, aBounds.size.height, 
             aPos.x, aPos.y,
-            [[self sublayers] count],
+            static_cast<unsigned long>([[self sublayers] count]),
             [self masksToBounds]];
     
     NSMutableString* curDesc = [NSMutableString stringWithString:selfString];
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
index b6410f61c..596b2fa3f 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
@@ -98,6 +98,9 @@ bool Extensions3DOpenGL::supports(const String& name)
     if (name == "GL_OES_standard_derivatives")
         return true;
 
+    if (name == "GL_EXT_texture_filter_anisotropic")
+        return m_availableExtensions.contains("GL_EXT_texture_filter_anisotropic");
+
     return m_availableExtensions.contains(name);
 }
 
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
index 8c002facc..7c477786e 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
@@ -135,7 +135,12 @@ void GraphicsContext3D::resolveMultisamplingIfNecessary(const IntRect& rect)
 {
     ::glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
     ::glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
-    ::glBlitFramebufferEXT(rect.x(), rect.y(), rect.maxX(), rect.maxY(), rect.x(), rect.y(), rect.maxX(), rect.maxY(), GL_COLOR_BUFFER_BIT, GL_LINEAR);
+
+    IntRect resolveRect = rect;
+    if (rect.isEmpty())
+        resolveRect = IntRect(0, 0, m_currentWidth, m_currentHeight);
+
+    ::glBlitFramebufferEXT(resolveRect.x(), resolveRect.y(), resolveRect.maxX(), resolveRect.maxY(), resolveRect.x(), resolveRect.y(), resolveRect.maxX(), resolveRect.maxY(), GL_COLOR_BUFFER_BIT, GL_LINEAR);
 }
 
 void GraphicsContext3D::renderbufferStorage(GC3Denum target, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height)
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
index 03d4a32cc..9123ed0b2 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
@@ -168,7 +168,7 @@ void GraphicsContext3D::prepareTexture()
 
     makeContextCurrent();
     if (m_attrs.antialias)
-        resolveMultisamplingIfNecessary(IntRect(0, 0, m_currentWidth, m_currentHeight));
+        resolveMultisamplingIfNecessary();
 
     ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
     ::glActiveTexture(GL_TEXTURE0);
@@ -191,7 +191,7 @@ void GraphicsContext3D::readRenderingResults(unsigned char *pixels, int pixelsSi
 
     bool mustRestoreFBO = false;
     if (m_attrs.antialias) {
-        resolveMultisamplingIfNecessary(IntRect(0, 0, m_currentWidth, m_currentHeight));
+        resolveMultisamplingIfNecessary();
         ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
         mustRestoreFBO = true;
     } else {
@@ -907,7 +907,7 @@ void GraphicsContext3D::uniform1f(GC3Dint location, GC3Dfloat v0)
     ::glUniform1f(location, v0);
 }
 
-void GraphicsContext3D::uniform1fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform1fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     makeContextCurrent();
     ::glUniform1fv(location, size, array);
@@ -919,7 +919,7 @@ void GraphicsContext3D::uniform2f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1)
     ::glUniform2f(location, v0, v1);
 }
 
-void GraphicsContext3D::uniform2fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform2fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 2.
     makeContextCurrent();
@@ -932,7 +932,7 @@ void GraphicsContext3D::uniform3f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1,
     ::glUniform3f(location, v0, v1, v2);
 }
 
-void GraphicsContext3D::uniform3fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform3fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 3.
     makeContextCurrent();
@@ -945,7 +945,7 @@ void GraphicsContext3D::uniform4f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1,
     ::glUniform4f(location, v0, v1, v2, v3);
 }
 
-void GraphicsContext3D::uniform4fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform4fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 4.
     makeContextCurrent();
@@ -958,7 +958,7 @@ void GraphicsContext3D::uniform1i(GC3Dint location, GC3Dint v0)
     ::glUniform1i(location, v0);
 }
 
-void GraphicsContext3D::uniform1iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform1iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     makeContextCurrent();
     ::glUniform1iv(location, size, array);
@@ -970,7 +970,7 @@ void GraphicsContext3D::uniform2i(GC3Dint location, GC3Dint v0, GC3Dint v1)
     ::glUniform2i(location, v0, v1);
 }
 
-void GraphicsContext3D::uniform2iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform2iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     // FIXME: length needs to be a multiple of 2.
     makeContextCurrent();
@@ -983,7 +983,7 @@ void GraphicsContext3D::uniform3i(GC3Dint location, GC3Dint v0, GC3Dint v1, GC3D
     ::glUniform3i(location, v0, v1, v2);
 }
 
-void GraphicsContext3D::uniform3iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform3iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     // FIXME: length needs to be a multiple of 3.
     makeContextCurrent();
@@ -996,28 +996,28 @@ void GraphicsContext3D::uniform4i(GC3Dint location, GC3Dint v0, GC3Dint v1, GC3D
     ::glUniform4i(location, v0, v1, v2, v3);
 }
 
-void GraphicsContext3D::uniform4iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform4iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     // FIXME: length needs to be a multiple of 4.
     makeContextCurrent();
     ::glUniform4iv(location, size, array);
 }
 
-void GraphicsContext3D::uniformMatrix2fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix2fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 4.
     makeContextCurrent();
     ::glUniformMatrix2fv(location, size, transpose, array);
 }
 
-void GraphicsContext3D::uniformMatrix3fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix3fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 9.
     makeContextCurrent();
     ::glUniformMatrix3fv(location, size, transpose, array);
 }
 
-void GraphicsContext3D::uniformMatrix4fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix4fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 16.
     makeContextCurrent();
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index 80591e9c4..7005785c0 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -1087,7 +1087,7 @@ void GraphicsContext3D::uniform1f(GC3Dint location, GC3Dfloat v0)
     glUniform1f(location, v0);
 }
 
-void GraphicsContext3D::uniform1fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform1fv(GC3Dint location, GGC3Dsizei size, C3Dfloat* array)
 {
     makeContextCurrent();
     glUniform1fv(location, size, array);
@@ -1099,7 +1099,7 @@ void GraphicsContext3D::uniform2f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1)
     glUniform2f(location, v0, v1);
 }
 
-void GraphicsContext3D::uniform2fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform2fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniform2fv(location, size, array);
@@ -1111,7 +1111,7 @@ void GraphicsContext3D::uniform3f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1,
     glUniform3f(location, v0, v1, v2);
 }
 
-void GraphicsContext3D::uniform3fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform3fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniform3fv(location, size, array);
@@ -1123,7 +1123,7 @@ void GraphicsContext3D::uniform4f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1,
     glUniform4f(location, v0, v1, v2, v3);
 }
 
-void GraphicsContext3D::uniform4fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform4fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniform4fv(location, size, array);
@@ -1135,7 +1135,7 @@ void GraphicsContext3D::uniform1i(GC3Dint location, GC3Dint v0)
     glUniform1i(location, v0);
 }
 
-void GraphicsContext3D::uniform1iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform1iv(GC3Dint location, GGC3Dsizei size, C3Dint* array)
 {
     makeContextCurrent();
     glUniform1iv(location, size, array);
@@ -1147,7 +1147,7 @@ void GraphicsContext3D::uniform2i(GC3Dint location, GC3Dint v0, GC3Dint v1)
     glUniform2i(location, v0, v1);
 }
 
-void GraphicsContext3D::uniform2iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform2iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     makeContextCurrent();
     glUniform2iv(location, size, array);
@@ -1159,7 +1159,7 @@ void GraphicsContext3D::uniform3i(GC3Dint location, GC3Dint v0, GC3Dint v1, GC3D
     glUniform3i(location, v0, v1, v2);
 }
 
-void GraphicsContext3D::uniform3iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform3iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     makeContextCurrent();
     glUniform3iv(location, size, array);
@@ -1171,25 +1171,25 @@ void GraphicsContext3D::uniform4i(GC3Dint location, GC3Dint v0, GC3Dint v1, GC3D
     glUniform4i(location, v0, v1, v2, v3);
 }
 
-void GraphicsContext3D::uniform4iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform4iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     makeContextCurrent();
     glUniform4iv(location, size, array);
 }
 
-void GraphicsContext3D::uniformMatrix2fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix2fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniformMatrix2fv(location, size, transpose, array);
 }
 
-void GraphicsContext3D::uniformMatrix3fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix3fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniformMatrix3fv(location, size, transpose, array);
 }
 
-void GraphicsContext3D::uniformMatrix4fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix4fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniformMatrix4fv(location, size, transpose, array);
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index d07d732b4..aa49e2ddf 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -1068,12 +1068,14 @@ void GraphicsContext::beginPlatformTransparencyLayer(float opacity)
     w = device->width();
     h = device->height();
 
-    QRectF clip = m_data->clipBoundingRect();
-    QRectF deviceClip = p->transform().mapRect(clip);
-    x = int(qBound(qreal(0), deviceClip.x(), (qreal)w));
-    y = int(qBound(qreal(0), deviceClip.y(), (qreal)h));
-    w = int(qBound(qreal(0), deviceClip.width(), (qreal)w) + 2);
-    h = int(qBound(qreal(0), deviceClip.height(), (qreal)h) + 2);
+    if (p->hasClipping()) {
+        QRectF clip = m_data->clipBoundingRect();
+        QRectF deviceClip = p->transform().mapRect(clip);
+        x = int(qBound(qreal(0), deviceClip.x(), (qreal)w));
+        y = int(qBound(qreal(0), deviceClip.y(), (qreal)h));
+        w = int(qBound(qreal(0), deviceClip.width(), (qreal)w) + 2);
+        h = int(qBound(qreal(0), deviceClip.height(), (qreal)h) + 2);
+    }
 
     QPixmap emptyAlphaMask;
     m_data->layers.push(new TransparencyLayer(p, QRect(x, y, w, h), opacity, emptyAlphaMask));
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index 15f89b7ae..44f860af2 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -109,11 +109,6 @@ ImageBuffer::~ImageBuffer()
 {
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    return m_size.width() * m_size.height() * 4;
-}
-
 GraphicsContext* ImageBuffer::context() const
 {
     ASSERT(m_data.m_painter->isActive());
diff --git a/Source/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp b/Source/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
index 6a5735b3d..7ff432b17 100644
--- a/Source/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
@@ -50,6 +50,22 @@ TransformationMatrix::TransformationMatrix(const QTransform& transform)
               transform.m31(), transform.m32(), 0, transform.m33());
 }
 
+TransformationMatrix::operator QMatrix4x4() const
+{
+    return QMatrix4x4(m11(), m12(), m13(), m14(),
+                      m21(), m22(), m23(), m24(),
+                      m31(), m32(), m33(), m34(),
+                      m41(), m42(), m43(), m44());
+}
+
+TransformationMatrix::TransformationMatrix(const QMatrix4x4& matrix)
+{
+    setMatrix(matrix(0, 0), matrix(1, 0), matrix(2, 0), matrix(3, 0),
+              matrix(0, 1), matrix(1, 1), matrix(2, 1), matrix(3, 1),
+              matrix(0, 2), matrix(1, 2), matrix(2, 2), matrix(3, 2),
+              matrix(0, 3), matrix(1, 3), matrix(2, 3), matrix(3, 3));
+}
+
 }
 
 // vim: ts=4 sw=4 et
diff --git a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index e0b52a318..0d379a42a 100644
--- a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -169,11 +169,6 @@ GraphicsContext* ImageBuffer::context() const
     return m_context.get();
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    return m_size.width() * m_size.height() * 4;
-}
-
 PassRefPtr<Image> ImageBuffer::copyImage(BackingStoreCopy copyBehavior) const
 {
     return BitmapImageSingleFrameSkia::create(*m_data.m_platformContext.bitmap(), copyBehavior == CopyBackingStore);
diff --git a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
index 21facaadb..5a4f1534c 100644
--- a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
@@ -147,7 +147,7 @@ static inline bool paintIsOpaque(const SkPaint& paint, const SkBitmap* bitmap =
     return true;
 }
 
-void OpaqueRegionSkia::didDrawRect(const PlatformContextSkia* context, const AffineTransform& transform, const SkRect& fillRect, const SkPaint& paint, const SkBitmap* bitmap)
+void OpaqueRegionSkia::didDrawRect(PlatformContextSkia* context, const AffineTransform& transform, const SkRect& fillRect, const SkPaint& paint, const SkBitmap* bitmap)
 {
     // Any stroking may put alpha in pixels even if the filling part does not.
     if (paint.getStyle() != SkPaint::kFill_Style) {
@@ -169,7 +169,7 @@ void OpaqueRegionSkia::didDrawRect(const PlatformContextSkia* context, const Aff
     didDraw(context, transform, fillRect, paint, opaque, fillsBounds);
 }
 
-void OpaqueRegionSkia::didDrawPath(const PlatformContextSkia* context, const AffineTransform& transform, const SkPath& path, const SkPaint& paint)
+void OpaqueRegionSkia::didDrawPath(PlatformContextSkia* context, const AffineTransform& transform, const SkPath& path, const SkPaint& paint)
 {
     SkRect rect;
     if (path.isRect(&rect)) {
@@ -188,7 +188,7 @@ void OpaqueRegionSkia::didDrawPath(const PlatformContextSkia* context, const Aff
     }
 }
 
-void OpaqueRegionSkia::didDrawPoints(const PlatformContextSkia* context, const AffineTransform& transform, SkCanvas::PointMode mode, int numPoints, const SkPoint points[], const SkPaint& paint)
+void OpaqueRegionSkia::didDrawPoints(PlatformContextSkia* context, const AffineTransform& transform, SkCanvas::PointMode mode, int numPoints, const SkPoint points[], const SkPaint& paint)
 {
     if (!numPoints)
         return;
@@ -217,7 +217,7 @@ void OpaqueRegionSkia::didDrawPoints(const PlatformContextSkia* context, const A
     }
 }
 
-void OpaqueRegionSkia::didDrawBounded(const PlatformContextSkia* context, const AffineTransform& transform, const SkRect& bounds, const SkPaint& paint)
+void OpaqueRegionSkia::didDrawBounded(PlatformContextSkia* context, const AffineTransform& transform, const SkRect& bounds, const SkPaint& paint)
 {
     bool opaque = paintIsOpaque(paint);
     bool fillsBounds = false;
@@ -231,10 +231,13 @@ void OpaqueRegionSkia::didDrawBounded(const PlatformContextSkia* context, const
     }
 }
 
-void OpaqueRegionSkia::didDraw(const PlatformContextSkia* context, const AffineTransform& transform, const SkRect& rect, const SkPaint& paint, bool drawsOpaque, bool fillsBounds)
+void OpaqueRegionSkia::didDraw(PlatformContextSkia* context, const AffineTransform& transform, const SkRect& rect, const SkPaint& paint, bool drawsOpaque, bool fillsBounds)
 {
     SkRect targetRect = rect;
 
+    bool xfersOpaque = xfermodeIsOpaque(paint, drawsOpaque);
+    bool preservesOpaque = xfermodePreservesOpaque(paint, drawsOpaque);
+
     // Apply the transform to device coordinate space.
     SkMatrix canvasTransform = context->canvas()->getTotalMatrix();
     if (!canvasTransform.mapRect(&targetRect))
@@ -249,17 +252,33 @@ void OpaqueRegionSkia::didDraw(const PlatformContextSkia* context, const AffineT
         if (!targetRect.intersect(SkIntToScalar(deviceClip.fLeft), SkIntToScalar(deviceClip.fTop), SkIntToScalar(deviceClip.fRight), SkIntToScalar(deviceClip.fBottom)))
             return;
     }
-    if (!context->clippedToImage().isOpaque())
-        fillsBounds = false;
+
+    // Apply any layers that we are drawing into.
+    for (SkCanvas::LayerIter it(context->canvas(), false); !it.done(); it.next()) {
+        // Apply the layer's clip (which is in device space)
+        const SkRegion& deviceLayerClip = it.clip();
+        if (deviceLayerClip.isEmpty() || !deviceLayerClip.isRect())
+            fillsBounds = false;
+        else {
+            SkIRect clipBounds = it.clip().getBounds();
+            if (!targetRect.intersect(SkIntToScalar(clipBounds.fLeft), SkIntToScalar(clipBounds.fTop), SkIntToScalar(clipBounds.fRight), SkIntToScalar(clipBounds.fBottom)))
+                return;
+        }
+
+        // Make sure the paint stays opaque through the layer.
+        bool drawsOpaque = paintIsOpaque(it.paint());
+        xfersOpaque = xfersOpaque && xfermodeIsOpaque(it.paint(), drawsOpaque);
+        preservesOpaque = preservesOpaque && xfermodePreservesOpaque(it.paint(), drawsOpaque);
+    }
 
     // Apply the transform to the tracking space.
     SkMatrix canvasToTargetTransform = transform;
     if (!canvasToTargetTransform.mapRect(&targetRect))
         fillsBounds = false;
 
-    if (fillsBounds && xfermodeIsOpaque(paint, drawsOpaque))
+    if (fillsBounds && xfersOpaque)
         markRectAsOpaque(targetRect);
-    else if (SkRect::Intersects(targetRect, m_opaqueRect) && !xfermodePreservesOpaque(paint, drawsOpaque))
+    else if (SkRect::Intersects(targetRect, m_opaqueRect) && !preservesOpaque)
         markRectAsNonOpaque(targetRect);
 }
 
@@ -339,4 +358,5 @@ void OpaqueRegionSkia::markRectAsNonOpaque(const SkRect& rect)
         m_opaqueRect = vertical;
 }
 
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.h b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.h
index 45b069004..431c6ec19 100644
--- a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.h
+++ b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.h
@@ -53,13 +53,15 @@ public:
     // The resulting opaque region as a single rect.
     IntRect asRect() const;
 
-    void didDrawRect(const PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&, const SkBitmap*);
-    void didDrawPath(const PlatformContextSkia*, const AffineTransform&, const SkPath&, const SkPaint&);
-    void didDrawPoints(const PlatformContextSkia*, const AffineTransform&, SkCanvas::PointMode, int numPoints, const SkPoint[], const SkPaint&);
-    void didDrawBounded(const PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&);
+    // FIXME: make all the PlatformContextSkia* into a const pointer when Skia fixes LayerIter's SkCanvas*.
+
+    void didDrawRect(PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&, const SkBitmap*);
+    void didDrawPath(PlatformContextSkia*, const AffineTransform&, const SkPath&, const SkPaint&);
+    void didDrawPoints(PlatformContextSkia*, const AffineTransform&, SkCanvas::PointMode, int numPoints, const SkPoint[], const SkPaint&);
+    void didDrawBounded(PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&);
 
 private:
-    void didDraw(const PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&, bool drawsOpaque, bool fillsBounds);
+    void didDraw(PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&, bool drawsOpaque, bool fillsBounds);
     void didDrawUnbounded(const SkPaint&, bool drawsOpaque);
     void markRectAsOpaque(const SkRect&);
     void markRectAsNonOpaque(const SkRect&);
diff --git a/Source/WebCore/platform/graphics/skia/PatternSkia.cpp b/Source/WebCore/platform/graphics/skia/PatternSkia.cpp
index cd6a6676e..cc91c63da 100644
--- a/Source/WebCore/platform/graphics/skia/PatternSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PatternSkia.cpp
@@ -38,12 +38,18 @@
 #include "SkColorShader.h"
 #include "SkShader.h"
 
+#include <v8.h>
+
 namespace WebCore {
 
 void Pattern::platformDestroy()
 {
     SkSafeUnref(m_pattern);
     m_pattern = 0;
+    if (m_externalMemoryAllocated) {
+        v8::V8::AdjustAmountOfExternalAllocatedMemory(-m_externalMemoryAllocated);
+        m_externalMemoryAllocated = 0;
+    }
 }
 
 PlatformPatternPtr Pattern::platformPattern(const AffineTransform& patternTransform)
@@ -89,6 +95,9 @@ PlatformPatternPtr Pattern::platformPattern(const AffineTransform& patternTransf
         SkCanvas canvas(bm2);
         canvas.drawBitmap(image->bitmap(), 0, 0);
         m_pattern = SkShader::CreateBitmapShader(bm2, tileModeX, tileModeY);
+
+        m_externalMemoryAllocated = bm2.getSafeSize();
+        v8::V8::AdjustAmountOfExternalAllocatedMemory(m_externalMemoryAllocated);
     }
     m_pattern->setLocalMatrix(m_patternSpaceTransformation);
     return m_pattern;
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index 3a677e2b0..7ee90cadd 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -241,7 +241,7 @@ void PlatformContextSkia::beginLayerClippedToImage(const FloatRect& rect,
 
     canvas()->clipRect(bounds);
 
-    if (imageBuffer->size().isEmpty())
+    if (imageBuffer->internalSize().isEmpty())
         return;
 
     canvas()->saveLayerAlpha(&bounds, 255,
@@ -267,11 +267,6 @@ void PlatformContextSkia::clipPathAntiAliased(const SkPath& clipPath)
     canvas()->clipPath(clipPath, SkRegion::kIntersect_Op, true);
 }
 
-const SkBitmap& PlatformContextSkia::clippedToImage() const
-{
-    return m_state->m_imageBufferClip;
-}
-
 void PlatformContextSkia::restore()
 {
     if (!m_state->m_imageBufferClip.empty()) {
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
index b306450cb..8d7a2e684 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
@@ -100,8 +100,6 @@ public:
     // NOTE: |imageBuffer| may be deleted before the |restore| is invoked.
     void beginLayerClippedToImage(const FloatRect&, const ImageBuffer*);
     void clipPathAntiAliased(const SkPath&);
-    // If non-empty, the layer is clipped to the bitmap.
-    const SkBitmap& clippedToImage() const;
 
     // Sets up the common flags on a paint for antialiasing, effects, etc.
     // This is implicitly called by setupPaintFill and setupPaintStroke, but
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.h b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
index af2d59e7f..4c07cab63 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -20,8 +20,12 @@
 #ifndef TextureMapper_h
 #define TextureMapper_h
 
+#if PLATFORM(QT)
+#include <qglobal.h>
+#endif
+
 #if USE(ACCELERATED_COMPOSITING)
-#if (defined(QT_OPENGL_LIB))
+#if defined(QT_OPENGL_LIB) || (QT_VERSION >= QT_VERSION_CHECK(5, 0, 0))
     #if defined(QT_OPENGL_ES_2) && !defined(TEXMAP_OPENGL_ES_2)
         #define TEXMAP_OPENGL_ES_2
     #endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
index 746a1d89b..80cf9fa67 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
@@ -223,42 +223,6 @@ struct TextureMapperGLData {
     RefPtr<BitmapTexture> currentSurface;
 };
 
-class BitmapTextureGL : public BitmapTexture {
-public:
-    virtual void destroy();
-    virtual IntSize size() const;
-    virtual bool isValid() const;
-    virtual void didReset();
-    void bind();
-    void initializeStencil();
-    ~BitmapTextureGL() { destroy(); }
-    virtual uint32_t id() const { return m_id; }
-    inline FloatSize relativeSize() const { return m_relativeSize; }
-    void setTextureMapper(TextureMapperGL* texmap) { m_textureMapper = texmap; }
-    void updateContents(Image*, const IntRect&, const IntRect&, PixelFormat);
-    void updateContents(const void*, const IntRect&);
-
-private:
-    GLuint m_id;
-    FloatSize m_relativeSize;
-    IntSize m_textureSize;
-    IntRect m_dirtyRect;
-    GLuint m_fbo;
-    GLuint m_rbo;
-    bool m_surfaceNeedsReset;
-    TextureMapperGL* m_textureMapper;
-    BitmapTextureGL()
-        : m_id(0)
-        , m_fbo(0)
-        , m_rbo(0)
-        , m_surfaceNeedsReset(true)
-        , m_textureMapper(0)
-    {
-    }
-
-    friend class TextureMapperGL;
-};
-
 void TextureMapperGLData::initializeStencil()
 {
     if (currentSurface) {
@@ -354,15 +318,11 @@ void TextureMapperGL::drawTexture(const BitmapTexture& texture, const FloatRect&
 
 void TextureMapperGL::drawTexture(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture)
 {
+    RefPtr<TextureMapperShaderProgram> shaderInfo;
     if (maskTexture)
-        drawTextureWithMaskAndOpacity(texture, flags, relativeSize, targetRect, modelViewMatrix, opacity, maskTexture);
+        shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramOpacityAndMask>();
     else
-        drawTextureSimple(texture, flags, relativeSize, targetRect, modelViewMatrix, opacity, maskTexture);
-}
-
-void TextureMapperGL::drawTextureWithMaskAndOpacity(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture)
-{
-    RefPtr<TextureMapperShaderProgramOpacityAndMask> shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramOpacityAndMask>();
+        shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramSimple>();
 
     GL_CMD(glUseProgram(shaderInfo->id()))
     GL_CMD(glEnableVertexAttribArray(shaderInfo->vertexAttrib()))
@@ -392,63 +352,10 @@ void TextureMapperGL::drawTextureWithMaskAndOpacity(uint32_t texture, Flags flag
     GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4))
     GL_CMD(glUniformMatrix4fv(shaderInfo->sourceMatrixVariable(), 1, GL_FALSE, m4src))
     GL_CMD(glUniform1i(shaderInfo->sourceTextureVariable(), 0))
-    GL_CMD(glUniform1f(shaderInfo->opacityVariable(), opacity))
-
-    if (maskTexture->isValid()) {
-        const BitmapTextureGL* maskTextureGL = static_cast<const BitmapTextureGL*>(maskTexture);
-        GL_CMD(glActiveTexture(GL_TEXTURE1))
-        GL_CMD(glBindTexture(GL_TEXTURE_2D, maskTextureGL->id()))
-        const GLfloat m4mask[] = {maskTextureGL->relativeSize().width(), 0, 0, 0,
-                                         0, maskTextureGL->relativeSize().height(), 0, 0,
-                                         0, 0, 1, 0,
-                                         0, 0, 0, 1};
-        GL_CMD(glUniformMatrix4fv(shaderInfo->maskMatrixVariable(), 1, GL_FALSE, m4mask));
-        GL_CMD(glUniform1i(shaderInfo->maskTextureVariable(), 1))
-        GL_CMD(glActiveTexture(GL_TEXTURE0))
-    }
-
-    GL_CMD(glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA))
-    GL_CMD(glEnable(GL_BLEND))
-
-    GL_CMD(glDrawArrays(GL_TRIANGLE_FAN, 0, 4))
-    GL_CMD(glDisableVertexAttribArray(shaderInfo->vertexAttrib()))
-}
-
-void TextureMapperGL::drawTextureSimple(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture*)
-{
-    RefPtr<TextureMapperShaderProgramSimple> shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramSimple>();
-
-    GL_CMD(glUseProgram(shaderInfo->id()))
-    GL_CMD(glEnableVertexAttribArray(shaderInfo->vertexAttrib()))
-    GL_CMD(glActiveTexture(GL_TEXTURE0))
-    GL_CMD(glBindTexture(GL_TEXTURE_2D, texture))
-    GL_CMD(glBindBuffer(GL_ARRAY_BUFFER, 0))
-    const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
-    GL_CMD(glVertexAttribPointer(shaderInfo->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, unitRect))
-
-    TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multiply(modelViewMatrix).multiply(TransformationMatrix(
-            targetRect.width(), 0, 0, 0,
-            0, targetRect.height(), 0, 0,
-            0, 0, 1, 0,
-            targetRect.x(), targetRect.y(), 0, 1));
 
-    const GLfloat m4[] = {
-        matrix.m11(), matrix.m12(), matrix.m13(), matrix.m14(),
-        matrix.m21(), matrix.m22(), matrix.m23(), matrix.m24(),
-        matrix.m31(), matrix.m32(), matrix.m33(), matrix.m34(),
-        matrix.m41(), matrix.m42(), matrix.m43(), matrix.m44()
-    };
-    const GLfloat m4src[] = {relativeSize.width(), 0, 0, 0,
-                                     0, relativeSize.height() * ((flags & ShouldFlipTexture) ? -1 : 1), 0, 0,
-                                     0, 0, 1, 0,
-                                     0, (flags & ShouldFlipTexture) ? relativeSize.height() : 0, 0, 1};
-
-    GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4))
-    GL_CMD(glUniformMatrix4fv(shaderInfo->sourceMatrixVariable(), 1, GL_FALSE, m4src))
-    GL_CMD(glUniform1i(shaderInfo->sourceTextureVariable(), 0))
-    GL_CMD(glUniform1f(shaderInfo->opacityVariable(), opacity))
+    shaderInfo->prepare(opacity, maskTexture);
 
-    bool needsBlending = (flags & SupportsBlending) || opacity < 0.99;
+    bool needsBlending = (flags & SupportsBlending) || opacity < 0.99 || maskTexture;
 
     if (needsBlending) {
         GL_CMD(glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA))
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
index 3e598904b..9e474015b 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
@@ -24,6 +24,7 @@
 
 #include "FloatQuad.h"
 #include "IntSize.h"
+#include "OpenGLShims.h"
 #include "TextureMapper.h"
 #include "TransformationMatrix.h"
 
@@ -31,6 +32,7 @@ namespace WebCore {
 
 class TextureMapperGLData;
 class GraphicsContext;
+class TextureMapperShaderProgram;
 
 // An OpenGL-ES2 implementation of TextureMapper.
 class TextureMapperGL : public TextureMapper {
@@ -48,8 +50,6 @@ public:
     // reimps from TextureMapper
     virtual void drawTexture(const BitmapTexture&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
     virtual void drawTexture(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
-    virtual void drawTextureWithMaskAndOpacity(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
-    virtual void drawTextureSimple(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
     virtual void bindSurface(BitmapTexture* surface);
     virtual void beginClip(const TransformationMatrix&, const FloatRect&);
     virtual void beginPainting();
@@ -73,6 +73,42 @@ private:
     friend class BitmapTextureGL;
 };
 
+class BitmapTextureGL : public BitmapTexture {
+public:
+    virtual void destroy();
+    virtual IntSize size() const;
+    virtual bool isValid() const;
+    virtual void didReset();
+    void bind();
+    void initializeStencil();
+    ~BitmapTextureGL() { destroy(); }
+    virtual uint32_t id() const { return m_id; }
+    inline FloatSize relativeSize() const { return m_relativeSize; }
+    void setTextureMapper(TextureMapperGL* texmap) { m_textureMapper = texmap; }
+    void updateContents(Image*, const IntRect&, const IntRect&, PixelFormat);
+    void updateContents(const void*, const IntRect&);
+
+private:
+    GLuint m_id;
+    FloatSize m_relativeSize;
+    IntSize m_textureSize;
+    IntRect m_dirtyRect;
+    GLuint m_fbo;
+    GLuint m_rbo;
+    bool m_surfaceNeedsReset;
+    TextureMapperGL* m_textureMapper;
+    BitmapTextureGL()
+        : m_id(0)
+        , m_fbo(0)
+        , m_rbo(0)
+        , m_surfaceNeedsReset(true)
+        , m_textureMapper(0)
+    {
+    }
+
+    friend class TextureMapperGL;
+};
+
 // An offscreen buffer to be rendered by software.
 static inline int nextPowerOfTwo(int num)
 {
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
index 0b363a33a..22e67df5b 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
@@ -32,7 +32,7 @@ public:
     static PassRefPtr<BitmapTexture> create() { return adoptRef(new BitmapTextureImageBuffer); }
     ~BitmapTextureImageBuffer() { destroy(); }
     virtual void destroy() { m_image.clear(); }
-    virtual IntSize size() const { return m_image->size(); }
+    virtual IntSize size() const { return m_image->internalSize(); }
     virtual void didReset();
     virtual bool isValid() const { return m_image; }
     inline GraphicsContext* graphicsContext() { return m_image ? m_image->context() : 0; }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
index 3eb34d16e..9e52ca2b1 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
@@ -22,6 +22,8 @@
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
 
+#include "TextureMapperGL.h"
+
 namespace WebCore {
 
 #ifndef TEXMAP_OPENGL_ES_2
@@ -144,16 +146,21 @@ TextureMapperShaderProgramSimple::TextureMapperShaderProgramSimple()
     getUniformLocation(m_opacityVariable, "Opacity");
 }
 
-const char* TextureMapperShaderProgramSimple::vertexShaderSource()
+const char* TextureMapperShaderProgramSimple::vertexShaderSource() const
 {
     return vertexShaderSourceSimple;
 }
 
-const char* TextureMapperShaderProgramSimple::fragmentShaderSource()
+const char* TextureMapperShaderProgramSimple::fragmentShaderSource() const
 {
     return fragmentShaderSourceSimple;
 }
 
+void TextureMapperShaderProgramSimple::prepare(float opacity, const BitmapTexture* maskTexture)
+{
+    glUniform1f(m_opacityVariable, opacity);
+}
+
 PassRefPtr<TextureMapperShaderProgramOpacityAndMask> TextureMapperShaderProgramOpacityAndMask::create()
 {
     return adoptRef(new TextureMapperShaderProgramOpacityAndMask());
@@ -170,16 +177,34 @@ TextureMapperShaderProgramOpacityAndMask::TextureMapperShaderProgramOpacityAndMa
     getUniformLocation(m_opacityVariable, "Opacity");
 }
 
-const char* TextureMapperShaderProgramOpacityAndMask::vertexShaderSource()
+const char* TextureMapperShaderProgramOpacityAndMask::vertexShaderSource() const
 {
     return vertexShaderSourceOpacityAndMask;
 }
 
-const char* TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource()
+const char* TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource() const
 {
     return fragmentShaderSourceOpacityAndMask;
 }
 
+void TextureMapperShaderProgramOpacityAndMask::prepare(float opacity, const BitmapTexture* maskTexture)
+{
+    glUniform1f(m_opacityVariable, opacity);
+    if (!maskTexture || !maskTexture->isValid())
+        return;
+
+    const BitmapTextureGL* maskTextureGL = static_cast<const BitmapTextureGL*>(maskTexture);
+    glActiveTexture(GL_TEXTURE1);
+    glBindTexture(GL_TEXTURE_2D, maskTextureGL->id());
+    const GLfloat m4mask[] = {maskTextureGL->relativeSize().width(), 0, 0, 0,
+                                     0, maskTextureGL->relativeSize().height(), 0, 0,
+                                     0, 0, 1, 0,
+                                     0, 0, 0, 1};
+    glUniformMatrix4fv(m_maskMatrixVariable, 1, GL_FALSE, m4mask);
+    glUniform1i(m_maskTextureVariable, 1);
+    glActiveTexture(GL_TEXTURE0);
+}
+
 TextureMapperShaderManager::TextureMapperShaderManager()
 {
     ASSERT(initializeOpenGLShims());
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
index 53aeaaacc..4502e7e3a 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
@@ -35,6 +35,7 @@ namespace WebCore {
 
 typedef void* ShaderType;
 
+class BitmapTexture;
 class TextureMapperShaderManager;
 
 class TextureMapperShaderProgram : public RefCounted<TextureMapperShaderProgram> {
@@ -51,57 +52,53 @@ public:
         return &type;
     }
 
+    virtual void prepare(float opacity, const BitmapTexture*) { }
+    GLint matrixVariable() const { return m_matrixVariable; }
+    GLint sourceMatrixVariable() const { return m_sourceMatrixVariable; }
+    GLint sourceTextureVariable() const { return m_sourceTextureVariable; }
+    GLint opacityVariable() const { return m_opacityVariable; }
+
 protected:
     void getUniformLocation(GLint& var, const char* name);
     void initializeProgram();
-    virtual const char* vertexShaderSource() = 0;
-    virtual const char* fragmentShaderSource() = 0;
+    virtual const char* vertexShaderSource() const = 0;
+    virtual const char* fragmentShaderSource() const = 0;
 
     GLuint m_id;
     GLuint m_vertexAttrib;
     GLuint m_vertexShader;
     GLuint m_fragmentShader;
+    GLint m_matrixVariable;
+    GLint m_sourceMatrixVariable;
+    GLint m_sourceTextureVariable;
+    GLint m_opacityVariable;
 };
 
 class TextureMapperShaderProgramSimple : public TextureMapperShaderProgram {
 public:
     static PassRefPtr<TextureMapperShaderProgramSimple> create();
-    GLint matrixVariable() { return m_matrixVariable; }
-    GLint sourceMatrixVariable() { return m_sourceMatrixVariable; }
-    GLint sourceTextureVariable() { return m_sourceTextureVariable; }
-    GLint opacityVariable() { return m_opacityVariable; }
+    virtual void prepare(float opacity, const BitmapTexture*);
 
 private:
-    virtual const char* vertexShaderSource();
-    virtual const char* fragmentShaderSource();
+    virtual const char* vertexShaderSource() const;
+    virtual const char* fragmentShaderSource() const;
     TextureMapperShaderProgramSimple();
-    GLint m_matrixVariable;
-    GLint m_sourceMatrixVariable;
-    GLint m_sourceTextureVariable;
-    GLint m_opacityVariable;
 };
 
 class TextureMapperShaderProgramOpacityAndMask : public TextureMapperShaderProgram {
 public:
     static PassRefPtr<TextureMapperShaderProgramOpacityAndMask> create();
-    GLint sourceMatrixVariable() { return m_sourceMatrixVariable; }
-    GLint matrixVariable() { return m_matrixVariable; }
-    GLint maskMatrixVariable() { return m_maskMatrixVariable; }
-    GLint sourceTextureVariable() { return m_sourceTextureVariable; }
-    GLint maskTextureVariable() { return m_maskTextureVariable; }
-    GLint opacityVariable() { return m_opacityVariable; }
+    virtual void prepare(float opacity, const BitmapTexture*);
+    GLint maskMatrixVariable() const { return m_maskMatrixVariable; }
+    GLint maskTextureVariable() const { return m_maskTextureVariable; }
 
 private:
     static int m_classID;
-    virtual const char* vertexShaderSource();
-    virtual const char* fragmentShaderSource();
+    virtual const char* vertexShaderSource() const;
+    virtual const char* fragmentShaderSource() const;
     TextureMapperShaderProgramOpacityAndMask();
-    GLint m_sourceMatrixVariable;
-    GLint m_matrixVariable;
     GLint m_maskMatrixVariable;
-    GLint m_sourceTextureVariable;
     GLint m_maskTextureVariable;
-    GLint m_opacityVariable;
 };
 
 class TextureMapperShaderManager {
diff --git a/Source/WebCore/platform/graphics/transforms/TransformState.cpp b/Source/WebCore/platform/graphics/transforms/TransformState.cpp
index f094c608d..a8fb8f32d 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformState.cpp
+++ b/Source/WebCore/platform/graphics/transforms/TransformState.cpp
@@ -49,7 +49,7 @@ TransformState& TransformState::operator=(const TransformState& other)
     return *this;
 }
 
-void TransformState::move(int x, int y, TransformAccumulation accumulate)
+void TransformState::move(LayoutUnit x, LayoutUnit y, TransformAccumulation accumulate)
 {
     if (m_accumulatingTransform && m_accumulatedTransform) {
         // If we're accumulating into an existing transform, apply the translation.
diff --git a/Source/WebCore/platform/graphics/transforms/TransformState.h b/Source/WebCore/platform/graphics/transforms/TransformState.h
index 7236010b2..c25d26619 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformState.h
+++ b/Source/WebCore/platform/graphics/transforms/TransformState.h
@@ -30,6 +30,7 @@
 #include "FloatPoint.h"
 #include "FloatQuad.h"
 #include "IntSize.h"
+#include "LayoutTypes.h"
 #include "TransformationMatrix.h"
 #include <wtf/OwnPtr.h>
 
@@ -74,12 +75,12 @@ public:
     
     void setQuad(const FloatQuad& quad) { m_lastPlanarQuad = quad; }
     
-    void move(const IntSize& s, TransformAccumulation accumulate = FlattenTransform)
+    void move(const LayoutSize& s, TransformAccumulation accumulate = FlattenTransform)
     {
         move(s.width(), s.height(), accumulate);
     }
     
-    void move(int x, int y, TransformAccumulation = FlattenTransform);
+    void move(LayoutUnit x, LayoutUnit y, TransformAccumulation = FlattenTransform);
     void applyTransform(const AffineTransform& transformFromContainer, TransformAccumulation = FlattenTransform);
     void applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation = FlattenTransform);
     void flatten();
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
index c21f6c1b7..1cf96f842 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
@@ -28,6 +28,7 @@
 #include "TransformationMatrix.h"
 
 #include "AffineTransform.h"
+#include "FractionalLayoutRect.h"
 #include "FloatPoint3D.h"
 #include "FloatRect.h"
 #include "FloatQuad.h"
@@ -587,10 +588,10 @@ FloatQuad TransformationMatrix::projectQuad(const FloatQuad& q) const
 static float clampEdgeValue(float f)
 {
     ASSERT(!isnan(f));
-    return min<float>(max<float>(f, -numeric_limits<int>::max() / 2), numeric_limits<int>::max() / 2);
+    return min<float>(max<float>(f, -numeric_limits<LayoutUnit>::max() / 2), numeric_limits<LayoutUnit>::max() / 2);
 }
 
-IntRect TransformationMatrix::clampedBoundsOfProjectedQuad(const FloatQuad& q) const
+LayoutRect TransformationMatrix::clampedBoundsOfProjectedQuad(const FloatQuad& q) const
 {
     FloatRect mappedQuadBounds = projectQuad(q).boundingBox();
 
@@ -599,18 +600,18 @@ IntRect TransformationMatrix::clampedBoundsOfProjectedQuad(const FloatQuad& q) c
 
     float right;
     if (isinf(mappedQuadBounds.x()) && isinf(mappedQuadBounds.width()))
-        right = numeric_limits<int>::max() / 2;
+        right = numeric_limits<LayoutUnit>::max() / 2;
     else
         right = clampEdgeValue(ceilf(mappedQuadBounds.maxX()));
 
     float bottom;
     if (isinf(mappedQuadBounds.y()) && isinf(mappedQuadBounds.height()))
-        bottom = numeric_limits<int>::max() / 2;
+        bottom = numeric_limits<LayoutUnit>::max() / 2;
     else
         bottom = clampEdgeValue(ceilf(mappedQuadBounds.maxY()));
     
-    return IntRect(clampToInteger(left), clampToInteger(top), 
-                   clampToInteger(right - left), clampToInteger(bottom - top));
+    return LayoutRect(clampToLayoutUnit(left), clampToLayoutUnit(top), 
+                      clampToLayoutUnit(right - left), clampToLayoutUnit(bottom - top));
 }
 
 FloatPoint TransformationMatrix::mapPoint(const FloatPoint& p) const
@@ -640,6 +641,11 @@ IntRect TransformationMatrix::mapRect(const IntRect &rect) const
     return enclosingIntRect(mapRect(FloatRect(rect)));
 }
 
+FractionalLayoutRect TransformationMatrix::mapRect(const FractionalLayoutRect& r) const
+{
+    return enclosingFractionalLayoutRect(mapRect(FloatRect(r)));
+}
+
 FloatRect TransformationMatrix::mapRect(const FloatRect& r) const
 {
     if (isIdentityOrTranslation()) {
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
index a98d70e03..5b5dad520 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -28,6 +28,7 @@
 
 #include "FloatPoint.h"
 #include "IntPoint.h"
+#include "LayoutTypes.h"
 #include <string.h> //for memcpy
 #include <wtf/FastAllocBase.h>
 
@@ -41,6 +42,7 @@ typedef struct CGAffineTransform CGAffineTransform;
 #elif PLATFORM(OPENVG)
 #include "VGUtils.h"
 #elif PLATFORM(QT)
+#include <QMatrix4x4>
 #include <QTransform>
 #elif USE(SKIA)
 #include <SkMatrix.h>
@@ -60,6 +62,7 @@ namespace WebCore {
 
 class AffineTransform;
 class IntRect;
+class FractionalLayoutRect;
 class FloatPoint3D;
 class FloatRect;
 class FloatQuad;
@@ -82,6 +85,7 @@ public:
 
 #if PLATFORM(QT)
     TransformationMatrix(const QTransform&);
+    TransformationMatrix(const QMatrix4x4&);
 #endif
 
     void setMatrix(double a, double b, double c, double d, double e, double f)
@@ -146,6 +150,7 @@ public:
     // Rounds the resulting mapped rectangle out. This is helpful for bounding
     // box computations but may not be what is wanted in other contexts.
     IntRect mapRect(const IntRect&) const;
+    FractionalLayoutRect mapRect(const FractionalLayoutRect&) const;
 
     // If the matrix has 3D components, the z component of the result is
     // dropped, effectively projecting the quad into the z=0 plane
@@ -161,7 +166,7 @@ public:
     FloatQuad projectQuad(const FloatQuad&) const;
     // Projects the four corners of the quad and takes a bounding box,
     // while sanitizing values created when the w component is negative.
-    IntRect clampedBoundsOfProjectedQuad(const FloatQuad&) const;
+    LayoutRect clampedBoundsOfProjectedQuad(const FloatQuad&) const;
 
     double m11() const { return m_matrix[0][0]; }
     void setM11(double f) { m_matrix[0][0] = f; }
@@ -328,6 +333,7 @@ public:
     operator VGMatrix() const;
 #elif PLATFORM(QT)
     operator QTransform() const;
+    operator QMatrix4x4() const;
 #elif USE(SKIA)
     operator SkMatrix() const;
 #elif PLATFORM(WX) && USE(WXGC)
diff --git a/Source/WebCore/platform/graphics/win/QTDecompressionSession.h b/Source/WebCore/platform/graphics/win/QTDecompressionSession.h
index 67b663588..98964b270 100644
--- a/Source/WebCore/platform/graphics/win/QTDecompressionSession.h
+++ b/Source/WebCore/platform/graphics/win/QTDecompressionSession.h
@@ -34,7 +34,7 @@
 
 #include "QTPixelBuffer.h"
 
-#include <WTF/PassOwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 class QTDecompressionSessionClient;
 typedef struct OpaqueICMDecompressionSession*  ICMDecompressionSessionRef;
diff --git a/Source/WebCore/platform/graphics/win/QTMovie.h b/Source/WebCore/platform/graphics/win/QTMovie.h
index 38b3473b1..3ab05065a 100644
--- a/Source/WebCore/platform/graphics/win/QTMovie.h
+++ b/Source/WebCore/platform/graphics/win/QTMovie.h
@@ -27,7 +27,8 @@
 #define QTMovie_h
 
 #include "QTTrack.h"
-#include <WTF/Vector.h>
+#include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
 
 #ifdef QTMOVIEWIN_EXPORTS
 #define QTMOVIEWIN_API __declspec(dllexport)
diff --git a/Source/WebCore/platform/graphics/win/QTMovieGWorld.h b/Source/WebCore/platform/graphics/win/QTMovieGWorld.h
index 495fe25f9..4f34c2cfc 100644
--- a/Source/WebCore/platform/graphics/win/QTMovieGWorld.h
+++ b/Source/WebCore/platform/graphics/win/QTMovieGWorld.h
@@ -28,9 +28,8 @@
 
 
 #include "QTMovie.h"
-#include <Unicode.h>
-#include <WTF/RefCounted.h>
-#include <WTF/RefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
 #include <windows.h>
 
 #ifdef QTMOVIEWIN_EXPORTS
diff --git a/Source/WebCore/platform/graphics/win/QTMovieTask.h b/Source/WebCore/platform/graphics/win/QTMovieTask.h
index e394d6ec9..93e221065 100644
--- a/Source/WebCore/platform/graphics/win/QTMovieTask.h
+++ b/Source/WebCore/platform/graphics/win/QTMovieTask.h
@@ -26,7 +26,7 @@
 #ifndef QTMovieTask_h
 #define QTMovieTask_h
 
-#include <WTF/HashSet.h>
+#include <wtf/HashSet.h>
 
 #ifdef QTMOVIEWIN_EXPORTS
 #define QTMOVIEWIN_API __declspec(dllexport)
diff --git a/Source/WebCore/platform/graphics/win/QTMovieVisualContext.h b/Source/WebCore/platform/graphics/win/QTMovieVisualContext.h
index 8410208e1..a813e3c6f 100644
--- a/Source/WebCore/platform/graphics/win/QTMovieVisualContext.h
+++ b/Source/WebCore/platform/graphics/win/QTMovieVisualContext.h
@@ -35,8 +35,8 @@
 #include "QTMovie.h"
 #include "QTMovieTask.h"
 #include "QTPixelBuffer.h"
-#include <WTF/OwnPtr.h>
-#include <WTF/RefCounted.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/RefCounted.h>
 
 typedef const struct __CFDictionary* CFDictionaryRef;
 typedef struct OpaqueQTVisualContext*   QTVisualContextRef;
diff --git a/Source/WebCore/platform/graphics/win/QTTrack.h b/Source/WebCore/platform/graphics/win/QTTrack.h
index bda56448d..516a4f22d 100644
--- a/Source/WebCore/platform/graphics/win/QTTrack.h
+++ b/Source/WebCore/platform/graphics/win/QTTrack.h
@@ -26,12 +26,10 @@
 #ifndef QTTrack_h
 #define QTTrack_h
 
-#include <Unicode.h>
 #include <windows.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
-// We must include this after <Unicode.h>, or the definition of OSErr will change:
 #include <CoreGraphics/CGAffineTransform.h>
 
 #ifdef QTMOVIEWIN_EXPORTS
diff --git a/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp b/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
index 606956763..b70782b82 100644
--- a/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
+++ b/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
@@ -34,6 +34,7 @@
 #include "Font.h"
 #include "FontCache.h"
 #include "FontDescription.h"
+#include "HWndDC.h"
 #include <cairo.h>
 #include <cairo-win32.h>
 #include <mlang.h>
@@ -55,27 +56,30 @@ void SimpleFontData::platformInit()
         m_fontMetrics.reset();
         m_avgCharWidth = 0;
         m_maxCharWidth = 0;
+        m_isSystemFont = false;
+        m_scriptCache = 0;
+        m_scriptFontProperties = 0;
         return;
     }
 
-    HDC hdc = GetDC(0);
-    SaveDC(hdc);
+    HWndDC dc(0);
+    SaveDC(dc);
 
     cairo_scaled_font_t* scaledFont = m_platformData.scaledFont();
     const double metricsMultiplier = cairo_win32_scaled_font_get_metrics_factor(scaledFont) * m_platformData.size();
 
-    cairo_win32_scaled_font_select_font(scaledFont, hdc);
+    cairo_win32_scaled_font_select_font(scaledFont, dc);
 
     TEXTMETRIC textMetrics;
-    GetTextMetrics(hdc, &textMetrics);
+    GetTextMetrics(dc, &textMetrics);
     float ascent = textMetrics.tmAscent * metricsMultiplier;
     float descent = textMetrics.tmDescent * metricsMultiplier;
     float xHeight = ascent * 0.56f; // Best guess for xHeight for non-Truetype fonts.
     float lineGap = textMetrics.tmExternalLeading * metricsMultiplier;
 
-    int faceLength = ::GetTextFace(hdc, 0, 0);
+    int faceLength = ::GetTextFace(dc, 0, 0);
     Vector<WCHAR> faceName(faceLength);
-    ::GetTextFace(hdc, faceLength, faceName.data());
+    ::GetTextFace(dc, faceLength, faceName.data());
     m_isSystemFont = !wcscmp(faceName.data(), L"Lucida Grande");
  
     ascent = ascentConsideringMacAscentHack(faceName.data(), ascent, descent);
@@ -87,21 +91,17 @@ void SimpleFontData::platformInit()
     m_avgCharWidth = textMetrics.tmAveCharWidth * metricsMultiplier;
     m_maxCharWidth = textMetrics.tmMaxCharWidth * metricsMultiplier;
 
-    OUTLINETEXTMETRIC metrics;
-    if (GetOutlineTextMetrics(hdc, sizeof(metrics), &metrics) > 0) {
-        // This is a TrueType font.  We might be able to get an accurate xHeight
-        GLYPHMETRICS gm;
-        MAT2 mat = { 1, 0, 0, 1 };
-        DWORD len = GetGlyphOutline(hdc, 'x', GGO_METRICS, &gm, 0, 0, &mat);
-        if (len != GDI_ERROR && gm.gmptGlyphOrigin.y > 0)
-            xHeight = gm.gmptGlyphOrigin.y * metricsMultiplier;
-    }
+    cairo_text_extents_t extents;
+    cairo_scaled_font_text_extents(scaledFont, "x", &extents);
+    xHeight = -extents.y_bearing;
 
     m_fontMetrics.setXHeight(xHeight);
     cairo_win32_scaled_font_done_font(scaledFont);
 
-    RestoreDC(hdc, -1);
-    ReleaseDC(0, hdc);
+    m_scriptCache = 0;
+    m_scriptFontProperties = 0;
+
+    RestoreDC(dc, -1);
 }
 
 FloatRect SimpleFontData::platformBoundsForGlyph(Glyph glyph) const
@@ -120,19 +120,18 @@ float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
     if (!m_platformData.size())
         return 0;
 
-    HDC hdc = GetDC(0);
-    SaveDC(hdc);
+    HWndDC dc(0);
+    SaveDC(dc);
 
     cairo_scaled_font_t* scaledFont = m_platformData.scaledFont();
-    cairo_win32_scaled_font_select_font(scaledFont, hdc);
+    cairo_win32_scaled_font_select_font(scaledFont, dc);
 
     int width;
-    GetCharWidthI(hdc, glyph, 1, 0, &width);
+    GetCharWidthI(dc, glyph, 1, 0, &width);
 
     cairo_win32_scaled_font_done_font(scaledFont);
 
-    RestoreDC(hdc, -1);
-    ReleaseDC(0, hdc);
+    RestoreDC(dc, -1);
 
     const double metricsMultiplier = cairo_win32_scaled_font_get_metrics_factor(scaledFont) * m_platformData.size();
     return width * metricsMultiplier;
diff --git a/Source/WebCore/platform/graphics/wince/ImageBufferWinCE.cpp b/Source/WebCore/platform/graphics/wince/ImageBufferWinCE.cpp
index 0d4e0ba60..bdbe62db9 100644
--- a/Source/WebCore/platform/graphics/wince/ImageBufferWinCE.cpp
+++ b/Source/WebCore/platform/graphics/wince/ImageBufferWinCE.cpp
@@ -88,11 +88,6 @@ ImageBuffer::~ImageBuffer()
 {
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    return m_size.width() * m_size.height() * 4;
-}
-
 GraphicsContext* ImageBuffer::context() const
 {
     return m_context.get();
diff --git a/Source/WebCore/platform/graphics/wx/ImageBufferWx.cpp b/Source/WebCore/platform/graphics/wx/ImageBufferWx.cpp
index 2dbb1961d..800bc8709 100644
--- a/Source/WebCore/platform/graphics/wx/ImageBufferWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/ImageBufferWx.cpp
@@ -48,12 +48,6 @@ ImageBuffer::~ImageBuffer()
 {
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    notImplemented();
-    return 0;
-}
-
 GraphicsContext* ImageBuffer::context() const
 {
     notImplemented();
diff --git a/Source/WebCore/platform/gtk/ClipboardGtk.cpp b/Source/WebCore/platform/gtk/ClipboardGtk.cpp
index b20216760..b22adf4a4 100644
--- a/Source/WebCore/platform/gtk/ClipboardGtk.cpp
+++ b/Source/WebCore/platform/gtk/ClipboardGtk.cpp
@@ -18,7 +18,6 @@
 #include "ClipboardGtk.h"
 
 #include "CachedImage.h"
-#include "DOMStringList.h"
 #include "DragData.h"
 #include "Editor.h"
 #include "Element.h"
@@ -143,13 +142,8 @@ void ClipboardGtk::clearAllData()
         PasteboardHelper::defaultPasteboardHelper()->writeClipboardContents(m_clipboard);
 }
 
-String ClipboardGtk::getData(const String& typeString, bool& success) const
+String ClipboardGtk::getData(const String& typeString) const
 {
-    success = true; // According to http://www.whatwg.org/specs/web-apps/current-work/multipage/dnd.html
-    // "The getData(format) method must return the data that is associated with the type format converted
-    // to ASCII lowercase, if any, and must return the empty string otherwise." Since success == false 
-    // results in an 'undefined' return value, we always want to return success == true. This parameter
-    // should eventually be removed.
     if (policy() != ClipboardReadable || !m_dataObject)
         return String();
 
@@ -190,33 +184,33 @@ bool ClipboardGtk::setData(const String& typeString, const String& data)
     return success;
 }
 
-PassRefPtr<DOMStringList> ClipboardGtk::types() const
+HashSet<String> ClipboardGtk::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return DOMStringList::create();
+        return HashSet<String>();
 
     if (m_clipboard)
         PasteboardHelper::defaultPasteboardHelper()->getClipboardContents(m_clipboard);
 
-    RefPtr<DOMStringList> types = DOMStringList::create();
+    HashSet<String> types;
     if (m_dataObject->hasText()) {
-        types->append("text/plain");
-        types->append("Text");
-        types->append("text");
+        types.add("text/plain");
+        types.add("Text");
+        types.add("text");
     }
 
     if (m_dataObject->hasMarkup())
-        types->append("text/html");
+        types.add("text/html");
 
     if (m_dataObject->hasURIList()) {
-        types->append("text/uri-list");
-        types->append("URL");
+        types.add("text/uri-list");
+        types.add("URL");
     }
 
     if (m_dataObject->hasFilenames())
-        types->append("Files");
+        types.add("Files");
 
-    return types.release();
+    return types;
 }
 
 PassRefPtr<FileList> ClipboardGtk::files() const
diff --git a/Source/WebCore/platform/gtk/ClipboardGtk.h b/Source/WebCore/platform/gtk/ClipboardGtk.h
index b72e1c81b..9af53e5f5 100644
--- a/Source/WebCore/platform/gtk/ClipboardGtk.h
+++ b/Source/WebCore/platform/gtk/ClipboardGtk.h
@@ -54,10 +54,10 @@ namespace WebCore {
 
         void clearData(const String&);
         void clearAllData();
-        String getData(const String&, bool&) const;
+        String getData(const String&) const;
         bool setData(const String&, const String&);
 
-        virtual PassRefPtr<DOMStringList> types() const;
+        virtual HashSet<String> types() const;
         virtual PassRefPtr<FileList> files() const;
 
         void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/gtk/RunLoopGtk.cpp b/Source/WebCore/platform/gtk/RunLoopGtk.cpp
index 929a7b98e..e6ee6c0f5 100644
--- a/Source/WebCore/platform/gtk/RunLoopGtk.cpp
+++ b/Source/WebCore/platform/gtk/RunLoopGtk.cpp
@@ -27,43 +27,74 @@
 #include "config.h"
 #include "RunLoop.h"
 
+#include <gdk/gdk.h>
 #include <glib.h>
 
 namespace WebCore {
 
 RunLoop::RunLoop()
 {
+    // g_main_context_default() doesn't add an extra reference.
     m_runLoopContext = g_main_context_default();
     ASSERT(m_runLoopContext);
-    m_runLoopMain = g_main_loop_new(m_runLoopContext, FALSE);
-    ASSERT(m_runLoopMain);
+    GRefPtr<GMainLoop> innermostLoop = adoptGRef(g_main_loop_new(m_runLoopContext.get(), FALSE));
+    ASSERT(innermostLoop);
+    m_runLoopMainLoops.append(innermostLoop);
 }
 
 RunLoop::~RunLoop()
 {
-    if (m_runLoopMain) {
-        if (g_main_loop_is_running(m_runLoopMain))
-            g_main_loop_quit(m_runLoopMain);
-        g_main_loop_unref(m_runLoopMain);
+    for (int i = m_runLoopMainLoops.size() - 1; i >= 0; --i) {
+        if (!g_main_loop_is_running(m_runLoopMainLoops[i].get()))
+            continue;
+        g_main_loop_quit(m_runLoopMainLoops[i].get());
     }
-
-    if (m_runLoopContext)
-        g_main_context_unref(m_runLoopContext);
 }
 
 void RunLoop::run()
 {
-    g_main_loop_run(RunLoop::main()->mainLoop());
+    RunLoop* mainRunLoop = RunLoop::main();
+    GMainLoop* innermostLoop = mainRunLoop->innermostLoop();
+    if (!g_main_loop_is_running(innermostLoop)) {
+        g_main_loop_run(innermostLoop);
+        return;
+    }
+
+    // Create and run a nested loop if the innermost one was already running.
+    GMainLoop* nestedMainLoop = g_main_loop_new(0, FALSE);
+    mainRunLoop->pushNestedMainLoop(nestedMainLoop);
+    g_main_loop_run(nestedMainLoop);
+    mainRunLoop->popNestedMainLoop();
+}
+
+GMainLoop* RunLoop::innermostLoop()
+{
+    // The innermost main loop should always be there.
+    ASSERT(!m_runLoopMainLoops.isEmpty());
+    return m_runLoopMainLoops[0].get();
+}
+
+void RunLoop::pushNestedMainLoop(GMainLoop* nestedLoop)
+{
+    // The innermost main loop should always be there.
+    ASSERT(!m_runLoopMainLoops.isEmpty());
+    m_runLoopMainLoops.append(adoptGRef(nestedLoop));
 }
 
-GMainLoop* RunLoop::mainLoop()
+void RunLoop::popNestedMainLoop()
 {
-    return m_runLoopMain;
+    // The innermost main loop should always be there.
+    ASSERT(!m_runLoopMainLoops.isEmpty());
+    m_runLoopMainLoops.removeLast();
 }
 
 void RunLoop::stop()
 {
-    g_main_loop_quit(m_runLoopMain);
+    // The innermost main loop should always be there.
+    ASSERT(!m_runLoopMainLoops.isEmpty());
+    GRefPtr<GMainLoop> lastMainLoop = m_runLoopMainLoops.last();
+    if (g_main_loop_is_running(lastMainLoop.get()))
+        g_main_loop_quit(lastMainLoop.get());
 }
 
 gboolean RunLoop::queueWork(RunLoop* runLoop)
@@ -77,9 +108,9 @@ void RunLoop::wakeUp()
     GRefPtr<GSource> source = adoptGRef(g_idle_source_new());
     g_source_set_priority(source.get(), G_PRIORITY_DEFAULT);
     g_source_set_callback(source.get(), reinterpret_cast<GSourceFunc>(&RunLoop::queueWork), this, 0);
-    g_source_attach(source.get(), m_runLoopContext);
+    g_source_attach(source.get(), m_runLoopContext.get());
 
-    g_main_context_wakeup(m_runLoopContext);
+    g_main_context_wakeup(m_runLoopContext.get());
 }
 
 RunLoop::TimerBase::TimerBase(RunLoop* runLoop)
@@ -117,7 +148,7 @@ void RunLoop::TimerBase::start(double fireInterval, bool repeat)
     m_timerSource = adoptGRef(g_timeout_source_new(static_cast<guint>(fireInterval * 1000)));
     m_isRepeating = repeat;
     g_source_set_callback(m_timerSource.get(), reinterpret_cast<GSourceFunc>(&RunLoop::TimerBase::timerFiredCallback), this, 0);
-    g_source_attach(m_timerSource.get(), m_runLoop->m_runLoopContext);
+    g_source_attach(m_timerSource.get(), m_runLoop->m_runLoopContext.get());
 }
 
 void RunLoop::TimerBase::stop()
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp b/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
index e99364f2a..94e3fd76f 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-static HashSet<Scrollbar*>* gScrollbars;
+static HashSet<ScrollbarThemeClient*>* gScrollbars;
 
 ScrollbarTheme* ScrollbarTheme::nativeTheme()
 {
@@ -45,14 +45,14 @@ ScrollbarThemeGtk::~ScrollbarThemeGtk()
 {
 }
 
-void ScrollbarThemeGtk::registerScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeGtk::registerScrollbar(ScrollbarThemeClient* scrollbar)
 {
     if (!gScrollbars)
-        gScrollbars = new HashSet<Scrollbar*>;
+        gScrollbars = new HashSet<ScrollbarThemeClient*>;
     gScrollbars->add(scrollbar);
 }
 
-void ScrollbarThemeGtk::unregisterScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeGtk::unregisterScrollbar(ScrollbarThemeClient* scrollbar)
 {
     gScrollbars->remove(scrollbar);
     if (gScrollbars->isEmpty()) {
@@ -69,9 +69,9 @@ void ScrollbarThemeGtk::updateScrollbarsFrameThickness()
     // Update the thickness of every interior frame scrollbar widget. The
     // platform-independent scrollbar them code isn't yet smart enough to get
     // this information when it paints.
-    HashSet<Scrollbar*>::iterator end = gScrollbars->end();
-    for (HashSet<Scrollbar*>::iterator it = gScrollbars->begin(); it != end; ++it) {
-        Scrollbar* scrollbar = (*it);
+    HashSet<ScrollbarThemeClient*>::iterator end = gScrollbars->end();
+    for (HashSet<ScrollbarThemeClient*>::iterator it = gScrollbars->begin(); it != end; ++it) {
+        ScrollbarThemeClient* scrollbar = (*it);
 
         // Top-level scrollbar i.e. scrollbars who have a parent ScrollView
         // with no parent are native, and thus do not need to be resized.
@@ -86,14 +86,14 @@ void ScrollbarThemeGtk::updateScrollbarsFrameThickness()
     }
 }
 
-bool ScrollbarThemeGtk::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeGtk::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     // This method is just called as a paint-time optimization to see if
     // painting the thumb can be skipped.  We don't have to be exact here.
     return thumbLength(scrollbar) > 0;
 }
 
-IntRect ScrollbarThemeGtk::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeGtk::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     if (part == BackButtonEndPart && !m_hasBackButtonEndPart)
         return IntRect();
@@ -114,7 +114,7 @@ IntRect ScrollbarThemeGtk::backButtonRect(Scrollbar* scrollbar, ScrollbarPart pa
     return IntRect(x, scrollbar->y() + scrollbar->height() - m_troughBorderWidth - (2 * size.height()), size.width(), size.height());
 }
 
-IntRect ScrollbarThemeGtk::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeGtk::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     if (part == ForwardButtonStartPart && !m_hasForwardButtonStartPart)
         return IntRect();
@@ -140,7 +140,7 @@ IntRect ScrollbarThemeGtk::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart
     return IntRect(x, scrollbar->y() + m_troughBorderWidth + size.height(), size.width(), size.height());
 }
 
-IntRect ScrollbarThemeGtk::trackRect(Scrollbar* scrollbar, bool)
+IntRect ScrollbarThemeGtk::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     // The padding along the thumb movement axis includes the trough border
     // plus the size of stepper spacing (the space between the stepper and
@@ -180,7 +180,7 @@ IntRect ScrollbarThemeGtk::trackRect(Scrollbar* scrollbar, bool)
                    thickness, scrollbar->height() - (2 * movementAxisPadding) - buttonsWidth);
 }
 
-IntRect ScrollbarThemeGtk::thumbRect(Scrollbar* scrollbar, const IntRect& unconstrainedTrackRect)
+IntRect ScrollbarThemeGtk::thumbRect(ScrollbarThemeClient* scrollbar, const IntRect& unconstrainedTrackRect)
 {
     IntRect trackRect = constrainTrackRectToTrackPieces(scrollbar, unconstrainedTrackRect);
     int thumbPos = thumbPosition(scrollbar);
@@ -191,7 +191,7 @@ IntRect ScrollbarThemeGtk::thumbRect(Scrollbar* scrollbar, const IntRect& uncons
     return IntRect(trackRect.x() + (trackRect.width() - m_thumbFatness) / 2, trackRect.y() + thumbPos, m_thumbFatness, thumbLength(scrollbar));
 }
 
-bool ScrollbarThemeGtk::paint(Scrollbar* scrollbar, GraphicsContext* graphicsContext, const IntRect& damageRect)
+bool ScrollbarThemeGtk::paint(ScrollbarThemeClient* scrollbar, GraphicsContext* graphicsContext, const IntRect& damageRect)
 {
     if (graphicsContext->paintingDisabled())
         return false;
@@ -260,7 +260,7 @@ bool ScrollbarThemeGtk::paint(Scrollbar* scrollbar, GraphicsContext* graphicsCon
     return true;
 }
 
-bool ScrollbarThemeGtk::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& event)
+bool ScrollbarThemeGtk::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& event)
 {
     return (event.shiftKey() && event.button() == LeftButton) || (event.button() == MiddleButton);
 }
@@ -270,7 +270,7 @@ int ScrollbarThemeGtk::scrollbarThickness(ScrollbarControlSize)
     return m_thumbFatness + (m_troughBorderWidth * 2);
 }
 
-IntSize ScrollbarThemeGtk::buttonSize(Scrollbar* scrollbar)
+IntSize ScrollbarThemeGtk::buttonSize(ScrollbarThemeClient* scrollbar)
 {
     if (scrollbar->orientation() == VerticalScrollbar)
         return IntSize(m_thumbFatness, m_stepperSize);
@@ -279,7 +279,7 @@ IntSize ScrollbarThemeGtk::buttonSize(Scrollbar* scrollbar)
     return IntSize(m_stepperSize, m_thumbFatness);
 }
 
-int ScrollbarThemeGtk::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeGtk::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return m_minThumbLength;
 }
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk.h b/Source/WebCore/platform/gtk/ScrollbarThemeGtk.h
index 45e093b1e..e73df2855 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk.h
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk.h
@@ -37,29 +37,29 @@ public:
     ScrollbarThemeGtk();
     virtual ~ScrollbarThemeGtk();
 
-    virtual bool hasButtons(Scrollbar*) { return true; }
-    virtual bool hasThumb(Scrollbar*);
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool);
-    virtual IntRect trackRect(Scrollbar*, bool);
-    IntRect thumbRect(Scrollbar*, const IntRect& unconstrainedTrackRect);
-    bool paint(Scrollbar*, GraphicsContext*, const IntRect& damageRect);
-    void paintScrollbarBackground(GraphicsContext*, Scrollbar*);
-    void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-    void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
-    virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
+    virtual bool hasButtons(ScrollbarThemeClient*) { return true; }
+    virtual bool hasThumb(ScrollbarThemeClient*);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool);
+    IntRect thumbRect(ScrollbarThemeClient*, const IntRect& unconstrainedTrackRect);
+    bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& damageRect);
+    void paintScrollbarBackground(GraphicsContext*, ScrollbarThemeClient*);
+    void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
     virtual int scrollbarThickness(ScrollbarControlSize);
-    virtual IntSize buttonSize(Scrollbar*);
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual IntSize buttonSize(ScrollbarThemeClient*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
 
     // TODO: These are the default GTK+ values. At some point we should pull these from the theme itself.
     virtual double initialAutoscrollTimerDelay() { return 0.20; }
     virtual double autoscrollTimerDelay() { return 0.02; }
     void updateThemeProperties();
     void updateScrollbarsFrameThickness();
-    void registerScrollbar(Scrollbar*);
-    void unregisterScrollbar(Scrollbar*);
+    void registerScrollbar(ScrollbarThemeClient*);
+    void unregisterScrollbar(ScrollbarThemeClient*);
 
 protected:
 #ifndef GTK_API_VERSION_2
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp b/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp
index 729bd124d..866bb8a1d 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp
@@ -66,13 +66,13 @@ void ScrollbarThemeGtk::updateThemeProperties()
     updateScrollbarsFrameThickness();
 }
 
-static GtkWidget* getWidgetForScrollbar(Scrollbar* scrollbar)
+static GtkWidget* getWidgetForScrollbar(ScrollbarThemeClient* scrollbar)
 {
     RenderThemeGtk* theme = static_cast<RenderThemeGtk*>(RenderTheme::defaultTheme().get());
     return scrollbar->orientation() == VerticalScrollbar ? theme->gtkVScrollbar() : theme->gtkHScrollbar();
 }
 
-void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     // Paint the track background. If the trough-under-steppers property is true, this
     // should be the full size of the scrollbar, but if is false, it should only be the
@@ -87,7 +87,7 @@ void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar
                               GTK_STATE_ACTIVE, GTK_SHADOW_IN, "trough");
 }
 
-void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
+void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
 {
     IntRect fullScrollbarRect = IntRect(scrollbar->x(), scrollbar->y(), scrollbar->width(), scrollbar->height());
 
@@ -96,7 +96,7 @@ void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, Scrol
                               GTK_STATE_NORMAL, GTK_SHADOW_IN, "scrolled_window");
 }
 
-void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     GtkWidget* widget = getWidgetForScrollbar(scrollbar);
     gboolean activateSlider;
@@ -129,7 +129,7 @@ void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, Scrollbar* scrollba
     widgetContext.gtkPaintSlider(sliderRect, widget, stateType, shadowType, "slider", orientation);
 }
 
-void ScrollbarThemeGtk::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeGtk::paintButton(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     // The buttons will be disabled if the thumb is as the appropriate extreme.
     GtkShadowType shadowType = GTK_SHADOW_OUT;
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp b/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
index 4c33e66db..9749c543f 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
@@ -72,7 +72,7 @@ static void applyScrollbarStyleContextClasses(GtkStyleContext* context, Scrollba
     gtk_style_context_add_class(context, orientation == VerticalScrollbar ?  GTK_STYLE_CLASS_VERTICAL : GTK_STYLE_CLASS_HORIZONTAL);
 }
 
-void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     // Paint the track background. If the trough-under-steppers property is true, this
     // should be the full size of the scrollbar, but if is false, it should only be the
@@ -94,7 +94,7 @@ void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar
     gtk_style_context_restore(m_context);
 }
 
-void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
+void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
 {
     gtk_style_context_save(m_context);
 
@@ -105,7 +105,7 @@ void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, Scrol
     gtk_style_context_restore(m_context);
 }
 
-void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     gtk_style_context_save(m_context);
 
@@ -126,7 +126,7 @@ void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, Scrollbar* scrollba
     gtk_style_context_restore(m_context);
 }
 
-void ScrollbarThemeGtk::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeGtk::paintButton(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     gtk_style_context_save(m_context);
 
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
index 34caf0abe..d9e969092 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
@@ -31,7 +31,9 @@
 #include "ICOImageDecoder.h"
 #include "JPEGImageDecoder.h"
 #include "PNGImageDecoder.h"
+#if USE(WEBP)
 #include "WEBPImageDecoder.h"
+#endif
 #include "SharedBuffer.h"
 
 using namespace std;
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.h b/Source/WebCore/platform/image-decoders/ImageDecoder.h
index 9d9b34f60..20122fffb 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.h
@@ -64,7 +64,7 @@ namespace WebCore {
             DisposeOverwritePrevious  // Clear frame to previous framebuffer
                                       // contents
         };
-#if USE(SKIA) || PLATFORM(QT)
+#if USE(SKIA) || (PLATFORM(QT) && USE(QT_IMAGE_DECODER))
         typedef uint32_t PixelData;
 #else
         typedef unsigned PixelData;
@@ -140,7 +140,7 @@ namespace WebCore {
         {
 #if USE(SKIA)
             return m_bitmap.bitmap().getAddr32(x, y);
-#elif PLATFORM(QT)
+#elif PLATFORM(QT) && USE(QT_IMAGE_DECODER)
             m_image = m_pixmap.toImage();
             m_pixmap = QPixmap();
             return reinterpret_cast_ptr<QRgb*>(m_image.scanLine(y)) + x;
@@ -149,7 +149,7 @@ namespace WebCore {
 #endif
         }
 
-#if PLATFORM(QT)
+#if PLATFORM(QT) && USE(QT_IMAGE_DECODER)
         void setPixmap(const QPixmap& pixmap);
 #endif
 
@@ -190,7 +190,7 @@ namespace WebCore {
 #if PLATFORM(CHROMIUM) && OS(DARWIN)
         ColorProfile m_colorProfile;
 #endif
-#elif PLATFORM(QT)
+#elif PLATFORM(QT) && USE(QT_IMAGE_DECODER)
         mutable QPixmap m_pixmap;
         mutable QImage m_image;
         bool m_hasAlpha;
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index f0fbe44ac..d9910c92b 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -103,7 +103,11 @@ void init_source(j_decompress_ptr jd);
 boolean fill_input_buffer(j_decompress_ptr jd);
 void skip_input_data(j_decompress_ptr jd, long num_bytes);
 void term_source(j_decompress_ptr jd);
+#if PLATFORM(QT)
+void error_exit(j_common_ptr) NO_RETURN;
+#else
 void error_exit(j_common_ptr cinfo);
+#endif
 
 // Implementation of a JPEG src object that understands our state machine
 struct decoder_source_mgr {
@@ -243,6 +247,14 @@ public:
             case JCS_YCbCr:
                 // libjpeg can convert GRAYSCALE and YCbCr image pixels to RGB.
                 m_info.out_color_space = rgbOutputColorSpace();
+#if defined(TURBO_JPEG_RGB_SWIZZLE)
+                if (m_info.saw_JFIF_marker)
+                    break;
+                // FIXME: Swizzle decoding does not support Adobe transform=0
+                // images (yet), so revert to using JSC_RGB in that case.
+                if (m_info.saw_Adobe_marker && !m_info.Adobe_transform)
+                    m_info.out_color_space = JCS_RGB;
+#endif
                 break;
             case JCS_CMYK:
             case JCS_YCCK:
@@ -489,7 +501,9 @@ bool JPEGImageDecoder::outputScanlines()
         if (!buffer.setSize(scaledSize().width(), scaledSize().height()))
             return setFailed();
         buffer.setStatus(ImageFrame::FramePartial);
-        buffer.setHasAlpha(false);
+        // The buffer is transparent outside the decoded area while the image is
+        // loading. The completed image will be marked fully opaque in jpegComplete().
+        buffer.setHasAlpha(true);
         buffer.setColorProfile(m_colorProfile);
 
         // For JPEGs, the frame always fills the entire image.
@@ -557,7 +571,9 @@ void JPEGImageDecoder::jpegComplete()
 
     // Hand back an appropriately sized buffer, even if the image ended up being
     // empty.
-    m_frameBufferCache[0].setStatus(ImageFrame::FrameComplete);
+    ImageFrame& buffer = m_frameBufferCache[0];
+    buffer.setStatus(ImageFrame::FrameComplete);
+    buffer.setHasAlpha(false);
 }
 
 void JPEGImageDecoder::decode(bool onlySize)
diff --git a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
index c50ebe957..bcca47401 100644
--- a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
@@ -64,6 +64,9 @@ const double cInverseGamma = 0.45455;
 const unsigned long cMaxPNGSize = 1000000UL;
 
 // Called if the decoding of the image fails.
+#if PLATFORM(QT)
+static void PNGAPI decodingFailed(png_structp, png_const_charp) NO_RETURN;
+#endif
 static void PNGAPI decodingFailed(png_structp png, png_const_charp)
 {
     longjmp(JMPBUF(png), 1);
diff --git a/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp b/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp
index 1ead9a9ac..999ac2903 100644
--- a/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp
+++ b/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp
@@ -30,11 +30,10 @@
 
 #include "NotImplemented.h"
 
-#include <QPixmap>
-#include <stdio.h>
-
 namespace WebCore {
 
+#if USE(QT_IMAGE_DECODER)
+
 ImageFrame::ImageFrame()
     : m_hasAlpha(false) 
     , m_size()
@@ -154,4 +153,21 @@ int ImageFrame::height() const
     return m_size.height();
 }
 
+#else
+
+QPixmap* ImageFrame::asNewNativeImage() const
+{
+    QImage::Format fmt;
+    if (m_hasAlpha)
+        fmt = m_premultiplyAlpha ?  QImage::Format_ARGB32_Premultiplied : QImage::Format_ARGB32;
+    else
+        fmt = QImage::Format_RGB32;
+
+    QImage img(reinterpret_cast<uchar*>(m_bytes), m_size.width(), m_size.height(), sizeof(PixelData) * m_size.width(), fmt);
+
+    return new QPixmap(QPixmap::fromImage(img));
+}
+
+#endif // USE(QT_IMAGE_DECODER)
+
 }
diff --git a/Source/WebCore/platform/mac/ClipboardMac.h b/Source/WebCore/platform/mac/ClipboardMac.h
index a84f289dc..7f6ad85a7 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.h
+++ b/Source/WebCore/platform/mac/ClipboardMac.h
@@ -31,7 +31,6 @@
 #include <wtf/RetainPtr.h>
 
 OBJC_CLASS NSImage;
-OBJC_CLASS NSPasteboard;
 
 namespace WebCore {
 
@@ -50,13 +49,13 @@ public:
     
     void clearData(const String& type);
     void clearAllData();
-    String getData(const String& type, bool& success) const;
+    String getData(const String& type) const;
     bool setData(const String& type, const String& data);
     
     virtual bool hasData();
     
     // extensions beyond IE's API
-    virtual PassRefPtr<DOMStringList> types() const;
+    virtual HashSet<String> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/mac/ClipboardMac.mm b/Source/WebCore/platform/mac/ClipboardMac.mm
index 88eefcb53..a4933f335 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.mm
+++ b/Source/WebCore/platform/mac/ClipboardMac.mm
@@ -27,7 +27,6 @@
 #import "ClipboardMac.h"
 
 #import "DOMElementInternal.h"
-#import "DOMStringList.h"
 #import "DragClient.h"
 #import "DragController.h"
 #import "DragData.h"
@@ -112,15 +111,15 @@ static String utiTypeFromCocoaType(const String& type)
     return String();
 }
 
-static void addHTMLClipboardTypesForCocoaType(DOMStringList* resultTypes, const String& cocoaType, const String& pasteboardName)
+static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, const String& cocoaType, const String& pasteboardName)
 {
     // UTI may not do these right, so make sure we get the right, predictable result
     if (cocoaType == String(NSStringPboardType)) {
-        resultTypes->append("text/plain");
+        resultTypes.add("text/plain");
         return;
     }
     if (cocoaType == String(NSURLPboardType)) {
-        resultTypes->append("text/uri-list");
+        resultTypes.add("text/uri-list");
         return;
     }
     if (cocoaType == String(NSFilenamesPboardType)) {
@@ -132,18 +131,18 @@ static void addHTMLClipboardTypesForCocoaType(DOMStringList* resultTypes, const
         if (!fileList.isEmpty()) {
             // It is unknown if NSFilenamesPboardType always implies NSURLPboardType in Cocoa,
             // but NSFilenamesPboardType should imply both 'text/uri-list' and 'Files'
-            resultTypes->append("text/uri-list");
-            resultTypes->append("Files");
+            resultTypes.add("text/uri-list");
+            resultTypes.add("Files");
         }
         return;
     }
     String utiType = utiTypeFromCocoaType(cocoaType);
     if (!utiType.isEmpty()) {
-        resultTypes->append(utiType);
+        resultTypes.add(utiType);
         return;
     }
     // No mapping, just pass the whole string though
-    resultTypes->append(cocoaType);
+    resultTypes.add(cocoaType);
 }
 
 void ClipboardMac::clearData(const String& type)
@@ -212,9 +211,8 @@ static Vector<String> absoluteURLsFromPasteboard(const String& pasteboardName, b
     return Vector<String>();
 }
 
-String ClipboardMac::getData(const String& type, bool& success) const
+String ClipboardMac::getData(const String& type) const
 {
-    success = false;
     if (policy() != ClipboardReadable)
         return String();
 
@@ -236,7 +234,6 @@ String ClipboardMac::getData(const String& type, bool& success) const
     // Enforce changeCount ourselves for security.  We check after reading instead of before to be
     // sure it doesn't change between our testing the change count and accessing the data.
     if (!cocoaValue.isEmpty() && m_changeCount == platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName)) {
-        success = true;
         return cocoaValue;
     }
 
@@ -284,10 +281,10 @@ bool ClipboardMac::setData(const String &type, const String &data)
     return false;
 }
 
-PassRefPtr<DOMStringList> ClipboardMac::types() const
+HashSet<String> ClipboardMac::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return DOMStringList::create();
+        return HashSet<String>();
 
     Vector<String> types;
     platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
@@ -295,19 +292,19 @@ PassRefPtr<DOMStringList> ClipboardMac::types() const
     // Enforce changeCount ourselves for security.  We check after reading instead of before to be
     // sure it doesn't change between our testing the change count and accessing the data.
     if (m_changeCount != platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName))
-        return DOMStringList::create();
+        return HashSet<String>();
 
-    RefPtr<DOMStringList> result = DOMStringList::create();
+    HashSet<String> result;
     // FIXME: This loop could be split into two stages. One which adds all the HTML5 specified types
     // and a second which adds all the extra types from the cocoa clipboard (which is Mac-only behavior).
     for (size_t i = 0; i < types.size(); i++) {
         if (types[i] == "NeXT plain ascii pasteboard type")
             continue;   // skip this ancient type that gets auto-supplied by some system conversion
 
-        addHTMLClipboardTypesForCocoaType(result.get(), types[i], m_pasteboardName);
+        addHTMLClipboardTypesForCocoaType(result, types[i], m_pasteboardName);
     }
 
-    return result.release();
+    return result;
 }
 
 // FIXME: We could cache the computed fileList if necessary
diff --git a/Source/WebCore/platform/mac/FileSystemMac.mm b/Source/WebCore/platform/mac/FileSystemMac.mm
index f01b7a468..efb7d452e 100644
--- a/Source/WebCore/platform/mac/FileSystemMac.mm
+++ b/Source/WebCore/platform/mac/FileSystemMac.mm
@@ -30,6 +30,9 @@
 #import "FileSystem.h"
 
 #import "PlatformString.h"
+//#import "WebCoreNSStringExtras.h"
+#import "WebCoreNSURLExtras.h"
+#import "WebCoreSystemInterface.h"
 #import <wtf/RetainPtr.h>
 #import <wtf/text/CString.h>
 
@@ -65,6 +68,47 @@ String openTemporaryFile(const String& prefix, PlatformFileHandle& platformFileH
     return String::fromUTF8(temporaryFilePath.data());
 }
 
+typedef struct MetaDataInfo
+{
+    String URLString;
+    String referrer;
+    String path;
+} MetaDataInfo;
+
+static void* setMetaData(void* context)
+{
+    MetaDataInfo *info = (MetaDataInfo *)context;
+    wkSetMetadataURL((NSString *)info->URLString, (NSString *)info->referrer, (NSString *)fileSystemRepresentation(info->path).data());
+    
+    delete info;
+    
+    return 0;
+}
+
+void setMetadataURL(String& URLString, const String& referrer, const String& path)
+{
+    NSURL *URL = URLWithUserTypedString(URLString, nil);
+    if (URL)
+        URLString = userVisibleString(URLByRemovingUserInfo(URL));
+    
+    // Spawn a background thread for WKSetMetadataURL because this function will not return until mds has
+    // journaled the data we're're trying to set. Depending on what other I/O is going on, it can take some
+    // time. 
+    pthread_t tid;
+    pthread_attr_t attr;
+    pthread_attr_init(&attr);
+    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+    
+    MetaDataInfo *info = new MetaDataInfo;
+    
+    info->URLString = URLString;
+    info->referrer = referrer;
+    info->path = path;
+    
+    pthread_create(&tid, &attr, setMetaData, info);
+    pthread_attr_destroy(&attr);
+}
+
 #if !PLATFORM(IOS)
 bool canExcludeFromBackup()
 {
diff --git a/Source/WebCore/platform/mac/HTMLConverter.mm b/Source/WebCore/platform/mac/HTMLConverter.mm
index 5ce5446eb..47d5fe058 100644
--- a/Source/WebCore/platform/mac/HTMLConverter.mm
+++ b/Source/WebCore/platform/mac/HTMLConverter.mm
@@ -818,7 +818,7 @@ static inline NSShadow *_shadowForShadowStyle(NSString *shadowStyle)
         NSUInteger textLength = [_attrStr length];
         NSTextAttachment *attachment = [[NSTextAttachment alloc] initWithFileWrapper:fileWrapper];
         NSTextAttachmentCell *cell;
-        NSString *string = [[NSString alloc] initWithFormat:(needsParagraph ? @"%C\n" : @"%C"), NSAttachmentCharacter];
+        NSString *string = [[NSString alloc] initWithFormat:(needsParagraph ? @"%C\n" : @"%C"), static_cast<unichar>(NSAttachmentCharacter)];
         NSRange rangeToReplace = NSMakeRange(textLength, 0);
         NSDictionary *attrs;
         if (fileWrapper) {
diff --git a/Source/WebCore/platform/mac/KURLMac.mm b/Source/WebCore/platform/mac/KURLMac.mm
index a5d15f5ea..c69d7acce 100644
--- a/Source/WebCore/platform/mac/KURLMac.mm
+++ b/Source/WebCore/platform/mac/KURLMac.mm
@@ -31,6 +31,8 @@
 
 namespace WebCore {
 
+#if !USE(WTFURL)
+
 typedef Vector<char, 512> CharBuffer;
 extern CFURLRef createCFURLFromBuffer(const CharBuffer& buffer);
 
@@ -69,4 +71,20 @@ CFURLRef KURL::createCFURL() const
     return createCFURLFromBuffer(buffer);
 }
 
+#else
+
+KURL::KURL(NSURL *)
+{
+    // FIXME: Add WTFURL Implementation.
+    invalidate();
+}
+
+KURL::operator NSURL *() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return nil;
+}
+
+#endif
+
 }
diff --git a/Source/WebCore/platform/mac/LocalizedStringsMac.mm b/Source/WebCore/platform/mac/LocalizedStringsMac.cpp
index 9d738afae..8cabe86d4 100644
--- a/Source/WebCore/platform/mac/LocalizedStringsMac.mm
+++ b/Source/WebCore/platform/mac/LocalizedStringsMac.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,32 +23,37 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import "config.h"
-#import "LocalizedStrings.h"
+#include "config.h"
+#include "LocalizedStrings.h"
 
-#import <wtf/Assertions.h>
-#import <wtf/MainThread.h>
-#import <wtf/RetainPtr.h>
-#import <wtf/text/WTFString.h>
+#include <CoreFoundation/CFBundle.h>
+#include <wtf/Assertions.h>
+#include <wtf/MainThread.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
 String localizedString(const char* key)
 {
-    static NSBundle *bundle = [NSBundle bundleWithIdentifier:@"com.apple.WebCore"];
+    static CFBundleRef bundle = CFBundleGetBundleWithIdentifier(CFSTR("com.apple.WebCore"));
 
 #if !PLATFORM(IOS)
     // Can be called on a dispatch queue when initializing strings on iOS.
     // See LoadWebLocalizedStrings and <rdar://problem/7902473>.
     ASSERT(isMainThread());
 #endif
-    
-    RetainPtr<CFStringRef> keyString(AdoptCF, CFStringCreateWithCStringNoCopy(NULL, key, kCFStringEncodingUTF8, kCFAllocatorNull));
-    NSString *notFound = @"localized string not found";
-    NSString *result = [bundle localizedStringForKey:(NSString *)keyString.get() value:notFound table:nil];
 
-    ASSERT_WITH_MESSAGE(result != notFound, "could not find localizable string %s in bundle", key);
-    return result;
+    RetainPtr<CFStringRef> keyString(AdoptCF, CFStringCreateWithCStringNoCopy(0, key, kCFStringEncodingUTF8, kCFAllocatorNull));
+    CFStringRef notFound = CFSTR("localized string not found");
+    RetainPtr<CFStringRef> result;
+    if (bundle) {
+        result.adoptCF(CFBundleCopyLocalizedString(bundle, keyString.get(), notFound, 0));
+        ASSERT_WITH_MESSAGE(result.get() != notFound, "could not find localizable string %s in bundle", key);
+    } else
+        result = notFound;
+
+    return String(result.get());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/PlatformPasteboardMac.mm b/Source/WebCore/platform/mac/PlatformPasteboardMac.mm
index d03df24b5..d6a47e6f7 100644
--- a/Source/WebCore/platform/mac/PlatformPasteboardMac.mm
+++ b/Source/WebCore/platform/mac/PlatformPasteboardMac.mm
@@ -45,7 +45,10 @@ void PlatformPasteboard::getTypes(Vector<String>& types)
 
 PassRefPtr<SharedBuffer> PlatformPasteboard::bufferForType(const String& pasteboardType)
 {
-    return SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:pasteboardType] copy] autorelease]);
+    NSData *data = [m_pasteboard.get() dataForType:pasteboardType];
+    if (!data)
+        return 0;
+    return SharedBuffer::wrapNSData([[data copy] autorelease]);
 }
 
 void PlatformPasteboard::getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType)
diff --git a/Source/WebCore/platform/mac/RunLoopMac.mm b/Source/WebCore/platform/mac/RunLoopMac.mm
index 46fa4c2cb..717dd8dac 100644
--- a/Source/WebCore/platform/mac/RunLoopMac.mm
+++ b/Source/WebCore/platform/mac/RunLoopMac.mm
@@ -116,7 +116,7 @@ void RunLoop::stop()
     ASSERT(m_runLoop == CFRunLoopGetCurrent());
     
     if (m_runLoop == main()->m_runLoop && m_nestingLevel == 1) {
-        [NSApp stop:nil];
+        [[NSApplication sharedApplication] stop:nil];
         NSEvent *event = [NSEvent otherEventWithType:NSApplicationDefined
                                             location:NSMakePoint(0, 0)
                                        modifierFlags:0
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.h b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
index 3720feb74..4ea6904a5 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.h
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
@@ -86,6 +86,8 @@ private:
     virtual bool handleWheelEvent(const PlatformWheelEvent&) OVERRIDE;
 #endif
 
+    virtual void handleWheelEventPhase(PlatformWheelEventPhase) OVERRIDE;
+
     virtual void cancelAnimations();
     virtual void setIsActive();
     
@@ -103,6 +105,7 @@ private:
     virtual void contentAreaDidHide() const;
     void didBeginScrollGesture() const;
     void didEndScrollGesture() const;
+    void mayBeginScrollGesture() const;
 
     virtual void didAddVerticalScrollbar(Scrollbar*);
     virtual void willRemoveVerticalScrollbar(Scrollbar*);
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
index 5bcc77549..78b71b01e 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
@@ -779,6 +779,17 @@ void ScrollAnimatorMac::didEndScrollGesture() const
         [m_scrollbarPainterController.get() endScrollGesture];
 }
 
+void ScrollAnimatorMac::mayBeginScrollGesture() const
+{
+    if (!scrollableArea()->isOnActivePage())
+        return;
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
+
+    [m_scrollbarPainterController.get() beginScrollGesture];
+    [m_scrollbarPainterController.get() contentAreaScrolled];
+}
+
 void ScrollAnimatorMac::didAddVerticalScrollbar(Scrollbar* scrollbar)
 {
     if (!isScrollbarOverlayAPIAvailable())
@@ -889,6 +900,16 @@ void ScrollAnimatorMac::cancelAnimations()
     }
 }
 
+void ScrollAnimatorMac::handleWheelEventPhase(PlatformWheelEventPhase phase)
+{
+    if (phase == PlatformWheelEventPhaseBegan)
+        didBeginScrollGesture();
+    else if (phase == PlatformWheelEventPhaseEnded || phase == PlatformWheelEventPhaseCancelled)
+        didEndScrollGesture();
+    else if (phase == PlatformWheelEventPhaseMayBegin)
+        mayBeginScrollGesture();
+}
+
 #if ENABLE(RUBBER_BANDING)
 bool ScrollAnimatorMac::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
 {
@@ -911,12 +932,8 @@ bool ScrollAnimatorMac::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
 
     bool didHandleEvent = m_scrollElasticityController.handleWheelEvent(wheelEvent);
 
-    if (didHandleEvent) {
-        if (wheelEvent.phase() == PlatformWheelEventPhaseBegan)
-            didBeginScrollGesture();
-        else if (wheelEvent.phase() == PlatformWheelEventPhaseEnded)
-            didEndScrollGesture();
-    }
+    if (didHandleEvent)
+        handleWheelEventPhase(wheelEvent.phase());
 
     return didHandleEvent;
 }
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.h b/Source/WebCore/platform/mac/ScrollbarThemeMac.h
index 13d44c23d..d14da6db2 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.h
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.h
@@ -39,46 +39,46 @@ public:
 
     void preferencesChanged();
 
-    virtual void updateEnabledState(Scrollbar*);
+    virtual void updateEnabledState(ScrollbarThemeClient*);
 
 #if !PLATFORM(CHROMIUM)
-    virtual bool paint(Scrollbar*, GraphicsContext* context, const IntRect& damageRect);
+    virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& damageRect);
 #endif
 
     virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
     
     virtual bool supportsControlTints() const { return true; }
     virtual bool usesOverlayScrollbars() const;
-    virtual void updateScrollbarOverlayStyle(Scrollbar*);
+    virtual void updateScrollbarOverlayStyle(ScrollbarThemeClient*);
 
     virtual double initialAutoscrollTimerDelay();
     virtual double autoscrollTimerDelay();
 
     virtual ScrollbarButtonsPlacement buttonsPlacement() const;
 
-    virtual void registerScrollbar(Scrollbar*);
-    virtual void unregisterScrollbar(Scrollbar*);
+    virtual void registerScrollbar(ScrollbarThemeClient*);
+    virtual void unregisterScrollbar(ScrollbarThemeClient*);
 
-    void setNewPainterForScrollbar(Scrollbar*, ScrollbarPainter);
-    ScrollbarPainter painterForScrollbar(Scrollbar*);
+    void setNewPainterForScrollbar(ScrollbarThemeClient*, ScrollbarPainter);
+    ScrollbarPainter painterForScrollbar(ScrollbarThemeClient*);
 
     static bool isCurrentlyDrawingIntoLayer();
     static void setIsCurrentlyDrawingIntoLayer(bool);
 
 protected:
-    virtual bool hasButtons(Scrollbar*);
-    virtual bool hasThumb(Scrollbar*);
+    virtual bool hasButtons(ScrollbarThemeClient*);
+    virtual bool hasThumb(ScrollbarThemeClient*);
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
 
     virtual int maxOverlapBetweenPages() { return 40; }
 
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
     
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
-    virtual bool shouldDragDocumentInsteadOfThumb(Scrollbar*, const PlatformMouseEvent&);
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
+    virtual bool shouldDragDocumentInsteadOfThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
     int scrollbarPartToHIPressedState(ScrollbarPart);
 
 #if !PLATFORM(CHROMIUM) && USE(ACCELERATED_COMPOSITING) && ENABLE(RUBBER_BANDING)
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
index cc7482457..e47468bd5 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -50,7 +50,7 @@ using namespace WebCore;
 
 namespace WebCore {
 
-typedef HashMap<Scrollbar*, RetainPtr<ScrollbarPainter> > ScrollbarPainterMap;
+typedef HashMap<ScrollbarThemeClient*, RetainPtr<ScrollbarPainter> > ScrollbarPainterMap;
 
 static ScrollbarPainterMap* scrollbarMap()
 {
@@ -162,7 +162,7 @@ static void updateArrowPlacement()
     }
 }
 
-void ScrollbarThemeMac::registerScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeMac::registerScrollbar(ScrollbarThemeClient* scrollbar)
 {
     if (isScrollbarOverlayAPIAvailable()) {
         bool isHorizontal = scrollbar->orientation() == HorizontalScrollbar;
@@ -175,19 +175,19 @@ void ScrollbarThemeMac::registerScrollbar(Scrollbar* scrollbar)
     }
 }
 
-void ScrollbarThemeMac::unregisterScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeMac::unregisterScrollbar(ScrollbarThemeClient* scrollbar)
 {
     scrollbarMap()->remove(scrollbar);
 }
 
-void ScrollbarThemeMac::setNewPainterForScrollbar(Scrollbar* scrollbar, ScrollbarPainter newPainter)
+void ScrollbarThemeMac::setNewPainterForScrollbar(ScrollbarThemeClient* scrollbar, ScrollbarPainter newPainter)
 {
     scrollbarMap()->set(scrollbar, newPainter);
     updateEnabledState(scrollbar);
     updateScrollbarOverlayStyle(scrollbar);
 }
 
-ScrollbarPainter ScrollbarThemeMac::painterForScrollbar(Scrollbar* scrollbar)
+ScrollbarPainter ScrollbarThemeMac::painterForScrollbar(ScrollbarThemeClient* scrollbar)
 {
     return scrollbarMap()->get(scrollbar).get();
 }
@@ -248,10 +248,10 @@ bool ScrollbarThemeMac::usesOverlayScrollbars() const
         return false;
 }
 
-void ScrollbarThemeMac::updateScrollbarOverlayStyle(Scrollbar* scrollbar)
+void ScrollbarThemeMac::updateScrollbarOverlayStyle(ScrollbarThemeClient* scrollbar)
 {
     ScrollbarPainter painter = painterForScrollbar(scrollbar);
-    switch (scrollbar->scrollableArea()->scrollbarOverlayStyle()) {
+    switch (scrollbar->scrollbarOverlayStyle()) {
     case ScrollbarOverlayStyleDefault:
         [painter setKnobStyle:NSScrollerKnobStyleDefault];
         break;
@@ -279,7 +279,7 @@ ScrollbarButtonsPlacement ScrollbarThemeMac::buttonsPlacement() const
     return gButtonPlacement;
 }
 
-bool ScrollbarThemeMac::hasButtons(Scrollbar* scrollbar)
+bool ScrollbarThemeMac::hasButtons(ScrollbarThemeClient* scrollbar)
 {
     return scrollbar->enabled() && buttonsPlacement() != ScrollbarButtonsNone
              && (scrollbar->orientation() == HorizontalScrollbar
@@ -287,7 +287,7 @@ bool ScrollbarThemeMac::hasButtons(Scrollbar* scrollbar)
              : scrollbar->height()) >= 2 * (cRealButtonLength[scrollbar->controlSize()] - cButtonHitInset[scrollbar->controlSize()]);
 }
 
-bool ScrollbarThemeMac::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeMac::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     int minLengthForThumb;
     if (isScrollbarOverlayAPIAvailable()) {
@@ -319,7 +319,7 @@ static IntRect buttonRepaintRect(const IntRect& buttonRect, ScrollbarOrientation
     return paintRect;
 }
 
-IntRect ScrollbarThemeMac::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+IntRect ScrollbarThemeMac::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool painting)
 {
     IntRect result;
     
@@ -353,7 +353,7 @@ IntRect ScrollbarThemeMac::backButtonRect(Scrollbar* scrollbar, ScrollbarPart pa
     return result;
 }
 
-IntRect ScrollbarThemeMac::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+IntRect ScrollbarThemeMac::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool painting)
 {
     IntRect result;
     
@@ -393,7 +393,7 @@ IntRect ScrollbarThemeMac::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart
     return result;
 }
 
-IntRect ScrollbarThemeMac::trackRect(Scrollbar* scrollbar, bool painting)
+IntRect ScrollbarThemeMac::trackRect(ScrollbarThemeClient* scrollbar, bool painting)
 {
     if (painting || !hasButtons(scrollbar))
         return scrollbar->frameRect();
@@ -430,7 +430,7 @@ IntRect ScrollbarThemeMac::trackRect(Scrollbar* scrollbar, bool painting)
     return IntRect(scrollbar->x(), scrollbar->y() + startWidth, thickness, scrollbar->height() - totalWidth);
 }
 
-int ScrollbarThemeMac::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeMac::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     if (isScrollbarOverlayAPIAvailable())
         return [scrollbarMap()->get(scrollbar).get() knobMinLength];
@@ -438,7 +438,7 @@ int ScrollbarThemeMac::minimumThumbLength(Scrollbar* scrollbar)
         return cThumbMinLength[scrollbar->controlSize()];
 }
 
-bool ScrollbarThemeMac::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeMac::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     if (evt.button() != LeftButton)
         return false;
@@ -447,7 +447,7 @@ bool ScrollbarThemeMac::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent
     return evt.altKey();
 }
 
-bool ScrollbarThemeMac::shouldDragDocumentInsteadOfThumb(Scrollbar*, const PlatformMouseEvent& event)
+bool ScrollbarThemeMac::shouldDragDocumentInsteadOfThumb(ScrollbarThemeClient*, const PlatformMouseEvent& event)
 {
     return event.altKey();
 }
@@ -470,7 +470,7 @@ int ScrollbarThemeMac::scrollbarPartToHIPressedState(ScrollbarPart part)
     }
 }
 
-void ScrollbarThemeMac::updateEnabledState(Scrollbar* scrollbar)
+void ScrollbarThemeMac::updateEnabledState(ScrollbarThemeClient* scrollbar)
 {
     if (isScrollbarOverlayAPIAvailable())
         [scrollbarMap()->get(scrollbar).get() setEnabled:scrollbar->enabled()];
@@ -499,7 +499,7 @@ static void scrollbarPainterPaint(ScrollbarPainter scrollbarPainter, bool enable
 }
 
 #if !PLATFORM(CHROMIUM)
-bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, const IntRect& damageRect)
+bool ScrollbarThemeMac::paint(ScrollbarThemeClient* scrollbar, GraphicsContext* context, const IntRect& damageRect)
 {
     if (isScrollbarOverlayAPIAvailable()) {
         float value = 0;
@@ -570,7 +570,7 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
     if (!scrollbar->enabled())
         trackInfo.enableState = kThemeTrackDisabled;
     else
-        trackInfo.enableState = scrollbar->scrollableArea()->isActive() ? kThemeTrackActive : kThemeTrackInactive;
+        trackInfo.enableState = scrollbar->isScrollableAreaActive() ? kThemeTrackActive : kThemeTrackInactive;
 
     if (hasThumb(scrollbar))
         trackInfo.attributes |= kThemeTrackShowThumb;
@@ -589,7 +589,7 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
         IntRect bufferRect(scrollbar->frameRect());
         bufferRect.intersect(damageRect);
         
-        OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(bufferRect.size());
+        OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(bufferRect.size(), 1);
         if (!imageBuffer)
             return true;
 
diff --git a/Source/WebCore/platform/mac/SoftLinking.h b/Source/WebCore/platform/mac/SoftLinking.h
index d43c3034e..e61bb7ad4 100644
--- a/Source/WebCore/platform/mac/SoftLinking.h
+++ b/Source/WebCore/platform/mac/SoftLinking.h
@@ -52,6 +52,13 @@
         return frameworkLibrary; \
     }
 
+#define SOFT_LINK_PRIVATE_FRAMEWORK_OPTIONAL(framework) \
+    static void* framework##Library() \
+    { \
+        static void* frameworkLibrary = dlopen("/System/Library/PrivateFrameworks/" #framework ".framework/" #framework, RTLD_NOW); \
+        return frameworkLibrary; \
+    }
+
 #define SOFT_LINK_FRAMEWORK_IN_CORESERVICES_UMBRELLA(framework) \
     static void* framework##Library() \
     { \
diff --git a/Source/WebKit2/UIProcess/API/C/mac/WKInspectorMac.h b/Source/WebCore/platform/mac/WebCoreFullScreenWindow.h
index ec5a35afb..214e673a7 100644
--- a/Source/WebKit2/UIProcess/API/C/mac/WKInspectorMac.h
+++ b/Source/WebCore/platform/mac/WebCoreFullScreenWindow.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,17 +23,10 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WKInspectorMac_h
-#define WKInspectorMac_h
+#ifndef WebCoreFullScreenWindow_h
+#define WebCoreFullScreenWindow_h
 
-#ifdef __cplusplus
-extern "C" {
-#endif
+@interface WebCoreFullScreenWindow : NSWindow
+@end
 
-const NSInteger WKInspectorViewTag = 1000;
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif // WKInspectorMac_h
+#endif // WebCoreFullScreenWindow_h
diff --git a/Source/WebCore/platform/mac/WebCoreFullScreenWindow.mm b/Source/WebCore/platform/mac/WebCoreFullScreenWindow.mm
new file mode 100644
index 000000000..b62483b30
--- /dev/null
+++ b/Source/WebCore/platform/mac/WebCoreFullScreenWindow.mm
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "WebCoreFullScreenWindow.h"
+
+@implementation WebCoreFullScreenWindow
+
+- (id)initWithContentRect:(NSRect)contentRect styleMask:(NSUInteger)aStyle backing:(NSBackingStoreType)bufferingType defer:(BOOL)flag
+{
+    self = [super initWithContentRect:contentRect styleMask:aStyle backing:bufferingType defer:flag];
+    if (!self)
+        return nil;
+    [self setOpaque:NO];
+    [self setBackgroundColor:[NSColor clearColor]];
+    [self setIgnoresMouseEvents:NO];
+    [self setAcceptsMouseMovedEvents:YES];
+    [self setReleasedWhenClosed:NO];
+    [self setHasShadow:NO];
+#ifndef BUILDING_ON_LEOPARD
+    [self setMovable:NO];
+#else
+    [self setMovableByWindowBackground:NO];
+#endif
+
+    return self;
+}
+
+- (BOOL)canBecomeKeyWindow
+{
+    return YES;
+}
+
+- (void)keyDown:(NSEvent *)theEvent
+{
+    if ([[theEvent charactersIgnoringModifiers] isEqual:@"\e"]) // Esacpe key-code
+        [self cancelOperation:self];
+    else [super keyDown:theEvent];
+}
+
+- (void)cancelOperation:(id)sender
+{
+    [[self windowController] cancelOperation:sender];
+}
+@end
+
diff --git a/Source/WebCore/platform/mac/WebCoreNSStringExtras.h b/Source/WebCore/platform/mac/WebCoreNSStringExtras.h
index b91c95b7c..a2a0e9316 100644
--- a/Source/WebCore/platform/mac/WebCoreNSStringExtras.h
+++ b/Source/WebCore/platform/mac/WebCoreNSStringExtras.h
@@ -40,9 +40,10 @@ extern "C" {
 #endif
 
 BOOL stringIsCaseInsensitiveEqualToString(NSString *first, NSString *second);
-BOOL hasCaseInsensitiveSuffix(NSString *string, NSString *suffix);
-BOOL hasCaseInsensitiveSubstring(NSString *string, NSString *substring);
-NSString *filenameByFixingIllegalCharacters(NSString *string);
+BOOL hasCaseInsensitiveSuffix(NSString *, NSString *suffix);
+BOOL hasCaseInsensitivePrefix(NSString *, NSString *prefix);
+BOOL hasCaseInsensitiveSubstring(NSString *, NSString *substring);
+NSString *filenameByFixingIllegalCharacters(NSString *);
 #if !PLATFORM(IOS)
 CFStringEncoding stringEncodingForResource(Handle resource);
 #endif
diff --git a/Source/WebCore/platform/mac/WebCoreNSStringExtras.mm b/Source/WebCore/platform/mac/WebCoreNSStringExtras.mm
index 81655ede1..38211c169 100644
--- a/Source/WebCore/platform/mac/WebCoreNSStringExtras.mm
+++ b/Source/WebCore/platform/mac/WebCoreNSStringExtras.mm
@@ -41,6 +41,11 @@ BOOL hasCaseInsensitiveSuffix(NSString *string, NSString *suffix)
     return [string rangeOfString:suffix options:(NSCaseInsensitiveSearch | NSBackwardsSearch | NSAnchoredSearch)].location != NSNotFound;
 }
 
+BOOL hasCaseInsensitivePrefix(NSString *string, NSString *prefix)
+{
+    return [string rangeOfString:prefix options:(NSCaseInsensitiveSearch | NSAnchoredSearch)].location != NSNotFound;
+}
+
 BOOL hasCaseInsensitiveSubstring(NSString *string, NSString *substring)
 {
     return [string rangeOfString:substring options:NSCaseInsensitiveSearch].location != NSNotFound;
diff --git a/Source/WebCore/platform/mac/WebCoreNSURLExtras.h b/Source/WebCore/platform/mac/WebCoreNSURLExtras.h
new file mode 100644
index 000000000..b8cbfdacd
--- /dev/null
+++ b/Source/WebCore/platform/mac/WebCoreNSURLExtras.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2005, 2007, 2012 Apple, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <objc/objc.h>
+
+#ifdef __OBJC__
+@class NSString;
+@class NSURL;
+#else
+OBJC_CLASS(NSString);
+OBJC_CLASS(NSURL);
+#endif
+
+namespace WebCore {
+
+NSString *userVisibleString(NSURL *);
+NSURL *URLWithUserTypedString(NSString *, NSURL *);
+NSURL *URLByRemovingUserInfo(NSURL *);
+BOOL hostNameNeedsDecodingWithRange(NSString *, NSRange);
+BOOL hostNameNeedsEncodingWithRange(NSString *, NSRange);
+NSString *decodeHostNameWithRange(NSString *, NSRange);
+NSString *encodeHostNameWithRange(NSString *, NSRange);
+NSString *decodeHostName(NSString *);
+NSString *encodeHostName(NSString *);
+NSURL *URLByTruncatingOneCharacterBeforeComponent(NSURL *, CFURLComponentType);
+NSURL *URLWithData(NSData *, NSURL *baseURL);
+NSData *originalURLData(NSURL *);
+NSData *dataForURLComponentType(NSURL *, CFURLComponentType);
+BOOL isUserVisibleURL(NSString *);
+    
+} // namespace WebCore
diff --git a/Source/WebCore/platform/mac/WebCoreNSURLExtras.mm b/Source/WebCore/platform/mac/WebCoreNSURLExtras.mm
new file mode 100644
index 000000000..b0751875f
--- /dev/null
+++ b/Source/WebCore/platform/mac/WebCoreNSURLExtras.mm
@@ -0,0 +1,880 @@
+/*
+ * Copyright (C) 2005, 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "WebCoreObjCExtras.h"
+#import "WebCoreNSStringExtras.h"
+#import "WebCoreNSURLExtras.h"
+#import "WebCoreSystemInterface.h"
+#import <wtf/RetainPtr.h>
+#import <wtf/Vector.h>
+#import <unicode/uchar.h>
+#import <unicode/uidna.h>
+#import <unicode/uscript.h>
+
+// Needs to be big enough to hold an IDN-encoded name.
+// For host names bigger than this, we won't do IDN encoding, which is almost certainly OK.
+#define HOST_NAME_BUFFER_LENGTH 2048
+#define URL_BYTES_BUFFER_LENGTH 2048
+
+typedef void (* StringRangeApplierFunction)(NSString *string, NSRange range, void *context);
+
+static pthread_once_t IDNScriptWhiteListFileRead = PTHREAD_ONCE_INIT;
+static uint32_t IDNScriptWhiteList[(USCRIPT_CODE_LIMIT + 31) / 32];
+
+namespace WebCore {
+
+static inline BOOL isLookalikeCharacter(int charCode)
+{
+    // This function treats the following as unsafe, lookalike characters:
+    // any non-printable character, any character considered as whitespace that isn't already converted to a space by ICU, 
+    // and any ignorable character.
+    
+    // We also considered the characters in Mozilla's blacklist (http://kb.mozillazine.org/Network.IDN.blacklist_chars), 
+    // and included all of these characters that ICU can encode.
+    
+    if (!u_isprint(charCode) || u_isUWhiteSpace(charCode) || u_hasBinaryProperty(charCode, UCHAR_DEFAULT_IGNORABLE_CODE_POINT))
+        return YES;
+    
+    switch (charCode) {
+        case 0x00ED: /* LATIN SMALL LETTER I WITH ACUTE */
+        case 0x01C3: /* LATIN LETTER RETROFLEX CLICK */
+        case 0x0251: /* LATIN SMALL LETTER ALPHA */
+        case 0x0261: /* LATIN SMALL LETTER SCRIPT G */
+        case 0x0337: /* COMBINING SHORT SOLIDUS OVERLAY */
+        case 0x0338: /* COMBINING LONG SOLIDUS OVERLAY */
+        case 0x05B4: /* HEBREW POINT HIRIQ */
+        case 0x05BC: /* HEBREW POINT DAGESH OR MAPIQ */
+        case 0x05C3: /* HEBREW PUNCTUATION SOF PASUQ */
+        case 0x05F4: /* HEBREW PUNCTUATION GERSHAYIM */
+        case 0x0660: /* ARABIC INDIC DIGIT ZERO */
+        case 0x06D4: /* ARABIC FULL STOP */
+        case 0x06F0: /* EXTENDED ARABIC INDIC DIGIT ZERO */
+        case 0x2027: /* HYPHENATION POINT */
+        case 0x2039: /* SINGLE LEFT-POINTING ANGLE QUOTATION MARK */
+        case 0x203A: /* SINGLE RIGHT-POINTING ANGLE QUOTATION MARK */
+        case 0x2044: /* FRACTION SLASH */
+        case 0x2215: /* DIVISION SLASH */
+        case 0x2216: /* SET MINUS */
+        case 0x233F: /* APL FUNCTIONAL SYMBOL SLASH BAR */
+        case 0x23AE: /* INTEGRAL EXTENSION */
+        case 0x244A: /* OCR DOUBLE BACKSLASH */
+        case 0x2571: /* BOX DRAWINGS LIGHT DIAGONAL UPPER RIGHT TO LOWER LEFT */
+        case 0x2572: /* BOX DRAWINGS LIGHT DIAGONAL UPPER LEFT TO LOWER RIGHT */
+        case 0x29F8: /* BIG SOLIDUS */
+        case 0x29f6: /* SOLIDUS WITH OVERBAR */
+        case 0x2AFB: /* TRIPLE SOLIDUS BINARY RELATION */
+        case 0x2AFD: /* DOUBLE SOLIDUS OPERATOR */
+        case 0x3008: /* LEFT ANGLE BRACKET */
+        case 0x3014: /* LEFT TORTOISE SHELL BRACKET */
+        case 0x3015: /* RIGHT TORTOISE SHELL BRACKET */
+        case 0x3033: /* VERTICAL KANA REPEAT MARK UPPER HALF */
+        case 0x3035: /* VERTICAL KANA REPEAT MARK LOWER HALF */
+        case 0x321D: /* PARENTHESIZED KOREAN CHARACTER OJEON */
+        case 0x321E: /* PARENTHESIZED KOREAN CHARACTER O HU */
+        case 0x33DF: /* SQUARE A OVER M */
+        case 0xFE14: /* PRESENTATION FORM FOR VERTICAL SEMICOLON */
+        case 0xFE15: /* PRESENTATION FORM FOR VERTICAL EXCLAMATION MARK */
+        case 0xFE3F: /* PRESENTATION FORM FOR VERTICAL LEFT ANGLE BRACKET */
+        case 0xFE5D: /* SMALL LEFT TORTOISE SHELL BRACKET */
+        case 0xFE5E: /* SMALL RIGHT TORTOISE SHELL BRACKET */
+            return YES;
+        default:
+            return NO;
+    }
+}
+
+static BOOL readIDNScriptWhiteListFile(NSString *filename)
+{
+    if (!filename)
+        return NO;
+
+    FILE *file = fopen([filename fileSystemRepresentation], "r");
+    if (!file)
+        return NO;
+    
+    // Read a word at a time.
+    // Allow comments, starting with # character to the end of the line.
+    while (1) {
+        // Skip a comment if present.
+        if (fscanf(file, " #%*[^\n\r]%*[\n\r]") == EOF)
+            break;
+        
+        // Read a script name if present.
+        char word[33];
+        int result = fscanf(file, " %32[^# \t\n\r]%*[^# \t\n\r] ", word);
+        if (result == EOF)
+            break;
+        
+        if (result == 1) {
+            // Got a word, map to script code and put it into the array.
+            int32_t script = u_getPropertyValueEnum(UCHAR_SCRIPT, word);
+            if (script >= 0 && script < USCRIPT_CODE_LIMIT) {
+                size_t index = script / 32;
+                uint32_t mask = 1 << (script % 32);
+                IDNScriptWhiteList[index] |= mask;
+            }
+        }
+    }
+    fclose(file);
+    return YES;
+}
+
+static void readIDNScriptWhiteList(void)
+{
+    // Read white list from library.
+    NSArray *dirs = NSSearchPathForDirectoriesInDomains(NSLibraryDirectory, NSAllDomainsMask, YES);
+    int numDirs = [dirs count];
+    for (int i = 0; i < numDirs; i++) {
+        if (readIDNScriptWhiteListFile([[dirs objectAtIndex:i] stringByAppendingPathComponent:@"IDNScriptWhiteList.txt"]))
+            return;
+    }
+    
+    // Fall back on white list inside bundle.
+    NSBundle *bundle = [NSBundle bundleWithIdentifier:@"com.apple.WebKit"];
+    
+    if (!readIDNScriptWhiteListFile([bundle pathForResource:@"IDNScriptWhiteList" ofType:@"txt"]))
+        CRASH();
+}
+
+static BOOL allCharactersInIDNScriptWhiteList(const UChar *buffer, int32_t length)
+{
+    pthread_once(&IDNScriptWhiteListFileRead, readIDNScriptWhiteList);
+    
+    int32_t i = 0;
+    while (i < length) {
+        UChar32 c;
+        U16_NEXT(buffer, i, length, c)
+        UErrorCode error = U_ZERO_ERROR;
+        UScriptCode script = uscript_getScript(c, &error);
+        if (error != U_ZERO_ERROR) {
+            LOG_ERROR("got ICU error while trying to look at scripts: %d", error);
+            return NO;
+        }
+        if (script < 0) {
+            LOG_ERROR("got negative number for script code from ICU: %d", script);
+            return NO;
+        }
+        if (script >= USCRIPT_CODE_LIMIT)
+            return NO;
+
+        size_t index = script / 32;
+        uint32_t mask = 1 << (script % 32);
+        if (!(IDNScriptWhiteList[index] & mask))
+            return NO;
+        
+        if (isLookalikeCharacter(c))
+            return NO;
+    }
+    return YES;
+}
+
+static BOOL allCharactersAllowedByTLDRules(const UChar* buffer, int32_t length)
+{
+    // Skip trailing dot for root domain.
+    if (buffer[length - 1] == '.')
+        length--;
+    
+    if (length > 3 && buffer[length - 3] == '.'
+        && buffer[length - 2] == 0x0440 // CYRILLIC SMALL LETTER ER
+        && buffer[length - 1] == 0x0444) // CYRILLIC SMALL LETTER EF
+    {
+        // Rules defined by <http://www.cctld.ru/ru/docs/rulesrf.php>. This code only checks requirements that matter for presentation purposes.
+        for (int32_t i = length - 4; i; --i) {
+            UChar ch = buffer[i];
+            
+            // Only modern Russian letters, digits and dashes are allowed.
+            if ((ch >= 0x0430 && ch <= 0x044f) || ch == 0x0451|| (ch >= '0' && ch <= '9') || ch == '-')
+                continue;
+            
+            // Only check top level domain. Lower level registrars may have different rules.
+            if (ch == '.')
+                break;
+            
+            return NO;
+        }
+        return YES;
+    }
+    
+    // Not a known top level domain with special rules.
+    return NO;
+}
+
+// Return value of nil means no mapping is necessary.
+// If makeString is NO, then return value is either nil or self to indicate mapping is necessary.
+// If makeString is YES, then return value is either nil or the mapped string.
+static NSString *mapHostNameWithRange(NSString *string, NSRange range, BOOL encode, BOOL makeString)
+{
+    if (range.length > HOST_NAME_BUFFER_LENGTH)
+        return nil;
+    
+    if (![string length])
+        return nil;
+    
+    UChar sourceBuffer[HOST_NAME_BUFFER_LENGTH];
+    UChar destinationBuffer[HOST_NAME_BUFFER_LENGTH];
+    
+    if (encode && [string rangeOfString:@"%" options:NSLiteralSearch range:range].location != NSNotFound) {
+        NSString *substring = [string substringWithRange:range];
+        substring = WebCoreCFAutorelease(CFURLCreateStringByReplacingPercentEscapes(NULL, (CFStringRef)substring, CFSTR("")));
+        if (substring) {
+            string = substring;
+            range = NSMakeRange(0, [string length]);
+        }
+    }
+    
+    int length = range.length;
+    [string getCharacters:sourceBuffer range:range];
+    
+    UErrorCode error = U_ZERO_ERROR;
+    int32_t numCharactersConverted = (encode ? uidna_IDNToASCII : uidna_IDNToUnicode)(sourceBuffer, length, destinationBuffer, HOST_NAME_BUFFER_LENGTH, UIDNA_ALLOW_UNASSIGNED, NULL, &error);
+    if (error != U_ZERO_ERROR)
+        return nil;
+    
+    if (numCharactersConverted == length && !memcmp(sourceBuffer, destinationBuffer, length * sizeof(UChar)))
+        return nil;
+    
+    if (!encode && !allCharactersInIDNScriptWhiteList(destinationBuffer, numCharactersConverted) && !allCharactersAllowedByTLDRules(destinationBuffer, numCharactersConverted))
+        return nil;
+    
+    return makeString ? (NSString *)[NSString stringWithCharacters:destinationBuffer length:numCharactersConverted] : string;
+}
+
+BOOL hostNameNeedsDecodingWithRange(NSString *string, NSRange range)
+{
+     return mapHostNameWithRange(string, range, NO, NO) != nil;
+}
+ 
+BOOL hostNameNeedsEncodingWithRange(NSString *string, NSRange range)
+{
+     return mapHostNameWithRange(string, range, YES,  NO) != nil;
+}
+
+NSString *decodeHostNameWithRange(NSString *string, NSRange range)
+{
+    return mapHostNameWithRange(string, range, NO, YES);
+}
+
+NSString *encodeHostNameWithRange(NSString *string, NSRange range)
+{
+    return mapHostNameWithRange(string, range, YES, YES);
+}
+
+NSString *decodeHostName(NSString *string)
+{
+    NSString *name = mapHostNameWithRange(string, NSMakeRange(0, [string length]), NO, YES);
+    return !name ? string : name;
+}
+
+NSString *encodeHostName(NSString *string)
+{
+    NSString *name =  mapHostNameWithRange(string, NSMakeRange(0, [string length]), YES, YES);
+    return !name ? string : name;
+}
+
+static void collectRangesThatNeedMapping(NSString *string, NSRange range, void *context, BOOL encode)
+{
+    BOOL needsMapping = encode ? hostNameNeedsEncodingWithRange(string, range) : hostNameNeedsDecodingWithRange(string, range);
+    if (!needsMapping)
+        return;
+    
+    NSMutableArray **array = (NSMutableArray **)context;
+    if (!*array)
+        *array = [[NSMutableArray alloc] init];
+    
+    [*array addObject:[NSValue valueWithRange:range]];
+}
+
+static void collectRangesThatNeedEncoding(NSString *string, NSRange range, void *context)
+{
+    return collectRangesThatNeedMapping(string, range, context, YES);
+}
+
+static void collectRangesThatNeedDecoding(NSString *string, NSRange range, void *context)
+{
+    return collectRangesThatNeedMapping(string, range, context, NO);
+}
+
+static inline NSCharacterSet *retain(NSCharacterSet *charset)
+{
+    CFRetain(charset);
+    return charset;
+}
+
+static void applyHostNameFunctionToMailToURLString(NSString *string, StringRangeApplierFunction f, void *context)
+{
+    // In a mailto: URL, host names come after a '@' character and end with a '>' or ',' or '?' character.
+    // Skip quoted strings so that characters in them don't confuse us.
+    // When we find a '?' character, we are past the part of the URL that contains host names.
+    
+    static NSCharacterSet *hostNameOrStringStartCharacters = retain([NSCharacterSet characterSetWithCharactersInString:@"\"@?"]);
+    static NSCharacterSet *hostNameEndCharacters = retain([NSCharacterSet characterSetWithCharactersInString:@">,?"]);
+    static NSCharacterSet *quotedStringCharacters = retain([NSCharacterSet characterSetWithCharactersInString:@"\"\\"]);
+    
+    unsigned stringLength = [string length];
+    NSRange remaining = NSMakeRange(0, stringLength);
+    
+    while (1) {
+        // Find start of host name or of quoted string.
+        NSRange hostNameOrStringStart = [string rangeOfCharacterFromSet:hostNameOrStringStartCharacters options:0 range:remaining];
+        if (hostNameOrStringStart.location == NSNotFound)
+            return;
+
+        unichar c = [string characterAtIndex:hostNameOrStringStart.location];
+        remaining.location = NSMaxRange(hostNameOrStringStart);
+        remaining.length = stringLength - remaining.location;
+        
+        if (c == '?')
+            return;
+        
+        if (c == '@') {
+            // Find end of host name.
+            unsigned hostNameStart = remaining.location;
+            NSRange hostNameEnd = [string rangeOfCharacterFromSet:hostNameEndCharacters options:0 range:remaining];
+            BOOL done;
+            if (hostNameEnd.location == NSNotFound) {
+                hostNameEnd.location = stringLength;
+                done = YES;
+            } else {
+                remaining.location = hostNameEnd.location;
+                remaining.length = stringLength - remaining.location;
+                done = NO;
+            }
+            
+            // Process host name range.
+            f(string, NSMakeRange(hostNameStart, hostNameEnd.location - hostNameStart), context);
+            
+            if (done)
+                return;
+        } else {
+            // Skip quoted string.
+            ASSERT(c == '"');
+            while (1) {
+                NSRange escapedCharacterOrStringEnd = [string rangeOfCharacterFromSet:quotedStringCharacters options:0 range:remaining];
+                if (escapedCharacterOrStringEnd.location == NSNotFound)
+                    return;
+
+                c = [string characterAtIndex:escapedCharacterOrStringEnd.location];
+                remaining.location = NSMaxRange(escapedCharacterOrStringEnd);
+                remaining.length = stringLength - remaining.location;
+                
+                // If we are the end of the string, then break from the string loop back to the host name loop.
+                if (c == '"')
+                    break;
+                
+                // Skip escaped character.
+                ASSERT(c == '\\');
+                if (!remaining.length)
+                    return;
+
+                remaining.location += 1;
+                remaining.length -= 1;
+            }
+        }
+    }
+}
+
+static void applyHostNameFunctionToURLString(NSString *string, StringRangeApplierFunction f, void *context)
+{
+    // Find hostnames. Too bad we can't use any real URL-parsing code to do this,
+    // but we have to do it before doing all the %-escaping, and this is the only
+    // code we have that parses mailto URLs anyway.
+    
+    // Maybe we should implement this using a character buffer instead?
+    
+    if (hasCaseInsensitivePrefix(string, @"mailto:")) {
+        applyHostNameFunctionToMailToURLString(string, f, context);
+        return;
+    }
+    
+    // Find the host name in a hierarchical URL.
+    // It comes after a "://" sequence, with scheme characters preceding.
+    // If ends with the end of the string or a ":", "/", or a "?".
+    // If there is a "@" character, the host part is just the part after the "@".
+    NSRange separatorRange = [string rangeOfString:@"://"];
+    if (separatorRange.location == NSNotFound)
+        return;
+    
+    // Check that all characters before the :// are valid scheme characters.
+    static NSCharacterSet *nonSchemeCharacters = retain([[NSCharacterSet characterSetWithCharactersInString:@"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-."] invertedSet]);
+    if ([string rangeOfCharacterFromSet:nonSchemeCharacters options:0 range:NSMakeRange(0, separatorRange.location)].location != NSNotFound)
+        return;
+    
+    unsigned stringLength = [string length];
+    
+    static NSCharacterSet *hostTerminators = retain([NSCharacterSet characterSetWithCharactersInString:@":/?#"]);
+    
+    // Start after the separator.
+    unsigned authorityStart = NSMaxRange(separatorRange);
+    
+    // Find terminating character.
+    NSRange hostNameTerminator = [string rangeOfCharacterFromSet:hostTerminators options:0 range:NSMakeRange(authorityStart, stringLength - authorityStart)];
+    unsigned hostNameEnd = hostNameTerminator.location == NSNotFound ? stringLength : hostNameTerminator.location;
+    
+    // Find "@" for the start of the host name.
+    NSRange userInfoTerminator = [string rangeOfString:@"@" options:0 range:NSMakeRange(authorityStart, hostNameEnd - authorityStart)];
+    unsigned hostNameStart = userInfoTerminator.location == NSNotFound ? authorityStart : NSMaxRange(userInfoTerminator);
+    
+    f(string, NSMakeRange(hostNameStart, hostNameEnd - hostNameStart), context);
+}
+
+static NSString *mapHostNames(NSString *string, BOOL encode)
+{
+    // Generally, we want to optimize for the case where there is one host name that does not need mapping.
+    
+    if (encode && [string canBeConvertedToEncoding:NSASCIIStringEncoding])
+        return string;
+    
+    // Make a list of ranges that actually need mapping.
+    NSMutableArray *hostNameRanges = nil;
+    StringRangeApplierFunction f = encode ? collectRangesThatNeedEncoding : collectRangesThatNeedDecoding;
+    applyHostNameFunctionToURLString(string, f, &hostNameRanges);
+    if (!hostNameRanges)
+        return string;
+    
+    // Do the mapping.
+    NSMutableString *mutableCopy = [string mutableCopy];
+    unsigned i = [hostNameRanges count];
+    while (i--) {
+        NSRange hostNameRange = [[hostNameRanges objectAtIndex:i] rangeValue];
+        NSString *mappedHostName = encode ? encodeHostNameWithRange(string, hostNameRange) : decodeHostNameWithRange(string, hostNameRange);
+        [mutableCopy replaceCharactersInRange:hostNameRange withString:mappedHostName];
+    }
+    [hostNameRanges release];
+    return [mutableCopy autorelease];
+}
+
+static BOOL isHexDigit(char c)
+{
+    return (c >= '0' && c <= '9') || (c >= 'A' && c <= 'F') || (c >= 'a' && c <= 'f');
+}
+
+static char hexDigit(int i)
+{
+    if (i < 0 || i > 16)
+        return '0';
+
+    return (i >= 10) ? i - 10 + 'A' : i += '0'; 
+}
+
+static int hexDigitValue(char c)
+{
+    if (c >= '0' && c <= '9')
+        return c - '0';
+
+    if (c >= 'A' && c <= 'F')
+        return c - 'A' + 10;
+
+    if (c >= 'a' && c <= 'f')
+        return c - 'a' + 10;
+
+    LOG_ERROR("illegal hex digit");
+    return 0;
+}
+
+static NSString *stringByTrimmingWhitespace(NSString *string)
+{
+    NSMutableString *trimmed = [[string mutableCopy] autorelease];
+    CFStringTrimWhitespace((CFMutableStringRef)trimmed);
+    return trimmed;
+}
+
+NSURL *URLByTruncatingOneCharacterBeforeComponent(NSURL *URL, CFURLComponentType component)
+{
+    if (!URL)
+        return nil;
+    
+    CFRange fragRg = CFURLGetByteRangeForComponent((CFURLRef)URL, component, NULL);
+    if (fragRg.location == kCFNotFound)
+        return URL;
+    
+    UInt8 *urlBytes, buffer[2048];
+    CFIndex numBytes = CFURLGetBytes((CFURLRef)URL, buffer, 2048);
+    if (numBytes == -1) {
+        numBytes = CFURLGetBytes((CFURLRef)URL, NULL, 0);
+        urlBytes = static_cast<UInt8*>(malloc(numBytes));
+        CFURLGetBytes((CFURLRef)URL, urlBytes, numBytes);
+    } else
+        urlBytes = buffer;
+        
+    NSURL *result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, fragRg.location - 1, kCFStringEncodingUTF8, NULL));
+    if (!result)
+        result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, fragRg.location - 1, kCFStringEncodingISOLatin1, NULL));
+        
+    if (urlBytes != buffer)
+        free(urlBytes);
+    return result ? [result autorelease] : URL;
+}
+
+static NSURL *URLByRemovingResourceSpecifier(NSURL *URL)
+{
+    return URLByTruncatingOneCharacterBeforeComponent(URL, kCFURLComponentResourceSpecifier);
+}
+
+NSURL *URLWithData(NSData *data, NSURL *baseURL)
+{
+    if (!data)
+        return nil;
+    
+    NSURL *result = nil;
+    size_t length = [data length];
+    if (length > 0) {
+        // work around <rdar://4470771>: CFURLCreateAbsoluteURLWithBytes(.., TRUE) doesn't remove non-path components.
+        baseURL = URLByRemovingResourceSpecifier(baseURL);
+        
+        const UInt8 *bytes = static_cast<const UInt8*>([data bytes]);
+        
+        // CFURLCreateAbsoluteURLWithBytes would complain to console if we passed a path to it.
+        if (bytes[0] == '/' && !baseURL)
+            return nil;
+        
+        // NOTE: We use UTF-8 here since this encoding is used when computing strings when returning URL components
+        // (e.g calls to NSURL -path). However, this function is not tolerant of illegal UTF-8 sequences, which
+        // could either be a malformed string or bytes in a different encoding, like shift-jis, so we fall back
+        // onto using ISO Latin 1 in those cases.
+        result = WebCoreCFAutorelease(CFURLCreateAbsoluteURLWithBytes(NULL, bytes, length, kCFStringEncodingUTF8, (CFURLRef)baseURL, YES));
+        if (!result)
+            result = WebCoreCFAutorelease(CFURLCreateAbsoluteURLWithBytes(NULL, bytes, length, kCFStringEncodingISOLatin1, (CFURLRef)baseURL, YES));
+    } else
+            result = [NSURL URLWithString:@""];
+                
+    return result;
+}
+
+NSURL *URLWithUserTypedString(NSString *string, NSURL *URL)
+{
+    if (!string)
+        return nil;
+
+    string = mapHostNames(stringByTrimmingWhitespace(string), YES);
+    
+    NSData *userTypedData = [string dataUsingEncoding:NSUTF8StringEncoding];
+    ASSERT(userTypedData);
+    
+    const UInt8* inBytes = static_cast<const UInt8 *>([userTypedData bytes]);
+    int inLength = [userTypedData length];
+    if (!inLength)
+        return [NSURL URLWithString:@""];
+    
+    char* outBytes = static_cast<char *>(malloc(inLength * 3)); // large enough to %-escape every character
+    char* p = outBytes;
+    int outLength = 0;
+    for (int i = 0; i < inLength; i++) {
+        UInt8 c = inBytes[i];
+        if (c <= 0x20 || c >= 0x7f) {
+            *p++ = '%';
+            *p++ = hexDigit(c >> 4);
+            *p++ = hexDigit(c & 0xf);
+            outLength += 3;
+        } else {
+            *p++ = c;
+            outLength++;
+        }
+    }
+    
+    NSData *data = [NSData dataWithBytesNoCopy:outBytes length:outLength]; // adopts outBytes
+    return URLWithData(data, URL);
+}
+
+static BOOL hasQuestionMarkOnlyQueryString(NSURL *URL)
+{
+    CFRange rangeWithSeparators;
+    CFURLGetByteRangeForComponent((CFURLRef)URL, kCFURLComponentQuery, &rangeWithSeparators);
+    if (rangeWithSeparators.location != kCFNotFound && rangeWithSeparators.length == 1)
+        return YES;
+
+    return NO;
+}
+
+#define completeURL (CFURLComponentType)-1
+
+NSData *dataForURLComponentType(NSURL *URL, CFURLComponentType componentType)
+{
+    static int URLComponentTypeBufferLength = 2048;
+    
+    UInt8 staticAllBytesBuffer[URLComponentTypeBufferLength];
+    UInt8 *allBytesBuffer = staticAllBytesBuffer;
+    
+    CFIndex bytesFilled = CFURLGetBytes((CFURLRef)URL, allBytesBuffer, URLComponentTypeBufferLength);
+    if (bytesFilled == -1) {
+        CFIndex bytesToAllocate = CFURLGetBytes((CFURLRef)URL, NULL, 0);
+        allBytesBuffer = static_cast<UInt8 *>(malloc(bytesToAllocate));
+        bytesFilled = CFURLGetBytes((CFURLRef)URL, allBytesBuffer, bytesToAllocate);
+    }
+    
+    CFRange range;
+    if (componentType != completeURL) {
+        range = CFURLGetByteRangeForComponent((CFURLRef)URL, componentType, NULL);
+        if (range.location == kCFNotFound)
+            return nil;
+    } else {
+        range.location = 0;
+        range.length = bytesFilled;
+    }
+    
+    NSData *componentData = [NSData dataWithBytes:allBytesBuffer + range.location length:range.length]; 
+    
+    const unsigned char *bytes = static_cast<const unsigned char *>([componentData bytes]);
+    NSMutableData *resultData = [NSMutableData data];
+    // NOTE: add leading '?' to query strings non-zero length query strings.
+    // NOTE: retain question-mark only query strings.
+    if (componentType == kCFURLComponentQuery) {
+        if (range.length > 0 || hasQuestionMarkOnlyQueryString(URL))
+            [resultData appendBytes:"?" length:1];    
+    }
+    for (int i = 0; i < range.length; i++) {
+        unsigned char c = bytes[i];
+        if (c <= 0x20 || c >= 0x7f) {
+            char escaped[3];
+            escaped[0] = '%';
+            escaped[1] = hexDigit(c >> 4);
+            escaped[2] = hexDigit(c & 0xf);
+            [resultData appendBytes:escaped length:3];    
+        } else {
+            char b[1];
+            b[0] = c;
+            [resultData appendBytes:b length:1];    
+        }               
+    }
+    
+    if (staticAllBytesBuffer != allBytesBuffer)
+        free(allBytesBuffer);
+    
+    return resultData;
+}
+
+static NSURL *URLByRemovingComponentAndSubsequentCharacter(NSURL *URL, CFURLComponentType component)
+{
+    CFRange range = CFURLGetByteRangeForComponent((CFURLRef)URL, component, 0);
+    if (range.location == kCFNotFound)
+        return URL;
+    
+    // Remove one subsequent character.
+    range.length++;
+    
+    UInt8* urlBytes;
+    UInt8 buffer[2048];
+    CFIndex numBytes = CFURLGetBytes((CFURLRef)URL, buffer, 2048);
+    if (numBytes == -1) {
+        numBytes = CFURLGetBytes((CFURLRef)URL, NULL, 0);
+        urlBytes = static_cast<UInt8*>(malloc(numBytes));
+        CFURLGetBytes((CFURLRef)URL, urlBytes, numBytes);
+    } else
+        urlBytes = buffer;
+        
+    if (numBytes < range.location)
+        return URL;
+    if (numBytes < range.location + range.length)
+        range.length = numBytes - range.location;
+        
+    memmove(urlBytes + range.location, urlBytes + range.location + range.length, numBytes - range.location + range.length);
+    
+    NSURL *result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, numBytes - range.length, kCFStringEncodingUTF8, NULL));
+    if (!result)
+        result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, numBytes - range.length, kCFStringEncodingISOLatin1, NULL));
+            
+    if (urlBytes != buffer)
+        free(urlBytes);
+                
+    return result ? [result autorelease] : URL;
+}
+
+NSURL *URLByRemovingUserInfo(NSURL *URL)
+{
+    return URLByRemovingComponentAndSubsequentCharacter(URL, kCFURLComponentUserInfo);
+}
+
+NSData *originalURLData(NSURL *URL)
+{
+    UInt8 *buffer = (UInt8 *)malloc(URL_BYTES_BUFFER_LENGTH);
+    CFIndex bytesFilled = CFURLGetBytes((CFURLRef)URL, buffer, URL_BYTES_BUFFER_LENGTH);
+    if (bytesFilled == -1) {
+        CFIndex bytesToAllocate = CFURLGetBytes((CFURLRef)URL, NULL, 0);
+        buffer = (UInt8 *)realloc(buffer, bytesToAllocate);
+        bytesFilled = CFURLGetBytes((CFURLRef)URL, buffer, bytesToAllocate);
+        ASSERT(bytesFilled == bytesToAllocate);
+    }
+    
+    // buffer is adopted by the NSData
+    NSData *data = [NSData dataWithBytesNoCopy:buffer length:bytesFilled freeWhenDone:YES];
+    
+    NSURL *baseURL = (NSURL *)CFURLGetBaseURL((CFURLRef)URL);
+    if (baseURL)
+        return originalURLData(URLWithData(data, baseURL));
+    return data;
+}
+
+static CFStringRef createStringWithEscapedUnsafeCharacters(CFStringRef string)
+{
+    CFIndex length = CFStringGetLength(string);
+    Vector<UChar, 2048> sourceBuffer(length);
+    CFStringGetCharacters(string, CFRangeMake(0, length), sourceBuffer.data());
+    
+    Vector<UChar, 2048> outBuffer;
+    
+    CFIndex i = 0;
+    while (i < length) {
+        UChar32 c;
+        U16_NEXT(sourceBuffer, i, length, c)
+        
+        if (isLookalikeCharacter(c)) {
+            uint8_t utf8Buffer[4];
+            CFIndex offset = 0;
+            UBool failure = false;
+            U8_APPEND(utf8Buffer, offset, 4, c, failure)
+            ASSERT(!failure);
+            
+            for (CFIndex j = 0; j < offset; ++j) {
+                outBuffer.append('%');
+                outBuffer.append(hexDigit(utf8Buffer[j] >> 4));
+                outBuffer.append(hexDigit(utf8Buffer[j] & 0xf));
+            }
+        } else {
+            UChar utf16Buffer[2];
+            CFIndex offset = 0;
+            UBool failure = false;
+            U16_APPEND(utf16Buffer, offset, 2, c, failure)
+            ASSERT(!failure);
+            for (CFIndex j = 0; j < offset; ++j)
+                outBuffer.append(utf16Buffer[j]);
+        }
+    }
+    
+    return CFStringCreateWithCharacters(NULL, outBuffer.data(), outBuffer.size());
+}
+
+NSString *userVisibleString(NSURL *URL)
+{
+    NSData *data = originalURLData(URL);
+    const unsigned char *before = static_cast<const unsigned char*>([data bytes]);
+    int length = [data length];
+    
+    bool needsHostNameDecoding = false;
+    
+    const unsigned char *p = before;
+    int bufferLength = (length * 3) + 1;
+    char *after = static_cast<char *>(malloc(bufferLength)); // large enough to %-escape every character
+    char *q = after;
+    for (int i = 0; i < length; i++) {
+        unsigned char c = p[i];
+        // unescape escape sequences that indicate bytes greater than 0x7f
+        if (c == '%' && (i + 1 < length && isHexDigit(p[i + 1])) && i + 2 < length && isHexDigit(p[i + 2])) {
+            unsigned char u = (hexDigitValue(p[i + 1]) << 4) | hexDigitValue(p[i + 2]);
+            if (u > 0x7f) {
+                // unescape
+                *q++ = u;
+            } else {
+                // do not unescape
+                *q++ = p[i];
+                *q++ = p[i + 1];
+                *q++ = p[i + 2];
+            }
+            i += 2;
+        } else {
+            *q++ = c;
+            
+            // Check for "xn--" in an efficient, non-case-sensitive, way.
+            if (c == '-' && i >= 3 && !needsHostNameDecoding && (q[-4] | 0x20) == 'x' && (q[-3] | 0x20) == 'n' && q[-2] == '-')
+                needsHostNameDecoding = true;
+        }
+    }
+    *q = '\0';
+    
+    // Check string to see if it can be converted to display using UTF-8  
+    NSString *result = [NSString stringWithUTF8String:after];
+    if (!result) {
+        // Could not convert to UTF-8.
+        // Convert characters greater than 0x7f to escape sequences.
+        // Shift current string to the end of the buffer
+        // then we will copy back bytes to the start of the buffer 
+        // as we convert.
+        int afterlength = q - after;
+        char *p = after + bufferLength - afterlength - 1;
+        memmove(p, after, afterlength + 1); // copies trailing '\0'
+        char *q = after;
+        while (*p) {
+            unsigned char c = *p;
+            if (c > 0x7f) {
+                *q++ = '%';
+                *q++ = hexDigit(c >> 4);
+                *q++ = hexDigit(c & 0xf);
+            } else
+                *q++ = *p;
+            p++;
+        }
+        *q = '\0';
+        result = [NSString stringWithUTF8String:after];
+    }
+    
+    free(after);
+    
+    result = mapHostNames(result, !needsHostNameDecoding);
+    result = [result precomposedStringWithCanonicalMapping];
+    return WebCoreCFAutorelease(createStringWithEscapedUnsafeCharacters((CFStringRef)result));
+}
+
+BOOL isUserVisibleURL(NSString *string)
+{
+    BOOL valid = YES;
+    // get buffer
+    
+    char static_buffer[1024];
+    const char *p;
+    BOOL success = CFStringGetCString((CFStringRef)string, static_buffer, 1023, kCFStringEncodingUTF8);
+    p = success ? static_buffer : [string UTF8String];
+    
+    int length = strlen(p);
+    
+    // check for characters <= 0x20 or >=0x7f, %-escape sequences of %7f, and xn--, these
+    // are the things that will lead _web_userVisibleString to actually change things.
+    for (int i = 0; i < length; i++) {
+        unsigned char c = p[i];
+        // escape control characters, space, and delete
+        if (c <= 0x20 || c == 0x7f) {
+            valid = NO;
+            break;
+        } else if (c == '%' && (i + 1 < length && isHexDigit(p[i + 1])) && i + 2 < length && isHexDigit(p[i + 2])) {
+            unsigned char u = (hexDigitValue(p[i + 1]) << 4) | hexDigitValue(p[i + 2]);
+            if (u > 0x7f) {
+                valid = NO;
+                break;
+            }
+            i += 2;
+        } else {
+            // Check for "xn--" in an efficient, non-case-sensitive, way.
+            if (c == '-' && i >= 3 && (p[i - 3] | 0x20) == 'x' && (p[i - 2] | 0x20) == 'n' && p[i - 1] == '-') {
+                valid = NO;
+                break;
+            }
+        }
+    }
+    
+    return valid;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/mac/WebCoreObjCExtras.h b/Source/WebCore/platform/mac/WebCoreObjCExtras.h
index 7e699a5d1..62383898d 100644
--- a/Source/WebCore/platform/mac/WebCoreObjCExtras.h
+++ b/Source/WebCore/platform/mac/WebCoreObjCExtras.h
@@ -32,6 +32,18 @@
 extern "C" {
 #endif
 
+// Use WebCFAutorelease to return an object made by a CoreFoundation
+// "create" or "copy" function as an autoreleased and garbage collected
+// object. CF objects need to be "made collectable" for autorelease to work
+// properly under GC.
+static inline id WebCoreCFAutorelease(CFTypeRef obj)
+{
+    if (obj)
+        CFMakeCollectable(obj);
+    [(id)obj autorelease];
+    return (id)obj;
+}
+
 void WebCoreObjCFinalizeOnMainThread(Class cls);
 
 // The 'Class' that should be passed in here is the class of the
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.h b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
index e632e2a9a..b2afadd12 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -78,6 +78,7 @@ typedef const struct _CFURLRequest* CFURLRequestRef;
 #endif
 
 OBJC_CLASS AVAsset;
+OBJC_CLASS CALayer;
 OBJC_CLASS NSArray;
 OBJC_CLASS NSButtonCell;
 OBJC_CLASS NSControl;
@@ -106,6 +107,10 @@ extern "C" {
 // In alphabetical order.
 
 extern void (*wkAdvanceDefaultButtonPulseAnimation)(NSButtonCell *);
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+extern void (*wkCALayerEnumerateRectsBeingDrawnWithBlock)(CALayer *, CGContextRef, void (^block)(CGRect rect));
+#endif
+
 extern BOOL (*wkCGContextGetShouldSmoothFonts)(CGContextRef);
 typedef enum {
     wkPatternTilingNoDistortion,
@@ -287,7 +292,8 @@ extern CFArrayRef (*wkCFURLRequestCopyHTTPRequestBodyParts)(CFURLRequestRef);
 extern void (*wkCFURLRequestSetHTTPRequestBodyParts)(CFMutableURLRequestRef, CFArrayRef bodyParts);
 extern void (*wkSetRequestStorageSession)(CFURLStorageSessionRef, CFMutableURLRequestRef);
 #endif
-
+extern void (*wkSetMetadataURL)(NSString *urlString, NSString *referrer, NSString *path);
+    
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
 #import <dispatch/dispatch.h>
 
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
index a046a892b..4cce2afb0 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -28,6 +28,9 @@
 #import <Foundation/Foundation.h>
 
 void (*wkAdvanceDefaultButtonPulseAnimation)(NSButtonCell *);
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+void (*wkCALayerEnumerateRectsBeingDrawnWithBlock)(CALayer *, CGContextRef context, void (^block)(CGRect rect));
+#endif
 BOOL (*wkCGContextGetShouldSmoothFonts)(CGContextRef);
 void (*wkCGContextResetClip)(CGContextRef);
 CGPatternRef (*wkCGPatternCreateWithImageAndTransform)(CGImageRef, CGAffineTransform, int);
@@ -173,6 +176,7 @@ CFURLRef (*wkGetCFURLResponseURL)(CFURLResponseRef);
 CFHTTPMessageRef (*wkGetCFURLResponseHTTPResponse)(CFURLResponseRef);
 CFStringRef (*wkCopyCFURLResponseSuggestedFilename)(CFURLResponseRef);
 void (*wkSetCFURLResponseMIMEType)(CFURLResponseRef, CFStringRef mimeType);
+void (*wkSetMetadataURL)(NSString *urlString, NSString *referrer, NSString *path);
 
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
 dispatch_source_t (*wkCreateVMPressureDispatchOnMainQueue)(void);
diff --git a/Source/WebCore/platform/mock/ScrollbarThemeMock.cpp b/Source/WebCore/platform/mock/ScrollbarThemeMock.cpp
index 5d2bc3ec0..6de91ccb8 100644
--- a/Source/WebCore/platform/mock/ScrollbarThemeMock.cpp
+++ b/Source/WebCore/platform/mock/ScrollbarThemeMock.cpp
@@ -32,7 +32,7 @@ namespace WebCore {
 
 static int cScrollbarThickness[] = { 15, 11 };
 
-IntRect ScrollbarThemeMock::trackRect(Scrollbar* scrollbar, bool)
+IntRect ScrollbarThemeMock::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     return scrollbar->frameRect();
 }
@@ -42,12 +42,12 @@ int ScrollbarThemeMock::scrollbarThickness(ScrollbarControlSize controlSize)
     return cScrollbarThickness[controlSize];
 }
 
-void ScrollbarThemeMock::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& trackRect)
+void ScrollbarThemeMock::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& trackRect)
 {
     context->fillRect(trackRect, scrollbar->enabled() ? Color::lightGray : Color(0xFFE0E0E0), ColorSpaceDeviceRGB);
 }
 
-void ScrollbarThemeMock::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& thumbRect)
+void ScrollbarThemeMock::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& thumbRect)
 {
     if (scrollbar->enabled())
         context->fillRect(thumbRect, Color::darkGray, ColorSpaceDeviceRGB);
diff --git a/Source/WebCore/platform/mock/ScrollbarThemeMock.h b/Source/WebCore/platform/mock/ScrollbarThemeMock.h
index e2548422a..6333841ab 100644
--- a/Source/WebCore/platform/mock/ScrollbarThemeMock.h
+++ b/Source/WebCore/platform/mock/ScrollbarThemeMock.h
@@ -36,15 +36,15 @@ public:
     virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
 
 protected:
-    virtual bool hasButtons(Scrollbar*) { return false; }
-    virtual bool hasThumb(Scrollbar*) { return true; }
+    virtual bool hasButtons(ScrollbarThemeClient*) { return false; }
+    virtual bool hasThumb(ScrollbarThemeClient*) { return true; }
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool /*painting*/ = false) { return IntRect(); }
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool /*painting*/ = false) { return IntRect(); }
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool /*painting*/ = false) { return IntRect(); }
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool /*painting*/ = false) { return IntRect(); }
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
     
-    virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-    virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
+    virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
     
 private:
     virtual bool isMockTheme() const { return true; }
diff --git a/Source/WebCore/platform/network/BlobRegistry.h b/Source/WebCore/platform/network/BlobRegistry.h
index 7e64233d2..5284a9b0d 100644
--- a/Source/WebCore/platform/network/BlobRegistry.h
+++ b/Source/WebCore/platform/network/BlobRegistry.h
@@ -59,7 +59,6 @@ public:
     virtual void registerBlobURL(const KURL&, const KURL& srcURL) = 0;
 
     virtual void unregisterBlobURL(const KURL&) = 0;
-    virtual PassRefPtr<ResourceHandle> createResourceHandle(const ResourceRequest&, ResourceHandleClient*) = 0;
     virtual bool loadResourceSynchronously(const ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>& data) = 0;
 
 protected:
diff --git a/Source/WebCore/platform/network/BlobRegistryImpl.cpp b/Source/WebCore/platform/network/BlobRegistryImpl.cpp
index 83517f10e..59a9a9c60 100644
--- a/Source/WebCore/platform/network/BlobRegistryImpl.cpp
+++ b/Source/WebCore/platform/network/BlobRegistryImpl.cpp
@@ -52,6 +52,26 @@ BlobRegistry& blobRegistry()
     DEFINE_STATIC_LOCAL(BlobRegistryImpl, instance, ());
     return instance;
 }
+
+static PassRefPtr<ResourceHandle> createResourceHandle(const ResourceRequest& request, ResourceHandleClient* client)
+{
+    return static_cast<BlobRegistryImpl&>(blobRegistry()).createResourceHandle(request, client);
+}
+
+static void registerBlobResourceHandleConstructor()
+{
+    static bool didRegister = false;
+    if (!didRegister) {
+        ResourceHandle::registerBuiltinConstructor("blob", createResourceHandle);
+        didRegister = true;
+    }
+}
+
+#else
+
+static void registerBlobResourceHandleConstructor()
+{
+}
 #endif
 
 bool BlobRegistryImpl::shouldLoadResource(const ResourceRequest& request) const
@@ -125,6 +145,7 @@ void BlobRegistryImpl::appendStorageItems(BlobStorageData* blobStorageData, cons
 void BlobRegistryImpl::registerBlobURL(const KURL& url, PassOwnPtr<BlobData> blobData)
 {
     ASSERT(isMainThread());
+    registerBlobResourceHandleConstructor();
 
     RefPtr<BlobStorageData> blobStorageData = BlobStorageData::create(blobData->contentType(), blobData->contentDisposition());
 
@@ -154,6 +175,7 @@ void BlobRegistryImpl::registerBlobURL(const KURL& url, PassOwnPtr<BlobData> blo
 void BlobRegistryImpl::registerBlobURL(const KURL& url, const KURL& srcURL)
 {
     ASSERT(isMainThread());
+    registerBlobResourceHandleConstructor();
 
     RefPtr<BlobStorageData> src = m_blobs.get(srcURL.string());
     ASSERT(src);
diff --git a/Source/WebCore/platform/network/BlobRegistryImpl.h b/Source/WebCore/platform/network/BlobRegistryImpl.h
index f61666480..608da7f29 100644
--- a/Source/WebCore/platform/network/BlobRegistryImpl.h
+++ b/Source/WebCore/platform/network/BlobRegistryImpl.h
@@ -56,11 +56,12 @@ public:
     virtual void registerBlobURL(const KURL&, PassOwnPtr<BlobData>);
     virtual void registerBlobURL(const KURL&, const KURL& srcURL);
     virtual void unregisterBlobURL(const KURL&);
-    virtual PassRefPtr<ResourceHandle> createResourceHandle(const ResourceRequest&, ResourceHandleClient*);
     virtual bool loadResourceSynchronously(const ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>& data);
 
     PassRefPtr<BlobStorageData> getBlobDataFromURL(const KURL&) const;
 
+    PassRefPtr<ResourceHandle> createResourceHandle(const ResourceRequest&, ResourceHandleClient*);
+
 private:
     bool shouldLoadResource(const ResourceRequest& request) const;
     void appendStorageItems(BlobStorageData*, const BlobDataItemList&);
diff --git a/Source/WebCore/platform/network/BlobResourceHandle.cpp b/Source/WebCore/platform/network/BlobResourceHandle.cpp
index 2b94bdb52..e47b87983 100644
--- a/Source/WebCore/platform/network/BlobResourceHandle.cpp
+++ b/Source/WebCore/platform/network/BlobResourceHandle.cpp
@@ -35,21 +35,20 @@
 #include "BlobResourceHandle.h"
 
 #include "AsyncFileStream.h"
-#include "BlobRegistryImpl.h"
+#include "BlobStorageData.h"
 #include "FileStream.h"
 #include "FileSystem.h"
 #include "HTTPParsers.h"
 #include "KURL.h"
 #include "ResourceError.h"
-#include "ResourceLoader.h"
+#include "ResourceHandleClient.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include <wtf/MainThread.h>
 
 namespace WebCore {
 
-static const unsigned bufferSize = 1024;
-static const int maxVectorLength = 0x7fffffff;
+static const unsigned bufferSize = 512 * 1024;
 static const long long positionNotSpecified = -1;
 
 static const int httpOK = 200;
@@ -65,10 +64,13 @@ static const char* httpNotFoundText = "Not Found";
 static const char* httpRequestedRangeNotSatisfiableText = "Requested Range Not Satisfiable";
 static const char* httpInternalErrorText = "Internal Server Error";
 
-static const int notFoundError = 1;
-static const int securityError = 2;
-static const int rangeError = 3;
-static const int notReadableError = 4;
+static const char* const webKitBlobResourceDomain = "WebKitBlobResource";
+enum {
+    notFoundError = 1,
+    securityError = 2,
+    rangeError = 3,
+    notReadableError = 4,
+};
 
 ///////////////////////////////////////////////////////////////////////////////
 // BlobResourceSynchronousLoader
@@ -100,9 +102,8 @@ BlobResourceSynchronousLoader::BlobResourceSynchronousLoader(ResourceError& erro
 void BlobResourceSynchronousLoader::didReceiveResponse(ResourceHandle* handle, const ResourceResponse& response)
 {
     // We cannot handle the size that is more than maximum integer.
-    const int intMaxForLength = 0x7fffffff;
-    if (response.expectedContentLength() > intMaxForLength) {
-        m_error = ResourceError(String(), notReadableError, response.url(), String());
+    if (response.expectedContentLength() > INT_MAX) {
+        m_error = ResourceError(webKitBlobResourceDomain, notReadableError, response.url(), "File is too large");
         return;
     }
 
@@ -229,6 +230,7 @@ void BlobResourceHandle::doStart()
     if (m_async)
         getSizeForNext();
     else {
+        RefPtr<BlobResourceHandle> protect(this); // getSizeForNext calls the client
         for (size_t i = 0; i < m_blobData->items().size() && !m_aborted && !m_errorCode; ++i)
             getSizeForNext();
         notifyResponse();
@@ -243,6 +245,7 @@ void BlobResourceHandle::getSizeForNext()
 
         // Start reading if in asynchronous mode.
         if (m_async) {
+            RefPtr<BlobResourceHandle> protect(this);
             notifyResponse();
             m_buffer.resize(bufferSize);
             readAsync();
@@ -327,6 +330,7 @@ void BlobResourceHandle::seek()
 int BlobResourceHandle::readSync(char* buf, int length)
 {
     ASSERT(!m_async);
+    RefPtr<BlobResourceHandle> protect(this);
 
     int offset = 0;
     int remaining = length;
@@ -446,6 +450,7 @@ void BlobResourceHandle::readAsync()
 void BlobResourceHandle::readDataAsync(const BlobDataItem& item)
 {
     ASSERT(m_async);
+    RefPtr<BlobResourceHandle> protect(this);
 
     long long bytesToRead = item.length - m_currentItemReadSize;
     if (bytesToRead > m_totalRemainingSize)
@@ -486,12 +491,18 @@ void BlobResourceHandle::didOpen(bool success)
 
 void BlobResourceHandle::didRead(int bytesRead)
 {
+    if (bytesRead < 0) {
+        failed(notReadableError);
+        return;
+    }
+
     consumeData(m_buffer.data(), bytesRead);
 }
 
 void BlobResourceHandle::consumeData(const char* data, int bytesRead)
 {
     ASSERT(m_async);
+    RefPtr<BlobResourceHandle> protect(this);
 
     m_totalRemainingSize -= bytesRead;
 
@@ -521,6 +532,7 @@ void BlobResourceHandle::consumeData(const char* data, int bytesRead)
 void BlobResourceHandle::failed(int errorCode)
 {
     ASSERT(m_async);
+    RefPtr<BlobResourceHandle> protect(this);
 
     // Notify the client.
     notifyFail(errorCode);
@@ -592,7 +604,7 @@ void BlobResourceHandle::notifyReceiveData(const char* data, int bytesRead)
 void BlobResourceHandle::notifyFail(int errorCode)
 {
     if (client())
-        client()->didFail(this, ResourceError(String(), errorCode, firstRequest().url(), String()));
+        client()->didFail(this, ResourceError(webKitBlobResourceDomain, errorCode, firstRequest().url(), String()));
 }
 
 static void doNotifyFinish(void* context)
diff --git a/Source/WebCore/platform/network/CredentialStorage.cpp b/Source/WebCore/platform/network/CredentialStorage.cpp
index 361c78477..f0984f885 100644
--- a/Source/WebCore/platform/network/CredentialStorage.cpp
+++ b/Source/WebCore/platform/network/CredentialStorage.cpp
@@ -85,7 +85,7 @@ static String protectionSpaceMapKeyFromURL(const KURL& url)
 
 void CredentialStorage::set(const Credential& credential, const ProtectionSpace& protectionSpace, const KURL& url)
 {
-    ASSERT(protectionSpace.isProxy() || url.protocolInHTTPFamily());
+    ASSERT(protectionSpace.isProxy() || url.protocolIsInHTTPFamily());
     ASSERT(protectionSpace.isProxy() || url.isValid());
 
     protectionSpaceToCredentialMap().set(protectionSpace, credential);
@@ -112,7 +112,7 @@ void CredentialStorage::remove(const ProtectionSpace& protectionSpace)
 
 static PathToDefaultProtectionSpaceMap::iterator findDefaultProtectionSpaceForURL(const KURL& url)
 {
-    ASSERT(url.protocolInHTTPFamily());
+    ASSERT(url.protocolIsInHTTPFamily());
     ASSERT(url.isValid());
 
     PathToDefaultProtectionSpaceMap& map = pathToDefaultProtectionSpaceMap();
@@ -141,7 +141,7 @@ static PathToDefaultProtectionSpaceMap::iterator findDefaultProtectionSpaceForUR
 
 bool CredentialStorage::set(const Credential& credential, const KURL& url)
 {
-    ASSERT(url.protocolInHTTPFamily());
+    ASSERT(url.protocolIsInHTTPFamily());
     ASSERT(url.isValid());
     PathToDefaultProtectionSpaceMap::iterator iter = findDefaultProtectionSpaceForURL(url);
     if (iter == pathToDefaultProtectionSpaceMap().end())
diff --git a/Source/WebCore/platform/network/ResourceHandle.cpp b/Source/WebCore/platform/network/ResourceHandle.cpp
index 4d943694e..6f2be27b0 100644
--- a/Source/WebCore/platform/network/ResourceHandle.cpp
+++ b/Source/WebCore/platform/network/ResourceHandle.cpp
@@ -33,12 +33,26 @@
 #include "ResourceHandleClient.h"
 #include "Timer.h"
 #include <algorithm>
+#include <wtf/MainThread.h>
 #include <wtf/text/CString.h>
 
 namespace WebCore {
 
 static bool shouldForceContentSniffing;
 
+typedef HashMap<AtomicString, ResourceHandle::BuiltinConstructor> BuiltinResourceHandleConstructorMap;
+static BuiltinResourceHandleConstructorMap& builtinResourceHandleConstructorMap()
+{
+    ASSERT(isMainThread());
+    DEFINE_STATIC_LOCAL(BuiltinResourceHandleConstructorMap, map, ());
+    return map;
+}
+
+void ResourceHandle::registerBuiltinConstructor(const AtomicString& protocol, ResourceHandle::BuiltinConstructor constructor)
+{
+    builtinResourceHandleConstructorMap().add(protocol, constructor);
+}
+
 ResourceHandle::ResourceHandle(const ResourceRequest& request, ResourceHandleClient* client, bool defersLoading, bool shouldContentSniff)
     : d(adoptPtr(new ResourceHandleInternal(this, request, client, defersLoading, shouldContentSniff && shouldContentSniffURL(request.url()))))
 {
@@ -55,13 +69,10 @@ ResourceHandle::ResourceHandle(const ResourceRequest& request, ResourceHandleCli
 
 PassRefPtr<ResourceHandle> ResourceHandle::create(NetworkingContext* context, const ResourceRequest& request, ResourceHandleClient* client, bool defersLoading, bool shouldContentSniff)
 {
-#if ENABLE(BLOB)
-    if (request.url().protocolIs("blob")) {
-        PassRefPtr<ResourceHandle> handle = blobRegistry().createResourceHandle(request, client);
-        if (handle)
-            return handle;
-    }
-#endif
+    BuiltinResourceHandleConstructorMap::iterator protocolMapItem = builtinResourceHandleConstructorMap().find(request.url().protocol());
+
+    if (protocolMapItem != builtinResourceHandleConstructorMap().end())
+        return protocolMapItem->second(request, client);
 
     RefPtr<ResourceHandle> newHandle(adoptRef(new ResourceHandle(request, client, defersLoading, shouldContentSniff)));
 
diff --git a/Source/WebCore/platform/network/ResourceHandle.h b/Source/WebCore/platform/network/ResourceHandle.h
index 1b1eacc73..8626e09e8 100644
--- a/Source/WebCore/platform/network/ResourceHandle.h
+++ b/Source/WebCore/platform/network/ResourceHandle.h
@@ -217,6 +217,9 @@ public:
     void handleDataArray(CFArrayRef dataArray);
 #endif
 
+    typedef PassRefPtr<ResourceHandle> (*BuiltinConstructor)(const ResourceRequest& request, ResourceHandleClient* client);
+    static void registerBuiltinConstructor(const AtomicString& protocol, BuiltinConstructor);
+
 protected:
     ResourceHandle(const ResourceRequest&, ResourceHandleClient*, bool defersLoading, bool shouldContentSniff);
 
diff --git a/Source/WebCore/platform/network/ResourceRequestBase.cpp b/Source/WebCore/platform/network/ResourceRequestBase.cpp
index e1e96c409..23ece24dc 100644
--- a/Source/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/Source/WebCore/platform/network/ResourceRequestBase.cpp
@@ -151,7 +151,7 @@ void ResourceRequestBase::setCachePolicy(ResourceRequestCachePolicy cachePolicy)
     
     m_cachePolicy = cachePolicy;
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -168,7 +168,7 @@ void ResourceRequestBase::setTimeoutInterval(double timeoutInterval)
     
     m_timeoutInterval = timeoutInterval; 
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -201,7 +201,7 @@ void ResourceRequestBase::setHTTPMethod(const String& httpMethod)
 
     m_httpMethod = httpMethod;
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -232,7 +232,7 @@ void ResourceRequestBase::setHTTPHeaderField(const AtomicString& name, const Str
     
     m_httpHeaderFields.set(name, value); 
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -247,7 +247,7 @@ void ResourceRequestBase::clearHTTPAuthorization()
 
     m_httpHeaderFields.remove("Authorization");
 
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -257,7 +257,7 @@ void ResourceRequestBase::clearHTTPReferrer()
 
     m_httpHeaderFields.remove("Referer");
 
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -267,7 +267,7 @@ void ResourceRequestBase::clearHTTPOrigin()
 
     m_httpHeaderFields.remove("Origin");
 
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -283,7 +283,7 @@ void ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray(con
     if (!encoding3.isNull())
         m_responseContentDispositionEncodingFallbackArray.append(encoding3);
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -300,7 +300,7 @@ void ResourceRequestBase::setHTTPBody(PassRefPtr<FormData> httpBody)
     
     m_httpBody = httpBody; 
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 } 
 
@@ -317,7 +317,7 @@ void ResourceRequestBase::setAllowCookies(bool allowCookies)
     
     m_allowCookies = allowCookies;
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -334,7 +334,7 @@ void ResourceRequestBase::setPriority(ResourceLoadPriority priority)
 
     m_priority = priority;
 
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -345,7 +345,7 @@ void ResourceRequestBase::addHTTPHeaderField(const AtomicString& name, const Str
     if (!result.second)
         result.first->second += "," + value;
 
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
diff --git a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
index acacc3789..e024c2775 100644
--- a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
+++ b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
@@ -22,15 +22,16 @@
 #include "CredentialBackingStore.h"
 
 #include "CredentialStorage.h"
+#include "FileSystem.h"
 #include "KURL.h"
 #include "NotImplemented.h"
 #include "ProtectionSpaceHash.h"
 #include "SQLiteStatement.h"
-#include <wtf/UnusedParam.h>
+#include <BlackBerryPlatformClient.h>
 
 #define HANDLE_SQL_EXEC_FAILURE(statement, returnValue, ...) \
     if (statement) { \
-        LOG_ERROR(__VAR_ARGS__); \
+        LOG_ERROR(__VA_ARGS__); \
         return returnValue; \
     }
 
@@ -39,17 +40,24 @@ namespace WebCore {
 CredentialBackingStore* CredentialBackingStore::instance()
 {
     static CredentialBackingStore* backingStore = 0;
-    if (!backingStore)
+    if (!backingStore) {
         backingStore = new CredentialBackingStore;
+        backingStore->open(pathByAppendingComponent(BlackBerry::Platform::Client::get()->getApplicationDataDirectory().c_str(), "/credentials.db"));
+    }
     return backingStore;
 }
 
 CredentialBackingStore::CredentialBackingStore()
-    : m_addStatement(0)
-    , m_updateStatement(0)
-    , m_hasStatement(0)
-    , m_getStatement(0)
-    , m_removeStatement(0)
+    : m_addLoginStatement(0)
+    , m_updateLoginStatement(0)
+    , m_hasLoginStatement(0)
+    , m_getLoginStatement(0)
+    , m_getLoginByURLStatement(0)
+    , m_removeLoginStatement(0)
+    , m_addNeverRememberStatement(0)
+    , m_hasNeverRememberStatement(0)
+    , m_getNeverRememberStatement(0)
+    , m_removeNeverRememberStatement(0)
 {
 }
 
@@ -71,69 +79,85 @@ bool CredentialBackingStore::open(const String& dbPath)
             false, "Failed to create table logins for login database");
 
         // Create index for table logins.
-        HANDLE_SQL_EXEC_FAILURE(!m_database.executeCommand("CREATE INDEX logins_signon ON logins (host)"),
+        HANDLE_SQL_EXEC_FAILURE(!m_database.executeCommand("CREATE INDEX logins_index ON logins (host)"),
             false, "Failed to create index for table logins");
-    } else { // Initiate CredentialStorage.
-        SQLiteStatement query(m_database, "SELECT origin_url, host, port, service_type, realm, auth_scheme, username, password FROM logins");
-        HANDLE_SQL_EXEC_FAILURE(query.prepare() != SQLResultOk,
-            false, "Failed to prepare query statement to initiate CredentialStorage");
-
-        int result = query.step();
-        while (result == SQLResultRow) {
-            String strUrl = query.getColumnText(1);
-            String strHost = query.getColumnText(2);
-            int intPort = query.getColumnInt(3);
-            ProtectionSpaceServerType serviceType = static_cast<ProtectionSpaceServerType>(query.getColumnInt(4));
-            String strRealm = query.getColumnText(5);
-            ProtectionSpaceAuthenticationScheme authScheme = static_cast<ProtectionSpaceAuthenticationScheme>(query.getColumnInt(6));
-            String strUserName = query.getColumnText(7);
-            String strPassword = decryptedString(query.getColumnText(8));
-
-            KURL url(ParsedURLString, strUrl);
-            ProtectionSpace protectionSpace(strHost, intPort, serviceType, strRealm, authScheme);
-            Credential credential(strUserName, strPassword, CredentialPersistencePermanent);
-            CredentialStorage::set(credential, protectionSpace, url);
-
-            result = query.step();
-        }
+    }
+
+    if (!m_database.tableExists("never_remember")) {
+        HANDLE_SQL_EXEC_FAILURE(!m_database.executeCommand("CREATE TABLE never_remember (origin_url VARCHAR NOT NULL, host VARCHAR NOT NULL, port INTEGER, service_type INTEGER NOT NULL, realm VARCHAR, auth_scheme INTEGER NOT NULL) "),
+            false, "Failed to create table never_remember for login database");
+
+        // Create index for table never_remember.
+        HANDLE_SQL_EXEC_FAILURE(!m_database.executeCommand("CREATE INDEX never_remember_index ON never_remember (host)"),
+            false, "Failed to create index for table never_remember");
     }
 
     // Prepare the statements.
-    m_addStatement = new SQLiteStatement(m_database, "INSERT OR REPLACE INTO logins (origin_url, host, port, service_type, realm, auth_scheme, username, password) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
-    HANDLE_SQL_EXEC_FAILURE(m_addStatement->prepare() != SQLResultOk,
+    m_addLoginStatement = new SQLiteStatement(m_database, "INSERT OR REPLACE INTO logins (origin_url, host, port, service_type, realm, auth_scheme, username, password) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
+    HANDLE_SQL_EXEC_FAILURE(m_addLoginStatement->prepare() != SQLResultOk,
         false, "Failed to prepare addLogin statement");
 
-    m_updateStatement = new SQLiteStatement(m_database, "UPDATE logins SET username = ?, password = ? WHERE origin_url = ? AND host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
-    HANDLE_SQL_EXEC_FAILURE(m_updateStatement->prepare() != SQLResultOk,
+    m_updateLoginStatement = new SQLiteStatement(m_database, "UPDATE logins SET username = ?, password = ? WHERE origin_url = ? AND host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_updateLoginStatement->prepare() != SQLResultOk,
         false, "Failed to prepare updateLogin statement");
 
-    m_hasStatement = new SQLiteStatement(m_database, "SELECT COUNT(*) FROM logins WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
-    HANDLE_SQL_EXEC_FAILURE(m_hasStatement->prepare() != SQLResultOk,
+    m_hasLoginStatement = new SQLiteStatement(m_database, "SELECT COUNT(*) FROM logins WHERE origin_url = ? AND host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_hasLoginStatement->prepare() != SQLResultOk,
         false, "Failed to prepare hasLogin statement");
 
-    m_getStatement = new SQLiteStatement(m_database, "SELECT username, password FROM logins WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
-    HANDLE_SQL_EXEC_FAILURE(m_getStatement->prepare() != SQLResultOk,
+    m_getLoginStatement = new SQLiteStatement(m_database, "SELECT username, password FROM logins WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_getLoginStatement->prepare() != SQLResultOk,
         false, "Failed to prepare getLogin statement");
 
-    m_removeStatement = new SQLiteStatement(m_database, "DELETE FROM logins WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
-    HANDLE_SQL_EXEC_FAILURE(m_removeStatement->prepare() != SQLResultOk,
+    m_getLoginByURLStatement = new SQLiteStatement(m_database, "SELECT username, password FROM logins WHERE origin_url = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_getLoginByURLStatement->prepare() != SQLResultOk,
+        false, "Failed to prepare getLoginByURL statement");
+
+    m_removeLoginStatement = new SQLiteStatement(m_database, "DELETE FROM logins WHERE origin_url = ? AND host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_removeLoginStatement->prepare() != SQLResultOk,
         false, "Failed to prepare removeLogin statement");
 
+    m_addNeverRememberStatement = new SQLiteStatement(m_database, "INSERT OR REPLACE INTO never_remember (origin_url, host, port, service_type, realm, auth_scheme) VALUES (?, ?, ?, ?, ?, ?)");
+    HANDLE_SQL_EXEC_FAILURE(m_addNeverRememberStatement->prepare() != SQLResultOk,
+        false, "Failed to prepare addNeverRemember statement");
+
+    m_hasNeverRememberStatement = new SQLiteStatement(m_database, "SELECT COUNT(*) FROM never_remember WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_hasNeverRememberStatement->prepare() != SQLResultOk,
+        false, "Failed to prepare hasNeverRemember statement");
+
+    m_getNeverRememberStatement = new SQLiteStatement(m_database, "SELECT origin_url FROM never_remember WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_getNeverRememberStatement->prepare() != SQLResultOk,
+        false, "Failed to prepare getNeverRemember statement");
+
+    m_removeNeverRememberStatement = new SQLiteStatement(m_database, "DELETE FROM never_remember WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_removeNeverRememberStatement->prepare() != SQLResultOk,
+        false, "Failed to prepare removeNeverRemember statement");
+
     return true;
 }
 
 void CredentialBackingStore::close()
 {
-    delete m_addStatement;
-    m_addStatement = 0;
-    delete m_updateStatement;
-    m_updateStatement = 0;
-    delete m_hasStatement;
-    m_hasStatement = 0;
-    delete m_getStatement;
-    m_getStatement = 0;
-    delete m_removeStatement;
-    m_removeStatement = 0;
+    delete m_addLoginStatement;
+    m_addLoginStatement = 0;
+    delete m_updateLoginStatement;
+    m_updateLoginStatement = 0;
+    delete m_hasLoginStatement;
+    m_hasLoginStatement = 0;
+    delete m_getLoginStatement;
+    m_getLoginStatement = 0;
+    delete m_getLoginByURLStatement;
+    m_getLoginByURLStatement = 0;
+    delete m_removeLoginStatement;
+    m_removeLoginStatement = 0;
+    delete m_addNeverRememberStatement;
+    m_addNeverRememberStatement = 0;
+    delete m_hasNeverRememberStatement;
+    m_hasNeverRememberStatement = 0;
+    delete m_getNeverRememberStatement;
+    m_getNeverRememberStatement = 0;
+    delete m_removeNeverRememberStatement;
+    m_removeNeverRememberStatement = 0;
 
     if (m_database.isOpen())
         m_database.close();
@@ -144,19 +168,20 @@ bool CredentialBackingStore::addLogin(const KURL& url, const ProtectionSpace& pr
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
 
-    if (!m_addStatement)
+    if (!m_addLoginStatement)
         return false;
 
-    m_addStatement->bindText(1, url.string());
-    m_addStatement->bindText(2, protectionSpace.host());
-    m_addStatement->bindInt(3, protectionSpace.port());
-    m_addStatement->bindInt(4, static_cast<int>(protectionSpace.serverType()));
-    m_addStatement->bindText(5, protectionSpace.realm());
-    m_addStatement->bindInt(6, static_cast<int>(protectionSpace.authenticationScheme()));
-    m_addStatement->bindText(7, credential.user());
-    m_addStatement->bindBlob(8, encryptedString(credential.password()));
-
-    int result = m_addStatement->step();
+    m_addLoginStatement->bindText(1, url.string());
+    m_addLoginStatement->bindText(2, protectionSpace.host());
+    m_addLoginStatement->bindInt(3, protectionSpace.port());
+    m_addLoginStatement->bindInt(4, static_cast<int>(protectionSpace.serverType()));
+    m_addLoginStatement->bindText(5, protectionSpace.realm());
+    m_addLoginStatement->bindInt(6, static_cast<int>(protectionSpace.authenticationScheme()));
+    m_addLoginStatement->bindText(7, credential.user());
+    m_addLoginStatement->bindBlob(8, encryptedString(credential.password()));
+
+    int result = m_addLoginStatement->step();
+    m_addLoginStatement->reset();
     HANDLE_SQL_EXEC_FAILURE(result != SQLResultDone, false,
         "Failed to add login info into table logins - %i", result);
 
@@ -168,44 +193,48 @@ bool CredentialBackingStore::updateLogin(const KURL& url, const ProtectionSpace&
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
 
-    if (!m_updateStatement)
+    if (!m_updateLoginStatement)
         return false;
 
-    m_updateStatement->bindText(1, url.string());
-    m_updateStatement->bindText(2, credential.user());
-    m_updateStatement->bindBlob(3, encryptedString(credential.password()));
-    m_updateStatement->bindText(4, protectionSpace.host());
-    m_updateStatement->bindInt(5, protectionSpace.port());
-    m_updateStatement->bindInt(6, static_cast<int>(protectionSpace.serverType()));
-    m_updateStatement->bindText(7, protectionSpace.realm());
-    m_updateStatement->bindInt(8, static_cast<int>(protectionSpace.authenticationScheme()));
-
-    int result = m_updateStatement->step();
+    m_updateLoginStatement->bindText(1, credential.user());
+    m_updateLoginStatement->bindBlob(2, encryptedString(credential.password()));
+    m_updateLoginStatement->bindText(3, url.string());
+    m_updateLoginStatement->bindText(4, protectionSpace.host());
+    m_updateLoginStatement->bindInt(5, protectionSpace.port());
+    m_updateLoginStatement->bindInt(6, static_cast<int>(protectionSpace.serverType()));
+    m_updateLoginStatement->bindText(7, protectionSpace.realm());
+    m_updateLoginStatement->bindInt(8, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_updateLoginStatement->step();
+    m_updateLoginStatement->reset();
     HANDLE_SQL_EXEC_FAILURE(result != SQLResultDone, false,
         "Failed to update login info in table logins - %i", result);
 
     return true;
 }
 
-bool CredentialBackingStore::hasLogin(const ProtectionSpace& protectionSpace)
+bool CredentialBackingStore::hasLogin(const KURL& url, const ProtectionSpace& protectionSpace)
 {
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
 
-    if (!m_hasStatement)
+    if (!m_hasLoginStatement)
         return false;
 
-    m_hasStatement->bindText(1, protectionSpace.host());
-    m_hasStatement->bindInt(2, protectionSpace.port());
-    m_hasStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
-    m_hasStatement->bindText(4, protectionSpace.realm());
-    m_hasStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+    m_hasLoginStatement->bindText(1, url.string());
+    m_hasLoginStatement->bindText(2, protectionSpace.host());
+    m_hasLoginStatement->bindInt(3, protectionSpace.port());
+    m_hasLoginStatement->bindInt(4, static_cast<int>(protectionSpace.serverType()));
+    m_hasLoginStatement->bindText(5, protectionSpace.realm());
+    m_hasLoginStatement->bindInt(6, static_cast<int>(protectionSpace.authenticationScheme()));
 
-    int result = m_hasStatement->step();
+    int result = m_hasLoginStatement->step();
+    int numOfRow = m_hasLoginStatement->getColumnInt(0);
+    m_hasLoginStatement->reset();
     HANDLE_SQL_EXEC_FAILURE(result != SQLResultRow, false,
         "Failed to execute select login info from table logins in hasLogin - %i", result);
 
-    if (m_hasStatement->getColumnInt(0))
+    if (numOfRow)
         return true;
     return false;
 }
@@ -215,44 +244,162 @@ Credential CredentialBackingStore::getLogin(const ProtectionSpace& protectionSpa
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
 
-    if (!m_getStatement)
+    if (!m_getLoginStatement)
+        return Credential();
+
+    m_getLoginStatement->bindText(1, protectionSpace.host());
+    m_getLoginStatement->bindInt(2, protectionSpace.port());
+    m_getLoginStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
+    m_getLoginStatement->bindText(4, protectionSpace.realm());
+    m_getLoginStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_getLoginStatement->step();
+    String username = m_getLoginStatement->getColumnText(0);
+    String password = m_getLoginStatement->getColumnBlobAsString(1);
+    m_getLoginStatement->reset();
+    HANDLE_SQL_EXEC_FAILURE(result != SQLResultRow, Credential(),
+        "Failed to execute select login info from table logins in getLogin - %i", result);
+
+    return Credential(username, decryptedString(password), CredentialPersistencePermanent);
+}
+
+Credential CredentialBackingStore::getLogin(const KURL& url)
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("logins"));
+
+    if (!m_getLoginByURLStatement)
         return Credential();
 
-    m_getStatement->bindText(1, protectionSpace.host());
-    m_getStatement->bindInt(2, protectionSpace.port());
-    m_getStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
-    m_getStatement->bindText(4, protectionSpace.realm());
-    m_getStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+    m_getLoginByURLStatement->bindText(1, url.string());
 
-    int result = m_getStatement->step();
+    int result = m_getLoginByURLStatement->step();
+    String username = m_getLoginByURLStatement->getColumnText(0);
+    String password = m_getLoginByURLStatement->getColumnBlobAsString(1);
+    m_getLoginByURLStatement->reset();
     HANDLE_SQL_EXEC_FAILURE(result != SQLResultRow, Credential(),
         "Failed to execute select login info from table logins in getLogin - %i", result);
 
-    return Credential(m_getStatement->getColumnText(0), decryptedString(m_getStatement->getColumnText(1)), CredentialPersistencePermanent);
+    return Credential(username, decryptedString(password), CredentialPersistencePermanent);
 }
 
-bool CredentialBackingStore::removeLogin(const ProtectionSpace& protectionSpace)
+bool CredentialBackingStore::removeLogin(const KURL& url, const ProtectionSpace& protectionSpace)
 {
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
 
-    if (!m_removeStatement)
+    if (!m_removeLoginStatement)
         return false;
 
-    m_removeStatement->bindText(1, protectionSpace.host());
-    m_removeStatement->bindInt(2, protectionSpace.port());
-    m_removeStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
-    m_removeStatement->bindText(4, protectionSpace.realm());
-    m_removeStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+    m_removeLoginStatement->bindText(1, url.string());
+    m_removeLoginStatement->bindText(2, protectionSpace.host());
+    m_removeLoginStatement->bindInt(3, protectionSpace.port());
+    m_removeLoginStatement->bindInt(4, static_cast<int>(protectionSpace.serverType()));
+    m_removeLoginStatement->bindText(5, protectionSpace.realm());
+    m_removeLoginStatement->bindInt(6, static_cast<int>(protectionSpace.authenticationScheme()));
 
-    int result = m_removeStatement->step();
+    int result = m_removeLoginStatement->step();
+    m_removeLoginStatement->reset();
     HANDLE_SQL_EXEC_FAILURE(result != SQLResultDone, false,
         "Failed to remove login info from table logins - %i", result);
 
     return true;
 }
 
-bool CredentialBackingStore::clear()
+bool CredentialBackingStore::addNeverRemember(const KURL& url, const ProtectionSpace& protectionSpace)
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("never_remember"));
+
+    if (!m_addNeverRememberStatement)
+        return false;
+
+    m_addNeverRememberStatement->bindText(1, url.string());
+    m_addNeverRememberStatement->bindText(2, protectionSpace.host());
+    m_addNeverRememberStatement->bindInt(3, protectionSpace.port());
+    m_addNeverRememberStatement->bindInt(4, static_cast<int>(protectionSpace.serverType()));
+    m_addNeverRememberStatement->bindText(5, protectionSpace.realm());
+    m_addNeverRememberStatement->bindInt(6, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_addNeverRememberStatement->step();
+    m_addNeverRememberStatement->reset();
+    HANDLE_SQL_EXEC_FAILURE(result != SQLResultDone, false,
+        "Failed to add naver saved item info into table never_remember - %i", result);
+
+    return true;
+}
+
+bool CredentialBackingStore::hasNeverRemember(const ProtectionSpace& protectionSpace)
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("never_remember"));
+
+    if (!m_hasNeverRememberStatement)
+        return false;
+
+    m_hasNeverRememberStatement->bindText(1, protectionSpace.host());
+    m_hasNeverRememberStatement->bindInt(2, protectionSpace.port());
+    m_hasNeverRememberStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
+    m_hasNeverRememberStatement->bindText(4, protectionSpace.realm());
+    m_hasNeverRememberStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_hasNeverRememberStatement->step();
+    int numOfRow = m_hasNeverRememberStatement->getColumnInt(0);
+    m_hasNeverRememberStatement->reset();
+    HANDLE_SQL_EXEC_FAILURE(result != SQLResultRow, false,
+        "Failed to execute select to find naver saved site from table never_remember - %i", result);
+
+    if (numOfRow)
+        return true;
+    return false;
+}
+
+KURL CredentialBackingStore::getNeverRemember(const ProtectionSpace& protectionSpace)
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("never_remember"));
+
+    if (!m_getNeverRememberStatement)
+        return KURL();
+
+    m_getNeverRememberStatement->bindText(1, protectionSpace.host());
+    m_getNeverRememberStatement->bindInt(2, protectionSpace.port());
+    m_getNeverRememberStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
+    m_getNeverRememberStatement->bindText(4, protectionSpace.realm());
+    m_getNeverRememberStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_getNeverRememberStatement->step();
+    String url = m_getNeverRememberStatement->getColumnText(0);
+    m_getNeverRememberStatement->reset();
+    HANDLE_SQL_EXEC_FAILURE(result != SQLResultRow, KURL(),
+        "Failed to execute select never saved site info from table never_remember in getNeverRemember - %i", result);
+
+    return KURL(ParsedURLString, url);
+}
+
+bool CredentialBackingStore::removeNeverRemember(const ProtectionSpace& protectionSpace)
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("never_remember"));
+
+    if (!m_removeNeverRememberStatement)
+        return false;
+
+    m_removeNeverRememberStatement->bindText(1, protectionSpace.host());
+    m_removeNeverRememberStatement->bindInt(2, protectionSpace.port());
+    m_removeNeverRememberStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
+    m_removeNeverRememberStatement->bindText(4, protectionSpace.realm());
+    m_removeNeverRememberStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_removeNeverRememberStatement->step();
+    m_removeNeverRememberStatement->reset();
+    HANDLE_SQL_EXEC_FAILURE(result != SQLResultDone, false,
+        "Failed to remove never saved site from table never_remember - %i", result);
+
+    return true;
+}
+
+bool CredentialBackingStore::clearLogins()
 {
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
@@ -263,6 +410,17 @@ bool CredentialBackingStore::clear()
     return true;
 }
 
+bool CredentialBackingStore::clearNeverRemember()
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("never_remember"));
+
+    HANDLE_SQL_EXEC_FAILURE(!m_database.executeCommand("DELETE * FROM never_remember"),
+        false, "Failed to clear table never_remember");
+
+    return true;
+}
+
 String CredentialBackingStore::encryptedString(const String& plainText) const
 {
     // FIXME: Need encrypt plainText here
diff --git a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h
index d12631065..fc12c6b66 100644
--- a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h
+++ b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h
@@ -37,10 +37,16 @@ public:
     void close();
     bool addLogin(const KURL&, const ProtectionSpace&, const Credential&);
     bool updateLogin(const KURL&, const ProtectionSpace&, const Credential&);
-    bool hasLogin(const ProtectionSpace&);
+    bool hasLogin(const KURL&, const ProtectionSpace&);
     Credential getLogin(const ProtectionSpace&);
-    bool removeLogin(const ProtectionSpace&);
-    bool clear();
+    Credential getLogin(const KURL&);
+    bool removeLogin(const KURL&, const ProtectionSpace&);
+    bool addNeverRemember(const KURL&, const ProtectionSpace&);
+    bool hasNeverRemember(const ProtectionSpace&);
+    KURL getNeverRemember(const ProtectionSpace&);
+    bool removeNeverRemember(const ProtectionSpace&);
+    bool clearLogins();
+    bool clearNeverRemember();
 
 private:
     CredentialBackingStore();
@@ -48,11 +54,16 @@ private:
     String decryptedString(const String& cipherText) const;
 
     SQLiteDatabase m_database;
-    SQLiteStatement* m_addStatement;
-    SQLiteStatement* m_updateStatement;
-    SQLiteStatement* m_hasStatement;
-    SQLiteStatement* m_getStatement;
-    SQLiteStatement* m_removeStatement;
+    SQLiteStatement* m_addLoginStatement;
+    SQLiteStatement* m_updateLoginStatement;
+    SQLiteStatement* m_hasLoginStatement;
+    SQLiteStatement* m_getLoginStatement;
+    SQLiteStatement* m_getLoginByURLStatement;
+    SQLiteStatement* m_removeLoginStatement;
+    SQLiteStatement* m_addNeverRememberStatement;
+    SQLiteStatement* m_hasNeverRememberStatement;
+    SQLiteStatement* m_getNeverRememberStatement;
+    SQLiteStatement* m_removeNeverRememberStatement;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
index 29134757a..912b7e996 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
@@ -27,6 +27,7 @@
 #include "FrameLoaderClientBlackBerry.h"
 #include "HTTPParsers.h"
 #include "KURL.h"
+#include "MIMESniffing.h"
 #include "MIMETypeRegistry.h"
 #include "NetworkManager.h"
 #include "ResourceHandleClient.h"
@@ -107,6 +108,7 @@ NetworkJob::NetworkJob()
     , m_callingClient(false)
     , m_isXHR(false)
     , m_needsRetryAsFTPDirectory(false)
+    , m_isOverrideContentType(false)
     , m_extendedStatusCode(0)
     , m_redirectCount(0)
     , m_deferredData(*this)
@@ -151,8 +153,10 @@ bool NetworkJob::initialize(int playerId,
 
     // We don't need to explicitly call notifyHeaderReceived, as the Content-Type
     // will ultimately get parsed when sendResponseIfNeeded gets called.
-    if (!request.getOverrideContentType().empty())
+    if (!request.getOverrideContentType().empty()) {
         m_contentType = String(request.getOverrideContentType().c_str());
+        m_isOverrideContentType = true;
+    }
 
     // No need to create the streams for data and about.
     if (m_isData || m_isAbout)
@@ -382,6 +386,32 @@ void NetworkJob::handleNotifyDataReceived(const char* buf, size_t len)
     if (!buf || !len)
         return;
 
+    // The loadFile API sets the override content type,
+    // this will always be used as the content type and should not be overridden.
+    if (!m_dataReceived && !m_isOverrideContentType) {
+        bool shouldSniff = true;
+
+        // Don't bother sniffing the content type of a file that
+        // is on a file system if it has a MIME mappable file extension.
+        // The file extension is likely to be correct.
+        if (m_isFile) {
+            String urlFilename = m_response.url().lastPathComponent();
+            size_t pos = urlFilename.reverseFind('.');
+            if (pos != WTF::notFound) {
+                String extension = urlFilename.substring(pos + 1);
+                String mimeType = MIMETypeRegistry::getMIMETypeForExtension(extension);
+                if (!mimeType.isEmpty())
+                    shouldSniff = false;
+            }
+        }
+
+        if (shouldSniff) {
+            MIMESniffer sniffer = MIMESniffer(m_contentType.latin1().data(), MIMETypeRegistry::isSupportedImageResourceMIMEType(m_contentType));
+            if (const char* type = sniffer.sniff(buf, std::min(len, sniffer.dataSize())))
+                m_sniffedMimeType = String(type);
+        }
+    }
+
     m_dataReceived = true;
 
     // Protect against reentrancy.
@@ -583,11 +613,9 @@ void NetworkJob::sendResponseIfNeeded()
     // Get the MIME type that was set by the content sniffer
     // if there's no custom sniffer header, try to set it from the Content-Type header
     // if this fails, guess it from extension.
-    String mimeType;
+    String mimeType = m_sniffedMimeType;
     if (m_isFTP && m_isFTPDir)
         mimeType = "application/x-ftp-directory";
-    else
-        mimeType = m_response.httpHeaderField(BlackBerry::Platform::NetworkRequest::HEADER_RIM_SNIFFED_MIME_TYPE);
     if (mimeType.isNull())
         mimeType = extractMIMETypeFromMediaType(m_contentType);
     if (mimeType.isNull())
@@ -911,7 +939,6 @@ void NetworkJob::handleAbout()
         result.append(String(BlackBerry::Platform::WEBKITCREDITS));
         result.append(String("</body></html>"));
         handled = true;
-#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     } else if (aboutWhat.startsWith("cache?query=", false)) {
         BlackBerry::Platform::Client* client = BlackBerry::Platform::Client::get();
         ASSERT(client);
@@ -929,6 +956,7 @@ void NetworkJob::handleAbout()
         result.append(String(client->generateHtmlFragmentForCacheKeys().data()));
         result.append(String("</body></html>"));
         handled = true;
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     } else if (equalIgnoringCase(aboutWhat, "cache/disable")) {
         BlackBerry::Platform::Client* client = BlackBerry::Platform::Client::get();
         ASSERT(client);
@@ -941,6 +969,11 @@ void NetworkJob::handleAbout()
         client->setDiskCacheEnabled(true);
         result.append(String("<html><head><title>BlackBerry Browser Disk Cache</title></head><body>Http disk cache is enabled.</body></html>"));
         handled = true;
+    } else if (equalIgnoringCase(aboutWhat, "cookie")) {
+        result.append(String("<html><head><title>BlackBerry Browser cookie information</title></head><body>"));
+        result.append(cookieManager().generateHtmlFragmentForCookies());
+        result.append(String("</body></html>"));
+        handled = true;
     } else if (equalIgnoringCase(aboutWhat, "version")) {
         result.append(String("<html><meta name=\"viewport\" content=\"width=device-width, user-scalable=no\"></head><body>"));
         result.append(String(BlackBerry::Platform::BUILDTIME));
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.h b/Source/WebCore/platform/network/blackberry/NetworkJob.h
index 447a6442e..a50059ab1 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.h
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.h
@@ -158,6 +158,7 @@ private:
     OwnPtr<ResourceResponse> m_multipartResponse;
     Timer<NetworkJob> m_deleteJobTimer;
     String m_contentType;
+    String m_sniffedMimeType;
     String m_contentDisposition;
     BlackBerry::Platform::NetworkStreamFactory* m_streamFactory;
     bool m_isFile;
@@ -175,6 +176,7 @@ private:
     bool m_callingClient;
     bool m_isXHR; // FIXME - After 7.0, remove this. Only the Qt port reports HTTP error statuses as didFails, so we probably shouldn't.
     bool m_needsRetryAsFTPDirectory;
+    bool m_isOverrideContentType;
 
     // If an HTTP status code is received, m_extendedStatusCode and m_response.httpStatusCode will both be set to it.
     // If a platform error code is received, m_extendedStatusCode will be set to it and m_response.httpStatusCode will be set to 404.
diff --git a/Source/WebCore/platform/network/blackberry/NetworkManager.cpp b/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
index 388d6d8fd..7c628f005 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
@@ -109,7 +109,7 @@ bool NetworkManager::startJob(int playerId, const String& pageGroupName, PassRef
 
         if (authType != BlackBerry::Platform::NetworkRequest::AuthNone)
             platformRequest.setCredentials(username.utf8().data(), password.utf8().data(), authType);
-    } else if (url.protocolInHTTPFamily()) {
+    } else if (url.protocolIsInHTTPFamily()) {
         // For URLs that match the paths of those previously challenged for HTTP Basic authentication,
         // try and reuse the credential preemptively, as allowed by RFC 2617.
         Credential credential = CredentialStorage::get(url);
@@ -122,9 +122,8 @@ bool NetworkManager::startJob(int playerId, const String& pageGroupName, PassRef
         // Prepare a cookie header if there are cookies related to this url.
         String cookiePairs = cookieManager().getCookie(url, WithHttpOnlyCookies);
         if (!cookiePairs.isEmpty()) {
-            // We encode the cookie header data using utf8 to support unicode characters.
-            // For more information, look at RFC5987 - 4.1 (http://tools.ietf.org/html/rfc5987#ref-ISO-8859-1).
-            platformRequest.setCookieData(cookiePairs.utf8().data());
+            // We need to check the encoding and encode the cookie header data using latin1 or utf8 to support unicode characters.
+            platformRequest.setCookieData(cookiePairs.containsOnlyLatin1() ? cookiePairs.latin1().data() : cookiePairs.utf8().data());
         }
     }
 
diff --git a/Source/WebCore/platform/network/blackberry/ResourceRequest.h b/Source/WebCore/platform/network/blackberry/ResourceRequest.h
index cd9760db4..7072eb1f3 100644
--- a/Source/WebCore/platform/network/blackberry/ResourceRequest.h
+++ b/Source/WebCore/platform/network/blackberry/ResourceRequest.h
@@ -118,6 +118,8 @@ public:
     TargetType targetType() const { return m_targetType; }
     void setTargetType(TargetType type) { m_targetType = type; }
 
+    static TargetType targetTypeFromMimeType(const String& mimeType);
+
 private:
     friend class ResourceRequestBase;
 
diff --git a/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp b/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp
index d86b88cf1..5b6792fa7 100644
--- a/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp
+++ b/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp
@@ -22,6 +22,7 @@
 #include "BlobRegistryImpl.h"
 #include <BlackBerryPlatformClient.h>
 #include <network/NetworkRequest.h>
+#include <wtf/HashMap.h>
 #include <wtf/text/CString.h>
 
 using BlackBerry::Platform::NetworkRequest;
@@ -84,6 +85,47 @@ static inline NetworkRequest::TargetType platformTargetTypeForRequest(const Reso
     }
 }
 
+typedef HashMap<String, ResourceRequest::TargetType> MimeTypeResourceRequestTypeMap;
+
+static const MimeTypeResourceRequestTypeMap& mimeTypeRequestTypeMap()
+{
+    static MimeTypeResourceRequestTypeMap* map = 0;
+    if (!map) {
+        map = new MimeTypeResourceRequestTypeMap;
+
+        if (map) {
+            // The list here should match extensionMap[] in MIMETypeRegistryBlackBerry.cpp
+            map->add(String("text/css"), ResourceRequest::TargetIsStyleSheet);
+            map->add(String("application/x-javascript"), ResourceRequest::TargetIsScript);
+            map->add(String("image/bmp"), ResourceRequest::TargetIsImage);
+            map->add(String("image/gif"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-icon"), ResourceRequest::TargetIsImage);
+            map->add(String("image/jpeg"), ResourceRequest::TargetIsImage);
+            map->add(String("image/png"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-portable-bitmap"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-portable-graymap"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-portable-pixmap"), ResourceRequest::TargetIsImage);
+            map->add(String("image/svg+xml"), ResourceRequest::TargetIsImage);
+            map->add(String("image/tiff"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-xbitmap"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-xpm"), ResourceRequest::TargetIsImage);
+        }
+    }
+
+    return *map;
+}
+
+ResourceRequest::TargetType ResourceRequest::targetTypeFromMimeType(const String& mimeType)
+{
+    const MimeTypeResourceRequestTypeMap& map = mimeTypeRequestTypeMap();
+
+    MimeTypeResourceRequestTypeMap::const_iterator iter = map.find(mimeType);
+    if (iter == map.end())
+        return ResourceRequest::TargetIsUnspecified;
+
+    return iter->second;
+}
+
 void ResourceRequest::initializePlatformRequest(NetworkRequest& platformRequest, bool isInitial) const
 {
     // If this is the initial load, skip the request body and headers.
diff --git a/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
index fbfb902c8..0f39eb0bd 100644
--- a/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
@@ -460,7 +460,7 @@ static CFDictionaryRef createConnectionProperties(bool shouldUseCredentialStorag
 
 void ResourceHandle::createCFURLConnection(bool shouldUseCredentialStorage, bool shouldContentSniff)
 {
-    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty()) && !firstRequest().url().protocolInHTTPFamily()) {
+    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty()) && !firstRequest().url().protocolIsInHTTPFamily()) {
         // Credentials for ftp can only be passed in URL, the didReceiveAuthenticationChallenge delegate call won't be made.
         KURL urlWithCredentials(firstRequest().url());
         urlWithCredentials.setUser(d->m_user);
@@ -470,7 +470,7 @@ void ResourceHandle::createCFURLConnection(bool shouldUseCredentialStorage, bool
 
     // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
     // try and reuse the credential preemptively, as allowed by RFC 2617.
-    if (shouldUseCredentialStorage && firstRequest().url().protocolInHTTPFamily()) {
+    if (shouldUseCredentialStorage && firstRequest().url().protocolIsInHTTPFamily()) {
         if (d->m_user.isEmpty() && d->m_pass.isEmpty()) {
             // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
             // try and reuse the credential preemptively, as allowed by RFC 2617.
diff --git a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
index 06a81c59a..594db8e91 100644
--- a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -185,7 +185,7 @@ static bool shouldRelaxThirdPartyCookiePolicy(const KURL& url)
 void ResourceHandle::createNSURLConnection(id delegate, bool shouldUseCredentialStorage, bool shouldContentSniff)
 {
     // Credentials for ftp can only be passed in URL, the connection:didReceiveAuthenticationChallenge: delegate call won't be made.
-    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty()) && !firstRequest().url().protocolInHTTPFamily()) {
+    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty()) && !firstRequest().url().protocolIsInHTTPFamily()) {
         KURL urlWithCredentials(firstRequest().url());
         urlWithCredentials.setUser(d->m_user);
         urlWithCredentials.setPass(d->m_pass);
@@ -195,7 +195,7 @@ void ResourceHandle::createNSURLConnection(id delegate, bool shouldUseCredential
     if (shouldRelaxThirdPartyCookiePolicy(firstRequest().url()))
         firstRequest().setFirstPartyForCookies(firstRequest().url());
 
-    if (shouldUseCredentialStorage && firstRequest().url().protocolInHTTPFamily()) {
+    if (shouldUseCredentialStorage && firstRequest().url().protocolIsInHTTPFamily()) {
         if (d->m_user.isEmpty() && d->m_pass.isEmpty()) {
             // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
             // try and reuse the credential preemptively, as allowed by RFC 2617.
diff --git a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index e7984c4dc..d30ffce92 100644
--- a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -486,7 +486,7 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     // The status code is equal to 0 for protocols not in the HTTP family.
     int statusCode = m_replyWrapper->reply()->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
-    if (url.protocolInHTTPFamily()) {
+    if (url.protocolIsInHTTPFamily()) {
         String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromLatin1(m_replyWrapper->reply()->rawHeader("Content-Disposition")));
 
         if (!suggestedFilename.isEmpty())
diff --git a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index e671660ae..92c66e54c 100644
--- a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -56,6 +56,7 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
+#include <wtf/gobject/GRefPtr.h>
 #include <wtf/text/CString.h>
 
 #if ENABLE(BLOB)
@@ -86,7 +87,7 @@ private:
     ResourceResponse& m_response;
     Vector<char>& m_data;
     bool m_finished;
-    GMainLoop* m_mainLoop;
+    GRefPtr<GMainLoop> m_mainLoop;
 };
 
 WebCoreSynchronousLoader::WebCoreSynchronousLoader(ResourceError& error, ResourceResponse& response, Vector<char>& data)
@@ -95,12 +96,11 @@ WebCoreSynchronousLoader::WebCoreSynchronousLoader(ResourceError& error, Resourc
     , m_data(data)
     , m_finished(false)
 {
-    m_mainLoop = g_main_loop_new(0, false);
+    m_mainLoop = adoptGRef(g_main_loop_new(0, false));
 }
 
 WebCoreSynchronousLoader::~WebCoreSynchronousLoader()
 {
-    g_main_loop_unref(m_mainLoop);
 }
 
 void WebCoreSynchronousLoader::didReceiveResponse(ResourceHandle*, const ResourceResponse& response)
@@ -115,7 +115,7 @@ void WebCoreSynchronousLoader::didReceiveData(ResourceHandle*, const char* data,
 
 void WebCoreSynchronousLoader::didFinishLoading(ResourceHandle*, double)
 {
-    g_main_loop_quit(m_mainLoop);
+    g_main_loop_quit(m_mainLoop.get());
     m_finished = true;
 }
 
@@ -128,7 +128,7 @@ void WebCoreSynchronousLoader::didFail(ResourceHandle* handle, const ResourceErr
 void WebCoreSynchronousLoader::run()
 {
     if (!m_finished)
-        g_main_loop_run(m_mainLoop);
+        g_main_loop_run(m_mainLoop.get());
 }
 
 static void cleanupSoupRequestOperation(ResourceHandle*, bool isDestroying);
diff --git a/Source/WebCore/platform/qt/ClipboardQt.cpp b/Source/WebCore/platform/qt/ClipboardQt.cpp
index 3d8bab1f6..6d2ab7229 100644
--- a/Source/WebCore/platform/qt/ClipboardQt.cpp
+++ b/Source/WebCore/platform/qt/ClipboardQt.cpp
@@ -30,7 +30,6 @@
 #include "ClipboardQt.h"
 
 #include "CachedImage.h"
-#include "DOMStringList.h"
 #include "DataTransferItemListQt.h"
 #include "Document.h"
 #include "DragData.h"
@@ -144,28 +143,21 @@ void ClipboardQt::clearAllData()
     m_writableData = 0;
 }
 
-String ClipboardQt::getData(const String& type, bool& success) const
+String ClipboardQt::getData(const String& type) const
 {
 
-    if (policy() != ClipboardReadable) {
-        success = false;
+    if (policy() != ClipboardReadable)
         return String();
-    }
 
-    if (isHtmlMimeType(type) && m_readableData->hasHtml()) {
-        success = true;
+    if (isHtmlMimeType(type) && m_readableData->hasHtml())
         return m_readableData->html();
-    }
 
-    if (isTextMimeType(type) && m_readableData->hasText()) {
-        success = true;
+    if (isTextMimeType(type) && m_readableData->hasText())
         return m_readableData->text();
-    }
 
     ASSERT(m_readableData);
     QByteArray rawData = m_readableData->data(type);
     QString data = QTextCodec::codecForName("UTF-16")->toUnicode(rawData);
-    success = !data.isEmpty();
     return data;
 }
 
@@ -190,17 +182,17 @@ bool ClipboardQt::setData(const String& type, const String& data)
 }
 
 // extensions beyond IE's API
-PassRefPtr<DOMStringList> ClipboardQt::types() const
+HashSet<String> ClipboardQt::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return DOMStringList::create();
+        return HashSet<String>();
 
     ASSERT(m_readableData);
-    RefPtr<DOMStringList> result = DOMStringList::create();
+    HashSet<String> result;
     QStringList formats = m_readableData->formats();
     for (int i = 0; i < formats.count(); ++i)
-        result->append(formats.at(i));
-    return result.release();
+        result.add(formats.at(i));
+    return result;
 }
 
 PassRefPtr<FileList> ClipboardQt::files() const
diff --git a/Source/WebCore/platform/qt/ClipboardQt.h b/Source/WebCore/platform/qt/ClipboardQt.h
index a840becf6..a03fa3b87 100644
--- a/Source/WebCore/platform/qt/ClipboardQt.h
+++ b/Source/WebCore/platform/qt/ClipboardQt.h
@@ -53,11 +53,11 @@ public:
 
     void clearData(const String& type);
     void clearAllData();
-    String getData(const String& type, bool& success) const;
+    String getData(const String& type) const;
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual PassRefPtr<DOMStringList> types() const;
+    virtual HashSet<String> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/qt/QtStyleOptionWebComboBox.h b/Source/WebCore/platform/qt/QtStyleOptionWebComboBox.h
deleted file mode 100644
index dae16965a..000000000
--- a/Source/WebCore/platform/qt/QtStyleOptionWebComboBox.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef QtStyleOptionWebComboBox_h
-#define QtStyleOptionWebComboBox_h
-
-#include "HTMLSelectElement.h"
-#include "RenderObject.h"
-#include "RenderThemeQt.h"
-
-#include <QStyleOption>
-
-namespace WebCore {
-
-class RenderObject;
-
-class QtStyleOptionWebComboBox : public QStyleOptionComboBox {
-public:
-    QtStyleOptionWebComboBox(RenderObject* o)
-        : QStyleOptionComboBox()
-        , m_multiple(checkMultiple(o))
-    {
-    }
-
-    bool multiple() const { return m_multiple; }
-
-private:
-    bool m_multiple;
-
-    bool checkMultiple(RenderObject* o)
-    {
-        if (RenderThemeQt::useMobileTheme())
-            return false;
-        HTMLSelectElement* select = o ? static_cast<HTMLSelectElement*>(o->node()) : 0;
-        return select ? select->multiple() : false;
-    }
-};
-
-}
-
-#endif // QtStyleOptionWebComboBox_h
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index 00b8b1c1b..83b0d82a2 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -54,6 +54,7 @@
 #include "RenderProgress.h"
 #endif
 #include "RenderTheme.h"
+#include "RenderThemeQtMobile.h"
 #include "ScrollbarTheme.h"
 #include "TimeRanges.h"
 #include "UserAgentStyleSheets.h"
@@ -82,6 +83,9 @@ static const float minSearchFieldResultsDecorationSize = 9;
 static const float maxSearchFieldResultsDecorationSize = 30;
 static const float defaultSearchFieldResultsButtonWidth = 18;
 
+static QtThemeFactoryFunction themeFactory;
+static ScrollbarTheme* scrollbarTheme;
+
 RenderThemeQt::RenderThemeQt(Page* page)
     : RenderTheme()
     , m_page(page)
@@ -89,13 +93,30 @@ RenderThemeQt::RenderThemeQt(Page* page)
     m_buttonFontFamily = QGuiApplication::font().family();
 }
 
-bool RenderThemeQt::useMobileTheme()
+void RenderThemeQt::setCustomTheme(QtThemeFactoryFunction factory, ScrollbarTheme* customScrollbarTheme)
 {
-#if HAVE(QSTYLE)
-    return !qgetenv("QT_WEBKIT_USE_MOBILE_THEME").isNull();
-#else
-    return true;
-#endif
+    themeFactory = factory;
+    scrollbarTheme = customScrollbarTheme;
+}
+
+ScrollbarTheme* RenderThemeQt::customScrollbarTheme()
+{
+    return scrollbarTheme;
+}
+
+static PassRefPtr<RenderTheme> createTheme(Page* page)
+{
+    if (themeFactory)
+        return themeFactory(page);
+    return RenderThemeQtMobile::create(page);
+}
+
+PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
+{
+    if (page)
+        return createTheme(page);
+    static RenderTheme* fallback = createTheme(0).leakRef();
+    return fallback;
 }
 
 // Remove this when SearchFieldPart is style-able in RenderTheme::isControlStyled()
@@ -116,7 +137,9 @@ String RenderThemeQt::extraDefaultStyleSheet()
 {
     StringBuilder result;
     result.append(RenderTheme::extraDefaultStyleSheet());
-    if (useMobileTheme()) {
+    // When no theme factory is provided we default to using our platform independent "Mobile Qt" theme,
+    // which requires the following stylesheets.
+    if (!themeFactory) {
         result.append(String(themeQtNoListboxesUserAgentStyleSheet, sizeof(themeQtNoListboxesUserAgentStyleSheet)));
         result.append(String(mobileThemeQtUserAgentStyleSheet, sizeof(mobileThemeQtUserAgentStyleSheet)));
     }
@@ -861,7 +884,7 @@ String RenderThemeQt::fileListNameForWidth(const Vector<String>& filenames, cons
         int n = filenames.size();
         string = QCoreApplication::translate("QWebPage", "%n file(s)",
                                              "number of chosen file",
-                                             QCoreApplication::CodecForTr, n);
+                                             QCoreApplication::DefaultCodec, n);
     }
 
     return string;
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.h b/Source/WebCore/platform/qt/RenderThemeQt.h
index cdaaa98eb..83e729d88 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.h
+++ b/Source/WebCore/platform/qt/RenderThemeQt.h
@@ -40,13 +40,17 @@ class RenderProgress;
 class RenderStyle;
 class HTMLMediaElement;
 class StylePainter;
+class ScrollbarTheme;
+
+typedef PassRefPtr<RenderTheme> (*QtThemeFactoryFunction)(Page* page);
 
 class RenderThemeQt : public RenderTheme {
 
 public:
     RenderThemeQt(Page*);
 
-    static bool useMobileTheme();
+    static void setCustomTheme(QtThemeFactoryFunction, ScrollbarTheme* customScrollbarTheme);
+    static ScrollbarTheme* customScrollbarTheme();
 
     String extraDefaultStyleSheet();
 
diff --git a/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp b/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
index c2f4228b0..201a1b206 100644
--- a/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
@@ -41,10 +41,6 @@
 #if ENABLE(PROGRESS_TAG)
 #include "RenderProgress.h"
 #endif
-#if HAVE(QSTYLE)
-#include "RenderThemeQStyle.h"
-#endif
-
 #include <QColor>
 #include <QFile>
 #include <QFontMetrics>
@@ -550,23 +546,6 @@ PassRefPtr<RenderTheme> RenderThemeQtMobile::create(Page* page)
     return adoptRef(new RenderThemeQtMobile(page));
 }
 
-static PassRefPtr<RenderTheme> createTheme(Page* page)
-{
-#if HAVE(QSTYLE)
-    if (!RenderThemeQt::useMobileTheme())
-        return RenderThemeQStyle::create(page);
-#endif
-    return RenderThemeQtMobile::create(page);
-}
-
-PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
-{
-    if (page)
-        return createTheme(page);
-    static RenderTheme* fallback = createTheme(0).leakRef();
-    return fallback;
-}
-
 RenderThemeQtMobile::RenderThemeQtMobile(Page* page)
     : RenderThemeQt(page)
 {
diff --git a/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp b/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp
index e3243ecfa..4f557665f 100644
--- a/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp
+++ b/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp
@@ -26,29 +26,9 @@
  */
 
 #include "config.h"
-
-#if !HAVE(QSTYLE)
 #include "ScrollbarTheme.h"
 
-#else
-#include "ScrollbarThemeQt.h"
-
-#include "GraphicsContext.h"
-#include "PlatformMouseEvent.h"
-#include "RenderThemeQStyle.h"
-#include "RenderThemeQtMobile.h"
-#include "ScrollView.h"
-#include "Scrollbar.h"
-
-#include <QApplication>
-#ifdef Q_WS_MAC
-#include <QMacStyle>
-#endif
-#include <QMenu>
-#include <QPainter>
-#include <QStyle>
-#include <QStyleOptionSlider>
-#endif // HAVE(QSTYLE)
+#include "RenderThemeQt.h"
 
 namespace WebCore {
 
@@ -57,219 +37,11 @@ ScrollbarTheme* ScrollbarTheme::nativeTheme()
     static ScrollbarTheme* theme = 0;
     if (theme)
         return theme;
-#if HAVE(QSTYLE)
-    if (!RenderThemeQt::useMobileTheme())
-        theme = new ScrollbarThemeQt();
-    else
-#endif
+    theme = RenderThemeQt::customScrollbarTheme();
+    if (!theme)
         theme = new ScrollbarTheme();
     return theme;
 }
 
-#if HAVE(QSTYLE)
-ScrollbarThemeQt::~ScrollbarThemeQt()
-{
-}
-
-static QStyle::SubControl scPart(const ScrollbarPart& part)
-{
-    switch (part) {
-    case NoPart:
-        return QStyle::SC_None;
-    case BackButtonStartPart:
-    case BackButtonEndPart:
-        return QStyle::SC_ScrollBarSubLine;
-    case BackTrackPart:
-        return QStyle::SC_ScrollBarSubPage;
-    case ThumbPart:
-        return QStyle::SC_ScrollBarSlider;
-    case ForwardTrackPart:
-        return QStyle::SC_ScrollBarAddPage;
-    case ForwardButtonStartPart:
-    case ForwardButtonEndPart:
-        return QStyle::SC_ScrollBarAddLine;
-    }
-
-    return QStyle::SC_None;
-}
-
-static ScrollbarPart scrollbarPart(const QStyle::SubControl& sc)
-{
-    switch (sc) {
-    case QStyle::SC_None:
-        return NoPart;
-    case QStyle::SC_ScrollBarSubLine:
-        return BackButtonStartPart;
-    case QStyle::SC_ScrollBarSubPage:
-        return BackTrackPart;
-    case QStyle::SC_ScrollBarSlider:
-        return ThumbPart;
-    case QStyle::SC_ScrollBarAddPage:
-        return ForwardTrackPart;
-    case QStyle::SC_ScrollBarAddLine:
-        return ForwardButtonStartPart;
-    }
-    return NoPart;
-}
-
-static QStyleOptionSlider* styleOptionSlider(Scrollbar* scrollbar, QWidget* widget = 0)
-{
-    static QStyleOptionSlider opt;
-    if (widget)
-        opt.initFrom(widget);
-    else
-        opt.state |= QStyle::State_Active;
-
-    opt.state &= ~QStyle::State_HasFocus;
-
-    opt.rect = scrollbar->frameRect();
-    if (scrollbar->enabled())
-        opt.state |= QStyle::State_Enabled;
-    if (scrollbar->controlSize() != RegularScrollbar)
-        opt.state |= QStyle::State_Mini;
-    opt.orientation = (scrollbar->orientation() == VerticalScrollbar) ? Qt::Vertical : Qt::Horizontal;
-
-    if (scrollbar->orientation() == HorizontalScrollbar)
-        opt.state |= QStyle::State_Horizontal;
-    else
-        opt.state &= ~QStyle::State_Horizontal;
-
-    opt.sliderValue = scrollbar->value();
-    opt.sliderPosition = opt.sliderValue;
-    opt.pageStep = scrollbar->pageStep();
-    opt.singleStep = scrollbar->lineStep();
-    opt.minimum = 0;
-    opt.maximum = qMax(0, scrollbar->maximum());
-    ScrollbarPart pressedPart = scrollbar->pressedPart();
-    ScrollbarPart hoveredPart = scrollbar->hoveredPart();
-    if (pressedPart != NoPart) {
-        opt.activeSubControls = scPart(scrollbar->pressedPart());
-        if (pressedPart == BackButtonStartPart || pressedPart == ForwardButtonStartPart
-            || pressedPart == BackButtonEndPart || pressedPart == ForwardButtonEndPart
-            || pressedPart == ThumbPart)
-            opt.state |= QStyle::State_Sunken;
-    } else
-        opt.activeSubControls = scPart(hoveredPart);
-    if (hoveredPart != NoPart)
-        opt.state |= QStyle::State_MouseOver;
-    return &opt;
-}
-
-bool ScrollbarThemeQt::paint(Scrollbar* scrollbar, GraphicsContext* graphicsContext, const IntRect& damageRect)
-{
-    if (graphicsContext->updatingControlTints()) {
-       scrollbar->invalidateRect(damageRect);
-       return false;
-    }
-
-    StylePainterQStyle p(this, graphicsContext);
-    if (!p.isValid())
-      return true;
-
-    p.painter->save();
-    QStyleOptionSlider* opt = styleOptionSlider(scrollbar, p.widget);
-
-    p.painter->setClipRect(opt->rect.intersected(damageRect), Qt::IntersectClip);
-
-#ifdef Q_WS_MAC
-    // FIXME: We also need to check the widget style but today ScrollbarTheme is not aware of the page so we
-    // can't get the widget.
-    if (qobject_cast<QMacStyle*>(style()))
-        p.drawComplexControl(QStyle::CC_ScrollBar, *opt);
-    else
-#endif
-    {
-        // The QStyle expects the background to be already filled.
-        p.painter->fillRect(opt->rect, opt->palette.background());
-
-        const QPoint topLeft = opt->rect.topLeft();
-        p.painter->translate(topLeft);
-        opt->rect.moveTo(QPoint(0, 0));
-        p.drawComplexControl(QStyle::CC_ScrollBar, *opt);
-        opt->rect.moveTo(topLeft);
-    }
-    p.painter->restore();
-
-    return true;
-}
-
-ScrollbarPart ScrollbarThemeQt::hitTest(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
-{
-    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
-    const QPoint pos = scrollbar->convertFromContainingWindow(evt.position());
-    opt->rect.moveTo(QPoint(0, 0));
-    QStyle::SubControl sc = style()->hitTestComplexControl(QStyle::CC_ScrollBar, opt, pos, 0);
-    return scrollbarPart(sc);
-}
-
-bool ScrollbarThemeQt::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
-{
-    // Middle click centers slider thumb (if supported).
-    return style()->styleHint(QStyle::SH_ScrollBar_MiddleClickAbsolutePosition) && evt.button() == MiddleButton;
-}
-
-void ScrollbarThemeQt::invalidatePart(Scrollbar* scrollbar, ScrollbarPart)
-{
-    // FIXME: Do more precise invalidation.
-    scrollbar->invalidate();
-}
-
-int ScrollbarThemeQt::scrollbarThickness(ScrollbarControlSize controlSize)
-{
-    QStyleOptionSlider o;
-    o.orientation = Qt::Vertical;
-    o.state &= ~QStyle::State_Horizontal;
-    if (controlSize != RegularScrollbar)
-        o.state |= QStyle::State_Mini;
-    return style()->pixelMetric(QStyle::PM_ScrollBarExtent, &o, 0);
-}
-
-int ScrollbarThemeQt::thumbPosition(Scrollbar* scrollbar)
-{
-    if (scrollbar->enabled()) {
-        float pos = (float)scrollbar->currentPos() * (trackLength(scrollbar) - thumbLength(scrollbar)) / scrollbar->maximum();
-        return (pos < 1 && pos > 0) ? 1 : pos;
-    }
-    return 0;
-}
-
-int ScrollbarThemeQt::thumbLength(Scrollbar* scrollbar)
-{
-    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
-    IntRect thumb = style()->subControlRect(QStyle::CC_ScrollBar, opt, QStyle::SC_ScrollBarSlider, 0);
-    return scrollbar->orientation() == HorizontalScrollbar ? thumb.width() : thumb.height();
-}
-
-int ScrollbarThemeQt::trackPosition(Scrollbar* scrollbar)
-{
-    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
-    IntRect track = style()->subControlRect(QStyle::CC_ScrollBar, opt, QStyle::SC_ScrollBarGroove, 0);
-    return scrollbar->orientation() == HorizontalScrollbar ? track.x() - scrollbar->x() : track.y() - scrollbar->y();
-}
-
-int ScrollbarThemeQt::trackLength(Scrollbar* scrollbar)
-{
-    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
-    IntRect track = style()->subControlRect(QStyle::CC_ScrollBar, opt, QStyle::SC_ScrollBarGroove, 0);
-    return scrollbar->orientation() == HorizontalScrollbar ? track.width() : track.height();
-}
-
-void ScrollbarThemeQt::paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& rect)
-{
-    StylePainterQStyle p(this, context);
-    if (!p.isValid())
-        return;
-
-    QStyleOption option;
-    option.rect = rect;
-    p.drawPrimitive(QStyle::PE_PanelScrollAreaCorner, option);
-}
-
-QStyle* ScrollbarThemeQt::style() const
-{
-    return QApplication::style();
-}
-
-#endif // HAVE(QSTYLE)
 }
 
diff --git a/Source/WebCore/platform/sql/SQLiteStatement.cpp b/Source/WebCore/platform/sql/SQLiteStatement.cpp
index 18dd1e209..d308872d5 100644
--- a/Source/WebCore/platform/sql/SQLiteStatement.cpp
+++ b/Source/WebCore/platform/sql/SQLiteStatement.cpp
@@ -97,7 +97,7 @@ int SQLiteStatement::step()
     MutexLocker databaseLock(m_database.databaseMutex());
     if (m_database.isInterrupted())
         return SQLITE_INTERRUPT;
-    ASSERT(m_isPrepared);
+    //ASSERT(m_isPrepared);
 
     if (!m_statement)
         return SQLITE_OK;
diff --git a/Source/WebCore/platform/text/LineBreakIteratorPoolICU.h b/Source/WebCore/platform/text/LineBreakIteratorPoolICU.h
index d8e2ccbcd..7e4c2d8c5 100644
--- a/Source/WebCore/platform/text/LineBreakIteratorPoolICU.h
+++ b/Source/WebCore/platform/text/LineBreakIteratorPoolICU.h
@@ -61,7 +61,15 @@ public:
 
         if (!iterator) {
             UErrorCode openStatus = U_ZERO_ERROR;
-            iterator = ubrk_open(UBRK_LINE, locale.isEmpty() ? currentTextBreakLocaleID() : locale.string().utf8().data(), 0, 0, &openStatus);
+            bool localeIsEmpty = locale.isEmpty();
+            iterator = ubrk_open(UBRK_LINE, localeIsEmpty ? currentTextBreakLocaleID() : locale.string().utf8().data(), 0, 0, &openStatus);
+            // locale comes from a web page and it can be invalid, leading ICU
+            // to fail, in which case we fall back to the default locale.
+            if (!localeIsEmpty && U_FAILURE(openStatus)) {
+                openStatus = U_ZERO_ERROR;
+                iterator = ubrk_open(UBRK_LINE, currentTextBreakLocaleID(), 0, 0, &openStatus);
+            }
+                
             if (U_FAILURE(openStatus)) {
                 LOG_ERROR("ubrk_open failed with status %d", openStatus);
                 return 0;
diff --git a/Source/WebCore/platform/text/LocaleToScriptMappingICU.cpp b/Source/WebCore/platform/text/LocaleToScriptMappingICU.cpp
index 997707511..1710c7969 100644
--- a/Source/WebCore/platform/text/LocaleToScriptMappingICU.cpp
+++ b/Source/WebCore/platform/text/LocaleToScriptMappingICU.cpp
@@ -68,7 +68,7 @@ UScriptCode localeToScriptCodeForFontSelection(const String& locale)
     if (U_FAILURE(status))
         return USCRIPT_COMMON;
 
-    UScriptCode scriptCode;
+    UScriptCode scriptCode = USCRIPT_COMMON;
     uscript_getCode(script, &scriptCode, 1, &status);
     // Ignore error that multiple scripts could be returned, since we only want one script.
     if (U_FAILURE(status) && status != U_BUFFER_OVERFLOW_ERROR)
diff --git a/Source/WebCore/platform/text/LocalizedNumberICU.cpp b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
index 03db4d546..76f7d2c32 100644
--- a/Source/WebCore/platform/text/LocalizedNumberICU.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
@@ -29,107 +29,244 @@
  */
 
 #include "config.h"
-#include "LocalizedNumber.h"
+#include "LocalizedNumberICU.h"
 
-#include <limits>
-#include <unicode/numfmt.h>
-#include <unicode/parsepos.h>
-#include <wtf/MainThread.h>
-#include <wtf/MathExtras.h>
+#include "LocalizedNumber.h"
 #include <wtf/PassOwnPtr.h>
-#include <wtf/dtoa.h>
+#include <wtf/text/StringBuilder.h>
 
 using namespace icu;
-using namespace std;
 
 namespace WebCore {
 
-static PassOwnPtr<NumberFormat> createFormatterForCurrentLocale()
+ICULocale::ICULocale(const char* locale)
+    : m_locale(locale)
+    , m_numberFormat(0)
+    , m_didCreateDecimalFormat(false)
 {
-    UErrorCode status = U_ZERO_ERROR;
-    OwnPtr<NumberFormat> formatter = adoptPtr(NumberFormat::createInstance(status));
-    return U_SUCCESS(status) ? formatter.release() : nullptr;
 }
 
-static PassOwnPtr<NumberFormat> createFormatterForCurrentLocaleToDisplay()
+ICULocale::~ICULocale()
 {
-    OwnPtr<NumberFormat> formatter(createFormatterForCurrentLocale());
-    if (!formatter)
-        return nullptr;
+    unum_close(m_numberFormat);
+}
 
-    formatter->setGroupingUsed(FALSE);
-    return formatter.release();
+PassOwnPtr<ICULocale> ICULocale::create(const char* localeString)
+{
+    return adoptPtr(new ICULocale(localeString));
 }
 
-// This might return 0.
-static NumberFormat* numberFormatterForParsing()
+PassOwnPtr<ICULocale> ICULocale::createForCurrentLocale()
 {
-    ASSERT(isMainThread());
-    static NumberFormat* formatter = createFormatterForCurrentLocale().leakPtr();
-    return formatter;
+    return adoptPtr(new ICULocale(0));
 }
 
-// This might return 0.
-static NumberFormat* numberFormatterForDisplay()
+void ICULocale::setDecimalSymbol(unsigned index, UNumberFormatSymbol symbol)
 {
-    ASSERT(isMainThread());
-    static NumberFormat* formatter = createFormatterForCurrentLocaleToDisplay().leakPtr();
-    return formatter;
+    UErrorCode status = U_ZERO_ERROR;
+    int32_t bufferLength = unum_getSymbol(m_numberFormat, symbol, 0, 0, &status);
+    ASSERT(U_SUCCESS(status) || status == U_BUFFER_OVERFLOW_ERROR);
+    if (U_FAILURE(status) && status != U_BUFFER_OVERFLOW_ERROR)
+        return;
+    Vector<UChar> buffer(bufferLength);
+    status = U_ZERO_ERROR;
+    unum_getSymbol(m_numberFormat, symbol, buffer.data(), bufferLength, &status);
+    if (U_FAILURE(status))
+        return;
+    m_decimalSymbols[index] = String::adopt(buffer);
 }
 
-static double parseLocalizedNumber(const String& numberString)
+void ICULocale::setDecimalTextAttribute(String& destination, UNumberFormatTextAttribute tag)
 {
-    if (numberString.isEmpty())
-        return numeric_limits<double>::quiet_NaN();
-    NumberFormat* formatter = numberFormatterForParsing();
-    if (!formatter)
-        return numeric_limits<double>::quiet_NaN();
-    UnicodeString numberUnicodeString(numberString.characters(), numberString.length());
-    Formattable result;
-    ParsePosition position(0);
-    formatter->parse(numberUnicodeString, result, position);
-    if (position.getIndex() != numberUnicodeString.length())
-        return numeric_limits<double>::quiet_NaN();
     UErrorCode status = U_ZERO_ERROR;
-    double numericResult = result.getDouble(status);
-    return U_SUCCESS(status) ? numericResult : numeric_limits<double>::quiet_NaN();
+    int32_t bufferLength = unum_getTextAttribute(m_numberFormat, tag, 0, 0, &status);
+    ASSERT(U_SUCCESS(status) || status == U_BUFFER_OVERFLOW_ERROR);
+    if (U_FAILURE(status) && status != U_BUFFER_OVERFLOW_ERROR)
+        return;
+    Vector<UChar> buffer(bufferLength);
+    status = U_ZERO_ERROR;
+    unum_getTextAttribute(m_numberFormat, tag, buffer.data(), bufferLength, &status);
+    ASSERT(U_SUCCESS(status));
+    if (U_FAILURE(status))
+        return;
+    destination = String::adopt(buffer);
 }
 
-static String formatLocalizedNumber(double number, unsigned fractionDigits)
+void ICULocale::initializeDecimalFormat()
 {
-    NumberFormat* formatter = numberFormatterForDisplay();
-    if (!formatter)
-        return String();
-    UnicodeString result;
-    formatter->setMaximumFractionDigits(clampToInteger(fractionDigits));
-    formatter->format(number, result);
-    return String(result.getBuffer(), result.length());
+    if (m_didCreateDecimalFormat)
+        return;
+    m_didCreateDecimalFormat = true;
+    UErrorCode status = U_ZERO_ERROR;
+    m_numberFormat = unum_open(UNUM_DECIMAL, 0, 0, m_locale.data(), 0, &status);
+    if (!U_SUCCESS(status))
+        return;
+
+    setDecimalSymbol(0, UNUM_ZERO_DIGIT_SYMBOL);
+    setDecimalSymbol(1, UNUM_ONE_DIGIT_SYMBOL);
+    setDecimalSymbol(2, UNUM_TWO_DIGIT_SYMBOL);
+    setDecimalSymbol(3, UNUM_THREE_DIGIT_SYMBOL);
+    setDecimalSymbol(4, UNUM_FOUR_DIGIT_SYMBOL);
+    setDecimalSymbol(5, UNUM_FIVE_DIGIT_SYMBOL);
+    setDecimalSymbol(6, UNUM_SIX_DIGIT_SYMBOL);
+    setDecimalSymbol(7, UNUM_SEVEN_DIGIT_SYMBOL);
+    setDecimalSymbol(8, UNUM_EIGHT_DIGIT_SYMBOL);
+    setDecimalSymbol(9, UNUM_NINE_DIGIT_SYMBOL);
+    setDecimalSymbol(DecimalSeparatorIndex, UNUM_DECIMAL_SEPARATOR_SYMBOL);
+    setDecimalSymbol(GroupSeparatorIndex, UNUM_GROUPING_SEPARATOR_SYMBOL);
+    setDecimalTextAttribute(m_positivePrefix, UNUM_POSITIVE_PREFIX);
+    setDecimalTextAttribute(m_positiveSuffix, UNUM_POSITIVE_SUFFIX);
+    setDecimalTextAttribute(m_negativePrefix, UNUM_NEGATIVE_PREFIX);
+    setDecimalTextAttribute(m_negativeSuffix, UNUM_NEGATIVE_SUFFIX);
+    ASSERT(!m_positivePrefix.isEmpty() || !m_positiveSuffix.isEmpty() || !m_negativePrefix.isEmpty() || !m_negativeSuffix.isEmpty());
 }
 
-String convertToLocalizedNumber(const String& canonicalNumberString, unsigned fractionDigits)
+String ICULocale::convertToLocalizedNumber(const String& input)
+{
+    initializeDecimalFormat();
+    if (!m_numberFormat || input.isEmpty())
+        return input;
+
+    unsigned i = 0;
+    bool isNegative = false;
+    UnicodeString ustring;
+    StringBuilder builder;
+    builder.reserveCapacity(input.length());
+
+    if (input[0] == '-') {
+        ++i;
+        isNegative = true;
+        builder.append(m_negativePrefix);
+    } else
+        builder.append(m_positivePrefix);
+
+    for (; i < input.length(); ++i) {
+        switch (input[i]) {
+        case '0':
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9':
+            builder.append(m_decimalSymbols[input[i] - '0']);
+            break;
+        case '.':
+            builder.append(m_decimalSymbols[DecimalSeparatorIndex]);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    builder.append(isNegative ? m_negativeSuffix : m_positiveSuffix);
+
+    return builder.toString();
+}
+
+static bool matches(const String& text, unsigned position, const String& part)
 {
-    // FIXME: We should not do parse-then-format. It makes some
-    // problems such as removing leading zeros, changing trailing
-    // digits to zeros.
-    // FIXME: We should not use the fractionDigits argument.
+    if (part.isEmpty())
+        return true;
+    if (position + part.length() > text.length())
+        return false;
+    for (unsigned i = 0; i < part.length(); ++i) {
+        if (text[position + i] != part[i])
+            return false;
+    }
+    return true;
+}
+
+bool ICULocale::detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex)
+{
+    startIndex = 0;
+    endIndex = input.length();
+    if (m_negativePrefix.isEmpty() && m_negativeSuffix.isEmpty()) {
+        if (input.startsWith(m_positivePrefix) && input.endsWith(m_positiveSuffix)) {
+            isNegative = false;
+            startIndex = m_positivePrefix.length();
+            endIndex -= m_positiveSuffix.length();
+        } else
+            isNegative = true;
+    } else {
+        if (input.startsWith(m_negativePrefix) && input.endsWith(m_negativeSuffix)) {
+            isNegative = true;
+            startIndex = m_negativePrefix.length();
+            endIndex -= m_negativeSuffix.length();
+        } else {
+            isNegative = false;
+            if (input.startsWith(m_positivePrefix) && input.endsWith(m_positiveSuffix)) {
+                startIndex = m_positivePrefix.length();
+                endIndex -= m_positiveSuffix.length();
+            } else
+                return false;
+        }
+    }
+    return true;
+}
+
+unsigned ICULocale::matchedDecimalSymbolIndex(const String& input, unsigned& position)
+{
+    for (unsigned symbolIndex = 0; symbolIndex < DecimalSymbolsSize; ++symbolIndex) {
+        if (m_decimalSymbols[symbolIndex].length() && matches(input, position, m_decimalSymbols[symbolIndex])) {
+            position += m_decimalSymbols[symbolIndex].length();
+            return symbolIndex;
+        }
+    }
+    return DecimalSymbolsSize;
+}
+
+String ICULocale::convertFromLocalizedNumber(const String& localized)
+{
+    initializeDecimalFormat();
+    String input = localized.stripWhiteSpace();
+    if (!m_numberFormat || input.isEmpty())
+        return input;
 
-    double doubleValue = canonicalNumberString.toDouble();
-    // The input string must be valid.
-    return formatLocalizedNumber(doubleValue, fractionDigits);
+    bool isNegative;
+    unsigned startIndex;
+    unsigned endIndex;
+    if (!detectSignAndGetDigitRange(input, isNegative, startIndex, endIndex)) {
+        // Input is broken. Returning an invalid number string.
+        return "*";
+    }
 
+    StringBuilder builder;
+    builder.reserveCapacity(input.length());
+    if (isNegative)
+        builder.append("-");
+    for (unsigned i = startIndex; i < endIndex;) {
+        unsigned symbolIndex = matchedDecimalSymbolIndex(input, i);
+        if (symbolIndex >= DecimalSymbolsSize)
+            return "*";
+        if (symbolIndex == DecimalSeparatorIndex)
+            builder.append('.');
+        else if (symbolIndex == GroupSeparatorIndex) {
+            // Ignore group separators.
+
+        } else
+            builder.append(static_cast<UChar>('0' + symbolIndex));
+    }
+    return builder.toString();
+}
+
+static ICULocale* currentLocale()
+{
+    static ICULocale* currentICULocale = ICULocale::createForCurrentLocale().leakPtr();
+    return currentICULocale;
+}
+
+String convertToLocalizedNumber(const String& canonicalNumberString, unsigned fractionDigits)
+{
+    return currentLocale()->convertToLocalizedNumber(canonicalNumberString);
 }
 
 String convertFromLocalizedNumber(const String& localizedNumberString)
 {
-    // FIXME: We should not do parse-then-format. It makes some
-    // problems such as removing leading zeros, changing trailing
-    // digits to zeros.
-
-    double doubleValue = parseLocalizedNumber(localizedNumberString);
-    if (!isfinite(doubleValue))
-        return localizedNumberString;
-    NumberToStringBuffer buffer;
-    return String(numberToString(doubleValue, buffer));
+    return currentLocale()->convertFromLocalizedNumber(localizedNumberString);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/text/LocalizedNumberICU.h b/Source/WebCore/platform/text/LocalizedNumberICU.h
new file mode 100644
index 000000000..fd85622cd
--- /dev/null
+++ b/Source/WebCore/platform/text/LocalizedNumberICU.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LocalizedNumberICU_h
+#define LocalizedNumberICU_h
+
+#include <unicode/unum.h>
+#include <wtf/Forward.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+// We should use this class only for LocalizedNumberICU.cpp and LocalizedNumberICUTest.cpp.
+class ICULocale {
+public:
+    static PassOwnPtr<ICULocale> create(const char* localeString);
+    static PassOwnPtr<ICULocale> createForCurrentLocale();
+    ~ICULocale();
+    String convertToLocalizedNumber(const String&);
+    String convertFromLocalizedNumber(const String&);
+
+private:
+    explicit ICULocale(const char*);
+    void setDecimalSymbol(unsigned index, UNumberFormatSymbol);
+    void setDecimalTextAttribute(String&, UNumberFormatTextAttribute);
+    void initializeDecimalFormat();
+
+    bool detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex);
+    unsigned matchedDecimalSymbolIndex(const String& input, unsigned& position);
+
+    CString m_locale;
+    UNumberFormat* m_numberFormat;
+    enum {
+        // 0-9 for digits.
+        DecimalSeparatorIndex = 10,
+        GroupSeparatorIndex = 11,
+        DecimalSymbolsSize
+    };
+    String m_decimalSymbols[DecimalSymbolsSize];
+    String m_positivePrefix;
+    String m_positiveSuffix;
+    String m_negativePrefix;
+    String m_negativeSuffix;
+    bool m_didCreateDecimalFormat;
+};
+
+}
+#endif
diff --git a/Source/WebCore/platform/text/RegularExpression.cpp b/Source/WebCore/platform/text/RegularExpression.cpp
index bdc9f848d..3fbe3f866 100644
--- a/Source/WebCore/platform/text/RegularExpression.cpp
+++ b/Source/WebCore/platform/text/RegularExpression.cpp
@@ -100,20 +100,26 @@ int RegularExpression::match(const String& str, int startFrom, int* matchLength)
         return -1;
 
     int offsetVectorSize = (d->m_numSubpatterns + 1) * 2;
-    int* offsetVector;
-    Vector<int, 32> nonReturnedOvector;
+    unsigned* offsetVector;
+    Vector<unsigned, 32> nonReturnedOvector;
 
     nonReturnedOvector.resize(offsetVectorSize);
     offsetVector = nonReturnedOvector.data();
 
     ASSERT(offsetVector);
     for (unsigned j = 0, i = 0; i < d->m_numSubpatterns + 1; j += 2, i++)
-        offsetVector[j] = -1;
-
-    int result = JSC::Yarr::interpret(d->m_regExpByteCode.get(), JSC::UString(str.impl()), startFrom, str.length(), offsetVector);
-    ASSERT(result >= -1);
+        offsetVector[j] = JSC::Yarr::offsetNoMatch;
+
+    unsigned result;
+    if (str.length() <= INT_MAX)
+        result = JSC::Yarr::interpret(d->m_regExpByteCode.get(), JSC::UString(str.impl()), startFrom, str.length(), offsetVector);
+    else {
+        // This code can't handle unsigned offsets. Limit our processing to strings with offsets that 
+        // can be represented as ints.
+        result = JSC::Yarr::offsetNoMatch;
+    }
 
-    if (result < 0) {
+    if (result == JSC::Yarr::offsetNoMatch) {
         d->lastMatchLength = -1;
         return -1;
     }
diff --git a/Source/WebCore/platform/text/TextAllInOne.cpp b/Source/WebCore/platform/text/TextAllInOne.cpp
new file mode 100644
index 000000000..b0bc39432
--- /dev/null
+++ b/Source/WebCore/platform/text/TextAllInOne.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "TextBoundaries.cpp"
+#include "TextBreakIteratorICU.cpp"
+#include "TextCodec.cpp"
+#include "TextCodecICU.cpp"
+#include "TextCodecLatin1.cpp"
+#include "TextCodecUTF16.cpp"
+#include "TextCodecUTF8.cpp"
+#include "TextCodecUserDefined.cpp"
+#include "TextEncoding.cpp"
+#include "TextEncodingDetectorICU.cpp"
+#include "TextEncodingRegistry.cpp"
+#include "TextStream.cpp"
diff --git a/Source/WebCore/platform/text/TextBreakIteratorICU.cpp b/Source/WebCore/platform/text/TextBreakIteratorICU.cpp
index a591297e6..82471bd32 100644
--- a/Source/WebCore/platform/text/TextBreakIteratorICU.cpp
+++ b/Source/WebCore/platform/text/TextBreakIteratorICU.cpp
@@ -71,6 +71,8 @@ TextBreakIterator* wordBreakIterator(const UChar* string, int length)
 TextBreakIterator* acquireLineBreakIterator(const UChar* string, int length, const AtomicString& locale)
 {
     UBreakIterator* iterator = LineBreakIteratorPool::sharedPool().take(locale);
+    if (!iterator)
+        return 0;
 
     UErrorCode setTextStatus = U_ZERO_ERROR;
     ubrk_setText(iterator, string, length, &setTextStatus);
diff --git a/Source/WebCore/platform/text/UnicodeBidi.h b/Source/WebCore/platform/text/UnicodeBidi.h
index 08f054525..0b875e435 100644
--- a/Source/WebCore/platform/text/UnicodeBidi.h
+++ b/Source/WebCore/platform/text/UnicodeBidi.h
@@ -33,12 +33,18 @@ enum EUnicodeBidi {
     Embed,
     Override,
     Isolate,
-    Plaintext
+    Plaintext,
+    OverrideIsolate,
 }; 
 
 inline bool isIsolated(const EUnicodeBidi& unicodeBidi)
 {
-    return unicodeBidi == Isolate || unicodeBidi == Plaintext;
+    return unicodeBidi == Isolate || unicodeBidi == OverrideIsolate || unicodeBidi == Plaintext;
+}
+
+inline bool isOverride(EUnicodeBidi unicodeBidi)
+{
+    return unicodeBidi == Override || unicodeBidi == OverrideIsolate;
 }
 
 }
diff --git a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
index 827e3588c..d61c01432 100644
--- a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
@@ -208,7 +208,7 @@ HGLOBAL createGlobalData(const Vector<char>& vector)
     return globalData;
 }
 
-static String getFullCFHTML(IDataObject* data, bool& success)
+static String getFullCFHTML(IDataObject* data)
 {
     STGMEDIUM store;
     if (SUCCEEDED(data->GetData(htmlFormat(), &store))) {
@@ -218,10 +218,8 @@ static String getFullCFHTML(IDataObject* data, bool& success)
         String cfhtml(UTF8Encoding().decode(data, dataSize));
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
         return cfhtml;
     }
-    success = false;
     return String();
 }
 
@@ -447,27 +445,25 @@ void setFileContentData(IDataObject* dataObject, int size, void* dataBlob)
     dataObject->SetData(fileContentFormatZero(), &medium, TRUE);
 }
 
-String getURL(IDataObject* dataObject, DragData::FilenameConversionPolicy filenamePolicy, bool& success, String* title)
+String getURL(IDataObject* dataObject, DragData::FilenameConversionPolicy filenamePolicy, String* title)
 {
     STGMEDIUM store;
     String url;
-    success = false;
     if (getWebLocData(dataObject, url, title))
-        success = true;
-    else if (SUCCEEDED(dataObject->GetData(urlWFormat(), &store))) {
+        return url;
+
+    if (SUCCEEDED(dataObject->GetData(urlWFormat(), &store))) {
         // URL using Unicode
         UChar* data = static_cast<UChar*>(GlobalLock(store.hGlobal));
         url = extractURL(String(data), title);
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
     } else if (SUCCEEDED(dataObject->GetData(urlFormat(), &store))) {
         // URL using ASCII
         char* data = static_cast<char*>(GlobalLock(store.hGlobal));
         url = extractURL(String(data), title);
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
     }
 #if USE(CF)
     else if (filenamePolicy == DragData::ConvertFilenames) {
@@ -476,11 +472,8 @@ String getURL(IDataObject* dataObject, DragData::FilenameConversionPolicy filena
             wchar_t* data = static_cast<wchar_t*>(GlobalLock(store.hGlobal));
             if (data && data[0] && (PathFileExists(data) || PathIsUNC(data))) {
                 RetainPtr<CFStringRef> pathAsCFString(AdoptCF, CFStringCreateWithCharacters(kCFAllocatorDefault, (const UniChar*)data, wcslen(data)));
-                if (urlFromPath(pathAsCFString.get(), url)) {
-                    if (title)
-                        *title = url;
-                    success = true;
-                }
+                if (urlFromPath(pathAsCFString.get(), url) && title)
+                    *title = url;
             }
             GlobalUnlock(store.hGlobal);
             ReleaseStgMedium(&store);
@@ -489,11 +482,8 @@ String getURL(IDataObject* dataObject, DragData::FilenameConversionPolicy filena
             char* data = static_cast<char*>(GlobalLock(store.hGlobal));
             if (data && data[0] && (PathFileExistsA(data) || PathIsUNCA(data))) {
                 RetainPtr<CFStringRef> pathAsCFString(AdoptCF, CFStringCreateWithCString(kCFAllocatorDefault, data, kCFStringEncodingASCII));
-                if (urlFromPath(pathAsCFString.get(), url)) {
-                    if (title)
-                        *title = url;
-                    success = true;
-                }
+                if (urlFromPath(pathAsCFString.get(), url) && title)
+                    *title = url;
             }
             GlobalUnlock(store.hGlobal);
             ReleaseStgMedium(&store);
@@ -530,31 +520,27 @@ String getURL(const DragDataMap* data, DragData::FilenameConversionPolicy filena
     return url;
 }
 
-String getPlainText(IDataObject* dataObject, bool& success)
+String getPlainText(IDataObject* dataObject)
 {
     STGMEDIUM store;
     String text;
-    success = false;
     if (SUCCEEDED(dataObject->GetData(plainTextWFormat(), &store))) {
         // Unicode text
         UChar* data = static_cast<UChar*>(GlobalLock(store.hGlobal));
         text = String(data);
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
     } else if (SUCCEEDED(dataObject->GetData(plainTextFormat(), &store))) {
         // ASCII text
         char* data = static_cast<char*>(GlobalLock(store.hGlobal));
         text = String(data);
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
     } else {
         // FIXME: Originally, we called getURL() here because dragging and dropping files doesn't
         // populate the drag with text data. Per https://bugs.webkit.org/show_bug.cgi?id=38826, this
         // is undesirable, so maybe this line can be removed.
-        text = getURL(dataObject, DragData::DoNotConvertFilenames, success);
-        success = true;
+        text = getURL(dataObject, DragData::DoNotConvertFilenames);
     }
     return text;
 }
@@ -570,17 +556,15 @@ String getPlainText(const DragDataMap* data)
     return getURL(data, DragData::DoNotConvertFilenames);
 }
 
-String getTextHTML(IDataObject* data, bool& success)
+String getTextHTML(IDataObject* data)
 {
     STGMEDIUM store;
     String html;
-    success = false;
     if (SUCCEEDED(data->GetData(texthtmlFormat(), &store))) {
         UChar* data = static_cast<UChar*>(GlobalLock(store.hGlobal));
         html = String(data);
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
     }
     return html;
 }
@@ -592,10 +576,10 @@ String getTextHTML(const DragDataMap* data)
     return text;
 }
 
-String getCFHTML(IDataObject* data, bool& success)
+String getCFHTML(IDataObject* data)
 {
-    String cfhtml = getFullCFHTML(data, success);
-    if (success)
+    String cfhtml = getFullCFHTML(data);
+    if (!cfhtml.isEmpty())
         return extractMarkupFromCFHTML(cfhtml);
     return String();
 }
@@ -655,16 +639,15 @@ PassRefPtr<DocumentFragment> fragmentFromHTML(Document* doc, IDataObject* data)
     if (!doc || !data)
         return 0;
 
-    bool success = false;
-    String cfhtml = getFullCFHTML(data, success);
-    if (success) {
+    String cfhtml = getFullCFHTML(data);
+    if (!cfhtml.isEmpty()) {
         if (RefPtr<DocumentFragment> fragment = fragmentFromCFHTML(doc, cfhtml))
             return fragment.release();
     }
 
-    String html = getTextHTML(data, success);
+    String html = getTextHTML(data);
     String srcURL;
-    if (success)
+    if (!html.isEmpty())
         return createFragmentFromMarkup(doc, html, srcURL, FragmentScriptingNotAllowed);
 
     return 0;
diff --git a/Source/WebCore/platform/win/ClipboardUtilitiesWin.h b/Source/WebCore/platform/win/ClipboardUtilitiesWin.h
index 7501d56f1..e8d4755e3 100644
--- a/Source/WebCore/platform/win/ClipboardUtilitiesWin.h
+++ b/Source/WebCore/platform/win/ClipboardUtilitiesWin.h
@@ -67,13 +67,13 @@ PassRefPtr<DocumentFragment> fragmentFromHTML(Document*, IDataObject*);
 PassRefPtr<DocumentFragment> fragmentFromHTML(Document*, const DragDataMap*);
 PassRefPtr<DocumentFragment> fragmentFromCFHTML(Document*, const String& cfhtml);
 
-String getURL(IDataObject*, DragData::FilenameConversionPolicy, bool& success, String* title = 0);
+String getURL(IDataObject*, DragData::FilenameConversionPolicy, String* title = 0);
 String getURL(const DragDataMap*, DragData::FilenameConversionPolicy, String* title = 0);
-String getPlainText(IDataObject*, bool& success);
+String getPlainText(IDataObject*);
 String getPlainText(const DragDataMap*);
-String getTextHTML(IDataObject*, bool& success);
+String getTextHTML(IDataObject*);
 String getTextHTML(const DragDataMap*);
-String getCFHTML(IDataObject*, bool& success);
+String getCFHTML(IDataObject*);
 String getCFHTML(const DragDataMap*);
 
 void getClipboardData(IDataObject*, FORMATETC* fetc, Vector<String>& dataStrings);
diff --git a/Source/WebCore/platform/win/ClipboardWin.cpp b/Source/WebCore/platform/win/ClipboardWin.cpp
index 89cacb351..12cb8bf01 100644
--- a/Source/WebCore/platform/win/ClipboardWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardWin.cpp
@@ -28,7 +28,6 @@
 
 #include "CachedImage.h"
 #include "ClipboardUtilitiesWin.h"
-#include "DOMStringList.h"
 #include "Document.h"
 #include "DragData.h"
 #include "Editor.h"
@@ -436,22 +435,21 @@ void ClipboardWin::clearAllData()
     m_dataObject = m_writableDataObject;
 }
 
-String ClipboardWin::getData(const String& type, bool& success) const
+String ClipboardWin::getData(const String& type) const
 {     
-    success = false;
     if (policy() != ClipboardReadable || (!m_dataObject && m_dragDataMap.isEmpty()))
         return "";
 
     ClipboardDataType dataType = clipboardTypeFromMIMEType(type);
     if (dataType == ClipboardDataTypeText)
-        return m_dataObject ? getPlainText(m_dataObject.get(), success) : getPlainText(&m_dragDataMap);
+        return m_dataObject ? getPlainText(m_dataObject.get()) : getPlainText(&m_dragDataMap);
     if (dataType == ClipboardDataTypeURL)
-        return m_dataObject ? getURL(m_dataObject.get(), DragData::DoNotConvertFilenames, success) : getURL(&m_dragDataMap, DragData::DoNotConvertFilenames);
+        return m_dataObject ? getURL(m_dataObject.get(), DragData::DoNotConvertFilenames) : getURL(&m_dragDataMap, DragData::DoNotConvertFilenames);
     else if (dataType == ClipboardDataTypeTextHTML) {
-        String data = m_dataObject ? getTextHTML(m_dataObject.get(), success) : getTextHTML(&m_dragDataMap);
-        if (success)
+        String data = m_dataObject ? getTextHTML(m_dataObject.get()) : getTextHTML(&m_dragDataMap);
+        if (!data.isEmpty())
             return data;
-        return m_dataObject ? getCFHTML(m_dataObject.get(), success) : getCFHTML(&m_dragDataMap);
+        return m_dataObject ? getCFHTML(m_dataObject.get()) : getCFHTML(&m_dragDataMap);
     }
     
     return "";
@@ -486,24 +484,24 @@ bool ClipboardWin::setData(const String& type, const String& data)
     return false;
 }
 
-static void addMimeTypesForFormat(DOMStringList* results, const FORMATETC& format)
+static void addMimeTypesForFormat(HashSet<String>& results, const FORMATETC& format)
 {
     // URL and Text are provided for compatibility with IE's model
     if (format.cfFormat == urlFormat()->cfFormat || format.cfFormat == urlWFormat()->cfFormat) {
-        results->append("URL");
-        results->append("text/uri-list");
+        results.add("URL");
+        results.add("text/uri-list");
     }
 
     if (format.cfFormat == plainTextWFormat()->cfFormat || format.cfFormat == plainTextFormat()->cfFormat) {
-        results->append("Text");
-        results->append("text/plain");
+        results.add("Text");
+        results.add("text/plain");
     }
 }
 
 // extensions beyond IE's API
-PassRefPtr<DOMStringList> ClipboardWin::types() const
+HashSet<String> ClipboardWin::types() const
 { 
-    RefPtr<DOMStringList> results = DOMStringList::create();
+    HashSet<String> results; 
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
         return results;
 
@@ -523,16 +521,16 @@ PassRefPtr<DOMStringList> ClipboardWin::types() const
 
         // IEnumFORMATETC::Next returns S_FALSE if there are no more items.
         while (itr->Next(1, &data, 0) == S_OK)
-            addMimeTypesForFormat(results.get(), data);
+            addMimeTypesForFormat(results, data);
     } else {
         for (DragDataMap::const_iterator it = m_dragDataMap.begin(); it != m_dragDataMap.end(); ++it) {
             FORMATETC data;
             data.cfFormat = (*it).first;
-            addMimeTypesForFormat(results.get(), data);
+            addMimeTypesForFormat(results, data);
         }
     }
 
-    return results.release();
+    return results;
 }
 
 PassRefPtr<FileList> ClipboardWin::files() const
diff --git a/Source/WebCore/platform/win/ClipboardWin.h b/Source/WebCore/platform/win/ClipboardWin.h
index 8c22c0a35..d56ea1900 100644
--- a/Source/WebCore/platform/win/ClipboardWin.h
+++ b/Source/WebCore/platform/win/ClipboardWin.h
@@ -60,11 +60,11 @@ public:
 
     void clearData(const String& type);
     void clearAllData();
-    String getData(const String& type, bool& success) const;
+    String getData(const String& type) const;
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual PassRefPtr<DOMStringList> types() const;
+    virtual HashSet<String> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/win/DragDataWin.cpp b/Source/WebCore/platform/win/DragDataWin.cpp
index 9ab62b950..46a9073cb 100644
--- a/Source/WebCore/platform/win/DragDataWin.cpp
+++ b/Source/WebCore/platform/win/DragDataWin.cpp
@@ -101,8 +101,7 @@ void DragData::getDragFileContentData(int size, void* dataBlob)
 
 String DragData::asURL(Frame*, FilenameConversionPolicy filenamePolicy, String* title) const
 {
-    bool success;
-    return (m_platformDragData) ? getURL(m_platformDragData, filenamePolicy, success, title) : getURL(&m_dragDataMap, filenamePolicy, title);
+    return (m_platformDragData) ? getURL(m_platformDragData, filenamePolicy, title) : getURL(&m_dragDataMap, filenamePolicy, title);
 }
 
 bool DragData::containsFiles() const
@@ -155,8 +154,7 @@ bool DragData::containsPlainText() const
 
 String DragData::asPlainText(Frame*) const
 {
-    bool success;
-    return (m_platformDragData) ? getPlainText(m_platformDragData, success) : getPlainText(&m_dragDataMap);
+    return (m_platformDragData) ? getPlainText(m_platformDragData) : getPlainText(&m_dragDataMap);
 }
 
 bool DragData::containsColor() const
diff --git a/Source/WebCore/platform/win/ScrollbarThemeSafari.cpp b/Source/WebCore/platform/win/ScrollbarThemeSafari.cpp
index 343bbb280..1cc5385e1 100644
--- a/Source/WebCore/platform/win/ScrollbarThemeSafari.cpp
+++ b/Source/WebCore/platform/win/ScrollbarThemeSafari.cpp
@@ -104,14 +104,14 @@ int ScrollbarThemeSafari::scrollbarThickness(ScrollbarControlSize controlSize)
     return cScrollbarThickness[controlSize];
 }
 
-bool ScrollbarThemeSafari::hasButtons(Scrollbar* scrollbar)
+bool ScrollbarThemeSafari::hasButtons(ScrollbarThemeClient* scrollbar)
 {
     return scrollbar->enabled() && (scrollbar->orientation() == HorizontalScrollbar ? 
              scrollbar->width() : 
              scrollbar->height()) >= 2 * (cRealButtonLength[scrollbar->controlSize()] - cButtonHitInset[scrollbar->controlSize()]);
 }
 
-bool ScrollbarThemeSafari::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeSafari::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     return scrollbar->enabled() && (scrollbar->orientation() == HorizontalScrollbar ? 
              scrollbar->width() : 
@@ -134,7 +134,7 @@ static IntRect buttonRepaintRect(const IntRect& buttonRect, ScrollbarOrientation
     return paintRect;
 }
 
-IntRect ScrollbarThemeSafari::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+IntRect ScrollbarThemeSafari::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool painting)
 {
     IntRect result;
 
@@ -152,7 +152,7 @@ IntRect ScrollbarThemeSafari::backButtonRect(Scrollbar* scrollbar, ScrollbarPart
     return result;
 }
 
-IntRect ScrollbarThemeSafari::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+IntRect ScrollbarThemeSafari::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool painting)
 {
     IntRect result;
     
@@ -181,7 +181,7 @@ static IntRect trackRepaintRect(const IntRect& trackRect, ScrollbarOrientation o
     return paintRect;
 }
 
-IntRect ScrollbarThemeSafari::trackRect(Scrollbar* scrollbar, bool painting)
+IntRect ScrollbarThemeSafari::trackRect(ScrollbarThemeClient* scrollbar, bool painting)
 {
     if (painting || !hasButtons(scrollbar))
         return scrollbar->frameRect();
@@ -193,36 +193,36 @@ IntRect ScrollbarThemeSafari::trackRect(Scrollbar* scrollbar, bool painting)
     return IntRect(scrollbar->x(), scrollbar->y() + cButtonLength[scrollbar->controlSize()], thickness, scrollbar->height() - 2 * cButtonLength[scrollbar->controlSize()]);
 }
 
-int ScrollbarThemeSafari::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeSafari::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return cThumbMinLength[scrollbar->controlSize()];
 }
 
-bool ScrollbarThemeSafari::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeSafari::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     return evt.shiftKey() && evt.button() == LeftButton;
 }
 
-void ScrollbarThemeSafari::paintTrackBackground(GraphicsContext* graphicsContext, Scrollbar* scrollbar, const IntRect& trackRect)
+void ScrollbarThemeSafari::paintTrackBackground(GraphicsContext* graphicsContext, ScrollbarThemeClient* scrollbar, const IntRect& trackRect)
 {
     if (!SafariThemeLibrary())
         return;
     NSControlSize size = scrollbar->controlSize() == SmallScrollbar ? NSSmallControlSize : NSRegularControlSize;
     ThemeControlState state = 0;
-    if (scrollbar->scrollableArea()->isActive())
+    if (scrollbar->isScrollableAreaActive())
         state |= ActiveState;
     if (hasButtons(scrollbar))
         state |= EnabledState;
     paintThemePart(scrollbar->orientation() == VerticalScrollbar ? VScrollTrackPart : HScrollTrackPart, graphicsContext->platformContext(), trackRect, size, state); 
 }
 
-void ScrollbarThemeSafari::paintButton(GraphicsContext* graphicsContext, Scrollbar* scrollbar, const IntRect& buttonRect, ScrollbarPart part)
+void ScrollbarThemeSafari::paintButton(GraphicsContext* graphicsContext, ScrollbarThemeClient* scrollbar, const IntRect& buttonRect, ScrollbarPart part)
 {
     if (!SafariThemeLibrary())
         return;
     NSControlSize size = scrollbar->controlSize() == SmallScrollbar ? NSSmallControlSize : NSRegularControlSize;
     ThemeControlState state = 0;
-    if (scrollbar->scrollableArea()->isActive())
+    if (scrollbar->isScrollableAreaActive())
         state |= ActiveState;
     if (hasButtons(scrollbar))
         state |= EnabledState;
@@ -236,13 +236,13 @@ void ScrollbarThemeSafari::paintButton(GraphicsContext* graphicsContext, Scrollb
                        buttonRect, size, state);
 }
 
-void ScrollbarThemeSafari::paintThumb(GraphicsContext* graphicsContext, Scrollbar* scrollbar, const IntRect& thumbRect)
+void ScrollbarThemeSafari::paintThumb(GraphicsContext* graphicsContext, ScrollbarThemeClient* scrollbar, const IntRect& thumbRect)
 {
     if (!SafariThemeLibrary())
         return;
     NSControlSize size = scrollbar->controlSize() == SmallScrollbar ? NSSmallControlSize : NSRegularControlSize;
     ThemeControlState state = 0;
-    if (scrollbar->scrollableArea()->isActive())
+    if (scrollbar->isScrollableAreaActive())
         state |= ActiveState;
     if (hasThumb(scrollbar))
         state |= EnabledState;
diff --git a/Source/WebCore/platform/win/ScrollbarThemeSafari.h b/Source/WebCore/platform/win/ScrollbarThemeSafari.h
index f039379ea..f427b190f 100644
--- a/Source/WebCore/platform/win/ScrollbarThemeSafari.h
+++ b/Source/WebCore/platform/win/ScrollbarThemeSafari.h
@@ -41,20 +41,20 @@ public:
     virtual bool supportsControlTints() const { return true; }
 
 protected:
-    virtual bool hasButtons(Scrollbar*);
-    virtual bool hasThumb(Scrollbar*);
+    virtual bool hasButtons(ScrollbarThemeClient*);
+    virtual bool hasThumb(ScrollbarThemeClient*);
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
 
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
     
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
 
-    virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-    virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
+    virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
 };
 
 }
diff --git a/Source/WebCore/platform/win/ScrollbarThemeWin.cpp b/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
index d36341068..5644297d7 100644
--- a/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
+++ b/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
@@ -130,12 +130,12 @@ bool ScrollbarThemeWin::invalidateOnMouseEnterExit()
     return runningVista;
 }
 
-bool ScrollbarThemeWin::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeWin::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     return thumbLength(scrollbar) > 0;
 }
 
-IntRect ScrollbarThemeWin::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeWin::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // Windows just has single arrows.
     if (part == BackButtonEndPart)
@@ -154,7 +154,7 @@ IntRect ScrollbarThemeWin::backButtonRect(Scrollbar* scrollbar, ScrollbarPart pa
                    thickness, scrollbar->height() < 2 * thickness ? scrollbar->height() / 2 : thickness);
 }
 
-IntRect ScrollbarThemeWin::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeWin::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // Windows just has single arrows.
     if (part == ForwardButtonStartPart)
@@ -175,7 +175,7 @@ IntRect ScrollbarThemeWin::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart
     return IntRect(scrollbar->x(), scrollbar->y() + scrollbar->height() - h, thickness, h);
 }
 
-IntRect ScrollbarThemeWin::trackRect(Scrollbar* scrollbar, bool)
+IntRect ScrollbarThemeWin::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     int thickness = scrollbarThickness();
     if (scrollbar->orientation() == HorizontalScrollbar) {
@@ -188,12 +188,12 @@ IntRect ScrollbarThemeWin::trackRect(Scrollbar* scrollbar, bool)
     return IntRect(scrollbar->x(), scrollbar->y() + thickness, thickness, scrollbar->height() - 2 * thickness);
 }
 
-bool ScrollbarThemeWin::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeWin::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     return evt.shiftKey() && evt.button() == LeftButton;
 }
 
-bool ScrollbarThemeWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
+bool ScrollbarThemeWin::shouldSnapBackToDragOrigin(ScrollbarThemeClient* scrollbar, const PlatformMouseEvent& evt)
 {
     // Find the rect within which we shouldn't snap, by expanding the track rect
     // in both dimensions.
@@ -211,14 +211,14 @@ bool ScrollbarThemeWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar, const P
     return !rect.contains(mousePosition);
 }
 
-void ScrollbarThemeWin::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeWin::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     // Just assume a forward track part.  We only paint the track as a single piece when there is no thumb.
     if (!hasThumb(scrollbar))
         paintTrackPiece(context, scrollbar, rect, ForwardTrackPart);
 }
 
-void ScrollbarThemeWin::paintTrackPiece(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart partType)
+void ScrollbarThemeWin::paintTrackPiece(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart partType)
 {
     checkAndInitScrollbarTheme();
 
@@ -276,7 +276,7 @@ void ScrollbarThemeWin::paintTrackPiece(GraphicsContext* context, Scrollbar* scr
 #endif
 }
 
-void ScrollbarThemeWin::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeWin::paintButton(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     checkAndInitScrollbarTheme();
 
@@ -339,7 +339,7 @@ static IntRect gripperRect(int thickness, const IntRect& thumbRect)
                    gripperThickness, gripperThickness);
 }
 
-static void paintGripper(Scrollbar* scrollbar, HDC hdc, const IntRect& rect)
+static void paintGripper(ScrollbarThemeClient* scrollbar, HDC hdc, const IntRect& rect)
 {
     if (!scrollbarTheme)
         return;  // Classic look has no gripper.
@@ -358,7 +358,7 @@ static void paintGripper(Scrollbar* scrollbar, HDC hdc, const IntRect& rect)
     DrawThemeBackground(scrollbarTheme, hdc, scrollbar->orientation() == HorizontalScrollbar ? SP_GRIPPERHOR : SP_GRIPPERVERT, state, &themeRect, 0);
 }
 
-void ScrollbarThemeWin::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeWin::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     checkAndInitScrollbarTheme();
 
diff --git a/Source/WebCore/platform/win/ScrollbarThemeWin.h b/Source/WebCore/platform/win/ScrollbarThemeWin.h
index cd2f176df..870240c16 100644
--- a/Source/WebCore/platform/win/ScrollbarThemeWin.h
+++ b/Source/WebCore/platform/win/ScrollbarThemeWin.h
@@ -42,20 +42,20 @@ public:
     virtual bool invalidateOnMouseEnterExit();
 
 protected:
-    virtual bool hasButtons(Scrollbar*) { return true; }
-    virtual bool hasThumb(Scrollbar*);
+    virtual bool hasButtons(ScrollbarThemeClient*) { return true; }
+    virtual bool hasThumb(ScrollbarThemeClient*);
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
 
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
-    virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&);
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
+    virtual bool shouldSnapBackToDragOrigin(ScrollbarThemeClient*, const PlatformMouseEvent&);
 
-    virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-    virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
+    virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
 };
 
 }
diff --git a/Source/WebCore/platform/wx/ClipboardWx.cpp b/Source/WebCore/platform/wx/ClipboardWx.cpp
index 161bce8aa..8a3a9c8a3 100644
--- a/Source/WebCore/platform/wx/ClipboardWx.cpp
+++ b/Source/WebCore/platform/wx/ClipboardWx.cpp
@@ -26,7 +26,6 @@
 #include "config.h"
 #include "ClipboardWx.h"
 
-#include "DOMStringList.h"
 #include "FileList.h"
 #include "HashTable.h"
 #include "IntPoint.h"
@@ -58,7 +57,7 @@ void ClipboardWx::clearAllData()
     Pasteboard::generalPasteboard()->clear();
 }
 
-String ClipboardWx::getData(const String& type, bool& success) const 
+String ClipboardWx::getData(const String& type) const 
 {
     notImplemented();
     return ""; 
@@ -71,10 +70,11 @@ bool ClipboardWx::setData(const String& type, const String& data)
 }
 
 // extensions beyond IE's API
-PassRefPtr<DOMStringList> ClipboardWx::types() const 
+HashSet<String> ClipboardWx::types() const 
 {
     notImplemented();
-    return DOMStringList::create();
+    HashSet<String> result;
+    return result;
 }
 
 PassRefPtr<FileList> ClipboardWx::files() const
diff --git a/Source/WebCore/platform/wx/ClipboardWx.h b/Source/WebCore/platform/wx/ClipboardWx.h
index f92726ae6..9e661d786 100644
--- a/Source/WebCore/platform/wx/ClipboardWx.h
+++ b/Source/WebCore/platform/wx/ClipboardWx.h
@@ -42,11 +42,11 @@ namespace WebCore {
 
         void clearData(const String& type);
         void clearAllData();
-        String getData(const String& type, bool& success) const;
+        String getData(const String& type) const;
         bool setData(const String& type, const String& data);
     
         // extensions beyond IE's API
-        virtual PassRefPtr<DOMStringList> types() const;
+        virtual HashSet<String> types() const;
         virtual PassRefPtr<FileList> files() const;
     
         IntPoint dragLocation() const;
diff --git a/Source/WebCore/platform/wx/ScrollbarThemeWx.cpp b/Source/WebCore/platform/wx/ScrollbarThemeWx.cpp
index c924978a5..badf31554 100644
--- a/Source/WebCore/platform/wx/ScrollbarThemeWx.cpp
+++ b/Source/WebCore/platform/wx/ScrollbarThemeWx.cpp
@@ -71,19 +71,19 @@ int ScrollbarThemeWx::scrollbarThickness(ScrollbarControlSize size)
     return thickness;
 }
 
-bool ScrollbarThemeWx::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeWx::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     // This method is just called as a paint-time optimization to see if
     // painting the thumb can be skipped.  We don't have to be exact here.
     return thumbLength(scrollbar) > 0;
 }
 
-int ScrollbarThemeWx::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeWx::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return 20;
 }
 
-IntSize ScrollbarThemeWx::buttonSize(Scrollbar*) 
+IntSize ScrollbarThemeWx::buttonSize(ScrollbarThemeClient*) 
 {
 #ifdef __WXMAC__
     return IntSize(20,20);
@@ -92,7 +92,7 @@ IntSize ScrollbarThemeWx::buttonSize(Scrollbar*)
 #endif
 }
 
-void ScrollbarThemeWx::splitTrack(Scrollbar* scrollbar, const IntRect& unconstrainedTrackRect, IntRect& beforeThumbRect, IntRect& thumbRect, IntRect& afterThumbRect)
+void ScrollbarThemeWx::splitTrack(ScrollbarThemeClient* scrollbar, const IntRect& unconstrainedTrackRect, IntRect& beforeThumbRect, IntRect& thumbRect, IntRect& afterThumbRect)
 {
     ScrollbarThemeComposite::splitTrack(scrollbar, unconstrainedTrackRect, beforeThumbRect, thumbRect, afterThumbRect);
 #ifdef __WXMAC__
@@ -109,7 +109,7 @@ void ScrollbarThemeWx::splitTrack(Scrollbar* scrollbar, const IntRect& unconstra
 #endif
 }
 
-IntRect ScrollbarThemeWx::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeWx::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // FIXME: Handling this case is needed when there are two sets of arrow buttons
     // on Mac, one at the top and one at the bottom.
@@ -130,7 +130,7 @@ IntRect ScrollbarThemeWx::backButtonRect(Scrollbar* scrollbar, ScrollbarPart par
     return IntRect(x, y, size.width(), size.height());
 }
 
-IntRect ScrollbarThemeWx::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeWx::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // FIXME: Handling this case is needed when there are two sets of arrow buttons
     // on Mac, one at the top and one at the bottom.
@@ -155,7 +155,7 @@ IntRect ScrollbarThemeWx::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart
     return IntRect(x, y, size.width(), size.height());
 }
 
-IntRect ScrollbarThemeWx::trackRect(Scrollbar* scrollbar, bool)
+IntRect ScrollbarThemeWx::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     IntSize bs = buttonSize(scrollbar);
     int trackStart = 0;
@@ -179,11 +179,11 @@ IntRect ScrollbarThemeWx::trackRect(Scrollbar* scrollbar, bool)
     return IntRect(scrollbar->x(), scrollbar->y() + trackStart, thickness, scrollbar->height() - 2 * bs.height());
 }
 
-bool ScrollbarThemeWx::paint(Scrollbar* scrollbar, GraphicsContext* context, const IntRect& rect)
+bool ScrollbarThemeWx::paint(ScrollbarThemeClient* scrollbar, GraphicsContext* context, const IntRect& rect)
 {
     wxOrientation orientation = (scrollbar->orientation() == HorizontalScrollbar) ? wxHORIZONTAL : wxVERTICAL;
     int flags = 0;
-    if (scrollbar->scrollableArea()->isActive())
+    if (scrollbar->isScrollableAreaActive())
         flags |= wxCONTROL_FOCUSED;
     
     if (!scrollbar->enabled())
diff --git a/Source/WebCore/platform/wx/ScrollbarThemeWx.h b/Source/WebCore/platform/wx/ScrollbarThemeWx.h
index 75ab175a3..372aaf966 100644
--- a/Source/WebCore/platform/wx/ScrollbarThemeWx.h
+++ b/Source/WebCore/platform/wx/ScrollbarThemeWx.h
@@ -35,21 +35,21 @@ class ScrollbarThemeWx : public ScrollbarThemeComposite {
 public:
     virtual ~ScrollbarThemeWx();
     virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
-    virtual bool paint(Scrollbar*, GraphicsContext*, const IntRect&);
+    virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect&);
     
 protected:
-    virtual bool hasButtons(Scrollbar*) { return true; }
-    virtual bool hasThumb(Scrollbar*);
+    virtual bool hasButtons(ScrollbarThemeClient*) { return true; }
+    virtual bool hasThumb(ScrollbarThemeClient*);
 
-    virtual IntSize buttonSize(Scrollbar*);
+    virtual IntSize buttonSize(ScrollbarThemeClient*);
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
 
-    virtual void splitTrack(Scrollbar*, const IntRect& track, IntRect& startTrack, IntRect& thumb, IntRect& endTrack);
+    virtual void splitTrack(ScrollbarThemeClient*, const IntRect& track, IntRect& startTrack, IntRect& thumb, IntRect& endTrack);
     
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
 };
 
 }
diff --git a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
index 3ef203f54..c568a4b92 100644
--- a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -884,7 +884,11 @@ bool PluginView::platformStart()
         } else
             setPlatformWidget(gtk_xtbin_new(pageClient, 0));
 #else
+#if OS(WINDOWS) && !defined(GTK_API_VERSION_2)
+        setPlatformWidget(0);
+#else
         setPlatformWidget(gtk_socket_new());
+#endif
         gtk_container_add(GTK_CONTAINER(pageClient), platformPluginWidget());
 #endif
     } else {
diff --git a/Source/WebCore/plugins/npapi-sandbox.h b/Source/WebCore/plugins/npapi-sandbox.h
new file mode 100644
index 000000000..651fdad16
--- /dev/null
+++ b/Source/WebCore/plugins/npapi-sandbox.h
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*!
+ * @header WebKit Mac Sandbox
+ *
+ * This header provides an *EXPERIMENTAL* API for NPAPI plug-ins that wish
+ * to reduce their runtime privileges. When entering the sandbox, adopting
+ * plug-ins specify a whitelist of files they wish to have available for
+ * reading and writing. Plug-ins that need to have access to arbitrary files,
+ * such as to enable user-initiated file uploads or downloads, can invoke
+ * native Cocoa APIs, which will automatically grant permissions to the plug-in.
+ *
+ *
+ * Security characteristics
+ *
+ * Sandboxed plug-in's local file access is restricted to the union of:
+ *
+ * 1. The file whitelist specified by the plug-in when entering the sandbox.
+ * 2. Any files obtained at runtime through the secure Open and Save dialogs.
+ * 3. Any files that were open before entering the sandbox.
+ *
+ * Implementation may additionally choose to restrict the creation of IPC
+ * channels or the use of other security-sensitive system resources, such as
+ * the ability to spawn additional processes. However, any such resources
+ * acquired before entry into the sandbox are guaranteed to remain available
+ * within it. For example, plug-ins are free to spawn a trusted broker process
+ * before entering the sandbox and to establish an IPC channel with it. The
+ * channel will remain available within the sandbox even if the implementation
+ * is highly restrictive and allows neither process creation nor IPC channel
+ * establishment.
+ */
+
+
+#ifndef npapi_sandbox_h
+#define npapi_sandbox_h
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+ * @constant WKNVSandboxFunctions
+ * Use this constant with NPN_GetValue to get a pointer to WKNSandboxFunctions
+ * structure, which contains pointers to sandboxing functions.
+ */
+#define WKNVSandboxFunctions 74659
+
+/*!
+ * Version of WKNSandboxFunctions structure that is returned by NPN_GetValue.
+ */
+#define WKNVSandboxFunctionsVersionCurrent 1
+
+/*!
+ * @function WKN_EnterSandbox
+ * Requests that the plug-in instance be placed in a sandbox.
+ *
+ * @param readOnlyPaths
+ * NULL-terminated C array of paths to files and directories that the plug-in
+ * wishes to have available in the sandbox for read-only access. Any
+ * directories in this array will automatically extend the sandbox to encompass
+ * all their files and subdirectories, meaning that they will be available
+ * through OS level file access functions for reading.
+ *
+ * @param readWritePaths
+ * NULL-terminated C array of paths to files and directories that the plug-in
+ * wishes to have available in the sandbox for both reading and writing.
+ * Typically, this array will include paths to the plug-in's local caches, a
+ * directory for temporary files, and any configuration files which are not
+ * security sensitive, in that they are not consulted when determining the
+ * lists of paths to pass to this function during plug-in instantiation.
+ * Any directories in this array will automatically extend the sandbox to
+ * encompass all their files and subdirectories, meaning that they will be
+ * available through OS level file access functions for reading and writing.
+ *
+ * @result
+ * Places the plug-in instance in a sandbox. The sandbox allows read-only access
+ * to paths specified by `readOnlyPaths` and read-write access to
+ * `readWritePaths`. If the same path appears in both `readOnlyPaths` and
+ * `readWritePaths`, access to that path will be read-only. No other filesystem
+ * access is available except as expressly permitted by the user through
+ * NSOpenPanel and NSSavePanel invocations.  Returns NPERR_NO_ERROR when the
+ * navigator has successfully placed the plug-in in a sandbox and
+ * NPERR_GENERIC_ERROR if the the plug-in instance was already placed in a sandbox
+ * with a prior call to this function. If entering sandbox fails for any other reason,
+ * the process is terminated.
+ * Note that either or both `readOnlyPaths` and `readWritePaths` may be NULL.
+ *
+ * @discussion
+ * This function should be called as early as possible during plug-in
+ * instantiation and ALWAYS before any untrusted code has run. Generally, the
+ * only things that the plug-in should do before entering the sandbox are to
+ * determine the paths to pass in as `readOnlyPaths` and `readWritePaths`, and
+ * to establish any IPC channels to be used from the sandbox. In cases where
+ * the plug-in must parse its configuration files to determine any needed local
+ * resources (such as files to preload), it should do so and then immediately
+ * call this function. If configuration files do not influence the paths that
+ * the plug-in will pass as part of `readOnlyPaths` and `readWritePaths`, the
+ * plug-in should enter the sandbox first and only then process configuration
+ * files and deal with normal startup tasks.
+ *
+ * Very close attention must be paid to weeding out security-sensitive files
+ * from the `readWritePaths` list. If the plug-in instance reads a configuration
+ * file at startup to determine which additional files it will place in the
+ * `readWritePaths` list to this call, then that configuration file MUST NOT be
+ * in the `readWritePaths` itself. Otherwise, should the plug-in become
+ * compromised, it can trivially escape its sandbox the next time it is
+ * instantiated by writing arbitrary paths (or just "/") into this writable
+ * configuration file.
+ *
+ * Note that after a plug-in instance enters the sandbox, any native calls that
+ * it makes which refer to arbitrary paths on disk  will only work if the paths are
+ * available within the sandbox, either statically through `readOnlyPaths` and
+ * `readWritePaths`, or dynamically through Cocoa APIs.
+ * However, NPAPI calls (such as e.g. NPN_PostURL with the file parameter set to TRUE)
+ * can access files that navigator policies allow, which is usually an entirely
+ * different set for remote and for local Web pages.
+ */
+typedef NPError (*WKN_EnterSandboxProcPtr)(const char *readOnlyPaths[], const char *readWritePaths[]);
+
+/*!
+ * @function WKN_FileStopAccessing
+ * Requests that the navigator revoke the plug-in's access to the given path.
+ *
+ * @param path
+ * Required. A path that was previously returned from NSOpenPanel or NSSavePanel.
+ *
+ * @result
+ * Returns  NPERR_NO_ERROR, or NPERR_GENERIC_ERROR if the requesting plug-in
+ * instance is not in a sandbox.
+ *
+ * @discussion
+ * Whenever file access is provided to a plug-in instance through a
+ * Cocoa API, navigator should be notfied when it is no longer needed.
+ * This will cause subsequent open(2) calls on any of the revoked files to fail,
+ * but by design no attempt is made to invalidate existing file descriptors.
+ * plug-in writers are strongly encouraged to keep files open for as short a period
+ * of time as possible, and to always call this function when objects representing
+ * the returned files go out of scope or are otherwise destroyed.
+ */
+typedef NPError (*WKN_FileStopAccessingProcPtr)(const char* path);
+
+typedef struct _WKNSandboxFunctions {
+    uint16_t size;
+    uint16_t version;
+    
+    WKN_EnterSandboxProcPtr enterSandbox;
+    WKN_FileStopAccessingProcPtr fileStopAccessing;
+} WKNSandboxFunctions;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // npapi_sandbox_h
diff --git a/Source/WebCore/rendering/FilterEffectObserver.h b/Source/WebCore/rendering/FilterEffectObserver.h
index 92c60637a..7573497ce 100644
--- a/Source/WebCore/rendering/FilterEffectObserver.h
+++ b/Source/WebCore/rendering/FilterEffectObserver.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/rendering/FilterEffectRenderer.cpp b/Source/WebCore/rendering/FilterEffectRenderer.cpp
index 7d9873151..af5ecaf27 100644
--- a/Source/WebCore/rendering/FilterEffectRenderer.cpp
+++ b/Source/WebCore/rendering/FilterEffectRenderer.cpp
@@ -322,7 +322,8 @@ void FilterEffectRenderer::prepare()
     // source image sizes set. We just need to attach the graphic
     // buffer if we have not yet done so.
     if (!m_graphicsBufferAttached) {
-        setSourceImage(ImageBuffer::create(IntSize(m_sourceDrawingRegion.width(), m_sourceDrawingRegion.height()), ColorSpaceDeviceRGB, renderingMode()));
+        IntSize logicalSize(m_sourceDrawingRegion.width(), m_sourceDrawingRegion.height());
+        setSourceImage(ImageBuffer::create(logicalSize, 1, ColorSpaceDeviceRGB, renderingMode()));
         m_graphicsBufferAttached = true;
     }
     m_sourceGraphic->clearResult();
diff --git a/Source/WebCore/rendering/HitTestResult.h b/Source/WebCore/rendering/HitTestResult.h
index 90a156e5c..152278c4d 100644
--- a/Source/WebCore/rendering/HitTestResult.h
+++ b/Source/WebCore/rendering/HitTestResult.h
@@ -57,6 +57,7 @@ public:
     Node* innerNode() const { return m_innerNode.get(); }
     Node* innerNonSharedNode() const { return m_innerNonSharedNode.get(); }
     LayoutPoint point() const { return m_point; }
+    IntPoint roundedPoint() const { return roundedIntPoint(m_point); }
     LayoutPoint localPoint() const { return m_localPoint; }
     Element* URLElement() const { return m_innerURLElement.get(); }
     Scrollbar* scrollbar() const { return m_scrollbar.get(); }
diff --git a/Source/WebCore/rendering/InlineBox.cpp b/Source/WebCore/rendering/InlineBox.cpp
index 2873664b2..7eceba404 100644
--- a/Source/WebCore/rendering/InlineBox.cpp
+++ b/Source/WebCore/rendering/InlineBox.cpp
@@ -213,11 +213,6 @@ void InlineBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset, Layo
     if (!paintInfo.shouldPaintWithinRoot(renderer()) || (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection))
         return;
 
-    if (Frame* frame = renderer()->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(renderer(), paintInfo.rect);
-    }
-
     LayoutPoint childPoint = paintOffset;
     if (parent()->renderer()->style()->isFlippedBlocksWritingMode()) // Faster than calling containingBlock().
         childPoint = renderer()->containingBlock()->flipForWritingModeForChild(toRenderBox(renderer()), childPoint);
@@ -299,7 +294,23 @@ InlineBox* InlineBox::prevLeafChild() const
         leaf = parent()->prevLeafChild();
     return leaf;
 }
-    
+
+InlineBox* InlineBox::nextLeafChildIgnoringLineBreak() const
+{
+    InlineBox* leaf = nextLeafChild();
+    if (leaf && leaf->isLineBreak())
+        return 0;
+    return leaf;
+}
+
+InlineBox* InlineBox::prevLeafChildIgnoringLineBreak() const
+{
+    InlineBox* leaf = prevLeafChild();
+    if (leaf && leaf->isLineBreak())
+        return 0;
+    return leaf;
+}
+
 RenderObject::SelectionState InlineBox::selectionState()
 {
     return renderer()->selectionState();
@@ -354,14 +365,14 @@ FloatPoint InlineBox::flipForWritingMode(const FloatPoint& point)
     return root()->block()->flipForWritingMode(point);
 }
 
-void InlineBox::flipForWritingMode(IntRect& rect)
+void InlineBox::flipForWritingMode(LayoutRect& rect)
 {
     if (!renderer()->style()->isFlippedBlocksWritingMode())
         return;
     root()->block()->flipForWritingMode(rect);
 }
 
-IntPoint InlineBox::flipForWritingMode(const IntPoint& point)
+LayoutPoint InlineBox::flipForWritingMode(const LayoutPoint& point)
 {
     if (!renderer()->style()->isFlippedBlocksWritingMode())
         return point;
diff --git a/Source/WebCore/rendering/InlineBox.h b/Source/WebCore/rendering/InlineBox.h
index 326f9c9bb..196c230fd 100644
--- a/Source/WebCore/rendering/InlineBox.h
+++ b/Source/WebCore/rendering/InlineBox.h
@@ -200,7 +200,13 @@ public:
     
     InlineBox* nextLeafChild() const;
     InlineBox* prevLeafChild() const;
-        
+
+    // Helper functions for editing and hit-testing code.
+    // FIXME: These two functions should be moved to RenderedPosition once the code to convert between
+    // Position and inline box, offset pair is moved to RenderedPosition.
+    InlineBox* nextLeafChildIgnoringLineBreak() const;
+    InlineBox* prevLeafChildIgnoringLineBreak() const;
+
     RenderObject* renderer() const { return m_renderer; }
 
     InlineFlowBox* parent() const
@@ -311,8 +317,8 @@ public:
     FloatPoint locationIncludingFlipping();
     void flipForWritingMode(FloatRect&);
     FloatPoint flipForWritingMode(const FloatPoint&);
-    void flipForWritingMode(IntRect&);
-    IntPoint flipForWritingMode(const IntPoint&);
+    void flipForWritingMode(LayoutRect&);
+    LayoutPoint flipForWritingMode(const LayoutPoint&);
 
     bool knownToHaveNoOverflow() const { return m_knownToHaveNoOverflow; }
     void clearKnownToHaveNoOverflow();
@@ -358,7 +364,7 @@ public:
 protected:
     mutable bool m_determinedIfNextOnLineExists : 1;
     mutable bool m_nextOnLineExists : 1;
-    signed m_expansion : 11; // for justified text
+    signed m_expansion : 12; // for justified text
 
 #ifndef NDEBUG
 private:
diff --git a/Source/WebCore/rendering/InlineFlowBox.cpp b/Source/WebCore/rendering/InlineFlowBox.cpp
index f799a1ae1..bf84a0a03 100644
--- a/Source/WebCore/rendering/InlineFlowBox.cpp
+++ b/Source/WebCore/rendering/InlineFlowBox.cpp
@@ -56,9 +56,9 @@ InlineFlowBox::~InlineFlowBox()
 
 #endif
 
-int InlineFlowBox::getFlowSpacingLogicalWidth()
+LayoutUnit InlineFlowBox::getFlowSpacingLogicalWidth()
 {
-    int totWidth = marginBorderPaddingLogicalLeft() + marginBorderPaddingLogicalRight();
+    LayoutUnit totWidth = marginBorderPaddingLogicalLeft() + marginBorderPaddingLogicalRight();
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->isInlineFlowBox())
             totWidth += toInlineFlowBox(curr)->getFlowSpacingLogicalWidth();
@@ -397,8 +397,8 @@ float InlineFlowBox::placeBoxesInInlineDirection(float logicalLeft, bool& needsW
             } else if (!curr->renderer()->isListMarker() || toRenderListMarker(curr->renderer())->isInside()) {
                 // The box can have a different writing-mode than the overall line, so this is a bit complicated.
                 // Just get all the physical margin and overflow values by hand based off |isVertical|.
-                int logicalLeftMargin = isHorizontal() ? curr->boxModelObject()->marginLeft() : curr->boxModelObject()->marginTop();
-                int logicalRightMargin = isHorizontal() ? curr->boxModelObject()->marginRight() : curr->boxModelObject()->marginBottom();
+                LayoutUnit logicalLeftMargin = isHorizontal() ? curr->boxModelObject()->marginLeft() : curr->boxModelObject()->marginTop();
+                LayoutUnit logicalRightMargin = isHorizontal() ? curr->boxModelObject()->marginRight() : curr->boxModelObject()->marginBottom();
                 
                 logicalLeft += logicalLeftMargin;
                 curr->setLogicalLeft(logicalLeft);
@@ -700,10 +700,10 @@ void InlineFlowBox::placeBoxesInBlockDirection(LayoutUnit top, LayoutUnit maxHei
                 lineTop = pixelSnappedLogicalTop();
                 lineTopIncludingMargins = lineTop;
             } else {
-                lineTop = min(lineTop, pixelSnappedLogicalTop());
+                lineTop = min<LayoutUnit>(lineTop, pixelSnappedLogicalTop());
                 lineTopIncludingMargins = min(lineTop, lineTopIncludingMargins);
             }
-            lineBottom = max(lineBottom, pixelSnappedLogicalBottom());
+            lineBottom = max<LayoutUnit>(lineBottom, pixelSnappedLogicalBottom());
             lineBottomIncludingMargins = max(lineBottom, lineBottomIncludingMargins);
         }
         
@@ -1118,8 +1118,8 @@ void InlineFlowBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, c
         }
         LayoutUnit stripX = rect.x() - (isHorizontal() ? logicalOffsetOnLine : zeroLayoutUnit);
         LayoutUnit stripY = rect.y() - (isHorizontal() ? zeroLayoutUnit : logicalOffsetOnLine);
-        LayoutUnit stripWidth = isHorizontal() ? totalLogicalWidth : width();
-        LayoutUnit stripHeight = isHorizontal() ? height() : totalLogicalWidth;
+        LayoutUnit stripWidth = isHorizontal() ? totalLogicalWidth : static_cast<LayoutUnit>(width());
+        LayoutUnit stripHeight = isHorizontal() ? static_cast<LayoutUnit>(height()) : totalLogicalWidth;
 
         GraphicsContextStateSaver stateSaver(*paintInfo.context);
         paintInfo.context->clip(LayoutRect(rect.x(), rect.y(), width(), height()));
diff --git a/Source/WebCore/rendering/InlineFlowBox.h b/Source/WebCore/rendering/InlineFlowBox.h
index 500de7ed9..a81af717b 100644
--- a/Source/WebCore/rendering/InlineFlowBox.h
+++ b/Source/WebCore/rendering/InlineFlowBox.h
@@ -119,8 +119,8 @@ public:
     virtual RenderLineBoxList* rendererLineBoxes() const;
 
     // logicalLeft = left in a horizontal line and top in a vertical line.
-    int marginBorderPaddingLogicalLeft() const { return marginLogicalLeft() + borderLogicalLeft() + paddingLogicalLeft(); }
-    int marginBorderPaddingLogicalRight() const { return marginLogicalRight() + borderLogicalRight() + paddingLogicalRight(); }
+    LayoutUnit marginBorderPaddingLogicalLeft() const { return marginLogicalLeft() + borderLogicalLeft() + paddingLogicalLeft(); }
+    LayoutUnit marginBorderPaddingLogicalRight() const { return marginLogicalRight() + borderLogicalRight() + paddingLogicalRight(); }
     LayoutUnit marginLogicalLeft() const
     {
         if (!includeLogicalLeftEdge())
@@ -168,7 +168,7 @@ public:
 
     // Helper functions used during line construction and placement.
     void determineSpacingForFlowBoxes(bool lastLine, bool isLogicallyLastRunWrapped, RenderObject* logicallyLastRunRenderer);
-    int getFlowSpacingLogicalWidth();
+    LayoutUnit getFlowSpacingLogicalWidth();
     float placeBoxesInInlineDirection(float logicalLeft, bool& needsWordSpacing, GlyphOverflowAndFallbackFontsMap&);
     void computeLogicalBoxHeights(RootInlineBox*, LayoutUnit& maxPositionTop, LayoutUnit& maxPositionBottom,
                                   LayoutUnit& maxAscent, LayoutUnit& maxDescent, bool& setMaxAscent, bool& setMaxDescent,
@@ -207,8 +207,8 @@ public:
     { 
         return m_overflow ? m_overflow->layoutOverflowRect() : enclosingLayoutRect(frameRectIncludingLineHeight(lineTop, lineBottom));
     }
-    LayoutUnit logicalLeftLayoutOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->minXLayoutOverflow() : m_overflow->minYLayoutOverflow()) : logicalLeft(); }
-    LayoutUnit logicalRightLayoutOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->maxXLayoutOverflow() : m_overflow->maxYLayoutOverflow()) : ceilf(logicalRight()); }
+    LayoutUnit logicalLeftLayoutOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->minXLayoutOverflow() : m_overflow->minYLayoutOverflow()) : static_cast<LayoutUnit>(logicalLeft()); }
+    LayoutUnit logicalRightLayoutOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->maxXLayoutOverflow() : m_overflow->maxYLayoutOverflow()) : static_cast<LayoutUnit>(ceilf(logicalRight())); }
     LayoutUnit logicalTopLayoutOverflow(LayoutUnit lineTop) const
     {
         if (m_overflow)
@@ -233,8 +233,8 @@ public:
     { 
         return m_overflow ? m_overflow->visualOverflowRect() : enclosingLayoutRect(frameRectIncludingLineHeight(lineTop, lineBottom));
     }
-    LayoutUnit logicalLeftVisualOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->minXVisualOverflow() : m_overflow->minYVisualOverflow()) : logicalLeft(); }
-    LayoutUnit logicalRightVisualOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->maxXVisualOverflow() : m_overflow->maxYVisualOverflow()) : ceilf(logicalRight()); }
+    LayoutUnit logicalLeftVisualOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->minXVisualOverflow() : m_overflow->minYVisualOverflow()) : static_cast<LayoutUnit>(logicalLeft()); }
+    LayoutUnit logicalRightVisualOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->maxXVisualOverflow() : m_overflow->maxYVisualOverflow()) : static_cast<LayoutUnit>(ceilf(logicalRight())); }
     LayoutUnit logicalTopVisualOverflow(LayoutUnit lineTop) const
     {
         if (m_overflow)
diff --git a/Source/WebCore/rendering/InlineTextBox.cpp b/Source/WebCore/rendering/InlineTextBox.cpp
index c9e8c07cb..639d6bad6 100644
--- a/Source/WebCore/rendering/InlineTextBox.cpp
+++ b/Source/WebCore/rendering/InlineTextBox.cpp
@@ -496,11 +496,6 @@ void InlineTextBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset,
         // When only painting the selection, don't bother to paint if there is none.
         return;
 
-    if (Frame* frame = renderer()->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(renderer(), paintInfo.rect);
-    }
-
     if (m_truncation != cNoTruncation) {
         if (renderer()->containingBlock()->style()->isLeftToRightDirection() != isLeftToRightDirection()) {
             // Make the visible fragment of text hug the edge closest to the rest of the run by moving the origin
@@ -567,6 +562,17 @@ void InlineTextBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset,
             paintSelection(context, boxOrigin, styleToUse, font);
     }
 
+    if (Frame* frame = renderer()->frame()) {
+        if (Page* page = frame->page()) {
+            // FIXME: Right now, InlineTextBoxes never call addRelevantUnpaintedObject() even though they might 
+            // legitimately be unpainted if they are waiting on a slow-loading web font. We should fix that, and
+            // when we do, we will have to account for the fact the InlineTextBoxes do not always have unique
+            // renderers and Page currently relies on each unpainted object having a unique renderer.
+            if (paintInfo.phase == PaintPhaseForeground)
+                page->addRelevantRepaintedObject(renderer(), IntRect(boxOrigin.x(), boxOrigin.y(), logicalWidth(), logicalHeight()));
+        }
+    }
+
     // 2. Now paint the foreground, including text and decorations like underline/overline (in quirks mode only).
     Color textFillColor;
     Color textStrokeColor;
diff --git a/Source/WebCore/rendering/LayoutState.cpp b/Source/WebCore/rendering/LayoutState.cpp
index e89dcc5db..1fbfc0cdd 100644
--- a/Source/WebCore/rendering/LayoutState.cpp
+++ b/Source/WebCore/rendering/LayoutState.cpp
@@ -70,8 +70,7 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const LayoutSiz
         m_clipRect = prev->m_clipRect;
 
     if (renderer->hasOverflowClip()) {
-        RenderLayer* layer = renderer->layer();
-        LayoutRect clipRect(toPoint(m_paintOffset) + renderer->view()->layoutDelta(), layer->size());
+        LayoutRect clipRect(toPoint(m_paintOffset) + renderer->view()->layoutDelta(), renderer->cachedSizeForOverflowClip());
         if (m_clipped)
             m_clipRect.intersect(clipRect);
         else {
@@ -156,10 +155,9 @@ LayoutState::LayoutState(RenderObject* root)
     m_paintOffset = LayoutSize(absContentPoint.x(), absContentPoint.y());
 
     if (container->hasOverflowClip()) {
-        RenderBox* containerBox = toRenderBox(container);
-        RenderLayer* layer = containerBox->layer();
         m_clipped = true;
-        m_clipRect = LayoutRect(toPoint(m_paintOffset), layer->size());
+        RenderBox* containerBox = toRenderBox(container);
+        m_clipRect = LayoutRect(toPoint(m_paintOffset), containerBox->cachedSizeForOverflowClip());
         m_paintOffset -= containerBox->scrolledContentOffset();
     }
 }
@@ -280,7 +278,7 @@ void LayoutState::computeLineGridPaginationOrigin(RenderBox* renderer)
         if (pageLogicalTop > firstLineTopWithLeading) {
             // Shift to the next highest line grid multiple past the page logical top. Cache the delta
             // between this new value and the page logical top as the pagination origin.
-            LayoutUnit remainder = (pageLogicalTop - firstLineTopWithLeading) % gridLineHeight;
+            LayoutUnit remainder = roundToInt(pageLogicalTop - firstLineTopWithLeading) % roundToInt(gridLineHeight);
             LayoutUnit paginationDelta = gridLineHeight - remainder;
             if (isHorizontalWritingMode)
                 m_lineGridPaginationOrigin.setHeight(paginationDelta);
diff --git a/Source/WebCore/rendering/LayoutTypes.h b/Source/WebCore/rendering/LayoutTypes.h
index 72cbf2fd9..2041ee597 100644
--- a/Source/WebCore/rendering/LayoutTypes.h
+++ b/Source/WebCore/rendering/LayoutTypes.h
@@ -38,6 +38,7 @@
 
 #include "FloatRect.h"
 #include "IntRect.h"
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
@@ -58,11 +59,27 @@ inline IntRect pixelSnappedIntRect(const LayoutRect& rect)
     return rect;
 }
 
+inline IntRect pixelSnappedIntRect(LayoutUnit left, LayoutUnit top, LayoutUnit width, LayoutUnit height)
+{
+    return IntRect(left, top, width, height);
+}
+
+inline IntRect pixelSnappedIntRect(const LayoutPoint& location, const LayoutSize& size)
+{
+    return IntRect(location, size);
+}
+
 inline IntRect pixelSnappedIntRectFromEdges(LayoutUnit left, LayoutUnit top, LayoutUnit right, LayoutUnit bottom)
 {
     return IntRect(left, top, right - left, bottom - top);
 }
 
+inline int snapSizeToPixel(LayoutUnit size, LayoutUnit location) 
+{
+    UNUSED_PARAM(location);
+    return size;
+}
+
 inline IntSize roundedIntSize(const LayoutSize& s)
 {
     return s;
@@ -98,6 +115,11 @@ inline LayoutSize flooredLayoutSize(const FloatPoint& p)
     return LayoutSize(static_cast<int>(p.x()), static_cast<int>(p.y()));
 }
 
+inline int roundToInt(LayoutUnit value)
+{
+    return value;
+}
+
 inline LayoutUnit roundedLayoutUnit(float value)
 {
     return lroundf(value);
@@ -123,6 +145,11 @@ inline LayoutUnit layoutMod(const LayoutUnit& numerator, const LayoutUnit& denom
     return numerator % denominator;
 }
 
+inline LayoutUnit clampToLayoutUnit(double value)
+{
+    return clampToInteger(value);
+}
+
 } // namespace WebCore
 
 #endif // LayoutTypes_h
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 413c60ece..d87d77226 100755
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -38,6 +38,7 @@
 #include "InlineIterator.h"
 #include "InlineTextBox.h"
 #include "LayoutRepainter.h"
+#include "OverflowEvent.h"
 #include "PODFreeListArena.h"
 #include "Page.h"
 #include "PaintInfo.h"
@@ -83,8 +84,60 @@ typedef WTF::HashSet<RenderBlock*> DelayedUpdateScrollInfoSet;
 static int gDelayUpdateScrollInfo = 0;
 static DelayedUpdateScrollInfoSet* gDelayedUpdateScrollInfoSet = 0;
 
+// We only create "generated" renderers like one for first-letter and
+// before/after pseudo elements if:
+// - the firstLetterBlock can have children in the DOM and
+// - the block doesn't have any special assumption on its text children.
+// This correctly prevents form controls from having such renderers.
+static inline bool canHaveGeneratedChildren(RenderObject* renderer)
+{
+    return (renderer->canHaveChildren()
+            && (!renderer->isDeprecatedFlexibleBox()
+                || static_cast<RenderDeprecatedFlexibleBox*>(renderer)->canHaveGeneratedChildren()));
+}
+
 bool RenderBlock::s_canPropagateFloatIntoSibling = false;
 
+// This class helps dispatching the 'overflow' event on layout change. overflow can be set on RenderBoxes, yet the existing code
+// only works on RenderBlocks. If this change, this class should be shared with other RenderBoxes.
+class OverflowEventDispatcher {
+    WTF_MAKE_NONCOPYABLE(OverflowEventDispatcher);
+public:
+    OverflowEventDispatcher(const RenderBlock* block)
+        : m_block(block)
+        , m_hadHorizontalLayoutOverflow(false)
+        , m_hadVerticalLayoutOverflow(false)
+    {
+        m_shouldDispatchEvent = !m_block->isAnonymous() && m_block->hasOverflowClip() && m_block->document()->hasListenerType(Document::OVERFLOWCHANGED_LISTENER);
+        if (m_shouldDispatchEvent) {
+            m_hadHorizontalLayoutOverflow = m_block->hasHorizontalLayoutOverflow();
+            m_hadVerticalLayoutOverflow = m_block->hasVerticalLayoutOverflow();
+        }
+    }
+
+    ~OverflowEventDispatcher()
+    {
+        if (!m_shouldDispatchEvent)
+            return;
+
+        bool hasHorizontalLayoutOverflow = m_block->hasHorizontalLayoutOverflow();
+        bool hasVerticalLayoutOverflow = m_block->hasVerticalLayoutOverflow();
+
+        bool horizontalLayoutOverflowChanged = hasHorizontalLayoutOverflow != m_hadHorizontalLayoutOverflow;
+        bool verticalLayoutOverflowChanged = hasVerticalLayoutOverflow != m_hadVerticalLayoutOverflow;
+        if (horizontalLayoutOverflowChanged || verticalLayoutOverflowChanged) {
+            if (FrameView* frameView = m_block->document()->view())
+                frameView->scheduleEvent(OverflowEvent::create(horizontalLayoutOverflowChanged, hasHorizontalLayoutOverflow, verticalLayoutOverflowChanged, hasVerticalLayoutOverflow), m_block->node());
+        }
+    }
+
+private:
+    const RenderBlock* m_block;
+    bool m_shouldDispatchEvent;
+    bool m_hadHorizontalLayoutOverflow;
+    bool m_hadVerticalLayoutOverflow;
+};
+
 // Our MarginInfo state used when laying out block children.
 RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, LayoutUnit beforeBorderPadding, LayoutUnit afterBorderPadding)
     : m_atBeforeSideOfBlock(true)
@@ -125,6 +178,7 @@ RenderBlock::RenderBlock(Node* node)
       , m_lineHeight(-1)
       , m_beingDestroyed(false)
       , m_hasPositionedFloats(false)
+      , m_hasMarkupTruncation(false)
 {
     setChildrenInline(true);
 }
@@ -261,7 +315,7 @@ void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
     m_lineHeight = -1;
 
     // Update pseudos for :before and :after now.
-    if (!isAnonymous() && document()->usesBeforeAfterRules() && canHaveChildren()) {
+    if (!isAnonymous() && document()->usesBeforeAfterRules() && canHaveGeneratedChildren(this)) {
         updateBeforeAfterContent(BEFORE);
         updateBeforeAfterContent(AFTER);
     }
@@ -380,8 +434,17 @@ void RenderBlock::addChildToAnonymousColumnBlocks(RenderObject* newChild, Render
     ASSERT(!continuation()); // We don't yet support column spans that aren't immediate children of the multi-column block.
         
     // The goal is to locate a suitable box in which to place our child.
-    RenderBlock* beforeChildParent = toRenderBlock(beforeChild && beforeChild->parent()->isRenderBlock() ? beforeChild->parent() : lastChild());
-    
+    RenderBlock* beforeChildParent = 0;
+    if (beforeChild) {
+        RenderObject* curr = beforeChild;
+        while (curr && curr->parent() != this)
+            curr = curr->parent();
+        beforeChildParent = toRenderBlock(curr);
+        ASSERT(beforeChildParent);
+        ASSERT(beforeChildParent->isAnonymousColumnsBlock() || beforeChildParent->isAnonymousColumnSpanBlock());
+    } else
+        beforeChildParent = toRenderBlock(lastChild());
+
     // If the new child is floating or positioned it can just go in that block.
     if (newChild->isFloatingOrPositioned()) {
         beforeChildParent->addChildIgnoringAnonymousColumnBlocks(newChild, beforeChild);
@@ -491,6 +554,14 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
     if (beforeChild && childrenInline())
         deleteLineBoxTree();
 
+    // We have to remove the descendant child from our positioned objects list
+    // before we do the split and move some of the children to cloneBlock. Since
+    // we are doing layout anyway, it is easier to blow away the entire list, than
+    // traversing down the subtree looking for positioned childs and then remove them
+    // from our positioned objects list.
+    if (beforeChild)
+        removePositionedObjects(0);
+
     // Now take all of the children from beforeChild to the end and remove
     // them from |this| and place them in the clone.
     moveChildrenTo(cloneBlock, beforeChild, 0, true);
@@ -504,6 +575,7 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
     // Once we hit the anonymous columns block we're done.
     RenderBoxModelObject* curr = toRenderBoxModelObject(parent());
     RenderBoxModelObject* currChild = this;
+    RenderObject* currChildNextSibling = currChild->nextSibling();
     
     while (curr && curr != fromBlock) {
         ASSERT(curr->isRenderBlock());
@@ -530,15 +602,20 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
         // Someone may have indirectly caused a <q> to split.  When this happens, the :after content
         // has to move into the inline continuation.  Call updateBeforeAfterContent to ensure that the inline's :after
         // content gets properly destroyed.
+        bool isLastChild = (currChildNextSibling == blockCurr->lastChild());
         if (document()->usesBeforeAfterRules())
             blockCurr->children()->updateBeforeAfterContent(blockCurr, AFTER);
+        if (isLastChild && currChildNextSibling != blockCurr->lastChild())
+            currChildNextSibling = 0; // We destroyed the last child, so now we need to update
+                                      // the value of currChildNextSibling.
 
         // Now we need to take all of the children starting from the first child
         // *after* currChild and append them all to the clone.
-        blockCurr->moveChildrenTo(cloneBlock, currChild->nextSibling(), 0, true);
+        blockCurr->moveChildrenTo(cloneBlock, currChildNextSibling, 0, true);
 
         // Keep walking up the chain.
         currChild = curr;
+        currChildNextSibling = currChild->nextSibling();
         curr = toRenderBoxModelObject(curr->parent());
     }
 
@@ -547,7 +624,7 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
 
     // Now take all the children after currChild and remove them from the fromBlock
     // and put them in the toBlock.
-    fromBlock->moveChildrenTo(toBlock, currChild->nextSibling(), 0, true);
+    fromBlock->moveChildrenTo(toBlock, currChildNextSibling, 0, true);
 }
 
 void RenderBlock::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
@@ -835,7 +912,11 @@ void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild,
             // We are nested inside a multi-column element and are being split by the span.  We have to break up
             // our block into continuations.
             RenderBoxModelObject* oldContinuation = continuation();
-            setContinuation(newBox);
+
+            // When we split an anonymous block, there's no need to do any continuation hookup,
+            // since we haven't actually split a real element.
+            if (!isAnonymousBlock())
+                setContinuation(newBox);
 
             // Someone may have put a <p> inside a <q>, causing a split.  When this happens, the :after content
             // has to move into the inline continuation.  Call updateBeforeAfterContent to ensure that our :after
@@ -1201,8 +1282,8 @@ void RenderBlock::removeChild(RenderObject* oldChild)
         // are floating, then we need to pull the content up also.
         RenderBlock* anonBlock = toRenderBlock((prev && prev->isAnonymousBlock()) ? prev : next);
         if ((anonBlock->previousSibling() || anonBlock->nextSibling())
-            && (!anonBlock->previousSibling() || (anonBlock->previousSibling()->style()->styleType() != NOPSEUDO && anonBlock->previousSibling()->isFloating()))
-            && (!anonBlock->nextSibling() || (anonBlock->nextSibling()->style()->styleType() != NOPSEUDO && anonBlock->nextSibling()->isFloating()))) {
+            && (!anonBlock->previousSibling() || (anonBlock->previousSibling()->style()->styleType() != NOPSEUDO && anonBlock->previousSibling()->isFloating() && !anonBlock->previousSibling()->previousSibling()))
+            && (!anonBlock->nextSibling() || (anonBlock->nextSibling()->style()->styleType() != NOPSEUDO && anonBlock->nextSibling()->isFloating() && !anonBlock->nextSibling()->nextSibling()))) {
             collapseAnonymousBoxChild(this, anonBlock);
         }
     }
@@ -1290,16 +1371,24 @@ void RenderBlock::finishDelayUpdateScrollInfo()
 
 void RenderBlock::updateScrollInfoAfterLayout()
 {
-    if (hasOverflowClip()) {
-        if (gDelayUpdateScrollInfo)
-            gDelayedUpdateScrollInfoSet->add(this);
-        else
-            layer()->updateScrollInfoAfterLayout();
+    if (!hasOverflowClip())
+        return;
+
+    if (!hasLayer()) {
+        updateCachedSizeForOverflowClip();
+        return;
     }
+
+    if (gDelayUpdateScrollInfo)
+        gDelayedUpdateScrollInfoSet->add(this);
+    else
+        layer()->updateScrollInfoAfterLayout();
 }
 
 void RenderBlock::layout()
 {
+    OverflowEventDispatcher dispatcher(this);
+
     // Update our first letter info now.
     updateFirstLetter();
 
@@ -1522,7 +1611,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeigh
 
         repaintRect.inflate(maximalOutlineSize(PaintPhaseOutline));
         
-        if (hasOverflowClip()) {
+        if (hasOverflowClipWithLayer()) {
             // Adjust repaint rect for scroll offset
             repaintRect.move(-scrolledContentOffset());
 
@@ -1631,8 +1720,12 @@ void RenderBlock::addOverflowFromPositionedObjects()
         positionedObject = *it;
         
         // Fixed positioned elements don't contribute to layout overflow, since they don't scroll with the content.
-        if (positionedObject->style()->position() != FixedPosition)
-            addOverflowFromChild(positionedObject);
+        if (positionedObject->style()->position() != FixedPosition) {
+            int x = positionedObject->x();
+            if (style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+                x -= verticalScrollbarWidth();
+            addOverflowFromChild(positionedObject, IntSize(x, positionedObject->y()));
+        }
     }
 }
 
@@ -1742,6 +1835,10 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
         return false;
     // FIXME: We don't handle non-block elements with run-in for now.
     if (!child->isRenderBlock())
+        return false;  
+    // Run-in child shouldn't intrude into the sibling block if it is part of a
+    // continuation chain. In that case, treat it as a normal block.
+    if (child->isElementContinuation() || child->virtualContinuation())
         return false;
 
     RenderBlock* blockRunIn = toRenderBlock(child);
@@ -2024,6 +2121,8 @@ LayoutUnit RenderBlock::computeStartPositionDeltaForChildAvoidingFloats(const Re
 void RenderBlock::determineLogicalLeftPositionForChild(RenderBox* child)
 {
     LayoutUnit startPosition = borderStart() + paddingStart();
+    if (style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+        startPosition -= verticalScrollbarWidth();
     LayoutUnit totalAvailableLogicalWidth = borderAndPaddingLogicalWidth() + availableLogicalWidth();
 
     // Add in our start margin.
@@ -2352,7 +2451,7 @@ bool RenderBlock::simplifiedLayout()
     if ((!posChildNeedsLayout() && !needsSimplifiedNormalFlowLayout()) || normalChildNeedsLayout() || selfNeedsLayout())
         return false;
 
-    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasColumns() || hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
+    LayoutStateMaintainer statePusher(view(), this, locationOffset(), hasColumns() || hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
     
     if (needsPositionedMovementLayout() && !tryLayoutDoingPositionedMovementOnly())
         return false;
@@ -2545,7 +2644,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
     // Our scrollbar widgets paint exactly when we tell them to, so that they work properly with
     // z-index.  We paint after we painted the background/border, so that the scrollbars will
     // sit above the background/border.
-    if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground) && paintInfo.shouldPaintWithinRoot(this))
+    if (hasOverflowClipWithLayer() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground) && paintInfo.shouldPaintWithinRoot(this))
         layer()->paintOverflowControls(paintInfo.context, roundedIntPoint(adjustedPaintOffset), paintInfo.rect);
 }
 
@@ -3841,6 +3940,36 @@ LayoutUnit RenderBlock::logicalLeftOffsetForLine(LayoutUnit logicalTop, LayoutUn
     if (applyTextIndent && style()->isLeftToRightDirection())
         left += textIndentOffset();
 
+    if (style()->lineAlign() == LineAlignNone)
+        return left;
+    
+    // Push in our left offset so that it is aligned with the character grid.
+    LayoutState* layoutState = view()->layoutState();
+    if (!layoutState)
+        return left;
+
+    RenderBlock* lineGrid = layoutState->lineGrid();
+    if (!lineGrid || lineGrid->style()->writingMode() != style()->writingMode())
+        return left;
+
+    // FIXME: Should letter-spacing apply? This is complicated since it doesn't apply at the edge?
+    float maxCharWidth = lineGrid->style()->font().primaryFont()->maxCharWidth();
+    if (!maxCharWidth)
+        return left;
+
+    LayoutUnit lineGridOffset = lineGrid->isHorizontalWritingMode() ? layoutState->lineGridOffset().width(): layoutState->lineGridOffset().height();
+    LayoutUnit layoutOffset = lineGrid->isHorizontalWritingMode() ? layoutState->layoutOffset().width() : layoutState->layoutOffset().height();
+    
+    // Push in to the nearest character width (truncated so that we pixel snap left).
+    // FIXME: Should be patched when subpixel layout lands, since this calculation doesn't have to pixel snap
+    // any more (https://bugs.webkit.org/show_bug.cgi?id=79946).
+    // FIXME: This is wrong for RTL (https://bugs.webkit.org/show_bug.cgi?id=79945).
+    // FIXME: This doesn't work with columns or regions (https://bugs.webkit.org/show_bug.cgi?id=79942).
+    // FIXME: This doesn't work when the inline position of the object isn't set ahead of time.
+    // FIXME: Dynamic changes to the font or to the inline position need to result in a deep relayout.
+    // (https://bugs.webkit.org/show_bug.cgi?id=79944)
+    float remainder = fmodf(maxCharWidth - fmodf(left + layoutOffset - lineGridOffset, maxCharWidth), maxCharWidth);
+    left += remainder;
     return left;
 }
 
@@ -3860,6 +3989,36 @@ LayoutUnit RenderBlock::logicalRightOffsetForLine(LayoutUnit logicalTop, LayoutU
     if (applyTextIndent && !style()->isLeftToRightDirection())
         right -= textIndentOffset();
     
+    if (style()->lineAlign() == LineAlignNone)
+        return right;
+    
+    // Push in our right offset so that it is aligned with the character grid.
+    LayoutState* layoutState = view()->layoutState();
+    if (!layoutState)
+        return right;
+
+    RenderBlock* lineGrid = layoutState->lineGrid();
+    if (!lineGrid || lineGrid->style()->writingMode() != style()->writingMode())
+        return right;
+
+    // FIXME: Should letter-spacing apply? This is complicated since it doesn't apply at the edge?
+    float maxCharWidth = lineGrid->style()->font().primaryFont()->maxCharWidth();
+    if (!maxCharWidth)
+        return right;
+
+    LayoutUnit lineGridOffset = lineGrid->isHorizontalWritingMode() ? layoutState->lineGridOffset().width(): layoutState->lineGridOffset().height();
+    LayoutUnit layoutOffset = lineGrid->isHorizontalWritingMode() ? layoutState->layoutOffset().width() : layoutState->layoutOffset().height();
+    
+    // Push in to the nearest character width (truncated so that we pixel snap right).
+    // FIXME: Should be patched when subpixel layout lands, since this calculation doesn't have to pixel snap
+    // any more (https://bugs.webkit.org/show_bug.cgi?id=79946).
+    // FIXME: This is wrong for RTL (https://bugs.webkit.org/show_bug.cgi?id=79945).
+    // FIXME: This doesn't work with columns or regions (https://bugs.webkit.org/show_bug.cgi?id=79942).
+    // FIXME: This doesn't work when the inline position of the object isn't set ahead of time.
+    // FIXME: Dynamic changes to the font or to the inline position need to result in a deep relayout.
+    // (https://bugs.webkit.org/show_bug.cgi?id=79944)
+    float remainder = fmodf(fmodf(right + layoutOffset - lineGridOffset, maxCharWidth), maxCharWidth);
+    right -= ceilf(remainder);
     return right;
 }
 
@@ -4315,7 +4474,7 @@ LayoutUnit RenderBlock::getClearDelta(RenderBox* child, LayoutUnit logicalTop)
 
 bool RenderBlock::isPointInOverflowControl(HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset)
 {
-    if (!scrollsOverflow())
+    if (!scrollsOverflow() || !hasLayer())
         return false;
 
     return layer()->hitTestOverflowControls(result, pointInContainer - toLayoutSize(accumulatedOffset));
@@ -4619,12 +4778,17 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const LayoutPoin
     if (closestBox) {
         if (moveCaretToBoundary && pointInLogicalContents.y() < firstRootBoxWithChildren->selectionTop()
             && pointInLogicalContents.y() < firstRootBoxWithChildren->logicalTop()) {
+            InlineBox* box = firstRootBoxWithChildren->firstLeafChild();
+            if (box->isLineBreak()) {
+                if (InlineBox* newBox = box->nextLeafChildIgnoringLineBreak())
+                    box = newBox;
+            }
             // y coordinate is above first root line box, so return the start of the first
-            return VisiblePosition(positionForBox(firstRootBoxWithChildren->firstLeafChild(), true), DOWNSTREAM);
+            return VisiblePosition(positionForBox(box, true), DOWNSTREAM);
         }
 
         // pass the box a top position that is inside it
-        LayoutPoint point(pointInLogicalContents.x(), closestBox->logicalTop());
+        LayoutPoint point(pointInLogicalContents.x(), max(closestBox->root()->lineTop(), closestBox->root()->selectionTop()));
         if (!isHorizontalWritingMode())
             point = point.transposedPoint();
         if (closestBox->renderer()->isReplaced())
@@ -5810,23 +5974,12 @@ static inline bool shouldSkipForFirstLetter(UChar c)
     return isSpaceOrNewline(c) || c == noBreakSpace || isPunctuationForFirstLetter(c);
 }
 
-// We only honor first-letter if 
-// - the firstLetterBlock can have children in the DOM and
-// - the block doesn't have any special assumption on its text children.
-// This correctly prevents form controls from honoring first-letter.
-static inline bool isSafeToCreateFirstLetterRendererOn(RenderObject* renderer)
-{
-    return (renderer->canHaveChildren()
-            && !(renderer->isDeprecatedFlexibleBox()
-                 && static_cast<RenderDeprecatedFlexibleBox*>(renderer)->buttonText()));
-}
-
 static inline RenderObject* findFirstLetterBlock(RenderBlock* start)
 {
     RenderObject* firstLetterBlock = start;
     while (true) {
         bool canHaveFirstLetterRenderer = firstLetterBlock->style()->hasPseudoStyle(FIRST_LETTER)
-            && isSafeToCreateFirstLetterRendererOn(firstLetterBlock);
+            && canHaveGeneratedChildren(firstLetterBlock);
         if (canHaveFirstLetterRenderer)
             return firstLetterBlock;
 
@@ -5839,7 +5992,7 @@ static inline RenderObject* findFirstLetterBlock(RenderBlock* start)
 
     return 0;
 }
-   
+
 void RenderBlock::updateFirstLetter()
 {
     if (!document()->usesFirstLetterRules())
@@ -5869,7 +6022,7 @@ void RenderBlock::updateFirstLetter()
             currChild = currChild->nextSibling();
         } else if (currChild->isReplaced() || currChild->isRenderButton() || currChild->isMenuList())
             break;
-        else if (currChild->style()->hasPseudoStyle(FIRST_LETTER) && currChild->canHaveChildren())  {
+        else if (currChild->style()->hasPseudoStyle(FIRST_LETTER) && canHaveGeneratedChildren(currChild))  {
             // We found a lower-level node with first-letter, which supersedes the higher-level style
             firstLetterBlock = currChild;
             currChild = currChild->firstChild();
@@ -6222,7 +6375,7 @@ void RenderBlock::setPageLogicalOffset(int logicalOffset)
     m_rareData->m_pageLogicalOffset = logicalOffset;
 }
 
-void RenderBlock::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
+void RenderBlock::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
     // For blocks inside inlines, we go ahead and include margins so that we run right up to the
     // inline boxes above and below us (thus getting merged with them to form a single irregular
@@ -6230,12 +6383,12 @@ void RenderBlock::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& ac
     if (isAnonymousBlockContinuation()) {
         // FIXME: This is wrong for block-flows that are horizontal.
         // https://bugs.webkit.org/show_bug.cgi?id=46781
-        rects.append(LayoutRect(accumulatedOffset.x(), accumulatedOffset.y() - collapsedMarginBefore(),
+        rects.append(pixelSnappedIntRect(accumulatedOffset.x(), accumulatedOffset.y() - collapsedMarginBefore(),
                                 width(), height() + collapsedMarginBefore() + collapsedMarginAfter()));
         continuation()->absoluteRects(rects, accumulatedOffset - toLayoutSize(location() +
                 inlineElementContinuation()->containingBlock()->location()));
     } else
-        rects.append(LayoutRect(accumulatedOffset, size()));
+        rects.append(pixelSnappedIntRect(accumulatedOffset, size()));
 }
 
 void RenderBlock::absoluteQuads(Vector<FloatQuad>& quads, bool* wasFixed) const
@@ -6393,7 +6546,7 @@ LayoutRect RenderBlock::localCaretRect(InlineBox* inlineBox, int caretOffset, La
     return LayoutRect(x, y, caretWidth, height);
 }
 
-void RenderBlock::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint& additionalOffset)
+void RenderBlock::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint& additionalOffset)
 {
     // For blocks inside inlines, we go ahead and include margins so that we run right up to the
     // inline boxes above and below us (thus getting merged with them to form a single irregular
@@ -6409,17 +6562,17 @@ void RenderBlock::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint
         float bottomMargin = nextInlineHasLineBox ? collapsedMarginAfter() : static_cast<LayoutUnit>(0);
         LayoutRect rect(additionalOffset.x(), additionalOffset.y() - topMargin, width(), height() + topMargin + bottomMargin);
         if (!rect.isEmpty())
-            rects.append(rect);
+            rects.append(pixelSnappedIntRect(rect));
     } else if (width() && height())
-        rects.append(LayoutRect(additionalOffset, size()));
+        rects.append(pixelSnappedIntRect(additionalOffset, size()));
 
     if (!hasOverflowClip() && !hasControlClip()) {
         for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
-            LayoutUnit top = max(curr->lineTop(), static_cast<LayoutUnit>(curr->top()));
-            LayoutUnit bottom = min(curr->lineBottom(), static_cast<LayoutUnit>(curr->top() + curr->height()));
+            LayoutUnit top = max<LayoutUnit>(curr->lineTop(), curr->top());
+            LayoutUnit bottom = min<LayoutUnit>(curr->lineBottom(), curr->top() + curr->height());
             LayoutRect rect(additionalOffset.x() + curr->x(), additionalOffset.y() + top, curr->width(), bottom - top);
             if (!rect.isEmpty())
-                rects.append(rect);
+                rects.append(pixelSnappedIntRect(rect));
         }
 
         for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
@@ -6582,7 +6735,7 @@ LayoutUnit RenderBlock::pageLogicalTopForOffset(LayoutUnit offset) const
         LayoutUnit pageLogicalHeight = renderView->layoutState()->pageLogicalHeight();
         if (!pageLogicalHeight)
             return 0;
-        return cumulativeOffset - (cumulativeOffset - firstPageLogicalTop) % pageLogicalHeight;
+        return cumulativeOffset - roundToInt(cumulativeOffset - firstPageLogicalTop) % roundToInt(pageLogicalHeight);
     }
     return enclosingRenderFlowThread()->regionLogicalTopForLine(cumulativeOffset);
 }
@@ -7203,7 +7356,7 @@ TextRun RenderBlock::constructTextRun(RenderObject* context, const Font& font, c
         if (flags & RespectDirection)
             textDirection = style->direction();
         if (flags & RespectDirectionOverride)
-            directionalOverride |= style->unicodeBidi() == Override;
+            directionalOverride |= isOverride(style->unicodeBidi());
     }
 
     TextRun run(characters, length, false, 0, 0, expansion, textDirection, directionalOverride);
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 8996da5ef..cf2317348 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -113,6 +113,9 @@ public:
     static bool hasPercentHeightDescendant(RenderBox*);
 #endif
 
+    void setHasMarkupTruncation(bool b) { m_hasMarkupTruncation = b; }
+    bool hasMarkupTruncation() const { return m_hasMarkupTruncation; }
+
     RootInlineBox* createAndAppendRootInlineBox();
 
     bool generatesLineBoxesForInlineChild(RenderObject*);
@@ -182,7 +185,7 @@ public:
 
     int pixelSnappedLogicalLeftOffsetForLine(LayoutUnit position, bool firstLine) const
     {
-        return logicalLeftOffsetForLine(position, logicalLeftOffsetForContent(position), firstLine, 0);
+        return roundToInt(logicalLeftOffsetForLine(position, logicalLeftOffsetForContent(position), firstLine, 0));
     }
     
     LayoutUnit startAlignedOffsetForLine(RenderBox* child, LayoutUnit position, bool firstLine);
@@ -378,6 +381,8 @@ public:
 protected:
     virtual void willBeDestroyed();
 
+    void updateScrollInfoAfterLayout();
+
     // These functions are only used internally to manipulate the render tree structure via remove/insert/appendChildNode.
     // Since they are typically called only to move objects around within anonymous blocks (which only have layers in
     // the case of column spans), the default for fullRemoveInsert is false rather than true.
@@ -467,7 +472,7 @@ protected:
     void addOverflowFromInlineChildren();
     void addVisualOverflowFromTheme();
 
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
 #if ENABLE(SVG)
     // Only used by RenderSVGText, which explicitely overrides RenderBlock::layoutBlock(), do NOT use for anything else.
@@ -527,7 +532,7 @@ private:
     struct FloatWithRect {
         FloatWithRect(RenderBox* f)
             : object(f)
-            , rect(LayoutRect(f->x() - f->marginLeft(), f->y() - f->marginTop(), f->width() + f->marginLeft() + f->marginRight(), f->height() + f->marginTop() + f->marginBottom()))
+            , rect(LayoutRect(f->x() - f->marginLeft(), f->y() - f->marginTop(), f->width() + f->marginWidth(), f->height() + f->marginHeight()))
             , everHadLayout(f->everHadLayout())
         {
         }
@@ -634,11 +639,11 @@ private:
     LayoutUnit logicalRightForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->maxX() : child->maxY(); }
     LayoutUnit logicalWidthForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->width() : child->height(); }
 
-    // FIXME: The implementation for these functions will change once we move to subpixel layout. See bug 60318.
-    int pixelSnappedLogicalTopForFloat(const FloatingObject* child) const { return logicalTopForFloat(child); }
-    int pixelSnappedLogicalBottomForFloat(const FloatingObject* child) const { return logicalBottomForFloat(child); }
-    int pixelSnappedLogicalLeftForFloat(const FloatingObject* child) const { return logicalLeftForFloat(child); }
-    int pixelSnappedLogicalRightForFloat(const FloatingObject* child) const { return logicalRightForFloat(child); }
+    int pixelSnappedLogicalTopForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedY() : child->pixelSnappedX(); }
+    int pixelSnappedLogicalBottomForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedMaxY() : child->pixelSnappedMaxX(); }
+    int pixelSnappedLogicalLeftForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedX() : child->pixelSnappedY(); }
+    int pixelSnappedLogicalRightForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedMaxX() : child->pixelSnappedMaxY(); }
+    int pixelSnappedLogicalWidthForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedWidth() : child->pixelSnappedHeight(); }
 
     void setLogicalTopForFloat(FloatingObject* child, LayoutUnit logicalTop)
     {
@@ -810,7 +815,7 @@ private:
     LayoutUnit logicalLeftSelectionOffset(RenderBlock* rootBlock, LayoutUnit position);
     LayoutUnit logicalRightSelectionOffset(RenderBlock* rootBlock, LayoutUnit position);
     
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
 
     LayoutUnit desiredColumnWidth() const;
@@ -839,8 +844,6 @@ private:
 
     bool expandsToEncloseOverhangingFloats() const;
 
-    void updateScrollInfoAfterLayout();
-
     RenderObject* splitAnonymousBlocksAroundChild(RenderObject* beforeChild);
     RenderObject* splitTablePartsAroundChild(RenderObject* beforeChild);
     void splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock, RenderBlock* middleBlock,
@@ -1119,9 +1122,10 @@ protected:
     RenderObjectChildList m_children;
     RenderLineBoxList m_lineBoxes;   // All of the root line boxes created for this block flow.  For example, <div>Hello<br>world.</div> will have two total lines for the <div>.
 
-    mutable signed m_lineHeight : 30;
+    mutable signed m_lineHeight : 29;
     bool m_beingDestroyed : 1;
     bool m_hasPositionedFloats : 1;
+    bool m_hasMarkupTruncation : 1;
 
     // RenderRubyBase objects need to be able to split and merge, moving their children around
     // (calling moveChildTo, moveAllChildrenTo, and makeChildrenNonInline).
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index 47b632464..e98db5c79 100755
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -114,9 +114,9 @@ private:
 
 inline void LineWidth::updateAvailableWidth()
 {
-    int height = m_block->logicalHeight();
-    m_left = m_block->logicalLeftOffsetForLine(height, m_isFirstLine);
-    m_right = m_block->logicalRightOffsetForLine(height, m_isFirstLine);
+    LayoutUnit height = m_block->logicalHeight();
+    m_left = m_block->pixelSnappedLogicalLeftOffsetForLine(height, m_isFirstLine);
+    m_right = m_block->pixelSnappedLogicalRightOffsetForLine(height, m_isFirstLine);
 
     computeAvailableWidthFromLeftAndRight();
 }
@@ -759,8 +759,8 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
                                                          GlyphOverflowAndFallbackFontsMap& textBoxDataMap, VerticalPositionCache& verticalPositionCache)
 {
     ETextAlign textAlign = textAlignmentForLine(!reachedEnd && !lineBox->endsWithBreak());
-    float logicalLeft = logicalLeftOffsetForLine(logicalHeight(), lineInfo.isFirstLine());
-    float availableLogicalWidth = logicalRightOffsetForLine(logicalHeight(), lineInfo.isFirstLine()) - logicalLeft;
+    float logicalLeft = pixelSnappedLogicalLeftOffsetForLine(logicalHeight(), lineInfo.isFirstLine());
+    float availableLogicalWidth = pixelSnappedLogicalRightOffsetForLine(logicalHeight(), lineInfo.isFirstLine()) - logicalLeft;
 
     bool needsWordSpacing = false;
     float totalLogicalWidth = lineBox->getFlowSpacingLogicalWidth();
@@ -943,10 +943,10 @@ void RenderBlock::appendFloatingObjectToLastLine(FloatingObject* floatingObject)
 }
 
 // FIXME: This should be a BidiStatus constructor or create method.
-static inline BidiStatus statusWithDirection(TextDirection textDirection)
+static inline BidiStatus statusWithDirection(TextDirection textDirection, bool isOverride)
 {
     WTF::Unicode::Direction direction = textDirection == LTR ? LeftToRight : RightToLeft;
-    RefPtr<BidiContext> context = BidiContext::create(textDirection == LTR ? 0 : 1, direction, false, FromStyleOrDOM);
+    RefPtr<BidiContext> context = BidiContext::create(textDirection == LTR ? 0 : 1, direction, isOverride, FromStyleOrDOM);
 
     // This copies BidiStatus and may churn the ref on BidiContext. I doubt it matters.
     return BidiStatus(direction, direction, direction, context.release());
@@ -980,10 +980,10 @@ static inline void constructBidiRuns(InlineBidiResolver& topResolver, BidiRunLis
         if (unicodeBidi == Plaintext)
             determineDirectionality(direction, InlineIterator(isolatedInline, isolatedRun->object(), 0));
         else {
-            ASSERT(unicodeBidi == Isolate);
+            ASSERT(unicodeBidi == Isolate || unicodeBidi == OverrideIsolate);
             direction = isolatedInline->style()->direction();
         }
-        isolatedResolver.setStatus(statusWithDirection(direction));
+        isolatedResolver.setStatus(statusWithDirection(direction, isOverride(unicodeBidi)));
 
         // FIXME: The fact that we have to construct an Iterator here
         // currently prevents this code from moving into BidiResolver.
@@ -1272,7 +1272,7 @@ void RenderBlock::layoutRunsAndFloatsInRange(LineLayoutState& layoutState, Inlin
             if (isNewUBAParagraph && styleToUse->unicodeBidi() == Plaintext && !resolver.context()->parent()) {
                 TextDirection direction = styleToUse->direction();
                 determineDirectionality(direction, resolver.position());
-                resolver.setStatus(BidiStatus(direction, styleToUse->unicodeBidi() == Override));
+                resolver.setStatus(BidiStatus(direction, isOverride(styleToUse->unicodeBidi())));
             }
             // FIXME: This ownership is reversed. We should own the BidiRunList and pass it to createBidiRunsForLine.
             BidiRunList<BidiRun>& bidiRuns = resolver.runs();
@@ -1462,7 +1462,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, LayoutUnit& repain
     LineLayoutState layoutState(isFullLayout, repaintLogicalTop, repaintLogicalBottom);
 
     if (isFullLayout)
-        deleteLineBoxTree();
+        lineBoxes()->deleteLineBoxes(renderArena());
 
     // Text truncation only kicks in if your overflow isn't visible and your text-overflow-mode isn't
     // clip.
@@ -1486,7 +1486,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, LayoutUnit& repain
             if (o->isReplaced() || o->isFloating() || o->isPositioned()) {
                 RenderBox* box = toRenderBox(o);
 
-                if (relayoutChildren || o->style()->width().isPercent() || o->style()->height().isPercent())
+                if (relayoutChildren || box->hasRelativeDimensions())
                     o->setChildNeedsLayout(true, false);
 
                 // If relayoutChildren is set and the child has percentage padding or an embedded content box, we also need to invalidate the childs pref widths.
@@ -1546,7 +1546,7 @@ void RenderBlock::checkFloatsInCleanLine(RootInlineBox* line, Vector<FloatWithRe
     for (Vector<RenderBox*>::iterator it = cleanLineFloats->begin(); it != end; ++it) {
         RenderBox* floatingBox = *it;
         floatingBox->layoutIfNeeded();
-        LayoutSize newSize(floatingBox->width() + floatingBox->marginLeft() + floatingBox->marginRight(), floatingBox->height() + floatingBox->marginTop() + floatingBox->marginBottom());
+        LayoutSize newSize(floatingBox->width() + floatingBox->marginWidth(), floatingBox->height() + floatingBox->marginHeight());
         ASSERT(floatIndex < floats.size());
         if (floats[floatIndex].object != floatingBox) {
             encounteredNewFloat = true;
@@ -1682,7 +1682,7 @@ RootInlineBox* RenderBlock::determineStartPosition(LineLayoutState& layoutState,
         TextDirection direction = style()->direction();
         if (style()->unicodeBidi() == Plaintext)
             determineDirectionality(direction, InlineIterator(this, bidiFirstSkippingEmptyInlines(this), 0));
-        resolver.setStatus(BidiStatus(direction, style()->unicodeBidi() == Override));
+        resolver.setStatus(BidiStatus(direction, isOverride(style()->unicodeBidi())));
         InlineIterator iter = InlineIterator(this, bidiFirstSkippingEmptyInlines(this, &resolver), 0);
         resolver.setPosition(iter, numberOfIsolateAncestors(iter));
     }
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index d21c2405d..bafdc376a 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -263,6 +263,9 @@ void RenderBox::willBeDestroyed()
     // value during laying out. It causes a use-after-free bug.
     ASSERT(!RenderBlock::hasPercentHeightDescendant(this));
 
+    if (hasOverflowClip() && everHadLayout() && !hasLayer())
+        clearCachedSizeForOverflowClip();
+
     RenderBoxModelObject::willBeDestroyed();
 }
 
@@ -285,7 +288,7 @@ void RenderBox::removeFloatingOrPositionedChildFromBlockLists()
 
         if (parentBlock) {
             RenderObject* parent = parentBlock->parent();
-            if (parent && parent->isDeprecatedFlexibleBox())
+            if (parent && parent->isFlexibleBoxIncludingDeprecated())
                 parentBlock = toRenderBlock(parent);
 
             parentBlock->markSiblingsWithFloatsForLayout(this);
@@ -360,7 +363,7 @@ void RenderBox::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle
 
     // If our zoom factor changes and we have a defined scrollLeft/Top, we need to adjust that value into the
     // new zoomed coordinate space.
-    if (hasOverflowClip() && oldStyle && newStyle && oldStyle->effectiveZoom() != newStyle->effectiveZoom()) {
+    if (hasOverflowClipWithLayer() && oldStyle && newStyle && oldStyle->effectiveZoom() != newStyle->effectiveZoom()) {
         if (int left = layer()->scrollXOffset()) {
             left = (left / oldStyle->effectiveZoom()) * newStyle->effectiveZoom();
             layer()->scrollToXOffset(left);
@@ -463,6 +466,10 @@ void RenderBox::layout()
         child = child->nextSibling();
     }
     statePusher.pop();
+
+    if (hasOverflowClip() && !hasLayer())
+        updateCachedSizeForOverflowClip();
+
     setNeedsLayout(false);
 }
 
@@ -480,17 +487,17 @@ LayoutUnit RenderBox::clientHeight() const
 
 int RenderBox::pixelSnappedClientWidth() const
 {
-    return clientWidth();
+    return snapSizeToPixel(clientWidth(), clientLeft());
 }
 
 int RenderBox::pixelSnappedClientHeight() const
 {
-    return clientHeight();
+    return snapSizeToPixel(clientHeight(), clientTop());
 }
 
 int RenderBox::scrollWidth() const
 {
-    if (hasOverflowClip())
+    if (hasOverflowClipWithLayer())
         return layer()->scrollWidth();
     // For objects with visible overflow, this matches IE.
     // FIXME: Need to work right with writing modes.
@@ -501,7 +508,7 @@ int RenderBox::scrollWidth() const
 
 int RenderBox::scrollHeight() const
 {
-    if (hasOverflowClip())
+    if (hasOverflowClipWithLayer())
         return layer()->scrollHeight();
     // For objects with visible overflow, this matches IE.
     // FIXME: Need to work right with writing modes.
@@ -510,29 +517,29 @@ int RenderBox::scrollHeight() const
 
 int RenderBox::scrollLeft() const
 {
-    return hasOverflowClip() ? layer()->scrollXOffset() : 0;
+    return hasOverflowClipWithLayer() ? layer()->scrollXOffset() : 0;
 }
 
 int RenderBox::scrollTop() const
 {
-    return hasOverflowClip() ? layer()->scrollYOffset() : 0;
+    return hasOverflowClipWithLayer() ? layer()->scrollYOffset() : 0;
 }
 
 void RenderBox::setScrollLeft(int newLeft)
 {
-    if (hasOverflowClip())
+    if (hasOverflowClipWithLayer())
         layer()->scrollToXOffset(newLeft, RenderLayer::ScrollOffsetClamped);
 }
 
 void RenderBox::setScrollTop(int newTop)
 {
-    if (hasOverflowClip())
+    if (hasOverflowClipWithLayer())
         layer()->scrollToYOffset(newTop, RenderLayer::ScrollOffsetClamped);
 }
 
 void RenderBox::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
-    rects.append(LayoutRect(accumulatedOffset, size()));
+    rects.append(pixelSnappedIntRect(accumulatedOffset, size()));
 }
 
 void RenderBox::absoluteQuads(Vector<FloatQuad>& quads, bool* wasFixed) const
@@ -581,10 +588,10 @@ LayoutRect RenderBox::outlineBoundsForRepaint(RenderBoxModelObject* repaintConta
     return box;
 }
 
-void RenderBox::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint& additionalOffset)
+void RenderBox::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint& additionalOffset)
 {
     if (!size().isEmpty())
-        rects.append(LayoutRect(additionalOffset, size()));
+        rects.append(pixelSnappedIntRect(additionalOffset, size()));
 }
 
 LayoutRect RenderBox::reflectionBox() const
@@ -651,13 +658,13 @@ bool RenderBox::fixedElementLaysOutRelativeToFrame(Frame* frame, FrameView* fram
 
 bool RenderBox::includeVerticalScrollbarSize() const
 {
-    return hasOverflowClip() && !layer()->hasOverlayScrollbars()
+    return hasOverflowClipWithLayer() && !layer()->hasOverlayScrollbars()
         && (style()->overflowY() == OSCROLL || style()->overflowY() == OAUTO);
 }
 
 bool RenderBox::includeHorizontalScrollbarSize() const
 {
-    return hasOverflowClip() && !layer()->hasOverlayScrollbars()
+    return hasOverflowClipWithLayer() && !layer()->hasOverlayScrollbars()
         && (style()->overflowX() == OSCROLL || style()->overflowX() == OAUTO);
 }
 
@@ -749,8 +756,56 @@ bool RenderBox::needsPreferredWidthsRecalculation() const
 IntSize RenderBox::scrolledContentOffset() const
 {
     ASSERT(hasOverflowClip());
-    ASSERT(hasLayer());
-    return layer()->scrolledContentOffset();
+
+    if (hasLayer())
+        return layer()->scrolledContentOffset();
+
+    // If we have no layer, it means that we have no overflowing content as we lazily
+    // allocate it on demand. Thus we don't have any scroll offset.
+    ASSERT(!requiresLayerForOverflowClip());
+    return LayoutSize();
+}
+
+typedef HashMap<const RenderBox*, LayoutSize> RendererSizeCache;
+static RendererSizeCache& cachedSizeForOverflowClipMap()
+{
+    DEFINE_STATIC_LOCAL(RendererSizeCache, cachedSizeForOverflowClipMap, ());
+    return cachedSizeForOverflowClipMap;
+}
+
+IntSize RenderBox::cachedSizeForOverflowClip() const
+{
+    ASSERT(hasOverflowClip());
+    if (hasLayer())
+        return layer()->size();
+
+    ASSERT(!requiresLayerForOverflowClip());
+    RendererSizeCache::iterator it = cachedSizeForOverflowClipMap().find(this);
+    if (it == cachedSizeForOverflowClipMap().end())
+        return LayoutSize();
+
+    return it->second;
+}
+
+void RenderBox::updateCachedSizeForOverflowClip()
+{
+    ASSERT(hasOverflowClip());
+    ASSERT(!requiresLayerForOverflowClip());
+    ASSERT(!hasLayer());
+
+    cachedSizeForOverflowClipMap().set(this, size());
+}
+
+void RenderBox::clearCachedSizeForOverflowClip()
+{
+    ASSERT(hasOverflowClip());
+    ASSERT(!requiresLayerForOverflowClip());
+    ASSERT(!hasLayer());
+
+    // FIXME: We really would like to enable this ASSERT. However the current updateScrollInfoAfterLayout
+    // is not bullet-proof and it triggers in non-obvious ways under NRWT.
+    // ASSERT(cachedSizeForOverflowClipMap().contains(this));
+    cachedSizeForOverflowClipMap().remove(this);
 }
 
 LayoutUnit RenderBox::minPreferredLogicalWidth() const
@@ -795,9 +850,9 @@ void RenderBox::setOverrideWidth(LayoutUnit width)
 
 void RenderBox::clearOverrideSize()
 {
-    if (hasOverrideHeight())
+    if (gOverrideHeightMap)
         gOverrideHeightMap->remove(this);
-    if (hasOverrideWidth())
+    if (gOverrideWidthMap)
         gOverrideWidthMap->remove(this);
 }
 
@@ -1070,7 +1125,7 @@ void RenderBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, cons
 void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, const LayoutRect& rect,
     BackgroundBleedAvoidance bleedAvoidance, CompositeOperator op, RenderObject* backgroundObject)
 {
-    paintFillLayerExtended(paintInfo, c, fillLayer, rect, bleedAvoidance, 0, IntSize(), op, backgroundObject);
+    paintFillLayerExtended(paintInfo, c, fillLayer, rect, bleedAvoidance, 0, LayoutSize(), op, backgroundObject);
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -1133,8 +1188,8 @@ bool RenderBox::repaintLayerRectsForImage(WrappedImagePtr image, const FillLayer
                     }
                     rendererRect = LayoutRect(-layerRenderer->marginLeft(),
                         -layerRenderer->marginTop(),
-                        max(layerRenderer->width() + layerRenderer->marginLeft() + layerRenderer->marginRight() + layerRenderer->borderLeft() + layerRenderer->borderRight(), rw),
-                        max(layerRenderer->height() + layerRenderer->marginTop() + layerRenderer->marginBottom() + layerRenderer->borderTop() + layerRenderer->borderBottom(), rh));
+                        max(layerRenderer->width() + layerRenderer->marginWidth() + layerRenderer->borderLeft() + layerRenderer->borderRight(), rw),
+                        max(layerRenderer->height() + layerRenderer->marginHeight() + layerRenderer->borderTop() + layerRenderer->borderBottom(), rh));
                 } else {
                     layerRenderer = this;
                     rendererRect = borderBoxRect();
@@ -1182,7 +1237,7 @@ bool RenderBox::pushContentsClip(PaintInfo& paintInfo, const LayoutPoint& accumu
         return false;
         
     bool isControlClip = hasControlClip();
-    bool isOverflowClip = hasOverflowClip() && !layer()->isSelfPaintingLayer();
+    bool isOverflowClip = hasOverflowClip() && !hasSelfPaintingLayer();
     
     if (!isControlClip && !isOverflowClip)
         return false;
@@ -1204,7 +1259,7 @@ bool RenderBox::pushContentsClip(PaintInfo& paintInfo, const LayoutPoint& accumu
 
 void RenderBox::popContentsClip(PaintInfo& paintInfo, PaintPhase originalPhase, const LayoutPoint& accumulatedOffset)
 {
-    ASSERT(hasControlClip() || (hasOverflowClip() && !layer()->isSelfPaintingLayer()));
+    ASSERT(hasControlClip() || (hasOverflowClip() && !hasSelfPaintingLayer()));
 
     paintInfo.context->restore();
     if (originalPhase == PaintPhaseOutline) {
@@ -1224,8 +1279,11 @@ LayoutRect RenderBox::overflowClipRect(const LayoutPoint& location, RenderRegion
     clipRect.setSize(clipRect.size() - LayoutSize(borderLeft() + borderRight(), borderTop() + borderBottom()));
 
     // Subtract out scrollbars if we have them.
-    if (layer())
+     if (layer()) {
+        if (style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+            clipRect.move(layer()->verticalScrollbarWidth(relevancy), 0);
         clipRect.contract(layer()->verticalScrollbarWidth(relevancy), layer()->horizontalScrollbarHeight(relevancy));
+     }
 
     return clipRect;
 }
@@ -1265,7 +1323,7 @@ LayoutUnit RenderBox::shrinkLogicalWidthToAvoidFloats(LayoutUnit childMarginStar
     LayoutUnit logicalTopPosition = logicalTop();
     LayoutUnit adjustedPageOffsetForContainingBlock = offsetFromLogicalTopOfFirstPage - logicalTop();
     if (region) {
-        LayoutUnit offsetFromLogicalTopOfRegion = region ? region->offsetFromLogicalTopOfFirstPage() - offsetFromLogicalTopOfFirstPage : 0;
+        LayoutUnit offsetFromLogicalTopOfRegion = region ? region->offsetFromLogicalTopOfFirstPage() - offsetFromLogicalTopOfFirstPage : zeroLayoutUnit;
         logicalTopPosition = max(logicalTopPosition, logicalTopPosition + offsetFromLogicalTopOfRegion);
         containingBlockRegion = cb->clampToStartAndEndRegions(region);
     }
@@ -1346,8 +1404,7 @@ void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool
     if (RenderView* v = view()) {
         if (v->layoutStateEnabled() && !repaintContainer) {
             LayoutState* layoutState = v->layoutState();
-            LayoutSize offset = layoutState->m_paintOffset;
-            offset.expand(x(), y());
+            LayoutSize offset = layoutState->m_paintOffset + locationOffset();
             if (style()->position() == RelativePosition && layer())
                 offset += layer()->relativePositionOffset();
             transformState.move(offset);
@@ -1474,7 +1531,7 @@ void RenderBox::positionLineBox(InlineBox* box)
             // our object was inline originally, since otherwise it would have ended up underneath
             // the inlines.
             RootInlineBox* root = box->root();
-            root->block()->setStaticInlinePositionForChild(this, root->lineTopWithLeading(), lroundf(box->logicalLeft()));
+            root->block()->setStaticInlinePositionForChild(this, root->lineTopWithLeading(), roundedLayoutUnit(box->logicalLeft()));
             if (style()->hasStaticInlinePosition(box->isHorizontal()))
                 setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
         } else {
@@ -1597,7 +1654,7 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, La
 #endif
 
     LayoutPoint topLeft = rect.location();
-    topLeft.move(x(), y());
+    topLeft.move(locationOffset());
 
     EPosition position = styleToUse->position();
 
@@ -1607,7 +1664,7 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, La
         fixed = position == FixedPosition;
         rect = layer()->transform()->mapRect(rect);
         topLeft = rect.location();
-        topLeft.move(x(), y());
+        topLeft.move(locationOffset());
     } else if (position == FixedPosition)
         fixed = true;
 
@@ -1642,7 +1699,7 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, La
         topLeft -= containerBox->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
 
         LayoutRect repaintRect(topLeft, rect.size());
-        LayoutRect boxRect(LayoutPoint(), containerBox->layer()->size());
+        LayoutRect boxRect(LayoutPoint(), containerBox->cachedSizeForOverflowClip());
         rect = intersection(repaintRect, boxRect);
         if (rect.isEmpty())
             return;
@@ -1830,7 +1887,8 @@ bool RenderBox::sizesToIntrinsicLogicalWidth(LogicalWidthType widthType) const
     // In the case of columns that have a stretch alignment, we go ahead and layout at the
     // stretched size to avoid an extra layout when applying alignment.
     if (parent()->isFlexibleBox()) {
-        if (!parent()->style()->isColumnFlexDirection())
+        // For multiline columns, we need to apply the flex-line-pack first, so we can't stretch now.
+        if (!parent()->style()->isColumnFlexDirection() || parent()->style()->flexWrap() != FlexWrapNone)
             return true;
         EFlexAlign itemAlign = style()->flexItemAlign();
         if (itemAlign != AlignStretch && (itemAlign != AlignAuto || parent()->style()->flexAlign() != AlignStretch))
@@ -3675,6 +3733,10 @@ void RenderBox::addLayoutOverflow(const LayoutRect& rect)
     if (!m_overflow)
         m_overflow = adoptPtr(new RenderOverflow(clientBox, borderBoxRect()));
     
+    // Lazily allocate our layer as we will need it to hold our scroll information.
+    if (hasOverflowClip())
+        ensureLayer();
+
     m_overflow->addLayoutOverflow(overflowRect);
 }
 
@@ -3884,7 +3946,7 @@ LayoutPoint RenderBox::flipForWritingModeForChild(const RenderBox* child, const
     return LayoutPoint(point.x() + width() - child->width() - (2 * child->x()), point.y());
 }
 
-void RenderBox::flipForWritingMode(IntRect& rect) const
+void RenderBox::flipForWritingMode(LayoutRect& rect) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return;
@@ -3895,18 +3957,18 @@ void RenderBox::flipForWritingMode(IntRect& rect) const
         rect.setX(width() - rect.maxX());
 }
 
-int RenderBox::flipForWritingMode(int position) const
+LayoutUnit RenderBox::flipForWritingMode(LayoutUnit position) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return position;
     return logicalHeight() - position;
 }
 
-IntPoint RenderBox::flipForWritingMode(const IntPoint& position) const
+LayoutPoint RenderBox::flipForWritingMode(const LayoutPoint& position) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return position;
-    return isHorizontalWritingMode() ? IntPoint(position.x(), height() - position.y()) : IntPoint(width() - position.x(), position.y());
+    return isHorizontalWritingMode() ? LayoutPoint(position.x(), height() - position.y()) : LayoutPoint(width() - position.x(), position.y());
 }
 
 LayoutPoint RenderBox::flipForWritingModeIncludingColumns(const LayoutPoint& point) const
@@ -3916,11 +3978,11 @@ LayoutPoint RenderBox::flipForWritingModeIncludingColumns(const LayoutPoint& poi
     return toRenderBlock(this)->flipForWritingModeIncludingColumns(point);
 }
 
-IntSize RenderBox::flipForWritingMode(const IntSize& offset) const
+LayoutSize RenderBox::flipForWritingMode(const LayoutSize& offset) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return offset;
-    return isHorizontalWritingMode() ? IntSize(offset.width(), height() - offset.height()) : IntSize(width() - offset.width(), offset.height());
+    return isHorizontalWritingMode() ? LayoutSize(offset.width(), height() - offset.height()) : LayoutSize(width() - offset.width(), offset.height());
 }
 
 FloatPoint RenderBox::flipForWritingMode(const FloatPoint& position) const
@@ -3960,4 +4022,11 @@ LayoutSize RenderBox::topLeftLocationOffset() const
     return LayoutSize(rect.x(), rect.y());
 }
 
+bool RenderBox::hasRelativeDimensions() const
+{
+    return style()->height().isPercent() || style()->width().isPercent()
+            || style()->maxHeight().isPercent() || style()->maxWidth().isPercent()
+            || style()->minHeight().isPercent() || style()->minWidth().isPercent();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index 31ec39a20..2bba71f0b 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -42,6 +42,11 @@ public:
     RenderBox(Node*);
     virtual ~RenderBox();
 
+    virtual bool requiresLayer() const OVERRIDE { return isRoot() || isPositioned() || isRelPositioned() || isTransparent() || requiresLayerForOverflowClip() || hasTransform() || hasMask() || hasReflection() || hasFilter() || style()->specifiesColumns(); }
+    bool requiresLayerForOverflowClip() const;
+
+    bool hasOverflowClipWithLayer() const { return hasOverflowClip() && hasLayer(); }
+
     // Use this with caution! No type checking is done!
     RenderBox* firstChildBox() const;
     RenderBox* lastChildBox() const;
@@ -127,11 +132,13 @@ public:
     LayoutRect frameRect() const { return m_frameRect; }
     void setFrameRect(const LayoutRect& rect) { m_frameRect = rect; }
 
-    LayoutRect borderBoxRect() const { return LayoutRect(0, 0, width(), height()); }
-    virtual LayoutRect borderBoundingBox() const { return borderBoxRect(); } 
+    // FIXME: We shouldn't be returning this as a LayoutRect, since it loses its position and won't properly pixel snap.
+    LayoutRect borderBoxRect() const { return LayoutRect(LayoutPoint(), size()); }
+    IntRect pixelSnappedBorderBoxRect() const { return IntRect(IntPoint(), IntSize(m_frameRect.pixelSnappedWidth(), m_frameRect.pixelSnappedHeight())); }
+    virtual IntRect borderBoundingBox() const { return pixelSnappedBorderBoxRect(); }
 
     // The content area of the box (excludes padding and border).
-    LayoutRect contentBoxRect() const { return LayoutRect(borderLeft() + paddingLeft(), borderTop() + paddingTop(), contentWidth(), contentHeight()); }
+    LayoutRect contentBoxRect(PaddingOptions paddingOption = ExcludeIntrinsicPadding) const { return LayoutRect(borderLeft() + paddingLeft(paddingOption), borderTop() + paddingTop(paddingOption), contentWidth(paddingOption), contentHeight(paddingOption)); }
     // The content box in absolute coords. Ignores transforms.
     LayoutRect absoluteContentBox() const;
     // The content box converted to absolute coords (taking transforms into account).
@@ -139,7 +146,7 @@ public:
 
     // Bounds of the outline box in absolute coords. Respects transforms
     virtual LayoutRect outlineBoundsForRepaint(RenderBoxModelObject* /*repaintContainer*/, LayoutPoint* cachedOffsetToRepaintContainer) const;
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     // Use this with caution! No type checking is done!
     RenderBox* previousSiblingBox() const;
@@ -178,10 +185,10 @@ public:
     
     void updateLayerTransform();
 
-    LayoutUnit contentWidth() const { return clientWidth() - paddingLeft() - paddingRight(); }
-    LayoutUnit contentHeight() const { return clientHeight() - paddingTop() - paddingBottom(); }
-    LayoutUnit contentLogicalWidth() const { return style()->isHorizontalWritingMode() ? contentWidth() : contentHeight(); }
-    LayoutUnit contentLogicalHeight() const { return style()->isHorizontalWritingMode() ? contentHeight() : contentWidth(); }
+    LayoutUnit contentWidth(PaddingOptions paddingOption = ExcludeIntrinsicPadding) const { return clientWidth() - paddingLeft(paddingOption) - paddingRight(paddingOption); }
+    LayoutUnit contentHeight(PaddingOptions paddingOption = ExcludeIntrinsicPadding) const { return clientHeight() - paddingTop(paddingOption) - paddingBottom(paddingOption); }
+    LayoutUnit contentLogicalWidth(PaddingOptions paddingOption = ExcludeIntrinsicPadding) const { return style()->isHorizontalWritingMode() ? contentWidth(paddingOption) : contentHeight(paddingOption); }
+    LayoutUnit contentLogicalHeight(PaddingOptions paddingOption = ExcludeIntrinsicPadding) const { return style()->isHorizontalWritingMode() ? contentHeight(paddingOption) : contentWidth(paddingOption); }
 
     // IE extensions. Used to calculate offsetWidth/Height.  Overridden by inlines (RenderFlow)
     // to return the remaining width on a given line (and the height of a single line).
@@ -246,7 +253,7 @@ public:
     virtual LayoutUnit collapsedMarginBefore() const { return marginBefore(); }
     virtual LayoutUnit collapsedMarginAfter() const { return marginAfter(); }
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
     
     LayoutRect reflectionBox() const;
@@ -321,7 +328,7 @@ public:
         return document()->inQuirksMode() && style()->logicalHeight().isAuto() && !isFloatingOrPositioned() && (isRoot() || isBody());
     }
 
-    virtual LayoutSize intrinsicSize() const { return LayoutSize(); }
+    virtual IntSize intrinsicSize() const { return IntSize(); }
     LayoutUnit intrinsicLogicalWidth() const { return style()->isHorizontalWritingMode() ? intrinsicSize().width() : intrinsicSize().height(); }
     LayoutUnit intrinsicLogicalHeight() const { return style()->isHorizontalWritingMode() ? intrinsicSize().height() : intrinsicSize().width(); }
 
@@ -424,11 +431,11 @@ public:
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
     LayoutPoint flipForWritingModeForChild(const RenderBox* child, const LayoutPoint&) const;
-    int flipForWritingMode(int position) const; // The offset is in the block direction (y for horizontal writing modes, x for vertical writing modes).
-    IntPoint flipForWritingMode(const IntPoint&) const;
+    LayoutUnit flipForWritingMode(LayoutUnit position) const; // The offset is in the block direction (y for horizontal writing modes, x for vertical writing modes).
+    LayoutPoint flipForWritingMode(const LayoutPoint&) const;
     LayoutPoint flipForWritingModeIncludingColumns(const LayoutPoint&) const;
-    IntSize flipForWritingMode(const IntSize&) const;
-    void flipForWritingMode(IntRect&) const;
+    LayoutSize flipForWritingMode(const LayoutSize&) const;
+    void flipForWritingMode(LayoutRect&) const;
     FloatPoint flipForWritingMode(const FloatPoint&) const;
     void flipForWritingMode(FloatRect&) const;
     // These represent your location relative to your container as a physical offset.
@@ -448,6 +455,33 @@ public:
     virtual void computeIntrinsicRatioInformation(FloatSize& /* intrinsicSize */, double& /* intrinsicRatio */, bool& /* isPercentageIntrinsicSize */) const { }
 
     IntSize scrolledContentOffset() const;
+    IntSize cachedSizeForOverflowClip() const;
+    void updateCachedSizeForOverflowClip();
+    void clearCachedSizeForOverflowClip();
+
+    virtual bool hasRelativeDimensions() const;
+
+    bool hasHorizontalLayoutOverflow() const
+    {
+        if (RenderOverflow* overflow = hasRenderOverflow()) {
+            LayoutRect layoutOverflowRect = overflow->layoutOverflowRect();
+            flipForWritingMode(layoutOverflowRect);
+            return layoutOverflowRect.x() < x() || layoutOverflowRect.maxX() > x() + logicalWidth();
+        }
+
+        return false;
+    }
+
+    bool hasVerticalLayoutOverflow() const
+    {
+        if (RenderOverflow* overflow = hasRenderOverflow()) {
+            LayoutRect layoutOverflowRect = overflow->layoutOverflowRect();
+            flipForWritingMode(layoutOverflowRect);
+            return layoutOverflowRect.y() < y() || layoutOverflowRect.maxY() > y() + logicalHeight();
+        }
+
+        return false;
+    }
 
 protected:
     virtual void willBeDestroyed();
@@ -577,6 +611,24 @@ inline RenderBox* RenderBox::lastChildBox() const
     return toRenderBox(lastChild());
 }
 
+inline bool RenderBox::requiresLayerForOverflowClip() const
+{
+    if (!hasOverflowClip())
+        return false;
+
+    // The resizer is attached to the RenderLayer so we need one.
+    if (style()->resize() != RESIZE_NONE)
+        return true;
+
+    // FIXME: overflow: auto could also lazily create its layer but some repainting
+    // issues are arising from that.
+    bool onlyOverflowHidden = style()->overflowX() == OHIDDEN && style()->overflowY() == OHIDDEN;
+
+    // Currently {push|pop}ContentsClip do not handle properly all cases involving a clip
+    // with a border radius so we need a RenderLayer to handle them.
+    return !onlyOverflowHidden || style()->hasBorderRadius();
+}
+
 } // namespace WebCore
 
 #endif // RenderBox_h
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index e3ab32180..c709705bc 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -48,6 +48,7 @@ using namespace HTMLNames;
 
 bool RenderBoxModelObject::s_wasFloating = false;
 bool RenderBoxModelObject::s_hadLayer = false;
+bool RenderBoxModelObject::s_hadTransform = false;
 bool RenderBoxModelObject::s_layerWasSelfPainting = false;
 
 static const double cInterpolationCutoff = 800. * 800.;
@@ -220,26 +221,23 @@ static ImageQualityController* imageQualityController()
     return gImageQualityController;
 }
 
-void RenderBoxModelObject::setSelectionState(SelectionState s)
+void RenderBoxModelObject::setSelectionState(SelectionState state)
 {
-    if (selectionState() == s)
-        return;
-    
-    if (s == SelectionInside && selectionState() != SelectionNone)
+    if (state == SelectionInside && selectionState() != SelectionNone)
         return;
 
-    if ((s == SelectionStart && selectionState() == SelectionEnd)
-        || (s == SelectionEnd && selectionState() == SelectionStart))
+    if ((state == SelectionStart && selectionState() == SelectionEnd)
+        || (state == SelectionEnd && selectionState() == SelectionStart))
         RenderObject::setSelectionState(SelectionBoth);
     else
-        RenderObject::setSelectionState(s);
-    
-    // FIXME:
-    // We should consider whether it is OK propagating to ancestor RenderInlines.
+        RenderObject::setSelectionState(state);
+
+    // FIXME: We should consider whether it is OK propagating to ancestor RenderInlines.
     // This is a workaround for http://webkit.org/b/32123
-    RenderBlock* cb = containingBlock();
-    if (cb && !cb->isRenderView())
-        cb->setSelectionState(s);
+    // The containing block can be null in case of an orphaned tree.
+    RenderBlock* containingBlock = this->containingBlock();
+    if (containingBlock && !containingBlock->isRenderView())
+        containingBlock->setSelectionState(state);
 }
 
 bool RenderBoxModelObject::shouldPaintAtLowQuality(GraphicsContext* context, Image* image, const void* layer, const LayoutSize& size)
@@ -302,6 +300,7 @@ void RenderBoxModelObject::styleWillChange(StyleDifference diff, const RenderSty
 {
     s_wasFloating = isFloating();
     s_hadLayer = hasLayer();
+    s_hadTransform = hasTransform();
     if (s_hadLayer)
         s_layerWasSelfPainting = layer()->isSelfPaintingLayer();
 
@@ -352,18 +351,28 @@ void RenderBoxModelObject::styleWillChange(StyleDifference diff, const RenderSty
     RenderObject::styleWillChange(diff, newStyle);
 }
 
+void RenderBoxModelObject::ensureLayer()
+{
+    if (m_layer)
+        return;
+
+    m_layer = new (renderArena()) RenderLayer(this);
+    setHasLayer(true);
+    m_layer->insertOnlyThisLayer();
+}
+
 void RenderBoxModelObject::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderObject::styleDidChange(diff, oldStyle);
     updateBoxModelInfoFromStyle();
-    
+
     if (requiresLayer()) {
         if (!layer() && layerCreationAllowedForSubtree()) {
             if (s_wasFloating && isFloating())
                 setChildNeedsLayout(true);
-            m_layer = new (renderArena()) RenderLayer(this);
-            setHasLayer(true);
-            m_layer->insertOnlyThisLayer();
+
+            ensureLayer();
+
             if (parent() && !needsLayout() && containingBlock()) {
                 m_layer->setRepaintStatus(NeedsFullRepaint);
                 // There is only one layer to update, it is not worth using |cachedOffset| since
@@ -377,6 +386,10 @@ void RenderBoxModelObject::styleDidChange(StyleDifference diff, const RenderStyl
         m_layer->removeOnlyThisLayer(); // calls destroyLayer() which clears m_layer
         if (s_wasFloating && isFloating())
             setChildNeedsLayout(true);
+        if (s_hadTransform)
+            setNeedsLayoutAndPrefWidthsRecalc();
+        if (hasOverflowClip())
+            toRenderBox(this)->updateCachedSizeForOverflowClip();
     }
 
     if (layer()) {
@@ -537,7 +550,7 @@ int RenderBoxModelObject::pixelSnappedOffsetHeight() const
     return offsetHeight();
 }
 
-LayoutUnit RenderBoxModelObject::paddingTop(bool) const
+LayoutUnit RenderBoxModelObject::paddingTop(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingTop();
@@ -546,7 +559,7 @@ LayoutUnit RenderBoxModelObject::paddingTop(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingBottom(bool) const
+LayoutUnit RenderBoxModelObject::paddingBottom(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingBottom();
@@ -555,7 +568,7 @@ LayoutUnit RenderBoxModelObject::paddingBottom(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingLeft(bool) const
+LayoutUnit RenderBoxModelObject::paddingLeft(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingLeft();
@@ -564,7 +577,7 @@ LayoutUnit RenderBoxModelObject::paddingLeft(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingRight(bool) const
+LayoutUnit RenderBoxModelObject::paddingRight(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingRight();
@@ -573,7 +586,7 @@ LayoutUnit RenderBoxModelObject::paddingRight(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingBefore(bool) const
+LayoutUnit RenderBoxModelObject::paddingBefore(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingBefore();
@@ -582,7 +595,7 @@ LayoutUnit RenderBoxModelObject::paddingBefore(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingAfter(bool) const
+LayoutUnit RenderBoxModelObject::paddingAfter(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingAfter();
@@ -591,7 +604,7 @@ LayoutUnit RenderBoxModelObject::paddingAfter(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingStart(bool) const
+LayoutUnit RenderBoxModelObject::paddingStart(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingStart();
@@ -600,7 +613,7 @@ LayoutUnit RenderBoxModelObject::paddingStart(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingEnd(bool) const
+LayoutUnit RenderBoxModelObject::paddingEnd(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingEnd();
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.h b/Source/WebCore/rendering/RenderBoxModelObject.h
index 11e97c3fd..553584769 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.h
+++ b/Source/WebCore/rendering/RenderBoxModelObject.h
@@ -40,6 +40,8 @@ enum BackgroundBleedAvoidance {
     BackgroundBleedUseTransparencyLayer
 };
 
+enum PaddingOptions { IncludeIntrinsicPadding, ExcludeIntrinsicPadding };
+
 // This class is the base for all objects that adhere to the CSS box model as described
 // at http://www.w3.org/TR/CSS21/box.html
 
@@ -60,9 +62,9 @@ public:
     virtual LayoutUnit offsetWidth() const = 0;
     virtual LayoutUnit offsetHeight() const = 0;
 
+    int pixelSnappedOffsetLeft() const { return roundToInt(offsetLeft()); }
+    int pixelSnappedOffsetTop() const { return roundToInt(offsetTop()); }
     // FIXME: The implementation for these functions will change once we move to subpixel layout. See bug 60318.
-    int pixelSnappedOffsetLeft() const { return offsetLeft(); }
-    int pixelSnappedOffsetTop() const { return offsetTop(); }
     int pixelSnappedOffsetWidth() const;
     int pixelSnappedOffsetHeight() const;
 
@@ -72,29 +74,29 @@ public:
 
     bool hasSelfPaintingLayer() const;
     RenderLayer* layer() const { return m_layer; }
-    virtual bool requiresLayer() const { return isRoot() || isPositioned() || isRelPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasReflection() || hasFilter() || style()->specifiesColumns(); }
+    virtual bool requiresLayer() const { return isRoot() || isPositioned() || isRelPositioned() || isTransparent() || hasTransform() || hasMask() || hasReflection() || hasFilter() || style()->specifiesColumns(); }
 
     // This will work on inlines to return the bounding box of all of the lines' border boxes.
     virtual LayoutRect borderBoundingBox() const = 0;
 
     // Virtual since table cells override
-    virtual LayoutUnit paddingTop(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingBottom(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingLeft(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingRight(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingBefore(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingAfter(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingStart(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingEnd(bool includeIntrinsicPadding = true) const;
-
-    virtual LayoutUnit borderTop() const { return style()->borderTopWidth(); }
-    virtual LayoutUnit borderBottom() const { return style()->borderBottomWidth(); }
-    virtual LayoutUnit borderLeft() const { return style()->borderLeftWidth(); }
-    virtual LayoutUnit borderRight() const { return style()->borderRightWidth(); }
-    virtual LayoutUnit borderBefore() const { return style()->borderBeforeWidth(); }
-    virtual LayoutUnit borderAfter() const { return style()->borderAfterWidth(); }
-    virtual LayoutUnit borderStart() const { return style()->borderStartWidth(); }
-    virtual LayoutUnit borderEnd() const { return style()->borderEndWidth(); }
+    virtual LayoutUnit paddingTop(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingBottom(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingLeft(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingRight(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingBefore(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingAfter(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingStart(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingEnd(PaddingOptions = IncludeIntrinsicPadding) const;
+
+    virtual int borderTop() const { return style()->borderTopWidth(); }
+    virtual int borderBottom() const { return style()->borderBottomWidth(); }
+    virtual int borderLeft() const { return style()->borderLeftWidth(); }
+    virtual int borderRight() const { return style()->borderRightWidth(); }
+    virtual int borderBefore() const { return style()->borderBeforeWidth(); }
+    virtual int borderAfter() const { return style()->borderAfterWidth(); }
+    virtual int borderStart() const { return style()->borderStartWidth(); }
+    virtual int borderEnd() const { return style()->borderEndWidth(); }
 
     LayoutUnit borderAndPaddingHeight() const { return borderTop() + borderBottom() + paddingTop() + paddingBottom(); }
     LayoutUnit borderAndPaddingWidth() const { return borderLeft() + borderRight() + paddingLeft() + paddingRight(); }
@@ -114,6 +116,8 @@ public:
     virtual LayoutUnit marginAfter() const = 0;
     virtual LayoutUnit marginStart() const = 0;
     virtual LayoutUnit marginEnd() const = 0;
+    LayoutUnit marginHeight() const { return marginTop() + marginBottom(); }
+    LayoutUnit marginWidth() const { return marginLeft() + marginRight(); }
 
     bool hasInlineDirectionBordersPaddingOrMargin() const { return hasInlineDirectionBordersOrPadding() || marginStart()|| marginEnd(); }
     bool hasInlineDirectionBordersOrPadding() const { return borderStart() || borderEnd() || paddingStart()|| paddingEnd(); }
@@ -207,6 +211,8 @@ public:
     RenderObject* firstLetterRemainingText() const;
     void setFirstLetterRemainingText(RenderObject*);
 
+    void ensureLayer();
+
 private:
     virtual bool isBoxModelObject() const { return true; }
 
@@ -238,6 +244,7 @@ private:
     // Used to store state between styleWillChange and styleDidChange
     static bool s_wasFloating;
     static bool s_hadLayer;
+    static bool s_hadTransform;
     static bool s_layerWasSelfPainting;
 };
 
diff --git a/Source/WebCore/rendering/RenderButton.cpp b/Source/WebCore/rendering/RenderButton.cpp
index dd23130a6..380c5da35 100644
--- a/Source/WebCore/rendering/RenderButton.cpp
+++ b/Source/WebCore/rendering/RenderButton.cpp
@@ -141,6 +141,14 @@ String RenderButton::text() const
     return m_buttonText ? m_buttonText->text() : 0;
 }
 
+bool RenderButton::canHaveGeneratedChildren() const
+{
+    // Input elements can't have generated children, but button elements can. We'll
+    // write the code assuming any other button types that might emerge in the future
+    // can also have children.
+    return !node()->hasTagName(inputTag);
+}
+
 void RenderButton::updateBeforeAfterContent(PseudoId type)
 {
     if (m_inner)
@@ -149,11 +157,6 @@ void RenderButton::updateBeforeAfterContent(PseudoId type)
         children()->updateBeforeAfterContent(this, type);
 }
 
-RenderText* RenderButton::buttonText() const
-{
-    return m_buttonText;
-}
-
 LayoutRect RenderButton::controlClipRect(const LayoutPoint& additionalOffset) const
 {
     // Clip to the padding box to at least give content the extra padding space.
diff --git a/Source/WebCore/rendering/RenderButton.h b/Source/WebCore/rendering/RenderButton.h
index c851abc7d..fb94af988 100644
--- a/Source/WebCore/rendering/RenderButton.h
+++ b/Source/WebCore/rendering/RenderButton.h
@@ -50,7 +50,7 @@ public:
 
     virtual void updateBeforeAfterContent(PseudoId);
 
-    virtual RenderText* buttonText() const OVERRIDE;
+    virtual bool canHaveGeneratedChildren() const OVERRIDE;
     virtual bool hasControlClip() const { return true; }
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
 
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
index 4e88d5c6b..add01a0c2 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
@@ -226,7 +226,7 @@ void RenderDeprecatedFlexibleBox::layoutBlock(bool relayoutChildren, LayoutUnit
         return;
 
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
-    LayoutStateMaintainer statePusher(view(), this, LayoutSize(x(), y()), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
+    LayoutStateMaintainer statePusher(view(), this, locationOffset(), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
 
     if (inRenderFlowThread()) {
         // Regions changing widths can force us to relayout our children.
@@ -305,8 +305,7 @@ void RenderDeprecatedFlexibleBox::layoutBlock(bool relayoutChildren, LayoutUnit
 
     // Update our scrollbars if we're overflow:auto/scroll/hidden now that we know if
     // we overflow or not.
-    if (hasOverflowClip())
-        layer()->updateScrollInfoAfterLayout();
+    updateScrollInfoAfterLayout();
 
     // Repaint with our new bounds if they are different from our old bounds.
     repainter.repaintAfterLayout();
@@ -395,7 +394,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                 if (ascent == -1)
                     ascent = child->height() + child->marginBottom();
                 ascent += child->marginTop();
-                LayoutUnit descent = (child->marginTop() + child->height() + child->marginBottom()) - ascent;
+                LayoutUnit descent = (child->height() + child->marginHeight()) - ascent;
 
                 // Update our maximum ascent.
                 maxAscent = max(maxAscent, ascent);
@@ -407,7 +406,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                 setHeight(max(yPos + maxAscent + maxDescent, height()));
             }
             else
-                setHeight(max(height(), yPos + child->marginTop() + child->height() + child->marginBottom()));
+                setHeight(max(height(), yPos + child->height() + child->marginHeight()));
         }
 
         if (!iterator.first() && hasLineIfEmpty())
@@ -461,7 +460,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             LayoutUnit childY = yPos;
             switch (style()->boxAlign()) {
                 case BCENTER:
-                    childY += child->marginTop() + max<LayoutUnit>(0, (contentHeight() - (child->height() + child->marginTop() + child->marginBottom())) / 2);
+                    childY += child->marginTop() + max<LayoutUnit>(0, (contentHeight() - (child->height() + child->marginHeight())) / 2);
                     break;
                 case BBASELINE: {
                     LayoutUnit ascent = child->firstLineBoxBaseline();
@@ -700,7 +699,7 @@ void RenderDeprecatedFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             switch (style()->boxAlign()) {
                 case BCENTER:
                 case BBASELINE: // Baseline just maps to center for vertical boxes
-                    childX += child->marginLeft() + max<LayoutUnit>(0, (contentWidth() - (child->width() + child->marginLeft() + child->marginRight())) / 2);
+                    childX += child->marginLeft() + max<LayoutUnit>(0, (contentWidth() - (child->width() + child->marginWidth())) / 2);
                     break;
                 case BEND:
                     if (!style()->isLeftToRightDirection())
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
index 101bedbe3..9a42bd401 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
@@ -49,7 +49,7 @@ public:
     virtual bool isDeprecatedFlexibleBox() const { return true; }
     virtual bool isFlexingChildren() const { return m_flexingChildren; }
     virtual bool isStretchingChildren() const { return m_stretchingChildren; }
-    virtual RenderText* buttonText() const { return 0; }
+    virtual bool canHaveGeneratedChildren() const { return true; }
 
     void placeChild(RenderBox* child, const LayoutPoint& location);
 
diff --git a/Source/WebCore/rendering/RenderDetails.cpp b/Source/WebCore/rendering/RenderDetails.cpp
deleted file mode 100644
index 39882b197..000000000
--- a/Source/WebCore/rendering/RenderDetails.cpp
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "RenderDetails.h"
-
-#if ENABLE(DETAILS)
-
-#include "CSSStyleSelector.h"
-#include "HTMLDetailsElement.h"
-#include "HTMLNames.h"
-
-namespace WebCore {
-
-using namespace HTMLNames;
-
-RenderDetails::RenderDetails(Node* node)
-    : RenderBlock(node)
-{
-}
-
-void RenderDetails::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
-{
-    RenderBlock::styleDidChange(diff, oldStyle);
-    // Ensure that if we ended up being inline that we set our replaced flag
-    // so that we're treated like an inline-block.
-    setReplaced(isInline());
-}
-
-bool RenderDetails::isOpen() const
-{
-    return node() && node()->isElementNode() ? !static_cast<Element*>(node())->getAttribute(openAttr).isNull() : false;
-}
-
-} // namespace WebCore
-
-#endif
diff --git a/Source/WebCore/rendering/RenderDetails.h b/Source/WebCore/rendering/RenderDetails.h
deleted file mode 100644
index b89cedc06..000000000
--- a/Source/WebCore/rendering/RenderDetails.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef RenderDetails_h
-#define RenderDetails_h
-
-#if ENABLE(DETAILS)
-
-#include "RenderBlock.h"
-#include "RenderObject.h"
-
-namespace WebCore {
-
-class RenderDetails : public RenderBlock {
-public:
-    explicit RenderDetails(Node*);
-
-    bool isOpen() const;
-
-private:
-    virtual const char* renderName() const { return "RenderDetails"; }
-    virtual bool isDetails() const { return true; }
-    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
-};
-
-inline RenderDetails* toRenderDetails(RenderObject* object)
-{
-    ASSERT(!object || object->isDetails());
-    return static_cast<RenderDetails*>(object);
-}
-
-// This will catch anyone doing an unnecessary cast.
-void toRenderDetails(const RenderDetails*);
-
-} // namespace WebCore
-
-#endif
-
-#endif // RenderDetails_h
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.cpp b/Source/WebCore/rendering/RenderDetailsMarker.cpp
index c1468b543..bcffaac1c 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.cpp
+++ b/Source/WebCore/rendering/RenderDetailsMarker.cpp
@@ -23,10 +23,10 @@
 
 #if ENABLE(DETAILS)
 
+#include "Element.h"
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
 #include "PaintInfo.h"
-#include "RenderDetails.h"
 
 namespace WebCore {
 
@@ -37,13 +37,6 @@ RenderDetailsMarker::RenderDetailsMarker(Node* node)
 {
 }
 
-bool RenderDetailsMarker::isOpen() const
-{
-    if (RenderDetails* owner = details())
-        return owner->isOpen();
-    return false;
-}
-
 static Path createPath(const FloatPoint* path)
 {
     Path result;
@@ -144,14 +137,14 @@ void RenderDetailsMarker::paint(PaintInfo& paintInfo, const LayoutPoint& paintOf
     paintInfo.context->fillPath(getPath(boxOrigin));
 }
 
-RenderDetails* RenderDetailsMarker::details() const
+bool RenderDetailsMarker::isOpen() const
 {
     for (RenderObject* renderer = parent(); renderer; renderer = renderer->parent()) {
-        if (renderer->isDetails())
-            return toRenderDetails(renderer);
+        if (renderer->node() && renderer->node()->hasTagName(detailsTag))
+            return !toElement(renderer->node())->getAttribute(openAttr).isNull();
     }
 
-    return 0;
+    return false;
 }
 
 }
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.h b/Source/WebCore/rendering/RenderDetailsMarker.h
index 2b41c39f0..3afac553b 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.h
+++ b/Source/WebCore/rendering/RenderDetailsMarker.h
@@ -27,8 +27,6 @@
 
 namespace WebCore {
 
-class RenderDetails;
-
 class RenderDetailsMarker : public RenderBlock {
 public:
     RenderDetailsMarker(Node*);
@@ -45,7 +43,6 @@ private:
     bool isOpen() const;
     Path getCanonicalPath() const;
     Path getPath(const IntPoint& origin) const;
-    RenderDetails* details() const;
 };
 
 inline RenderDetailsMarker* toRenderDetailsMarker(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.cpp b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
index bdafd62d5..c239db277 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.cpp
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -139,11 +139,20 @@ void RenderEmbeddedObject::setMissingPluginIndicatorIsPressed(bool pressed)
 
 void RenderEmbeddedObject::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
 {
+    Page* page = 0;
+    if (Frame* frame = this->frame())
+        page = frame->page();
+
     if (pluginCrashedOrWasMissing()) {
+        if (page && paintInfo.phase == PaintPhaseForeground)
+            page->addRelevantUnpaintedObject(this, visualOverflowRect());
         RenderReplaced::paint(paintInfo, paintOffset);
         return;
     }
-    
+
+    if (page && paintInfo.phase == PaintPhaseForeground)
+        page->addRelevantRepaintedObject(this, visualOverflowRect());
+
     RenderPart::paint(paintInfo, paintOffset);
 }
 
@@ -167,11 +176,6 @@ void RenderEmbeddedObject::paintReplaced(PaintInfo& paintInfo, const LayoutPoint
     float textWidth;
     if (!getReplacementTextGeometry(paintOffset, contentRect, path, replacementTextRect, font, run, textWidth))
         return;
-
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
     
     GraphicsContextStateSaver stateSaver(*context);
     context->clip(contentRect);
diff --git a/Source/WebCore/rendering/RenderFieldset.cpp b/Source/WebCore/rendering/RenderFieldset.cpp
index 1d18bb9df..3b70e6a11 100644
--- a/Source/WebCore/rendering/RenderFieldset.cpp
+++ b/Source/WebCore/rendering/RenderFieldset.cpp
@@ -158,7 +158,7 @@ void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint
     // https://bugs.webkit.org/show_bug.cgi?id=47236
     if (style()->isHorizontalWritingMode()) {
         LayoutUnit clipTop = paintRect.y();
-        LayoutUnit clipHeight = max(static_cast<LayoutUnit>(style()->borderTopWidth()), legend->height());
+        LayoutUnit clipHeight = max(static_cast<LayoutUnit>(style()->borderTopWidth()), legend->height() - ((legend->height() - borderTop()) / 2));
         graphicsContext->clipOut(LayoutRect(paintRect.x() + legend->x(), clipTop, legend->width(), clipHeight));
     } else {
         LayoutUnit clipLeft = paintRect.x();
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.cpp b/Source/WebCore/rendering/RenderFileUploadControl.cpp
index a927f3fae..74e6f7de7 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/Source/WebCore/rendering/RenderFileUploadControl.cpp
@@ -32,7 +32,7 @@
 #include "RenderText.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "TextRun.h"
 #include "VisiblePosition.h"
 #include <math.h>
@@ -220,7 +220,7 @@ HTMLInputElement* RenderFileUploadControl::uploadButton() const
 
     ASSERT(input->hasShadowRoot());
 
-    Node* buttonNode = input->shadowRootList()->oldestShadowRoot()->firstChild();
+    Node* buttonNode = input->shadowTree()->oldestShadowRoot()->firstChild();
     return buttonNode && buttonNode->isHTMLElement() && buttonNode->hasTagName(inputTag) ? static_cast<HTMLInputElement*>(buttonNode) : 0;
 }
 
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index f2f993d7b..e9dd8381d 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -34,6 +34,7 @@
 #include "LayoutRepainter.h"
 #include "RenderLayer.h"
 #include "RenderView.h"
+#include <limits>
 
 namespace WebCore {
 
@@ -56,8 +57,11 @@ public:
     {
         copyToVector(flexOrderValues, m_orderValues);
         std::sort(m_orderValues.begin(), m_orderValues.end());
+        first();
     }
 
+    RenderBox* currentChild() { return m_currentChild; }
+
     RenderBox* first()
     {
         reset();
@@ -98,6 +102,40 @@ private:
     Vector<int>::const_iterator m_orderValuesIterator;
 };
 
+struct RenderFlexibleBox::WrapReverseContext {
+    explicit WrapReverseContext(EFlexWrap flexWrap)
+        : isWrapReverse(flexWrap == FlexWrapReverse)
+    {
+    }
+
+    void addCrossAxisOffset(LayoutUnit offset)
+    {
+        if (!isWrapReverse)
+            return;
+        crossAxisOffsets.append(offset);
+    }
+
+    void addNumberOfChildrenOnLine(size_t numberOfChildren)
+    {
+        if (!isWrapReverse)
+            return;
+        childrenPerLine.append(numberOfChildren);
+    }
+
+    LayoutUnit lineCrossAxisDelta(size_t line, LayoutUnit crossAxisContentExtent) const
+    {
+        ASSERT(line + 1 < crossAxisOffsets.size());
+        LayoutUnit lineHeight = crossAxisOffsets[line + 1] - crossAxisOffsets[line];
+        LayoutUnit originalOffset = crossAxisOffsets[line] - crossAxisOffsets[0];
+        LayoutUnit newOffset = crossAxisContentExtent - originalOffset - lineHeight;
+        return newOffset - originalOffset;
+    }
+
+    WTF::Vector<LayoutUnit> crossAxisOffsets;
+    WTF::Vector<size_t> childrenPerLine;
+    bool isWrapReverse;
+};
+
 
 RenderFlexibleBox::RenderFlexibleBox(Node* node)
     : RenderBlock(node)
@@ -200,7 +238,7 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren, int, BlockLayoutPass)
         return;
 
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
-    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
+    LayoutStateMaintainer statePusher(view(), this, locationOffset(), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
 
     if (inRenderFlowThread()) {
         // Regions changing widths can force us to relayout our children.
@@ -246,8 +284,7 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren, int, BlockLayoutPass)
 
     // Update our scroll information if we're overflow:auto/scroll/hidden now that we know if
     // we overflow or not.
-    if (hasOverflowClip())
-        layer()->updateScrollInfoAfterLayout();
+    updateScrollInfoAfterLayout();
 
     repainter.repaintAfterLayout();
 
@@ -279,6 +316,11 @@ bool RenderFlexibleBox::isLeftToRightFlow() const
     return style()->isLeftToRightDirection() ^ (style()->flexDirection() == FlowRowReverse);
 }
 
+bool RenderFlexibleBox::isMultiline() const
+{
+    return style()->flexWrap() != FlexWrapNone;
+}
+
 Length RenderFlexibleBox::mainAxisLengthForChild(RenderBox* child) const
 {
     return isHorizontalFlow() ? child->style()->width() : child->style()->height();
@@ -375,9 +417,20 @@ LayoutUnit RenderFlexibleBox::flowAwareBorderBefore() const
     return borderTop();
 }
 
-LayoutUnit RenderFlexibleBox::crossAxisBorderAndPaddingExtent() const
+LayoutUnit RenderFlexibleBox::flowAwareBorderAfter() const
 {
-    return isHorizontalFlow() ? borderAndPaddingHeight() : borderAndPaddingWidth();
+    switch (transformedWritingMode()) {
+    case TopToBottomWritingMode:
+        return borderBottom();
+    case BottomToTopWritingMode:
+        return borderTop();
+    case LeftToRightWritingMode:
+        return borderRight();
+    case RightToLeftWritingMode:
+        return borderLeft();
+    }
+    ASSERT_NOT_REACHED();
+    return borderTop();
 }
 
 LayoutUnit RenderFlexibleBox::flowAwarePaddingStart() const
@@ -410,6 +463,22 @@ LayoutUnit RenderFlexibleBox::flowAwarePaddingBefore() const
     return paddingTop();
 }
 
+LayoutUnit RenderFlexibleBox::flowAwarePaddingAfter() const
+{
+    switch (transformedWritingMode()) {
+    case TopToBottomWritingMode:
+        return paddingBottom();
+    case BottomToTopWritingMode:
+        return paddingTop();
+    case LeftToRightWritingMode:
+        return paddingRight();
+    case RightToLeftWritingMode:
+        return paddingLeft();
+    }
+    ASSERT_NOT_REACHED();
+    return paddingTop();
+}
+
 LayoutUnit RenderFlexibleBox::flowAwareMarginStartForChild(RenderBox* child) const
 {
     if (isHorizontalFlow())
@@ -458,7 +527,7 @@ LayoutUnit RenderFlexibleBox::flowAwareMarginAfterForChild(RenderBox* child) con
 
 LayoutUnit RenderFlexibleBox::crossAxisMarginExtentForChild(RenderBox* child) const
 {
-    return isHorizontalFlow() ? child->marginTop() + child->marginBottom() : child->marginLeft() + child->marginRight();
+    return isHorizontalFlow() ? child->marginHeight() : child->marginWidth();
 }
 
 LayoutUnit RenderFlexibleBox::crossAxisScrollbarExtent() const
@@ -509,17 +578,34 @@ void RenderFlexibleBox::layoutFlexItems(bool relayoutChildren)
     float totalPositiveFlexibility;
     float totalNegativeFlexibility;
     FlexOrderIterator flexIterator(this, flexOrderValues);
-    computeFlexOrder(flexIterator, orderedChildren, preferredMainAxisExtent, totalPositiveFlexibility, totalNegativeFlexibility);
 
-    LayoutUnit availableFreeSpace = mainAxisContentExtent() - preferredMainAxisExtent;
-    InflexibleFlexItemSize inflexibleItems;
-    WTF::Vector<LayoutUnit> childSizes;
-    while (!runFreeSpaceAllocationAlgorithm(orderedChildren, availableFreeSpace, totalPositiveFlexibility, totalNegativeFlexibility, inflexibleItems, childSizes)) {
-        ASSERT(totalPositiveFlexibility >= 0 && totalNegativeFlexibility >= 0);
-        ASSERT(inflexibleItems.size() > 0);
+    // For wrap-reverse, we need to layout as wrap, then reverse the lines. The next two arrays
+    // are some extra information so it's possible to reverse the lines.
+    WrapReverseContext wrapReverseContext(style()->flexWrap());
+
+    LayoutUnit crossAxisOffset = flowAwareBorderBefore() + flowAwarePaddingBefore();
+    LayoutUnit mainAxisFlexibleSpace = mainAxisContentExtent();
+    while (computeNextFlexLine(flexIterator, orderedChildren, preferredMainAxisExtent, totalPositiveFlexibility, totalNegativeFlexibility)) {
+        LayoutUnit availableFreeSpace = mainAxisFlexibleSpace - preferredMainAxisExtent;
+        InflexibleFlexItemSize inflexibleItems;
+        WTF::Vector<LayoutUnit> childSizes;
+        while (!runFreeSpaceAllocationAlgorithm(orderedChildren, availableFreeSpace, totalPositiveFlexibility, totalNegativeFlexibility, inflexibleItems, childSizes)) {
+            ASSERT(totalPositiveFlexibility >= 0 && totalNegativeFlexibility >= 0);
+            ASSERT(inflexibleItems.size() > 0);
+        }
+
+        wrapReverseContext.addNumberOfChildrenOnLine(orderedChildren.size());
+        wrapReverseContext.addCrossAxisOffset(crossAxisOffset);
+        layoutAndPlaceChildren(crossAxisOffset, orderedChildren, childSizes, availableFreeSpace);
+    }
+
+    if (wrapReverseContext.isWrapReverse) {
+        wrapReverseContext.addCrossAxisOffset(crossAxisOffset);
+        flipForWrapReverse(flexIterator, wrapReverseContext);
     }
 
-    layoutAndPlaceChildren(orderedChildren, childSizes, availableFreeSpace);
+    // direction:rtl + flex-direction:column means the cross-axis direction is flipped.
+    flipForRightToLeftColumn(flexIterator);
 }
 
 float RenderFlexibleBox::positiveFlexForChild(RenderBox* child) const
@@ -532,14 +618,13 @@ float RenderFlexibleBox::negativeFlexForChild(RenderBox* child) const
     return isHorizontalFlow() ? child->style()->flexboxWidthNegativeFlex() : child->style()->flexboxHeightNegativeFlex();
 }
 
-LayoutUnit RenderFlexibleBox::availableAlignmentSpaceForChild(RenderBox* child)
+LayoutUnit RenderFlexibleBox::availableAlignmentSpaceForChild(LayoutUnit lineCrossAxisExtent, RenderBox* child)
 {
-    LayoutUnit crossContentExtent = crossAxisContentExtent();
     LayoutUnit childCrossExtent = crossAxisMarginExtentForChild(child) + crossAxisExtentForChild(child);
-    return crossContentExtent - childCrossExtent;
+    return lineCrossAxisExtent - childCrossExtent;
 }
 
-LayoutUnit RenderFlexibleBox::marginBoxAscent(RenderBox* child)
+LayoutUnit RenderFlexibleBox::marginBoxAscentForChild(RenderBox* child)
 {
     LayoutUnit ascent = child->firstLineBoxBaseline();
     if (ascent == -1)
@@ -576,28 +661,35 @@ void RenderFlexibleBox::computeMainAxisPreferredSizes(bool relayoutChildren, Fle
     }
 }
 
-void RenderFlexibleBox::computeFlexOrder(FlexOrderIterator& iterator, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility)
+bool RenderFlexibleBox::computeNextFlexLine(FlexOrderIterator& iterator, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility)
 {
     orderedChildren.clear();
     preferredMainAxisExtent = 0;
     totalPositiveFlexibility = totalNegativeFlexibility = 0;
-    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
-        orderedChildren.append(child);
-        if (child->isPositioned())
+
+    if (!iterator.currentChild())
+        return false;
+
+    for (RenderBox* child = iterator.currentChild(); child; child = iterator.next()) {
+        if (child->isPositioned()) {
+            orderedChildren.append(child);
             continue;
+        }
 
         LayoutUnit childMainAxisExtent = mainAxisBorderAndPaddingExtentForChild(child) + preferredMainAxisContentExtentForChild(child);
         if (isHorizontalFlow())
-            childMainAxisExtent += child->marginLeft() + child->marginRight();
+            childMainAxisExtent += child->marginWidth();
         else
-            childMainAxisExtent += child->marginTop() + child->marginBottom();
+            childMainAxisExtent += child->marginHeight();
 
-        // FIXME: When implementing multiline, we would return here if adding
-        // the child's main axis extent would cause us to overflow.
+        if (isMultiline() && preferredMainAxisExtent + childMainAxisExtent > mainAxisContentExtent() && orderedChildren.size() > 0)
+            break;
+        orderedChildren.append(child);
         preferredMainAxisExtent += childMainAxisExtent;
         totalPositiveFlexibility += positiveFlexForChild(child);
         totalNegativeFlexibility += negativeFlexForChild(child);
     }
+    return true;
 }
 
 // Returns true if we successfully ran the algorithm and sized the flex items.
@@ -707,20 +799,28 @@ static EFlexAlign flexAlignForChild(RenderBox* child)
 {
     EFlexAlign align = child->style()->flexItemAlign();
     if (align == AlignAuto)
-        return child->parent()->style()->flexAlign();
+        align = child->parent()->style()->flexAlign();
+
+    if (child->parent()->style()->flexWrap() == FlexWrapReverse) {
+        if (align == AlignStart)
+            align = AlignEnd;
+        else if (align == AlignEnd)
+            align = AlignStart;
+    }
+
     return align;
 }
 
-void RenderFlexibleBox::layoutAndPlaceChildren(const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace)
+void RenderFlexibleBox::layoutAndPlaceChildren(LayoutUnit& crossAxisOffset, const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace)
 {
     LayoutUnit mainAxisOffset = flowAwareBorderStart() + flowAwarePaddingStart();
     mainAxisOffset += initialPackingOffset(availableFreeSpace, style()->flexPack(), childSizes.size());
     if (style()->flexDirection() == FlowRowReverse)
         mainAxisOffset += isHorizontalFlow() ? verticalScrollbarWidth() : horizontalScrollbarHeight();
 
-    LayoutUnit crossAxisOffset = flowAwareBorderBefore() + flowAwarePaddingBefore();
     LayoutUnit totalMainExtent = mainAxisExtent();
     LayoutUnit maxAscent = 0, maxDescent = 0; // Used when flex-align: baseline.
+    LayoutUnit maxChildCrossAxisExtent = 0;
     bool shouldFlipMainAxis = !isColumnFlow() && !isLeftToRightFlow();
     for (size_t i = 0; i < children.size(); ++i) {
         RenderBox* child = children[i];
@@ -734,19 +834,20 @@ void RenderFlexibleBox::layoutAndPlaceChildren(const OrderedFlexItemList& childr
         child->setChildNeedsLayout(true);
         child->layoutIfNeeded();
 
-        LayoutUnit childCrossAxisExtent;
+        LayoutUnit childCrossAxisMarginBoxExtent;
         if (flexAlignForChild(child) == AlignBaseline) {
-            LayoutUnit ascent = marginBoxAscent(child);
+            LayoutUnit ascent = marginBoxAscentForChild(child);
             LayoutUnit descent = (crossAxisMarginExtentForChild(child) + crossAxisExtentForChild(child)) - ascent;
 
             maxAscent = std::max(maxAscent, ascent);
             maxDescent = std::max(maxDescent, descent);
 
-            childCrossAxisExtent = maxAscent + maxDescent;
+            childCrossAxisMarginBoxExtent = maxAscent + maxDescent;
         } else
-            childCrossAxisExtent =  crossAxisExtentForChild(child);
+            childCrossAxisMarginBoxExtent = crossAxisExtentForChild(child) + crossAxisMarginExtentForChild(child);
         if (crossAxisLength().isAuto())
-            setCrossAxisExtent(std::max(crossAxisExtent(), crossAxisBorderAndPaddingExtent() + crossAxisMarginExtentForChild(child) + childCrossAxisExtent + crossAxisScrollbarExtent()));
+            setCrossAxisExtent(std::max(crossAxisExtent(), crossAxisOffset + flowAwareBorderAfter() + flowAwarePaddingAfter() + childCrossAxisMarginBoxExtent + crossAxisScrollbarExtent()));
+        maxChildCrossAxisExtent = std::max(maxChildCrossAxisExtent, childCrossAxisMarginBoxExtent);
 
         mainAxisOffset += flowAwareMarginStartForChild(child);
 
@@ -759,22 +860,25 @@ void RenderFlexibleBox::layoutAndPlaceChildren(const OrderedFlexItemList& childr
         mainAxisOffset += childMainExtent + flowAwareMarginEndForChild(child);
 
         mainAxisOffset += packingSpaceBetweenChildren(availableFreeSpace, style()->flexPack(), childSizes.size());
-
-        if (isColumnFlow())
-            setLogicalHeight(mainAxisOffset + flowAwareBorderEnd() + flowAwarePaddingEnd() + scrollbarLogicalHeight());
     }
 
+    if (isColumnFlow())
+        setLogicalHeight(mainAxisOffset + flowAwareBorderEnd() + flowAwarePaddingEnd() + scrollbarLogicalHeight());
+
     if (style()->flexDirection() == FlowColumnReverse) {
         // We have to do an extra pass for column-reverse to reposition the flex items since the start depends
         // on the height of the flexbox, which we only know after we've positioned all the flex items.
         computeLogicalHeight();
-        layoutColumnReverse(children, childSizes, availableFreeSpace);
+        layoutColumnReverse(children, childSizes, crossAxisOffset, availableFreeSpace);
     }
 
-    alignChildren(children, maxAscent);
+    LayoutUnit lineCrossAxisExtent = isMultiline() ? maxChildCrossAxisExtent : crossAxisContentExtent();
+    alignChildren(children, lineCrossAxisExtent, maxAscent);
+
+    crossAxisOffset += lineCrossAxisExtent;
 }
 
-void RenderFlexibleBox::layoutColumnReverse(const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace)
+void RenderFlexibleBox::layoutColumnReverse(const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit crossAxisOffset, LayoutUnit availableFreeSpace)
 {
     // This is similar to the logic in layoutAndPlaceChildren, except we place the children
     // starting from the end of the flexbox. We also don't need to layout anything since we're
@@ -783,7 +887,6 @@ void RenderFlexibleBox::layoutColumnReverse(const OrderedFlexItemList& children,
     mainAxisOffset -= initialPackingOffset(availableFreeSpace, style()->flexPack(), childSizes.size());
     mainAxisOffset -= isHorizontalFlow() ? verticalScrollbarWidth() : horizontalScrollbarHeight();
 
-    LayoutUnit crossAxisOffset = flowAwareBorderBefore() + flowAwarePaddingBefore();
     for (size_t i = 0; i < children.size(); ++i) {
         RenderBox* child = children[i];
         if (child->isPositioned()) {
@@ -816,9 +919,9 @@ void RenderFlexibleBox::adjustAlignmentForChild(RenderBox* child, LayoutUnit del
         child->repaintDuringLayoutIfMoved(oldRect);
 }
 
-void RenderFlexibleBox::alignChildren(const OrderedFlexItemList& children, LayoutUnit maxAscent)
+void RenderFlexibleBox::alignChildren(const OrderedFlexItemList& children, LayoutUnit lineCrossAxisExtent, LayoutUnit maxAscent)
 {
-    LayoutUnit crossExtent = crossAxisExtent();
+    LayoutUnit minMarginAfterBaseline = std::numeric_limits<LayoutUnit>::max();
 
     for (size_t i = 0; i < children.size(); ++i) {
         RenderBox* child = children[i];
@@ -829,7 +932,7 @@ void RenderFlexibleBox::alignChildren(const OrderedFlexItemList& children, Layou
         case AlignStretch: {
             if (!isColumnFlow() && child->style()->logicalHeight().isAuto()) {
                 LayoutUnit logicalHeightBefore = child->logicalHeight();
-                LayoutUnit stretchedLogicalHeight = child->logicalHeight() + RenderFlexibleBox::availableAlignmentSpaceForChild(child);
+                LayoutUnit stretchedLogicalHeight = child->logicalHeight() + availableAlignmentSpaceForChild(lineCrossAxisExtent, child);
                 child->setLogicalHeight(stretchedLogicalHeight);
                 child->computeLogicalHeight();
 
@@ -839,31 +942,83 @@ void RenderFlexibleBox::alignChildren(const OrderedFlexItemList& children, Layou
                     child->setChildNeedsLayout(true);
                     child->layoutIfNeeded();
                 }
+            } else if (isColumnFlow() && child->style()->logicalWidth().isAuto() && isMultiline()) {
+                // FIXME: Handle min-width and max-width.
+                LayoutUnit childWidth = lineCrossAxisExtent - crossAxisMarginExtentForChild(child);
+                child->setOverrideWidth(std::max(0, childWidth));
+                child->setChildNeedsLayout(true);
+                child->layoutIfNeeded();
             }
+            // Since wrap-reverse flips cross start and cross end, strech children should be aligned with the cross end.
+            if (style()->flexWrap() == FlexWrapReverse)
+                adjustAlignmentForChild(child, availableAlignmentSpaceForChild(lineCrossAxisExtent, child));
             break;
         }
         case AlignStart:
             break;
         case AlignEnd:
-            adjustAlignmentForChild(child, RenderFlexibleBox::availableAlignmentSpaceForChild(child));
+            adjustAlignmentForChild(child, availableAlignmentSpaceForChild(lineCrossAxisExtent, child));
             break;
         case AlignCenter:
-            adjustAlignmentForChild(child, RenderFlexibleBox::availableAlignmentSpaceForChild(child) / 2);
+            adjustAlignmentForChild(child, availableAlignmentSpaceForChild(lineCrossAxisExtent, child) / 2);
             break;
         case AlignBaseline: {
-            LayoutUnit ascent = marginBoxAscent(child);
-            adjustAlignmentForChild(child, maxAscent - ascent);
+            LayoutUnit ascent = marginBoxAscentForChild(child);
+            LayoutUnit startOffset = maxAscent - ascent;
+            adjustAlignmentForChild(child, startOffset);
+
+            if (style()->flexWrap() == FlexWrapReverse)
+                minMarginAfterBaseline = std::min(minMarginAfterBaseline, availableAlignmentSpaceForChild(lineCrossAxisExtent, child) - startOffset);
             break;
         }
         }
+    }
 
-        // direction:rtl + flex-direction:column means the cross-axis direction is flipped.
-        if (!style()->isLeftToRightDirection() && isColumnFlow()) {
-            LayoutPoint location = flowAwareLocationForChild(child);
-            location.setY(crossExtent - crossAxisExtentForChild(child) - location.y());
-            setFlowAwareLocationForChild(child, location);
+    // wrap-reverse flips the cross axis start and end. For baseline alignment, this means we
+    // need to align the after edge of baseline elements with the after edge of the flex line.
+    if (style()->flexWrap() == FlexWrapReverse && minMarginAfterBaseline) {
+        for (size_t i = 0; i < children.size(); ++i) {
+            RenderBox* child = children[i];
+            if (flexAlignForChild(child) == AlignBaseline)
+                adjustAlignmentForChild(child, minMarginAfterBaseline);
         }
+    }
+}
+
+void RenderFlexibleBox::flipForRightToLeftColumn(FlexOrderIterator& iterator)
+{
+    if (style()->isLeftToRightDirection() || !isColumnFlow())
+        return;
+
+    LayoutUnit crossExtent = crossAxisExtent();
+    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
+        LayoutPoint location = flowAwareLocationForChild(child);
+        location.setY(crossExtent - crossAxisExtentForChild(child) - location.y());
+        setFlowAwareLocationForChild(child, location);
+    }
+}
 
+void RenderFlexibleBox::flipForWrapReverse(FlexOrderIterator& iterator, const WrapReverseContext& wrapReverseContext)
+{
+    if (!isColumnFlow())
+        computeLogicalHeight();
+
+    size_t currentChild = 0;
+    size_t lineNumber = 0;
+    LayoutUnit contentExtent = crossAxisContentExtent();
+    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
+        LayoutPoint location = flowAwareLocationForChild(child);
+        location.setY(location.y() + wrapReverseContext.lineCrossAxisDelta(lineNumber, contentExtent));
+
+        LayoutRect oldRect = child->frameRect();
+        setFlowAwareLocationForChild(child, location);
+        if (!selfNeedsLayout() && child->checkForRepaintDuringLayout())
+            child->repaintDuringLayoutIfMoved(oldRect);
+
+        if (++currentChild == wrapReverseContext.childrenPerLine[lineNumber]) {
+            ++lineNumber;
+            currentChild = 0;
+        }
     }
 }
 
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.h b/Source/WebCore/rendering/RenderFlexibleBox.h
index 0ee715f7e..3490bf1c6 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.h
+++ b/Source/WebCore/rendering/RenderFlexibleBox.h
@@ -56,9 +56,12 @@ private:
     typedef WTF::HashMap<const RenderBox*, LayoutUnit> InflexibleFlexItemSize;
     typedef WTF::Vector<RenderBox*> OrderedFlexItemList;
 
+    struct WrapReverseContext;
+
     bool hasOrthogonalFlow(RenderBox* child) const;
     bool isColumnFlow() const;
     bool isLeftToRightFlow() const;
+    bool isMultiline() const;
     Length crossAxisLength() const;
     Length mainAxisLengthForChild(RenderBox* child) const;
     void setCrossAxisExtent(LayoutUnit);
@@ -70,12 +73,13 @@ private:
     LayoutUnit mainAxisContentExtent() const;
     WritingMode transformedWritingMode() const;
     LayoutUnit flowAwareBorderStart() const;
-    LayoutUnit flowAwareBorderBefore() const;
     LayoutUnit flowAwareBorderEnd() const;
-    LayoutUnit crossAxisBorderAndPaddingExtent() const;
+    LayoutUnit flowAwareBorderBefore() const;
+    LayoutUnit flowAwareBorderAfter() const;
     LayoutUnit flowAwarePaddingStart() const;
-    LayoutUnit flowAwarePaddingBefore() const;
     LayoutUnit flowAwarePaddingEnd() const;
+    LayoutUnit flowAwarePaddingBefore() const;
+    LayoutUnit flowAwarePaddingAfter() const;
     LayoutUnit flowAwareMarginStartForChild(RenderBox* child) const;
     LayoutUnit flowAwareMarginEndForChild(RenderBox* child) const;
     LayoutUnit flowAwareMarginBeforeForChild(RenderBox* child) const;
@@ -95,17 +99,19 @@ private:
     float positiveFlexForChild(RenderBox* child) const;
     float negativeFlexForChild(RenderBox* child) const;
 
-    LayoutUnit availableAlignmentSpaceForChild(RenderBox*);
-    LayoutUnit marginBoxAscent(RenderBox*);
+    LayoutUnit availableAlignmentSpaceForChild(LayoutUnit lineCrossAxisExtent, RenderBox*);
+    LayoutUnit marginBoxAscentForChild(RenderBox*);
 
     void computeMainAxisPreferredSizes(bool relayoutChildren, FlexOrderHashSet&);
-    void computeFlexOrder(FlexOrderIterator&, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility);
+    bool computeNextFlexLine(FlexOrderIterator&, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility);
     bool runFreeSpaceAllocationAlgorithm(const OrderedFlexItemList&, LayoutUnit& availableFreeSpace, float& totalPositiveFlexibility, float& totalNegativeFlexibility, InflexibleFlexItemSize&, WTF::Vector<LayoutUnit>& childSizes);
     void setLogicalOverrideSize(RenderBox* child, LayoutUnit childPreferredSize);
     void prepareChildForPositionedLayout(RenderBox* child, LayoutUnit mainAxisOffset, LayoutUnit crossAxisOffset);
-    void layoutAndPlaceChildren(const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace);
-    void layoutColumnReverse(const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace);
-    void alignChildren(const OrderedFlexItemList&, LayoutUnit maxAscent);
+    void layoutAndPlaceChildren(LayoutUnit& crossAxisOffset, const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace);
+    void layoutColumnReverse(const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit crossAxisOffset, LayoutUnit availableFreeSpace);
+    void alignChildren(const OrderedFlexItemList&, LayoutUnit lineCrossAxisExtent, LayoutUnit maxAscent);
+    void flipForRightToLeftColumn(FlexOrderIterator&);
+    void flipForWrapReverse(FlexOrderIterator&, const WrapReverseContext&);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderFlowThread.cpp b/Source/WebCore/rendering/RenderFlowThread.cpp
index 9e47d4dc9..e241d9670 100644
--- a/Source/WebCore/rendering/RenderFlowThread.cpp
+++ b/Source/WebCore/rendering/RenderFlowThread.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -13,7 +13,7 @@
  *    disclaimer in the documentation and/or other materials
  *    provided with the distribution.
  * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
@@ -905,4 +905,70 @@ void RenderFlowThread::computeOverflowStateForRegions(LayoutUnit oldClientAfterE
     m_overflow = lastReg && (lastReg->regionState() == RenderRegion::RegionOverflow);
 }
 
+bool RenderFlowThread::regionInRange(const RenderRegion* targetRegion, const RenderRegion* startRegion, const RenderRegion* endRegion) const
+{
+    ASSERT(targetRegion);
+
+    for (RenderRegionList::const_iterator it = m_regionList.find(const_cast<RenderRegion*>(startRegion)); it != m_regionList.end(); ++it) {
+        const RenderRegion* currRegion = *it;
+        if (!currRegion->isValid())
+            continue;
+        if (targetRegion == currRegion)
+            return true;
+        if (currRegion == endRegion)
+            break;
+    }
+
+    return false;
+}
+
+bool RenderFlowThread::objectInFlowRegion(const RenderObject* object, const RenderRegion* region) const
+{
+    ASSERT(object);
+    ASSERT(region);
+
+    if (!object->inRenderFlowThread())
+        return false;
+    if (object->enclosingRenderFlowThread() != this)
+        return false;
+    if (!m_regionList.contains(const_cast<RenderRegion*>(region)))
+        return false;
+
+    RenderBox* enclosingBox = object->enclosingBox();
+    RenderRegion* enclosingBoxStartRegion = 0;
+    RenderRegion* enclosingBoxEndRegion = 0;
+    getRegionRangeForBox(enclosingBox, enclosingBoxStartRegion, enclosingBoxEndRegion);
+    if (!regionInRange(region, enclosingBoxStartRegion, enclosingBoxEndRegion))
+        return false;
+
+    if (object->isBox())
+        return true;
+
+    LayoutRect objectABBRect = object->absoluteBoundingBoxRect(true);
+    if (!objectABBRect.width())
+        objectABBRect.setWidth(1);
+    if (!objectABBRect.height())
+        objectABBRect.setHeight(1); 
+    if (objectABBRect.intersects(region->absoluteBoundingBoxRect(true)))
+        return true;
+
+    if (region == lastRegion()) {
+        // If the object does not intersect any of the enclosing box regions
+        // then the object is in last region.
+        for (RenderRegionList::const_iterator it = m_regionList.find(enclosingBoxStartRegion); it != m_regionList.end(); ++it) {
+            const RenderRegion* currRegion = *it;
+            if (!region->isValid())
+                continue;
+            if (currRegion == region)
+                break;
+            if (objectABBRect.intersects(currRegion->absoluteBoundingBoxRect(true)))
+                return false;
+        }
+        return true;
+    }
+
+    return false;
+}
+
 } // namespace WebCore
+
diff --git a/Source/WebCore/rendering/RenderFlowThread.h b/Source/WebCore/rendering/RenderFlowThread.h
index d05938891..b958eb164 100644
--- a/Source/WebCore/rendering/RenderFlowThread.h
+++ b/Source/WebCore/rendering/RenderFlowThread.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -13,7 +13,7 @@
  *    disclaimer in the documentation and/or other materials
  *    provided with the distribution.
  * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
@@ -136,6 +136,10 @@ public:
     void computeOverflowStateForRegions(LayoutUnit oldClientAfterEdge);
 
     bool overflow() const { return m_overflow; }
+
+    // Check if the object is in region and the region is part of this flow thread.
+    bool objectInFlowRegion(const RenderObject*, const RenderRegion*) const;
+
 private:
     virtual const char* renderName() const { return "RenderFlowThread"; }
 
@@ -146,6 +150,8 @@ private:
 
     bool shouldRepaint(const LayoutRect&) const;
 
+    bool regionInRange(const RenderRegion* targetRegion, const RenderRegion* startRegion, const RenderRegion* endRegion) const;
+
     typedef ListHashSet<RenderObject*> FlowThreadChildList;
     FlowThreadChildList m_flowThreadChildList;
 
diff --git a/Source/WebCore/rendering/RenderHTMLCanvas.cpp b/Source/WebCore/rendering/RenderHTMLCanvas.cpp
index 7ce0681fb..0df9fe998 100644
--- a/Source/WebCore/rendering/RenderHTMLCanvas.cpp
+++ b/Source/WebCore/rendering/RenderHTMLCanvas.cpp
@@ -58,13 +58,16 @@ bool RenderHTMLCanvas::requiresLayer() const
 
 void RenderHTMLCanvas::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
 {
+    LayoutRect rect = contentBoxRect();
+    rect.moveBy(paintOffset);
+
     if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
+        if (Page* page = frame->page()) {
+            if (paintInfo.phase == PaintPhaseForeground)
+                page->addRelevantRepaintedObject(this, rect);
+        }
     }
 
-    LayoutRect rect = contentBoxRect();
-    rect.moveBy(paintOffset);
     bool useLowQualityScale = style()->imageRendering() == ImageRenderingOptimizeContrast;
     static_cast<HTMLCanvasElement*>(node())->paint(paintInfo.context, rect, useLowQualityScale);
 }
diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
index de3e7e190..6406f6f66 100644
--- a/Source/WebCore/rendering/RenderImage.cpp
+++ b/Source/WebCore/rendering/RenderImage.cpp
@@ -264,10 +264,17 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
 
     GraphicsContext* context = paintInfo.context;
 
+    Page* page = 0;
+    if (Frame* frame = this->frame())
+        page = frame->page();
+
     if (!m_imageResource->hasImage() || m_imageResource->errorOccurred()) {
         if (paintInfo.phase == PaintPhaseSelection)
             return;
 
+        if (page && paintInfo.phase == PaintPhaseForeground)
+            page->addRelevantUnpaintedObject(this, visualOverflowRect());
+
         if (cWidth > 2 && cHeight > 2) {
             // Draw an outline rect where the image should be.
             context->setStrokeStyle(SolidStroke);
@@ -325,13 +332,11 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
         }
     } else if (m_imageResource->hasImage() && cWidth > 0 && cHeight > 0) {
         RefPtr<Image> img = m_imageResource->image(cWidth, cHeight);
-        if (!img || img->isNull())
+        if (!img || img->isNull()) {
+            if (page && paintInfo.phase == PaintPhaseForeground)
+                page->addRelevantUnpaintedObject(this, visualOverflowRect());
             return;
-
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
+        }
 
 #if PLATFORM(MAC)
         if (style()->highlight() != nullAtom && !paintInfo.context->paintingDisabled())
@@ -342,6 +347,15 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
         LayoutPoint contentLocation = paintOffset;
         contentLocation.move(leftBorder + leftPad, topBorder + topPad);
         paintIntoRect(context, LayoutRect(contentLocation, contentSize));
+        
+        if (cachedImage() && page && paintInfo.phase == PaintPhaseForeground) {
+            // For now, count images as unpainted if they are still progressively loading. We may want 
+            // to refine this in the future to account for the portion of the image that has painted.
+            if (cachedImage()->isLoading())
+                page->addRelevantUnpaintedObject(this, LayoutRect(contentLocation, contentSize));
+            else
+                page->addRelevantRepaintedObject(this, LayoutRect(contentLocation, contentSize));
+        }
     }
 }
 
@@ -490,8 +504,8 @@ void RenderImage::updateAltText()
 
 LayoutUnit RenderImage::computeReplacedLogicalWidth(bool includeMaxWidth) const
 {
-    // If we've got an explicit width/height assigned, propagate it to the image resource.    
-    if (style()->logicalWidth().isFixed() && style()->logicalHeight().isFixed()) {
+    // If we've got an explicit width/height assigned, propagate it to the image resource.
+    if (style()->logicalWidth().isSpecified() && style()->logicalHeight().isSpecified()) {
         LayoutUnit width = RenderReplaced::computeReplacedLogicalWidth(includeMaxWidth);
         m_imageResource->setContainerSizeForRenderer(IntSize(width, computeReplacedLogicalHeight()));
         return width;
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index 3be57ae0a..0a5a65ee9 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -507,15 +507,15 @@ void RenderInline::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
     m_lineBoxes.paint(this, paintInfo, paintOffset);
 }
 
-void RenderInline::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
+void RenderInline::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
     if (!alwaysCreateLineBoxes())
         culledInlineAbsoluteRects(this, rects, toLayoutSize(accumulatedOffset));
     else if (InlineFlowBox* curr = firstLineBox()) {
         for (; curr; curr = curr->nextLineBox())
-            rects.append(enclosingLayoutRect(FloatRect(accumulatedOffset + curr->topLeft(), curr->size())));
+            rects.append(enclosingIntRect(FloatRect(accumulatedOffset + curr->topLeft(), curr->size())));
     } else
-        rects.append(LayoutRect(accumulatedOffset, LayoutSize()));
+        rects.append(IntRect(roundedIntPoint(accumulatedOffset), IntSize()));
 
     if (continuation()) {
         if (continuation()->isBox()) {
@@ -526,7 +526,7 @@ void RenderInline::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& a
     }
 }
 
-void RenderInline::culledInlineAbsoluteRects(const RenderInline* container, Vector<LayoutRect>& rects, const LayoutSize& offset) const
+void RenderInline::culledInlineAbsoluteRects(const RenderInline* container, Vector<IntRect>& rects, const LayoutSize& offset) const
 {
     if (!culledInlineFirstLineBox()) {
         rects.append(IntRect(offset.width(), offset.height(), 0, 0));
@@ -548,9 +548,9 @@ void RenderInline::culledInlineAbsoluteRects(const RenderInline* container, Vect
                 int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
                 FloatRect result;
                 if (isHorizontal)
-                    result = FloatRect(offset.width() + currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), offset.height() + logicalTop, currBox->width() + currBox->marginLeft() + currBox->marginRight(), logicalHeight);
+                    result = FloatRect(offset.width() + currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), offset.height() + logicalTop, currBox->width() + currBox->marginWidth(), logicalHeight);
                 else
-                    result = FloatRect(offset.width() + logicalTop, offset.height() + currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginTop() + currBox->marginBottom());
+                    result = FloatRect(offset.width() + logicalTop, offset.height() + currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginHeight());
                 rects.append(enclosingIntRect(result));
             }
         } else if (curr->isRenderInline()) {
@@ -632,9 +632,9 @@ void RenderInline::culledInlineAbsoluteQuads(const RenderInline* container, Vect
                 int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
                 FloatRect result;
                 if (isHorizontal)
-                    result = FloatRect(currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), logicalTop, currBox->width() + currBox->marginLeft() + currBox->marginRight(), logicalHeight);
+                    result = FloatRect(currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), logicalTop, currBox->width() + currBox->marginWidth(), logicalHeight);
                 else
-                    result = FloatRect(logicalTop, currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginTop() + currBox->marginBottom());
+                    result = FloatRect(logicalTop, currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginHeight());
                 quads.append(localToAbsoluteQuad(result));
             }
         } else if (curr->isRenderInline()) {
@@ -838,9 +838,9 @@ FloatRect RenderInline::culledInlineBoundingBox(const RenderInline* container) c
                 int logicalTop = rootBox->logicalTop() + (rootBox->renderer()->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent() - container->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent());
                 int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
                 if (isHorizontal)
-                    result.uniteIfNonZero(FloatRect(currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), logicalTop, currBox->width() + currBox->marginLeft() + currBox->marginRight(), logicalHeight));
+                    result.uniteIfNonZero(FloatRect(currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), logicalTop, currBox->width() + currBox->marginWidth(), logicalHeight));
                 else
-                    result.uniteIfNonZero(FloatRect(logicalTop, currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginTop() + currBox->marginBottom()));
+                    result.uniteIfNonZero(FloatRect(logicalTop, currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginHeight()));
             }
         } else if (curr->isRenderInline()) {
             // If the child doesn't need line boxes either, then we can recur.
@@ -1033,7 +1033,7 @@ LayoutRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
         LayoutRect repaintRect(r);
         repaintRect.move(-cb->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
 
-        LayoutRect boxRect(LayoutPoint(), cb->layer()->size());
+        LayoutRect boxRect(LayoutPoint(), cb->cachedSizeForOverflowClip());
         r = intersection(repaintRect, boxRect);
     }
     
@@ -1135,7 +1135,7 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
         topLeft -= containerBox->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
 
         LayoutRect repaintRect(topLeft, rect.size());
-        LayoutRect boxRect(LayoutPoint(), containerBox->layer()->size());
+        LayoutRect boxRect(LayoutPoint(), containerBox->cachedSizeForOverflowClip());
         rect = intersection(repaintRect, boxRect);
         if (rect.isEmpty())
             return;
@@ -1368,13 +1368,13 @@ void RenderInline::imageChanged(WrappedImagePtr, const IntRect*)
     repaint();
 }
 
-void RenderInline::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint& additionalOffset)
+void RenderInline::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint& additionalOffset)
 {
     if (!alwaysCreateLineBoxes())
         culledInlineAbsoluteRects(this, rects, toLayoutSize(additionalOffset));
     else {
         for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-            rects.append(enclosingLayoutRect(FloatRect(additionalOffset.x() + curr->x(), additionalOffset.y() + curr->y(), curr->width(), curr->height())));
+            rects.append(enclosingIntRect(FloatRect(additionalOffset.x() + curr->x(), additionalOffset.y() + curr->y(), curr->width(), curr->height())));
     }
 
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
@@ -1587,14 +1587,6 @@ void RenderInline::addDashboardRegions(Vector<DashboardRegionValue>& regions)
         region.bounds.setX(absPos.x() + region.bounds.x());
         region.bounds.setY(absPos.y() + region.bounds.y());
 
-        if (frame()) {
-            float deviceScaleFactor = frame()->page()->deviceScaleFactor();
-            if (deviceScaleFactor != 1.0f) {
-                region.bounds.scale(deviceScaleFactor);
-                region.clip.scale(deviceScaleFactor);
-            }
-        }
-
         regions.append(region);
     }
 }
diff --git a/Source/WebCore/rendering/RenderInline.h b/Source/WebCore/rendering/RenderInline.h
index 557ce59a0..0cb026448 100644
--- a/Source/WebCore/rendering/RenderInline.h
+++ b/Source/WebCore/rendering/RenderInline.h
@@ -46,7 +46,7 @@ public:
     virtual LayoutUnit marginStart() const;
     virtual LayoutUnit marginEnd() const;
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
 
     virtual LayoutSize offsetFromContainer(RenderObject*, const LayoutPoint&) const;
@@ -73,7 +73,7 @@ public:
     
     LayoutSize relativePositionedInlineOffset(const RenderBox* child) const;
 
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
     void paintOutline(GraphicsContext*, const LayoutPoint&);
 
     using RenderBoxModelObject::continuation;
@@ -102,7 +102,7 @@ private:
     LayoutRect culledInlineVisualOverflowBoundingBox() const;
     InlineBox* culledInlineFirstLineBox() const;
     InlineBox* culledInlineLastLineBox() const;
-    void culledInlineAbsoluteRects(const RenderInline* container, Vector<LayoutRect>&, const LayoutSize&) const;
+    void culledInlineAbsoluteRects(const RenderInline* container, Vector<IntRect>&, const LayoutSize&) const;
     void culledInlineAbsoluteQuads(const RenderInline* container, Vector<FloatQuad>&) const;
 
     void addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild);
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index a5b028b65..9cf767ee8 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -108,7 +108,7 @@
 #include "SVGNames.h"
 #endif
 
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
 // FIXME: border radius clipping triggers too-slow path on Chromium
 // https://bugs.webkit.org/show_bug.cgi?id=69866
 #define DISABLE_ROUNDED_CORNER_CLIPPING
@@ -153,7 +153,6 @@ RenderLayer::RenderLayer(RenderBoxModelObject* renderer)
     , m_paintingInsideReflection(false)
     , m_inOverflowRelayout(false)
     , m_repaintStatus(NeedsNormalRepaint)
-    , m_overflowStatusDirty(true)
     , m_visibleContentStatusDirty(true)
     , m_hasVisibleContent(false)
     , m_visibleDescendantStatusDirty(false)
@@ -1197,6 +1196,11 @@ void RenderLayer::removeOnlyThisLayer()
     bool hasLayerOffset;
     const LayoutPoint offsetFromRootBeforeMove = computeOffsetFromRoot(hasLayerOffset);
 
+    // Remove the child reflection layer before moving other child layers.
+    // The reflection layer should not be moved to the parent.
+    if (reflection())
+        removeChild(reflectionLayer());
+
     // Now walk our kids and reattach them to our parent.
     RenderLayer* current = m_first;
     while (current) {
@@ -1212,10 +1216,7 @@ void RenderLayer::removeOnlyThisLayer()
     }
 
     // Remove us from the parent.
-    if (reflection())
-        removeChild(reflectionLayer());
     m_parent->removeChild(this);
-
     m_renderer->destroyLayer();
 }
 
@@ -1386,7 +1387,7 @@ void RenderLayer::panScrollFromPoint(const LayoutPoint& sourcePoint)
     scrollByRecursively(adjustedScrollDelta(xDelta), adjustedScrollDelta(yDelta), ScrollOffsetClamped);
 }
 
-void RenderLayer::scrollByRecursively(LayoutUnit xDelta, LayoutUnit yDelta, ScrollOffsetClamping clamp)
+void RenderLayer::scrollByRecursively(int xDelta, int yDelta, ScrollOffsetClamping clamp)
 {
     if (!xDelta && !yDelta)
         return;
@@ -1396,13 +1397,13 @@ void RenderLayer::scrollByRecursively(LayoutUnit xDelta, LayoutUnit yDelta, Scro
         restrictedByLineClamp = !renderer()->parent()->style()->lineClamp().isNone();
 
     if (renderer()->hasOverflowClip() && !restrictedByLineClamp) {
-        LayoutUnit newOffsetX = scrollXOffset() + xDelta;
-        LayoutUnit newOffsetY = scrollYOffset() + yDelta;
+        int newOffsetX = scrollXOffset() + xDelta;
+        int newOffsetY = scrollYOffset() + yDelta;
         scrollToOffset(newOffsetX, newOffsetY, clamp);
 
         // If this layer can't do the scroll we ask the next layer up that can scroll to try
-        LayoutUnit leftToScrollX = newOffsetX - scrollXOffset();
-        LayoutUnit leftToScrollY = newOffsetY - scrollYOffset();
+        int leftToScrollX = newOffsetX - scrollXOffset();
+        int leftToScrollY = newOffsetY - scrollYOffset();
         if ((leftToScrollX || leftToScrollY) && renderer()->parent()) {
             if (RenderLayer* scrollableLayer = enclosingScrollableLayer())
                 scrollableLayer->scrollByRecursively(leftToScrollX, leftToScrollY);
@@ -1420,21 +1421,21 @@ void RenderLayer::scrollByRecursively(LayoutUnit xDelta, LayoutUnit yDelta, Scro
     }
 }
 
-void RenderLayer::scrollToOffset(LayoutUnit x, LayoutUnit y, ScrollOffsetClamping clamp)
+void RenderLayer::scrollToOffset(int x, int y, ScrollOffsetClamping clamp)
 {
     if (clamp == ScrollOffsetClamped) {
         RenderBox* box = renderBox();
         if (!box)
             return;
 
-        LayoutUnit maxX = scrollWidth() - box->clientWidth();
-        LayoutUnit maxY = scrollHeight() - box->clientHeight();
+        int maxX = scrollWidth() - box->clientWidth();
+        int maxY = scrollHeight() - box->clientHeight();
 
-        x = min(max<LayoutUnit>(x, 0), maxX);
-        y = min(max<LayoutUnit>(y, 0), maxY);
+        x = min(max(x, 0), maxX);
+        y = min(max(y, 0), maxY);
     }
 
-    LayoutPoint newScrollOffset(x, y);
+    IntPoint newScrollOffset(x, y);
     if (newScrollOffset != LayoutPoint(scrollXOffset(), scrollYOffset()))
         scrollToOffsetWithoutAnimation(newScrollOffset);
 }
@@ -1545,15 +1546,18 @@ void RenderLayer::scrollRectToVisible(const LayoutRect& rect, const ScrollAlignm
         LayoutRect exposeRect = LayoutRect(rect.x() + scrollXOffset(), rect.y() + scrollYOffset(), rect.width(), rect.height());
         LayoutRect r = getRectToExpose(layerBounds, exposeRect, alignX, alignY);
         
-        LayoutUnit xOffset = r.x() - absPos.x();
-        LayoutUnit yOffset = r.y() - absPos.y();
+        LayoutUnit adjustedX = r.x() - absPos.x();
+        LayoutUnit adjustedY = r.y() - absPos.y();
         // Adjust offsets if they're outside of the allowable range.
-        xOffset = max<LayoutUnit>(0, min(scrollWidth() - layerBounds.width(), xOffset));
-        yOffset = max<LayoutUnit>(0, min(scrollHeight() - layerBounds.height(), yOffset));
+        adjustedX = max<LayoutUnit>(0, min(scrollWidth() - layerBounds.width(), adjustedX));
+        adjustedY = max<LayoutUnit>(0, min(scrollHeight() - layerBounds.height(), adjustedY));
+
+        int xOffset = roundToInt(adjustedX);
+        int yOffset = roundToInt(adjustedY);
         
         if (xOffset != scrollXOffset() || yOffset != scrollYOffset()) {
-            LayoutUnit diffX = scrollXOffset();
-            LayoutUnit diffY = scrollYOffset();
+            int diffX = scrollXOffset();
+            int diffY = scrollYOffset();
             scrollToOffset(xOffset, yOffset);
             diffX = scrollXOffset() - diffX;
             diffY = scrollYOffset() - diffY;
@@ -1576,11 +1580,11 @@ void RenderLayer::scrollRectToVisible(const LayoutRect& rect, const ScrollAlignm
                     LayoutRect viewRect = frameView->visibleContentRect();
                     LayoutRect exposeRect = getRectToExpose(viewRect, rect, alignX, alignY);
 
-                    LayoutUnit xOffset = exposeRect.x();
-                    LayoutUnit yOffset = exposeRect.y();
+                    int xOffset = roundToInt(exposeRect.x());
+                    int yOffset = roundToInt(exposeRect.y());
                     // Adjust offsets if they're outside of the allowable range.
-                    xOffset = max<LayoutUnit>(0, min(frameView->contentsWidth(), xOffset));
-                    yOffset = max<LayoutUnit>(0, min(frameView->contentsHeight(), yOffset));
+                    xOffset = max(0, min(frameView->contentsWidth(), xOffset));
+                    yOffset = max(0, min(frameView->contentsHeight(), yOffset));
 
                     frameView->setScrollPosition(IntPoint(xOffset, yOffset));
                     parentLayer = ownerElement->renderer()->enclosingLayer();
@@ -1734,6 +1738,10 @@ void RenderLayer::resize(const PlatformMouseEvent& evt, const LayoutSize& oldOff
     element->setMinimumSizeForResizing(minimumSize);
     
     LayoutSize adjustedOldOffset = LayoutSize(oldOffset.width() / zoomFactor, oldOffset.height() / zoomFactor);
+    if (renderer->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft()) {
+        newOffset.setWidth(-newOffset.width());
+        adjustedOldOffset.setWidth(-adjustedOldOffset.width());
+    }
     
     LayoutSize difference = (currentSize + newOffset - adjustedOldOffset).expandedTo(minimumSize) - currentSize;
 
@@ -1829,6 +1837,13 @@ bool RenderLayer::isActive() const
     return page && page->focusController()->isActive();
 }
 
+static int cornerStart(const RenderLayer* layer, int minX, int maxX, int thickness)
+{
+    if (layer->renderer()->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+        return minX + layer->renderer()->style()->borderLeftWidth();
+    return maxX - thickness - layer->renderer()->style()->borderRightWidth();
+}
+
 static IntRect cornerRect(const RenderLayer* layer, const IntRect& bounds)
 {
     int horizontalThickness;
@@ -1848,7 +1863,7 @@ static IntRect cornerRect(const RenderLayer* layer, const IntRect& bounds)
         horizontalThickness = layer->verticalScrollbar()->width();
         verticalThickness = layer->horizontalScrollbar()->height();
     }
-    return IntRect(bounds.maxX() - horizontalThickness - layer->renderer()->style()->borderRightWidth(), 
+    return IntRect(cornerStart(layer, bounds.x(), bounds.maxX(), horizontalThickness),
                    bounds.maxY() - verticalThickness - layer->renderer()->style()->borderBottomWidth(),
                    horizontalThickness, verticalThickness);
 }
@@ -1971,15 +1986,32 @@ IntPoint RenderLayer::currentMousePosition() const
     return renderer()->frame() ? renderer()->frame()->eventHandler()->currentMousePosition() : IntPoint();
 }
 
+LayoutUnit RenderLayer::verticalScrollbarStart(int minX, int maxX) const
+{
+    const RenderBox* box = renderBox();
+    if (renderer()->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+        return minX + box->borderLeft();
+    return maxX - box->borderRight() - m_vBar->width();
+}
+
+LayoutUnit RenderLayer::horizontalScrollbarStart(int minX) const
+{
+    const RenderBox* box = renderBox();
+    int x = minX + box->borderLeft();
+    if (renderer()->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+        x += m_vBar ? m_vBar->width() : resizerCornerRect(this, box->borderBoxRect()).width();
+    return x;
+}
+
 IntSize RenderLayer::scrollbarOffset(const Scrollbar* scrollbar) const
 {
     RenderBox* box = renderBox();
 
     if (scrollbar == m_vBar.get())
-        return IntSize(box->width() - box->borderRight() - scrollbar->width(), box->borderTop());
+        return IntSize(verticalScrollbarStart(0, box->width()), box->borderTop());
 
     if (scrollbar == m_hBar.get())
-        return IntSize(box->borderLeft(), box->height() - box->borderBottom() - scrollbar->height());
+        return IntSize(horizontalScrollbarStart(0), box->height() - box->borderBottom() - scrollbar->height());
     
     ASSERT_NOT_REACHED();
     return IntSize();
@@ -2004,9 +2036,9 @@ void RenderLayer::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& r
     RenderBox* box = renderBox();
     ASSERT(box);
     if (scrollbar == m_vBar.get())
-        scrollRect.move(box->width() - box->borderRight() - scrollbar->width(), box->borderTop());
+        scrollRect.move(verticalScrollbarStart(0, box->width()), box->borderTop());
     else
-        scrollRect.move(box->borderLeft(), box->height() - box->borderBottom() - scrollbar->height());
+        scrollRect.move(horizontalScrollbarStart(0), box->height() - box->borderBottom() - scrollbar->height());
     renderer()->repaintRectangle(scrollRect);
 }
 
@@ -2146,11 +2178,14 @@ int RenderLayer::horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy relevan
 
 IntSize RenderLayer::offsetFromResizeCorner(const IntPoint& absolutePoint) const
 {
-    // Currently the resize corner is always the bottom right corner
+    // Currently the resize corner is either the bottom right corner or the bottom left corner.
     // FIXME: This assumes the location is 0, 0. Is this guaranteed to always be the case?
-    IntPoint bottomRight = toPoint(size());
+    IntSize elementSize = size();
+    if (renderer()->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+        elementSize.setWidth(0);
+    IntPoint resizerPoint = toPoint(elementSize);
     IntPoint localPoint = roundedIntPoint(absoluteToContents(absolutePoint));
-    return localPoint - bottomRight;
+    return localPoint - resizerPoint;
 }
 
 bool RenderLayer::hasOverflowControls() const
@@ -2171,13 +2206,13 @@ void RenderLayer::positionOverflowControls(const IntSize& offsetFromLayer)
     const IntRect& scrollCorner = scrollCornerRect();
     IntRect absBounds(borderBox.location() + offsetFromLayer, borderBox.size());
     if (m_vBar)
-        m_vBar->setFrameRect(IntRect(absBounds.maxX() - box->borderRight() - m_vBar->width(),
+        m_vBar->setFrameRect(IntRect(verticalScrollbarStart(absBounds.x(), absBounds.maxX()),
                                      absBounds.y() + box->borderTop(),
                                      m_vBar->width(),
                                      absBounds.height() - (box->borderTop() + box->borderBottom()) - scrollCorner.height()));
 
     if (m_hBar)
-        m_hBar->setFrameRect(IntRect(absBounds.x() + box->borderLeft(),
+        m_hBar->setFrameRect(IntRect(horizontalScrollbarStart(absBounds.x()),
                                      absBounds.maxY() - box->borderBottom() - m_hBar->height(),
                                      absBounds.width() - (box->borderLeft() + box->borderRight()) - scrollCorner.width(),
                                      m_hBar->height()));
@@ -2212,30 +2247,20 @@ void RenderLayer::positionOverflowControls(const IntSize& offsetFromLayer)
         m_resizer->setFrameRect(resizerCornerRect(this, borderBox));
 }
 
-LayoutUnit RenderLayer::scrollWidth()
+int RenderLayer::scrollWidth()
 {
     if (m_scrollDimensionsDirty)
         computeScrollDimensions();
     return m_scrollSize.width();
 }
 
-LayoutUnit RenderLayer::scrollHeight()
+int RenderLayer::scrollHeight()
 {
     if (m_scrollDimensionsDirty)
         computeScrollDimensions();
     return m_scrollSize.height();
 }
 
-int RenderLayer::pixelSnappedScrollWidth()
-{
-    return scrollWidth();
-}
-
-int RenderLayer::pixelSnappedScrollHeight()
-{
-    return scrollHeight();
-}
-
 LayoutUnit RenderLayer::overflowTop() const
 {
     RenderBox* box = renderBox();
@@ -2284,32 +2309,9 @@ void RenderLayer::computeScrollDimensions(bool* needHBar, bool* needVBar)
     setScrollOrigin(IntPoint(-m_scrollOverflow.width(), -m_scrollOverflow.height()));
 
     if (needHBar)
-        *needHBar = pixelSnappedScrollWidth() > box->pixelSnappedClientWidth();
+        *needHBar = scrollWidth() > box->pixelSnappedClientWidth();
     if (needVBar)
-        *needVBar = pixelSnappedScrollHeight() > box->pixelSnappedClientHeight();
-}
-
-void RenderLayer::updateOverflowStatus(bool horizontalOverflow, bool verticalOverflow)
-{
-    if (m_overflowStatusDirty) {
-        m_horizontalOverflow = horizontalOverflow;
-        m_verticalOverflow = verticalOverflow;
-        m_overflowStatusDirty = false;
-        return;
-    }
-    
-    bool horizontalOverflowChanged = (m_horizontalOverflow != horizontalOverflow);
-    bool verticalOverflowChanged = (m_verticalOverflow != verticalOverflow);
-    
-    if (horizontalOverflowChanged || verticalOverflowChanged) {
-        m_horizontalOverflow = horizontalOverflow;
-        m_verticalOverflow = verticalOverflow;
-        
-        if (FrameView* frameView = renderer()->document()->view()) {
-            frameView->scheduleEvent(OverflowEvent::create(horizontalOverflowChanged, horizontalOverflow, verticalOverflowChanged, verticalOverflow),
-                renderer()->node());
-        }
-    }
+        *needVBar = scrollHeight() > box->pixelSnappedClientHeight();
 }
 
 void RenderLayer::updateScrollInfoAfterLayout()
@@ -2327,8 +2329,8 @@ void RenderLayer::updateScrollInfoAfterLayout()
     if (box->style()->overflowX() != OMARQUEE) {
         // Layout may cause us to be in an invalid scroll position.  In this case we need
         // to pull our scroll offsets back to the max (or push them up to the min).
-        int newX = max(0, min(scrollXOffset(), scrollWidth() - box->clientWidth()));
-        int newY = max(0, min(scrollYOffset(), scrollHeight() - box->clientHeight()));
+        int newX = max(0, min<int>(scrollXOffset(), scrollWidth() - box->clientWidth()));
+        int newY = max(0, min<int>(scrollYOffset(), scrollHeight() - box->clientHeight()));
         if (newX != scrollXOffset() || newY != scrollYOffset())
             scrollToOffset(newX, newY);
     }
@@ -2404,10 +2406,7 @@ void RenderLayer::updateScrollInfoAfterLayout()
     }
 
     if (scrollOffsetOriginal != scrollOffset())
-        scrollToOffsetWithoutAnimation(LayoutPoint(scrollXOffset(), scrollYOffset()));
-
-    if (renderer()->node() && renderer()->document()->hasListenerType(Document::OVERFLOWCHANGED_LISTENER))
-        updateOverflowStatus(horizontalOverflow, verticalOverflow);
+        scrollToOffsetWithoutAnimation(IntPoint(scrollXOffset(), scrollYOffset()));
 }
 
 void RenderLayer::paintOverflowControls(GraphicsContext* context, const IntPoint& paintOffset, const IntRect& damageRect, bool paintingOverlayControls)
@@ -2514,6 +2513,16 @@ void RenderLayer::drawPlatformResizerImage(GraphicsContext* context, IntRect res
     }
 
     IntRect imageRect(resizerCornerRect.maxXMaxYCorner() - cornerResizerSize, cornerResizerSize);
+    if (renderer()->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft()) {
+        context->save();
+        context->translate(imageRect.x(), imageRect.y());
+        imageRect.setX(0);
+        imageRect.setY(0);
+        context->scale(FloatSize(-1.0, 1.0));
+        context->drawImage(resizeCornerImage.get(), renderer()->style()->colorSpace(), imageRect);
+        context->restore();
+        return;
+    }
     context->drawImage(resizeCornerImage.get(), renderer()->style()->colorSpace(), imageRect);
 }
 
@@ -2588,7 +2597,7 @@ bool RenderLayer::hitTestOverflowControls(HitTestResult& result, const IntPoint&
     int resizeControlSize = max(resizeControlRect.height(), 0);
 
     if (m_vBar && m_vBar->shouldParticipateInHitTesting()) {
-        LayoutRect vBarRect(box->width() - box->borderRight() - m_vBar->width(), 
+        LayoutRect vBarRect(verticalScrollbarStart(0, box->width()),
                             box->borderTop(),
                             m_vBar->width(),
                             box->height() - (box->borderTop() + box->borderBottom()) - (m_hBar ? m_hBar->height() : resizeControlSize));
@@ -2600,7 +2609,7 @@ bool RenderLayer::hitTestOverflowControls(HitTestResult& result, const IntPoint&
 
     resizeControlSize = max(resizeControlRect.width(), 0);
     if (m_hBar && m_hBar->shouldParticipateInHitTesting()) {
-        LayoutRect hBarRect(box->borderLeft(),
+        LayoutRect hBarRect(horizontalScrollbarStart(0),
                             box->height() - box->borderBottom() - m_hBar->height(),
                             box->width() - (box->borderLeft() + box->borderRight()) - (m_vBar ? m_vBar->width() : resizeControlSize),
                             m_hBar->height());
@@ -3653,8 +3662,12 @@ void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, RenderRegion*
     // Update the clip rects that will be passed to child layers.
     if (renderer()->hasOverflowClip() || renderer()->hasClip()) {
         // This layer establishes a clip of some kind.
+
+        // This offset cannot use convertToLayerCoords, because sometimes our rootLayer may be across
+        // some transformed layer boundary, for example, in the RenderLayerCompositor overlapMap, where
+        // clipRects are needed in view space.
         LayoutPoint offset;
-        convertToLayerCoords(rootLayer, offset);
+        offset = roundedIntPoint(renderer()->localToContainerPoint(FloatPoint(), rootLayer->renderer()));
         RenderView* view = renderer()->view();
         ASSERT(view);
         if (view && clipRects.fixed() && rootLayer->renderer() == view) {
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 4c5be0cdc..4f5ec91f1 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -280,10 +280,8 @@ public:
 
     LayoutRect rect() const { return LayoutRect(location(), size()); }
 
-    LayoutUnit scrollWidth();
-    LayoutUnit scrollHeight();
-    int pixelSnappedScrollWidth();
-    int pixelSnappedScrollHeight();
+    int scrollWidth();
+    int scrollHeight();
 
     void panScrollFromPoint(const LayoutPoint&);
 
@@ -293,15 +291,15 @@ public:
     };
 
     // Scrolling methods for layers that can scroll their overflow.
-    void scrollByRecursively(LayoutUnit xDelta, LayoutUnit yDelta, ScrollOffsetClamping = ScrollOffsetUnclamped);
+    void scrollByRecursively(int xDelta, int yDelta, ScrollOffsetClamping = ScrollOffsetUnclamped);
 
     int scrollXOffset() const { return m_scrollOffset.width() + scrollOrigin().x(); }
     int scrollYOffset() const { return m_scrollOffset.height() + scrollOrigin().y(); }
     IntSize scrollOffset() const { return IntSize(scrollXOffset(), scrollYOffset()); }
 
-    void scrollToOffset(LayoutUnit, LayoutUnit, ScrollOffsetClamping = ScrollOffsetUnclamped);
-    void scrollToXOffset(LayoutUnit x, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(x, scrollYOffset(), clamp); }
-    void scrollToYOffset(LayoutUnit y, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(scrollXOffset(), y, clamp); }
+    void scrollToOffset(int, int, ScrollOffsetClamping = ScrollOffsetUnclamped);
+    void scrollToXOffset(int x, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(x, scrollYOffset(), clamp); }
+    void scrollToYOffset(int y, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(scrollXOffset(), y, clamp); }
 
     void scrollRectToVisible(const LayoutRect&, const ScrollAlignment& alignX = ScrollAlignment::alignCenterIfNeeded, const ScrollAlignment& alignY = ScrollAlignment::alignCenterIfNeeded);
 
@@ -680,8 +678,6 @@ private:
 
     IntSize scrollbarOffset(const Scrollbar*) const;
     
-    void updateOverflowStatus(bool horizontalOverflow, bool verticalOverflow);
-
     void childVisibilityChanged(bool newVisibility);
     void dirtyVisibleDescendantStatus();
     void updateVisibilityStatus();
@@ -755,6 +751,9 @@ private:
             ;
     }
 
+    LayoutUnit verticalScrollbarStart(int minX, int maxX) const;
+    LayoutUnit horizontalScrollbarStart(int minX) const;
+
 protected:
     // The bitfields are up here so they will fall into the padding from ScrollableArea on 64-bit.
 
@@ -773,9 +772,6 @@ protected:
     bool m_inOverflowRelayout : 1;
     unsigned m_repaintStatus : 2; // RepaintStatus
 
-    bool m_overflowStatusDirty : 1;
-    bool m_horizontalOverflow : 1;
-    bool m_verticalOverflow : 1;
     bool m_visibleContentStatusDirty : 1;
     bool m_hasVisibleContent : 1;
     bool m_visibleDescendantStatusDirty : 1;
@@ -821,7 +817,7 @@ protected:
     // Our scroll offsets if the view is scrolled.
     IntSize m_scrollOffset;
 
-    LayoutSize m_scrollOverflow;
+    IntSize m_scrollOverflow;
     
     // The width/height of our scrolled area.
     LayoutSize m_scrollSize;
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index f559970b4..daed5c265 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -210,22 +210,21 @@ static bool layerOrAncestorIsTransformed(RenderLayer* layer)
     
     return false;
 }
-    
-#if ENABLE(FULLSCREEN_API)
-static bool layerOrAncestorIsFullScreen(RenderLayer* layer)
+
+bool RenderLayerBacking::shouldClipCompositedBounds() const
 {
-    // Don't traverse through the render layer tree if we do not yet have a full screen renderer.        
-    if (!layer->renderer()->document()->fullScreenRenderer())
+    if (m_usingTiledCacheLayer)
+        return true;
+
+    if (!compositor()->compositingConsultsOverlap())
         return false;
 
-    for (RenderLayer* curr = layer; curr; curr = curr->parent()) {
-        if (curr->renderer()->isRenderFullScreen())
-            return true;
-    }
-    
-    return false;
+    if (layerOrAncestorIsTransformed(m_owningLayer))
+        return false;
+
+    return true;
 }
-#endif
+
 
 void RenderLayerBacking::updateCompositedBounds()
 {
@@ -233,14 +232,8 @@ void RenderLayerBacking::updateCompositedBounds()
 
     // Clip to the size of the document or enclosing overflow-scroll layer.
     // If this or an ancestor is transformed, we can't currently compute the correct rect to intersect with.
-    // We'd need RenderObject::convertContainerToLocalQuad(), which doesn't yet exist.  If this
-    // is a fullscreen renderer, don't clip to the viewport, as the renderer will be asked to
-    // display outside of the viewport bounds.
-    if (compositor()->compositingConsultsOverlap() && !layerOrAncestorIsTransformed(m_owningLayer) 
-#if ENABLE(FULLSCREEN_API)
-        && !layerOrAncestorIsFullScreen(m_owningLayer)
-#endif
-        ) {
+    // We'd need RenderObject::convertContainerToLocalQuad(), which doesn't yet exist.
+    if (shouldClipCompositedBounds()) {
         RenderView* view = m_owningLayer->renderer()->view();
         RenderLayer* rootLayer = view->layer();
 
diff --git a/Source/WebCore/rendering/RenderLayerBacking.h b/Source/WebCore/rendering/RenderLayerBacking.h
index e1fafc0ac..a75e318b9 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.h
+++ b/Source/WebCore/rendering/RenderLayerBacking.h
@@ -199,7 +199,9 @@ private:
 
     bool containsNonEmptyRenderers() const;
     bool hasVisibleNonCompositingDescendantLayers() const;
-    
+
+    bool shouldClipCompositedBounds() const;
+
     void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect, PaintBehavior, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
 
     static int graphicsLayerToCSSProperty(AnimatedPropertyID);
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 75a280c95..dbcbf2158 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -75,6 +75,58 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+class RenderLayerCompositor::OverlapMap {
+    WTF_MAKE_NONCOPYABLE(OverlapMap);
+public:
+    OverlapMap()
+    {
+        // Begin assuming the root layer will be composited so that there is
+        // something on the stack. The root layer should also never get an
+        // popCompositingContainer call.
+        pushCompositingContainer();
+    }
+
+    void add(const RenderLayer* layer, const IntRect& bounds)
+    {
+        // Layers do not contribute to overlap immediately--instead, they will
+        // contribute to overlap as soon as their composited ancestor has been
+        // recursively processed and popped off the stack.
+        ASSERT(m_overlapStack.size() >= 2);
+        m_overlapStack[m_overlapStack.size() - 2].unite(bounds);
+        m_layers.add(layer);
+    }
+
+    bool contains(const RenderLayer* layer)
+    {
+        return m_layers.contains(layer);
+    }
+
+    bool overlapsLayers(const IntRect& bounds) const
+    {
+        return m_overlapStack.last().intersects(bounds);
+    }
+
+    bool isEmpty()
+    {
+        return m_layers.isEmpty();
+    }
+
+    void pushCompositingContainer()
+    {
+        m_overlapStack.append(Region());
+    }
+
+    void popCompositingContainer()
+    {
+        m_overlapStack[m_overlapStack.size() - 2].unite(m_overlapStack.last());
+        m_overlapStack.removeLast();
+    }
+
+private:
+    Vector<Region> m_overlapStack;
+    HashSet<const RenderLayer*> m_layers;
+};
+
 struct CompositingState {
     CompositingState(RenderLayer* compAncestor)
         : m_compositingAncestor(compAncestor)
@@ -365,6 +417,11 @@ bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeR
 
             layer->ensureBacking();
 
+            // The RenderLayer's needs to update repaint rects here, because the target
+            // repaintContainer may have changed after becoming a composited layer.
+            // https://bugs.webkit.org/show_bug.cgi?id=80641
+            layer->computeRepaintRects();
+
 #if PLATFORM(MAC) && USE(CA)
             Settings* settings = m_renderView->document()->settings();
             if (settings && settings->acceleratedDrawingEnabled())
@@ -586,12 +643,12 @@ void RenderLayerCompositor::addToOverlapMap(OverlapMap& overlapMap, RenderLayer*
 
     if (!boundsComputed) {
         layerBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
-        // Empty rects never intersect, but we need them to for the purposes of overlap testing.
-        if (layerBounds.isEmpty())
-            layerBounds.setSize(IntSize(1, 1));
         boundsComputed = true;
     }
 
+    if (layerBounds.isEmpty())
+        return;
+
     IntRect clipRect = pixelSnappedIntRect(layer->backgroundClipRect(rootRenderLayer(), 0, true).rect()); // FIXME: Incorrect for CSS regions.
     clipRect.scale(pageScaleFactor());
     clipRect.intersect(layerBounds);
@@ -637,18 +694,6 @@ void RenderLayerCompositor::addToOverlapMapRecursive(OverlapMap& overlapMap, Ren
     }
 }
 
-bool RenderLayerCompositor::overlapsCompositedLayers(OverlapMap& overlapMap, const IntRect& layerBounds)
-{
-    RenderLayerCompositor::OverlapMap::const_iterator end = overlapMap.end();
-    for (RenderLayerCompositor::OverlapMap::const_iterator it = overlapMap.begin(); it != end; ++it) {
-        const IntRect& bounds = it->second;
-        if (layerBounds.intersects(bounds))
-            return true;
-    }
-    
-    return false;
-}
-
 //  Recurse through the layers in z-index and overflow order (which is equivalent to painting order)
 //  For the z-order children of a compositing layer:
 //      If a child layers has a compositing layer, then all subsequent layers must
@@ -675,10 +720,8 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
         // If we're testing for overlap, we only need to composite if we overlap something that is already composited.
         absBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
         // Empty rects never intersect, but we need them to for the purposes of overlap testing.
-        if (absBounds.isEmpty())
-            absBounds.setSize(IntSize(1, 1));
         haveComputedBounds = true;
-        mustOverlapCompositedLayers = overlapsCompositedLayers(*overlapMap, absBounds);
+        mustOverlapCompositedLayers = overlapMap->overlapsLayers(absBounds);
     }
     
     layer->setMustOverlapCompositedLayers(mustOverlapCompositedLayers);
@@ -688,7 +731,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     // ancestor with m_subtreeIsCompositing set to false.
     CompositingState childState(compositingState.m_compositingAncestor);
 #ifndef NDEBUG
-    ++childState.m_depth;
+    childState.m_depth = compositingState.m_depth + 1;
 #endif
 
     bool willBeComposited = needsToBeComposited(layer);
@@ -697,10 +740,9 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
         compositingState.m_subtreeIsCompositing = true;
         // This layer now acts as the ancestor for kids.
         childState.m_compositingAncestor = layer;
-    }
 
-    if (overlapMap && childState.m_compositingAncestor && !childState.m_compositingAncestor->isRootLayer()) {
-        addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
+        if (overlapMap)
+            overlapMap->pushCompositingContainer();
     }
 
 #if ENABLE(VIDEO)
@@ -726,7 +768,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
                     layer->setMustOverlapCompositedLayers(true);
                     childState.m_compositingAncestor = layer;
                     if (overlapMap)
-                        addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
+                        overlapMap->pushCompositingContainer();
                     willBeComposited = true;
                 }
             }
@@ -760,13 +802,22 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     
     ASSERT(willBeComposited == needsToBeComposited(layer));
 
+    // All layers (even ones that aren't being composited) need to get added to
+    // the overlap map. Layers that do not composite will draw into their
+    // compositing ancestor's backing, and so are still considered for overlap.
+    if (overlapMap && childState.m_compositingAncestor && !childState.m_compositingAncestor->isRootLayer())
+        addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
+
     // If we have a software transform, and we have layers under us, we need to also
     // be composited. Also, if we have opacity < 1, then we need to be a layer so that
     // the child layers are opaque, then rendered with opacity on this layer.
     if (!willBeComposited && canBeComposited(layer) && childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
         layer->setMustOverlapCompositedLayers(true);
-        if (overlapMap)
+        childState.m_compositingAncestor = layer;
+        if (overlapMap) {
+            overlapMap->pushCompositingContainer();
             addToOverlapMapRecursive(*overlapMap, layer);
+        }
         willBeComposited = true;
     }
 
@@ -784,11 +835,17 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     // setHasCompositingDescendant() may have changed the answer to needsToBeComposited() when clipping,
     // so test that again.
     if (!willBeComposited && canBeComposited(layer) && clipsCompositingDescendants(layer)) {
-        if (overlapMap)
+        childState.m_compositingAncestor = layer;
+        if (overlapMap) {
+            overlapMap->pushCompositingContainer();
             addToOverlapMapRecursive(*overlapMap, layer);
+        }
         willBeComposited = true;
     }
 
+    if (overlapMap && childState.m_compositingAncestor == layer && !layer->isRootLayer())
+        overlapMap->popCompositingContainer();
+
     // If we're back at the root, and no other layers need to be composited, and the root layer itself doesn't need
     // to be composited, then we can drop out of compositing mode altogether. However, don't drop out of compositing mode
     // if there are composited layers that we didn't hit in our traversal (e.g. because of visibility:hidden).
@@ -939,13 +996,6 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, Vect
             }
         }
 
-#if ENABLE(FULLSCREEN_API)
-        // For the sake of clients of the full screen renderer, don't reparent
-        // the full screen layer out from under them if they're in the middle of
-        // animating.
-        if (layer->renderer()->isRenderFullScreen() && m_renderView->document()->isAnimatingFullScreen())
-            return;
-#endif
         childLayersOfEnclosingLayer.append(layerBacking->childForSuperlayers());
     }
 }
@@ -978,7 +1028,7 @@ void RenderLayerCompositor::frameViewDidScroll()
     IntPoint scrollPosition = frameView->scrollPosition();
 
     if (RenderLayerBacking* backing = rootRenderLayer()->backing())
-        backing->graphicsLayer()->visibleRectChanged();
+        backing->graphicsLayer()->visibleRectChanged(frameView->visibleContentRect(false /* exclude scrollbars */));
 
     if (!m_scrollLayer)
         return;
@@ -1338,7 +1388,6 @@ bool RenderLayerCompositor::requiresCompositingLayer(const RenderLayer* layer) c
              || (canRender3DTransforms() && renderer->style()->backfaceVisibility() == BackfaceVisibilityHidden)
              || clipsCompositingDescendants(layer)
              || requiresCompositingForAnimation(renderer)
-             || requiresCompositingForFullScreen(renderer)
              || requiresCompositingForFilters(renderer)
              || requiresCompositingForPosition(renderer, layer);
 }
@@ -1505,6 +1554,12 @@ bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* render
 
     if (AnimationController* animController = renderer->animation()) {
         return (animController->isRunningAnimationOnRenderer(renderer, CSSPropertyOpacity) && inCompositingMode())
+#if ENABLE(CSS_FILTERS)
+#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+            // <rdar://problem/10907251> - WebKit2 doesn't support CA animations of CI filters on Lion and below
+            || animController->isRunningAnimationOnRenderer(renderer, CSSPropertyWebkitFilter)
+#endif // !SNOW_LEOPARD && !LION
+#endif // CSS_FILTERS
             || animController->isRunningAnimationOnRenderer(renderer, CSSPropertyWebkitTransform);
     }
     return false;
@@ -1515,16 +1570,6 @@ bool RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing(Ren
     return renderer->hasTransform() || renderer->isTransparent() || renderer->hasMask() || renderer->hasReflection() || renderer->hasFilter();
 }
     
-bool RenderLayerCompositor::requiresCompositingForFullScreen(RenderObject* renderer) const
-{
-#if ENABLE(FULLSCREEN_API)
-    return renderer->isRenderFullScreen() && m_renderView->document()->isAnimatingFullScreen();
-#else
-    UNUSED_PARAM(renderer);
-    return false;
-#endif
-}
-
 bool RenderLayerCompositor::requiresCompositingForFilters(RenderObject* renderer) const
 {
 #if ENABLE(CSS_FILTERS)
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.h b/Source/WebCore/rendering/RenderLayerCompositor.h
index 86aea07a6..98a2a9f95 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.h
+++ b/Source/WebCore/rendering/RenderLayerCompositor.h
@@ -210,6 +210,8 @@ public:
     void documentBackgroundColorDidChange();
 
 private:
+    class OverlapMap;
+
     // GraphicsLayerClient Implementation
     virtual void notifyAnimationStarted(const GraphicsLayer*, double) { }
     virtual void notifySyncRequired(const GraphicsLayer*) { scheduleLayerFlush(); }
@@ -233,10 +235,8 @@ private:
     // Repaint the given rect (which is layer's coords), and regions of child layers that intersect that rect.
     void recursiveRepaintLayerRect(RenderLayer*, const IntRect&);
 
-    typedef HashMap<RenderLayer*, IntRect> OverlapMap;
     void addToOverlapMap(OverlapMap&, RenderLayer*, IntRect& layerBounds, bool& boundsComputed);
     void addToOverlapMapRecursive(OverlapMap&, RenderLayer*);
-    static bool overlapsCompositedLayers(OverlapMap&, const IntRect& layerBounds);
 
     void updateCompositingLayersTimerFired(Timer<RenderLayerCompositor>*);
 
@@ -282,7 +282,6 @@ private:
     bool requiresCompositingForPlugin(RenderObject*) const;
     bool requiresCompositingForFrame(RenderObject*) const;
     bool requiresCompositingWhenDescendantsAreCompositing(RenderObject*) const;
-    bool requiresCompositingForFullScreen(RenderObject*) const;
     bool requiresCompositingForFilters(RenderObject*) const;
     bool requiresCompositingForScrollableFrame() const;
     bool requiresCompositingForPosition(RenderObject*, const RenderLayer*) const;
diff --git a/Source/WebCore/rendering/RenderListBox.cpp b/Source/WebCore/rendering/RenderListBox.cpp
index 68ae283e3..e9b0ede36 100644
--- a/Source/WebCore/rendering/RenderListBox.cpp
+++ b/Source/WebCore/rendering/RenderListBox.cpp
@@ -316,7 +316,7 @@ void RenderListBox::paintObject(PaintInfo& paintInfo, const LayoutPoint& paintOf
     }
 }
 
-void RenderListBox::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint& additionalOffset)
+void RenderListBox::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint& additionalOffset)
 {
     if (!isSpatialNavigationEnabled(frame()))
         return RenderBlock::addFocusRingRects(rects, additionalOffset);
@@ -326,7 +326,7 @@ void RenderListBox::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoi
     // Focus the last selected item.
     int selectedItem = select->activeSelectionEndListIndex();
     if (selectedItem >= 0) {
-        rects.append(itemBoundingBoxRect(additionalOffset, selectedItem));
+        rects.append(pixelSnappedIntRect(itemBoundingBoxRect(additionalOffset, selectedItem)));
         return;
     }
 
@@ -336,7 +336,7 @@ void RenderListBox::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoi
     for (int i = 0; i < size; ++i) {
         HTMLElement* element = listItems[i];
         if (element->hasTagName(optionTag) && !toHTMLOptionElement(element)->disabled()) {
-            rects.append(itemBoundingBoxRect(additionalOffset, i));
+            rects.append(pixelSnappedIntRect(itemBoundingBoxRect(additionalOffset, i)));
             return;
         }
     }
@@ -409,7 +409,7 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, const LayoutPoint&
 
     unsigned length = itemText.length();
     const UChar* string = itemText.characters();
-    TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, itemStyle->direction(), itemStyle->unicodeBidi() == Override, TextRun::NoRounding);
+    TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, itemStyle->direction(), isOverride(itemStyle->unicodeBidi()), TextRun::NoRounding);
     Font itemFont = style()->font();
     LayoutRect r = itemBoundingBoxRect(paintOffset, listIndex);
     r.move(itemOffsetForAlignment(textRun, itemStyle, itemFont, r));
@@ -643,15 +643,15 @@ int RenderListBox::verticalScrollbarWidth() const
 
 // FIXME: We ignore padding in the vertical direction as far as these values are concerned, since that's
 // how the control currently paints.
-LayoutUnit RenderListBox::scrollWidth() const
+int RenderListBox::scrollWidth() const
 {
     // There is no horizontal scrolling allowed.
-    return clientWidth();
+    return pixelSnappedClientWidth();
 }
 
 int RenderListBox::scrollHeight() const
 {
-    return max(pixelSnappedClientHeight(), listHeight());
+    return max(pixelSnappedClientHeight(), roundToInt(listHeight()));
 }
 
 int RenderListBox::scrollLeft() const
diff --git a/Source/WebCore/rendering/RenderListBox.h b/Source/WebCore/rendering/RenderListBox.h
index 407fa5247..707b61d40 100644
--- a/Source/WebCore/rendering/RenderListBox.h
+++ b/Source/WebCore/rendering/RenderListBox.h
@@ -77,7 +77,7 @@ private:
 
     virtual void layout();
 
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     virtual bool canBeProgramaticallyScrolled() const { return true; }
     virtual void autoscroll();
@@ -97,9 +97,9 @@ private:
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
 
     // ScrollableArea interface.
-    virtual LayoutUnit scrollSize(ScrollbarOrientation) const;
-    virtual LayoutUnit scrollPosition(Scrollbar*) const;
-    virtual void setScrollOffset(const LayoutPoint&);
+    virtual int scrollSize(ScrollbarOrientation) const;
+    virtual int scrollPosition(Scrollbar*) const;
+    virtual void setScrollOffset(const IntPoint&);
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
     virtual bool isActive() const;
     virtual bool isScrollCornerVisible() const { return false; } // We don't support resize on list boxes yet. If we did these would have to change.
diff --git a/Source/WebCore/rendering/RenderListItem.cpp b/Source/WebCore/rendering/RenderListItem.cpp
index 883218d4f..6c0677ed8 100644
--- a/Source/WebCore/rendering/RenderListItem.cpp
+++ b/Source/WebCore/rendering/RenderListItem.cpp
@@ -247,14 +247,15 @@ void RenderListItem::updateMarkerLocation()
             LayoutStateDisabler layoutStateDisabler(view());
             updateFirstLetter();
             m_marker->remove();
-            // If markerPar is an anonymous block that will lose all its children, destroy it
-            if (markerPar && (markerPar != lineBoxParent) && markerPar->isAnonymousBlock() && !(toRenderBlock(markerPar)->firstChild()))
-                markerPar->destroy();
             if (!lineBoxParent)
                 lineBoxParent = this;
             lineBoxParent->addChild(m_marker, firstNonMarkerChild(lineBoxParent));
             if (m_marker->preferredLogicalWidthsDirty())
                 m_marker->computePreferredLogicalWidths();
+            // If markerPar is an anonymous block that has lost all its children, destroy it.
+            // Extraneous anonymous blocks can cause problems for RenderBlock::updateBeforeAfterContent.
+            if (markerPar && markerPar->isAnonymousBlock() && !markerPar->firstChild() && !toRenderBlock(markerPar)->continuation())
+                markerPar->destroy();
         }
     }
 }
diff --git a/Source/WebCore/rendering/RenderListMarker.cpp b/Source/WebCore/rendering/RenderListMarker.cpp
index fe193987c..8c804549e 100644
--- a/Source/WebCore/rendering/RenderListMarker.cpp
+++ b/Source/WebCore/rendering/RenderListMarker.cpp
@@ -1094,7 +1094,7 @@ IntRect RenderListMarker::localSelectionRect()
 {
     InlineBox* box = inlineBoxWrapper();
     if (!box)
-        return IntRect(0, 0, width(), height());
+        return IntRect(IntPoint(), size());
     RootInlineBox* root = m_inlineBoxWrapper->root();
     int newLogicalTop = root->block()->style()->isFlippedBlocksWritingMode() ? m_inlineBoxWrapper->logicalBottom() - root->selectionBottom() : root->selectionTop() - m_inlineBoxWrapper->logicalTop();
     if (root->block()->style()->isHorizontalWritingMode())
@@ -1694,11 +1694,12 @@ IntRect RenderListMarker::getRelativeMarkerRect()
 
 void RenderListMarker::setSelectionState(SelectionState state)
 {
+    // The selection state for our containing block hierarchy is updated by the base class call.
     RenderBox::setSelectionState(state);
-    if (InlineBox* box = inlineBoxWrapper())
-        if (RootInlineBox* root = box->root())
+
+    if (m_inlineBoxWrapper && canUpdateSelectionOnRootLineBoxes())
+        if (RootInlineBox* root = m_inlineBoxWrapper->root())
             root->setHasSelectedChildren(state != SelectionNone);
-    containingBlock()->setSelectionState(state);
 }
 
 LayoutRect RenderListMarker::selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent)
diff --git a/Source/WebCore/rendering/RenderMediaControls.cpp b/Source/WebCore/rendering/RenderMediaControls.cpp
index 97d2774da..f791274e7 100644
--- a/Source/WebCore/rendering/RenderMediaControls.cpp
+++ b/Source/WebCore/rendering/RenderMediaControls.cpp
@@ -90,12 +90,23 @@ static const int mediaSliderThumbHeight = 14;
 
 void RenderMediaControls::adjustMediaSliderThumbSize(RenderStyle* style)
 {
-    ControlPart part = style->appearance();
-    if (part != MediaSliderThumbPart && part != MediaVolumeSliderThumbPart)
+    int part;
+    switch (style->appearance()) {
+    case MediaSliderThumbPart:
+        part = MediaSliderThumb;
+        break;
+    case MediaVolumeSliderThumbPart:
+        part = MediaVolumeSliderThumb;
+        break;
+    case MediaFullScreenVolumeSliderThumbPart:
+        part = MediaFullScreenVolumeSliderThumb;
+        break;
+    default:
         return;
+    }
 
     CGSize size;
-    wkMeasureMediaUIPart(part == MediaSliderThumbPart ? MediaSliderThumb : MediaVolumeSliderThumb, WKMediaControllerThemeQuickTime, 0, &size);
+    wkMeasureMediaUIPart(part, WKMediaControllerThemeQuickTime, 0, &size);
 
     float zoomLevel = style->effectiveZoom();
     style->setWidth(Length(static_cast<int>(size.width * zoomLevel), Fixed));
@@ -163,6 +174,12 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
         case MediaVolumeSliderThumb:
             wkDrawMediaUIPart(WKMediaUIPartVolumeSliderThumb, themeStyle, paintInfo.context->platformContext(), r, determineState(o));
             break;
+        case MediaFullScreenVolumeSlider:
+            wkDrawMediaUIPart(WKMediaUIPartFullScreenVolumeSlider, themeStyle, paintInfo.context->platformContext(), r, determineState(o));
+            break;
+        case MediaFullScreenVolumeSliderThumb:
+            wkDrawMediaUIPart(WKMediaUIPartFullScreenVolumeSliderThumb, themeStyle, paintInfo.context->platformContext(), r, determineState(o));
+            break;
         case MediaTimelineContainer:
             wkDrawMediaUIPart(WKMediaUIPartBackground, themeStyle, paintInfo.context->platformContext(), r, determineState(o));
             break;
diff --git a/Source/WebCore/rendering/RenderMediaControlsChromium.cpp b/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
index 8a2580515..66b088260 100644
--- a/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -238,6 +238,16 @@ static bool paintMediaTimelineContainer(RenderObject* object, const PaintInfo& p
     return true;
 }
 
+static bool paintMediaFullscreenButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    DEFINE_STATIC_LOCAL(Image*, mediaFullscreen, (platformResource("mediaFullscreen")));
+    return paintMediaButton(paintInfo.context, rect, mediaFullscreen);
+}
+
 bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType part, RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     switch (part) {
@@ -257,8 +267,9 @@ bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType
         return paintMediaVolumeSliderThumb(object, paintInfo, rect);
     case MediaTimelineContainer:
         return paintMediaTimelineContainer(object, paintInfo, rect);
-    case MediaVolumeSliderMuteButton:
     case MediaFullscreenButton:
+        return paintMediaFullscreenButton(object, paintInfo, rect);
+    case MediaVolumeSliderMuteButton:
     case MediaSeekBackButton:
     case MediaSeekForwardButton:
     case MediaVolumeSliderContainer:
@@ -272,6 +283,8 @@ bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType
     case MediaHideClosedCaptionsButton:
     case MediaTextTrackDisplayContainer:
     case MediaTextTrackDisplay:
+    case MediaFullScreenVolumeSlider:
+    case MediaFullScreenVolumeSliderThumb:
         ASSERT_NOT_REACHED();
         break;
     }
diff --git a/Source/WebCore/rendering/RenderMenuList.cpp b/Source/WebCore/rendering/RenderMenuList.cpp
index 3f7ac3081..a47aebbae 100644
--- a/Source/WebCore/rendering/RenderMenuList.cpp
+++ b/Source/WebCore/rendering/RenderMenuList.cpp
@@ -447,7 +447,8 @@ PopupMenuStyle RenderMenuList::itemStyle(unsigned listIndex) const
     HTMLElement* element = listItems[listIndex];
     
     RenderStyle* style = element->renderStyle() ? element->renderStyle() : element->computedStyle();
-    return style ? PopupMenuStyle(style->visitedDependentColor(CSSPropertyColor), itemBackgroundColor(listIndex), style->font(), style->visibility() == VISIBLE, style->display() == NONE, style->textIndent(), style->direction(), style->unicodeBidi() == Override) : menuStyle();
+    return style ? PopupMenuStyle(style->visitedDependentColor(CSSPropertyColor), itemBackgroundColor(listIndex), style->font(), style->visibility() == VISIBLE,
+        style->display() == NONE, style->textIndent(), style->direction(), isOverride(style->unicodeBidi())) : menuStyle();
 }
 
 Color RenderMenuList::itemBackgroundColor(unsigned listIndex) const
@@ -476,7 +477,8 @@ Color RenderMenuList::itemBackgroundColor(unsigned listIndex) const
 PopupMenuStyle RenderMenuList::menuStyle() const
 {
     RenderStyle* s = m_innerBlock ? m_innerBlock->style() : style();
-    return PopupMenuStyle(s->visitedDependentColor(CSSPropertyColor), s->visitedDependentColor(CSSPropertyBackgroundColor), s->font(), s->visibility() == VISIBLE, s->display() == NONE, s->textIndent(), style()->direction(), style()->unicodeBidi() == Override);
+    return PopupMenuStyle(s->visitedDependentColor(CSSPropertyColor), s->visitedDependentColor(CSSPropertyBackgroundColor), s->font(), s->visibility() == VISIBLE,
+        s->display() == NONE, s->textIndent(), style()->direction(), isOverride(style()->unicodeBidi()));
 }
 
 HostWindow* RenderMenuList::hostWindow() const
diff --git a/Source/WebCore/rendering/RenderMenuList.h b/Source/WebCore/rendering/RenderMenuList.h
index 27872eba2..7466b1ff9 100644
--- a/Source/WebCore/rendering/RenderMenuList.h
+++ b/Source/WebCore/rendering/RenderMenuList.h
@@ -67,7 +67,7 @@ private:
 
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
     virtual bool hasControlClip() const { return true; }
-    virtual RenderText* buttonText() const OVERRIDE { return m_buttonText; }
+    virtual bool canHaveGeneratedChildren() const OVERRIDE { return false; }
 
     virtual const char* renderName() const { return "RenderMenuList"; }
 
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index a91b7f89c..fbe452577 100755
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -644,8 +644,9 @@ void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, RenderOb
         if (!container && !object->isRenderView())
             return;
         if (!last->isText() && last->style()->isPositioned()) {
-            bool willSkipRelativelyPositionedInlines = !object->isRenderBlock();
-            while (object && !object->isRenderBlock()) // Skip relatively positioned inlines and get to the enclosing RenderBlock.
+            bool willSkipRelativelyPositionedInlines = !object->isRenderBlock() || object->isAnonymousBlock();
+            // Skip relatively positioned inlines and anonymous blocks to get to the enclosing RenderBlock.
+            while (object && (!object->isRenderBlock() || object->isAnonymousBlock()))
                 object = object->container();
             if (!object || object->posChildNeedsLayout())
                 return;
@@ -1109,7 +1110,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
     
 void RenderObject::paintFocusRing(GraphicsContext* context, const LayoutPoint& paintOffset, RenderStyle* style)
 {
-    Vector<LayoutRect> focusRingRects;
+    Vector<IntRect> focusRingRects;
     addFocusRingRects(focusRingRects, paintOffset);
     if (style->outlineStyleIsAuto())
         context->drawFocusRing(focusRingRects, style->outlineWidth(), style->outlineOffset(), style->visitedDependentColor(CSSPropertyOutlineColor));
@@ -1196,7 +1197,7 @@ void RenderObject::paintOutline(GraphicsContext* graphicsContext, const LayoutRe
         graphicsContext->endTransparencyLayer();
 }
 
-LayoutRect RenderObject::absoluteBoundingBoxRect(bool useTransforms) const
+IntRect RenderObject::absoluteBoundingBoxRect(bool useTransforms) const
 {
     if (useTransforms) {
         Vector<FloatQuad> quads;
@@ -1206,29 +1207,29 @@ LayoutRect RenderObject::absoluteBoundingBoxRect(bool useTransforms) const
         if (!n)
             return IntRect();
     
-        LayoutRect result = quads[0].enclosingBoundingBox();
+        IntRect result = quads[0].enclosingBoundingBox();
         for (size_t i = 1; i < n; ++i)
             result.unite(quads[i].enclosingBoundingBox());
         return result;
     }
 
     FloatPoint absPos = localToAbsolute();
-    Vector<LayoutRect> rects;
+    Vector<IntRect> rects;
     absoluteRects(rects, flooredLayoutPoint(absPos));
 
     size_t n = rects.size();
     if (!n)
-        return LayoutRect();
+        return IntRect();
 
     LayoutRect result = rects[0];
     for (size_t i = 1; i < n; ++i)
         result.unite(rects[i]);
-    return result;
+    return pixelSnappedIntRect(result);
 }
 
 void RenderObject::absoluteFocusRingQuads(Vector<FloatQuad>& quads)
 {
-    Vector<LayoutRect> rects;
+    Vector<IntRect> rects;
     // FIXME: addFocusRingRects() needs to be passed this transform-unaware
     // localToAbsolute() offset here because RenderInline::addFocusRingRects()
     // implicitly assumes that. This doesn't work correctly with transformed
@@ -1237,7 +1238,7 @@ void RenderObject::absoluteFocusRingQuads(Vector<FloatQuad>& quads)
     addFocusRingRects(rects, flooredLayoutPoint(absolutePoint));
     size_t count = rects.size(); 
     for (size_t i = 0; i < count; ++i) {
-        LayoutRect rect = rects[i];
+        IntRect rect = rects[i];
         rect.move(-absolutePoint.x(), -absolutePoint.y());
         quads.append(localToAbsoluteQuad(FloatQuad(rect)));
     }
@@ -1519,7 +1520,7 @@ void RenderObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
             LayoutRect repaintRect(rect);
             repaintRect.move(-boxParent->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
 
-            LayoutRect boxRect(LayoutPoint(), boxParent->layer()->size());
+            LayoutRect boxRect(LayoutPoint(), boxParent->cachedSizeForOverflowClip());
             rect = intersection(repaintRect, boxRect);
             if (rect.isEmpty())
                 return;
@@ -2093,6 +2094,15 @@ FloatQuad RenderObject::localToContainerQuad(const FloatQuad& localQuad, RenderB
     return transformState.lastPlanarQuad();
 }
 
+FloatPoint RenderObject::localToContainerPoint(const FloatPoint& localPoint, RenderBoxModelObject* repaintContainer, bool fixed, bool* wasFixed) const
+{
+    TransformState transformState(TransformState::ApplyTransformDirection, localPoint);
+    mapLocalToContainer(repaintContainer, fixed, true, transformState, wasFixed);
+    transformState.flatten();
+
+    return transformState.lastPlanarPoint();
+}
+
 LayoutSize RenderObject::offsetFromContainer(RenderObject* o, const LayoutPoint& point) const
 {
     ASSERT(o == container());
@@ -2230,6 +2240,21 @@ bool RenderObject::isSelectionBorder() const
     return st == SelectionStart || st == SelectionEnd || st == SelectionBoth;
 }
 
+inline void RenderObject::clearLayoutRootIfNeeded() const
+{
+    if (node() && !documentBeingDestroyed() && frame()) {
+        if (FrameView* view = frame()->view()) {
+            if (view->layoutRoot() == this) {
+                ASSERT_NOT_REACHED();
+                // This indicates a failure to layout the child, which is why
+                // the layout root is still set to |this|. Make sure to clear it
+                // since we are getting destroyed.
+                view->clearLayoutRoot();
+            }
+        }
+    }
+}
+
 void RenderObject::willBeDestroyed()
 {
     // Destroy any leftover anonymous children.
@@ -2280,6 +2305,8 @@ void RenderObject::willBeDestroyed()
         setHasLayer(false);
         toRenderBoxModelObject(this)->destroyLayer();
     }
+
+    clearLayoutRootIfNeeded();
 }
 
 void RenderObject::destroyAndCleanupAnonymousWrappers()
@@ -2604,14 +2631,6 @@ void RenderObject::addDashboardRegions(Vector<DashboardRegionValue>& regions)
         region.bounds.setX(absPos.x() + styleRegion.offset.left().value());
         region.bounds.setY(absPos.y() + styleRegion.offset.top().value());
 
-        if (frame()) {
-            float deviceScaleFactor = frame()->page()->deviceScaleFactor();
-            if (deviceScaleFactor != 1.0f) {
-                region.bounds.scale(deviceScaleFactor);
-                region.clip.scale(deviceScaleFactor);
-            }
-        }
-
         regions.append(region);
     }
 }
@@ -2635,6 +2654,10 @@ bool RenderObject::willRenderImage(CachedImage*)
     if (style()->visibility() != VISIBLE)
         return false;
 
+    // We will not render a new image when Active DOM is suspended
+    if (document()->activeDOMObjectsAreSuspended())
+        return false;
+
     // If we're not in a window (i.e., we're dormant from being put in the b/f cache or in a background tab)
     // then we don't want to render either.
     return !document()->inPageCache() && !document()->view()->isOffscreen();
@@ -2803,6 +2826,12 @@ CursorDirective RenderObject::getCursor(const LayoutPoint&, Cursor&) const
     return SetCursorBasedOnStyle;
 }
 
+bool RenderObject::canUpdateSelectionOnRootLineBoxes()
+{
+    RenderBlock* containingBlock = this->containingBlock();
+    return containingBlock ? !containingBlock->needsLayout() : true;
+}
+
 #if ENABLE(SVG)
 
 RenderSVGResourceContainer* RenderObject::toRenderSVGResourceContainer()
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index ac1bfc76d..60e2a403c 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -286,8 +286,8 @@ public:
     virtual bool isBoxModelObject() const { return false; }
     virtual bool isCounter() const { return false; }
     virtual bool isQuote() const { return false; }
+
 #if ENABLE(DETAILS)
-    virtual bool isDetails() const { return false; }
     virtual bool isDetailsMarker() const { return false; }
 #endif
     virtual bool isEmbeddedObject() const { return false; }
@@ -325,9 +325,6 @@ public:
 
     virtual bool isSlider() const { return false; }
     virtual bool isSliderThumb() const { return false; }
-#if ENABLE(DETAILS)
-    virtual bool isSummary() const { return false; }
-#endif
     virtual bool isTable() const { return false; }
     virtual bool isTableCell() const { return false; }
     virtual bool isTableCol() const { return false; }
@@ -403,7 +400,6 @@ public:
     virtual bool isSVGResourceContainer() const { return false; }
     virtual bool isSVGResourceFilter() const { return false; }
     virtual bool isSVGResourceFilterPrimitive() const { return false; }
-    virtual bool isSVGShadowTreeRootContainer() const { return false; }
 
     virtual RenderSVGResourceContainer* toRenderSVGResourceContainer();
 
@@ -644,8 +640,10 @@ public:
     {
         return localToContainerQuad(quad, 0, fixed, wasFixed);
     }
+
     // Convert a local quad into the coordinate system of container, taking transforms into account.
     FloatQuad localToContainerQuad(const FloatQuad&, RenderBoxModelObject* repaintContainer, bool fixed = false, bool* wasFixed = 0) const;
+    FloatPoint localToContainerPoint(const FloatPoint&, RenderBoxModelObject* repaintContainer, bool fixed = false, bool* wasFixed = 0) const;
 
     // Return the offset from the container() renderer (excluding transforms). In multi-column layout,
     // different offsets apply at different points, so return the offset that applies to the given point.
@@ -653,11 +651,11 @@ public:
     // Return the offset from an object up the container() chain. Asserts that none of the intermediate objects have transforms.
     LayoutSize offsetFromAncestorContainer(RenderObject*) const;
     
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint&) const { }
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint&) const { }
 
     // FIXME: useTransforms should go away eventually
-    LayoutRect absoluteBoundingBoxRect(bool useTransform = true) const;
-    LayoutRect absoluteBoundingBoxRectIgnoringTransforms() const { return absoluteBoundingBoxRect(false); }
+    IntRect absoluteBoundingBoxRect(bool useTransform = true) const;
+    IntRect absoluteBoundingBoxRectIgnoringTransforms() const { return absoluteBoundingBoxRect(false); }
 
     // Build an array of quads in absolute coords for line boxes
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* /*wasFixed*/ = 0) const { }
@@ -748,9 +746,6 @@ public:
     // Applied as a "slop" to dirty rect checks during the outline painting phase's dirty-rect checks.
     LayoutUnit maximalOutlineSize(PaintPhase) const;
 
-    void setHasMarkupTruncation(bool b = true) { m_bitfields.setHasMarkupTruncation(b); }
-    bool hasMarkupTruncation() const { return m_bitfields.hasMarkupTruncation(); }
-
     enum SelectionState {
         SelectionNone, // The object is not selected.
         SelectionStart, // The object either contains the start of a selection run or is the start of a run
@@ -763,6 +758,8 @@ public:
     // descendants (as described above in the SelectionState enum declaration).
     SelectionState selectionState() const { return m_bitfields.selectionState(); }
     virtual void setSelectionState(SelectionState state) { m_bitfields.setSelectionState(state); }
+    inline void setSelectionStateIfNeeded(SelectionState);
+    bool canUpdateSelectionOnRootLineBoxes();
 
     // A single rectangle that encompasses all of the selected objects within this object.  Used to determine the tightest
     // possible bounding box for the selection.
@@ -842,7 +839,7 @@ public:
     bool shouldUseTransformFromContainer(const RenderObject* container) const;
     void getTransformFromContainer(const RenderObject* container, const LayoutSize& offsetInContainer, TransformationMatrix&) const;
     
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&) { };
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&) { };
 
     LayoutRect absoluteOutlineBounds() const
     {
@@ -872,6 +869,7 @@ protected:
 
     void adjustRectForOutlineAndShadow(LayoutRect&) const;
 
+    void clearLayoutRootIfNeeded() const;
     virtual void willBeDestroyed();
     void arenaDelete(RenderArena*, void* objectBase);
 
@@ -933,7 +931,6 @@ private:
             , m_childrenInline(false)
             , m_marginBeforeQuirk(false) 
             , m_marginAfterQuirk(false)
-            , m_hasMarkupTruncation(false)
             , m_hasColumns(false)
             , m_selectionState(SelectionNone)
         {
@@ -977,7 +974,6 @@ private:
         ADD_BOOLEAN_BITFIELD(childrenInline, ChildrenInline);
         ADD_BOOLEAN_BITFIELD(marginBeforeQuirk, MarginBeforeQuirk);
         ADD_BOOLEAN_BITFIELD(marginAfterQuirk, MarginAfterQuirk);
-        ADD_BOOLEAN_BITFIELD(hasMarkupTruncation, HasMarkupTruncation);
         ADD_BOOLEAN_BITFIELD(hasColumns, HasColumns);
 
     private:
@@ -1120,6 +1116,14 @@ inline bool RenderObject::layerCreationAllowedForSubtree() const
     return true;
 }
 
+inline void RenderObject::setSelectionStateIfNeeded(SelectionState state)
+{
+    if (selectionState() == state)
+        return;
+
+    setSelectionState(state);
+}
+
 inline void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRendering)
 {
 #if !ENABLE(3D_RENDERING)
diff --git a/Source/WebCore/rendering/RenderRegion.cpp b/Source/WebCore/rendering/RenderRegion.cpp
index 42f7d2955..5b7692a6c 100644
--- a/Source/WebCore/rendering/RenderRegion.cpp
+++ b/Source/WebCore/rendering/RenderRegion.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -139,11 +139,6 @@ void RenderRegion::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintO
     if (!m_flowThread || !isValid())
         return;
 
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
-
     setRegionBoxesRegionStyle();
     m_flowThread->paintIntoRegion(paintInfo, this, LayoutPoint(paintOffset.x() + borderLeft() + paddingLeft(), paintOffset.y() + borderTop() + paddingTop()));
     restoreRegionBoxesOriginalStyle();
diff --git a/Source/WebCore/rendering/RenderRegion.h b/Source/WebCore/rendering/RenderRegion.h
index d46d6da67..70fa23b30 100644
--- a/Source/WebCore/rendering/RenderRegion.h
+++ b/Source/WebCore/rendering/RenderRegion.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -56,6 +56,7 @@ public:
     void attachRegion();
     void detachRegion();
 
+    RenderFlowThread* flowThread() const { return m_flowThread; }
     RenderFlowThread* parentFlowThread() const { return m_parentFlowThread; }
 
     // Valid regions do not create circular dependencies with other flows.
diff --git a/Source/WebCore/rendering/RenderReplaced.cpp b/Source/WebCore/rendering/RenderReplaced.cpp
index 6bdb1831c..39bacfa7f 100644
--- a/Source/WebCore/rendering/RenderReplaced.cpp
+++ b/Source/WebCore/rendering/RenderReplaced.cpp
@@ -137,11 +137,6 @@ void RenderReplaced::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
         drawSelectionTint = false;
     }
 
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
-
     bool completelyClippedOut = false;
     if (style()->hasBorderRadius()) {
         LayoutRect borderRect = LayoutRect(adjustedPaintOffset, size());
@@ -196,10 +191,12 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, const LayoutPoint& paintO
         bottom = max(selBottom, bottom);
     }
     
-    LayoutUnit os = 2 * maximalOutlineSize(paintInfo.phase);
-    if (adjustedPaintOffset.x() + minXVisualOverflow() >= paintInfo.rect.maxX() + os || adjustedPaintOffset.x() + maxXVisualOverflow() <= paintInfo.rect.x() - os)
+    LayoutRect localRepaintRect = paintInfo.rect;
+    localRepaintRect.inflate(maximalOutlineSize(paintInfo.phase));
+    if (adjustedPaintOffset.x() + minXVisualOverflow() >= localRepaintRect.maxX() || adjustedPaintOffset.x() + maxXVisualOverflow() <= localRepaintRect.x())
         return false;
-    if (top >= paintInfo.rect.maxY() + os || bottom <= paintInfo.rect.y() - os)
+
+    if (top >= localRepaintRect.maxY() || bottom <= localRepaintRect.y())
         return false;
 
     return true;
@@ -440,9 +437,7 @@ void RenderReplaced::computePreferredLogicalWidths()
     if (style()->maxWidth().isFixed())
         m_maxPreferredLogicalWidth = min(m_maxPreferredLogicalWidth, style()->maxWidth().value() + (style()->boxSizing() == CONTENT_BOX ? borderAndPadding : zeroLayoutUnit));
 
-    if (style()->width().isPercent() || style()->height().isPercent()
-        || style()->maxWidth().isPercent() || style()->maxHeight().isPercent()
-        || style()->minWidth().isPercent() || style()->minHeight().isPercent())
+    if (hasRelativeDimensions())
         m_minPreferredLogicalWidth = 0;
     else
         m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth;
@@ -500,7 +495,7 @@ IntRect RenderReplaced::localSelectionRect(bool checkWhetherSelected) const
 
     if (!m_inlineBoxWrapper)
         // We're a block-level replaced element.  Just return our own dimensions.
-        return IntRect(0, 0, width(), height());
+        return IntRect(IntPoint(), size());
     
     RootInlineBox* root = m_inlineBoxWrapper->root();
     int newLogicalTop = root->block()->style()->isFlippedBlocksWritingMode() ? m_inlineBoxWrapper->logicalBottom() - root->selectionBottom() : root->selectionTop() - m_inlineBoxWrapper->logicalTop();
@@ -509,14 +504,14 @@ IntRect RenderReplaced::localSelectionRect(bool checkWhetherSelected) const
     return IntRect(newLogicalTop, 0, root->selectionHeight(), height());
 }
 
-void RenderReplaced::setSelectionState(SelectionState s)
+void RenderReplaced::setSelectionState(SelectionState state)
 {
-    RenderBox::setSelectionState(s); // The selection state for our containing block hierarchy is updated by the base class call.
-    if (m_inlineBoxWrapper) {
-        RootInlineBox* line = m_inlineBoxWrapper->root();
-        if (line)
-            line->setHasSelectedChildren(isSelected());
-    }
+    // The selection state for our containing block hierarchy is updated by the base class call.
+    RenderBox::setSelectionState(state);
+
+    if (m_inlineBoxWrapper && canUpdateSelectionOnRootLineBoxes())
+        if (RootInlineBox* root = m_inlineBoxWrapper->root())
+            root->setHasSelectedChildren(isSelected());
 }
 
 bool RenderReplaced::isSelected() const
diff --git a/Source/WebCore/rendering/RenderScrollbar.cpp b/Source/WebCore/rendering/RenderScrollbar.cpp
index 25eb5a7b3..6f6fd53ea 100644
--- a/Source/WebCore/rendering/RenderScrollbar.cpp
+++ b/Source/WebCore/rendering/RenderScrollbar.cpp
@@ -202,7 +202,7 @@ void RenderScrollbar::updateScrollbarParts(bool destroy)
     }
     
     if (newThickness != oldThickness) {
-        setFrameRect(IntRect(x(), y(), isHorizontal ? width() : newThickness, isHorizontal ? newThickness : height()));
+        setFrameRect(IntRect(location(), IntSize(isHorizontal ? width() : newThickness, isHorizontal ? newThickness : height())));
         if (RenderBox* box = owningRenderer())
             box->setChildNeedsLayout(true);
     }
@@ -297,7 +297,7 @@ IntRect RenderScrollbar::buttonRect(ScrollbarPart partType)
     
     bool isHorizontal = orientation() == HorizontalScrollbar;
     if (partType == BackButtonStartPart)
-        return IntRect(x(), y(), isHorizontal ? partRenderer->width() : width(), isHorizontal ? height() : partRenderer->height());
+        return IntRect(location(), IntSize(isHorizontal ? partRenderer->width() : width(), isHorizontal ? height() : partRenderer->height()));
     if (partType == ForwardButtonEndPart)
         return IntRect(isHorizontal ? x() + width() - partRenderer->width() : x(),
         
@@ -355,10 +355,10 @@ IntRect RenderScrollbar::trackPieceRectWithMargins(ScrollbarPart partType, const
     IntRect rect = oldRect;
     if (orientation() == HorizontalScrollbar) {
         rect.setX(rect.x() + partRenderer->marginLeft());
-        rect.setWidth(rect.width() - (partRenderer->marginLeft() + partRenderer->marginRight()));
+        rect.setWidth(rect.width() - partRenderer->marginWidth());
     } else {
         rect.setY(rect.y() + partRenderer->marginTop());
-        rect.setHeight(rect.height() - (partRenderer->marginTop() + partRenderer->marginBottom()));
+        rect.setHeight(rect.height() - partRenderer->marginHeight());
     }
     return rect;
 }
diff --git a/Source/WebCore/rendering/RenderScrollbar.h b/Source/WebCore/rendering/RenderScrollbar.h
index 810c98ff3..7fe2fac8b 100644
--- a/Source/WebCore/rendering/RenderScrollbar.h
+++ b/Source/WebCore/rendering/RenderScrollbar.h
@@ -85,7 +85,7 @@ private:
     HashMap<unsigned, RenderScrollbarPart*> m_parts;
 };
 
-inline RenderScrollbar* toRenderScrollbar(Scrollbar* scrollbar)
+inline RenderScrollbar* toRenderScrollbar(ScrollbarThemeClient* scrollbar)
 {
     ASSERT(!scrollbar || scrollbar->isCustomScrollbar());
     return static_cast<RenderScrollbar*>(scrollbar);
diff --git a/Source/WebCore/rendering/RenderScrollbarTheme.cpp b/Source/WebCore/rendering/RenderScrollbarTheme.cpp
index 87309d44e..44e2aa631 100644
--- a/Source/WebCore/rendering/RenderScrollbarTheme.cpp
+++ b/Source/WebCore/rendering/RenderScrollbarTheme.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "RenderScrollbarTheme.h"
 #include "RenderScrollbar.h"
+#include "ScrollbarThemeClient.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -36,7 +37,7 @@ RenderScrollbarTheme* RenderScrollbarTheme::renderScrollbarTheme()
     return &theme;
 }
 
-void RenderScrollbarTheme::buttonSizesAlongTrackAxis(Scrollbar* scrollbar, int& beforeSize, int& afterSize)
+void RenderScrollbarTheme::buttonSizesAlongTrackAxis(ScrollbarThemeClient* scrollbar, int& beforeSize, int& afterSize)
 {
     IntRect firstButton = backButtonRect(scrollbar, BackButtonStartPart);
     IntRect secondButton = forwardButtonRect(scrollbar, ForwardButtonStartPart);
@@ -51,7 +52,7 @@ void RenderScrollbarTheme::buttonSizesAlongTrackAxis(Scrollbar* scrollbar, int&
     }
 }
 
-bool RenderScrollbarTheme::hasButtons(Scrollbar* scrollbar)
+bool RenderScrollbarTheme::hasButtons(ScrollbarThemeClient* scrollbar)
 {
     int startSize;
     int endSize;
@@ -59,27 +60,27 @@ bool RenderScrollbarTheme::hasButtons(Scrollbar* scrollbar)
     return (startSize + endSize) <= (scrollbar->orientation() == HorizontalScrollbar ? scrollbar->width() : scrollbar->height());
 }
 
-bool RenderScrollbarTheme::hasThumb(Scrollbar* scrollbar)
+bool RenderScrollbarTheme::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     return trackLength(scrollbar) - thumbLength(scrollbar) >= 0;
 }
 
-int RenderScrollbarTheme::minimumThumbLength(Scrollbar* scrollbar)
+int RenderScrollbarTheme::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return toRenderScrollbar(scrollbar)->minimumThumbLength();
 }
 
-IntRect RenderScrollbarTheme::backButtonRect(Scrollbar* scrollbar, ScrollbarPart partType, bool)
+IntRect RenderScrollbarTheme::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart partType, bool)
 {
     return toRenderScrollbar(scrollbar)->buttonRect(partType);
 }
 
-IntRect RenderScrollbarTheme::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart partType, bool)
+IntRect RenderScrollbarTheme::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart partType, bool)
 {
     return toRenderScrollbar(scrollbar)->buttonRect(partType);
 }
 
-IntRect RenderScrollbarTheme::trackRect(Scrollbar* scrollbar, bool)
+IntRect RenderScrollbarTheme::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     if (!hasButtons(scrollbar))
         return scrollbar->frameRect();
@@ -91,7 +92,7 @@ IntRect RenderScrollbarTheme::trackRect(Scrollbar* scrollbar, bool)
     return toRenderScrollbar(scrollbar)->trackRect(startLength, endLength);
 }
 
-IntRect RenderScrollbarTheme::constrainTrackRectToTrackPieces(Scrollbar* scrollbar, const IntRect& rect)
+IntRect RenderScrollbarTheme::constrainTrackRectToTrackPieces(ScrollbarThemeClient* scrollbar, const IntRect& rect)
 { 
     IntRect backRect = toRenderScrollbar(scrollbar)->trackPieceRectWithMargins(BackTrackPart, rect);
     IntRect forwardRect = toRenderScrollbar(scrollbar)->trackPieceRectWithMargins(ForwardTrackPart, rect);
@@ -112,27 +113,27 @@ void RenderScrollbarTheme::paintScrollCorner(ScrollView*, GraphicsContext* conte
     context->fillRect(cornerRect, Color::white, ColorSpaceDeviceRGB);
 }
 
-void RenderScrollbarTheme::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
+void RenderScrollbarTheme::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
 {
     toRenderScrollbar(scrollbar)->paintPart(context, ScrollbarBGPart, scrollbar->frameRect());
 }
 
-void RenderScrollbarTheme::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void RenderScrollbarTheme::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     toRenderScrollbar(scrollbar)->paintPart(context, TrackBGPart, rect);
 }
 
-void RenderScrollbarTheme::paintTrackPiece(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void RenderScrollbarTheme::paintTrackPiece(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     toRenderScrollbar(scrollbar)->paintPart(context, part, rect);
 }
 
-void RenderScrollbarTheme::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void RenderScrollbarTheme::paintButton(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     toRenderScrollbar(scrollbar)->paintPart(context, part, rect);
 }
 
-void RenderScrollbarTheme::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void RenderScrollbarTheme::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     toRenderScrollbar(scrollbar)->paintPart(context, ThumbPart, rect);
 }
diff --git a/Source/WebCore/rendering/RenderScrollbarTheme.h b/Source/WebCore/rendering/RenderScrollbarTheme.h
index 70c24a5ea..9cef3949f 100644
--- a/Source/WebCore/rendering/RenderScrollbarTheme.h
+++ b/Source/WebCore/rendering/RenderScrollbarTheme.h
@@ -46,35 +46,35 @@ public:
 
     virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect);
 
-    virtual bool shouldCenterOnThumb(Scrollbar* scrollbar, const PlatformMouseEvent& event) { return ScrollbarTheme::theme()->shouldCenterOnThumb(scrollbar, event); }
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient* scrollbar, const PlatformMouseEvent& event) { return ScrollbarTheme::theme()->shouldCenterOnThumb(scrollbar, event); }
     
     virtual double initialAutoscrollTimerDelay() { return ScrollbarTheme::theme()->initialAutoscrollTimerDelay(); }
     virtual double autoscrollTimerDelay() { return ScrollbarTheme::theme()->autoscrollTimerDelay(); }
 
-    virtual void registerScrollbar(Scrollbar* scrollbar) { return ScrollbarTheme::theme()->registerScrollbar(scrollbar); }
-    virtual void unregisterScrollbar(Scrollbar* scrollbar) { return ScrollbarTheme::theme()->unregisterScrollbar(scrollbar); }
+    virtual void registerScrollbar(ScrollbarThemeClient* scrollbar) { return ScrollbarTheme::theme()->registerScrollbar(scrollbar); }
+    virtual void unregisterScrollbar(ScrollbarThemeClient* scrollbar) { return ScrollbarTheme::theme()->unregisterScrollbar(scrollbar); }
 
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
 
-    void buttonSizesAlongTrackAxis(Scrollbar* scrollbar, int& beforeSize, int& afterSize);
+    void buttonSizesAlongTrackAxis(ScrollbarThemeClient*, int& beforeSize, int& afterSize);
     
     static RenderScrollbarTheme* renderScrollbarTheme();
 
 protected:
-    virtual bool hasButtons(Scrollbar*);
-    virtual bool hasThumb(Scrollbar*);
+    virtual bool hasButtons(ScrollbarThemeClient*);
+    virtual bool hasThumb(ScrollbarThemeClient*);
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
     
-    virtual void paintScrollbarBackground(GraphicsContext*, Scrollbar*);    
-    virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-    virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
+    virtual void paintScrollbarBackground(GraphicsContext*, ScrollbarThemeClient*);
+    virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
 
-    virtual IntRect constrainTrackRectToTrackPieces(Scrollbar*, const IntRect&);
+    virtual IntRect constrainTrackRectToTrackPieces(ScrollbarThemeClient*, const IntRect&);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderSummary.h b/Source/WebCore/rendering/RenderSummary.h
deleted file mode 100644
index b73b36147..000000000
--- a/Source/WebCore/rendering/RenderSummary.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef RenderSummary_h
-#define RenderSummary_h
-
-#if ENABLE(DETAILS)
-
-#include "RenderBlock.h"
-
-namespace WebCore {
-
-class RenderDetails;
-
-class RenderSummary : public RenderBlock {
-public:
-    explicit RenderSummary(Node*);
-
-private:
-    virtual const char* renderName() const { return "RenderSummary"; }
-    virtual bool isSummary() const { return true; }
-    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
-};
-
-inline RenderSummary* toRenderSummary(RenderObject* object)
-{
-    ASSERT(!object || object->isSummary());
-    return static_cast<RenderSummary*>(object);
-}
-
-// This will catch anyone doing an unnecessary cast.
-void toRenderSummary(const RenderSummary*);
-
-}
-
-#endif
-
-#endif // RenderSummary_h
-
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index 1a42652db..2c8cae1dd 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -270,11 +270,11 @@ void RenderTable::computeLogicalWidth()
 LayoutUnit RenderTable::convertStyleLogicalWidthToComputedWidth(const Length& styleLogicalWidth, LayoutUnit availableWidth)
 {
     // HTML tables' width styles already include borders and paddings, but CSS tables' width styles do not.
-    LayoutUnit borders = 0;
+    int borders = 0;
     bool isCSSTable = !node() || !node()->hasTagName(tableTag);
     if (isCSSTable && styleLogicalWidth.isFixed() && styleLogicalWidth.isPositive()) {
         recalcBordersInRowDirection();
-        borders = borderStart() + borderEnd() + (collapseBorders() ? zeroLayoutUnit : paddingStart() + paddingEnd());
+        borders = borderStart() + borderEnd() + (collapseBorders() ? 0 : paddingStart() + paddingEnd());
     }
     return styleLogicalWidth.calcMinValue(availableWidth) + borders;
 }
@@ -840,14 +840,14 @@ void RenderTable::recalcSections() const
     m_needsSectionRecalc = false;
 }
 
-LayoutUnit RenderTable::calcBorderStart() const
+int RenderTable::calcBorderStart() const
 {
     if (collapseBorders()) {
         // Determined by the first cell of the first row. See the CSS 2.1 spec, section 17.6.2.
         if (!numEffCols())
             return 0;
 
-        LayoutUnit borderWidth = 0;
+        unsigned borderWidth = 0;
 
         const BorderValue& tb = style()->borderStart();
         if (tb.style() == BHIDDEN)
@@ -860,7 +860,7 @@ LayoutUnit RenderTable::calcBorderStart() const
             if (gb.style() == BHIDDEN)
                 return 0;
             if (gb.style() > BHIDDEN)
-                borderWidth = max<LayoutUnit>(borderWidth, gb.width());
+                borderWidth = max(borderWidth, gb.width());
         }
         
         if (const RenderTableSection* topNonEmptySection = this->topNonEmptySection()) {
@@ -869,7 +869,7 @@ LayoutUnit RenderTable::calcBorderStart() const
                 return 0;
 
             if (sb.style() > BHIDDEN)
-                borderWidth = max<LayoutUnit>(borderWidth, sb.width());
+                borderWidth = max(borderWidth, sb.width());
 
             const RenderTableSection::CellStruct& cs = topNonEmptySection->cellAt(0, 0);
             
@@ -883,9 +883,9 @@ LayoutUnit RenderTable::calcBorderStart() const
                     return 0;
 
                 if (cb.style() > BHIDDEN)
-                    borderWidth = max<LayoutUnit>(borderWidth, cb.width());
+                    borderWidth = max(borderWidth, cb.width());
                 if (rb.style() > BHIDDEN)
-                    borderWidth = max<LayoutUnit>(borderWidth, rb.width());
+                    borderWidth = max(borderWidth, rb.width());
             }
         }
         return (borderWidth + (style()->isLeftToRightDirection() ? 0 : 1)) / 2;
@@ -893,14 +893,14 @@ LayoutUnit RenderTable::calcBorderStart() const
     return RenderBlock::borderStart();
 }
 
-LayoutUnit RenderTable::calcBorderEnd() const
+int RenderTable::calcBorderEnd() const
 {
     if (collapseBorders()) {
         // Determined by the last cell of the first row. See the CSS 2.1 spec, section 17.6.2.
         if (!numEffCols())
             return 0;
 
-        LayoutUnit borderWidth = 0;
+        unsigned borderWidth = 0;
 
         const BorderValue& tb = style()->borderEnd();
         if (tb.style() == BHIDDEN)
@@ -914,7 +914,7 @@ LayoutUnit RenderTable::calcBorderEnd() const
             if (gb.style() == BHIDDEN)
                 return 0;
             if (gb.style() > BHIDDEN)
-                borderWidth = max<LayoutUnit>(borderWidth, gb.width());
+                borderWidth = max(borderWidth, gb.width());
         }
 
         if (const RenderTableSection* topNonEmptySection = this->topNonEmptySection()) {
@@ -923,7 +923,7 @@ LayoutUnit RenderTable::calcBorderEnd() const
                 return 0;
 
             if (sb.style() > BHIDDEN)
-                borderWidth = max<LayoutUnit>(borderWidth, sb.width());
+                borderWidth = max(borderWidth, sb.width());
 
             const RenderTableSection::CellStruct& cs = topNonEmptySection->cellAt(0, endColumn);
             
@@ -937,9 +937,9 @@ LayoutUnit RenderTable::calcBorderEnd() const
                     return 0;
 
                 if (cb.style() > BHIDDEN)
-                    borderWidth = max<LayoutUnit>(borderWidth, cb.width());
+                    borderWidth = max(borderWidth, cb.width());
                 if (rb.style() > BHIDDEN)
-                    borderWidth = max<LayoutUnit>(borderWidth, rb.width());
+                    borderWidth = max(borderWidth, rb.width());
             }
         }
         return (borderWidth + (style()->isLeftToRightDirection() ? 1 : 0)) / 2;
@@ -953,7 +953,7 @@ void RenderTable::recalcBordersInRowDirection()
     m_borderEnd = calcBorderEnd();
 }
 
-LayoutUnit RenderTable::borderBefore() const
+int RenderTable::borderBefore() const
 {
     if (collapseBorders()) {
         recalcSectionsIfNeeded();
@@ -962,7 +962,7 @@ LayoutUnit RenderTable::borderBefore() const
     return RenderBlock::borderBefore();
 }
 
-LayoutUnit RenderTable::borderAfter() const
+int RenderTable::borderAfter() const
 {
     if (collapseBorders()) {
         recalcSectionsIfNeeded();
@@ -971,11 +971,11 @@ LayoutUnit RenderTable::borderAfter() const
     return RenderBlock::borderAfter();
 }
 
-LayoutUnit RenderTable::outerBorderBefore() const
+int RenderTable::outerBorderBefore() const
 {
     if (!collapseBorders())
         return 0;
-    LayoutUnit borderWidth = 0;
+    int borderWidth = 0;
     if (RenderTableSection* topSection = this->topSection()) {
         borderWidth = topSection->outerBorderBefore();
         if (borderWidth < 0)
@@ -985,15 +985,15 @@ LayoutUnit RenderTable::outerBorderBefore() const
     if (tb.style() == BHIDDEN)
         return 0;
     if (tb.style() > BHIDDEN)
-        borderWidth = max<LayoutUnit>(borderWidth, tb.width() / 2);
+        borderWidth = max<int>(borderWidth, tb.width() / 2);
     return borderWidth;
 }
 
-LayoutUnit RenderTable::outerBorderAfter() const
+int RenderTable::outerBorderAfter() const
 {
     if (!collapseBorders())
         return 0;
-    LayoutUnit borderWidth = 0;
+    int borderWidth = 0;
     RenderTableSection* bottomSection;
     if (m_foot)
         bottomSection = m_foot;
@@ -1011,16 +1011,16 @@ LayoutUnit RenderTable::outerBorderAfter() const
     if (tb.style() == BHIDDEN)
         return 0;
     if (tb.style() > BHIDDEN)
-        borderWidth = max<LayoutUnit>(borderWidth, (tb.width() + 1) / 2);
+        borderWidth = max<int>(borderWidth, (tb.width() + 1) / 2);
     return borderWidth;
 }
 
-LayoutUnit RenderTable::outerBorderStart() const
+int RenderTable::outerBorderStart() const
 {
     if (!collapseBorders())
         return 0;
 
-    LayoutUnit borderWidth = 0;
+    int borderWidth = 0;
 
     const BorderValue& tb = style()->borderStart();
     if (tb.style() == BHIDDEN)
@@ -1032,7 +1032,7 @@ LayoutUnit RenderTable::outerBorderStart() const
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (!child->isTableSection())
             continue;
-        LayoutUnit sw = toRenderTableSection(child)->outerBorderStart();
+        int sw = toRenderTableSection(child)->outerBorderStart();
         if (sw < 0)
             continue;
         allHidden = false;
@@ -1044,12 +1044,12 @@ LayoutUnit RenderTable::outerBorderStart() const
     return borderWidth;
 }
 
-LayoutUnit RenderTable::outerBorderEnd() const
+int RenderTable::outerBorderEnd() const
 {
     if (!collapseBorders())
         return 0;
 
-    LayoutUnit borderWidth = 0;
+    int borderWidth = 0;
 
     const BorderValue& tb = style()->borderEnd();
     if (tb.style() == BHIDDEN)
@@ -1061,7 +1061,7 @@ LayoutUnit RenderTable::outerBorderEnd() const
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (!child->isTableSection())
             continue;
-        LayoutUnit sw = toRenderTableSection(child)->outerBorderEnd();
+        int sw = toRenderTableSection(child)->outerBorderEnd();
         if (sw < 0)
             continue;
         allHidden = false;
diff --git a/Source/WebCore/rendering/RenderTable.h b/Source/WebCore/rendering/RenderTable.h
index 9a6557e03..d4e4fca91 100644
--- a/Source/WebCore/rendering/RenderTable.h
+++ b/Source/WebCore/rendering/RenderTable.h
@@ -52,33 +52,33 @@ public:
     
     bool collapseBorders() const { return style()->borderCollapse(); }
 
-    LayoutUnit borderStart() const { return m_borderStart; }
-    LayoutUnit borderEnd() const { return m_borderEnd; }
-    LayoutUnit borderBefore() const;
-    LayoutUnit borderAfter() const;
+    int borderStart() const { return m_borderStart; }
+    int borderEnd() const { return m_borderEnd; }
+    int borderBefore() const;
+    int borderAfter() const;
 
-    LayoutUnit borderLeft() const
+    int borderLeft() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isLeftToRightDirection() ? borderStart() : borderEnd();
         return style()->isFlippedBlocksWritingMode() ? borderAfter() : borderBefore();
     }
 
-    LayoutUnit borderRight() const
+    int borderRight() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isLeftToRightDirection() ? borderEnd() : borderStart();
         return style()->isFlippedBlocksWritingMode() ? borderBefore() : borderAfter();
     }
 
-    LayoutUnit borderTop() const
+    int borderTop() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isFlippedBlocksWritingMode() ? borderAfter() : borderBefore();
         return style()->isLeftToRightDirection() ? borderStart() : borderEnd();
     }
 
-    LayoutUnit borderBottom() const
+    int borderBottom() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isFlippedBlocksWritingMode() ? borderBefore() : borderAfter();
@@ -87,41 +87,41 @@ public:
 
     Color bgColor() const { return style()->visitedDependentColor(CSSPropertyBackgroundColor); }
 
-    LayoutUnit outerBorderBefore() const;
-    LayoutUnit outerBorderAfter() const;
-    LayoutUnit outerBorderStart() const;
-    LayoutUnit outerBorderEnd() const;
+    int outerBorderBefore() const;
+    int outerBorderAfter() const;
+    int outerBorderStart() const;
+    int outerBorderEnd() const;
 
-    LayoutUnit outerBorderLeft() const
+    int outerBorderLeft() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isLeftToRightDirection() ? outerBorderStart() : outerBorderEnd();
         return style()->isFlippedBlocksWritingMode() ? outerBorderAfter() : outerBorderBefore();
     }
 
-    LayoutUnit outerBorderRight() const
+    int outerBorderRight() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isLeftToRightDirection() ? outerBorderEnd() : outerBorderStart();
         return style()->isFlippedBlocksWritingMode() ? outerBorderBefore() : outerBorderAfter();
     }
 
-    LayoutUnit outerBorderTop() const
+    int outerBorderTop() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isFlippedBlocksWritingMode() ? outerBorderAfter() : outerBorderBefore();
         return style()->isLeftToRightDirection() ? outerBorderStart() : outerBorderEnd();
     }
 
-    LayoutUnit outerBorderBottom() const
+    int outerBorderBottom() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isFlippedBlocksWritingMode() ? outerBorderBefore() : outerBorderAfter();
         return style()->isLeftToRightDirection() ? outerBorderEnd() : outerBorderStart();
     }
 
-    LayoutUnit calcBorderStart() const;
-    LayoutUnit calcBorderEnd() const;
+    int calcBorderStart() const;
+    int calcBorderEnd() const;
     void recalcBordersInRowDirection();
 
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
@@ -271,8 +271,8 @@ private:
     
     short m_hSpacing;
     short m_vSpacing;
-    LayoutUnit m_borderStart;
-    LayoutUnit m_borderEnd;
+    int m_borderStart;
+    int m_borderEnd;
 };
 
 inline RenderTableSection* RenderTable::topSection() const
diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
index 434ac0d69..4243848d9 100644
--- a/Source/WebCore/rendering/RenderTableCell.cpp
+++ b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -191,51 +191,51 @@ void RenderTableCell::layout()
     setCellWidthChanged(false);
 }
 
-LayoutUnit RenderTableCell::paddingTop(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingTop(PaddingOptions paddingOption) const
 {
     LayoutUnit result = RenderBlock::paddingTop();
-    if (!includeIntrinsicPadding || !isHorizontalWritingMode())
+    if (paddingOption == ExcludeIntrinsicPadding || !isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == TopToBottomWritingMode ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
 }
 
-LayoutUnit RenderTableCell::paddingBottom(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingBottom(PaddingOptions paddingOption) const
 {
     LayoutUnit result = RenderBlock::paddingBottom();
-    if (!includeIntrinsicPadding || !isHorizontalWritingMode())
+    if (paddingOption == ExcludeIntrinsicPadding || !isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == TopToBottomWritingMode ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
 }
 
-LayoutUnit RenderTableCell::paddingLeft(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingLeft(PaddingOptions paddingOption) const
 {
     LayoutUnit result = RenderBlock::paddingLeft();
-    if (!includeIntrinsicPadding || isHorizontalWritingMode())
+    if (paddingOption == ExcludeIntrinsicPadding || isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == LeftToRightWritingMode ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
     
 }
 
-LayoutUnit RenderTableCell::paddingRight(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingRight(PaddingOptions paddingOption) const
 {   
     LayoutUnit result = RenderBlock::paddingRight();
-    if (!includeIntrinsicPadding || isHorizontalWritingMode())
+    if (paddingOption == ExcludeIntrinsicPadding || isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == LeftToRightWritingMode ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
 }
 
-LayoutUnit RenderTableCell::paddingBefore(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingBefore(PaddingOptions paddingOption) const
 {
     LayoutUnit result = RenderBlock::paddingBefore();
-    if (!includeIntrinsicPadding)
+    if (paddingOption == ExcludeIntrinsicPadding)
         return result;
     return result + intrinsicPaddingBefore();
 }
 
-LayoutUnit RenderTableCell::paddingAfter(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingAfter(PaddingOptions paddingOption) const
 {
     LayoutUnit result = RenderBlock::paddingAfter();
-    if (!includeIntrinsicPadding)
+    if (paddingOption == ExcludeIntrinsicPadding)
         return result;
     return result + intrinsicPaddingAfter();
 }
@@ -267,11 +267,11 @@ LayoutRect RenderTableCell::clippedOverflowRectForRepaint(RenderBoxModelObject*
         return RenderBlock::clippedOverflowRectForRepaint(repaintContainer);
 
     bool rtl = !table()->style()->isLeftToRightDirection();
-    LayoutUnit outlineSize = style()->outlineSize();
-    LayoutUnit left = max(borderHalfLeft(true), outlineSize);
-    LayoutUnit right = max(borderHalfRight(true), outlineSize);
-    LayoutUnit top = max(borderHalfTop(true), outlineSize);
-    LayoutUnit bottom = max(borderHalfBottom(true), outlineSize);
+    int outlineSize = style()->outlineSize();
+    int left = max(borderHalfLeft(true), outlineSize);
+    int right = max(borderHalfRight(true), outlineSize);
+    int top = max(borderHalfTop(true), outlineSize);
+    int bottom = max(borderHalfBottom(true), outlineSize);
     if ((left && !rtl) || (right && rtl)) {
         if (RenderTableCell* before = table()->cellBefore(this)) {
             top = max(top, before->borderHalfTop(true));
@@ -328,7 +328,7 @@ LayoutUnit RenderTableCell::cellBaselinePosition() const
     LayoutUnit firstLineBaseline = firstLineBoxBaseline();
     if (firstLineBaseline != -1)
         return firstLineBaseline;
-    return paddingBefore() + borderBefore() + contentLogicalHeight();
+    return paddingBefore() + borderBefore() + contentLogicalHeight(IncludeIntrinsicPadding);
 }
 
 void RenderTableCell::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
@@ -747,49 +747,49 @@ inline CollapsedBorderValue RenderTableCell::cachedCollapsedBottomBorder(RenderS
     return tableStyle->isLeftToRightDirection() ? section()->cachedCollapsedBorder(this, CBSEnd) : section()->cachedCollapsedBorder(this, CBSStart);
 }
 
-LayoutUnit RenderTableCell::borderLeft() const
+int RenderTableCell::borderLeft() const
 {
     return table()->collapseBorders() ? borderHalfLeft(false) : RenderBlock::borderLeft();
 }
 
-LayoutUnit RenderTableCell::borderRight() const
+int RenderTableCell::borderRight() const
 {
     return table()->collapseBorders() ? borderHalfRight(false) : RenderBlock::borderRight();
 }
 
-LayoutUnit RenderTableCell::borderTop() const
+int RenderTableCell::borderTop() const
 {
     return table()->collapseBorders() ? borderHalfTop(false) : RenderBlock::borderTop();
 }
 
-LayoutUnit RenderTableCell::borderBottom() const
+int RenderTableCell::borderBottom() const
 {
     return table()->collapseBorders() ? borderHalfBottom(false) : RenderBlock::borderBottom();
 }
 
 // FIXME: https://bugs.webkit.org/show_bug.cgi?id=46191, make the collapsed border drawing
 // work with different block flow values instead of being hard-coded to top-to-bottom.
-LayoutUnit RenderTableCell::borderStart() const
+int RenderTableCell::borderStart() const
 {
     return table()->collapseBorders() ? borderHalfStart(false) : RenderBlock::borderStart();
 }
 
-LayoutUnit RenderTableCell::borderEnd() const
+int RenderTableCell::borderEnd() const
 {
     return table()->collapseBorders() ? borderHalfEnd(false) : RenderBlock::borderEnd();
 }
 
-LayoutUnit RenderTableCell::borderBefore() const
+int RenderTableCell::borderBefore() const
 {
     return table()->collapseBorders() ? borderHalfBefore(false) : RenderBlock::borderBefore();
 }
 
-LayoutUnit RenderTableCell::borderAfter() const
+int RenderTableCell::borderAfter() const
 {
     return table()->collapseBorders() ? borderHalfAfter(false) : RenderBlock::borderAfter();
 }
 
-LayoutUnit RenderTableCell::borderHalfLeft(bool outer) const
+int RenderTableCell::borderHalfLeft(bool outer) const
 {
     RenderStyle* tableStyle = table()->style();
     if (tableStyle->isHorizontalWritingMode())
@@ -797,7 +797,7 @@ LayoutUnit RenderTableCell::borderHalfLeft(bool outer) const
     return tableStyle->isFlippedBlocksWritingMode() ? borderHalfAfter(outer) : borderHalfBefore(outer);
 }
 
-LayoutUnit RenderTableCell::borderHalfRight(bool outer) const
+int RenderTableCell::borderHalfRight(bool outer) const
 {
     RenderStyle* tableStyle = table()->style();
     if (tableStyle->isHorizontalWritingMode())
@@ -805,7 +805,7 @@ LayoutUnit RenderTableCell::borderHalfRight(bool outer) const
     return tableStyle->isFlippedBlocksWritingMode() ? borderHalfBefore(outer) : borderHalfAfter(outer);
 }
 
-LayoutUnit RenderTableCell::borderHalfTop(bool outer) const
+int RenderTableCell::borderHalfTop(bool outer) const
 {
     RenderStyle* tableStyle = table()->style();
     if (tableStyle->isHorizontalWritingMode())
@@ -813,7 +813,7 @@ LayoutUnit RenderTableCell::borderHalfTop(bool outer) const
     return tableStyle->isLeftToRightDirection() ? borderHalfStart(outer) : borderHalfEnd(outer);
 }
 
-LayoutUnit RenderTableCell::borderHalfBottom(bool outer) const
+int RenderTableCell::borderHalfBottom(bool outer) const
 {
     RenderStyle* tableStyle = table()->style();
     if (tableStyle->isHorizontalWritingMode())
@@ -821,7 +821,7 @@ LayoutUnit RenderTableCell::borderHalfBottom(bool outer) const
     return tableStyle->isLeftToRightDirection() ? borderHalfEnd(outer) : borderHalfStart(outer);
 }
 
-LayoutUnit RenderTableCell::borderHalfStart(bool outer) const
+int RenderTableCell::borderHalfStart(bool outer) const
 {
     CollapsedBorderValue border = collapsedStartBorder(DoNotIncludeBorderColor);
     if (border.exists())
@@ -829,7 +829,7 @@ LayoutUnit RenderTableCell::borderHalfStart(bool outer) const
     return 0;
 }
     
-LayoutUnit RenderTableCell::borderHalfEnd(bool outer) const
+int RenderTableCell::borderHalfEnd(bool outer) const
 {
     CollapsedBorderValue border = collapsedEndBorder(DoNotIncludeBorderColor);
     if (border.exists())
@@ -837,7 +837,7 @@ LayoutUnit RenderTableCell::borderHalfEnd(bool outer) const
     return 0;
 }
 
-LayoutUnit RenderTableCell::borderHalfBefore(bool outer) const
+int RenderTableCell::borderHalfBefore(bool outer) const
 {
     CollapsedBorderValue border = collapsedBeforeBorder(DoNotIncludeBorderColor);
     if (border.exists())
@@ -845,7 +845,7 @@ LayoutUnit RenderTableCell::borderHalfBefore(bool outer) const
     return 0;
 }
 
-LayoutUnit RenderTableCell::borderHalfAfter(bool outer) const
+int RenderTableCell::borderHalfAfter(bool outer) const
 {
     CollapsedBorderValue border = collapsedAfterBorder(DoNotIncludeBorderColor);
     if (border.exists())
@@ -960,18 +960,20 @@ void RenderTableCell::paintCollapsedBorders(PaintInfo& paintInfo, const LayoutPo
     if (!paintInfo.shouldPaintWithinRoot(this) || style()->visibility() != VISIBLE)
         return;
 
-    LayoutPoint adjustedPaintOffset = paintOffset + location();
-    LayoutUnit os = 2 * maximalOutlineSize(paintInfo.phase);
-    if (!(adjustedPaintOffset.y() - table()->outerBorderTop() < paintInfo.rect.maxY() + os
-        && adjustedPaintOffset.y() + height() + table()->outerBorderBottom() > paintInfo.rect.y() - os))
+    LayoutRect localRepaintRect = paintInfo.rect;
+    localRepaintRect.inflate(maximalOutlineSize(paintInfo.phase));
+
+    LayoutRect paintRect = LayoutRect(paintOffset + location(), size());
+    if (paintRect.y() - table()->outerBorderTop() >= localRepaintRect.maxY())
+        return;
+
+    if (paintRect.maxY() + table()->outerBorderBottom() <= localRepaintRect.y())
         return;
 
     GraphicsContext* graphicsContext = paintInfo.context;
     if (!table()->currentBorderValue() || graphicsContext->paintingDisabled())
         return;
 
-    LayoutRect paintRect = LayoutRect(adjustedPaintOffset, size());
-
     RenderStyle* tableStyle = table()->style();
     CollapsedBorderValue leftVal = cachedCollapsedLeftBorder(tableStyle);
     CollapsedBorderValue rightVal = cachedCollapsedRightBorder(tableStyle);
@@ -979,16 +981,16 @@ void RenderTableCell::paintCollapsedBorders(PaintInfo& paintInfo, const LayoutPo
     CollapsedBorderValue bottomVal = cachedCollapsedBottomBorder(tableStyle);
      
     // Adjust our x/y/width/height so that we paint the collapsed borders at the correct location.
-    LayoutUnit topWidth = topVal.width();
-    LayoutUnit bottomWidth = bottomVal.width();
-    LayoutUnit leftWidth = leftVal.width();
-    LayoutUnit rightWidth = rightVal.width();
-    
-    LayoutUnit x = paintRect.x() - leftWidth / 2;
-    LayoutUnit y = paintRect.y() - topWidth / 2;
-    LayoutUnit w = paintRect.width() + leftWidth / 2 + (rightWidth + 1) / 2;
-    LayoutUnit h = paintRect.height() + topWidth / 2 + (bottomWidth + 1) / 2;
-    
+    int topWidth = topVal.width();
+    int bottomWidth = bottomVal.width();
+    int leftWidth = leftVal.width();
+    int rightWidth = rightVal.width();
+
+    IntRect borderRect = pixelSnappedIntRect(paintRect.x() - leftWidth / 2,
+            paintRect.y() - topWidth / 2,
+            paintRect.width() + leftWidth / 2 + (rightWidth + 1) / 2,
+            paintRect.height() + topWidth / 2 + (bottomWidth + 1) / 2);
+
     EBorderStyle topStyle = collapsedBorderStyle(topVal.style());
     EBorderStyle bottomStyle = collapsedBorderStyle(bottomVal.style());
     EBorderStyle leftStyle = collapsedBorderStyle(leftVal.style());
@@ -1002,10 +1004,10 @@ void RenderTableCell::paintCollapsedBorders(PaintInfo& paintInfo, const LayoutPo
     // We never paint diagonals at the joins.  We simply let the border with the highest
     // precedence paint on top of borders with lower precedence.  
     CollapsedBorders borders;
-    borders.addBorder(topVal, BSTop, renderTop, x, y, x + w, y + topWidth, topStyle);
-    borders.addBorder(bottomVal, BSBottom, renderBottom, x, y + h - bottomWidth, x + w, y + h, bottomStyle);
-    borders.addBorder(leftVal, BSLeft, renderLeft, x, y, x + leftWidth, y + h, leftStyle);
-    borders.addBorder(rightVal, BSRight, renderRight, x + w - rightWidth, y, x + w, y + h, rightStyle);
+    borders.addBorder(topVal, BSTop, renderTop, borderRect.x(), borderRect.y(), borderRect.maxX(), borderRect.y() + topWidth, topStyle);
+    borders.addBorder(bottomVal, BSBottom, renderBottom, borderRect.x(), borderRect.maxY() - bottomWidth, borderRect.maxX(), borderRect.maxY(), bottomStyle);
+    borders.addBorder(leftVal, BSLeft, renderLeft, borderRect.x(), borderRect.y(), borderRect.x() + leftWidth, borderRect.maxY(), leftStyle);
+    borders.addBorder(rightVal, BSRight, renderRight, borderRect.maxX() - rightWidth, borderRect.y(), borderRect.maxX(), borderRect.maxY(), rightStyle);
 
     bool antialias = shouldAntialiasLines(graphicsContext);
     
diff --git a/Source/WebCore/rendering/RenderTableCell.h b/Source/WebCore/rendering/RenderTableCell.h
index e0b4a0558..e18372ac5 100644
--- a/Source/WebCore/rendering/RenderTableCell.h
+++ b/Source/WebCore/rendering/RenderTableCell.h
@@ -91,14 +91,14 @@ public:
 
     void updateLogicalWidth(LayoutUnit);
 
-    virtual LayoutUnit borderLeft() const;
-    virtual LayoutUnit borderRight() const;
-    virtual LayoutUnit borderTop() const;
-    virtual LayoutUnit borderBottom() const;
-    virtual LayoutUnit borderStart() const;
-    virtual LayoutUnit borderEnd() const;
-    virtual LayoutUnit borderBefore() const;
-    virtual LayoutUnit borderAfter() const;
+    virtual int borderLeft() const;
+    virtual int borderRight() const;
+    virtual int borderTop() const;
+    virtual int borderBottom() const;
+    virtual int borderStart() const;
+    virtual int borderEnd() const;
+    virtual int borderBefore() const;
+    virtual int borderAfter() const;
 
     void collectBorderValues(RenderTable::CollapsedBorderValues&) const;
     static void sortBorderValues(RenderTable::CollapsedBorderValues&);
@@ -120,16 +120,16 @@ public:
     int intrinsicPaddingBefore() const { return m_intrinsicPaddingBefore; }
     int intrinsicPaddingAfter() const { return m_intrinsicPaddingAfter; }
 
-    virtual LayoutUnit paddingTop(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingBottom(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingLeft(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingRight(bool includeIntrinsicPadding = true) const;
+    virtual LayoutUnit paddingTop(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingBottom(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingLeft(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingRight(PaddingOptions = IncludeIntrinsicPadding) const;
     
     // FIXME: For now we just assume the cell has the same block flow direction as the table.  It's likely we'll
     // create an extra anonymous RenderBlock to handle mixing directionality anyway, in which case we can lock
     // the block flow directionality of the cells to the table's directionality.
-    virtual LayoutUnit paddingBefore(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingAfter(bool includeIntrinsicPadding = true) const;
+    virtual LayoutUnit paddingBefore(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingAfter(PaddingOptions = IncludeIntrinsicPadding) const;
 
     void setOverrideHeightFromRowHeight(LayoutUnit);
 
@@ -159,15 +159,15 @@ private:
     virtual LayoutRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const;
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, LayoutRect&, bool fixed = false) const;
 
-    LayoutUnit borderHalfLeft(bool outer) const;
-    LayoutUnit borderHalfRight(bool outer) const;
-    LayoutUnit borderHalfTop(bool outer) const;
-    LayoutUnit borderHalfBottom(bool outer) const;
+    int borderHalfLeft(bool outer) const;
+    int borderHalfRight(bool outer) const;
+    int borderHalfTop(bool outer) const;
+    int borderHalfBottom(bool outer) const;
 
-    LayoutUnit borderHalfStart(bool outer) const;
-    LayoutUnit borderHalfEnd(bool outer) const;
-    LayoutUnit borderHalfBefore(bool outer) const;
-    LayoutUnit borderHalfAfter(bool outer) const;
+    int borderHalfStart(bool outer) const;
+    int borderHalfEnd(bool outer) const;
+    int borderHalfBefore(bool outer) const;
+    int borderHalfAfter(bool outer) const;
 
     CollapsedBorderValue collapsedStartBorder(IncludeBorderColorOrNot = IncludeBorderColor) const;
     CollapsedBorderValue collapsedEndBorder(IncludeBorderColorOrNot = IncludeBorderColor) const;
diff --git a/Source/WebCore/rendering/RenderTableRow.h b/Source/WebCore/rendering/RenderTableRow.h
index 67d81c6a5..f3175dfc0 100644
--- a/Source/WebCore/rendering/RenderTableRow.h
+++ b/Source/WebCore/rendering/RenderTableRow.h
@@ -57,7 +57,8 @@ private:
     virtual LayoutRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const;
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
 
-    virtual bool requiresLayer() const { return isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasFilter(); }
+    // We need to allocate a layer whenever we have an overflow clip as RenderTableSection::paintObject does not push rows' clips.
+    virtual bool requiresLayer() const OVERRIDE { return isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasFilter(); }
 
     virtual void paint(PaintInfo&, const LayoutPoint&);
 
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index 844209c8d..08a8c9b7d 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -304,7 +304,7 @@ void RenderTableSection::setCellLogicalWidths()
                     if (!statePusher.didPush()) {
                         // Technically, we should also push state for the row, but since
                         // rows don't push a coordinate transform, that's not necessary.
-                        statePusher.push(this, LayoutSize(x(), y()));
+                        statePusher.push(this, locationOffset());
                     }
                     cell->repaint();
                 }
@@ -334,6 +334,7 @@ int RenderTableSection::calcRowLogicalHeight()
     m_rowPos[0] = spacing;
 
     for (unsigned r = 0; r < m_grid.size(); r++) {
+        m_grid[r].baseline = 0;
         LayoutUnit baselineDescent = 0;
 
         // Our base size is the biggest logical height from our cells' styles (excluding row spanning cells).
@@ -416,10 +417,110 @@ void RenderTableSection::layout()
         }
     }
     statePusher.pop();
+
+    if (hasOverflowClip() && !hasLayer())
+        updateCachedSizeForOverflowClip();
+
     setNeedsLayout(false);
 }
 
-int RenderTableSection::layoutRows(int toAdd)
+int RenderTableSection::distributeExtraLogicalHeightToPercentRows(int extraLogicalHeight, int totalPercent)
+{
+    if (!totalPercent)
+        return extraLogicalHeight;
+
+    unsigned totalRows = m_grid.size();
+    int totalHeight = m_rowPos[totalRows] + extraLogicalHeight;
+    int add = 0;
+    totalPercent = min(totalPercent, 100);
+    int rowHeight = m_rowPos[1] - m_rowPos[0];
+    for (unsigned r = 0; r < totalRows; ++r) {
+        if (totalPercent > 0 && m_grid[r].logicalHeight.isPercent()) {
+            int toAdd = min<int>(extraLogicalHeight, (totalHeight * m_grid[r].logicalHeight.percent() / 100) - rowHeight);
+            // If toAdd is negative, then we don't want to shrink the row (this bug
+            // affected Outlook Web Access).
+            toAdd = max(0, toAdd);
+            add += toAdd;
+            extraLogicalHeight -= toAdd;
+            totalPercent -= m_grid[r].logicalHeight.percent();
+        }
+        ASSERT(totalRows >= 1);
+        if (r < totalRows - 1)
+            rowHeight = m_rowPos[r + 2] - m_rowPos[r + 1];
+        m_rowPos[r + 1] += add;
+    }
+    return extraLogicalHeight;
+}
+
+int RenderTableSection::distributeExtraLogicalHeightToAutoRows(int extraLogicalHeight, unsigned autoRowsCount)
+{
+    if (!autoRowsCount)
+        return extraLogicalHeight;
+
+    int add = 0;
+    for (unsigned r = 0; r < m_grid.size(); ++r) {
+        if (autoRowsCount > 0 && m_grid[r].logicalHeight.isAuto()) {
+            // Recomputing |extraLogicalHeightForRow| guarantees that we properly ditribute round |extraLogicalHeight|.
+            int extraLogicalHeightForRow = extraLogicalHeight / autoRowsCount;
+            add += extraLogicalHeightForRow;
+            extraLogicalHeight -= extraLogicalHeightForRow;
+            --autoRowsCount;
+        }
+        m_rowPos[r + 1] += add;
+    }
+    return extraLogicalHeight;
+}
+
+int RenderTableSection::distributeRemainingExtraLogicalHeight(int extraLogicalHeight)
+{
+    unsigned totalRows = m_grid.size();
+
+    if (extraLogicalHeight <= 0 || !m_rowPos[totalRows])
+        return extraLogicalHeight;
+
+    // FIXME: m_rowPos[totalRows] - m_rowPos[0] is the total rows' size.
+    int totalRowSize = m_rowPos[totalRows];
+    int add = 0;
+    int previousRowPosition = m_rowPos[0];
+    for (unsigned r = 0; r < totalRows; r++) {
+        // weight with the original height
+        add += extraLogicalHeight * (m_rowPos[r + 1] - previousRowPosition) / totalRowSize;
+        previousRowPosition = m_rowPos[r + 1];
+        m_rowPos[r + 1] += add;
+    }
+
+    return extraLogicalHeight;
+}
+
+int RenderTableSection::distributeExtraLogicalHeightToRows(int extraLogicalHeight)
+{
+    if (!extraLogicalHeight)
+        return extraLogicalHeight;
+
+    unsigned totalRows = m_grid.size();
+    if (!totalRows)
+        return extraLogicalHeight;
+
+    if (!m_rowPos[totalRows] && nextSibling())
+        return extraLogicalHeight;
+
+    unsigned autoRowsCount = 0;
+    int totalPercent = 0;
+    for (unsigned r = 0; r < totalRows; r++) {
+        if (m_grid[r].logicalHeight.isAuto())
+            ++autoRowsCount;
+        else if (m_grid[r].logicalHeight.isPercent())
+            totalPercent += m_grid[r].logicalHeight.percent();
+    }
+
+    int remainingExtraLogicalHeight = extraLogicalHeight;
+    remainingExtraLogicalHeight = distributeExtraLogicalHeightToPercentRows(remainingExtraLogicalHeight, totalPercent);
+    remainingExtraLogicalHeight = distributeExtraLogicalHeightToAutoRows(remainingExtraLogicalHeight, autoRowsCount);
+    remainingExtraLogicalHeight = distributeRemainingExtraLogicalHeight(remainingExtraLogicalHeight);
+    return remainingExtraLogicalHeight;
+}
+
+int RenderTableSection::layoutRows(int extraLogicalHeight)
 {
 #ifndef NDEBUG
     setNeedsLayoutIsForbidden(true);
@@ -437,71 +538,13 @@ int RenderTableSection::layoutRows(int toAdd)
     m_overflowingCells.clear();
     m_forceSlowPaintPathWithOverflowingCell = false;
 
-    if (toAdd && totalRows && (m_rowPos[totalRows] || !nextSibling())) {
-        int totalHeight = m_rowPos[totalRows] + toAdd;
-
-        int dh = toAdd;
-        int totalPercent = 0;
-        int numAuto = 0;
-        for (unsigned r = 0; r < totalRows; r++) {
-            if (m_grid[r].logicalHeight.isAuto())
-                numAuto++;
-            else if (m_grid[r].logicalHeight.isPercent())
-                totalPercent += m_grid[r].logicalHeight.percent();
-        }
-        if (totalPercent) {
-            // try to satisfy percent
-            int add = 0;
-            totalPercent = min(totalPercent, 100);
-            int rh = m_rowPos[1] - m_rowPos[0];
-            for (unsigned r = 0; r < totalRows; r++) {
-                if (totalPercent > 0 && m_grid[r].logicalHeight.isPercent()) {
-                    int toAdd = min<int>(dh, (totalHeight * m_grid[r].logicalHeight.percent() / 100) - rh);
-                    // If toAdd is negative, then we don't want to shrink the row (this bug
-                    // affected Outlook Web Access).
-                    toAdd = max(0, toAdd);
-                    add += toAdd;
-                    dh -= toAdd;
-                    totalPercent -= m_grid[r].logicalHeight.percent();
-                }
-                ASSERT(totalRows >= 1);
-                if (r < totalRows - 1)
-                    rh = m_rowPos[r + 2] - m_rowPos[r + 1];
-                m_rowPos[r + 1] += add;
-            }
-        }
-        if (numAuto) {
-            // distribute over variable cols
-            int add = 0;
-            for (unsigned r = 0; r < totalRows; r++) {
-                if (numAuto > 0 && m_grid[r].logicalHeight.isAuto()) {
-                    int toAdd = dh / numAuto;
-                    add += toAdd;
-                    dh -= toAdd;
-                    numAuto--;
-                }
-                m_rowPos[r + 1] += add;
-            }
-        }
-        if (dh > 0 && m_rowPos[totalRows]) {
-            // if some left overs, distribute equally.
-            int tot = m_rowPos[totalRows];
-            int add = 0;
-            int prev = m_rowPos[0];
-            for (unsigned r = 0; r < totalRows; r++) {
-                // weight with the original height
-                add += dh * (m_rowPos[r + 1] - prev) / tot;
-                prev = m_rowPos[r + 1];
-                m_rowPos[r + 1] += add;
-            }
-        }
-    }
+    extraLogicalHeight = distributeExtraLogicalHeightToRows(extraLogicalHeight);
 
     int hspacing = table()->hBorderSpacing();
     int vspacing = table()->vBorderSpacing();
     unsigned nEffCols = table()->numEffCols();
 
-    LayoutStateMaintainer statePusher(view(), this, LayoutSize(x(), y()), style()->isFlippedBlocksWritingMode());
+    LayoutStateMaintainer statePusher(view(), this, locationOffset(), style()->isFlippedBlocksWritingMode());
 
     for (unsigned r = 0; r < totalRows; r++) {
         // Set the row's x/y position and width/height.
@@ -911,7 +954,7 @@ LayoutUnit RenderTableSection::firstLineBoxBaseline() const
         const CellStruct& cs = firstRow.at(i);
         const RenderTableCell* cell = cs.primaryCell();
         if (cell)
-            firstLineBaseline = max(firstLineBaseline, cell->logicalTop() + cell->paddingBefore() + cell->borderBefore() + cell->contentLogicalHeight());
+            firstLineBaseline = max(firstLineBaseline, cell->logicalTop() + cell->paddingBefore() + cell->borderBefore() + cell->contentLogicalHeight(IncludeIntrinsicPadding));
     }
 
     return firstLineBaseline;
@@ -992,17 +1035,63 @@ void RenderTableSection::paintCell(RenderTableCell* cell, PaintInfo& paintInfo,
         cell->paint(paintInfo, cellPoint);
 }
 
-void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
+CellSpan RenderTableSection::dirtiedRows(const LayoutRect& damageRect) const
 {
-    // Check which rows and cols are visible and only paint these.
-    unsigned totalRows = m_grid.size();
-    unsigned totalCols = table()->columns().size();
+    if (m_forceSlowPaintPathWithOverflowingCell) 
+        return fullTableRowSpan();
 
-    PaintPhase paintPhase = paintInfo.phase;
+    LayoutUnit before = style()->isHorizontalWritingMode() ? damageRect.y() : damageRect.x();
+
+    // binary search to find a row
+    unsigned startRow = std::lower_bound(m_rowPos.begin(), m_rowPos.end(), before) - m_rowPos.begin();
+
+    // The binary search above gives us the first row with
+    // a y position >= the top of the paint rect. Thus, the previous
+    // may need to be repainted as well.
+    if (startRow == m_rowPos.size() || (startRow > 0 && (m_rowPos[startRow] >  before)))
+        --startRow;
+
+    LayoutUnit after = (style()->isHorizontalWritingMode() ? damageRect.maxY() : damageRect.maxX());
+    unsigned endRow = std::lower_bound(m_rowPos.begin(), m_rowPos.end(), after) - m_rowPos.begin();
+    if (endRow == m_rowPos.size())
+        --endRow;
+
+    if (!endRow && m_rowPos[0] - table()->outerBorderBefore() <= after)
+        ++endRow;
+
+    return CellSpan(startRow, endRow);
+}
 
-    LayoutUnit os = 2 * maximalOutlineSize(paintPhase);
-    unsigned startrow = 0;
-    unsigned endrow = totalRows;
+
+CellSpan RenderTableSection::dirtiedColumns(const LayoutRect& damageRect) const
+{
+    if (m_forceSlowPaintPathWithOverflowingCell) 
+        return fullTableColumnSpan();
+
+    // FIXME: Implement RTL.
+    if (!style()->isLeftToRightDirection())
+        return fullTableColumnSpan();
+
+    LayoutUnit start = style()->isHorizontalWritingMode() ? damageRect.x() : damageRect.y();
+    Vector<int>& columnPos = table()->columnPositions();
+    unsigned startCol = std::lower_bound(columnPos.begin(), columnPos.end(), start) - columnPos.begin();
+    if ((startCol == columnPos.size()) || (startCol > 0 && (columnPos[startCol] > start)))
+        --startCol;
+
+    LayoutUnit end = (style()->isHorizontalWritingMode() ? damageRect.maxX() : damageRect.maxY());
+    unsigned endCol = std::lower_bound(columnPos.begin(), columnPos.end(), end) - columnPos.begin();
+    if (endCol == columnPos.size())
+        --endCol;
+
+    if (!endCol && columnPos[0] - table()->outerBorderStart() <= end)
+        ++endCol;
+
+    return CellSpan(startCol, endCol);
+}
+
+void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
+{
+    PaintPhase paintPhase = paintInfo.phase;
 
     LayoutRect localRepaintRect = paintInfo.rect;
     localRepaintRect.moveBy(-paintOffset);
@@ -1013,56 +1102,23 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& pa
             localRepaintRect.setX(width() - localRepaintRect.maxX());
     }
 
-    if (!m_forceSlowPaintPathWithOverflowingCell) {
-        LayoutUnit before = (style()->isHorizontalWritingMode() ? localRepaintRect.y() : localRepaintRect.x()) - os;
-        // binary search to find a row
-        startrow = std::lower_bound(m_rowPos.begin(), m_rowPos.end(), before) - m_rowPos.begin();
-
-        // The binary search above gives us the first row with
-        // a y position >= the top of the paint rect. Thus, the previous
-        // may need to be repainted as well.
-        if (startrow == m_rowPos.size() || (startrow > 0 && (m_rowPos[startrow] >  before)))
-          --startrow;
+    localRepaintRect.inflate(maximalOutlineSize(paintPhase));
 
-        LayoutUnit after = (style()->isHorizontalWritingMode() ? localRepaintRect.maxY() : localRepaintRect.maxX()) + os;
-        endrow = std::lower_bound(m_rowPos.begin(), m_rowPos.end(), after) - m_rowPos.begin();
-        if (endrow == m_rowPos.size())
-          --endrow;
-
-        if (!endrow && m_rowPos[0] - table()->outerBorderBefore() <= after)
-            ++endrow;
-    }
+    CellSpan dirtiedRows = this->dirtiedRows(localRepaintRect);
+    CellSpan dirtiedColumns = this->dirtiedColumns(localRepaintRect);
 
-    unsigned startcol = 0;
-    unsigned endcol = totalCols;
-    // FIXME: Implement RTL.
-    if (!m_forceSlowPaintPathWithOverflowingCell && style()->isLeftToRightDirection()) {
-        LayoutUnit start = (style()->isHorizontalWritingMode() ? localRepaintRect.x() : localRepaintRect.y()) - os;
-        Vector<int>& columnPos = table()->columnPositions();
-        startcol = std::lower_bound(columnPos.begin(), columnPos.end(), start) - columnPos.begin();
-        if ((startcol == columnPos.size()) || (startcol > 0 && (columnPos[startcol] > start)))
-            --startcol;
-
-        LayoutUnit end = (style()->isHorizontalWritingMode() ? localRepaintRect.maxX() : localRepaintRect.maxY()) + os;
-        endcol = std::lower_bound(columnPos.begin(), columnPos.end(), end) - columnPos.begin();
-        if (endcol == columnPos.size())
-            --endcol;
-
-        if (!endcol && columnPos[0] - table()->outerBorderStart() <= end)
-            ++endcol;
-    }
-    if (startcol < endcol) {
+    if (dirtiedColumns.start() < dirtiedColumns.end()) {
         if (!m_hasMultipleCellLevels && !m_overflowingCells.size()) {
             if (paintInfo.phase == PaintPhaseCollapsedTableBorders) {
                 // Collapsed borders are painted from the bottom right to the top left so that precedence
                 // due to cell position is respected.
-                for (unsigned r = endrow; r > startrow; r--) {
+                for (unsigned r = dirtiedRows.end(); r > dirtiedRows.start(); r--) {
                     unsigned row = r - 1;
-                    for (unsigned c = endcol; c > startcol; c--) {
+                    for (unsigned c = dirtiedColumns.end(); c > dirtiedColumns.start(); c--) {
                         unsigned col = c - 1;
                         CellStruct& current = cellAt(row, col);
                         RenderTableCell* cell = current.primaryCell();
-                        if (!cell || (row > startrow && primaryCellAt(row - 1, col) == cell) || (col > startcol && primaryCellAt(row, col - 1) == cell))
+                        if (!cell || (row > dirtiedRows.start() && primaryCellAt(row - 1, col) == cell) || (col > dirtiedColumns.start() && primaryCellAt(row, col - 1) == cell))
                             continue;
                         LayoutPoint cellPoint = flipForWritingModeForChild(cell, paintOffset);
                         cell->paintCollapsedBorders(paintInfo, cellPoint);
@@ -1070,14 +1126,14 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& pa
                 }
             } else {
                 // Draw the dirty cells in the order that they appear.
-                for (unsigned r = startrow; r < endrow; r++) {
+                for (unsigned r = dirtiedRows.start(); r < dirtiedRows.end(); r++) {
                     RenderTableRow* row = m_grid[r].rowRenderer;
                     if (row && !row->hasSelfPaintingLayer())
                         row->paintOutlineForRowIfNeeded(paintInfo, paintOffset);
-                    for (unsigned c = startcol; c < endcol; c++) {
+                    for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) {
                         CellStruct& current = cellAt(r, c);
                         RenderTableCell* cell = current.primaryCell();
-                        if (!cell || (r > startrow && primaryCellAt(r - 1, c) == cell) || (c > startcol && primaryCellAt(r, c - 1) == cell))
+                        if (!cell || (r > dirtiedRows.start() && primaryCellAt(r - 1, c) == cell) || (c > dirtiedColumns.start() && primaryCellAt(r, c - 1) == cell))
                             continue;
                         paintCell(cell, paintInfo, paintOffset);
                     }
@@ -1085,7 +1141,11 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& pa
             }
         } else {
             // The overflowing cells should be scarce to avoid adding a lot of cells to the HashSet.
+#ifndef NDEBUG
+            unsigned totalRows = m_grid.size();
+            unsigned totalCols = table()->columns().size();
             ASSERT(m_overflowingCells.size() < totalRows * totalCols * gMaxAllowedOverflowingCellRatioForFastPaintPath);
+#endif
 
             // To make sure we properly repaint the section, we repaint all the overflowing cells that we collected.
             Vector<RenderTableCell*> cells;
@@ -1093,11 +1153,11 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& pa
 
             HashSet<RenderTableCell*> spanningCells;
 
-            for (unsigned r = startrow; r < endrow; r++) {
+            for (unsigned r = dirtiedRows.start(); r < dirtiedRows.end(); r++) {
                 RenderTableRow* row = m_grid[r].rowRenderer;
                 if (row && !row->hasSelfPaintingLayer())
                     row->paintOutlineForRowIfNeeded(paintInfo, paintOffset);
-                for (unsigned c = startcol; c < endcol; c++) {
+                for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) {
                     CellStruct& current = cellAt(r, c);
                     if (!current.hasCells())
                         continue;
diff --git a/Source/WebCore/rendering/RenderTableSection.h b/Source/WebCore/rendering/RenderTableSection.h
index d12c87041..8df74f06f 100644
--- a/Source/WebCore/rendering/RenderTableSection.h
+++ b/Source/WebCore/rendering/RenderTableSection.h
@@ -37,6 +37,23 @@ enum CollapsedBorderSide {
     CBSEnd
 };
 
+// Helper class for paintObject.
+class CellSpan {
+public:
+    CellSpan(unsigned start, unsigned end)
+        : m_start(start)
+        , m_end(end)
+    {
+    }
+
+    unsigned start() const { return m_start; }
+    unsigned end() const { return m_end; }
+
+private:
+    unsigned m_start;
+    unsigned m_end;
+};
+
 class RenderTableCell;
 class RenderTableRow;
 
@@ -168,8 +185,21 @@ private:
 
     void ensureRows(unsigned);
 
+    // Those methods return the remaining extra logical height.
+    // FIXME: We may want to introduce a structure holding the in-flux layout information.
+    int distributeExtraLogicalHeightToRows(int extraLogicalHeight);
+    int distributeExtraLogicalHeightToPercentRows(int extraLogicalHeight, int totalPercent);
+    int distributeExtraLogicalHeightToAutoRows(int extraLogicalHeight, unsigned autoRowsCount);
+    int distributeRemainingExtraLogicalHeight(int extraLogicalHeight);
+
     bool hasOverflowingCell() const { return m_overflowingCells.size() || m_forceSlowPaintPathWithOverflowingCell; }
 
+    CellSpan fullTableRowSpan() const { return CellSpan(0, m_grid.size()); }
+    CellSpan fullTableColumnSpan() const { return CellSpan(0, table()->columns().size()); }
+
+    CellSpan dirtiedRows(const LayoutRect& repaintRect) const;
+    CellSpan dirtiedColumns(const LayoutRect& repaintRect) const;
+
     RenderObjectChildList m_children;
 
     Vector<RowStruct> m_grid;
diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
index f2408dbcc..d497a33d6 100644
--- a/Source/WebCore/rendering/RenderText.cpp
+++ b/Source/WebCore/rendering/RenderText.cpp
@@ -303,10 +303,10 @@ PassRefPtr<StringImpl> RenderText::originalText() const
     return (e && e->isTextNode()) ? toText(e)->dataImpl() : 0;
 }
 
-void RenderText::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
+void RenderText::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
-        rects.append(enclosingLayoutRect(FloatRect(accumulatedOffset + box->topLeft(), box->size())));
+        rects.append(enclosingIntRect(FloatRect(accumulatedOffset + box->topLeft(), box->size())));
 }
 
 static FloatRect localQuadForTextBox(InlineTextBox* box, unsigned start, unsigned end, bool useSelectionHeight)
@@ -330,7 +330,7 @@ static FloatRect localQuadForTextBox(InlineTextBox* box, unsigned start, unsigne
     return FloatRect();
 }
 
-void RenderText::absoluteRectsForRange(Vector<LayoutRect>& rects, unsigned start, unsigned end, bool useSelectionHeight, bool* wasFixed)
+void RenderText::absoluteRectsForRange(Vector<IntRect>& rects, unsigned start, unsigned end, bool useSelectionHeight, bool* wasFixed)
 {
     // Work around signed/unsigned issues. This function takes unsigneds, and is often passed UINT_MAX
     // to mean "all the way to the end". InlineTextBox coordinates are unsigneds, so changing this 
@@ -347,7 +347,6 @@ void RenderText::absoluteRectsForRange(Vector<LayoutRect>& rects, unsigned start
         if (start <= box->start() && box->end() < end) {
             FloatRect r = box->calculateBoundaries();
             if (useSelectionHeight) {
-                // FIXME: localSelectionRect should switch to return FloatRect soon with the subpixellayout branch.
                 IntRect selectionRect = box->localSelectionRect(start, end);
                 if (box->isHorizontal()) {
                     r.setHeight(selectionRect.height());
@@ -479,8 +478,11 @@ static bool lineDirectionPointFitsInBox(int pointLineDirection, InlineTextBox* b
 
     // the x coordinate is equal to the left edge of this box
     // the affinity must be downstream so the position doesn't jump back to the previous line
-    if (pointLineDirection == box->logicalLeft())
+    // except when box is the first box in the line
+    if (pointLineDirection <= box->logicalLeft()) {
+        shouldAffinityBeDownstream = !box->prevLeafChild() ? UpstreamIfPositionIsNotAtStart : AlwaysDownstream;
         return true;
+    }
 
     // and the x coordinate is to the left of the right edge of this box
     // check to see if position goes in this box
@@ -491,10 +493,10 @@ static bool lineDirectionPointFitsInBox(int pointLineDirection, InlineTextBox* b
 
     // box is first on line
     // and the x coordinate is to the left of the first text box left edge
-    if (!box->prevOnLine() && pointLineDirection < box->logicalLeft())
+    if (!box->prevLeafChildIgnoringLineBreak() && pointLineDirection < box->logicalLeft())
         return true;
 
-    if (!box->nextOnLine()) {
+    if (!box->nextLeafChildIgnoringLineBreak()) {
         // box is last on line
         // and the x coordinate is to the right of the last text box right edge
         // generate VisiblePosition, use UPSTREAM affinity if possible
@@ -535,7 +537,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
     if (positionIsAtStartOfBox == box->isLeftToRightDirection()) {
         // offset is on the left edge
 
-        const InlineBox* prevBox = box->prevLeafChild();
+        const InlineBox* prevBox = box->prevLeafChildIgnoringLineBreak();
         if ((prevBox && prevBox->bidiLevel() == box->bidiLevel())
             || box->renderer()->containingBlock()->style()->direction() == box->direction()) // FIXME: left on 12CBA
             return createVisiblePositionForBox(box, box->caretLeftmostOffset(), shouldAffinityBeDownstream);
@@ -545,7 +547,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
             const InlineBox* leftmostBox;
             do {
                 leftmostBox = prevBox;
-                prevBox = leftmostBox->prevLeafChild();
+                prevBox = leftmostBox->prevLeafChildIgnoringLineBreak();
             } while (prevBox && prevBox->bidiLevel() > box->bidiLevel());
             return createVisiblePositionForBox(leftmostBox, leftmostBox->caretRightmostOffset(), shouldAffinityBeDownstream);
         }
@@ -556,7 +558,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
             const InlineBox* nextBox = box;
             do {
                 rightmostBox = nextBox;
-                nextBox = rightmostBox->nextLeafChild();
+                nextBox = rightmostBox->nextLeafChildIgnoringLineBreak();
             } while (nextBox && nextBox->bidiLevel() >= box->bidiLevel());
             return createVisiblePositionForBox(rightmostBox,
                 box->isLeftToRightDirection() ? rightmostBox->caretMaxOffset() : rightmostBox->caretMinOffset(), shouldAffinityBeDownstream);
@@ -565,7 +567,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
         return createVisiblePositionForBox(box, box->caretRightmostOffset(), shouldAffinityBeDownstream);
     }
 
-    const InlineBox* nextBox = box->nextLeafChild();
+    const InlineBox* nextBox = box->nextLeafChildIgnoringLineBreak();
     if ((nextBox && nextBox->bidiLevel() == box->bidiLevel())
         || box->renderer()->containingBlock()->style()->direction() == box->direction())
         return createVisiblePositionForBox(box, box->caretRightmostOffset(), shouldAffinityBeDownstream);
@@ -576,7 +578,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
         const InlineBox* rightmostBox;
         do {
             rightmostBox = nextBox;
-            nextBox = rightmostBox->nextLeafChild();
+            nextBox = rightmostBox->nextLeafChildIgnoringLineBreak();
         } while (nextBox && nextBox->bidiLevel() > box->bidiLevel());
         return createVisiblePositionForBox(rightmostBox, rightmostBox->caretLeftmostOffset(), shouldAffinityBeDownstream);
     }
@@ -587,7 +589,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
         const InlineBox* prevBox = box;
         do {
             leftmostBox = prevBox;
-            prevBox = leftmostBox->prevLeafChild();
+            prevBox = leftmostBox->prevLeafChildIgnoringLineBreak();
         } while (prevBox && prevBox->bidiLevel() >= box->bidiLevel());
         return createVisiblePositionForBox(leftmostBox,
             box->isLeftToRightDirection() ? leftmostBox->caretMinOffset() : leftmostBox->caretMaxOffset(), shouldAffinityBeDownstream);
@@ -601,28 +603,14 @@ VisiblePosition RenderText::positionForPoint(const LayoutPoint& point)
     if (!firstTextBox() || textLength() == 0)
         return createVisiblePosition(0, DOWNSTREAM);
 
-    // Get the offset for the position, since this will take rtl text into account.
-    int offset;
-
     LayoutUnit pointLineDirection = firstTextBox()->isHorizontal() ? point.x() : point.y();
     LayoutUnit pointBlockDirection = firstTextBox()->isHorizontal() ? point.y() : point.x();
-    
-    // FIXME: We should be able to roll these special cases into the general cases in the loop below.
-    if (firstTextBox() && pointBlockDirection <  firstTextBox()->root()->selectionBottom() && pointLineDirection < firstTextBox()->logicalLeft()) {
-        // at the y coordinate of the first line or above
-        // and the x coordinate is to the left of the first text box left edge
-        offset = firstTextBox()->offsetForPosition(pointLineDirection);
-        return createVisiblePositionAfterAdjustingOffsetForBiDi(firstTextBox(), offset, UpstreamIfPositionIsNotAtStart);
-    }
-    if (lastTextBox() && pointBlockDirection >= lastTextBox()->root()->selectionTop() && pointLineDirection >= lastTextBox()->logicalRight()) {
-        // at the y coordinate of the last line or below
-        // and the x coordinate is to the right of the last text box right edge
-        offset = lastTextBox()->offsetForPosition(pointLineDirection);
-        return createVisiblePositionAfterAdjustingOffsetForBiDi(lastTextBox(), offset, AlwaysUpstream);
-    }
 
-    InlineTextBox* lastBoxAbove = 0;
+    InlineTextBox* lastBox = 0;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
+        if (box->isLineBreak() && !box->prevLeafChild() && box->nextLeafChild() && !box->nextLeafChild()->isLineBreak())
+            box = box->nextTextBox();
+
         RootInlineBox* rootBox = box->root();
         if (pointBlockDirection >= rootBox->selectionTop() || pointBlockDirection >= rootBox->lineTop()) {
             LayoutUnit bottom = rootBox->selectionBottom();
@@ -631,15 +619,19 @@ VisiblePosition RenderText::positionForPoint(const LayoutPoint& point)
 
             if (pointBlockDirection < bottom) {
                 ShouldAffinityBeDownstream shouldAffinityBeDownstream;
-                offset = box->offsetForPosition(pointLineDirection);
                 if (lineDirectionPointFitsInBox(pointLineDirection, box, shouldAffinityBeDownstream))
-                    return createVisiblePositionAfterAdjustingOffsetForBiDi(box, offset, shouldAffinityBeDownstream);
+                    return createVisiblePositionAfterAdjustingOffsetForBiDi(box, box->offsetForPosition(pointLineDirection), shouldAffinityBeDownstream);
             }
-            lastBoxAbove = box;
         }
+        lastBox = box;
     }
 
-    return createVisiblePosition(lastBoxAbove ? lastBoxAbove->start() + lastBoxAbove->len() : 0, DOWNSTREAM);
+    if (lastBox) {
+        ShouldAffinityBeDownstream shouldAffinityBeDownstream;
+        lineDirectionPointFitsInBox(pointLineDirection, lastBox, shouldAffinityBeDownstream);
+        return createVisiblePositionAfterAdjustingOffsetForBiDi(lastBox, lastBox->offsetForPosition(pointLineDirection) + lastBox->start(), shouldAffinityBeDownstream);
+    }
+    return createVisiblePosition(0, DOWNSTREAM);
 }
 
 LayoutRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, LayoutUnit* extraWidthToEndOfLine)
@@ -1134,39 +1126,41 @@ float RenderText::firstRunY() const
     
 void RenderText::setSelectionState(SelectionState state)
 {
-    InlineTextBox* box;
-
     RenderObject::setSelectionState(state);
-    if (state == SelectionStart || state == SelectionEnd || state == SelectionBoth) {
-        int startPos, endPos;
-        selectionStartEnd(startPos, endPos);
-        if (selectionState() == SelectionStart) {
-            endPos = textLength();
 
-            // to handle selection from end of text to end of line
-            if (startPos != 0 && startPos == endPos)
-                startPos = endPos - 1;
-        } else if (selectionState() == SelectionEnd)
-            startPos = 0;
-
-        for (box = firstTextBox(); box; box = box->nextTextBox()) {
-            if (box->isSelected(startPos, endPos)) {
-                RootInlineBox* line = box->root();
-                if (line)
-                    line->setHasSelectedChildren(true);
+    if (canUpdateSelectionOnRootLineBoxes()) {
+        if (state == SelectionStart || state == SelectionEnd || state == SelectionBoth) {
+            int startPos, endPos;
+            selectionStartEnd(startPos, endPos);
+            if (selectionState() == SelectionStart) {
+                endPos = textLength();
+
+                // to handle selection from end of text to end of line
+                if (startPos && startPos == endPos)
+                    startPos = endPos - 1;
+            } else if (selectionState() == SelectionEnd)
+                startPos = 0;
+
+            for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
+                if (box->isSelected(startPos, endPos)) {
+                    RootInlineBox* root = box->root();
+                    if (root)
+                        root->setHasSelectedChildren(true);
+                }
+            }
+        } else {
+            for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
+                RootInlineBox* root = box->root();
+                if (root)
+                    root->setHasSelectedChildren(state == SelectionInside);
             }
-        }
-    } else {
-        for (box = firstTextBox(); box; box = box->nextTextBox()) {
-            RootInlineBox* line = box->root();
-            if (line)
-                line->setHasSelectedChildren(state == SelectionInside);
         }
     }
 
-    // The returned value can be null in case of an orphaned tree.
-    if (RenderBlock* cb = containingBlock())
-        cb->setSelectionState(state);
+    // The containing block can be null in case of an orphaned tree.
+    RenderBlock* containingBlock = this->containingBlock();
+    if (containingBlock && !containingBlock->isRenderView())
+        containingBlock->setSelectionState(state);
 }
 
 void RenderText::setTextWithOffset(PassRefPtr<StringImpl> text, unsigned offset, unsigned len, bool force)
diff --git a/Source/WebCore/rendering/RenderText.h b/Source/WebCore/rendering/RenderText.h
index 3918336a1..e2c6a8a69 100644
--- a/Source/WebCore/rendering/RenderText.h
+++ b/Source/WebCore/rendering/RenderText.h
@@ -54,8 +54,8 @@ public:
     InlineTextBox* createInlineTextBox();
     void dirtyLineBoxes(bool fullLayout);
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
-    void absoluteRectsForRange(Vector<LayoutRect>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false, bool* wasFixed = 0);
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
+    void absoluteRectsForRange(Vector<IntRect>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false, bool* wasFixed = 0);
 
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
     void absoluteQuadsForRange(Vector<FloatQuad>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false, bool* wasFixed = 0);
diff --git a/Source/WebCore/rendering/RenderTextControl.cpp b/Source/WebCore/rendering/RenderTextControl.cpp
index 0fef05173..2b311f18e 100644
--- a/Source/WebCore/rendering/RenderTextControl.cpp
+++ b/Source/WebCore/rendering/RenderTextControl.cpp
@@ -142,14 +142,9 @@ void RenderTextControl::computeLogicalHeight()
 {
     HTMLElement* innerText = innerTextElement();
     ASSERT(innerText);
-    RenderBox* innerTextRenderBox = innerText->renderBox();
-
-    setHeight(innerTextRenderBox->borderTop() + innerTextRenderBox->borderBottom() +
-              innerTextRenderBox->paddingTop() + innerTextRenderBox->paddingBottom() +
-              innerTextRenderBox->marginTop() + innerTextRenderBox->marginBottom());
-
-    adjustControlHeightBasedOnLineHeight(innerText->renderBox()->lineHeight(true, HorizontalLine, PositionOfInteriorLineBoxes));
-    setHeight(height() + borderAndPaddingHeight());
+    RenderBox* innerTextBox = innerText->renderBox();
+    LayoutUnit nonContentHeight = innerTextBox->borderAndPaddingHeight() + innerTextBox->marginHeight();
+    setHeight(computeControlHeight(innerTextBox->lineHeight(true, HorizontalLine, PositionOfInteriorLineBoxes), nonContentHeight) + borderAndPaddingHeight());
 
     // We are able to have a horizontal scrollbar if the overflow style is scroll, or if its auto and there's no word wrap.
     if (style()->overflowX() == OSCROLL ||  (style()->overflowX() == OAUTO && innerText->renderer()->style()->wordWrap() == NormalWordWrap))
@@ -280,10 +275,10 @@ void RenderTextControl::computePreferredLogicalWidths()
     setPreferredLogicalWidthsDirty(false);
 }
 
-void RenderTextControl::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint& additionalOffset)
+void RenderTextControl::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint& additionalOffset)
 {
     if (!size().isEmpty())
-        rects.append(LayoutRect(additionalOffset, size()));
+        rects.append(pixelSnappedIntRect(additionalOffset, size()));
 }
 
 RenderObject* RenderTextControl::layoutSpecialExcludedChild(bool relayoutChildren)
diff --git a/Source/WebCore/rendering/RenderTextControl.h b/Source/WebCore/rendering/RenderTextControl.h
index aa936e7a0..0c31ed806 100644
--- a/Source/WebCore/rendering/RenderTextControl.h
+++ b/Source/WebCore/rendering/RenderTextControl.h
@@ -58,7 +58,7 @@ protected:
     static bool hasValidAvgCharWidth(AtomicString family);
     virtual float getAvgCharWidth(AtomicString family);
     virtual LayoutUnit preferredContentWidth(float charWidth) const = 0;
-    virtual void adjustControlHeightBasedOnLineHeight(LayoutUnit lineHeight) = 0;
+    virtual LayoutUnit computeControlHeight(LayoutUnit lineHeight, LayoutUnit nonContentHeight) const = 0;
     virtual RenderStyle* textBaseStyle() const = 0;
 
     virtual void updateFromElement();
@@ -72,7 +72,7 @@ private:
     virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
     virtual bool avoidsFloats() const { return true; }
     
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     virtual bool canBeProgramaticallyScrolled() const { return true; }
 
diff --git a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
index 9d91f4b9e..9b4ffe5cf 100644
--- a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -70,9 +70,9 @@ LayoutUnit RenderTextControlMultiLine::preferredContentWidth(float charWidth) co
     return static_cast<LayoutUnit>(ceilf(charWidth * factor)) + scrollbarThickness();
 }
 
-void RenderTextControlMultiLine::adjustControlHeightBasedOnLineHeight(LayoutUnit lineHeight)
+LayoutUnit RenderTextControlMultiLine::computeControlHeight(LayoutUnit lineHeight, LayoutUnit nonContentHeight) const
 {
-    setHeight(height() + lineHeight * static_cast<HTMLTextAreaElement*>(node())->rows());
+    return lineHeight * static_cast<HTMLTextAreaElement*>(node())->rows() + nonContentHeight;
 }
 
 LayoutUnit RenderTextControlMultiLine::baselinePosition(FontBaseline baselineType, bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
diff --git a/Source/WebCore/rendering/RenderTextControlMultiLine.h b/Source/WebCore/rendering/RenderTextControlMultiLine.h
index 761177a16..3ae1ea210 100644
--- a/Source/WebCore/rendering/RenderTextControlMultiLine.h
+++ b/Source/WebCore/rendering/RenderTextControlMultiLine.h
@@ -38,7 +38,7 @@ private:
 
     virtual float getAvgCharWidth(AtomicString family);
     virtual LayoutUnit preferredContentWidth(float charWidth) const;
-    virtual void adjustControlHeightBasedOnLineHeight(LayoutUnit lineHeight);
+    virtual LayoutUnit computeControlHeight(LayoutUnit lineHeight, LayoutUnit nonContentHeight) const OVERRIDE;
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
     virtual RenderStyle* textBaseStyle() const;
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
index a44e2886c..e7ecedfa6 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -250,7 +250,8 @@ void RenderTextControlSingleLine::layout()
         } else if (containerRenderer->height() < contentHeight()) {
             containerRenderer->style()->setHeight(Length(contentHeight(), Fixed));
             relayoutChildren = true;
-        }
+        } else
+            containerRenderer->style()->setHeight(Length(containerHeight, Fixed));
     }
 
     RenderBlock::layoutBlock(relayoutChildren);
@@ -360,13 +361,6 @@ void RenderTextControlSingleLine::capsLockStateMayHaveChanged()
     }
 }
 
-#if ENABLE(INPUT_SPEECH)
-HTMLElement* RenderTextControlSingleLine::speechButtonElement() const
-{
-    return inputElement()->speechButtonElement();
-}
-#endif
-
 bool RenderTextControlSingleLine::hasControlClip() const
 {
     // Apply control clip for text fields with decorations.
@@ -417,16 +411,6 @@ LayoutUnit RenderTextControlSingleLine::preferredContentWidth(float charWidth) c
     if (maxCharWidth > 0.f)
         result += maxCharWidth - charWidth;
 
-    HTMLElement* resultsButton = resultsButtonElement();
-    if (RenderBox* resultsRenderer = resultsButton ? resultsButton->renderBox() : 0)
-        result += resultsRenderer->borderLeft() + resultsRenderer->borderRight() +
-                  resultsRenderer->paddingLeft() + resultsRenderer->paddingRight();
-
-    HTMLElement* cancelButton = cancelButtonElement();
-    if (RenderBox* cancelRenderer = cancelButton ? cancelButton->renderBox() : 0)
-        result += cancelRenderer->borderLeft() + cancelRenderer->borderRight() +
-                  cancelRenderer->paddingLeft() + cancelRenderer->paddingRight();
-
     if (includesDecoration) {
         HTMLElement* spinButton = innerSpinButtonElement();
         if (RenderBox* spinRenderer = spinButton ? spinButton->renderBox() : 0) {
@@ -438,38 +422,25 @@ LayoutUnit RenderTextControlSingleLine::preferredContentWidth(float charWidth) c
         }
     }
 
-#if ENABLE(INPUT_SPEECH)
-    HTMLElement* speechButton = speechButtonElement();
-    if (RenderBox* speechRenderer = speechButton ? speechButton->renderBox() : 0) {
-        result += speechRenderer->borderLeft() + speechRenderer->borderRight() +
-                  speechRenderer->paddingLeft() + speechRenderer->paddingRight();
-    }
-#endif
     return result;
 }
 
-void RenderTextControlSingleLine::adjustControlHeightBasedOnLineHeight(LayoutUnit lineHeight)
+LayoutUnit RenderTextControlSingleLine::computeControlHeight(LayoutUnit lineHeight, LayoutUnit nonContentHeight) const
 {
     HTMLElement* resultsButton = resultsButtonElement();
     if (RenderBox* resultsRenderer = resultsButton ? resultsButton->renderBox() : 0) {
         resultsRenderer->computeLogicalHeight();
-        setHeight(max(height(),
-                  resultsRenderer->borderTop() + resultsRenderer->borderBottom() +
-                  resultsRenderer->paddingTop() + resultsRenderer->paddingBottom() +
-                  resultsRenderer->marginTop() + resultsRenderer->marginBottom()));
+        nonContentHeight = max(nonContentHeight, resultsRenderer->borderAndPaddingHeight() + resultsRenderer->marginHeight());
         lineHeight = max(lineHeight, resultsRenderer->height());
     }
     HTMLElement* cancelButton = cancelButtonElement();
     if (RenderBox* cancelRenderer = cancelButton ? cancelButton->renderBox() : 0) {
         cancelRenderer->computeLogicalHeight();
-        setHeight(max(height(),
-                  cancelRenderer->borderTop() + cancelRenderer->borderBottom() +
-                  cancelRenderer->paddingTop() + cancelRenderer->paddingBottom() +
-                  cancelRenderer->marginTop() + cancelRenderer->marginBottom()));
+        nonContentHeight = max(nonContentHeight, cancelRenderer->borderAndPaddingHeight() + cancelRenderer->marginHeight());
         lineHeight = max(lineHeight, cancelRenderer->height());
     }
 
-    setHeight(height() + lineHeight);
+    return lineHeight + nonContentHeight;
 }
 
 void RenderTextControlSingleLine::updateFromElement()
@@ -620,7 +591,8 @@ PopupMenuStyle RenderTextControlSingleLine::itemStyle(unsigned) const
 
 PopupMenuStyle RenderTextControlSingleLine::menuStyle() const
 {
-    return PopupMenuStyle(style()->visitedDependentColor(CSSPropertyColor), style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->font(), style()->visibility() == VISIBLE, style()->display() == NONE, style()->textIndent(), style()->direction(), style()->unicodeBidi() == Override);
+    return PopupMenuStyle(style()->visitedDependentColor(CSSPropertyColor), style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->font(), style()->visibility() == VISIBLE,
+        style()->display() == NONE, style()->textIndent(), style()->direction(), isOverride(style()->unicodeBidi()));
 }
 
 int RenderTextControlSingleLine::clientInsetLeft() const
@@ -641,22 +613,18 @@ int RenderTextControlSingleLine::clientInsetRight() const
 LayoutUnit RenderTextControlSingleLine::clientPaddingLeft() const
 {
     LayoutUnit padding = paddingLeft();
-
-    HTMLElement* resultsButton = resultsButtonElement();
-    if (RenderBox* resultsRenderer = resultsButton ? resultsButton->renderBox() : 0)
-        padding += resultsRenderer->width() + resultsRenderer->marginLeft() + resultsRenderer->paddingLeft() + resultsRenderer->marginRight() + resultsRenderer->paddingRight();
-
+    if (RenderBox* box = innerBlockElement() ? innerBlockElement()->renderBox() : 0)
+        padding += box->x();
     return padding;
 }
 
 LayoutUnit RenderTextControlSingleLine::clientPaddingRight() const
 {
     LayoutUnit padding = paddingRight();
-
-    HTMLElement* cancelButton = cancelButtonElement();
-    if (RenderBox* cancelRenderer = cancelButton ? cancelButton->renderBox() : 0)
-        padding += cancelRenderer->width() + cancelRenderer->marginLeft() + cancelRenderer->paddingLeft() + cancelRenderer->marginRight() + cancelRenderer->paddingRight();
-
+    if (RenderBox* containerBox = containerElement() ? containerElement()->renderBox() : 0) {
+        if (RenderBox* innerBlockBox = innerBlockElement() ? innerBlockElement()->renderBox() : 0)
+            padding += containerBox->width() - (innerBlockBox->x() + innerBlockBox->width());
+    }
     return padding;
 }
 
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.h b/Source/WebCore/rendering/RenderTextControlSingleLine.h
index 45d19ee99..6e21c856c 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.h
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.h
@@ -49,10 +49,6 @@ public:
 
     void capsLockStateMayHaveChanged();
 
-#if ENABLE(INPUT_SPEECH)
-    HTMLElement* speechButtonElement() const;
-#endif
-
 private:
     virtual bool hasControlClip() const;
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
@@ -78,8 +74,8 @@ private:
     int textBlockWidth() const;
     virtual float getAvgCharWidth(AtomicString family);
     virtual LayoutUnit preferredContentWidth(float charWidth) const;
-    virtual void adjustControlHeightBasedOnLineHeight(LayoutUnit lineHeight);
-
+    virtual LayoutUnit computeControlHeight(LayoutUnit lineHeight, LayoutUnit nonContentHeight) const OVERRIDE;
+    
     virtual void updateFromElement();
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
diff --git a/Source/WebCore/rendering/RenderTextFragment.cpp b/Source/WebCore/rendering/RenderTextFragment.cpp
index ff4082422..1f267cde4 100644
--- a/Source/WebCore/rendering/RenderTextFragment.cpp
+++ b/Source/WebCore/rendering/RenderTextFragment.cpp
@@ -33,6 +33,7 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str, int startOff
     , m_start(startOffset)
     , m_end(length)
     , m_firstLetter(0)
+    , m_allowFragmentReset(true)
 {
 }
 
@@ -42,6 +43,7 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str)
     , m_end(str ? str->length() : 0)
     , m_contentString(str)
     , m_firstLetter(0)
+    , m_allowFragmentReset(true)
 {
 }
 
@@ -60,7 +62,9 @@ PassRefPtr<StringImpl> RenderTextFragment::originalText() const
 
 void RenderTextFragment::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
+    m_allowFragmentReset = false;
     RenderText::styleDidChange(diff, oldStyle);
+    m_allowFragmentReset = true;
 
     if (RenderBlock* block = blockForAccompanyingFirstLetter()) {
         block->style()->removeCachedPseudoStyle(FIRST_LETTER);
@@ -78,15 +82,18 @@ void RenderTextFragment::willBeDestroyed()
 void RenderTextFragment::setTextInternal(PassRefPtr<StringImpl> text)
 {
     RenderText::setTextInternal(text);
-    if (m_firstLetter) {
-        ASSERT(!m_contentString);
-        m_firstLetter->destroy();
-        m_firstLetter = 0;
+
+    if (m_allowFragmentReset) {
         m_start = 0;
         m_end = textLength();
-        if (Node* t = node()) {
-            ASSERT(!t->renderer());
-            t->setRenderer(this);
+        if (m_firstLetter) {
+            ASSERT(!m_contentString);
+            m_firstLetter->destroy();
+            m_firstLetter = 0;
+            if (Node* t = node()) {
+                ASSERT(!t->renderer());
+                t->setRenderer(this);
+            }
         }
     }
 }
diff --git a/Source/WebCore/rendering/RenderTextFragment.h b/Source/WebCore/rendering/RenderTextFragment.h
index 54b307e3b..426276fe0 100644
--- a/Source/WebCore/rendering/RenderTextFragment.h
+++ b/Source/WebCore/rendering/RenderTextFragment.h
@@ -62,6 +62,7 @@ private:
     unsigned m_end;
     RefPtr<StringImpl> m_contentString;
     RenderObject* m_firstLetter;
+    bool m_allowFragmentReset;
 };
 
 inline RenderTextFragment* toRenderTextFragment(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderTheme.cpp b/Source/WebCore/rendering/RenderTheme.cpp
index 6be2f5efb..8fd2d6c8b 100644
--- a/Source/WebCore/rendering/RenderTheme.cpp
+++ b/Source/WebCore/rendering/RenderTheme.cpp
@@ -205,6 +205,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
             return adjustMenuListButtonStyle(selector, style, e);
         case MediaSliderPart:
         case MediaVolumeSliderPart:
+        case MediaFullScreenVolumeSliderPart:
         case SliderHorizontalPart:
         case SliderVerticalPart:
             return adjustSliderTrackStyle(selector, style, e);
@@ -338,6 +339,10 @@ bool RenderTheme::paint(RenderObject* o, const PaintInfo& paintInfo, const Layou
             return paintMediaVolumeSliderTrack(o, paintInfo, r);
         case MediaVolumeSliderThumbPart:
             return paintMediaVolumeSliderThumb(o, paintInfo, r);
+        case MediaFullScreenVolumeSliderPart:
+            return paintMediaFullScreenVolumeSliderTrack(o, paintInfo, r);
+        case MediaFullScreenVolumeSliderThumbPart:
+            return paintMediaFullScreenVolumeSliderThumb(o, paintInfo, r);
         case MediaTimeRemainingPart:
             return paintMediaTimeRemaining(o, paintInfo, r);
         case MediaCurrentTimePart:
diff --git a/Source/WebCore/rendering/RenderTheme.h b/Source/WebCore/rendering/RenderTheme.h
index f65b8523f..44ef1241e 100644
--- a/Source/WebCore/rendering/RenderTheme.h
+++ b/Source/WebCore/rendering/RenderTheme.h
@@ -314,6 +314,8 @@ protected:
     virtual bool paintMediaControlsBackground(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaCurrentTime(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaTimeRemaining(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaFullScreenVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaFullScreenVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
 public:
     // Methods for state querying
diff --git a/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp b/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
index 88ac3a8d6..949fdfb5d 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
@@ -30,6 +30,7 @@
 #include "Color.h"
 #include "PaintInfo.h"
 #include "PlatformSupport.h"
+#include "RenderMediaControlsChromium.h"
 #include "RenderObject.h"
 #include "RenderProgress.h"
 #include "RenderSlider.h"
@@ -63,6 +64,11 @@ Color RenderThemeChromiumAndroid::systemColor(int cssValueId) const
     return RenderTheme::systemColor(cssValueId);
 }
 
+String RenderThemeChromiumAndroid::extraMediaControlsStyleSheet()
+{
+    return String(mediaControlsChromiumAndroidUserAgentStyleSheet, sizeof(mediaControlsChromiumAndroidUserAgentStyleSheet));
+}
+
 String RenderThemeChromiumAndroid::extraDefaultStyleSheet()
 {
     return RenderThemeChromiumLinux::extraDefaultStyleSheet() +
@@ -81,4 +87,16 @@ void RenderThemeChromiumAndroid::adjustInnerSpinButtonStyle(CSSStyleSelector*, R
     }
 }
 
+bool RenderThemeChromiumAndroid::paintMediaFullscreenButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaFullscreenButton, object, paintInfo, rect);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderThemeChromiumAndroid.h b/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
index 5fb12bc02..53490135c 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
@@ -41,6 +41,12 @@ public:
 
     virtual bool delegatesMenuListRendering() const OVERRIDE { return true; }
 
+    virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
+
+#if ENABLE(VIDEO)
+    virtual String extraMediaControlsStyleSheet() OVERRIDE;
+#endif
+
 #if ENABLE(TOUCH_EVENTS)
     virtual Color platformTapHighlightColor() const OVERRIDE
     {
diff --git a/Source/WebCore/rendering/RenderThemeMac.h b/Source/WebCore/rendering/RenderThemeMac.h
index 25065c422..f8a5657ae 100644
--- a/Source/WebCore/rendering/RenderThemeMac.h
+++ b/Source/WebCore/rendering/RenderThemeMac.h
@@ -157,6 +157,8 @@ protected:
     virtual bool paintMediaVolumeSliderContainer(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaFullScreenVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&) OVERRIDE;
+    virtual bool paintMediaFullScreenVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&) OVERRIDE;
 
     // Media controls
     virtual String extraMediaControlsStyleSheet();
diff --git a/Source/WebCore/rendering/RenderThemeMac.mm b/Source/WebCore/rendering/RenderThemeMac.mm
index cd566e859..0ae0196bc 100644
--- a/Source/WebCore/rendering/RenderThemeMac.mm
+++ b/Source/WebCore/rendering/RenderThemeMac.mm
@@ -990,7 +990,7 @@ bool RenderThemeMac::paintProgressBar(RenderObject* renderObject, const PaintInf
     trackInfo.reserved = 0;
     trackInfo.filler1 = 0;
 
-    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(inflatedRect.size());
+    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(inflatedRect.size(), 1);
     if (!imageBuffer)
         return true;
 
@@ -1720,24 +1720,34 @@ void RenderThemeMac::adjustSliderThumbSize(RenderStyle* style) const
 
 void RenderThemeMac::adjustMediaSliderThumbSize(RenderStyle* style) const
 {
-    ControlPart part = style->appearance();
+    int wkPart;
+    switch (style->appearance()) {
+    case MediaSliderThumbPart:
+        wkPart = MediaSliderThumb;
+        break;
+    case MediaVolumeSliderThumbPart:
+        wkPart = MediaVolumeSliderThumb;
+        break;
+    case MediaFullScreenVolumeSliderThumbPart:
+        wkPart = MediaFullScreenVolumeSliderThumb;
+        break;
+    default:
+        return;
+    }
 
-    if (part == MediaSliderThumbPart || part == MediaVolumeSliderThumbPart) {
-        int width = mediaSliderThumbWidth;
-        int height = mediaSliderThumbHeight;
-        
-        if (mediaControllerTheme() == MediaControllerThemeQuickTime) {
-            CGSize size;
-            
-            wkMeasureMediaUIPart(part == MediaSliderThumbPart ? MediaSliderThumb : MediaVolumeSliderThumb, MediaControllerThemeQuickTime, NULL, &size);
-            width = size.width;
-            height = size.height;
-        }
-
-        float zoomLevel = style->effectiveZoom();
-        style->setWidth(Length(static_cast<int>(width * zoomLevel), Fixed));
-        style->setHeight(Length(static_cast<int>(height * zoomLevel), Fixed));
+    int width = mediaSliderThumbWidth;
+    int height = mediaSliderThumbHeight;
+
+    if (mediaControllerTheme() == MediaControllerThemeQuickTime) {
+        CGSize size;
+        wkMeasureMediaUIPart(wkPart, MediaControllerThemeQuickTime, NULL, &size);
+        width = size.width;
+        height = size.height;
     }
+
+    float zoomLevel = style->effectiveZoom();
+    style->setWidth(Length(static_cast<int>(width * zoomLevel), Fixed));
+    style->setHeight(Length(static_cast<int>(height * zoomLevel), Fixed));
 }
 
 enum WKMediaControllerThemeState { 
@@ -1977,7 +1987,29 @@ bool RenderThemeMac::paintMediaVolumeSliderThumb(RenderObject* o, const PaintInf
     wkDrawMediaUIPart(MediaVolumeSliderThumb, mediaControllerTheme(), localContext.cgContext(), r, getMediaUIPartStateFlags(node));
     return false;
 }
+
+bool RenderThemeMac::paintMediaFullScreenVolumeSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
+{
+    Node* node = o->node();
+    if (!node)
+        return false;
+    
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(MediaFullScreenVolumeSlider, mediaControllerTheme(), localContext.cgContext(), r, getMediaUIPartStateFlags(node));
+    return false;
+}
+
+bool RenderThemeMac::paintMediaFullScreenVolumeSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
+{
+    Node* node = o->node();
+    if (!node)
+        return false;
     
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(MediaFullScreenVolumeSliderThumb, mediaControllerTheme(), localContext.cgContext(), r, getMediaUIPartStateFlags(node));
+    return false;
+}
+
 String RenderThemeMac::extraMediaControlsStyleSheet()
 {
 #if PLATFORM(MAC)
diff --git a/Source/WebCore/rendering/RenderThemeWin.cpp b/Source/WebCore/rendering/RenderThemeWin.cpp
index 64b5c8a95..16795c3b7 100644
--- a/Source/WebCore/rendering/RenderThemeWin.cpp
+++ b/Source/WebCore/rendering/RenderThemeWin.cpp
@@ -457,6 +457,8 @@ unsigned RenderThemeWin::determineState(RenderObject* o)
         result = TS_HOVER;
     if (isChecked(o))
         result += 4; // 4 unchecked states, 4 checked states.
+    else if (isIndeterminate(o) && appearance == CheckboxPart)
+        result += 8;
     return result;
 }
 
diff --git a/Source/WebCore/rendering/RenderTreeAsText.cpp b/Source/WebCore/rendering/RenderTreeAsText.cpp
index 4cb4c0e67..79751ba5f 100644
--- a/Source/WebCore/rendering/RenderTreeAsText.cpp
+++ b/Source/WebCore/rendering/RenderTreeAsText.cpp
@@ -183,7 +183,7 @@ static bool isEmptyOrUnstyledAppleStyleSpan(const Node* node)
     if (!node->hasChildNodes())
         return true;
 
-    StylePropertySet* inlineStyleDecl = elem->inlineStyleDecl();
+    const StylePropertySet* inlineStyleDecl = elem->inlineStyle();
     return (!inlineStyleDecl || inlineStyleDecl->isEmpty());
 }
 
@@ -616,10 +616,10 @@ static void write(TextStream& ts, RenderLayer& l,
             ts << " scrollX " << l.scrollXOffset();
         if (l.scrollYOffset())
             ts << " scrollY " << l.scrollYOffset();
-        if (l.renderBox() && l.renderBox()->pixelSnappedClientWidth() != l.pixelSnappedScrollWidth())
-            ts << " scrollWidth " << l.pixelSnappedScrollWidth();
-        if (l.renderBox() && l.renderBox()->pixelSnappedClientHeight() != l.pixelSnappedScrollHeight())
-            ts << " scrollHeight " << l.pixelSnappedScrollHeight();
+        if (l.renderBox() && l.renderBox()->pixelSnappedClientWidth() != l.scrollWidth())
+            ts << " scrollWidth " << l.scrollWidth();
+        if (l.renderBox() && l.renderBox()->pixelSnappedClientHeight() != l.scrollHeight())
+            ts << " scrollHeight " << l.scrollHeight();
     }
 
     if (paintPhase == LayerPaintPhaseBackground)
diff --git a/Source/WebCore/rendering/RenderVideo.cpp b/Source/WebCore/rendering/RenderVideo.cpp
index 01426090e..1fc87a7d2 100644
--- a/Source/WebCore/rendering/RenderVideo.cpp
+++ b/Source/WebCore/rendering/RenderVideo.cpp
@@ -198,21 +198,29 @@ void RenderVideo::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
     MediaPlayer* mediaPlayer = mediaElement()->player();
     bool displayingPoster = videoElement()->shouldDisplayPosterImage();
 
+    Page* page = 0;
+    if (Frame* frame = this->frame())
+        page = frame->page();
+
     if (!displayingPoster) {
-        if (!mediaPlayer)
+        if (!mediaPlayer) {
+            if (page && paintInfo.phase == PaintPhaseForeground)
+                page->addRelevantUnpaintedObject(this, visualOverflowRect());
             return;
+        }
         updatePlayer();
     }
 
     LayoutRect rect = videoBox();
-    if (rect.isEmpty())
+    if (rect.isEmpty()) {
+        if (page && paintInfo.phase == PaintPhaseForeground)
+            page->addRelevantUnpaintedObject(this, visualOverflowRect());
         return;
+    }
     rect.moveBy(paintOffset);
 
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
+    if (page && paintInfo.phase == PaintPhaseForeground)
+        page->addRelevantRepaintedObject(this, rect);
 
     if (displayingPoster)
         paintIntoRect(paintInfo.context, rect);
diff --git a/Source/WebCore/rendering/RenderView.cpp b/Source/WebCore/rendering/RenderView.cpp
index df2910763..cd3893a55 100644
--- a/Source/WebCore/rendering/RenderView.cpp
+++ b/Source/WebCore/rendering/RenderView.cpp
@@ -366,9 +366,9 @@ void RenderView::computeRectForRepaint(RenderBoxModelObject* repaintContainer, I
         rect = m_layer->transform()->mapRect(rect);
 }
 
-void RenderView::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
+void RenderView::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
-    rects.append(LayoutRect(accumulatedOffset, m_layer->size()));
+    rects.append(pixelSnappedIntRect(accumulatedOffset, m_layer->size()));
 }
 
 void RenderView::absoluteQuads(Vector<FloatQuad>& quads, bool* wasFixed) const
@@ -498,7 +498,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     // Now clear the selection.
     SelectedObjectMap::iterator oldObjectsEnd = oldSelectedObjects.end();
     for (SelectedObjectMap::iterator i = oldSelectedObjects.begin(); i != oldObjectsEnd; ++i)
-        i->first->setSelectionState(SelectionNone);
+        i->first->setSelectionStateIfNeeded(SelectionNone);
 
     // set selection start and end
     m_selectionStart = start;
@@ -508,12 +508,12 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
 
     // Update the selection status of all objects between m_selectionStart and m_selectionEnd
     if (start && start == end)
-        start->setSelectionState(SelectionBoth);
+        start->setSelectionStateIfNeeded(SelectionBoth);
     else {
         if (start)
-            start->setSelectionState(SelectionStart);
+            start->setSelectionStateIfNeeded(SelectionStart);
         if (end)
-            end->setSelectionState(SelectionEnd);
+            end->setSelectionStateIfNeeded(SelectionEnd);
     }
 
     RenderObject* o = start;
@@ -521,7 +521,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
 
     while (o && o != stop) {
         if (o != start && o != end && o->canBeSelectionLeaf())
-            o->setSelectionState(SelectionInside);
+            o->setSelectionStateIfNeeded(SelectionInside);
         o = o->nextInPreOrder();
     }
 
@@ -703,7 +703,7 @@ void RenderView::notifyWidgets(WidgetNotification notification)
 IntRect RenderView::viewRect() const
 {
     if (printing())
-        return IntRect(0, 0, width(), height());
+        return IntRect(IntPoint(), size());
     if (m_frameView)
         return m_frameView->visibleContentRect();
     return IntRect();
diff --git a/Source/WebCore/rendering/RenderView.h b/Source/WebCore/rendering/RenderView.h
index 9ee7a1d6d..66000942e 100644
--- a/Source/WebCore/rendering/RenderView.h
+++ b/Source/WebCore/rendering/RenderView.h
@@ -88,7 +88,7 @@ public:
 
     bool printing() const;
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
 
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
index ad5a03fd2..55802c4c2 100644
--- a/Source/WebCore/rendering/RenderWidget.cpp
+++ b/Source/WebCore/rendering/RenderWidget.cpp
@@ -359,11 +359,11 @@ IntRect RenderWidget::windowClipRect() const
 
 void RenderWidget::setSelectionState(SelectionState state)
 {
-    if (selectionState() != state) {
-        RenderReplaced::setSelectionState(state);
-        if (m_widget)
-            m_widget->setIsSelected(isSelected());
-    }
+    // The selection state for our containing block hierarchy is updated by the base class call.
+    RenderReplaced::setSelectionState(state);
+
+    if (m_widget)
+        m_widget->setIsSelected(isSelected());
 }
 
 void RenderWidget::clearWidget()
diff --git a/Source/WebCore/rendering/RenderingAllInOne.cpp b/Source/WebCore/rendering/RenderingAllInOne.cpp
index 7e9e7ddcc..b52e2908a 100644
--- a/Source/WebCore/rendering/RenderingAllInOne.cpp
+++ b/Source/WebCore/rendering/RenderingAllInOne.cpp
@@ -50,7 +50,6 @@
 #include "RenderCombineText.cpp"
 #include "RenderCounter.cpp"
 #include "RenderDeprecatedFlexibleBox.cpp"
-#include "RenderDetails.cpp"
 #include "RenderDetailsMarker.cpp"
 #include "RenderEmbeddedObject.cpp"
 #include "RenderFieldset.cpp"
@@ -90,7 +89,6 @@
 #include "RenderScrollbarPart.cpp"
 #include "RenderScrollbarTheme.cpp"
 #include "RenderSlider.cpp"
-#include "RenderSummary.cpp"
 #include "RenderTable.cpp"
 #include "RenderTableCaption.cpp"
 #include "RenderTableCell.cpp"
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index 8d84bfe61..c56560065 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -580,6 +580,14 @@ InlineBox* RootInlineBox::closestLeafChildForLogicalLeftPosition(int leftPositio
 {
     InlineBox* firstLeaf = firstLeafChild();
     InlineBox* lastLeaf = lastLeafChild();
+
+    if (firstLeaf != lastLeaf) {
+        if (firstLeaf->isLineBreak())
+            firstLeaf = firstLeaf->nextLeafChildIgnoringLineBreak();
+        else if (lastLeaf->isLineBreak())
+            lastLeaf = lastLeaf->prevLeafChildIgnoringLineBreak();
+    }
+
     if (firstLeaf == lastLeaf && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
         return firstLeaf;
 
@@ -595,7 +603,7 @@ InlineBox* RootInlineBox::closestLeafChildForLogicalLeftPosition(int leftPositio
         return lastLeaf;
 
     InlineBox* closestLeaf = 0;
-    for (InlineBox* leaf = firstLeaf; leaf; leaf = leaf->nextLeafChild()) {
+    for (InlineBox* leaf = firstLeaf; leaf; leaf = leaf->nextLeafChildIgnoringLineBreak()) {
         if (!leaf->renderer()->isListMarker() && (!onlyEditableLeaves || isEditableLeaf(leaf))) {
             closestLeaf = leaf;
             if (leftPosition < leaf->logicalRight())
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
index 631266258..84928d4b4 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
@@ -35,9 +35,7 @@ namespace WebCore {
     
 using namespace MathMLNames;
 
-static const int gTopAdjustDivisor = 3;
 static const int gSubsupScriptMargin = 1;
-static const float gSubSupStretch = 1.2f;
 
 RenderMathMLSubSup::RenderMathMLSubSup(Element* element) 
     : RenderMathMLBlock(element)
@@ -90,6 +88,8 @@ void RenderMathMLSubSup::addChild(RenderObject* child, RenderObject* beforeChild
             scriptsStyle->setVerticalAlign(TOP);
             scriptsStyle->setMarginLeft(Length(gSubsupScriptMargin, Fixed));
             scriptsStyle->setTextAlign(LEFT);
+            // Set this wrapper's font-size for its line-height & baseline position.
+            scriptsStyle->setBlendedFontSize(static_cast<int>(0.75 * style()->fontSize()));
             m_scripts->setStyle(scriptsStyle.release());
             RenderMathMLBlock::addChild(m_scripts, beforeChild);
         }
@@ -126,74 +126,68 @@ RenderMathMLOperator* RenderMathMLSubSup::unembellishedOperator()
 void RenderMathMLSubSup::stretchToHeight(int height)
 {
     RenderBoxModelObject* base = this->base();
-    if (base && base->isRenderMathMLBlock()) {
-        toRenderMathMLBlock(base)->stretchToHeight(static_cast<int>(gSubSupStretch * height));
-        
-        // Adjust the script placement after we stretch
-        if (height > 0 && m_kind == SubSup && m_scripts) {
-            RenderObject* supWrapper = m_scripts->firstChild();
-            if (supWrapper) {
-                // Calculate the script height without the container margins.
-                int supHeight = getBoxModelObjectHeight(supWrapper->firstChild());
-                int supTopAdjust = supHeight / gTopAdjustDivisor;
-                supWrapper->style()->setMarginTop(Length(-supTopAdjust, Fixed));
-                supWrapper->style()->setMarginBottom(Length(height - supHeight + supTopAdjust, Fixed));
-                supWrapper->setNeedsLayout(true);
-            }
-        }
-    }
+    if (base && base->isRenderMathMLBlock())
+        toRenderMathMLBlock(base)->stretchToHeight(height);
 }
 
 void RenderMathMLSubSup::layout()
 {
     RenderBlock::layout();
     
-    if (m_kind == SubSup && m_scripts) {
-        if (RenderBoxModelObject* base = this->base()) {
-            LayoutUnit heightDiff = (m_scripts->offsetHeight() - base->offsetHeight()) / 2;
-            if (heightDiff < 0) 
-                heightDiff = 0;
-            RenderObject* baseWrapper = firstChild();
-            baseWrapper->style()->setPaddingTop(Length(heightDiff, Fixed));
-            baseWrapper->setNeedsLayout(true);
-            RenderBlock::layout();
-        }
-    }    
-}
-
-LayoutUnit RenderMathMLSubSup::baselinePosition(FontBaseline, bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
-{
-    RenderObject* base = firstChild();
-    if (!base) 
-        return offsetHeight();
+    if (m_kind != SubSup || !m_scripts)
+        return;
+    RenderBoxModelObject* base = this->base();
+    RenderObject* superscriptWrapper = m_scripts->firstChild();
+    RenderObject* subscriptWrapper = m_scripts->lastChild();
+    if (!base || !superscriptWrapper || !subscriptWrapper || superscriptWrapper == subscriptWrapper)
+        return;
+    ASSERT(superscriptWrapper->isRenderMathMLBlock());
+    ASSERT(subscriptWrapper->isRenderMathMLBlock());
+    RenderObject* superscript = superscriptWrapper->firstChild();
+    RenderObject* subscript = subscriptWrapper->firstChild();
+    if (!superscript || !subscript)
+        return;
     
-    LayoutUnit baseline = offsetHeight();
-    if (!base || !base->isBoxModelObject()) 
-        return baseline;
-
-    switch (m_kind) {
-    case SubSup:
-        base = base->firstChild();
-        if (m_scripts && base && base->isBoxModelObject()) {
-            RenderBoxModelObject* box = toRenderBoxModelObject(base);
-            
-            int topAdjust = (m_scripts->offsetHeight() - box->offsetHeight()) / 2;
-        
-            // FIXME: The last bit of this calculation should be more exact. Why is the 2-3px scaled for zoom necessary?
-            // The baseline is top spacing of the base + the baseline of the base + adjusted space for zoom
-            float zoomFactor = style()->effectiveZoom();
-            return topAdjust + box->baselinePosition(AlphabeticBaseline, firstLine, direction, linePositionMode) + static_cast<int>((zoomFactor > 1.25 ? 2 : 3) * zoomFactor);
-        }
-        break;
-    case Sup: 
-    case Sub:
-        return RenderMathMLBlock::baselinePosition(AlphabeticBaseline, firstLine, direction, linePositionMode);
+    LineDirectionMode lineDirection = style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
+    LayoutUnit baseBaseline = base->baselinePosition(AlphabeticBaseline, true, lineDirection);
+    LayoutUnit baseExtendUnderBaseline = getBoxModelObjectHeight(base) - baseBaseline;
+    LayoutUnit axis = style()->fontMetrics().xHeight() / 2;
+    LayoutUnit superscriptHeight = getBoxModelObjectHeight(superscript);
+    LayoutUnit subscriptHeight = getBoxModelObjectHeight(subscript);
+    
+    // Our layout rules are: Don't let the superscript go below the "axis" (half x-height above the
+    // baseline), or the subscript above the axis. Also, don't let the superscript's top edge be
+    // below the base's top edge, or the subscript's bottom edge above the base's bottom edge.
+    //
+    // FIXME: Check any subscriptshift or superscriptshift attributes, and maybe use more sophisticated
+    // heuristics from TeX or elsewhere. See https://bugs.webkit.org/show_bug.cgi?id=79274#c5.
+    
+    // Above we did scriptsStyle->setVerticalAlign(TOP) for mscripts' style, so the superscript's
+    // top edge will equal the top edge of the base's padding.
+    LayoutUnit basePaddingTop = superscriptHeight + axis - baseBaseline;
+    // If basePaddingTop is positive, it's indeed the base's padding-top that we need. If it's negative,
+    // then we should instead use its absolute value to pad the bottom of the superscript, to get the
+    // superscript's bottom edge down to the axis. First we compute how much more we need to shift the
+    // subscript down, once its top edge is at the axis.
+    LayoutUnit superPaddingBottom = max<LayoutUnit>(baseExtendUnderBaseline + axis - subscriptHeight, 0);
+    if (basePaddingTop < 0) {
+        superPaddingBottom += -basePaddingTop;
+        basePaddingTop = 0;
     }
     
-    return baseline;
+    setChildNeedsLayout(true, false);
     
-}
+    RenderObject* baseWrapper = firstChild();
+    baseWrapper->style()->setPaddingTop(Length(basePaddingTop, Fixed));
+    baseWrapper->setNeedsLayout(true, false);
     
+    superscriptWrapper->style()->setPaddingBottom(Length(superPaddingBottom, Fixed));
+    superscriptWrapper->setNeedsLayout(true, false);
+    m_scripts->setNeedsLayout(true, false);
+    
+    RenderBlock::layout();
+}
+
 }    
 
 #endif // ENABLE(MATHML)
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
index 9c7d02c89..0a291de97 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
@@ -39,7 +39,6 @@ public:
     
     virtual RenderMathMLOperator* unembellishedOperator();
     virtual void stretchToHeight(int pixelHeight);
-    virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
 protected:
     virtual void layout();
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index c62b3b198..8f31e0f7d 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -135,6 +135,7 @@ ALWAYS_INLINE RenderStyle::RenderStyle(bool)
 #endif
 #if ENABLE(CSS_GRID_LAYOUT)
     rareNonInheritedData.access()->m_grid.init();
+    rareNonInheritedData.access()->m_gridItem.init();
 #endif
     rareInheritedData.init();
     inherited.init();
@@ -424,7 +425,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
         }
 #endif
 #if ENABLE(CSS_GRID_LAYOUT)
-        if (rareNonInheritedData->m_grid.get() != other->rareNonInheritedData->m_grid.get())
+        if (rareNonInheritedData->m_grid.get() != other->rareNonInheritedData->m_grid.get()
+            && rareNonInheritedData->m_gridItem.get() != other->rareNonInheritedData->m_gridItem.get())
             return StyleDifferenceLayout;
 #endif
 
@@ -843,14 +845,14 @@ void RenderStyle::setBoxShadow(PassOwnPtr<ShadowData> shadowData, bool add)
 static RoundedRect::Radii calcRadiiFor(const BorderData& border, LayoutSize size)
 {
     return RoundedRect::Radii(
-        LayoutSize(border.topLeft().width().calcValue(size.width()), 
-                   border.topLeft().height().calcValue(size.height())),
-        LayoutSize(border.topRight().width().calcValue(size.width()),
-                   border.topRight().height().calcValue(size.height())),
-        LayoutSize(border.bottomLeft().width().calcValue(size.width()), 
-                   border.bottomLeft().height().calcValue(size.height())),
-        LayoutSize(border.bottomRight().width().calcValue(size.width()), 
-                   border.bottomRight().height().calcValue(size.height())));
+        IntSize(border.topLeft().width().calcValue(size.width()), 
+                border.topLeft().height().calcValue(size.height())),
+        IntSize(border.topRight().width().calcValue(size.width()),
+                border.topRight().height().calcValue(size.height())),
+        IntSize(border.bottomLeft().width().calcValue(size.width()), 
+                border.bottomLeft().height().calcValue(size.height())),
+        IntSize(border.bottomRight().width().calcValue(size.width()), 
+                border.bottomRight().height().calcValue(size.height())));
 }
 
 static float calcConstraintScaleFor(const IntRect& rect, const RoundedRect::Radii& radii)
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index 647d3e9fc..55151d3ec 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -77,6 +77,7 @@
 
 #if ENABLE(CSS_GRID_LAYOUT)
 #include "StyleGridData.h"
+#include "StyleGridItemData.h"
 #endif
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -814,6 +815,9 @@ public:
 #if ENABLE(CSS_GRID_LAYOUT)
     const Vector<Length>& gridColumns() const { return rareNonInheritedData->m_grid->m_gridColumns; }
     const Vector<Length>& gridRows() const { return rareNonInheritedData->m_grid->m_gridRows; }
+
+    const Length& gridItemColumn() const { return rareNonInheritedData->m_gridItem->m_gridColumn; }
+    const Length& gridItemRow() const { return rareNonInheritedData->m_gridItem->m_gridRow; }
 #endif
 
     const ShadowData* boxShadow() const { return rareNonInheritedData->m_boxShadow.get(); }
@@ -957,7 +961,7 @@ public:
 
     EImageRendering imageRendering() const { return static_cast<EImageRendering>(rareInheritedData->m_imageRendering); }
     
-    ESpeak speak() { return static_cast<ESpeak>(rareInheritedData->speak); }
+    ESpeak speak() const { return static_cast<ESpeak>(rareInheritedData->speak); }
 
 #if ENABLE(CSS_FILTERS)
     FilterOperations& filter() { return rareNonInheritedData.access()->m_filter.access()->m_operations; }
@@ -966,6 +970,12 @@ public:
 #else
     bool hasFilter() const { return false; }
 #endif
+
+#if USE(RTL_SCROLLBAR)
+    bool shouldPlaceBlockDirectionScrollbarOnLogicalLeft() const { return !isLeftToRightDirection() && isHorizontalWritingMode(); }
+#else
+    bool shouldPlaceBlockDirectionScrollbarOnLogicalLeft() const { return false; }
+#endif
         
 // attribute setter methods
 
@@ -1100,7 +1110,7 @@ public:
         return false;
     }
 
-    // Only used for blending font sizes when animating.
+    // Only used for blending font sizes when animating, or MathML anonymous blocks.
     void setBlendedFontSize(int);
 
     void setColor(const Color& v) { SET_VAR(inherited, color, v) }
@@ -1240,6 +1250,9 @@ public:
 #if ENABLE(CSS_GRID_LAYOUT)
     void setGridColumns(const Vector<Length>& lengths) { SET_VAR(rareNonInheritedData.access()->m_grid, m_gridColumns, lengths); }
     void setGridRows(const Vector<Length>& lengths) { SET_VAR(rareNonInheritedData.access()->m_grid, m_gridRows, lengths); }
+
+    void setGridItemColumn(const Length& columnPosition) { SET_VAR(rareNonInheritedData.access()->m_gridItem, m_gridColumn, columnPosition); }
+    void setGridItemRow(const Length& rowPosition) { SET_VAR(rareNonInheritedData.access()->m_gridItem, m_gridRow, rowPosition); }
 #endif
 
     void setMarqueeIncrement(const Length& f) { SET_VAR(rareNonInheritedData.access()->m_marquee, increment, f); }
@@ -1443,21 +1456,9 @@ public:
 
     StyleDifference diff(const RenderStyle*, unsigned& changedContextSensitiveProperties) const;
 
-    bool isDisplayReplacedType() const
-    {
-        return display() == INLINE_BLOCK || display() == INLINE_BOX || display() == INLINE_TABLE;
-    }
-
-    bool isDisplayInlineType() const
-    {
-        return display() == INLINE || isDisplayReplacedType();
-    }
-
-    bool isOriginalDisplayInlineType() const
-    {
-        return originalDisplay() == INLINE || originalDisplay() == INLINE_BLOCK
-            || originalDisplay() == INLINE_BOX || originalDisplay() == INLINE_TABLE;
-    }
+    bool isDisplayReplacedType() const { return isDisplayReplacedType(display()); }
+    bool isDisplayInlineType() const { return isDisplayInlineType(display()); }
+    bool isOriginalDisplayInlineType() const { return isDisplayInlineType(originalDisplay()); }
 
     void setWritingMode(WritingMode v) { inherited_flags.m_writingMode = v; }
 
@@ -1636,6 +1637,10 @@ public:
     }
     static Vector<Length> initialGridColumns() { return initialGridTrackValue(); }
     static Vector<Length> initialGridRows() { return initialGridTrackValue(); }
+
+    // 'auto' is the default.
+    static Length initialGridItemColumn() { return Length(); }
+    static Length initialGridItemRow() { return Length(); }
 #endif
 
     static const AtomicString& initialLineGrid() { return nullAtom; }
@@ -1704,6 +1709,12 @@ private:
         return isHorizontalWritingMode() ? getImageVerticalOutsets(image, logicalTop, logicalBottom) : getImageHorizontalOutsets(image, logicalTop, logicalBottom);
     }
 
+    bool isDisplayReplacedType(EDisplay display) const
+    {
+        return display == INLINE_BLOCK || display == INLINE_BOX || display == INLINE_FLEXBOX || display == INLINE_TABLE;
+    }
+    bool isDisplayInlineType(EDisplay display) const { return display == INLINE || isDisplayReplacedType(display); }
+
     // Color accessors are all private to make sure callers use visitedDependentColor instead to access them.
     const Color& invalidColor() const { static Color invalid; return invalid; }
     const Color& borderLeftColor() const { return surround->border.left().color(); }
diff --git a/Source/WebCore/rendering/style/StyleCachedShader.cpp b/Source/WebCore/rendering/style/StyleCachedShader.cpp
index 52fd2ef64..d9118a15a 100644
--- a/Source/WebCore/rendering/style/StyleCachedShader.cpp
+++ b/Source/WebCore/rendering/style/StyleCachedShader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/rendering/style/StyleCachedShader.h b/Source/WebCore/rendering/style/StyleCachedShader.h
index 269226457..c2e007756 100644
--- a/Source/WebCore/rendering/style/StyleCachedShader.h
+++ b/Source/WebCore/rendering/style/StyleCachedShader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/rendering/style/StyleCustomFilterProgram.h b/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
index 472e157f5..b6eec7470 100644
--- a/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
+++ b/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/storage/DOMWindowSQLDatabase.idl b/Source/WebCore/rendering/style/StyleGridItemData.cpp
index 025116202..a633c11d2 100644
--- a/Source/WebCore/storage/DOMWindowSQLDatabase.idl
+++ b/Source/WebCore/rendering/style/StyleGridItemData.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Google Inc.  All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -27,18 +27,29 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+#include "config.h"
+#include "StyleGridItemData.h"
 
-module window {
+#if ENABLE(CSS_GRID_LAYOUT)
 
-    interface [
-        Conditional=SQL_DATABASE,
-        Supplemental=DOMWindow
-    ] DOMWindowSQLDatabase {
-        [V8EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
-            raises(DOMException);
-#if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
-        attribute SQLExceptionConstructor SQLException;
-#endif
-    };
+#include "RenderStyle.h"
 
+namespace WebCore {
+
+StyleGridItemData::StyleGridItemData()
+    : m_gridColumn(RenderStyle::initialGridItemColumn())
+    , m_gridRow(RenderStyle::initialGridItemRow())
+{
+}
+
+StyleGridItemData::StyleGridItemData(const StyleGridItemData& o)
+    : RefCounted<StyleGridItemData>()
+    , m_gridColumn(o.m_gridColumn)
+    , m_gridRow(o.m_gridRow)
+{
 }
+
+} // namespace WebCore
+
+#endif // ENABLE(CSS_GRID_LAYOUT)
+
diff --git a/Source/WebCore/platform/AsyncFileStream.h b/Source/WebCore/rendering/style/StyleGridItemData.h
index a555a2467..76306b47b 100644
--- a/Source/WebCore/platform/AsyncFileStream.h
+++ b/Source/WebCore/rendering/style/StyleGridItemData.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc.  All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,47 +28,46 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef AsyncFileStream_h
-#define AsyncFileStream_h
+#ifndef StyleGridItemData_h
+#define StyleGridItemData_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(CSS_GRID_LAYOUT)
 
-#include "FileStreamClient.h"
-#include <wtf/Forward.h>
+#include "Length.h"
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
-class KURL;
-
-class AsyncFileStream : public RefCounted<AsyncFileStream> {
+class StyleGridItemData : public RefCounted<StyleGridItemData> {
 public:
-    virtual ~AsyncFileStream() { }
-
-    virtual void getSize(const String& path, double expectedModificationTime) = 0;
-    virtual void openForRead(const String& path, long long offset, long long length) = 0;
-    virtual void openForWrite(const String& path) = 0;
-    virtual void close() = 0;
-    virtual void read(char* buffer, int length) = 0;
-    virtual void write(const KURL& blobURL, long long position, int length) = 0;
-    virtual void truncate(long long position) = 0;
-    virtual void stop() = 0;
+    static PassRefPtr<StyleGridItemData> create() { return adoptRef(new StyleGridItemData); }
+    PassRefPtr<StyleGridItemData> copy() const { return adoptRef(new StyleGridItemData(*this)); }
 
-    FileStreamClient* client() const { return m_client; }
-    void setClient(FileStreamClient* client) { m_client = client; }
+    bool operator==(const StyleGridItemData& o) const
+    {
+        return m_gridColumn == o.m_gridColumn && m_gridRow == o.m_gridRow;
+    }
 
-protected:
-    AsyncFileStream(FileStreamClient* client)
-        : m_client(client)
+    bool operator!=(const StyleGridItemData& o) const
     {
+        return !(*this == o);
     }
 
+    // FIXME: For the moment, we only support a subset of the grammar which correspond to:
+    // 'auto' | <length>
+    // When we add more of the syntax, we will need a dedicated GridPosition class.
+    Length m_gridColumn;
+    Length m_gridRow;
+
 private:
-    FileStreamClient* m_client;
+    StyleGridItemData();
+    StyleGridItemData(const StyleGridItemData&);
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(CSS_LAYOUT_GRID)
 
-#endif // AsyncFileStream_h
+#endif // StyleGridItemData_h
diff --git a/Source/WebCore/rendering/style/StylePendingShader.h b/Source/WebCore/rendering/style/StylePendingShader.h
index 0046c82a1..98ad91c58 100644
--- a/Source/WebCore/rendering/style/StylePendingShader.h
+++ b/Source/WebCore/rendering/style/StylePendingShader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
index 3dc34f021..529fc4eb8 100644
--- a/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
@@ -98,6 +98,7 @@ StyleRareNonInheritedData::StyleRareNonInheritedData(const StyleRareNonInherited
 #endif
 #if ENABLE(CSS_GRID_LAYOUT)
     , m_grid(o.m_grid)
+    , m_gridItem(o.m_gridItem)
 #endif
     , m_content(o.m_content ? o.m_content->clone() : nullptr)
     , m_counterDirectives(o.m_counterDirectives ? clone(*o.m_counterDirectives) : nullptr)
@@ -165,6 +166,7 @@ bool StyleRareNonInheritedData::operator==(const StyleRareNonInheritedData& o) c
 #endif
 #if ENABLE(CSS_GRID_LAYOUT)
         && m_grid == o.m_grid
+        && m_gridItem == o.m_gridItem
 #endif
         && contentDataEquivalent(o)
         && counterDataEquivalent(o)
diff --git a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
index 3e2c4a107..e95c55b60 100644
--- a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
@@ -48,6 +48,7 @@ class StyleFilterData;
 class StyleFlexibleBoxData;
 #if ENABLE(CSS_GRID_LAYOUT)
 class StyleGridData;
+class StyleGridItemData;
 #endif
 class StyleMarqueeData;
 class StyleMultiColData;
@@ -119,6 +120,7 @@ public:
 
 #if ENABLE(CSS_GRID_LAYOUT)
     DataRef<StyleGridData> m_grid;
+    DataRef<StyleGridItemData> m_gridItem;
 #endif
 
     OwnPtr<ContentData> m_content;
diff --git a/Source/WebCore/rendering/style/StyleShader.h b/Source/WebCore/rendering/style/StyleShader.h
index ff5d2fda6..e38f9bf8f 100644
--- a/Source/WebCore/rendering/style/StyleShader.h
+++ b/Source/WebCore/rendering/style/StyleShader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp b/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
index 98be1ba0a..8f8c86ea6 100644
--- a/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
@@ -49,7 +49,6 @@
 #include "RenderSVGResourceRadialGradient.cpp"
 #include "RenderSVGResourceSolidColor.cpp"
 #include "RenderSVGRoot.cpp"
-#include "RenderSVGShadowTreeRootContainer.cpp"
 #include "RenderSVGShape.cpp"
 #include "RenderSVGTSpan.cpp"
 #include "RenderSVGText.cpp"
@@ -63,11 +62,11 @@
 #include "SVGPathData.cpp"
 #include "SVGRenderSupport.cpp"
 #include "SVGRenderTreeAsText.cpp"
+#include "SVGRenderingContext.cpp"
 #include "SVGResources.cpp"
 #include "SVGResourcesCache.cpp"
 #include "SVGResourcesCycleSolver.cpp"
 #include "SVGRootInlineBox.cpp"
-#include "SVGShadowTreeElements.cpp"
 #include "SVGTextChunk.cpp"
 #include "SVGTextChunkBuilder.cpp"
 #include "SVGTextLayoutAttributes.cpp"
diff --git a/Source/WebCore/rendering/svg/RenderSVGBlock.cpp b/Source/WebCore/rendering/svg/RenderSVGBlock.cpp
index 58f6631fa..cf44efff1 100644
--- a/Source/WebCore/rendering/svg/RenderSVGBlock.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGBlock.cpp
@@ -79,7 +79,7 @@ void RenderSVGBlock::updateBoxModelInfoFromStyle()
     setHasOverflowClip(false);
 }
 
-void RenderSVGBlock::absoluteRects(Vector<LayoutRect>&, const LayoutPoint&) const
+void RenderSVGBlock::absoluteRects(Vector<IntRect>&, const LayoutPoint&) const
 {
     // This code path should never be taken for SVG, as we're assuming useTransforms=true everywhere, absoluteQuads should be used.
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/rendering/svg/RenderSVGBlock.h b/Source/WebCore/rendering/svg/RenderSVGBlock.h
index 58cf2620a..ca000f50b 100644
--- a/Source/WebCore/rendering/svg/RenderSVGBlock.h
+++ b/Source/WebCore/rendering/svg/RenderSVGBlock.h
@@ -38,7 +38,7 @@ private:
     virtual void setStyle(PassRefPtr<RenderStyle>);
     virtual void updateBoxModelInfoFromStyle();
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
 
     virtual void willBeDestroyed();
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
diff --git a/Source/WebCore/rendering/svg/RenderSVGContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGContainer.cpp
index 515565521..e16bfa33c 100644
--- a/Source/WebCore/rendering/svg/RenderSVGContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGContainer.cpp
@@ -31,7 +31,7 @@
 #include "RenderSVGResource.h"
 #include "RenderSVGResourceFilter.h"
 #include "RenderView.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGResources.h"
 #include "SVGResourcesCache.h"
 #include "SVGStyledElement.h"
@@ -114,18 +114,18 @@ void RenderSVGContainer::paint(PaintInfo& paintInfo, const LayoutPoint&)
 
         childPaintInfo.applyTransform(localToParentTransform());
 
+        SVGRenderingContext renderingContext;
         bool continueRendering = true;
-        if (childPaintInfo.phase == PaintPhaseForeground)
-            continueRendering = SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo);
+        if (childPaintInfo.phase == PaintPhaseForeground) {
+            renderingContext.prepareToRenderSVGContent(this, childPaintInfo);
+            continueRendering = renderingContext.isRenderingPrepared();
+        }
 
         if (continueRendering) {
             childPaintInfo.updatePaintingRootForChildren(this);
             for (RenderObject* child = firstChild(); child; child = child->nextSibling())
                 child->paint(childPaintInfo, IntPoint());
         }
-
-        if (paintInfo.phase == PaintPhaseForeground)
-            SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, paintInfo.context);
     }
     
     // FIXME: This really should be drawn from local coordinates, but currently we hack it
@@ -140,9 +140,9 @@ void RenderSVGContainer::paint(PaintInfo& paintInfo, const LayoutPoint&)
 }
 
 // addFocusRingRects is called from paintOutline and needs to be in the same coordinates as the paintOuline call
-void RenderSVGContainer::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint&)
+void RenderSVGContainer::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint&)
 {
-    LayoutRect paintRectInParent = enclosingLayoutRect(localToParentTransform().mapRect(repaintRectInLocalCoordinates()));
+    IntRect paintRectInParent = enclosingIntRect(localToParentTransform().mapRect(repaintRectInLocalCoordinates()));
     if (!paintRectInParent.isEmpty())
         rects.append(paintRectInParent);
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGContainer.h b/Source/WebCore/rendering/svg/RenderSVGContainer.h
index b3324703c..84621f175 100644
--- a/Source/WebCore/rendering/svg/RenderSVGContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGContainer.h
@@ -52,7 +52,7 @@ protected:
 
     virtual void layout();
 
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     virtual FloatRect objectBoundingBox() const { return m_objectBoundingBox; }
     virtual FloatRect strokeBoundingBox() const { return m_strokeBoundingBox; }
diff --git a/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp b/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
index dadcaed8a..676e8f4a7 100644
--- a/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
@@ -29,7 +29,7 @@
 #include "RenderSVGResource.h"
 #include "RenderView.h"
 #include "SVGForeignObjectElement.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGResourcesCache.h"
 #include "SVGSVGElement.h"
 #include "TransformState.h"
@@ -59,9 +59,12 @@ void RenderSVGForeignObject::paint(PaintInfo& paintInfo, const LayoutPoint&)
     if (SVGRenderSupport::isOverflowHidden(this))
         childPaintInfo.context->clip(m_viewport);
 
+    SVGRenderingContext renderingContext;
     bool continueRendering = true;
-    if (paintInfo.phase == PaintPhaseForeground)
-        continueRendering = SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo);
+    if (paintInfo.phase == PaintPhaseForeground) {
+        renderingContext.prepareToRenderSVGContent(this, childPaintInfo);
+        continueRendering = renderingContext.isRenderingPrepared();
+    }
 
     if (continueRendering) {
         // Paint all phases of FO elements atomically, as though the FO element established its
@@ -81,9 +84,6 @@ void RenderSVGForeignObject::paint(PaintInfo& paintInfo, const LayoutPoint&)
             RenderBlock::paint(childPaintInfo, childPoint);
         }
     }
-
-    if (paintInfo.phase == PaintPhaseForeground)
-        SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, paintInfo.context);
 }
 
 LayoutRect RenderSVGForeignObject::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const
diff --git a/Source/WebCore/rendering/svg/RenderSVGImage.cpp b/Source/WebCore/rendering/svg/RenderSVGImage.cpp
index 7230c6ae9..56be5cd41 100644
--- a/Source/WebCore/rendering/svg/RenderSVGImage.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGImage.cpp
@@ -41,7 +41,7 @@
 #include "SVGImageElement.h"
 #include "SVGLength.h"
 #include "SVGPreserveAspectRatio.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGResources.h"
 #include "SVGResourcesCache.h"
 
@@ -124,9 +124,9 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, const LayoutPoint&)
         childPaintInfo.applyTransform(m_localTransform);
 
         if (childPaintInfo.phase == PaintPhaseForeground) {
-            PaintInfo savedInfo(childPaintInfo);
+            SVGRenderingContext renderingContext(this, childPaintInfo);
 
-            if (SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo)) {
+            if (renderingContext.isRenderingPrepared()) {
                 RefPtr<Image> image = m_imageResource->image();
                 FloatRect destRect = m_objectBoundingBox;
                 FloatRect srcRect(0, 0, image->width(), image->height());
@@ -136,8 +136,6 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, const LayoutPoint&)
 
                 childPaintInfo.context->drawImage(image.get(), ColorSpaceDeviceRGB, destRect, srcRect);
             }
-
-            SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, savedInfo.context);
         }
 
         if (drawsOutline)
@@ -183,10 +181,10 @@ void RenderSVGImage::imageChanged(WrappedImagePtr, const IntRect*)
     repaint();
 }
 
-void RenderSVGImage::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint&)
+void RenderSVGImage::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint&)
 {
     // this is called from paint() after the localTransform has already been applied
-    LayoutRect contentRect = enclosingLayoutRect(repaintRectInLocalCoordinates());
+    IntRect contentRect = enclosingIntRect(repaintRectInLocalCoordinates());
     if (!contentRect.isEmpty())
         rects.append(contentRect);
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGImage.h b/Source/WebCore/rendering/svg/RenderSVGImage.h
index 6a301eaad..9cd3eeac1 100644
--- a/Source/WebCore/rendering/svg/RenderSVGImage.h
+++ b/Source/WebCore/rendering/svg/RenderSVGImage.h
@@ -58,7 +58,7 @@ private:
     virtual FloatRect strokeBoundingBox() const { return m_objectBoundingBox; }
     virtual FloatRect repaintRectInLocalCoordinates() const { return m_repaintBoundingBox; }
 
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp b/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
index 3377fc026..3841336a5 100644
--- a/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
@@ -34,6 +34,7 @@
 #include "RenderSVGModelObject.h"
 
 #include "RenderSVGResource.h"
+#include "SVGNames.h"
 #include "SVGResourcesCache.h"
 #include "SVGStyledElement.h"
 
@@ -71,10 +72,10 @@ LayoutRect RenderSVGModelObject::outlineBoundsForRepaint(RenderBoxModelObject* r
     return containerRelativeQuad.enclosingBoundingBox();
 }
 
-void RenderSVGModelObject::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
+void RenderSVGModelObject::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
-    LayoutRect rect = enclosingLayoutRect(strokeBoundingBox());
-    rect.moveBy(accumulatedOffset);
+    IntRect rect = enclosingIntRect(strokeBoundingBox());
+    rect.moveBy(roundedIntPoint(accumulatedOffset));
     rects.append(rect);
 }
 
@@ -161,7 +162,7 @@ static bool intersectsAllowingEmpty(const FloatRect& r, const FloatRect& other)
 // image, line, path, polygon, polyline, rect, text and use.
 static bool isGraphicsElement(RenderObject* renderer)
 {
-    return renderer->isSVGShape() || renderer->isSVGText() || renderer->isSVGImage() || renderer->isSVGShadowTreeRootContainer();
+    return renderer->isSVGShape() || renderer->isSVGText() || renderer->isSVGImage() || renderer->node()->hasTagName(SVGNames::useTag);
 }
 
 bool RenderSVGModelObject::checkIntersection(RenderObject* renderer, const FloatRect& rect)
diff --git a/Source/WebCore/rendering/svg/RenderSVGModelObject.h b/Source/WebCore/rendering/svg/RenderSVGModelObject.h
index a2f031365..1582ff5fa 100644
--- a/Source/WebCore/rendering/svg/RenderSVGModelObject.h
+++ b/Source/WebCore/rendering/svg/RenderSVGModelObject.h
@@ -55,7 +55,7 @@ public:
     virtual void computeFloatRectForRepaint(RenderBoxModelObject* repaintContainer, FloatRect&, bool fixed = false) const;
     virtual LayoutRect outlineBoundsForRepaint(RenderBoxModelObject* repaintContainer, LayoutPoint*) const;
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
 
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&, bool* wasFixed = 0) const;
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp
index 34db57d00..ba20502f3 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp
@@ -244,7 +244,7 @@ bool RenderSVGResourceClipper::drawContentIntoMaskImage(ClipperData* clipperData
             continue;
 
         WindRule newClipRule = style->svgStyle()->clipRule();
-        bool isUseElement = renderer->isSVGShadowTreeRootContainer();
+        bool isUseElement = childNode->hasTagName(SVGNames::useTag);
         if (isUseElement) {
             SVGUseElement* useElement = static_cast<SVGUseElement*>(childNode);
             renderer = useElement->rendererClipChild();
@@ -277,7 +277,7 @@ void RenderSVGResourceClipper::calculateClipContentRepaintRect()
         RenderObject* renderer = childNode->renderer();
         if (!childNode->isSVGElement() || !static_cast<SVGElement*>(childNode)->isStyled() || !renderer)
             continue;
-        if (!renderer->isSVGShape() && !renderer->isSVGText() && !renderer->isSVGShadowTreeRootContainer())
+        if (!renderer->isSVGShape() && !renderer->isSVGText() && !childNode->hasTagName(SVGNames::useTag))
             continue;
         RenderStyle* style = renderer->style();
         if (!style || style->display() == NONE || style->visibility() != VISIBLE)
@@ -307,7 +307,7 @@ bool RenderSVGResourceClipper::hitTestClipContent(const FloatRect& objectBoundin
         RenderObject* renderer = childNode->renderer();
         if (!childNode->isSVGElement() || !static_cast<SVGElement*>(childNode)->isStyled() || !renderer)
             continue;
-        if (!renderer->isSVGShape() && !renderer->isSVGText() && !renderer->isSVGShadowTreeRootContainer())
+        if (!renderer->isSVGShape() && !renderer->isSVGText() && !childNode->hasTagName(SVGNames::useTag))
             continue;
         IntPoint hitPoint;
         HitTestResult result(hitPoint);
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
index 2e03e9f59..2952442cf 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
@@ -22,7 +22,6 @@
 #if ENABLE(SVG)
 #include "RenderSVGResourceContainer.h"
 
-#include "RenderSVGShadowTreeRootContainer.h"
 #include "RenderView.h"
 #include "SVGResourcesCache.h"
 #include "SVGStyledTransformableElement.h"
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
index cf4303d13..43ebee284 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
@@ -300,6 +300,7 @@ void RenderSVGResourceFilter::postApplyResource(RenderObject* object, GraphicsCo
         // Always true if filterData is just built (filterData->builded is false).
         if (!lastEffect->hasResult()) {
             lastEffect->apply();
+            lastEffect->correctFilterResultIfNeeded();
 #if !USE(CG)
             ImageBuffer* resultImage = lastEffect->asImageBuffer();
             if (resultImage)
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
index 7baa4fc38..b99701d81 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
@@ -38,7 +38,7 @@
 #include "RenderSVGResource.h"
 #include "RenderView.h"
 #include "SVGLength.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGResources.h"
 #include "SVGResourcesCache.h"
 #include "SVGSVGElement.h"
@@ -188,8 +188,20 @@ LayoutUnit RenderSVGRoot::computeReplacedLogicalHeight() const
     if (hasReplacedLogicalHeight())
         return RenderReplaced::computeReplacedLogicalHeight();
 
-    if (svg->heightAttributeEstablishesViewport())
-        return resolveLengthAttributeForSVG(svg->intrinsicHeight(SVGSVGElement::IgnoreCSSProperties), style()->effectiveZoom(), containingBlock()->availableLogicalHeight());
+    if (svg->heightAttributeEstablishesViewport()) {
+        Length height = svg->intrinsicHeight(SVGSVGElement::IgnoreCSSProperties);
+        if (height.isPercent()) {
+            RenderBlock* cb = containingBlock();
+            ASSERT(cb);
+            while (cb->isAnonymous()) {
+                cb = cb->containingBlock();
+                cb->addPercentHeightDescendant(const_cast<RenderSVGRoot*>(this));
+            }
+        } else
+            RenderBlock::removePercentHeightDescendant(const_cast<RenderSVGRoot*>(this));
+
+        return resolveLengthAttributeForSVG(height, style()->effectiveZoom(), containingBlock()->availableLogicalHeight());
+    }
 
     // Only SVGs embedded in <object> reach this point.
     ASSERT(isEmbeddedThroughFrameContainingSVGDocument());
@@ -206,7 +218,7 @@ void RenderSVGRoot::layout()
     bool needsLayout = selfNeedsLayout();
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && needsLayout);
 
-    LayoutSize oldSize(width(), height());
+    LayoutSize oldSize = size();
     computeLogicalWidth();
     computeLogicalHeight();
     buildLocalToBorderBoxTransform();
@@ -237,17 +249,22 @@ void RenderSVGRoot::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& adjus
     if (paintInfo.context->paintingDisabled())
         return;
 
+    Page* page = 0;
+    if (Frame* frame = this->frame())
+        page = frame->page();
+
     // Don't paint if we don't have kids, except if we have filters we should paint those.
     if (!firstChild()) {
         SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(this);
-        if (!resources || !resources->filter())
+        if (!resources || !resources->filter()) {
+            if (page && paintInfo.phase == PaintPhaseForeground)
+                page->addRelevantUnpaintedObject(this, visualOverflowRect());
             return;
+        }
     }
 
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
+    if (page && paintInfo.phase == PaintPhaseForeground)
+        page->addRelevantRepaintedObject(this, visualOverflowRect());
 
     // Make a copy of the PaintInfo because applyTransform will modify the damage rect.
     PaintInfo childPaintInfo(paintInfo);
@@ -260,21 +277,23 @@ void RenderSVGRoot::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& adjus
     // Transform from our paint container's coordinate system to our local coords.
     childPaintInfo.applyTransform(AffineTransform::translation(adjustedPaintOffset.x() - x(), adjustedPaintOffset.y() - y()) * localToParentTransform());
 
+    SVGRenderingContext renderingContext;
     bool continueRendering = true;
-    if (childPaintInfo.phase == PaintPhaseForeground)
-        continueRendering = SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo);
+    if (childPaintInfo.phase == PaintPhaseForeground) {
+        renderingContext.prepareToRenderSVGContent(this, childPaintInfo);
+        continueRendering = renderingContext.isRenderingPrepared();
+    }
 
     if (continueRendering)
         RenderBox::paint(childPaintInfo, LayoutPoint());
 
-    if (childPaintInfo.phase == PaintPhaseForeground)
-        SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, paintInfo.context);
-
     childPaintInfo.context->restore();
 }
 
 void RenderSVGRoot::willBeDestroyed()
 {
+    RenderBlock::removePercentHeightDescendant(const_cast<RenderSVGRoot*>(this));
+
     SVGResourcesCache::clientDestroyed(this);
     RenderReplaced::willBeDestroyed();
 }
@@ -317,9 +336,9 @@ const AffineTransform& RenderSVGRoot::localToParentTransform() const
     // Slightly optimized version of m_localToParentTransform = AffineTransform::translation(x(), y()) * m_localToBorderBoxTransform;
     m_localToParentTransform = m_localToBorderBoxTransform;
     if (x())
-        m_localToParentTransform.setE(m_localToParentTransform.e() + x());
+        m_localToParentTransform.setE(m_localToParentTransform.e() + roundToInt(x()));
     if (y())
-        m_localToParentTransform.setF(m_localToParentTransform.f() + y());
+        m_localToParentTransform.setF(m_localToParentTransform.f() + roundToInt(y()));
     return m_localToParentTransform;
 }
 
@@ -376,7 +395,7 @@ bool RenderSVGRoot::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
     if (!contentBoxRect().contains(pointInBorderBox))
         return false;
 
-    LayoutPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
+    FloatPoint localPoint = localToParentTransform().inverse().mapPoint(FloatPoint(pointInParent));
 
     for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
         if (child->nodeAtFloatPoint(request, result, localPoint, hitTestAction)) {
@@ -401,6 +420,14 @@ bool RenderSVGRoot::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
     return false;
 }
 
+bool RenderSVGRoot::hasRelativeDimensions() const
+{
+    SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
+    ASSERT(svg);
+
+    return svg->intrinsicHeight(SVGSVGElement::IgnoreCSSProperties).isPercent() || svg->intrinsicWidth(SVGSVGElement::IgnoreCSSProperties).isPercent();
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.h b/Source/WebCore/rendering/svg/RenderSVGRoot.h
index 701137f44..adc1884e4 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.h
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.h
@@ -53,6 +53,8 @@ public:
     IntSize containerSize() const { return m_containerSize; }
     void setContainerSize(const IntSize& containerSize) { m_containerSize = containerSize; }
 
+    virtual bool hasRelativeDimensions() const;
+
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
diff --git a/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp
deleted file mode 100644
index 7cc89e983..000000000
--- a/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "RenderSVGShadowTreeRootContainer.h"
-
-#include "MouseEvent.h"
-#include "SVGShadowTreeElements.h"
-#include "SVGUseElement.h"
-
-namespace WebCore {
-
-RenderSVGShadowTreeRootContainer::RenderSVGShadowTreeRootContainer(SVGUseElement* node)
-    : RenderSVGTransformableContainer(node)
-    , m_recreateTree(false)
-{
-}
-
-RenderSVGShadowTreeRootContainer::~RenderSVGShadowTreeRootContainer()
-{
-    if (m_shadowRoot)
-        m_shadowRoot->clearSVGShadowHost();
-}
-
-void RenderSVGShadowTreeRootContainer::updateStyle(Node::StyleChange change)
-{
-    if (m_shadowRoot && m_shadowRoot->attached())
-        m_shadowRoot->recalcStyle(change);
-}
-
-void RenderSVGShadowTreeRootContainer::updateFromElement()
-{
-    bool hadExistingTree = m_shadowRoot;
-
-    SVGUseElement* useElement = static_cast<SVGUseElement*>(node());
-    if (!m_shadowRoot) {
-        ASSERT(!m_recreateTree);
-        m_shadowRoot = SVGShadowTreeRootElement::create(document(), useElement);
-        useElement->buildPendingResource();
-    }
-
-    ASSERT(m_shadowRoot->svgShadowHost() == useElement);
-
-    bool shouldRecreateTree = m_recreateTree;
-    if (m_recreateTree) {
-        ASSERT(hadExistingTree);
-
-        if (m_shadowRoot->attached())
-            m_shadowRoot->detach();
-
-        m_shadowRoot->removeAllChildren();
-        m_recreateTree = false;
-    }
-
-    // Only rebuild the shadow tree, if we a) never had a tree or b) we were specifically asked to do so
-    // If the use element is a pending resource, and a) or b) is true, do nothing, and wait for the use
-    // element to be asked to buildPendingResource(), this will call us again, with m_recreateTrue=true.
-    if ((shouldRecreateTree || !hadExistingTree) && !useElement->hasPendingResources()) {
-        useElement->buildShadowAndInstanceTree(m_shadowRoot.get());
-
-        // Attach shadow root element
-        m_shadowRoot->attachElement(style(), renderArena());
-
-        // Attach subtree, as if it was a regular non-shadow tree
-        for (Node* child = m_shadowRoot->firstChild(); child; child = child->nextSibling())
-            child->attach();
-    }
-
-    ASSERT(!m_recreateTree);
-    RenderSVGTransformableContainer::updateFromElement();
-}
-
-void RenderSVGShadowTreeRootContainer::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
-{
-    RenderSVGTransformableContainer::styleDidChange(diff, oldStyle);
-
-    if (RenderObject* shadowRootRenderer = m_shadowRoot ? m_shadowRoot->renderer() : 0)
-        shadowRootRenderer->setStyle(style());
-}
-
-Node* RenderSVGShadowTreeRootContainer::rootElement() const
-{
-    return m_shadowRoot.get();
-}
-
-}
-
-#endif
diff --git a/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.h b/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.h
deleted file mode 100644
index cee840965..000000000
--- a/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef RenderSVGShadowTreeRootContainer_h
-#define RenderSVGShadowTreeRootContainer_h
-
-#if ENABLE(SVG)
-#include "RenderSVGTransformableContainer.h"
-
-namespace WebCore {
-    
-class SVGUseElement;
-class SVGShadowTreeRootElement;
-
-class RenderSVGShadowTreeRootContainer : public RenderSVGTransformableContainer {
-public:
-    RenderSVGShadowTreeRootContainer(SVGUseElement*);
-    virtual ~RenderSVGShadowTreeRootContainer();
-
-    virtual bool isSVGShadowTreeRootContainer() const { return true; }
-
-    void markShadowTreeForRecreation() { m_recreateTree = true; }
-    void updateStyle(Node::StyleChange);
-    virtual void updateFromElement();
-
-    Node* rootElement() const;
-
-private:
-    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
-
-    bool m_recreateTree;
-    RefPtr<SVGShadowTreeRootElement> m_shadowRoot;
-};
-
-}
-
-#endif
-#endif
diff --git a/Source/WebCore/rendering/svg/RenderSVGShape.cpp b/Source/WebCore/rendering/svg/RenderSVGShape.cpp
index 31f15251b..c438d30b0 100755
--- a/Source/WebCore/rendering/svg/RenderSVGShape.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGShape.cpp
@@ -41,7 +41,7 @@
 #include "RenderSVGResourceSolidColor.h"
 #include "SVGPathData.h"
 #include "SVGPathElement.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGResources.h"
 #include "SVGResourcesCache.h"
 #include "SVGStyledTransformableElement.h"
@@ -168,7 +168,7 @@ void RenderSVGShape::layout()
     bool updateCachedBoundariesInParents = false;
 
     bool needsShapeUpdate = m_needsShapeUpdate;
-    if (needsShapeUpdate) {
+    if (needsShapeUpdate || m_needsBoundariesUpdate) {
         setIsPaintingFallback(false);
         m_path.clear();
         createShape();
@@ -182,13 +182,6 @@ void RenderSVGShape::layout()
         updateCachedBoundariesInParents = true;
     }
 
-    if (m_needsBoundariesUpdate) {
-        setIsPaintingFallback(false);
-        m_path.clear();
-        createShape();
-        updateCachedBoundariesInParents = true;
-    }
-
     // Invalidate all resources of this client if our layout changed.
     if (everHadLayout() && selfNeedsLayout()) {
         SVGResourcesCache::clientLayoutChanged(this);
@@ -340,9 +333,9 @@ void RenderSVGShape::paint(PaintInfo& paintInfo, const IntPoint&)
         childPaintInfo.applyTransform(m_localTransform);
 
         if (childPaintInfo.phase == PaintPhaseForeground) {
-            PaintInfo savedInfo(childPaintInfo);
+            SVGRenderingContext renderingContext(this, childPaintInfo);
 
-            if (SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo)) {
+            if (renderingContext.isRenderingPrepared()) {
                 const SVGRenderStyle* svgStyle = style()->svgStyle();
                 if (svgStyle->shapeRendering() == SR_CRISPEDGES)
                     childPaintInfo.context->setShouldAntialias(false);
@@ -352,8 +345,6 @@ void RenderSVGShape::paint(PaintInfo& paintInfo, const IntPoint&)
                 if (svgStyle->hasMarkers())
                     m_markerLayoutInfo.drawMarkers(childPaintInfo);
             }
-
-            SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, savedInfo.context);
         }
 
         if (drawsOutline)
@@ -363,9 +354,9 @@ void RenderSVGShape::paint(PaintInfo& paintInfo, const IntPoint&)
 
 // This method is called from inside paintOutline() since we call paintOutline()
 // while transformed to our coord system, return local coords
-void RenderSVGShape::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint&)
+void RenderSVGShape::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint&)
 {
-    LayoutRect rect = enclosingLayoutRect(repaintRectInLocalCoordinates());
+    IntRect rect = enclosingIntRect(repaintRectInLocalCoordinates());
     if (!rect.isEmpty())
         rects.append(rect);
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGShape.h b/Source/WebCore/rendering/svg/RenderSVGShape.h
index 1a1ed447b..934a05d39 100644
--- a/Source/WebCore/rendering/svg/RenderSVGShape.h
+++ b/Source/WebCore/rendering/svg/RenderSVGShape.h
@@ -113,7 +113,7 @@ private:
 
     virtual void layout();
     virtual void paint(PaintInfo&, const LayoutPoint&);
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
index 0a62f6885..ee4d74e24 100644
--- a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
@@ -26,8 +26,8 @@
 
 #include "SVGNames.h"
 #include "SVGRenderSupport.h"
-#include "SVGShadowTreeElements.h"
 #include "SVGStyledTransformableElement.h"
+#include "SVGUseElement.h"
 
 namespace WebCore {
     
@@ -42,27 +42,33 @@ bool RenderSVGTransformableContainer::calculateLocalTransform()
 {
     SVGStyledTransformableElement* element = static_cast<SVGStyledTransformableElement*>(node());
 
-    bool needsUpdate = m_needsTransformUpdate;
-    m_didTransformToRootUpdate = m_needsTransformUpdate || SVGRenderSupport::transformToRootChanged(parent());
-    if (needsUpdate) {
-        m_localTransform = element->animatedLocalTransform();
-        m_needsTransformUpdate = false;
+    // If we're either the renderer for a <use> element, or for any <g> element inside the shadow
+    // tree, that was created during the use/symbol/svg expansion in SVGUseElement. These containers
+    // need to respect the translations induced by their corresponding use elements x/y attributes.
+    SVGUseElement* useElement = 0;
+    if (element->hasTagName(SVGNames::useTag))
+        useElement = static_cast<SVGUseElement*>(element);
+    else if (element->isInShadowTree() && element->hasTagName(SVGNames::gTag)) {
+        SVGElement* correspondingElement = element->correspondingElement();
+        if (correspondingElement && correspondingElement->hasTagName(SVGNames::useTag))
+            useElement = static_cast<SVGUseElement*>(correspondingElement);
     }
 
-    if (!element->hasTagName(SVGNames::gTag) || !static_cast<SVGGElement*>(element)->isShadowTreeContainerElement())
-        return needsUpdate;
-
-    SVGShadowTreeContainerElement* shadowElement = static_cast<SVGShadowTreeContainerElement*>(element);
-    FloatSize translation = shadowElement->containerTranslation();
-    if (!shadowElement->containerOffsetChanged() && !translation.width() && !translation.height())
-        return needsUpdate;
+    if (useElement) {
+        SVGLengthContext lengthContext(useElement);
+        FloatSize translation(useElement->x().value(lengthContext), useElement->y().value(lengthContext));
+        if (translation != m_lastTranslation)
+            m_needsTransformUpdate = true;
+        m_lastTranslation = translation;
+    }
 
-    // FIXME: Could optimize this case for use to avoid refetching the animatedLocalTransform() here, if only the containerTranslation() changed.
-    if (!needsUpdate)
-        m_localTransform = element->animatedLocalTransform();
+    m_didTransformToRootUpdate = m_needsTransformUpdate || SVGRenderSupport::transformToRootChanged(parent());
+    if (!m_needsTransformUpdate)
+        return false;
 
-    m_localTransform.translate(translation.width(), translation.height());
-    shadowElement->setContainerOffsetChanged(false);
+    m_localTransform = element->animatedLocalTransform();
+    m_localTransform.translate(m_lastTranslation.width(), m_lastTranslation.height());
+    m_needsTransformUpdate = false;
     return true;
 }
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
index c9c607ba2..c10a08dc2 100644
--- a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
@@ -43,7 +43,9 @@ private:
     bool m_needsTransformUpdate : 1;
     bool m_didTransformToRootUpdate : 1;
     AffineTransform m_localTransform;
+    FloatSize m_lastTranslation;
 };
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
index 3e0e3e4d9..0de95d551 100644
--- a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
@@ -27,8 +27,10 @@
 
 #include "GraphicsContext.h"
 #include "RenderView.h"
+#include "SVGElementInstance.h"
 #include "SVGNames.h"
 #include "SVGSVGElement.h"
+#include "SVGUseElement.h"
 
 namespace WebCore {
 
@@ -65,6 +67,52 @@ void RenderSVGViewportContainer::calcViewport()
     SVGLengthContext lengthContext(element);
     m_viewport = FloatRect(svg->x().value(lengthContext), svg->y().value(lengthContext), svg->width().value(lengthContext), svg->height().value(lengthContext));
 
+    SVGElement* correspondingElement = svg->correspondingElement();
+    if (correspondingElement && svg->isInShadowTree()) {
+        const HashSet<SVGElementInstance*>& instances = correspondingElement->instancesForElement();
+        ASSERT(!instances.isEmpty());
+
+        SVGUseElement* useElement = 0;
+        const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
+        for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
+            const SVGElementInstance* instance = (*it);
+            ASSERT(instance->correspondingElement()->hasTagName(SVGNames::svgTag) || instance->correspondingElement()->hasTagName(SVGNames::symbolTag));
+            if (instance->shadowTreeElement() == svg) {
+                ASSERT(correspondingElement == instance->correspondingElement());
+                useElement = instance->directUseElement();
+                if (!useElement)
+                    useElement = instance->correspondingUseElement();
+                break;
+            }
+        }
+
+        ASSERT(useElement);
+        bool isSymbolElement = correspondingElement->hasTagName(SVGNames::symbolTag);
+
+        // Spec (<use> on <symbol>): This generated 'svg' will always have explicit values for attributes width and height.
+        // If attributes width and/or height are provided on the 'use' element, then these attributes
+        // will be transferred to the generated 'svg'. If attributes width and/or height are not specified,
+        // the generated 'svg' element will use values of 100% for these attributes.
+
+        // Spec (<use> on <svg>): If attributes width and/or height are provided on the 'use' element, then these
+        // values will override the corresponding attributes on the 'svg' in the generated tree.
+
+        SVGLengthContext lengthContext(element);
+        if (useElement->hasAttribute(SVGNames::widthAttr))
+            m_viewport.setWidth(useElement->width().value(lengthContext));
+        else if (isSymbolElement && svg->hasAttribute(SVGNames::widthAttr)) {
+            SVGLength containerWidth(LengthModeWidth, "100%");
+            m_viewport.setWidth(containerWidth.value(lengthContext));
+        }
+
+        if (useElement->hasAttribute(SVGNames::heightAttr))
+            m_viewport.setHeight(useElement->height().value(lengthContext));
+        else if (isSymbolElement && svg->hasAttribute(SVGNames::heightAttr)) {
+            SVGLength containerHeight(LengthModeHeight, "100%");
+            m_viewport.setHeight(containerHeight.value(lengthContext));
+        }
+    }
+
     if (oldViewport != m_viewport) {
         m_didTransformToRootUpdate = true;
         setNeedsBoundariesUpdate();
diff --git a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
index b748fe6f0..eb7041a30 100644
--- a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
@@ -42,7 +42,6 @@ public:
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
 
 private:
-    virtual bool isSVGContainer() const { return true; }
     virtual bool isSVGViewportContainer() const { return true; }
     virtual const char* renderName() const { return "RenderSVGViewportContainer"; }
 
diff --git a/Source/WebCore/rendering/svg/SVGImageBufferTools.cpp b/Source/WebCore/rendering/svg/SVGImageBufferTools.cpp
index ef97a2847..899550055 100644
--- a/Source/WebCore/rendering/svg/SVGImageBufferTools.cpp
+++ b/Source/WebCore/rendering/svg/SVGImageBufferTools.cpp
@@ -60,7 +60,7 @@ bool SVGImageBufferTools::createImageBuffer(const FloatRect& targetRect, const A
         return false;
 
     IntSize clampedSize = clampedAbsoluteSize(paintRect.size());
-    OwnPtr<ImageBuffer> image = ImageBuffer::create(clampedSize, colorSpace, renderingMode);
+    OwnPtr<ImageBuffer> image = ImageBuffer::create(clampedSize, 1, colorSpace, renderingMode);
     if (!image)
         return false;
 
@@ -89,7 +89,7 @@ bool SVGImageBufferTools::createImageBufferForPattern(const FloatRect& absoluteT
     if (imageSize.isEmpty())
         return false;
 
-    OwnPtr<ImageBuffer> image = ImageBuffer::create(imageSize, colorSpace, renderingMode);
+    OwnPtr<ImageBuffer> image = ImageBuffer::create(imageSize, 1, colorSpace, renderingMode);
     if (!image)
         return false;
 
diff --git a/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp b/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp
index cdeec61ca..21a909224 100644
--- a/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp
@@ -29,7 +29,7 @@
 #include "RenderSVGInlineText.h"
 #include "RenderedDocumentMarker.h"
 #include "SVGInlineTextBox.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 
 using namespace std;
 
@@ -57,19 +57,15 @@ void SVGInlineFlowBox::paint(PaintInfo& paintInfo, const LayoutPoint&, LayoutUni
     RenderObject* boxRenderer = renderer();
     ASSERT(boxRenderer);
 
-    PaintInfo childPaintInfo(paintInfo);
-    GraphicsContextStateSaver stateSaver(*childPaintInfo.context);
-
-    if (SVGRenderSupport::prepareToRenderSVGContent(boxRenderer, childPaintInfo)) {
+    SVGRenderingContext renderingContext(boxRenderer, paintInfo, SVGRenderingContext::SaveGraphicsContext);
+    if (renderingContext.isRenderingPrepared()) {
         for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
             if (child->isSVGInlineTextBox())
                 computeTextMatchMarkerRectForRenderer(toRenderSVGInlineText(static_cast<SVGInlineTextBox*>(child)->textRenderer()));
 
-            child->paint(childPaintInfo, LayoutPoint(), 0, 0);
+            child->paint(paintInfo, LayoutPoint(), 0, 0);
         }
     }
-
-    SVGRenderSupport::finishRenderSVGContent(boxRenderer, childPaintInfo, paintInfo.context);
 }
 
 FloatRect SVGInlineFlowBox::calculateBoundaries() const
diff --git a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
index 7feb88fec..e262422ad 100644
--- a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
+++ b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
@@ -27,12 +27,8 @@
 #if ENABLE(SVG)
 #include "SVGRenderSupport.h"
 
-#include "Frame.h"
-#include "FrameView.h"
-#include "ImageBuffer.h"
 #include "NodeRenderStyle.h"
 #include "RenderLayer.h"
-#include "RenderSVGPath.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGResourceClipper.h"
 #include "RenderSVGResourceFilter.h"
@@ -80,106 +76,6 @@ void SVGRenderSupport::mapLocalToContainer(const RenderObject* object, RenderBox
     object->parent()->mapLocalToContainer(repaintContainer, false, true, transformState, wasFixed);
 }
 
-static inline bool isRenderingMaskImage(RenderObject* object)
-{
-    if (object->frame() && object->frame()->view())
-        return object->frame()->view()->paintBehavior() & PaintBehaviorRenderingSVGMask;
-    return false;
-}
-
-bool SVGRenderSupport::prepareToRenderSVGContent(RenderObject* object, PaintInfo& paintInfo)
-{
-    ASSERT(object);
-
-    RenderStyle* style = object->style();
-    ASSERT(style);
-
-    const SVGRenderStyle* svgStyle = style->svgStyle();
-    ASSERT(svgStyle);
-
-    // Setup transparency layers before setting up SVG resources!
-    bool isRenderingMask = isRenderingMaskImage(object);
-    float opacity = isRenderingMask ? 1 : style->opacity();
-    const ShadowData* shadow = svgStyle->shadow();
-    if (opacity < 1 || shadow) {
-        FloatRect repaintRect = object->repaintRectInLocalCoordinates();
-
-        if (opacity < 1) {
-            paintInfo.context->clip(repaintRect);
-            paintInfo.context->beginTransparencyLayer(opacity);
-        }
-
-        if (shadow) {
-            paintInfo.context->clip(repaintRect);
-            paintInfo.context->setShadow(IntSize(shadow->x(), shadow->y()), shadow->blur(), shadow->color(), style->colorSpace());
-            paintInfo.context->beginTransparencyLayer(1);
-        }
-    }
-
-    SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(object);
-    if (!resources) {
-#if ENABLE(FILTERS)
-        if (svgStyle->hasFilter())
-            return false;
-#endif
-        return true;
-    }
-
-    if (!isRenderingMask) {
-        if (RenderSVGResourceMasker* masker = resources->masker()) {
-            if (!masker->applyResource(object, style, paintInfo.context, ApplyToDefaultMode))
-                return false;
-        }
-    }
-
-    if (RenderSVGResourceClipper* clipper = resources->clipper()) {
-        if (!clipper->applyResource(object, style, paintInfo.context, ApplyToDefaultMode))
-            return false;
-    }
-
-#if ENABLE(FILTERS)
-    if (!isRenderingMask) {
-        if (RenderSVGResourceFilter* filter = resources->filter()) {
-            if (!filter->applyResource(object, style, paintInfo.context, ApplyToDefaultMode))
-                return false;
-        }
-    }
-#endif
-
-    return true;
-}
-
-void SVGRenderSupport::finishRenderSVGContent(RenderObject* object, PaintInfo& paintInfo, GraphicsContext* savedContext)
-{
-#if !ENABLE(FILTERS)
-    UNUSED_PARAM(savedContext);
-#endif
-
-    ASSERT(object);
-
-    const RenderStyle* style = object->style();
-    ASSERT(style);
-
-    const SVGRenderStyle* svgStyle = style->svgStyle();
-    ASSERT(svgStyle);
-
-#if ENABLE(FILTERS)
-    SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(object);
-    if (resources) {
-        if (RenderSVGResourceFilter* filter = resources->filter()) {
-            filter->postApplyResource(static_cast<RenderSVGShape*>(object), paintInfo.context, ApplyToDefaultMode, 0, 0);
-            paintInfo.context = savedContext;
-        }
-    }
-#endif
-
-    if (style->opacity() < 1 && !isRenderingMaskImage(object))
-        paintInfo.context->endTransparencyLayer();
-
-    if (svgStyle->shadow())
-        paintInfo.context->endTransparencyLayer();
-}
-
 void SVGRenderSupport::computeContainerBoundingBoxes(const RenderObject* container, FloatRect& objectBoundingBox, FloatRect& strokeBoundingBox, FloatRect& repaintBoundingBox)
 {
     bool isFirstChild = true;
diff --git a/Source/WebCore/rendering/svg/SVGRenderSupport.h b/Source/WebCore/rendering/svg/SVGRenderSupport.h
index c7b2fdcbf..51c9d1bc0 100644
--- a/Source/WebCore/rendering/svg/SVGRenderSupport.h
+++ b/Source/WebCore/rendering/svg/SVGRenderSupport.h
@@ -42,10 +42,6 @@ class TransformState;
 // SVGRendererSupport is a helper class sharing code between all SVG renderers.
 class SVGRenderSupport {
 public:
-    // Used by all SVG renderers who apply clip/filter/etc. resources to the renderer content
-    static bool prepareToRenderSVGContent(RenderObject*, PaintInfo&);
-    static void finishRenderSVGContent(RenderObject*, PaintInfo&, GraphicsContext* savedContext);
-
     // Shares child layouting code between RenderSVGRoot/RenderSVG(Hidden)Container
     static void layoutChildren(RenderObject*, bool selfNeedsLayout);
 
diff --git a/Source/WebCore/rendering/svg/SVGRenderingContext.cpp b/Source/WebCore/rendering/svg/SVGRenderingContext.cpp
new file mode 100644
index 000000000..0f13dcf3a
--- /dev/null
+++ b/Source/WebCore/rendering/svg/SVGRenderingContext.cpp
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2007, 2008 Rob Buis <buis@kde.org>
+ * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Google, Inc.  All rights reserved.
+ * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGRenderingContext.h"
+
+#include "Frame.h"
+#include "FrameView.h"
+#include "RenderSVGResource.h"
+#include "RenderSVGResourceClipper.h"
+#include "RenderSVGResourceFilter.h"
+#include "RenderSVGResourceMasker.h"
+#include "SVGImageBufferTools.h"
+#include "SVGResources.h"
+#include "SVGResourcesCache.h"
+
+namespace WebCore {
+
+static inline bool isRenderingMaskImage(RenderObject* object)
+{
+    if (object->frame() && object->frame()->view())
+        return object->frame()->view()->paintBehavior() & PaintBehaviorRenderingSVGMask;
+    return false;
+}
+
+SVGRenderingContext::~SVGRenderingContext()
+{
+    // Fast path if we don't need to restore anything.
+    if (!(m_renderingFlags & ActionsNeeded))
+        return;
+
+    ASSERT(m_object && m_paintInfo);
+
+#if ENABLE(FILTERS)
+    if (m_renderingFlags & EndFilterLayer) {
+        ASSERT(m_filter);
+        m_filter->postApplyResource(static_cast<RenderSVGShape*>(m_object), m_paintInfo->context, ApplyToDefaultMode, 0, 0);
+        m_paintInfo->context = m_savedContext;
+    }
+#endif
+
+    if (m_renderingFlags & EndOpacityLayer)
+        m_paintInfo->context->endTransparencyLayer();
+
+    if (m_renderingFlags & EndShadowLayer)
+        m_paintInfo->context->endTransparencyLayer();
+
+    if (m_renderingFlags & RestoreGraphicsContext)
+        m_paintInfo->context->restore();
+}
+
+void SVGRenderingContext::prepareToRenderSVGContent(RenderObject* object, PaintInfo& paintInfo, NeedsGraphicsContextSave needsGraphicsContextSave)
+{
+    ASSERT(object);
+
+#ifndef NDEBUG
+    // This function must not be called twice!
+    ASSERT(!(m_renderingFlags & PrepareToRenderSVGContentWasCalled));
+    m_renderingFlags |= PrepareToRenderSVGContentWasCalled;
+#endif
+
+    m_object = object;
+    m_paintInfo = &paintInfo;
+#if ENABLE(FILTERS)
+    m_filter = 0;
+#endif
+
+    // We need to save / restore the context even if the initialization failed.
+    if (needsGraphicsContextSave == SaveGraphicsContext) {
+        m_paintInfo->context->save();
+        m_renderingFlags |= RestoreGraphicsContext;
+    }
+
+    RenderStyle* style = m_object->style();
+    ASSERT(style);
+
+    const SVGRenderStyle* svgStyle = style->svgStyle();
+    ASSERT(svgStyle);
+
+    // Setup transparency layers before setting up SVG resources!
+    bool isRenderingMask = isRenderingMaskImage(m_object);
+    float opacity = isRenderingMask ? 1 : style->opacity();
+    const ShadowData* shadow = svgStyle->shadow();
+    if (opacity < 1 || shadow) {
+        FloatRect repaintRect = m_object->repaintRectInLocalCoordinates();
+
+        if (opacity < 1) {
+            m_paintInfo->context->clip(repaintRect);
+            m_paintInfo->context->beginTransparencyLayer(opacity);
+            m_renderingFlags |= EndOpacityLayer;
+        }
+
+        if (shadow) {
+            m_paintInfo->context->clip(repaintRect);
+            m_paintInfo->context->setShadow(IntSize(roundToInt(shadow->x()), roundToInt(shadow->y())), shadow->blur(), shadow->color(), style->colorSpace());
+            m_paintInfo->context->beginTransparencyLayer(1);
+            m_renderingFlags |= EndShadowLayer;
+        }
+    }
+
+    SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(m_object);
+    if (!resources) {
+#if ENABLE(FILTERS)
+        if (svgStyle->hasFilter())
+            return;
+#endif
+        m_renderingFlags |= RenderingPrepared;
+        return;
+    }
+
+    if (!isRenderingMask) {
+        if (RenderSVGResourceMasker* masker = resources->masker()) {
+            if (!masker->applyResource(m_object, style, m_paintInfo->context, ApplyToDefaultMode))
+                return;
+        }
+    }
+
+    if (RenderSVGResourceClipper* clipper = resources->clipper()) {
+        if (!clipper->applyResource(m_object, style, m_paintInfo->context, ApplyToDefaultMode))
+            return;
+    }
+
+#if ENABLE(FILTERS)
+    if (!isRenderingMask) {
+        m_filter = resources->filter();
+        if (m_filter) {
+            m_savedContext = m_paintInfo->context;
+            // Return with false here may mean that we don't need to draw the content
+            // (because it was either drawn before or empty) but we still need to apply the filter.
+            m_renderingFlags |= EndFilterLayer;
+            if (!m_filter->applyResource(m_object, style, m_paintInfo->context, ApplyToDefaultMode))
+                return;
+        }
+    }
+#endif
+
+    m_renderingFlags |= RenderingPrepared;
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/rendering/svg/SVGRenderingContext.h b/Source/WebCore/rendering/svg/SVGRenderingContext.h
new file mode 100644
index 000000000..1dc3d6220
--- /dev/null
+++ b/Source/WebCore/rendering/svg/SVGRenderingContext.h
@@ -0,0 +1,105 @@
+/**
+ * Copyright (C) 2007 Rob Buis <buis@kde.org>
+ * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Google, Inc.  All rights reserved.
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ * Copyright (C) 2012 Zoltan Herczeg <zherczeg@webkit.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SVGRenderingContext_h
+#define SVGRenderingContext_h
+
+#if ENABLE(SVG)
+#include "ImageBuffer.h"
+#include "LayoutTypes.h"
+#include "PaintInfo.h"
+
+namespace WebCore {
+
+class AffineTransform;
+class RenderObject;
+class FloatRect;
+class RenderSVGResourceFilter;
+
+// SVGRenderingContext 
+class SVGRenderingContext {
+public:
+    enum NeedsGraphicsContextSave {
+        SaveGraphicsContext,
+        DontSaveGraphicsContext,
+    };
+
+    // Does not start rendering.
+    SVGRenderingContext()
+        : m_renderingFlags(0)
+        , m_object(0)
+        , m_paintInfo(0)
+        , m_savedContext(0)
+#if ENABLE(FILTERS)
+        , m_filter(0)
+#endif
+    {
+    }
+
+    SVGRenderingContext(RenderObject* object, PaintInfo& paintinfo, NeedsGraphicsContextSave needsGraphicsContextSave = DontSaveGraphicsContext)
+        : m_renderingFlags(0)
+        , m_object(0)
+        , m_paintInfo(0)
+        , m_savedContext(0)
+#if ENABLE(FILTERS)
+        , m_filter(0)
+#endif
+    {
+        prepareToRenderSVGContent(object, paintinfo, needsGraphicsContextSave);
+    }
+
+    // Automatically finishes context rendering.
+    ~SVGRenderingContext();
+
+    // Used by all SVG renderers who apply clip/filter/etc. resources to the renderer content.
+    void prepareToRenderSVGContent(RenderObject*, PaintInfo&, NeedsGraphicsContextSave = DontSaveGraphicsContext);
+    bool isRenderingPrepared() const { return m_renderingFlags & RenderingPrepared; }
+
+private:
+    // To properly revert partially successful initializtions in the destructor, we record all successful steps.
+    enum RenderingFlags {
+        RenderingPrepared = 1,
+        RestoreGraphicsContext = 1 << 1,
+        EndOpacityLayer = 1 << 2,
+        EndShadowLayer = 1 << 3,
+        EndFilterLayer = 1 << 4,
+        PrepareToRenderSVGContentWasCalled = 1 << 5
+    };
+
+    // List of those flags which require actions during the destructor.
+    const static int ActionsNeeded = RestoreGraphicsContext | EndOpacityLayer | EndShadowLayer | EndFilterLayer;
+
+    int m_renderingFlags;
+    RenderObject* m_object;
+    PaintInfo* m_paintInfo;
+    GraphicsContext* m_savedContext;
+#if ENABLE(FILTERS)
+    RenderSVGResourceFilter* m_filter;
+#endif
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif // SVGRenderingContext_h
diff --git a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
index ae495ec94..57146c90c 100644
--- a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
@@ -31,7 +31,7 @@
 #include "SVGInlineFlowBox.h"
 #include "SVGInlineTextBox.h"
 #include "SVGNames.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGTextPositioningElement.h"
 
 namespace WebCore {
@@ -57,18 +57,15 @@ void SVGRootInlineBox::paint(PaintInfo& paintInfo, const LayoutPoint&, LayoutUni
         }
     }
 
-    GraphicsContextStateSaver stateSaver(*childPaintInfo.context);
-
-    if (SVGRenderSupport::prepareToRenderSVGContent(boxRenderer, childPaintInfo)) {
+    SVGRenderingContext renderingContext(boxRenderer, paintInfo, SVGRenderingContext::SaveGraphicsContext);
+    if (renderingContext.isRenderingPrepared()) {
         for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
             if (child->isSVGInlineTextBox())
                 SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer(toRenderSVGInlineText(static_cast<SVGInlineTextBox*>(child)->textRenderer()));
 
-            child->paint(childPaintInfo, LayoutPoint(), 0, 0);
+            child->paint(paintInfo, LayoutPoint(), 0, 0);
         }
     }
-
-    SVGRenderSupport::finishRenderSVGContent(boxRenderer, childPaintInfo, paintInfo.context);
 }
 
 void SVGRootInlineBox::computePerCharacterLayoutInformation()
diff --git a/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp b/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
deleted file mode 100644
index b1aa9a288..000000000
--- a/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "SVGShadowTreeElements.h"
-
-#include "CSSStyleSelector.h"
-#include "Document.h"
-#include "FloatSize.h"
-#include "RenderObject.h"
-#include "SVGNames.h"
-#include "SVGUseElement.h"
-
-namespace WebCore {
-
-// SVGShadowTreeContainerElement
-
-SVGShadowTreeContainerElement::SVGShadowTreeContainerElement(Document* document, ConstructionType constructionType)
-    : SVGGElement(SVGNames::gTag, document, constructionType)
-    , m_containerOffsetChanged(false)
-{
-}
-
-PassRefPtr<SVGShadowTreeContainerElement> SVGShadowTreeContainerElement::create(Document* document)
-{
-    return adoptRef(new SVGShadowTreeContainerElement(document));
-}
-
-void SVGShadowTreeContainerElement::setContainerOffset(const SVGLength& x, const SVGLength& y)
-{
-    m_containerOffsetChanged = true;
-    m_xOffset = x;
-    m_yOffset = y;
-}
-
-FloatSize SVGShadowTreeContainerElement::containerTranslation() const
-{
-    SVGLengthContext lengthContext(this);
-    return FloatSize(m_xOffset.value(lengthContext), m_yOffset.value(lengthContext));
-}
-
-PassRefPtr<Element> SVGShadowTreeContainerElement::cloneElementWithoutAttributesAndChildren()
-{
-    return adoptRef(new SVGShadowTreeContainerElement(document()));
-}
-// SVGShadowTreeRootElement
-
-inline SVGShadowTreeRootElement::SVGShadowTreeRootElement(Document* document, SVGUseElement* host)
-    : SVGShadowTreeContainerElement(document, CreateSVGShadowRoot)
-{
-    setParent(host);
-    setInDocument();
-}
-
-PassRefPtr<SVGShadowTreeRootElement> SVGShadowTreeRootElement::create(Document* document, SVGUseElement* host)
-{
-    return adoptRef(new SVGShadowTreeRootElement(document, host));
-}
-
-void SVGShadowTreeRootElement::attachElement(PassRefPtr<RenderStyle> style, RenderArena* arena)
-{
-    ASSERT(svgShadowHost());
-
-    // Create the renderer with the specified style
-    RenderObject* renderer = createRenderer(arena, style.get());
-    if (renderer) {
-        setRenderer(renderer);
-        renderer->setStyle(style);
-    }
-
-    // Set these explicitly since this normally happens during an attach()
-    setAttached();
-
-    // Add the renderer to the render tree
-    if (renderer)
-        svgShadowHost()->renderer()->addChild(renderer);
-}
-
-void SVGShadowTreeRootElement::clearSVGShadowHost()
-{
-    setParent(0);
-}
-
-PassRefPtr<RenderStyle> SVGShadowTreeContainerElement::customStyleForRenderer()
-{
-    return document()->styleSelector()->styleForElement(this, 0, true/*allowSharing*/);
-}
-
-}
-
-#endif
diff --git a/Source/WebCore/rendering/svg/SVGShadowTreeElements.h b/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
deleted file mode 100644
index 5057150c8..000000000
--- a/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef SVGShadowTreeElements_h
-#define SVGShadowTreeElements_h
-
-#if ENABLE(SVG)
-#include "SVGGElement.h"
-#include "SVGLength.h"
-
-namespace WebCore {
-
-class FloatSize;
-class SVGUseElement;
-
-class SVGShadowTreeContainerElement : public SVGGElement {
-public:
-    static PassRefPtr<SVGShadowTreeContainerElement> create(Document*);
-
-    FloatSize containerTranslation() const;
-    void setContainerOffset(const SVGLength& x, const SVGLength& y);
-
-    bool containerOffsetChanged() const { return m_containerOffsetChanged; }
-    void setContainerOffsetChanged(bool containerOffsetChanged) { m_containerOffsetChanged = containerOffsetChanged; }
-
-    virtual PassRefPtr<RenderStyle> customStyleForRenderer();
-
-protected:
-    SVGShadowTreeContainerElement(Document*, ConstructionType = CreateSVGElement);
-
-private:
-    virtual PassRefPtr<Element> cloneElementWithoutAttributesAndChildren();
-    virtual bool isShadowTreeContainerElement() const { return true; }
-
-    SVGLength m_xOffset;
-    SVGLength m_yOffset;
-    bool m_containerOffsetChanged;
-};
-
-class SVGShadowTreeRootElement : public SVGShadowTreeContainerElement {
-public:
-    static PassRefPtr<SVGShadowTreeRootElement> create(Document*, SVGUseElement* host);
-
-    void attachElement(PassRefPtr<RenderStyle>, RenderArena*);
-    void clearSVGShadowHost();
-
-private:
-    SVGShadowTreeRootElement(Document*, SVGUseElement* host);
-};
-
-}
-
-#endif
-#endif
diff --git a/Source/WebCore/rendering/svg/SVGTextMetrics.cpp b/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
index 5174e6368..8d155d8f4 100644
--- a/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
@@ -75,7 +75,7 @@ TextRun SVGTextMetrics::constructTextRun(RenderSVGInlineText* text, const UChar*
                 , 0 /* padding, only relevant for justified text, not relevant for SVG */
                 , TextRun::AllowTrailingExpansion
                 , style->direction()
-                , style->unicodeBidi() == Override /* directionalOverride */);
+                , isOverride(style->unicodeBidi()) /* directionalOverride */);
 
     if (textRunNeedsRenderingContext(style->font()))
         run.setRenderingContext(SVGTextRunRenderingContext::create(text));
diff --git a/Source/WebCore/svg/DOMWindowSVG.idl b/Source/WebCore/svg/DOMWindowSVG.idl
deleted file mode 100644
index cc907136b..000000000
--- a/Source/WebCore/svg/DOMWindowSVG.idl
+++ /dev/null
@@ -1,187 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    // FIXME: Most of this could/should be generated from make_names.pl/SVGNames.in
-    // to reduce the chance that we forget a constructor when adding a new element.
-    interface [
-        Conditional=SVG,
-        Supplemental=DOMWindow
-    ] DOMWindowSVG {
-
-        attribute SVGZoomEventConstructor SVGZoomEvent;
-
-        // Expose all implemented SVG 1.1 interfaces, excluding the SVG MI interfaces:
-        // SVGAnimatedPathData, SVGAnimatedPoints, SVGExternalResourcesRequired,
-        // SVGFilterPrimitiveStandardAttributes, SVGFitToViewBox, SVGLangSpace, SVGLocatable
-        // SVGStylable, SVGTests, SVGTransformable, SVGURIReference, SVGZoomAndPan
-        attribute SVGAElementConstructor SVGAElement;
-        attribute SVGAngleConstructor SVGAngle;
-        attribute SVGAnimatedAngleConstructor SVGAnimatedAngle;
-        attribute SVGAnimatedBooleanConstructor SVGAnimatedBoolean;
-        attribute SVGAnimatedEnumerationConstructor SVGAnimatedEnumeration;
-        attribute SVGAnimatedIntegerConstructor SVGAnimatedInteger;
-        attribute SVGAnimatedLengthConstructor SVGAnimatedLength;
-        attribute SVGAnimatedLengthListConstructor SVGAnimatedLengthList;
-        attribute SVGAnimatedNumberConstructor SVGAnimatedNumber;
-        attribute SVGAnimatedNumberListConstructor SVGAnimatedNumberList;
-        attribute SVGAnimatedPreserveAspectRatioConstructor SVGAnimatedPreserveAspectRatio;
-        attribute SVGAnimatedRectConstructor SVGAnimatedRect;
-        attribute SVGAnimatedStringConstructor SVGAnimatedString;
-        attribute SVGAnimatedTransformListConstructor SVGAnimatedTransformList;
-        attribute SVGCircleElementConstructor SVGCircleElement;
-        attribute SVGClipPathElementConstructor SVGClipPathElement;
-        attribute SVGColorConstructor SVGColor;
-        attribute SVGCursorElementConstructor SVGCursorElement;
-//      attribute SVGCSSRuleConstructor SVGCSSRule;
-        attribute SVGDefsElementConstructor SVGDefsElement;
-        attribute SVGDescElementConstructor SVGDescElement;
-        attribute SVGDocumentConstructor SVGDocument;
-        attribute SVGElementConstructor SVGElement;
-        attribute SVGElementInstanceConstructor SVGElementInstance;
-        attribute SVGElementInstanceListConstructor SVGElementInstanceList;
-        attribute SVGEllipseElementConstructor SVGEllipseElement;
-        attribute SVGForeignObjectElementConstructor SVGForeignObjectElement;
-        attribute SVGExceptionConstructor SVGException;
-        attribute SVGGElementConstructor SVGGElement;
-        attribute SVGGradientElementConstructor SVGGradientElement;
-        attribute SVGImageElementConstructor SVGImageElement;
-        attribute SVGLengthConstructor SVGLength;
-        attribute SVGLengthListConstructor SVGLengthList;
-        attribute SVGLinearGradientElementConstructor SVGLinearGradientElement;
-        attribute SVGLineElementConstructor SVGLineElement;
-        attribute SVGMarkerElementConstructor SVGMarkerElement;
-        attribute SVGMaskElementConstructor SVGMaskElement;
-        attribute SVGMatrixConstructor SVGMatrix;
-        attribute SVGMetadataElementConstructor SVGMetadataElement;
-        attribute SVGNumberConstructor SVGNumber;
-        attribute SVGNumberListConstructor SVGNumberList;
-        attribute SVGPaintConstructor SVGPaint;
-        attribute SVGPathElementConstructor SVGPathElement;
-        attribute SVGPathSegConstructor SVGPathSeg;
-        attribute SVGPathSegArcAbsConstructor SVGPathSegArcAbs;
-        attribute SVGPathSegArcRelConstructor SVGPathSegArcRel;
-        attribute SVGPathSegClosePathConstructor SVGPathSegClosePath;
-        attribute SVGPathSegCurvetoCubicAbsConstructor SVGPathSegCurvetoCubicAbs;
-        attribute SVGPathSegCurvetoCubicRelConstructor SVGPathSegCurvetoCubicRel;
-        attribute SVGPathSegCurvetoCubicSmoothAbsConstructor SVGPathSegCurvetoCubicSmoothAbs;
-        attribute SVGPathSegCurvetoCubicSmoothRelConstructor SVGPathSegCurvetoCubicSmoothRel;
-        attribute SVGPathSegCurvetoQuadraticAbsConstructor SVGPathSegCurvetoQuadraticAbs;
-        attribute SVGPathSegCurvetoQuadraticRelConstructor SVGPathSegCurvetoQuadraticRel;
-        attribute SVGPathSegCurvetoQuadraticSmoothAbsConstructor SVGPathSegCurvetoQuadraticSmoothAbs;
-        attribute SVGPathSegCurvetoQuadraticSmoothRelConstructor SVGPathSegCurvetoQuadraticSmoothRel;
-        attribute SVGPathSegLinetoAbsConstructor SVGPathSegLinetoAbs;
-        attribute SVGPathSegLinetoHorizontalAbsConstructor SVGPathSegLinetoHorizontalAbs;
-        attribute SVGPathSegLinetoHorizontalRelConstructor SVGPathSegLinetoHorizontalRel;
-        attribute SVGPathSegLinetoRelConstructor SVGPathSegLinetoRel;
-        attribute SVGPathSegLinetoVerticalAbsConstructor SVGPathSegLinetoVerticalAbs;
-        attribute SVGPathSegLinetoVerticalRelConstructor SVGPathSegLinetoVerticalRel;
-        attribute SVGPathSegListConstructor SVGPathSegList;
-        attribute SVGPathSegMovetoAbsConstructor SVGPathSegMovetoAbs;
-        attribute SVGPathSegMovetoRelConstructor SVGPathSegMovetoRel;
-        attribute SVGPatternElementConstructor SVGPatternElement;
-        attribute SVGPointConstructor SVGPoint;
-        attribute SVGPointListConstructor SVGPointList;
-        attribute SVGPolygonElementConstructor SVGPolygonElement;
-        attribute SVGPolylineElementConstructor SVGPolylineElement;
-        attribute SVGPreserveAspectRatioConstructor SVGPreserveAspectRatio;
-        attribute SVGRadialGradientElementConstructor SVGRadialGradientElement;
-        attribute SVGRectConstructor SVGRect;
-        attribute SVGRectElementConstructor SVGRectElement;
-        attribute SVGRenderingIntentConstructor SVGRenderingIntent;
-        attribute SVGScriptElementConstructor SVGScriptElement;
-        attribute SVGStopElementConstructor SVGStopElement;
-        attribute SVGStringListConstructor SVGStringList;
-        attribute SVGStyleElementConstructor SVGStyleElement;
-        attribute SVGSVGElementConstructor SVGSVGElement;
-        attribute SVGSwitchElementConstructor SVGSwitchElement;
-        attribute SVGSymbolElementConstructor SVGSymbolElement;
-        attribute SVGTextContentElementConstructor SVGTextContentElement;
-        attribute SVGTextElementConstructor SVGTextElement;
-        attribute SVGTextPathElementConstructor SVGTextPathElement;
-        attribute SVGTextPositioningElementConstructor SVGTextPositioningElement;
-        attribute SVGTitleElementConstructor SVGTitleElement;
-        attribute SVGTransformConstructor SVGTransform;
-        attribute SVGTransformListConstructor SVGTransformList;
-        attribute SVGTRefElementConstructor SVGTRefElement;
-        attribute SVGTSpanElementConstructor SVGTSpanElement;
-        attribute SVGUnitTypesConstructor SVGUnitTypes;
-        attribute SVGUseElementConstructor SVGUseElement;
-        attribute SVGViewElementConstructor SVGViewElement;
-//      attribute SVGViewSpecConstructor SVGViewSpec;
-
-        attribute SVGAnimateColorElementConstructor SVGAnimateColorElement;
-        attribute SVGAnimateElementConstructor SVGAnimateElement;
-        attribute SVGAnimateMotionElementConstructor SVGAnimateMotionElement;
-        attribute SVGAnimateTransformElementConstructor SVGAnimateTransformElement;
-        attribute SVGMPathElementConstructor SVGMPathElement;
-        attribute SVGSetElementConstructor SVGSetElement;
-
-#if defined(ENABLE_SVG_FONTS) && ENABLE_SVG_FONTS
-        attribute SVGAltGlyphDefElementConstructor SVGAltGlyphDefElement;
-        attribute SVGAltGlyphElementConstructor SVGAltGlyphElement;
-        attribute SVGAltGlyphItemElementConstructor SVGAltGlyphItemElement;
-//      attribute SVGDefinitionSrcElementConstructor SVGDefinitionSrcElement;
-        attribute SVGFontElementConstructor SVGFontElement;
-        attribute SVGFontFaceElementConstructor SVGFontFaceElement;
-        attribute SVGFontFaceFormatElementConstructor SVGFontFaceFormatElement;
-        attribute SVGFontFaceNameElementConstructor SVGFontFaceNameElement;
-        attribute SVGFontFaceSrcElementConstructor SVGFontFaceSrcElement;
-        attribute SVGFontFaceUriElementConstructor SVGFontFaceUriElement;
-        attribute SVGGlyphElementConstructor SVGGlyphElement;
-        attribute SVGGlyphRefElementConstructor SVGGlyphRefElement;
-        attribute SVGHKernElementConstructor SVGHKernElement;
-        attribute SVGMissingGlyphElementConstructor SVGMissingGlyphElement;
-        attribute SVGVKernElementConstructor SVGVKernElement;
-#endif
-
-#if defined(ENABLE_FILTERS) && ENABLE_FILTERS
-        attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
-        attribute SVGFEBlendElementConstructor SVGFEBlendElement;
-        attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
-        attribute SVGFEComponentTransferElementConstructor SVGFEComponentTransferElement;
-        attribute SVGFECompositeElementConstructor SVGFECompositeElement;
-        attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
-        attribute SVGFEDiffuseLightingElementConstructor SVGFEDiffuseLightingElement;
-        attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
-        attribute SVGFEDistantLightElementConstructor SVGFEDistantLightElement;
-        attribute SVGFEDropShadowElementConstructor SVGFEDropShadowElement;
-        attribute SVGFEFloodElementConstructor SVGFEFloodElement;
-        attribute SVGFEFuncAElementConstructor SVGFEFuncAElement;
-        attribute SVGFEFuncBElementConstructor SVGFEFuncBElement;
-        attribute SVGFEFuncGElementConstructor SVGFEFuncGElement;
-        attribute SVGFEFuncRElementConstructor SVGFEFuncRElement;
-        attribute SVGFEGaussianBlurElementConstructor SVGFEGaussianBlurElement;
-        attribute SVGFEImageElementConstructor SVGFEImageElement;
-        attribute SVGFEMergeElementConstructor SVGFEMergeElement;
-        attribute SVGFEMergeNodeElementConstructor SVGFEMergeNodeElement;
-        attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
-        attribute SVGFEOffsetElementConstructor SVGFEOffsetElement;
-        attribute SVGFEPointLightElementConstructor SVGFEPointLightElement;
-        attribute SVGFESpecularLightingElementConstructor SVGFESpecularLightingElement;
-        attribute SVGFESpotLightElementConstructor SVGFESpotLightElement;
-        attribute SVGFETileElementConstructor SVGFETileElement;
-        attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
-        attribute SVGFilterElementConstructor SVGFilterElement;
-#endif
-
-    };
-
-}
diff --git a/Source/WebCore/svg/SVGAElement.cpp b/Source/WebCore/svg/SVGAElement.cpp
index 7ec617ae0..f54906351 100644
--- a/Source/WebCore/svg/SVGAElement.cpp
+++ b/Source/WebCore/svg/SVGAElement.cpp
@@ -40,6 +40,7 @@
 #include "NodeRenderingContext.h"
 #include "PlatformMouseEvent.h"
 #include "RenderSVGInline.h"
+#include "RenderSVGText.h"
 #include "RenderSVGTransformableContainer.h"
 #include "ResourceRequest.h"
 #include "SVGElementInstance.h"
@@ -144,7 +145,7 @@ void SVGAElement::svgAttributeChanged(const QualifiedName& attrName)
 
 RenderObject* SVGAElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    if (static_cast<SVGElement*>(parentNode())->isTextContent())
+    if (parentNode() && parentNode()->isSVGElement() && static_cast<SVGElement*>(parentNode())->isTextContent())
         return new (arena) RenderSVGInline(this);
 
     return new (arena) RenderSVGTransformableContainer(this);
@@ -237,6 +238,19 @@ bool SVGAElement::childShouldCreateRenderer(const NodeRenderingContext& childCon
     return SVGElement::childShouldCreateRenderer(childContext);
 }
 
+void SVGAElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+    SVGStyledTransformableElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+
+    if (changedByParser || !renderer())
+        return;
+
+    // Invalidate the TextPosition cache in SVGTextLayoutAttributesBuilder as it may now point
+    // to no-longer existing SVGTextPositioningElements and thus needs to be rebuilt.
+    if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(renderer()))
+        textRenderer->textDOMChanged();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGAElement.h b/Source/WebCore/svg/SVGAElement.h
index e3b8f2802..72afdec12 100644
--- a/Source/WebCore/svg/SVGAElement.h
+++ b/Source/WebCore/svg/SVGAElement.h
@@ -40,6 +40,9 @@ class SVGAElement : public SVGStyledTransformableElement,
 public:
     static PassRefPtr<SVGAElement> create(const QualifiedName&, Document*);
 
+protected:
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0) OVERRIDE;
+
 private:
     SVGAElement(const QualifiedName&, Document*);
 
diff --git a/Source/WebCore/svg/SVGAnimateElement.cpp b/Source/WebCore/svg/SVGAnimateElement.cpp
index 13f7cf96b..cacf488e0 100644
--- a/Source/WebCore/svg/SVGAnimateElement.cpp
+++ b/Source/WebCore/svg/SVGAnimateElement.cpp
@@ -41,6 +41,7 @@ namespace WebCore {
 SVGAnimateElement::SVGAnimateElement(const QualifiedName& tagName, Document* document)
     : SVGAnimationElement(tagName, document)
     , m_animatedPropertyType(AnimatedString)
+    , m_aboutToStopAnimation(false)
     , m_fromPropertyValueType(RegularPropertyValue)
     , m_toPropertyValueType(RegularPropertyValue)
 {
@@ -230,6 +231,12 @@ void SVGAnimateElement::applyResultsToTarget()
     ASSERT(m_animatedPropertyType != AnimatedUnknown);
     ASSERT(m_animatedType);
 
+    if (m_aboutToStopAnimation) {
+        m_aboutToStopAnimation = false;
+        resetAnimationState(m_animatedType->valueAsString());
+        return;
+    }
+
     setTargetAttributeAnimatedValue(m_animatedType->valueAsString());
 }
     
@@ -260,5 +267,11 @@ SVGAnimatedTypeAnimator* SVGAnimateElement::ensureAnimator()
     return m_animator.get();
 }
 
+void SVGAnimateElement::endedActiveInterval()
+{
+    SVGAnimationElement::endedActiveInterval();
+    m_aboutToStopAnimation = true;
+}
+
 }
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGAnimateElement.h b/Source/WebCore/svg/SVGAnimateElement.h
index 69cb9a6ed..febc34d7c 100644
--- a/Source/WebCore/svg/SVGAnimateElement.h
+++ b/Source/WebCore/svg/SVGAnimateElement.h
@@ -65,6 +65,7 @@ protected:
     virtual void applyResultsToTarget();
     virtual float calculateDistance(const String& fromString, const String& toString);
 
+    virtual void endedActiveInterval();
     virtual void targetElementDidChange(SVGElement* targetElement) OVERRIDE;
 
 private:
@@ -72,6 +73,7 @@ private:
     
     virtual bool hasValidAttributeType();
     AnimatedPropertyType m_animatedPropertyType;
+    bool m_aboutToStopAnimation;
 
     AnimatedPropertyValueType m_fromPropertyValueType;
     AnimatedPropertyValueType m_toPropertyValueType;
diff --git a/Source/WebCore/svg/SVGAnimationElement.cpp b/Source/WebCore/svg/SVGAnimationElement.cpp
index 2659dd9df..dd6501b29 100644
--- a/Source/WebCore/svg/SVGAnimationElement.cpp
+++ b/Source/WebCore/svg/SVGAnimationElement.cpp
@@ -330,53 +330,90 @@ bool SVGAnimationElement::isTargetAttributeCSSProperty(SVGElement* targetElement
     return SVGStyledElement::isAnimatableCSSProperty(attributeName);
 }
 
-void SVGAnimationElement::setTargetAttributeAnimatedValue(const String& value)
+static inline void setTargetAttributeAnimatedCSSValue(SVGElement* targetElement, const QualifiedName& attributeName, const String& value)
 {
-    if (!hasValidAttributeType())
+    StylePropertySet* propertySet = targetElement->ensureAnimatedSMILStyleProperties();
+    if (value.isNull()) {
+        if (propertySet->removeProperty(cssPropertyID(attributeName.localName())))
+            targetElement->setNeedsStyleRecalc();
         return;
+    }
+
+    if (propertySet->setProperty(cssPropertyID(attributeName.localName()), value, false, 0))
+        targetElement->setNeedsStyleRecalc();
+}
+
+static inline void setTargetAttributeAnimatedXMLValue(SVGElement* targetElement, const QualifiedName& attributeName, const String& value)
+{
+    // FIXME: Detach animVal, if value.isNull() - once animVal support is enabled.
+    targetElement->setAttribute(attributeName, value);
+}
+
+void SVGAnimationElement::setTargetAttributeAnimatedValue(const String& value)
+{
     SVGElement* targetElement = this->targetElement();
-    QualifiedName attributeName = this->attributeName();
-    if (!targetElement || attributeName == anyQName() || value.isNull())
+    const QualifiedName& attributeName = this->attributeName();
+    ShouldApplyAnimation shouldApply = shouldApplyAnimation(targetElement, attributeName);
+    if (shouldApply == DontApplyAnimation)
         return;
 
-    // We don't want the instance tree to get rebuild. Instances are updated in the loop below.
     if (targetElement->isStyled())
         static_cast<SVGStyledElement*>(targetElement)->setInstanceUpdatesBlocked(true);
-        
-    bool attributeIsCSSProperty = isTargetAttributeCSSProperty(targetElement, attributeName);
-    // Stop animation, if attributeType is set to CSS by the user, but the attribute itself is not a CSS property.
-    if (!attributeIsCSSProperty && attributeType() == AttributeTypeCSS)
-        return;
 
-    ExceptionCode ec;
-    if (attributeIsCSSProperty) {
-        // FIXME: This should set the override style, not the inline style.
-        // Sadly override styles are not yet implemented.
-        targetElement->style()->setProperty(attributeName.localName(), value, "", ec);
-    } else {
-        // FIXME: This should set the 'presentation' value, not the actual 
-        // attribute value. Whatever that means in practice.
-        targetElement->setAttribute(attributeName, value);
-    }
-    
+    if (shouldApply == ApplyCSSAnimation)
+        setTargetAttributeAnimatedCSSValue(targetElement, attributeName, value);
+    else
+        setTargetAttributeAnimatedXMLValue(targetElement, attributeName, value);
+
     if (targetElement->isStyled())
         static_cast<SVGStyledElement*>(targetElement)->setInstanceUpdatesBlocked(false);
-    
-    // If the target element is used in an <use> instance tree, update that as well.
+
+    // If the target element has instances, update them as well, w/o requiring the <use> tree to be rebuilt.
     const HashSet<SVGElementInstance*>& instances = targetElement->instancesForElement();
     const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
     for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
         SVGElement* shadowTreeElement = (*it)->shadowTreeElement();
         if (!shadowTreeElement)
             continue;
-        if (attributeIsCSSProperty)
-            shadowTreeElement->style()->setProperty(attributeName.localName(), value, "", ec);
+
+        if (shouldApply == ApplyCSSAnimation)
+            setTargetAttributeAnimatedCSSValue(shadowTreeElement, attributeName, value);
         else
-            shadowTreeElement->setAttribute(attributeName, value);
-        (*it)->correspondingUseElement()->setNeedsStyleRecalc();
+            setTargetAttributeAnimatedXMLValue(shadowTreeElement, attributeName, value);
     }
 }
-    
+
+void SVGAnimationElement::resetAnimationState(const String& baseValue)
+{
+    // FIXME: This extra check will go away, once animVal is enabled.
+    SVGElement* targetElement = this->targetElement();
+    const QualifiedName& attributeName = this->attributeName();
+    ShouldApplyAnimation shouldApply = shouldApplyAnimation(targetElement, attributeName);
+    if (shouldApply == DontApplyAnimation)
+        return;
+
+    if (isFrozen() || shouldApply == ApplyXMLAnimation)
+        setTargetAttributeAnimatedValue(baseValue);
+    else // Only CSS animations support detaching previously animated properties so far, indicating by passing a null-string.
+        setTargetAttributeAnimatedValue(String());
+}
+
+SVGAnimationElement::ShouldApplyAnimation SVGAnimationElement::shouldApplyAnimation(SVGElement* targetElement, const QualifiedName& attributeName)
+{
+    if (!hasValidAttributeType() || !targetElement || attributeName == anyQName())
+        return DontApplyAnimation;
+
+    // Always animate CSS properties, using the ApplyCSSAnimation code path, regardless of the attributeType value.
+    if (isTargetAttributeCSSProperty(targetElement, attributeName))
+        return ApplyCSSAnimation;
+
+    // If attributeType="CSS" and attributeName doesn't point to a CSS property, ignore the animation.
+    if (attributeType() == AttributeTypeCSS)
+        return DontApplyAnimation;
+
+    return ApplyXMLAnimation;
+}
+
 void SVGAnimationElement::calculateKeyTimesForCalcModePaced()
 {
     ASSERT(calcMode() == CalcModePaced);
@@ -593,7 +630,7 @@ void SVGAnimationElement::startedActiveInterval()
     } else if (animationMode == PathAnimation)
         m_animationValid = calcMode == CalcModePaced || !fastHasAttribute(SVGNames::keyPointsAttr) || (m_keyTimes.size() > 1 && m_keyTimes.size() == m_keyPoints.size());
 }
-    
+
 void SVGAnimationElement::updateAnimation(float percent, unsigned repeat, SVGSMILElement* resultElement)
 {    
     if (!m_animationValid)
diff --git a/Source/WebCore/svg/SVGAnimationElement.h b/Source/WebCore/svg/SVGAnimationElement.h
index 495c1b244..73a331ab1 100644
--- a/Source/WebCore/svg/SVGAnimationElement.h
+++ b/Source/WebCore/svg/SVGAnimationElement.h
@@ -105,6 +105,8 @@ protected:
     virtual void startedActiveInterval();
     virtual void updateAnimation(float percent, unsigned repeat, SVGSMILElement* resultElement);
 
+    void resetAnimationState(const String& baseValue);
+
 private:
     virtual void attributeChanged(Attribute*) OVERRIDE;
 
@@ -122,6 +124,14 @@ private:
     float calculatePercentForFromTo(float percent) const;
     unsigned calculateKeyTimesIndex(float percent) const;
 
+    enum ShouldApplyAnimation {
+        DontApplyAnimation,
+        ApplyCSSAnimation,
+        ApplyXMLAnimation
+    };
+
+    ShouldApplyAnimation shouldApplyAnimation(SVGElement* targetElement, const QualifiedName& attributeName);
+
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGAnimationElement)
         DECLARE_ANIMATED_BOOLEAN(ExternalResourcesRequired, externalResourcesRequired)
     END_DECLARE_ANIMATED_PROPERTIES
diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
index 24adcf794..f0486a8a2 100644
--- a/Source/WebCore/svg/SVGElement.cpp
+++ b/Source/WebCore/svg/SVGElement.cpp
@@ -39,6 +39,7 @@
 #include "NodeRenderingContext.h"
 #include "RegisteredEventListener.h"
 #include "RenderObject.h"
+#include "ShadowRoot.h"
 #include "SVGCursorElement.h"
 #include "SVGDocumentExtensions.h"
 #include "SVGElementInstance.h"
@@ -77,6 +78,7 @@ SVGElement::~SVGElement()
         ASSERT(it != rareDataMap.end());
 
         SVGElementRareData* rareData = it->second;
+        rareData->destroyAnimatedSMILStyleProperties();
         if (SVGCursorElement* cursorElement = rareData->cursorElement())
             cursorElement->removeClient(this);
         if (CSSCursorImageValue* cursorImageValue = rareData->cursorImageValue())
@@ -109,6 +111,15 @@ SVGElementRareData* SVGElement::ensureRareSVGData()
 
 bool SVGElement::isOutermostSVGSVGElement() const
 {
+    if (!hasTagName(SVGNames::svgTag))
+        return false;
+
+    // If we're living in a shadow tree, we're a <svg> element that got created as replacement
+    // for a <symbol> element or a cloned <svg> element in the referenced tree. In that case
+    // we're always an inner <svg> element.
+    if (isInShadowTree())
+        return false;
+
     // Element may not be in the document, pretend we're outermost for viewport(), getCTM(), etc.
     if (!parentNode())
         return true;
@@ -331,13 +342,13 @@ bool SVGElement::haveLoadedRequiredResources()
     return true;
 }
 
-static bool hasLoadListener(Node* node)
+static bool hasLoadListener(Element* element)
 {
-    if (node->hasEventListeners(eventNames().loadEvent))
+    if (element->hasEventListeners(eventNames().loadEvent))
         return true;
 
-    for (node = node->parentNode(); node && node->isElementNode(); node = node->parentNode()) {
-        const EventListenerVector& entry = node->getEventListeners(eventNames().loadEvent);
+    for (element = element->parentOrHostElement(); element; element = element->parentOrHostElement()) {
+        const EventListenerVector& entry = element->getEventListeners(eventNames().loadEvent);
         for (size_t i = 0; i < entry.size(); ++i) {
             if (entry[i].useCapture)
                 return true;
@@ -351,9 +362,9 @@ void SVGElement::sendSVGLoadEventIfPossible(bool sendParentLoadEvents)
 {
     RefPtr<SVGElement> currentTarget = this;
     while (currentTarget && currentTarget->haveLoadedRequiredResources()) {
-        RefPtr<Node> parent;
+        RefPtr<Element> parent;
         if (sendParentLoadEvents)
-            parent = currentTarget->parentNode(); // save the next parent to dispatch too incase dispatching the event changes the tree
+            parent = currentTarget->parentOrHostElement(); // save the next parent to dispatch too incase dispatching the event changes the tree
         if (hasLoadListener(currentTarget.get()))
             currentTarget->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
         currentTarget = (parent && parent->isSVGElement()) ? static_pointer_cast<SVGElement>(parent) : RefPtr<SVGElement>();
@@ -404,7 +415,7 @@ void SVGElement::attributeChanged(Attribute* attr)
 
     // When an animated SVG property changes through SVG DOM, svgAttributeChanged() is called, not attributeChanged().
     // Next time someone tries to access the XML attributes, the synchronization code starts. During that synchronization
-    // SVGAnimatedPropertySynchronizer may call NamedNodeMap::removeAttribute(), which in turn calls attributeChanged().
+    // SVGAnimatedPropertySynchronizer may call ElementAttributeData::removeAttribute(), which in turn calls attributeChanged().
     // At this point we're not allowed to call svgAttributeChanged() again - it may lead to extra work being done, or crashes
     // see bug https://bugs.webkit.org/show_bug.cgi?id=40994.
     if (isSynchronizingSVGAttributes())
@@ -466,10 +477,28 @@ void SVGElement::synchronizeSystemLanguage(void* contextElement)
 
 PassRefPtr<RenderStyle> SVGElement::customStyleForRenderer()
 {
-    if (correspondingElement())
-        return document()->styleSelector()->styleForElement(correspondingElement(), parentNode() ? parentNode()->renderer()->style() : 0, false/*allowSharing*/);
+    if (!correspondingElement())
+        return document()->styleSelector()->styleForElement(static_cast<Element*>(this), 0, true);
+
+    RenderStyle* style = 0;
+    if (Element* parent = parentOrHostElement()) {
+        if (RenderObject* renderer = parent->renderer())
+            style = renderer->style();
+    }
+
+    return document()->styleSelector()->styleForElement(correspondingElement(), style, false /*allowSharing*/);
+}
+
+StylePropertySet* SVGElement::animatedSMILStyleProperties() const
+{
+    if (hasRareSVGData())
+        return rareSVGData()->animatedSMILStyleProperties();
+    return 0;
+}
 
-    return document()->styleSelector()->styleForElement(static_cast<Element*>(this), 0, true);
+StylePropertySet* SVGElement::ensureAnimatedSMILStyleProperties()
+{
+    return ensureRareSVGData()->ensureAnimatedSMILStyleProperties();
 }
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/svg/SVGElement.h b/Source/WebCore/svg/SVGElement.h
index 4735690b3..87b98351c 100644
--- a/Source/WebCore/svg/SVGElement.h
+++ b/Source/WebCore/svg/SVGElement.h
@@ -107,6 +107,9 @@ public:
     static bool isAnimatableAttribute(const QualifiedName&);
 #endif
 
+    StylePropertySet* animatedSMILStyleProperties() const;
+    StylePropertySet* ensureAnimatedSMILStyleProperties();
+
 protected:
     SVGElement(const QualifiedName&, Document*, ConstructionType = CreateSVGElement);
 
@@ -145,6 +148,12 @@ struct SVGAttributeHashTranslator {
     static bool equal(QualifiedName a, QualifiedName b) { return a.matches(b); }
 };
 
+inline SVGElement* toSVGElement(Element* element)
+{
+    ASSERT(!element || element->isSVGElement());
+    return static_cast<SVGElement*>(element);
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/svg/SVGElementInstance.cpp b/Source/WebCore/svg/SVGElementInstance.cpp
index d23c2cfeb..b41400d33 100644
--- a/Source/WebCore/svg/SVGElementInstance.cpp
+++ b/Source/WebCore/svg/SVGElementInstance.cpp
@@ -130,8 +130,7 @@ void SVGElementInstance::invalidateAllInstancesOfElement(SVGElement* element)
         }
     }
 
-    // Be sure to rebuild use trees, if needed
-    element->document()->updateLayoutIgnorePendingStylesheets();
+    element->document()->updateStyleIfNeeded();
 }
 
 const AtomicString& SVGElementInstance::interfaceName() const
diff --git a/Source/WebCore/svg/SVGElementRareData.h b/Source/WebCore/svg/SVGElementRareData.h
index 501966241..ceec01cc9 100644
--- a/Source/WebCore/svg/SVGElementRareData.h
+++ b/Source/WebCore/svg/SVGElementRareData.h
@@ -74,6 +74,21 @@ public:
     CSSCursorImageValue* cursorImageValue() const { return m_cursorImageValue; }
     void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
 
+    StylePropertySet* animatedSMILStyleProperties() const { return m_animatedSMILStyleProperties.get(); }
+    StylePropertySet* ensureAnimatedSMILStyleProperties()
+    {
+        if (!m_animatedSMILStyleProperties) {
+            m_animatedSMILStyleProperties = StylePropertySet::create();
+            m_animatedSMILStyleProperties->setStrictParsing(false);
+        }
+        return m_animatedSMILStyleProperties.get();
+    }
+
+    void destroyAnimatedSMILStyleProperties()
+    {
+        m_animatedSMILStyleProperties.clear();
+    }
+
 private:
     HashSet<SVGElementInstance*> m_elementInstances;
     SVGCursorElement* m_cursorElement;
@@ -81,6 +96,7 @@ private:
     SVGElement* m_correspondingElement;
     bool m_instancesUpdatesBlocked : 1;
     bool m_hasPendingResources : 1;
+    RefPtr<StylePropertySet> m_animatedSMILStyleProperties;
 };
 
 }
diff --git a/Source/WebCore/svg/SVGFontFaceElement.cpp b/Source/WebCore/svg/SVGFontFaceElement.cpp
index 98518de4d..93534e53b 100644
--- a/Source/WebCore/svg/SVGFontFaceElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceElement.cpp
@@ -298,8 +298,7 @@ void SVGFontFaceElement::rebuildFontFace()
 
     // Parse in-memory CSS rules
     CSSProperty srcProperty(CSSPropertySrc, list);
-    const CSSProperty* srcPropertyRef = &srcProperty;
-    m_fontFaceRule->declaration()->addParsedProperties(&srcPropertyRef, 1);
+    m_fontFaceRule->declaration()->addParsedProperties(&srcProperty, 1);
 
     if (describesParentFont) {    
         // Traverse parsed CSS values and associate CSSFontFaceSrcValue elements with ourselves.
diff --git a/Source/WebCore/svg/SVGGElement.cpp b/Source/WebCore/svg/SVGGElement.cpp
index 4f539f26f..13fa57181 100644
--- a/Source/WebCore/svg/SVGGElement.cpp
+++ b/Source/WebCore/svg/SVGGElement.cpp
@@ -110,7 +110,9 @@ RenderObject* SVGGElement::createRenderer(RenderArena* arena, RenderStyle* style
 
 bool SVGGElement::rendererIsNeeded(const NodeRenderingContext&)
 {
-    return parentNode() && parentNode()->isSVGElement(); 
+    // Unlike SVGStyledElement::rendererIsNeeded(), we still create renderers, even if
+    // display is set to 'none' - which is special to SVG <g> container elements.
+    return parentOrHostElement() && parentOrHostElement()->isSVGElement();
 }
 
 }
diff --git a/Source/WebCore/svg/SVGGElement.h b/Source/WebCore/svg/SVGGElement.h
index 6520fa6dd..851c6a7a1 100644
--- a/Source/WebCore/svg/SVGGElement.h
+++ b/Source/WebCore/svg/SVGGElement.h
@@ -37,8 +37,6 @@ class SVGGElement : public SVGStyledTransformableElement,
 public:
     static PassRefPtr<SVGGElement> create(const QualifiedName&, Document*);
 
-    virtual bool isShadowTreeContainerElement() const { return false; }
-
 protected:
     SVGGElement(const QualifiedName&, Document*, ConstructionType = CreateSVGElement);
 
diff --git a/Source/WebCore/svg/SVGImageElement.cpp b/Source/WebCore/svg/SVGImageElement.cpp
index 6f7fe9d1e..5a288fee6 100644
--- a/Source/WebCore/svg/SVGImageElement.cpp
+++ b/Source/WebCore/svg/SVGImageElement.cpp
@@ -91,11 +91,11 @@ bool SVGImageElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-bool SVGImageElement::isPresentationAttribute(Attribute* attr) const
+bool SVGImageElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == SVGNames::widthAttr || attr->name() == SVGNames::heightAttr)
+    if (name == SVGNames::widthAttr || name == SVGNames::heightAttr)
         return true;
-    return SVGStyledTransformableElement::isPresentationAttribute(attr);
+    return SVGStyledTransformableElement::isPresentationAttribute(name);
 }
 
 void SVGImageElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/svg/SVGImageElement.h b/Source/WebCore/svg/SVGImageElement.h
index fb1229e23..05be5cc90 100644
--- a/Source/WebCore/svg/SVGImageElement.h
+++ b/Source/WebCore/svg/SVGImageElement.h
@@ -50,7 +50,7 @@ private:
 
     bool isSupportedAttribute(const QualifiedName&);
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
diff --git a/Source/WebCore/svg/SVGLocatable.cpp b/Source/WebCore/svg/SVGLocatable.cpp
index b954ddad4..415f70c57 100644
--- a/Source/WebCore/svg/SVGLocatable.cpp
+++ b/Source/WebCore/svg/SVGLocatable.cpp
@@ -43,9 +43,9 @@ static bool isViewportElement(Node* node)
 SVGElement* SVGLocatable::nearestViewportElement(const SVGElement* element)
 {
     ASSERT(element);
-    for (ContainerNode* n = element->parentNode(); n; n = n->parentNode()) {
-        if (isViewportElement(n))
-            return static_cast<SVGElement*>(n);
+    for (Element* current = element->parentOrHostElement(); current; current = current->parentOrHostElement()) {
+        if (isViewportElement(current))
+            return static_cast<SVGElement*>(current);
     }
 
     return 0;
@@ -55,9 +55,9 @@ SVGElement* SVGLocatable::farthestViewportElement(const SVGElement* element)
 {
     ASSERT(element);
     SVGElement* farthest = 0;
-    for (ContainerNode* n = element->parentNode(); n; n = n->parentNode()) {
-        if (isViewportElement(n))
-            farthest = static_cast<SVGElement*>(n);
+    for (Element* current = element->parentOrHostElement(); current; current = current->parentOrHostElement()) {
+        if (isViewportElement(current))
+            farthest = static_cast<SVGElement*>(current);
     }
     return farthest;
 }
@@ -84,19 +84,16 @@ AffineTransform SVGLocatable::computeCTM(SVGElement* element, CTMScope mode, Sty
     AffineTransform ctm;
 
     SVGElement* stopAtElement = mode == NearestViewportScope ? nearestViewportElement(element) : 0;
+    for (Element* currentElement = element; currentElement; currentElement = currentElement->parentOrHostElement()) {
+        if (!currentElement->isSVGElement())
+            break;
 
-    Node* current = const_cast<SVGElement*>(element);
-    while (current && current->isSVGElement()) {
-        SVGElement* currentElement = static_cast<SVGElement*>(current);
-        if (currentElement->isStyled())
-            // note that this modifies the AffineTransform returned by localCoordinateSpaceTransform(mode) too.
+        if (static_cast<SVGElement*>(currentElement)->isStyled())
             ctm = static_cast<SVGStyledElement*>(currentElement)->localCoordinateSpaceTransform(mode).multiply(ctm);
 
         // For getCTM() computation, stop at the nearest viewport element
         if (currentElement == stopAtElement)
             break;
-
-        current = current->parentOrHostNode();
     }
 
     return ctm;
diff --git a/Source/WebCore/svg/SVGScriptElement.cpp b/Source/WebCore/svg/SVGScriptElement.cpp
index 39192e68a..8a4823999 100644
--- a/Source/WebCore/svg/SVGScriptElement.cpp
+++ b/Source/WebCore/svg/SVGScriptElement.cpp
@@ -144,8 +144,8 @@ void SVGScriptElement::insertedIntoDocument()
 
 void SVGScriptElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    ScriptElement::childrenChanged();
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    ScriptElement::childrenChanged();
 }
 
 bool SVGScriptElement::isURLAttribute(Attribute* attr) const
diff --git a/Source/WebCore/svg/SVGStyleElement.cpp b/Source/WebCore/svg/SVGStyleElement.cpp
index e32e93225..e00f66df2 100644
--- a/Source/WebCore/svg/SVGStyleElement.cpp
+++ b/Source/WebCore/svg/SVGStyleElement.cpp
@@ -148,8 +148,8 @@ void SVGStyleElement::removedFromDocument()
 
 void SVGStyleElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    StyleElement::childrenChanged(this);
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    StyleElement::childrenChanged(this);
 }
 
 }
diff --git a/Source/WebCore/svg/SVGStyledElement.cpp b/Source/WebCore/svg/SVGStyledElement.cpp
index dd159a099..a573b8dce 100644
--- a/Source/WebCore/svg/SVGStyledElement.cpp
+++ b/Source/WebCore/svg/SVGStyledElement.cpp
@@ -59,7 +59,10 @@ using namespace SVGNames;
 
 void mapAttributeToCSSProperty(HashMap<AtomicStringImpl*, int>* propertyNameToIdMap, const QualifiedName& attrName)
 {
+    // FIXME: when CSS supports "transform-origin" the special case for transform_originAttr can be removed.
     int propertyId = cssPropertyID(attrName.localName());
+    if (!propertyId && attrName == transform_originAttr)
+        propertyId = CSSPropertyWebkitTransformOrigin; // cssPropertyID("-webkit-transform-origin")
     ASSERT(propertyId > 0);
     propertyNameToIdMap->set(attrName.localName().impl(), propertyId);
 }
@@ -82,33 +85,26 @@ String SVGStyledElement::title() const
 {
     // According to spec, we should not return titles when hovering over root <svg> elements (those
     // <title> elements are the title of the document, not a tooltip) so we instantly return.
-    if (hasTagName(SVGNames::svgTag)) {
-        const SVGSVGElement* svg = static_cast<const SVGSVGElement*>(this);
-        if (svg->isOutermostSVGSVGElement())
-            return String();
-    }
-    
+    if (isOutermostSVGSVGElement())
+        return String();
+
     // Walk up the tree, to find out whether we're inside a <use> shadow tree, to find the right title.
-    Node* parent = const_cast<SVGStyledElement*>(this);
-    while (parent) {
-        if (!parent->isSVGShadowRoot()) {
-            parent = parent->parentNodeGuaranteedHostFree();
-            continue;
-        }
-        
-        // Get the <use> element.
-        Element* shadowParent = parent->svgShadowHost();
-        if (shadowParent && shadowParent->isSVGElement() && shadowParent->hasTagName(SVGNames::useTag)) {
-            SVGUseElement* useElement = static_cast<SVGUseElement*>(shadowParent);
+    if (isInShadowTree()) {
+        Element* shadowHostElement = treeScope()->rootNode()->shadowHost();
+        // At this time, SVG nodes are not allowed in non-<use> shadow trees, so any shadow root we do
+        // have should be a use. The assert and following test is here to catch future shadow DOM changes
+        // that do enable SVG in a shadow tree.
+        ASSERT(!shadowHostElement || shadowHostElement->hasTagName(SVGNames::useTag));
+        if (shadowHostElement && shadowHostElement->hasTagName(SVGNames::useTag)) {
+            SVGUseElement* useElement = static_cast<SVGUseElement*>(shadowHostElement);
+ 
             // If the <use> title is not empty we found the title to use.
             String useTitle(useElement->title());
-            if (useTitle.isEmpty())
-                break;
-            return useTitle;
+            if (!useTitle.isEmpty())
+               return useTitle;
         }
-        parent = parent->parentNode();
     }
-    
+
     // If we aren't an instance in a <use> or the <use> title was not found, then find the first
     // <title> child of this element.
     Element* titleElement = firstElementChild();
@@ -132,7 +128,7 @@ bool SVGStyledElement::rendererIsNeeded(const NodeRenderingContext& context)
     // Spec: SVG allows inclusion of elements from foreign namespaces anywhere
     // with the SVG content. In general, the SVG user agent will include the unknown
     // elements in the DOM but will otherwise ignore unknown elements. 
-    if (!parentNode() || parentNode()->isSVGElement())
+    if (!parentOrHostElement() || parentOrHostElement()->isSVGElement())
         return StyledElement::rendererIsNeeded(context);
 
     return false;
@@ -201,6 +197,7 @@ int SVGStyledElement::cssPropertyIdForSVGAttributeName(const QualifiedName& attr
         mapAttributeToCSSProperty(propertyNameToIdMap, text_anchorAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, text_decorationAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, text_renderingAttr);
+        mapAttributeToCSSProperty(propertyNameToIdMap, transform_originAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, unicode_bidiAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, vector_effectAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, visibilityAttr);
@@ -292,11 +289,11 @@ bool SVGStyledElement::isAnimatableCSSProperty(const QualifiedName& attrName)
     return cssPropertyToTypeMap().contains(attrName);
 }
 
-bool SVGStyledElement::isPresentationAttribute(Attribute* attr) const
+bool SVGStyledElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (SVGStyledElement::cssPropertyIdForSVGAttributeName(attr->name()) > 0)
+    if (SVGStyledElement::cssPropertyIdForSVGAttributeName(name) > 0)
         return true;
-    return SVGElement::isPresentationAttribute(attr);
+    return SVGElement::isPresentationAttribute(name);
 }
 
 void SVGStyledElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/svg/SVGStyledElement.h b/Source/WebCore/svg/SVGStyledElement.h
index 7a400641c..64830e852 100644
--- a/Source/WebCore/svg/SVGStyledElement.h
+++ b/Source/WebCore/svg/SVGStyledElement.h
@@ -66,7 +66,7 @@ protected:
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
diff --git a/Source/WebCore/svg/SVGTRefElement.cpp b/Source/WebCore/svg/SVGTRefElement.cpp
index 90b2d9985..82bc0e54d 100644
--- a/Source/WebCore/svg/SVGTRefElement.cpp
+++ b/Source/WebCore/svg/SVGTRefElement.cpp
@@ -32,7 +32,7 @@
 #include "RenderSVGInlineText.h"
 #include "RenderSVGResource.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SVGDocument.h"
 #include "SVGElementInstance.h"
 #include "SVGNames.h"
@@ -165,7 +165,7 @@ void SVGTRefElement::updateReferencedText()
         textContent = target->textContent();
 
     ASSERT(hasShadowRoot());
-    ShadowRoot* root = shadowRootList()->oldestShadowRoot();
+    ShadowRoot* root = shadowTree()->oldestShadowRoot();
     if (!root->firstChild())
         root->appendChild(SVGShadowText::create(document(), textContent), ASSERT_NO_EXCEPTION);
     else
@@ -181,7 +181,7 @@ void SVGTRefElement::detachTarget()
     ExceptionCode ignore = 0;
 
     ASSERT(hasShadowRoot());
-    Node* container = shadowRootList()->oldestShadowRoot()->firstChild();
+    Node* container = shadowTree()->oldestShadowRoot()->firstChild();
     if (container)
         container->setTextContent(emptyContent, ignore);
 
diff --git a/Source/WebCore/svg/SVGTextContentElement.cpp b/Source/WebCore/svg/SVGTextContentElement.cpp
index 1efedac93..585f7ae63 100644
--- a/Source/WebCore/svg/SVGTextContentElement.cpp
+++ b/Source/WebCore/svg/SVGTextContentElement.cpp
@@ -228,11 +228,11 @@ bool SVGTextContentElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-bool SVGTextContentElement::isPresentationAttribute(Attribute* attr) const
+bool SVGTextContentElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name().matches(XMLNames::spaceAttr))
+    if (name.matches(XMLNames::spaceAttr))
         return true;
-    return SVGStyledElement::isPresentationAttribute(attr);
+    return SVGStyledElement::isPresentationAttribute(name);
 }
 
 void SVGTextContentElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -329,7 +329,7 @@ void SVGTextContentElement::childrenChanged(bool changedByParser, Node* beforeCh
         return;
 
     // Invalidate the TextPosition cache in SVGTextLayoutAttributesBuilder as it may now point
-    // to no-longer existing SVGTextPositioningElements and thus needs to be rebuild.
+    // to no-longer existing SVGTextPositioningElements and thus needs to be rebuilt.
     if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(renderer()))
         textRenderer->textDOMChanged();
 }
diff --git a/Source/WebCore/svg/SVGTextContentElement.h b/Source/WebCore/svg/SVGTextContentElement.h
index 91ae378f8..d9e350fb1 100644
--- a/Source/WebCore/svg/SVGTextContentElement.h
+++ b/Source/WebCore/svg/SVGTextContentElement.h
@@ -104,7 +104,7 @@ protected:
 
     bool isSupportedAttribute(const QualifiedName&);
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index e342ee4ad..bb691aaf2 100644
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -34,7 +34,9 @@
 #include "NodeRenderStyle.h"
 #include "RegisteredEventListener.h"
 #include "RenderSVGResource.h"
-#include "RenderSVGShadowTreeRootContainer.h"
+#include "RenderSVGTransformableContainer.h"
+#include "ShadowRoot.h"
+#include "ShadowTree.h"
 #include "SVGElementInstance.h"
 #include "SVGElementRareData.h"
 #include "SVGElementInstanceList.h"
@@ -43,7 +45,6 @@
 #include "SVGNames.h"
 #include "SVGSMILElement.h"
 #include "SVGSVGElement.h"
-#include "SVGShadowTreeElements.h"
 #include "SVGSymbolElement.h"
 #include "XLinkNames.h"
 #include "XMLDocumentParser.h"
@@ -82,7 +83,6 @@ inline SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* docu
     , m_y(LengthModeHeight)
     , m_width(LengthModeWidth)
     , m_height(LengthModeHeight)
-    , m_updatesBlocked(false)
     , m_needsShadowTreeRecreation(false)
 {
     ASSERT(hasTagName(SVGNames::useTag));
@@ -93,7 +93,10 @@ inline SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* docu
 
 PassRefPtr<SVGUseElement> SVGUseElement::create(const QualifiedName& tagName, Document* document)
 {
-    return adoptRef(new SVGUseElement(tagName, document));
+    // Always build a #shadow-root for SVGUseElement.
+    RefPtr<SVGUseElement> use = adoptRef(new SVGUseElement(tagName, document));
+    use->ensureShadowRoot();
+    return use.release();
 }
 
 SVGElementInstance* SVGUseElement::instanceRoot()
@@ -167,12 +170,13 @@ void SVGUseElement::insertedIntoDocument()
     SVGStyledTransformableElement::insertedIntoDocument();
     ASSERT(!m_targetElementInstance || !isWellFormedDocument(document()));
     ASSERT(!hasPendingResources() || !isWellFormedDocument(document()));
+    buildPendingResource();
 }
 
 void SVGUseElement::removedFromDocument()
 {
     SVGStyledTransformableElement::removedFromDocument();
-    detachInstance();
+    clearResourceReferences();
 }
 
 void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)
@@ -184,48 +188,30 @@ void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)
 
     SVGElementInstance::InvalidationGuard invalidationGuard(this);
 
-    bool isXYAttribute = attrName == SVGNames::xAttr || attrName == SVGNames::yAttr;
-    bool isWidthHeightAttribute = attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr;
-
-    if (isXYAttribute || isWidthHeightAttribute)
+    RenderObject* renderer = this->renderer();
+    if (attrName == SVGNames::xAttr
+        || attrName == SVGNames::yAttr
+        || attrName == SVGNames::widthAttr
+        || attrName == SVGNames::heightAttr) {
         updateRelativeLengthsInformation();
-
-    if (SVGTests::handleAttributeChange(this, attrName))
-        return;
-
-    RenderObject* object = renderer();
-    if (!object)
-        return;
-
-    if (SVGURIReference::isKnownAttribute(attrName)) {
-        SVGDocumentExtensions* extensions = document()->accessSVGExtensions();
-        if (hasPendingResources() && extensions->isElementPendingResource(this, m_resourceId)) {
-            extensions->removePendingResourceForElement(m_resourceId, this);
-            m_resourceId = String();
-        }
-
-        m_targetElementInstance = 0;
-        invalidateShadowTree();
+        if (renderer)
+            RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
         return;
     }
 
-    if (isXYAttribute) {
-        updateContainerOffsets();
+    if (SVGTests::handleAttributeChange(this, attrName))
         return;
-    }
 
-    if (isWidthHeightAttribute) {
-        updateContainerSizes();
+    if (!renderer)
         return;
-    }
 
-    // Be very careful here, if svgAttributeChanged() has been called because a SVG CSS property changed, we do NOT want to reclone the tree!
-    if (SVGStyledElement::isKnownAttribute(attrName)) {
-        setNeedsStyleRecalc();
+    if (SVGURIReference::isKnownAttribute(attrName)) {
+        buildPendingResource();
         return;
     }
 
-    if (SVGLangSpace::isKnownAttribute(attrName) || SVGExternalResourcesRequired::isKnownAttribute(attrName)) {
+    if (SVGLangSpace::isKnownAttribute(attrName)
+        || SVGExternalResourcesRequired::isKnownAttribute(attrName)) {
         invalidateShadowTree();
         return;
     }
@@ -233,149 +219,15 @@ void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)
     ASSERT_NOT_REACHED();
 }
 
-static void updateContainerSize(SVGElementInstance* targetInstance)
-{
-    // Depth-first used to write the method in early exit style, no particular other reason.
-    for (SVGElementInstance* instance = targetInstance->firstChild(); instance; instance = instance->nextSibling())
-        updateContainerSize(instance);
-
-    SVGUseElement* useElement = targetInstance->directUseElement();
-    if (!useElement)
-        return;
-
-    SVGElement* correspondingElement = targetInstance->correspondingElement();
-    ASSERT(correspondingElement);
-
-    bool isSymbolTag = correspondingElement->hasTagName(SVGNames::symbolTag);
-    if (!correspondingElement->hasTagName(SVGNames::svgTag) && !isSymbolTag)
-        return;
-
-    SVGElement* shadowTreeElement = targetInstance->shadowTreeElement();
-    ASSERT(shadowTreeElement);
-    ASSERT(shadowTreeElement->hasTagName(SVGNames::svgTag));
-
-    // Spec (<use> on <symbol>): This generated 'svg' will always have explicit values for attributes width and height.
-    // If attributes width and/or height are provided on the 'use' element, then these attributes
-    // will be transferred to the generated 'svg'. If attributes width and/or height are not specified,
-    // the generated 'svg' element will use values of 100% for these attributes.
-    
-    // Spec (<use> on <svg>): If attributes width and/or height are provided on the 'use' element, then these
-    // values will override the corresponding attributes on the 'svg' in the generated tree.
-
-    if (useElement->hasAttribute(SVGNames::widthAttr))
-        shadowTreeElement->setAttribute(SVGNames::widthAttr, useElement->getAttribute(SVGNames::widthAttr));
-    else if (isSymbolTag && shadowTreeElement->hasAttribute(SVGNames::widthAttr))
-        shadowTreeElement->setAttribute(SVGNames::widthAttr, "100%");
-
-    if (useElement->hasAttribute(SVGNames::heightAttr))
-        shadowTreeElement->setAttribute(SVGNames::heightAttr, useElement->getAttribute(SVGNames::heightAttr));
-    else if (isSymbolTag && shadowTreeElement->hasAttribute(SVGNames::heightAttr))
-        shadowTreeElement->setAttribute(SVGNames::heightAttr, "100%");
-}   
-
-void SVGUseElement::updateContainerSizes()
+bool SVGUseElement::willRecalcStyle(StyleChange)
 {
-    if (!m_targetElementInstance)
-        return;
-
-    // Update whole subtree, scanning for shadow container elements, that correspond to <svg>/<symbol> tags
-    ASSERT(m_targetElementInstance->directUseElement() == this);
-    updateContainerSize(m_targetElementInstance.get());
-
-    if (RenderObject* object = renderer())
-        RenderSVGResource::markForLayoutAndParentResourceInvalidation(object);
-}
-
-static void updateContainerOffset(SVGElementInstance* targetInstance)
-{
-    // Depth-first used to write the method in early exit style, no particular other reason.
-    for (SVGElementInstance* instance = targetInstance->firstChild(); instance; instance = instance->nextSibling())
-        updateContainerOffset(instance);
-
-    SVGElement* correspondingElement = targetInstance->correspondingElement();
-    ASSERT(correspondingElement);
-
-    if (!correspondingElement->hasTagName(SVGNames::useTag))
-        return;
-
-    SVGElement* shadowTreeElement = targetInstance->shadowTreeElement();
-    ASSERT(shadowTreeElement);
-    ASSERT(shadowTreeElement->hasTagName(SVGNames::gTag));
-
-    if (!static_cast<SVGGElement*>(shadowTreeElement)->isShadowTreeContainerElement())
-        return;
-
-    // Spec: An additional transformation translate(x,y) is appended to the end
-    // (i.e., right-side) of the transform attribute on the generated 'g', where x
-    // and y represent the values of the x and y attributes on the 'use' element. 
-    SVGUseElement* useElement = static_cast<SVGUseElement*>(correspondingElement);
-    SVGShadowTreeContainerElement* containerElement = static_cast<SVGShadowTreeContainerElement*>(shadowTreeElement);
-    containerElement->setContainerOffset(useElement->x(), useElement->y());
-}
-
-void SVGUseElement::updateContainerOffsets()
-{
-    if (!m_targetElementInstance)
-        return;
-
-    // Update root container offset (not reachable through instance tree)
-    SVGElement* shadowRoot = m_targetElementInstance->shadowTreeElement();
-    ASSERT(shadowRoot);
-
-    ContainerNode* parentNode = shadowRoot->parentNode();
-    ASSERT(parentNode);
-    ASSERT(parentNode->isSVGElement());
-    ASSERT(parentNode->hasTagName(SVGNames::gTag));
-    ASSERT(static_cast<SVGGElement*>(parentNode)->isShadowTreeContainerElement());
-
-    SVGShadowTreeContainerElement* containerElement = static_cast<SVGShadowTreeContainerElement*>(parentNode);
-    containerElement->setContainerOffset(x(), y());
-
-    // Update whole subtree, scanning for shadow container elements, marking a cloned use subtree
-    updateContainerOffset(m_targetElementInstance.get());
-
-    if (RenderObject* object = renderer())
-        RenderSVGResource::markForLayoutAndParentResourceInvalidation(object);
-}
-
-bool SVGUseElement::willRecalcStyle(StyleChange change)
-{
-    // Eventually mark shadow root element needing style recalc
-    if ((change >= Inherit || needsStyleRecalc() || childNeedsStyleRecalc()) && m_targetElementInstance && !m_updatesBlocked) {
-        if (SVGElement* shadowRoot = m_targetElementInstance->shadowTreeElement())
-            shadowRoot->setNeedsStyleRecalc();
-    }
-    // Do not do style calculation during shadow tree construction because it may cause nodes to
-    // be attached before they should be. Style recalc will happen when the tree is constructed
-    // and explicitly attached.
-    if (m_updatesBlocked)
-        return false;
+    if (m_needsShadowTreeRecreation && renderer() && needsStyleRecalc())
+        buildPendingResource();
     return true;
 }
 
-void SVGUseElement::didRecalcStyle(StyleChange change)
-{
-    // Assure that the shadow tree has not been marked for recreation, while we're building it.
-    if (m_updatesBlocked && m_needsShadowTreeRecreation) {
-        // We are about to recreate the tree while in the middle of recreating the tree.
-        return;
-    }
-
-    RenderSVGShadowTreeRootContainer* shadowRoot = static_cast<RenderSVGShadowTreeRootContainer*>(renderer());
-    if (!shadowRoot)
-        return;
-    
-    if (m_needsShadowTreeRecreation) {
-        shadowRoot->markShadowTreeForRecreation();
-        m_needsShadowTreeRecreation = false;
-    }
-
-    shadowRoot->updateFromElement();
-    shadowRoot->updateStyle(change);
-}
-
 #ifdef DUMP_INSTANCE_TREE
-void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* targetInstance)
+static void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* targetInstance)
 {
     SVGElement* element = targetInstance->correspondingElement();
     ASSERT(element);
@@ -423,14 +275,46 @@ void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* tar
 }
 #endif
 
-static bool isDisallowedElement(Node* element)
+static bool isDisallowedElement(Node* node)
 {
-    // <foreignObject> should never be contained in a <use> tree. Too dangerous side effects possible.
-    if (element->hasTagName(SVGNames::foreignObjectTag))
-        return true;
-    if (SVGSMILElement::isSMILElement(element))
+    // Spec: "Any 'svg', 'symbol', 'g', graphics element or other 'use' is potentially a template object that can be re-used
+    // (i.e., "instanced") in the SVG document via a 'use' element."
+    // "Graphics Element" is defined as 'circle', 'ellipse', 'image', 'line', 'path', 'polygon', 'polyline', 'rect', 'text'
+    // Excluded are anything that is used by reference or that only make sense to appear once in a document.
+    // We must also allow the shadow roots of other use elements.
+    if (node->isShadowRoot() || node->isTextNode())
+        return false;
+
+    if (!node->isSVGElement())
         return true;
-    return false;
+
+    Element* element = static_cast<Element*>(node);
+
+    DEFINE_STATIC_LOCAL(HashSet<QualifiedName>, allowedElementTags, ());
+    if (allowedElementTags.isEmpty()) {
+        allowedElementTags.add(SVGNames::aTag);
+        allowedElementTags.add(SVGNames::circleTag);
+        allowedElementTags.add(SVGNames::descTag);
+        allowedElementTags.add(SVGNames::ellipseTag);
+        allowedElementTags.add(SVGNames::gTag);
+        allowedElementTags.add(SVGNames::imageTag);
+        allowedElementTags.add(SVGNames::lineTag);
+        allowedElementTags.add(SVGNames::metadataTag);
+        allowedElementTags.add(SVGNames::pathTag);
+        allowedElementTags.add(SVGNames::polygonTag);
+        allowedElementTags.add(SVGNames::polylineTag);
+        allowedElementTags.add(SVGNames::rectTag);
+        allowedElementTags.add(SVGNames::svgTag);
+        allowedElementTags.add(SVGNames::switchTag);
+        allowedElementTags.add(SVGNames::symbolTag);
+        allowedElementTags.add(SVGNames::textTag);
+        allowedElementTags.add(SVGNames::textPathTag);
+        allowedElementTags.add(SVGNames::titleTag);
+        allowedElementTags.add(SVGNames::trefTag);
+        allowedElementTags.add(SVGNames::tspanTag);
+        allowedElementTags.add(SVGNames::useTag);
+    }
+    return !allowedElementTags.contains<QualifiedName, SVGAttributeHashTranslator>(element->tagQName());
 }
 
 static bool subtreeContainsDisallowedElement(Node* start)
@@ -446,78 +330,51 @@ static bool subtreeContainsDisallowedElement(Node* start)
     return false;
 }
 
+void SVGUseElement::clearResourceReferences()
+{
+    // FIXME: We should try to optimize this, to at least allow partial reclones.
+    if (ShadowRoot* shadowTreeRootElement =  shadowTree()->oldestShadowRoot())
+        shadowTreeRootElement->removeAllChildren();
+
+    if (m_targetElementInstance) {
+        m_targetElementInstance->detach();
+        m_targetElementInstance = 0;
+    }
+
+    m_needsShadowTreeRecreation = false;
+}
+
 void SVGUseElement::buildPendingResource()
 {
-    // If we're called the first time (during shadow tree root creation from RenderSVGShadowTreeRootContainer)
-    // we either determine that our target is available or not - then we add ourselves to the pending resource list
-    // Once the pending resource appears, it will call buildPendingResource(), so we're called a second time.
-    String id;
-    Element* targetElement = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
-    ASSERT(!m_targetElementInstance);
-    SVGDocumentExtensions* extensions = document()->accessSVGExtensions();
+    clearResourceReferences();
+    if (!inDocument())
+        return;
 
-    if (!targetElement) {
-        if ((hasPendingResources() && extensions->isElementPendingResource(this, id)) || id.isEmpty())
+    String id;
+    Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
+    if (!target) {
+        if (hasPendingResources() || id.isEmpty())
             return;
 
-        m_resourceId = id;
-        extensions->addPendingResource(id, this);
+        ASSERT(!hasPendingResources());
+        document()->accessSVGExtensions()->addPendingResource(id, this);
         ASSERT(hasPendingResources());
         return;
     }
 
-    if (hasPendingResources()) {
-        ASSERT(!m_targetElementInstance);
-        m_resourceId = String();
-        invalidateShadowTree();
-    }
+    if (target->isSVGElement())
+        buildShadowAndInstanceTree(static_cast<SVGElement*>(target));
+    ASSERT(!m_needsShadowTreeRecreation);
 }
 
-void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowRoot)
+void SVGUseElement::buildShadowAndInstanceTree(SVGElement* target)
 {
-    struct ShadowTreeUpdateBlocker {
-        ShadowTreeUpdateBlocker(SVGUseElement* currentUseElement)
-            : useElement(currentUseElement)
-        {
-            useElement->setUpdatesBlocked(true);
-        }
-
-        ~ShadowTreeUpdateBlocker()
-        {
-            useElement->setUpdatesBlocked(false);
-        }
-
-        SVGUseElement* useElement;
-    };
-
-    // When cloning the target nodes, they may decide to synchronize style and/or animated SVG attributes.
-    // That causes calls to SVGElementInstance::updateAllInstancesOfElement(), which mark the shadow tree for recreation.
-    // Solution: block any updates to the shadow tree while we're building it.
-    ShadowTreeUpdateBlocker blocker(this);
-
-    Element* targetElement = SVGURIReference::targetElementFromIRIString(href(), document());
-    if (!targetElement) {
-        // The only time we should get here is when the use element has not been
-        // given a resource to target.
-        ASSERT(m_resourceId.isEmpty());
-        return;
-    }
+    ASSERT(!m_targetElementInstance);
 
     // Do not build the shadow/instance tree for <use> elements living in a shadow tree.
     // The will be expanded soon anyway - see expandUseElementsInShadowTree().
-    ContainerNode* parent = parentNode();
-    while (parent) {
-        if (parent->isSVGShadowRoot())
-            return;
-
-        parent = parent->parentNodeGuaranteedHostFree();
-    }
-
-    SVGElement* target = 0;
-    if (targetElement && targetElement->isSVGElement())
-        target = static_cast<SVGElement*>(targetElement);
-
-    detachInstance();
+    if (isInShadowTree())
+        return;
 
     // Do not allow self-referencing.
     // 'target' may be null, if it's a non SVG namespaced element.
@@ -543,7 +400,7 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
     // SVG specification does not say a word about <use> & cycles. My view on this is: just ignore it!
     // Non-appearing <use> content is easier to debug, then half-appearing content.
     if (foundProblem) {
-        detachInstance();
+        clearResourceReferences();
         return;
     }
 
@@ -554,42 +411,39 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
     ASSERT(m_targetElementInstance->directUseElement() == this);
     ASSERT(m_targetElementInstance->correspondingElement() == target);
 
+    ShadowRoot* shadowTreeRootElement = shadowTree()->oldestShadowRoot();
+    ASSERT(shadowTreeRootElement);
+
     // Build shadow tree from instance tree
     // This also handles the special cases: <use> on <symbol>, <use> on <svg>.
-    buildShadowTree(shadowRoot, target, m_targetElementInstance.get());
+    buildShadowTree(target, m_targetElementInstance.get());
 
     // Expand all <use> elements in the shadow tree.
     // Expand means: replace the actual <use> element by what it references.
-    expandUseElementsInShadowTree(shadowRoot);
+    expandUseElementsInShadowTree(shadowTreeRootElement);
 
     // Expand all <symbol> elements in the shadow tree.
     // Expand means: replace the actual <symbol> element by the <svg> element.
-    expandSymbolElementsInShadowTree(shadowRoot);
+    expandSymbolElementsInShadowTree(shadowTreeRootElement);
 
     // Now that the shadow tree is completly expanded, we can associate
     // shadow tree elements <-> instances in the instance tree.
-    associateInstancesWithShadowTreeElements(shadowRoot->firstChild(), m_targetElementInstance.get());
+    associateInstancesWithShadowTreeElements(shadowTreeRootElement->firstChild(), m_targetElementInstance.get());
 
     // If no shadow tree element is present, this means that the reference root
     // element was removed, as it is disallowed (ie. <use> on <foreignObject>)
     // Do NOT leave an inconsistent instance tree around, instead destruct it.
     if (!m_targetElementInstance->shadowTreeElement()) {
-        shadowRoot->removeAllChildren();
-        detachInstance();
+        clearResourceReferences();
         return;
     }
 
-    // Consistency checks - this is assumed in updateContainerOffset().
-    ASSERT(m_targetElementInstance->shadowTreeElement()->parentNode() == shadowRoot);
+    ASSERT(m_targetElementInstance->shadowTreeElement()->parentNode() == shadowTreeRootElement);
 
     // Transfer event listeners assigned to the referenced element to our shadow tree elements.
     transferEventListenersToShadowTree(m_targetElementInstance.get());
 
-    // Update container offset/size
-    updateContainerOffsets();
-    updateContainerSizes();
-
-    // Update relative length information
+    // Update relative length information.
     updateRelativeLengthsInformation();
 
     // Eventually dump instance tree
@@ -603,48 +457,15 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
 
     // Eventually dump shadow tree
 #ifdef DUMP_SHADOW_TREE
-    ExceptionCode ec = 0;
-
     RefPtr<XMLSerializer> serializer = XMLSerializer::create();
-
-    String markup = serializer->serializeToString(shadowRoot, ec);
-    ASSERT(!ec);
-
+    String markup = serializer->serializeToString(shadowTreeRootElement, ASSERT_NO_EXCEPTION);
     fprintf(stderr, "Dumping <use> shadow tree markup:\n%s\n", markup.latin1().data());
 #endif
 }
 
-void SVGUseElement::detachInstance()
-{
-    if (!m_targetElementInstance)
-        return;
-    m_targetElementInstance->detach();
-    m_targetElementInstance = 0;
-}
-
 RenderObject* SVGUseElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderSVGShadowTreeRootContainer(this);
-}
-
-static void updateFromElementCallback(Node* node, unsigned)
-{
-    if (RenderObject* renderer = node->renderer())
-        renderer->updateFromElement();
-}
-
-void SVGUseElement::attach()
-{
-    SVGStyledTransformableElement::attach();
-
-    if (renderer())
-        queuePostAttachCallback(updateFromElementCallback, this);
-}
-
-void SVGUseElement::detach()
-{
-    SVGStyledTransformableElement::detach();
-    detachInstance();
+    return new (arena) RenderSVGTransformableContainer(this);
 }
 
 static bool isDirectReference(const Node* node)
@@ -770,23 +591,22 @@ bool SVGUseElement::hasCycleUseReferencing(SVGUseElement* use, SVGElementInstanc
     return false;
 }
 
-void SVGUseElement::removeDisallowedElementsFromSubtree(Node* subtree)
+static inline void removeDisallowedElementsFromSubtree(Node* subtree)
 {
     ASSERT(!subtree->inDocument());
-    ExceptionCode ec;
     Node* node = subtree->firstChild();
     while (node) {
         if (isDisallowedElement(node)) {
             Node* next = node->traverseNextSibling(subtree);
             // The subtree is not in document so this won't generate events that could mutate the tree.
-            node->parentNode()->removeChild(node, ec);
+            node->parentNode()->removeChild(node);
             node = next;
         } else
             node = node->traverseNextNode(subtree);
     }
 }
 
-void SVGUseElement::buildShadowTree(SVGShadowTreeRootElement* shadowRoot, SVGElement* target, SVGElementInstance* targetInstance)
+void SVGUseElement::buildShadowTree(SVGElement* target, SVGElementInstance* targetInstance)
 {
     // For instance <use> on <foreignObject> (direct case).
     if (isDisallowedElement(target))
@@ -802,14 +622,7 @@ void SVGUseElement::buildShadowTree(SVGShadowTreeRootElement* shadowRoot, SVGEle
     if (subtreeContainsDisallowedElement(newChild.get()))
         removeDisallowedElementsFromSubtree(newChild.get());
 
-    SVGElement* newChildPtr = 0;
-    if (newChild->isSVGElement())
-        newChildPtr = static_cast<SVGElement*>(newChild.get());
-    ASSERT_UNUSED(newChildPtr, newChildPtr);
-
-    ExceptionCode ec = 0;
-    shadowRoot->appendChild(newChild.release(), ec);
-    ASSERT(!ec);
+    shadowTree()->oldestShadowRoot()->appendChild(newChild.release());
 }
 
 void SVGUseElement::expandUseElementsInShadowTree(Node* element)
@@ -831,24 +644,17 @@ void SVGUseElement::expandUseElementsInShadowTree(Node* element)
 
         // Don't ASSERT(target) here, it may be "pending", too.
         // Setup sub-shadow tree root node
-        RefPtr<SVGShadowTreeContainerElement> cloneParent = SVGShadowTreeContainerElement::create(document());
+        RefPtr<SVGGElement> cloneParent = SVGGElement::create(SVGNames::gTag, document());
         use->cloneChildNodes(cloneParent.get());
 
         // Spec: In the generated content, the 'use' will be replaced by 'g', where all attributes from the
         // 'use' element except for x, y, width, height and xlink:href are transferred to the generated 'g' element.
         transferUseAttributesToReplacedElement(use, cloneParent.get());
 
-        ExceptionCode ec = 0;
         if (target && !isDisallowedElement(target)) {
             RefPtr<Element> newChild = target->cloneElementWithChildren();
-
-            SVGElement* newChildPtr = 0;
-            if (newChild->isSVGElement())
-                newChildPtr = static_cast<SVGElement*>(newChild.get());
-            ASSERT_UNUSED(newChildPtr, newChildPtr);
-
-            cloneParent->appendChild(newChild.release(), ec);
-            ASSERT(!ec);
+            ASSERT(newChild->isSVGElement());
+            cloneParent->appendChild(newChild.release());
         }
 
         // We don't walk the target tree element-by-element, and clone each element,
@@ -863,8 +669,7 @@ void SVGUseElement::expandUseElementsInShadowTree(Node* element)
 
         // Replace <use> with referenced content.
         ASSERT(use->parentNode()); 
-        use->parentNode()->replaceChild(cloneParent.release(), use, ec);
-        ASSERT(!ec);
+        use->parentNode()->replaceChild(cloneParent.release(), use);
 
         // Expand the siblings because the *element* is replaced and we will
         // lose the sibling chain when we are back from recursion.
@@ -892,11 +697,9 @@ void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
         svgElement->setAttributesFromElement(*toElement(element));
 
         // Only clone symbol children, and add them to the new <svg> element    
-        ExceptionCode ec = 0;
         for (Node* child = element->firstChild(); child; child = child->nextSibling()) {
             RefPtr<Node> newChild = child->cloneNode(true);
-            svgElement->appendChild(newChild.release(), ec);
-            ASSERT(!ec);
+            svgElement->appendChild(newChild.release());
         }
     
         // We don't walk the target tree element-by-element, and clone each element,
@@ -910,9 +713,7 @@ void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
         RefPtr<Node> replacingElement(svgElement.get());
 
         // Replace <symbol> with <svg>.
-        ASSERT(element->parentNode()); 
-        element->parentNode()->replaceChild(svgElement.release(), element, ec);
-        ASSERT(!ec);
+        element->parentNode()->replaceChild(svgElement.release(), element);
 
         // Expand the siblings because the *element* is replaced and we will
         // lose the sibling chain when we are back from recursion.
@@ -1013,10 +814,8 @@ SVGElementInstance* SVGUseElement::instanceForShadowTreeElement(Node* element, S
 
 void SVGUseElement::invalidateShadowTree()
 {
-    // Don't mutate the shadow tree while we're building it.
-    if (m_updatesBlocked)
+    if (!renderer() || m_needsShadowTreeRecreation)
         return;
-
     m_needsShadowTreeRecreation = true;
     setNeedsStyleRecalc();
 }
diff --git a/Source/WebCore/svg/SVGUseElement.h b/Source/WebCore/svg/SVGUseElement.h
index 0d9c06e46..953b7e253 100644
--- a/Source/WebCore/svg/SVGUseElement.h
+++ b/Source/WebCore/svg/SVGUseElement.h
@@ -33,7 +33,6 @@
 namespace WebCore {
 
 class SVGElementInstance;
-class SVGShadowTreeRootElement;
 
 class SVGUseElement : public SVGStyledTransformableElement,
                       public SVGTests,
@@ -65,21 +64,12 @@ private:
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool willRecalcStyle(StyleChange);
-    virtual void didRecalcStyle(StyleChange);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual void attach();
-    virtual void detach();
-
     virtual void toClipPath(Path&);
 
-    static void removeDisallowedElementsFromSubtree(Node* element);
-
-    void setUpdatesBlocked(bool blocked) { m_updatesBlocked = blocked; }
-
-    friend class RenderSVGShadowTreeRootContainer;
-    friend class SVGElement;
-    void buildShadowAndInstanceTree(SVGShadowTreeRootElement*);
+    void clearResourceReferences();
+    void buildShadowAndInstanceTree(SVGElement* target);
     void detachInstance();
 
     virtual bool selfHasRelativeLengths() const;
@@ -89,7 +79,7 @@ private:
     bool hasCycleUseReferencing(SVGUseElement*, SVGElementInstance* targetInstance, SVGElement*& newTarget);
 
     // Shadow tree handling
-    void buildShadowTree(SVGShadowTreeRootElement*, SVGElement* target, SVGElementInstance* targetInstance);
+    void buildShadowTree(SVGElement* target, SVGElementInstance* targetInstance);
 
     void expandUseElementsInShadowTree(Node* element);
     void expandSymbolElementsInShadowTree(Node* element);
@@ -101,9 +91,6 @@ private:
     void transferUseAttributesToReplacedElement(SVGElement* from, SVGElement* to) const;
     void transferEventListenersToShadowTree(SVGElementInstance* target);
 
-    void updateContainerOffsets();
-    void updateContainerSizes();
-
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGUseElement)
         DECLARE_ANIMATED_LENGTH(X, x)
         DECLARE_ANIMATED_LENGTH(Y, y)
@@ -118,9 +105,7 @@ private:
     virtual void synchronizeRequiredExtensions() { SVGTests::synchronizeRequiredExtensions(this); }
     virtual void synchronizeSystemLanguage() { SVGTests::synchronizeSystemLanguage(this); }
 
-    bool m_updatesBlocked;
     bool m_needsShadowTreeRecreation;
-    String m_resourceId;
     RefPtr<SVGElementInstance> m_targetElementInstance;
 };
 
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
index dda170bf9..73c8785da 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
@@ -192,11 +192,10 @@ void SVGSMILElement::reset()
 void SVGSMILElement::insertedIntoDocument()
 {
     SVGElement::insertedIntoDocument();
-#ifndef NDEBUG
+
     // Verify we are not in <use> instance tree.
-    for (ContainerNode* n = this; n; n = n->parentNode())
-        ASSERT(!n->isSVGShadowRoot());
-#endif
+    ASSERT(!isInShadowTree());
+
     m_attributeName = constructQualifiedName(this, fastGetAttribute(SVGNames::attributeNameAttr));
     SVGSVGElement* owner = ownerSVGElement();
     if (!owner)
@@ -222,14 +221,17 @@ void SVGSMILElement::removedFromDocument()
         m_timeContainer->unschedule(this);
         m_timeContainer = 0;
     }
-    if (m_targetElement) {
-        document()->accessSVGExtensions()->removeAnimationElementFromTarget(this, m_targetElement);
-        m_targetElement = 0;
-    }
     // Calling disconnectConditions() may kill us if there are syncbase conditions.
     // OK, but we don't want to die inside the call.
     RefPtr<SVGSMILElement> keepAlive(this);
     disconnectConditions();
+
+    // Clear target now, because disconnectConditions calls targetElement() which will recreate the target if we removed it sooner. 
+    if (m_targetElement) {
+        document()->accessSVGExtensions()->removeAnimationElementFromTarget(this, m_targetElement);
+        m_targetElement = 0;
+    }
+
     SVGElement::removedFromDocument();
 }
    
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.h b/Source/WebCore/svg/animation/SVGSMILElement.h
index 9e1dfd014..400a7a6ba 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.h
+++ b/Source/WebCore/svg/animation/SVGSMILElement.h
@@ -116,11 +116,11 @@ protected:
 
     // Sub-classes may need to take action when the target is changed.
     virtual void targetElementDidChange(SVGElement*) { }
+    virtual void endedActiveInterval();
 
 private:
     virtual void startedActiveInterval() = 0;
     virtual void updateAnimation(float percent, unsigned repeat, SVGSMILElement* resultElement) = 0;
-    void endedActiveInterval();
 
     enum BeginOrEnd {
         Begin,
diff --git a/Source/WebCore/svg/graphics/SVGImage.cpp b/Source/WebCore/svg/graphics/SVGImage.cpp
index 7e1ce2854..585780fea 100644
--- a/Source/WebCore/svg/graphics/SVGImage.cpp
+++ b/Source/WebCore/svg/graphics/SVGImage.cpp
@@ -304,7 +304,7 @@ NativeImagePtr SVGImage::nativeImageForCurrentFrame()
     if (!m_frameCache) {
         if (!m_page)
             return 0;
-        OwnPtr<ImageBuffer> buffer = ImageBuffer::create(size());
+        OwnPtr<ImageBuffer> buffer = ImageBuffer::create(size(), 1);
         if (!buffer) // failed to allocate image
             return 0;
         draw(buffer->context(), rect(), rect(), ColorSpaceDeviceRGB, CompositeSourceOver);
diff --git a/Source/WebCore/svg/graphics/SVGImageCache.cpp b/Source/WebCore/svg/graphics/SVGImageCache.cpp
index cd901f4b4..0d97a0fec 100644
--- a/Source/WebCore/svg/graphics/SVGImageCache.cpp
+++ b/Source/WebCore/svg/graphics/SVGImageCache.cpp
@@ -133,7 +133,7 @@ Image* SVGImageCache::lookupOrCreateBitmapImageForRenderer(const RenderObject* r
     }
 
     // Create and cache new image and image buffer at requested size.
-    OwnPtr<ImageBuffer> newBuffer = ImageBuffer::create(size);
+    OwnPtr<ImageBuffer> newBuffer = ImageBuffer::create(size, 1);
     if (!newBuffer)
         return Image::nullImage();
 
diff --git a/Source/WebCore/svg/svgattrs.in b/Source/WebCore/svg/svgattrs.in
index 688f25034..c220b67b8 100644
--- a/Source/WebCore/svg/svgattrs.in
+++ b/Source/WebCore/svg/svgattrs.in
@@ -209,6 +209,7 @@ textLength
 title
 to
 transform
+transform-origin
 type
 u1
 u2
diff --git a/Source/WebCore/testing/InternalSettings.cpp b/Source/WebCore/testing/InternalSettings.cpp
index 2884e5661..87543824a 100644
--- a/Source/WebCore/testing/InternalSettings.cpp
+++ b/Source/WebCore/testing/InternalSettings.cpp
@@ -34,6 +34,7 @@
 #include "InspectorController.h"
 #include "Language.h"
 #include "Page.h"
+#include "RuntimeEnabledFeatures.h"
 #include "Settings.h"
 
 #if ENABLE(INPUT_COLOR)
@@ -79,27 +80,34 @@
 namespace WebCore {
 
 
-PassRefPtr<InternalSettings> InternalSettings::create(Frame* frame, InternalSettings* old)
+PassRefPtr<InternalSettings> InternalSettings::create(Frame* frame)
 {
-    return adoptRef(new InternalSettings(frame, old));
+    return adoptRef(new InternalSettings(frame));
 }
 
 InternalSettings::~InternalSettings()
 {
 }
 
-InternalSettings::InternalSettings(Frame* frame, InternalSettings* old)
+InternalSettings::InternalSettings(Frame* frame)
     : FrameDestructionObserver(frame)
-    , m_passwordEchoDurationInSecondsBackup(0)
-    , m_passwordEchoDurationInSecondsBackedUp(false)
-    , m_passwordEchoEnabledBackedUp(false)
-{
-    if (old && settings()) {
-        if (old->m_passwordEchoDurationInSecondsBackedUp)
-            settings()->setPasswordEchoDurationInSeconds(old->m_passwordEchoDurationInSecondsBackup);
-        if (old->m_passwordEchoEnabledBackedUp)
-            settings()->setPasswordEchoEnabled(old->m_passwordEchoEnabledBackup);
-    }
+    , m_originalPasswordEchoDurationInSeconds(settings()->passwordEchoDurationInSeconds())
+    , m_originalPasswordEchoEnabled(settings()->passwordEchoEnabled())
+#if ENABLE(SHADOW_DOM)
+    , m_originalShadowDOMEnabled(RuntimeEnabledFeatures::shadowDOMEnabled())
+#endif
+
+
+{
+}
+
+void InternalSettings::restoreTo(Settings* settings)
+{
+    settings->setPasswordEchoDurationInSeconds(m_originalPasswordEchoDurationInSeconds);
+    settings->setPasswordEchoEnabled(m_originalPasswordEchoEnabled);
+#if ENABLE(SHADOW_DOM)
+    RuntimeEnabledFeatures::setShadowDOMEnabled(m_originalShadowDOMEnabled);
+#endif
 }
 
 Settings* InternalSettings::settings() const
@@ -173,20 +181,12 @@ void InternalSettings::setMockScrollbarsEnabled(bool enabled, ExceptionCode& ec)
 void InternalSettings::setPasswordEchoEnabled(bool enabled, ExceptionCode& ec)
 {
     InternalSettingsGuardForSettings();
-    if (!m_passwordEchoEnabledBackedUp) {
-        m_passwordEchoEnabledBackup = settings()->passwordEchoEnabled();
-        m_passwordEchoEnabledBackedUp = true;
-    }
     settings()->setPasswordEchoEnabled(enabled);
 }
 
 void InternalSettings::setPasswordEchoDurationInSeconds(double durationInSeconds, ExceptionCode& ec)
 {
     InternalSettingsGuardForSettings();
-    if (!m_passwordEchoDurationInSecondsBackedUp) {
-        m_passwordEchoDurationInSecondsBackup = settings()->passwordEchoDurationInSeconds();
-        m_passwordEchoDurationInSecondsBackedUp = true;
-    }
     settings()->setPasswordEchoDurationInSeconds(durationInSeconds);
 }
 
@@ -220,6 +220,19 @@ void InternalSettings::setPerTileDrawingEnabled(bool enabled, ExceptionCode& ec)
     settings()->setPerTileDrawingEnabled(enabled);
 }
 
+void InternalSettings::setShadowDOMEnabled(bool enabled, ExceptionCode& ec)
+{
+#if ENABLE(SHADOW_DOM)
+    UNUSED_PARAM(ec);
+    RuntimeEnabledFeatures::setShadowDOMEnabled(enabled);
+#else
+    // Even SHADOW_DOM is off, InternalSettings allows setShadowDOMEnabled(false) to
+    // have broader test coverage. But it cannot be setShadowDOMEnabled(true).
+    if (enabled)
+        ec = INVALID_ACCESS_ERR;
+#endif
+}
+
 void InternalSettings::setTouchEventEmulationEnabled(bool enabled, ExceptionCode& ec)
 {
 #if ENABLE(TOUCH_EVENTS)
diff --git a/Source/WebCore/testing/InternalSettings.h b/Source/WebCore/testing/InternalSettings.h
index ef66c9959..a0bc0e820 100644
--- a/Source/WebCore/testing/InternalSettings.h
+++ b/Source/WebCore/testing/InternalSettings.h
@@ -43,7 +43,8 @@ class Settings;
 class InternalSettings : public RefCounted<InternalSettings>,
                          public FrameDestructionObserver {
 public:
-    static PassRefPtr<InternalSettings> create(Frame*, InternalSettings* old);
+    static PassRefPtr<InternalSettings> create(Frame*);
+
     virtual ~InternalSettings();
 
     void setInspectorResourcesDataSizeLimits(int maximumResourcesContentSize, int maximumSingleResourceContentSize, ExceptionCode&);
@@ -61,18 +62,22 @@ public:
     void setPageScaleFactor(float scaleFactor, int x, int y, ExceptionCode&);
     void setPerTileDrawingEnabled(bool enabled, ExceptionCode&);
     void setTouchEventEmulationEnabled(bool enabled, ExceptionCode&);
+    void setShadowDOMEnabled(bool enabled, ExceptionCode&);
+
+    void restoreTo(Settings*);
 
 private:
-    InternalSettings(Frame*, InternalSettings* old);
+    InternalSettings(Frame*);
 
     Settings* settings() const;
     Document* document() const;
     Page* page() const;
 
-    double m_passwordEchoDurationInSecondsBackup;
-    bool m_passwordEchoEnabledBackup : 1;
-    bool m_passwordEchoDurationInSecondsBackedUp : 1;
-    bool m_passwordEchoEnabledBackedUp : 1;
+    double m_originalPasswordEchoDurationInSeconds;
+    bool m_originalPasswordEchoEnabled;
+#if ENABLE(SHADOW_DOM)
+    bool m_originalShadowDOMEnabled;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/testing/InternalSettings.idl b/Source/WebCore/testing/InternalSettings.idl
index dd9519ec2..387b5b9ae 100644
--- a/Source/WebCore/testing/InternalSettings.idl
+++ b/Source/WebCore/testing/InternalSettings.idl
@@ -41,6 +41,7 @@ module window {
         boolean unifiedTextCheckingEnabled() raises (DOMException);
         void setPageScaleFactor(in float scaleFactor, in long x, in long y) raises(DOMException);
         void setTouchEventEmulationEnabled(in boolean enabled) raises(DOMException);
+        void setShadowDOMEnabled(in boolean enabled) raises(DOMException);
     };
 }
 
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index 84e9cf754..aafe9ade7 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -50,7 +50,7 @@
 #include "RenderTreeAsText.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SpellChecker.h"
 #include "TextIterator.h"
 
@@ -119,6 +119,14 @@ Internals::Internals(Document* document)
     reset(document);
 }
 
+String Internals::address(Node* node)
+{
+    char buf[32];
+    sprintf(buf, "%p", node);
+
+    return String(buf);
+}
+
 bool Internals::isPreloaded(Document* document, const String& url)
 {
     if (!document)
@@ -146,14 +154,14 @@ Element* Internals::getElementByIdInShadowRoot(Node* shadowRoot, const String& i
     return toShadowRoot(shadowRoot)->getElementById(id);
 }
 
-bool Internals::isValidContentSelect(Element* contentElement, ExceptionCode& ec)
+bool Internals::isValidContentSelect(Element* insertionPoint, ExceptionCode& ec)
 {
-    if (!contentElement || !contentElement->isContentElement()) {
+    if (!insertionPoint || !isInsertionPoint(insertionPoint)) {
         ec = INVALID_ACCESS_ERR;
         return false;
     }
 
-    return toHTMLContentElement(contentElement)->isSelectValid();
+    return toInsertionPoint(insertionPoint)->isSelectValid();
 }
 
 bool Internals::attached(Node* node, ExceptionCode& ec)
@@ -203,7 +211,7 @@ Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::ensureShadowRoot(Eleme
     }
 
     if (host->hasShadowRoot())
-        return host->shadowRootList()->youngestShadowRoot();
+        return host->shadowTree()->youngestShadowRoot();
 
     return ShadowRoot::create(host, ec).get();
 }
@@ -225,7 +233,7 @@ Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::youngestShadowRoot(Ele
     if (!host->hasShadowRoot())
         return 0;
 
-    return host->shadowRootList()->youngestShadowRoot();
+    return host->shadowTree()->youngestShadowRoot();
 }
 
 Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::oldestShadowRoot(Element* host, ExceptionCode& ec)
@@ -238,7 +246,27 @@ Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::oldestShadowRoot(Eleme
     if (!host->hasShadowRoot())
         return 0;
 
-    return host->shadowRootList()->oldestShadowRoot();
+    return host->shadowTree()->oldestShadowRoot();
+}
+
+Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::youngerShadowRoot(Node* shadow, ExceptionCode& ec)
+{
+    if (!shadow || !shadow->isShadowRoot()) {
+        ec = INVALID_ACCESS_ERR;
+        return 0;
+    }
+
+    return toShadowRoot(shadow)->youngerShadowRoot();
+}
+
+Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::olderShadowRoot(Node* shadow, ExceptionCode& ec)
+{
+    if (!shadow || !shadow->isShadowRoot()) {
+        ec = INVALID_ACCESS_ERR;
+        return 0;
+    }
+
+    return toShadowRoot(shadow)->olderShadowRoot();
 }
 
 void Internals::removeShadowRoot(Element* host, ExceptionCode& ec)
@@ -248,7 +276,8 @@ void Internals::removeShadowRoot(Element* host, ExceptionCode& ec)
         return;
     }
 
-    host->removeShadowRoot();
+    if (host->hasShadowRoot())
+        host->shadowTree()->removeAllShadowRoots();
 }
 
 void Internals::setMultipleShadowSubtreesEnabled(bool enabled)
@@ -405,7 +434,10 @@ void Internals::reset(Document* document)
         return;
 
     observeFrame(document->frame());
-    m_settings = InternalSettings::create(document->frame(), m_settings.get());
+
+    if (m_settings)
+        m_settings->restoreTo(document->page()->settings());
+    m_settings = InternalSettings::create(document->frame());
     if (Page* page = document->page())
         page->setPagination(Page::Pagination());
 }
@@ -517,6 +549,16 @@ unsigned Internals::lengthFromRange(Element* scope, const Range* range, Exceptio
     return length;
 }
 
+String Internals::rangeAsText(const Range* range, ExceptionCode& ec)
+{
+    if (!range) {
+        ec = INVALID_ACCESS_ERR;
+        return String();
+    }
+
+    return range->text();
+}
+
 int Internals::lastSpellCheckRequestSequence(Document* document, ExceptionCode& ec)
 {
     SpellChecker* checker = spellchecker(document);
@@ -541,6 +583,16 @@ int Internals::lastSpellCheckProcessedSequence(Document* document, ExceptionCode
     return checker->lastProcessedSequence();
 }
 
+void Internals::setMediaPlaybackRequiresUserGesture(Document* document, bool enabled, ExceptionCode& ec)
+{
+    if (!document || !document->settings()) {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+
+    document->settings()->setMediaPlaybackRequiresUserGesture(enabled);
+}
+
 Vector<String> Internals::userPreferredLanguages() const
 {
     return WebCore::userPreferredLanguages();
diff --git a/Source/WebCore/testing/Internals.h b/Source/WebCore/testing/Internals.h
index ea2f8b8af..adaca34ed 100644
--- a/Source/WebCore/testing/Internals.h
+++ b/Source/WebCore/testing/Internals.h
@@ -55,6 +55,8 @@ public:
 
     String elementRenderTreeAsText(Element*, ExceptionCode&);
 
+    String address(Node*);
+
     bool isPreloaded(Document*, const String& url);
 
     size_t numberOfScopedHTMLStyleChildren(const Node*, ExceptionCode&) const;
@@ -68,13 +70,15 @@ public:
     ShadowRootIfShadowDOMEnabledOrNode* shadowRoot(Element* host, ExceptionCode&);
     ShadowRootIfShadowDOMEnabledOrNode* youngestShadowRoot(Element* host, ExceptionCode&);
     ShadowRootIfShadowDOMEnabledOrNode* oldestShadowRoot(Element* host, ExceptionCode&);
+    ShadowRootIfShadowDOMEnabledOrNode* youngerShadowRoot(Node* shadow, ExceptionCode&);
+    ShadowRootIfShadowDOMEnabledOrNode* olderShadowRoot(Node* shadow, ExceptionCode&);
     void removeShadowRoot(Element* host, ExceptionCode&);
     void setMultipleShadowSubtreesEnabled(bool);
     Element* includerFor(Node*, ExceptionCode&);
     String shadowPseudoId(Element*, ExceptionCode&);
     PassRefPtr<Element> createContentElement(Document*, ExceptionCode&);
     Element* getElementByIdInShadowRoot(Node* shadowRoot, const String& id, ExceptionCode&);
-    bool isValidContentSelect(Element* contentElement, ExceptionCode&);
+    bool isValidContentSelect(Element* insertionPoint, ExceptionCode&);
 
     bool attached(Node*, ExceptionCode&);
 
@@ -102,10 +106,13 @@ public:
     PassRefPtr<Range> rangeFromLocationAndLength(Element* scope, int rangeLocation, int rangeLength, ExceptionCode&);
     unsigned locationFromRange(Element* scope, const Range*, ExceptionCode&);
     unsigned lengthFromRange(Element* scope, const Range*, ExceptionCode&);
+    String rangeAsText(const Range*, ExceptionCode&);
 
     int lastSpellCheckRequestSequence(Document*, ExceptionCode&);
     int lastSpellCheckProcessedSequence(Document*, ExceptionCode&);
     
+    void setMediaPlaybackRequiresUserGesture(Document*, bool enabled, ExceptionCode&);
+
     Vector<String> userPreferredLanguages() const;
     void setUserPreferredLanguages(const Vector<String>&);
 
diff --git a/Source/WebCore/testing/Internals.idl b/Source/WebCore/testing/Internals.idl
index ba76d486d..394376e79 100644
--- a/Source/WebCore/testing/Internals.idl
+++ b/Source/WebCore/testing/Internals.idl
@@ -27,6 +27,8 @@ module window {
     interface [
         OmitConstructor
     ] Internals {
+        DOMString address(in Node node);
+
         DOMString elementRenderTreeAsText(in Element element) raises(DOMException);
         boolean isPreloaded(in Document document, in DOMString url);
 
@@ -37,11 +39,14 @@ module window {
         ShadowRoot shadowRoot(in Element host) raises (DOMException);
         ShadowRoot youngestShadowRoot(in Element host) raises (DOMException);
         ShadowRoot oldestShadowRoot(in Element host) raises (DOMException);
+        ShadowRoot youngerShadowRoot(in Node root) raises (DOMException);
+        ShadowRoot olderShadowRoot(in Node root) raises (DOMException);
 #else
         Node ensureShadowRoot(in Element host) raises (DOMException);
         Node shadowRoot(in Element host) raises (DOMException);
         Node youngestShadowRoot(in Element host) raises (DOMException);
         Node oldestShadowRoot(in Element host) raises (DOMException);
+        Node youngerShadowRoot(in Node root) raises (DOMException);
 #endif
         void setMultipleShadowSubtreesEnabled(in boolean enabled);
         Element includerFor(in Node node) raises (DOMException);
@@ -77,10 +82,13 @@ module window {
         Range rangeFromLocationAndLength(in Element scope, in long rangeLocation, in long rangeLength) raises (DOMException);
         unsigned long locationFromRange(in Element scope, in Range range) raises (DOMException);
         unsigned long lengthFromRange(in Element scope, in Range range) raises (DOMException);
+        DOMString rangeAsText(in Range range) raises (DOMException);
 
         long lastSpellCheckRequestSequence(in Document document) raises (DOMException);
         long lastSpellCheckProcessedSequence(in Document document) raises (DOMException);
 
+        void setMediaPlaybackRequiresUserGesture(in Document document, in boolean enabled) raises(DOMException);
+
 #if defined(ENABLE_VIDEO_TRACK) && ENABLE_VIDEO_TRACK
         void setShouldDisplayTrackKind(in Document document, in DOMString kind, in boolean enabled) raises (DOMException);
         boolean shouldDisplayTrackKind(in Document document, in DOMString trackKind) raises (DOMException);
diff --git a/Source/WebCore/webaudio/AudioBuffer.cpp b/Source/WebCore/webaudio/AudioBuffer.cpp
index 0515a34a2..0453fbc5d 100644
--- a/Source/WebCore/webaudio/AudioBuffer.cpp
+++ b/Source/WebCore/webaudio/AudioBuffer.cpp
@@ -33,6 +33,7 @@
 #include "AudioBuffer.h"
 
 #include "AudioBus.h"
+#include "AudioContext.h"
 #include "AudioFileReader.h"
 #include "ExceptionCode.h"
 #include <wtf/OwnPtr.h>
@@ -41,7 +42,7 @@ namespace WebCore {
 
 PassRefPtr<AudioBuffer> AudioBuffer::create(unsigned numberOfChannels, size_t numberOfFrames, float sampleRate)
 {
-    if (sampleRate < 22050 || sampleRate > 96000 || numberOfChannels > 10 || !numberOfFrames)
+    if (sampleRate < 22050 || sampleRate > 96000 || numberOfChannels > AudioContext::maxNumberOfChannels() || !numberOfFrames)
         return 0;
     
     return adoptRef(new AudioBuffer(numberOfChannels, numberOfFrames, sampleRate));
diff --git a/Source/WebCore/webaudio/AudioBufferSourceNode.cpp b/Source/WebCore/webaudio/AudioBufferSourceNode.cpp
index db9d3ed3b..4881131a4 100644
--- a/Source/WebCore/webaudio/AudioBufferSourceNode.cpp
+++ b/Source/WebCore/webaudio/AudioBufferSourceNode.cpp
@@ -126,6 +126,9 @@ void AudioBufferSourceNode::process(size_t framesToProcess)
         quantumFrameOffset = min(quantumFrameOffset, framesToProcess); // clamp to valid range
         size_t bufferFramesToProcess = framesToProcess - quantumFrameOffset;
 
+        for (unsigned i = 0; i < outputBus->numberOfChannels(); ++i) 
+            m_destinationChannels[i] = outputBus->channel(i)->mutableData();
+
         // Render by reading directly from the buffer.
         renderFromBuffer(outputBus, quantumFrameOffset, bufferFramesToProcess);
 
@@ -144,7 +147,7 @@ void AudioBufferSourceNode::process(size_t framesToProcess)
             
             if (isSafe) {
                 for (unsigned i = 0; i < outputBus->numberOfChannels(); ++i)
-                    memset(outputBus->channel(i)->mutableData() + zeroStartFrame, 0, sizeof(float) * framesToZero);
+                    memset(m_destinationChannels[i] + zeroStartFrame, 0, sizeof(float) * framesToZero);
             }
 
             m_isPlaying = false;
@@ -160,7 +163,7 @@ void AudioBufferSourceNode::process(size_t framesToProcess)
 }
 
 // Returns true if we're finished.
-bool AudioBufferSourceNode::renderSilenceAndFinishIfNotLooping(float* destinationL, float* destinationR, size_t framesToProcess)
+bool AudioBufferSourceNode::renderSilenceAndFinishIfNotLooping(AudioBus*, unsigned index, size_t framesToProcess)
 {
     if (!loop()) {
         // If we're not looping, then stop playing when we get to the end.
@@ -169,10 +172,8 @@ bool AudioBufferSourceNode::renderSilenceAndFinishIfNotLooping(float* destinatio
         if (framesToProcess > 0) {
             // We're not looping and we've reached the end of the sample data, but we still need to provide more output,
             // so generate silence for the remaining.
-            memset(destinationL, 0, sizeof(float) * framesToProcess);
-
-            if (destinationR)
-                memset(destinationR, 0, sizeof(float) * framesToProcess);
+            for (unsigned i = 0; i < numberOfChannels(); ++i) 
+                memset(m_destinationChannels[i] + index, 0, sizeof(float) * framesToProcess);
         }
 
         finish();
@@ -194,21 +195,11 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     unsigned numberOfChannels = this->numberOfChannels();
     unsigned busNumberOfChannels = bus->numberOfChannels();
 
-    // FIXME: we can add support for sources with more than two channels, but this is not a common case.
-    bool channelCountGood = numberOfChannels == busNumberOfChannels && (numberOfChannels == 1 || numberOfChannels == 2);
+    bool channelCountGood = numberOfChannels && numberOfChannels == busNumberOfChannels;
     ASSERT(channelCountGood);
     if (!channelCountGood)
         return;
 
-    // Get the destination pointers.
-    float* destinationL = bus->channel(0)->mutableData();
-    ASSERT(destinationL);
-    if (!destinationL)
-        return;
-    float* destinationR = (numberOfChannels < 2) ? 0 : bus->channel(1)->mutableData();
-    
-    bool isStereo = destinationR;
-    
     // Sanity check destinationFrameOffset, numberOfFrames.
     size_t destinationLength = bus->length();
 
@@ -221,18 +212,15 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     ASSERT(isOffsetGood);
     if (!isOffsetGood)
         return;
-        
+
     // Potentially zero out initial frames leading up to the offset.
     if (destinationFrameOffset) {
-        memset(destinationL, 0, sizeof(float) * destinationFrameOffset);
-        if (destinationR)
-            memset(destinationR, 0, sizeof(float) * destinationFrameOffset);
+        for (unsigned i = 0; i < numberOfChannels; ++i) 
+            memset(m_destinationChannels[i], 0, sizeof(float) * destinationFrameOffset);
     }
 
     // Offset the pointers to the correct offset frame.
-    destinationL += destinationFrameOffset;
-    if (destinationR)
-        destinationR += destinationFrameOffset;
+    unsigned writeIndex = destinationFrameOffset;
 
     size_t bufferLength = buffer()->length();
     double bufferSampleRate = buffer()->sampleRate();
@@ -264,10 +252,6 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     if (m_virtualReadIndex >= endFrame)
         m_virtualReadIndex = startFrame; // reset to start
 
-    // Get pointers to the start of the sample buffer.
-    float* sourceL = m_buffer->getChannelData(0)->data();
-    float* sourceR = m_buffer->numberOfChannels() == 2 ? m_buffer->getChannelData(1)->data() : 0;
-    
     double pitchRate = totalPitchRate();
 
     // Get local copy.
@@ -276,6 +260,9 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     // Render loop - reading from the source buffer to the destination using linear interpolation.
     int framesToProcess = numberOfFrames;
 
+    const float** sourceChannels = m_sourceChannels.get();
+    float** destinationChannels = m_destinationChannels.get();
+
     // Optimize for the very common case of playing back with pitchRate == 1.
     // We can avoid the linear interpolation.
     if (pitchRate == 1 && virtualReadIndex == floor(virtualReadIndex)) {
@@ -285,20 +272,17 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
             int framesThisTime = min(framesToProcess, framesToEnd);
             framesThisTime = max(0, framesThisTime);
 
-            memcpy(destinationL, sourceL + readIndex, sizeof(*sourceL) * framesThisTime);
-            destinationL += framesThisTime;
-            if (isStereo) {
-                memcpy(destinationR, sourceR + readIndex, sizeof(*sourceR) * framesThisTime);
-                destinationR += framesThisTime;
-            }
+            for (unsigned i = 0; i < numberOfChannels; ++i) 
+                memcpy(destinationChannels[i] + writeIndex, sourceChannels[i] + readIndex, sizeof(float) * framesThisTime);
 
+            writeIndex += framesThisTime;
             readIndex += framesThisTime;
             framesToProcess -= framesThisTime;
 
             // Wrap-around.
             if (readIndex >= endFrame) {
                 readIndex -= deltaFrames;
-                if (renderSilenceAndFinishIfNotLooping(destinationL, destinationR, framesToProcess))
+                if (renderSilenceAndFinishIfNotLooping(bus, writeIndex, framesToProcess))
                     break;
             }
         }
@@ -324,17 +308,17 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
                 break;
 
             // Linear interpolation.
-            double sampleL1 = sourceL[readIndex];
-            double sampleL2 = sourceL[readIndex2];
-            double sampleL = (1.0 - interpolationFactor) * sampleL1 + interpolationFactor * sampleL2;
-            *destinationL++ = narrowPrecisionToFloat(sampleL);
-
-            if (isStereo) {
-                double sampleR1 = sourceR[readIndex];
-                double sampleR2 = sourceR[readIndex2];
-                double sampleR = (1.0 - interpolationFactor) * sampleR1 + interpolationFactor * sampleR2;
-                *destinationR++ = narrowPrecisionToFloat(sampleR);
+            for (unsigned i = 0; i < numberOfChannels; ++i) {
+                float* destination = destinationChannels[i];
+                const float* source = sourceChannels[i];
+
+                double sample1 = source[readIndex];
+                double sample2 = source[readIndex2];
+                double sample = (1.0 - interpolationFactor) * sample1 + interpolationFactor * sample2;
+
+                destination[writeIndex] = narrowPrecisionToFloat(sample);
             }
+            writeIndex++;
 
             virtualReadIndex += pitchRate;
 
@@ -342,7 +326,7 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
             if (virtualReadIndex >= endFrame) {
                 virtualReadIndex -= deltaFrames;
 
-                if (renderSilenceAndFinishIfNotLooping(destinationL, destinationR, framesToProcess))
+                if (renderSilenceAndFinishIfNotLooping(bus, writeIndex, framesToProcess))
                     break;
             }
         }
@@ -379,11 +363,17 @@ bool AudioBufferSourceNode::setBuffer(AudioBuffer* buffer)
     if (buffer) {
         // Do any necesssary re-configuration to the buffer's number of channels.
         unsigned numberOfChannels = buffer->numberOfChannels();
-        if (!numberOfChannels || numberOfChannels > 2) {
-            // FIXME: implement multi-channel greater than stereo.
+
+        if (numberOfChannels > AudioContext::maxNumberOfChannels())
             return false;
-        }
+
         output(0)->setNumberOfChannels(numberOfChannels);
+
+        m_sourceChannels = adoptArrayPtr(new const float* [numberOfChannels]);
+        m_destinationChannels = adoptArrayPtr(new float* [numberOfChannels]);
+
+        for (unsigned i = 0; i < numberOfChannels; ++i) 
+            m_sourceChannels[i] = buffer->getChannelData(i)->data();
     }
 
     m_virtualReadIndex = 0;
diff --git a/Source/WebCore/webaudio/AudioBufferSourceNode.h b/Source/WebCore/webaudio/AudioBufferSourceNode.h
index 49091c017..5ac54c60a 100644
--- a/Source/WebCore/webaudio/AudioBufferSourceNode.h
+++ b/Source/WebCore/webaudio/AudioBufferSourceNode.h
@@ -30,6 +30,7 @@
 #include "AudioGain.h"
 #include "AudioPannerNode.h"
 #include "AudioSourceNode.h"
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
@@ -87,11 +88,16 @@ private:
 
     void renderFromBuffer(AudioBus*, unsigned destinationFrameOffset, size_t numberOfFrames);
 
-    inline bool renderSilenceAndFinishIfNotLooping(float* destinationL, float* destinationR, size_t framesToProcess);
+    // Render silence starting from "index" frame in AudioBus.
+    inline bool renderSilenceAndFinishIfNotLooping(AudioBus*, unsigned index, size_t framesToProcess);
 
     // m_buffer holds the sample data which this node outputs.
     RefPtr<AudioBuffer> m_buffer;
 
+    // Pointers for the buffer and destination.
+    OwnArrayPtr<const float*> m_sourceChannels;
+    OwnArrayPtr<float*> m_destinationChannels;
+
     // Used for the "gain" and "playbackRate" attributes.
     RefPtr<AudioGain> m_gain;
     RefPtr<AudioParam> m_playbackRate;
diff --git a/Source/WebCore/webaudio/AudioContext.cpp b/Source/WebCore/webaudio/AudioContext.cpp
index afc81130b..5f4905a3b 100644
--- a/Source/WebCore/webaudio/AudioContext.cpp
+++ b/Source/WebCore/webaudio/AudioContext.cpp
@@ -445,9 +445,15 @@ PassRefPtr<AudioGainNode> AudioContext::createGainNode()
 
 PassRefPtr<DelayNode> AudioContext::createDelayNode()
 {
+    const double defaultMaxDelayTime = 1;
+    return createDelayNode(defaultMaxDelayTime);
+}
+
+PassRefPtr<DelayNode> AudioContext::createDelayNode(double maxDelayTime)
+{
     ASSERT(isMainThread());
     lazyInitialize();
-    return DelayNode::create(this, m_destinationNode->sampleRate());
+    return DelayNode::create(this, m_destinationNode->sampleRate(), maxDelayTime);
 }
 
 PassRefPtr<AudioChannelSplitter> AudioContext::createChannelSplitter()
diff --git a/Source/WebCore/webaudio/AudioContext.h b/Source/WebCore/webaudio/AudioContext.h
index 7911519b3..b42a075f2 100644
--- a/Source/WebCore/webaudio/AudioContext.h
+++ b/Source/WebCore/webaudio/AudioContext.h
@@ -114,6 +114,7 @@ public:
     PassRefPtr<BiquadFilterNode> createBiquadFilter();
     PassRefPtr<WaveShaperNode> createWaveShaper();
     PassRefPtr<DelayNode> createDelayNode();
+    PassRefPtr<DelayNode> createDelayNode(double maxDelayTime);
     PassRefPtr<LowPass2FilterNode> createLowPass2Filter();
     PassRefPtr<HighPass2FilterNode> createHighPass2Filter();
     PassRefPtr<AudioPannerNode> createPanner();
@@ -172,6 +173,9 @@ public:
     // Returns true if this thread owns the context's lock.
     bool isGraphOwner() const;
 
+    // Returns the maximum numuber of channels we can support.
+    static unsigned maxNumberOfChannels() { return MaxNumberOfChannels;}
+
     class AutoLocker {
     public:
         AutoLocker(AudioContext* context)
@@ -303,6 +307,11 @@ private:
     bool m_isOfflineContext;
 
     AsyncAudioDecoder m_audioDecoder;
+
+    // This is considering 32 is large enough for multiple channels audio. 
+    // It is somewhat arbitrary and could be increased if necessary.
+    enum { MaxNumberOfChannels = 32 };
+
 };
 
 } // WebCore
diff --git a/Source/WebCore/webaudio/AudioContext.idl b/Source/WebCore/webaudio/AudioContext.idl
index ef6935526..c1ff8c6e7 100644
--- a/Source/WebCore/webaudio/AudioContext.idl
+++ b/Source/WebCore/webaudio/AudioContext.idl
@@ -28,10 +28,9 @@ module webaudio {
         Conditional=WEB_AUDIO,
         ActiveDOMObject,
         CustomConstructor,
+        ConstructorParameters=0,
         JSCustomMarkFunction,
-#if defined(V8_BINDING) && V8_BINDING
         EventTarget
-#endif        
     ] AudioContext {
         // All rendered audio ultimately connects to destination, which represents the audio hardware.
         readonly attribute AudioDestinationNode destination;
@@ -62,7 +61,7 @@ module webaudio {
 #endif
         // Processing nodes
         AudioGainNode createGainNode();
-        DelayNode createDelayNode();
+        DelayNode createDelayNode(in [Optional] double maxDelayTime);
         BiquadFilterNode createBiquadFilter();
         WaveShaperNode createWaveShaper();
         LowPass2FilterNode createLowPass2Filter();
diff --git a/Source/WebCore/webaudio/AudioNodeOutput.cpp b/Source/WebCore/webaudio/AudioNodeOutput.cpp
index e7176b6ec..77927b988 100644
--- a/Source/WebCore/webaudio/AudioNodeOutput.cpp
+++ b/Source/WebCore/webaudio/AudioNodeOutput.cpp
@@ -35,10 +35,6 @@
 
 namespace WebCore {
 
-// This is considering that 5.1 (6 channels) is the largest we'll ever deal with.
-// It can easily be increased to support more if the web audio specification is updated.
-const unsigned MaxNumberOfChannels = 6;
-
 AudioNodeOutput::AudioNodeOutput(AudioNode* node, unsigned numberOfChannels)
     : m_node(node)
     , m_numberOfChannels(numberOfChannels)
@@ -47,7 +43,7 @@ AudioNodeOutput::AudioNodeOutput(AudioNode* node, unsigned numberOfChannels)
     , m_isEnabled(true)
     , m_renderingFanOutCount(0)
 {
-    ASSERT(numberOfChannels <= MaxNumberOfChannels);
+    ASSERT(numberOfChannels <= AudioContext::maxNumberOfChannels());
 
     m_internalBus = adoptPtr(new AudioBus(numberOfChannels, AudioNode::ProcessingSizeInFrames));
     m_actualDestinationBus = m_internalBus.get();
@@ -55,7 +51,7 @@ AudioNodeOutput::AudioNodeOutput(AudioNode* node, unsigned numberOfChannels)
 
 void AudioNodeOutput::setNumberOfChannels(unsigned numberOfChannels)
 {
-    ASSERT(numberOfChannels <= MaxNumberOfChannels);
+    ASSERT(numberOfChannels <= AudioContext::maxNumberOfChannels());
     ASSERT(context()->isGraphOwner());
 
     m_desiredNumberOfChannels = numberOfChannels;
diff --git a/Source/WebCore/webaudio/AudioParamTimeline.cpp b/Source/WebCore/webaudio/AudioParamTimeline.cpp
index cd8f53676..63c2bb639 100644
--- a/Source/WebCore/webaudio/AudioParamTimeline.cpp
+++ b/Source/WebCore/webaudio/AudioParamTimeline.cpp
@@ -279,7 +279,7 @@ float AudioParamTimeline::valuesForTimeRangeImpl(float startTime,
                     // Exponential approach to target value with given time constant.
                     float targetValue = event.value();
                     float timeConstant = event.timeConstant();
-                    float discreteTimeConstant = AudioUtilities::discreteTimeConstantForSampleRate(timeConstant, controlRate);
+                    float discreteTimeConstant = static_cast<float>(AudioUtilities::discreteTimeConstantForSampleRate(timeConstant, controlRate));
 
                     for (; writeIndex < fillToFrame; ++writeIndex) {
                         values[writeIndex] = value;
@@ -329,7 +329,10 @@ float AudioParamTimeline::valuesForTimeRangeImpl(float startTime,
                     // Render the stretched curve data using nearest neighbor sampling.
                     // Oversampled curve data can be provided if smoothness is desired.
                     for (; writeIndex < fillToFrame; ++writeIndex) {
-                        unsigned curveIndex = static_cast<unsigned>(curveVirtualIndex);
+                        // Ideally we'd use round() from MathExtras, but we're in a tight loop here
+                        // and we're trading off precision for extra speed.
+                        unsigned curveIndex = static_cast<unsigned>(0.5 + curveVirtualIndex);
+
                         curveVirtualIndex += curvePointsPerFrame;
 
                         // Bounds check.
diff --git a/Source/WebCore/webaudio/DOMWindowWebAudio.idl b/Source/WebCore/webaudio/DOMWindowWebAudio.idl
index f17198f4b..ca8e50e5f 100644
--- a/Source/WebCore/webaudio/DOMWindowWebAudio.idl
+++ b/Source/WebCore/webaudio/DOMWindowWebAudio.idl
@@ -1,20 +1,27 @@
 /*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 module window {
diff --git a/Source/WebCore/webaudio/DelayDSPKernel.cpp b/Source/WebCore/webaudio/DelayDSPKernel.cpp
index aeda189c5..fb31e2ddd 100644
--- a/Source/WebCore/webaudio/DelayDSPKernel.cpp
+++ b/Source/WebCore/webaudio/DelayDSPKernel.cpp
@@ -32,15 +32,13 @@
 #include <algorithm>
 
 using namespace std;
-  
-const float DefaultMaxDelayTime = 1;
+
 const float SmoothingTimeConstant = 0.020f; // 20ms
   
 namespace WebCore {
 
 DelayDSPKernel::DelayDSPKernel(DelayProcessor* processor)
     : AudioDSPKernel(processor)
-    , m_maxDelayTime(DefaultMaxDelayTime)
     , m_writeIndex(0)
     , m_firstTime(true)
 {
@@ -48,7 +46,8 @@ DelayDSPKernel::DelayDSPKernel(DelayProcessor* processor)
     if (!processor)
         return;
 
-    m_buffer.allocate(static_cast<size_t>(processor->sampleRate() * DefaultMaxDelayTime));
+    m_maxDelayTime = processor->maxDelayTime();
+    m_buffer.allocate(static_cast<size_t>(processor->sampleRate() * m_maxDelayTime));
     m_buffer.zero();
 
     m_smoothingRate = AudioUtilities::discreteTimeConstantForSampleRate(SmoothingTimeConstant, processor->sampleRate());
diff --git a/Source/WebCore/webaudio/DelayNode.cpp b/Source/WebCore/webaudio/DelayNode.cpp
index 2a525dd1a..59341abf5 100644
--- a/Source/WebCore/webaudio/DelayNode.cpp
+++ b/Source/WebCore/webaudio/DelayNode.cpp
@@ -30,10 +30,10 @@
 
 namespace WebCore {
 
-DelayNode::DelayNode(AudioContext* context, float sampleRate)
+DelayNode::DelayNode(AudioContext* context, float sampleRate, double maxDelayTime)
     : AudioBasicProcessorNode(context, sampleRate)
 {
-    m_processor = adoptPtr(new DelayProcessor(sampleRate, 1));    
+    m_processor = adoptPtr(new DelayProcessor(sampleRate, 1, maxDelayTime));
     delayTime()->setContext(context);
     setNodeType(NodeTypeDelay);
 }
diff --git a/Source/WebCore/webaudio/DelayNode.h b/Source/WebCore/webaudio/DelayNode.h
index 3d58a8913..92b1e0562 100644
--- a/Source/WebCore/webaudio/DelayNode.h
+++ b/Source/WebCore/webaudio/DelayNode.h
@@ -35,15 +35,15 @@ class AudioParam;
 
 class DelayNode : public AudioBasicProcessorNode {
 public:
-    static PassRefPtr<DelayNode> create(AudioContext* context, float sampleRate)
+    static PassRefPtr<DelayNode> create(AudioContext* context, float sampleRate, double maxDelayTime)
     {
-        return adoptRef(new DelayNode(context, sampleRate));      
+        return adoptRef(new DelayNode(context, sampleRate, maxDelayTime));      
     }
 
     AudioParam* delayTime();
 
 private:
-    DelayNode(AudioContext*, float sampleRate);
+    DelayNode(AudioContext*, float sampleRate, double maxDelayTime);
 
     DelayProcessor* delayProcessor() { return static_cast<DelayProcessor*>(processor()); }
 };
diff --git a/Source/WebCore/webaudio/DelayProcessor.cpp b/Source/WebCore/webaudio/DelayProcessor.cpp
index 8ed3e4337..b23e8ac1d 100644
--- a/Source/WebCore/webaudio/DelayProcessor.cpp
+++ b/Source/WebCore/webaudio/DelayProcessor.cpp
@@ -32,10 +32,11 @@
 
 namespace WebCore {
 
-DelayProcessor::DelayProcessor(float sampleRate, unsigned numberOfChannels)
+DelayProcessor::DelayProcessor(float sampleRate, unsigned numberOfChannels, double maxDelayTime)
     : AudioDSPKernelProcessor(sampleRate, numberOfChannels)
+    , m_maxDelayTime(maxDelayTime)
 {
-    m_delayTime = AudioParam::create("delayTime", 0.0, 0.0, 1.0);
+    m_delayTime = AudioParam::create("delayTime", 0.0, 0.0, maxDelayTime);
 }
 
 DelayProcessor::~DelayProcessor()
diff --git a/Source/WebCore/webaudio/DelayProcessor.h b/Source/WebCore/webaudio/DelayProcessor.h
index 15428ce75..43c5e0cbe 100644
--- a/Source/WebCore/webaudio/DelayProcessor.h
+++ b/Source/WebCore/webaudio/DelayProcessor.h
@@ -37,15 +37,17 @@ class AudioDSPKernel;
     
 class DelayProcessor : public AudioDSPKernelProcessor {
 public:
-    DelayProcessor(float sampleRate, unsigned numberOfChannels);
+    DelayProcessor(float sampleRate, unsigned numberOfChannels, double maxDelayTime);
     virtual ~DelayProcessor();
     
     virtual PassOwnPtr<AudioDSPKernel> createKernel();
         
     AudioParam* delayTime() const { return m_delayTime.get(); }
 
+    double maxDelayTime() { return m_maxDelayTime; }
 private:
     RefPtr<AudioParam> m_delayTime;
+    double m_maxDelayTime;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/webaudio/DynamicsCompressorNode.cpp b/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
index 263755595..5afe2d683 100644
--- a/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
+++ b/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
@@ -43,9 +43,19 @@ DynamicsCompressorNode::DynamicsCompressorNode(AudioContext* context, float samp
 {
     addInput(adoptPtr(new AudioNodeInput(this)));
     addOutput(adoptPtr(new AudioNodeOutput(this, defaultNumberOfOutputChannels)));
-    
+
     setNodeType(NodeTypeDynamicsCompressor);
-    
+
+    m_threshold = AudioParam::create("threshold", -24, -100, 0);
+    m_knee = AudioParam::create("knee", 30, 0, 40);
+    m_ratio = AudioParam::create("ratio", 12, 1, 20);
+    m_reduction = AudioParam::create("reduction", 0, -20, 0);
+
+    m_threshold->setContext(context);
+    m_knee->setContext(context);
+    m_ratio->setContext(context);
+    m_reduction->setContext(context);
+
     initialize();
 }
 
@@ -59,7 +69,18 @@ void DynamicsCompressorNode::process(size_t framesToProcess)
     AudioBus* outputBus = output(0)->bus();
     ASSERT(outputBus);
 
+    float threshold = m_threshold->value();
+    float knee = m_knee->value();
+    float ratio = m_ratio->value();
+
+    m_dynamicsCompressor->setParameterValue(DynamicsCompressor::ParamThreshold, threshold);
+    m_dynamicsCompressor->setParameterValue(DynamicsCompressor::ParamKnee, knee);
+    m_dynamicsCompressor->setParameterValue(DynamicsCompressor::ParamRatio, ratio);
+
     m_dynamicsCompressor->process(input(0)->bus(), outputBus, framesToProcess);
+
+    float reduction = m_dynamicsCompressor->parameterValue(DynamicsCompressor::ParamReduction);
+    m_reduction->setValue(reduction);
 }
 
 void DynamicsCompressorNode::reset()
diff --git a/Source/WebCore/webaudio/DynamicsCompressorNode.h b/Source/WebCore/webaudio/DynamicsCompressorNode.h
index d718ab341..32d3cb173 100644
--- a/Source/WebCore/webaudio/DynamicsCompressorNode.h
+++ b/Source/WebCore/webaudio/DynamicsCompressorNode.h
@@ -26,31 +26,44 @@
 #define DynamicsCompressorNode_h
 
 #include "AudioNode.h"
+#include "AudioParam.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
 class DynamicsCompressor;
-    
+
 class DynamicsCompressorNode : public AudioNode {
 public:
     static PassRefPtr<DynamicsCompressorNode> create(AudioContext* context, float sampleRate)
     {
-        return adoptRef(new DynamicsCompressorNode(context, sampleRate));      
+        return adoptRef(new DynamicsCompressorNode(context, sampleRate));
     }
-    
+
     virtual ~DynamicsCompressorNode();
-    
+
     // AudioNode
     virtual void process(size_t framesToProcess);
     virtual void reset();
     virtual void initialize();
     virtual void uninitialize();
 
+    // Static compression curve parameters.
+    AudioParam* threshold() { return m_threshold.get(); }
+    AudioParam* knee() { return m_knee.get(); }
+    AudioParam* ratio() { return m_ratio.get(); }
+
+    // Amount by which the compressor is currently compressing the signal in decibels.
+    AudioParam* reduction() { return m_reduction.get(); }
+
 private:
     DynamicsCompressorNode(AudioContext*, float sampleRate);
 
     OwnPtr<DynamicsCompressor> m_dynamicsCompressor;
+    RefPtr<AudioParam> m_threshold;
+    RefPtr<AudioParam> m_knee;
+    RefPtr<AudioParam> m_ratio;
+    RefPtr<AudioParam> m_reduction;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/webaudio/DynamicsCompressorNode.idl b/Source/WebCore/webaudio/DynamicsCompressorNode.idl
index faad13e3c..60d64fda0 100644
--- a/Source/WebCore/webaudio/DynamicsCompressorNode.idl
+++ b/Source/WebCore/webaudio/DynamicsCompressorNode.idl
@@ -27,5 +27,9 @@ module audio {
         Conditional=WEB_AUDIO,
         JSGenerateToJSObject
     ] DynamicsCompressorNode : AudioNode {
+        readonly attribute AudioParam threshold; // in Decibels
+        readonly attribute AudioParam knee; // in Decibels
+        readonly attribute AudioParam ratio; // unit-less
+        readonly attribute AudioParam reduction; // in Decibels
     };
 }
diff --git a/Source/WebCore/webaudio/JavaScriptAudioNode.idl b/Source/WebCore/webaudio/JavaScriptAudioNode.idl
index 83e3e6285..97da0c16d 100644
--- a/Source/WebCore/webaudio/JavaScriptAudioNode.idl
+++ b/Source/WebCore/webaudio/JavaScriptAudioNode.idl
@@ -28,9 +28,7 @@ module audio {
         Conditional=WEB_AUDIO,
         JSGenerateToJSObject,
         JSCustomMarkFunction,
-#if defined(V8_BINDING) && V8_BINDING
         EventTarget
-#endif
     ] JavaScriptAudioNode : AudioNode {
         // Rendering callback
         attribute EventListener onaudioprocess;
diff --git a/Source/WebCore/workers/DOMWindowWorker.idl b/Source/WebCore/workers/DOMWindowWorker.idl
deleted file mode 100644
index 80bb93a39..000000000
--- a/Source/WebCore/workers/DOMWindowWorker.idl
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    interface [
-        Supplemental=DOMWindow
-    ] DOMWindowWorker {
-        attribute [Conditional=WORKERS] WorkerConstructor Worker; // Usable with the new operator
-        attribute [Conditional=SHARED_WORKERS, JSCustomGetter, V8EnabledAtRuntime] SharedWorkerConstructor SharedWorker; // Usable with the new operator
-    };
-
-}
diff --git a/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp b/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
index 4ae30e4e3..773ccd95d 100644
--- a/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -298,7 +298,7 @@ void SharedWorkerScriptLoader::load(const KURL& url)
 
     // Mark this object as active for the duration of the load.
     m_scriptLoader = WorkerScriptLoader::create();
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
     m_scriptLoader->setTargetType(ResourceRequest::TargetIsSharedWorker);
 #endif
     m_scriptLoader->loadAsynchronously(m_worker->scriptExecutionContext(), url, DenyCrossOriginRequests, this);
diff --git a/Source/WebCore/workers/SharedWorker.idl b/Source/WebCore/workers/SharedWorker.idl
index d2152720e..40ccdd403 100644
--- a/Source/WebCore/workers/SharedWorker.idl
+++ b/Source/WebCore/workers/SharedWorker.idl
@@ -35,7 +35,6 @@ module threads {
         Conditional=SHARED_WORKERS,
         ActiveDOMObject,
         JSCustomConstructor,
-        ConstructorParameters=2,
         Constructor(in DOMString scriptURL, in [Optional=DefaultIsNullString] DOMString name),
         CallWith=ScriptExecutionContext,
         ConstructorRaisesException,
diff --git a/Source/WebCore/workers/Worker.cpp b/Source/WebCore/workers/Worker.cpp
index ec965a4e7..1d440f548 100644
--- a/Source/WebCore/workers/Worker.cpp
+++ b/Source/WebCore/workers/Worker.cpp
@@ -70,7 +70,7 @@ PassRefPtr<Worker> Worker::create(ScriptExecutionContext* context, const String&
     worker->setPendingActivity(worker.get());
 
     worker->m_scriptLoader = WorkerScriptLoader::create();
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
     worker->m_scriptLoader->setTargetType(ResourceRequest::TargetIsWorker);
 #endif
     worker->m_scriptLoader->loadAsynchronously(context, scriptURL, DenyCrossOriginRequests, worker.get());
diff --git a/Source/WebCore/workers/Worker.idl b/Source/WebCore/workers/Worker.idl
index 867d36710..083353c04 100644
--- a/Source/WebCore/workers/Worker.idl
+++ b/Source/WebCore/workers/Worker.idl
@@ -31,7 +31,6 @@ module threads {
         Conditional=WORKERS,
         ActiveDOMObject,
         JSCustomConstructor,
-        ConstructorParameters=1,
         Constructor(in DOMString scriptUrl),
         CallWith=ScriptExecutionContext,
         ConstructorRaisesException,
diff --git a/Source/WebCore/workers/WorkerContext.cpp b/Source/WebCore/workers/WorkerContext.cpp
index 0d68c4d65..debbeba3f 100644
--- a/Source/WebCore/workers/WorkerContext.cpp
+++ b/Source/WebCore/workers/WorkerContext.cpp
@@ -31,13 +31,8 @@
 
 #include "WorkerContext.h"
 
-#include "AbstractDatabase.h"
 #include "ActiveDOMObject.h"
 #include "ContentSecurityPolicy.h"
-#include "Database.h"
-#include "DatabaseCallback.h"
-#include "DatabaseSync.h"
-#include "DatabaseTracker.h"
 #include "DOMTimer.h"
 #include "DOMURL.h"
 #include "DOMWindow.h"
@@ -68,25 +63,7 @@
 #include "NotificationCenter.h"
 #endif
 
-#if ENABLE(FILE_SYSTEM)
-#include "AsyncFileSystem.h"
-#include "DirectoryEntrySync.h"
-#include "DOMFileSystem.h"
-#include "DOMFileSystemBase.h"
-#include "DOMFileSystemSync.h"
-#include "ErrorCallback.h"
-#include "FileEntrySync.h"
-#include "FileError.h"
-#include "FileException.h"
-#include "FileSystemCallback.h"
-#include "FileSystemCallbacks.h"
-#include "LocalFileSystem.h"
-#include "SyncCallbackHelper.h"
-#else
 #include "ExceptionCode.h"
-#endif
-
-#include "IDBFactory.h"
 
 namespace WebCore {
 
@@ -266,7 +243,7 @@ void WorkerContext::importScripts(const Vector<String>& urls, ExceptionCode& ec)
 
     for (Vector<KURL>::const_iterator it = completedURLs.begin(); it != end; ++it) {
         RefPtr<WorkerScriptLoader> scriptLoader(WorkerScriptLoader::create());
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
         scriptLoader->setTargetType(ResourceRequest::TargetIsScript);
 #endif
         scriptLoader->loadSynchronously(scriptExecutionContext(), *it, AllowCrossOriginRequests);
@@ -321,42 +298,11 @@ void WorkerContext::addMessageToWorkerConsole(MessageSource source, MessageType
 NotificationCenter* WorkerContext::webkitNotifications() const
 {
     if (!m_notifications)
-        m_notifications = NotificationCenter::create(scriptExecutionContext(), m_thread->getNotificationPresenter());
+        m_notifications = NotificationCenter::create(scriptExecutionContext(), m_thread->getNotificationClient());
     return m_notifications.get();
 }
 #endif
 
-#if ENABLE(SQL_DATABASE)
-PassRefPtr<Database> WorkerContext::openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
-{
-    if (!securityOrigin()->canAccessDatabase() || !AbstractDatabase::isAvailable()) {
-        ec = SECURITY_ERR;
-        return 0;
-    }
-
-    return Database::openDatabase(this, name, version, displayName, estimatedSize, creationCallback, ec);
-}
-
-void WorkerContext::databaseExceededQuota(const String&)
-{
-#if !PLATFORM(CHROMIUM)
-    // FIXME: This needs a real implementation; this is a temporary solution for testing.
-    const unsigned long long defaultQuota = 5 * 1024 * 1024;
-    DatabaseTracker::tracker().setQuota(securityOrigin(), defaultQuota);
-#endif
-}
-
-PassRefPtr<DatabaseSync> WorkerContext::openDatabaseSync(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
-{
-    if (!securityOrigin()->canAccessDatabase() || !AbstractDatabase::isAvailable()) {
-        ec = SECURITY_ERR;
-        return 0;
-    }
-
-    return DatabaseSync::openDatabaseSync(this, name, version, displayName, estimatedSize, creationCallback, ec);
-}
-#endif
-
 bool WorkerContext::isContextThread() const
 {
     return currentThread() == thread()->threadID();
@@ -377,93 +323,6 @@ EventTargetData* WorkerContext::ensureEventTargetData()
     return &m_eventTargetData;
 }
 
-#if ENABLE(FILE_SYSTEM)
-void WorkerContext::webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem()) {
-        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::SECURITY_ERR));
-        return;
-    }
-
-    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
-    if (!AsyncFileSystem::isValidType(fileSystemType)) {
-        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::INVALID_MODIFICATION_ERR));
-        return;
-    }
-
-    LocalFileSystem::localFileSystem().requestFileSystem(this, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, this), false);
-}
-
-PassRefPtr<DOMFileSystemSync> WorkerContext::webkitRequestFileSystemSync(int type, long long size, ExceptionCode& ec)
-{
-    ec = 0;
-    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem()) {
-        ec = FileException::SECURITY_ERR;
-        return 0;
-    }
-
-    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
-    if (!AsyncFileSystem::isValidType(fileSystemType)) {
-        ec = FileException::INVALID_MODIFICATION_ERR;
-        return 0;
-    }
-
-    FileSystemSyncCallbackHelper helper;
-    LocalFileSystem::localFileSystem().requestFileSystem(this, fileSystemType, size, FileSystemCallbacks::create(helper.successCallback(), helper.errorCallback(), this), true);
-    return helper.getResult(ec);
-}
-
-void WorkerContext::webkitResolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    KURL completedURL = completeURL(url);
-    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem() || !securityOrigin()->canRequest(completedURL)) {
-        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::SECURITY_ERR));
-        return;
-    }
-
-    AsyncFileSystem::Type type;
-    String filePath;
-    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
-        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::ENCODING_ERR));
-        return;
-    }
-
-    LocalFileSystem::localFileSystem().readFileSystem(this, type, ResolveURICallbacks::create(successCallback, errorCallback, this, filePath));
-}
-
-PassRefPtr<EntrySync> WorkerContext::webkitResolveLocalFileSystemSyncURL(const String& url, ExceptionCode& ec)
-{
-    ec = 0;
-    KURL completedURL = completeURL(url);
-    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem() || !securityOrigin()->canRequest(completedURL)) {
-        ec = FileException::SECURITY_ERR;
-        return 0;
-    }
-
-    AsyncFileSystem::Type type;
-    String filePath;
-    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
-        ec = FileException::ENCODING_ERR;
-        return 0;
-    }
-
-    FileSystemSyncCallbackHelper readFileSystemHelper;
-    LocalFileSystem::localFileSystem().readFileSystem(this, type, FileSystemCallbacks::create(readFileSystemHelper.successCallback(), readFileSystemHelper.errorCallback(), this), true);
-    RefPtr<DOMFileSystemSync> fileSystem = readFileSystemHelper.getResult(ec);
-    if (!fileSystem)
-        return 0;
-
-    RefPtr<EntrySync> entry = fileSystem->root()->getDirectory(filePath, 0, ec);
-    if (ec == FileException::TYPE_MISMATCH_ERR)
-        return fileSystem->root()->getFile(filePath, 0, ec);
-
-    return entry.release();
-}
-
-COMPILE_ASSERT(static_cast<int>(WorkerContext::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
-COMPILE_ASSERT(static_cast<int>(WorkerContext::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
-#endif
-
 WorkerContext::Observer::Observer(WorkerContext* context)
     : m_context(context)
 {
@@ -511,19 +370,6 @@ void WorkerContext::notifyObserversOfStop()
     }
 }
 
-#if ENABLE(INDEXED_DATABASE)
-IDBFactory* WorkerContext::webkitIndexedDB() const
-{
-    if (!securityOrigin()->canAccessDatabase())
-        return 0;
-    if (!m_idbFactoryBackendInterface)
-        m_idbFactoryBackendInterface = IDBFactoryBackendInterface::create();
-    if (!m_idbFactory)
-        m_idbFactory = IDBFactory::create(m_idbFactoryBackendInterface.get());
-    return m_idbFactory.get();
-}
-#endif
-
 WorkerEventQueue* WorkerContext::eventQueue() const
 {
     return m_eventQueue.get();
diff --git a/Source/WebCore/workers/WorkerContext.h b/Source/WebCore/workers/WorkerContext.h
index 25ca63b8a..f045a4819 100644
--- a/Source/WebCore/workers/WorkerContext.h
+++ b/Source/WebCore/workers/WorkerContext.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  */
 
@@ -47,16 +47,7 @@
 namespace WebCore {
 
     class Blob;
-    class DOMFileSystemSync;
     class DOMURL;
-    class Database;
-    class DatabaseCallback;
-    class DatabaseSync;
-    class EntryCallback;
-    class EntrySync;
-    class ErrorCallback;
-    class FileSystemCallback;
-    class IDBFactory;
     class NotificationCenter;
     class ScheduledAction;
     class WorkerInspectorController;
@@ -118,29 +109,9 @@ namespace WebCore {
         NotificationCenter* webkitNotifications() const;
 #endif
 
-#if ENABLE(SQL_DATABASE)
-        // HTML 5 client-side database
-        PassRefPtr<Database> openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
-        PassRefPtr<DatabaseSync> openDatabaseSync(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
-
-        // Not implemented yet.
-        virtual bool allowDatabaseAccess() const { return true; }
-        // Not implemented for real yet.
-        virtual void databaseExceededQuota(const String&);
-#endif
         virtual bool isContextThread() const;
         virtual bool isJSExecutionForbidden() const;
 
-#if ENABLE(FILE_SYSTEM)
-        enum FileSystemType {
-            TEMPORARY,
-            PERSISTENT,
-        };
-        void webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback>);
-        PassRefPtr<DOMFileSystemSync> webkitRequestFileSystemSync(int type, long long size, ExceptionCode&);
-        void webkitResolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback>);
-        PassRefPtr<EntrySync> webkitResolveLocalFileSystemSyncURL(const String& url, ExceptionCode&);
-#endif
 #if ENABLE(INSPECTOR)
         WorkerInspectorController* workerInspectorController() { return m_workerInspectorController.get(); }
 #endif
@@ -169,9 +140,6 @@ namespace WebCore {
         void registerObserver(Observer*);
         void unregisterObserver(Observer*);
         void notifyObserversOfStop();
-#if ENABLE(INDEXED_DATABASE)
-        IDBFactory* webkitIndexedDB() const;
-#endif
 
     protected:
         WorkerContext(const KURL&, const String&, WorkerThread*, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
@@ -219,12 +187,6 @@ namespace WebCore {
         HashSet<Observer*> m_workerObservers;
 
         OwnPtr<WorkerEventQueue> m_eventQueue;
-
-#if ENABLE(INDEXED_DATABASE)
-        mutable RefPtr<IDBFactory> m_idbFactory;
-        mutable RefPtr<IDBFactoryBackendInterface> m_idbFactoryBackendInterface;
-#endif
-
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/workers/WorkerContext.idl b/Source/WebCore/workers/WorkerContext.idl
index a5408d785..930c2d0ad 100644
--- a/Source/WebCore/workers/WorkerContext.idl
+++ b/Source/WebCore/workers/WorkerContext.idl
@@ -50,12 +50,6 @@ module threads {
         // WorkerUtils
         [Custom] void importScripts(/*[Variadic] in DOMString urls */);
                  attribute [Replaceable] WorkerNavigator navigator;
-#if defined(ENABLE_SQL_DATABASE) && ENABLE_SQL_DATABASE
-        [V8EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
-            raises(DOMException);
-        [V8EnabledAtRuntime] DatabaseSync openDatabaseSync(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
-            raises(DOMException);
-#endif
 
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
@@ -104,18 +98,6 @@ module threads {
 
         attribute [Conditional=BLOB] DOMURLConstructor webkitURL;
 
-#if defined(ENABLE_FILE_SYSTEM) && ENABLE_FILE_SYSTEM
-        const unsigned short TEMPORARY = 0;
-        const unsigned short PERSISTENT = 1;
-        [V8EnabledAtRuntime=FileSystem] void webkitRequestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-        [V8EnabledAtRuntime=FileSystem] DOMFileSystemSync webkitRequestFileSystemSync(in unsigned short type, in long long size) raises (FileException);
-        [V8EnabledAtRuntime=FileSystem] void webkitResolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-        [V8EnabledAtRuntime=FileSystem] EntrySync webkitResolveLocalFileSystemSyncURL(in DOMString url) raises (FileException);
-
-                 attribute [V8EnabledAtRuntime=FileSystem] FileErrorConstructor FileError;
-                 attribute [V8EnabledAtRuntime=FileSystem] FileExceptionConstructor FileException;
-#endif
-
         attribute ArrayBufferConstructor ArrayBuffer; // Usable with new operator
         attribute Int8ArrayConstructor Int8Array; // Usable with new operator
         attribute Uint8ArrayConstructor Uint8Array; // Usable with new operator
@@ -127,20 +109,6 @@ module threads {
         attribute Float32ArrayConstructor Float32Array; // Usable with new operator
         attribute Float64ArrayConstructor Float64Array; // Usable with new operator
         attribute DataViewConstructor DataView; // Usable with new operator
-#if defined(ENABLE_INDEXED_DATABASE) && ENABLE_INDEXED_DATABASE
-        readonly attribute [V8EnabledAtRuntime] IDBFactory webkitIndexedDB;
-
-        attribute [V8EnabledAtRuntime] IDBCursorConstructor webkitIDBCursor;
-        attribute [V8EnabledAtRuntime] IDBDatabaseConstructor webkitIDBDatabase;
-        attribute [V8EnabledAtRuntime] IDBDatabaseErrorConstructor webkitIDBDatabaseError;
-        attribute [V8EnabledAtRuntime] IDBDatabaseExceptionConstructor webkitIDBDatabaseException;
-        attribute [V8EnabledAtRuntime] IDBFactoryConstructor webkitIDBFactory;
-        attribute [V8EnabledAtRuntime] IDBIndexConstructor webkitIDBIndex;
-        attribute [V8EnabledAtRuntime] IDBKeyRangeConstructor webkitIDBKeyRange;
-        attribute [V8EnabledAtRuntime] IDBObjectStoreConstructor webkitIDBObjectStore;
-        attribute [V8EnabledAtRuntime] IDBRequestConstructor webkitIDBRequest;
-        attribute [V8EnabledAtRuntime] IDBTransactionConstructor webkitIDBTransaction;
-#endif
     };
 
 }
diff --git a/Source/WebCore/workers/WorkerScriptLoader.cpp b/Source/WebCore/workers/WorkerScriptLoader.cpp
index 95476f878..3296f4e54 100644
--- a/Source/WebCore/workers/WorkerScriptLoader.cpp
+++ b/Source/WebCore/workers/WorkerScriptLoader.cpp
@@ -109,7 +109,7 @@ PassOwnPtr<ResourceRequest> WorkerScriptLoader::createResourceRequest()
 {
     OwnPtr<ResourceRequest> request = adoptPtr(new ResourceRequest(m_url));
     request->setHTTPMethod("GET");
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
     request->setTargetType(m_targetType);
 #endif
     return request.release();
diff --git a/Source/WebCore/workers/WorkerScriptLoader.h b/Source/WebCore/workers/WorkerScriptLoader.h
index d6e7de37b..85c4ea81f 100644
--- a/Source/WebCore/workers/WorkerScriptLoader.h
+++ b/Source/WebCore/workers/WorkerScriptLoader.h
@@ -72,7 +72,7 @@ namespace WebCore {
         virtual void didFail(const ResourceError&);
         virtual void didFailRedirectCheck();
 
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
         void setTargetType(ResourceRequest::TargetType targetType) { m_targetType = targetType; }
 #endif
 
diff --git a/Source/WebCore/workers/WorkerThread.cpp b/Source/WebCore/workers/WorkerThread.cpp
index 34cf909ff..d2e23a87d 100644
--- a/Source/WebCore/workers/WorkerThread.cpp
+++ b/Source/WebCore/workers/WorkerThread.cpp
@@ -30,6 +30,7 @@
 
 #include "WorkerThread.h"
 
+#include "DatabaseContext.h"
 #include "DedicatedWorkerContext.h"
 #include "InspectorInstrumentation.h"
 #include "KURL.h"
@@ -96,7 +97,7 @@ WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const
     , m_workerReportingProxy(workerReportingProxy)
     , m_startupData(WorkerThreadStartupData::create(scriptURL, userAgent, sourceCode, startMode, contentSecurityPolicy, contentSecurityPolicyType))
 #if ENABLE(NOTIFICATIONS)
-    , m_notificationPresenter(0)
+    , m_notificationClient(0)
 #endif
 {
     MutexLocker lock(threadCountMutex());
@@ -215,8 +216,9 @@ public:
         WorkerContext* workerContext = static_cast<WorkerContext*>(context);
 
 #if ENABLE(SQL_DATABASE)
+        // FIXME: Should we stop the databases as part of stopActiveDOMObjects() below?
         DatabaseTaskSynchronizer cleanupSync;
-        workerContext->stopDatabases(&cleanupSync);
+        DatabaseContext::stopDatabases(workerContext, &cleanupSync);
 #endif
 
         workerContext->stopActiveDOMObjects();
diff --git a/Source/WebCore/workers/WorkerThread.h b/Source/WebCore/workers/WorkerThread.h
index e3a11df00..cbe5a7178 100644
--- a/Source/WebCore/workers/WorkerThread.h
+++ b/Source/WebCore/workers/WorkerThread.h
@@ -39,7 +39,7 @@
 namespace WebCore {
 
     class KURL;
-    class NotificationPresenter;
+    class NotificationClient;
     class WorkerContext;
     class WorkerLoaderProxy;
     class WorkerReportingProxy;
@@ -63,8 +63,8 @@ namespace WebCore {
         static unsigned workerThreadCount();
 
 #if ENABLE(NOTIFICATIONS)
-        NotificationPresenter* getNotificationPresenter() { return m_notificationPresenter; }
-        void setNotificationPresenter(NotificationPresenter* presenter) { m_notificationPresenter = presenter; }
+        NotificationClient* getNotificationClient() { return m_notificationClient; }
+        void setNotificationClient(NotificationClient* client) { m_notificationClient = client; }
 #endif
 
     protected:
@@ -94,7 +94,7 @@ namespace WebCore {
         OwnPtr<WorkerThreadStartupData> m_startupData;
 
 #if ENABLE(NOTIFICATIONS)
-        NotificationPresenter* m_notificationPresenter;
+        NotificationClient* m_notificationClient;
 #endif
 
         // Track the number of WorkerThread instances for use in layout tests.
diff --git a/Source/WebCore/xml/DOMWindowXML.idl b/Source/WebCore/xml/DOMWindowXML.idl
deleted file mode 100644
index e527350ca..000000000
--- a/Source/WebCore/xml/DOMWindowXML.idl
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    interface [
-        Supplemental=DOMWindow
-    ] DOMWindowXML {
-        // Mozilla has a separate XMLDocument object for XML documents. 
-        // We just use Document for this.
-        attribute DocumentConstructor XMLDocument;
-        attribute DOMParserConstructor DOMParser;
-        attribute XMLSerializerConstructor XMLSerializer;
-        attribute XMLHttpRequestConstructor XMLHttpRequest; // Usable with the new operator
-        attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
-        attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
-        attribute XMLHttpRequestProgressEventConstructor XMLHttpRequestProgressEvent;
-        attribute [Conditional=XSLT] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
-    };
-
-}
diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
index 7ed8212ee..e3fb9d1c0 100644
--- a/Source/WebCore/xml/XMLHttpRequest.cpp
+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
@@ -23,6 +23,7 @@
 #include "XMLHttpRequest.h"
 
 #include "Blob.h"
+#include "BlobData.h"
 #include "ContentSecurityPolicy.h"
 #include "CrossOriginAccessControl.h"
 #include "DOMFormData.h"
@@ -262,12 +263,37 @@ Document* XMLHttpRequest::responseXML(ExceptionCode& ec)
 }
 
 #if ENABLE(XHR_RESPONSE_BLOB)
-Blob* XMLHttpRequest::responseBlob(ExceptionCode& ec) const
+Blob* XMLHttpRequest::responseBlob(ExceptionCode& ec)
 {
     if (m_responseTypeCode != ResponseTypeBlob) {
         ec = INVALID_STATE_ERR;
         return 0;
     }
+    // We always return null before DONE.
+    if (m_state != DONE)
+        return 0;
+
+    if (!m_responseBlob.get()) {
+        // FIXME: This causes two (or more) unnecessary copies of the data.
+        // Chromium stores blob data in the browser process, so we're pulling the data
+        // from the network only to copy it into the renderer to copy it back to the browser.
+        // Ideally we'd get the blob/file-handle from the ResourceResponse directly
+        // instead of copying the bytes. Embedders who store blob data in the
+        // same process as WebCore would at least to teach BlobData to take
+        // a SharedBuffer, even if they don't get the Blob from the network layer directly.
+        OwnPtr<BlobData> blobData = BlobData::create();
+        // If we errored out or got no data, we still return a blob, just an empty one.
+        if (m_binaryResponseBuilder.get()) {
+            RefPtr<RawData> rawData = RawData::create();
+            size_t size = m_binaryResponseBuilder->size();
+            rawData->mutableData()->append(m_binaryResponseBuilder->data(), size);
+            blobData->appendData(rawData, 0, BlobDataItem::toEndOfFile);
+            blobData->setContentType(responseMIMEType()); // responseMIMEType defaults to text/xml which may be incorrect.
+            m_binaryResponseBuilder.clear();
+        }
+        m_responseBlob = Blob::create(blobData.release(), m_binaryResponseBuilder.get() ? m_binaryResponseBuilder->size() : 0);
+    }
+
     return m_responseBlob.get();
 }
 #endif
@@ -287,10 +313,7 @@ ArrayBuffer* XMLHttpRequest::responseArrayBuffer(ExceptionCode& ec)
         m_binaryResponseBuilder.clear();
     }
 
-    if (m_responseArrayBuffer.get())
-        return m_responseArrayBuffer.get();
-
-    return 0;
+    return m_responseArrayBuffer.get();
 }
 
 void XMLHttpRequest::setResponseType(const String& responseType, ExceptionCode& ec)
@@ -530,7 +553,7 @@ void XMLHttpRequest::send(Document* document, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolIsInHTTPFamily()) {
         String contentType = getRequestHeader("Content-Type");
         if (contentType.isEmpty()) {
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -561,7 +584,7 @@ void XMLHttpRequest::send(const String& body, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (!body.isNull() && m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
+    if (!body.isNull() && m_method != "GET" && m_method != "HEAD" && m_url.protocolIsInHTTPFamily()) {
         String contentType = getRequestHeader("Content-Type");
         if (contentType.isEmpty()) {
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -588,7 +611,7 @@ void XMLHttpRequest::send(Blob* body, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolIsInHTTPFamily()) {
         // FIXME: Should we set a Content-Type if one is not set.
         // FIXME: add support for uploading bundles.
         m_requestEntityBody = FormData::create();
@@ -608,7 +631,7 @@ void XMLHttpRequest::send(DOMFormData* body, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolIsInHTTPFamily()) {
         m_requestEntityBody = FormData::createMultiPart(*(static_cast<FormDataList*>(body)), body->encoding(), document());
 
         // We need to ask the client to provide the generated file names if needed. When FormData fills the element
@@ -631,7 +654,7 @@ void XMLHttpRequest::send(ArrayBuffer* body, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolIsInHTTPFamily()) {
         m_requestEntityBody = FormData::create(body->data(), body->byteLength());
         if (m_upload)
             m_requestEntityBody->setAlwaysStream(true);
@@ -1033,10 +1056,6 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier, double)
 
     m_responseBuilder.shrinkToFit();
 
-#if ENABLE(XHR_RESPONSE_BLOB)
-    // FIXME: Set m_responseBlob to something here in the ResponseTypeBlob case.
-#endif
-
     InspectorInstrumentation::resourceRetrievedByXMLHttpRequest(scriptExecutionContext(), identifier, m_responseBuilder.toStringPreserveCapacity(), m_url, m_lastSendURL, m_lastSendLineNumber);
 
     bool hadLoader = m_loader;
@@ -1106,7 +1125,11 @@ void XMLHttpRequest::didReceiveData(const char* data, int len)
 
     if (useDecoder)
         m_responseBuilder.append(m_decoder->decode(data, len));
-    else if (m_responseTypeCode == ResponseTypeArrayBuffer) {
+    else if (m_responseTypeCode == ResponseTypeArrayBuffer
+#if ENABLE(XHR_RESPONSE_BLOB)
+             || m_responseTypeCode == ResponseTypeBlob
+#endif
+             ) {
         // Buffer binary data.
         if (!m_binaryResponseBuilder)
             m_binaryResponseBuilder = SharedBuffer::create();
diff --git a/Source/WebCore/xml/XMLHttpRequest.h b/Source/WebCore/xml/XMLHttpRequest.h
index 26ee65ceb..1373fe7bf 100644
--- a/Source/WebCore/xml/XMLHttpRequest.h
+++ b/Source/WebCore/xml/XMLHttpRequest.h
@@ -106,7 +106,7 @@ public:
     Document* responseXML(ExceptionCode&);
     Document* optionalResponseXML() const { return m_responseDocument.get(); }
 #if ENABLE(XHR_RESPONSE_BLOB)
-    Blob* responseBlob(ExceptionCode&) const;
+    Blob* responseBlob(ExceptionCode&);
     Blob* optionalResponseBlob() const { return m_responseBlob.get(); }
 #endif
 
diff --git a/Source/WebCore/xml/parser/MarkupTokenBase.h b/Source/WebCore/xml/parser/MarkupTokenBase.h
index 986538b8d..2a0aa3050 100644
--- a/Source/WebCore/xml/parser/MarkupTokenBase.h
+++ b/Source/WebCore/xml/parser/MarkupTokenBase.h
@@ -27,7 +27,7 @@
 #ifndef MarkupTokenBase_h
 #define MarkupTokenBase_h
 
-#include "NamedNodeMap.h"
+#include "ElementAttributeData.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
@@ -410,7 +410,7 @@ public:
         }
     }
 
-    AtomicMarkupTokenBase(typename Token::Type::Type type, AtomicString name, PassOwnPtr<NamedNodeMap> attributes = nullptr)
+    AtomicMarkupTokenBase(typename Token::Type::Type type, AtomicString name, PassOwnPtr<AttributeVector> attributes = nullptr)
         : m_type(type)
         , m_name(name)
         , m_attributes(attributes)
@@ -446,13 +446,13 @@ public:
         return m_attributes->getAttributeItem(attributeName);
     }
 
-    NamedNodeMap* attributes() const
+    AttributeVector* attributes() const
     {
         ASSERT(usesAttributes());
         return m_attributes.get();
     }
 
-    PassOwnPtr<NamedNodeMap> takeAttributes()
+    PassOwnPtr<AttributeVector> takeAttributes()
     {
         ASSERT(usesAttributes());
         return m_attributes.release();
@@ -516,7 +516,7 @@ protected:
     // For StartTag and EndTag
     bool m_selfClosing;
 
-    OwnPtr<NamedNodeMap> m_attributes;
+    OwnPtr<AttributeVector> m_attributes;
 };
 
 template<typename Token>
@@ -526,7 +526,7 @@ inline void AtomicMarkupTokenBase<Token>::initializeAttributes(const typename To
     if (!size)
         return;
 
-    m_attributes = NamedNodeMap::create();
+    m_attributes = AttributeVector::create();
     m_attributes->reserveInitialCapacity(size);
     for (size_t i = 0; i < size; ++i) {
         const typename Token::Attribute& attribute = attributes[i];
@@ -541,7 +541,7 @@ inline void AtomicMarkupTokenBase<Token>::initializeAttributes(const typename To
         ASSERT(attribute.m_valueRange.m_end);
 
         AtomicString value(attribute.m_value.data(), attribute.m_value.size());
-        m_attributes->insertAttribute(Attribute::create(nameForAttribute(attribute), value), false);
+        m_attributes->insertAttribute(Attribute::create(nameForAttribute(attribute), value));
     }
 }
 
diff --git a/Source/WebCore/xml/parser/XMLToken.h b/Source/WebCore/xml/parser/XMLToken.h
index d1bdc0e6b..1ed16ca9b 100644
--- a/Source/WebCore/xml/parser/XMLToken.h
+++ b/Source/WebCore/xml/parser/XMLToken.h
@@ -431,7 +431,7 @@ public:
         }
     }
 
-    AtomicXMLToken(XMLTokenTypes::Type type, AtomicString name, PassOwnPtr<NamedNodeMap> attributes = nullptr)
+    AtomicXMLToken(XMLTokenTypes::Type type, AtomicString name, PassOwnPtr<AttributeVector> attributes = nullptr)
         : AtomicMarkupTokenBase<XMLToken>(type, name, attributes)
     {
     }
diff --git a/Source/WebCore/xml/parser/XMLTreeBuilder.cpp b/Source/WebCore/xml/parser/XMLTreeBuilder.cpp
index 0c2b2d6a0..81793ed6d 100644
--- a/Source/WebCore/xml/parser/XMLTreeBuilder.cpp
+++ b/Source/WebCore/xml/parser/XMLTreeBuilder.cpp
@@ -301,7 +301,7 @@ void XMLTreeBuilder::processNamespaces(const AtomicXMLToken& token, NodeStackIte
     if (!token.attributes())
         return;
 
-    for (size_t i = 0; i < token.attributes()->length(); ++i) {
+    for (size_t i = 0; i < token.attributes()->size(); ++i) {
         Attribute* attribute = token.attributes()->attributeItem(i);
         if (attribute->name().prefix() == xmlnsAtom)
             stackItem.setNamespaceURI(attribute->name().localName(), attribute->value());
@@ -315,7 +315,7 @@ void XMLTreeBuilder::processAttributes(const AtomicXMLToken& token, NodeStackIte
     if (!token.attributes())
         return;
 
-    for (size_t i = 0; i < token.attributes()->length(); ++i) {
+    for (size_t i = 0; i < token.attributes()->size(); ++i) {
         Attribute* attribute = token.attributes()->attributeItem(i);
         ExceptionCode ec = 0;
         if (attribute->name().prefix() == xmlnsAtom)
diff --git a/Source/WebKit/CMakeLists.txt b/Source/WebKit/CMakeLists.txt
index 8bf565edc..62f4b3116 100644
--- a/Source/WebKit/CMakeLists.txt
+++ b/Source/WebKit/CMakeLists.txt
@@ -1,6 +1,7 @@
 SET(WebKit_INCLUDE_DIRECTORIES
     "${WEBKIT_DIR}"
     "${WEBCORE_DIR}"
+    "${WEBCORE_DIR}/Modules/webdatabase"
     "${WEBCORE_DIR}/accessibility"
     "${WEBCORE_DIR}/bindings/js"
     "${WEBCORE_DIR}/bindings"
@@ -74,6 +75,7 @@ INCLUDE_DIRECTORIES(${WebKit_INCLUDE_DIRECTORIES})
 ADD_LIBRARY(${WebKit_LIBRARY_NAME} ${WebKit_LIBRARY_TYPE} ${WebKit_SOURCES})
 ADD_DEPENDENCIES(${WebKit_LIBRARY_NAME} ${WebCore_LIBRARY_NAME})
 TARGET_LINK_LIBRARIES(${WebKit_LIBRARY_NAME} ${WebKit_LIBRARIES})
+SET_TARGET_PROPERTIES(${WebKit_LIBRARY_NAME} PROPERTIES LINK_INTERFACE_LIBRARIES "")
 
 IF (WebKit_LINK_FLAGS)
     ADD_TARGET_PROPERTIES(${WebKit_LIBRARY_NAME} LINK_FLAGS "${WebKit_LINK_FLAGS}")
@@ -84,4 +86,4 @@ IF (VERSION_SCRIPT)
 ENDIF ()
 
 SET_TARGET_PROPERTIES(${WebKit_LIBRARY_NAME} PROPERTIES VERSION ${PROJECT_VERSION} SOVERSION ${PROJECT_VERSION_MAJOR})
-INSTALL(TARGETS ${WebKit_LIBRARY_NAME} DESTINATION lib)
+INSTALL(TARGETS ${WebKit_LIBRARY_NAME} DESTINATION "${LIB_INSTALL_DIR}")
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index c95efcf3c..4f1cf58b9 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,65 @@
+2012-03-11  Timothy Hatcher  <timothy@apple.com>
+
+        Update how the Web Inspector resources are loaded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=80798
+        rdar://problem/10359959
+
+        Reviewed by Brian Weinstein.
+
+        * WebKit.xcodeproj/project.pbxproj: Add a framework.
+
+2012-03-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Make the removal of transitive library dependencies work with CMake < 2.8.7.
+        https://bugs.webkit.org/show_bug.cgi?id=80469
+
+        Reviewed by Antonio Gomes.
+
+        * CMakeLists.txt: Manually set the LINK_INTERFACE_LIBRARIES target
+        property on the library being created.
+
+2012-03-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Unreviewed; fix the build after r109877.
+
+        * CMakeLists.txt: Add WebCore/Modules/webdatabase to the list of
+        include directories so that #include'ing DatabaseDetails.h and
+        friends still works.
+
+2012-03-04  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>
+
+        [BlackBerry] upstream CredentialManager and CredentialTransformData implementation
+        https://bugs.webkit.org/show_bug.cgi?id=80107
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream of CredentialManager.[h|cpp] and
+        CredentialTransformData.[h|cpp].
+        No new test.
+
+        * PlatformBlackBerry.cmake:
+
+2012-03-04  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Libraries are installed to /usr/lib and not /usr/lib64 on x86_64
+        https://bugs.webkit.org/show_bug.cgi?id=71507
+
+        Reviewed by Antonio Gomes.
+
+        * CMakeLists.txt: Use ${LIB_INSTALL_DIR} instead of hardcoding "lib".
+
+2012-02-24  Grzegorz Czajkowski  <g.czajkowski@samsung.com>
+
+        [EFL][DRT] Implement setValueForUser and setAutofilled.
+        https://bugs.webkit.org/show_bug.cgi?id=79237
+
+        Reviewed by Andreas Kling.
+
+        Adds the main directory of WebKit's source to find headers of JavaScriptCore.
+
+        * PlatformEfl.cmake:
+
 2012-02-23  Patrick Gansterer  <paroga@webkit.org>
 
         [CMake] Add WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS macro
diff --git a/Source/WebKit/PlatformBlackBerry.cmake b/Source/WebKit/PlatformBlackBerry.cmake
index 5d5c8b352..b0d07546a 100644
--- a/Source/WebKit/PlatformBlackBerry.cmake
+++ b/Source/WebKit/PlatformBlackBerry.cmake
@@ -51,6 +51,8 @@ LIST(APPEND WebKit_SOURCES
     blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
     blackberry/WebCoreSupport/ClientExtension.cpp
     blackberry/WebCoreSupport/ContextMenuClientBlackBerry.cpp
+    blackberry/WebCoreSupport/CredentialManager.cpp
+    blackberry/WebCoreSupport/CredentialTransformData.cpp
     blackberry/WebCoreSupport/DeviceMotionClientBlackBerry.cpp
     blackberry/WebCoreSupport/DeviceOrientationClientBlackBerry.cpp
     blackberry/WebCoreSupport/DragClientBlackBerry.cpp
diff --git a/Source/WebKit/PlatformEfl.cmake b/Source/WebKit/PlatformEfl.cmake
index daf22876e..1debe3684 100644
--- a/Source/WebKit/PlatformEfl.cmake
+++ b/Source/WebKit/PlatformEfl.cmake
@@ -6,8 +6,10 @@ LIST(APPEND WebKit_LINK_FLAGS
 )
 
 LIST(APPEND WebKit_INCLUDE_DIRECTORIES
+    "${CMAKE_SOURCE_DIR}/Source"
     "${WEBKIT_DIR}/efl/ewk"
     "${WEBKIT_DIR}/efl/WebCoreSupport"
+    "${JAVASCRIPTCORE_DIR}/ForwardingHeaders"
     "${JAVASCRIPTCORE_DIR}/wtf/gobject"
     "${WEBCORE_DIR}/platform/efl"
     "${WEBCORE_DIR}/platform/graphics/cairo"
diff --git a/Source/WebKit/blackberry/Api/BackingStore.cpp b/Source/WebKit/blackberry/Api/BackingStore.cpp
index 2971d2698..0df6137c6 100644
--- a/Source/WebKit/blackberry/Api/BackingStore.cpp
+++ b/Source/WebKit/blackberry/Api/BackingStore.cpp
@@ -201,6 +201,10 @@ BackingStorePrivate::BackingStorePrivate()
     , m_currentWindowBackBuffer(0)
     , m_preferredTileMatrixDimension(Vertical)
     , m_blitGeneration(-1)
+#if USE(ACCELERATED_COMPOSITING)
+    , m_needsDrawLayersOnCommit(false)
+    , m_isDirectRenderingAnimationMessageScheduled(false)
+#endif
 {
     m_frontState = reinterpret_cast<unsigned>(new BackingStoreGeometry);
     m_backState = reinterpret_cast<unsigned>(new BackingStoreGeometry);
@@ -464,10 +468,12 @@ void BackingStorePrivate::renderOnTimer(WebCore::Timer<BackingStorePrivate>*)
     while (m_renderQueue->hasCurrentVisibleZoomJob() || m_renderQueue->hasCurrentVisibleScrollJob())
         m_renderQueue->render(!m_suspendRegularRenderJobs);
 
-    if (!shouldPerformRegularRenderJobs() || !m_renderQueue->hasCurrentRegularRenderJob())
-        return;
+    if (shouldPerformRegularRenderJobs() && m_renderQueue->hasCurrentRegularRenderJob())
+        m_renderQueue->renderAllCurrentRegularRenderJobs();
 
-    m_renderQueue->renderAllCurrentRegularRenderJobs();
+#if USE(ACCELERATED_COMPOSITING)
+    drawLayersOnCommitIfNeeded();
+#endif
 }
 
 void BackingStorePrivate::renderOnIdle()
@@ -483,6 +489,10 @@ void BackingStorePrivate::renderOnIdle()
 #endif
 
     m_renderQueue->render(!m_suspendRegularRenderJobs);
+
+#if USE(ACCELERATED_COMPOSITING)
+    drawLayersOnCommitIfNeeded();
+#endif
 }
 
 bool BackingStorePrivate::willFireTimer()
@@ -512,6 +522,10 @@ bool BackingStorePrivate::willFireTimer()
     if (m_renderQueue->hasCurrentRegularRenderJob())
         m_renderQueue->renderAllCurrentRegularRenderJobs();
 
+#if USE(ACCELERATED_COMPOSITING)
+    drawLayersOnCommitIfNeeded();
+#endif
+
     // Let the caller yield and reschedule the timer.
     return false;
 }
@@ -932,7 +946,6 @@ bool BackingStorePrivate::renderDirectToWindow(const Platform::IntRect& rect)
 
     Platform::IntRect screenRect = m_client->mapFromTransformedContentsToTransformedViewport(dirtyRect);
     windowFrontBufferState()->clearBlittedRegion(screenRect);
-    copyPreviousContentsToBackSurfaceOfWindow();
 
     paintDefaultBackground(dirtyRect, TransformationMatrix(), true /*flush*/);
 
@@ -941,10 +954,14 @@ bool BackingStorePrivate::renderDirectToWindow(const Platform::IntRect& rect)
     renderContents(0, origin, dirtyRect);
     windowBackBufferState()->addBlittedRegion(screenRect);
 
-#if USE(ACCELERATED_COMPOSITING) && ENABLE_COMPOSITING_SURFACE
-    if (m_webPage->d->m_client->window()->windowUsage() != BlackBerry::Platform::Graphics::Window::GLES2Usage) {
-        Platform::IntRect clippedRect = intersection(dirtyRect, visibleContentsRect());
-        blendCompositingSurface(clippedRect);
+#if USE(ACCELERATED_COMPOSITING)
+    m_isDirectRenderingAnimationMessageScheduled = false;
+
+    if (m_webPage->d->isAcceleratedCompositingActive()) {
+        BlackBerry::Platform::userInterfaceThreadMessageClient()->dispatchSyncMessage(
+            BlackBerry::Platform::createMethodCallMessage(
+                &BackingStorePrivate::drawAndBlendLayersForDirectRendering,
+                this, dirtyRect));
     }
 #endif
 
@@ -979,8 +996,6 @@ bool BackingStorePrivate::render(const Platform::IntRect& rect)
     TileMap currentMap = currentState->tileMap();
 
     Platform::IntRect dirtyContentsRect;
-    const Platform::IntRect contentsRect = Platform::IntRect(Platform::IntPoint(0, 0), m_client->transformedContentsSize());
-    const Platform::IntRect viewportRect = Platform::IntRect(Platform::IntPoint(0, 0), m_client->transformedViewportSize());
 
     for (size_t i = 0; i < tileRectList.size(); ++i) {
         TileRect tileRect = tileRectList[i];
@@ -1106,6 +1121,11 @@ void BackingStorePrivate::blitVisibleContents(bool force)
     }
 
     if (!BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread()) {
+#if USE(ACCELERATED_COMPOSITING)
+        // The blit will call drawSubLayers if necessary
+        m_needsDrawLayersOnCommit = false;
+#endif
+
         BlackBerry::Platform::userInterfaceThreadMessageClient()->dispatchMessage(
             BlackBerry::Platform::createMethodCallMessage(
                 &BackingStorePrivate::blitVisibleContents, this, force));
@@ -1196,6 +1216,11 @@ void BackingStorePrivate::blitContents(const Platform::IntRect& dstRect,
     }
 
     if (!BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread()) {
+#if USE(ACCELERATED_COMPOSITING)
+        // The blit will call drawSubLayers if necessary
+        m_needsDrawLayersOnCommit = false;
+#endif
+
         BlackBerry::Platform::userInterfaceThreadMessageClient()->dispatchMessage(
             BlackBerry::Platform::createMethodCallMessage(
                 &BackingStorePrivate::blitContents, this, dstRect, srcRect, force));
@@ -2069,13 +2094,13 @@ Platform::IntSize BackingStorePrivate::expandedContentsSize() const
 
 int BackingStorePrivate::tileWidth()
 {
-    static int tileWidth = BlackBerry::Platform::Graphics::Screen::landscapeWidth();
+    static int tileWidth = BlackBerry::Platform::Graphics::Screen::primaryScreen()->landscapeWidth();
     return tileWidth;
 }
 
 int BackingStorePrivate::tileHeight()
 {
-    static int tileHeight = BlackBerry::Platform::Graphics::Screen::landscapeHeight();
+    static int tileHeight = BlackBerry::Platform::Graphics::Screen::primaryScreen()->landscapeHeight();
     return tileHeight;
 }
 
@@ -2131,7 +2156,15 @@ void BackingStorePrivate::renderContents(BlackBerry::Platform::Graphics::Buffer*
         return;
 
 #if USE(ACCELERATED_COMPOSITING)
-    m_webPage->d->commitRootLayerIfNeeded();
+    // When committing the pending accelerated compositing layer changes, it's
+    // necessary to draw the new layer appearance. This is normally done as
+    // part of a blit, but if no blit happens because of this rendering, for
+    // example because we're rendering an offscreen rectangle, someone needs to
+    // catch this flag and make sure those layers get drawn.
+    // This is just a complicated way to do
+    // "if (commitRootLayerIfNeeded()) drawLayersOnCommit();"
+    if (m_webPage->d->commitRootLayerIfNeeded())
+        m_needsDrawLayersOnCommit = true;
 #endif
 
     BlackBerry::Platform::Graphics::Drawable* bufferDrawable =
@@ -2471,7 +2504,9 @@ bool BackingStorePrivate::drawSubLayers()
     if (!BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread())
         return false;
 
-    if (m_suspendBackingStoreUpdates)
+    bool blittingDirectlyToCompositingWindow = m_webPage->d->m_client->window()->windowUsage() == BlackBerry::Platform::Graphics::Window::GLES2Usage;
+
+    if (m_suspendBackingStoreUpdates && !blittingDirectlyToCompositingWindow)
         return false;
 
     Platform::IntRect dst = m_webPage->client()->userInterfaceBlittedDestinationRect();
@@ -2483,6 +2518,46 @@ bool BackingStorePrivate::drawSubLayers()
         WebCore::FloatRect(WebCore::IntRect(src)));
     return m_webPage->d->drawSubLayers(dst, contentsRect);
 }
+
+bool BackingStorePrivate::drawLayersOnCommitIfNeeded()
+{
+    // Check if rendering caused a commit and we need to redraw the layers
+    if (!m_needsDrawLayersOnCommit)
+        return false;
+
+    m_needsDrawLayersOnCommit = false;
+    m_webPage->d->drawLayersOnCommit();
+
+    return true;
+}
+
+void BackingStorePrivate::drawAndBlendLayersForDirectRendering(const Platform::IntRect& dirtyRect)
+{
+    ASSERT(BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread());
+    if (!BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread())
+        return;
+
+    // Because we're being called sync from the WebKit thread, we can use
+    // regular WebPage size and transformation functions without concerns.
+    WebCore::IntRect contentsRect = visibleContentsRect();
+    WebCore::FloatRect untransformedContentsRect = m_webPage->d->mapFromTransformedFloatRect(WebCore::FloatRect(contentsRect));
+    WebCore::IntRect contentsScreenRect = m_client->mapFromTransformedContentsToTransformedViewport(contentsRect);
+    WebCore::IntRect dstRect = intersection(contentsScreenRect,
+        WebCore::IntRect(WebCore::IntPoint(0, 0), m_webPage->d->transformedViewportSize()));
+
+    // Check if rendering caused a commit and we need to redraw the layers.
+    m_needsDrawLayersOnCommit = false;
+    m_webPage->d->drawSubLayers(dstRect, untransformedContentsRect);
+
+#if ENABLE_COMPOSITING_SURFACE
+    // See above comment about sync calling, visibleContentsRect() is safe here.
+    Platform::IntRect visibleDirtyRect = dirtyRect;
+    visibleDirtyRect.intersect(visibleContentsRect());
+    visibleDirtyRect = m_client->mapFromTransformedContentsToTransformedViewport(visibleDirtyRect);
+
+    blendCompositingSurface(visibleDirtyRect);
+#endif
+}
 #endif
 
 bool BackingStorePrivate::isActive() const
diff --git a/Source/WebKit/blackberry/Api/BackingStore.h b/Source/WebKit/blackberry/Api/BackingStore.h
index 8673268ae..73194859f 100644
--- a/Source/WebKit/blackberry/Api/BackingStore.h
+++ b/Source/WebKit/blackberry/Api/BackingStore.h
@@ -40,6 +40,7 @@ namespace WebKit {
 
 class WebPage;
 class WebPagePrivate;
+class WebPageCompositor;
 class BackingStorePrivate;
 class BackingStoreClient;
 
@@ -77,6 +78,7 @@ private:
     friend class BlackBerry::WebKit::BackingStoreClient;
     friend class BlackBerry::WebKit::WebPage;
     friend class BlackBerry::WebKit::WebPagePrivate; // FIXME: For now, we expose our internals to WebPagePrivate. See PR #120301.
+    friend class BlackBerry::WebKit::WebPageCompositor;
     friend class WebCore::ChromeClientBlackBerry;
     friend class WebCore::FrameLoaderClientBlackBerry;
     friend class WebCore::GLES2Context;
diff --git a/Source/WebKit/blackberry/Api/BackingStore_p.h b/Source/WebKit/blackberry/Api/BackingStore_p.h
index 49c70a6a5..795b7711b 100644
--- a/Source/WebKit/blackberry/Api/BackingStore_p.h
+++ b/Source/WebKit/blackberry/Api/BackingStore_p.h
@@ -196,6 +196,13 @@ public:
     void blendCompositingSurface(const Platform::IntRect& dstRect);
     void clearCompositingSurface();
     bool drawSubLayers();
+    bool drawLayersOnCommitIfNeeded();
+    void drawAndBlendLayersForDirectRendering(const Platform::IntRect& dirtyRect);
+    // WebPage will call this when drawing layers to tell us we don't need to
+    void willDrawLayersOnCommit() { m_needsDrawLayersOnCommit = false; }
+    // WebPageCompositor uses this to cut down on excessive message sending.
+    bool isDirectRenderingAnimationMessageScheduled() { return m_isDirectRenderingAnimationMessageScheduled; }
+    void setDirectRenderingAnimationMessageScheduled() { m_isDirectRenderingAnimationMessageScheduled = true; }
 #endif
 
     void blitHorizontalScrollbar(const Platform::IntPoint&);
@@ -347,6 +354,11 @@ public:
     pthread_mutex_t m_blitGenerationLock;
     pthread_cond_t m_blitGenerationCond;
     struct timespec m_currentBlitEnd;
+
+#if USE(ACCELERATED_COMPOSITING)
+    mutable bool m_needsDrawLayersOnCommit; // Not thread safe, WebKit thread only
+    bool m_isDirectRenderingAnimationMessageScheduled;
+#endif
 };
 } // namespace WebKit
 } // namespace BlackBerry
diff --git a/Source/WebKit/blackberry/Api/WebPage.cpp b/Source/WebKit/blackberry/Api/WebPage.cpp
index f3ce5f0ce..ad433607e 100644
--- a/Source/WebKit/blackberry/Api/WebPage.cpp
+++ b/Source/WebKit/blackberry/Api/WebPage.cpp
@@ -72,6 +72,9 @@
 #include "LayerWebKitThread.h"
 #include "NetworkManager.h"
 #include "NodeRenderStyle.h"
+#if ENABLE(NOTIFICATIONS)
+#include "NotificationPresenterImpl.h"
+#endif
 #include "Page.h"
 #include "PageCache.h"
 #include "PageGroup.h"
@@ -330,6 +333,13 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
 {
 }
 
+WebPage::WebPage(WebPageClient* client, const WebString& pageGroupName, const Platform::IntRect& rect)
+{
+    globalInitialize();
+    d = new WebPagePrivate(this, client, rect);
+    d->init(pageGroupName);
+}
+
 WebPagePrivate::~WebPagePrivate()
 {
     // Hand the backingstore back to another owner if necessary.
@@ -368,6 +378,17 @@ WebPagePrivate::~WebPagePrivate()
 #endif
 }
 
+WebPage::~WebPage()
+{
+    delete d;
+    d = 0;
+}
+
+Page* WebPagePrivate::core(const WebPage* webPage)
+{
+    return webPage->d->m_page;
+}
+
 void WebPagePrivate::init(const WebString& pageGroupName)
 {
     ChromeClientBlackBerry* chromeClient = new ChromeClientBlackBerry(this);
@@ -410,6 +431,10 @@ void WebPagePrivate::init(const WebString& pageGroupName)
     pageClients.deviceOrientationClient = new DeviceOrientationClientBlackBerry(this);
     m_page = new Page(pageClients);
 
+#if ENABLE(NOTIFICATIONS)
+    WebCore::provideNotification(m_page, NotificationPresenterImpl::instance());
+#endif
+
 #if ENABLE(CLIENT_BASED_GEOLOCATION) && ENABLE_DRT
     // In case running in DumpRenderTree mode set the controller to mock provider.
     if (getenv("drtRun"))
@@ -449,6 +474,7 @@ void WebPagePrivate::init(const WebString& pageGroupName)
     m_page->settings()->setUseHixie76WebSocketProtocol(false);
     m_page->settings()->setInteractiveFormValidationEnabled(true);
     m_page->settings()->setAllowUniversalAccessFromFileURLs(false);
+    m_page->settings()->setAllowFileAccessFromFileURLs(false);
 
     m_backingStoreClient = BackingStoreClient::create(m_mainFrame, /* parent frame */ 0, m_webPage);
     // The direct access to BackingStore is left here for convenience since it
@@ -456,7 +482,7 @@ void WebPagePrivate::init(const WebString& pageGroupName)
     m_backingStore = m_backingStoreClient->backingStore();
 
     m_page->settings()->setSpatialNavigationEnabled(m_webSettings->isSpatialNavigationEnabled());
-    blockClickRadius = int(roundf(0.35 * Platform::Graphics::Screen::pixelsPerInch(0).width())); // The clicked rectangle area should be a fixed unit of measurement.
+    blockClickRadius = int(roundf(0.35 * Platform::Graphics::Screen::primaryScreen()->pixelsPerInch(0).width())); // The clicked rectangle area should be a fixed unit of measurement.
 
     m_page->settings()->setDelegateSelectionPaint(true);
 }
@@ -507,6 +533,32 @@ void WebPagePrivate::load(const char* url, const char* networkToken, const char*
     m_mainFrame->loader()->load(request, "" /* name */, false);
 }
 
+void WebPage::load(const char* url, const char* networkToken, bool isInitial)
+{
+    d->load(url, networkToken, "GET", Platform::NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, isInitial, false);
+}
+
+void WebPage::loadExtended(const char* url, const char* networkToken, const char* method, Platform::NetworkRequest::CachePolicy cachePolicy, const char* data, size_t dataLength, const char* const* headers, size_t headersLength, bool mustHandleInternally)
+{
+    d->load(url, networkToken, method, cachePolicy, data, dataLength, headers, headersLength, false, mustHandleInternally, false, "");
+}
+
+void WebPage::loadFile(const char* path, const char* overrideContentType)
+{
+    std::string fileUrl(path);
+    if (!fileUrl.find("/"))
+        fileUrl.insert(0, "file://");
+    else if (fileUrl.find("file:///"))
+        return;
+
+    d->load(fileUrl.c_str(), 0, "GET", Platform::NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, false, false, false, overrideContentType);
+}
+
+void WebPage::download(const Platform::NetworkRequest& request)
+{
+    d->load(request.getUrlRef().c_str(), 0, "GET", Platform::NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, false, false, true, "");
+}
+
 void WebPagePrivate::loadString(const char* string, const char* baseURL, const char* contentType, const char* failingURL)
 {
     KURL kurl = parseUrl(baseURL);
@@ -520,6 +572,11 @@ void WebPagePrivate::loadString(const char* string, const char* baseURL, const c
     m_mainFrame->loader()->load(request, substituteData, false);
 }
 
+void WebPage::loadString(const char* string, const char* baseURL, const char* mimeType, const char* failingURL)
+{
+    d->loadString(string, baseURL, mimeType, failingURL);
+}
+
 bool WebPagePrivate::executeJavaScript(const char* script, JavaScriptDataType& returnType, WebString& returnValue)
 {
     ScriptValue result = m_mainFrame->script()->executeScript(String::fromUTF8(script), false);
@@ -564,6 +621,11 @@ bool WebPagePrivate::executeJavaScript(const char* script, JavaScriptDataType& r
     return true;
 }
 
+bool WebPage::executeJavaScript(const char* script, JavaScriptDataType& returnType, WebString& returnValue)
+{
+    return d->executeJavaScript(script, returnType, returnValue);
+}
+
 bool WebPagePrivate::executeJavaScriptInIsolatedWorld(const ScriptSourceCode& sourceCode, JavaScriptDataType& returnType, WebString& returnValue)
 {
     if (!m_isolatedWorld)
@@ -612,6 +674,33 @@ bool WebPagePrivate::executeJavaScriptInIsolatedWorld(const ScriptSourceCode& so
     return true;
 }
 
+bool WebPage::executeJavaScriptInIsolatedWorld(const std::wstring& script, JavaScriptDataType& returnType, WebString& returnValue)
+{
+    // On our platform wchar_t is unsigned int and UChar is unsigned short
+    // so we have to convert using ICU conversion function
+    int lengthCopied = 0;
+    UErrorCode error = U_ZERO_ERROR;
+    const int length = script.length() + 1 /*null termination char*/;
+    UChar data[length];
+
+    // FIXME: PR 138162 is giving U_INVALID_CHAR_FOUND error.
+    u_strFromUTF32(data, length, &lengthCopied, reinterpret_cast<const UChar32*>(script.c_str()), script.length(), &error);
+    BLACKBERRY_ASSERT(error == U_ZERO_ERROR);
+    if (error != U_ZERO_ERROR) {
+        Platform::logAlways(Platform::LogLevelCritical, "WebPage::executeJavaScriptInIsolatedWorld failed to convert UTF16 to JavaScript!");
+        return false;
+    }
+    String str = String(data, lengthCopied);
+    ScriptSourceCode sourceCode(str, KURL());
+    return d->executeJavaScriptInIsolatedWorld(sourceCode, returnType, returnValue);
+}
+
+bool WebPage::executeJavaScriptInIsolatedWorld(const char* script, JavaScriptDataType& returnType, WebString& returnValue)
+{
+    ScriptSourceCode sourceCode(String::fromUTF8(script), KURL());
+    return d->executeJavaScriptInIsolatedWorld(sourceCode, returnType, returnValue);
+}
+
 void WebPagePrivate::stopCurrentLoad()
 {
     // This function should contain all common code triggered by WebPage::load
@@ -626,6 +715,11 @@ void WebPagePrivate::stopCurrentLoad()
     frameLoaderClient->setDeferredManualScript(KURL());
 }
 
+void WebPage::stopLoading()
+{
+    d->stopCurrentLoad();
+}
+
 static void closeURLRecursively(Frame* frame)
 {
     // Do not create more frame please.
@@ -652,6 +746,11 @@ void WebPagePrivate::prepareToDestroy()
     closeURLRecursively(m_mainFrame);
 }
 
+void WebPage::prepareToDestroy()
+{
+    d->prepareToDestroy();
+}
+
 void WebPagePrivate::setLoadState(LoadState state)
 {
     if (m_loadState == state)
@@ -1028,6 +1127,24 @@ void WebPagePrivate::setScrollPosition(const IntPoint& pos)
     m_backingStoreClient->setScrollPosition(pos);
 }
 
+// Setting the scroll position is in transformed coordinates.
+void WebPage::setScrollPosition(const Platform::IntPoint& point)
+{
+    if (d->transformedPointEqualsUntransformedPoint(point, d->scrollPosition()))
+        return;
+
+    // If the user recently performed an event, this new scroll position
+    // could possibly be a result of that. Or not, this is just a heuristic.
+    if (currentTime() - d->m_lastUserEventTimestamp < manualScrollInterval)
+        d->m_userPerformedManualScroll = true;
+
+    d->m_backingStoreClient->setIsClientGeneratedScroll(true);
+    d->m_mainFrame->view()->setCanOverscroll(true);
+    d->setScrollPosition(d->mapFromTransformed(point));
+    d->m_mainFrame->view()->setCanOverscroll(false);
+    d->m_backingStoreClient->setIsClientGeneratedScroll(false);
+}
+
 bool WebPagePrivate::shouldSendResizeEvent()
 {
     if (!m_mainFrame->document())
@@ -1066,14 +1183,6 @@ void WebPagePrivate::didResumeLoading()
     m_client->didResumeLoading();
 }
 
-bool WebPage::scrollBy(const Platform::IntSize& delta, bool scrollMainFrame)
-{
-    d->m_backingStoreClient->setIsClientGeneratedScroll(true);
-    bool b = d->scrollBy(delta.width(), delta.height(), scrollMainFrame);
-    d->m_backingStoreClient->setIsClientGeneratedScroll(false);
-    return b;
-}
-
 bool WebPagePrivate::scrollBy(int deltaX, int deltaY, bool scrollMainFrame)
 {
     IntSize delta(deltaX, deltaY);
@@ -1104,9 +1213,12 @@ bool WebPagePrivate::scrollBy(int deltaX, int deltaY, bool scrollMainFrame)
     return true;
 }
 
-void WebPage::notifyInRegionScrollStatusChanged(bool status)
+bool WebPage::scrollBy(const Platform::IntSize& delta, bool scrollMainFrame)
 {
-    d->notifyInRegionScrollStatusChanged(status);
+    d->m_backingStoreClient->setIsClientGeneratedScroll(true);
+    bool b = d->scrollBy(delta.width(), delta.height(), scrollMainFrame);
+    d->m_backingStoreClient->setIsClientGeneratedScroll(false);
+    return b;
 }
 
 void WebPagePrivate::notifyInRegionScrollStatusChanged(bool status)
@@ -1117,6 +1229,11 @@ void WebPagePrivate::notifyInRegionScrollStatusChanged(bool status)
     }
 }
 
+void WebPage::notifyInRegionScrollStatusChanged(bool status)
+{
+    d->notifyInRegionScrollStatusChanged(status);
+}
+
 void WebPagePrivate::enqueueRenderingOfClippedContentOfScrollableNodeAfterInRegionScrolling(Node* scrolledNode)
 {
     ASSERT(scrolledNode);
@@ -1399,6 +1516,11 @@ double WebPagePrivate::zoomToFitScale() const
     return contentWidth > 0.0 ? static_cast<double>(m_actualVisibleWidth) / contentWidth : 1.0;
 }
 
+double WebPage::zoomToFitScale() const
+{
+    return d->zoomToFitScale();
+}
+
 double WebPagePrivate::initialScale() const
 {
     if (m_initialScale > 0.0)
@@ -1410,6 +1532,11 @@ double WebPagePrivate::initialScale() const
     return 1.0;
 }
 
+double WebPage::initialScale() const
+{
+    return d->initialScale();
+}
+
 void WebPage::initializeIconDataBase()
 {
     IconDatabaseClientBlackBerry::getInstance()->initIconDatabase(d->m_webSettings);
@@ -1425,16 +1552,6 @@ double WebPage::currentScale() const
     return d->currentScale();
 }
 
-double WebPage::initialScale() const
-{
-    return d->initialScale();
-}
-
-double WebPage::zoomToFitScale() const
-{
-    return d->zoomToFitScale();
-}
-
 void WebPage::setInitialScale(double initialScale)
 {
     d->setInitialScale(initialScale);
@@ -1450,11 +1567,6 @@ void WebPage::setMinimumScale(double minimumScale)
     d->setMinimumScale(minimumScale);
 }
 
-double WebPage::maximumScale() const
-{
-    return d->maximumScale();
-}
-
 void WebPage::setMaximumScale(double maximumScale)
 {
     d->setMaximumScale(maximumScale);
@@ -1468,6 +1580,11 @@ double WebPagePrivate::maximumScale() const
     return hasVirtualViewport() ? std::max<double>(zoomToFitScale(), 4.0) : 4.0;
 }
 
+double WebPage::maximumScale() const
+{
+    return d->maximumScale();
+}
+
 void WebPagePrivate::resetScales()
 {
     TransformationMatrix identity;
@@ -1486,6 +1603,12 @@ IntPoint WebPagePrivate::transformedScrollPosition() const
     return m_backingStoreClient->transformedScrollPosition();
 }
 
+// Returned scroll position is in transformed coordinates.
+Platform::IntPoint WebPage::scrollPosition() const
+{
+    return d->transformedScrollPosition();
+}
+
 IntPoint WebPagePrivate::transformedMaximumScrollPosition() const
 {
     return m_backingStoreClient->transformedMaximumScrollPosition();
@@ -1496,9 +1619,14 @@ IntSize WebPagePrivate::transformedActualVisibleSize() const
     return IntSize(m_actualVisibleWidth, m_actualVisibleHeight);
 }
 
+Platform::IntSize WebPage::viewportSize() const
+{
+    return d->transformedActualVisibleSize();
+}
+
 IntSize WebPagePrivate::transformedViewportSize() const
 {
-    return Platform::Graphics::Screen::size();
+    return Platform::Graphics::Screen::primaryScreen()->size();
 }
 
 IntRect WebPagePrivate::transformedVisibleContentsRect() const
@@ -1947,6 +2075,11 @@ ActiveNodeContext WebPagePrivate::activeNodeContext(TargetDetectionStrategy stra
     return context;
 }
 
+ActiveNodeContext WebPage::activeNodeContext(TargetDetectionStrategy strategy) const
+{
+    return d->activeNodeContext(strategy);
+}
+
 void WebPagePrivate::updateCursor()
 {
     int buttonMask = 0;
@@ -2029,10 +2162,10 @@ IntSize WebPagePrivate::fixedLayoutSize(bool snapToIncrement) const
             // layout width.
 #if ENABLE(ORIENTATION_EVENTS)
             minWidth = m_mainFrame->orientation() % 180
-                ? Platform::Graphics::Screen::height()
-                : Platform::Graphics::Screen::width();
+                ? Platform::Graphics::Screen::primaryScreen()->height()
+                : Platform::Graphics::Screen::primaryScreen()->width();
 #else
-            minWidth = Platform::Graphics::Screen::width();
+            minWidth = Platform::Graphics::Screen::primaryScreen()->width();
 #endif
         }
     }
@@ -2189,11 +2322,6 @@ IntRect WebPagePrivate::getRecursiveVisibleWindowRect(ScrollView* view, bool noC
     return visibleWindowRect;
 }
 
-void WebPage::assignFocus(Platform::FocusDirection direction)
-{
-    d->assignFocus(direction);
-}
-
 void WebPagePrivate::assignFocus(Platform::FocusDirection direction)
 {
     ASSERT((int) Platform::FocusDirectionNone == (int) FocusDirectionNone);
@@ -2217,6 +2345,11 @@ void WebPagePrivate::assignFocus(Platform::FocusDirection direction)
     }
 }
 
+void WebPage::assignFocus(Platform::FocusDirection direction)
+{
+    d->assignFocus(direction);
+}
+
 Platform::IntRect WebPagePrivate::focusNodeRect()
 {
     Frame* frame = focusedOrMainFrame();
@@ -2563,11 +2696,6 @@ IntRect WebPagePrivate::blockZoomRectForNode(Node* node)
     return blockRect;
 }
 
-void WebPage::blockZoomAnimationFinished()
-{
-    d->zoomBlock();
-}
-
 // This function should not be called directly.
 // It is called after the animation ends (see above).
 void WebPagePrivate::zoomBlock()
@@ -2649,6 +2777,10 @@ void WebPagePrivate::zoomBlock()
     m_client->zoomChanged(m_webPage->isMinZoomed(), m_webPage->isMaxZoomed(), !shouldZoomOnEscape(), currentScale());
 }
 
+void WebPage::blockZoomAnimationFinished()
+{
+    d->zoomBlock();
+}
 
 void WebPagePrivate::resetBlockZoom()
 {
@@ -2657,13 +2789,6 @@ void WebPagePrivate::resetBlockZoom()
     m_shouldReflowBlock = false;
 }
 
-WebPage::WebPage(WebPageClient* client, const WebString& pageGroupName, const Platform::IntRect& rect)
-{
-    globalInitialize();
-    d = new WebPagePrivate(this, client, rect);
-    d->init(pageGroupName);
-}
-
 void WebPage::destroyWebPageCompositor()
 {
 #if USE(ACCELERATED_COMPOSITING)
@@ -2703,90 +2828,11 @@ void WebPage::destroy()
     delete this;
 }
 
-WebPage::~WebPage()
-{
-    delete d;
-    d = 0;
-}
-
 WebPageClient* WebPage::client() const
 {
     return d->m_client;
 }
 
-void WebPage::load(const char* url, const char* networkToken, bool isInitial)
-{
-    d->load(url, networkToken, "GET", Platform::NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, isInitial, false);
-}
-
-void WebPage::loadExtended(const char* url, const char* networkToken, const char* method, Platform::NetworkRequest::CachePolicy cachePolicy, const char* data, size_t dataLength, const char* const* headers, size_t headersLength, bool mustHandleInternally)
-{
-    d->load(url, networkToken, method, cachePolicy, data, dataLength, headers, headersLength, false, mustHandleInternally, false, "");
-}
-
-void WebPage::loadFile(const char* path, const char* overrideContentType)
-{
-    std::string fileUrl(path);
-    if (!fileUrl.find("/"))
-        fileUrl.insert(0, "file://");
-    else if (fileUrl.find("file:///"))
-        return;
-
-    d->load(fileUrl.c_str(), 0, "GET", Platform::NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, false, false, false, overrideContentType);
-}
-
-void WebPage::loadString(const char* string, const char* baseURL, const char* mimeType, const char* failingURL)
-{
-    d->loadString(string, baseURL, mimeType, failingURL);
-}
-
-void WebPage::download(const Platform::NetworkRequest& request)
-{
-    d->load(request.getUrlRef().c_str(), 0, "GET", Platform::NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, false, false, true, "");
-}
-
-bool WebPage::executeJavaScript(const char* script, JavaScriptDataType& returnType, WebString& returnValue)
-{
-    return d->executeJavaScript(script, returnType, returnValue);
-}
-
-bool WebPage::executeJavaScriptInIsolatedWorld(const std::wstring& script, JavaScriptDataType& returnType, WebString& returnValue)
-{
-    // On our platform wchar_t is unsigned int and UChar is unsigned short
-    // so we have to convert using ICU conversion function
-    int lengthCopied = 0;
-    UErrorCode error = U_ZERO_ERROR;
-    const int length = script.length() + 1 /*null termination char*/;
-    UChar data[length];
-
-    // FIXME: PR 138162 is giving U_INVALID_CHAR_FOUND error.
-    u_strFromUTF32(data, length, &lengthCopied, reinterpret_cast<const UChar32*>(script.c_str()), script.length(), &error);
-    BLACKBERRY_ASSERT(error == U_ZERO_ERROR);
-    if (error != U_ZERO_ERROR) {
-        Platform::logAlways(Platform::LogLevelCritical, "WebPage::executeJavaScriptInIsolatedWorld failed to convert UTF16 to JavaScript!");
-        return false;
-    }
-    String str = String(data, lengthCopied);
-    ScriptSourceCode sourceCode(str, KURL());
-    return d->executeJavaScriptInIsolatedWorld(sourceCode, returnType, returnValue);
-}
-
-bool WebPage::executeJavaScriptInIsolatedWorld(const char* script, JavaScriptDataType& returnType, WebString& returnValue)
-{
-    ScriptSourceCode sourceCode(String::fromUTF8(script), KURL());
-    return d->executeJavaScriptInIsolatedWorld(sourceCode, returnType, returnValue);
-}
-
-void WebPage::stopLoading()
-{
-    d->stopCurrentLoad();
-}
-
-void WebPage::prepareToDestroy()
-{
-    d->prepareToDestroy();
-}
-
 int WebPage::backForwardListLength() const
 {
     return d->m_page->getHistoryLength();
@@ -2953,11 +2999,6 @@ void WebPage::setColorInput(const WebString& value)
     d->m_inputHandler->setInputValue(String(value.impl()));
 }
 
-ActiveNodeContext WebPage::activeNodeContext(TargetDetectionStrategy strategy) const
-{
-    return d->activeNodeContext(strategy);
-}
-
 void WebPage::setVirtualViewportSize(int width, int height)
 {
     d->m_virtualViewportWidth = width;
@@ -2976,9 +3017,9 @@ IntSize WebPagePrivate::recomputeVirtualViewportFromViewportArguments()
         return IntSize();
 
     int desktopWidth = defaultMaxLayoutSize().width();
-    int deviceWidth = Platform::Graphics::Screen::width();
-    int deviceHeight = Platform::Graphics::Screen::height();
-    FloatSize currentPPI = Platform::Graphics::Screen::pixelsPerInch(-1);
+    int deviceWidth = Platform::Graphics::Screen::primaryScreen()->width();
+    int deviceHeight = Platform::Graphics::Screen::primaryScreen()->height();
+    FloatSize currentPPI = Platform::Graphics::Screen::primaryScreen()->pixelsPerInch(-1);
     int deviceDPI = int(roundf((currentPPI.width() + currentPPI.height()) / 2));
     if (m_viewportArguments.targetDensityDpi == ViewportArguments::ValueAuto) {
         // Auto means 160dpi if we leave it alone. This looks terrible for pages wanting 1:1.
@@ -2987,6 +3028,7 @@ IntSize WebPagePrivate::recomputeVirtualViewportFromViewportArguments()
     }
 
     ViewportAttributes result = computeViewportAttributes(m_viewportArguments, desktopWidth, deviceWidth, deviceHeight, deviceDPI, m_defaultLayoutSize);
+    m_page->setDeviceScaleFactor(result.devicePixelRatio);
     return IntSize(result.layoutSize.width(), result.layoutSize.height());
 }
 
@@ -3048,15 +3090,9 @@ void WebPagePrivate::onInputLocaleChanged(bool isRTL)
     }
 }
 
-void WebPage::setScreenOrientation(int orientation)
-{
-    d->m_pendingOrientation = orientation;
-}
-
-void WebPage::applyPendingOrientationIfNeeded()
+void WebPage::onInputLocaleChanged(bool isRTL)
 {
-    if (d->m_pendingOrientation != -1)
-        d->setScreenOrientation(d->m_pendingOrientation);
+    d->onInputLocaleChanged(isRTL);
 }
 
 void WebPagePrivate::suspendBackingStore()
@@ -3111,14 +3147,15 @@ void WebPagePrivate::setScreenOrientation(int orientation)
 #endif
 }
 
-Platform::IntSize WebPage::viewportSize() const
+void WebPage::setScreenOrientation(int orientation)
 {
-    return d->transformedActualVisibleSize();
+    d->m_pendingOrientation = orientation;
 }
 
-void WebPage::setViewportSize(const Platform::IntSize& viewportSize, bool ensureFocusElementVisible)
+void WebPage::applyPendingOrientationIfNeeded()
 {
-    d->setViewportSize(viewportSize, ensureFocusElementVisible);
+    if (d->m_pendingOrientation != -1)
+        d->setScreenOrientation(d->m_pendingOrientation);
 }
 
 void WebPagePrivate::screenRotated()
@@ -3165,7 +3202,7 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
     bool newVisibleRectContainsOldVisibleRect = (m_actualVisibleHeight <= transformedActualVisibleSize.height())
                                           && (m_actualVisibleWidth <= transformedActualVisibleSize.width());
 
-    bool atInitialScale = currentScale() == initialScale();
+    bool atInitialScale = m_webPage->isAtInitialZoom();
     bool atTop = !scrollPosition().y();
     bool atLeft = !scrollPosition().x();
 
@@ -3235,8 +3272,10 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
     if (setViewMode(viewMode()))
         needsLayout = true;
 
+    bool needsLayoutToFindContentSize = hasPendingOrientation;
+
     // We need to update the viewport size of the WebCore::ScrollView...
-    updateViewportSize(!hasPendingOrientation /* setFixedReportedSize */, false /* sendResizeEvent */);
+    updateViewportSize(!needsLayoutToFindContentSize /* setFixedReportedSize */, false /* sendResizeEvent */);
     notifyTransformedContentsSizeChanged();
 
     // If automatic zooming is disabled, prevent zooming below.
@@ -3273,7 +3312,7 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
     // Do our own clamping.
     scale = clampedScale(scale);
 
-    if (hasPendingOrientation) {
+    if (needsLayoutToFindContentSize) {
         // Set the fixed reported size here so that innerWidth|innerHeight works
         // with this new scale.
         TransformationMatrix rotationMatrix;
@@ -3281,6 +3320,7 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
         IntRect viewportRect = IntRect(IntPoint::zero(), transformedActualVisibleSize);
         IntRect actualVisibleRect = enclosingIntRect(rotationMatrix.inverse().mapRect(FloatRect(viewportRect)));
         m_mainFrame->view()->setFixedReportedSize(actualVisibleRect.size());
+        m_mainFrame->view()->repaintFixedElementsAfterScrolling();
     }
 
     // We're going to need to send a resize event to JavaScript because
@@ -3339,26 +3379,30 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
         ensureContentVisible(!newVisibleRectContainsOldVisibleRect);
 }
 
-void WebPage::setDefaultLayoutSize(int width, int height)
+void WebPage::setViewportSize(const Platform::IntSize& viewportSize, bool ensureFocusElementVisible)
 {
-    IntSize size(width, height);
-    d->setDefaultLayoutSize(size);
+    d->setViewportSize(viewportSize, ensureFocusElementVisible);
 }
 
 void WebPagePrivate::setDefaultLayoutSize(const IntSize& size)
 {
-    if (size == m_defaultLayoutSize)
-        return;
-
-    IntSize screenSize = Platform::Graphics::Screen::size();
+    IntSize screenSize = Platform::Graphics::Screen::primaryScreen()->size();
     ASSERT(size.width() <= screenSize.width() && size.height() <= screenSize.height());
     m_defaultLayoutSize = size.expandedTo(minimumLayoutSize).shrunkTo(screenSize);
+}
+
+void WebPage::setDefaultLayoutSize(int width, int height)
+{
+    IntSize size(width, height);
+    if (size == d->m_defaultLayoutSize)
+        return;
 
-    bool needsLayout = setViewMode(viewMode());
+    d->setDefaultLayoutSize(size);
+    bool needsLayout = d->setViewMode(d->viewMode());
     if (needsLayout) {
-        setNeedsLayout();
-        if (!isLoading())
-            requestLayoutIfNeeded();
+        d->setNeedsLayout();
+        if (!d->isLoading())
+            d->requestLayoutIfNeeded();
     }
 }
 
@@ -3590,12 +3634,6 @@ bool WebPage::touchEvent(const Platform::TouchEvent& event)
     return false;
 }
 
-void WebPage::setScrollOriginPoint(const Platform::IntPoint& point)
-{
-    Platform::IntPoint untransformedPoint = d->mapFromTransformed(point);
-    d->setScrollOriginPoint(untransformedPoint);
-}
-
 void WebPagePrivate::setScrollOriginPoint(const Platform::IntPoint& point)
 {
     m_inRegionScrollStartingNode = 0;
@@ -3606,6 +3644,12 @@ void WebPagePrivate::setScrollOriginPoint(const Platform::IntPoint& point)
     m_client->notifyInRegionScrollingStartingPointChanged(inRegionScrollableAreasForPoint(point));
 }
 
+void WebPage::setScrollOriginPoint(const Platform::IntPoint& point)
+{
+    Platform::IntPoint untransformedPoint = d->mapFromTransformed(point);
+    d->setScrollOriginPoint(untransformedPoint);
+}
+
 bool WebPagePrivate::dispatchTouchEventToFullScreenPlugin(PluginView* plugin, const Platform::TouchEvent& event)
 {
     NPTouchEvent npTouchEvent;
@@ -3735,6 +3779,38 @@ void WebPagePrivate::clearFocusNode()
         frame->page()->focusController()->setFocusedNode(0, frame);
 }
 
+WebString WebPage::textEncoding()
+{
+    Frame* frame = d->focusedOrMainFrame();
+    if (!frame)
+        return "";
+
+    Document* document = frame->document();
+    if (!document)
+        return "";
+
+    return document->loader()->writer()->encoding();
+}
+
+WebString WebPage::forcedTextEncoding()
+{
+    Frame* frame = d->focusedOrMainFrame();
+    if (!frame)
+        return "";
+
+    Document* document = frame->document();
+    if (!document)
+        return "";
+
+    return document->loader()->overrideEncoding();
+}
+
+void WebPage::setForcedTextEncoding(const char* encoding)
+{
+    if (encoding && d->focusedOrMainFrame() && d->focusedOrMainFrame()->loader() && d->focusedOrMainFrame()->loader())
+        return d->focusedOrMainFrame()->loader()->reloadWithOverrideEncoding(encoding);
+}
+
 bool WebPagePrivate::scrollNodeRecursively(Node* node, const IntSize& delta)
 {
     if (delta.isZero())
@@ -3960,7 +4036,7 @@ int32_t WebPage::commitText(spannable_string_t* spannableString, int32_t relativ
     return d->m_inputHandler->commitText(spannableString, relativeCursorPosition);
 }
 
-void WebPage::spellCheckingEnabled(bool enabled)
+void WebPage::setSpellCheckingEnabled(bool enabled)
 {
     static_cast<EditorClientBlackBerry*>(d->m_page->editorClient())->enableSpellChecking(enabled);
 }
@@ -4053,62 +4129,6 @@ void WebPage::selectAtPoint(const Platform::IntPoint& location)
     d->m_selectionHandler->selectAtPoint(selectionLocation);
 }
 
-// Returned scroll position is in transformed coordinates.
-Platform::IntPoint WebPage::scrollPosition() const
-{
-    return d->transformedScrollPosition();
-}
-
-// Setting the scroll position is in transformed coordinates.
-void WebPage::setScrollPosition(const Platform::IntPoint& point)
-{
-    if (d->transformedPointEqualsUntransformedPoint(point, d->scrollPosition()))
-        return;
-
-    // If the user recently performed an event, this new scroll position
-    // could possibly be a result of that. Or not, this is just a heuristic.
-    if (currentTime() - d->m_lastUserEventTimestamp < manualScrollInterval)
-        d->m_userPerformedManualScroll = true;
-
-    d->m_backingStoreClient->setIsClientGeneratedScroll(true);
-    d->m_mainFrame->view()->setCanOverscroll(true);
-    d->setScrollPosition(d->mapFromTransformed(point));
-    d->m_mainFrame->view()->setCanOverscroll(false);
-    d->m_backingStoreClient->setIsClientGeneratedScroll(false);
-}
-
-WebString WebPage::textEncoding()
-{
-    Frame* frame = d->focusedOrMainFrame();
-    if (!frame)
-        return "";
-
-    Document* document = frame->document();
-    if (!document)
-        return "";
-
-    return document->loader()->writer()->encoding();
-}
-
-WebString WebPage::forcedTextEncoding()
-{
-    Frame* frame = d->focusedOrMainFrame();
-    if (!frame)
-        return "";
-
-    Document* document = frame->document();
-    if (!document)
-        return "";
-
-    return document->loader()->overrideEncoding();
-}
-
-void WebPage::setForcedTextEncoding(const char* encoding)
-{
-    if (encoding && d->focusedOrMainFrame() && d->focusedOrMainFrame()->loader() && d->focusedOrMainFrame()->loader())
-        return d->focusedOrMainFrame()->loader()->reloadWithOverrideEncoding(encoding);
-}
-
 // FIXME: Move to DOMSupport.
 bool WebPagePrivate::canScrollInnerFrame(Frame* frame) const
 {
@@ -4152,7 +4172,6 @@ bool WebPagePrivate::canScrollRenderBox(RenderBox* box)
 static RenderLayer* parentLayer(RenderLayer* layer)
 {
     ASSERT(layer);
-
     if (layer->parent())
         return layer->parent();
 
@@ -4203,7 +4222,6 @@ std::vector<Platform::ScrollViewBase> WebPagePrivate::inRegionScrollableAreasFor
         return emptyReturn;
 
     RenderLayer* layer = renderer->enclosingLayer();
-
     do {
         RenderObject* renderer = layer->renderer();
 
@@ -4231,7 +4249,6 @@ std::vector<Platform::ScrollViewBase> WebPagePrivate::inRegionScrollableAreasFor
         }
 
     } while (layer = parentLayer(layer));
-
     if (validReturn.empty())
         return emptyReturn;
 
@@ -4535,11 +4552,6 @@ bool WebPage::zoomToOneOne()
     return d->zoomAboutPoint(scale, d->centerOfVisibleContentsRect());
 }
 
-Platform::IntRect WebPage::focusNodeRect()
-{
-    return d->focusNodeRect();
-}
-
 void WebPage::setFocused(bool focused)
 {
     FocusController* focusController = d->m_page->focusController();
@@ -4903,20 +4915,12 @@ void WebPage::notifyPageResume()
 
 void WebPage::notifyPageBackground()
 {
-#if USE(ACCELERATED_COMPOSITING)
-    d->suspendRootLayerCommit();
-#endif
-
     FOR_EACH_PLUGINVIEW(d->m_pluginViews)
         (*it)->handleBackgroundEvent();
 }
 
 void WebPage::notifyPageForeground()
 {
-#if USE(ACCELERATED_COMPOSITING)
-    d->resumeRootLayerCommit();
-#endif
-
     FOR_EACH_PLUGINVIEW(d->m_pluginViews)
         (*it)->handleForegroundEvent();
 }
@@ -4998,11 +5002,6 @@ void WebPage::clearPluginSiteData()
         (*it)->clearSiteData(String());
 }
 
-void WebPage::onInputLocaleChanged(bool isRTL)
-{
-    d->onInputLocaleChanged(isRTL);
-}
-
 void WebPage::onNetworkAvailabilityChanged(bool available)
 {
     updateOnlineStatus(available);
@@ -5027,6 +5026,11 @@ void WebPage::disableWebInspector()
     d->m_page->settings()->setDeveloperExtrasEnabled(false);
 }
 
+bool WebPage::isWebInspectorEnabled()
+{
+    return d->m_page->settings()->developerExtrasEnabled();
+}
+
 void WebPage::enablePasswordEcho()
 {
     d->m_page->settings()->setPasswordEchoEnabled(true);
@@ -5037,17 +5041,12 @@ void WebPage::disablePasswordEcho()
     d->m_page->settings()->setPasswordEchoEnabled(false);
 }
 
-void WebPage::dispatchInspectorMessage(const char* message, int length)
+void WebPage::dispatchInspectorMessage(const std::string& message)
 {
-    String stringMessage(message, length);
+    String stringMessage(message.c_str(), message.length());
     d->m_page->inspectorController()->dispatchMessageFromFrontend(stringMessage);
 }
 
-Frame* WebPage::mainFrame() const
-{
-    return d->m_mainFrame;
-}
-
 #if USE(ACCELERATED_COMPOSITING)
 void WebPagePrivate::drawLayersOnCommit()
 {
@@ -5414,14 +5413,14 @@ void WebPagePrivate::enterFullscreenForNode(Node* node)
     if (!mmrPlayer)
         return;
 
-    Platform::Graphics::Window* window = mmrPlayer->windowGet();
+    Platform::Graphics::Window* window = mmrPlayer->getWindow();
     if (!window)
         return;
 
     unsigned x, y, width, height;
-    mmrPlayer->windowPositionGet(x, y, width, height);
+    mmrPlayer->getWindowPosition(x, y, width, height);
 
-    const char* contextName = mmrPlayer->mmrContextNameGet();
+    const char* contextName = mmrPlayer->mmrContextName();
     if (!contextName)
         return;
 
@@ -5466,7 +5465,7 @@ void WebPagePrivate::didChangeSettings(WebSettings* webSettings)
     coreSettings->setPrivateBrowsingEnabled(webSettings->isPrivateBrowsingEnabled());
     coreSettings->setDefaultFixedFontSize(webSettings->defaultFixedFontSize());
     coreSettings->setDefaultFontSize(webSettings->defaultFontSize());
-    coreSettings->setMinimumFontSize(webSettings->minimumFontSize());
+    coreSettings->setMinimumLogicalFontSize(webSettings->minimumFontSize());
     coreSettings->setSerifFontFamily(webSettings->serifFontFamily().impl());
     coreSettings->setFixedFontFamily(webSettings->fixedFontFamily().impl());
     coreSettings->setSansSerifFontFamily(webSettings->sansSerifFontFamily().impl());
@@ -5546,8 +5545,8 @@ IntSize WebPagePrivate::defaultMaxLayoutSize()
 {
     static IntSize size;
     if (size.isEmpty())
-        size = IntSize(std::max(1024, Platform::Graphics::Screen::landscapeWidth()),
-                       std::max(768, Platform::Graphics::Screen::landscapeHeight()));
+        size = IntSize(std::max(1024, Platform::Graphics::Screen::primaryScreen()->landscapeWidth()),
+                       std::max(768, Platform::Graphics::Screen::primaryScreen()->landscapeHeight()));
 
     return size;
 }
@@ -5594,5 +5593,11 @@ void WebPagePrivate::setNeedTouchEvents(bool value)
     m_needTouchEvents = value;
 }
 
+void WebPagePrivate::frameUnloaded(const Frame* frame)
+{
+    m_inputHandler->frameUnloaded(frame);
+    m_inPageSearchManager->frameUnloaded(frame);
+}
+
 }
 }
diff --git a/Source/WebKit/blackberry/Api/WebPage.h b/Source/WebKit/blackberry/Api/WebPage.h
index 489f4536c..3a883ce66 100644
--- a/Source/WebKit/blackberry/Api/WebPage.h
+++ b/Source/WebKit/blackberry/Api/WebPage.h
@@ -34,17 +34,8 @@ typedef const struct OpaqueJSValue* JSValueRef;
 
 namespace WebCore {
 class ChromeClientBlackBerry;
-class EditorClientBlackBerry;
-class Element;
 class Frame;
 class FrameLoaderClientBlackBerry;
-class GeolocationControllerClientBlackBerry;
-class IconDatabaseClientBlackBerry;
-class InspectorClientBlackBerry;
-class JavaScriptDebuggerBlackBerry;
-class Node;
-class RenderObject;
-class VisibleSelection;
 }
 
 class WebDOMDocument;
@@ -67,7 +58,6 @@ namespace WebKit {
 class BackingStore;
 class BackingStoreClient;
 class BackingStorePrivate;
-class DumpRenderTreeClient;
 class RenderQueue;
 class WebPageClient;
 class WebPageGroupLoadDeferrer;
@@ -192,8 +182,6 @@ public:
 
     void assignFocus(Platform::FocusDirection);
 
-    Platform::IntRect focusNodeRect();
-
     void setFocused(bool);
 
     void clearBrowsingData();
@@ -250,7 +238,7 @@ public:
     int32_t setComposingText(spannable_string_t*, int32_t relativeCursorPosition);
     int32_t commitText(spannable_string_t*, int32_t relativeCursorPosition);
 
-    void spellCheckingEnabled(bool);
+    void setSpellCheckingEnabled(bool);
 
     void setSelection(const Platform::IntPoint& startPoint, const Platform::IntPoint& endPoint);
     void setCaretPosition(const Platform::IntPoint&);
@@ -312,10 +300,10 @@ public:
 
     void enableWebInspector();
     void disableWebInspector();
+    bool isWebInspectorEnabled();
     void enablePasswordEcho();
     void disablePasswordEcho();
-    void dispatchInspectorMessage(const char* message, int length);
-    WebCore::Frame* mainFrame() const;
+    void dispatchInspectorMessage(const std::string& message);
 
     // FIXME: Needs API review on this header. See PR #120402.
     void notifyPagePause();
@@ -344,6 +332,7 @@ private:
     friend class WebKit::BackingStorePrivate;
     friend class WebKit::RenderQueue;
     friend class WebKit::WebPageGroupLoadDeferrer;
+    friend class WebKit::WebPagePrivate;
     friend class WebCore::ChromeClientBlackBerry;
     friend class WebCore::FrameLoaderClientBlackBerry;
     WebPagePrivate* d;
diff --git a/Source/WebKit/blackberry/Api/WebPageClient.h b/Source/WebKit/blackberry/Api/WebPageClient.h
index 74b735c77..6799d428e 100644
--- a/Source/WebKit/blackberry/Api/WebPageClient.h
+++ b/Source/WebKit/blackberry/Api/WebPageClient.h
@@ -66,42 +66,6 @@ public:
         FlagWindowDefault = 0xFFFFFFFF,
     };
 
-    enum FocusType {
-        FocusUnknown = 0,
-        FocusNone,
-        FocusCanvas,
-        FocusImage,
-        FocusInputButton,
-        FocusInputCheckBox,
-        FocusInputColor,
-        FocusInputDate,
-        FocusInputDateTime,
-        FocusInputDateTimeLocal,
-        FocusInputEmail,
-        FocusInputFile,
-        FocusInputImage,
-        FocusInputMonth,
-        FocusInputNumber,
-        FocusInputPassword,
-        FocusInputRadio,
-        FocusInputRange,
-        FocusInputReset,
-        FocusInputSearch,
-        FocusInputSubmit,
-        FocusInputTelephone,
-        FocusInputText,
-        FocusInputTime,
-        FocusInputURL,
-        FocusInputWeek,
-        FocusInputUnknown,
-        FocusLink,
-        FocusObject,
-        FocusSelect,
-        FocusSVGElement,
-        FocusTextArea,
-        FocusVideo,
-    };
-
     enum AlertType {
         MediaOK = 0,
         MediaDecodeError,
@@ -165,7 +129,6 @@ public:
     virtual void drawTapHighlight(const Platform::IntRectRegion&, int red, int green, int blue, int alpha, bool hideAfterScroll) = 0;
     virtual void hideTapHighlight() = 0;
 
-    virtual void focusChanged(FocusType, int elementId) = 0;
     virtual void inputFocusGained(Platform::BlackBerryInputType, int inputStyle, bool waitForExplicitKeyboardShowCall) = 0;
     virtual void inputFocusLost() = 0;
     virtual void inputTextChanged() = 0;
@@ -261,7 +224,6 @@ public:
     virtual void touchEventModeChanged(Platform::TouchEventMode) = 0;
 
     virtual bool downloadAllowed(const char* url) = 0;
-    virtual void downloadRequested(const Platform::NetworkRequest&) = 0;
     virtual void downloadRequested(Platform::FilterStream*, const WebString& suggestedFilename) = 0;
 
     virtual int fullscreenStart(const char* contextName, Platform::Graphics::Window*, unsigned x, unsigned y, unsigned width, unsigned height) = 0;
diff --git a/Source/WebKit/blackberry/Api/WebPage_p.h b/Source/WebKit/blackberry/Api/WebPage_p.h
index e0238b6d6..ed3739c22 100644
--- a/Source/WebKit/blackberry/Api/WebPage_p.h
+++ b/Source/WebKit/blackberry/Api/WebPage_p.h
@@ -37,7 +37,6 @@ namespace WebCore {
 class DOMWrapperWorld;
 class Document;
 class Frame;
-class FrameView;
 class GeolocationControllerClientBlackBerry;
 class JavaScriptDebuggerBlackBerry;
 class KURL;
@@ -60,7 +59,6 @@ class BackingStoreTile;
 class DumpRenderTreeClient;
 class InPageSearchManager;
 class InputHandler;
-class InRegionScrollableArea;
 class SelectionHandler;
 class TouchEventHandler;
 class WebPageClient;
@@ -82,6 +80,8 @@ public:
     WebPagePrivate(WebPage*, WebPageClient*, const WebCore::IntRect&);
     virtual ~WebPagePrivate();
 
+    static WebCore::Page* core(const WebPage*);
+
     void init(const WebString& pageGroupName);
     bool handleMouseEvent(WebCore::PlatformMouseEvent&);
     bool handleWheelEvent(WebCore::PlatformWheelEvent&);
@@ -373,6 +373,7 @@ public:
     void setRootLayerCompositingThread(WebCore::LayerCompositingThread*);
     void commitRootLayer(const WebCore::IntRect&, const WebCore::IntSize&);
     void setIsAcceleratedCompositingActive(bool);
+    bool isAcceleratedCompositingActive() const { return m_isAcceleratedCompositingActive; }
     void destroyCompositor();
     void syncDestroyCompositorOnCompositingThread();
     void destroyLayerResources();
@@ -392,6 +393,8 @@ public:
     // Clean up any document related data we might be holding.
     void clearDocumentData(const WebCore::Document*);
 
+    void frameUnloaded(const WebCore::Frame*);
+
     static WebCore::RenderLayer* enclosingPositionedAncestorOrSelfIfPositioned(WebCore::RenderLayer*);
     static WebCore::RenderLayer* enclosingFixedPositionedAncestorOrSelfIfFixedPositioned(WebCore::RenderLayer*);
 
diff --git a/Source/WebKit/blackberry/Api/WebSettings.cpp b/Source/WebKit/blackberry/Api/WebSettings.cpp
index 960964cd8..f6067178a 100644
--- a/Source/WebKit/blackberry/Api/WebSettings.cpp
+++ b/Source/WebKit/blackberry/Api/WebSettings.cpp
@@ -52,6 +52,7 @@ DEFINE_STATIC_LOCAL(String, BlackBerryUserAgentString, ("BlackBerryUserAgentStri
 DEFINE_STATIC_LOCAL(String, BlackBerryUserScalableEnabled, ("BlackBerryUserScalableEnabled"));
 DEFINE_STATIC_LOCAL(String, BlackBerryViewportWidth, ("BlackBerryViewportWidth"));
 DEFINE_STATIC_LOCAL(String, BlackBerryZoomToFitOnLoadEnabled, ("BlackBerryZoomToFitOnLoadEnabled"));
+DEFINE_STATIC_LOCAL(String, SpatialNavigationEnabled, ("SpatialNavigationEnabled"));
 DEFINE_STATIC_LOCAL(String, WebKitDatabasePath, ("WebKitDatabasePath"));
 DEFINE_STATIC_LOCAL(String, WebKitDatabasesEnabled, ("WebKitDatabasesEnabled"));
 DEFINE_STATIC_LOCAL(String, WebKitDefaultFixedFontSize, ("WebKitDefaultFixedFontSize"));
@@ -82,7 +83,6 @@ DEFINE_STATIC_LOCAL(String, WebKitUserStyleSheet, ("WebKitUserStyleSheet"));
 DEFINE_STATIC_LOCAL(String, WebKitUserStyleSheetLocation, ("WebKitUserStyleSheetLocation"));
 DEFINE_STATIC_LOCAL(String, WebKitWebSocketsEnabled, ("WebKitWebSocketsEnabled"));
 DEFINE_STATIC_LOCAL(String, WebKitXSSAuditorEnabled, ("WebKitXSSAuditorEnabled"));
-DEFINE_STATIC_LOCAL(String, SpatialNavigationEnabled, ("SpatialNavigationEnabled"));
 
 // FIXME: We should consider moving all the mime type code into its own object.
 
@@ -131,6 +131,7 @@ static const MIMETypeAssociationMap& mimeTypeAssociationMap()
     mimeTypeMap->add("audio/x-aac", "audio/aac");
     mimeTypeMap->add("audio/x-amr", "audio/amr");
     mimeTypeMap->add("audio/mpegurl", "audio/x-mpegurl");
+    mimeTypeMap->add("audio/flac", "audio/x-flac");
     mimeTypeMap->add("video/3gp", "video/3gpp");
     mimeTypeMap->add("video/avi", "video/x-msvideo");
     mimeTypeMap->add("video/x-m4v", "video/mp4");
@@ -214,25 +215,25 @@ WebSettings* WebSettings::standardSettings()
     // FIXME: We should detect whether we are embedded in a browser or an email client and default to TextReflowEnabledOnlyForBlockZoom and TextReflowEnabled, respectively.
     settings->m_private->setTextReflowMode(BlackBerryTextReflowMode, TextReflowDisabled);
 
-    settings->m_private->setBoolean(BlackBerryUserScalableEnabled, true);
     settings->m_private->setBoolean(BlackBerryUseWebKitCache, true);
+    settings->m_private->setBoolean(BlackBerryUserScalableEnabled, true);
     settings->m_private->setBoolean(BlackBerryZoomToFitOnLoadEnabled, true);
+
     settings->m_private->setInteger(WebKitDefaultFontSize, 16);
     settings->m_private->setInteger(WebKitDefaultFixedFontSize, 13);
-    settings->m_private->setInteger(WebKitMinimumFontSize, 8);
     settings->m_private->setString(WebKitDefaultTextEncodingName, "iso-8859-1");
+    settings->m_private->setBoolean(WebKitDownloadableBinaryFontsEnabled, true);
     settings->m_private->setInteger(WebKitFirstScheduledLayoutDelay, 250); // Match Document::cLayoutScheduleThreshold.
+    settings->m_private->setString(WebKitFixedFontFamily, "Courier New");
     settings->m_private->setBoolean(WebKitJavaScriptEnabled, true);
     settings->m_private->setBoolean(WebKitLoadsImagesAutomatically, true);
-    settings->m_private->setBoolean(WebKitDownloadableBinaryFontsEnabled, true);
     settings->m_private->setUnsignedLongLong(WebKitLocalStorageQuota, 5 * 1024 * 1024);
     settings->m_private->setInteger(WebKitMaximumPagesInCache, 0);
-    settings->m_private->setBoolean(WebKitWebSocketsEnabled, true);
-    settings->m_private->setString(WebKitFixedFontFamily, "Courier New");
+    settings->m_private->setInteger(WebKitMinimumFontSize, 8);
     settings->m_private->setString(WebKitSansSeriffFontFamily, "Arial");
     settings->m_private->setString(WebKitSeriffFontFamily, "Times New Roman");
     settings->m_private->setString(WebKitStandardFontFamily, "Times New Roman");
-    settings->m_private->setBoolean(SpatialNavigationEnabled, false);
+    settings->m_private->setBoolean(WebKitWebSocketsEnabled, true);
 
     return settings;
 }
diff --git a/Source/WebKit/blackberry/ChangeLog b/Source/WebKit/blackberry/ChangeLog
index 60d341ad0..28317d8aa 100644
--- a/Source/WebKit/blackberry/ChangeLog
+++ b/Source/WebKit/blackberry/ChangeLog
@@ -1,3 +1,792 @@
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Rename NotificationPresenter to NotificationClient
+        https://bugs.webkit.org/show_bug.cgi?id=80488
+        <rdar://problem/10965558>
+
+        Reviewed by Kentaro Hara.
+
+        Refactor to use renamed WebCore::NotificationClient.
+        * WebCoreSupport/NotificationPresenterImpl.cpp:
+        (WebCore::NotificationPresenterImpl::instance):
+        (WebCore::NotificationPresenterImpl::show):
+        (WebCore::NotificationPresenterImpl::checkPermission):
+        * WebCoreSupport/NotificationPresenterImpl.h:
+        (NotificationPresenterImpl):
+
+2012-03-09  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Web Notification not working after rebase
+        https://bugs.webkit.org/show_bug.cgi?id=80690
+
+        Reviewed by George Staikos.
+
+        1. NotificationPresenterImpl should be in namespace WebCore
+        2. Need to connect NotificationPresenterImpl to webcore the new way:
+           WebCore::provideNotification(Page*, NotificationPresenter*)
+        3. Remove the old way of connecting the Notification:
+           ChromeClientBlackBerry::notificationPresenter()
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::init):
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore):
+        * WebCoreSupport/ChromeClientBlackBerry.h:
+        (ChromeClientBlackBerry):
+        * WebCoreSupport/NotificationPresenterImpl.cpp:
+        * WebCoreSupport/NotificationPresenterImpl.h:
+
+2012-03-08  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Always use the current focused node when processing focus changes
+        https://bugs.webkit.org/show_bug.cgi?id=80594
+
+        Reviewed by Antonio Gomes.
+
+        Guard against toRange or fromRange being null when called
+        as part of a clear event.
+
+        * WebCoreSupport/EditorClientBlackBerry.cpp:
+        (WebCore::EditorClientBlackBerry::shouldChangeSelectedRange):
+
+2012-03-08  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Block file-to-file access by default
+        https://bugs.webkit.org/show_bug.cgi?id=80605
+
+        Reviewed by Rob Buis.
+
+        Turn off allowFileAccessFromFileURLs() by default.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::init):
+
+2012-03-08  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Always use the current focused node when processing focus changes
+        https://bugs.webkit.org/show_bug.cgi?id=80594
+
+        Reviewed by Antonio Gomes.
+
+        Update InputHandler focused node handling to strictly use
+        the currently focused node.  This prevents a handling loop
+        when JS is modifying the focus and we get a late notification
+        of a past change from ChromeClientBlackBerry with the previously
+        unfocused node.
+
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::focusedNodeChanged):
+        * WebCoreSupport/EditorClientBlackBerry.cpp:
+        (WebCore::EditorClientBlackBerry::shouldChangeSelectedRange):
+        (WebCore::EditorClientBlackBerry::setInputMethodState):
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::focusedNodeChanged):
+        * WebKitSupport/InputHandler.h:
+
+2012-03-07  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] WebKit rendering problem when show/hide VKB
+        https://bugs.webkit.org/show_bug.cgi?id=80448
+        RIM PR: 141727
+
+        Reviewed by Antonio Gomes.
+
+        When setting viewport size, layout happens inside
+        WebPagePrivate::setDefaultLayoutSize(), in this way, the layout is
+        outside of the code path of "needsLayout" so that the contents are
+        not rendered into the backing store. This is a regression of r108718,
+        switch back to do the layout inside the public API
+        WebPage::setDefaultLayoutSize().
+
+        We haven't upstreamed the manual tests directory yet, therefore,
+        the new manual test case will be upstreamed later.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setDefaultLayoutSize):
+        (BlackBerry::WebKit::WebPage::setDefaultLayoutSize):
+
+2012-03-06  Lianghui Chen  <liachen@rim.com>
+
+        [BlackBerry] Set correct ResourceRequest target type.
+        https://bugs.webkit.org/show_bug.cgi?id=80430
+
+        Reviewed by Rob Buis.
+
+        Removed unused code in dispatchWillSendRequest(). These codes are too
+        late as the target type has already been referred to when calling
+        ResourceRequest::initializePlatformRequest().
+
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchWillSendRequest):
+
+2012-03-06  Lianghui Chen  <liachen@rim.com>
+
+        [BlackBerry] Remove unused and unneeded WebPageClient::downloadRequested(NetworkRequest&)
+        https://bugs.webkit.org/show_bug.cgi?id=80438
+
+        Reviewed by Antonio Gomes.
+
+        * Api/WebPageClient.h:
+
+2012-03-06  Jakob Petsovits  <jpetsovits@rim.com>
+
+        [BlackBerry] Don't suspend accel comp when backgrounding a page.
+        https://bugs.webkit.org/show_bug.cgi?id=80369
+        RIM PR: 137609
+
+        Reviewed by Adam Treat.
+
+        Just because the page is in the background doesn't mean
+        it's invisible, doesn't mean it won't have to be redrawn
+        at some point - on rotation, for instance.
+
+        We still suspend accelerated compositing on setVisible(false).
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::notifyPageBackground):
+        (BlackBerry::WebKit::WebPage::notifyPageForeground):
+
+2012-03-06  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>
+
+        [BlackBerry] function rename issue after MediaPlayerPrivateBlackBerry.[cpp\h] upstream
+        https://bugs.webkit.org/show_bug.cgi?id=80377
+
+        Reviewed by Rob Buis.
+
+        As some of the function names changed in class MediaPlayerPrivate
+        with the upstream of MediaPlayerPrivateBlackBerry.[cpp|h], we
+        should update WebKit/blackberry/Api/WebPage.cpp which uses these
+        functions accordingly.
+        Renamed functions in class MediaPlayerPrivate:
+        windowGet() -> getWindow()
+        windowPositionGet() -> getWindowPosition()
+        mmrContextNameGet() -> mmrContextName()
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::enterFullscreenForNode):
+
+2012-03-05  Eli Fidler  <efidler@rim.com>
+
+        The minimum font size WebSetting should actually change the LOGICAL font size in WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=80312
+        RIM PR: 139874
+
+        Reviewed by George Staikos.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::didChangeSettings):
+
+2012-03-05  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Make accelerated compositing work again with direct rendering.
+        https://bugs.webkit.org/show_bug.cgi?id=80181
+        RIM PR: 139110
+
+        Reviewed by Antonio Gomes.
+        Internally reviewed by Arvid Nilsson.
+
+        The significant amount of refactoring and optimization work
+        that has gone into accelerated compositing missed out on
+        some of the code paths that are being used in direct rendering.
+
+        Animations were relying on blitVisibleContents() only (which
+        is a no-op in direct rendering mode). There were early returns
+        which are suitable to determine whether screen contents need
+        to be updated at all; however, when we're already forcing a
+        re-render then those checks would cause the composition surface
+        not to appear at all, or avoid drawing new animation frames.
+
+        We went through dispatchMessage(), potentially causing
+        mismatches between rendered (but not yet posted) back content
+        and layers composited on top of it. As we're rendering onto
+        the sole target surface (the window) directly and posting
+        from the same thread, we have to wait for compositing on the
+        UI thread to finish before posting the window.
+
+        In turn, this patch combines both drawSubLayers() and
+        blendCompositingSurface() calls into one method, reducing
+        the number of messages to the UI thread within
+        renderDirectToWindow() to one.
+
+        blendCompositingMessage() in renderDirectToScreen() was called
+        with contents coordinates rather than viewport coordinates.
+        That caused some of the composited content to be cut off when
+        the scroll position wasn't (0, 0).
+
+        We called copyPreviousContentsToBackSurfaceOfWindow() twice for
+        one frame, in both renderDirectToWindow() and invalidateWindow().
+        Only one of those (the latter one) is necessary.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::BackingStorePrivate):
+        (BlackBerry::WebKit::BackingStorePrivate::renderDirectToWindow):
+        (BlackBerry::WebKit::BackingStorePrivate::drawSubLayers):
+        (WebKit):
+        (BlackBerry::WebKit::BackingStorePrivate::drawAndBlendLayersForDirectRendering):
+        * Api/BackingStore.h:
+        (WebKit):
+        * Api/BackingStore_p.h:
+        (BackingStorePrivate):
+        (BlackBerry::WebKit::BackingStorePrivate::isDirectRenderingAnimationMessageScheduled):
+        (BlackBerry::WebKit::BackingStorePrivate::setDirectRenderingAnimationMessageScheduled):
+        * Api/WebPage_p.h:
+        (BlackBerry::WebKit::WebPagePrivate::isAcceleratedCompositingActive):
+        (WebPagePrivate):
+        * WebKitSupport/WebPageCompositor.cpp:
+        (BlackBerry::WebKit::WebPageCompositor::WebPageCompositor):
+        (BlackBerry::WebKit::WebPageCompositor::~WebPageCompositor):
+        (BlackBerry::WebKit::WebPageCompositor::drawLayers):
+        (BlackBerry::WebKit::WebPageCompositor::animationTimerFired):
+        * WebKitSupport/WebPageCompositor.h:
+        (WebPageCompositor):
+
+2012-03-05  George Staikos  <gstaikos@rim.com>
+
+        [BlackBerry] DOMSupport visibleSelectionForRangeInputElement incorrectly dereferences a null range.
+        https://bugs.webkit.org/show_bug.cgi?id=80274
+
+        Reviewed by Antonio Gomes.
+
+        A null range can be returned so we should not blindly deref it.
+        Reviewed Internally by Mike Fenton.
+
+        * WebKitSupport/DOMSupport.cpp:
+        (BlackBerry::WebKit::DOMSupport::visibleSelectionForRangeInputElement):
+
+2012-03-04  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>
+
+        [BlackBerry] upstream CredentialManager and CredentialTransformData implementation
+        https://bugs.webkit.org/show_bug.cgi?id=80107
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream of CredentialManager.[h|cpp] and
+        CredentialTransformData.[h|cpp].
+        No new test.
+
+        * WebCoreSupport/CredentialManager.cpp: Added.
+        (WebCore):
+        (WebCore::CredentialManager::CredentialManager):
+        (WebCore::CredentialManager::autofillAuthenticationChallenge):
+        (WebCore::CredentialManager::autofillPasswordForms):
+        (WebCore::CredentialManager::saveCredentialIfConfirmed):
+        * WebCoreSupport/CredentialManager.h: Added.
+        (WebKit):
+        (WebCore):
+        (CredentialManager):
+        * WebCoreSupport/CredentialTransformData.cpp: Added.
+        (WebCore::CredentialTransformData::CredentialTransformData):
+        (WebCore):
+        (WebCore::CredentialTransformData::url):
+        (WebCore::CredentialTransformData::credential):
+        (WebCore::CredentialTransformData::setCredential):
+        (WebCore::CredentialTransformData::findPasswordFormFields):
+        * WebCoreSupport/CredentialTransformData.h: Added.
+        (WebCore):
+        (CredentialTransformData):
+        (WebCore::CredentialTransformData::isValid):
+        (WebCore::CredentialTransformData::protectionSpace):
+
+2012-03-04  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Fixed positioned element not correctly positioned after orientation change, when viewport metatag is used
+        https://bugs.webkit.org/show_bug.cgi?id=80228
+        PR #138865
+
+        Reviewed by George Staikos.
+
+        Viewport size changes in two main scenarios:
+        - orientation changes;
+        - virtual keyboard pop up/hide.
+
+        When we are setting a new viewport size, we need to
+        update the FixedReportedSize of the mainframe. This size
+        is used to return innerWidth|Heigth as well as to calculate
+        the fixed position elements height relative to the RenderView [1].
+
+        [1] RenderBox::containingBlockLogicalHeightForPositioned.
+
+        When we are rotating, we need to delay setting the new FixedReportedSize
+        till we layout and are able to figure out the new contents size. At this
+        time we call setFixedReportedSize, but we do not reposition the fixed elemts
+        afterwards.
+
+        Patch adds a call to FrameView::repaintFixedElementsAfterScrolling, after
+        setting the new size.
+
+        Source/WebKit/blackberry:
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setViewportSize):
+
+2012-03-02  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Expose WebInspector state to client and clean up WebSettings
+        https://bugs.webkit.org/show_bug.cgi?id=80177
+
+        Reviewed by Antonio Gomes.
+
+        Expose the Web Inspector state to WebPage client's and
+        re-order initialization of WebSettings to be alphabetical
+        matching their definitions.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::isWebInspectorEnabled):
+        * Api/WebPage.h:
+        * Api/WebSettings.cpp:
+        (BlackBerry::WebKit::WebSettings::standardSettings):
+
+2012-03-02  Arvid Nilsson  <anilsson@rim.com>
+
+        Accelerated compositing: Checkerboard never goes away
+        https://bugs.webkit.org/show_bug.cgi?id=79020
+        RIM PR #134164
+
+        Reviewed by Adam Treat.
+
+        Checkerboard appears in accelerated compositing layers when there's no
+        texture for (part of) a layer. The layer renderer queues up some render
+        jobs and schedules a commit to make the WebKit thread process those
+        jobs. Render jobs performed during commit cause texture upload jobs to
+        be scheduled on the UI thread. Texture uploads are performed when next
+        drawing the layers.
+
+        Unfortunately, sometimes commit operation happens without a subsequent
+        call draw the layers.
+
+        In order to implement one-shot drawing sync, I added a call to
+        commitRootLayerIfNeeded() in BackingStore::renderContents(), and
+        I was lucky that most of the time, renderContents() is followed by
+        blit(Visible)Contents() which in turn draws the layers.
+        However, render is not always followed by a blit, for example when
+        rendering offscreen tiles in BackingStore::renderOnIdle(), and in
+        direct rendering mode.
+
+        Fixed by making sure that every call to commitRootLayerIfNeeded() that
+        returns true is followed by a call to drawLayersOnCommit(), unless a
+        blit was requested already.
+
+        Also tweak the logic for one-shot drawing sync to make the code in
+        drawLayersOnCommit() reusable outside of rootLayerCommitTimerFired().
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::BackingStorePrivate):
+        (BlackBerry::WebKit::BackingStorePrivate::renderOnTimer):
+        (BlackBerry::WebKit::BackingStorePrivate::renderOnIdle):
+        (BlackBerry::WebKit::BackingStorePrivate::willFireTimer):
+        (BlackBerry::WebKit::BackingStorePrivate::renderDirectToWindow):
+        (BlackBerry::WebKit::BackingStorePrivate::render):
+        (BlackBerry::WebKit::BackingStorePrivate::blitVisibleContents):
+        (BlackBerry::WebKit::BackingStorePrivate::blitContents):
+        (BlackBerry::WebKit::BackingStorePrivate::renderContents):
+        (WebKit):
+        (BlackBerry::WebKit::BackingStorePrivate::drawLayersOnCommitIfNeeded):
+        * Api/BackingStore_p.h:
+        (BackingStorePrivate):
+        (BlackBerry::WebKit::BackingStorePrivate::willDrawLayersOnCommit):
+
+2012-03-02  Adam Treat  <atreat@rim.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80161
+        PR: 141157
+
+        BlackBerryPlatformScreen.h API has been updated.  Reflect those
+        changes in our usage.
+
+        Reviewed by Antonio Gomes.
+        Internally reviewed by Jakob Petsovits.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::tileWidth):
+        (BlackBerry::WebKit::BackingStorePrivate::tileHeight):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::init):
+        (BlackBerry::WebKit::WebPagePrivate::transformedViewportSize):
+        (BlackBerry::WebKit::WebPagePrivate::fixedLayoutSize):
+        (BlackBerry::WebKit::WebPagePrivate::recomputeVirtualViewportFromViewportArguments):
+        (BlackBerry::WebKit::WebPagePrivate::setDefaultLayoutSize):
+        (BlackBerry::WebKit::WebPagePrivate::defaultMaxLayoutSize):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::restoreViewState):
+        * WebKitSupport/SurfacePool.cpp:
+        (BlackBerry::WebKit::createCompositingSurface):
+
+2012-03-02  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Set the devicePixelRatio from the results of computeViewportAttributes
+        https://bugs.webkit.org/show_bug.cgi?id=80160
+
+        Reviewed by Antonio Gomes.
+
+        Tested by going to layout test fast/viewport/viewport-95.html and viewport-93.html
+        Previously when executing window.devicePixelRatio these two pages returned 1 now
+        they report the devicePixelRatio returned by computeViewportAttributes.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::recomputeVirtualViewportFromViewportArguments):
+
+2012-03-02  Jacky Jiang  <zhajiang@rim.com>
+
+        Fix a warning in InputHandler::learnText()
+        https://bugs.webkit.org/show_bug.cgi?id=80049
+
+        Reviewed by Antonio Gomes.
+
+        Fix a warning of the comparison "textInField.length() <=
+        MaxLearnTextDataSize" in InputHandler::learnText().
+
+        Rubber-stamped internally by Mike Fenton.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::learnText):
+
+2012-03-01  Andy Chen  <andchen@rim.com>
+
+        [BlackBerry] Implement features for find-in-page
+        https://bugs.webkit.org/show_bug.cgi?id=79820
+
+        Reviewed by Antonio Gomes.
+
+        - Make it be able to search text around the whole page instead of single frame.
+        - Make it be able to start new search from active selection and last active match.
+
+        No new tests as this patch doesn't change behavior.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::frameUnloaded):
+        * Api/WebPage_p.h:
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchWillClose):
+        (WebCore::FrameLoaderClientBlackBerry::detachedFromParent2):
+        * WebKitSupport/DOMSupport.cpp:
+        (BlackBerry::WebKit::DOMSupport::incrementFrame):
+        * WebKitSupport/DOMSupport.h:
+        * WebKitSupport/InPageSearchManager.cpp:
+        (BlackBerry::WebKit::InPageSearchManager::findNextString):
+        (BlackBerry::WebKit::InPageSearchManager::shouldSearchForText):
+        (BlackBerry::WebKit::InPageSearchManager::findAndMarkText):
+        (BlackBerry::WebKit::InPageSearchManager::setMarkerActive):
+        (BlackBerry::WebKit::InPageSearchManager::frameUnloaded):
+        * WebKitSupport/InPageSearchManager.h:
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::frameUnloaded):
+        * WebKitSupport/InputHandler.h:
+
+2012-03-01  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Web Notification crashes the browser.
+        https://bugs.webkit.org/show_bug.cgi?id=79897
+
+        Reviewed by Antonio Gomes.
+
+        The reason of the crash is that it still uses the iterator
+        after been removed from the container, which invalidates the
+        iterator. 
+        We should stop processing after we have found the element
+        and removed from the container through the iterator.
+
+        This patch only fixes the crash issue, but not any notification
+        functionality issue, which is tracked seperatly.
+
+        Test case: http://sandbox.gtaero.net/chrome/notifications.php
+
+        * WebCoreSupport/NotificationPresenterImpl.cpp:
+        (WebKit::NotificationPresenterImpl::onPermission):
+        (WebKit::NotificationPresenterImpl::notificationClicked):
+
+2012-03-01  Mike Fenton  <mifenton@rim.com>
+
+        Autocomplete attribute should apply to textarea's.
+        https://bugs.webkit.org/show_bug.cgi?id=79929
+
+        Reviewed by Antonio Gomes.
+
+        Add local static Qualified name for autocorrect attribute.
+
+        * WebKitSupport/DOMSupport.cpp:
+        (BlackBerry::WebKit::DOMSupport::elementSupportsAutocorrect):
+
+2012-02-29  Mike Fenton  <mifenton@rim.com>
+
+        Autocomplete attribute should apply to textarea's.
+        https://bugs.webkit.org/show_bug.cgi?id=79929
+
+        Reviewed by Antonio Gomes.
+
+        Allow the autocomplete attribute to bubble back to the form setting.
+
+        Expand support to include checking autocorrect, autocomplete and
+        name/id matching to text areas.
+
+        Reviewed internally by Nima Ghanavatian and Gen Mak.
+
+        * WebKitSupport/DOMSupport.cpp:
+        (BlackBerry::WebKit::DOMSupport::elementSupportsAutocorrect):
+        (BlackBerry::WebKit::DOMSupport::elementSupportsAutocomplete):
+        (BlackBerry::WebKit::DOMSupport::elementAttributeState):
+        * WebKitSupport/DOMSupport.h:
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::inputStyle):
+
+2012-02-29  Max Feil  <mfeil@rim.com>
+
+        [BlackBerry] Add support for FLAC audio and OGG/Vorbis audio
+        https://bugs.webkit.org/show_bug.cgi?id=79519
+
+        Reviewed by Antonio Gomes.
+
+        * Api/WebSettings.cpp:
+        (BlackBerry::WebKit::mimeTypeAssociationMap):
+
+2012-02-28  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Change the API to use std::string
+        https://bugs.webkit.org/show_bug.cgi?id=79818
+
+        Reviewed by Antonio Gomes.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::dispatchInspectorMessage):
+        * Api/WebPage.h:
+
+2012-02-28  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] x86 build fix after cleaning up WebPage.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79814
+
+        Reviewed by Antonio Gomes.
+
+        x86 build fix, keep WebPage::destroyWebPageCompositor() method where it
+        was which was outside of USE(ACCELERATED_COMPOSITING).
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::destroyWebPageCompositor):
+        (WebKit):
+
+2012-02-28  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Remove unused focusedNodeChange notifications from the Chrome client.
+        https://bugs.webkit.org/show_bug.cgi?id=79794
+
+        Reviewed by Rob Buis.
+
+        Remove unused notification for focusedNodeChanged.
+
+        Internally reviewed by Gen Mak.
+
+        * Api/WebPageClient.h:
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::focusedNodeChanged):
+
+2012-02-27  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] Upstream BlackBerry API web page related files
+        https://bugs.webkit.org/show_bug.cgi?id=74380
+
+        Reviewed by Antonio Gomes.
+
+        Clean up WebPage.{h, cpp} and WebPage_p.h.
+        - Remove WebPage::mainFrame() as it is bad to expose WebCore::Frame in
+          the public API, adapt to the change by adding a new method
+          WebPagePrivate::core(Const WebPage*) and expose it to
+          DumpRenderTreeSupport.
+        - Rename WebPage::spellCheckingEnabled to
+          WebPage::setSpellCheckingEnabled.
+        - Remove unused WebPage::focusNodeRect().
+        - Remove extra blank lines.
+        - Put WebPage methods and their associated WebPagePrivate methods
+          together.
+
+        No new tests as this patch doesn't change behavior.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::WebPage):
+        (WebKit):
+        (BlackBerry::WebKit::WebPage::~WebPage):
+        (BlackBerry::WebKit::WebPagePrivate::core):
+        (BlackBerry::WebKit::WebPage::load):
+        (BlackBerry::WebKit::WebPage::loadExtended):
+        (BlackBerry::WebKit::WebPage::loadFile):
+        (BlackBerry::WebKit::WebPage::download):
+        (BlackBerry::WebKit::WebPage::loadString):
+        (BlackBerry::WebKit::WebPage::executeJavaScript):
+        (BlackBerry::WebKit::WebPage::executeJavaScriptInIsolatedWorld):
+        (BlackBerry::WebKit::WebPage::stopLoading):
+        (BlackBerry::WebKit::WebPage::prepareToDestroy):
+        (BlackBerry::WebKit::WebPage::setScrollPosition):
+        (BlackBerry::WebKit::WebPage::scrollBy):
+        (BlackBerry::WebKit::WebPage::notifyInRegionScrollStatusChanged):
+        (BlackBerry::WebKit::WebPage::zoomToFitScale):
+        (BlackBerry::WebKit::WebPage::initialScale):
+        (BlackBerry::WebKit::WebPage::maximumScale):
+        (BlackBerry::WebKit::WebPage::scrollPosition):
+        (BlackBerry::WebKit::WebPage::viewportSize):
+        (BlackBerry::WebKit::WebPage::activeNodeContext):
+        (BlackBerry::WebKit::WebPage::assignFocus):
+        (BlackBerry::WebKit::WebPage::blockZoomAnimationFinished):
+        (BlackBerry::WebKit::WebPage::onInputLocaleChanged):
+        (BlackBerry::WebKit::WebPage::setScreenOrientation):
+        (BlackBerry::WebKit::WebPage::applyPendingOrientationIfNeeded):
+        (BlackBerry::WebKit::WebPage::setViewportSize):
+        (BlackBerry::WebKit::WebPage::setDefaultLayoutSize):
+        (BlackBerry::WebKit::WebPage::setScrollOriginPoint):
+        (BlackBerry::WebKit::WebPage::textEncoding):
+        (BlackBerry::WebKit::WebPage::forcedTextEncoding):
+        (BlackBerry::WebKit::WebPage::setForcedTextEncoding):
+        (BlackBerry::WebKit::WebPage::setSpellCheckingEnabled):
+        (BlackBerry::WebKit::parentLayer):
+        (BlackBerry::WebKit::WebPagePrivate::inRegionScrollableAreasForPoint):
+        (BlackBerry::WebKit::WebPage::destroyWebPageCompositor):
+        * Api/WebPage.h:
+        (WebCore):
+        (WebKit):
+        * Api/WebPage_p.h:
+        (WebCore):
+        (WebKit):
+        * WebKitSupport/DumpRenderTreeSupport.cpp:
+        (DumpRenderTreeSupport::corePage):
+        (DumpRenderTreeSupport::numberOfPendingGeolocationPermissionRequests):
+        (DumpRenderTreeSupport::resetGeolocationMock):
+        (DumpRenderTreeSupport::setMockGeolocationError):
+        (DumpRenderTreeSupport::setMockGeolocationPermission):
+        (DumpRenderTreeSupport::setMockGeolocationPosition):
+        (DumpRenderTreeSupport::scalePageBy):
+        * WebKitSupport/DumpRenderTreeSupport.h:
+        (WebCore):
+        (DumpRenderTreeSupport):
+
+2012-02-27  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Selection handling should be entirely directional
+        https://bugs.webkit.org/show_bug.cgi?id=79692
+
+        Reviewed by Antonio Gomes.
+
+        Make all VisibleSelections directional.
+
+        * WebKitSupport/SelectionHandler.cpp:
+        (BlackBerry::WebKit::SelectionHandler::updateOrHandleInputSelection):
+        (BlackBerry::WebKit::SelectionHandler::setSelection):
+
+2012-02-27  Ed Baker  <edbaker@rim.com>
+
+        [BlackBerry] Dragging a selection handle outside of the content bounding box does not update the selection range correctly
+        https://bugs.webkit.org/show_bug.cgi?id=78608
+
+        Ensure that when selection handles leave the content bounding box that
+        the handle not being dragged remains fixed. Do not apply padding to a
+        direction that would cause the selection to shrink when performing the
+        handle direction detection.
+
+        Reviewed by Antonio Gomes.
+
+        * WebKitSupport/DOMSupport.cpp:
+        (BlackBerry::WebKit::DOMSupport::convertPointToFrame):
+        * WebKitSupport/DOMSupport.h:
+        * WebKitSupport/SelectionHandler.cpp:
+        (BlackBerry::WebKit::clamp):
+        (BlackBerry::WebKit::directionalVisiblePositionAtExtentOfBox):
+        (BlackBerry::WebKit::SelectionHandler::extendSelectionToFieldBoundary):
+        (BlackBerry::WebKit::SelectionHandler::setSelection):
+        (BlackBerry::WebKit::SelectionHandler::clipPointToVisibleContainer):
+        * WebKitSupport/SelectionHandler.h:
+
+2012-02-27  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream accelerated compositing helper class
+        https://bugs.webkit.org/show_bug.cgi?id=78448
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * WebKitSupport/FrameLayers.cpp: Added.
+        * WebKitSupport/FrameLayers.h: Added.
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        * WebCoreSupport/ChromeClientBlackBerry.h:
+        (ChromeClientBlackBerry):
+
+2012-02-24  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Eliminate excessive BlackBerry::Platform use in InputHandler
+        https://bugs.webkit.org/show_bug.cgi?id=79393
+
+        Reviewed by Antonio Gomes.
+
+        Cleanup usage of BlackBerry::Platform in InputHandler.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::convertStringToWchar):
+        (BlackBerry::WebKit::convertStringToWcharVector):
+        (BlackBerry::WebKit::convertSpannableStringToString):
+        (BlackBerry::WebKit::InputHandler::learnText):
+        (BlackBerry::WebKit::InputHandler::setElementUnfocused):
+        (BlackBerry::WebKit::InputHandler::shouldAcceptInputFocus):
+        (BlackBerry::WebKit::InputHandler::setElementFocused):
+        (BlackBerry::WebKit::InputHandler::nodeTextChanged):
+        (BlackBerry::WebKit::InputHandler::ensureFocusTextElementVisible):
+        (BlackBerry::WebKit::InputHandler::frameUnloaded):
+        (BlackBerry::WebKit::InputHandler::selectionChanged):
+        (BlackBerry::WebKit::InputHandler::setSelection):
+        (BlackBerry::WebKit::InputHandler::handleKeyboardInput):
+        (BlackBerry::WebKit::InputHandler::deleteTextRelativeToCursor):
+        (BlackBerry::WebKit::InputHandler::deleteText):
+        (BlackBerry::WebKit::InputHandler::spannableTextInRange):
+        (BlackBerry::WebKit::InputHandler::setComposingRegion):
+        (BlackBerry::WebKit::InputHandler::finishComposition):
+        (BlackBerry::WebKit::InputHandler::setText):
+        (BlackBerry::WebKit::InputHandler::setTextAttributes):
+        (BlackBerry::WebKit::InputHandler::setRelativeCursorPosition):
+        (BlackBerry::WebKit::InputHandler::setSpannableTextAndRelativeCursor):
+        (BlackBerry::WebKit::InputHandler::setComposingText):
+        (BlackBerry::WebKit::InputHandler::commitText):
+
+2012-02-24  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Eliminate excessive BlackBerry::Platform use in SelectionHandler.
+        https://bugs.webkit.org/show_bug.cgi?id=79391
+
+        Reviewed by Antonio Gomes.
+
+        Clean up usage of BlackBerry::Platform in SelectionHandler and
+        explicitly define what namespace to use for ambiguous objects like
+        IntRect and IntPoint.
+
+        * WebKitSupport/SelectionHandler.cpp:
+        (BlackBerry::WebKit::SelectionHandler::cancelSelection):
+        (BlackBerry::WebKit::SelectionHandler::getConsolidatedRegionOfTextQuadsForSelection):
+        (BlackBerry::WebKit::visiblePositionForPointIgnoringClipping):
+        (BlackBerry::WebKit::directionOfPointRelativeToRect):
+        (BlackBerry::WebKit::SelectionHandler::shouldUpdateSelectionOrCaretForPoint):
+        (BlackBerry::WebKit::SelectionHandler::setCaretPosition):
+        (BlackBerry::WebKit::directionalVisiblePositionAtExtentOfBox):
+        (BlackBerry::WebKit::pointIsOutsideOfBoundingBoxInDirection):
+        (BlackBerry::WebKit::SelectionHandler::extendSelectionToFieldBoundary):
+        (BlackBerry::WebKit::SelectionHandler::updateOrHandleInputSelection):
+        (BlackBerry::WebKit::SelectionHandler::clipPointToFocusNode):
+        (BlackBerry::WebKit::SelectionHandler::setSelection):
+        (BlackBerry::WebKit::SelectionHandler::selectAtPoint):
+        (BlackBerry::WebKit::SelectionHandler::selectObject):
+        (BlackBerry::WebKit::comparePointsToReferencePoint):
+        (BlackBerry::WebKit::minXMinYCorner):
+        (BlackBerry::WebKit::maxXMinYCorner):
+        (BlackBerry::WebKit::minXMaxYCorner):
+        (BlackBerry::WebKit::maxXMaxYCorner):
+        (BlackBerry::WebKit::caretLocationForRect):
+        (BlackBerry::WebKit::caretComparisonPointForRect):
+        (BlackBerry::WebKit::adjustCaretRects):
+        (BlackBerry::WebKit::SelectionHandler::clipRegionToVisibleContainer):
+        (BlackBerry::WebKit::referencePoint):
+        (BlackBerry::WebKit::SelectionHandler::selectionPositionChanged):
+        (BlackBerry::WebKit::SelectionHandler::caretPositionChanged):
+        (BlackBerry::WebKit::SelectionHandler::selectionContains):
+
 2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
 
         SpellCheckRequest needs to know the context where the spellcheck happened.
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
index b12f49b21..3fc4afb62 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
@@ -43,7 +43,6 @@
 #include "KURL.h"
 #include "Node.h"
 #include "NotImplemented.h"
-#include "NotificationPresenterImpl.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "PageGroupLoadDeferrer.h"
@@ -188,85 +187,9 @@ void ChromeClientBlackBerry::takeFocus(FocusDirection)
     notImplemented();
 }
 
-void ChromeClientBlackBerry::focusedNodeChanged(Node* node)
-{
-    WebPageClient::FocusType type = WebPageClient::FocusUnknown;
-
-    if (!node)
-        type = WebPageClient::FocusNone;
-    else if (node->isSVGElement())
-        type = WebPageClient::FocusSVGElement;
-    else if (node->isHTMLElement()) {
-        if (node->hasTagName(HTMLNames::aTag)) {
-            type = WebPageClient::FocusLink;
-        } else if (node->hasTagName(HTMLNames::inputTag)) {
-            HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(node);
-            if (inputElement->hasTagName(HTMLNames::isindexTag) || inputElement->isInputTypeHidden())
-                type = WebPageClient::FocusInputUnknown;
-            else if (inputElement->isTextButton())
-                type = WebPageClient::FocusInputButton;
-            else if (inputElement->isCheckbox())
-                type = WebPageClient::FocusInputCheckBox;
-#if ENABLE(INPUT_COLOR)
-            else if (inputElement->isColorControl())
-                type = WebPageClient::FocusInputColor;
-#endif
-            else if (inputElement->isDateControl())
-                type = WebPageClient::FocusInputDate;
-            else if (inputElement->isDateTimeControl())
-                type = WebPageClient::FocusInputDateTime;
-            else if (inputElement->isDateTimeLocalControl())
-                type = WebPageClient::FocusInputDateTimeLocal;
-            else if (inputElement->isEmailField())
-                type = WebPageClient::FocusInputEmail;
-            else if (inputElement->isFileUpload())
-                type = WebPageClient::FocusInputFile;
-            else if (inputElement->isImageButton())
-                type = WebPageClient::FocusInputImage;
-            else if (inputElement->isMonthControl())
-                type = WebPageClient::FocusInputMonth;
-            else if (inputElement->isNumberField())
-                type = WebPageClient::FocusInputNumber;
-            else if (inputElement->isPasswordField())
-                type = WebPageClient::FocusInputPassword;
-            else if (inputElement->isRadioButton())
-                type = WebPageClient::FocusInputRadio;
-            else if (inputElement->isRangeControl())
-                type = WebPageClient::FocusInputRange;
-            else if (inputElement->isResetButton())
-                type = WebPageClient::FocusInputReset;
-            else if (inputElement->isSearchField())
-                type = WebPageClient::FocusInputSearch;
-            else if (inputElement->isSubmitButton())
-                type = WebPageClient::FocusInputSubmit;
-            else if (inputElement->isTelephoneField())
-                type = WebPageClient::FocusInputTelephone;
-            else if (inputElement->isURLField())
-                type = WebPageClient::FocusInputURL;
-            else if (inputElement->isTextField())
-                type = WebPageClient::FocusInputText;
-            else if (inputElement->isTimeControl())
-                type = WebPageClient::FocusInputTime;
-            // FIXME: missing WEEK popup selector
-            else
-                type = WebPageClient::FocusInputUnknown;
-        } else if (node->hasTagName(HTMLNames::imgTag))
-            type = WebPageClient::FocusImage;
-        else if (node->hasTagName(HTMLNames::objectTag))
-            type = WebPageClient::FocusObject;
-        else if (node->hasTagName(HTMLNames::videoTag))
-            type = WebPageClient::FocusVideo;
-        else if (node->hasTagName(HTMLNames::selectTag))
-            type = WebPageClient::FocusSelect;
-        else if (node->hasTagName(HTMLNames::textareaTag))
-            type = WebPageClient::FocusTextArea;
-        else if (node->hasTagName(HTMLNames::canvasTag))
-            type = WebPageClient::FocusCanvas;
-    }
-
-    m_webPagePrivate->m_inputHandler->nodeFocused(node);
-
-    m_webPagePrivate->m_client->focusChanged(type, reinterpret_cast<int>(node));
+void ChromeClientBlackBerry::focusedNodeChanged(Node*)
+{
+    m_webPagePrivate->m_inputHandler->focusedNodeChanged();
 }
 
 void ChromeClientBlackBerry::focusedFrameChanged(Frame*)
@@ -801,13 +724,6 @@ void ChromeClientBlackBerry::didSetSVGZoomAndPan(Frame* frame, unsigned short zo
 }
 #endif
 
-#if ENABLE(NOTIFICATIONS)
-NotificationPresenter* ChromeClientBlackBerry::notificationPresenter() const
-{
-    return WebKit::NotificationPresenterImpl::instance();
-}
-#endif
-
 #if USE(ACCELERATED_COMPOSITING)
 void ChromeClientBlackBerry::attachRootGraphicsLayer(Frame* frame, GraphicsLayer* graphicsLayer)
 {
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
index 99c8b6062..b24d39c80 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
@@ -128,10 +128,6 @@ public:
     virtual void requestWebGLPermission(Frame*);
 #endif
 
-#if ENABLE(NOTIFICATIONS)
-    virtual NotificationPresenter* notificationPresenter() const;
-#endif
-
 #if ENABLE(SVG)
     virtual void didSetSVGZoomAndPan(Frame*, unsigned short zoomAndPan);
 #endif
@@ -139,7 +135,6 @@ public:
     virtual bool selectItemAlignmentFollowsMenuWritingDirection();
     virtual PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const;
     virtual PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const;
-    virtual void showContextMenu() { }
 
 #if USE(ACCELERATED_COMPOSITING)
     virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*);
diff --git a/Source/WebKit/blackberry/WebCoreSupport/CredentialManager.cpp b/Source/WebKit/blackberry/WebCoreSupport/CredentialManager.cpp
new file mode 100644
index 000000000..97e7de6f8
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/CredentialManager.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if ENABLE(BLACKBERRY_CREDENTIAL_PERSIST)
+#include "CredentialManager.h"
+
+#include "CredentialBackingStore.h"
+#include "CredentialTransformData.h"
+#include "FrameLoaderClientBlackBerry.h"
+#include "HTMLFormElement.h"
+#include "KURL.h"
+#include "Logging.h"
+#include "WebPageClient.h"
+#include "WebPage_p.h"
+#include "WebString.h"
+
+using BlackBerry::WebKit::WebPageClient;
+using BlackBerry::WebKit::WebString;
+
+namespace WebCore {
+
+CredentialManager::CredentialManager(FrameLoaderClientBlackBerry* frameLoaderClient)
+    : m_frameLoaderClient(frameLoaderClient)
+{
+    ASSERT(m_frameLoaderClient);
+}
+
+void CredentialManager::autofillAuthenticationChallenge(const ProtectionSpace& protectionSpace, WebString& username, WebString& password)
+{
+    if (CredentialBackingStore::instance()->hasNeverRemember(protectionSpace))
+        return;
+
+    Credential savedCredential = CredentialBackingStore::instance()->getLogin(protectionSpace);
+    username = savedCredential.user();
+    password = savedCredential.password();
+}
+
+void CredentialManager::autofillPasswordForms(PassRefPtr<HTMLCollection> docForms)
+{
+    ASSERT(docForms);
+
+    RefPtr<HTMLCollection> forms = docForms;
+    size_t sourceLength = forms->length();
+    for (size_t i = 0; i < sourceLength; ++i) {
+        Node* node = forms->item(i);
+        if (node && node->isHTMLElement()) {
+            CredentialTransformData data(static_cast<HTMLFormElement*>(node));
+            if (!data.isValid() || !CredentialBackingStore::instance()->hasLogin(data.url(), data.protectionSpace()))
+                continue;
+            Credential savedCredential = CredentialBackingStore::instance()->getLogin(data.url());
+            data.setCredential(savedCredential);
+        }
+    }
+}
+
+void CredentialManager::saveCredentialIfConfirmed(const CredentialTransformData& data)
+{
+    if (!data.isValid() || data.credential().isEmpty() || CredentialBackingStore::instance()->hasNeverRemember(data.protectionSpace()))
+        return;
+
+    Credential savedCredential = CredentialBackingStore::instance()->getLogin(data.url());
+    if (savedCredential == data.credential())
+        return;
+
+    WebPageClient::SaveCredentialType type = m_frameLoaderClient->m_webPagePrivate->m_client->notifyShouldSaveCredential(savedCredential.isEmpty());
+    if (type == WebPageClient::SaveCredentialYes) {
+        if (savedCredential.isEmpty())
+            CredentialBackingStore::instance()->addLogin(data.url(), data.protectionSpace(), data.credential());
+        else
+            CredentialBackingStore::instance()->updateLogin(data.url(), data.protectionSpace(), data.credential());
+    } else if (type == WebPageClient::SaveCredentialNeverForThisSite) {
+        CredentialBackingStore::instance()->addNeverRemember(data.url(), data.protectionSpace());
+        CredentialBackingStore::instance()->removeLogin(data.url(), data.protectionSpace());
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(BLACKBERRY_CREDENTIAL_PERSIST)
diff --git a/Source/WebKit/blackberry/WebCoreSupport/CredentialManager.h b/Source/WebKit/blackberry/WebCoreSupport/CredentialManager.h
new file mode 100644
index 000000000..1d39f10c0
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/CredentialManager.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef CredentialManager_h
+#define CredentialManager_h
+
+#if ENABLE(BLACKBERRY_CREDENTIAL_PERSIST)
+
+#include "HTMLCollection.h"
+#include <wtf/PassRefPtr.h>
+
+namespace BlackBerry {
+namespace WebKit {
+class WebString;
+}
+}
+
+namespace WebCore {
+class FrameLoaderClientBlackBerry;
+class KURL;
+class ProtectionSpace;
+class CredentialTransformData;
+
+class CredentialManager {
+public:
+    CredentialManager(FrameLoaderClientBlackBerry*);
+
+    void autofillAuthenticationChallenge(const ProtectionSpace&, BlackBerry::WebKit::WebString& username, BlackBerry::WebKit::WebString& password);
+    void autofillPasswordForms(PassRefPtr<HTMLCollection> docForms);
+    void saveCredentialIfConfirmed(const CredentialTransformData&);
+
+private:
+    FrameLoaderClientBlackBerry* m_frameLoaderClient;
+};
+
+} // WebCore
+
+#endif // ENABLE(BLACKBERRY_CREDENTIAL_PERSIST)
+
+#endif // CredentialManager_h
diff --git a/Source/WebKit/blackberry/WebCoreSupport/CredentialTransformData.cpp b/Source/WebKit/blackberry/WebCoreSupport/CredentialTransformData.cpp
new file mode 100644
index 000000000..8c22ae2a2
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/CredentialTransformData.cpp
@@ -0,0 +1,233 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+ /*
+ * This methods are based on Chromium codes in
+ * Source/WebKit/chromium/src/WebPasswordFormUtils.cpp
+ */
+
+#include "config.h"
+#include "CredentialTransformData.h"
+
+#include "HTMLFormElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "KURL.h"
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+namespace {
+// Maximum number of password fields we will observe before throwing our
+// hands in the air and giving up with a given form.
+static const size_t maxPasswords = 3;
+
+// Helper method to clear url of unneeded parts.
+KURL stripURL(const KURL& url)
+{
+    KURL strippedURL = url;
+    strippedURL.setUser(String());
+    strippedURL.setPass(String());
+    strippedURL.setQuery(String());
+    strippedURL.setFragmentIdentifier(String());
+    return strippedURL;
+}
+
+// Helper method to determine which password is the main one, and which is
+// an old password (e.g on a "make new password" form), if any.
+bool locateSpecificPasswords(Vector<HTMLInputElement*>& passwords,
+                             HTMLInputElement** password)
+{
+    ASSERT(password);
+
+    switch (passwords.size()) {
+    case 1:
+        // Single password, easy.
+        *password = passwords[0];
+        break;
+    case 2:
+        if (passwords[0]->value() == passwords[1]->value())
+            // Treat two identical passwords as a single password.
+            *password = passwords[0];
+        else {
+            // Assume first is old password, second is new (no choice but to guess).
+            *password = passwords[1];
+        }
+        break;
+    case 3:
+        if (passwords[0]->value() == passwords[1]->value()
+            && passwords[0]->value() == passwords[2]->value()) {
+            // All three passwords the same? Just treat as one and hope.
+            *password = passwords[0];
+        } else if (passwords[0]->value() == passwords[1]->value()) {
+            // Two the same and one different -> old password is duplicated one.
+            *password = passwords[2];
+        } else if (passwords[1]->value() == passwords[2]->value())
+            *password = passwords[1];
+        else {
+            // Three different passwords, or first and last match with middle
+            // different. No idea which is which, so no luck.
+            return false;
+        }
+        break;
+    default:
+        return false;
+    }
+    return true;
+}
+
+} // namespace
+
+CredentialTransformData::CredentialTransformData(HTMLFormElement* form)
+    : m_userNameElement(0)
+    , m_passwordElement(0)
+    , m_isValid(false)
+{
+    ASSERT(form);
+
+    // Get the document URL
+    KURL fullOrigin(ParsedURLString, form->document()->documentURI());
+
+    // Calculate the canonical action URL
+    String action = form->action();
+    if (action.isNull())
+        action = ""; // missing 'action' attribute implies current URL
+    KURL fullAction = form->document()->completeURL(action);
+    if (!fullAction.isValid())
+        return;
+
+    if (!findPasswordFormFields(form))
+        return;
+
+    m_url = stripURL(fullOrigin);
+    m_action = stripURL(fullAction);
+    m_protectionSpace = ProtectionSpace(m_url.host(), m_url.port(), ProtectionSpaceServerHTTP, "Form", ProtectionSpaceAuthenticationSchemeHTMLForm);
+    m_credential = Credential(m_userNameElement->value(), m_passwordElement->value(), CredentialPersistencePermanent);
+
+    m_isValid = true;
+}
+
+CredentialTransformData::CredentialTransformData(const KURL& url, const ProtectionSpace& protectionSpace, const Credential& credential)
+    : m_url(url)
+    , m_protectionSpace(protectionSpace)
+    , m_credential(credential)
+    , m_userNameElement(0)
+    , m_passwordElement(0)
+    , m_isValid(true)
+{
+}
+
+KURL CredentialTransformData::url() const
+{
+    if (!m_isValid)
+        return KURL();
+
+    if (m_protectionSpace.authenticationScheme() == ProtectionSpaceAuthenticationSchemeHTMLForm)
+        return m_action;
+    return m_url;
+}
+
+Credential CredentialTransformData::credential() const
+{
+    if (m_credential.isEmpty() && m_userNameElement && m_passwordElement)
+        return m_credential = Credential(m_userNameElement->value(), m_passwordElement->value(), CredentialPersistencePermanent);
+    return m_credential;
+}
+
+void CredentialTransformData::setCredential(const Credential& credential)
+{
+    if (!m_isValid)
+        return;
+
+    m_credential = credential;
+    m_userNameElement->setValue(credential.user());
+    m_passwordElement->setValue(credential.password());
+}
+
+bool CredentialTransformData::findPasswordFormFields(HTMLFormElement* form)
+{
+    ASSERT(form);
+
+    int firstPasswordIndex = 0;
+    // First, find the password fields and activated submit button.
+    const Vector<FormAssociatedElement*>& formElements = form->associatedElements();
+    Vector<HTMLInputElement*> passwords;
+    for (size_t i = 0; i < formElements.size(); i++) {
+        if (!formElements[i]->isFormControlElement())
+            continue;
+        HTMLFormControlElement* formElement = static_cast<HTMLFormControlElement*>(formElements[i]);
+        if (!formElement->hasLocalName(HTMLNames::inputTag))
+            continue;
+
+        HTMLInputElement* inputElement = formElement->toInputElement();
+        if (!inputElement->isEnabledFormControl())
+            continue;
+
+        if ((passwords.size() < maxPasswords)
+            && inputElement->isPasswordField()
+            && inputElement->shouldAutocomplete()) {
+            if (passwords.isEmpty())
+                firstPasswordIndex = i;
+            passwords.append(inputElement);
+        }
+    }
+
+    if (!passwords.isEmpty()) {
+        // Then, search backwards for the username field.
+        for (int i = firstPasswordIndex - 1; i >= 0; i--) {
+            if (!formElements[i]->isFormControlElement())
+                continue;
+            HTMLFormControlElement* formElement = static_cast<HTMLFormControlElement*>(formElements[i]);
+            if (!formElement->hasLocalName(HTMLNames::inputTag))
+                continue;
+
+            HTMLInputElement* inputElement = formElement->toInputElement();
+            if (!inputElement->isEnabledFormControl())
+                continue;
+
+            // Various input types such as text, url, email can be a username field.
+            if ((inputElement->isTextField() && !inputElement->isPasswordField())
+                && (inputElement->shouldAutocomplete())) {
+                m_userNameElement = inputElement;
+                break;
+            }
+        }
+    }
+    if (!m_userNameElement)
+        return false;
+
+    if (!locateSpecificPasswords(passwords, &(m_passwordElement)))
+        return false;
+    return true;
+}
+
+} // namespace WebCore
diff --git a/Source/WebKit/blackberry/WebCoreSupport/CredentialTransformData.h b/Source/WebKit/blackberry/WebCoreSupport/CredentialTransformData.h
new file mode 100644
index 000000000..409c5776b
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/CredentialTransformData.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef CredentialTransformData_h
+#define CredentialTransformData_h
+
+#include "Credential.h"
+#include "HTMLFormElement.h"
+#include "KURL.h"
+#include "ProtectionSpace.h"
+
+namespace WebCore {
+
+class HTMLFormElement;
+
+struct CredentialTransformData {
+    // If the provided form is suitable for password completion, isValid() will
+    // return true;
+    CredentialTransformData(HTMLFormElement*);
+    CredentialTransformData(const KURL&, const ProtectionSpace&, const Credential&);
+
+    // If creation failed, return false.
+    bool isValid() const { return m_isValid; }
+
+    KURL url() const;
+    ProtectionSpace protectionSpace() const { return m_protectionSpace; }
+    Credential credential() const;
+    void setCredential(const Credential&);
+
+private:
+    bool findPasswordFormFields(HTMLFormElement*);
+
+    KURL m_url;
+    KURL m_action;
+    ProtectionSpace m_protectionSpace;
+    mutable Credential m_credential;
+    HTMLInputElement* m_userNameElement;
+    HTMLInputElement* m_passwordElement;
+    bool m_isValid;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp
index 0e4441d82..356fee9ea 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp
@@ -193,11 +193,9 @@ bool EditorClientBlackBerry::shouldChangeSelectedRange(Range* fromRange, Range*
         if (frame->document()->focusedNode() && frame->document()->focusedNode()->hasTagName(HTMLNames::selectTag))
             return false;
 
-        // Update the focus state to re-show the keyboard if needed.
-        // FIXME, this should be removed and strictly be a show keyboard call if
-        // focus is active.
-        if (m_webPagePrivate->m_inputHandler->isInputMode())
-            m_webPagePrivate->m_inputHandler->nodeFocused(frame->document()->focusedNode());
+        // Check if this change does not represent a focus change and input is active and if so ensure the keyboard is visible.
+        if (m_webPagePrivate->m_inputHandler->isInputMode() && fromRange && toRange && (fromRange->startContainer() == toRange->startContainer()))
+            m_webPagePrivate->m_inputHandler->notifyClientOfKeyboardVisibilityChange(true);
     }
 
     return true;
@@ -604,25 +602,9 @@ void EditorClientBlackBerry::willSetInputMethodState()
     notImplemented();
 }
 
-void EditorClientBlackBerry::setInputMethodState(bool active)
+void EditorClientBlackBerry::setInputMethodState(bool)
 {
-    Frame* frame = m_webPagePrivate->focusedOrMainFrame();
-    // Determines whether or not to provide input assistance. Password fields
-    // do not have this flag active, so it needs to be overridden.
-    if (frame && frame->document()) {
-        if (Node* focusNode = frame->document()->focusedNode()) {
-            if (!active && focusNode->hasTagName(HTMLNames::inputTag)
-                && static_cast<HTMLInputElement*>(focusNode)->isPasswordField())
-                    active = true;
-
-            if (active) {
-                m_webPagePrivate->m_inputHandler->nodeFocused(focusNode);
-                return;
-            }
-        }
-    }
-    // No frame or document or a node that doesn't support IME.
-    m_webPagePrivate->m_inputHandler->nodeFocused(0);
+    m_webPagePrivate->m_inputHandler->focusedNodeChanged();
 }
 
 } // namespace WebCore
diff --git a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
index afddd51a3..0eef1f3da 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
@@ -790,7 +790,7 @@ ObjectContentType FrameLoaderClientBlackBerry::objectContentType(const KURL& url
 
 void FrameLoaderClientBlackBerry::dispatchWillClose()
 {
-    m_webPagePrivate->m_inputHandler->frameUnloaded(m_frame);
+    m_webPagePrivate->frameUnloaded(m_frame);
 }
 
 void FrameLoaderClientBlackBerry::setMainDocumentError(DocumentLoader*, const ResourceError& error)
@@ -926,7 +926,7 @@ void FrameLoaderClientBlackBerry::detachedFromParent2()
     if (m_frame->document())
         m_webPagePrivate->clearDocumentData(m_frame->document());
 
-    m_webPagePrivate->m_inputHandler->frameUnloaded(m_frame);
+    m_webPagePrivate->frameUnloaded(m_frame);
     m_webPagePrivate->m_client->notifyFrameDetached(m_frame);
 }
 
@@ -969,12 +969,6 @@ void FrameLoaderClientBlackBerry::dispatchWillSendRequest(DocumentLoader* docLoa
             finalUrl.characters(), finalUrl.length());
     }
 
-    // FIXME: Update the request type. See PR #119792.
-    if (docLoader->frameLoader()->isLoadingMainFrame())
-        request.setTargetType(ResourceRequest::TargetIsMainFrame);
-    else
-        request.setTargetType(ResourceRequest::TargetIsSubframe);
-
     FrameLoader* loader = m_frame->loader();
     ASSERT(loader);
     if (isBackForwardLoadType(loader->loadType())) {
@@ -1058,7 +1052,7 @@ void FrameLoaderClientBlackBerry::restoreViewState()
 
     // When rotate happens, only zoom when previous page was zoomToFitScale, otherwise keep old scale.
     if (orientationChanged && viewState.isZoomToFitScale)
-        scale = BlackBerry::Platform::Graphics::Screen::width() * scale / static_cast<double>(BlackBerry::Platform::Graphics::Screen::height());
+        scale = BlackBerry::Platform::Graphics::Screen::primaryScreen()->width() * scale / static_cast<double>(BlackBerry::Platform::Graphics::Screen::primaryScreen()->height());
     m_webPagePrivate->m_backingStore->d->suspendScreenAndBackingStoreUpdates(); // don't flash checkerboard for the setScrollPosition call
     m_frame->view()->setContentsSizeFromHistory(contentsSize);
 
diff --git a/Source/WebKit/blackberry/WebCoreSupport/NotificationPresenterImpl.cpp b/Source/WebKit/blackberry/WebCoreSupport/NotificationPresenterImpl.cpp
index 505b1801b..16c451ec3 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/NotificationPresenterImpl.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/NotificationPresenterImpl.cpp
@@ -26,11 +26,10 @@
 #include <ScriptExecutionContext.h>
 #include <UUID.h>
 
-using namespace WebCore;
 
-namespace WebKit {
+namespace WebCore {
 
-NotificationPresenter* NotificationPresenterImpl::instance()
+NotificationClient* NotificationPresenterImpl::instance()
 {
     static NotificationPresenterImpl* s_instance = 0;
     if (!s_instance)
@@ -55,7 +54,7 @@ bool NotificationPresenterImpl::show(Notification* notification)
     if (m_notifications.contains(n))
         return false;
 
-    if (checkPermission(notification->scriptExecutionContext()) != NotificationPresenter::PermissionAllowed)
+    if (checkPermission(notification->scriptExecutionContext()) != NotificationClient::PermissionAllowed)
         return false;
 
     String uuid = createCanonicalUUIDString();
@@ -108,10 +107,10 @@ void NotificationPresenterImpl::onPermission(const std::string& domain, bool isA
     ASSERT(!domain.empty());
     String domainString = String::fromUTF8(domain.c_str());
     PermissionRequestMap::iterator it = m_permissionRequests.begin();
-    PermissionRequestMap::iterator end = m_permissionRequests.end();
-    for (; it != end; ++it) {
+    for (; it != m_permissionRequests.end(); ++it) {
         if (it->first->url().host() != domainString)
             continue;
+
         if (isAllowed) {
             m_allowedDomains.add(domainString);
             it->second->handleEvent();
@@ -119,6 +118,7 @@ void NotificationPresenterImpl::onPermission(const std::string& domain, bool isA
             m_allowedDomains.remove(domainString);
 
         m_permissionRequests.remove(it);
+        return;
     }
 }
 
@@ -127,14 +127,14 @@ void NotificationPresenterImpl::cancelRequestsForPermission(ScriptExecutionConte
     // Because we are using modal dialogs to request permission, it's impossible to cancel them.
 }
 
-NotificationPresenter::Permission NotificationPresenterImpl::checkPermission(ScriptExecutionContext* context)
+NotificationClient::Permission NotificationPresenterImpl::checkPermission(ScriptExecutionContext* context)
 {
     ASSERT(context);
     // FIXME: Should store the permission information into file permanently instead of in m_allowedDomains.
     // The suggested place to do this is in m_platformPresenter->checkPermission().
     if (m_allowedDomains.contains(context->url().host()))
-        return NotificationPresenter::PermissionAllowed;
-    return NotificationPresenter::PermissionNotAllowed;
+        return NotificationClient::PermissionAllowed;
+    return NotificationClient::PermissionNotAllowed;
 }
 
 // This function is called in platform side.
@@ -143,11 +143,12 @@ void NotificationPresenterImpl::notificationClicked(const std::string& id)
     ASSERT(!id.empty());
     String idString = String::fromUTF8(id.c_str());
     NotificationMap::iterator it = m_notifications.begin();
-    NotificationMap::iterator end = m_notifications.end();
-    for (; it != end; ++it) {
+    for (; it != m_notifications.end(); ++it) {
         if (it->second == idString && it->first->scriptExecutionContext()) {
+            RefPtr<Notification> notification = it->first;
             it->first->dispatchEvent(Event::create(eventNames().clickEvent, false, true));
-            m_notifications.remove(it);
+            m_notifications.remove(notification);
+            return;
         }
     }
 }
diff --git a/Source/WebKit/blackberry/WebCoreSupport/NotificationPresenterImpl.h b/Source/WebKit/blackberry/WebCoreSupport/NotificationPresenterImpl.h
index e26c15fe2..b708e002e 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/NotificationPresenterImpl.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/NotificationPresenterImpl.h
@@ -21,7 +21,7 @@
 
 #if ENABLE(NOTIFICATIONS)
 #include <NotificationAckListener.h>
-#include <NotificationPresenter.h>
+#include <NotificationClient.h>
 #include <NotificationPresenterBlackBerry.h>
 #include <string>
 #include <wtf/HashMap.h>
@@ -29,11 +29,11 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/text/StringHash.h>
 
-namespace WebKit {
+namespace WebCore {
 
-class NotificationPresenterImpl : public WebCore::NotificationPresenter, public BlackBerry::Platform::NotificationAckListener {
+class NotificationPresenterImpl : public WebCore::NotificationClient, public BlackBerry::Platform::NotificationAckListener {
 public:
-    static NotificationPresenter* instance();
+    static NotificationClient* instance();
     virtual ~NotificationPresenterImpl();
 
     // Requests that a notification be shown.
diff --git a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
index 9dd5d2117..26c0e6cd2 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
@@ -173,13 +173,28 @@ bool isColorInputField(const Element* element)
     return false;
 }
 
+// This is a Tristate return to allow us to override name matching when
+// the attribute is expressly requested for a field. Default indicates
+// that the setting is On which is the default but not expressly requested
+// for the element being checked. On indicates that it is directly added
+// to the element.
 AttributeState elementSupportsAutocorrect(const Element* element)
 {
+    DEFINE_STATIC_LOCAL(QualifiedName, autocorrectAttr, (nullAtom, "autocorrect", nullAtom));
+    return elementAttributeState(element, autocorrectAttr);
+}
+
+AttributeState elementSupportsAutocomplete(const Element* element)
+{
+    return elementAttributeState(element, HTMLNames::autocompleteAttr);
+}
+
+AttributeState elementAttributeState(const Element* element, const QualifiedName& attributeName)
+{
     // First we check the input item itself. If the attribute is not defined,
     // we check its parent form.
-    QualifiedName autocorrectAttr = QualifiedName(nullAtom, "autocorrect", nullAtom);
-    if (element->fastHasAttribute(autocorrectAttr)) {
-        AtomicString attributeString = element->fastGetAttribute(autocorrectAttr);
+    if (element->fastHasAttribute(attributeName)) {
+        AtomicString attributeString = element->fastGetAttribute(attributeName);
         if (equalIgnoringCase(attributeString, "off"))
             return Off;
         if (equalIgnoringCase(attributeString, "on"))
@@ -189,8 +204,8 @@ AttributeState elementSupportsAutocorrect(const Element* element)
     }
     if (element->isFormControlElement()) {
         const HTMLFormControlElement* formElement = static_cast<const HTMLFormControlElement*>(element);
-        if (formElement->form() && formElement->form()->fastHasAttribute(autocorrectAttr)) {
-            AtomicString attributeString = formElement->form()->fastGetAttribute(autocorrectAttr);
+        if (formElement->form() && formElement->form()->fastHasAttribute(attributeName)) {
+            AtomicString attributeString = formElement->form()->fastGetAttribute(attributeName);
             if (equalIgnoringCase(attributeString, "off"))
                 return Off;
             if (equalIgnoringCase(attributeString, "on"))
@@ -254,6 +269,10 @@ VisibleSelection visibleSelectionForRangeInputElement(Element* element, int star
 
     // Must be content editable, generate the range.
     RefPtr<Range> selectionRange = TextIterator::rangeFromLocationAndLength(element, start, end - start);
+
+    if (!selectionRange)
+        return VisibleSelection();
+
     if (start == end)
         return VisibleSelection(selectionRange.get()->startPosition(), DOWNSTREAM);
 
@@ -285,25 +304,6 @@ bool isPositionInNode(Node* node, const Position& position)
     return rangeForNode->isPointInRange(domNodeAtPos, offset, ec);
 }
 
-// This is a Tristate return to allow us to override name matching when
-// autocomplete is expressly requested for a field. Default indicates
-// that the setting is On which is the default but not expressly requested
-// for the element being checked. On indicates that it is directly added
-// to the element.
-AttributeState elementSupportsAutocomplete(const Element* element)
-{
-    if (!element->hasTagName(HTMLNames::inputTag))
-        return Default;
-
-    const HTMLInputElement* inputElement = static_cast<const HTMLInputElement*>(element);
-    if (inputElement->fastHasAttribute(HTMLNames::autocompleteAttr)) {
-        if (equalIgnoringCase(inputElement->fastGetAttribute(HTMLNames::autocompleteAttr), "on"))
-            return On;
-    }
-
-    return inputElement->shouldAutocomplete() ? Default : Off;
-}
-
 bool matchesReservedStringPreventingAutocomplete(AtomicString& string)
 {
     if (string.contains("email", false /* caseSensitive */)
@@ -336,7 +336,7 @@ bool elementIdOrNameIndicatesNoAutocomplete(const Element* element)
     return false;
 }
 
-IntPoint convertPointToFrame(const Frame* sourceFrame, const Frame* targetFrame, const IntPoint& point)
+IntPoint convertPointToFrame(const Frame* sourceFrame, const Frame* targetFrame, const IntPoint& point, const bool clampToTargetFrame)
 {
     ASSERT(sourceFrame && targetFrame);
     if (sourceFrame == targetFrame)
@@ -347,6 +347,7 @@ IntPoint convertPointToFrame(const Frame* sourceFrame, const Frame* targetFrame,
 
     Frame* targetFrameParent = targetFrame->tree()->parent();
     IntRect targetFrameRect = targetFrame->view()->frameRect();
+    IntPoint targetPoint = point;
 
     // Convert the target frame rect to source window content coordinates. This is only required
     // if the parent frame is not the source. If the parent is the source, subframeRect
@@ -355,11 +356,14 @@ IntPoint convertPointToFrame(const Frame* sourceFrame, const Frame* targetFrame,
         targetFrameRect = sourceFrame->view()->windowToContents(targetFrameParent->view()->contentsToWindow(targetFrameRect));
 
     // Requested point is outside of target frame, return InvalidPoint.
-    if (!targetFrameRect.contains(point))
+    if (clampToTargetFrame && !targetFrameRect.contains(targetPoint))
+        targetPoint = IntPoint(targetPoint.x() < targetFrameRect.x() ? targetFrameRect.x() : std::min(targetPoint.x(), targetFrameRect.maxX()),
+                targetPoint.y() < targetFrameRect.y() ? targetFrameRect.y() : std::min(targetPoint.y(), targetFrameRect.maxY()));
+    else if (!targetFrameRect.contains(targetPoint))
         return InvalidPoint;
 
     // Adjust the points to be relative to the target.
-    return targetFrame->view()->windowToContents(sourceFrame->view()->contentsToWindow(point));
+    return targetFrame->view()->windowToContents(sourceFrame->view()->contentsToWindow(targetPoint));
 }
 
 VisibleSelection visibleSelectionForClosestActualWordStart(const VisibleSelection& selection)
@@ -399,6 +403,14 @@ VisibleSelection visibleSelectionForClosestActualWordStart(const VisibleSelectio
     return selection;
 }
 
+// This function is copied from WebCore/page/Page.cpp.
+Frame* incrementFrame(Frame* curr, bool forward, bool wrapFlag)
+{
+    return forward
+        ? curr->tree()->traverseNextWithWrap(wrapFlag)
+        : curr->tree()->traversePreviousWithWrap(wrapFlag);
+}
+
 } // DOMSupport
 } // WebKit
 } // BlackBerry
diff --git a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.h b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.h
index 1e0945189..85d9cbfa9 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.h
+++ b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.h
@@ -35,6 +35,7 @@ class Frame;
 class HTMLTextFormControlElement;
 class Node;
 class Position;
+class QualifiedName;
 class Range;
 class VisibleSelection;
 }
@@ -54,7 +55,10 @@ bool isPasswordElement(const WebCore::Element*);
 bool isPopupInputField(const WebCore::Element*);
 bool isDateTimeInputField(const WebCore::Element*);
 bool isColorInputField(const WebCore::Element*);
+
+AttributeState elementAttributeState(const WebCore::Element*, const WebCore::QualifiedName&);
 AttributeState elementSupportsAutocorrect(const WebCore::Element*);
+AttributeState elementSupportsAutocomplete(const WebCore::Element*);
 
 WTF::String inputElementText(WebCore::Element*);
 
@@ -69,15 +73,16 @@ WebCore::VisibleSelection visibleSelectionForInputElement(WebCore::Element*);
 WebCore::Node* DOMContainerNodeForPosition(const WebCore::Position&);
 bool isPositionInNode(WebCore::Node*, const WebCore::Position&);
 
-AttributeState elementSupportsAutocomplete(const WebCore::Element*);
 bool elementIdOrNameIndicatesNoAutocomplete(const WebCore::Element*);
 
-WebCore::IntPoint convertPointToFrame(const WebCore::Frame* sourceFrame, const WebCore::Frame* targetFrame, const WebCore::IntPoint& sourcePoint);
+WebCore::IntPoint convertPointToFrame(const WebCore::Frame* sourceFrame, const WebCore::Frame* targetFrame, const WebCore::IntPoint& sourcePoint, const bool clampToTargetFrame = false);
 
 static const WebCore::IntPoint InvalidPoint = WebCore::IntPoint(-1, -1);
 
 WebCore::VisibleSelection visibleSelectionForClosestActualWordStart(const WebCore::VisibleSelection&);
 
+WebCore::Frame* incrementFrame(WebCore::Frame* curr, bool forward, bool wrapFlag);
+
 } // DOMSupport
 } // WebKit
 } // BlackBerry
diff --git a/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.cpp b/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.cpp
index a93005010..c8ede6e5a 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.cpp
@@ -29,7 +29,7 @@
 #include "JSElement.h"
 #include "Page.h"
 #include "ViewportArguments.h"
-#include "WebPage.h"
+#include "WebPage_p.h"
 #include "bindings/js/GCController.h"
 #include <JavaScriptCore/APICast.h>
 #include <wtf/CurrentTime.h>
@@ -56,6 +56,11 @@ DumpRenderTreeSupport::~DumpRenderTreeSupport()
 {
 }
 
+Page* DumpRenderTreeSupport::corePage(WebPage* webPage)
+{
+    return WebPagePrivate::core(webPage);
+}
+
 int DumpRenderTreeSupport::javaScriptObjectsCount()
 {
     return JSDOMWindowBase::commonJSGlobalData()->heap.globalObjectCount();
@@ -94,7 +99,7 @@ void DumpRenderTreeSupport::dumpConfigurationForViewport(Frame* mainFrame, int d
 int DumpRenderTreeSupport::numberOfPendingGeolocationPermissionRequests(WebPage* webPage)
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-    GeolocationClientMock* mockClient = toGeolocationClientMock(webPage->mainFrame()->page()->geolocationController()->client());
+    GeolocationClientMock* mockClient = toGeolocationClientMock(corePage(webPage)->geolocationController()->client());
     return mockClient->numberOfPendingPermissionRequests();
 #else
     UNUSED_PARAM(webPage);
@@ -105,7 +110,7 @@ int DumpRenderTreeSupport::numberOfPendingGeolocationPermissionRequests(WebPage*
 void DumpRenderTreeSupport::resetGeolocationMock(WebPage* webPage)
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-    GeolocationClientMock* mockClient = toGeolocationClientMock(webPage->mainFrame()->page()->geolocationController()->client());
+    GeolocationClientMock* mockClient = toGeolocationClientMock(corePage(webPage)->geolocationController()->client());
     mockClient->reset();
 #endif
 }
@@ -123,7 +128,7 @@ void DumpRenderTreeSupport::setMockGeolocationError(WebPage* webPage, int errorC
         break;
     }
 
-    GeolocationClientMock* mockClient = static_cast<GeolocationClientMock*>(webPage->mainFrame()->page()->geolocationController()->client());
+    GeolocationClientMock* mockClient = static_cast<GeolocationClientMock*>(corePage(webPage)->geolocationController()->client());
     mockClient->setError(GeolocationError::create(code, message));
 #endif
 }
@@ -131,7 +136,7 @@ void DumpRenderTreeSupport::setMockGeolocationError(WebPage* webPage, int errorC
 void DumpRenderTreeSupport::setMockGeolocationPermission(WebPage* webPage, bool allowed)
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-    GeolocationClientMock* mockClient = toGeolocationClientMock(webPage->mainFrame()->page()->geolocationController()->client());
+    GeolocationClientMock* mockClient = toGeolocationClientMock(corePage(webPage)->geolocationController()->client());
     mockClient->setPermission(allowed);
 #endif
 }
@@ -139,14 +144,14 @@ void DumpRenderTreeSupport::setMockGeolocationPermission(WebPage* webPage, bool
 void DumpRenderTreeSupport::setMockGeolocationPosition(WebPage* webPage, double latitude, double longitude, double accuracy)
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-    GeolocationClientMock* mockClient = toGeolocationClientMock(webPage->mainFrame()->page()->geolocationController()->client());
+    GeolocationClientMock* mockClient = toGeolocationClientMock(corePage(webPage)->geolocationController()->client());
     mockClient->setPosition(GeolocationPosition::create(currentTime(), latitude, longitude, accuracy));
 #endif
 }
 
 void DumpRenderTreeSupport::scalePageBy(WebPage* webPage, float scaleFactor, float x, float y)
 {
-    webPage->mainFrame()->page()->setPageScaleFactor(scaleFactor, IntPoint(x, y));
+    corePage(webPage)->setPageScaleFactor(scaleFactor, IntPoint(x, y));
 }
 
 JSValueRef DumpRenderTreeSupport::computedStyleIncludingVisitedInfo(JSContextRef context, JSValueRef value)
diff --git a/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.h b/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.h
index 3b140304b..54e48f029 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.h
+++ b/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.h
@@ -29,6 +29,7 @@ class WebPage;
 
 namespace WebCore {
 class Frame;
+class Page;
 }
 
 namespace WTF {
@@ -40,6 +41,8 @@ public:
     DumpRenderTreeSupport();
     ~DumpRenderTreeSupport();
 
+    static WebCore::Page* corePage(BlackBerry::WebKit::WebPage*);
+
     static void setLinksIncludedInFocusChain(bool);
     static bool linksIncludedInFocusChain();
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/FrameLayers.cpp b/Source/WebKit/blackberry/WebKitSupport/FrameLayers.cpp
new file mode 100644
index 000000000..b875646da
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/FrameLayers.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "FrameLayers.h"
+
+#include "Frame.h"
+#include "FrameView.h"
+#include "LayerWebKitThread.h"
+#include "Page.h"
+#include "RenderPart.h"
+#include "WebPage_p.h"
+#include <wtf/Assertions.h>
+
+using namespace WebCore;
+
+namespace BlackBerry {
+namespace WebKit {
+
+static FloatSize frameLayerAbsoluteOffset(Frame* frame)
+{
+    ASSERT(frame);
+
+    if (!frame->view() || !frame->page() || !frame->page()->mainFrame() || !frame->page()->mainFrame()->view())
+        return FloatSize();
+
+    IntPoint offset = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(IntPoint::zero()));
+    return FloatSize(offset.x(), offset.y());
+}
+
+FrameLayers::FrameLayers(WebPagePrivate* page)
+    : m_pagePrivate(page)
+    , m_rootGraphicsLayer()
+    , m_rootLayer(0)
+{
+}
+
+FrameLayers::~FrameLayers()
+{
+    m_frameLayers.clear();
+}
+
+bool FrameLayers::containsLayerForFrame(Frame* frame)
+{
+    ASSERT(frame);
+    return m_frameLayers.contains(frame);
+}
+
+void FrameLayers::addLayer(Frame* frame, LayerWebKitThread* layer)
+{
+    // If we have main frame layer we don't accept other layers.
+    // This should not happen actually.
+    ASSERT(frame != m_pagePrivate->m_mainFrame || !isRootLayerMainFrameLayer());
+    if (frame == m_pagePrivate->m_mainFrame && isRootLayerMainFrameLayer())
+        return;
+
+    ASSERT(frame && layer && !m_frameLayers.contains(frame));
+
+    m_frameLayers.add(frame, layer);
+
+    calculateRootLayer();
+    if (!m_rootLayer) {
+        ASSERT(!m_rootGraphicsLayer);
+        m_rootGraphicsLayer = GraphicsLayer::create(0);
+        m_rootLayer = m_rootGraphicsLayer->platformLayer();
+    }
+
+    if (m_rootLayer != layer)
+        m_rootLayer->addSublayer(layer);
+}
+
+void FrameLayers::removeLayerByFrame(Frame* frame)
+{
+    ASSERT(frame);
+    FrameLayerMap::iterator it = m_frameLayers.find(frame);
+    if (it != m_frameLayers.end()) {
+        LayerWebKitThread* layer = it->second;
+        if (layer->superlayer())
+            layer->removeFromSuperlayer();
+        m_frameLayers.remove(it);
+        calculateRootLayer();
+    }
+}
+
+void FrameLayers::commitOnWebKitThread(double scale)
+{
+    ASSERT(m_rootLayer);
+    if (!isRootLayerMainFrameLayer()) {
+        for (FrameLayerMap::iterator it = m_frameLayers.begin(); it != m_frameLayers.end(); ++it)
+            it->second->setAbsoluteOffset(frameLayerAbsoluteOffset(it->first));
+    }
+    m_rootLayer->commitOnWebKitThread(scale);
+}
+
+void FrameLayers::calculateRootLayer()
+{
+    if (m_frameLayers.size() == 1 && m_frameLayers.begin()->first == m_pagePrivate->m_mainFrame)
+        m_rootLayer = m_frameLayers.begin()->second;
+    else if (m_rootGraphicsLayer)
+        m_rootLayer = m_rootGraphicsLayer->platformLayer();
+    else
+        m_rootLayer = 0;
+}
+
+} // namespace BlackBerry
+} // namespace WebKit
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebKit/blackberry/WebKitSupport/FrameLayers.h b/Source/WebKit/blackberry/WebKitSupport/FrameLayers.h
new file mode 100644
index 000000000..b90138ba9
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/FrameLayers.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef FrameLayers_h
+#define FrameLayers_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayer.h"
+#include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+class Frame;
+class LayerWebKitThread;
+}
+
+namespace BlackBerry {
+namespace WebKit {
+
+class WebPagePrivate;
+
+// This class may only be used on the WebKit thread.
+class FrameLayers {
+public:
+    FrameLayers(WebPagePrivate*);
+    ~FrameLayers();
+
+    bool containsLayerForFrame(WebCore::Frame*);
+    void addLayer(WebCore::Frame*, WebCore::LayerWebKitThread*);
+    void removeLayerByFrame(WebCore::Frame*);
+
+    bool hasLayer() const { return m_frameLayers.size(); }
+
+    void commitOnWebKitThread(double scale);
+
+    void calculateRootLayer();
+
+    bool isRootLayerMainFrameLayer() const { return m_rootLayer && !m_rootGraphicsLayer; }
+
+    // FIXME: This function should only be called on the WebKit thread.
+    // But it's now also being called on the Compositing thread.
+    WebCore::LayerWebKitThread* rootLayer() const { return m_rootLayer; }
+
+private:
+    WebPagePrivate* m_pagePrivate;
+    OwnPtr<WebCore::GraphicsLayer> m_rootGraphicsLayer;
+    WebCore::LayerWebKitThread* m_rootLayer;
+    typedef HashMap<WebCore::Frame*, WebCore::LayerWebKitThread*> FrameLayerMap;
+    FrameLayerMap m_frameLayers;
+};
+
+} // namespace BlackBerry
+} // namespace WebKit
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // FrameLayers_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.cpp b/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.cpp
index ae0402100..09cfd55bc 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.cpp
@@ -19,6 +19,7 @@
 #include "config.h"
 #include "InPageSearchManager.h"
 
+#include "DOMSupport.h"
 #include "Document.h"
 #include "DocumentMarkerController.h"
 #include "Editor.h"
@@ -51,43 +52,124 @@ bool InPageSearchManager::findNextString(const String& text, bool forward)
         return false;
     }
 
-    if (m_activeSearchString != text) {
-        clearTextMatches();
+    if (!shouldSearchForText(text)) {
         m_activeSearchString = text;
-        m_activeMatchCount = m_webPage->m_page->markAllMatchesForText(text, WebCore::CaseInsensitive, true, TextMatchMarkerLimit);
-    } else
-        setMarkerActive(m_activeMatch.get(), false);
-
-    if (!m_activeMatchCount)
         return false;
+    }
+
+    // Validate the range in case any node has been removed since last search.
+    if (m_activeMatch && !m_activeMatch->boundaryPointsValid())
+        m_activeMatch = 0;
+
+    RefPtr<Range> searchStartingPoint(m_activeMatch);
+    if (m_activeSearchString != text) { // Start a new search.
+        m_activeSearchString = text;
+        m_webPage->m_page->unmarkAllTextMatches();
+        m_activeMatchCount = m_webPage->m_page->markAllMatchesForText(text, CaseInsensitive, true /* shouldHighlight */, TextMatchMarkerLimit);
+        if (!m_activeMatchCount) {
+            clearTextMatches();
+            return false;
+        }
+    } else { // Search same string for next occurrence.
+        setMarkerActive(m_activeMatch.get(), false /* active */);
+        // Searching for same string should start from the end of last match.
+        if (m_activeMatch) {
+            if (forward)
+                searchStartingPoint->setStart(searchStartingPoint->endPosition());
+            else
+                searchStartingPoint->setEnd(searchStartingPoint->startPosition());
+        }
+    }
 
-    const FindOptions findOptions = (forward ? 0 : WebCore::Backwards)
-        | WebCore::CaseInsensitive
-        | WebCore::WrapAround; // TODO should wrap around in page, not in frame
+    // If there is any active selection, new search should start from the beginning of it.
+    VisibleSelection selection = m_webPage->focusedOrMainFrame()->selection()->selection();
+    if (!selection.isNone()) {
+        searchStartingPoint = selection.firstRange().get();
+        m_webPage->focusedOrMainFrame()->selection()->clear();
+    }
+
+    Frame* currentActiveMatchFrame = selection.isNone() && m_activeMatch ? m_activeMatch->ownerDocument()->frame() : m_webPage->focusedOrMainFrame();
+
+    const FindOptions findOptions = (forward ? 0 : Backwards)
+        | CaseInsensitive
+        | StartInSelection;
+
+    if (findAndMarkText(text, searchStartingPoint.get(), currentActiveMatchFrame, findOptions))
+        return true;
 
-    // TODO StartInSelection
+    Frame* startFrame = currentActiveMatchFrame;
+    do {
+        currentActiveMatchFrame = DOMSupport::incrementFrame(currentActiveMatchFrame, forward, true /* wrapFlag */);
+        if (findAndMarkText(text, 0, currentActiveMatchFrame, findOptions))
+            return true;
+    } while (currentActiveMatchFrame && startFrame != currentActiveMatchFrame);
 
-    m_activeMatch = m_webPage->mainFrame()->editor()->findStringAndScrollToVisible(text, m_activeMatch.get(), findOptions);
-    setMarkerActive(m_activeMatch.get(), true);
+    clearTextMatches();
 
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool InPageSearchManager::shouldSearchForText(const String& text)
+{
+    if (text == m_activeSearchString)
+        return m_activeMatchCount;
+
+    // If the previous search string is prefix of new search string,
+    // don't search if the previous one has zero result.
+    if (!m_activeMatchCount
+        && m_activeSearchString.length()
+        && text.length() > m_activeSearchString.length()
+        && m_activeSearchString == text.substring(0, m_activeSearchString.length()))
+        return false;
     return true;
 }
 
+bool InPageSearchManager::findAndMarkText(const String& text, Range* range, Frame* frame, const FindOptions& options)
+{
+    m_activeMatch = frame->editor()->findStringAndScrollToVisible(text, range, options);
+    if (m_activeMatch) {
+        setMarkerActive(m_activeMatch.get(), true /* active */);
+        return true;
+    }
+    return false;
+}
+
 void InPageSearchManager::clearTextMatches()
 {
     m_webPage->m_page->unmarkAllTextMatches();
     m_activeMatch = 0;
 }
 
-void InPageSearchManager::setMarkerActive(WebCore::Range* range, bool active)
+void InPageSearchManager::setMarkerActive(Range* range, bool active)
 {
     if (!range)
         return;
-    WebCore::Document* doc = m_webPage->mainFrame()->document();
+    Document* doc = m_activeMatch->ownerDocument();
     if (!doc)
         return;
     doc->markers()->setMarkersActive(range, active);
 }
 
+void InPageSearchManager::frameUnloaded(const Frame* frame)
+{
+    if (!m_activeMatch) {
+        if (m_webPage->mainFrame() == frame && m_activeSearchString.length())
+            m_activeSearchString = String();
+        return;
+    }
+
+    Frame* currentActiveMatchFrame = m_activeMatch->ownerDocument()->frame();
+    if (currentActiveMatchFrame == frame) {
+        m_activeMatch = 0;
+        m_activeSearchString = String();
+        m_activeMatchCount = 0;
+        // FIXME: We need to notify client here.
+        if (frame == m_webPage->mainFrame()) // Don't need to unmark because the page will be destroyed.
+            return;
+        m_webPage->m_page->unmarkAllTextMatches();
+    }
+}
+
 }
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.h b/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.h
index 1f6bbb535..4b0562b17 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.h
+++ b/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.h
@@ -19,12 +19,13 @@
 #ifndef InPageSearchManager_h
 #define InPageSearchManager_h
 
+#include "FindOptions.h"
 #include "WTFString.h"
 
-#include <wtf/RefPtr.h>
-
 namespace WebCore {
+class Frame;
 class Range;
+class VisibleSelection;
 }
 
 namespace BlackBerry {
@@ -39,10 +40,13 @@ public:
     ~InPageSearchManager();
 
     bool findNextString(const String& text, bool forward);
+    void frameUnloaded(const WebCore::Frame*);
 
 private:
     void clearTextMatches();
-    void setMarkerActive(WebCore::Range*, bool active);
+    void setMarkerActive(WebCore::Range*, bool);
+    bool findAndMarkText(const String&, WebCore::Range*, WebCore::Frame*, const WebCore::FindOptions&);
+    bool shouldSearchForText(const String&);
 
     WebPagePrivate* m_webPage;
     RefPtr<WebCore::Range> m_activeMatch;
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
index 27b941e6f..a3362287f 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
@@ -64,23 +64,23 @@
 #define ENABLE_INPUT_LOG 0
 #define ENABLE_FOCUS_LOG 0
 
+static const unsigned MaxLearnTextDataSize = 500;
+
+using namespace BlackBerry::Platform;
+using namespace WebCore;
+
 #if ENABLE_INPUT_LOG
-#define InputLog(severity, format, ...) BlackBerry::Platform::logAlways(severity, format, ## __VA_ARGS__)
+#define InputLog(severity, format, ...) logAlways(severity, format, ## __VA_ARGS__)
 #else
 #define InputLog(severity, format, ...)
 #endif // ENABLE_INPUT_LOG
 
 #if ENABLE_FOCUS_LOG
-#define FocusLog(severity, format, ...) BlackBerry::Platform::logAlways(severity, format, ## __VA_ARGS__)
+#define FocusLog(severity, format, ...) logAlways(severity, format, ## __VA_ARGS__)
 #else
 #define FocusLog(severity, format, ...)
 #endif // ENABLE_FOCUS_LOG
 
-static const int MaxLearnTextDataSize = 500;
-
-using namespace BlackBerry::Platform;
-using namespace WebCore;
-
 namespace BlackBerry {
 namespace WebKit {
 
@@ -162,6 +162,7 @@ static int inputStyle(BlackBerryInputType type, const Element* element)
     switch (type) {
     case InputTypeText:
     case InputTypeSearch:
+    case InputTypeTextArea:
         {
             // Regular input mode, disable help if autocomplete is off.
             int imfMask = 0;
@@ -189,7 +190,6 @@ static int inputStyle(BlackBerryInputType type, const Element* element)
     case InputTypeURL:
         // Disable special handling.
         return NO_AUTO_TEXT | NO_PREDICTION | NO_AUTO_CORRECTION;
-    case InputTypeTextArea:
     default:
         break;
     }
@@ -222,8 +222,15 @@ BlackBerryInputType InputHandler::elementType(Element* element) const
     return InputTypeTextArea;
 }
 
-void InputHandler::nodeFocused(Node* node)
+void InputHandler::focusedNodeChanged()
 {
+    ASSERT(m_webPage->m_page->focusController());
+    Frame* frame = m_webPage->m_page->focusController()->focusedOrMainFrame();
+    if (!frame || !frame->document())
+        return;
+
+    Node* node = frame->document()->focusedNode();
+
     if (isActiveTextEdit() && m_currentFocusElement == node) {
         notifyClientOfKeyboardVisibilityChange(true);
         return;
@@ -297,7 +304,7 @@ static bool convertStringToWchar(const String& string, wchar_t* dest, int destCa
     // wchar_t strings sent to IMF are 32 bit so casting to UChar32 is safe.
     u_strToUTF32(reinterpret_cast<UChar32*>(dest), destCapacity, destLength, string.characters(), string.length(), &ec);
     if (ec) {
-        InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::convertStringToWchar Error converting string ec (%d).", ec);
+        InputLog(LogLevelInfo, "InputHandler::convertStringToWchar Error converting string ec (%d).", ec);
         destLength = 0;
         return false;
     }
@@ -313,7 +320,7 @@ static bool convertStringToWcharVector(const String& string, WTF::Vector<wchar_t
         return true;
 
     if (!wcharString.tryReserveCapacity(length + 1)) {
-        BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelWarn, "InputHandler::convertStringToWcharVector Cannot allocate memory for string.\n");
+        logAlways(LogLevelWarn, "InputHandler::convertStringToWcharVector Cannot allocate memory for string.\n");
         return false;
     }
 
@@ -333,7 +340,7 @@ static String convertSpannableStringToString(spannable_string_t* src)
     WTF::Vector<UChar> dest;
     int destCapacity = (src->length * 2) + 1;
     if (!dest.tryReserveCapacity(destCapacity)) {
-        BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelWarn, "InputHandler::convertSpannableStringToString Cannot allocate memory for string.\n");
+        logAlways(LogLevelWarn, "InputHandler::convertSpannableStringToString Cannot allocate memory for string.\n");
         return String();
     }
 
@@ -342,7 +349,7 @@ static String convertSpannableStringToString(spannable_string_t* src)
     // wchar_t strings sent from IMF are 32 bit so casting to UChar32 is safe.
     u_strFromUTF32(dest.data(), destCapacity, &destLength, reinterpret_cast<UChar32*>(src->str), src->length, &ec);
     if (ec) {
-        InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::convertSpannableStringToString Error converting string ec (%d).", ec);
+        InputLog(LogLevelInfo, "InputHandler::convertSpannableStringToString Error converting string ec (%d).", ec);
         return String();
     }
     dest.resize(destLength);
@@ -368,7 +375,7 @@ void InputHandler::learnText()
         return;
 
     String textInField(elementText());
-    textInField = textInField.substring(std::max(0, static_cast<int>(textInField.length()) - MaxLearnTextDataSize), textInField.length());
+    textInField = textInField.substring(std::max(0, static_cast<int>(textInField.length() - MaxLearnTextDataSize)), textInField.length());
     textInField.remove(0, textInField.find(" "));
 
     // Build up the 500 character strings in word chunks.
@@ -378,14 +385,14 @@ void InputHandler::learnText()
     if (textInField.isEmpty())
         return;
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::learnText %s", textInField.latin1().data());
+    InputLog(LogLevelInfo, "InputHandler::learnText %s", textInField.latin1().data());
     sendLearnTextDetails(textInField);
 }
 
 void InputHandler::setElementUnfocused(bool refocusOccuring)
 {
     if (isActiveTextEdit()) {
-        FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setElementUnfocused");
+        FocusLog(LogLevelInfo, "InputHandler::setElementUnfocused");
 
         // Pass any text into the field to IMF to learn.
         learnText();
@@ -412,36 +419,36 @@ bool InputHandler::shouldAcceptInputFocus()
     if (m_webPage->m_dumpRenderTree)
         return true;
 
-    if (BlackBerry::Platform::Settings::get()->alwaysShowKeyboardOnFocus()) {
-        FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus alwaysShowKeyboardOnFocus is active.");
+    if (Platform::Settings::get()->alwaysShowKeyboardOnFocus()) {
+        FocusLog(LogLevelInfo, "InputHandler::shouldAcceptInputFocus alwaysShowKeyboardOnFocus is active.");
         return true;
     }
 
     Frame* focusedFrame = m_webPage->focusedOrMainFrame();
     if (!focusedFrame) {
-        FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus Frame not valid.");
+        FocusLog(LogLevelInfo, "InputHandler::shouldAcceptInputFocus Frame not valid.");
         return false;
     }
 
     // Any user action should be respected. Mouse will be down when touch is
     // used to focus.
     if (focusedFrame->eventHandler()->mousePressed()) {
-        FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus Mouse is pressed focusing.");
+        FocusLog(LogLevelInfo, "InputHandler::shouldAcceptInputFocus Mouse is pressed focusing.");
         return true;
     }
 
     if (!m_webPage->m_client->hasKeyboardFocus()) {
-        FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus Client does not have input focus.");
+        FocusLog(LogLevelInfo, "InputHandler::shouldAcceptInputFocus Client does not have input focus.");
         return false;
     }
 
     if (m_webPage->isLoading()) {
-        FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus Webpage is loading.");
+        FocusLog(LogLevelInfo, "InputHandler::shouldAcceptInputFocus Webpage is loading.");
         return false;
     }
 
     // Make sure the focused frame is not processing load events.
-    FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus returning state of processingLoadEvent (%s).", !focusedFrame->document()->processingLoadEvent() ? "true" : "false");
+    FocusLog(LogLevelInfo, "InputHandler::shouldAcceptInputFocus returning state of processingLoadEvent (%s).", !focusedFrame->document()->processingLoadEvent() ? "true" : "false");
     return !focusedFrame->document()->processingLoadEvent();
 }
 
@@ -473,7 +480,7 @@ void InputHandler::setElementFocused(Element* element)
     BlackBerryInputType type = elementType(element);
     m_currentFocusElementTextEditMask = inputStyle(type, element);
 
-    FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setElementFocused, Type=%d, Style=%d", type, m_currentFocusElementTextEditMask);
+    FocusLog(LogLevelInfo, "InputHandler::setElementFocused, Type=%d, Style=%d", type, m_currentFocusElementTextEditMask);
 
     m_webPage->m_client->inputFocusGained(type,
                                           m_currentFocusElementTextEditMask,
@@ -534,7 +541,7 @@ void InputHandler::nodeTextChanged(const Node* node)
     if (node != m_currentFocusElement)
         return;
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::nodeTextChanged");
+    InputLog(LogLevelInfo, "InputHandler::nodeTextChanged");
 
     m_webPage->m_client->inputTextChanged();
 
@@ -548,7 +555,7 @@ void InputHandler::ensureFocusTextElementVisible(CaretScrollType scrollType)
     if (!m_currentFocusElement || !m_currentFocusElement->document())
         return;
 
-    if (!BlackBerry::Platform::Settings::get()->allowCenterScrollAdjustmentForInputFields() && scrollType != EdgeIfNeeded)
+    if (!Platform::Settings::get()->allowCenterScrollAdjustmentForInputFields() && scrollType != EdgeIfNeeded)
         return;
 
     Frame* elementFrame = m_currentFocusElement->document()->frame();
@@ -710,7 +717,7 @@ void InputHandler::ensureFocusElementVisible(bool centerInView)
         ensureFocusTextElementVisible(centerInView ? CenterAlways : CenterIfNeeded);
 }
 
-void InputHandler::frameUnloaded(Frame* frame)
+void InputHandler::frameUnloaded(const Frame* frame)
 {
     if (!isActiveTextEdit())
         return;
@@ -718,7 +725,7 @@ void InputHandler::frameUnloaded(Frame* frame)
     if (m_currentFocusElement->document()->frame() != frame)
         return;
 
-    FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::frameUnloaded");
+    FocusLog(LogLevelInfo, "InputHandler::frameUnloaded");
 
     setElementUnfocused(false /*refocusOccuring*/);
 }
@@ -837,7 +844,7 @@ void InputHandler::selectionChanged()
     int newSelectionStart = selectionStart();
     int newSelectionEnd = selectionEnd();
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::selectionChanged selectionStart=%u, selectionEnd=%u", newSelectionStart, newSelectionEnd);
+    InputLog(LogLevelInfo, "InputHandler::selectionChanged selectionStart=%u, selectionEnd=%u", newSelectionStart, newSelectionEnd);
 
     m_webPage->m_client->inputSelectionChanged(newSelectionStart, newSelectionEnd);
 
@@ -863,7 +870,7 @@ bool InputHandler::setSelection(int start, int end, bool changeIsPartOfCompositi
     VisibleSelection newSelection = DOMSupport::visibleSelectionForRangeInputElement(m_currentFocusElement.get(), start, end);
     m_currentFocusElement->document()->frame()->selection()->setSelection(newSelection, changeIsPartOfComposition ? 0 : FrameSelection::CloseTyping | FrameSelection::ClearTypingStyle);
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setSelection selectionStart=%u, selectionEnd=%u", start, end);
+    InputLog(LogLevelInfo, "InputHandler::setSelection selectionStart=%u, selectionEnd=%u", start, end);
 
     return start == selectionStart() && end == selectionEnd();
 }
@@ -898,9 +905,9 @@ void InputHandler::cancelSelection()
     setCursorPosition(selectionStartPosition);
 }
 
-bool InputHandler::handleKeyboardInput(const BlackBerry::Platform::KeyboardEvent& keyboardEvent, bool changeIsPartOfComposition)
+bool InputHandler::handleKeyboardInput(const Platform::KeyboardEvent& keyboardEvent, bool changeIsPartOfComposition)
 {
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::handleKeyboardInput received character=%lc, type=%d", keyboardEvent.character(), keyboardEvent.type());
+    InputLog(LogLevelInfo, "InputHandler::handleKeyboardInput received character=%lc, type=%d", keyboardEvent.character(), keyboardEvent.type());
 
     // If we aren't specifically part of a composition, fail, IMF should never send key input
     // while composing text. If IMF has failed, we should have already finished the
@@ -917,23 +924,23 @@ bool InputHandler::handleKeyboardInput(const BlackBerry::Platform::KeyboardEvent
     ASSERT(m_webPage->m_page->focusController());
     bool keyboardEventHandled = false;
     if (Frame* focusedFrame = m_webPage->m_page->focusController()->focusedFrame()) {
-        bool isKeyChar = keyboardEvent.type() == BlackBerry::Platform::KeyboardEvent::KeyChar;
-        BlackBerry::Platform::KeyboardEvent::Type type = keyboardEvent.type();
+        bool isKeyChar = keyboardEvent.type() == Platform::KeyboardEvent::KeyChar;
+        Platform::KeyboardEvent::Type type = keyboardEvent.type();
 
         // If this is a KeyChar type then we handle it as a keydown followed by a key up.
         if (isKeyChar)
-            type = BlackBerry::Platform::KeyboardEvent::KeyDown;
+            type = Platform::KeyboardEvent::KeyDown;
 
-        BlackBerry::Platform::KeyboardEvent adjustedKeyboardEvent(keyboardEvent.character(), type, adjustedModifiers);
+        Platform::KeyboardEvent adjustedKeyboardEvent(keyboardEvent.character(), type, adjustedModifiers);
         keyboardEventHandled = focusedFrame->eventHandler()->keyEvent(PlatformKeyboardEvent(adjustedKeyboardEvent));
 
         if (isKeyChar) {
-            type = BlackBerry::Platform::KeyboardEvent::KeyUp;
-            adjustedKeyboardEvent = BlackBerry::Platform::KeyboardEvent(keyboardEvent.character(), type, adjustedModifiers);
+            type = Platform::KeyboardEvent::KeyUp;
+            adjustedKeyboardEvent = Platform::KeyboardEvent(keyboardEvent.character(), type, adjustedModifiers);
             keyboardEventHandled = focusedFrame->eventHandler()->keyEvent(PlatformKeyboardEvent(adjustedKeyboardEvent)) || keyboardEventHandled;
         }
 
-        if (!changeIsPartOfComposition && type == BlackBerry::Platform::KeyboardEvent::KeyUp)
+        if (!changeIsPartOfComposition && type == Platform::KeyboardEvent::KeyUp)
             ensureFocusTextElementVisible(EdgeIfNeeded);
     }
     return keyboardEventHandled;
@@ -1244,7 +1251,7 @@ bool InputHandler::deleteTextRelativeToCursor(int leftOffset, int rightOffset)
 
     ProcessingChangeGuard guard(this);
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::deleteTextRelativeToCursor left %d right %d", leftOffset, rightOffset);
+    InputLog(LogLevelInfo, "InputHandler::deleteTextRelativeToCursor left %d right %d", leftOffset, rightOffset);
 
     int caretOffset = caretPosition();
     int start = relativeLeftOffset(caretOffset, leftOffset);
@@ -1269,7 +1276,7 @@ bool InputHandler::deleteText(int start, int end)
     if (!setSelection(start, end, true /*changeIsPartOfComposition*/))
         return false;
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::deleteText start %d end %d", start, end);
+    InputLog(LogLevelInfo, "InputHandler::deleteText start %d end %d", start, end);
 
     return deleteSelection();
 }
@@ -1289,13 +1296,13 @@ spannable_string_t* InputHandler::spannableTextInRange(int start, int end, int32
 
     spannable_string_t* pst = (spannable_string_t*)malloc(sizeof(spannable_string_t));
     if (!pst) {
-        InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::spannableTextInRange error allocating spannable string.");
+        InputLog(LogLevelInfo, "InputHandler::spannableTextInRange error allocating spannable string.");
         return 0;
     }
 
     pst->str = (wchar_t*)malloc(sizeof(wchar_t) * (length + 1));
     if (!pst->str) {
-        InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::spannableTextInRange Cannot allocate memory for string.\n");
+        InputLog(LogLevelInfo, "InputHandler::spannableTextInRange Cannot allocate memory for string.\n");
         free(pst);
         return 0;
     }
@@ -1438,7 +1445,7 @@ int32_t InputHandler::setComposingRegion(int32_t start, int32_t end)
     if (compositionActive())
         addAttributedTextMarker(start, end, compositionTextStyle());
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setComposingRegion start %d end %d", start, end);
+    InputLog(LogLevelInfo, "InputHandler::setComposingRegion start %d end %d", start, end);
 
     return 0;
 }
@@ -1455,7 +1462,7 @@ int32_t InputHandler::finishComposition()
     // Remove all markers.
     removeAttributedTextMarker();
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::finishComposition completed");
+    InputLog(LogLevelInfo, "InputHandler::finishComposition completed");
 
     return 0;
 }
@@ -1519,7 +1526,7 @@ bool InputHandler::setText(spannable_string_t* spannableString)
         // Handle the case where text is being composed.
         if (firstSpanInString(spannableString, COMPOSED_TEXT_ATTRIB))
             return editor->command("InsertText").execute(textToInsert.right(1));
-        return handleKeyboardInput(BlackBerry::Platform::KeyboardEvent(textToInsert[textLength - 1], BlackBerry::Platform::KeyboardEvent::KeyChar, 0), false /* changeIsPartOfComposition */);
+        return handleKeyboardInput(Platform::KeyboardEvent(textToInsert[textLength - 1], Platform::KeyboardEvent::KeyChar, 0), false /* changeIsPartOfComposition */);
     }
 
     // If no spans have changed, treat it as a delete operation.
@@ -1544,7 +1551,7 @@ bool InputHandler::setText(spannable_string_t* spannableString)
         return true;
     }
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "setText spannableString is %s, %d \n", textToInsert.latin1().data(), textLength);
+    InputLog(LogLevelInfo, "setText spannableString is %s, %d \n", textToInsert.latin1().data(), textLength);
 
     // Triggering an insert of the text with a space character trailing
     // causes new text to adopt the previous text style.
@@ -1557,27 +1564,27 @@ bool InputHandler::setText(spannable_string_t* spannableString)
         textToInsert.remove(textLength, 1);
     }
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setText Request being processed Text before %s", elementText().latin1().data());
+    InputLog(LogLevelInfo, "InputHandler::setText Request being processed Text before %s", elementText().latin1().data());
 
     if (textLength == 1 && !spannableString->spans_count) {
         // Handle single key non-attributed entry as key press rather than insert to allow
         // triggering of javascript events.
 
-        return handleKeyboardInput(BlackBerry::Platform::KeyboardEvent(textToInsert[0], BlackBerry::Platform::KeyboardEvent::KeyChar, 0), true /* changeIsPartOfComposition */);
+        return handleKeyboardInput(Platform::KeyboardEvent(textToInsert[0], Platform::KeyboardEvent::KeyChar, 0), true /* changeIsPartOfComposition */);
     }
 
     // Perform the text change as a single command if there is one.
     if (!textToInsert.isEmpty() && !editor->command("InsertText").execute(textToInsert)) {
-        InputLog(BlackBerry::Platform::LogLevelWarn, "InputHandler::setText Failed to insert text %s", textToInsert.latin1().data());
+        InputLog(LogLevelWarn, "InputHandler::setText Failed to insert text %s", textToInsert.latin1().data());
         return false;
     }
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setText Request being processed Text after insert %s", elementText().latin1().data());
+    InputLog(LogLevelInfo, "InputHandler::setText Request being processed Text after insert %s", elementText().latin1().data());
 
     if (requiresSpaceKeyPress)
-        handleKeyboardInput(BlackBerry::Platform::KeyboardEvent(32 /* space */, BlackBerry::Platform::KeyboardEvent::KeyChar, 0), true /* changeIsPartOfComposition */);
+        handleKeyboardInput(Platform::KeyboardEvent(32 /* space */, Platform::KeyboardEvent::KeyChar, 0), true /* changeIsPartOfComposition */);
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setText Text after %s", elementText().latin1().data());
+    InputLog(LogLevelInfo, "InputHandler::setText Text after %s", elementText().latin1().data());
 
     return true;
 }
@@ -1602,13 +1609,13 @@ bool InputHandler::setTextAttributes(int insertionPoint, spannable_string_t* spa
         // used by IMF. When they add support for on the fly spell checking we can
         // use it to apply spelling markers and disable continuous spell checking.
 
-        InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setTextAttributes adding marker %d to %d - %d", startPosition, endPosition, span->attributes_mask);
+        InputLog(LogLevelInfo, "InputHandler::setTextAttributes adding marker %d to %d - %d", startPosition, endPosition, span->attributes_mask);
         addAttributedTextMarker(startPosition, endPosition, textStyleFromMask(span->attributes_mask));
 
         span++;
     }
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setTextAttributes attribute count %d", spannableString->spans_count);
+    InputLog(LogLevelInfo, "InputHandler::setTextAttributes attribute count %d", spannableString->spans_count);
 
     return true;
 }
@@ -1639,14 +1646,14 @@ bool InputHandler::setRelativeCursorPosition(int insertionPoint, int relativeCur
     if (cursorPosition < 0 || cursorPosition > (int)elementText().length())
         return false;
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setRelativeCursorPosition cursor position %d", cursorPosition);
+    InputLog(LogLevelInfo, "InputHandler::setRelativeCursorPosition cursor position %d", cursorPosition);
 
     return setCursorPosition(cursorPosition);
 }
 
 bool InputHandler::setSpannableTextAndRelativeCursor(spannable_string_t* spannableString, int relativeCursorPosition, bool markTextAsComposing)
 {
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setSpannableTextAndRelativeCursor(%d, %d, %d)\n", spannableString->length, relativeCursorPosition, markTextAsComposing);
+    InputLog(LogLevelInfo, "InputHandler::setSpannableTextAndRelativeCursor(%d, %d, %d)\n", spannableString->length, relativeCursorPosition, markTextAsComposing);
     int insertionPoint = compositionActive() ? m_composingTextStart : selectionStart();
 
     ProcessingChangeGuard guard(this);
@@ -1680,7 +1687,7 @@ int32_t InputHandler::setComposingText(spannable_string_t* spannableString, int3
     if (!spannableString)
         return -1;
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setComposingText at relativeCursorPosition: %d", relativeCursorPosition);
+    InputLog(LogLevelInfo, "InputHandler::setComposingText at relativeCursorPosition: %d", relativeCursorPosition);
 
     return setSpannableTextAndRelativeCursor(spannableString, relativeCursorPosition, true /* markTextAsComposing */) ? 0 : -1;
 }
@@ -1693,7 +1700,7 @@ int32_t InputHandler::commitText(spannable_string_t* spannableString, int32_t re
     if (!spannableString)
         return -1;
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::commitText");
+    InputLog(LogLevelInfo, "InputHandler::commitText");
 
     return setSpannableTextAndRelativeCursor(spannableString, relativeCursorPosition, false /* markTextAsComposing */) ? 0 : -1;
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.h b/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
index 1b64a78b1..94c93ff30 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
@@ -57,10 +57,10 @@ public:
     enum FocusElementType { TextEdit, TextPopup /* Date/Time & Color */, SelectPopup, Plugin };
     enum CaretScrollType { CenterAlways, CenterIfNeeded, EdgeIfNeeded };
 
-    void nodeFocused(WebCore::Node*);
+    void focusedNodeChanged();
     void nodeTextChanged(const WebCore::Node*);
     void selectionChanged();
-    void frameUnloaded(WebCore::Frame*);
+    void frameUnloaded(const WebCore::Frame*);
 
     bool handleKeyboardInput(const BlackBerry::Platform::KeyboardEvent&, bool changeIsPartOfComposition = false);
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
index 0723c65c8..8385deeda 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
@@ -49,14 +49,15 @@
 
 #define SHOWDEBUG_SELECTIONHANDLER 0
 
+using namespace BlackBerry::Platform;
+using namespace WebCore;
+
 #if SHOWDEBUG_SELECTIONHANDLER
-#define DEBUG_SELECTION(severity, format, ...) BlackBerry::Platform::logAlways(severity, format, ## __VA_ARGS__)
+#define DEBUG_SELECTION(severity, format, ...) logAlways(severity, format, ## __VA_ARGS__)
 #else
 #define DEBUG_SELECTION(severity, format, ...)
 #endif // SHOWDEBUG_SELECTIONHANDLER
 
-using namespace WebCore;
-
 namespace BlackBerry {
 namespace WebKit {
 
@@ -75,9 +76,9 @@ SelectionHandler::~SelectionHandler()
 void SelectionHandler::cancelSelection()
 {
     m_selectionActive = false;
-    m_lastSelectionRegion = BlackBerry::Platform::IntRectRegion();
+    m_lastSelectionRegion = IntRectRegion();
 
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::cancelSelection");
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::cancelSelection");
 
     if (m_webPage->m_inputHandler->isInputMode())
         m_webPage->m_inputHandler->cancelSelection();
@@ -90,7 +91,7 @@ WebString SelectionHandler::selectedText() const
     return m_webPage->focusedOrMainFrame()->editor()->selectedText();
 }
 
-void SelectionHandler::getConsolidatedRegionOfTextQuadsForSelection(const VisibleSelection& selection, BlackBerry::Platform::IntRectRegion& region) const
+void SelectionHandler::getConsolidatedRegionOfTextQuadsForSelection(const VisibleSelection& selection, IntRectRegion& region) const
 {
     ASSERT(region.isEmpty());
 
@@ -106,24 +107,24 @@ void SelectionHandler::getConsolidatedRegionOfTextQuadsForSelection(const Visibl
         FrameView* frameView = m_webPage->focusedOrMainFrame()->view();
 
         // frameRect is in frame coordinates.
-        IntRect frameRect(IntPoint(0, 0), frameView->contentsSize());
+        WebCore::IntRect frameRect(WebCore::IntPoint(0, 0), frameView->contentsSize());
 
         // framePosition is in main frame coordinates.
-        IntPoint framePosition = m_webPage->frameOffset(m_webPage->focusedOrMainFrame());
+        WebCore::IntPoint framePosition = m_webPage->frameOffset(m_webPage->focusedOrMainFrame());
 
         // The ranges rect list is based on render elements and may include multiple adjacent rects.
-        // Use BlackBerry::Platform::IntRectRegion to consolidate these rects into bands as well as a container to pass
+        // Use IntRectRegion to consolidate these rects into bands as well as a container to pass
         // to the client.
         for (unsigned i = 0; i < quadList.size(); i++) {
-            IntRect enclosingRect = quadList[i].enclosingBoundingBox();
+            WebCore::IntRect enclosingRect = quadList[i].enclosingBoundingBox();
             enclosingRect.intersect(frameRect);
             enclosingRect.move(framePosition.x(), framePosition.y());
-            region = unionRegions(region, BlackBerry::Platform::IntRectRegion(enclosingRect));
+            region = unionRegions(region, IntRectRegion(enclosingRect));
         }
     }
 }
 
-static VisiblePosition visiblePositionForPointIgnoringClipping(const Frame& frame, const IntPoint& framePoint)
+static VisiblePosition visiblePositionForPointIgnoringClipping(const Frame& frame, const WebCore::IntPoint& framePoint)
 {
     // Frame::visiblePositionAtPoint hard-codes ignoreClipping=false in the
     // call to hitTestResultAtPoint. This has a bug where some pages (such as
@@ -148,7 +149,7 @@ static VisiblePosition visiblePositionForPointIgnoringClipping(const Frame& fram
     return visiblePos;
 }
 
-static unsigned short directionOfPointRelativeToRect(const IntPoint& point, const IntRect& rect, const bool useTopPadding = true, const bool useBottomPadding = true)
+static unsigned short directionOfPointRelativeToRect(const WebCore::IntPoint& point, const WebCore::IntRect& rect, const bool useTopPadding = true, const bool useBottomPadding = true)
 {
     ASSERT(!rect.contains(point));
 
@@ -169,7 +170,7 @@ static unsigned short directionOfPointRelativeToRect(const IntPoint& point, cons
     return 0;
 }
 
-bool SelectionHandler::shouldUpdateSelectionOrCaretForPoint(const IntPoint& point, const IntRect& caretRect, bool startCaret) const
+bool SelectionHandler::shouldUpdateSelectionOrCaretForPoint(const WebCore::IntPoint& point, const WebCore::IntRect& caretRect, bool startCaret) const
 {
     ASSERT(m_webPage->m_inputHandler->isInputMode());
 
@@ -184,7 +185,7 @@ bool SelectionHandler::shouldUpdateSelectionOrCaretForPoint(const IntPoint& poin
     bool aboveCaret = point.y() < caretRect.y();
     bool belowCaret = point.y() >= caretRect.maxY();
 
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::shouldUpdateSelectionOrCaretForPoint multiline = %s above = %s below = %s first line = %s last line = %s start = %s \n"
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::shouldUpdateSelectionOrCaretForPoint multiline = %s above = %s below = %s first line = %s last line = %s start = %s \n"
             , m_webPage->m_inputHandler->isMultilineInputMode() ? "true" : "false", aboveCaret ? "true" : "false", belowCaret ? "true" : "false"
             , inSameLine(currentSelection.visibleStart(), startOfEditableContent(currentSelection.visibleStart())) ? "true" : "false"
             , inSameLine(currentSelection.visibleEnd(), endOfEditableContent(currentSelection.visibleEnd())) ? "true" : "false"
@@ -200,19 +201,19 @@ bool SelectionHandler::shouldUpdateSelectionOrCaretForPoint(const IntPoint& poin
     return true;
 }
 
-void SelectionHandler::setCaretPosition(const IntPoint &position)
+void SelectionHandler::setCaretPosition(const WebCore::IntPoint &position)
 {
     if (!m_webPage->m_inputHandler->isInputMode())
         return;
 
     m_caretActive = true;
 
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::setCaretPosition requested point %d, %d", position.x(), position.y());
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::setCaretPosition requested point %d, %d", position.x(), position.y());
 
     Frame* focusedFrame = m_webPage->focusedOrMainFrame();
     FrameSelection* controller = focusedFrame->selection();
-    IntPoint relativePoint = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), focusedFrame, position);
-    IntRect currentCaretRect = controller->selection().visibleStart().absoluteCaretBounds();
+    WebCore::IntPoint relativePoint = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), focusedFrame, position);
+    WebCore::IntRect currentCaretRect = controller->selection().visibleStart().absoluteCaretBounds();
 
     if (relativePoint == DOMSupport::InvalidPoint || !shouldUpdateSelectionOrCaretForPoint(relativePoint, currentCaretRect)) {
         selectionPositionChanged();
@@ -223,7 +224,7 @@ void SelectionHandler::setCaretPosition(const IntPoint &position)
 
     if (!DOMSupport::isPositionInNode(m_webPage->focusedOrMainFrame()->document()->focusedNode(), visibleCaretPosition.deepEquivalent())) {
         if (unsigned short character = directionOfPointRelativeToRect(relativePoint, currentCaretRect))
-            m_webPage->m_inputHandler->handleKeyboardInput(BlackBerry::Platform::KeyboardEvent(character));
+            m_webPage->m_inputHandler->handleKeyboardInput(Platform::KeyboardEvent(character));
 
         selectionPositionChanged();
         return;
@@ -237,7 +238,7 @@ void SelectionHandler::setCaretPosition(const IntPoint &position)
 
     controller->setSelection(newSelection);
 
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::setCaretPosition point valid, cursor updated");
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::setCaretPosition point valid, cursor updated");
 }
 
 // This function makes sure we are not reducing the selection to a caret selection.
@@ -270,7 +271,12 @@ static bool shouldExtendSelectionInDirection(const VisibleSelection& selection,
     return tempSelection.selection().selectionType() == VisibleSelection::RangeSelection;
 }
 
-static VisiblePosition directionalVisiblePositionAtExtentOfBox(Frame* frame, const IntRect& boundingBox, unsigned short direction, const IntPoint& basePoint)
+static int clamp(const int min, const int value, const int max)
+{
+    return value < min ? min : std::min(value, max);
+}
+
+static VisiblePosition directionalVisiblePositionAtExtentOfBox(Frame* frame, const WebCore::IntRect& boundingBox, unsigned short direction, const WebCore::IntPoint& basePoint)
 {
     ASSERT(frame);
 
@@ -279,25 +285,25 @@ static VisiblePosition directionalVisiblePositionAtExtentOfBox(Frame* frame, con
 
     switch (direction) {
     case KEYCODE_LEFT:
-        // Extend x to start without modifying y.
-        return frame->visiblePositionForPoint(IntPoint(boundingBox.x(), basePoint.y()));
+        // Extend x to start and clamp y to the edge of bounding box.
+        return frame->visiblePositionForPoint(WebCore::IntPoint(boundingBox.x(), clamp(boundingBox.y(), basePoint.y(), boundingBox.maxY())));
     case KEYCODE_RIGHT:
-        // Extend x to end without modifying y.
-        return frame->visiblePositionForPoint(IntPoint(boundingBox.maxX(), basePoint.y()));
+        // Extend x to end and clamp y to the edge of bounding box.
+        return frame->visiblePositionForPoint(WebCore::IntPoint(boundingBox.maxX(), clamp(boundingBox.y(), basePoint.y(), boundingBox.maxY())));
     case KEYCODE_UP:
-        // Extend y to top without modifying x.
-        return frame->visiblePositionForPoint(IntPoint(basePoint.x(), boundingBox.y()));
+        // Extend y to top and clamp x to the edge of bounding box.
+        return frame->visiblePositionForPoint(WebCore::IntPoint(clamp(boundingBox.x(), basePoint.x(), boundingBox.maxX()), boundingBox.y()));
     case KEYCODE_DOWN:
-        // Extend y to bottom without modifying x.
-        return frame->visiblePositionForPoint(IntPoint(basePoint.x(), boundingBox.maxY()));
+        // Extend y to bottom and clamp x to the edge of bounding box.
+        return frame->visiblePositionForPoint(WebCore::IntPoint(clamp(boundingBox.x(), basePoint.x(), boundingBox.maxX()), boundingBox.maxY()));
     default:
         break;
     }
 
-    return frame->visiblePositionForPoint(IntPoint(basePoint.x(), basePoint.y()));
+    return frame->visiblePositionForPoint(WebCore::IntPoint(basePoint.x(), basePoint.y()));
 }
 
-static bool pointIsOutsideOfBoundingBoxInDirection(unsigned direction, const IntPoint& selectionPoint, const IntRect& boundingBox)
+static bool pointIsOutsideOfBoundingBoxInDirection(unsigned direction, const WebCore::IntPoint& selectionPoint, const WebCore::IntRect& boundingBox)
 {
     if ((direction == KEYCODE_LEFT && selectionPoint.x() < boundingBox.x())
         || (direction == KEYCODE_UP && selectionPoint.y() < boundingBox.y())
@@ -308,7 +314,7 @@ static bool pointIsOutsideOfBoundingBoxInDirection(unsigned direction, const Int
     return false;
 }
 
-unsigned short SelectionHandler::extendSelectionToFieldBoundary(bool isStartHandle, const IntPoint& selectionPoint, VisibleSelection& newSelection)
+unsigned short SelectionHandler::extendSelectionToFieldBoundary(bool isStartHandle, const WebCore::IntPoint& selectionPoint, VisibleSelection& newSelection)
 {
     Frame* focusedFrame = m_webPage->focusedOrMainFrame();
     if (!focusedFrame->document()->focusedNode() || !focusedFrame->document()->focusedNode()->renderer())
@@ -316,15 +322,15 @@ unsigned short SelectionHandler::extendSelectionToFieldBoundary(bool isStartHand
 
     FrameSelection* controller = focusedFrame->selection();
 
-    IntRect caretRect = isStartHandle ? controller->selection().visibleStart().absoluteCaretBounds()
+    WebCore::IntRect caretRect = isStartHandle ? controller->selection().visibleStart().absoluteCaretBounds()
                                       : controller->selection().visibleEnd().absoluteCaretBounds();
 
-    IntRect nodeBoundingBox = focusedFrame->document()->focusedNode()->renderer()->absoluteBoundingBoxRect();
+    WebCore::IntRect nodeBoundingBox = focusedFrame->document()->focusedNode()->renderer()->absoluteBoundingBoxRect();
     nodeBoundingBox.inflate(-1);
 
     // Start handle is outside of the field. Treat it as the changed handle and move
     // relative to the start caret rect.
-    unsigned short character = directionOfPointRelativeToRect(selectionPoint, caretRect, isStartHandle /*useTopPadding*/, !isStartHandle /*useBottomPadding*/);
+    unsigned short character = directionOfPointRelativeToRect(selectionPoint, caretRect, isStartHandle /* useTopPadding */, !isStartHandle /* useBottomPadding */);
 
     // Prevent incorrect movement, handles can only extend the selection this way
     // to prevent inversion of the handles.
@@ -339,9 +345,9 @@ unsigned short SelectionHandler::extendSelectionToFieldBoundary(bool isStartHand
         newVisiblePosition = directionalVisiblePositionAtExtentOfBox(focusedFrame, nodeBoundingBox, character, selectionPoint);
 
     if (isStartHandle)
-        newSelection = VisibleSelection(newVisiblePosition, newSelection.extent(), true /*isDirectional*/);
+        newSelection = VisibleSelection(newVisiblePosition, newSelection.extent(), true /* isDirectional */);
     else
-        newSelection = VisibleSelection(newSelection.base(), newVisiblePosition, true /*isDirectional*/);
+        newSelection = VisibleSelection(newSelection.base(), newVisiblePosition, true /* isDirectional */);
 
     // If no selection will be changed, return the character to extend using navigation.
     if (controller->selection() == newSelection)
@@ -352,8 +358,8 @@ unsigned short SelectionHandler::extendSelectionToFieldBoundary(bool isStartHand
 }
 
 // Returns true if handled.
-bool SelectionHandler::updateOrHandleInputSelection(VisibleSelection& newSelection, const IntPoint& relativeStart
-                                                    , const IntPoint& relativeEnd)
+bool SelectionHandler::updateOrHandleInputSelection(VisibleSelection& newSelection, const WebCore::IntPoint& relativeStart
+                                                    , const WebCore::IntPoint& relativeEnd)
 {
     ASSERT(m_webPage->m_inputHandler->isInputMode());
 
@@ -364,8 +370,8 @@ bool SelectionHandler::updateOrHandleInputSelection(VisibleSelection& newSelecti
 
     FrameSelection* controller = focusedFrame->selection();
 
-    IntRect currentStartCaretRect = controller->selection().visibleStart().absoluteCaretBounds();
-    IntRect currentEndCaretRect = controller->selection().visibleEnd().absoluteCaretBounds();
+    WebCore::IntRect currentStartCaretRect = controller->selection().visibleStart().absoluteCaretBounds();
+    WebCore::IntRect currentEndCaretRect = controller->selection().visibleEnd().absoluteCaretBounds();
 
     // Check if the handle movement is valid.
     if (!shouldUpdateSelectionOrCaretForPoint(relativeStart, currentStartCaretRect, true /* startCaret */)
@@ -374,7 +380,7 @@ bool SelectionHandler::updateOrHandleInputSelection(VisibleSelection& newSelecti
         return true;
     }
 
-    IntRect nodeBoundingBox = focusedNode->renderer()->absoluteBoundingBoxRect();
+    WebCore::IntRect nodeBoundingBox = focusedNode->renderer()->absoluteBoundingBoxRect();
 
     // Only do special handling if one handle is outside of the node.
     bool startIsOutsideOfField = relativeStart != DOMSupport::InvalidPoint && !nodeBoundingBox.contains(relativeStart);
@@ -387,23 +393,23 @@ bool SelectionHandler::updateOrHandleInputSelection(VisibleSelection& newSelecti
         character = extendSelectionToFieldBoundary(true /* isStartHandle */, relativeStart, newSelection);
         if (character) {
             // Invert the selection so that the cursor point is at the beginning.
-            controller->setSelection(VisibleSelection(controller->selection().end(), controller->selection().start()));
+            controller->setSelection(VisibleSelection(controller->selection().end(), controller->selection().start(), true /* isDirectional */));
         }
     } else if (endIsOutsideOfField) {
         character = extendSelectionToFieldBoundary(false /* isStartHandle */, relativeEnd, newSelection);
         if (character) {
             // Reset the selection so that the end is the edit point.
-            controller->setSelection(VisibleSelection(controller->selection().start(), controller->selection().end()));
+            controller->setSelection(VisibleSelection(controller->selection().start(), controller->selection().end(), true /* isDirectional */));
         }
     }
 
     if (!character)
         return false;
 
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::setSelection making selection change attempt using key event %d", character);
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::setSelection making selection change attempt using key event %d", character);
 
     if (shouldExtendSelectionInDirection(controller->selection(), character))
-        m_webPage->m_inputHandler->handleKeyboardInput(BlackBerry::Platform::KeyboardEvent(character, BlackBerry::Platform::KeyboardEvent::KeyDown, KEYMOD_SHIFT));
+        m_webPage->m_inputHandler->handleKeyboardInput(Platform::KeyboardEvent(character, Platform::KeyboardEvent::KeyDown, KEYMOD_SHIFT));
 
     // Must send the selectionPositionChanged every time, sometimes this will duplicate but an accepted
     // handleNavigationMove may not make an actual selection change.
@@ -411,27 +417,7 @@ bool SelectionHandler::updateOrHandleInputSelection(VisibleSelection& newSelecti
     return true;
 }
 
-IntPoint SelectionHandler::clipPointToFocusNode(const IntPoint& point)
-{
-    Frame* focusedFrame = m_webPage->focusedOrMainFrame();
-    FrameSelection* controller = focusedFrame->selection();
-
-    if (!focusedFrame->document()->focusedNode() || !focusedFrame->document()->focusedNode()->renderer())
-        return point;
-
-    IntRect focusedNodeBoundingBox = focusedFrame->document()->focusedNode()->renderer()->absoluteBoundingBoxRect();
-    focusedNodeBoundingBox.inflate(-1);
-
-    IntPoint clippedPoint = point;
-    if (!focusedNodeBoundingBox.contains(clippedPoint))
-        clippedPoint = IntPoint(
-            point.x() < focusedNodeBoundingBox.x() ? focusedNodeBoundingBox.x() : std::min(focusedNodeBoundingBox.maxX(), point.x()),
-            point.y() < focusedNodeBoundingBox.y() ? focusedNodeBoundingBox.y() : std::min(focusedNodeBoundingBox.maxY(), point.y()));
-
-    return clippedPoint;
-}
-
-void SelectionHandler::setSelection(const IntPoint& start, const IntPoint& end)
+void SelectionHandler::setSelection(const WebCore::IntPoint& start, const WebCore::IntPoint& end)
 {
     m_selectionActive = true;
 
@@ -442,7 +428,7 @@ void SelectionHandler::setSelection(const IntPoint& start, const IntPoint& end)
     Frame* focusedFrame = m_webPage->focusedOrMainFrame();
     FrameSelection* controller = focusedFrame->selection();
 
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::setSelection adjusted points %d, %d, %d, %d", start.x(), start.y(), end.x(), end.y());
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::setSelection adjusted points %d, %d, %d, %d", start.x(), start.y(), end.x(), end.y());
 
     // Note that IntPoint(-1, -1) is being our sentinel so far for
     // clipped out selection starting or ending location.
@@ -452,20 +438,20 @@ void SelectionHandler::setSelection(const IntPoint& start, const IntPoint& end)
     // At least one of the locations must be valid.
     ASSERT(startIsValid || m_lastUpdatedEndPointIsValid);
 
-    IntPoint relativeStart = start;
-    IntPoint relativeEnd = end;
+    WebCore::IntPoint relativeStart = start;
+    WebCore::IntPoint relativeEnd = end;
 
     VisibleSelection newSelection(controller->selection());
 
     // We need the selection to be ordered base then extent.
     if (!controller->selection().isBaseFirst())
-        controller->setSelection(VisibleSelection(controller->selection().start(), controller->selection().end()));
+        controller->setSelection(VisibleSelection(controller->selection().start(), controller->selection().end(), true /* isDirectional */));
 
     if (startIsValid) {
         relativeStart = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), focusedFrame, start);
 
         // Set the selection with validation.
-        newSelection.setBase(visiblePositionForPointIgnoringClipping(*focusedFrame, clipPointToFocusNode(relativeStart)));
+        newSelection.setBase(visiblePositionForPointIgnoringClipping(*focusedFrame, clipPointToVisibleContainer(start)));
 
         // Reset the selection using the existing extent without validation.
         newSelection.setWithoutValidation(newSelection.base(), controller->selection().end());
@@ -475,12 +461,14 @@ void SelectionHandler::setSelection(const IntPoint& start, const IntPoint& end)
         relativeEnd = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), focusedFrame, end);
 
         // Set the selection with validation.
-        newSelection.setExtent(visiblePositionForPointIgnoringClipping(*focusedFrame, clipPointToFocusNode(relativeEnd)));
+        newSelection.setExtent(visiblePositionForPointIgnoringClipping(*focusedFrame, clipPointToVisibleContainer(end)));
 
         // Reset the selection using the existing base without validation.
         newSelection.setWithoutValidation(controller->selection().start(), newSelection.extent());
     }
 
+    newSelection.setIsDirectional(true);
+
     if (m_webPage->m_inputHandler->isInputMode()) {
         if (updateOrHandleInputSelection(newSelection, relativeStart, relativeEnd))
             return;
@@ -494,7 +482,7 @@ void SelectionHandler::setSelection(const IntPoint& start, const IntPoint& end)
     // If the selection size is reduce to less than a character, selection type becomes
     // Caret. As long as it is still a range, it's a valid selection. Selection cannot
     // be cancelled through this function.
-    BlackBerry::Platform::IntRectRegion region;
+    IntRectRegion region;
     getConsolidatedRegionOfTextQuadsForSelection(newSelection, region);
     clipRegionToVisibleContainer(region);
     if (!region.isEmpty()) {
@@ -504,12 +492,12 @@ void SelectionHandler::setSelection(const IntPoint& start, const IntPoint& end)
 
         controller->setSelection(newSelection);
 
-        DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::setSelection selection points valid, selection updated");
+        DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::setSelection selection points valid, selection updated");
     } else {
         // Requested selection results in an empty selection, skip this change.
         selectionPositionChanged();
 
-        DEBUG_SELECTION(BlackBerry::Platform::LogLevelWarn, "SelectionHandler::setSelection selection points invalid, selection not updated");
+        DEBUG_SELECTION(LogLevelWarn, "SelectionHandler::setSelection selection points invalid, selection not updated");
     }
 }
 
@@ -526,7 +514,7 @@ static Node* enclosingLinkEventParentForNode(Node* node)
     return linkNode && linkNode->isLink() ? linkNode : 0;
 }
 
-void SelectionHandler::selectAtPoint(const IntPoint& location)
+void SelectionHandler::selectAtPoint(const WebCore::IntPoint& location)
 {
     // If point is invalid trigger selection based expansion.
     if (location == DOMSupport::InvalidPoint) {
@@ -535,7 +523,7 @@ void SelectionHandler::selectAtPoint(const IntPoint& location)
     }
 
     Node* targetNode;
-    IntPoint targetPosition;
+    WebCore::IntPoint targetPosition;
     // FIXME: Factory this get right fat finger code into a helper.
     const FatFingersResult lastFatFingersResult = m_webPage->m_touchEventHandler->lastFatFingersResult();
     if (lastFatFingersResult.positionWasAdjusted() && lastFatFingersResult.nodeAsElementIfApplicable()) {
@@ -584,15 +572,15 @@ static bool expandSelectionToGranularity(Frame* frame, VisibleSelection selectio
     return frame->selection()->setSelectedRange(newRange.get(), affinity, true);
 }
 
-void SelectionHandler::selectObject(const IntPoint& location, TextGranularity granularity)
+void SelectionHandler::selectObject(const WebCore::IntPoint& location, TextGranularity granularity)
 {
     ASSERT(location.x() >= 0 && location.y() >= 0);
     ASSERT(m_webPage && m_webPage->focusedOrMainFrame() && m_webPage->focusedOrMainFrame()->selection());
     Frame* focusedFrame = m_webPage->focusedOrMainFrame();
 
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::selectObject adjusted points %d, %d", location.x(), location.y());
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::selectObject adjusted points %d, %d", location.x(), location.y());
 
-    IntPoint relativePoint = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), focusedFrame, location);
+    WebCore::IntPoint relativePoint = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), focusedFrame, location);
     VisiblePosition pointLocation(focusedFrame->visiblePositionForPoint(relativePoint));
     VisibleSelection selection = VisibleSelection(pointLocation, pointLocation);
 
@@ -609,7 +597,7 @@ void SelectionHandler::selectObject(TextGranularity granularity)
     ASSERT(m_webPage->focusedOrMainFrame() && m_webPage->focusedOrMainFrame()->selection());
     Frame* focusedFrame = m_webPage->focusedOrMainFrame();
 
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::selectObject using current selection");
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::selectObject using current selection");
 
     // Use the current selection as the selection point.
     ASSERT(focusedFrame->selection()->selectionType() != VisibleSelection::NoSelection);
@@ -626,7 +614,7 @@ void SelectionHandler::selectObject(Node* node)
     ASSERT(m_webPage && m_webPage->focusedOrMainFrame() && m_webPage->focusedOrMainFrame()->selection());
     Frame* focusedFrame = m_webPage->focusedOrMainFrame();
 
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::selectNode");
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::selectNode");
 
     VisibleSelection selection = VisibleSelection::selectionFromContentsOfNode(node);
     focusedFrame->selection()->setSelection(selection);
@@ -647,7 +635,7 @@ static TextDirection directionOfEnclosingBlock(FrameSelection* selection)
 // Returns > 0 if p1 is "closer" to referencePoint, < 0 if p2 is "closer", 0 if they are equidistant.
 // Because text is usually arranged in horizontal rows, distance is measured along the y-axis, with x-axis used only to break ties.
 // If rightGravity is true, the right-most x-coordinate is chosen, otherwise teh left-most coordinate is chosen.
-static inline int comparePointsToReferencePoint(const IntPoint& p1, const IntPoint& p2, const IntPoint& referencePoint, bool rightGravity)
+static inline int comparePointsToReferencePoint(const WebCore::IntPoint& p1, const WebCore::IntPoint& p2, const WebCore::IntPoint& referencePoint, bool rightGravity)
 {
     int dy1 = abs(referencePoint.y() - p1.y());
     int dy2 = abs(referencePoint.y() - p2.y());
@@ -667,10 +655,10 @@ static inline int comparePointsToReferencePoint(const IntPoint& p1, const IntPoi
 // NOTE/FIXME: Due to r77286, we are getting off-by-one results in the IntRect class counterpart implementation of the
 //             methods below. As done in r89803, r77928 and a few others, lets use local method to fix it.
 //             We should keep our eyes very open on it, since it can affect BackingStore very badly.
-static IntPoint minXMinYCorner(const IntRect& rect) { return rect.location(); } // typically topLeft
-static IntPoint maxXMinYCorner(const IntRect& rect) { return IntPoint(rect.x() + rect.width() - 1, rect.y()); } // typically topRight
-static IntPoint minXMaxYCorner(const IntRect& rect) { return IntPoint(rect.x(), rect.y() + rect.height() - 1); } // typically bottomLeft
-static IntPoint maxXMaxYCorner(const IntRect& rect) { return IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height() - 1); } // typically bottomRight
+static WebCore::IntPoint minXMinYCorner(const WebCore::IntRect& rect) { return rect.location(); } // typically topLeft
+static WebCore::IntPoint maxXMinYCorner(const WebCore::IntRect& rect) { return WebCore::IntPoint(rect.x() + rect.width() - 1, rect.y()); } // typically topRight
+static WebCore::IntPoint minXMaxYCorner(const WebCore::IntRect& rect) { return WebCore::IntPoint(rect.x(), rect.y() + rect.height() - 1); } // typically bottomLeft
+static WebCore::IntPoint maxXMaxYCorner(const WebCore::IntRect& rect) { return WebCore::IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height() - 1); } // typically bottomRight
 
 // The caret is a one-pixel wide line down either the right or left edge of a
 // rect, depending on the text direction.
@@ -682,12 +670,12 @@ static inline bool caretIsOnLeft(bool isStartCaret, bool isRTL)
     return isRTL;
 }
 
-static inline IntPoint caretLocationForRect(const IntRect& rect, bool isStartCaret, bool isRTL)
+static inline WebCore::IntPoint caretLocationForRect(const WebCore::IntRect& rect, bool isStartCaret, bool isRTL)
 {
     return caretIsOnLeft(isStartCaret, isRTL) ? minXMinYCorner(rect) : maxXMinYCorner(rect);
 }
 
-static inline IntPoint caretComparisonPointForRect(const IntRect& rect, bool isStartCaret, bool isRTL)
+static inline WebCore::IntPoint caretComparisonPointForRect(const WebCore::IntRect& rect, bool isStartCaret, bool isRTL)
 {
     if (isStartCaret)
         return caretIsOnLeft(isStartCaret, isRTL) ? minXMinYCorner(rect) : maxXMinYCorner(rect);
@@ -695,11 +683,11 @@ static inline IntPoint caretComparisonPointForRect(const IntRect& rect, bool isS
     return caretIsOnLeft(isStartCaret, isRTL) ? minXMaxYCorner(rect) : maxXMaxYCorner(rect);
 }
 
-static void adjustCaretRects(IntRect& startCaret, bool isStartCaretClippedOut,
-                             IntRect& endCaret, bool isEndCaretClippedOut,
-                             const std::vector<BlackBerry::Platform::IntRect> rectList,
-                             const IntPoint& startReferencePoint,
-                             const IntPoint& endReferencePoint,
+static void adjustCaretRects(WebCore::IntRect& startCaret, bool isStartCaretClippedOut,
+                             WebCore::IntRect& endCaret, bool isEndCaretClippedOut,
+                             const std::vector<Platform::IntRect> rectList,
+                             const WebCore::IntPoint& startReferencePoint,
+                             const WebCore::IntPoint& endReferencePoint,
                              bool isRTL)
 {
     // startReferencePoint is the best guess at the top left of the selection; endReferencePoint is the best guess at the bottom right.
@@ -725,7 +713,7 @@ static void adjustCaretRects(IntRect& startCaret, bool isStartCaretClippedOut,
     endCaret.setWidth(1);
 
     for (unsigned i = 1; i < rectList.size(); i++) {
-        IntRect currentRect(rectList[i]);
+        WebCore::IntRect currentRect(rectList[i]);
 
         // Compare and update the start and end carets with their respective reference points.
         if (!isStartCaretClippedOut && comparePointsToReferencePoint(
@@ -746,7 +734,7 @@ static void adjustCaretRects(IntRect& startCaret, bool isStartCaretClippedOut,
     }
 }
 
-void SelectionHandler::clipRegionToVisibleContainer(BlackBerry::Platform::IntRectRegion& region)
+void SelectionHandler::clipRegionToVisibleContainer(IntRectRegion& region)
 {
     ASSERT(m_webPage->m_mainFrame && m_webPage->m_mainFrame->view());
 
@@ -754,10 +742,10 @@ void SelectionHandler::clipRegionToVisibleContainer(BlackBerry::Platform::IntRec
 
     // Don't allow the region to extend outside of the all its ancestor frames' visible area.
     if (frame != m_webPage->mainFrame()) {
-        IntRect containingContentRect;
+        WebCore::IntRect containingContentRect;
         containingContentRect = m_webPage->getRecursiveVisibleWindowRect(frame->view(), true /* no clip to main frame window */);
         containingContentRect = m_webPage->m_mainFrame->view()->windowToContents(containingContentRect);
-        region = intersectRegions(BlackBerry::Platform::IntRectRegion(containingContentRect), region);
+        region = intersectRegions(IntRectRegion(containingContentRect), region);
     }
 
     // Don't allow the region to extend outside of the input field.
@@ -766,20 +754,38 @@ void SelectionHandler::clipRegionToVisibleContainer(BlackBerry::Platform::IntRec
         && frame->document()->focusedNode()->renderer()) {
 
         // Adjust the bounding box to the frame offset.
-        IntRect boundingBox(frame->document()->focusedNode()->renderer()->absoluteBoundingBoxRect());
+        WebCore::IntRect boundingBox(frame->document()->focusedNode()->renderer()->absoluteBoundingBoxRect());
         boundingBox = m_webPage->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(boundingBox));
 
-        region = intersectRegions(BlackBerry::Platform::IntRectRegion(boundingBox), region);
+        region = intersectRegions(IntRectRegion(boundingBox), region);
     }
 }
 
-static IntPoint referencePoint(const VisiblePosition& position, const IntRect& boundingRect, const IntPoint& framePosition, bool isStartCaret, bool isRTL)
+WebCore::IntPoint SelectionHandler::clipPointToVisibleContainer(const WebCore::IntPoint& point) const
+{
+    ASSERT(m_webPage->m_mainFrame && m_webPage->m_mainFrame->view());
+
+    Frame* frame = m_webPage->focusedOrMainFrame();
+    WebCore::IntPoint clippedPoint = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), frame, point, true /* clampToTargetFrame */);
+
+    if (m_webPage->m_inputHandler->isInputMode()
+            && frame->document()->focusedNode()
+            && frame->document()->focusedNode()->renderer()) {
+        WebCore::IntRect boundingBox(frame->document()->focusedNode()->renderer()->absoluteBoundingBoxRect());
+        boundingBox.inflate(-1);
+        clippedPoint = WebCore::IntPoint(clamp(boundingBox.x(), clippedPoint.x(), boundingBox.maxX()), clamp(boundingBox.y(), clippedPoint.y(), boundingBox.maxY()));
+    }
+
+    return clippedPoint;
+}
+
+static WebCore::IntPoint referencePoint(const VisiblePosition& position, const WebCore::IntRect& boundingRect, const WebCore::IntPoint& framePosition, bool isStartCaret, bool isRTL)
 {
     // If one of the carets is invalid (this happens, for instance, if the
     // selection ends in an empty div) fall back to using the corner of the
     // entire region (which is already in frame coordinates so doesn't need
     // adjusting).
-    IntRect startCaretBounds(position.absoluteCaretBounds());
+    WebCore::IntRect startCaretBounds(position.absoluteCaretBounds());
     if (startCaretBounds.isEmpty())
         startCaretBounds = boundingRect;
     else
@@ -792,7 +798,7 @@ static IntPoint referencePoint(const VisiblePosition& position, const IntRect& b
 // system is not entirely WebKit.
 void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
 {
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::selectionPositionChanged visibleChangeOnly = %s", visualChangeOnly ? "true" : "false");
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::selectionPositionChanged visibleChangeOnly = %s", visualChangeOnly ? "true" : "false");
 
     // This method can get called during WebPage shutdown process.
     // If that is the case, just bail out since the client is not
@@ -813,7 +819,7 @@ void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
     // Enter selection mode if selection type is RangeSelection, and disable selection if
     // selection is active and becomes caret selection.
     Frame* frame = m_webPage->focusedOrMainFrame();
-    IntPoint framePos = m_webPage->frameOffset(frame);
+    WebCore::IntPoint framePos = m_webPage->frameOffset(frame);
     if (m_selectionActive && (m_caretActive || frame->selection()->isNone()))
         m_selectionActive = false;
     else if (frame->selection()->isRange())
@@ -821,11 +827,11 @@ void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
     else if (!m_selectionActive)
         return;
 
-    IntRect startCaret;
-    IntRect endCaret;
+    WebCore::IntRect startCaret;
+    WebCore::IntRect endCaret;
 
     // Get the text rects from the selections range.
-    BlackBerry::Platform::IntRectRegion region;
+    IntRectRegion region;
     getConsolidatedRegionOfTextQuadsForSelection(frame->selection()->selection(), region);
 
     // If there is no change in selected text and the visual rects
@@ -836,15 +842,15 @@ void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
     m_lastSelectionRegion = region;
 
     if (!region.isEmpty()) {
-        IntRect unclippedStartCaret;
-        IntRect unclippedEndCaret;
+        WebCore::IntRect unclippedStartCaret;
+        WebCore::IntRect unclippedEndCaret;
 
         bool isRTL = directionOfEnclosingBlock(frame->selection()) == RTL;
 
-        std::vector<BlackBerry::Platform::IntRect> rectList = region.rects();
+        std::vector<Platform::IntRect> rectList = region.rects();
 
-        IntPoint startCaretReferencePoint = referencePoint(frame->selection()->selection().visibleStart(), region.extents(), framePos, true /* isStartCaret */, isRTL);
-        IntPoint endCaretReferencePoint = referencePoint(frame->selection()->selection().visibleEnd(), region.extents(), framePos, false /* isStartCaret */, isRTL);
+        WebCore::IntPoint startCaretReferencePoint = referencePoint(frame->selection()->selection().visibleStart(), region.extents(), framePos, true /* isStartCaret */, isRTL);
+        WebCore::IntPoint endCaretReferencePoint = referencePoint(frame->selection()->selection().visibleEnd(), region.extents(), framePos, false /* isStartCaret */, isRTL);
 
         adjustCaretRects(unclippedStartCaret, false /* unclipped */, unclippedEndCaret, false /* unclipped */, rectList, startCaretReferencePoint, endCaretReferencePoint, isRTL);
 
@@ -852,9 +858,9 @@ void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
 
 #if SHOWDEBUG_SELECTIONHANDLER // Don't rely just on DEBUG_SELECTION to avoid loop.
         for (unsigned int i = 0; i < rectList.size(); i++)
-            DEBUG_SELECTION(BlackBerry::Platform::LogLevelCritical, "Rect list - Unmodified #%d, (%d, %d) (%d x %d)", i, rectList[i].x(), rectList[i].y(), rectList[i].width(), rectList[i].height());
+            DEBUG_SELECTION(LogLevelCritical, "Rect list - Unmodified #%d, (%d, %d) (%d x %d)", i, rectList[i].x(), rectList[i].y(), rectList[i].width(), rectList[i].height());
         for (unsigned int i = 0; i < region.numRects(); i++)
-            DEBUG_SELECTION(BlackBerry::Platform::LogLevelCritical, "Rect list  - Consolidated #%d, (%d, %d) (%d x %d)", i, region.rects()[i].x(), region.rects()[i].y(), region.rects()[i].width(), region.rects()[i].height());
+            DEBUG_SELECTION(LogLevelCritical, "Rect list  - Consolidated #%d, (%d, %d) (%d x %d)", i, region.rects()[i].x(), region.rects()[i].y(), region.rects()[i].width(), region.rects()[i].height());
 #endif
 
         bool shouldCareAboutPossibleClippedOutSelection = frame != m_webPage->mainFrame() || m_webPage->m_inputHandler->isInputMode();
@@ -868,7 +874,7 @@ void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
             bool shouldClipEndCaret = !region.isRectInRegion(unclippedEndCaret);
 
             // Find the top corner and bottom corner.
-            std::vector<BlackBerry::Platform::IntRect> clippedRectList = region.rects();
+            std::vector<Platform::IntRect> clippedRectList = region.rects();
             adjustCaretRects(startCaret, shouldClipStartCaret, endCaret, shouldClipEndCaret, clippedRectList, startCaretReferencePoint, endCaretReferencePoint, isRTL);
 
             // Translate the caret values as they must be in transformed coordinates.
@@ -894,9 +900,9 @@ void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
 // NOTE: This function is not in WebKit coordinates.
 void SelectionHandler::caretPositionChanged()
 {
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::caretPositionChanged");
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::caretPositionChanged");
 
-    IntRect caretLocation;
+    WebCore::IntRect caretLocation;
     // If the input field is not active, we must be turning off the caret.
     if (!m_webPage->m_inputHandler->isInputMode() && m_caretActive) {
         m_caretActive = false;
@@ -911,20 +917,20 @@ void SelectionHandler::caretPositionChanged()
     ASSERT(m_webPage->m_inputHandler->isInputMode());
 
     if (m_webPage->focusedOrMainFrame()->selection()->selectionType() == VisibleSelection::CaretSelection) {
-        IntPoint frameOffset = m_webPage->frameOffset(m_webPage->focusedOrMainFrame());
+        WebCore::IntPoint frameOffset = m_webPage->frameOffset(m_webPage->focusedOrMainFrame());
 
         caretLocation = m_webPage->focusedOrMainFrame()->selection()->selection().visibleStart().absoluteCaretBounds();
         caretLocation.move(frameOffset.x(), frameOffset.y());
 
         // Clip against the containing frame and node boundaries.
-        BlackBerry::Platform::IntRectRegion region(caretLocation);
+        IntRectRegion region(caretLocation);
         clipRegionToVisibleContainer(region);
         caretLocation = region.extents();
     }
 
     m_caretActive = !caretLocation.isEmpty();
 
-    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::caretPositionChanged caret Rect %d, %d, %dx%d",
+    DEBUG_SELECTION(LogLevelInfo, "SelectionHandler::caretPositionChanged caret Rect %d, %d, %dx%d",
                         caretLocation.x(), caretLocation.y(), caretLocation.width(), caretLocation.height());
 
     caretLocation = m_webPage->mapToTransformed(caretLocation);
@@ -933,7 +939,7 @@ void SelectionHandler::caretPositionChanged()
     m_webPage->m_client->notifyCaretChanged(caretLocation, m_webPage->m_touchEventHandler->lastFatFingersResult().isTextInput() /* userTouchTriggered */);
 }
 
-bool SelectionHandler::selectionContains(const IntPoint& point)
+bool SelectionHandler::selectionContains(const WebCore::IntPoint& point)
 {
     ASSERT(m_webPage && m_webPage->focusedOrMainFrame() && m_webPage->focusedOrMainFrame()->selection());
     return m_webPage->focusedOrMainFrame()->selection()->contains(point);
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h
index 8c5fe7637..41a69f8f6 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h
@@ -76,7 +76,7 @@ private:
     WebCore::Node* DOMContainerNodeForVisiblePosition(const WebCore::VisiblePosition&) const;
     bool shouldUpdateSelectionOrCaretForPoint(const WebCore::IntPoint&, const WebCore::IntRect&, bool startCaret = true) const;
     unsigned short extendSelectionToFieldBoundary(bool isStartHandle, const WebCore::IntPoint& selectionPoint, WebCore::VisibleSelection& newSelection);
-    WebCore::IntPoint clipPointToFocusNode(const WebCore::IntPoint&);
+    WebCore::IntPoint clipPointToVisibleContainer(const WebCore::IntPoint&) const;
 
     WebPagePrivate* m_webPage;
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
index 2642f39e3..5f0a2770a 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
@@ -38,7 +38,7 @@ namespace WebKit {
 #if USE(ACCELERATED_COMPOSITING) && ENABLE_COMPOSITING_SURFACE
 static PassRefPtr<BackingStoreCompositingSurface> createCompositingSurface()
 {
-    BlackBerry::Platform::IntSize screenSize = BlackBerry::Platform::Graphics::Screen::size();
+    BlackBerry::Platform::IntSize screenSize = BlackBerry::Platform::Graphics::Screen::primaryScreen()->size();
     return BackingStoreCompositingSurface::create(screenSize, false /*doubleBuffered*/);
 }
 #endif
diff --git a/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.cpp b/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.cpp
index fcbc1acff..91a4eb21d 100644
--- a/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.cpp
@@ -21,9 +21,13 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "WebPageCompositor.h"
 
+#include "BackingStore_p.h"
 #include "LayerWebKitThread.h"
 #include "WebPage_p.h"
 
+#include <BlackBerryPlatformExecutableMessage.h>
+#include <BlackBerryPlatformMessage.h>
+#include <BlackBerryPlatformMessageClient.h>
 #include <GenericTimerClient.h>
 #include <ThreadTimerClient.h>
 
@@ -38,15 +42,15 @@ WebPageCompositor::WebPageCompositor(WebPagePrivate* page)
     , m_generation(0)
     , m_compositedGeneration(-1)
     , m_compositingOntoMainWindow(false)
-    , m_blitTimer(this, &BlackBerry::WebKit::WebPageCompositor::blitTimerFired)
-    , m_timerClient(new BlackBerry::Platform::GenericTimerClient(BlackBerry::Platform::userInterfaceThreadTimerClient()))
+    , m_animationTimer(this, &WebPageCompositor::animationTimerFired)
+    , m_timerClient(new Platform::GenericTimerClient(Platform::userInterfaceThreadTimerClient()))
 {
-    m_blitTimer.setClient(m_timerClient);
+    m_animationTimer.setClient(m_timerClient);
 }
 
 WebPageCompositor::~WebPageCompositor()
 {
-    m_blitTimer.stop();
+    m_animationTimer.stop();
     delete m_timerClient;
 }
 
@@ -93,7 +97,7 @@ bool WebPageCompositor::drawLayers(const IntRect& dstRect, const FloatRect& cont
     if (m_lastCompositingResults.needsAnimationFrame) {
         ++m_generation; // The animation update moves us along one generation.
         // Using a timeout of 0 actually won't start a timer, it will send a message.
-        m_blitTimer.start(1.0 / 60.0);
+        m_animationTimer.start(1.0 / 60.0);
         m_webPage->updateDelegatedOverlays();
     }
 
@@ -105,8 +109,18 @@ void WebPageCompositor::releaseLayerResources()
     m_layerRenderer->releaseLayerResources();
 }
 
-void WebPageCompositor::blitTimerFired()
+void WebPageCompositor::animationTimerFired()
 {
+    if (m_webPage->m_backingStore->d->shouldDirectRenderingToWindow()) {
+        if (m_webPage->m_backingStore->d->isDirectRenderingAnimationMessageScheduled())
+            return; // don't send new messages as long as we haven't rerendered
+
+        m_webPage->m_backingStore->d->setDirectRenderingAnimationMessageScheduled();
+        BlackBerry::Platform::webKitThreadMessageClient()->dispatchMessage(
+            BlackBerry::Platform::createMethodCallMessage(
+                &BackingStorePrivate::renderVisibleContents, m_webPage->m_backingStore->d));
+        return;
+    }
     m_webPage->blitVisibleContents();
 }
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.h b/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.h
index 437ab95e0..aa0a9a8c0 100644
--- a/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.h
+++ b/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.h
@@ -65,7 +65,7 @@ public:
     void releaseLayerResources();
 
 private:
-    void blitTimerFired();
+    void animationTimerFired();
 
     WebPagePrivate* m_webPage;
     OwnPtr<WebCore::LayerRenderer> m_layerRenderer;
@@ -78,7 +78,7 @@ private:
     WebCore::IntRect m_compositedDstRect;
     WebCore::FloatRect m_compositedContentsRect;
     bool m_compositingOntoMainWindow;
-    BlackBerry::Platform::Timer<WebPageCompositor> m_blitTimer;
+    BlackBerry::Platform::Timer<WebPageCompositor> m_animationTimer;
     BlackBerry::Platform::TimerClient* m_timerClient;
 };
 
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index 797b31c6c..8fe572481 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,1792 @@
+2012-03-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110359.
+        http://trac.webkit.org/changeset/110359
+        https://bugs.webkit.org/show_bug.cgi?id=80799
+
+        SelectPopupMenuTest.ClickItem failure (Requested by ukai on
+        #webkit).
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::gestureEvent):
+        (WebKit::WebViewImpl::applyAutofillSuggestions):
+
+2012-03-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: [chromium] add provisional test for the downstream sanity test.
+        https://bugs.webkit.org/show_bug.cgi?id=80784
+
+        Reviewed by Yury Semikhatsky.
+
+        * src/js/Tests.js:
+        (.TestSuite.prototype.checkLogAndErrorMessages.validMessage):
+        (.TestSuite.prototype.checkLogAndErrorMessages.onConsoleMessage):
+        (.TestSuite.prototype.checkLogAndErrorMessages):
+
+2012-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110384.
+        http://trac.webkit.org/changeset/110384
+        https://bugs.webkit.org/show_bug.cgi?id=80774
+
+        compile failed on Chromium Win Release (Requested by ukai_home
+        on #webkit).
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebCore::LayerChromiumWithForcedDrawsContent::LayerChromiumWithForcedDrawsContent):
+        (WebCore::LayerChromiumWithForcedDrawsContent::opaqueContentsRegion):
+        (WebCore::LayerChromiumWithForcedDrawsContent::setOpaquePaintRect):
+        (LayerChromiumWithForcedDrawsContent):
+        (WebCore::setLayerPropertiesForTesting):
+        (WebCore):
+        (WebCore::TestCCOcclusionTracker::TestCCOcclusionTracker):
+        (WebCore::TestCCOcclusionTracker::occlusionInScreenSpace):
+        (WebCore::TestCCOcclusionTracker::occlusionInTargetSurface):
+        (WebCore::TestCCOcclusionTracker::setOcclusionInScreenSpace):
+        (WebCore::TestCCOcclusionTracker::setOcclusionInTargetSurface):
+        (WebCore::TestCCOcclusionTracker::layerScissorRectInTargetSurface):
+        (WebCore::TestDamageClient::damageRect):
+        (WebCore::layerAddedToOccludedRegion):
+        (WebCore::layerAddedToOccludedRegionWithRotation):
+        (WebCore::layerAddedToOccludedRegionWithTranslation):
+        (WebCore::layerAddedToOccludedRegionWithRotatedSurface):
+        (WebCore::layerAddedToOccludedRegionWithSurfaceAlreadyOnStack):
+        (WebCore::layerAddedToOccludedRegionWithRotatedOffAxisSurface):
+        (WebCore::layerAddedToOccludedRegionWithMultipleOpaqueLayers):
+        (WebCore::surfaceOcclusionWithOverlappingSiblingSurfaces):
+        (WebCore::surfaceOcclusionInScreenSpace):
+        (WebCore::surfaceOcclusionInScreenSpaceDifferentTransforms):
+        (WebCore::occlusionInteractionWithFilters):
+        (WebCore::layerScissorRectOverTile):
+        (WebCore::screenScissorRectOverTile):
+        (WebCore::layerScissorRectOverCulledTile):
+        (WebCore::screenScissorRectOverCulledTile):
+        (WebCore::layerScissorRectOverPartialTiles):
+        (WebCore::screenScissorRectOverPartialTiles):
+        (WebCore::layerScissorRectOverNoTiles):
+        (WebCore::screenScissorRectOverNoTiles):
+        (WebCore::layerScissorRectForLayerOffOrigin):
+        (WebCore::damageRectOverTile):
+        (WebCore::damageRectOverCulledTile):
+        (WebCore::damageRectOverPartialTiles):
+        (WebCore::damageRectOverNoTiles):
+        (WebCore::TEST):
+
+2012-03-10  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Clean up culling tests and templatize to test impl constructs
+        https://bugs.webkit.org/show_bug.cgi?id=80613
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebCore::TestContentLayerChromium::TestContentLayerChromium):
+        (WebCore::TestContentLayerChromium::opaqueContentsRegion):
+        (WebCore::TestContentLayerChromium::setOpaqueContentsRect):
+        (TestContentLayerChromium):
+        (TestContentLayerImpl):
+        (WebCore::TestContentLayerImpl::TestContentLayerImpl):
+        (WebCore::TestContentLayerImpl::opaqueContentsRegion):
+        (WebCore::TestContentLayerImpl::setOpaqueContentsRect):
+        (WebCore):
+        (WebCore::TestCCOcclusionTrackerBase::TestCCOcclusionTrackerBase):
+        (WebCore::TestCCOcclusionTrackerBase::occlusionInScreenSpace):
+        (WebCore::TestCCOcclusionTrackerBase::occlusionInTargetSurface):
+        (WebCore::TestCCOcclusionTrackerBase::setOcclusionInScreenSpace):
+        (WebCore::TestCCOcclusionTrackerBase::setOcclusionInTargetSurface):
+        (WebCore::TestCCOcclusionTrackerBase::layerScissorRectInTargetSurface):
+        (WebCore::TestDamageClient::damageRect):
+        (CCOcclusionTrackerTestMainThreadTypes):
+        (WebCore::CCOcclusionTrackerTestMainThreadTypes::createLayer):
+        (WebCore::CCOcclusionTrackerTestMainThreadTypes::createContentLayer):
+        (CCOcclusionTrackerTestImplThreadTypes):
+        (WebCore::CCOcclusionTrackerTestImplThreadTypes::createLayer):
+        (WebCore::CCOcclusionTrackerTestImplThreadTypes::createContentLayer):
+        (CCOcclusionTrackerTest):
+        (WebCore::CCOcclusionTrackerTest::TearDown):
+        (WebCore::CCOcclusionTrackerTest::createRoot):
+        (WebCore::CCOcclusionTrackerTest::createLayer):
+        (WebCore::CCOcclusionTrackerTest::createSurface):
+        (WebCore::CCOcclusionTrackerTest::createDrawingLayer):
+        (WebCore::CCOcclusionTrackerTest::createDrawingSurface):
+        (WebCore::CCOcclusionTrackerTest::calcDrawEtc):
+        (WebCore::CCOcclusionTrackerTest::setBaseProperties):
+        (WebCore::CCOcclusionTrackerTest::setProperties):
+        (CCOcclusionTrackerTestIdentityTransforms):
+        (WebCore::CCOcclusionTrackerTestIdentityTransforms::runMyTest):
+        (CCOcclusionTrackerTestRotatedChild):
+        (WebCore::CCOcclusionTrackerTestRotatedChild::runMyTest):
+        (CCOcclusionTrackerTestTranslatedChild):
+        (WebCore::CCOcclusionTrackerTestTranslatedChild::runMyTest):
+        (CCOcclusionTrackerTestChildInRotatedChild):
+        (WebCore::CCOcclusionTrackerTestChildInRotatedChild::runMyTest):
+        (CCOcclusionTrackerTestVisitTargetTwoTimes):
+        (WebCore::CCOcclusionTrackerTestVisitTargetTwoTimes::runMyTest):
+        (CCOcclusionTrackerTestSurfaceRotatedOffAxis):
+        (WebCore::CCOcclusionTrackerTestSurfaceRotatedOffAxis::runMyTest):
+        (CCOcclusionTrackerTestSurfaceWithTwoOpaqueChildren):
+        (WebCore::CCOcclusionTrackerTestSurfaceWithTwoOpaqueChildren::runMyTest):
+        (CCOcclusionTrackerTestOverlappingSurfaceSiblings):
+        (WebCore::CCOcclusionTrackerTestOverlappingSurfaceSiblings::runMyTest):
+        (CCOcclusionTrackerTestOverlappingSurfaceSiblingsWithTwoTransforms):
+        (WebCore::CCOcclusionTrackerTestOverlappingSurfaceSiblingsWithTwoTransforms::runMyTest):
+        (CCOcclusionTrackerTestFilters):
+        (WebCore::CCOcclusionTrackerTestFilters::runMyTest):
+        (CCOcclusionTrackerTestLayerScissorRectOutsideChild):
+        (WebCore::CCOcclusionTrackerTestLayerScissorRectOutsideChild::runMyTest):
+        (CCOcclusionTrackerTestScreenScissorRectOutsideChild):
+        (WebCore::CCOcclusionTrackerTestScreenScissorRectOutsideChild::runMyTest):
+        (CCOcclusionTrackerTestDamageRectOutsideChild):
+        (WebCore::CCOcclusionTrackerTestDamageRectOutsideChild::runMyTest):
+        (CCOcclusionTrackerTestLayerScissorRectOverChild):
+        (WebCore::CCOcclusionTrackerTestLayerScissorRectOverChild::runMyTest):
+        (CCOcclusionTrackerTestScreenScissorRectOverChild):
+        (WebCore::CCOcclusionTrackerTestScreenScissorRectOverChild::runMyTest):
+        (CCOcclusionTrackerTestDamageRectOverChild):
+        (WebCore::CCOcclusionTrackerTestDamageRectOverChild::runMyTest):
+        (CCOcclusionTrackerTestLayerScissorRectPartlyOverChild):
+        (WebCore::CCOcclusionTrackerTestLayerScissorRectPartlyOverChild::runMyTest):
+        (CCOcclusionTrackerTestScreenScissorRectPartlyOverChild):
+        (WebCore::CCOcclusionTrackerTestScreenScissorRectPartlyOverChild::runMyTest):
+        (CCOcclusionTrackerTestDamageRectPartlyOverChild):
+        (WebCore::CCOcclusionTrackerTestDamageRectPartlyOverChild::runMyTest):
+        (CCOcclusionTrackerTestLayerScissorRectOverNothing):
+        (WebCore::CCOcclusionTrackerTestLayerScissorRectOverNothing::runMyTest):
+        (CCOcclusionTrackerTestScreenScissorRectOverNothing):
+        (WebCore::CCOcclusionTrackerTestScreenScissorRectOverNothing::runMyTest):
+        (CCOcclusionTrackerTestDamageRectOverNothing):
+        (WebCore::CCOcclusionTrackerTestDamageRectOverNothing::runMyTest):
+        (CCOcclusionTrackerTestLayerScissorRectForLayerOffOrigin):
+        (WebCore::CCOcclusionTrackerTestLayerScissorRectForLayerOffOrigin::runMyTest):
+        (CCOcclusionTrackerTestOpaqueContentsRegionEmpty):
+        (WebCore::CCOcclusionTrackerTestOpaqueContentsRegionEmpty::runMyTest):
+        (CCOcclusionTrackerTestOpaqueContentsRegionNonEmpty):
+        (WebCore::CCOcclusionTrackerTestOpaqueContentsRegionNonEmpty::runMyTest):
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Rename NotificationPresenter to NotificationClient
+        https://bugs.webkit.org/show_bug.cgi?id=80488
+        <rdar://problem/10965558>
+
+        Reviewed by Kentaro Hara.
+
+        Refactor to use renamed WebCore::NotificationClient.
+        * src/AssertMatchingEnums.cpp:
+        * src/NotificationPresenterImpl.cpp:
+        (WebKit::NotificationPresenterImpl::checkPermission):
+        * src/NotificationPresenterImpl.h:
+        (NotificationPresenterImpl):
+
+2012-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110363.
+        http://trac.webkit.org/changeset/110363
+        https://bugs.webkit.org/show_bug.cgi?id=80757
+
+        link error in chromium: unresolved external symbol
+        webkit_support::CreateScopedTempDirectory(void) (Requested by
+        ukai_home on #webkit).
+
+        * WebKit.gypi:
+        * tests/LevelDBTest.cpp: Removed.
+
+2012-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110353.
+        http://trac.webkit.org/changeset/110353
+        https://bugs.webkit.org/show_bug.cgi?id=80752
+
+        copmile failed on Chromium (Requested by ukai_home on
+        #webkit).
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebCore::LayerChromiumWithForcedDrawsContent::LayerChromiumWithForcedDrawsContent):
+        (WebCore::LayerChromiumWithForcedDrawsContent::opaqueContentsRegion):
+        (WebCore::LayerChromiumWithForcedDrawsContent::setOpaquePaintRect):
+        (LayerChromiumWithForcedDrawsContent):
+        (WebCore::setLayerPropertiesForTesting):
+        (WebCore):
+        (WebCore::TestCCOcclusionTracker::TestCCOcclusionTracker):
+        (WebCore::TestCCOcclusionTracker::occlusionInScreenSpace):
+        (WebCore::TestCCOcclusionTracker::occlusionInTargetSurface):
+        (WebCore::TestCCOcclusionTracker::setOcclusionInScreenSpace):
+        (WebCore::TestCCOcclusionTracker::setOcclusionInTargetSurface):
+        (WebCore::TestCCOcclusionTracker::layerScissorRectInTargetSurface):
+        (WebCore::TestDamageClient::damageRect):
+        (WebCore::layerAddedToOccludedRegion):
+        (WebCore::layerAddedToOccludedRegionWithRotation):
+        (WebCore::layerAddedToOccludedRegionWithTranslation):
+        (WebCore::layerAddedToOccludedRegionWithRotatedSurface):
+        (WebCore::layerAddedToOccludedRegionWithSurfaceAlreadyOnStack):
+        (WebCore::layerAddedToOccludedRegionWithRotatedOffAxisSurface):
+        (WebCore::layerAddedToOccludedRegionWithMultipleOpaqueLayers):
+        (WebCore::surfaceOcclusionWithOverlappingSiblingSurfaces):
+        (WebCore::surfaceOcclusionInScreenSpace):
+        (WebCore::surfaceOcclusionInScreenSpaceDifferentTransforms):
+        (WebCore::occlusionInteractionWithFilters):
+        (WebCore::layerScissorRectOverTile):
+        (WebCore::screenScissorRectOverTile):
+        (WebCore::layerScissorRectOverCulledTile):
+        (WebCore::screenScissorRectOverCulledTile):
+        (WebCore::layerScissorRectOverPartialTiles):
+        (WebCore::screenScissorRectOverPartialTiles):
+        (WebCore::layerScissorRectOverNoTiles):
+        (WebCore::screenScissorRectOverNoTiles):
+        (WebCore::layerScissorRectForLayerOffOrigin):
+        (WebCore::damageRectOverTile):
+        (WebCore::damageRectOverCulledTile):
+        (WebCore::damageRectOverPartialTiles):
+        (WebCore::damageRectOverNoTiles):
+        (WebCore::TEST):
+
+2012-03-09  Robert Kroeger  <rjkroege@chromium.org>
+
+        Handle more Gesture* events by performing scrolls on the correct target ScrollableArea 
+        https://bugs.webkit.org/show_bug.cgi?id=80311
+
+        Added a unit test for the changes to ScrollAnimatorNone to make sure that the two-call
+        transport of fling parameters is correctly delivered.
+
+        Reviewed by James Robinson.
+
+        * tests/ScrollAnimatorNoneTest.cpp:
+        (MockScrollAnimatorNone):
+        (MockScrollAnimatorNone::reset):
+        (MockScrollAnimatorNone::fireUpAnAnimation):
+        (TEST):
+
+2012-03-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Deprecate renderDirectlyToWebView parameter of WebViewClient::createGraphicsContext3D()
+        https://bugs.webkit.org/show_bug.cgi?id=80523
+
+        Reviewed by Darin Fisher.
+
+        * public/WebViewClient.h:
+        (WebViewClient):
+        (WebKit::WebViewClient::createGraphicsContext3D):
+        * public/platform/WebKitPlatformSupport.h:
+        (WebKit):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::createCompositorGraphicsContext3D):
+
+2012-03-09  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Handle LevelDB database corruption
+        https://bugs.webkit.org/show_bug.cgi?id=79413
+
+        Reviewed by Tony Chang.
+
+        * WebKit.gypi:
+        * tests/LevelDBTest.cpp: Added.
+        (WebCore):
+        (SimpleComparator):
+        (WebCore::SimpleComparator::compare):
+        (WebCore::SimpleComparator::name):
+        (WebCore::encodeString):
+        (WebCore::TEST):
+
+2012-03-09  Tim Dresser  <tdresser@chromium.org>
+
+        [chromium] Increase size of Combo Box Options for touch and high DPI devices
+        https://bugs.webkit.org/show_bug.cgi?id=80027
+
+        Reviewed by Darin Fisher.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::gestureEvent):
+        (WebKit::WebViewImpl::applyAutofillSuggestions):
+
+2012-03-09  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Roll chromium DEPS to r125600
+        https://bugs.webkit.org/show_bug.cgi?id=80722
+
+        Unreviewed
+
+        * DEPS:
+
+2012-03-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Clean up culling tests and templatize to test impl constructs
+        https://bugs.webkit.org/show_bug.cgi?id=80613
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebCore::TestContentLayerChromium::TestContentLayerChromium):
+        (WebCore::TestContentLayerChromium::opaqueContentsRegion):
+        (WebCore::TestContentLayerChromium::setOpaqueContentsRect):
+        (TestContentLayerChromium):
+        (TestContentLayerImpl):
+        (WebCore::TestContentLayerImpl::TestContentLayerImpl):
+        (WebCore::TestContentLayerImpl::opaqueContentsRegion):
+        (WebCore::TestContentLayerImpl::setOpaqueContentsRect):
+        (WebCore):
+        (WebCore::TestCCOcclusionTrackerBase::TestCCOcclusionTrackerBase):
+        (WebCore::TestCCOcclusionTrackerBase::occlusionInScreenSpace):
+        (WebCore::TestCCOcclusionTrackerBase::occlusionInTargetSurface):
+        (WebCore::TestCCOcclusionTrackerBase::setOcclusionInScreenSpace):
+        (WebCore::TestCCOcclusionTrackerBase::setOcclusionInTargetSurface):
+        (WebCore::TestCCOcclusionTrackerBase::layerScissorRectInTargetSurface):
+        (WebCore::TestDamageClient::damageRect):
+        (CCOcclusionTrackerTestMainThreadTypes):
+        (WebCore::CCOcclusionTrackerTestMainThreadTypes::createLayer):
+        (WebCore::CCOcclusionTrackerTestMainThreadTypes::createContentLayer):
+        (CCOcclusionTrackerTestImplThreadTypes):
+        (WebCore::CCOcclusionTrackerTestImplThreadTypes::createLayer):
+        (WebCore::CCOcclusionTrackerTestImplThreadTypes::createContentLayer):
+        (CCOcclusionTrackerTest):
+        (WebCore::CCOcclusionTrackerTest::TearDown):
+        (WebCore::CCOcclusionTrackerTest::createRoot):
+        (WebCore::CCOcclusionTrackerTest::createLayer):
+        (WebCore::CCOcclusionTrackerTest::createSurface):
+        (WebCore::CCOcclusionTrackerTest::createDrawingLayer):
+        (WebCore::CCOcclusionTrackerTest::createDrawingSurface):
+        (WebCore::CCOcclusionTrackerTest::calcDrawEtc):
+        (WebCore::CCOcclusionTrackerTest::setBaseProperties):
+        (WebCore::CCOcclusionTrackerTest::setProperties):
+        (CCOcclusionTrackerTestIdentityTransforms):
+        (WebCore::CCOcclusionTrackerTestIdentityTransforms::runMyTest):
+        (CCOcclusionTrackerTestRotatedChild):
+        (WebCore::CCOcclusionTrackerTestRotatedChild::runMyTest):
+        (CCOcclusionTrackerTestTranslatedChild):
+        (WebCore::CCOcclusionTrackerTestTranslatedChild::runMyTest):
+        (CCOcclusionTrackerTestChildInRotatedChild):
+        (WebCore::CCOcclusionTrackerTestChildInRotatedChild::runMyTest):
+        (CCOcclusionTrackerTestVisitTargetTwoTimes):
+        (WebCore::CCOcclusionTrackerTestVisitTargetTwoTimes::runMyTest):
+        (CCOcclusionTrackerTestSurfaceRotatedOffAxis):
+        (WebCore::CCOcclusionTrackerTestSurfaceRotatedOffAxis::runMyTest):
+        (CCOcclusionTrackerTestSurfaceWithTwoOpaqueChildren):
+        (WebCore::CCOcclusionTrackerTestSurfaceWithTwoOpaqueChildren::runMyTest):
+        (CCOcclusionTrackerTestOverlappingSurfaceSiblings):
+        (WebCore::CCOcclusionTrackerTestOverlappingSurfaceSiblings::runMyTest):
+        (CCOcclusionTrackerTestOverlappingSurfaceSiblingsWithTwoTransforms):
+        (WebCore::CCOcclusionTrackerTestOverlappingSurfaceSiblingsWithTwoTransforms::runMyTest):
+        (CCOcclusionTrackerTestFilters):
+        (WebCore::CCOcclusionTrackerTestFilters::runMyTest):
+        (CCOcclusionTrackerTestLayerScissorRectOutsideChild):
+        (WebCore::CCOcclusionTrackerTestLayerScissorRectOutsideChild::runMyTest):
+        (CCOcclusionTrackerTestScreenScissorRectOutsideChild):
+        (WebCore::CCOcclusionTrackerTestScreenScissorRectOutsideChild::runMyTest):
+        (CCOcclusionTrackerTestDamageRectOutsideChild):
+        (WebCore::CCOcclusionTrackerTestDamageRectOutsideChild::runMyTest):
+        (CCOcclusionTrackerTestLayerScissorRectOverChild):
+        (WebCore::CCOcclusionTrackerTestLayerScissorRectOverChild::runMyTest):
+        (CCOcclusionTrackerTestScreenScissorRectOverChild):
+        (WebCore::CCOcclusionTrackerTestScreenScissorRectOverChild::runMyTest):
+        (CCOcclusionTrackerTestDamageRectOverChild):
+        (WebCore::CCOcclusionTrackerTestDamageRectOverChild::runMyTest):
+        (CCOcclusionTrackerTestLayerScissorRectPartlyOverChild):
+        (WebCore::CCOcclusionTrackerTestLayerScissorRectPartlyOverChild::runMyTest):
+        (CCOcclusionTrackerTestScreenScissorRectPartlyOverChild):
+        (WebCore::CCOcclusionTrackerTestScreenScissorRectPartlyOverChild::runMyTest):
+        (CCOcclusionTrackerTestDamageRectPartlyOverChild):
+        (WebCore::CCOcclusionTrackerTestDamageRectPartlyOverChild::runMyTest):
+        (CCOcclusionTrackerTestLayerScissorRectOverNothing):
+        (WebCore::CCOcclusionTrackerTestLayerScissorRectOverNothing::runMyTest):
+        (CCOcclusionTrackerTestScreenScissorRectOverNothing):
+        (WebCore::CCOcclusionTrackerTestScreenScissorRectOverNothing::runMyTest):
+        (CCOcclusionTrackerTestDamageRectOverNothing):
+        (WebCore::CCOcclusionTrackerTestDamageRectOverNothing::runMyTest):
+        (CCOcclusionTrackerTestLayerScissorRectForLayerOffOrigin):
+        (WebCore::CCOcclusionTrackerTestLayerScissorRectForLayerOffOrigin::runMyTest):
+        (CCOcclusionTrackerTestOpaqueContentsRegionEmpty):
+        (WebCore::CCOcclusionTrackerTestOpaqueContentsRegionEmpty::runMyTest):
+        (CCOcclusionTrackerTestOpaqueContentsRegionNonEmpty):
+        (WebCore::CCOcclusionTrackerTestOpaqueContentsRegionNonEmpty::runMyTest):
+
+2012-03-09  Emil A Eklund  <eae@chromium.org>
+
+        Add roundedPoint to HitTestResult and change platform code to use it
+        https://bugs.webkit.org/show_bug.cgi?id=80715
+
+        Reviewed by James Robinson.
+
+        Change ports to use roundedPoint to avoid exposing subpixel types to
+        platform code.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::mouseDidMoveOverElement):
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+
+2012-03-09  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Implement scroll physics architecture for impl/main thread
+        https://bugs.webkit.org/show_bug.cgi?id=79827
+
+        Reviewed by James Robinson.
+
+        * WebKit.gypi:
+        * tests/PlatformGestureCurveTest.cpp: Added.
+
+2012-03-09  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] ScrollbarLayerChromium/CCScrollbarLayerImpl for CC-side scrollbar painting
+        https://bugs.webkit.org/show_bug.cgi?id=78872
+
+        Reviewed by James Robinson.
+
+        * WebKit.gypi:
+        * tests/ScrollbarLayerChromiumTest.cpp: Added.
+        (WebCore):
+        (MockScrollbar):
+        (WebCore::MockScrollbar::x):
+        (WebCore::MockScrollbar::y):
+        (WebCore::MockScrollbar::width):
+        (WebCore::MockScrollbar::height):
+        (WebCore::MockScrollbar::size):
+        (WebCore::MockScrollbar::location):
+        (WebCore::MockScrollbar::parent):
+        (WebCore::MockScrollbar::root):
+        (WebCore::MockScrollbar::setFrameRect):
+        (WebCore::MockScrollbar::frameRect):
+        (WebCore::MockScrollbar::invalidate):
+        (WebCore::MockScrollbar::invalidateRect):
+        (WebCore::MockScrollbar::scrollbarOverlayStyle):
+        (WebCore::MockScrollbar::getTickmarks):
+        (WebCore::MockScrollbar::isScrollableAreaActive):
+        (WebCore::MockScrollbar::isScrollViewScrollbar):
+        (WebCore::MockScrollbar::convertFromContainingWindow):
+        (WebCore::MockScrollbar::isCustomScrollbar):
+        (WebCore::MockScrollbar::orientation):
+        (WebCore::MockScrollbar::value):
+        (WebCore::MockScrollbar::currentPos):
+        (WebCore::MockScrollbar::visibleSize):
+        (WebCore::MockScrollbar::totalSize):
+        (WebCore::MockScrollbar::maximum):
+        (WebCore::MockScrollbar::controlSize):
+        (WebCore::MockScrollbar::lineStep):
+        (WebCore::MockScrollbar::pageStep):
+        (WebCore::MockScrollbar::pressedPart):
+        (WebCore::MockScrollbar::hoveredPart):
+        (WebCore::MockScrollbar::styleChanged):
+        (WebCore::MockScrollbar::enabled):
+        (WebCore::MockScrollbar::setEnabled):
+        (WebCore::MockScrollbar::MockScrollbar):
+        (WebCore::MockScrollbar::~MockScrollbar):
+        (WebCore::TEST):
+
+2012-03-08  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Expose the shared graphics context on WebView so callers can allocate resources on the main thread for the compositor to use
+        https://bugs.webkit.org/show_bug.cgi?id=80670
+
+        Reviewed by Stephen White.
+
+        This exposes a context on WebView that is in the compositor's share group and can be used directly from the main
+        thread. This is useful for content that needs to allocate resources for the compositor to use, but cannot
+        directly use the compositor's context either because it cannot access the correct thread or because it needs to
+        initialize in situations where we cannot initialize a compositor (view) context - for instance before the native
+        window is created.
+
+        * public/WebView.h:
+        (WebView):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::sharedGraphicsContext3D):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-03-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Use opaque paints in CCOcclusionTracker
+        https://bugs.webkit.org/show_bug.cgi?id=80173
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebCore::LayerChromiumWithForcedDrawsContent::opaqueContentsRegion):
+        (LayerChromiumWithForcedDrawsContent):
+        (WebCore::LayerChromiumWithForcedDrawsContent::setOpaquePaintRect):
+        (WebCore::setLayerPropertiesForTesting):
+        (WebCore):
+        (WebCore::layerAddedToOccludedRegion):
+        (WebCore::layerAddedToOccludedRegionWithRotation):
+        (WebCore::layerAddedToOccludedRegionWithTranslation):
+        (WebCore::layerAddedToOccludedRegionWithRotatedSurface):
+        (WebCore::layerAddedToOccludedRegionWithSurfaceAlreadyOnStack):
+        (WebCore::layerAddedToOccludedRegionWithRotatedOffAxisSurface):
+        (WebCore::layerAddedToOccludedRegionWithMultipleOpaqueLayers):
+        (WebCore::surfaceOcclusionWithOverlappingSiblingSurfaces):
+        (WebCore::surfaceOcclusionInScreenSpace):
+        (WebCore::surfaceOcclusionInScreenSpaceDifferentTransforms):
+        (WebCore::occlusionInteractionWithFilters):
+        (WebCore::layerScissorRectOverTile):
+        (WebCore::screenScissorRectOverTile):
+        (WebCore::layerScissorRectOverCulledTile):
+        (WebCore::screenScissorRectOverCulledTile):
+        (WebCore::layerScissorRectOverPartialTiles):
+        (WebCore::screenScissorRectOverPartialTiles):
+        (WebCore::layerScissorRectOverNoTiles):
+        (WebCore::screenScissorRectOverNoTiles):
+        (WebCore::layerScissorRectForLayerOffOrigin):
+        (WebCore::damageRectOverTile):
+        (WebCore::damageRectOverCulledTile):
+        (WebCore::damageRectOverPartialTiles):
+        (WebCore::damageRectOverNoTiles):
+        (WebCore::TEST):
+        * tests/TiledLayerChromiumTest.cpp:
+        (WTF::TEST):
+        (WTF):
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Add support for ENABLE(LEGACY_NOTIFICATIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=80497
+
+        Reviewed by Adam Barth.
+
+        Prep for b80472: Update API for Web Notifications
+        * features.gypi:
+
+2012-03-09  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Ensure we use the correct time when notifying animation started
+        https://bugs.webkit.org/show_bug.cgi?id=79537
+
+        Reviewed by James Robinson
+
+        * src/WebCompositorInputHandlerImpl.cpp:
+        (WebKit::WebCompositorInputHandlerImpl::willDraw):
+        * src/WebCompositorInputHandlerImpl.h:
+        (WebCompositorInputHandlerImpl):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit::CCLayerTreeHostImplTest::postAnimationEventsToMainThreadOnImplThread):
+        (WebKit::TEST_F):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::TestHooks::animateLayers):
+        (WTF::TestHooks::updateAnimations):
+        (WTF::MockLayerTreeHostImpl::animateLayers):
+        (WTF::MockLayerTreeHostClient::updateAnimations):
+        (WTF::CCLayerTreeHostTestAddAnimation::CCLayerTreeHostTestAddAnimation):
+        (WTF::CCLayerTreeHostTestAddAnimation::animateLayers):
+        (WTF::CCLayerTreeHostTestAddAnimation::notifyAnimationStarted):
+        (CCLayerTreeHostTestAddAnimation):
+
+2012-03-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110191, r110202, and r110279.
+        http://trac.webkit.org/changeset/110191
+        http://trac.webkit.org/changeset/110202
+        http://trac.webkit.org/changeset/110279
+        https://bugs.webkit.org/show_bug.cgi?id=80694
+
+        They broke !ENABLE(INSPECTOR) builds (Requested by Ossy on
+        #webkit).
+
+        * features.gypi:
+
+2012-03-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        [chromium] Unreviewed, build fix after r110191
+
+        * features.gypi:
+
+2012-03-08  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Ensure that the cc thread animation framework continues to tick when the tab is backgrounded
+        https://bugs.webkit.org/show_bug.cgi?id=77668
+
+        Reviewed by James Robinson.
+
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::CCLayerTreeHostTest::postAddInstantAnimationToMainThread):
+        (CCLayerTreeHostTest):
+        (WTF::CCLayerTreeHostTest::dispatchAddInstantAnimation):
+        (WTF::CCLayerTreeHostTest::dispatchAddAnimation):
+        (WTF::CCLayerTreeHostTestAddAnimation::beginTest):
+        (WTF):
+        (CCLayerTreeHostTestTickAnimationWhileBackgrounded):
+        (WTF::CCLayerTreeHostTestTickAnimationWhileBackgrounded::CCLayerTreeHostTestTickAnimationWhileBackgrounded):
+        (WTF::CCLayerTreeHostTestTickAnimationWhileBackgrounded::beginTest):
+        (WTF::CCLayerTreeHostTestTickAnimationWhileBackgrounded::animateLayers):
+        (WTF::CCLayerTreeHostTestTickAnimationWhileBackgrounded::afterTest):
+        (WTF::TEST_F):
+
+2012-03-08  Jeff Timanus  <twiz@chromium.org>
+
+        [chromium] Force the Canvas2D GPU texture cache to 0 bytes for backgrounded tabs.
+        https://bugs.webkit.org/show_bug.cgi?id=79948
+
+        Reviewed by Stephen White.
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GrMemoryAllocationChangedCallback::onGpuMemoryAllocationChanged):
+        (WebCore::GraphicsContext3DPrivate::grContext):
+        (WebCore::GraphicsContext3DPrivate::setVisibilityCHROMIUM):
+
+2012-03-08  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Replace completelyContains with Region::contains()
+        https://bugs.webkit.org/show_bug.cgi?id=80617
+
+        Reviewed by James Robinson.
+
+        * tests/CCLayerTestCommon.cpp:
+        (CCLayerTestCommon):
+        (CCLayerTestCommon::verifyQuadsExactlyCoverRect):
+        * tests/CCLayerTestCommon.h:
+        (CCLayerTestCommon):
+
+2012-03-08  James Robinson  <jamesr@chromium.org>
+
+        Use an explicit attribute to signal that a context prefers to use a discrete GPU
+        https://bugs.webkit.org/show_bug.cgi?id=80639
+
+        Reviewed by Stephen White.
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3DPrivate::getContextAttributes):
+        (WebCore::GraphicsContext3D::create):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::createCompositorGraphicsContext3D):
+
+2012-03-08  Scott Byer  <scottbyer@chromium.org>
+
+        Have ScrollAnimatorNone use requestAnimationFrame
+        https://bugs.webkit.org/show_bug.cgi?id=78938
+
+        Reviewed by James Robinson.
+
+        * src/ScrollbarGroup.h:
+        (WebCore):
+        (WebKit::ScrollbarGroup::hostWindow):
+        (ScrollbarGroup):
+        * tests/ScrollAnimatorNoneTest.cpp:
+        (MockScrollableArea::hostWindow):
+
+2012-03-08  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Make elements with attributes smaller by eliminating the m_element back pointer in NamedNodeMap
+        https://bugs.webkit.org/show_bug.cgi?id=75069
+
+        Reviewed by Ryosuke Niwa.
+
+        * src/WebElement.cpp: Include NamedNodeMap.h since Element.h doesn't include it anymore.
+
+2012-03-07  Kent Tamura  <tkent@chromium.org>
+
+        Remove meaningless code in RenderTextControlSingleLine::preferredContentWidth()
+        https://bugs.webkit.org/show_bug.cgi?id=80493
+
+        Reviewed by Hajime Morita.
+
+        * src/WebInputElement.cpp:
+        RenderTextControlSingleLine::speechButtonElement() is removed. The
+        following functions get it from HTMLInputElement.
+        (WebKit::WebInputElement::getSpeechInputState):
+        (WebKit::WebInputElement::startSpeechInput):
+        (WebKit::WebInputElement::stopSpeechInput):
+
+2012-03-07  Adam Barth  <abarth@webkit.org>
+
+        Remove #define private public from WebCache.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80520
+
+        Reviewed by Eric Seidel.
+
+        This patch removes a hack we added long ago when Chromium used a forked
+        copy of WebKit and editing WebCore caused merge pain.  Now that we're
+        on trunk, we can unwind this hack.
+
+        * src/WebCache.cpp:
+        (WebKit::WebCache::getUsageStats):
+
+2012-03-07  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: V8LocalContext creation in IDBKey extraction/injection is slow
+        https://bugs.webkit.org/show_bug.cgi?id=80358
+
+        Reviewed by Tony Chang.
+
+        * tests/IDBBindingUtilitiesTest.cpp:
+        (WebCore::TEST):
+
+2012-03-07  Scott Byer  <scottbyer@chromium.org>
+
+        Get ScrollAnimatorNone to handle the stop and reverse cases.
+        https://bugs.webkit.org/show_bug.cgi?id=80455
+
+        Reviewed by James Robinson.
+
+        * tests/ScrollAnimatorNoneTest.cpp:
+        (ScrollAnimatorNoneTest::updateDataFromParameters):
+        (TEST_F):
+
+2012-03-07  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Cull occluded tiles during paint
+        https://bugs.webkit.org/show_bug.cgi?id=76838
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::ContentLayerChromiumWithUpdateTracking::idlePaintContentsIfDirty):
+        * tests/TiledLayerChromiumTest.cpp:
+        (WTF::FakeLayerTextureUpdater::Texture::prepareRect):
+        (WTF::FakeLayerTextureUpdater::FakeLayerTextureUpdater):
+        (FakeLayerTextureUpdater):
+        (WTF::FakeLayerTextureUpdater::prepareRectCount):
+        (WTF::FakeLayerTextureUpdater::clearPrepareRectCount):
+        (WTF::FakeLayerTextureUpdater::prepareRect):
+        (WTF::FakeTiledLayerChromium::prepareToUpdate):
+        (WTF::FakeTiledLayerChromium::prepareToUpdateIdle):
+        (WTF::FakeTiledLayerChromium::paintContentsIfDirty):
+        (WTF::TEST):
+        (WTF):
+
+2012-03-07  Elliot Poger  <epoger@google.com>
+
+        [Chromium] Remove use_skia option from GYP
+        https://bugs.webkit.org/show_bug.cgi?id=75811
+
+        Reviewed by Tony Chang.
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * features.gypi:
+
+2012-03-06  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Add clipping to scissor rect to CCOcclusionTracker
+        https://bugs.webkit.org/show_bug.cgi?id=79927
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebCore::TestCCOcclusionTracker::TestCCOcclusionTracker):
+        (TestCCOcclusionTracker):
+        (WebCore::TestCCOcclusionTracker::setLayerScissorRect):
+        (WebCore::TestCCOcclusionTracker::useDefaultLayerScissorRect):
+        (WebCore::TestCCOcclusionTracker::layerScissorRect):
+        (WebCore):
+        (TestDamageClient):
+        (WebCore::TestDamageClient::damageRect):
+        (WebCore::TestDamageClient::TestDamageClient):
+        (WebCore::TestDamageClient::setDamageRect):
+        (WebCore::TEST):
+
+2012-03-06  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Introduce ThreadableWebSocketChannel::SendResult
+        https://bugs.webkit.org/show_bug.cgi?id=80356
+
+        Reviewed by Kent Tamura.
+
+        * src/WebSocketImpl.cpp:
+        (WebKit::WebSocketImpl::sendText): Checks whether the return value of send() is ThreadableWebSocketChannel::SendSuccess.
+        (WebKit::WebSocketImpl::sendArrayBuffer): Ditto.
+
+2012-03-06  Nat Duca  <nduca@chromium.org>
+
+        [chromium] CCThreadProxy context lost support
+        https://bugs.webkit.org/show_bug.cgi?id=80100
+
+        Reviewed by James Robinson.
+
+        * tests/CCSchedulerStateMachineTest.cpp:
+        * tests/CCSchedulerTest.cpp:
+        (WebKitTests::FakeCCSchedulerClient::scheduledActionBeginContextRecreation):
+        (WebKitTests::SchedulerClientThatSetNeedsDrawInsideDraw::scheduledActionBeginContextRecreation):
+        (WebKitTests::SchedulerClientThatSetNeedsCommitInsideDraw::scheduledActionBeginContextRecreation):
+
+2012-03-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Null-check m_layerRenderer in CCLayerTreeHostImpl::finishAllRendering()
+        https://bugs.webkit.org/show_bug.cgi?id=80445
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (FakeWebGraphicsContext3DMakeCurrentFails):
+        (WebKit::FakeWebGraphicsContext3DMakeCurrentFails::makeContextCurrent):
+        (WebKit):
+        (WebKit::TEST_F):
+
+2012-03-06  David Grogan  <dgrogan@chromium.org>
+
+        [Chromium] Add OVERRIDEs to WebWorkerClientImpl.h
+        https://bugs.webkit.org/show_bug.cgi?id=80434
+
+        Reviewed by Tony Chang.
+
+        Tests: just that it compiles.
+
+        * src/WebWorkerClientImpl.h:
+        (WebWorkerClientImpl):
+
+2012-03-06  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Check WebCommonWorkerClient::allowIndexedDB before proceeding from a shared worker
+        https://bugs.webkit.org/show_bug.cgi?id=79954
+
+        Tests: The 'allow' case will be tested once the patch at
+        http://webkit.org/b/80189 and
+        https://chromiumcodereview.appspot.com/9585031/ both land. Bug for
+        testing the 'deny' case is http://crbug.com/113738.
+
+        Reviewed by Tony Chang.
+
+        * public/WebCommonWorkerClient.h:
+        (WebKit::WebCommonWorkerClient::allowDatabase):
+        (WebKit::WebCommonWorkerClient::allowFileSystem):
+        (WebKit::WebCommonWorkerClient::openFileSystem):
+        (WebCommonWorkerClient):
+        (WebKit::WebCommonWorkerClient::allowIndexedDB):
+        * public/WebSharedWorkerClient.h:
+        (WebSharedWorkerClient):
+        * src/IDBFactoryBackendProxy.cpp:
+        (WebKit::AllowIndexedDBMainThreadBridge::create):
+        (WebKit::AllowIndexedDBMainThreadBridge::cancel):
+        (WebKit::AllowIndexedDBMainThreadBridge::signalCompleted):
+        (WebKit::AllowIndexedDBMainThreadBridge::AllowIndexedDBMainThreadBridge):
+        (WebKit::AllowIndexedDBMainThreadBridge::allowIndexedDBTask):
+        (AllowIndexedDBMainThreadBridge):
+        (WebKit::IDBFactoryBackendProxy::allowIDBFromWorkerThread):
+        * src/WebWorkerClientImpl.cpp:
+        (WebKit):
+        (WebKit::WebWorkerClientImpl::allowIndexedDB):
+        * src/WebWorkerClientImpl.h:
+        (WebWorkerClientImpl):
+
+2012-03-06  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r109825.
+        http://trac.webkit.org/changeset/109825
+        https://bugs.webkit.org/show_bug.cgi?id=79413
+
+        Broke webkit_unit_tests on Chromium Win
+
+        * WebKit.gypi:
+        * tests/LevelDBTest.cpp: Removed.
+
+2012-03-06  Takashi Toyoshima  <toyoshim@chromium.org>
+
+        [Chromium] [WebSocket] Add WebSocket extensions query WebKit API
+        https://bugs.webkit.org/show_bug.cgi?id=80190
+
+        Reviewed by Darin Fisher.
+
+        * public/WebSocket.h: Add extensions() declaration.
+        (WebSocket):
+        * src/WebSocketImpl.cpp: Implement extensions() bridge.
+        (WebKit::WebSocketImpl::extensions):
+        (WebKit):
+        * src/WebSocketImpl.h: Add extensions() declaration.
+        (WebSocketImpl):
+
+2012-03-05  Kent Tamura  <tkent@chromium.org>
+
+        Do not reformat strings in <input type=number> on platforms using LocalizedNumberICU.
+        https://bugs.webkit.org/show_bug.cgi?id=78326
+
+        Reviewed by Hajime Morita.
+
+        Add a test for WebCore/platform/text/LocalizedNumberICU.
+
+        * WebKit.gypi: Added LocalizedNumberICUTest.cpp
+        * tests/LocalizedNumberICUTest.cpp: Added.
+
+2012-03-05  Kenneth Russell  <kbr@google.com>
+
+        [chromium] Notify CCLayerImpl tree of context loss and restoration
+        https://bugs.webkit.org/show_bug.cgi?id=80339
+
+        Reviewed by James Robinson.
+
+        Unit test for notification of context loss and restoration.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit):
+        (ContextLostNotificationCheckLayer):
+        (WebKit::ContextLostNotificationCheckLayer::create):
+        (WebKit::ContextLostNotificationCheckLayer::didLoseAndRecreateGraphicsContext):
+        (WebKit::ContextLostNotificationCheckLayer::didLoseAndRecreateGraphicsContextCalled):
+        (WebKit::ContextLostNotificationCheckLayer::ContextLostNotificationCheckLayer):
+        (WebKit::TEST_F):
+
+2012-03-05  Changhun Kang  <temoochin@company100.net>
+
+        Change the argument orders to match OpenGL's in GraphicsContext3D functions
+        https://bugs.webkit.org/show_bug.cgi?id=80120
+
+        Reviewed by Kenneth Russell.
+
+        No new tests because this patch just change the order of arguments.
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3DPrivate::uniform1fv):
+        (WebCore::GraphicsContext3DPrivate::uniform1iv):
+        (WebCore::GraphicsContext3DPrivate::uniform2fv):
+        (WebCore::GraphicsContext3DPrivate::uniform2iv):
+        (WebCore::GraphicsContext3DPrivate::uniform3fv):
+        (WebCore::GraphicsContext3DPrivate::uniform3iv):
+        (WebCore::GraphicsContext3DPrivate::uniform4fv):
+        (WebCore::GraphicsContext3DPrivate::uniform4iv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix2fv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix3fv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix4fv):
+        (WebCore):
+        * src/GraphicsContext3DPrivate.h:
+        (GraphicsContext3DPrivate):
+
+2012-03-05  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Chromium] WebOptionElement should inherit WebElement instead of WebFormControlElement
+        https://bugs.webkit.org/show_bug.cgi?id=80089
+
+        Change class hierarchy of WebOptionElement to match with specification.
+
+        Reviewed by Darin Fisher.
+
+        * public/WebOptionElement.h: Replace to WebElement from WebFormControlElement 
+        (WebKit::WebOptionElement::WebOptionElement):
+        (WebKit::WebOptionElement::operator=):
+        (WebKit::WebOptionElement::assign):
+        * src/WebOptionElement.cpp:
+        (WebKit::WebOptionElement::WebOptionElement):
+
+2012-03-05  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Handle LevelDB database corruption
+        https://bugs.webkit.org/show_bug.cgi?id=79413
+
+        Reviewed by Tony Chang.
+
+        * WebKit.gypi:
+        * tests/LevelDBTest.cpp: Added.
+        (WebCore):
+        (SimpleComparator):
+        (WebCore::SimpleComparator::compare):
+        (WebCore::SimpleComparator::name):
+        (WebCore::encodeString):
+        (WebCore::TEST):
+
+2012-03-05  Min Qin  <qinmin@google.com>
+
+        Enable context menu on android
+
+        For android, long press is converted into a right mouse down event
+        So we will use that to invoke the context menu
+        https://bugs.webkit.org/show_bug.cgi?id=80332
+
+        Reviewed by Adam Barth.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::mouseDown):
+
+2012-03-05  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium] Add new popup type: PagePopup
+        https://bugs.webkit.org/show_bug.cgi?id=80106
+
+        Reviewed by Darin Fisher.
+
+        This is a preparation of implementing ChromeClient::openPagePopup and
+        closePagePopup.
+
+        * WebKit.gyp: Add WebPagePopup.h and WebPagePopupImpl.cpp.
+        * public/WebPagePopup.h:
+        (WebPagePopup): Add WebPagePopup interface.
+        * public/WebPopupType.h: Add WebPopupTypePage.
+        * src/WebPagePopupImpl.cpp:
+        (WebKit::WebPagePopup::create): Temprary implementation which just returns 0.
+
+2012-03-05  Charlie Reis  <creis@chromium.org>
+
+        [chromium] Pass WebNavigationPolicy to WebViewClient::createView
+        https://bugs.webkit.org/show_bug.cgi?id=80057
+
+        Reviewed by Darin Fisher.
+
+        * public/WebViewClient.h:
+        (WebViewClient):
+        (WebKit::WebViewClient::createView):
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::ChromeClientImpl):
+        (WebKit::ChromeClientImpl::createWindow):
+        (WebKit::ChromeClientImpl::getNavigationPolicy):
+        (WebKit):
+        (WebKit::ChromeClientImpl::show):
+        (WebKit::ChromeClientImpl::setNewWindowNavigationPolicy):
+        * src/ChromeClientImpl.h:
+        (ChromeClientImpl):
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchCreatePage):
+        (WebKit::FrameLoaderClientImpl::dispatchDecidePolicyForNewWindowAction):
+
+2012-03-05  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Initialize CCOverdrawCounts struct to zero
+        https://bugs.webkit.org/show_bug.cgi?id=80204
+
+        Reviewed by Adrienne Walker.
+
+        Update test to use c'tor instead of {} struct initialization.
+
+        * tests/CCQuadCullerTest.cpp:
+        (WebCore):
+
+2012-03-05  Takashi Toyoshima  <toyoshim@chromium.org>
+
+        [Chromium] [WebSocket] use OVERRIDE in WebSocketImpl.h
+        https://bugs.webkit.org/show_bug.cgi?id=80192
+
+        Reviewed by Kent Tamura.
+
+        * src/WebSocketImpl.h: use OVERRIDE macro.
+        (WebSocketImpl):
+
+2012-03-05  Adam Barth  <abarth@webkit.org>
+
+        Geolocation should use a ScriptExecutionContext as its context object
+        https://bugs.webkit.org/show_bug.cgi?id=80248
+
+        Reviewed by Kentaro Hara.
+
+        Rather than indirecting through the Frame to get the SecurityOrigin, we
+        should get the SecurityOrigin directly from ScriptExecutionContext.
+
+        * src/WebGeolocationPermissionRequest.cpp:
+        (WebKit::WebGeolocationPermissionRequest::securityOrigin):
+
+2012-03-02  Andrey Kosyakov  <caseq@chromium.org>
+
+        Add instrumentation for frame start/end on timeline.
+
+        Web Inspector: add timeline instrumentation for frame events
+        https://bugs.webkit.org/show_bug.cgi?id=80127
+
+        Reviewed by Pavel Feldman.
+
+        - expose an instrumentation method from WebWidget to mark frame update start
+
+        * public/WebWidget.h:
+        (WebWidget):
+        (WebKit::WebWidget::instrumentBeginFrame):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::instrumentBeginFrame):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove the redundant method KURL::protocolInHTTPFamily()
+        https://bugs.webkit.org/show_bug.cgi?id=80216
+
+        Reviewed by Anders Carlsson.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchWillPerformClientRedirect):
+        * src/WebPageSerializer.cpp:
+        (WebCore::retrieveResourcesForElement):
+
+2012-03-03  Hans Wennborg  <hans@chromium.org>
+
+        Implement Speech JavaScript API
+        https://bugs.webkit.org/show_bug.cgi?id=80019
+
+        Reviewed by Adam Barth.
+
+        Add ENABLE_SCRIPTED_SPEECH and runtime flag.
+
+        * features.gypi:
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures):
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::enableScriptedSpeech):
+        (WebKit):
+        (WebKit::WebRuntimeFeatures::isScriptedSpeechEnabled):
+
+2012-03-03  Bill Budge  <bbudge@chromium.org>
+
+        Fixes AssociatedURLLoader support for Access-Control-Expose-Headers field in response.
+        https://bugs.webkit.org/show_bug.cgi?id=80198
+
+        Reviewed by Adam Barth.
+
+        * src/AssociatedURLLoader.cpp:
+        * tests/AssociatedURLLoaderTest.cpp:
+
+2012-03-02  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] Allow plugins to set opaque() on their platform layer
+        https://bugs.webkit.org/show_bug.cgi?id=80171
+
+        Reviewed by James Robinson.
+
+        * public/WebPluginContainer.h:
+        (WebPluginContainer):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::setOpaque):
+        (WebKit):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+
+2012-03-01  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Make parser code not depend on NamedNodeMap
+        https://bugs.webkit.org/show_bug.cgi?id=79963
+
+        Reviewed by Adam Barth.
+
+        * src/WebNamedNodeMap.cpp:
+        (WebKit::WebNamedNodeMap::attributeItem):
+
+2012-03-01  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Make opaque paint tracker aware of SkCanvas layers
+        https://bugs.webkit.org/show_bug.cgi?id=79145
+
+        Reviewed by Stephen White.
+
+        * tests/PlatformContextSkiaTest.cpp:
+        (WebCore::TEST):
+        (WebCore):
+
+2012-03-01  Hironori Bono  <hbono@chromium.org>
+
+        Render overflow controls of an RTL element to its left-side.
+        https://bugs.webkit.org/show_bug.cgi?id=54623
+
+        This change adds a new flag WTF_USE_RTL_SCROLLBAR and render the
+        vertical scrollbars and resizers of RTL elements to their left side if
+        this new flag is enabled.
+
+        Reviewed by Ryosuke Niwa.
+
+        * features.gypi: Set WTF_USE_RTL_SCROLLBAR to 1 on Chromium.
+
+2012-03-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Rename LayerChromium::name to debugName to be more consistent with other debug properties, make threadsafe
+        https://bugs.webkit.org/show_bug.cgi?id=79723
+
+        Reviewed by Adrienne Walker.
+
+        * tests/LayerChromiumTest.cpp:
+
+2012-03-01  Dale Curtis  <dalecurtis@chromium.org>
+
+        Remove deprecated FFmpeg build directories.
+        https://bugs.webkit.org/show_bug.cgi?id=79282
+
+        We've switched the layout of the FFmpeg repo in Chrome and these paths
+        are no longer needed or valid.
+
+        Reviewed by Dirk Pranke.
+
+        * DEPS:
+
+2012-03-01  Dirk Pranke  <dpranke@chromium.org>
+
+        Roll chromium DEPS to 124511
+
+        Unreviewed, DEPS change.
+
+        * DEPS:
+
+2012-02-29  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Move context lost control code from CCSingleThreadProxy to CCLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=79964
+
+        Reviewed by James Robinson.
+
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::loseCompositorContext):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit::WebLayerTreeViewImpl::createContext):
+        (WebKit::WebLayerTreeViewImpl::didRecreateContext):
+        * src/WebLayerTreeViewImpl.h:
+        (WebLayerTreeViewImpl):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::MockLayerTreeHostClient::createContext):
+        (WTF::MockLayerTreeHostClient::didRecreateContext):
+        * tests/FakeCCLayerTreeHostClient.h:
+        (WebCore::FakeCCLayerTreeHostClient::createContext):
+        (WebCore::FakeCCLayerTreeHostClient::didRecreateContext):
+
+2012-03-01  Kentaro Hara  <haraken@chromium.org>
+
+        REGRESSION(r109288): WebViewImpl::enableAutoResizeMode loops infinitely
+        https://bugs.webkit.org/show_bug.cgi?id=77452
+
+        Reviewed by Hajime Morita.
+
+        WebViewImpl::enableAutoResizeMode loops infinitely.
+        This patch fixes the following line:
+
+            enableAutoResizeMode(enable, minSize, maxSize);
+
+        to
+            enableAutoResizeMode(minSize, maxSize);
+
+        to avoid the infinite loop. I guess this is the change originally intended.
+
+        Test: webkit_unit_tests.WebViewTest.AutoResizeMinimumSize
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::enableAutoResizeMode):
+
+2012-02-29  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Use the new createSnapshotFileAndReadMetadata API for FileEntry.file()
+        https://bugs.webkit.org/show_bug.cgi?id=79928
+
+        Reviewed by David Levin.
+
+        In the new flow we first create an internal Blob URL for the
+        snapshot file and call the new createSnapshotFileAndReadMetadata()
+        WebKit API with the Blob URL.
+
+        The implementor of createSnapshotFileAndReadMetadata() (i.e. chromium)
+        registers the created snapshot file with the given internal Blob URL.
+
+        In the callback chain we call File::createWithName() to create a
+        new File using the returned platform path, and then call
+        unregisterBlobURL() to clean up the internal Blob URL.
+
+        * src/AsyncFileSystemChromium.cpp:
+        (WebCore::AsyncFileSystemChromium::createSnapshotFileAndReadMetadata): Added.
+        (WebCore::AsyncFileSystemChromium::createSnapshotFileCallback): Added.
+        * src/AsyncFileSystemChromium.h:
+        * src/WorkerAsyncFileSystemChromium.cpp:
+        (WebCore::WorkerAsyncFileSystemChromium::createSnapshotFileAndReadMetadata): Added.
+        * src/WorkerAsyncFileSystemChromium.h:
+        * src/WorkerFileSystemCallbacksBridge.cpp:
+        (WebKit::WorkerFileSystemCallbacksBridge::postCreateSnapshotFileToMainThread): Added.
+        (WebKit::WorkerFileSystemCallbacksBridge::createSnapshotFileOnMainThread): Added.
+        * src/WorkerFileSystemCallbacksBridge.h:
+        (WorkerFileSystemCallbacksBridge):
+
+2012-02-29  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-02-29  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Estimate pixel count for frame rate control
+        https://bugs.webkit.org/show_bug.cgi?id=74982
+
+        Reviewed by James Robinson.
+
+        Adds mechanism to compute and collect statistics on pixel overdraw for selected frames.
+
+        * tests/CCQuadCullerTest.cpp:
+        (WebCore):
+        (WebCore::TEST):
+
+2012-02-29  James Simonsen  <simonjam@chromium.org>
+
+        [chromium] Fix navigation start time on cross-renderer navigation
+        https://bugs.webkit.org/show_bug.cgi?id=75922
+
+        Reviewed by Darin Fisher.
+
+        * public/WebDataSource.h:
+        * src/WebDataSource.cpp:
+        (WebKit::WebDataSource::setNavigationStartTime): Added.
+        * src/WebDataSource.h:
+
+2012-02-29  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Add impl-thread support for animation-timing-function
+        https://bugs.webkit.org/show_bug.cgi?id=79819
+
+        Reviewed by James Robinson.
+
+        * tests/CCKeyframedAnimationCurveTest.cpp:
+        (WebCore::TEST):
+        (WebCore):
+
+2012-02-29  David Levin  <levin@chromium.org>
+
+        [chromium] Add the ability to turn off autoresize.
+        https://bugs.webkit.org/show_bug.cgi?id=77452
+
+        Reviewed by Darin Fisher.
+
+        * public/WebView.h:
+        (WebKit::WebViewImpl::enableAutoResizeMode): Cleaned up the api.
+        (WebKit::WebViewImpl::disableAutoResizeMode): Added the ability to disable auto-resize.
+        (WebKit::WebViewImpl::enableAutoResizeMode): Deprecated it.
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::enableAutoResizeMode): Adjust for new api.
+        (WebKit::WebViewImpl::disableAutoResizeMode): Allow turning off autoresize.
+        (WebKit::WebViewImpl::enableAutoResizeMode): Call the other two apis, but
+        this api will be deleted shortly.
+        (WebKit::WebViewImpl::configureAutoResizeMode): Common code.
+        * src/WebViewImpl.h:
+        (WebViewImpl): Adjust to new public api.
+
+2012-02-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-02-29  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Don't let invalidation for next frame prevent tile upload
+        https://bugs.webkit.org/show_bug.cgi?id=79841
+
+        Reviewed by James Robinson.
+
+        * tests/TiledLayerChromiumTest.cpp:
+        (WTF::TEST):
+
+2012-02-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107917 and r109188.
+        http://trac.webkit.org/changeset/107917
+        http://trac.webkit.org/changeset/109188
+        https://bugs.webkit.org/show_bug.cgi?id=79865
+
+        Fix the chromium build. (Requested by dcheng on #webkit).
+
+        * src/WebDragData.cpp:
+        (WebKit::WebDragData::items):
+
+2012-02-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Chromium build fix attempt.
+
+        * src/WebDragData.cpp:
+
+2012-02-28  Jonathan Backer  <backer@chromium.org>
+
+        [chromium] Reset damage tracker on visibility change.
+        https://bugs.webkit.org/show_bug.cgi?id=79267
+
+        Reviewed by James Robinson.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit::PartialSwapTrackerContext::getString):
+        (WebKit):
+        (WebKit::TEST_F):
+
+2012-02-28  Tim Dresser  <tdresser@chromium.org>
+
+        Provide DefaultDeviceScaleFactor though WebSettings
+        https://bugs.webkit.org/show_bug.cgi?id=79534
+
+        Reviewed by Darin Fisher.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setDefaultDeviceScaleFactor):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-02-28  Gary Kacmarcik  <garykac@chromium.org>
+
+        [chromium] Set nativeKeyCode to include Windows scan code
+        https://bugs.webkit.org/show_bug.cgi?id=79289
+
+        Reviewed by Ryosuke Niwa.
+
+        Set the key event's nativeKeyCode on Windows Chromium so that it
+        actually includes the native scancode and other context bits.
+        Currently on Windows, the nativeKeyCode is set to be the same value as
+        the windowsKeyCode, which is redundant.
+
+        The actual native key information is required so that components (like
+        plugins) can reconstruct the original key event. The value stored in
+        the windowsKeyCode is a Windows virtual key code which does not provide
+        sufficient info to disambiguate the actual key being pressed (for
+        example, it cannot distinguish between the left and right shift keys).
+
+        All platforms except Windows currently send native key event info, so
+        this change will bring Windows in line with other platforms.
+
+        This change is part of our effort to send enhanced keycode information
+        to Pepper plugins in Chromium.
+
+        * src/win/WebInputEventFactory.cpp:
+        (WebKit::WebInputEventFactory::keyboardEvent):
+
+2012-02-28  Adam Klein  <adamk@chromium.org>
+
+        Unreviewed, speculative test fix after r109016.
+
+        * tests/TransparencyWinTest.cpp:
+        (WebCore::TEST): Update all ImageBuffer::create calls to include a scale of 1.
+
+2012-02-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-02-27  James Kozianski  <koz@chromium.org>
+
+        Add missing parameter to didCreateScriptContext() so it overrides base class again.
+        https://bugs.webkit.org/show_bug.cgi?id=79742
+
+        Reviewed by Kent Tamura.
+
+        * tests/WebFrameTest.cpp:
+
+2012-02-27  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Unreviewed gardening, Disable TransparencyWin.OpaqueCompositeLayerPixel
+
+        * tests/TransparencyWinTest.cpp:
+        (WebCore::TEST):
+
+2012-02-27  Kinuko Yasuda  <kinuko@chromium.org>
+
+        [chromium] Add createSnapshotFile API to WebFileSystem to create File snapshots for filesystem files
+        https://bugs.webkit.org/show_bug.cgi?id=79394
+
+        Reviewed by Darin Fisher.
+
+        * public/platform/WebFileSystem.h:
+        (WebKit::WebFileSystem::createSnapshotFileAndReadMetadata): Added.
+
+2012-02-27  James Kozianski  <koz@chromium.org>
+
+        [chromium] Plumb extensionGroup into didCreateScriptContext().
+        https://bugs.webkit.org/show_bug.cgi?id=79072
+
+        Reviewed by Darin Fisher.
+
+        * public/WebFrameClient.h:
+        (WebKit::WebFrameClient::didCreateScriptContext):
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::didCreateScriptContext):
+        * src/FrameLoaderClientImpl.h:
+        (FrameLoaderClientImpl):
+
+2012-02-27  Adrienne Walker  <enne@google.com>
+
+        [chromium] Unreviewed gardening, disable TransparencyWinTest unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=79718
+
+        * tests/TransparencyWinTest.cpp:
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        * src/ChromeClientImpl.h:
+        (ChromeClientImpl):
+
+2012-02-26  James Robinson  <jamesr@chromium.org>
+
+        Take 2 build fix.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit::TEST_F):
+
+2012-02-26  James Robinson  <jamesr@chromium.org>
+
+        Compile fix for CCLayerTreeHostImpl test.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit::TEST_F):
+
+2012-02-26  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Wire up shouldUpdateScrollPositionOnMainThread and nonFastScrollableRegion to compositor
+        https://bugs.webkit.org/show_bug.cgi?id=79155
+
+        Reviewed by Adam Barth.
+
+        Add new tests for shouldScrollOnMainThread and nonFastScrollableRegion properties.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit::TEST_F):
+        (WebKit):
+        * tests/LayerChromiumTest.cpp:
+
+2012-02-25  Adrienne Walker  <enne@google.com>
+
+        [chromium] Unreviewed gardening, fix Linux Clang OwnPtr breakage
+        https://bugs.webkit.org/show_bug.cgi?id=78404
+
+        r108886 doesn't compile on Linux Clang due to OwnPtr's public copy
+        constructor (i.e. "has internal linkage but is not defined"). Fixed
+        locally by changing copy initialization to direct initialization.
+
+        * tests/TiledLayerChromiumTest.cpp:
+        (WTF::TEST):
+
+2012-02-24  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] Replace RefPtr with OwnPtr for CCLayerImpl tree structure
+        https://bugs.webkit.org/show_bug.cgi?id=78404
+
+        Reviewed by James Robinson.
+
+        * tests/CCDamageTrackerTest.cpp:
+        (WebKitTests::executeCalculateDrawTransformsAndVisibility):
+        (WebKitTests::emulateDrawingOneFrame):
+        (WebKitTests::createTestTreeWithOneSurface):
+        (WebKitTests::createTestTreeWithTwoSurfaces):
+        (WebKitTests::createAndSetUpTestTreeWithOneSurface):
+        (WebKitTests::createAndSetUpTestTreeWithTwoSurfaces):
+        (WebKitTests::TEST_F):
+        * tests/CCLayerImplTest.cpp:
+        (WebCore::TEST):
+        * tests/CCLayerIteratorTest.cpp:
+        * tests/CCLayerSorterTest.cpp:
+        (WebCore::TEST):
+        * tests/CCLayerTreeHostCommonTest.cpp:
+        (WebCore::TEST):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit::CCLayerTreeHostImplTest::setupScrollAndContentsLayers):
+        (WebKit::TEST_F):
+        (WebKit::DidDrawCheckLayer::create):
+        (WebKit::BlendStateCheckLayer::create):
+        * tests/CCRenderSurfaceTest.cpp:
+        (WebCore::TEST):
+        * tests/CCSolidColorLayerImplTest.cpp:
+        (CCLayerTestCommon::TEST):
+        * tests/CCTiledLayerImplTest.cpp:
+        (CCLayerTestCommon::createLayer):
+        (CCLayerTestCommon::TEST):
+        (CCLayerTestCommon::getQuads):
+        * tests/Canvas2DLayerChromiumTest.cpp:
+        (WebCore::Canvas2DLayerChromiumTest::fullLifecycleTest):
+        * tests/TiledLayerChromiumTest.cpp:
+        (WTF::TEST):
+        * tests/TreeSynchronizerTest.cpp:
+        (WebKitTests::MockCCLayerImpl::create):
+        (WebKitTests::MockLayerChromium::createCCLayerImpl):
+        (WebKitTests::expectTreesAreIdentical):
+        (WebKitTests::TEST):
+
+2012-02-08  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Make WebViewImpl depend on WebLayerTreeView instead of CCLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=75591
+
+        Reviewed by Kenneth Russell.
+
+        This converts WebViewImpl from depending on CCLayerTreeHost to WebLayerTreeView in order to provide better
+        isolation and allow for future refactorings. The changes to WebViewImpl are mostly mechanical. The
+        WebLayerTreeView and WebLayerTreeViewClient interfaces have both grown and changed slightly:
+
+        - Setup path for WebLayerTreeView changed to expose an initialize() function instead of a create() factory
+        function. The new model is that a WebLayerTreeView when constructed is in a null state. Calling initialize()
+        attempts to re-initialize the WLTV, which can either fail or succeed.  All other functions must be called on a
+        successfully initialized view.
+
+        - WebLayerTreeView expanded to include functionality that CCLayerTreeHost exposes but WebLayerTreeView did not.
+        Some of this is only valid for the single thread case and will be removed when we invert the scheduling control
+        logic, these bits are commented.
+
+        - WebLayerTreeViewClient expanded with some flow-control related APIs.
+
+        Refactor only, no change in behavior.
+
+        * public/platform/WebLayerTreeView.h:
+        (WebKit::WebLayerTreeView::Settings::Settings):
+        (WebKit::WebLayerTreeView::isNull):
+        * public/platform/WebLayerTreeViewClient.h:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::scheduleCompositingLayerSync):
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::initialize):
+        (WebKit::WebLayerTreeView::compositorIdentifier):
+        (WebKit::WebLayerTreeView::setVisible):
+        (WebKit::WebLayerTreeView::setNeedsAnimate):
+        (WebKit::WebLayerTreeView::updateAnimations):
+        (WebKit::WebLayerTreeView::setNeedsRedraw):
+        (WebKit::WebLayerTreeView::setPageScaleFactorAndLimits):
+        (WebKit::WebLayerTreeView::startPageScaleAnimation):
+        (WebKit::WebLayerTreeView::finishAllRendering):
+        (WebKit::WebLayerTreeView::context):
+        (WebKit::WebLayerTreeView::loseCompositorContext):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit::WebLayerTreeViewImpl::didRecreateGraphicsContext):
+        (WebKit::WebLayerTreeViewImpl::didCommitAndDrawFrame):
+        (WebKit::WebLayerTreeViewImpl::didCompleteSwapBuffers):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::animate):
+        (WebKit::WebViewImpl::doPixelReadbackToCanvas):
+        (WebKit::WebViewImpl::paint):
+        (WebKit::WebViewImpl::composite):
+        (WebKit::WebViewImpl::loseCompositorContext):
+        (WebKit::WebViewImpl::computePageScaleFactorLimits):
+        (WebKit::WebViewImpl::addPageOverlay):
+        (WebKit::WebViewImpl::removePageOverlay):
+        (WebKit::WebViewImpl::setRootGraphicsLayer):
+        (WebKit::WebViewImpl::scheduleCompositingLayerSync):
+        (WebKit::WebViewImpl::scrollRootLayerRect):
+        (WebKit::WebViewImpl::invalidateRootLayerRect):
+        (WebKit::WebViewImpl::scheduleAnimation):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::createContext3D):
+        (WebKit::WebViewImpl::applyScrollAndScale):
+        (WebKit::WebViewImpl::didRebindGraphicsContext):
+        (WebKit::WebViewImpl::updateLayerTreeViewport):
+        (WebKit::WebViewImpl::graphicsContext3D):
+        (WebKit::WebViewImpl::setVisibilityState):
+        * src/WebViewImpl.h:
+        * tests/WebLayerTest.cpp:
+
+2012-02-24  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Plumb animation started notifications from CCLayerTreeHost to GraphicsLayerChromium
+        https://bugs.webkit.org/show_bug.cgi?id=77646
+
+        Reviewed by James Robinson.
+
+        * tests/CCLayerTreeHostTest.cpp:
+        (TestHooks):
+        (WTF::TestHooks::notifyAnimationStarted):
+        (WTF::TestHooks::notifyAnimationFinished):
+        (WTF::MockLayerTreeHost::create):
+        (WTF::CCLayerTreeHostTestAddAnimation::CCLayerTreeHostTestAddAnimation):
+        (WTF::CCLayerTreeHostTestAddAnimation::animateLayers):
+        (WTF::CCLayerTreeHostTestAddAnimation::notifyAnimationStarted):
+        (CCLayerTreeHostTestAddAnimation):
+        (WTF::CCLayerTreeHostTestAddAnimation::notifyAnimationFinished):
+
+2012-02-24  James Robinson  <jamesr@chromium.org>
+
+        [chromium] WebKit::setColorNames is a client API
+        https://bugs.webkit.org/show_bug.cgi?id=79539
+
+        Reviewed by Darin Fisher.
+
+        * WebKit.gyp:
+        * public/WebColorName.h: Renamed from Source/Platform/chromium/public/WebColorName.h.
+        (WebKit):
+        * public/platform/WebColorName.h:
+        * src/WebColor.cpp:
+
+2012-02-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108860.
+        http://trac.webkit.org/changeset/108860
+        https://bugs.webkit.org/show_bug.cgi?id=79544
+
+        "Breaks Linux compile" (Requested by enne on #webkit).
+
+        * WebKit.gyp:
+        * public/platform/WebColorName.h:
+        * src/WebColor.cpp: Renamed from Source/WebKit/chromium/src/WebColorName.cpp.
+        (WebKit):
+        (WebKit::toCSSValueKeyword):
+        (WebKit::setNamedColors):
+
+2012-02-24  James Robinson  <jamesr@chromium.org>
+
+        [chromium] WebKit::setColorNames is a client API
+        https://bugs.webkit.org/show_bug.cgi?id=79539
+
+        Reviewed by Darin Fisher.
+
+        * WebKit.gyp:
+        * public/WebColorName.h: Renamed from Source/Platform/chromium/public/WebColorName.h.
+        (WebKit):
+        * public/platform/WebColorName.h:
+        * src/WebColor.cpp:
+
+2012-02-22  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move WebGraphicsContext3D header into the Platform directory
+        https://bugs.webkit.org/show_bug.cgi?id=79301
+
+        Reviewed by Adam Barth.
+
+        Moves WebGraphicsContext3D and WebNonCopyable (which WGC3D depends on).
+
+        * public/platform/WebGraphicsContext3D.h:
+        * public/platform/WebNonCopyable.h:
+
+2012-02-24  Michal Mocny  <mmocny@google.com>
+
+        [chromium] Purge Skia's GPU texture cache using GL_CHROMIUM_gpu_memory_manager
+        https://bugs.webkit.org/show_bug.cgi?id=78265
+
+        Reviewed by Stephen White.
+
+        * src/GraphicsContext3DChromium.cpp:
+        (GrMemoryAllocationChangedCallback):
+        (WebCore::GrMemoryAllocationChangedCallback::GrMemoryAllocationChangedCallback):
+        (WebCore::GrMemoryAllocationChangedCallback::onGpuMemoryAllocationChanged):
+        (WebCore):
+        (WebCore::GraphicsContext3DPrivate::grContext):
+
+2012-02-24  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove deprecated and unused WebGraphicsContext3D::initialize call
+        https://bugs.webkit.org/show_bug.cgi?id=79296
+
+        Reviewed by Kenneth Russell.
+
+        The old way to initialize a WebGraphicsContext3D from inside WebKit was to call initialize() on it with a
+        WebView*. The new way to do this is via the WebViewClient interface. This deletes the old, unused path.
+
+        * public/platform/WebGraphicsContext3D.h:
+        (WebKit):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/FakeWebGraphicsContext3D.h:
+
+2012-02-23  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move Web*Layer* headers into Platform
+        https://bugs.webkit.org/show_bug.cgi?id=79425
+
+        Reviewed by Adam Barth.
+
+        Adds forwarding headers for Web*Layer* APIs and their dependencies.  The forwarding headers for the Web*Layer*
+        APIs are temporary since Web*Layer* is not exposed in the client interface.  The other headers (such as
+        WebColor) are exposed in both the client and platform APIs, so the forwarding headers are permanent, although we
+        might move them back down to public/ at some point.
+
+        * public/platform/WebCanvas.h:
+        * public/platform/WebColor.h:
+        * public/platform/WebColorName.h:
+        * public/platform/WebContentLayer.h:
+        * public/platform/WebContentLayerClient.h:
+        * public/platform/WebExternalTextureLayer.h:
+        * public/platform/WebLayer.h:
+        * public/platform/WebLayerTreeView.h:
+        * public/platform/WebLayerTreeViewClient.h:
+        * public/platform/WebPrivatePtr.h:
+        * public/platform/WebSolidColorLayer.h:
+
+2012-02-24  Peter Collingbourne  <peter@pcc.me.uk>
+
+        [chromium] Have WebFrameImpl::selectionAsMarkup create interchange markup.
+        https://bugs.webkit.org/show_bug.cgi?id=77307
+
+        Reviewed by Tony Chang.
+
+        This function is currently used to build markup in order to
+        print the selection, and will also be used to build markup for
+        the clipboard.  Without this change, the markup will refer to
+        (for example) nonexistent CSS classes and invalid relative
+        paths and therefore will not be interpreted correctly.
+
+        Chromium bug: http://crbug.com/23329
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::selectionAsMarkup):
+
+2012-02-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: chromium image for inspector status bar button updated.
+
+        * src/js/Images/segmentSelectedEndChromium.png:
+
 2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
 
         SpellCheckRequest needs to know the context where the spellcheck happened.
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index ba422445c..23e521aa7 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '123353'
+  'chromium_rev': '125600'
 }
 
 deps = {
@@ -145,8 +145,6 @@ deps_os = {
   'win': {
     'third_party/cygwin':
       From('chromium_deps', 'src/third_party/cygwin'),
-    'third_party/ffmpeg/binaries/chromium/win/ia32':
-      From('chromium_deps', 'src/third_party/ffmpeg/binaries/chromium/win/ia32'),
     'third_party/lighttpd':
       From('chromium_deps', 'src/third_party/lighttpd'),
     'third_party/nss':
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index f8e58b383..1e1a41665 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -112,6 +112,7 @@
                 'public/WebCache.h',
                 'public/WebColorChooser.h',
                 'public/WebColorChooserClient.h',
+                'public/WebColorName.h',
                 'public/WebCommonWorkerClient.h',
                 'public/WebCompositionUnderline.h',
                 'public/WebCompositor.h',
@@ -214,6 +215,7 @@
                 'public/WebNotificationPresenter.h',
                 'public/WebOptionElement.h',
                 'public/WebPageOverlay.h',
+                'public/WebPagePopup.h',
                 'public/WebPageSerializer.h',
                 'public/WebPageSerializerClient.h',
                 'public/WebPageVisibilityState.h',
@@ -292,7 +294,6 @@
                 'public/platform/WebCanvas.h',
                 'public/platform/WebClipboard.h',
                 'public/platform/WebColor.h',
-                'public/platform/WebColorName.h',
                 'public/platform/WebCommon.h',
                 'public/platform/WebContentLayer.h',
                 'public/platform/WebContentLayerClient.h',
@@ -494,9 +495,9 @@
                 'src/WebBlob.cpp',
                 'src/WebBlobData.cpp',
                 'src/WebCache.cpp',
-                'src/WebColor.cpp',
                 'src/WebColorChooserClientImpl.cpp',
                 'src/WebColorChooserClientImpl.h',
+                'src/WebColorName.cpp',
                 'src/WebCommon.cpp',
                 'src/WebCompositorImpl.cpp',
                 'src/WebCompositorImpl.h',
@@ -615,6 +616,7 @@
                 'src/WebNodeList.cpp',
                 'src/WebNotification.cpp',
                 'src/WebOptionElement.cpp',
+                'src/WebPagePopupImpl.cpp',
                 'src/WebPageSerializer.cpp',
                 'src/WebPageSerializerImpl.cpp',
                 'src/WebPageSerializerImpl.h',
@@ -824,20 +826,13 @@
                         ['exclude', '/android/'],
                     ],
                 }],
+                # TODO: we exclude CG.cpp on both sides of the below conditional. Move elsewhere?
                 ['OS=="mac"', {
                     'include_dirs': [
                         'public/mac',
                     ],
-                    'conditions': [
-                        ['use_skia==0', {
-                            'sources/': [
-                                ['exclude', 'Skia\\.cpp$'],
-                            ],
-                        },{ # use_skia
-                            'sources/': [
-                                ['exclude', 'CG\\.cpp$'],
-                            ],
-                        }],
+                    'sources/': [
+                        ['exclude', 'CG\\.cpp$'],
                     ],
                 }, { # else: OS!="mac"
                     'sources/': [
diff --git a/Source/WebKit/chromium/WebKit.gypi b/Source/WebKit/chromium/WebKit.gypi
index e91e336db..87d41bfb9 100644
--- a/Source/WebKit/chromium/WebKit.gypi
+++ b/Source/WebKit/chromium/WebKit.gypi
@@ -92,6 +92,7 @@
             'tests/ClipboardChromiumTest.cpp',
             'tests/CompositorFakeGraphicsContext3D.h',
             'tests/CompositorFakeWebGraphicsContext3D.h',
+            'tests/DragImageTest.cpp',
             'tests/FakeCCLayerTreeHostClient.h',
             'tests/FakeGraphicsContext3DTest.cpp',
             'tests/FakeWebGraphicsContext3D.h',
@@ -101,15 +102,20 @@
             'tests/IDBBindingUtilitiesTest.cpp',
             'tests/IDBKeyPathTest.cpp',
             'tests/IDBLevelDBCodingTest.cpp',
+            'tests/ImageLayerChromiumTest.cpp',
             'tests/KeyboardTest.cpp',
             'tests/KURLTest.cpp',
             'tests/LayerChromiumTest.cpp',
             'tests/LayerTextureUpdaterTest.cpp',
+            'tests/LocalizedNumberICUTest.cpp',
             'tests/PaintAggregatorTest.cpp',
+            'tests/PlatformGestureCurveTest.cpp',
+            'tests/PlatformContextSkiaTest.cpp',
             'tests/PODArenaTest.cpp',
             'tests/PODIntervalTreeTest.cpp',
             'tests/PODRedBlackTreeTest.cpp',
             'tests/RenderTableCellTest.cpp',
+            'tests/ScrollbarLayerChromiumTest.cpp',
             'tests/TextureManagerTest.cpp',
             'tests/TiledLayerChromiumTest.cpp',
             'tests/TilingDataTest.cpp',
@@ -131,13 +137,6 @@
         ],
 
         'conditions': [
-            ['use_skia == 1', {
-                'webkit_unittest_files': [
-                    'tests/DragImageTest.cpp',
-                    'tests/ImageLayerChromiumTest.cpp',
-                    'tests/PlatformContextSkiaTest.cpp',
-                ],
-            }],
             ['OS=="win"', {
                 'webkit_unittest_files': [
                     # FIXME: Port PopupMenuTest to Linux and Mac.
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index 4c46d4de4..5a033c8cf 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -63,6 +63,7 @@
       'ENABLE_INPUT_TYPE_WEEK=0',
       'ENABLE_JAVASCRIPT_DEBUGGER=1',
       'ENABLE_JAVASCRIPT_I18N_API=1',
+      'ENABLE_LEGACY_NOTIFICATIONS=1',
       'ENABLE_LINK_PREFETCH=1',
       'ENABLE_MEDIA_SOURCE=1',
       'ENABLE_MEDIA_STATISTICS=1',
@@ -81,6 +82,7 @@
       'ENABLE_REQUEST_ANIMATION_FRAME=1',
       'ENABLE_RUBY=1',
       'ENABLE_SANDBOX=1',
+      'ENABLE_SCRIPTED_SPEECH=1',
       'ENABLE_SHADOW_DOM=1',
       'ENABLE_SHARED_WORKERS=1',
       'ENABLE_SMOOTH_SCROLLING=1',
@@ -106,6 +108,7 @@
       # We can't define it here because it should be present only
       # in Debug or release_valgrind_build=1 builds.
       'WTF_USE_OPENTYPE_SANITIZER=1',
+      'WTF_USE_RTL_SCROLLBAR=1',
       'WTF_USE_SKIA_TEXT=<(enable_skia_text)',
       'WTF_USE_WEBP=1',
       'WTF_USE_WEBKIT_IMAGE_DECODERS=1',
@@ -118,7 +121,6 @@
       'enable_svg%': 1,
       'enable_viewport%': 0,
       'enable_touch_events%': 1,
-      'use_skia%': 0,
       'enable_touch_icon_loading%' : 0,
       'enable_mutation_observers%': 1,
     },
@@ -126,7 +128,6 @@
     'enable_skia_text%': '<(enable_skia_text)',
     'enable_svg%': '<(enable_svg)',
     'enable_touch_events%': '<(enable_touch_events)',
-    'use_skia%': '<(use_skia)',
     'conditions': [
       ['OS=="android"', {
         'feature_defines': [
@@ -143,7 +144,7 @@
           'ENABLE_3D_RENDERING=1',
         ],
       }],
-      ['use_accelerated_compositing==1 and (OS!="mac" or use_skia==1)', {
+      ['use_accelerated_compositing==1', {
         'feature_defines': [
           'ENABLE_ACCELERATED_2D_CANVAS=1',
         ],
@@ -153,7 +154,6 @@
         'feature_defines': [
           'WTF_USE_WEBAUDIO_FFMPEG=1',
         ],
-        'use_skia%': 1,
       }],
       ['enable_register_protocol_handler==1', {
         'feature_defines': [
@@ -168,7 +168,7 @@
       ['OS=="mac"', {
         'feature_defines': [
           'ENABLE_RUBBER_BANDING=1',
-          'WTF_USE_SKIA_ON_MAC_CHROMIUM=<(use_skia)',
+          'WTF_USE_SKIA_ON_MAC_CHROMIUM=1',
         ],
       }],
     ],
diff --git a/Source/WebKit/chromium/public/WebColorName.h b/Source/WebKit/chromium/public/WebColorName.h
new file mode 100644
index 000000000..698f7ce60
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebColorName.h
@@ -0,0 +1,77 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef WebColorName_h
+#define WebColorName_h
+
+#include "platform/WebColor.h"
+#include "platform/WebCommon.h"
+
+namespace WebKit {
+
+enum WebColorName {
+    WebColorActiveBorder,
+    WebColorActiveCaption,
+    WebColorAppworkspace,
+    WebColorBackground,
+    WebColorButtonFace,
+    WebColorButtonHighlight,
+    WebColorButtonShadow,
+    WebColorButtonText,
+    WebColorCaptionText,
+    WebColorGrayText,
+    WebColorHighlight,
+    WebColorHighlightText,
+    WebColorInactiveBorder,
+    WebColorInactiveCaption,
+    WebColorInactiveCaptionText,
+    WebColorInfoBackground,
+    WebColorInfoText,
+    WebColorMenu,
+    WebColorMenuText,
+    WebColorScrollbar,
+    WebColorText,
+    WebColorThreedDarkShadow,
+    WebColorThreedShadow,
+    WebColorThreedFace,
+    WebColorThreedHighlight,
+    WebColorThreedLightShadow,
+    WebColorWebkitFocusRingColor,
+    WebColorWindow,
+    WebColorWindowFrame,
+    WebColorWindowText
+};
+
+// Sets the values of a set of named colors.
+WEBKIT_EXPORT void setNamedColors(const WebColorName*, const WebColor*, size_t length);
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebCommonWorkerClient.h b/Source/WebKit/chromium/public/WebCommonWorkerClient.h
index 2ffb54d57..2d87c1401 100644
--- a/Source/WebKit/chromium/public/WebCommonWorkerClient.h
+++ b/Source/WebKit/chromium/public/WebCommonWorkerClient.h
@@ -47,13 +47,28 @@ class WebWorkerClient;
 class WebCommonWorkerClient {
 public:
     // Called on the main webkit thread before opening a web database.
-    virtual bool allowDatabase(WebFrame*, const WebString& name, const WebString& displayName, unsigned long estimatedSize) = 0;
+    virtual bool allowDatabase(WebFrame*, const WebString& name, const WebString& displayName, unsigned long estimatedSize)
+    {
+        return true;
+    }
 
     // Called on the main webkit thread before opening a file system.
-    virtual bool allowFileSystem() = 0;
+    virtual bool allowFileSystem()
+    {
+        return true;
+    }
 
     // Called on the main webkit thread before opening a file system.
-    virtual void openFileSystem(WebFileSystem::Type, long long size, bool create, WebFileSystemCallbacks*) = 0;
+    virtual void openFileSystem(WebFileSystem::Type, long long size, bool create, WebFileSystemCallbacks*)
+    {
+        WEBKIT_ASSERT_NOT_REACHED();
+    }
+
+    // Called on the main webkit thread before opening an indexed database.
+    virtual bool allowIndexedDB(const WebString& name)
+    {
+        return true;
+    }
 };
 
 
diff --git a/Source/WebKit/chromium/public/WebDataSource.h b/Source/WebKit/chromium/public/WebDataSource.h
index 07b63490c..77d6e78dc 100644
--- a/Source/WebKit/chromium/public/WebDataSource.h
+++ b/Source/WebKit/chromium/public/WebDataSource.h
@@ -103,6 +103,14 @@ public:
     // testing.
     virtual void setDeferMainResourceDataLoad(bool) = 0;
 
+    // Sets the navigation start time for this datasource. Ordinarily,
+    // navigation start is determined in WebCore. But, in some situations,
+    // the embedder might have a better value and can override it here. This
+    // should be called before WebFrameClient::didCommitProvisionalLoad.
+    // Calling it later may confuse users, because JavaScript may have run and
+    // the user may have already recorded the original value.
+    virtual void setNavigationStartTime(double) = 0;
+
 protected:
     ~WebDataSource() { }
 };
diff --git a/Source/WebKit/chromium/public/WebFrameClient.h b/Source/WebKit/chromium/public/WebFrameClient.h
index d0507e3d1..fa6fc7a33 100644
--- a/Source/WebKit/chromium/public/WebFrameClient.h
+++ b/Source/WebKit/chromium/public/WebFrameClient.h
@@ -297,7 +297,7 @@ public:
     // Notifies that a new script context has been created for this frame.
     // This is similar to didClearWindowObject but only called once per
     // frame context.
-    virtual void didCreateScriptContext(WebFrame*, v8::Handle<v8::Context>, int worldId) { }
+    virtual void didCreateScriptContext(WebFrame*, v8::Handle<v8::Context>, int extensionGroup, int worldId) { }
 
     // WebKit is about to release its reference to a v8 context for a frame.
     virtual void willReleaseScriptContext(WebFrame*, v8::Handle<v8::Context>, int worldId) { }
diff --git a/Source/WebKit/chromium/public/WebOptionElement.h b/Source/WebKit/chromium/public/WebOptionElement.h
index 3d9390b71..d58ccb4e3 100644
--- a/Source/WebKit/chromium/public/WebOptionElement.h
+++ b/Source/WebKit/chromium/public/WebOptionElement.h
@@ -31,7 +31,7 @@
 #ifndef WebOptionElement_h
 #define WebOptionElement_h
 
-#include "WebFormControlElement.h"
+#include "WebElement.h"
 #include "platform/WebVector.h"
 
 #if WEBKIT_IMPLEMENTATION
@@ -41,17 +41,17 @@ namespace WebCore { class HTMLOptionElement; }
 namespace WebKit {
 
 // Provides readonly access to some properties of a DOM option element node.
-class WebOptionElement : public WebFormControlElement {
+class WebOptionElement : public WebElement {
 public:
-    WebOptionElement() : WebFormControlElement() { }
-    WebOptionElement(const WebOptionElement& element) : WebFormControlElement(element) { }
+    WebOptionElement() : WebElement() { }
+    WebOptionElement(const WebOptionElement& element) : WebElement(element) { }
 
     WebOptionElement& operator=(const WebOptionElement& element)
     {
-        WebFormControlElement::assign(element);
+        WebElement::assign(element);
         return *this;
     }
-    void assign(const WebOptionElement& element) { WebFormControlElement::assign(element); }
+    void assign(const WebOptionElement& element) { WebElement::assign(element); }
 
     WEBKIT_EXPORT void setValue(const WebString&);
     WEBKIT_EXPORT WebString value() const;
diff --git a/Source/WebKit/chromium/public/WebPagePopup.h b/Source/WebKit/chromium/public/WebPagePopup.h
new file mode 100644
index 000000000..d8ab18773
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebPagePopup.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPagePopup_h
+#define WebPagePopup_h
+
+#include "WebWidget.h"
+#include "platform/WebCommon.h"
+
+namespace WebKit {
+
+class WebWidgetClient;
+
+class WebPagePopup : public WebWidget {
+public:
+    WEBKIT_EXPORT static WebPagePopup* create(WebWidgetClient*);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebPluginContainer.h b/Source/WebKit/chromium/public/WebPluginContainer.h
index 845cb1a28..777431fb0 100644
--- a/Source/WebKit/chromium/public/WebPluginContainer.h
+++ b/Source/WebKit/chromium/public/WebPluginContainer.h
@@ -100,6 +100,9 @@ public:
     // Notifies that the zoom level has changed.
     virtual void zoomLevelChanged(double zoomLevel) = 0;
 
+    // Notifies whether the contents of the plugin are entirely opaque.
+    virtual void setOpaque(bool) = 0;
+
     // Determines whether the given rectangle in this plugin is above all other
     // content. The rectangle is in the plugin's coordinate system.
     virtual bool isRectTopmost(const WebRect&) = 0;
diff --git a/Source/WebKit/chromium/public/WebPopupType.h b/Source/WebKit/chromium/public/WebPopupType.h
index 8a546bae4..2d0e8e4d2 100644
--- a/Source/WebKit/chromium/public/WebPopupType.h
+++ b/Source/WebKit/chromium/public/WebPopupType.h
@@ -35,8 +35,9 @@ namespace WebKit {
 
 enum WebPopupType {
     WebPopupTypeNone, // Not a popup.
-    WebPopupTypeSelect, // A HTML select (combo-box) popup.
+    WebPopupTypeSelect, // An HTML select (combo-box) popup.
     WebPopupTypeSuggestion, // An autofill/autocomplete popup.
+    WebPopupTypePage, // An HTML-capable popup.
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/public/WebRuntimeFeatures.h b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
index 34e3947f6..187ef0f55 100644
--- a/Source/WebKit/chromium/public/WebRuntimeFeatures.h
+++ b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
@@ -91,6 +91,9 @@ public:
     WEBKIT_EXPORT static void enableSpeechInput(bool);
     WEBKIT_EXPORT static bool isSpeechInputEnabled();
 
+    WEBKIT_EXPORT static void enableScriptedSpeech(bool);
+    WEBKIT_EXPORT static bool isScriptedSpeechEnabled();
+
     WEBKIT_EXPORT static void enableXHRResponseBlob(bool);
     WEBKIT_EXPORT static bool isXHRResponseBlobEnabled();
 
diff --git a/Source/WebKit/chromium/public/WebSettings.h b/Source/WebKit/chromium/public/WebSettings.h
index 7f1bbb0c4..47aaeece0 100644
--- a/Source/WebKit/chromium/public/WebSettings.h
+++ b/Source/WebKit/chromium/public/WebSettings.h
@@ -62,6 +62,7 @@ public:
     virtual void setDefaultFixedFontSize(int) = 0;
     virtual void setMinimumFontSize(int) = 0;
     virtual void setMinimumLogicalFontSize(int) = 0;
+    virtual void setDefaultDeviceScaleFactor(int) = 0;
     virtual void setDefaultTextEncodingName(const WebString&) = 0;
     virtual void setJavaScriptEnabled(bool) = 0;
     virtual void setWebSecurityEnabled(bool) = 0;
diff --git a/Source/WebKit/chromium/public/WebSharedWorkerClient.h b/Source/WebKit/chromium/public/WebSharedWorkerClient.h
index a085a3ea2..4a2b8732f 100644
--- a/Source/WebKit/chromium/public/WebSharedWorkerClient.h
+++ b/Source/WebKit/chromium/public/WebSharedWorkerClient.h
@@ -79,21 +79,6 @@ public:
     // Called on the main webkit thread in the worker process during initialization.
     virtual WebApplicationCacheHost* createApplicationCacheHost(WebApplicationCacheHostClient*) = 0;
 
-    // Called on the main webkit thread before opening a web database.
-    virtual bool allowDatabase(WebFrame*, const WebString& name, const WebString& displayName, unsigned long estimatedSize) = 0;
-
-    // Called on the main webkit thread before opening a file system.
-    virtual bool allowFileSystem()
-    {
-        return true;
-    }
-
-    // Called on the main webkit thread before opening a file system.
-    virtual void openFileSystem(WebFileSystem::Type, long long size, bool create, WebFileSystemCallbacks*)
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-    }
-
     virtual void dispatchDevToolsMessage(const WebString&) { }
     virtual void saveDevToolsAgentState(const WebString&) { }
 
diff --git a/Source/WebKit/chromium/public/WebSocket.h b/Source/WebKit/chromium/public/WebSocket.h
index c10c372ad..f2a140cfa 100644
--- a/Source/WebKit/chromium/public/WebSocket.h
+++ b/Source/WebKit/chromium/public/WebSocket.h
@@ -80,6 +80,7 @@ public:
 
     virtual void connect(const WebURL&, const WebString& protocol) = 0;
     virtual WebString subprotocol() = 0;
+    virtual WebString extensions() = 0;
     virtual bool sendText(const WebString&) = 0;
     virtual bool sendArrayBuffer(const WebArrayBuffer&) = 0;
     virtual unsigned long bufferedAmount() const = 0;
diff --git a/Source/WebKit/chromium/public/WebView.h b/Source/WebKit/chromium/public/WebView.h
index ed853e23a..50cf2eaa0 100644
--- a/Source/WebKit/chromium/public/WebView.h
+++ b/Source/WebKit/chromium/public/WebView.h
@@ -260,10 +260,17 @@ public:
     // In auto-resize mode, the view is automatically adjusted to fit the html
     // content within the given bounds.
     virtual void enableAutoResizeMode(
-        bool enable,
         const WebSize& minSize,
         const WebSize& maxSize) = 0;
 
+    // Turn off auto-resize.
+    virtual void disableAutoResizeMode() = 0;
+
+    // DEPRECATED
+    virtual void enableAutoResizeMode(
+        bool enable,
+        const WebSize& minSize,
+        const WebSize& maxSize) = 0;
 
     // Media ---------------------------------------------------------------
 
@@ -423,6 +430,10 @@ public:
     // APIs.
     virtual WebGraphicsContext3D* graphicsContext3D() = 0;
 
+    // Context that's in the compositor's share group, but is not the compositor context itself.
+    // Can be used for allocating resources that the compositor will later access.
+    virtual WebGraphicsContext3D* sharedGraphicsContext3D() = 0;
+
     // Visibility -----------------------------------------------------------
 
     // Sets the visibility of the WebView.
diff --git a/Source/WebKit/chromium/public/WebViewClient.h b/Source/WebKit/chromium/public/WebViewClient.h
index b656fd5ad..b2c0e5665 100644
--- a/Source/WebKit/chromium/public/WebViewClient.h
+++ b/Source/WebKit/chromium/public/WebViewClient.h
@@ -93,10 +93,13 @@ public:
     // WebStorage specification.
     // The request parameter is only for the client to check if the request
     // could be fulfilled.  The client should not load the request.
+    // The policy parameter indicates how the new view will be displayed in
+    // WebWidgetClient::show.
     virtual WebView* createView(WebFrame* creator,
                                 const WebURLRequest& request,
                                 const WebWindowFeatures& features,
-                                const WebString& name) {
+                                const WebString& name,
+                                WebNavigationPolicy policy) {
         return 0;
     }
 
@@ -110,10 +113,10 @@ public:
     // Create a session storage namespace object associated with this WebView.
     virtual WebStorageNamespace* createSessionStorageNamespace(unsigned quota) { return 0; }
 
-    // Creates a graphics context associated with the client's WebView.
-    // renderDirectlyToWebView means whether the context should be setup to
-    // render directly to the WebView (e.g. compositor context), or to an
-    // offscreen surface (e.g. WebGL context).
+    // Creates a graphics context that renders to the client's WebView.
+    virtual WebGraphicsContext3D* createGraphicsContext3D(const WebGraphicsContext3D::Attributes&) { return 0; }
+
+    // Deprecated, use the first version of this function. If you want an offscreen context, use WebKitPlatformSupport::createOffscreenGraphicsContext3D().
     virtual WebGraphicsContext3D* createGraphicsContext3D(const WebGraphicsContext3D::Attributes&, bool renderDirectlyToWebView) { return 0; }
 
     // Misc ----------------------------------------------------------------
diff --git a/Source/WebKit/chromium/public/WebWidget.h b/Source/WebKit/chromium/public/WebWidget.h
index 58f3fa169..e9712d743 100644
--- a/Source/WebKit/chromium/public/WebWidget.h
+++ b/Source/WebKit/chromium/public/WebWidget.h
@@ -192,6 +192,10 @@ public:
     // rect.)
     virtual void didChangeWindowResizerRect() { }
 
+    // Instrumentation method that marks beginning of frame update that includes
+    // things like animate()/layout()/paint()/composite().
+    virtual void instrumentBeginFrame() { }
+
 protected:
     ~WebWidget() { }
 };
diff --git a/Source/WebKit/chromium/public/platform/WebCanvas.h b/Source/WebKit/chromium/public/platform/WebCanvas.h
index 4cf729ee1..ba2a7189d 100644
--- a/Source/WebKit/chromium/public/platform/WebCanvas.h
+++ b/Source/WebKit/chromium/public/platform/WebCanvas.h
@@ -1,54 +1,26 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
+ * modification, are permitted provided that the following conditions
+ * are met:
  *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCanvas_h
-#define WebCanvas_h
-
-#include "WebCommon.h"
-
-#if WEBKIT_USING_SKIA
-class SkCanvas;
-#elif WEBKIT_USING_CG
-struct CGContext;
-#endif
-
-namespace WebKit {
-
-#if WEBKIT_USING_SKIA
-typedef SkCanvas WebCanvas;
-#elif WEBKIT_USING_CG
-typedef struct CGContext WebCanvas;
-#else
-#error "Need to define WebCanvas"
-#endif
-
-} // namespace WebKit
-
-#endif
+#include "../../../../Platform/chromium/public/WebCanvas.h"
diff --git a/Source/WebKit/chromium/public/platform/WebColor.h b/Source/WebKit/chromium/public/platform/WebColor.h
index da45eb1c6..65677dae9 100644
--- a/Source/WebKit/chromium/public/platform/WebColor.h
+++ b/Source/WebKit/chromium/public/platform/WebColor.h
@@ -1,46 +1,26 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
+ * modification, are permitted provided that the following conditions
+ * are met:
  *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebColor_h
-#define WebColor_h
-
-#include "WebColorName.h"
-#include "WebCommon.h"
-
-namespace WebKit {
-
-typedef unsigned WebColor;  // RGBA quad. Equivalent to SkColor.
-
-// Sets the values of a set of named colors.
-WEBKIT_EXPORT void setNamedColors(const WebColorName*, const WebColor*, size_t length);
-
-} // namespace WebKit
-
-#endif
+#include "../../../../Platform/chromium/public/WebColor.h"
diff --git a/Source/WebKit/chromium/public/platform/WebColorName.h b/Source/WebKit/chromium/public/platform/WebColorName.h
index f97ed265f..c3a8afedd 100644
--- a/Source/WebKit/chromium/public/platform/WebColorName.h
+++ b/Source/WebKit/chromium/public/platform/WebColorName.h
@@ -1,71 +1,29 @@
 /*
-* Copyright (C) 2009 Google Inc. All rights reserved.
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions are
-* met:
-*
-*     * Redistributions of source code must retain the above copyright
-* notice, this list of conditions and the following disclaimer.
-*     * Redistributions in binary form must reproduce the above
-* copyright notice, this list of conditions and the following disclaimer
-* in the documentation and/or other materials provided with the
-* distribution.
-*     * Neither the name of Google Inc. nor the names of its
-* contributors may be used to endorse or promote products derived from
-* this software without specific prior written permission.
-*
-* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
 
-#ifndef WebColorName_h
-#define WebColorName_h
+// FIXME: This is logically part of the WebKit client API and doesn't belong in platform. This is a forwarding header to avoid requiring a two-sided commit.
+// As soon as all chromium code is updated for the new location of this header, remove this.
 
-namespace WebKit {
-
-enum WebColorName {
-    WebColorActiveBorder,
-    WebColorActiveCaption,
-    WebColorAppworkspace,
-    WebColorBackground,
-    WebColorButtonFace,
-    WebColorButtonHighlight,
-    WebColorButtonShadow,
-    WebColorButtonText,
-    WebColorCaptionText,
-    WebColorGrayText,
-    WebColorHighlight,
-    WebColorHighlightText,
-    WebColorInactiveBorder,
-    WebColorInactiveCaption,
-    WebColorInactiveCaptionText,
-    WebColorInfoBackground,
-    WebColorInfoText,
-    WebColorMenu,
-    WebColorMenuText,
-    WebColorScrollbar,
-    WebColorText,
-    WebColorThreedDarkShadow,
-    WebColorThreedShadow,
-    WebColorThreedFace,
-    WebColorThreedHighlight,
-    WebColorThreedLightShadow,
-    WebColorWebkitFocusRingColor,
-    WebColorWindow,
-    WebColorWindowFrame,
-    WebColorWindowText
-};
-
-}  // namespace WebKit
-
-#endif
+#include "../WebColorName.h"
diff --git a/Source/WebKit/chromium/public/platform/WebContentLayer.h b/Source/WebKit/chromium/public/platform/WebContentLayer.h
index 6d7f91483..90a16ed91 100644
--- a/Source/WebKit/chromium/public/platform/WebContentLayer.h
+++ b/Source/WebKit/chromium/public/platform/WebContentLayer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,49 +23,4 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebContentLayer_h
-#define WebContentLayer_h
-
-#include "WebCommon.h"
-#include "WebLayer.h"
-
-namespace WebKit {
-class WebContentLayerClient;
-class WebContentLayerImpl;
-struct WebFloatRect;
-
-class WebContentLayer : public WebLayer {
-public:
-    WEBKIT_EXPORT static WebContentLayer create(WebContentLayerClient*);
-
-    WebContentLayer() { }
-    WebContentLayer(const WebContentLayer& layer) : WebLayer(layer) { }
-    virtual ~WebContentLayer() { }
-    WebContentLayer& operator=(const WebContentLayer& layer)
-    {
-        WebLayer::assign(layer);
-        return *this;
-    }
-
-    // Sets whether the layer draws its content when compositing.
-    WEBKIT_EXPORT void setDrawsContent(bool);
-    WEBKIT_EXPORT bool drawsContent() const;
-
-    // Sets a region of the layer as invalid, i.e. needs to update its content.
-    // The visible area of the dirty rect will be passed to one or more calls to
-    // WebContentLayerClient::paintContents before the compositing pass occurs.
-    WEBKIT_EXPORT void invalidateRect(const WebFloatRect&);
-
-    // Sets the entire layer as invalid, i.e. needs to update its content.
-    WEBKIT_EXPORT void invalidate();
-
-#if WEBKIT_IMPLEMENTATION
-    WebContentLayer(const WTF::PassRefPtr<WebContentLayerImpl>&);
-    WebContentLayer& operator=(const WTF::PassRefPtr<WebContentLayerImpl>&);
-    operator WTF::PassRefPtr<WebContentLayerImpl>() const;
-#endif
-};
-
-} // namespace WebKit
-
-#endif // WebContentLayer_h
+#include "../../../../Platform/chromium/public/WebContentLayer.h"
diff --git a/Source/WebKit/chromium/public/platform/WebContentLayerClient.h b/Source/WebKit/chromium/public/platform/WebContentLayerClient.h
index deb36e077..8f1ca3324 100644
--- a/Source/WebKit/chromium/public/platform/WebContentLayerClient.h
+++ b/Source/WebKit/chromium/public/platform/WebContentLayerClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,26 +23,4 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebContentLayerClient_h
-#define WebContentLayerClient_h
-
-#include "WebCanvas.h"
-
-namespace WebKit {
-struct WebRect;
-
-class WebContentLayerClient {
-public:
-    // Paints the content area for the layer, typically dirty rects submitted
-    // through WebContentLayer::setNeedsDisplay, submitting drawing commands
-    // through the WebCanvas.
-    // The canvas is already clipped to the |clip| rect.
-    virtual void paintContents(WebCanvas*, const WebRect& clip) = 0;
-
-protected:
-    virtual ~WebContentLayerClient() { }
-};
-
-} // namespace WebKit
-
-#endif // WebContentLayerClient_h
+#include "../../../../Platform/chromium/public/WebContentLayerClient.h"
diff --git a/Source/WebKit/chromium/public/platform/WebExternalTextureLayer.h b/Source/WebKit/chromium/public/platform/WebExternalTextureLayer.h
index ce87bb238..000826df7 100644
--- a/Source/WebKit/chromium/public/platform/WebExternalTextureLayer.h
+++ b/Source/WebKit/chromium/public/platform/WebExternalTextureLayer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,61 +23,4 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebExternalTextureLayer_h
-#define WebExternalTextureLayer_h
-
-#include "WebCommon.h"
-#include "WebFloatRect.h"
-#include "WebLayer.h"
-
-namespace WebKit {
-class WebExternalTextureLayerImpl;
-
-// This class represents a layer that renders a texture that is generated
-// externally (not managed by the WebLayerTreeView).
-// The texture will be used by the WebLayerTreeView during compositing passes.
-// When in single-thread mode, this means during WebLayerTreeView::composite().
-// When using the threaded compositor, this can mean at an arbitrary time until
-// the WebLayerTreeView is destroyed.
-class WebExternalTextureLayer : public WebLayer {
-public:
-    WEBKIT_EXPORT static WebExternalTextureLayer create();
-
-    WebExternalTextureLayer() { }
-    WebExternalTextureLayer(const WebExternalTextureLayer& layer) : WebLayer(layer) { }
-    virtual ~WebExternalTextureLayer() { }
-    WebExternalTextureLayer& operator=(const WebExternalTextureLayer& layer)
-    {
-        WebLayer::assign(layer);
-        return *this;
-    }
-
-    // Sets the texture id that represents the layer, in the namespace of the
-    // compositor context.
-    WEBKIT_EXPORT void setTextureId(unsigned);
-    WEBKIT_EXPORT unsigned textureId() const;
-
-    // Sets whether or not the texture should be flipped in the Y direction when
-    // rendered.
-    WEBKIT_EXPORT void setFlipped(bool);
-    WEBKIT_EXPORT bool flipped() const;
-
-    // Sets the rect in UV space of the texture that is mapped to the layer
-    // bounds.
-    WEBKIT_EXPORT void setUVRect(const WebFloatRect&);
-    WEBKIT_EXPORT WebFloatRect uvRect() const;
-
-    // Marks a region of the layer as needing a display. These regions are
-    // collected in a union until the display occurs.
-    WEBKIT_EXPORT void invalidateRect(const WebFloatRect&);
-
-#if WEBKIT_IMPLEMENTATION
-    WebExternalTextureLayer(const WTF::PassRefPtr<WebExternalTextureLayerImpl>&);
-    WebExternalTextureLayer& operator=(const WTF::PassRefPtr<WebExternalTextureLayerImpl>&);
-    operator WTF::PassRefPtr<WebExternalTextureLayerImpl>() const;
-#endif
-};
-
-} // namespace WebKit
-
-#endif // WebExternalTextureLayer_h
+#include "../../../../Platform/chromium/public/WebExternalTextureLayer.h"
diff --git a/Source/WebKit/chromium/public/platform/WebFileSystem.h b/Source/WebKit/chromium/public/platform/WebFileSystem.h
index 583efe07c..2562ef1c3 100644
--- a/Source/WebKit/chromium/public/platform/WebFileSystem.h
+++ b/Source/WebKit/chromium/public/platform/WebFileSystem.h
@@ -71,6 +71,7 @@ public:
     virtual void removeRecursively(const WebURL& path, WebFileSystemCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
 
     // Retrieves the metadata information of the file or directory at the given |path|.
+    // This may not always return the local platform path in remote filesystem cases.
     // WebFileSystemCallbacks::didReadMetadata() must be called with a valid metadata when the retrieval is completed successfully.
     // WebFileSystemCallbacks::didFail() must be called otherwise.
     virtual void readMetadata(const WebURL& path, WebFileSystemCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
@@ -114,6 +115,15 @@ public:
     // This is a fast, synchronous call, and should not stat the filesystem.
     virtual WebFileWriter* createFileWriter(const WebURL& path, WebFileWriterClient*) { WEBKIT_ASSERT_NOT_REACHED(); return 0; }
 
+    // Creates a snapshot file for a given file specified by |path| and registers the file with the |blobURL|. It returns the metadata of the created snapshot file.
+    // The returned metadata should include a local platform path to the snapshot image.
+    // In local filesystem cases the backend may simply return the metadata of the file itself (as well as readMetadata does), while in remote filesystem case the backend may download the file into a temporary snapshot file and return the metadata of the temporary file.
+    // The returned metadata is used to create a File object for the |path|.
+    // The snapshot file is supposed to be deleted when the last reference to the |blobURL| is dropped.
+    // WebFileSystemCallbacks::didReadMetadata() with the metadata of the snapshot file must be called when the operation is completed successfully.
+    // WebFileSystemCallbacks::didFail() must be called otherwise.
+    virtual void createSnapshotFileAndReadMetadata(const WebURL& blobURL, const WebURL& path, WebFileSystemCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
+
 protected:
     virtual ~WebFileSystem() { }
 };
diff --git a/Source/WebKit/chromium/public/platform/WebGraphicsContext3D.h b/Source/WebKit/chromium/public/platform/WebGraphicsContext3D.h
index f13f7c44d..876b5d9bb 100644
--- a/Source/WebKit/chromium/public/platform/WebGraphicsContext3D.h
+++ b/Source/WebKit/chromium/public/platform/WebGraphicsContext3D.h
@@ -1,421 +1,26 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
+ * modification, are permitted provided that the following conditions
+ * are met:
  *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebGraphicsContext3D_h
-#define WebGraphicsContext3D_h
-
-#include "WebCommon.h"
-#include "WebNonCopyable.h"
-#include "WebString.h"
-
-#define USE_WGC3D_TYPES
-
-#if WEBKIT_USING_SKIA
-struct GrGLInterface;
-#endif
-
-namespace WebKit {
-
-// WGC3D types match the corresponding GL types as defined in OpenGL ES 2.0
-// header file gl2.h from khronos.org.
-typedef char WGC3Dchar;
-typedef unsigned int WGC3Denum;
-typedef unsigned char WGC3Dboolean;
-typedef unsigned int WGC3Dbitfield;
-typedef signed char WGC3Dbyte;
-typedef unsigned char WGC3Dubyte;
-typedef short WGC3Dshort;
-typedef unsigned short WGC3Dushort;
-typedef int WGC3Dint;
-typedef int WGC3Dsizei;
-typedef unsigned int WGC3Duint;
-typedef float WGC3Dfloat;
-typedef float WGC3Dclampf;
-typedef signed long int WGC3Dintptr;
-typedef signed long int WGC3Dsizeiptr;
-
-// Typedef for server-side objects like OpenGL textures and program objects.
-typedef WGC3Duint WebGLId;
-
-// FIXME: We shouldn't mention WebView in platform.
-class WebView;
-
-// This interface abstracts the operations performed by the
-// GraphicsContext3D in order to implement WebGL. Nearly all of the
-// methods exposed on this interface map directly to entry points in
-// the OpenGL ES 2.0 API.
-//
-// Creating a WebGraphicsContext does not make it current, or guarantee
-// that the context has been created successfully. Use
-// makeContextCurrent() to complete initialization of the context, treating
-// a false return value as indication that the context could not be created
-// successfully.
-class WebGraphicsContext3D : public WebNonCopyable {
-public:
-    // Return value from getActiveUniform and getActiveAttrib.
-    struct ActiveInfo {
-        WebString name;
-        WGC3Denum type;
-        WGC3Dint size;
-    };
-
-    // Context creation attributes.
-    struct Attributes {
-        Attributes()
-            : alpha(true)
-            , depth(true)
-            , stencil(true)
-            , antialias(true)
-            , premultipliedAlpha(true)
-            , canRecoverFromContextLoss(true)
-            , noExtensions(false)
-            , shareResources(true)
-            , forUseOnAnotherThread(false)
-        {
-        }
-
-        bool alpha;
-        bool depth;
-        bool stencil;
-        bool antialias;
-        bool premultipliedAlpha;
-        bool canRecoverFromContextLoss;
-        bool noExtensions;
-        bool shareResources;
-        bool forUseOnAnotherThread;
-    };
-
-    class WebGraphicsContextLostCallback {
-    public:
-        virtual void onContextLost() = 0;
-        virtual ~WebGraphicsContextLostCallback() { }
-    };
-
-    class WebGraphicsErrorMessageCallback {
-    public:
-        virtual void onErrorMessage(const WebString&, WGC3Dint) = 0;
-        virtual ~WebGraphicsErrorMessageCallback() { }
-    };
-
-    class WebGraphicsSwapBuffersCompleteCallbackCHROMIUM {
-    public:
-        virtual void onSwapBuffersComplete() = 0;
-        virtual ~WebGraphicsSwapBuffersCompleteCallbackCHROMIUM() { }
-    };
-
-    class WebGraphicsMemoryAllocationChangedCallbackCHROMIUM {
-    public:
-        virtual void onMemoryAllocationChanged(size_t gpuResourceSizeInBytes) = 0;
-
-    protected:
-        virtual ~WebGraphicsMemoryAllocationChangedCallbackCHROMIUM() { }
-    };
-
-    // This destructor needs to be public so that using classes can destroy instances if initialization fails.
-    virtual ~WebGraphicsContext3D() {}
-
-    // This function is deprecated and will be removed soon.
-    virtual bool initialize(Attributes, WebView*, bool renderDirectlyToWebView) { return false; }
-
-    // Makes the OpenGL context current on the current thread. Returns true on
-    // success.
-    virtual bool makeContextCurrent() = 0;
-
-    // The size of the region into which this WebGraphicsContext3D is rendering.
-    // Returns the last values passed to reshape().
-    virtual int width() = 0;
-    virtual int height() = 0;
-
-    // Resizes the region into which this WebGraphicsContext3D is drawing.
-    virtual void reshape(int width, int height) = 0;
-
-    // GL_CHROMIUM_setVisibility - Changes the visibility of the backbuffer
-    virtual void setVisibilityCHROMIUM(bool visible) = 0;
-
-    // GL_CHROMIUM_gpu_memory_manager - sets callback to observe changes to memory allocation limits.
-    virtual void setMemoryAllocationChangedCallbackCHROMIUM(WebGraphicsMemoryAllocationChangedCallbackCHROMIUM* callback) { }
-
-    // Query whether it is built on top of compliant GLES2 implementation.
-    virtual bool isGLES2Compliant() = 0;
-
-    virtual bool setParentContext(WebGraphicsContext3D* parentContext) { return false; }
-
-    // Helper for software compositing path. Reads back the frame buffer into
-    // the memory region pointed to by "pixels" with size "bufferSize". It is
-    // expected that the storage for "pixels" covers (4 * width * height) bytes.
-    // Returns true on success.
-    virtual bool readBackFramebuffer(unsigned char* pixels, size_t bufferSize, WebGLId framebuffer, int width, int height) = 0;
-
-    // Returns the id of the texture which is used for storing the contents of
-    // the framebuffer associated with this context. This texture is accessible
-    // by the gpu-based page compositor.
-    virtual WebGLId getPlatformTextureId() = 0;
-
-    // Copies the contents of the off-screen render target used by the WebGL
-    // context to the corresponding texture used by the compositor.
-    virtual void prepareTexture() = 0;
-
-    // GL_CHROMIUM_post_sub_buffer - Copies part of the back buffer to the front buffer.
-    virtual void postSubBufferCHROMIUM(int x, int y, int width, int height) = 0;
-
-    // Synthesizes an OpenGL error which will be returned from a
-    // later call to getError. This is used to emulate OpenGL ES
-    // 2.0 behavior on the desktop and to enforce additional error
-    // checking mandated by WebGL.
-    //
-    // Per the behavior of glGetError, this stores at most one
-    // instance of any given error, and returns them from calls to
-    // getError in the order they were added.
-    virtual void synthesizeGLError(WGC3Denum) = 0;
-
-    virtual bool isContextLost() = 0;
-
-    // GL_CHROMIUM_map_sub
-    virtual void* mapBufferSubDataCHROMIUM(WGC3Denum target, WGC3Dintptr offset, WGC3Dsizeiptr size, WGC3Denum access) = 0;
-    virtual void unmapBufferSubDataCHROMIUM(const void*) = 0;
-    virtual void* mapTexSubImage2DCHROMIUM(WGC3Denum target, WGC3Dint level, WGC3Dint xoffset, WGC3Dint yoffset, WGC3Dsizei width, WGC3Dsizei height, WGC3Denum format, WGC3Denum type, WGC3Denum access) = 0;
-    virtual void unmapTexSubImage2DCHROMIUM(const void*) = 0;
-
-    // GL_CHROMIUM_request_extension
-    virtual WebString getRequestableExtensionsCHROMIUM() = 0;
-    virtual void requestExtensionCHROMIUM(const char*) = 0;
-
-    // GL_CHROMIUM_framebuffer_multisample
-    virtual void blitFramebufferCHROMIUM(WGC3Dint srcX0, WGC3Dint srcY0, WGC3Dint srcX1, WGC3Dint srcY1, WGC3Dint dstX0, WGC3Dint dstY0, WGC3Dint dstX1, WGC3Dint dstY1, WGC3Dbitfield mask, WGC3Denum filter) = 0;
-    virtual void renderbufferStorageMultisampleCHROMIUM(WGC3Denum target, WGC3Dsizei samples, WGC3Denum internalformat, WGC3Dsizei width, WGC3Dsizei height) = 0;
-
-    // GL_CHROMIUM_swapbuffers_complete_callback
-    virtual void setSwapBuffersCompleteCallbackCHROMIUM(WebGraphicsSwapBuffersCompleteCallbackCHROMIUM* callback) { }
-
-    // GL_CHROMIUM_rate_limit_offscreen_context
-    virtual void rateLimitOffscreenContextCHROMIUM() { }
-
-    // The entry points below map directly to the OpenGL ES 2.0 API.
-    // See: http://www.khronos.org/registry/gles/
-    // and: http://www.khronos.org/opengles/sdk/docs/man/
-    virtual void activeTexture(WGC3Denum texture) = 0;
-    virtual void attachShader(WebGLId program, WebGLId shader) = 0;
-    virtual void bindAttribLocation(WebGLId program, WGC3Duint index, const WGC3Dchar* name) = 0;
-    virtual void bindBuffer(WGC3Denum target, WebGLId buffer) = 0;
-    virtual void bindFramebuffer(WGC3Denum target, WebGLId framebuffer) = 0;
-    virtual void bindRenderbuffer(WGC3Denum target, WebGLId renderbuffer) = 0;
-    virtual void bindTexture(WGC3Denum target, WebGLId texture) = 0;
-    virtual void blendColor(WGC3Dclampf red, WGC3Dclampf green, WGC3Dclampf blue, WGC3Dclampf alpha) = 0;
-    virtual void blendEquation(WGC3Denum mode) = 0;
-    virtual void blendEquationSeparate(WGC3Denum modeRGB, WGC3Denum modeAlpha) = 0;
-    virtual void blendFunc(WGC3Denum sfactor, WGC3Denum dfactor) = 0;
-    virtual void blendFuncSeparate(WGC3Denum srcRGB, WGC3Denum dstRGB, WGC3Denum srcAlpha, WGC3Denum dstAlpha) = 0;
-
-    virtual void bufferData(WGC3Denum target, WGC3Dsizeiptr size, const void* data, WGC3Denum usage) = 0;
-    virtual void bufferSubData(WGC3Denum target, WGC3Dintptr offset, WGC3Dsizeiptr size, const void* data) = 0;
-
-    virtual WGC3Denum checkFramebufferStatus(WGC3Denum target) = 0;
-    virtual void clear(WGC3Dbitfield mask) = 0;
-    virtual void clearColor(WGC3Dclampf red, WGC3Dclampf green, WGC3Dclampf blue, WGC3Dclampf alpha) = 0;
-    virtual void clearDepth(WGC3Dclampf depth) = 0;
-    virtual void clearStencil(WGC3Dint s) = 0;
-    virtual void colorMask(WGC3Dboolean red, WGC3Dboolean green, WGC3Dboolean blue, WGC3Dboolean alpha) = 0;
-    virtual void compileShader(WebGLId shader) = 0;
-
-    virtual void compressedTexImage2D(WGC3Denum target, WGC3Dint level, WGC3Denum internalformat, WGC3Dsizei width, WGC3Dsizei height, WGC3Dint border, WGC3Dsizei imageSize, const void* data) = 0;
-    virtual void compressedTexSubImage2D(WGC3Denum target, WGC3Dint level, WGC3Dint xoffset, WGC3Dint yoffset, WGC3Dsizei width, WGC3Dsizei height, WGC3Denum format, WGC3Dsizei imageSize, const void* data) = 0;
-    virtual void copyTexImage2D(WGC3Denum target, WGC3Dint level, WGC3Denum internalformat, WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height, WGC3Dint border) = 0;
-    virtual void copyTexSubImage2D(WGC3Denum target, WGC3Dint level, WGC3Dint xoffset, WGC3Dint yoffset, WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height) = 0;
-    virtual void cullFace(WGC3Denum mode) = 0;
-    virtual void depthFunc(WGC3Denum func) = 0;
-    virtual void depthMask(WGC3Dboolean flag) = 0;
-    virtual void depthRange(WGC3Dclampf zNear, WGC3Dclampf zFar) = 0;
-    virtual void detachShader(WebGLId program, WebGLId shader) = 0;
-    virtual void disable(WGC3Denum cap) = 0;
-    virtual void disableVertexAttribArray(WGC3Duint index) = 0;
-    virtual void drawArrays(WGC3Denum mode, WGC3Dint first, WGC3Dsizei count) = 0;
-    virtual void drawElements(WGC3Denum mode, WGC3Dsizei count, WGC3Denum type, WGC3Dintptr offset) = 0;
-
-    virtual void enable(WGC3Denum cap) = 0;
-    virtual void enableVertexAttribArray(WGC3Duint index) = 0;
-    virtual void finish() = 0;
-    virtual void flush() = 0;
-    virtual void framebufferRenderbuffer(WGC3Denum target, WGC3Denum attachment, WGC3Denum renderbuffertarget, WebGLId renderbuffer) = 0;
-    virtual void framebufferTexture2D(WGC3Denum target, WGC3Denum attachment, WGC3Denum textarget, WebGLId texture, WGC3Dint level) = 0;
-    virtual void frontFace(WGC3Denum mode) = 0;
-    virtual void generateMipmap(WGC3Denum target) = 0;
-
-    virtual bool getActiveAttrib(WebGLId program, WGC3Duint index, ActiveInfo&) = 0;
-    virtual bool getActiveUniform(WebGLId program, WGC3Duint index, ActiveInfo&) = 0;
-    virtual void getAttachedShaders(WebGLId program, WGC3Dsizei maxCount, WGC3Dsizei* count, WebGLId* shaders) = 0;
-    virtual WGC3Dint getAttribLocation(WebGLId program, const WGC3Dchar* name) = 0;
-    virtual void getBooleanv(WGC3Denum pname, WGC3Dboolean* value) = 0;
-    virtual void getBufferParameteriv(WGC3Denum target, WGC3Denum pname, WGC3Dint* value) = 0;
-    virtual Attributes getContextAttributes() = 0;
-    virtual WGC3Denum getError() = 0;
-    virtual void getFloatv(WGC3Denum pname, WGC3Dfloat* value) = 0;
-    virtual void getFramebufferAttachmentParameteriv(WGC3Denum target, WGC3Denum attachment, WGC3Denum pname, WGC3Dint* value) = 0;
-    virtual void getIntegerv(WGC3Denum pname, WGC3Dint* value) = 0;
-    virtual void getProgramiv(WebGLId program, WGC3Denum pname, WGC3Dint* value) = 0;
-    virtual WebString getProgramInfoLog(WebGLId program) = 0;
-    virtual void getRenderbufferParameteriv(WGC3Denum target, WGC3Denum pname, WGC3Dint* value) = 0;
-    virtual void getShaderiv(WebGLId shader, WGC3Denum pname, WGC3Dint* value) = 0;
-    virtual WebString getShaderInfoLog(WebGLId shader) = 0;
-
-    // TBD
-    // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
-
-    virtual WebString getShaderSource(WebGLId shader) = 0;
-    virtual WebString getString(WGC3Denum name) = 0;
-    virtual void getTexParameterfv(WGC3Denum target, WGC3Denum pname, WGC3Dfloat* value) = 0;
-    virtual void getTexParameteriv(WGC3Denum target, WGC3Denum pname, WGC3Dint* value) = 0;
-    virtual void getUniformfv(WebGLId program, WGC3Dint location, WGC3Dfloat* value) = 0;
-    virtual void getUniformiv(WebGLId program, WGC3Dint location, WGC3Dint* value) = 0;
-    virtual WGC3Dint getUniformLocation(WebGLId program, const WGC3Dchar* name) = 0;
-    virtual void getVertexAttribfv(WGC3Duint index, WGC3Denum pname, WGC3Dfloat* value) = 0;
-    virtual void getVertexAttribiv(WGC3Duint index, WGC3Denum pname, WGC3Dint* value) = 0;
-    virtual WGC3Dsizeiptr getVertexAttribOffset(WGC3Duint index, WGC3Denum pname) = 0;
-
-    virtual void hint(WGC3Denum target, WGC3Denum mode) = 0;
-    virtual WGC3Dboolean isBuffer(WebGLId buffer) = 0;
-    virtual WGC3Dboolean isEnabled(WGC3Denum cap) = 0;
-    virtual WGC3Dboolean isFramebuffer(WebGLId framebuffer) = 0;
-    virtual WGC3Dboolean isProgram(WebGLId program) = 0;
-    virtual WGC3Dboolean isRenderbuffer(WebGLId renderbuffer) = 0;
-    virtual WGC3Dboolean isShader(WebGLId shader) = 0;
-    virtual WGC3Dboolean isTexture(WebGLId texture) = 0;
-    virtual void lineWidth(WGC3Dfloat) = 0;
-    virtual void linkProgram(WebGLId program) = 0;
-    virtual void pixelStorei(WGC3Denum pname, WGC3Dint param) = 0;
-    virtual void polygonOffset(WGC3Dfloat factor, WGC3Dfloat units) = 0;
-
-    virtual void readPixels(WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height, WGC3Denum format, WGC3Denum type, void* pixels) = 0;
-
-    virtual void releaseShaderCompiler() = 0;
-
-    virtual void renderbufferStorage(WGC3Denum target, WGC3Denum internalformat, WGC3Dsizei width, WGC3Dsizei height) = 0;
-    virtual void sampleCoverage(WGC3Dclampf value, WGC3Dboolean invert) = 0;
-    virtual void scissor(WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height) = 0;
-    virtual void shaderSource(WebGLId shader, const WGC3Dchar* string) = 0;
-    virtual void stencilFunc(WGC3Denum func, WGC3Dint ref, WGC3Duint mask) = 0;
-    virtual void stencilFuncSeparate(WGC3Denum face, WGC3Denum func, WGC3Dint ref, WGC3Duint mask) = 0;
-    virtual void stencilMask(WGC3Duint mask) = 0;
-    virtual void stencilMaskSeparate(WGC3Denum face, WGC3Duint mask) = 0;
-    virtual void stencilOp(WGC3Denum fail, WGC3Denum zfail, WGC3Denum zpass) = 0;
-    virtual void stencilOpSeparate(WGC3Denum face, WGC3Denum fail, WGC3Denum zfail, WGC3Denum zpass) = 0;
-
-    virtual void texImage2D(WGC3Denum target, WGC3Dint level, WGC3Denum internalformat, WGC3Dsizei width, WGC3Dsizei height, WGC3Dint border, WGC3Denum format, WGC3Denum type, const void* pixels) = 0;
-
-    virtual void texParameterf(WGC3Denum target, WGC3Denum pname, WGC3Dfloat param) = 0;
-    virtual void texParameteri(WGC3Denum target, WGC3Denum pname, WGC3Dint param) = 0;
-
-    virtual void texSubImage2D(WGC3Denum target, WGC3Dint level, WGC3Dint xoffset, WGC3Dint yoffset, WGC3Dsizei width, WGC3Dsizei height, WGC3Denum format, WGC3Denum type, const void* pixels) = 0;
-
-    virtual void uniform1f(WGC3Dint location, WGC3Dfloat x) = 0;
-    virtual void uniform1fv(WGC3Dint location, WGC3Dsizei count, const WGC3Dfloat* v) = 0;
-    virtual void uniform1i(WGC3Dint location, WGC3Dint x) = 0;
-    virtual void uniform1iv(WGC3Dint location, WGC3Dsizei count, const WGC3Dint* v) = 0;
-    virtual void uniform2f(WGC3Dint location, WGC3Dfloat x, WGC3Dfloat y) = 0;
-    virtual void uniform2fv(WGC3Dint location, WGC3Dsizei count, const WGC3Dfloat* v) = 0;
-    virtual void uniform2i(WGC3Dint location, WGC3Dint x, WGC3Dint y) = 0;
-    virtual void uniform2iv(WGC3Dint location, WGC3Dsizei count, const WGC3Dint* v) = 0;
-    virtual void uniform3f(WGC3Dint location, WGC3Dfloat x, WGC3Dfloat y, WGC3Dfloat z) = 0;
-    virtual void uniform3fv(WGC3Dint location, WGC3Dsizei count, const WGC3Dfloat* v) = 0;
-    virtual void uniform3i(WGC3Dint location, WGC3Dint x, WGC3Dint y, WGC3Dint z) = 0;
-    virtual void uniform3iv(WGC3Dint location, WGC3Dsizei count, const WGC3Dint* v) = 0;
-    virtual void uniform4f(WGC3Dint location, WGC3Dfloat x, WGC3Dfloat y, WGC3Dfloat z, WGC3Dfloat w) = 0;
-    virtual void uniform4fv(WGC3Dint location, WGC3Dsizei count, const WGC3Dfloat* v) = 0;
-    virtual void uniform4i(WGC3Dint location, WGC3Dint x, WGC3Dint y, WGC3Dint z, WGC3Dint w) = 0;
-    virtual void uniform4iv(WGC3Dint location, WGC3Dsizei count, const WGC3Dint* v) = 0;
-    virtual void uniformMatrix2fv(WGC3Dint location, WGC3Dsizei count, WGC3Dboolean transpose, const WGC3Dfloat* value) = 0;
-    virtual void uniformMatrix3fv(WGC3Dint location, WGC3Dsizei count, WGC3Dboolean transpose, const WGC3Dfloat* value) = 0;
-    virtual void uniformMatrix4fv(WGC3Dint location, WGC3Dsizei count, WGC3Dboolean transpose, const WGC3Dfloat* value) = 0;
-
-    virtual void useProgram(WebGLId program) = 0;
-    virtual void validateProgram(WebGLId program) = 0;
-
-    virtual void vertexAttrib1f(WGC3Duint index, WGC3Dfloat x) = 0;
-    virtual void vertexAttrib1fv(WGC3Duint index, const WGC3Dfloat* values) = 0;
-    virtual void vertexAttrib2f(WGC3Duint index, WGC3Dfloat x, WGC3Dfloat y) = 0;
-    virtual void vertexAttrib2fv(WGC3Duint index, const WGC3Dfloat* values) = 0;
-    virtual void vertexAttrib3f(WGC3Duint index, WGC3Dfloat x, WGC3Dfloat y, WGC3Dfloat z) = 0;
-    virtual void vertexAttrib3fv(WGC3Duint index, const WGC3Dfloat* values) = 0;
-    virtual void vertexAttrib4f(WGC3Duint index, WGC3Dfloat x, WGC3Dfloat y, WGC3Dfloat z, WGC3Dfloat w) = 0;
-    virtual void vertexAttrib4fv(WGC3Duint index, const WGC3Dfloat* values) = 0;
-    virtual void vertexAttribPointer(WGC3Duint index, WGC3Dint size, WGC3Denum type, WGC3Dboolean normalized,
-                                     WGC3Dsizei stride, WGC3Dintptr offset) = 0;
-
-    virtual void viewport(WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height) = 0;
-
-    // Support for buffer creation and deletion.
-    virtual WebGLId createBuffer() = 0;
-    virtual WebGLId createFramebuffer() = 0;
-    virtual WebGLId createProgram() = 0;
-    virtual WebGLId createRenderbuffer() = 0;
-    virtual WebGLId createShader(WGC3Denum) = 0;
-    virtual WebGLId createTexture() = 0;
-
-    virtual void deleteBuffer(WebGLId) = 0;
-    virtual void deleteFramebuffer(WebGLId) = 0;
-    virtual void deleteProgram(WebGLId) = 0;
-    virtual void deleteRenderbuffer(WebGLId) = 0;
-    virtual void deleteShader(WebGLId) = 0;
-    virtual void deleteTexture(WebGLId) = 0;
-
-    virtual void setContextLostCallback(WebGraphicsContextLostCallback* callback) {}
-    virtual void setErrorMessageCallback(WebGraphicsErrorMessageCallback* callback) { }
-    // GL_ARB_robustness
-    //
-    // This entry point must provide slightly different semantics than
-    // the GL_ARB_robustness extension; specifically, the lost context
-    // state is sticky, rather than reported only once.
-    virtual WGC3Denum getGraphicsResetStatusARB() { return 0; /* GL_NO_ERROR */ }
-
-    // FIXME: make this function pure virtual once it is implemented in
-    // both command buffer port and in-process port.
-    virtual WebString getTranslatedShaderSourceANGLE(WebGLId shader) { return WebString(); }
-
-    // GL_CHROMIUM_iosurface
-    virtual void texImageIOSurface2DCHROMIUM(WGC3Denum target, WGC3Dint width, WGC3Dint height, WGC3Duint ioSurfaceId, WGC3Duint plane) { }
-
-    // GL_EXT_texture_storage
-    virtual void texStorage2DEXT(WGC3Denum target, WGC3Dint levels, WGC3Duint internalformat,
-                                 WGC3Dint width, WGC3Dint height) { }
-
-
-#if WEBKIT_USING_SKIA
-    GrGLInterface* createGrGLInterface();
-#endif
-
-protected:
-#if WEBKIT_USING_SKIA
-    virtual GrGLInterface* onCreateGrGLInterface() { return 0; }
-#endif
-
-};
-
-} // namespace WebKit
-
-#endif
+#include "../../../../Platform/chromium/public/WebGraphicsContext3D.h"
diff --git a/Source/WebKit/chromium/public/platform/WebKitPlatformSupport.h b/Source/WebKit/chromium/public/platform/WebKitPlatformSupport.h
index 3bf4cb43a..d2c1fd814 100644
--- a/Source/WebKit/chromium/public/platform/WebKitPlatformSupport.h
+++ b/Source/WebKit/chromium/public/platform/WebKitPlatformSupport.h
@@ -58,7 +58,6 @@ class WebClipboard;
 class WebCookieJar;
 class WebFileSystem;
 class WebFileUtilities;
-class WebGraphicsContext3D;
 class WebIDBFactory; // FIXME: Does this belong in platform?
 class WebIDBKey; // FIXME: Does this belong in platform?
 class WebMediaStreamCenter;
@@ -386,8 +385,6 @@ public:
     // May return null if GPU is not supported.
     // Returns newly allocated and initialized offscreen WebGraphicsContext3D instance.
     virtual WebGraphicsContext3D* createOffscreenGraphicsContext3D(const WebGraphicsContext3D::Attributes&) { return 0; }
-    // Deprecated.
-    virtual WebGraphicsContext3D* createGraphicsContext3D() { return 0; }
 
     // Audio --------------------------------------------------------------
 
diff --git a/Source/WebKit/chromium/public/platform/WebLayer.h b/Source/WebKit/chromium/public/platform/WebLayer.h
index 3d919fa46..234c2fc4b 100644
--- a/Source/WebKit/chromium/public/platform/WebLayer.h
+++ b/Source/WebKit/chromium/public/platform/WebLayer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,121 +23,4 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebLayer_h
-#define WebLayer_h
-
-#include "WebColor.h"
-#include "WebCommon.h"
-#include "WebPrivatePtr.h"
-
-class SkMatrix44;
-namespace WebCore { class LayerChromium; }
-
-namespace WebKit {
-struct WebFloatPoint;
-struct WebSize;
-
-class WebLayer {
-public:
-    WEBKIT_EXPORT static WebLayer create();
-
-    WebLayer() { }
-    WebLayer(const WebLayer& layer) { assign(layer); }
-    virtual ~WebLayer() { reset(); }
-    WebLayer& operator=(const WebLayer& layer)
-    {
-        assign(layer);
-        return *this;
-    }
-    bool isNull() { return m_private.isNull(); }
-    WEBKIT_EXPORT void reset();
-    WEBKIT_EXPORT void assign(const WebLayer&);
-    WEBKIT_EXPORT bool equals(const WebLayer&) const;
-
-    WEBKIT_EXPORT WebLayer rootLayer() const;
-    WEBKIT_EXPORT WebLayer parent() const;
-    WEBKIT_EXPORT void addChild(const WebLayer&);
-    WEBKIT_EXPORT void insertChild(const WebLayer&, size_t index);
-    WEBKIT_EXPORT void replaceChild(const WebLayer& reference, const WebLayer& newLayer);
-    WEBKIT_EXPORT void removeFromParent();
-    WEBKIT_EXPORT void removeAllChildren();
-
-    WEBKIT_EXPORT void setAnchorPoint(const WebFloatPoint&);
-    WEBKIT_EXPORT WebFloatPoint anchorPoint() const;
-
-    WEBKIT_EXPORT void setAnchorPointZ(float);
-    WEBKIT_EXPORT float anchorPointZ() const;
-
-    WEBKIT_EXPORT void setBounds(const WebSize&);
-    WEBKIT_EXPORT WebSize bounds() const;
-
-    WEBKIT_EXPORT void setMasksToBounds(bool);
-    WEBKIT_EXPORT bool masksToBounds() const;
-
-    WEBKIT_EXPORT void setMaskLayer(const WebLayer&);
-    WEBKIT_EXPORT WebLayer maskLayer() const;
-
-    WEBKIT_EXPORT void setOpacity(float);
-    WEBKIT_EXPORT float opacity() const;
-
-    WEBKIT_EXPORT void setOpaque(bool);
-    WEBKIT_EXPORT bool opaque() const;
-
-    WEBKIT_EXPORT void setPosition(const WebFloatPoint&);
-    WEBKIT_EXPORT WebFloatPoint position() const;
-
-    WEBKIT_EXPORT void setSublayerTransform(const SkMatrix44&);
-    WEBKIT_EXPORT SkMatrix44 sublayerTransform() const;
-
-    WEBKIT_EXPORT void setTransform(const SkMatrix44&);
-    WEBKIT_EXPORT SkMatrix44 transform() const;
-
-    WEBKIT_EXPORT void setDebugBorderColor(const WebColor&);
-    WEBKIT_EXPORT void setDebugBorderWidth(float);
-
-    template<typename T> T to()
-    {
-        T res;
-        res.WebLayer::assign(*this);
-        return res;
-    }
-
-    template<typename T> const T toConst() const
-    {
-        T res;
-        res.WebLayer::assign(*this);
-        return res;
-    }
-
-#if WEBKIT_IMPLEMENTATION
-    WebLayer(const WTF::PassRefPtr<WebCore::LayerChromium>&);
-    WebLayer& operator=(const WTF::PassRefPtr<WebCore::LayerChromium>&);
-    operator WTF::PassRefPtr<WebCore::LayerChromium>() const;
-    template<typename T> T* unwrap()
-    {
-        return static_cast<T*>(m_private.get());
-    }
-
-    template<typename T> const T* constUnwrap() const
-    {
-        return static_cast<const T*>(m_private.get());
-    }
-#endif
-
-protected:
-    WebPrivatePtr<WebCore::LayerChromium> m_private;
-};
-
-inline bool operator==(const WebLayer& a, const WebLayer& b)
-{
-    return a.equals(b);
-}
-
-inline bool operator!=(const WebLayer& a, const WebLayer& b)
-{
-    return !(a == b);
-}
-
-} // namespace WebKit
-
-#endif // WebLayer_h
+#include "../../../../Platform/chromium/public/WebLayer.h"
diff --git a/Source/WebKit/chromium/public/platform/WebLayerTreeView.h b/Source/WebKit/chromium/public/platform/WebLayerTreeView.h
index 17a876a98..2ea2915e1 100644
--- a/Source/WebKit/chromium/public/platform/WebLayerTreeView.h
+++ b/Source/WebKit/chromium/public/platform/WebLayerTreeView.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,110 +23,4 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebLayerTreeView_h
-#define WebLayerTreeView_h
-
-#include "WebCommon.h"
-#include "WebPrivatePtr.h"
-
-namespace WebCore {
-class CCLayerTreeHost;
-struct CCSettings;
-}
-
-namespace WebKit {
-class WebLayer;
-class WebLayerTreeViewClient;
-struct WebRect;
-struct WebSize;
-
-class WebLayerTreeView {
-public:
-    struct Settings {
-        Settings()
-            : acceleratePainting(false)
-            , compositeOffscreen(false)
-            , showFPSCounter(false)
-            , showPlatformLayerTree(false)
-            , refreshRate(0)
-            , perTilePainting(false)
-            , partialSwapEnabled(false)
-            , threadedAnimationEnabled(false) { }
-
-        bool acceleratePainting;
-        bool compositeOffscreen;
-        bool showFPSCounter;
-        bool showPlatformLayerTree;
-        double refreshRate;
-        bool perTilePainting;
-        bool partialSwapEnabled;
-        bool threadedAnimationEnabled;
-#if WEBKIT_IMPLEMENTATION
-        operator WebCore::CCSettings() const;
-#endif
-    };
-
-    WEBKIT_EXPORT static WebLayerTreeView create(WebLayerTreeViewClient*, const WebLayer& root, const Settings&);
-
-    WebLayerTreeView() { }
-    WebLayerTreeView(const WebLayerTreeView& layer) { assign(layer); }
-    ~WebLayerTreeView() { reset(); }
-    WebLayerTreeView& operator=(const WebLayerTreeView& layer)
-    {
-        assign(layer);
-        return *this;
-    }
-    WEBKIT_EXPORT void reset();
-    WEBKIT_EXPORT void assign(const WebLayerTreeView&);
-    WEBKIT_EXPORT bool equals(const WebLayerTreeView&) const;
-
-    // Triggers a compositing pass. If the compositor thread was not
-    // enabled via WebCompositor::initialize, the compositing pass happens
-    // immediately. If it is enabled, the compositing pass will happen at a
-    // later time. Before the compositing pass happens (i.e. before composite()
-    // returns when the compositor thread is disabled), WebContentLayers will be
-    // asked to paint their dirty region, through
-    // WebContentLayerClient::paintContents.
-    WEBKIT_EXPORT void composite();
-
-    WEBKIT_EXPORT void setViewportSize(const WebSize&);
-    WEBKIT_EXPORT WebSize viewportSize() const;
-
-    // Composites and attempts to read back the result into the provided
-    // buffer. If it wasn't possible, e.g. due to context lost, will return
-    // false. Pixel format is 32bit (RGBA), and the provided buffer must be
-    // large enough contain viewportSize().width() * viewportSize().height()
-    // pixels. The WebLayerTreeView does not assume ownership of the buffer.
-    // The buffer is not modified if the false is returned.
-    WEBKIT_EXPORT bool compositeAndReadback(void *pixels, const WebRect&);
-
-    // Sets the root of the tree. The root is set by way of the constructor.
-    // This is typically used to explicitly set the root to null to break
-    // cycles.
-    WEBKIT_EXPORT void setRootLayer(WebLayer*);
-
-#if WEBKIT_IMPLEMENTATION
-    WebLayerTreeView(const WTF::PassRefPtr<WebCore::CCLayerTreeHost>&);
-    WebLayerTreeView& operator=(const WTF::PassRefPtr<WebCore::CCLayerTreeHost>&);
-    operator WTF::PassRefPtr<WebCore::CCLayerTreeHost>() const;
-#endif
-
-    WEBKIT_EXPORT void setNeedsRedraw();
-
-protected:
-    WebPrivatePtr<WebCore::CCLayerTreeHost> m_private;
-};
-
-inline bool operator==(const WebLayerTreeView& a, const WebLayerTreeView& b)
-{
-    return a.equals(b);
-}
-
-inline bool operator!=(const WebLayerTreeView& a, const WebLayerTreeView& b)
-{
-    return !(a == b);
-}
-
-} // namespace WebKit
-
-#endif // WebLayerTreeView_h
+#include "../../../../Platform/chromium/public/WebLayerTreeView.h"
diff --git a/Source/WebKit/chromium/public/platform/WebLayerTreeViewClient.h b/Source/WebKit/chromium/public/platform/WebLayerTreeViewClient.h
index 9c4dfb77b..36c61f584 100644
--- a/Source/WebKit/chromium/public/platform/WebLayerTreeViewClient.h
+++ b/Source/WebKit/chromium/public/platform/WebLayerTreeViewClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,45 +23,4 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebLayerTreeViewClient_h
-#define WebLayerTreeViewClient_h
-
-namespace WebKit {
-class WebGraphicsContext3D;
-struct WebSize;
-class WebThread;
-
-class WebLayerTreeViewClient {
-public:
-    // Updates animation and layout. These are called before the compositing
-    // pass so that layers can be updated at the given frame time.
-    virtual void updateAnimations(double frameBeginTime) = 0;
-    virtual void layout() = 0;
-
-    // Applies a scroll delta to the root layer, which is bundled with a page
-    // scale factor that may apply a CSS transform on the whole document (used
-    // for mobile-device pinch zooming). This is triggered by events sent to the
-    // compositor thread through the WebCompositor interface.
-    virtual void applyScrollAndScale(const WebSize& scrollDelta, float scaleFactor) = 0;
-
-    // Creates a 3D context suitable for the compositing. This may be called
-    // more than once if the context gets lost.
-    virtual WebGraphicsContext3D* createContext3D() = 0;
-
-    // Signals a successful rebinding of the 3D context (e.g. after a lost
-    // context event).
-    virtual void didRebindGraphicsContext(bool success) = 0;
-
-    // Schedules a compositing pass, meaning the client should call
-    // WebLayerTreeView::composite at a later time. This is only called if the
-    // compositor thread is disabled; when enabled, the compositor will
-    // internally schedule a compositing pass when needed.
-    virtual void scheduleComposite() = 0;
-
-protected:
-    virtual ~WebLayerTreeViewClient() { }
-};
-
-} // namespace WebKit
-
-#endif // WebLayerTreeViewClient_h
+#include "../../../../Platform/chromium/public/WebLayerTreeViewClient.h"
diff --git a/Source/WebKit/chromium/public/platform/WebNonCopyable.h b/Source/WebKit/chromium/public/platform/WebNonCopyable.h
index b0bd4565c..d44d2802c 100644
--- a/Source/WebKit/chromium/public/platform/WebNonCopyable.h
+++ b/Source/WebKit/chromium/public/platform/WebNonCopyable.h
@@ -1,49 +1,26 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
+ * modification, are permitted provided that the following conditions
+ * are met:
  *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebNonCopyable_h
-#define WebNonCopyable_h
-
-namespace WebKit {
-
-// A base class to extend from if you do not support copying.
-class WebNonCopyable {
-protected:
-    WebNonCopyable() { }
-    ~WebNonCopyable() { }
-
-private:
-    WebNonCopyable(const WebNonCopyable&);
-    WebNonCopyable& operator=(const WebNonCopyable&);
-};
-
-} // namespace WebKit
-
-#endif
+#include "../../../../Platform/chromium/public/WebNonCopyable.h"
diff --git a/Source/WebKit/chromium/public/platform/WebPrivatePtr.h b/Source/WebKit/chromium/public/platform/WebPrivatePtr.h
index 31d09a90b..208096ed3 100644
--- a/Source/WebKit/chromium/public/platform/WebPrivatePtr.h
+++ b/Source/WebKit/chromium/public/platform/WebPrivatePtr.h
@@ -1,107 +1,26 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
+ * modification, are permitted provided that the following conditions
+ * are met:
  *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebPrivatePtr_h
-#define WebPrivatePtr_h
-
-#include "WebCommon.h"
-
-#if WEBKIT_IMPLEMENTATION
-#include <wtf/PassRefPtr.h>
-#endif
-
-namespace WebKit {
-
-// This class is an implementation detail of the WebKit API.  It exists
-// to help simplify the implementation of WebKit interfaces that merely
-// wrap a reference counted WebCore class.
-template <typename T>
-class WebPrivatePtr {
-public:
-    WebPrivatePtr() : m_ptr(0) { }
-    ~WebPrivatePtr() { WEBKIT_ASSERT(!m_ptr); }
-
-    bool isNull() const { return !m_ptr; }
-
-#if WEBKIT_IMPLEMENTATION
-    WebPrivatePtr(const PassRefPtr<T>& prp)
-        : m_ptr(prp.leakRef())
-    {
-    }
-
-    void reset()
-    {
-        assign(0);
-    }
-
-    WebPrivatePtr<T>& operator=(const WebPrivatePtr<T>& other)
-    {
-        T* p = other.m_ptr;
-        if (p)
-            p->ref();
-        assign(p);
-        return *this;
-    }
-
-    WebPrivatePtr<T>& operator=(const PassRefPtr<T>& prp)
-    {
-        assign(prp.leakRef());
-        return *this;
-    }
-
-    T* get() const
-    {
-        return m_ptr;
-    }
-
-    T* operator->() const
-    {
-        ASSERT(m_ptr);
-        return m_ptr;
-    }
-#endif
-
-private:
-#if WEBKIT_IMPLEMENTATION
-    void assign(T* p)
-    {
-        // p is already ref'd for us by the caller
-        if (m_ptr)
-            m_ptr->deref();
-        m_ptr = p;
-    }
-#endif
-
-    T* m_ptr;
-};
-
-} // namespace WebKit
-
-#endif
+#include "../../../../Platform/chromium/public/WebPrivatePtr.h"
diff --git a/Source/WebKit/chromium/public/platform/WebSolidColorLayer.h b/Source/WebKit/chromium/public/platform/WebSolidColorLayer.h
index ad9123d96..f4edbd489 100644
--- a/Source/WebKit/chromium/public/platform/WebSolidColorLayer.h
+++ b/Source/WebKit/chromium/public/platform/WebSolidColorLayer.h
@@ -23,26 +23,4 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebSolidColorLayer_h
-#define WebSolidColorLayer_h
-
-#include "WebCommon.h"
-#include "WebFloatRect.h"
-#include "WebLayer.h"
-
-namespace WebKit {
-class WebSolidColorLayerImpl;
-
-class WebSolidColorLayer : public WebLayer {
-public:
-    WEBKIT_EXPORT static WebSolidColorLayer create();
-    WEBKIT_EXPORT void setBackgroundColor(const WebColor&);
-
-#if WEBKIT_IMPLEMENTATION
-    WebSolidColorLayer(const WTF::PassRefPtr<WebSolidColorLayerImpl>&);
-#endif
-};
-
-} // namespace WebKit
-
-#endif // WebSolidColorLayer_h
+#include "../../../../Platform/chromium/public/WebSolidColorLayer.h"
diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index 3f0875b53..ac6fa0447 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -53,7 +53,7 @@
 #include "IconURL.h"
 #include "MediaPlayer.h"
 #include "MediaStreamSource.h"
-#include "NotificationPresenter.h"
+#include "NotificationClient.h"
 #include "PageVisibilityState.h"
 #include "PasteboardPrivate.h"
 #include "PlatformCursor.h"
@@ -394,9 +394,9 @@ COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::FormatASCII, VideoFrameChromium::ASC
 #endif
 
 #if ENABLE(NOTIFICATIONS)
-COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionAllowed, NotificationPresenter::PermissionAllowed);
-COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionNotAllowed, NotificationPresenter::PermissionNotAllowed);
-COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionDenied, NotificationPresenter::PermissionDenied);
+COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionAllowed, NotificationClient::PermissionAllowed);
+COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionNotAllowed, NotificationClient::PermissionNotAllowed);
+COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionDenied, NotificationClient::PermissionDenied);
 #endif
 
 COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::Horizontal, HorizontalScrollbar);
diff --git a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
index c314411b4..0c3a0cf55 100644
--- a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
+++ b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
@@ -79,6 +79,7 @@ void HTTPRequestHeaderValidator::visitHeader(const WebString& name, const WebStr
     m_isSafe = m_isSafe && isValidHTTPToken(name) && XMLHttpRequest::isAllowedHTTPHeader(name) && isValidHTTPHeaderValue(value);
 }
 
+// FIXME: Remove this and use WebCore code that does the same thing.
 class HTTPResponseHeaderValidator : public WebHTTPHeaderVisitor {
     WTF_MAKE_NONCOPYABLE(HTTPResponseHeaderValidator);
 public:
@@ -97,7 +98,7 @@ void HTTPResponseHeaderValidator::visitHeader(const WebString& name, const WebSt
 {
     String headerName(name);
     if (m_usingAccessControl) {
-        if (equalIgnoringCase(headerName, "access-control-expose-header"))
+        if (equalIgnoringCase(headerName, "access-control-expose-headers"))
             parseAccessControlExposeHeadersAllowList(value, m_exposedHeaders);
         else if (!isOnAccessControlResponseHeaderWhitelist(headerName))
             m_blockedHeaders.add(name);
@@ -112,7 +113,7 @@ const HTTPHeaderSet& HTTPResponseHeaderValidator::blockedHeaders()
         m_exposedHeaders.remove("set-cookie");
         m_exposedHeaders.remove("set-cookie2");
         // Block Access-Control-Expose-Header itself. It could be exposed later.
-        m_blockedHeaders.add("access-control-expose-header");
+        m_blockedHeaders.add("access-control-expose-headers");
         HTTPHeaderSet::const_iterator end = m_exposedHeaders.end();
         for (HTTPHeaderSet::const_iterator it = m_exposedHeaders.begin(); it != end; ++it)
             m_blockedHeaders.remove(*it);
diff --git a/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp b/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
index 1f93cf93e..8d8a3fedc 100644
--- a/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
@@ -34,7 +34,10 @@
 
 #include "AsyncFileSystemCallbacks.h"
 #include "AsyncFileWriterChromium.h"
+#include "BlobURL.h"
+#include "FileMetadata.h"
 #include "SecurityOrigin.h"
+#include "ThreadableBlobRegistry.h"
 #include "WebFileInfo.h"
 #include "WebFileSystemCallbacksImpl.h"
 #include "WebFileWriter.h"
@@ -46,11 +49,51 @@
 
 namespace WebCore {
 
+namespace {
+
 // ChromeOS-specific filesystem type.
 const AsyncFileSystem::Type externalType = static_cast<AsyncFileSystem::Type>(WebKit::WebFileSystem::TypeExternal);
 const char externalPathPrefix[] = "external";
 const size_t externalPathPrefixLength = sizeof(externalPathPrefix) - 1;
 
+// Specialized callback class for createSnapshotFileAndReadMetadata.
+class SnapshotFileCallbacks : public AsyncFileSystemCallbacks {
+public:
+    static PassOwnPtr<SnapshotFileCallbacks> create(const KURL& internalBlobURL, PassOwnPtr<WebCore::AsyncFileSystemCallbacks> callbacks)
+    {
+        return adoptPtr(new SnapshotFileCallbacks(internalBlobURL, callbacks));
+    }
+
+    virtual void didReadMetadata(const FileMetadata& metadata)
+    {
+        ASSERT(m_callbacks);
+
+        // This will create a new File object using the metadata.
+        m_callbacks->didReadMetadata(metadata);
+
+        // Now that we've registered the snapshot file, we can unregister our internalBlobURL which has played a placeholder for the file during the IPC.
+        ThreadableBlobRegistry::unregisterBlobURL(m_internalBlobURL);
+    }
+
+    virtual void didFail(int error)
+    {
+        ASSERT(m_callbacks);
+        m_callbacks->didFail(error);
+    }
+
+private:
+    SnapshotFileCallbacks(const KURL& internalBlobURL, PassOwnPtr<WebCore::AsyncFileSystemCallbacks> callbacks)
+        : m_internalBlobURL(internalBlobURL)
+        , m_callbacks(callbacks)
+    {
+    }
+
+    KURL m_internalBlobURL;
+    OwnPtr<WebCore::AsyncFileSystemCallbacks> m_callbacks;
+};
+
+} // namespace
+
 // static
 bool AsyncFileSystem::isAvailable()
 {
@@ -254,6 +297,15 @@ void AsyncFileSystemChromium::createWriter(AsyncFileWriterClient* client, const
     m_webFileSystem->readMetadata(pathAsURL, new FileWriterHelperCallbacks(client, pathAsURL, m_webFileSystem, callbacks));
 }
 
+void AsyncFileSystemChromium::createSnapshotFileAndReadMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    KURL pathAsURL = virtualPathToFileSystemURL(path);
+    KURL internalBlobURL = BlobURL::createInternalURL();
+
+    // This will create a snapshot file and register the file to a blob using the given internalBlobURL.
+    m_webFileSystem->createSnapshotFileAndReadMetadata(internalBlobURL, pathAsURL, new WebKit::WebFileSystemCallbacksImpl(createSnapshotFileCallback(internalBlobURL, callbacks)));
+}
+
 KURL AsyncFileSystemChromium::virtualPathToFileSystemURL(const String& virtualPath) const
 {
     ASSERT(!m_filesystemRootURL.isEmpty());
@@ -263,6 +315,11 @@ KURL AsyncFileSystemChromium::virtualPathToFileSystemURL(const String& virtualPa
     return url;
 }
 
+PassOwnPtr<AsyncFileSystemCallbacks> AsyncFileSystemChromium::createSnapshotFileCallback(const KURL& internalBlobURL, PassOwnPtr<AsyncFileSystemCallbacks> callbacks) const
+{
+    return SnapshotFileCallbacks::create(internalBlobURL, callbacks);
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebKit/chromium/src/AsyncFileSystemChromium.h b/Source/WebKit/chromium/src/AsyncFileSystemChromium.h
index a8cbca276..8255d8e72 100644
--- a/Source/WebKit/chromium/src/AsyncFileSystemChromium.h
+++ b/Source/WebKit/chromium/src/AsyncFileSystemChromium.h
@@ -66,9 +66,13 @@ public:
     virtual void directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createSnapshotFileAndReadMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
 
 protected:
     AsyncFileSystemChromium(AsyncFileSystem::Type, const KURL& rootURL);
+
+    PassOwnPtr<AsyncFileSystemCallbacks> createSnapshotFileCallback(const KURL& internalBlobURL, PassOwnPtr<AsyncFileSystemCallbacks>) const;
+
     WebKit::WebFileSystem* m_webFileSystem;
 
     // Converts a given absolute virtual path to a full origin-qualified FileSystem URL.
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index 45a813859..ad35382b9 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -136,6 +136,7 @@ ChromeClientImpl::ChromeClientImpl(WebViewImpl* webView)
     , m_scrollbarsVisible(true)
     , m_menubarVisible(true)
     , m_resizable(true)
+    , m_nextNewWindowNavigationPolicy(WebNavigationPolicyIgnore)
 {
 }
 
@@ -238,13 +239,23 @@ Page* ChromeClientImpl::createWindow(
     if (!m_webView->client())
         return 0;
 
+    // FrameLoaderClientImpl may have given us a policy to use for the next new
+    // window navigation. If not, determine the policy using the same logic as
+    // show().
+    WebNavigationPolicy policy;
+    if (m_nextNewWindowNavigationPolicy != WebNavigationPolicyIgnore) {
+        policy = m_nextNewWindowNavigationPolicy;
+        m_nextNewWindowNavigationPolicy = WebNavigationPolicyIgnore;
+    } else
+        policy = getNavigationPolicy();
+
     WrappedResourceRequest request;
     if (!r.resourceRequest().isEmpty())
         request.bind(r.resourceRequest());
     else if (!action.resourceRequest().isEmpty())
         request.bind(action.resourceRequest());
     WebViewImpl* newView = static_cast<WebViewImpl*>(
-        m_webView->client()->createView(WebFrameImpl::fromFrame(frame), request, features, r.frameName()));
+        m_webView->client()->createView(WebFrameImpl::fromFrame(frame), request, features, r.frameName(), policy));
     if (!newView)
         return 0;
 
@@ -287,11 +298,8 @@ static inline bool currentEventShouldCauseBackgroundTab(const WebInputEvent* inp
     return policy == WebNavigationPolicyNewBackgroundTab;
 }
 
-void ChromeClientImpl::show()
+WebNavigationPolicy ChromeClientImpl::getNavigationPolicy()
 {
-    if (!m_webView->client())
-        return;
-
     // If our default configuration was modified by a script or wasn't
     // created by a user gesture, then show as a popup. Else, let this
     // new window be opened as a toplevel window.
@@ -306,8 +314,15 @@ void ChromeClientImpl::show()
         policy = WebNavigationPolicyNewPopup;
     if (currentEventShouldCauseBackgroundTab(WebViewImpl::currentInputEvent()))
         policy = WebNavigationPolicyNewBackgroundTab;
+    return policy;
+}
+ 
+void ChromeClientImpl::show()
+{
+    if (!m_webView->client())
+        return;
 
-    m_webView->client()->show(policy);
+    m_webView->client()->show(getNavigationPolicy());
 }
 
 bool ChromeClientImpl::canRunModal()
@@ -603,7 +618,7 @@ void ChromeClientImpl::mouseDidMoveOverElement(
             Widget* widget = toRenderWidget(object)->widget();
             if (widget && widget->isPluginContainer()) {
                 WebPluginContainerImpl* plugin = static_cast<WebPluginContainerImpl*>(widget);
-                url = plugin->plugin()->linkAtPosition(result.point());
+                url = plugin->plugin()->linkAtPosition(result.roundedPoint());
             }
         }
     }
@@ -802,6 +817,11 @@ void ChromeClientImpl::setCursorForPlugin(const WebCursorInfo& cursor)
     setCursor(cursor);
 }
 
+void ChromeClientImpl::setNewWindowNavigationPolicy(WebNavigationPolicy policy)
+{
+    m_nextNewWindowNavigationPolicy = policy;
+}
+
 void ChromeClientImpl::formStateDidChange(const Node* node)
 {
     // The current history item is not updated yet.  That happens lazily when
@@ -890,7 +910,7 @@ void ChromeClientImpl::attachRootGraphicsLayer(Frame* frame, GraphicsLayer* grap
 
 void ChromeClientImpl::scheduleCompositingLayerSync()
 {
-    m_webView->setRootLayerNeedsDisplay();
+    m_webView->scheduleCompositingLayerSync();
 }
 
 ChromeClient::CompositingTriggerFlags ChromeClientImpl::allowedCompositingTriggers() const
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.h b/Source/WebKit/chromium/src/ChromeClientImpl.h
index 23e02ff3d..c34945404 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.h
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.h
@@ -35,6 +35,7 @@
 #include "ChromeClientChromium.h"
 #include "PopupMenu.h"
 #include "SearchPopupMenu.h"
+#include "WebNavigationPolicy.h"
 
 namespace WebCore {
 class AccessibilityObject;
@@ -189,6 +190,7 @@ public:
 
     // ChromeClientImpl:
     void setCursorForPlugin(const WebCursorInfo&);
+    void setNewWindowNavigationPolicy(WebNavigationPolicy);
 
     virtual bool selectItemWritingDirectionIsNatural();
     virtual bool selectItemAlignmentFollowsMenuWritingDirection();
@@ -196,10 +198,6 @@ public:
     virtual PassRefPtr<WebCore::PopupMenu> createPopupMenu(WebCore::PopupMenuClient*) const;
     virtual PassRefPtr<WebCore::SearchPopupMenu> createSearchPopupMenu(WebCore::PopupMenuClient*) const;
 
-#if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() { }
-#endif
-
     virtual bool shouldRunModalDialogDuringPageDismissal(const DialogType&, const String& dialogMessage, WebCore::FrameLoader::PageDismissalType) const;
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const;
@@ -213,6 +211,7 @@ public:
 #endif
 
 private:
+    WebNavigationPolicy getNavigationPolicy();
     void getPopupMenuInfo(WebCore::PopupContainer*, WebPopupMenuInfo*);
     void setCursor(const WebCursorInfo&);
 
@@ -222,6 +221,9 @@ private:
     bool m_scrollbarsVisible;
     bool m_menubarVisible;
     bool m_resizable;
+
+    // The policy for how the next webview to be created will be shown.
+    WebNavigationPolicy m_nextNewWindowNavigationPolicy;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp b/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
index 790a9c52b..4712eff7d 100644
--- a/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -158,7 +158,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
     Frame* selectedFrame = r.innerNonSharedNode()->document()->frame();
 
     WebContextMenuData data;
-    data.mousePosition = selectedFrame->view()->contentsToWindow(r.point());
+    data.mousePosition = selectedFrame->view()->contentsToWindow(r.roundedPoint());
 
     // Compute edit flags.
     data.editFlags = WebContextMenuData::CanDoNone;
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index a85ccbd2e..2dada5c50 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -145,10 +145,10 @@ void FrameLoaderClientImpl::documentElementAvailable()
 }
 
 #if USE(V8)
-void FrameLoaderClientImpl::didCreateScriptContext(v8::Handle<v8::Context> context, int worldId)
+void FrameLoaderClientImpl::didCreateScriptContext(v8::Handle<v8::Context> context, int extensionGroup, int worldId)
 {
     if (m_webFrame->client())
-        m_webFrame->client()->didCreateScriptContext(m_webFrame, context, worldId);
+        m_webFrame->client()->didCreateScriptContext(m_webFrame, context, extensionGroup, worldId);
 }
 
 void FrameLoaderClientImpl::willReleaseScriptContext(v8::Handle<v8::Context> context, int worldId)
@@ -612,7 +612,7 @@ void FrameLoaderClientImpl::dispatchWillPerformClientRedirect(
     // carry out such a navigation anyway, the best thing we can do for now to
     // not get confused is ignore this notification.
     if (m_expectedClientRedirectDest.isLocalFile()
-        && m_expectedClientRedirectSrc.protocolInHTTPFamily()) {
+        && m_expectedClientRedirectSrc.protocolIsInHTTPFamily()) {
         m_expectedClientRedirectSrc = KURL();
         m_expectedClientRedirectDest = KURL();
         return;
@@ -873,21 +873,27 @@ void FrameLoaderClientImpl::dispatchDidFirstVisuallyNonEmptyLayout()
 
 Frame* FrameLoaderClientImpl::dispatchCreatePage(const NavigationAction& action)
 {
-    struct WindowFeatures features;
-    Page* newPage = m_webFrame->frame()->page()->chrome()->createWindow(
-        m_webFrame->frame(), FrameLoadRequest(m_webFrame->frame()->document()->securityOrigin()),
-        features, action);
-
     // Make sure that we have a valid disposition.  This should have been set in
     // the preceeding call to dispatchDecidePolicyForNewWindowAction.
     ASSERT(m_nextNavigationPolicy != WebNavigationPolicyIgnore);
     WebNavigationPolicy policy = m_nextNavigationPolicy;
     m_nextNavigationPolicy = WebNavigationPolicyIgnore;
 
+    // Store the disposition on the opener ChromeClientImpl so that we can pass
+    // it to WebViewClient::createView.
+    ChromeClientImpl* chromeClient = static_cast<ChromeClientImpl*>(m_webFrame->frame()->page()->chrome()->client());
+    chromeClient->setNewWindowNavigationPolicy(policy);
+
+    struct WindowFeatures features;
+    Page* newPage = m_webFrame->frame()->page()->chrome()->createWindow(
+        m_webFrame->frame(), FrameLoadRequest(m_webFrame->frame()->document()->securityOrigin()),
+        features, action);
+
     // createWindow can return null (e.g., popup blocker denies the window).
     if (!newPage)
         return 0;
 
+    // Also give the disposition to the new window.
     WebViewImpl::fromPage(newPage)->setInitialNavigationPolicy(policy);
     return newPage->mainFrame();
 }
@@ -949,6 +955,11 @@ void FrameLoaderClientImpl::dispatchDecidePolicyForNewWindowAction(
         // creating or showing the new window that would allow us to avoid having
         // to keep this state.
         m_nextNavigationPolicy = navigationPolicy;
+
+        // Store the disposition on the opener ChromeClientImpl so that we can pass
+        // it to WebViewClient::createView.
+        ChromeClientImpl* chromeClient = static_cast<ChromeClientImpl*>(m_webFrame->frame()->page()->chrome()->client());
+        chromeClient->setNewWindowNavigationPolicy(navigationPolicy);
     }
     (m_webFrame->frame()->loader()->policyChecker()->*function)(policyAction);
 }
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
index 0bf935d6d..53d5997e8 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -62,7 +62,7 @@ public:
     virtual void documentElementAvailable();
 
 #if USE(V8)
-    virtual void didCreateScriptContext(v8::Handle<v8::Context>, int worldId);
+    virtual void didCreateScriptContext(v8::Handle<v8::Context>, int extensionGroup, int worldId);
     virtual void willReleaseScriptContext(v8::Handle<v8::Context>, int worldId);
 #endif
 
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
index c7ac894b0..4bfa2e5bc 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
+++ b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
@@ -67,6 +67,15 @@
 #include "GrGLInterface.h"
 #endif
 
+namespace {
+
+// The limit of the number of textures we hold in the GrContext's bitmap->texture cache.
+const int maxGaneshTextureCacheCount = 512;
+// The limit of the bytes allocated toward textures in the GrContext's bitmap->texture cache.
+const size_t maxGaneshTextureCacheBytes = 96 * 1024 * 1024;
+
+}
+
 // There are two levels of delegation in this file:
 //
 //   1. GraphicsContext3D delegates to GraphicsContext3DPrivate. This is done
@@ -158,18 +167,41 @@ Platform3DObject GraphicsContext3DPrivate::platformTexture() const
 }
 
 #if USE(SKIA)
+class GrMemoryAllocationChangedCallback : public Extensions3DChromium::GpuMemoryAllocationChangedCallbackCHROMIUM {
+public:
+    GrMemoryAllocationChangedCallback(GraphicsContext3DPrivate* context)
+        : m_context(context)
+    {
+    }
+
+    virtual void onGpuMemoryAllocationChanged(size_t gpuResourceSizeInBytes)
+    {
+        GrContext* context = m_context->grContext();
+        if (!context)
+            return;
+
+        if (!gpuResourceSizeInBytes) {
+            context->freeGpuResources();
+            context->setTextureCacheLimits(0, 0);
+        } else
+            context->setTextureCacheLimits(maxGaneshTextureCacheCount, maxGaneshTextureCacheBytes);
+    }
+
+private:
+    GraphicsContext3DPrivate* m_context;
+};
+
 GrContext* GraphicsContext3DPrivate::grContext()
 {
-    // Limit the number of textures we hold in the bitmap->texture cache.
-    static const int maxTextureCacheCount = 512;
-    // Limit the bytes allocated toward textures in the bitmap->texture cache.
-    static const size_t maxTextureCacheBytes = 96 * 1024 * 1024;
-
     if (!m_grContext) {
         SkAutoTUnref<GrGLInterface> interface(m_impl->createGrGLInterface());
         m_grContext = GrContext::Create(kOpenGL_Shaders_GrEngine, reinterpret_cast<GrPlatform3DContext>(interface.get()));
-        if (m_grContext)
-            m_grContext->setTextureCacheLimits(maxTextureCacheCount, maxTextureCacheBytes);
+        if (m_grContext) {
+            m_grContext->setTextureCacheLimits(maxGaneshTextureCacheCount, maxGaneshTextureCacheBytes);
+            Extensions3DChromium* extensions3DChromium = static_cast<Extensions3DChromium*>(getExtensions());
+            if (extensions3DChromium->supports("GL_CHROMIUM_gpu_memory_manager"))
+                extensions3DChromium->setGpuMemoryAllocationChangedCallbackCHROMIUM(adoptPtr(new GrMemoryAllocationChangedCallback(this)));
+        }
     }
     return m_grContext;
 }
@@ -552,6 +584,7 @@ GraphicsContext3D::Attributes GraphicsContext3DPrivate::getContextAttributes()
     attributes.antialias = webAttributes.antialias;
     attributes.premultipliedAlpha = webAttributes.premultipliedAlpha;
     attributes.preserveDrawingBuffer = m_preserveDrawingBuffer;
+    attributes.preferDiscreteGPU = webAttributes.preferDiscreteGPU;
     return attributes;
 }
 
@@ -651,71 +684,71 @@ void GraphicsContext3DPrivate::texSubImage2D(GC3Denum target, GC3Dint level, GC3
 
 DELEGATE_TO_IMPL_2(uniform1f, GC3Dint, GC3Dfloat)
 
-void GraphicsContext3DPrivate::uniform1fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform1fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
 {
     m_impl->uniform1fv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_2(uniform1i, GC3Dint, GC3Dint)
 
-void GraphicsContext3DPrivate::uniform1iv(GC3Dint location, GC3Dint* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform1iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
 {
     m_impl->uniform1iv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_3(uniform2f, GC3Dint, GC3Dfloat, GC3Dfloat)
 
-void GraphicsContext3DPrivate::uniform2fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform2fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
 {
     m_impl->uniform2fv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_3(uniform2i, GC3Dint, GC3Dint, GC3Dint)
 
-void GraphicsContext3DPrivate::uniform2iv(GC3Dint location, GC3Dint* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform2iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
 {
     m_impl->uniform2iv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_4(uniform3f, GC3Dint, GC3Dfloat, GC3Dfloat, GC3Dfloat)
 
-void GraphicsContext3DPrivate::uniform3fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform3fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
 {
     m_impl->uniform3fv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_4(uniform3i, GC3Dint, GC3Dint, GC3Dint, GC3Dint)
 
-void GraphicsContext3DPrivate::uniform3iv(GC3Dint location, GC3Dint* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform3iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
 {
     m_impl->uniform3iv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_5(uniform4f, GC3Dint, GC3Dfloat, GC3Dfloat, GC3Dfloat, GC3Dfloat)
 
-void GraphicsContext3DPrivate::uniform4fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform4fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
 {
     m_impl->uniform4fv(location, size, v);
 }
 
 DELEGATE_TO_IMPL_5(uniform4i, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint)
 
-void GraphicsContext3DPrivate::uniform4iv(GC3Dint location, GC3Dint* v, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniform4iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
 {
     m_impl->uniform4iv(location, size, v);
 }
 
-void GraphicsContext3DPrivate::uniformMatrix2fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniformMatrix2fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
 {
     m_impl->uniformMatrix2fv(location, size, transpose, value);
 }
 
-void GraphicsContext3DPrivate::uniformMatrix3fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniformMatrix3fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
 {
     m_impl->uniformMatrix3fv(location, size, transpose, value);
 }
 
-void GraphicsContext3DPrivate::uniformMatrix4fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size)
+void GraphicsContext3DPrivate::uniformMatrix4fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
 {
     m_impl->uniformMatrix4fv(location, size, transpose, value);
 }
@@ -996,6 +1029,7 @@ PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attri
     webAttributes.canRecoverFromContextLoss = attrs.canRecoverFromContextLoss;
     webAttributes.noExtensions = attrs.noExtensions;
     webAttributes.shareResources = attrs.shareResources;
+    webAttributes.preferDiscreteGPU = attrs.preferDiscreteGPU;
 
     OwnPtr<WebKit::WebGraphicsContext3D> webContext = adoptPtr(WebKit::webKitPlatformSupport()->createOffscreenGraphicsContext3D(webAttributes));
     if (!webContext)
@@ -1155,24 +1189,24 @@ DELEGATE_TO_INTERNAL_3(texParameteri, GC3Denum, GC3Denum, GC3Dint)
 DELEGATE_TO_INTERNAL_9(texSubImage2D, GC3Denum, GC3Dint, GC3Dint, GC3Dint, GC3Dsizei, GC3Dsizei, GC3Denum, GC3Denum, const void*)
 
 DELEGATE_TO_INTERNAL_2(uniform1f, GC3Dint, GC3Dfloat)
-DELEGATE_TO_INTERNAL_3(uniform1fv, GC3Dint, GC3Dfloat*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform1fv, GC3Dint, GC3Dsizei, GC3Dfloat*)
 DELEGATE_TO_INTERNAL_2(uniform1i, GC3Dint, GC3Dint)
-DELEGATE_TO_INTERNAL_3(uniform1iv, GC3Dint, GC3Dint*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform1iv, GC3Dint, GC3Dsizei, GC3Dint*)
 DELEGATE_TO_INTERNAL_3(uniform2f, GC3Dint, GC3Dfloat, GC3Dfloat)
-DELEGATE_TO_INTERNAL_3(uniform2fv, GC3Dint, GC3Dfloat*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform2fv, GC3Dint, GC3Dsizei, GC3Dfloat*)
 DELEGATE_TO_INTERNAL_3(uniform2i, GC3Dint, GC3Dint, GC3Dint)
-DELEGATE_TO_INTERNAL_3(uniform2iv, GC3Dint, GC3Dint*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform2iv, GC3Dint, GC3Dsizei, GC3Dint*)
 DELEGATE_TO_INTERNAL_4(uniform3f, GC3Dint, GC3Dfloat, GC3Dfloat, GC3Dfloat)
-DELEGATE_TO_INTERNAL_3(uniform3fv, GC3Dint, GC3Dfloat*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform3fv, GC3Dint, GC3Dsizei, GC3Dfloat*)
 DELEGATE_TO_INTERNAL_4(uniform3i, GC3Dint, GC3Dint, GC3Dint, GC3Dint)
-DELEGATE_TO_INTERNAL_3(uniform3iv, GC3Dint, GC3Dint*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform3iv, GC3Dint, GC3Dsizei, GC3Dint*)
 DELEGATE_TO_INTERNAL_5(uniform4f, GC3Dint, GC3Dfloat, GC3Dfloat, GC3Dfloat, GC3Dfloat)
-DELEGATE_TO_INTERNAL_3(uniform4fv, GC3Dint, GC3Dfloat*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform4fv, GC3Dint, GC3Dsizei, GC3Dfloat*)
 DELEGATE_TO_INTERNAL_5(uniform4i, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint)
-DELEGATE_TO_INTERNAL_3(uniform4iv, GC3Dint, GC3Dint*, GC3Dsizei)
-DELEGATE_TO_INTERNAL_4(uniformMatrix2fv, GC3Dint, GC3Dboolean, GC3Dfloat*, GC3Dsizei)
-DELEGATE_TO_INTERNAL_4(uniformMatrix3fv, GC3Dint, GC3Dboolean, GC3Dfloat*, GC3Dsizei)
-DELEGATE_TO_INTERNAL_4(uniformMatrix4fv, GC3Dint, GC3Dboolean, GC3Dfloat*, GC3Dsizei)
+DELEGATE_TO_INTERNAL_3(uniform4iv, GC3Dint, GC3Dsizei, GC3Dint*)
+DELEGATE_TO_INTERNAL_4(uniformMatrix2fv, GC3Dint, GC3Dsizei, GC3Dboolean, GC3Dfloat*)
+DELEGATE_TO_INTERNAL_4(uniformMatrix3fv, GC3Dint, GC3Dsizei, GC3Dboolean, GC3Dfloat*)
+DELEGATE_TO_INTERNAL_4(uniformMatrix4fv, GC3Dint, GC3Dsizei, GC3Dboolean, GC3Dfloat*)
 
 DELEGATE_TO_INTERNAL_1(useProgram, Platform3DObject)
 DELEGATE_TO_INTERNAL_1(validateProgram, Platform3DObject)
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h b/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h
index d296eeb9b..be9db4287 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h
+++ b/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h
@@ -209,24 +209,24 @@ public:
     void texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, const void* pixels);
 
     void uniform1f(GC3Dint location, GC3Dfloat x);
-    void uniform1fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei);
+    void uniform1fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform1i(GC3Dint location, GC3Dint x);
-    void uniform1iv(GC3Dint location, GC3Dint* v, GC3Dsizei);
+    void uniform1iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
     void uniform2f(GC3Dint location, GC3Dfloat x, float y);
-    void uniform2fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei);
+    void uniform2fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform2i(GC3Dint location, GC3Dint x, GC3Dint y);
-    void uniform2iv(GC3Dint location, GC3Dint* v, GC3Dsizei);
+    void uniform2iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
     void uniform3f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z);
-    void uniform3fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei);
+    void uniform3fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform3i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z);
-    void uniform3iv(GC3Dint location, GC3Dint* v, GC3Dsizei);
+    void uniform3iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
     void uniform4f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w);
-    void uniform4fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei);
+    void uniform4fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform4i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z, GC3Dint w);
-    void uniform4iv(GC3Dint location, GC3Dint* v, GC3Dsizei);
-    void uniformMatrix2fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei);
-    void uniformMatrix3fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei);
-    void uniformMatrix4fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei);
+    void uniform4iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniformMatrix2fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix3fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix4fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
 
     void useProgram(Platform3DObject);
     void validateProgram(Platform3DObject);
diff --git a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
index a1cce45b0..149bfe12a 100755
--- a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
@@ -90,16 +90,16 @@ static const char allowIndexedDBMode[] = "allowIndexedDBMode";
 
 class AllowIndexedDBMainThreadBridge : public ThreadSafeRefCounted<AllowIndexedDBMainThreadBridge> {
 public:
-    static PassRefPtr<AllowIndexedDBMainThreadBridge> create(WebWorkerClientImpl* webWorkerClientImpl, const String& mode, const String& name)
+    static PassRefPtr<AllowIndexedDBMainThreadBridge> create(WebWorkerBase* webWorkerBase, const String& mode, const String& name)
     {
-        return adoptRef(new AllowIndexedDBMainThreadBridge(webWorkerClientImpl, mode, name));
+        return adoptRef(new AllowIndexedDBMainThreadBridge(webWorkerBase, mode, name));
     }
 
     // These methods are invoked on the worker context.
     void cancel()
     {
         MutexLocker locker(m_mutex);
-        m_webWorkerClientImpl = 0;
+        m_webWorkerBase = 0;
     }
 
     bool result()
@@ -111,31 +111,28 @@ public:
     void signalCompleted(bool result, const String& mode)
     {
         MutexLocker locker(m_mutex);
-        if (m_webWorkerClientImpl)
-            m_webWorkerClientImpl->postTaskForModeToWorkerContext(createCallbackTask(&didComplete, this, result), mode);
+        if (m_webWorkerBase)
+            m_webWorkerBase->postTaskForModeToWorkerContext(createCallbackTask(&didComplete, this, result), mode);
     }
 
 private:
-    AllowIndexedDBMainThreadBridge(WebWorkerClientImpl* webWorkerClientImpl, const String& mode, const String& name)
+    AllowIndexedDBMainThreadBridge(WebWorkerBase* webWorkerBase, const String& mode, const String& name)
         : m_result(false)
-        , m_webWorkerClientImpl(webWorkerClientImpl)
+        , m_webWorkerBase(webWorkerBase)
     {
-        WebFrameImpl* webFrame = static_cast<WebFrameImpl*>(webWorkerClientImpl->view()->mainFrame());
-        // webFrame is not deleted as long as the process is alive, relying on
-        // it to exist on the main thread should be ok.
+        WebCommonWorkerClient* commonClient = webWorkerBase->commonClient();
+        // See note about thread-safety below.
         WebWorkerBase::dispatchTaskToMainThread(
-            createCallbackTask(&allowIndexedDBTask, this, WebCore::AllowCrossThreadAccess(webFrame), name, mode));
+            createCallbackTask(&allowIndexedDBTask, this, WebCore::AllowCrossThreadAccess(commonClient), name, mode));
     }
 
-    static void allowIndexedDBTask(ScriptExecutionContext*, PassRefPtr<AllowIndexedDBMainThreadBridge> bridge, PassRefPtr<WebFrameImpl> prpWebFrame, const String& name, const String& mode)
+    static void allowIndexedDBTask(ScriptExecutionContext*, PassRefPtr<AllowIndexedDBMainThreadBridge> bridge, WebCommonWorkerClient* commonClient, const String& name, const String& mode)
     {
-        RefPtr<WebFrameImpl> webFrame = prpWebFrame;
-        WebViewImpl* webView = webFrame->viewImpl();
-        if (!webView) {
+        if (!commonClient) {
             bridge->signalCompleted(false, mode);
             return;
         }
-        bool allowed = !webView->permissionClient() || webView->permissionClient()->allowIndexedDB(webFrame.get(), name, WebSecurityOrigin());
+        bool allowed = commonClient->allowIndexedDB(name);
         bridge->signalCompleted(allowed, mode);
     }
 
@@ -146,29 +143,33 @@ private:
 
     bool m_result;
     Mutex m_mutex;
-    // WebWorkerClientImpl is never deleted as long as the renderer process
-    // is alive. We use it on the main thread to notify the worker thread that
-    // the permission result has been set. The underlying message proxy object
-    // is valid as long as the worker run loop hasn't returned
-    // MessageQueueTerminated, in which case we don't use the
-    // WebWorkerClientImpl.
-    WebWorkerClientImpl* m_webWorkerClientImpl;
+    // AllowIndexedDBMainThreadBridge uses two non-threadsafe classes across
+    // threads: WebWorkerBase and WebCommonWorkerClient.
+    // In the dedicated worker case, these are both the same object of type
+    // WebWorkerClientImpl, which isn't deleted for the life of the renderer
+    // process so we don't have to worry about use-after-frees.
+    // In the shared worker case, these are of type WebSharedWorkerImpl and
+    // chromium's WebSharedWorkerClientProxy, respectively. These are both
+    // deleted on the main thread in response to a request on the worker thread,
+    // but only after the worker run loop stops processing tasks. So even in
+    // the most interleaved case, we have:
+    // W AllowIndexedDBMainThreadBridge schedules allowIndexedDBTask
+    // M workerRunLoop marked as killed
+    // W runLoop stops and schedules object deletion on main thread
+    // M allowIndexedDBTask calls commonClient->allowIndexedDB()
+    // M WebWorkerBase and WebCommonWorkerClient are deleted
+    WebWorkerBase* m_webWorkerBase;
 };
 
 bool IDBFactoryBackendProxy::allowIDBFromWorkerThread(WorkerContext* workerContext, const String& name, const WebSecurityOrigin&)
 {
-    // FIXME: Bypass checking for permission so as not to block shared worker
-    // testing until a permissions check is implemented. This has to be fixed
-    // before m19 goes to beta. http://crbug.com/112855
-    if (workerContext->isSharedWorkerContext())
-        return true;
 
-    WebWorkerClientImpl* webWorkerClientImpl = static_cast<WebWorkerClientImpl*>(&workerContext->thread()->workerLoaderProxy());
+    WebWorkerBase* webWorkerBase = static_cast<WebWorkerBase*>(&workerContext->thread()->workerLoaderProxy());
     WorkerRunLoop& runLoop = workerContext->thread()->runLoop();
 
     String mode = allowIndexedDBMode;
     mode.append(String::number(runLoop.createUniqueId()));
-    RefPtr<AllowIndexedDBMainThreadBridge> bridge = AllowIndexedDBMainThreadBridge::create(webWorkerClientImpl, mode, name);
+    RefPtr<AllowIndexedDBMainThreadBridge> bridge = AllowIndexedDBMainThreadBridge::create(webWorkerBase, mode, name);
 
     // Either the bridge returns, or the queue gets terminated.
     if (runLoop.runInMode(workerContext, mode) == MessageQueueTerminated) {
diff --git a/Source/WebKit/chromium/src/NotificationPresenterImpl.cpp b/Source/WebKit/chromium/src/NotificationPresenterImpl.cpp
index 4b68235a1..99a7ea378 100644
--- a/Source/WebKit/chromium/src/NotificationPresenterImpl.cpp
+++ b/Source/WebKit/chromium/src/NotificationPresenterImpl.cpp
@@ -98,10 +98,10 @@ void NotificationPresenterImpl::notificationControllerDestroyed()
 {
 }
 
-NotificationPresenter::Permission NotificationPresenterImpl::checkPermission(ScriptExecutionContext* context)
+NotificationClient::Permission NotificationPresenterImpl::checkPermission(ScriptExecutionContext* context)
 {
     int result = m_presenter->checkPermission(WebSecurityOrigin(context->securityOrigin()));
-    return static_cast<NotificationPresenter::Permission>(result);
+    return static_cast<NotificationClient::Permission>(result);
 }
 
 void NotificationPresenterImpl::requestPermission(ScriptExecutionContext* context, PassRefPtr<VoidCallback> callback)
diff --git a/Source/WebKit/chromium/src/NotificationPresenterImpl.h b/Source/WebKit/chromium/src/NotificationPresenterImpl.h
index 3eb5a87da..cad5b8801 100644
--- a/Source/WebKit/chromium/src/NotificationPresenterImpl.h
+++ b/Source/WebKit/chromium/src/NotificationPresenterImpl.h
@@ -31,7 +31,7 @@
 #ifndef NotificationPresenterImpl_h
 #define NotificationPresenterImpl_h
 
-#include "NotificationPresenter.h"
+#include "NotificationClient.h"
 #include "VoidCallback.h"
 
 #include <wtf/HashMap.h>
@@ -43,7 +43,7 @@ namespace WebKit {
 
 class WebNotificationPresenter;
 
-class NotificationPresenterImpl : public WebCore::NotificationPresenter {
+class NotificationPresenterImpl : public WebCore::NotificationClient {
 public:
     NotificationPresenterImpl() : m_presenter(0) { }
 
@@ -55,7 +55,7 @@ public:
     virtual void cancel(WebCore::Notification* object);
     virtual void notificationObjectDestroyed(WebCore::Notification* object);
     virtual void notificationControllerDestroyed();
-    virtual WebCore::NotificationPresenter::Permission checkPermission(WebCore::ScriptExecutionContext*);
+    virtual WebCore::NotificationClient::Permission checkPermission(WebCore::ScriptExecutionContext*);
     virtual void requestPermission(WebCore::ScriptExecutionContext* , WTF::PassRefPtr<WebCore::VoidCallback> callback);
     virtual void cancelRequestsForPermission(WebCore::ScriptExecutionContext*) {}
 
diff --git a/Source/WebKit/chromium/src/WebCache.cpp b/Source/WebKit/chromium/src/WebCache.cpp
index fa260cc4c..d7bbc813b 100644
--- a/Source/WebKit/chromium/src/WebCache.cpp
+++ b/Source/WebKit/chromium/src/WebCache.cpp
@@ -31,14 +31,9 @@
 #include "config.h"
 #include "WebCache.h"
 
-// Instead of providing accessors, we make all members of MemoryCache public.
-// This will make it easier to track WebCore changes to the MemoryCache class.
-// FIXME: We should introduce public getters on the MemoryCache class.
-#define private public
 #include "MemoryCache.h"
-#undef private
 
-using namespace WebCore;
+using WebCore::MemoryCache;
 
 namespace WebKit {
 
@@ -83,11 +78,11 @@ void WebCache::getUsageStats(UsageStats* result)
 
     MemoryCache* cache = WebCore::memoryCache();
     if (cache) {
-        result->minDeadCapacity = cache->m_minDeadCapacity;
-        result->maxDeadCapacity = cache->m_maxDeadCapacity;
-        result->capacity = cache->m_capacity;
-        result->liveSize = cache->m_liveSize;
-        result->deadSize = cache->m_deadSize;
+        result->minDeadCapacity = cache->minDeadCapacity();
+        result->maxDeadCapacity = cache->maxDeadCapacity();
+        result->capacity = cache->capacity();
+        result->liveSize = cache->liveSize();
+        result->deadSize = cache->deadSize();
     } else
         memset(result, 0, sizeof(UsageStats));
 }
diff --git a/Source/WebKit/chromium/src/WebColor.cpp b/Source/WebKit/chromium/src/WebColorName.cpp
index 737338a8b..04d8ed8a8 100644
--- a/Source/WebKit/chromium/src/WebColor.cpp
+++ b/Source/WebKit/chromium/src/WebColorName.cpp
@@ -29,21 +29,21 @@
  */
 
 #include "config.h"
-#include "platform/WebColor.h"
+#include "WebColorName.h"
 
-#include "Color.h"
 #include "CSSValueKeywords.h"
+#include "Color.h"
 #include "RenderTheme.h"
 #include "UnusedParam.h"
-#include "platform/WebColorName.h"
+#include <public/WebColor.h>
 
 using namespace::WebCore;
 
 namespace WebKit {
 
-static int toCSSValueKeyword(WebColorName in_value)
+static int toCSSValueKeyword(WebColorName name)
 {
-    switch (in_value) {
+    switch (name) {
     case WebColorActiveBorder:
         return CSSValueActiveborder;
     case WebColorActiveCaption:
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
index 397308b52..c2dbee3b4 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
@@ -206,7 +206,7 @@ int WebCompositorInputHandlerImpl::identifier() const
     return m_identifier;
 }
 
-void WebCompositorInputHandlerImpl::willDraw(double frameBeginTimeMs)
+void WebCompositorInputHandlerImpl::willDraw(double monotonicTime)
 {
 }
 
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
index a2f13025d..83b4bd546 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
@@ -61,7 +61,7 @@ public:
 
     // WebCore::CCInputHandler implementation
     virtual int identifier() const;
-    virtual void willDraw(double frameBeginTimeMs);
+    virtual void willDraw(double monotonicTime);
 
 private:
     explicit WebCompositorInputHandlerImpl(WebCore::CCInputHandlerClient*);
diff --git a/Source/WebKit/chromium/src/WebDataSourceImpl.cpp b/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
index d6d98c752..501fd447c 100644
--- a/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
@@ -129,6 +129,11 @@ void WebDataSourceImpl::setDeferMainResourceDataLoad(bool defer)
     DocumentLoader::setDeferMainResourceDataLoad(defer);
 }
 
+void WebDataSourceImpl::setNavigationStartTime(double navigationStart)
+{
+    timing()->setNavigationStart(navigationStart);
+}
+
 WebNavigationType WebDataSourceImpl::toWebNavigationType(NavigationType type)
 {
     switch (type) {
diff --git a/Source/WebKit/chromium/src/WebDataSourceImpl.h b/Source/WebKit/chromium/src/WebDataSourceImpl.h
index 8cc2c80c6..3e8c8bb55 100644
--- a/Source/WebKit/chromium/src/WebDataSourceImpl.h
+++ b/Source/WebKit/chromium/src/WebDataSourceImpl.h
@@ -70,6 +70,7 @@ public:
     virtual void setExtraData(ExtraData*);
     virtual WebApplicationCacheHost* applicationCacheHost();
     virtual void setDeferMainResourceDataLoad(bool);
+    virtual void setNavigationStartTime(double);
 
     static WebNavigationType toWebNavigationType(WebCore::NavigationType type);
 
diff --git a/Source/WebKit/chromium/src/WebDragData.cpp b/Source/WebKit/chromium/src/WebDragData.cpp
index 9e634340e..322dfbaeb 100644
--- a/Source/WebKit/chromium/src/WebDragData.cpp
+++ b/Source/WebKit/chromium/src/WebDragData.cpp
@@ -69,8 +69,8 @@ void WebDragData::assign(const WebDragData& other)
 WebVector<WebDragData::Item> WebDragData::items() const
 {
     Vector<Item> itemList;
-    RefPtr<DOMStringList> types = m_private->types();
-    if (types->contains(mimeTypeTextPlain)) {
+    const HashSet<String>& types = m_private->types();
+    if (types.contains(mimeTypeTextPlain)) {
         Item item;
         item.storageType = Item::StorageTypeString;
         item.stringType = String(mimeTypeTextPlain);
@@ -78,7 +78,7 @@ WebVector<WebDragData::Item> WebDragData::items() const
         item.stringData = m_private->getData(mimeTypeTextPlain, ignored);
         itemList.append(item);
     }
-    if (types->contains(mimeTypeTextURIList)) {
+    if (types.contains(mimeTypeTextURIList)) {
         Item item;
         item.storageType = Item::StorageTypeString;
         item.stringType = String(mimeTypeTextURIList);
@@ -87,7 +87,7 @@ WebVector<WebDragData::Item> WebDragData::items() const
         item.title = m_private->urlTitle();
         itemList.append(item);
     }
-    if (types->contains(mimeTypeTextHTML)) {
+    if (types.contains(mimeTypeTextHTML)) {
         Item item;
         item.storageType = Item::StorageTypeString;
         item.stringType = String(mimeTypeTextHTML);
@@ -96,7 +96,7 @@ WebVector<WebDragData::Item> WebDragData::items() const
         item.baseURL = m_private->htmlBaseUrl();
         itemList.append(item);
     }
-    if (types->contains(mimeTypeDownloadURL)) {
+    if (types.contains(mimeTypeDownloadURL)) {
         Item item;
         item.storageType = Item::StorageTypeString;
         item.stringType = String(mimeTypeDownloadURL);
diff --git a/Source/WebKit/chromium/src/WebElement.cpp b/Source/WebKit/chromium/src/WebElement.cpp
index 43e51d4bf..e6a1b6e4e 100644
--- a/Source/WebKit/chromium/src/WebElement.cpp
+++ b/Source/WebKit/chromium/src/WebElement.cpp
@@ -34,6 +34,7 @@
 #include "WebDocument.h"
 
 #include "Element.h"
+#include "NamedNodeMap.h"
 #include "RenderBoxModelObject.h"
 #include "RenderObject.h"
 #include <wtf/PassRefPtr.h>
diff --git a/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp b/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
index b3a332b2a..c9ba0bc7b 100644
--- a/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
+++ b/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
@@ -68,7 +68,7 @@ WebFloatRect WebExternalTextureLayer::uvRect() const
 
 void WebExternalTextureLayer::invalidateRect(const WebFloatRect& updateRect)
 {
-    unwrap<WebExternalTextureLayerImpl>()->invalidateRect(updateRect);
+    unwrap<WebExternalTextureLayerImpl>()->setNeedsDisplayRect(updateRect);
 }
 
 WebExternalTextureLayer::WebExternalTextureLayer(const PassRefPtr<WebExternalTextureLayerImpl>& node)
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index adf202371..39897c823 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -1347,7 +1347,7 @@ WebString WebFrameImpl::selectionAsMarkup() const
     if (!range)
         return WebString();
 
-    return createMarkup(range.get(), 0);
+    return createMarkup(range.get(), 0, AnnotateForInterchange, false, ResolveNonLocalURLs);
 }
 
 void WebFrameImpl::selectWordAroundPosition(Frame* frame, VisiblePosition pos)
diff --git a/Source/WebKit/chromium/src/WebGeolocationPermissionRequest.cpp b/Source/WebKit/chromium/src/WebGeolocationPermissionRequest.cpp
index b4c7f3d17..6d7ec631a 100644
--- a/Source/WebKit/chromium/src/WebGeolocationPermissionRequest.cpp
+++ b/Source/WebKit/chromium/src/WebGeolocationPermissionRequest.cpp
@@ -39,7 +39,7 @@ namespace WebKit {
 
 WebSecurityOrigin WebGeolocationPermissionRequest::securityOrigin() const
 {
-    return WebSecurityOrigin(m_private->frame()->document()->securityOrigin());
+    return WebSecurityOrigin(m_private->scriptExecutionContext()->securityOrigin());
 }
 
 void WebGeolocationPermissionRequest::setIsAllowed(bool allowed)
diff --git a/Source/WebKit/chromium/src/WebInputElement.cpp b/Source/WebKit/chromium/src/WebInputElement.cpp
index 736165bbf..f5d52da80 100644
--- a/Source/WebKit/chromium/src/WebInputElement.cpp
+++ b/Source/WebKit/chromium/src/WebInputElement.cpp
@@ -33,8 +33,6 @@
 
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
-#include "RenderObject.h"
-#include "RenderTextControlSingleLine.h"
 #include "TextControlInnerElements.h"
 #include "platform/WebString.h"
 #include <wtf/PassRefPtr.h>
@@ -165,12 +163,7 @@ bool WebInputElement::isSpeechInputEnabled() const
 WebInputElement::SpeechInputState WebInputElement::getSpeechInputState() const
 {
 #if ENABLE(INPUT_SPEECH)
-    RenderObject* renderer = constUnwrap<HTMLInputElement>()->renderer();
-    if (!renderer)
-        return Idle;
-
-    RenderTextControlSingleLine* control = toRenderTextControlSingleLine(renderer);
-    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(control->speechButtonElement());
+    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(constUnwrap<HTMLInputElement>()->speechButtonElement());
     if (speechButton)
         return static_cast<WebInputElement::SpeechInputState>(speechButton->state());
 #endif
@@ -181,12 +174,7 @@ WebInputElement::SpeechInputState WebInputElement::getSpeechInputState() const
 void WebInputElement::startSpeechInput()
 {
 #if ENABLE(INPUT_SPEECH)
-    RenderObject* renderer = constUnwrap<HTMLInputElement>()->renderer();
-    if (!renderer)
-        return;
-
-    RenderTextControlSingleLine* control = toRenderTextControlSingleLine(renderer);
-    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(control->speechButtonElement());
+    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(constUnwrap<HTMLInputElement>()->speechButtonElement());
     if (speechButton)
         speechButton->startSpeechInput();
 #endif
@@ -195,12 +183,7 @@ void WebInputElement::startSpeechInput()
 void WebInputElement::stopSpeechInput()
 {
 #if ENABLE(INPUT_SPEECH)
-    RenderObject* renderer = constUnwrap<HTMLInputElement>()->renderer();
-    if (!renderer)
-        return;
-
-    RenderTextControlSingleLine* control = toRenderTextControlSingleLine(renderer);
-    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(control->speechButtonElement());
+    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(constUnwrap<HTMLInputElement>()->speechButtonElement());
     if (speechButton)
         speechButton->stopSpeechInput();
 #endif
diff --git a/Source/WebKit/chromium/src/WebLayerTreeView.cpp b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
index d2c0f0c12..3314dc2f5 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeView.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
@@ -26,9 +26,11 @@
 #include "config.h"
 #include "platform/WebLayerTreeView.h"
 
+#include "GraphicsContext3DPrivate.h"
 #include "WebLayerTreeViewImpl.h"
 #include "cc/CCLayerTreeHost.h"
 #include "platform/WebLayer.h"
+#include "platform/WebPoint.h"
 #include "platform/WebRect.h"
 #include "platform/WebSize.h"
 
@@ -51,11 +53,6 @@ WebLayerTreeView::Settings::operator CCSettings() const
     return settings;
 }
 
-WebLayerTreeView WebLayerTreeView::create(WebLayerTreeViewClient* client, const WebLayer& root, const WebLayerTreeView::Settings& settings)
-{
-    return WebLayerTreeView(WebLayerTreeViewImpl::create(client, root, settings));
-}
-
 void WebLayerTreeView::reset()
 {
     m_private.reset();
@@ -71,12 +68,23 @@ bool WebLayerTreeView::equals(const WebLayerTreeView& n) const
     return (m_private.get() == n.m_private.get());
 }
 
-void WebLayerTreeView::composite()
+bool WebLayerTreeView::initialize(WebLayerTreeViewClient* client, const WebLayer& root, const WebLayerTreeView::Settings& settings)
 {
-    if (CCProxy::hasImplThread())
-        m_private->setNeedsCommit();
+    m_private = WebLayerTreeViewImpl::create(client, root, settings);
+    return !isNull();
+}
+
+void WebLayerTreeView::setRootLayer(WebLayer *root)
+{
+    if (root)
+        m_private->setRootLayer(*root);
     else
-        m_private->composite();
+        m_private->setRootLayer(PassRefPtr<LayerChromium>());
+}
+
+int WebLayerTreeView::compositorIdentifier()
+{
+    return m_private->compositorIdentifier();
 }
 
 void WebLayerTreeView::setViewportSize(const WebSize& viewportSize)
@@ -89,38 +97,62 @@ WebSize WebLayerTreeView::viewportSize() const
     return WebSize(m_private->viewportSize());
 }
 
-bool WebLayerTreeView::compositeAndReadback(void *pixels, const WebRect& rect)
+void WebLayerTreeView::setVisible(bool visible)
 {
-    return m_private->compositeAndReadback(pixels, rect);
+    m_private->setVisible(visible);
 }
 
-void WebLayerTreeView::setRootLayer(WebLayer *root)
+void WebLayerTreeView::setPageScaleFactorAndLimits(float pageScaleFactor, float minimum, float maximum)
 {
-    if (root)
-        m_private->setRootLayer(*root);
+    m_private->setPageScaleFactorAndLimits(pageScaleFactor, minimum, maximum);
+}
+
+void WebLayerTreeView::startPageScaleAnimation(const WebPoint& scroll, bool useAnchor, float newPageScale, double durationSec)
+{
+    m_private->startPageScaleAnimation(IntSize(scroll.x, scroll.y), useAnchor, newPageScale, durationSec);
+}
+
+void WebLayerTreeView::setNeedsAnimate()
+{
+    m_private->setNeedsAnimate();
+}
+
+void WebLayerTreeView::setNeedsRedraw()
+{
+    m_private->setNeedsRedraw();
+}
+
+void WebLayerTreeView::composite()
+{
+    if (CCProxy::hasImplThread())
+        m_private->setNeedsCommit();
     else
-        m_private->setRootLayer(PassRefPtr<LayerChromium>());
+        m_private->composite();
+}
+
+void WebLayerTreeView::updateAnimations(double frameBeginTime)
+{
+    m_private->updateAnimations(frameBeginTime);
 }
 
-WebLayerTreeView::WebLayerTreeView(const PassRefPtr<CCLayerTreeHost>& node)
-    : m_private(node)
+bool WebLayerTreeView::compositeAndReadback(void *pixels, const WebRect& rect)
 {
+    return m_private->compositeAndReadback(pixels, rect);
 }
 
-WebLayerTreeView& WebLayerTreeView::operator=(const PassRefPtr<CCLayerTreeHost>& node)
+void WebLayerTreeView::finishAllRendering()
 {
-    m_private = node;
-    return *this;
+    m_private->finishAllRendering();
 }
 
-WebLayerTreeView::operator PassRefPtr<CCLayerTreeHost>() const
+WebGraphicsContext3D* WebLayerTreeView::context()
 {
-    return m_private.get();
+    return GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_private->context());
 }
 
-void WebLayerTreeView::setNeedsRedraw()
+void WebLayerTreeView::loseCompositorContext(int numTimes)
 {
-    m_private->setNeedsRedraw();
+    m_private->loseContext(numTimes);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
index 29d033215..335879b66 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
@@ -78,7 +78,7 @@ void WebLayerTreeViewImpl::applyScrollAndScale(const WebCore::IntSize& scrollDel
         m_client->applyScrollAndScale(WebSize(scrollDelta), pageScale);
 }
 
-PassRefPtr<GraphicsContext3D> WebLayerTreeViewImpl::createLayerTreeHostContext3D()
+PassRefPtr<GraphicsContext3D> WebLayerTreeViewImpl::createContext()
 {
     if (!m_client)
         return 0;
@@ -89,20 +89,22 @@ PassRefPtr<GraphicsContext3D> WebLayerTreeViewImpl::createLayerTreeHostContext3D
     return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(webContext.release(), GraphicsContext3D::RenderDirectlyToHostWindow, false /* preserveDrawingBuffer */ );
 }
 
-void WebLayerTreeViewImpl::didCommitAndDrawFrame()
+void WebLayerTreeViewImpl::didRecreateContext(bool success)
 {
-    // FIXME: route this up to the WebLayerTreeView client
+    if (m_client)
+        m_client->didRebindGraphicsContext(success);
 }
 
-void WebLayerTreeViewImpl::didCompleteSwapBuffers()
+void WebLayerTreeViewImpl::didCommitAndDrawFrame()
 {
-    // FIXME: route this up to the WebLayerTreeView client
+    if (m_client)
+        m_client->didCommitAndDrawFrame();
 }
 
-void WebLayerTreeViewImpl::didRecreateGraphicsContext(bool success)
+void WebLayerTreeViewImpl::didCompleteSwapBuffers()
 {
     if (m_client)
-        m_client->didRebindGraphicsContext(success);
+        m_client->didCompleteSwapBuffers();
 }
 
 void WebLayerTreeViewImpl::scheduleComposite()
diff --git a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
index 580e9af84..b1b26d0fc 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
+++ b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
@@ -44,8 +44,8 @@ private:
     virtual void updateAnimations(double frameBeginTime);
     virtual void layout();
     virtual void applyScrollAndScale(const WebCore::IntSize& scrollDelta, float pageScale);
-    virtual PassRefPtr<WebCore::GraphicsContext3D> createLayerTreeHostContext3D();
-    virtual void didRecreateGraphicsContext(bool success);
+    virtual PassRefPtr<WebCore::GraphicsContext3D> createContext();
+    virtual void didRecreateContext(bool success);
     virtual void didCommitAndDrawFrame();
     virtual void didCompleteSwapBuffers();
 
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index ec74b6bea..74c4a7200 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -152,7 +152,7 @@ void WebMediaPlayerClientImpl::repaint()
     ASSERT(m_mediaPlayer);
 #if USE(ACCELERATED_COMPOSITING)
     if (m_videoLayer && supportsAcceleratedRendering())
-        m_videoLayer->contentChanged();
+        m_videoLayer->setNeedsDisplay();
 #endif
     m_mediaPlayer->repaint();
 }
diff --git a/Source/WebKit/chromium/src/WebNamedNodeMap.cpp b/Source/WebKit/chromium/src/WebNamedNodeMap.cpp
index e2455e6b9..ba5f29625 100644
--- a/Source/WebKit/chromium/src/WebNamedNodeMap.cpp
+++ b/Source/WebKit/chromium/src/WebNamedNodeMap.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "WebNamedNodeMap.h"
 
+#include "Element.h"
 #include "NamedNodeMap.h"
 #include "Node.h"
 #include "WebAttribute.h"
@@ -63,7 +64,7 @@ unsigned WebNamedNodeMap::length() const
 
 WebAttribute WebNamedNodeMap::attributeItem(unsigned index) const
 {
-    return WebAttribute(m_private->attributeItem(index));
+    return WebAttribute(m_private->element()->attributeItem(index));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebOptionElement.cpp b/Source/WebKit/chromium/src/WebOptionElement.cpp
index d48492594..c71f7b565 100644
--- a/Source/WebKit/chromium/src/WebOptionElement.cpp
+++ b/Source/WebKit/chromium/src/WebOptionElement.cpp
@@ -83,7 +83,7 @@ bool WebOptionElement::isEnabled() const
 }
 
 WebOptionElement::WebOptionElement(const PassRefPtr<HTMLOptionElement>& elem)
-    : WebFormControlElement(elem)
+    : WebElement(elem)
 {
 }
 
diff --git a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
new file mode 100644
index 000000000..bc810c7b1
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WebPagePopup.h"
+
+namespace WebKit {
+
+// WebPagePopupImpl ----------------------------------------------------------------
+
+// FIXME: WebPagePopupImpl implementation will be written here.
+
+// WebPagePopup ----------------------------------------------------------------
+
+WebPagePopup* WebPagePopup::create(WebWidgetClient*)
+{
+    // FIXME: Returns a WebPagePopupImpl object.
+    return 0;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebPageSerializer.cpp b/Source/WebKit/chromium/src/WebPageSerializer.cpp
index dc2bc99e3..1ad70b1b4 100644
--- a/Source/WebKit/chromium/src/WebPageSerializer.cpp
+++ b/Source/WebKit/chromium/src/WebPageSerializer.cpp
@@ -127,7 +127,7 @@ void retrieveResourcesForElement(Element* element,
 
     // Ignore URLs that have a non-standard protocols. Since the FTP protocol
     // does no have a cache mechanism, we skip it as well.
-    if (!url.protocolInHTTPFamily() && !url.isLocalFile())
+    if (!url.protocolIsInHTTPFamily() && !url.isLocalFile())
         return;
 
     if (!resourceURLs->contains(url))
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 10c3e2e4b..a71703b15 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -370,8 +370,8 @@ void WebPluginContainerImpl::setBackingIOSurfaceId(int width,
 void WebPluginContainerImpl::commitBackingTexture()
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (m_platformLayer.get())
-        m_platformLayer->invalidateRect(FloatRect(FloatPoint(), m_platformLayer->bounds()));
+    if (m_platformLayer)
+        m_platformLayer->setNeedsDisplay();
 #endif
 }
 
@@ -435,6 +435,14 @@ void WebPluginContainerImpl::zoomLevelChanged(double zoomLevel)
     view->fullFramePluginZoomLevelChanged(zoomLevel);
 }
  
+void WebPluginContainerImpl::setOpaque(bool opaque)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_platformLayer)
+        m_platformLayer->setOpaque(opaque);
+#endif
+}
+
 bool WebPluginContainerImpl::isRectTopmost(const WebRect& rect)
 {
     Page* page = m_element->document()->page();
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.h b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
index 898130084..9d970f2f8 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -104,6 +104,7 @@ public:
     virtual WebString executeScriptURL(const WebURL&, bool popupsAllowed);
     virtual void loadFrameRequest(const WebURLRequest&, const WebString& target, bool notifyNeeded, void* notifyData);
     virtual void zoomLevelChanged(double zoomLevel);    
+    virtual void setOpaque(bool);
     virtual bool isRectTopmost(const WebRect&);
 
     // This cannot be null.
diff --git a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
index f1960eb31..d297a828c 100644
--- a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -34,7 +34,7 @@
 #include "AbstractDatabase.h"
 #include "RuntimeEnabledFeatures.h"
 #include "WebMediaPlayerClientImpl.h"
-#include "websockets/WebSocket.h"
+#include "Modules/websockets/WebSocket.h"
 
 #include <wtf/UnusedParam.h>
 
@@ -260,6 +260,22 @@ bool WebRuntimeFeatures::isSpeechInputEnabled()
     return RuntimeEnabledFeatures::speechInputEnabled();
 }
 
+void WebRuntimeFeatures::enableScriptedSpeech(bool enable)
+{
+#if ENABLE(SCRIPTED_SPEECH)
+    RuntimeEnabledFeatures::setScriptedSpeechEnabled(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isScriptedSpeechEnabled()
+{
+#if ENABLE(SCRIPTED_SPEECH)
+    return RuntimeEnabledFeatures::scriptedSpeechEnabled();
+#else
+    return false;
+#endif
+}
+
 void WebRuntimeFeatures::enableXHRResponseBlob(bool enable)
 {
 #if ENABLE(XHR_RESPONSE_BLOB)
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index 485a5b051..3b3a84f98 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -109,6 +109,11 @@ void WebSettingsImpl::setMinimumLogicalFontSize(int size)
     m_settings->setMinimumLogicalFontSize(size);
 }
 
+void WebSettingsImpl::setDefaultDeviceScaleFactor(int defaultDeviceScaleFactor)
+{
+    m_settings->setDefaultDeviceScaleFactor(defaultDeviceScaleFactor);
+}
+
 void WebSettingsImpl::setDefaultTextEncodingName(const WebString& encoding)
 {
     m_settings->setDefaultTextEncodingName((String)encoding);
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index 51d9323a4..7024b5164 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -54,6 +54,7 @@ public:
     virtual void setDefaultFixedFontSize(int);
     virtual void setMinimumFontSize(int);
     virtual void setMinimumLogicalFontSize(int);
+    virtual void setDefaultDeviceScaleFactor(int);
     virtual void setDefaultTextEncodingName(const WebString&);
     virtual void setJavaScriptEnabled(bool);
     virtual void setWebSecurityEnabled(bool);
diff --git a/Source/WebKit/chromium/src/WebSocketImpl.cpp b/Source/WebKit/chromium/src/WebSocketImpl.cpp
index f0bf28206..30a6033d3 100644
--- a/Source/WebKit/chromium/src/WebSocketImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSocketImpl.cpp
@@ -105,10 +105,19 @@ WebString WebSocketImpl::subprotocol()
 #endif
 }
 
+WebString WebSocketImpl::extensions()
+{
+#if ENABLE(WEB_SOCKETS)
+    return m_private->extensions();
+#else
+    ASSERT_NOT_REACHED();
+#endif
+}
+
 bool WebSocketImpl::sendText(const WebString& message)
 {
 #if ENABLE(WEB_SOCKETS)
-    return m_private->send(message);
+    return m_private->send(message) == ThreadableWebSocketChannel::SendSuccess;
 #else
     ASSERT_NOT_REACHED();
 #endif
@@ -117,7 +126,7 @@ bool WebSocketImpl::sendText(const WebString& message)
 bool WebSocketImpl::sendArrayBuffer(const WebArrayBuffer& webArrayBuffer)
 {
 #if ENABLE(WEB_SOCKETS)
-    return m_private->send(*PassRefPtr<ArrayBuffer>(webArrayBuffer));
+    return m_private->send(*PassRefPtr<ArrayBuffer>(webArrayBuffer)) == ThreadableWebSocketChannel::SendSuccess;
 #else
     ASSERT_NOT_REACHED();
 #endif
diff --git a/Source/WebKit/chromium/src/WebSocketImpl.h b/Source/WebKit/chromium/src/WebSocketImpl.h
index 3d42bd506..ef14b18c7 100644
--- a/Source/WebKit/chromium/src/WebSocketImpl.h
+++ b/Source/WebKit/chromium/src/WebSocketImpl.h
@@ -53,25 +53,26 @@ public:
 
     bool isNull() const { return !m_private; }
 
-    BinaryType binaryType() const;
-    virtual bool setBinaryType(BinaryType);
-    virtual void connect(const WebURL&, const WebString& protocol);
-    virtual WebString subprotocol();
-    virtual bool sendText(const WebString&);
-    virtual bool sendArrayBuffer(const WebArrayBuffer&);
-    virtual unsigned long bufferedAmount() const;
-    virtual void close(int code, const WebString& reason);
-    virtual void fail(const WebString& reason);
-    virtual void disconnect();
+    virtual BinaryType binaryType() const OVERRIDE;
+    virtual bool setBinaryType(BinaryType) OVERRIDE;
+    virtual void connect(const WebURL&, const WebString& protocol) OVERRIDE;
+    virtual WebString subprotocol() OVERRIDE;
+    virtual WebString extensions() OVERRIDE;
+    virtual bool sendText(const WebString&) OVERRIDE;
+    virtual bool sendArrayBuffer(const WebArrayBuffer&) OVERRIDE;
+    virtual unsigned long bufferedAmount() const OVERRIDE;
+    virtual void close(int code, const WebString& reason) OVERRIDE;
+    virtual void fail(const WebString& reason) OVERRIDE;
+    virtual void disconnect() OVERRIDE;
 
     // WebSocketChannelClient
-    virtual void didConnect();
-    virtual void didReceiveMessage(const String& message);
-    virtual void didReceiveBinaryData(PassOwnPtr<Vector<char> > binaryData);
-    virtual void didReceiveMessageError();
-    virtual void didUpdateBufferedAmount(unsigned long bufferedAmount);
-    virtual void didStartClosingHandshake();
-    virtual void didClose(unsigned long bufferedAmount, ClosingHandshakeCompletionStatus, unsigned short code, const String& reason);
+    virtual void didConnect() OVERRIDE;
+    virtual void didReceiveMessage(const String& message) OVERRIDE;
+    virtual void didReceiveBinaryData(PassOwnPtr<Vector<char> > binaryData) OVERRIDE;
+    virtual void didReceiveMessageError() OVERRIDE;
+    virtual void didUpdateBufferedAmount(unsigned long bufferedAmount) OVERRIDE;
+    virtual void didStartClosingHandshake() OVERRIDE;
+    virtual void didClose(unsigned long bufferedAmount, ClosingHandshakeCompletionStatus, unsigned short code, const String& reason) OVERRIDE;
 
 private:
     RefPtr<WebCore::WebSocketChannel> m_private;
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 55a2052a4..52a022ce9 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -34,6 +34,7 @@
 #include "AutofillPopupMenuClient.h"
 #include "AXObjectCache.h"
 #include "BackForwardListChromium.h"
+#include "cc/CCProxy.h"
 #include "CSSStyleSelector.h"
 #include "CSSValueKeywords.h"
 #include "Chrome.h"
@@ -73,6 +74,7 @@
 #include "Image.h"
 #include "ImageBuffer.h"
 #include "InspectorController.h"
+#include "InspectorInstrumentation.h"
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
 #include "LayerChromium.h"
@@ -102,6 +104,7 @@
 #include "SecurityOrigin.h"
 #include "SecurityPolicy.h"
 #include "Settings.h"
+#include "SharedGraphicsContext3D.h"
 #include "SpeechInputClientImpl.h"
 #include "TextIterator.h"
 #include "Timer.h"
@@ -123,6 +126,8 @@
 #include "WebInputEventConversion.h"
 #include "WebKit.h"
 #include "platform/WebKitPlatformSupport.h"
+#include "platform/WebLayer.h"
+#include "platform/WebLayerTreeView.h"
 #include "WebMediaPlayerAction.h"
 #include "WebNode.h"
 #include "WebPlugin.h"
@@ -137,7 +142,6 @@
 #include "platform/WebString.h"
 #include "platform/WebVector.h"
 #include "WebViewClient.h"
-#include "cc/CCProxy.h"
 #include <wtf/ByteArray.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
@@ -168,27 +172,6 @@
 using namespace WebCore;
 using namespace std;
 
-namespace {
-
-WebKit::WebGraphicsContext3D::Attributes getCompositorContextAttributes(bool threaded)
-{
-    // Explicitly disable antialiasing for the compositor. As of the time of
-    // this writing, the only platform that supported antialiasing for the
-    // compositor was Mac OS X, because the on-screen OpenGL context creation
-    // code paths on Windows and Linux didn't yet have multisampling support.
-    // Mac OS X essentially always behaves as though it's rendering offscreen.
-    // Multisampling has a heavy cost especially on devices with relatively low
-    // fill rate like most notebooks, and the Mac implementation would need to
-    // be optimized to resolve directly into the IOSurface shared between the
-    // GPU and browser processes. For these reasons and to avoid platform
-    // disparities we explicitly disable antialiasing.
-    WebKit::WebGraphicsContext3D::Attributes attributes;
-    attributes.antialias = false;
-    attributes.shareResources = true;
-    attributes.forUseOnAnotherThread = threaded;
-    return attributes;
-}
-
 // The following constants control parameters for automated scaling of webpages
 // (such as due to a double tap gesture or find in page etc.). These are
 // experimentally determined.
@@ -197,8 +180,6 @@ static const float minScaleDifference = 0.01;
 static const float doubleTapZoomContentDefaultMargin = 5;
 static const float doubleTapZoomContentMinimumMargin = 2;
 
-} // anonymous namespace
-
 namespace WebKit {
 
 // Change the text zoom level by kTextSizeMultiplierRatio each time the user
@@ -525,7 +506,7 @@ void WebViewImpl::mouseDown(const WebMouseEvent& event)
         || (event.button == WebMouseEvent::ButtonLeft
             && event.modifiers & WebMouseEvent::ControlKey))
         mouseContextMenu(event);
-#elif OS(UNIX)
+#elif OS(UNIX) || OS(ANDROID)
     if (event.button == WebMouseEvent::ButtonRight)
         mouseContextMenu(event);
 #endif
@@ -627,8 +608,8 @@ bool WebViewImpl::gestureEvent(const WebGestureEvent& event)
 
 void WebViewImpl::startPageScaleAnimation(const IntPoint& scroll, bool useAnchor, float newScale, double durationSec)
 {
-    if (m_layerTreeHost)
-        m_layerTreeHost->startPageScaleAnimation(IntSize(scroll.x(), scroll.y()), useAnchor, newScale, durationSec);
+    if (!m_layerTreeView.isNull())
+        m_layerTreeView.startPageScaleAnimation(scroll, useAnchor, newScale, durationSec);
 }
 #endif
 
@@ -1264,6 +1245,11 @@ void WebViewImpl::didExitFullScreen()
 #endif
 }
 
+void WebViewImpl::instrumentBeginFrame()
+{
+    InspectorInstrumentation::didBeginFrame(m_page.get());
+}
+
 void WebViewImpl::animate(double frameBeginTime)
 {
 #if ENABLE(REQUEST_ANIMATION_FRAME)
@@ -1276,7 +1262,7 @@ void WebViewImpl::animate(double frameBeginTime)
     // In composited mode, we always go through the compositor so it can apply
     // appropriate flow-control mechanisms.
     if (isAcceleratedCompositingActive())
-        m_layerTreeHost->updateAnimations(frameBeginTime);
+        m_layerTreeView.updateAnimations(frameBeginTime);
     else
 #endif
         updateAnimations(frameBeginTime);
@@ -1324,6 +1310,7 @@ void WebViewImpl::layout()
 #if USE(ACCELERATED_COMPOSITING)
 void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect)
 {
+    ASSERT(!m_layerTreeView.isNull());
 #if USE(SKIA)
     PlatformContextSkia context(canvas);
 
@@ -1342,7 +1329,7 @@ void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect
     OwnPtr<ImageBuffer> imageBuffer(ImageBuffer::create(rect.size()));
     RefPtr<ByteArray> pixelArray(ByteArray::create(rect.width() * rect.height() * 4));
     if (imageBuffer && pixelArray) {
-        m_layerTreeHost->compositeAndReadback(pixelArray->data(), invertRect);
+        m_layerTreeView.compositeAndReadback(pixelArray->data(), invertRect);
         imageBuffer->putByteArray(Premultiplied, pixelArray.get(), rect.size(), IntRect(IntPoint(), rect.size()), IntPoint());
         gc.save();
         gc.translate(IntSize(0, bitmapHeight));
@@ -1364,7 +1351,7 @@ void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect)
         if (canvas) {
             // Clip rect to the confines of the rootLayerTexture.
             IntRect resizeRect(rect);
-            resizeRect.intersect(IntRect(IntPoint(0, 0), m_layerTreeHost->viewportSize()));
+            resizeRect.intersect(IntRect(IntPoint(0, 0), m_layerTreeView.viewportSize()));
             doPixelReadbackToCanvas(canvas, resizeRect);
         }
 #endif
@@ -1394,7 +1381,7 @@ void WebViewImpl::composite(bool)
 {
 #if USE(ACCELERATED_COMPOSITING)
     if (CCProxy::hasImplThread())
-        m_layerTreeHost->setNeedsRedraw();
+        m_layerTreeView.setNeedsRedraw();
     else {
         ASSERT(isAcceleratedCompositingActive());
         if (!page())
@@ -1403,7 +1390,7 @@ void WebViewImpl::composite(bool)
         if (m_pageOverlays)
             m_pageOverlays->update();
 
-        m_layerTreeHost->composite();
+        m_layerTreeView.composite();
     }
 #endif
 }
@@ -1411,16 +1398,16 @@ void WebViewImpl::composite(bool)
 void WebViewImpl::setNeedsRedraw()
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (m_layerTreeHost && isAcceleratedCompositingActive())
-        m_layerTreeHost->setNeedsRedraw();
+    if (!m_layerTreeView.isNull() && isAcceleratedCompositingActive())
+        m_layerTreeView.setNeedsRedraw();
 #endif
 }
 
 void WebViewImpl::loseCompositorContext(int numTimes)
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (m_layerTreeHost)
-        m_layerTreeHost->loseCompositorContext(numTimes);
+    if (!m_layerTreeView.isNull())
+        m_layerTreeView.loseCompositorContext(numTimes);
 #endif
 }
 
@@ -2261,15 +2248,27 @@ void WebViewImpl::enableFixedLayoutMode(bool enable)
 #endif
 }
 
-void WebViewImpl::enableAutoResizeMode(bool enable, const WebSize& minSize, const WebSize& maxSize)
+
+void WebViewImpl::enableAutoResizeMode(const WebSize& minSize, const WebSize& maxSize)
 {
-    m_shouldAutoResize = enable;
+    m_shouldAutoResize = true;
     m_minAutoSize = minSize;
     m_maxAutoSize = maxSize;
-    if (!mainFrameImpl() || !mainFrameImpl()->frame() || !mainFrameImpl()->frame()->view())
-        return;
+    configureAutoResizeMode();
+}
 
-    mainFrameImpl()->frame()->view()->enableAutoSizeMode(m_shouldAutoResize, m_minAutoSize, m_maxAutoSize);
+void WebViewImpl::disableAutoResizeMode()
+{
+    m_shouldAutoResize = false;
+    configureAutoResizeMode();
+}
+
+void WebViewImpl::enableAutoResizeMode(bool enable, const WebSize& minSize, const WebSize& maxSize)
+{
+    if (enable)
+        enableAutoResizeMode(minSize, maxSize);
+    else
+        disableAutoResizeMode();
 }
 
 void WebViewImpl::setPageScaleFactorLimits(float minPageScale, float maxPageScale)
@@ -2302,8 +2301,8 @@ bool WebViewImpl::computePageScaleFactorLimits()
 
     float clampedScale = clampPageScaleFactorToLimits(pageScaleFactor());
 #if USE(ACCELERATED_COMPOSITING)
-    if (m_layerTreeHost)
-        m_layerTreeHost->setPageScaleFactorAndLimits(clampedScale, m_minimumPageScaleFactor, m_maximumPageScaleFactor);
+    if (!m_layerTreeView.isNull())
+        m_layerTreeView.setPageScaleFactorAndLimits(clampedScale, m_minimumPageScaleFactor, m_maximumPageScaleFactor);
 #endif
     if (clampedScale != pageScaleFactor()) {
         setPageScaleFactorPreservingScrollOffset(clampedScale);
@@ -2582,6 +2581,14 @@ void WebViewImpl::sendResizeEventAndRepaint()
     }
 }
 
+void WebViewImpl::configureAutoResizeMode()
+{
+    if (!mainFrameImpl() || !mainFrameImpl()->frame() || !mainFrameImpl()->frame()->view())
+        return;
+
+    mainFrameImpl()->frame()->view()->enableAutoSizeMode(m_shouldAutoResize, m_minAutoSize, m_maxAutoSize);
+}
+
 unsigned long WebViewImpl::createUniqueIdentifierForRequest()
 {
     if (m_page)
@@ -2929,17 +2936,12 @@ void WebViewImpl::addPageOverlay(WebPageOverlay* overlay, int zOrder)
         m_pageOverlays = PageOverlayList::create(this);
 
     m_pageOverlays->add(overlay, zOrder);
-    setRootLayerNeedsDisplay();
 }
 
 void WebViewImpl::removePageOverlay(WebPageOverlay* overlay)
 {
-    if (m_pageOverlays && m_pageOverlays->remove(overlay)) {
-        setRootLayerNeedsDisplay();
-
-        if (m_pageOverlays->empty())
-            m_pageOverlays = nullptr;
-    }
+    if (m_pageOverlays && m_pageOverlays->remove(overlay) && m_pageOverlays->empty())
+        m_pageOverlays = nullptr;
 }
 
 void WebViewImpl::setOverlayLayer(WebCore::GraphicsLayer* layer)
@@ -3047,29 +3049,31 @@ void WebViewImpl::setRootGraphicsLayer(GraphicsLayer* layer)
         }
         m_nonCompositedContentHost->setScrollLayer(scrollLayer);
     }
-    if (m_layerTreeHost)
-        m_layerTreeHost->setRootLayer(layer ? layer->platformLayer() : 0);
+
+    if (layer)
+        m_rootLayer = WebLayer(layer->platformLayer());
+
+    if (!m_layerTreeView.isNull())
+        m_layerTreeView.setRootLayer(layer ? &m_rootLayer : 0);
 
     IntRect damagedRect(0, 0, m_size.width, m_size.height);
     if (!m_isAcceleratedCompositingActive)
         m_client->didInvalidateRect(damagedRect);
 }
 
-void WebViewImpl::setRootLayerNeedsDisplay()
+void WebViewImpl::scheduleCompositingLayerSync()
 {
-    if (m_layerTreeHost)
-        m_layerTreeHost->setNeedsCommit();
+    m_layerTreeView.setNeedsRedraw();
 }
 
-void WebViewImpl::scrollRootLayerRect(const IntSize& scrollDelta, const IntRect& clipRect)
+void WebViewImpl::scrollRootLayerRect(const IntSize&, const IntRect&)
 {
     updateLayerTreeViewport();
-    setRootLayerNeedsDisplay();
 }
 
 void WebViewImpl::invalidateRootLayerRect(const IntRect& rect)
 {
-    ASSERT(m_layerTreeHost);
+    ASSERT(!m_layerTreeView.isNull());
 
     if (!page())
         return;
@@ -3078,7 +3082,6 @@ void WebViewImpl::invalidateRootLayerRect(const IntRect& rect)
     IntRect dirtyRect = view->windowToContents(rect);
     updateLayerTreeViewport();
     m_nonCompositedContentHost->invalidateRect(dirtyRect);
-    setRootLayerNeedsDisplay();
 }
 
 NonCompositedContentHost* WebViewImpl::nonCompositedContentHost()
@@ -3091,8 +3094,8 @@ void WebViewImpl::scheduleAnimation()
 {
     if (isAcceleratedCompositingActive()) {
         if (CCProxy::hasImplThread()) {
-            ASSERT(m_layerTreeHost);
-            m_layerTreeHost->setNeedsAnimate();
+            ASSERT(!m_layerTreeView.isNull());
+            m_layerTreeView.setNeedsAnimate();
         } else
             m_client->scheduleAnimation();
     } else
@@ -3145,26 +3148,26 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
         m_isAcceleratedCompositingActive = false;
         // We need to finish all GL rendering before sending didDeactivateCompositor() to prevent
         // flickering when compositing turns off.
-        if (m_layerTreeHost)
-            m_layerTreeHost->finishAllRendering();
+        if (!m_layerTreeView.isNull())
+            m_layerTreeView.finishAllRendering();
         m_client->didDeactivateCompositor();
-    } else if (m_layerTreeHost) {
+    } else if (!m_layerTreeView.isNull()) {
         m_isAcceleratedCompositingActive = true;
         updateLayerTreeViewport();
 
-        m_client->didActivateCompositor(m_layerTreeHost->compositorIdentifier());
+        m_client->didActivateCompositor(m_layerTreeView.compositorIdentifier());
     } else {
         TRACE_EVENT("WebViewImpl::setIsAcceleratedCompositingActive(true)", this, 0);
 
-        WebCore::CCSettings ccSettings;
-        ccSettings.acceleratePainting = page()->settings()->acceleratedDrawingEnabled();
-        ccSettings.compositeOffscreen = settings()->compositeToTextureEnabled();
-        ccSettings.showFPSCounter = settings()->showFPSCounter();
-        ccSettings.showPlatformLayerTree = settings()->showPlatformLayerTree();
+        WebLayerTreeView::Settings layerTreeViewSettings;
+        layerTreeViewSettings.acceleratePainting = page()->settings()->acceleratedDrawingEnabled();
+        layerTreeViewSettings.compositeOffscreen = settings()->compositeToTextureEnabled();
+        layerTreeViewSettings.showFPSCounter = settings()->showFPSCounter();
+        layerTreeViewSettings.showPlatformLayerTree = settings()->showPlatformLayerTree();
 
-        ccSettings.perTilePainting = page()->settings()->perTileDrawingEnabled();
-        ccSettings.partialSwapEnabled = page()->settings()->partialSwapEnabled();
-        ccSettings.threadedAnimationEnabled = page()->settings()->threadedAnimationEnabled();
+        layerTreeViewSettings.perTilePainting = page()->settings()->perTileDrawingEnabled();
+        layerTreeViewSettings.partialSwapEnabled = page()->settings()->partialSwapEnabled();
+        layerTreeViewSettings.threadedAnimationEnabled = page()->settings()->threadedAnimationEnabled();
 
         m_nonCompositedContentHost = NonCompositedContentHost::create(WebViewImplContentPainter::create(this));
         m_nonCompositedContentHost->setShowDebugBorders(page()->settings()->showDebugBorders());
@@ -3172,17 +3175,16 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
         if (page() && page()->mainFrame()->view())
             m_nonCompositedContentHost->setBackgroundColor(page()->mainFrame()->view()->documentBackgroundColor());
 
-        m_layerTreeHost = CCLayerTreeHost::create(this, ccSettings);
-        if (m_layerTreeHost) {
-            m_layerTreeHost->setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
+        m_layerTreeView.initialize(this, m_rootLayer, layerTreeViewSettings);
+        if (!m_layerTreeView.isNull()) {
+            m_layerTreeView.setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
             updateLayerTreeViewport();
-            m_client->didActivateCompositor(m_layerTreeHost->compositorIdentifier());
+            m_client->didActivateCompositor(m_layerTreeView.compositorIdentifier());
             m_isAcceleratedCompositingActive = true;
             m_compositorCreationFailed = false;
             if (m_pageOverlays)
                 m_pageOverlays->update();
         } else {
-            m_layerTreeHost.clear();
             m_nonCompositedContentHost.clear();
             m_isAcceleratedCompositingActive = false;
             m_client->didDeactivateCompositor();
@@ -3195,29 +3197,44 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
 #endif
 
-PassRefPtr<GraphicsContext3D> WebViewImpl::createCompositorGraphicsContext3D()
+PassOwnPtr<WebKit::WebGraphicsContext3D> WebViewImpl::createCompositorGraphicsContext3D()
 {
-    WebKit::WebGraphicsContext3D::Attributes attributes = getCompositorContextAttributes(CCProxy::hasImplThread());
-    OwnPtr<WebGraphicsContext3D> webContext = adoptPtr(client()->createGraphicsContext3D(attributes, true /* renderDirectlyToHostWindow */));
+    // Explicitly disable antialiasing for the compositor. As of the time of
+    // this writing, the only platform that supported antialiasing for the
+    // compositor was Mac OS X, because the on-screen OpenGL context creation
+    // code paths on Windows and Linux didn't yet have multisampling support.
+    // Mac OS X essentially always behaves as though it's rendering offscreen.
+    // Multisampling has a heavy cost especially on devices with relatively low
+    // fill rate like most notebooks, and the Mac implementation would need to
+    // be optimized to resolve directly into the IOSurface shared between the
+    // GPU and browser processes. For these reasons and to avoid platform
+    // disparities we explicitly disable antialiasing.
+    WebKit::WebGraphicsContext3D::Attributes attributes;
+    attributes.antialias = false;
+    attributes.shareResources = true;
+
+    OwnPtr<WebGraphicsContext3D> webContext = adoptPtr(client()->createGraphicsContext3D(attributes));
     if (!webContext)
-        return 0;
+        return nullptr;
 
-    return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(webContext.release(), GraphicsContext3D::RenderDirectlyToHostWindow);
+    return webContext.release();
 }
 
-PassRefPtr<GraphicsContext3D> WebViewImpl::createLayerTreeHostContext3D()
+WebKit::WebGraphicsContext3D* WebViewImpl::createContext3D()
 {
-    RefPtr<GraphicsContext3D> context;
+    OwnPtr<WebKit::WebGraphicsContext3D> webContext;
 
     // If we've already created an onscreen context for this view, return that.
     if (m_temporaryOnscreenGraphicsContext3D)
-        context = m_temporaryOnscreenGraphicsContext3D.release();
+        webContext = m_temporaryOnscreenGraphicsContext3D.release();
     else // Otherwise make a new one.
-        context = createCompositorGraphicsContext3D();
-    return context;
+        webContext = createCompositorGraphicsContext3D();
+    // The caller takes ownership of this object, but since there's no equivalent of PassOwnPtr<> in the WebKit API
+    // we return a raw pointer.
+    return webContext.leakPtr();
 }
 
-void WebViewImpl::applyScrollAndScale(const IntSize& scrollDelta, float pageScaleDelta)
+void WebViewImpl::applyScrollAndScale(const WebSize& scrollDelta, float pageScaleDelta)
 {
     if (!mainFrameImpl() || !mainFrameImpl()->frameView())
         return;
@@ -3230,8 +3247,8 @@ void WebViewImpl::applyScrollAndScale(const IntSize& scrollDelta, float pageScal
         // in the old coordinate space, so we first need to multiply them
         // by the page scale delta.
         WebSize scrollOffset = mainFrame()->scrollOffset();
-        scrollOffset.width += scrollDelta.width();
-        scrollOffset.height += scrollDelta.height();
+        scrollOffset.width += scrollDelta.width;
+        scrollOffset.height += scrollDelta.height;
         WebPoint scaledScrollOffset(scrollOffset.width * pageScaleDelta,
                                     scrollOffset.height * pageScaleDelta);
         setPageScaleFactor(pageScaleFactor() * pageScaleDelta, scaledScrollOffset);
@@ -3250,7 +3267,7 @@ void WebViewImpl::didCompleteSwapBuffers()
         m_client->didCompleteSwapBuffers();
 }
 
-void WebViewImpl::didRecreateGraphicsContext(bool success)
+void WebViewImpl::didRebindGraphicsContext(bool success)
 {
 
     // Switch back to software rendering mode, if necessary
@@ -3277,7 +3294,7 @@ void WebViewImpl::scheduleComposite()
 
 void WebViewImpl::updateLayerTreeViewport()
 {
-    if (!page() || !m_nonCompositedContentHost || !m_layerTreeHost)
+    if (!page() || !m_nonCompositedContentHost || m_layerTreeView.isNull())
         return;
 
     FrameView* view = page()->mainFrame()->view();
@@ -3293,18 +3310,18 @@ void WebViewImpl::updateLayerTreeViewport()
         layerAdjustX = -view->contentsSize().width() + view->visibleContentRect(false).width();
     }
     m_nonCompositedContentHost->setViewport(visibleRect.size(), view->contentsSize(), scroll, pageScaleFactor(), layerAdjustX);
-    m_layerTreeHost->setViewportSize(visibleRect.size());
-    m_layerTreeHost->setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
+    m_layerTreeView.setViewportSize(visibleRect.size());
+    m_layerTreeView.setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
 }
 
 WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
 {
 #if USE(ACCELERATED_COMPOSITING)
     if (m_page->settings()->acceleratedCompositingEnabled() && allowsAcceleratedCompositing()) {
-        if (m_layerTreeHost) {
-            WebGraphicsContext3D* webContext = GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_layerTreeHost->context());
-            if (webContext && !webContext->isContextLost())
-                return webContext;
+        if (!m_layerTreeView.isNull()) {
+            WebGraphicsContext3D* context = m_layerTreeView.context();
+            if (context && !context->isContextLost())
+                return context;
         }
         // If we get here it means that some system needs access to the context the compositor will use but the compositor itself
         // hasn't requested a context or it was unable to successfully instantiate a context.
@@ -3313,7 +3330,7 @@ WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
         if (!m_temporaryOnscreenGraphicsContext3D)
             m_temporaryOnscreenGraphicsContext3D = createCompositorGraphicsContext3D();
 
-        WebGraphicsContext3D* webContext = GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_temporaryOnscreenGraphicsContext3D.get());
+        WebGraphicsContext3D* webContext = m_temporaryOnscreenGraphicsContext3D.get();
         if (webContext && !webContext->isContextLost())
             return webContext;
     }
@@ -3321,6 +3338,14 @@ WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
     return 0;
 }
 
+WebGraphicsContext3D* WebViewImpl::sharedGraphicsContext3D()
+{
+    if (!m_page->settings()->acceleratedCompositingEnabled() || !allowsAcceleratedCompositing())
+        return 0;
+
+    return GraphicsContext3DPrivate::extractWebGraphicsContext3D(SharedGraphicsContext3D::get());
+}
+
 void WebViewImpl::setVisibilityState(WebPageVisibilityState visibilityState,
                                      bool isInitialState) {
     if (!page())
@@ -3338,7 +3363,7 @@ void WebViewImpl::setVisibilityState(WebPageVisibilityState visibilityState,
         bool visible = visibilityState == WebPageVisibilityStateVisible;
         if (!visible)
             m_nonCompositedContentHost->protectVisibleTileTextures();
-        m_layerTreeHost->setVisible(visible);
+        m_layerTreeView.setVisible(visible);
     }
 #endif
 }
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index bc7a53d04..3819ecb65 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -32,6 +32,9 @@
 #define WebViewImpl_h
 
 #include "WebNavigationPolicy.h"
+#include "platform/WebLayer.h"
+#include "platform/WebLayerTreeView.h"
+#include "platform/WebLayerTreeViewClient.h"
 #include "platform/WebPoint.h"
 #include "platform/WebRect.h"
 #include "platform/WebSize.h"
@@ -50,7 +53,6 @@
 #include "NotificationPresenterImpl.h"
 #include "PageOverlayList.h"
 #include "UserMediaClientImpl.h"
-#include "cc/CCLayerTreeHost.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/RefCounted.h>
 
@@ -94,7 +96,7 @@ class WebMouseWheelEvent;
 class WebSettingsImpl;
 class WebTouchEvent;
 
-class WebViewImpl : public WebView, public WebCore::CCLayerTreeHostClient, public RefCounted<WebViewImpl> {
+class WebViewImpl : public WebView, public WebLayerTreeViewClient, public RefCounted<WebViewImpl> {
 public:
     enum AutoZoomType {
         DoubleTap,
@@ -137,6 +139,7 @@ public:
     virtual void didNotAcquirePointerLock();
     virtual void didLosePointerLock();
     virtual void didChangeWindowResizerRect();
+    virtual void instrumentBeginFrame();
 
     // WebView methods:
     virtual void initializeMainFrame(WebFrameClient*);
@@ -186,6 +189,10 @@ public:
     virtual WebSize fixedLayoutSize() const;
     virtual void setFixedLayoutSize(const WebSize&);
     virtual void enableAutoResizeMode(
+        const WebSize& minSize,
+        const WebSize& maxSize);
+    virtual void disableAutoResizeMode();
+    virtual void enableAutoResizeMode(
         bool enable,
         const WebSize& minSize,
         const WebSize& maxSize);
@@ -246,13 +253,13 @@ public:
     virtual void addPageOverlay(WebPageOverlay*, int /* zOrder */);
     virtual void removePageOverlay(WebPageOverlay*);
 
-    // CCLayerTreeHostClient
+    // WebLayerTreeViewClient
     virtual void updateAnimations(double frameBeginTime);
-    virtual void applyScrollAndScale(const WebCore::IntSize&, float);
-    virtual PassRefPtr<WebCore::GraphicsContext3D> createLayerTreeHostContext3D();
+    virtual void applyScrollAndScale(const WebSize&, float);
+    virtual WebGraphicsContext3D* createContext3D();
+    virtual void didRebindGraphicsContext(bool);
     virtual void didCommitAndDrawFrame();
     virtual void didCompleteSwapBuffers();
-    virtual void didRecreateGraphicsContext(bool success);
     virtual void scheduleComposite();
 
     // WebViewImpl
@@ -434,7 +441,7 @@ public:
     bool allowsAcceleratedCompositing();
     bool pageHasRTLStyle() const;
     void setRootGraphicsLayer(WebCore::GraphicsLayer*);
-    void setRootLayerNeedsDisplay();
+    void scheduleCompositingLayerSync();
     void scrollRootLayerRect(const WebCore::IntSize& scrollDelta, const WebCore::IntRect& clipRect);
     void invalidateRootLayerRect(const WebCore::IntRect&);
     NonCompositedContentHost* nonCompositedContentHost();
@@ -450,7 +457,9 @@ public:
     // we could not successfully instantiate a context.
     virtual WebGraphicsContext3D* graphicsContext3D();
 
-    PassRefPtr<WebCore::GraphicsContext3D> createCompositorGraphicsContext3D();
+    virtual WebGraphicsContext3D* sharedGraphicsContext3D();
+
+    PassOwnPtr<WebGraphicsContext3D> createCompositorGraphicsContext3D();
 
     virtual void setVisibilityState(WebPageVisibilityState, bool);
 
@@ -532,6 +541,7 @@ private:
                                                DragAction);
 
     void sendResizeEventAndRepaint();
+    void configureAutoResizeMode();
 
 #if USE(ACCELERATED_COMPOSITING)
     void setIsAcceleratedCompositingActive(bool);
@@ -688,7 +698,8 @@ private:
 #if USE(ACCELERATED_COMPOSITING)
     WebCore::IntRect m_rootLayerScrollDamage;
     OwnPtr<NonCompositedContentHost> m_nonCompositedContentHost;
-    RefPtr<WebCore::CCLayerTreeHost> m_layerTreeHost;
+    WebLayerTreeView m_layerTreeView;
+    WebLayer m_rootLayer;
     WebCore::GraphicsLayer* m_rootGraphicsLayer;
     bool m_isAcceleratedCompositingActive;
     bool m_compositorCreationFailed;
@@ -703,7 +714,7 @@ private:
     // If we attempt to fetch the on-screen GraphicsContext3D before
     // the compositor has been turned on, we need to instantiate it
     // early. This member holds on to the GC3D in this case.
-    RefPtr<WebCore::GraphicsContext3D> m_temporaryOnscreenGraphicsContext3D;
+    OwnPtr<WebGraphicsContext3D> m_temporaryOnscreenGraphicsContext3D;
     OwnPtr<DeviceOrientationClientProxy> m_deviceOrientationClientProxy;
     OwnPtr<GeolocationClientProxy> m_geolocationClientProxy;
 
diff --git a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
index 1db2d1dd9..a69f01a5f 100644
--- a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
@@ -214,6 +214,16 @@ bool WebWorkerClientImpl::allowDatabase(WebFrame*, const WebString& name, const
         return false;
     return !webView->permissionClient() || webView->permissionClient()->allowDatabase(m_webFrame, name, displayName, estimatedSize);
 }
+
+bool WebWorkerClientImpl::allowIndexedDB(const WebString& name)
+{
+    if (m_proxy->askedToTerminate())
+        return false;
+    WebKit::WebViewImpl* webView = m_webFrame->viewImpl();
+    if (!webView)
+        return false;
+    return !webView->permissionClient() || webView->permissionClient()->allowIndexedDB(m_webFrame, name, WebSecurityOrigin());
+}
  
 WebView* WebWorkerClientImpl::view() const 
 {
diff --git a/Source/WebKit/chromium/src/WebWorkerClientImpl.h b/Source/WebKit/chromium/src/WebWorkerClientImpl.h
index 3d5dab0de..d47744c9c 100644
--- a/Source/WebKit/chromium/src/WebWorkerClientImpl.h
+++ b/Source/WebKit/chromium/src/WebWorkerClientImpl.h
@@ -69,45 +69,46 @@ public:
     virtual void startWorkerContext(const WebCore::KURL&,
                                     const WTF::String&,
                                     const WTF::String&,
-                                    WebCore::WorkerThreadStartMode);
-    virtual void terminateWorkerContext();
+                                    WebCore::WorkerThreadStartMode) OVERRIDE;
+    virtual void terminateWorkerContext() OVERRIDE;
     virtual void postMessageToWorkerContext(
         PassRefPtr<WebCore::SerializedScriptValue> message,
-        PassOwnPtr<WebCore::MessagePortChannelArray> channels);
-    virtual bool hasPendingActivity() const;
-    virtual void workerObjectDestroyed();
+        PassOwnPtr<WebCore::MessagePortChannelArray> channels) OVERRIDE;
+    virtual bool hasPendingActivity() const OVERRIDE;
+    virtual void workerObjectDestroyed() OVERRIDE;
 
 #if ENABLE(INSPECTOR)
-    virtual void connectToInspector(WebCore::WorkerContextProxy::PageInspector*);
-    virtual void disconnectFromInspector();
-    virtual void sendMessageToInspector(const String&);
-    virtual void postMessageToPageInspector(const String&);
-    virtual void updateInspectorStateCookie(const String&);
+    virtual void connectToInspector(WebCore::WorkerContextProxy::PageInspector*) OVERRIDE;
+    virtual void disconnectFromInspector() OVERRIDE;
+    virtual void sendMessageToInspector(const String&) OVERRIDE;
+    virtual void postMessageToPageInspector(const String&) OVERRIDE;
+    virtual void updateInspectorStateCookie(const String&) OVERRIDE;
 #endif
     // WebCore::WorkerLoaderProxy methods:
-    virtual void postTaskToLoader(PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
-    virtual void postTaskForModeToWorkerContext(PassOwnPtr<WebCore::ScriptExecutionContext::Task>, const String& mode);
+    virtual void postTaskToLoader(PassOwnPtr<WebCore::ScriptExecutionContext::Task>) OVERRIDE;
+    virtual void postTaskForModeToWorkerContext(PassOwnPtr<WebCore::ScriptExecutionContext::Task>, const String& mode) OVERRIDE;
 
     // WebCore::WorkerObjectProxy methods:
-    virtual void postMessageToWorkerObject(PassRefPtr<WebCore::SerializedScriptValue>, PassOwnPtr<WebCore::MessagePortChannelArray>);
-    virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
+    virtual void postMessageToWorkerObject(PassRefPtr<WebCore::SerializedScriptValue>, PassOwnPtr<WebCore::MessagePortChannelArray>) OVERRIDE;
+    virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL) OVERRIDE;
 
     virtual void postConsoleMessageToWorkerObject(WebCore::MessageSource, WebCore::MessageType, WebCore::MessageLevel,
-                                                  const String& message, int lineNumber, const String& sourceURL);
-    virtual void confirmMessageFromWorkerObject(bool);
-    virtual void reportPendingActivity(bool);
-    virtual void workerContextClosed();
-    virtual void workerContextDestroyed();
+                                                  const String& message, int lineNumber, const String& sourceURL) OVERRIDE;
+    virtual void confirmMessageFromWorkerObject(bool) OVERRIDE;
+    virtual void reportPendingActivity(bool) OVERRIDE;
+    virtual void workerContextClosed() OVERRIDE;
+    virtual void workerContextDestroyed() OVERRIDE;
 
     // WebWorkerClientBase methods:
-    virtual bool allowDatabase(WebFrame*, const WebString& name, const WebString& displayName, unsigned long estimatedSize);
+    virtual bool allowDatabase(WebFrame*, const WebString& name, const WebString& displayName, unsigned long estimatedSize) OVERRIDE;
     virtual bool allowFileSystem();
     virtual void openFileSystem(WebFileSystem::Type, long long size, bool create,
-                                WebFileSystemCallbacks*);
+                                WebFileSystemCallbacks*) OVERRIDE;
+    virtual bool allowIndexedDB(const WebString& name) OVERRIDE;
 
     // WebCommentWorkerBase methods:
-    virtual WebCommonWorkerClient* commonClient() { return this; }
-    virtual WebView* view() const;
+    virtual WebCommonWorkerClient* commonClient() OVERRIDE { return this; }
+    virtual WebView* view() const OVERRIDE;
 
 private:
     WebWorkerClientImpl(WebCore::Worker*, WebFrameImpl*);
diff --git a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
index 7fbb1f468..80a26ff03 100644
--- a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(FILE_SYSTEM) && ENABLE(WORKERS)
 
 #include "AsyncFileSystemCallbacks.h"
+#include "BlobURL.h"
 #include "FileMetadata.h"
 #include "FileSystem.h"
 #include "NotImplemented.h"
@@ -208,6 +209,14 @@ void WorkerAsyncFileSystemChromium::createWriter(AsyncFileWriterClient* client,
     createWorkerFileSystemCallbacksBridge(WorkerFileWriterHelperCallbacks::create(client, pathAsURL, m_webFileSystem, callbacks, m_workerContext))->postReadMetadataToMainThread(m_webFileSystem, pathAsURL, m_modeForCurrentOperation);
 }
 
+void WorkerAsyncFileSystemChromium::createSnapshotFileAndReadMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    KURL pathAsURL = virtualPathToFileSystemURL(path);
+    KURL internalBlobURL = BlobURL::createInternalURL();
+
+    createWorkerFileSystemCallbacksBridge(createSnapshotFileCallback(internalBlobURL, callbacks))->postCreateSnapshotFileToMainThread(m_webFileSystem, internalBlobURL, pathAsURL, m_modeForCurrentOperation);
+}
+
 PassRefPtr<WorkerFileSystemCallbacksBridge> WorkerAsyncFileSystemChromium::createWorkerFileSystemCallbacksBridge(PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
     ASSERT(!m_synchronous || !m_bridgeForCurrentOperation);
diff --git a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
index c8ae3565f..08918518a 100644
--- a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
+++ b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
@@ -74,6 +74,7 @@ public:
     virtual void directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createSnapshotFileAndReadMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
 
 private:
     WorkerAsyncFileSystemChromium(ScriptExecutionContext*, AsyncFileSystem::Type, const WebKit::WebURL& rootURL, bool synchronous);
diff --git a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
index b1dad7035..8fd5cfa6d 100644
--- a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
+++ b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
@@ -289,6 +289,15 @@ void WorkerFileSystemCallbacksBridge::postReadDirectoryToMainThread(WebFileSyste
                            this, mode));
 }
 
+void WorkerFileSystemCallbacksBridge::postCreateSnapshotFileToMainThread(WebFileSystem* fileSystem, const KURL& internalBlobURL, const KURL& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(
+        createCallbackTask(&createSnapshotFileOnMainThread,
+                           AllowCrossThreadAccess(fileSystem),
+                           internalBlobURL, path, this, mode));
+}
+
 void WorkerFileSystemCallbacksBridge::openFileSystemOnMainThread(ScriptExecutionContext*, WebCommonWorkerClient* commonClient, WebFileSystem::Type type, long long size, bool create, PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& mode)
 {
     if (!commonClient)
@@ -348,6 +357,11 @@ void WorkerFileSystemCallbacksBridge::readDirectoryOnMainThread(WebCore::ScriptE
     fileSystem->readDirectory(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
 }
 
+void WorkerFileSystemCallbacksBridge::createSnapshotFileOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const KURL& internalBlobURL, const KURL& path, PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& mode)
+{
+    fileSystem->createSnapshotFileAndReadMetadata(internalBlobURL, path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
 void WorkerFileSystemCallbacksBridge::didFailOnMainThread(WebFileError error, const String& mode)
 {
     mayPostTaskToWorker(createCallbackTask(&didFailOnWorkerThread, this, error), mode);
diff --git a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
index 350839cd5..e496de2ef 100644
--- a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
+++ b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
@@ -94,6 +94,7 @@ public:
     void postFileExistsToMainThread(WebFileSystem*, const WebCore::KURL& path, const String& mode);
     void postDirectoryExistsToMainThread(WebFileSystem*, const WebCore::KURL& path, const String& mode);
     void postReadDirectoryToMainThread(WebFileSystem*, const WebCore::KURL& path, const String& mode);
+    void postCreateSnapshotFileToMainThread(WebFileSystem*, const WebCore::KURL& internalBlobURL, const WebCore::KURL& path, const String& mode);
 
     // Callback methods that are called on the main thread.
     void didFailOnMainThread(WebFileError, const String& mode);
@@ -117,6 +118,7 @@ private:
     static void fileExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const WebCore::KURL& path, PassRefPtr<WorkerFileSystemCallbacksBridge>, const String& mode);
     static void directoryExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const WebCore::KURL& path, PassRefPtr<WorkerFileSystemCallbacksBridge>, const String& mode);
     static void readDirectoryOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const WebCore::KURL& path, PassRefPtr<WorkerFileSystemCallbacksBridge>, const String& mode);
+    static void createSnapshotFileOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const WebCore::KURL& internalBlobURL, const WebCore::KURL& path, PassRefPtr<WorkerFileSystemCallbacksBridge>, const String& mode);
 
     friend class MainThreadFileSystemCallbacks;
 
diff --git a/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png b/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png
index abe8db8ec..425ab5ed2 100644
--- a/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png
+++ b/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png
diff --git a/Source/WebKit/chromium/src/js/Tests.js b/Source/WebKit/chromium/src/js/Tests.js
index 16a1ba257..b8dc8de50 100644
--- a/Source/WebKit/chromium/src/js/Tests.js
+++ b/Source/WebKit/chromium/src/js/Tests.js
@@ -579,6 +579,50 @@ TestSuite.prototype.waitForTestResultsInConsole = function()
     this.takeControl();
 };
 
+TestSuite.prototype.checkLogAndErrorMessages = function()
+{
+    var messages = WebInspector.console.messages;
+
+    var matchesCount = 0;
+    function validMessage(message)
+    {
+        if (message.text === "log" && message.level === WebInspector.ConsoleMessage.MessageLevel.Log) {
+            ++matchesCount;
+            return true;
+        }
+
+        if (message.text === "error" && message.level === WebInspector.ConsoleMessage.MessageLevel.Error) {
+            ++matchesCount;
+            return true;
+        }
+        return false;
+    }
+
+    for (var i = 0; i < messages.length; ++i) {
+        if (validMessage(messages[i]))
+            continue;
+        this.fail(messages[i].text + ":" + messages[i].level); // This will throw.
+    }
+
+    if (matchesCount === 2)
+        return;
+
+    // Wait for more messages.
+    function onConsoleMessage(event)
+    {
+        var message = event.data;
+        if (validMessage(message)) {
+            if (matchesCount === 2) {
+                this.releaseControl();
+                return;
+            }
+        } else
+            this.fail(message.text + ":" + messages[i].level);
+    }
+
+    WebInspector.console.addEventListener(WebInspector.ConsoleModel.Events.MessageAdded, onConsoleMessage, this);
+    this.takeControl();
+};
 
 /**
  * Serializes array of uiSourceCodes to string.
diff --git a/Source/WebKit/chromium/src/win/WebInputEventFactory.cpp b/Source/WebKit/chromium/src/win/WebInputEventFactory.cpp
index c71a3b6c6..9da4b4a27 100644
--- a/Source/WebKit/chromium/src/win/WebInputEventFactory.cpp
+++ b/Source/WebKit/chromium/src/win/WebInputEventFactory.cpp
@@ -107,7 +107,9 @@ WebKeyboardEvent WebInputEventFactory::keyboardEvent(HWND hwnd, UINT message,
     // caller, who would know for sure.
     result.timeStampSeconds = GetMessageTime() / 1000.0;
 
-    result.windowsKeyCode = result.nativeKeyCode = static_cast<int>(wparam);
+    result.windowsKeyCode = static_cast<int>(wparam);
+    // Record the scan code (along with other context bits) for this key event.
+    result.nativeKeyCode = static_cast<int>(lparam);
 
     switch (message) {
     case WM_SYSKEYDOWN:
diff --git a/Source/WebKit/chromium/tests/AssociatedURLLoaderTest.cpp b/Source/WebKit/chromium/tests/AssociatedURLLoaderTest.cpp
index 677865ac0..a168ebca9 100644
--- a/Source/WebKit/chromium/tests/AssociatedURLLoaderTest.cpp
+++ b/Source/WebKit/chromium/tests/AssociatedURLLoaderTest.cpp
@@ -241,7 +241,7 @@ public:
         m_expectedResponse.setMIMEType("text/html");
         m_expectedResponse.addHTTPHeaderField("Access-Control-Allow-Origin", "*");
         if (exposed)
-            m_expectedResponse.addHTTPHeaderField("access-control-expose-header", headerNameString);
+            m_expectedResponse.addHTTPHeaderField("access-control-expose-headers", headerNameString);
         m_expectedResponse.addHTTPHeaderField(headerNameString, "foo");
         webkit_support::RegisterMockedURL(url, m_expectedResponse, m_frameFilePath);
 
diff --git a/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp b/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp
index a9f7b1c1a..74d635b40 100644
--- a/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp
@@ -39,11 +39,11 @@ using namespace WebKitTests;
 
 namespace {
 
-void executeCalculateDrawTransformsAndVisibility(CCLayerImpl* root, Vector<RefPtr<CCLayerImpl> >& renderSurfaceLayerList)
+void executeCalculateDrawTransformsAndVisibility(CCLayerImpl* root, Vector<CCLayerImpl*>& renderSurfaceLayerList)
 {
     CCLayerSorter layerSorter;
     TransformationMatrix identityMatrix;
-    Vector<RefPtr<CCLayerImpl> > dummyLayerList;
+    Vector<CCLayerImpl*> dummyLayerList;
     int dummyMaxTextureSize = 512;
 
     // Sanity check: The test itself should create the root layer's render surface, so
@@ -64,7 +64,7 @@ void emulateDrawingOneFrame(CCLayerImpl* root)
     //   2. updating all damage trackers in the correct order
     //   3. resetting all updateRects and propertyChanged flags for all layers and surfaces.
 
-    Vector<RefPtr<CCLayerImpl> > renderSurfaceLayerList;
+    Vector<CCLayerImpl*> renderSurfaceLayerList;
     executeCalculateDrawTransformsAndVisibility(root, renderSurfaceLayerList);
 
     // Iterate back-to-front, so that damage correctly propagates from descendant surfaces to ancestors.
@@ -76,10 +76,10 @@ void emulateDrawingOneFrame(CCLayerImpl* root)
     root->resetAllChangeTrackingForSubtree();
 }
 
-PassRefPtr<CCLayerImpl> createTestTreeWithOneSurface()
+PassOwnPtr<CCLayerImpl> createTestTreeWithOneSurface()
 {
-    RefPtr<CCLayerImpl> root = CCLayerImpl::create(1);
-    RefPtr<CCLayerImpl> child = CCLayerImpl::create(2);
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    OwnPtr<CCLayerImpl> child = CCLayerImpl::create(2);
 
     root->setPosition(FloatPoint::zero());
     root->setAnchorPoint(FloatPoint::zero());
@@ -92,22 +92,22 @@ PassRefPtr<CCLayerImpl> createTestTreeWithOneSurface()
     child->setAnchorPoint(FloatPoint::zero());
     child->setBounds(IntSize(30, 30));
     child->setDrawsContent(true);
-    root->addChild(child);
+    root->addChild(child.release());
 
     return root.release();
 }
 
-PassRefPtr<CCLayerImpl> createTestTreeWithTwoSurfaces()
+PassOwnPtr<CCLayerImpl> createTestTreeWithTwoSurfaces()
 {
     // This test tree has two render surfaces: one for the root, and one for
     // child1. Additionally, the root has a second child layer, and child1 has two
     // children of its own.
 
-    RefPtr<CCLayerImpl> root = CCLayerImpl::create(1);
-    RefPtr<CCLayerImpl> child1 = CCLayerImpl::create(2);
-    RefPtr<CCLayerImpl> child2 = CCLayerImpl::create(3);
-    RefPtr<CCLayerImpl> grandChild1 = CCLayerImpl::create(4);
-    RefPtr<CCLayerImpl> grandChild2 = CCLayerImpl::create(5);
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    OwnPtr<CCLayerImpl> child1 = CCLayerImpl::create(2);
+    OwnPtr<CCLayerImpl> child2 = CCLayerImpl::create(3);
+    OwnPtr<CCLayerImpl> grandChild1 = CCLayerImpl::create(4);
+    OwnPtr<CCLayerImpl> grandChild2 = CCLayerImpl::create(5);
 
     root->setPosition(FloatPoint::zero());
     root->setAnchorPoint(FloatPoint::zero());
@@ -137,17 +137,17 @@ PassRefPtr<CCLayerImpl> createTestTreeWithTwoSurfaces()
     grandChild2->setBounds(IntSize(6, 8));
     grandChild2->setDrawsContent(true);
 
-    child1->addChild(grandChild1);
-    child1->addChild(grandChild2);
-    root->addChild(child1);
-    root->addChild(child2);
+    child1->addChild(grandChild1.release());
+    child1->addChild(grandChild2.release());
+    root->addChild(child1.release());
+    root->addChild(child2.release());
 
     return root.release();
 }
 
-PassRefPtr<CCLayerImpl> createAndSetUpTestTreeWithOneSurface()
+PassOwnPtr<CCLayerImpl> createAndSetUpTestTreeWithOneSurface()
 {
-    RefPtr<CCLayerImpl> root = createTestTreeWithOneSurface();
+    OwnPtr<CCLayerImpl> root = createTestTreeWithOneSurface();
 
     // Setup includes going past the first frame which always damages everything, so
     // that we can actually perform specific tests.
@@ -156,9 +156,9 @@ PassRefPtr<CCLayerImpl> createAndSetUpTestTreeWithOneSurface()
     return root.release();
 }
 
-PassRefPtr<CCLayerImpl> createAndSetUpTestTreeWithTwoSurfaces()
+PassOwnPtr<CCLayerImpl> createAndSetUpTestTreeWithTwoSurfaces()
 {
-    RefPtr<CCLayerImpl> root = createTestTreeWithTwoSurfaces();
+    OwnPtr<CCLayerImpl> root = createTestTreeWithTwoSurfaces();
 
     // Setup includes going past the first frame which always damages everything, so
     // that we can actually perform specific tests.
@@ -178,7 +178,7 @@ TEST_F(CCDamageTrackerTest, sanityCheckTestTreeWithOneSurface)
     // Sanity check that the simple test tree will actually produce the expected render
     // surfaces and layer lists.
 
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
 
     EXPECT_EQ(static_cast<size_t>(2), root->renderSurface()->layerList().size());
     EXPECT_EQ(1, root->renderSurface()->layerList()[0]->id());
@@ -193,10 +193,10 @@ TEST_F(CCDamageTrackerTest, sanityCheckTestTreeWithTwoSurfaces)
     // Sanity check that the complex test tree will actually produce the expected render
     // surfaces and layer lists.
 
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
 
-    RefPtr<CCLayerImpl> child1 = root->children()[0];
-    RefPtr<CCLayerImpl> child2 = root->children()[1];
+    CCLayerImpl* child1 = root->children()[0].get();
+    CCLayerImpl* child2 = root->children()[1].get();
     FloatRect childDamageRect = child1->renderSurface()->damageTracker()->currentDamageRect();
     FloatRect rootDamageRect = root->renderSurface()->damageTracker()->currentDamageRect();
 
@@ -212,8 +212,8 @@ TEST_F(CCDamageTrackerTest, sanityCheckTestTreeWithTwoSurfaces)
 
 TEST_F(CCDamageTrackerTest, verifyDamageForUpdateRects)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
-    RefPtr<CCLayerImpl> child = root->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
+    CCLayerImpl* child = root->children()[0].get();
 
     // CASE 1: Setting the update rect should cause the corresponding damage to the surface.
     //
@@ -243,8 +243,8 @@ TEST_F(CCDamageTrackerTest, verifyDamageForUpdateRects)
 
 TEST_F(CCDamageTrackerTest, verifyDamageForPropertyChanges)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
-    RefPtr<CCLayerImpl> child = root->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
+    CCLayerImpl* child = root->children()[0].get();
 
     // CASE 1: The layer's property changed flag takes priority over update rect.
     //
@@ -284,8 +284,8 @@ TEST_F(CCDamageTrackerTest, verifyDamageForTransformedLayer)
     // If a layer is transformed, the damage rect should still enclose the entire
     // transformed layer.
 
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
-    RefPtr<CCLayerImpl> child = root->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
+    CCLayerImpl* child = root->children()[0].get();
 
     TransformationMatrix rotation;
     rotation.rotate(45);
@@ -317,18 +317,20 @@ TEST_F(CCDamageTrackerTest, verifyDamageForTransformedLayer)
 
 TEST_F(CCDamageTrackerTest, verifyDamageForAddingAndRemovingLayer)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
-    RefPtr<CCLayerImpl> child1 = root->children()[0];
-
-    RefPtr<CCLayerImpl> child2 = CCLayerImpl::create(3);
-    child2->setPosition(FloatPoint(400, 380));
-    child2->setAnchorPoint(FloatPoint::zero());
-    child2->setBounds(IntSize(6, 8));
-    child2->setDrawsContent(true);
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
+    CCLayerImpl* child1 = root->children()[0].get();
+
+    {
+        OwnPtr<CCLayerImpl> child2 = CCLayerImpl::create(3);
+        child2->setPosition(FloatPoint(400, 380));
+        child2->setAnchorPoint(FloatPoint::zero());
+        child2->setBounds(IntSize(6, 8));
+        child2->setDrawsContent(true);
+        root->addChild(child2.release());
+    }
 
     // CASE 1: Adding a new layer should cause the appropriate damage.
     //
-    root->addChild(child2);
     emulateDrawingOneFrame(root.get());
 
     // Sanity check - all 3 layers should be on the same render surface; render surfaces are tested elsewhere.
@@ -353,15 +355,18 @@ TEST_F(CCDamageTrackerTest, verifyDamageForAddingAndRemovingLayer)
 
 TEST_F(CCDamageTrackerTest, verifyDamageForMultipleLayers)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
-    RefPtr<CCLayerImpl> child1 = root->children()[0];
-
-    RefPtr<CCLayerImpl> child2 = CCLayerImpl::create(3);
-    child2->setPosition(FloatPoint(400, 380));
-    child2->setAnchorPoint(FloatPoint::zero());
-    child2->setBounds(IntSize(6, 8));
-    child2->setDrawsContent(true);
-    root->addChild(child2);
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
+    CCLayerImpl* child1 = root->children()[0].get();
+
+    {
+        OwnPtr<CCLayerImpl> child2 = CCLayerImpl::create(3);
+        child2->setPosition(FloatPoint(400, 380));
+        child2->setAnchorPoint(FloatPoint::zero());
+        child2->setBounds(IntSize(6, 8));
+        child2->setDrawsContent(true);
+        root->addChild(child2.release());
+    }
+    CCLayerImpl* child2 = root->children()[1].get();
 
     // In this test we don't want the above tree manipulation to be considered part of the same frame.
     emulateDrawingOneFrame(root.get());
@@ -378,10 +383,10 @@ TEST_F(CCDamageTrackerTest, verifyDamageForMultipleLayers)
 
 TEST_F(CCDamageTrackerTest, verifyDamageForNestedSurfaces)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
-    RefPtr<CCLayerImpl> child1 = root->children()[0];
-    RefPtr<CCLayerImpl> child2 = root->children()[1];
-    RefPtr<CCLayerImpl> grandChild1 = root->children()[0]->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
+    CCLayerImpl* child1 = root->children()[0].get();
+    CCLayerImpl* child2 = root->children()[1].get();
+    CCLayerImpl* grandChild1 = root->children()[0]->children()[0].get();
     FloatRect childDamageRect;
     FloatRect rootDamageRect;
 
@@ -415,9 +420,9 @@ TEST_F(CCDamageTrackerTest, verifyDamageForSurfaceChangeFromDescendantLayer)
     // This is a tricky case, since only the first grandChild changes, but the entire
     // surface should be marked dirty.
 
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
-    RefPtr<CCLayerImpl> child1 = root->children()[0];
-    RefPtr<CCLayerImpl> grandChild1 = root->children()[0]->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
+    CCLayerImpl* child1 = root->children()[0].get();
+    CCLayerImpl* grandChild1 = root->children()[0]->children()[0].get();
     FloatRect childDamageRect;
     FloatRect rootDamageRect;
 
@@ -447,9 +452,8 @@ TEST_F(CCDamageTrackerTest, verifyDamageForSurfaceChangeFromAncestorLayer)
     //        should be completely unchanged, since we are only transforming it, while the
     //        root surface would be damaged appropriately.
 
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
-    RefPtr<CCLayerImpl> child1 = root->children()[0];
-    RefPtr<CCLayerImpl> grandChild1 = root->children()[0]->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
+    CCLayerImpl* child1 = root->children()[0].get();
     FloatRect childDamageRect;
     FloatRect rootDamageRect;
 
@@ -469,8 +473,8 @@ TEST_F(CCDamageTrackerTest, verifyDamageForSurfaceChangeFromAncestorLayer)
 
 TEST_F(CCDamageTrackerTest, verifyDamageForAddingAndRemovingRenderSurfaces)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
-    RefPtr<CCLayerImpl> child1 = root->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
+    CCLayerImpl* child1 = root->children()[0].get();
     FloatRect childDamageRect;
     FloatRect rootDamageRect;
 
@@ -510,8 +514,8 @@ TEST_F(CCDamageTrackerTest, verifyDamageForAddingAndRemovingRenderSurfaces)
 
 TEST_F(CCDamageTrackerTest, verifyNoDamageWhenNothingChanged)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
-    RefPtr<CCLayerImpl> child1 = root->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
+    CCLayerImpl* child1 = root->children()[0].get();
     FloatRect childDamageRect;
     FloatRect rootDamageRect;
 
@@ -534,8 +538,8 @@ TEST_F(CCDamageTrackerTest, verifyNoDamageWhenNothingChanged)
 
 TEST_F(CCDamageTrackerTest, verifyNoDamageForUpdateRectThatDoesNotDrawContent)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
-    RefPtr<CCLayerImpl> child1 = root->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
+    CCLayerImpl* child1 = root->children()[0].get();
     FloatRect childDamageRect;
     FloatRect rootDamageRect;
 
@@ -551,10 +555,10 @@ TEST_F(CCDamageTrackerTest, verifyNoDamageForUpdateRectThatDoesNotDrawContent)
 
 TEST_F(CCDamageTrackerTest, verifyDamageForReplica)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
-    RefPtr<CCLayerImpl> child1 = root->children()[0];
-    RefPtr<CCLayerImpl> grandChild1 = child1->children()[0];
-    RefPtr<CCLayerImpl> grandChild2 = child1->children()[1];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
+    CCLayerImpl* child1 = root->children()[0].get();
+    CCLayerImpl* grandChild1 = child1->children()[0].get();
+    CCLayerImpl* grandChild2 = child1->children()[1].get();
 
     // Damage on a surface that has a reflection should cause the target surface to
     // receive the surface's damage and the surface's reflected damage.
@@ -563,24 +567,28 @@ TEST_F(CCDamageTrackerTest, verifyDamageForReplica)
     // of child1's surface. This way, we can test reflection changes without changing
     // contentBounds of the surface.
     grandChild2->setPosition(FloatPoint(180, 180));
-    RefPtr<CCLayerImpl> grandChild3 = CCLayerImpl::create(6);
-    grandChild3->setPosition(FloatPoint(240, 240));
-    grandChild3->setAnchorPoint(FloatPoint::zero());
-    grandChild3->setBounds(IntSize(10, 10));
-    grandChild3->setDrawsContent(true);
+    {
+        OwnPtr<CCLayerImpl> grandChild3 = CCLayerImpl::create(6);
+        grandChild3->setPosition(FloatPoint(240, 240));
+        grandChild3->setAnchorPoint(FloatPoint::zero());
+        grandChild3->setBounds(IntSize(10, 10));
+        grandChild3->setDrawsContent(true);
+        child1->addChild(grandChild3.release());
+    }
     child1->setOpacity(0.5);
-    child1->addChild(grandChild3);
     emulateDrawingOneFrame(root.get());
 
     // CASE 1: adding a reflection about the left edge of grandChild1.
     //
-    RefPtr<CCLayerImpl> grandChild1Replica = CCLayerImpl::create(7);
-    grandChild1Replica->setPosition(FloatPoint::zero());
-    grandChild1Replica->setAnchorPoint(FloatPoint::zero());
-    TransformationMatrix reflection;
-    reflection.scale3d(-1.0, 1.0, 1.0);
-    grandChild1Replica->setTransform(reflection);
-    grandChild1->setReplicaLayer(grandChild1Replica);
+    {
+        OwnPtr<CCLayerImpl> grandChild1Replica = CCLayerImpl::create(7);
+        grandChild1Replica->setPosition(FloatPoint::zero());
+        grandChild1Replica->setAnchorPoint(FloatPoint::zero());
+        TransformationMatrix reflection;
+        reflection.scale3d(-1.0, 1.0, 1.0);
+        grandChild1Replica->setTransform(reflection);
+        grandChild1->setReplicaLayer(grandChild1Replica.release());
+    }
     emulateDrawingOneFrame(root.get());
 
     FloatRect grandChildDamageRect = grandChild1->renderSurface()->damageTracker()->currentDamageRect();
@@ -614,7 +622,7 @@ TEST_F(CCDamageTrackerTest, verifyDamageForReplica)
 
     // CASE 3: removing the reflection should cause the entire region including reflection
     //         to damage the target surface.
-    grandChild1->setReplicaLayer(0);
+    grandChild1->setReplicaLayer(nullptr);
     emulateDrawingOneFrame(root.get());
     ASSERT_EQ(oldContentRect.width(), child1->renderSurface()->contentRect().width());
     ASSERT_EQ(oldContentRect.height(), child1->renderSurface()->contentRect().height());
@@ -629,27 +637,32 @@ TEST_F(CCDamageTrackerTest, verifyDamageForReplica)
 
 TEST_F(CCDamageTrackerTest, verifyDamageForMask)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
-    RefPtr<CCLayerImpl> child = root->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
+    CCLayerImpl* child = root->children()[0].get();
 
     // In the current implementation of the damage tracker, changes to mask layers should
     // damage the entire corresponding surface.
 
     // Set up the mask layer.
-    RefPtr<CCLayerImpl> maskLayer = CCLayerImpl::create(3);
-    maskLayer->setPosition(child->position());
-    maskLayer->setAnchorPoint(FloatPoint::zero());
-    maskLayer->setBounds(child->bounds());
-    child->setMaskLayer(maskLayer);
+    {
+        OwnPtr<CCLayerImpl> maskLayer = CCLayerImpl::create(3);
+        maskLayer->setPosition(child->position());
+        maskLayer->setAnchorPoint(FloatPoint::zero());
+        maskLayer->setBounds(child->bounds());
+        child->setMaskLayer(maskLayer.release());
+    }
+    CCLayerImpl* maskLayer = child->maskLayer();
 
     // Add opacity and a grandChild so that the render surface persists even after we remove the mask.
     child->setOpacity(0.5);
-    RefPtr<CCLayerImpl> grandChild = CCLayerImpl::create(4);
-    grandChild->setPosition(FloatPoint(2.0, 2.0));
-    grandChild->setAnchorPoint(FloatPoint::zero());
-    grandChild->setBounds(IntSize(2, 2));
-    grandChild->setDrawsContent(true);
-    child->addChild(grandChild);
+    {
+        OwnPtr<CCLayerImpl> grandChild = CCLayerImpl::create(4);
+        grandChild->setPosition(FloatPoint(2.0, 2.0));
+        grandChild->setAnchorPoint(FloatPoint::zero());
+        grandChild->setBounds(IntSize(2, 2));
+        grandChild->setDrawsContent(true);
+        child->addChild(grandChild.release());
+    }
     emulateDrawingOneFrame(root.get());
 
     // Sanity check that a new surface was created for the child.
@@ -685,7 +698,7 @@ TEST_F(CCDamageTrackerTest, verifyDamageForMask)
     EXPECT_TRUE(childDamageRect.isEmpty());
 
     // Then test mask removal.
-    child->setMaskLayer(0);
+    child->setMaskLayer(nullptr);
     ASSERT_TRUE(child->layerPropertyChanged());
     emulateDrawingOneFrame(root.get());
 
@@ -698,28 +711,34 @@ TEST_F(CCDamageTrackerTest, verifyDamageForMask)
 
 TEST_F(CCDamageTrackerTest, verifyDamageForReplicaMask)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
-    RefPtr<CCLayerImpl> child1 = root->children()[0];
-    RefPtr<CCLayerImpl> grandChild1 = child1->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithTwoSurfaces();
+    CCLayerImpl* child1 = root->children()[0].get();
+    CCLayerImpl* grandChild1 = child1->children()[0].get();
 
     // Changes to a replica's mask should not damage the original surface, because it is
     // not masked. But it does damage the ancestor target surface.
 
     // Create a reflection about the left edge of grandChild1.
-    RefPtr<CCLayerImpl> grandChild1Replica = CCLayerImpl::create(6);
-    grandChild1Replica->setPosition(FloatPoint::zero());
-    grandChild1Replica->setAnchorPoint(FloatPoint::zero());
-    TransformationMatrix reflection;
-    reflection.scale3d(-1.0, 1.0, 1.0);
-    grandChild1Replica->setTransform(reflection);
-    grandChild1->setReplicaLayer(grandChild1Replica);
+    {
+        OwnPtr<CCLayerImpl> grandChild1Replica = CCLayerImpl::create(6);
+        grandChild1Replica->setPosition(FloatPoint::zero());
+        grandChild1Replica->setAnchorPoint(FloatPoint::zero());
+        TransformationMatrix reflection;
+        reflection.scale3d(-1.0, 1.0, 1.0);
+        grandChild1Replica->setTransform(reflection);
+        grandChild1->setReplicaLayer(grandChild1Replica.release());
+    }
+    CCLayerImpl* grandChild1Replica = grandChild1->replicaLayer();
 
     // Set up the mask layer on the replica layer
-    RefPtr<CCLayerImpl> replicaMaskLayer = CCLayerImpl::create(7);
-    replicaMaskLayer->setPosition(FloatPoint::zero());
-    replicaMaskLayer->setAnchorPoint(FloatPoint::zero());
-    replicaMaskLayer->setBounds(grandChild1->bounds());
-    grandChild1Replica->setMaskLayer(replicaMaskLayer);
+    {
+        OwnPtr<CCLayerImpl> replicaMaskLayer = CCLayerImpl::create(7);
+        replicaMaskLayer->setPosition(FloatPoint::zero());
+        replicaMaskLayer->setAnchorPoint(FloatPoint::zero());
+        replicaMaskLayer->setBounds(grandChild1->bounds());
+        grandChild1Replica->setMaskLayer(replicaMaskLayer.release());
+    }
+    CCLayerImpl* replicaMaskLayer = grandChild1Replica->maskLayer();
 
     emulateDrawingOneFrame(root.get());
 
@@ -738,7 +757,7 @@ TEST_F(CCDamageTrackerTest, verifyDamageForReplicaMask)
 
     // CASE 2: removing the replica mask damages only the reflected region on the target surface.
     //
-    grandChild1Replica->setMaskLayer(0);
+    grandChild1Replica->setMaskLayer(nullptr);
     emulateDrawingOneFrame(root.get());
 
     grandChildDamageRect = grandChild1->renderSurface()->damageTracker()->currentDamageRect();
@@ -750,8 +769,8 @@ TEST_F(CCDamageTrackerTest, verifyDamageForReplicaMask)
 
 TEST_F(CCDamageTrackerTest, verifyDamageWhenReset)
 {
-    RefPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
-    RefPtr<CCLayerImpl> child = root->children()[0];
+    OwnPtr<CCLayerImpl> root = createAndSetUpTestTreeWithOneSurface();
+    CCLayerImpl* child = root->children()[0].get();
 
     // Case 1: This test ensures that when the tracker is forced to have full damage, that
     //         it takes priority over any other partial damage.
diff --git a/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp b/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp
index b7732aeab..15b554a06 100644
--- a/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp
+++ b/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp
@@ -48,9 +48,8 @@ void expectTranslateX(double translateX, const TransformationMatrix& matrix)
 // Tests that a float animation with one keyframe works as expected.
 TEST(CCKeyframedAnimationCurveTest, OneFloatKeyframe)
 {
-    Vector<CCFloatKeyframe> keyframes;
-    keyframes.append(CCFloatKeyframe(0, 2));
-    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create(keyframes));
+    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create());
+    curve->addKeyframe(CCFloatKeyframe::create(0, 2, nullptr));
     EXPECT_FLOAT_EQ(2, curve->getValue(-1));
     EXPECT_FLOAT_EQ(2, curve->getValue(0));
     EXPECT_FLOAT_EQ(2, curve->getValue(0.5));
@@ -61,10 +60,9 @@ TEST(CCKeyframedAnimationCurveTest, OneFloatKeyframe)
 // Tests that a float animation with two keyframes works as expected.
 TEST(CCKeyframedAnimationCurveTest, TwoFloatKeyframe)
 {
-    Vector<CCFloatKeyframe> keyframes;
-    keyframes.append(CCFloatKeyframe(0, 2));
-    keyframes.append(CCFloatKeyframe(1, 4));
-    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create(keyframes));
+    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create());
+    curve->addKeyframe(CCFloatKeyframe::create(0, 2, nullptr));
+    curve->addKeyframe(CCFloatKeyframe::create(1, 4, nullptr));
     EXPECT_FLOAT_EQ(2, curve->getValue(-1));
     EXPECT_FLOAT_EQ(2, curve->getValue(0));
     EXPECT_FLOAT_EQ(3, curve->getValue(0.5));
@@ -75,11 +73,10 @@ TEST(CCKeyframedAnimationCurveTest, TwoFloatKeyframe)
 // Tests that a float animation with three keyframes works as expected.
 TEST(CCKeyframedAnimationCurveTest, ThreeFloatKeyframe)
 {
-    Vector<CCFloatKeyframe> keyframes;
-    keyframes.append(CCFloatKeyframe(0, 2));
-    keyframes.append(CCFloatKeyframe(1, 4));
-    keyframes.append(CCFloatKeyframe(2, 8));
-    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create(keyframes));
+    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create());
+    curve->addKeyframe(CCFloatKeyframe::create(0, 2, nullptr));
+    curve->addKeyframe(CCFloatKeyframe::create(1, 4, nullptr));
+    curve->addKeyframe(CCFloatKeyframe::create(2, 8, nullptr));
     EXPECT_FLOAT_EQ(2, curve->getValue(-1));
     EXPECT_FLOAT_EQ(2, curve->getValue(0));
     EXPECT_FLOAT_EQ(3, curve->getValue(0.5));
@@ -92,13 +89,11 @@ TEST(CCKeyframedAnimationCurveTest, ThreeFloatKeyframe)
 // Tests that a float animation with multiple keys at a given time works sanely.
 TEST(CCKeyframedAnimationCurveTest, RepeatedFloatKeyTimes)
 {
-    Vector<CCFloatKeyframe> keyframes;
-    // A step function.
-    keyframes.append(CCFloatKeyframe(0, 4));
-    keyframes.append(CCFloatKeyframe(1, 4));
-    keyframes.append(CCFloatKeyframe(1, 6));
-    keyframes.append(CCFloatKeyframe(2, 6));
-    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create(keyframes));
+    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create());
+    curve->addKeyframe(CCFloatKeyframe::create(0, 4, nullptr));
+    curve->addKeyframe(CCFloatKeyframe::create(1, 4, nullptr));
+    curve->addKeyframe(CCFloatKeyframe::create(1, 6, nullptr));
+    curve->addKeyframe(CCFloatKeyframe::create(2, 6, nullptr));
 
     EXPECT_FLOAT_EQ(4, curve->getValue(-1));
     EXPECT_FLOAT_EQ(4, curve->getValue(0));
@@ -117,11 +112,11 @@ TEST(CCKeyframedAnimationCurveTest, RepeatedFloatKeyTimes)
 // Tests that a transform animation with one keyframe works as expected.
 TEST(CCKeyframedAnimationCurveTest, OneTransformKeyframe)
 {
-    Vector<CCTransformKeyframe> keyframes;
+    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create());
     TransformOperations operations;
     operations.operations().append(TranslateTransformOperation::create(Length(2, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
-    keyframes.append(CCTransformKeyframe(0, operations));
-    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create(keyframes));
+    curve->addKeyframe(CCTransformKeyframe::create(0, operations, nullptr));
+
     IntSize layerSize; // ignored
     expectTranslateX(2, curve->getValue(-1, layerSize));
     expectTranslateX(2, curve->getValue(0, layerSize));
@@ -133,14 +128,13 @@ TEST(CCKeyframedAnimationCurveTest, OneTransformKeyframe)
 // Tests that a transform animation with two keyframes works as expected.
 TEST(CCKeyframedAnimationCurveTest, TwoTransformKeyframe)
 {
-    Vector<CCTransformKeyframe> keyframes;
+    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create());
     TransformOperations operations1;
     operations1.operations().append(TranslateTransformOperation::create(Length(2, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
     TransformOperations operations2;
     operations2.operations().append(TranslateTransformOperation::create(Length(4, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
-    keyframes.append(CCTransformKeyframe(0, operations1));
-    keyframes.append(CCTransformKeyframe(1, operations2));
-    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create(keyframes));
+    curve->addKeyframe(CCTransformKeyframe::create(0, operations1, nullptr));
+    curve->addKeyframe(CCTransformKeyframe::create(1, operations2, nullptr));
     IntSize layerSize; // ignored
     expectTranslateX(2, curve->getValue(-1, layerSize));
     expectTranslateX(2, curve->getValue(0, layerSize));
@@ -152,17 +146,16 @@ TEST(CCKeyframedAnimationCurveTest, TwoTransformKeyframe)
 // Tests that a transform animation with three keyframes works as expected.
 TEST(CCKeyframedAnimationCurveTest, ThreeTransformKeyframe)
 {
-    Vector<CCTransformKeyframe> keyframes;
+    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create());
     TransformOperations operations1;
     operations1.operations().append(TranslateTransformOperation::create(Length(2, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
     TransformOperations operations2;
     operations2.operations().append(TranslateTransformOperation::create(Length(4, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
     TransformOperations operations3;
     operations3.operations().append(TranslateTransformOperation::create(Length(8, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
-    keyframes.append(CCTransformKeyframe(0, operations1));
-    keyframes.append(CCTransformKeyframe(1, operations2));
-    keyframes.append(CCTransformKeyframe(2, operations3));
-    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create(keyframes));
+    curve->addKeyframe(CCTransformKeyframe::create(0, operations1, nullptr));
+    curve->addKeyframe(CCTransformKeyframe::create(1, operations2, nullptr));
+    curve->addKeyframe(CCTransformKeyframe::create(2, operations3, nullptr));
     IntSize layerSize; // ignored
     expectTranslateX(2, curve->getValue(-1, layerSize));
     expectTranslateX(2, curve->getValue(0, layerSize));
@@ -176,7 +169,7 @@ TEST(CCKeyframedAnimationCurveTest, ThreeTransformKeyframe)
 // Tests that a transform animation with multiple keys at a given time works sanely.
 TEST(CCKeyframedAnimationCurveTest, RepeatedTransformKeyTimes)
 {
-    Vector<CCTransformKeyframe> keyframes;
+    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create());
     // A step function.
     TransformOperations operations1;
     operations1.operations().append(TranslateTransformOperation::create(Length(4, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
@@ -186,11 +179,10 @@ TEST(CCKeyframedAnimationCurveTest, RepeatedTransformKeyTimes)
     operations3.operations().append(TranslateTransformOperation::create(Length(6, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
     TransformOperations operations4;
     operations4.operations().append(TranslateTransformOperation::create(Length(6, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
-    keyframes.append(CCTransformKeyframe(0, operations1));
-    keyframes.append(CCTransformKeyframe(1, operations2));
-    keyframes.append(CCTransformKeyframe(1, operations3));
-    keyframes.append(CCTransformKeyframe(2, operations4));
-    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create(keyframes));
+    curve->addKeyframe(CCTransformKeyframe::create(0, operations1, nullptr));
+    curve->addKeyframe(CCTransformKeyframe::create(1, operations2, nullptr));
+    curve->addKeyframe(CCTransformKeyframe::create(1, operations3, nullptr));
+    curve->addKeyframe(CCTransformKeyframe::create(2, operations4, nullptr));
 
     IntSize layerSize; // ignored
 
@@ -209,33 +201,36 @@ TEST(CCKeyframedAnimationCurveTest, RepeatedTransformKeyTimes)
     expectTranslateX(6, curve->getValue(3, layerSize));
 }
 
-// Tests that invalid lists of keyframes result in nothing being returned from ::create.
-TEST(CCKeyframedAnimationCurveTest, InvalidKeyframes)
+// Tests that the keyframes may be added out of order.
+TEST(CCKeyframedAnimationCurveTest, UnsortedKeyframes)
 {
-    // It is invalid to pass an empty vector of keyframes to create.
-    Vector<CCTransformKeyframe> transformKeyframes;
-    OwnPtr<CCKeyframedTransformAnimationCurve> transformCurve = CCKeyframedTransformAnimationCurve::create(transformKeyframes);
-    EXPECT_FALSE(transformCurve.get());
-
-    Vector<CCFloatKeyframe> floatKeyframes;
-    OwnPtr<CCKeyframedFloatAnimationCurve> floatCurve = CCKeyframedFloatAnimationCurve::create(floatKeyframes);
-    EXPECT_FALSE(floatCurve.get());
-
-    // It is invalid to pass a vector of unsorted keyframes to create;
-    TransformOperations operations1;
-    operations1.operations().append(TranslateTransformOperation::create(Length(2, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
-    TransformOperations operations2;
-    operations2.operations().append(TranslateTransformOperation::create(Length(4, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
-    transformKeyframes.append(CCTransformKeyframe(1, operations1));
-    transformKeyframes.append(CCTransformKeyframe(0, operations2));
-    transformCurve = CCKeyframedTransformAnimationCurve::create(transformKeyframes);
-    EXPECT_FALSE(transformCurve.get());
-
-    floatKeyframes.append(CCFloatKeyframe(1, 2));
-    floatKeyframes.append(CCFloatKeyframe(0, 4));
-    floatCurve = CCKeyframedFloatAnimationCurve::create(floatKeyframes);
-    EXPECT_FALSE(floatCurve.get());
+    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create());
+    curve->addKeyframe(CCFloatKeyframe::create(2, 8, nullptr));
+    curve->addKeyframe(CCFloatKeyframe::create(0, 2, nullptr));
+    curve->addKeyframe(CCFloatKeyframe::create(1, 4, nullptr));
+    EXPECT_FLOAT_EQ(2, curve->getValue(-1));
+    EXPECT_FLOAT_EQ(2, curve->getValue(0));
+    EXPECT_FLOAT_EQ(3, curve->getValue(0.5));
+    EXPECT_FLOAT_EQ(4, curve->getValue(1));
+    EXPECT_FLOAT_EQ(6, curve->getValue(1.5));
+    EXPECT_FLOAT_EQ(8, curve->getValue(2));
+    EXPECT_FLOAT_EQ(8, curve->getValue(3));
 }
 
+// Tests that a cubic bezier timing function works as expected.
+TEST(CCKeyframedAnimationCurveTest, CubicBezierTimingFunction)
+{
+    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create());
+    curve->addKeyframe(CCFloatKeyframe::create(0, 0, CCCubicBezierTimingFunction::create(0.25, 0, 0.75, 1)));
+    curve->addKeyframe(CCFloatKeyframe::create(1, 1, nullptr));
+
+    EXPECT_FLOAT_EQ(0, curve->getValue(0));
+    EXPECT_LT(0, curve->getValue(0.25));
+    EXPECT_GT(0.25, curve->getValue(0.25));
+    EXPECT_FLOAT_EQ(0.5, curve->getValue(0.5));
+    EXPECT_LT(0.75, curve->getValue(0.75));
+    EXPECT_GT(1, curve->getValue(0.75));
+    EXPECT_FLOAT_EQ(1, curve->getValue(1));
+}
 
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
index 16a25e12e..8a9f35dc8 100644
--- a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
@@ -65,14 +65,11 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     DebugScopedSetImplThread setImplThread;
 
     // Create a simple CCLayerImpl tree:
-    RefPtr<CCLayerImpl> root = CCLayerImpl::create(1);
-    RefPtr<CCLayerImpl> child = CCLayerImpl::create(2);
-    RefPtr<CCLayerImpl> grandChild = CCLayerImpl::create(3);
-    root->addChild(child);
-    child->addChild(grandChild);
-
-    RefPtr<CCLayerImpl> dummyMask = CCLayerImpl::create(4);
-    RefPtr<CCLayerImpl> dummyReplica = CCLayerImpl::create(5);
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    root->addChild(CCLayerImpl::create(2));
+    CCLayerImpl* child = root->children()[0].get();
+    child->addChild(CCLayerImpl::create(3));
+    CCLayerImpl* grandChild = child->children()[0].get();
 
     // Adding children is an internal operation and should not mark layers as changed.
     EXPECT_FALSE(root->layerPropertyChanged());
@@ -95,11 +92,11 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setAnchorPoint(arbitraryFloatPoint));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setAnchorPointZ(arbitraryNumber));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setFilters(arbitraryFilters));
-    EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setMaskLayer(dummyMask));
+    EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setMaskLayer(CCLayerImpl::create(4)));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setMasksToBounds(true));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setOpaque(true));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setOpacity(arbitraryNumber));
-    EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setReplicaLayer(dummyReplica));
+    EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setReplicaLayer(CCLayerImpl::create(5)));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setPosition(arbitraryFloatPoint));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setPreserves3D(true));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setTransform(arbitraryTransform));
@@ -134,9 +131,7 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     // not cause any change.
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setAnchorPoint(arbitraryFloatPoint));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setAnchorPointZ(arbitraryNumber));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setMaskLayer(dummyMask));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setMasksToBounds(true));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setReplicaLayer(dummyReplica));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setPosition(arbitraryFloatPoint));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setPreserves3D(true));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setTransform(arbitraryTransform));
diff --git a/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp b/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
index bff7e1ba9..2f5a7a25d 100644
--- a/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
@@ -67,8 +67,8 @@ private:
     EXPECT_EQ(contrib, layer->m_countRepresentingContributingSurface);   \
     EXPECT_EQ(itself, layer->m_countRepresentingItself);
 
-typedef CCLayerIterator<LayerChromium, RenderSurfaceChromium, CCLayerIteratorActions::FrontToBack> FrontToBack;
-typedef CCLayerIterator<LayerChromium, RenderSurfaceChromium, CCLayerIteratorActions::BackToFront> BackToFront;
+typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::FrontToBack> FrontToBack;
+typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::BackToFront> BackToFront;
 
 void resetCounts(Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList)
 {
@@ -137,7 +137,7 @@ TEST(CCLayerIteratorTest, simpleTree)
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     Vector<RefPtr<LayerChromium> > layerList;
-    renderSurfaceLayerList.append(rootLayer);
+    renderSurfaceLayerList.append(rootLayer.get());
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(rootLayer.get(), rootLayer.get(),
                                                                 TransformationMatrix(), TransformationMatrix(),
                                                                 renderSurfaceLayerList, layerList,
@@ -184,7 +184,7 @@ TEST(CCLayerIteratorTest, complexTree)
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     Vector<RefPtr<LayerChromium> > layerList;
-    renderSurfaceLayerList.append(rootLayer);
+    renderSurfaceLayerList.append(rootLayer.get());
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(rootLayer.get(), rootLayer.get(),
                                                                 TransformationMatrix(), TransformationMatrix(),
                                                                 renderSurfaceLayerList, layerList,
@@ -243,7 +243,7 @@ TEST(CCLayerIteratorTest, complexTreeMultiSurface)
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     Vector<RefPtr<LayerChromium> > layerList;
-    renderSurfaceLayerList.append(rootLayer);
+    renderSurfaceLayerList.append(rootLayer.get());
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(rootLayer.get(), rootLayer.get(),
                                                                 TransformationMatrix(), TransformationMatrix(),
                                                                 renderSurfaceLayerList, layerList,
diff --git a/Source/WebKit/chromium/tests/CCLayerSorterTest.cpp b/Source/WebKit/chromium/tests/CCLayerSorterTest.cpp
index 69342cda7..a533c9373 100644
--- a/Source/WebKit/chromium/tests/CCLayerSorterTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerSorterTest.cpp
@@ -174,11 +174,11 @@ TEST(CCLayerSorterTest, verifyExistingOrderingPreservedWhenNoZDiff)
     //    - 3 and 4 do not have a 3d z difference, and therefore their relative ordering should be retained.
     //    - 3 and 4 should be re-sorted so they are in front of 1, 2, and 5.
 
-    RefPtr<CCLayerImpl> layer1 = CCLayerImpl::create(1);
-    RefPtr<CCLayerImpl> layer2 = CCLayerImpl::create(2);
-    RefPtr<CCLayerImpl> layer3 = CCLayerImpl::create(3);
-    RefPtr<CCLayerImpl> layer4 = CCLayerImpl::create(4);
-    RefPtr<CCLayerImpl> layer5 = CCLayerImpl::create(5);
+    OwnPtr<CCLayerImpl> layer1 = CCLayerImpl::create(1);
+    OwnPtr<CCLayerImpl> layer2 = CCLayerImpl::create(2);
+    OwnPtr<CCLayerImpl> layer3 = CCLayerImpl::create(3);
+    OwnPtr<CCLayerImpl> layer4 = CCLayerImpl::create(4);
+    OwnPtr<CCLayerImpl> layer5 = CCLayerImpl::create(5);
 
     TransformationMatrix BehindMatrix;
     BehindMatrix.translate3d(0, 0, 2);
@@ -205,12 +205,12 @@ TEST(CCLayerSorterTest, verifyExistingOrderingPreservedWhenNoZDiff)
     layer5->setDrawTransform(BehindMatrix);
     layer5->setDrawsContent(true);
 
-    Vector<RefPtr<CCLayerImpl> > layerList;
-    layerList.append(layer1);
-    layerList.append(layer2);
-    layerList.append(layer3);
-    layerList.append(layer4);
-    layerList.append(layer5);
+    Vector<CCLayerImpl*> layerList;
+    layerList.append(layer1.get());
+    layerList.append(layer2.get());
+    layerList.append(layer3.get());
+    layerList.append(layer4.get());
+    layerList.append(layer5.get());
 
     ASSERT_EQ(static_cast<size_t>(5), layerList.size());
     EXPECT_EQ(1, layerList[0]->id());
diff --git a/Source/WebKit/chromium/tests/CCLayerTestCommon.cpp b/Source/WebKit/chromium/tests/CCLayerTestCommon.cpp
index 9fe377766..423c668d9 100644
--- a/Source/WebKit/chromium/tests/CCLayerTestCommon.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTestCommon.cpp
@@ -36,15 +36,6 @@ namespace CCLayerTestCommon {
 // Align with expected and actual output
 const char* quadString = "    Quad: ";
 
-bool completelyContains(const Region& container, const IntRect& rect)
-{
-    Region tester(rect);
-    Vector<IntRect> rects = container.rects();
-    for (size_t i = 0; i < rects.size(); ++i)
-        tester.subtract(rects[i]);
-    return tester.isEmpty();
-}
-
 void verifyQuadsExactlyCoverRect(const CCQuadList& quads, const IntRect& rect)
 {
     Region remaining(rect);
@@ -53,7 +44,7 @@ void verifyQuadsExactlyCoverRect(const CCQuadList& quads, const IntRect& rect)
         CCDrawQuad* quad = quads[i].get();
 
         EXPECT_TRUE(rect.contains(quad->quadRect())) << quadString << i;
-        EXPECT_TRUE(completelyContains(remaining, quad->quadRect())) << quadString << i;
+        EXPECT_TRUE(remaining.contains(quad->quadRect())) << quadString << i;
         remaining.subtract(Region(quad->quadRect()));
     }
 
diff --git a/Source/WebKit/chromium/tests/CCLayerTestCommon.h b/Source/WebKit/chromium/tests/CCLayerTestCommon.h
index c5add93a9..052d44bc9 100644
--- a/Source/WebKit/chromium/tests/CCLayerTestCommon.h
+++ b/Source/WebKit/chromium/tests/CCLayerTestCommon.h
@@ -33,7 +33,6 @@ namespace CCLayerTestCommon {
 
 extern const char* quadString;
 
-bool completelyContains(const WebCore::Region&, const WebCore::IntRect&);
 void verifyQuadsExactlyCoverRect(const WebCore::CCQuadList&, const WebCore::IntRect&);
 
 } // namespace CCLayerTestCommon
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
index d2e1cfef9..e6206cc58 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
@@ -573,7 +573,7 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectCullsRenderSurfaces)
 
     // FIXME: when we fix this "root-layer special case" behavior in CCLayerTreeHost, we will have to fix it here, too.
     parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
-    renderSurfaceLayerList.append(parent);
+    renderSurfaceLayerList.append(parent.get());
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
index 9ba1cf4ad..d75c12890 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
@@ -49,10 +49,11 @@ public:
         m_hostImpl = CCLayerTreeHostImpl::create(settings, this);
     }
 
+    virtual void didLoseContextOnImplThread() { }
     virtual void onSwapBuffersCompleteOnImplThread() { }
     virtual void setNeedsRedrawOnImplThread() { m_didRequestRedraw = true; }
     virtual void setNeedsCommitOnImplThread() { m_didRequestCommit = true; }
-    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>) { }
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) { }
 
     static void expectClearedScrollDeltasRecursive(CCLayerImpl* layer)
     {
@@ -78,16 +79,16 @@ public:
 
     void setupScrollAndContentsLayers(const IntSize& contentSize)
     {
-        RefPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
         root->setScrollable(true);
         root->setScrollPosition(IntPoint(0, 0));
         root->setMaxScrollPosition(contentSize);
-        RefPtr<CCLayerImpl> contents = CCLayerImpl::create(1);
+        OwnPtr<CCLayerImpl> contents = CCLayerImpl::create(1);
         contents->setDrawsContent(true);
         contents->setBounds(contentSize);
         contents->setContentBounds(contentSize);
-        root->addChild(contents);
-        m_hostImpl->setRootLayer(root);
+        root->addChild(contents.release());
+        m_hostImpl->setRootLayer(root.release());
     }
 
 protected:
@@ -112,37 +113,43 @@ TEST_F(CCLayerTreeHostImplTest, scrollDeltaNoLayers)
 
 TEST_F(CCLayerTreeHostImplTest, scrollDeltaTreeButNoChanges)
 {
-    RefPtr<CCLayerImpl> root = CCLayerImpl::create(0);
-    root->addChild(CCLayerImpl::create(1));
-    root->addChild(CCLayerImpl::create(2));
-    root->children()[1]->addChild(CCLayerImpl::create(3));
-    root->children()[1]->addChild(CCLayerImpl::create(4));
-    root->children()[1]->children()[0]->addChild(CCLayerImpl::create(5));
-    m_hostImpl->setRootLayer(root);
+    {
+        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+        root->addChild(CCLayerImpl::create(1));
+        root->addChild(CCLayerImpl::create(2));
+        root->children()[1]->addChild(CCLayerImpl::create(3));
+        root->children()[1]->addChild(CCLayerImpl::create(4));
+        root->children()[1]->children()[0]->addChild(CCLayerImpl::create(5));
+        m_hostImpl->setRootLayer(root.release());
+    }
+    CCLayerImpl* root = m_hostImpl->rootLayer();
 
-    expectClearedScrollDeltasRecursive(root.get());
+    expectClearedScrollDeltasRecursive(root);
 
     OwnPtr<CCScrollAndScaleSet> scrollInfo;
 
     scrollInfo = m_hostImpl->processScrollDeltas();
     ASSERT_EQ(scrollInfo->scrolls.size(), 0u);
-    expectClearedScrollDeltasRecursive(root.get());
+    expectClearedScrollDeltasRecursive(root);
 
     scrollInfo = m_hostImpl->processScrollDeltas();
     ASSERT_EQ(scrollInfo->scrolls.size(), 0u);
-    expectClearedScrollDeltasRecursive(root.get());
+    expectClearedScrollDeltasRecursive(root);
 }
 
 TEST_F(CCLayerTreeHostImplTest, scrollDeltaRepeatedScrolls)
 {
     IntPoint scrollPosition(20, 30);
     IntSize scrollDelta(11, -15);
-    RefPtr<CCLayerImpl> root = CCLayerImpl::create(10);
-    root->setScrollPosition(scrollPosition);
-    root->setScrollable(true);
-    root->setMaxScrollPosition(IntSize(100, 100));
-    root->scrollBy(scrollDelta);
-    m_hostImpl->setRootLayer(root);
+    {
+        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(10);
+        root->setScrollPosition(scrollPosition);
+        root->setScrollable(true);
+        root->setMaxScrollPosition(IntSize(100, 100));
+        root->scrollBy(scrollDelta);
+        m_hostImpl->setRootLayer(root.release());
+    }
+    CCLayerImpl* root = m_hostImpl->rootLayer();
 
     OwnPtr<CCScrollAndScaleSet> scrollInfo;
 
@@ -165,11 +172,14 @@ TEST_F(CCLayerTreeHostImplTest, scrollDeltaRepeatedScrolls)
 
 TEST_F(CCLayerTreeHostImplTest, scrollRootCallsCommitAndRedraw)
 {
-    RefPtr<CCLayerImpl> root = CCLayerImpl::create(0);
-    root->setScrollable(true);
-    root->setScrollPosition(IntPoint(0, 0));
-    root->setMaxScrollPosition(IntSize(100, 100));
-    m_hostImpl->setRootLayer(root);
+    {
+        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+        root->setScrollable(true);
+        root->setScrollPosition(IntPoint(0, 0));
+        root->setMaxScrollPosition(IntSize(100, 100));
+        m_hostImpl->setRootLayer(root.release());
+    }
+
     EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(0, 0), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollStarted);
     m_hostImpl->scrollBy(IntSize(0, 10));
     m_hostImpl->scrollEnd();
@@ -179,11 +189,15 @@ TEST_F(CCLayerTreeHostImplTest, scrollRootCallsCommitAndRedraw)
 
 TEST_F(CCLayerTreeHostImplTest, wheelEventHandlers)
 {
-    RefPtr<CCLayerImpl> root = CCLayerImpl::create(0);
-    root->setScrollable(true);
-    root->setScrollPosition(IntPoint(0, 0));
-    root->setMaxScrollPosition(IntSize(100, 100));
-    m_hostImpl->setRootLayer(root);
+    {
+        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+        root->setScrollable(true);
+        root->setScrollPosition(IntPoint(0, 0));
+        root->setMaxScrollPosition(IntSize(100, 100));
+        m_hostImpl->setRootLayer(root.release());
+    }
+    CCLayerImpl* root = m_hostImpl->rootLayer();
+
     root->setHaveWheelEventHandlers(true);
     // With registered event handlers, wheel scrolls have to go to the main thread.
     EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(0, 0), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollFailed);
@@ -192,6 +206,61 @@ TEST_F(CCLayerTreeHostImplTest, wheelEventHandlers)
     EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(0, 0), CCInputHandlerClient::Gesture), CCInputHandlerClient::ScrollStarted);
 }
 
+TEST_F(CCLayerTreeHostImplTest, shouldScrollOnMainThread)
+{
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+    root->setScrollable(true);
+    root->setScrollPosition(IntPoint(0, 0));
+    root->setMaxScrollPosition(IntSize(100, 100));
+    root->setShouldScrollOnMainThread(true);
+    m_hostImpl->setRootLayer(root.release());
+    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(0, 0), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollFailed);
+    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(0, 0), CCInputHandlerClient::Gesture), CCInputHandlerClient::ScrollFailed);
+}
+
+TEST_F(CCLayerTreeHostImplTest, nonFastScrollableRegionBasic)
+{
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+    root->setScrollable(true);
+    root->setScrollPosition(IntPoint(0, 0));
+    root->setMaxScrollPosition(IntSize(100, 100));
+    root->setNonFastScrollableRegion(IntRect(0, 0, 50, 50));
+    m_hostImpl->setRootLayer(root.release());
+    // All scroll types inside the non-fast scrollable region should fail.
+    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(25, 25), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollFailed);
+    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(25, 25), CCInputHandlerClient::Gesture), CCInputHandlerClient::ScrollFailed);
+
+    // All scroll types outside this region should succeed.
+    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(75, 75), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollStarted);
+    m_hostImpl->scrollBy(IntSize(0, 10));
+    m_hostImpl->scrollEnd();
+    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(75, 75), CCInputHandlerClient::Gesture), CCInputHandlerClient::ScrollStarted);
+    m_hostImpl->scrollBy(IntSize(0, 10));
+    m_hostImpl->scrollEnd();
+}
+
+TEST_F(CCLayerTreeHostImplTest, nonFastScrollableRegionWithOffset)
+{
+    m_hostImpl->initializeLayerRenderer(createContext());
+
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+    root->setScrollable(true);
+    root->setScrollPosition(IntPoint(0, 0));
+    root->setMaxScrollPosition(IntSize(100, 100));
+    root->setNonFastScrollableRegion(IntRect(0, 0, 50, 50));
+    root->setPosition(FloatPoint(-25, 0));
+    m_hostImpl->setRootLayer(root.release());
+    m_hostImpl->drawLayers(); // Update draw transforms so we can correctly map points into layer space.
+
+    // This point would fall into the non-fast scrollable region except that we've moved the layer down by 25 pixels.
+    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(40, 10), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollStarted);
+    m_hostImpl->scrollBy(IntSize(0, 1));
+    m_hostImpl->scrollEnd();
+
+    // This point is still inside the non-fast region.
+    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(10, 10), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollFailed);
+}
+
 TEST_F(CCLayerTreeHostImplTest, pinchGesture)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
@@ -281,8 +350,10 @@ TEST_F(CCLayerTreeHostImplTest, pageScaleAnimation)
     ASSERT(scrollLayer);
 
     const float minPageScale = 0.5, maxPageScale = 4;
-    const double startTimeMs = 1000;
-    const double durationMs = 100;
+    const double startTime = 1;
+    const double duration = 0.1;
+    const double halfwayThroughAnimation = startTime + duration / 2;
+    const double endTime = startTime + duration;
 
     // Non-anchor zoom-in
     {
@@ -290,10 +361,10 @@ TEST_F(CCLayerTreeHostImplTest, pageScaleAnimation)
         scrollLayer->setPageScaleDelta(1);
         scrollLayer->setScrollPosition(IntPoint(50, 50));
 
-        m_hostImpl->startPageScaleAnimation(IntSize(0, 0), false, 2, startTimeMs, durationMs);
-        m_hostImpl->animate(startTimeMs + durationMs / 2);
+        m_hostImpl->startPageScaleAnimation(IntSize(0, 0), false, 2, startTime, duration);
+        m_hostImpl->animate(halfwayThroughAnimation, halfwayThroughAnimation);
         EXPECT_TRUE(m_didRequestRedraw);
-        m_hostImpl->animate(startTimeMs + durationMs);
+        m_hostImpl->animate(endTime, endTime);
         EXPECT_TRUE(m_didRequestCommit);
 
         OwnPtr<CCScrollAndScaleSet> scrollInfo = m_hostImpl->processScrollDeltas();
@@ -307,8 +378,8 @@ TEST_F(CCLayerTreeHostImplTest, pageScaleAnimation)
         scrollLayer->setPageScaleDelta(1);
         scrollLayer->setScrollPosition(IntPoint(50, 50));
 
-        m_hostImpl->startPageScaleAnimation(IntSize(25, 25), true, minPageScale, startTimeMs, durationMs);
-        m_hostImpl->animate(startTimeMs + durationMs);
+        m_hostImpl->startPageScaleAnimation(IntSize(25, 25), true, minPageScale, startTime, duration);
+        m_hostImpl->animate(endTime, endTime);
         EXPECT_TRUE(m_didRequestRedraw);
         EXPECT_TRUE(m_didRequestCommit);
 
@@ -321,7 +392,7 @@ TEST_F(CCLayerTreeHostImplTest, pageScaleAnimation)
 
 class DidDrawCheckLayer : public CCLayerImpl {
 public:
-    static PassRefPtr<DidDrawCheckLayer> create(int id) { return adoptRef(new DidDrawCheckLayer(id)); }
+    static PassOwnPtr<DidDrawCheckLayer> create(int id) { return adoptPtr(new DidDrawCheckLayer(id)); }
 
     virtual void didDraw()
     {
@@ -353,14 +424,13 @@ private:
 
 TEST_F(CCLayerTreeHostImplTest, didDrawNotCalledOnHiddenLayer)
 {
-    RefPtr<GraphicsContext3D> context = createContext();
-    m_hostImpl->initializeLayerRenderer(context);
+    m_hostImpl->initializeLayerRenderer(createContext());
 
     // Ensure visibleLayerRect for root layer is empty
     m_hostImpl->setViewportSize(IntSize(0, 0));
 
-    RefPtr<DidDrawCheckLayer> root = DidDrawCheckLayer::create(0);
-    m_hostImpl->setRootLayer(root);
+    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(0));
+    DidDrawCheckLayer* root = static_cast<DidDrawCheckLayer*>(m_hostImpl->rootLayer());
 
     EXPECT_FALSE(root->willDrawCalled());
     EXPECT_FALSE(root->didDrawCalled());
@@ -388,18 +458,17 @@ TEST_F(CCLayerTreeHostImplTest, didDrawNotCalledOnHiddenLayer)
 
 TEST_F(CCLayerTreeHostImplTest, didDrawCalledOnAllLayers)
 {
-    RefPtr<GraphicsContext3D> context = createContext();
-    m_hostImpl->initializeLayerRenderer(context);
+    m_hostImpl->initializeLayerRenderer(createContext());
     m_hostImpl->setViewportSize(IntSize(10, 10));
 
-    RefPtr<DidDrawCheckLayer> root = DidDrawCheckLayer::create(0);
-    m_hostImpl->setRootLayer(root);
+    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(0));
+    DidDrawCheckLayer* root = static_cast<DidDrawCheckLayer*>(m_hostImpl->rootLayer());
 
-    RefPtr<DidDrawCheckLayer> layer1 = DidDrawCheckLayer::create(1);
-    root->addChild(layer1);
+    root->addChild(DidDrawCheckLayer::create(1));
+    DidDrawCheckLayer* layer1 = static_cast<DidDrawCheckLayer*>(root->children()[0].get());
 
-    RefPtr<DidDrawCheckLayer> layer2 = DidDrawCheckLayer::create(2);
-    layer1->addChild(layer2);
+    layer1->addChild(DidDrawCheckLayer::create(2));
+    DidDrawCheckLayer* layer2 = static_cast<DidDrawCheckLayer*>(layer1->children()[0].get());
 
     layer1->setOpacity(0.3);
     layer1->setPreserves3D(false);
@@ -422,8 +491,6 @@ class BlendStateTrackerContext: public FakeWebGraphicsContext3D {
 public:
     BlendStateTrackerContext() : m_blend(false) { }
 
-    virtual bool initialize(Attributes, WebView*, bool renderDirectlyToWebView) { return true; }
-
     virtual void enable(WGC3Denum cap)
     {
         if (cap == GraphicsContext3D::BLEND)
@@ -444,7 +511,7 @@ private:
 
 class BlendStateCheckLayer : public CCLayerImpl {
 public:
-    static PassRefPtr<BlendStateCheckLayer> create(int id) { return adoptRef(new BlendStateCheckLayer(id)); }
+    static PassOwnPtr<BlendStateCheckLayer> create(int id) { return adoptPtr(new BlendStateCheckLayer(id)); }
 
     virtual void appendQuads(CCQuadList& quadList, const CCSharedQuadState* sharedQuadState)
     {
@@ -489,18 +556,20 @@ private:
 // https://bugs.webkit.org/show_bug.cgi?id=75783
 TEST_F(CCLayerTreeHostImplTest, blendingOffWhenDrawingOpaqueLayers)
 {
-    RefPtr<GraphicsContext3D> context = createContext();
-    m_hostImpl->initializeLayerRenderer(context);
+    m_hostImpl->initializeLayerRenderer(createContext());
     m_hostImpl->setViewportSize(IntSize(10, 10));
 
-    RefPtr<CCLayerImpl> root = CCLayerImpl::create(0);
-    root->setAnchorPoint(FloatPoint(0, 0));
-    root->setBounds(IntSize(10, 10));
-    root->setDrawsContent(false);
-    m_hostImpl->setRootLayer(root);
+    {
+        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+        root->setAnchorPoint(FloatPoint(0, 0));
+        root->setBounds(IntSize(10, 10));
+        root->setDrawsContent(false);
+        m_hostImpl->setRootLayer(root.release());
+    }
+    CCLayerImpl* root = m_hostImpl->rootLayer();
 
-    RefPtr<BlendStateCheckLayer> layer1 = BlendStateCheckLayer::create(1);
-    root->addChild(layer1);
+    root->addChild(BlendStateCheckLayer::create(1));
+    BlendStateCheckLayer* layer1 = static_cast<BlendStateCheckLayer*>(root->children()[0].get());
 
     // Opaque layer, drawn without blending.
     layer1->setOpaque(true);
@@ -539,8 +608,8 @@ TEST_F(CCLayerTreeHostImplTest, blendingOffWhenDrawingOpaqueLayers)
     m_hostImpl->drawLayers();
     EXPECT_TRUE(layer1->quadsAppended());
 
-    RefPtr<BlendStateCheckLayer> layer2 = BlendStateCheckLayer::create(2);
-    layer1->addChild(layer2);
+    layer1->addChild(BlendStateCheckLayer::create(2));
+    BlendStateCheckLayer* layer2 = static_cast<BlendStateCheckLayer*>(layer1->children()[0].get());
 
     // 2 opaque layers, drawn without blending.
     layer1->setOpaque(true);
@@ -632,8 +701,6 @@ class ReshapeTrackerContext: public FakeWebGraphicsContext3D {
 public:
     ReshapeTrackerContext() : m_reshapeCalled(false) { }
 
-    virtual bool initialize(Attributes, WebView*, bool renderDirectlyToWebView) { return true; }
-
     virtual void reshape(int width, int height)
     {
         m_reshapeCalled = true;
@@ -660,11 +727,11 @@ TEST_F(CCLayerTreeHostImplTest, reshapeNotCalledUntilDraw)
     m_hostImpl->initializeLayerRenderer(context);
     m_hostImpl->setViewportSize(IntSize(10, 10));
 
-    RefPtr<CCLayerImpl> root = adoptRef(new FakeDrawableCCLayerImpl(1));
+    CCLayerImpl* root = new FakeDrawableCCLayerImpl(1);
     root->setAnchorPoint(FloatPoint(0, 0));
     root->setBounds(IntSize(10, 10));
     root->setDrawsContent(true);
-    m_hostImpl->setRootLayer(root);
+    m_hostImpl->setRootLayer(adoptPtr(root));
     EXPECT_FALSE(reshapeTracker->reshapeCalled());
 
     m_hostImpl->drawLayers();
@@ -673,8 +740,6 @@ TEST_F(CCLayerTreeHostImplTest, reshapeNotCalledUntilDraw)
 
 class PartialSwapTrackerContext : public FakeWebGraphicsContext3D {
 public:
-    virtual bool initialize(Attributes, WebView*, bool renderDirectlyToWebView) { return true; }
-
     virtual void postSubBufferCHROMIUM(int x, int y, int width, int height)
     {
         m_partialSwapRect = IntRect(x, y, width, height);
@@ -683,7 +748,7 @@ public:
     virtual WebString getString(WGC3Denum name)
     {
         if (name == GraphicsContext3D::EXTENSIONS)
-            return WebString("GL_CHROMIUM_post_sub_buffer");
+            return WebString("GL_CHROMIUM_post_sub_buffer GL_CHROMIUM_set_visibility");
 
         return WebString();
     }
@@ -709,8 +774,8 @@ TEST_F(CCLayerTreeHostImplTest, partialSwapReceivesDamageRect)
     layerTreeHostImpl->initializeLayerRenderer(context);
     layerTreeHostImpl->setViewportSize(IntSize(500, 500));
 
-    RefPtr<CCLayerImpl> root = adoptRef(new FakeDrawableCCLayerImpl(1));
-    RefPtr<CCLayerImpl> child = adoptRef(new FakeDrawableCCLayerImpl(2));
+    CCLayerImpl* root = new FakeDrawableCCLayerImpl(1);
+    CCLayerImpl* child = new FakeDrawableCCLayerImpl(2);
     child->setPosition(FloatPoint(12, 13));
     child->setAnchorPoint(FloatPoint(0, 0));
     child->setBounds(IntSize(14, 15));
@@ -718,8 +783,8 @@ TEST_F(CCLayerTreeHostImplTest, partialSwapReceivesDamageRect)
     root->setAnchorPoint(FloatPoint(0, 0));
     root->setBounds(IntSize(500, 500));
     root->setDrawsContent(true);
-    root->addChild(child);
-    layerTreeHostImpl->setRootLayer(root);
+    root->addChild(adoptPtr(child));
+    layerTreeHostImpl->setRootLayer(adoptPtr(root));
 
     // First frame, the entire screen should get swapped.
     layerTreeHostImpl->drawLayers();
@@ -760,4 +825,106 @@ TEST_F(CCLayerTreeHostImplTest, partialSwapReceivesDamageRect)
     EXPECT_EQ(expectedSwapRect.height(), actualSwapRect.height());
 }
 
+// Make sure that we reset damage tracking on visibility change because the
+// state of the front buffer that we push to with PostSubBuffer is undefined.
+TEST_F(CCLayerTreeHostImplTest, visibilityChangeResetsDamage)
+{
+    PartialSwapTrackerContext* partialSwapTracker = new PartialSwapTrackerContext();
+    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(partialSwapTracker), GraphicsContext3D::RenderDirectlyToHostWindow);
+
+    // This test creates its own CCLayerTreeHostImpl, so
+    // that we can force partial swap enabled.
+    CCSettings settings;
+    settings.partialSwapEnabled = true;
+    OwnPtr<CCLayerTreeHostImpl> layerTreeHostImpl = CCLayerTreeHostImpl::create(settings, this);
+    layerTreeHostImpl->initializeLayerRenderer(context);
+    layerTreeHostImpl->setViewportSize(IntSize(500, 500));
+
+    CCLayerImpl* root = new FakeDrawableCCLayerImpl(1);
+    root->setAnchorPoint(FloatPoint(0, 0));
+    root->setBounds(IntSize(500, 500));
+    root->setDrawsContent(true);
+    layerTreeHostImpl->setRootLayer(adoptPtr(root));
+
+    // First frame: ignore.
+    layerTreeHostImpl->drawLayers();
+    layerTreeHostImpl->swapBuffers();
+
+    // Second frame: nothing has changed --- so we souldn't push anything with partial swap.
+    layerTreeHostImpl->drawLayers();
+    layerTreeHostImpl->swapBuffers();
+    EXPECT_TRUE(partialSwapTracker->partialSwapRect().isEmpty());
+
+    // Third frame: visibility change --- so we should push a full frame with partial swap.
+    layerTreeHostImpl->setVisible(false);
+    layerTreeHostImpl->setVisible(true);
+    layerTreeHostImpl->drawLayers();
+    layerTreeHostImpl->swapBuffers();
+    IntRect actualSwapRect = partialSwapTracker->partialSwapRect();
+    IntRect expectedSwapRect = IntRect(IntPoint::zero(), IntSize(500, 500));
+    EXPECT_EQ(expectedSwapRect.x(), actualSwapRect.x());
+    EXPECT_EQ(expectedSwapRect.y(), actualSwapRect.y());
+    EXPECT_EQ(expectedSwapRect.width(), actualSwapRect.width());
+    EXPECT_EQ(expectedSwapRect.height(), actualSwapRect.height());
+}
+
+// Make sure that context lost notifications are propagated through the tree.
+class ContextLostNotificationCheckLayer : public CCLayerImpl {
+public:
+    static PassOwnPtr<ContextLostNotificationCheckLayer> create(int id) { return adoptPtr(new ContextLostNotificationCheckLayer(id)); }
+
+    virtual void didLoseContext()
+    {
+        m_didLoseContextCalled = true;
+    }
+
+    bool didLoseContextCalled() const { return m_didLoseContextCalled; }
+
+private:
+    explicit ContextLostNotificationCheckLayer(int id)
+        : CCLayerImpl(id)
+        , m_didLoseContextCalled(false)
+    {
+    }
+
+    bool m_didLoseContextCalled;
+};
+
+TEST_F(CCLayerTreeHostImplTest, contextLostAndRestoredNotificationSentToAllLayers)
+{
+    m_hostImpl->initializeLayerRenderer(createContext());
+    m_hostImpl->setViewportSize(IntSize(10, 10));
+
+    m_hostImpl->setRootLayer(ContextLostNotificationCheckLayer::create(0));
+    ContextLostNotificationCheckLayer* root = static_cast<ContextLostNotificationCheckLayer*>(m_hostImpl->rootLayer());
+
+    root->addChild(ContextLostNotificationCheckLayer::create(1));
+    ContextLostNotificationCheckLayer* layer1 = static_cast<ContextLostNotificationCheckLayer*>(root->children()[0].get());
+
+    layer1->addChild(ContextLostNotificationCheckLayer::create(2));
+    ContextLostNotificationCheckLayer* layer2 = static_cast<ContextLostNotificationCheckLayer*>(layer1->children()[0].get());
+
+    EXPECT_FALSE(root->didLoseContextCalled());
+    EXPECT_FALSE(layer1->didLoseContextCalled());
+    EXPECT_FALSE(layer2->didLoseContextCalled());
+
+    m_hostImpl->initializeLayerRenderer(createContext());
+
+    EXPECT_TRUE(root->didLoseContextCalled());
+    EXPECT_TRUE(layer1->didLoseContextCalled());
+    EXPECT_TRUE(layer2->didLoseContextCalled());
+}
+
+class FakeWebGraphicsContext3DMakeCurrentFails : public FakeWebGraphicsContext3D {
+public:
+    virtual bool makeContextCurrent() { return false; }
+};
+
+TEST_F(CCLayerTreeHostImplTest, finishAllRenderingAfterContextLost)
+{
+    // The context initialization will fail, but we should still be able to call finishAllRendering() without any ill effects.
+    m_hostImpl->initializeLayerRenderer(GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new FakeWebGraphicsContext3DMakeCurrentFails), GraphicsContext3D::RenderDirectlyToHostWindow));
+    m_hostImpl->finishAllRendering();
+}
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
index 10cfa6931..2c4e7ce59 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
@@ -38,6 +38,7 @@
 #include "WebKit.h"
 #include "cc/CCActiveAnimation.h"
 #include "cc/CCLayerAnimationController.h"
+#include "cc/CCLayerAnimationDelegate.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCScopedThreadProxy.h"
@@ -59,15 +60,21 @@ using namespace WTF;
 namespace {
 
 // Used by test stubs to notify the test when something interesting happens.
-class TestHooks {
+class TestHooks : public CCLayerAnimationDelegate {
 public:
     virtual void beginCommitOnCCThread(CCLayerTreeHostImpl*) { }
     virtual void commitCompleteOnCCThread(CCLayerTreeHostImpl*) { }
     virtual void drawLayersOnCCThread(CCLayerTreeHostImpl*) { }
-    virtual void animateLayers(CCLayerTreeHostImpl*) { }
+    virtual void animateLayers(CCLayerTreeHostImpl*, double monotonicTime) { }
     virtual void applyScrollAndScale(const IntSize&, float) { }
-    virtual void updateAnimations(double frameBeginTime) { }
+    virtual void updateAnimations(double monotonicTime) { }
     virtual void layout() { }
+    virtual void didRecreateContext(bool succeded) { }
+    virtual void didCommitAndDrawFrame() { }
+
+    // Implementation of CCLayerAnimationDelegate
+    virtual void notifyAnimationStarted(double time) { }
+    virtual void notifyAnimationFinished(int animationId) { }
 };
 
 // Adapts CCLayerTreeHostImpl for test. Runs real code, then invokes test hooks.
@@ -97,10 +104,10 @@ public:
     }
 
 protected:
-    virtual void animateLayers(double frameBeginTimeMs)
+    virtual void animateLayers(double monotonicTime, double wallClockTime)
     {
-        CCLayerTreeHostImpl::animateLayers(frameBeginTimeMs);
-        m_testHooks->animateLayers(this);
+        CCLayerTreeHostImpl::animateLayers(monotonicTime, wallClockTime);
+        m_testHooks->animateLayers(this, monotonicTime);
     }
 
 private:
@@ -130,6 +137,8 @@ public:
         // LayerTreeHostImpl won't draw if it has 1x1 viewport.
         layerTreeHost->setViewportSize(IntSize(1, 1));
 
+        layerTreeHost->rootLayer()->setLayerAnimationDelegate(testHooks);
+
         return layerTreeHost.release();
     }
 
@@ -205,9 +214,9 @@ public:
         return adoptPtr(new MockLayerTreeHostClient(testHooks));
     }
 
-    virtual void updateAnimations(double frameBeginTime)
+    virtual void updateAnimations(double monotonicTime)
     {
-        m_testHooks->updateAnimations(frameBeginTime);
+        m_testHooks->updateAnimations(monotonicTime);
     }
 
     virtual void layout()
@@ -220,7 +229,7 @@ public:
         m_testHooks->applyScrollAndScale(scrollDelta, scale);
     }
 
-    virtual PassRefPtr<GraphicsContext3D> createLayerTreeHostContext3D()
+    virtual PassRefPtr<GraphicsContext3D> createContext()
     {
         GraphicsContext3D::Attributes attrs;
         WebGraphicsContext3D::Attributes webAttrs;
@@ -232,14 +241,16 @@ public:
 
     virtual void didCommitAndDrawFrame()
     {
+        m_testHooks->didCommitAndDrawFrame();
     }
 
     virtual void didCompleteSwapBuffers()
     {
     }
 
-    virtual void didRecreateGraphicsContext(bool)
+    virtual void didRecreateContext(bool succeeded)
     {
+        m_testHooks->didRecreateContext(succeeded);
     }
 
     virtual void scheduleComposite()
@@ -279,6 +290,11 @@ public:
         callOnMainThread(CCLayerTreeHostTest::dispatchAddAnimation, this);
     }
 
+    void postAddInstantAnimationToMainThread()
+    {
+        callOnMainThread(CCLayerTreeHostTest::dispatchAddInstantAnimation, this);
+    }
+
     void postSetNeedsCommitToMainThread()
     {
         callOnMainThread(CCLayerTreeHostTest::dispatchSetNeedsCommit, this);
@@ -329,67 +345,76 @@ protected:
 
     static void dispatchSetNeedsAnimate(void* self)
     {
-      ASSERT(isMainThread());
-      CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
-      ASSERT(test);
-      if (test->m_layerTreeHost)
-          test->m_layerTreeHost->setNeedsAnimate();
+        ASSERT(isMainThread());
+        CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
+        ASSERT(test);
+        if (test->m_layerTreeHost)
+            test->m_layerTreeHost->setNeedsAnimate();
+    }
+
+    static void dispatchAddInstantAnimation(void* self)
+    {
+        ASSERT(isMainThread());
+        CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
+        ASSERT(test);
+        if (test->m_layerTreeHost && test->m_layerTreeHost->rootLayer())
+            addOpacityTransitionToLayer(*test->m_layerTreeHost->rootLayer(), 0, 0, 1);
     }
 
     static void dispatchAddAnimation(void* self)
     {
-      ASSERT(isMainThread());
-      CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
-      ASSERT(test);
-      if (test->m_layerTreeHost && test->m_layerTreeHost->rootLayer())
-          addOpacityTransitionToLayer(*test->m_layerTreeHost->rootLayer(), 0, 0, 1);
+        ASSERT(isMainThread());
+        CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
+        ASSERT(test);
+        if (test->m_layerTreeHost && test->m_layerTreeHost->rootLayer())
+            addOpacityTransitionToLayer(*test->m_layerTreeHost->rootLayer(), 10, 0, 1);
     }
 
     static void dispatchSetNeedsAnimateAndCommit(void* self)
     {
-      ASSERT(isMainThread());
-      CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
-      ASSERT(test);
-      if (test->m_layerTreeHost) {
-          test->m_layerTreeHost->setNeedsAnimate();
-          test->m_layerTreeHost->setNeedsCommit();
-      }
+        ASSERT(isMainThread());
+        CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
+        ASSERT(test);
+        if (test->m_layerTreeHost) {
+            test->m_layerTreeHost->setNeedsAnimate();
+            test->m_layerTreeHost->setNeedsCommit();
+        }
     }
 
     static void dispatchSetNeedsCommit(void* self)
     {
-      ASSERT(isMainThread());
-      CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
-      ASSERT_TRUE(test);
-      if (test->m_layerTreeHost)
-          test->m_layerTreeHost->setNeedsCommit();
+        ASSERT(isMainThread());
+        CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
+        ASSERT_TRUE(test);
+        if (test->m_layerTreeHost)
+            test->m_layerTreeHost->setNeedsCommit();
     }
 
     static void dispatchSetNeedsRedraw(void* self)
     {
-      ASSERT(isMainThread());
-      CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
-      ASSERT_TRUE(test);
-      if (test->m_layerTreeHost)
-          test->m_layerTreeHost->setNeedsRedraw();
+        ASSERT(isMainThread());
+        CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
+        ASSERT_TRUE(test);
+        if (test->m_layerTreeHost)
+            test->m_layerTreeHost->setNeedsRedraw();
     }
 
     static void dispatchSetVisible(void* self)
     {
-      ASSERT(isMainThread());
-      CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
-      ASSERT(test);
-      if (test->m_layerTreeHost)
-          test->m_layerTreeHost->setVisible(true);
+        ASSERT(isMainThread());
+        CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
+        ASSERT(test);
+        if (test->m_layerTreeHost)
+            test->m_layerTreeHost->setVisible(true);
     }
 
     static void dispatchSetInvisible(void* self)
     {
-      ASSERT(isMainThread());
-      CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
-      ASSERT(test);
-      if (test->m_layerTreeHost)
-          test->m_layerTreeHost->setVisible(false);
+        ASSERT(isMainThread());
+        CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
+        ASSERT(test);
+        if (test->m_layerTreeHost)
+            test->m_layerTreeHost->setVisible(false);
     }
 
     class TimeoutTask : public WebThread::Task {
@@ -827,34 +852,57 @@ class CCLayerTreeHostTestAddAnimation : public CCLayerTreeHostTestThreadOnly {
 public:
     CCLayerTreeHostTestAddAnimation()
         : m_numAnimates(0)
-        , m_layerTreeHostImpl(0)
+        , m_receivedAnimationStartedNotification(false)
+        , m_receivedAnimationFinishedNotification(false)
+        , m_startTime(0)
+        , m_firstMonotonicTime(0)
     {
     }
 
     virtual void beginTest()
     {
-        postAddAnimationToMainThread();
+        postAddInstantAnimationToMainThread();
     }
 
-    virtual void animateLayers(CCLayerTreeHostImpl* layerTreeHostImpl)
+    virtual void animateLayers(CCLayerTreeHostImpl* layerTreeHostImpl, double monotonicTime)
     {
         if (!m_numAnimates) {
             // The animation had zero duration so layerTreeHostImpl should no
             // longer need to animate its layers.
             EXPECT_FALSE(layerTreeHostImpl->needsAnimateLayers());
             m_numAnimates++;
+            m_firstMonotonicTime = monotonicTime;
             return;
         }
+        EXPECT_LT(0, m_startTime);
+        EXPECT_LT(0, m_firstMonotonicTime);
+        EXPECT_NE(m_startTime, m_firstMonotonicTime);
+        EXPECT_TRUE(m_receivedAnimationStartedNotification);
+        EXPECT_TRUE(m_receivedAnimationFinishedNotification);
         endTest();
     }
 
+    virtual void notifyAnimationStarted(double wallClockTime)
+    {
+        m_receivedAnimationStartedNotification = true;
+        m_startTime = wallClockTime;
+    }
+
+    virtual void notifyAnimationFinished(int)
+    {
+        m_receivedAnimationFinishedNotification = true;
+    }
+
     virtual void afterTest()
     {
     }
 
 private:
     int m_numAnimates;
-    CCLayerTreeHostImpl* m_layerTreeHostImpl;
+    bool m_receivedAnimationStartedNotification;
+    bool m_receivedAnimationFinishedNotification;
+    double m_startTime;
+    double m_firstMonotonicTime;
 };
 
 TEST_F(CCLayerTreeHostTestAddAnimation, runMultiThread)
@@ -862,6 +910,43 @@ TEST_F(CCLayerTreeHostTestAddAnimation, runMultiThread)
     runTestThreaded();
 }
 
+// Ensures that animations continue to be ticked when we are backgrounded.
+class CCLayerTreeHostTestTickAnimationWhileBackgrounded : public CCLayerTreeHostTestThreadOnly {
+public:
+    CCLayerTreeHostTestTickAnimationWhileBackgrounded()
+        : m_numAnimates(0)
+    {
+    }
+
+    virtual void beginTest()
+    {
+        postAddAnimationToMainThread();
+    }
+
+    virtual void animateLayers(CCLayerTreeHostImpl* layerTreeHostImpl, double monotonicTime)
+    {
+        if (!m_numAnimates) {
+            // We have a long animation running. It should continue to tick even if we are not visible.
+            postSetVisibleToMainThread(false);
+            m_numAnimates++;
+            return;
+        }
+        endTest();
+    }
+
+    virtual void afterTest()
+    {
+    }
+
+private:
+    int m_numAnimates;
+};
+
+TEST_F(CCLayerTreeHostTestTickAnimationWhileBackgrounded, runMultiThread)
+{
+    runTestThreaded();
+}
+
 class CCLayerTreeHostTestScrollSimple : public CCLayerTreeHostTestThreadOnly {
 public:
     CCLayerTreeHostTestScrollSimple()
@@ -1154,9 +1239,9 @@ public:
         m_paintContentsCount++;
     }
 
-    virtual void idlePaintContentsIfDirty()
+    virtual void idlePaintContentsIfDirty(const Region& occluded)
     {
-        ContentLayerChromium::idlePaintContentsIfDirty();
+        ContentLayerChromium::idlePaintContentsIfDirty(occluded);
         m_idlePaintContentsCount++;
     }
 
@@ -1883,4 +1968,72 @@ public:
 
 SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestManySurfaces)
 
+// A loseContext(1) should lead to a didRecreateContext(true)
+class CCLayerTreeHostTestSetSingleLostContext : public CCLayerTreeHostTestThreadOnly {
+public:
+    CCLayerTreeHostTestSetSingleLostContext()
+    {
+    }
+
+    virtual void beginTest()
+    {
+        postSetNeedsCommitToMainThread();
+    }
+
+    virtual void didCommitAndDrawFrame()
+    {
+        m_layerTreeHost->loseContext(1);
+    }
+
+    virtual void didRecreateContext(bool succeeded)
+    {
+        EXPECT_TRUE(succeeded);
+        endTest();
+    }
+
+    virtual void afterTest()
+    {
+    }
+};
+
+TEST_F(CCLayerTreeHostTestSetSingleLostContext, runMultiThread)
+{
+    runTestThreaded();
+}
+
+// A loseContext(10) should lead to a didRecreateContext(false), and
+// a finishAllRendering() should not hang.
+class CCLayerTreeHostTestSetRepeatedLostContext : public CCLayerTreeHostTestThreadOnly {
+public:
+    CCLayerTreeHostTestSetRepeatedLostContext()
+    {
+    }
+
+    virtual void beginTest()
+    {
+        postSetNeedsCommitToMainThread();
+    }
+
+    virtual void didCommitAndDrawFrame()
+    {
+        m_layerTreeHost->loseContext(10);
+    }
+
+    virtual void didRecreateContext(bool succeeded)
+    {
+        EXPECT_FALSE(succeeded);
+        m_layerTreeHost->finishAllRendering();
+        endTest();
+    }
+
+    virtual void afterTest()
+    {
+    }
+};
+
+TEST_F(CCLayerTreeHostTestSetRepeatedLostContext, runMultiThread)
+{
+    runTestThreaded();
+}
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
index 678ec9645..26d52523b 100644
--- a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
@@ -45,16 +45,6 @@ using namespace WebCore;
 
 namespace {
 
-void setLayerPropertiesForTesting(LayerChromium* layer, const TransformationMatrix& transform, const TransformationMatrix& sublayerTransform, const FloatPoint& anchor, const FloatPoint& position, const IntSize& bounds, bool opaque)
-{
-    layer->setTransform(transform);
-    layer->setSublayerTransform(sublayerTransform);
-    layer->setAnchorPoint(anchor);
-    layer->setPosition(position);
-    layer->setBounds(bounds);
-    layer->setOpaque(opaque);
-}
-
 class LayerChromiumWithForcedDrawsContent : public LayerChromium {
 public:
     LayerChromiumWithForcedDrawsContent()
@@ -63,30 +53,106 @@ public:
     }
 
     virtual bool drawsContent() const { return true; }
+    virtual Region opaqueContentsRegion() const
+    {
+        return intersection(m_opaquePaintRect, visibleLayerRect());
+    }
+
+    void setOpaquePaintRect(const IntRect& opaquePaintRect) { m_opaquePaintRect = opaquePaintRect; }
+
+private:
+    IntRect m_opaquePaintRect;
 };
 
+void setLayerPropertiesForTesting(LayerChromium* layer, const TransformationMatrix& transform, const FloatPoint& position, const IntSize& bounds)
+{
+    layer->setTransform(transform);
+    layer->setSublayerTransform(TransformationMatrix());
+    layer->setAnchorPoint(FloatPoint(0, 0));
+    layer->setPosition(position);
+    layer->setBounds(bounds);
+}
+
+void setLayerPropertiesForTesting(LayerChromiumWithForcedDrawsContent* layer, const TransformationMatrix& transform, const FloatPoint& position, const IntSize& bounds, bool opaque, bool opaqueLayers)
+{
+    setLayerPropertiesForTesting(layer, transform, position, bounds);
+    if (opaqueLayers)
+        layer->setOpaque(opaque);
+    else {
+        layer->setOpaque(false);
+        if (opaque)
+            layer->setOpaquePaintRect(IntRect(IntPoint(), bounds));
+        else
+            layer->setOpaquePaintRect(IntRect());
+    }
+}
+
 // A subclass to expose the total current occlusion.
 class TestCCOcclusionTracker : public CCOcclusionTracker {
 public:
+    TestCCOcclusionTracker(IntRect screenScissorRect)
+        : CCOcclusionTracker(screenScissorRect)
+        , m_overrideLayerScissorRect(false)
+    {
+    }
+
+    TestCCOcclusionTracker(IntRect screenScissorRect, const CCOcclusionTrackerDamageClient* damageClient)
+        : CCOcclusionTracker(screenScissorRect, damageClient)
+        , m_overrideLayerScissorRect(false)
+    {
+    }
+
     Region occlusionInScreenSpace() const { return CCOcclusionTracker::m_stack.last().occlusionInScreen; }
     Region occlusionInTargetSurface() const { return CCOcclusionTracker::m_stack.last().occlusionInTarget; }
 
     void setOcclusionInScreenSpace(const Region& region) { CCOcclusionTracker::m_stack.last().occlusionInScreen = region; }
     void setOcclusionInTargetSurface(const Region& region) { CCOcclusionTracker::m_stack.last().occlusionInTarget = region; }
+
+    void setLayerScissorRect(const IntRect& rect) { m_overrideLayerScissorRect = true; m_layerScissorRect = rect;}
+    void useDefaultLayerScissorRect() { m_overrideLayerScissorRect = false; }
+
+protected:
+    virtual IntRect layerScissorRectInTargetSurface(const LayerChromium* layer) const { return m_overrideLayerScissorRect ? m_layerScissorRect : CCOcclusionTracker::layerScissorRectInTargetSurface(layer); }
+
+private:
+    bool m_overrideLayerScissorRect;
+    IntRect m_layerScissorRect;
 };
 
-TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegion)
+class TestDamageClient : public CCOcclusionTrackerDamageClient {
+public:
+    // The interface
+    virtual FloatRect damageRect(const RenderSurfaceChromium*) const { return m_damageRect; }
+
+    // Testing stuff
+    TestDamageClient(const FloatRect& damageRect) : m_damageRect(damageRect) { }
+    void setDamageRect(const FloatRect& damageRect) { m_damageRect = damageRect; }
+
+private:
+    FloatRect m_damageRect;
+};
+
+#define TEST_OPAQUE_AND_PAINTED_OPAQUE(FULLTESTNAME, SHORTTESTNAME) \
+    TEST(FULLTESTNAME, opaqueLayer)                                 \
+    {                                                               \
+        SHORTTESTNAME(true);                                        \
+    }                                                               \
+    TEST(FULLTESTNAME, opaquePaintRect)                             \
+    {                                                               \
+        SHORTTESTNAME(false);                                       \
+    }
+
+void layerAddedToOccludedRegion(bool opaqueLayers)
 {
     // This tests that the right transforms are being used.
-    TestCCOcclusionTracker occlusion;
     const TransformationMatrix identityMatrix;
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
     parent->createRenderSurface();
     parent->addChild(layer);
 
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(layer.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(100, 100));
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(30, 30), IntSize(500, 500), true, opaqueLayers);
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     Vector<RefPtr<LayerChromium> > dummyLayerList;
@@ -98,6 +164,9 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegion)
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+
     occlusion.enterTargetRenderSurface(parent->renderSurface());
     occlusion.markOccludedBehindLayer(layer.get());
     EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInScreenSpace().bounds());
@@ -111,6 +180,14 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegion)
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(31, 30, 70, 70)));
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 31, 70, 70)));
 
+    occlusion.useDefaultLayerScissorRect();
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 29, 70, 70)));
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(31, 30, 70, 70)));
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 31, 70, 70)));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+
     EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(30, 30, 70, 70)).isEmpty());
     EXPECT_EQ_RECT(IntRect(29, 30, 1, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 30, 70, 70)));
     EXPECT_EQ_RECT(IntRect(29, 29, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 29, 70, 70)));
@@ -122,10 +199,11 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegion)
     EXPECT_EQ_RECT(IntRect(29, 31, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 31, 70, 70)));
 }
 
-TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotation)
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerAddedToOccludedRegion, layerAddedToOccludedRegion);
+
+void layerAddedToOccludedRegionWithRotation(bool opaqueLayers)
 {
     // This tests that the right transforms are being used.
-    TestCCOcclusionTracker occlusion;
     const TransformationMatrix identityMatrix;
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
@@ -137,8 +215,8 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotation)
     layerTransform.rotate(90);
     layerTransform.translate(-250, -250);
 
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(layer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(100, 100));
+    setLayerPropertiesForTesting(layer.get(), layerTransform, FloatPoint(30, 30), IntSize(500, 500), true, opaqueLayers);
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     Vector<RefPtr<LayerChromium> > dummyLayerList;
@@ -150,6 +228,9 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotation)
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+
     occlusion.enterTargetRenderSurface(parent->renderSurface());
     occlusion.markOccludedBehindLayer(layer.get());
     EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInScreenSpace().bounds());
@@ -163,6 +244,14 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotation)
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(31, 30, 70, 70)));
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 31, 70, 70)));
 
+    occlusion.useDefaultLayerScissorRect();
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 29, 70, 70)));
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(31, 30, 70, 70)));
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 31, 70, 70)));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+
     EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(30, 30, 70, 70)).isEmpty());
     EXPECT_EQ_RECT(IntRect(29, 30, 1, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 30, 70, 70)));
     EXPECT_EQ_RECT(IntRect(29, 29, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 29, 70, 70)));
@@ -174,10 +263,11 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotation)
     EXPECT_EQ_RECT(IntRect(29, 31, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 31, 70, 70)));
 }
 
-TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithTranslation)
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerAddedToOccludedRegionWithRotation, layerAddedToOccludedRegionWithRotation);
+
+void layerAddedToOccludedRegionWithTranslation(bool opaqueLayers)
 {
     // This tests that the right transforms are being used.
-    TestCCOcclusionTracker occlusion;
     const TransformationMatrix identityMatrix;
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
@@ -187,8 +277,8 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithTranslation)
     TransformationMatrix layerTransform;
     layerTransform.translate(20, 20);
 
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(layer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(100, 100));
+    setLayerPropertiesForTesting(layer.get(), layerTransform, FloatPoint(30, 30), IntSize(500, 500), true, opaqueLayers);
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     Vector<RefPtr<LayerChromium> > dummyLayerList;
@@ -200,6 +290,9 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithTranslation)
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+
     occlusion.enterTargetRenderSurface(parent->renderSurface());
     occlusion.markOccludedBehindLayer(layer.get());
     EXPECT_EQ_RECT(IntRect(50, 50, 50, 50), occlusion.occlusionInScreenSpace().bounds());
@@ -213,6 +306,14 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithTranslation)
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(51, 50, 50, 50)));
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(50, 51, 50, 50)));
 
+    occlusion.useDefaultLayerScissorRect();
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(50, 50, 50, 50)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(49, 50, 50, 50)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(50, 49, 50, 50)));
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(51, 50, 50, 50)));
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(50, 51, 50, 50)));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+
     EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(50, 50, 50, 50)).isEmpty());
     EXPECT_EQ_RECT(IntRect(49, 50, 1, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(49, 50, 50, 50)));
     EXPECT_EQ_RECT(IntRect(49, 49, 50, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(49, 49, 50, 50)));
@@ -222,12 +323,25 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithTranslation)
     EXPECT_EQ_RECT(IntRect(51, 51, 50, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(51, 51, 50, 50)));
     EXPECT_EQ_RECT(IntRect(50, 100, 50, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(50, 51, 50, 50)));
     EXPECT_EQ_RECT(IntRect(49, 51, 50, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(49, 51, 50, 50)));
+
+    occlusion.useDefaultLayerScissorRect();
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(50, 50, 50, 50)).isEmpty());
+    EXPECT_EQ_RECT(IntRect(49, 50, 1, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(49, 50, 50, 50)));
+    EXPECT_EQ_RECT(IntRect(49, 49, 50, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(49, 49, 50, 50)));
+    EXPECT_EQ_RECT(IntRect(50, 49, 50, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(50, 49, 50, 50)));
+    EXPECT_EQ_RECT(IntRect(51, 49, 49, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(51, 49, 50, 50)));
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(51, 50, 50, 50)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(51, 51, 50, 50)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(50, 51, 50, 50)).isEmpty());
+    EXPECT_EQ_RECT(IntRect(49, 51, 1, 49), occlusion.unoccludedContentRect(parent.get(), IntRect(49, 51, 50, 50)));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
 }
 
-TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedSurface)
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerAddedToOccludedRegionWithTranslation, layerAddedToOccludedRegionWithTranslation);
+
+void layerAddedToOccludedRegionWithRotatedSurface(bool opaqueLayers)
 {
     // This tests that the right transforms are being used.
-    TestCCOcclusionTracker occlusion;
     const TransformationMatrix identityMatrix;
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromium> child = LayerChromium::create();
@@ -241,9 +355,9 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedSurface)
     childTransform.rotate(90);
     childTransform.translate(-250, -250);
 
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(child.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
-    setLayerPropertiesForTesting(layer.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(100, 100));
+    setLayerPropertiesForTesting(child.get(), childTransform, FloatPoint(30, 30), IntSize(500, 500));
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(10, 10), IntSize(500, 500), true, opaqueLayers);
 
     child->setMasksToBounds(true);
 
@@ -257,6 +371,9 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedSurface)
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+
     occlusion.enterTargetRenderSurface(child->renderSurface());
     occlusion.markOccludedBehindLayer(layer.get());
 
@@ -271,6 +388,14 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedSurface)
     EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(10, 430, 61, 70)));
     EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(10, 430, 60, 71)));
 
+    occlusion.useDefaultLayerScissorRect();
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(10, 430, 60, 70)));
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(9, 430, 60, 70)));
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(10, 429, 60, 70)));
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(10, 430, 61, 70)));
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(10, 430, 60, 71)));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+
     occlusion.markOccludedBehindLayer(child.get());
     occlusion.finishedTargetRenderSurface(child.get(), child->renderSurface());
     occlusion.leaveToTargetRenderSurface(parent->renderSurface());
@@ -283,6 +408,16 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedSurface)
     EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 40, 70, 60)));
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 40, 70, 60)));
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 39, 70, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(31, 40, 70, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 41, 70, 60)));
+
+    occlusion.useDefaultLayerScissorRect();
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 40, 70, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 40, 70, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 39, 70, 60)));
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(31, 40, 70, 60)));
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 41, 70, 60)));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
 
 
     /* Justification for the above occlusion from |layer|:
@@ -311,10 +446,11 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedSurface)
      */
 }
 
-TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithSurfaceAlreadyOnStack)
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerAddedToOccludedRegionWithRotatedSurface, layerAddedToOccludedRegionWithRotatedSurface);
+
+void layerAddedToOccludedRegionWithSurfaceAlreadyOnStack(bool opaqueLayers)
 {
     // This tests that the right transforms are being used.
-    TestCCOcclusionTracker occlusion;
     const TransformationMatrix identityMatrix;
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromium> child = LayerChromium::create();
@@ -330,13 +466,13 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithSurfaceAlreadyOnStack
     childTransform.rotate(90);
     childTransform.translate(-250, -250);
 
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(child.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
-    setLayerPropertiesForTesting(layer.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(100, 100));
+    setLayerPropertiesForTesting(child.get(), childTransform, FloatPoint(30, 30), IntSize(500, 500));
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(10, 10), IntSize(500, 500), true, opaqueLayers);
 
     // |child2| makes |parent|'s surface get considered by CCOcclusionTracker first, instead of |child|'s. This exercises different code in
     // leaveToTargetRenderSurface, as the target surface has already been seen.
-    setLayerPropertiesForTesting(child2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(60, 20), true);
+    setLayerPropertiesForTesting(child2.get(), identityMatrix, FloatPoint(30, 30), IntSize(60, 20), true, opaqueLayers);
 
     child->setMasksToBounds(true);
 
@@ -350,6 +486,9 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithSurfaceAlreadyOnStack
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(-10, -10, 1000, 1000));
+
     occlusion.enterTargetRenderSurface(parent->renderSurface());
     occlusion.markOccludedBehindLayer(child2.get());
 
@@ -372,6 +511,14 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithSurfaceAlreadyOnStack
     EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(11, 430, 60, 70)));
     EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(10, 431, 60, 70)));
 
+    occlusion.useDefaultLayerScissorRect();
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(10, 430, 60, 70)));
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(9, 430, 60, 70)));
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(10, 429, 60, 70)));
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(11, 430, 60, 70)));
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(10, 431, 60, 70)));
+    occlusion.setLayerScissorRect(IntRect(-10, -10, 1000, 1000));
+
     EXPECT_TRUE(occlusion.unoccludedContentRect(child.get(), IntRect(10, 430, 60, 70)).isEmpty());
     // This is the little piece not occluded by child2
     EXPECT_EQ_RECT(IntRect(9, 430, 1, 10), occlusion.unoccludedContentRect(child.get(), IntRect(9, 430, 60, 70)));
@@ -387,8 +534,16 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithSurfaceAlreadyOnStack
     EXPECT_EQ_RECT(IntRect(70, 430, 1, 70), occlusion.unoccludedContentRect(child.get(), IntRect(11, 430, 60, 70)));
     EXPECT_EQ_RECT(IntRect(10, 500, 60, 1), occlusion.unoccludedContentRect(child.get(), IntRect(10, 431, 60, 70)));
 
-    // Surface is not occluded by things that draw into itself.
-    EXPECT_EQ_RECT(IntRect(10, 430, 60, 70), occlusion.surfaceUnoccludedContentRect(child.get(), IntRect(10, 430, 60, 70)));
+    occlusion.useDefaultLayerScissorRect();
+    EXPECT_TRUE(occlusion.unoccludedContentRect(child.get(), IntRect(10, 430, 60, 70)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(child.get(), IntRect(9, 430, 60, 70)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(child.get(), IntRect(9, 430, 60, 80)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(child.get(), IntRect(-10, 430, 60, 70)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(child.get(), IntRect(-10, 430, 60, 80)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(child.get(), IntRect(10, 429, 60, 70)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(child.get(), IntRect(11, 430, 60, 70)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(child.get(), IntRect(10, 431, 60, 70)).isEmpty());
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
 
     occlusion.markOccludedBehindLayer(child.get());
     // |child2| should get merged with the surface we are leaving now
@@ -433,10 +588,6 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithSurfaceAlreadyOnStack
     EXPECT_EQ_RECT(IntRect(100, 40, 1, 60), occlusion.unoccludedContentRect(parent.get(), IntRect(31, 40, 70, 60)));
     EXPECT_EQ_RECT(IntRect(30, 100, 70, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 41, 70, 60)));
 
-    // Surface is not occluded by things that draw into itself.
-    EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(30, 40, 70, 60)));
-
-
     /* Justification for the above occlusion from |layer|:
                100
       +---------------------+                                      +---------------------+
@@ -463,9 +614,10 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithSurfaceAlreadyOnStack
      */
 }
 
-TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedOffAxisSurface)
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerAddedToOccludedRegionWithSurfaceAlreadyOnStack, layerAddedToOccludedRegionWithSurfaceAlreadyOnStack);
+
+void layerAddedToOccludedRegionWithRotatedOffAxisSurface(bool opaqueLayers)
 {
-    TestCCOcclusionTracker occlusion;
     const TransformationMatrix identityMatrix;
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromium> child = LayerChromium::create();
@@ -485,9 +637,9 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedOffAxisSurface
     TransformationMatrix layerTransform;
     layerTransform.translate(10, 10);
 
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(child.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
-    setLayerPropertiesForTesting(layer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(500, 500), true);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(100, 100));
+    setLayerPropertiesForTesting(child.get(), childTransform, FloatPoint(30, 30), IntSize(500, 500));
+    setLayerPropertiesForTesting(layer.get(), layerTransform, FloatPoint(0, 0), IntSize(500, 500), true, opaqueLayers);
 
     child->setMasksToBounds(true);
 
@@ -501,6 +653,9 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedOffAxisSurface
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+
     IntRect clippedLayerInChild = layerTransform.mapRect(layer->visibleLayerRect());
 
     occlusion.enterTargetRenderSurface(child->renderSurface());
@@ -530,9 +685,6 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedOffAxisSurface
     EXPECT_FALSE(occlusion.unoccludedContentRect(parent.get(), clippedLayerInChild).isEmpty());
     clippedLayerInChild.move(0, -1);
 
-    // Surface is not occluded by things that draw into itself.
-    EXPECT_EQ_RECT(IntRect(0, 0, 500, 500), occlusion.surfaceUnoccludedContentRect(child.get(), IntRect(0, 0, 500, 500)));
-
     occlusion.markOccludedBehindLayer(child.get());
     occlusion.finishedTargetRenderSurface(child.get(), child->renderSurface());
     occlusion.leaveToTargetRenderSurface(parent->renderSurface());
@@ -544,15 +696,13 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedOffAxisSurface
 
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(75, 55, 1, 1)));
     EXPECT_EQ_RECT(IntRect(75, 55, 1, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(75, 55, 1, 1)));
-
-    // Surface is not occluded by things that draw into itself.
-    EXPECT_EQ_RECT(IntRect(0, 0, 100, 100), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(0, 0, 100, 100)));
 }
 
-TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithMultipleOpaqueLayers)
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerAddedToOccludedRegionWithRotatedOffAxisSurface, layerAddedToOccludedRegionWithRotatedOffAxisSurface);
+
+void layerAddedToOccludedRegionWithMultipleOpaqueLayers(bool opaqueLayers)
 {
     // This is similar to the previous test but now we make a few opaque layers inside of |child| so that the occluded parts of child are not a simple rect.
-    TestCCOcclusionTracker occlusion;
     const TransformationMatrix identityMatrix;
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromium> child = LayerChromium::create();
@@ -568,10 +718,10 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithMultipleOpaqueLayers)
     childTransform.rotate(90);
     childTransform.translate(-250, -250);
 
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(child.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
-    setLayerPropertiesForTesting(layer1.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 440), true);
-    setLayerPropertiesForTesting(layer2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(10, 450), IntSize(500, 60), true);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(100, 100));
+    setLayerPropertiesForTesting(child.get(), childTransform, FloatPoint(30, 30), IntSize(500, 500));
+    setLayerPropertiesForTesting(layer1.get(), identityMatrix, FloatPoint(10, 10), IntSize(500, 440), true, opaqueLayers);
+    setLayerPropertiesForTesting(layer2.get(), identityMatrix, FloatPoint(10, 450), IntSize(500, 60), true, opaqueLayers);
 
     child->setMasksToBounds(true);
 
@@ -585,6 +735,9 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithMultipleOpaqueLayers)
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+
     occlusion.enterTargetRenderSurface(child->renderSurface());
     occlusion.markOccludedBehindLayer(layer2.get());
     occlusion.markOccludedBehindLayer(layer1.get());
@@ -606,9 +759,6 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithMultipleOpaqueLayers)
     EXPECT_EQ_RECT(IntRect(70, 430, 1, 70), occlusion.unoccludedContentRect(child.get(), IntRect(11, 430, 60, 70)));
     EXPECT_EQ_RECT(IntRect(10, 500, 60, 1), occlusion.unoccludedContentRect(child.get(), IntRect(10, 431, 60, 70)));
 
-    // Surface is not occluded by things that draw into itself.
-    EXPECT_EQ_RECT(IntRect(10, 430, 60, 70), occlusion.surfaceUnoccludedContentRect(child.get(), IntRect(10, 430, 60, 70)));
-
     occlusion.markOccludedBehindLayer(child.get());
     occlusion.finishedTargetRenderSurface(child.get(), child->renderSurface());
     occlusion.leaveToTargetRenderSurface(parent->renderSurface());
@@ -628,10 +778,6 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithMultipleOpaqueLayers)
     EXPECT_EQ_RECT(IntRect(100, 40, 1, 60), occlusion.unoccludedContentRect(parent.get(), IntRect(31, 40, 70, 60)));
     EXPECT_EQ_RECT(IntRect(30, 100, 70, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 41, 70, 60)));
 
-    // Surface is not occluded by things that draw into itself.
-    EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(30, 40, 70, 60)));
-
-
     /* Justification for the above occlusion from |layer1| and |layer2|:
 
        +---------------------+
@@ -658,10 +804,11 @@ TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithMultipleOpaqueLayers)
      */
 }
 
-TEST(CCOcclusionTrackerTest, surfaceOcclusionWithOverlappingSiblingSurfaces)
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerAddedToOccludedRegionWithMultipleOpaqueLayers, layerAddedToOccludedRegionWithMultipleOpaqueLayers);
+
+void surfaceOcclusionWithOverlappingSiblingSurfaces(bool opaqueLayers)
 {
     // This tests that the right transforms are being used.
-    TestCCOcclusionTracker occlusion;
     const TransformationMatrix identityMatrix;
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromium> child1 = LayerChromium::create();
@@ -679,11 +826,11 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionWithOverlappingSiblingSurfaces)
     childTransform.rotate(90);
     childTransform.translate(-250, -250);
 
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(child1.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
-    setLayerPropertiesForTesting(layer1.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(500, 500), true);
-    setLayerPropertiesForTesting(child2.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(20, 40), IntSize(500, 500), false);
-    setLayerPropertiesForTesting(layer2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(500, 500), true);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(100, 100));
+    setLayerPropertiesForTesting(child1.get(), childTransform, FloatPoint(30, 30), IntSize(500, 500));
+    setLayerPropertiesForTesting(layer1.get(), identityMatrix, FloatPoint(0, 0), IntSize(500, 500), true, opaqueLayers);
+    setLayerPropertiesForTesting(child2.get(), childTransform, FloatPoint(20, 40), IntSize(500, 500));
+    setLayerPropertiesForTesting(layer2.get(), identityMatrix, FloatPoint(0, 0), IntSize(500, 500), true, opaqueLayers);
 
     child1->setMasksToBounds(true);
     child2->setMasksToBounds(true);
@@ -698,6 +845,9 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionWithOverlappingSiblingSurfaces)
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(-10, -10, 1000, 1000));
+
     occlusion.enterTargetRenderSurface(child2->renderSurface());
     occlusion.markOccludedBehindLayer(layer2.get());
 
@@ -712,9 +862,6 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionWithOverlappingSiblingSurfaces)
     EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(0, 420, 61, 80)));
     EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(0, 420, 60, 81)));
 
-    // Surface is not occluded by things that draw into itself.
-    EXPECT_EQ_RECT(IntRect(0, 420, 60, 80), occlusion.surfaceUnoccludedContentRect(child2.get(), IntRect(0, 420, 60, 80)));
-
     occlusion.markOccludedBehindLayer(child2.get());
     occlusion.finishedTargetRenderSurface(child2.get(), child2->renderSurface());
     occlusion.leaveToTargetRenderSurface(parent->renderSurface());
@@ -732,9 +879,6 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionWithOverlappingSiblingSurfaces)
     EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(0, 430, 71, 70)));
     EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(0, 430, 70, 71)));
 
-    // Surface is not occluded by things that draw into itself, but the |child1| surface should be occluded by the |child2| surface.
-    EXPECT_EQ_RECT(IntRect(0, 430, 10, 70), occlusion.surfaceUnoccludedContentRect(child1.get(), IntRect(0, 430, 70, 70)));
-
     occlusion.markOccludedBehindLayer(child1.get());
     occlusion.finishedTargetRenderSurface(child1.get(), child1->renderSurface());
     occlusion.leaveToTargetRenderSurface(parent->renderSurface());
@@ -754,10 +898,6 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionWithOverlappingSiblingSurfaces)
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(19, 40, 80, 60)));
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(20, 39, 80, 60)));
 
-    // |child1| and |child2| both draw into parent so they should not occlude it.
-    EXPECT_EQ_RECT(IntRect(20, 30, 80, 70), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(20, 30, 80, 70)));
-
-
     /* Justification for the above occlusion:
                100
       +---------------------+
@@ -784,10 +924,11 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionWithOverlappingSiblingSurfaces)
      */
 }
 
-TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpace)
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_surfaceOcclusionWithOverlappingSiblingSurfaces, surfaceOcclusionWithOverlappingSiblingSurfaces);
+
+void surfaceOcclusionInScreenSpace(bool opaqueLayers)
 {
     // This tests that the right transforms are being used.
-    TestCCOcclusionTracker occlusion;
     const TransformationMatrix identityMatrix;
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromium> child1 = LayerChromium::create();
@@ -806,11 +947,11 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpace)
     childTransform.translate(-250, -250);
 
     // The owning layers have very different bounds from the surfaces that they own.
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(child1.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(10, 10), false);
-    setLayerPropertiesForTesting(layer1.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(-10, -10), IntSize(510, 510), true);
-    setLayerPropertiesForTesting(child2.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(20, 40), IntSize(10, 10), false);
-    setLayerPropertiesForTesting(layer2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(-10, -10), IntSize(510, 510), true);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(100, 100));
+    setLayerPropertiesForTesting(child1.get(), childTransform, FloatPoint(30, 30), IntSize(10, 10));
+    setLayerPropertiesForTesting(layer1.get(), identityMatrix, FloatPoint(-10, -10), IntSize(510, 510), true, opaqueLayers);
+    setLayerPropertiesForTesting(child2.get(), childTransform, FloatPoint(20, 40), IntSize(10, 10));
+    setLayerPropertiesForTesting(layer2.get(), identityMatrix, FloatPoint(-10, -10), IntSize(510, 510), true, opaqueLayers);
 
     // Make them both render surfaces
     FilterOperations filters;
@@ -831,6 +972,9 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpace)
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(-20, -20, 1000, 1000));
+
     occlusion.enterTargetRenderSurface(child2->renderSurface());
     occlusion.markOccludedBehindLayer(layer2.get());
 
@@ -845,9 +989,13 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpace)
     EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-10, 420, 71, 80)));
     EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-10, 420, 70, 81)));
 
-    // Surface is not occluded by things that draw into itself.
-    EXPECT_EQ_RECT(IntRect(-10, 420, 70, 80), occlusion.surfaceUnoccludedContentRect(child2.get(), IntRect(-10, 420, 70, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(child2.get(), IntRect(30, 250, 1, 1)));
+    occlusion.useDefaultLayerScissorRect();
+    EXPECT_TRUE(occlusion.occluded(child2.get(), IntRect(-10, 420, 70, 80)));
+    EXPECT_TRUE(occlusion.occluded(child2.get(), IntRect(-11, 420, 70, 80)));
+    EXPECT_TRUE(occlusion.occluded(child2.get(), IntRect(-10, 419, 70, 80)));
+    EXPECT_TRUE(occlusion.occluded(child2.get(), IntRect(-10, 420, 71, 80)));
+    EXPECT_TRUE(occlusion.occluded(child2.get(), IntRect(-10, 420, 70, 81)));
+    occlusion.setLayerScissorRect(IntRect(-20, -20, 1000, 1000));
 
     occlusion.markOccludedBehindLayer(child2.get());
     occlusion.finishedTargetRenderSurface(child2.get(), child2->renderSurface());
@@ -866,14 +1014,6 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpace)
     EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(-10, 430, 81, 70)));
     EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(-10, 430, 80, 71)));
 
-    // Surface is not occluded by things that draw into itself, but the |child1| surface should be occluded by the |child2| surface.
-    EXPECT_EQ_RECT(IntRect(-10, 430, 10, 80), occlusion.surfaceUnoccludedContentRect(child1.get(), IntRect(-10, 430, 70, 80)));
-    EXPECT_TRUE(occlusion.surfaceOccluded(child1.get(), IntRect(0, 430, 70, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(-1, 430, 70, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(0, 429, 70, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(1, 430, 70, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(0, 431, 70, 80)));
-
     occlusion.markOccludedBehindLayer(child1.get());
     occlusion.finishedTargetRenderSurface(child1.get(), child1->renderSurface());
     occlusion.leaveToTargetRenderSurface(parent->renderSurface());
@@ -893,11 +1033,6 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpace)
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(19, 30, 80, 70)));
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(20, 29, 80, 70)));
 
-    // |child1| and |child2| both draw into parent so they should not occlude it.
-    EXPECT_EQ_RECT(IntRect(20, 20, 80, 80), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(20, 20, 80, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(parent.get(), IntRect(50, 50, 1, 1)));
-
-
     /* Justification for the above occlusion:
                100
       +---------------------+
@@ -923,10 +1058,11 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpace)
      */
 }
 
-TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpaceDifferentTransforms)
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_surfaceOcclusionInScreenSpace, surfaceOcclusionInScreenSpace);
+
+void surfaceOcclusionInScreenSpaceDifferentTransforms(bool opaqueLayers)
 {
     // This tests that the right transforms are being used.
-    TestCCOcclusionTracker occlusion;
     const TransformationMatrix identityMatrix;
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromium> child1 = LayerChromium::create();
@@ -950,11 +1086,11 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpaceDifferentTransforms)
     child2Transform.translate(-250, -250);
 
     // The owning layers have very different bounds from the surfaces that they own.
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(child1.get(), child1Transform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 20), IntSize(10, 10), false);
-    setLayerPropertiesForTesting(layer1.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(-10, -20), IntSize(510, 520), true);
-    setLayerPropertiesForTesting(child2.get(), child2Transform, identityMatrix, FloatPoint(0, 0), FloatPoint(20, 40), IntSize(10, 10), false);
-    setLayerPropertiesForTesting(layer2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(-10, -10), IntSize(510, 510), true);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(100, 100));
+    setLayerPropertiesForTesting(child1.get(), child1Transform, FloatPoint(30, 20), IntSize(10, 10));
+    setLayerPropertiesForTesting(layer1.get(), identityMatrix, FloatPoint(-10, -20), IntSize(510, 520), true, opaqueLayers);
+    setLayerPropertiesForTesting(child2.get(), child2Transform, FloatPoint(20, 40), IntSize(10, 10));
+    setLayerPropertiesForTesting(layer2.get(), identityMatrix, FloatPoint(-10, -10), IntSize(510, 510), true, opaqueLayers);
 
     // Make them both render surfaces
     FilterOperations filters;
@@ -975,6 +1111,9 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpaceDifferentTransforms)
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(-30, -30, 1000, 1000));
+
     occlusion.enterTargetRenderSurface(child2->renderSurface());
     occlusion.markOccludedBehindLayer(layer2.get());
 
@@ -989,10 +1128,6 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpaceDifferentTransforms)
     EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-10, 420, 71, 80)));
     EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-10, 420, 70, 81)));
 
-    // Surface is not occluded by things that draw into itself.
-    EXPECT_EQ_RECT(IntRect(-10, 420, 70, 80), occlusion.surfaceUnoccludedContentRect(child2.get(), IntRect(-10, 420, 70, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(child2.get(), IntRect(30, 250, 1, 1)));
-
     occlusion.markOccludedBehindLayer(child2.get());
     occlusion.finishedTargetRenderSurface(child2.get(), child2->renderSurface());
     occlusion.leaveToTargetRenderSurface(parent->renderSurface());
@@ -1010,16 +1145,6 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpaceDifferentTransforms)
     EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(420, -19, 80, 90)));
     EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(421, -20, 80, 90)));
 
-    // Surface is not occluded by things that draw into itself, but the |child1| surface should be occluded by the |child2| surface.
-    EXPECT_EQ_RECT(IntRect(420, -20, 80, 90), occlusion.surfaceUnoccludedContentRect(child1.get(), IntRect(420, -20, 80, 90)));
-    EXPECT_EQ_RECT(IntRect(490, -10, 10, 80), occlusion.surfaceUnoccludedContentRect(child1.get(), IntRect(420, -10, 80, 80)));
-    EXPECT_EQ_RECT(IntRect(420, -20, 70, 10), occlusion.surfaceUnoccludedContentRect(child1.get(), IntRect(420, -20, 70, 90)));
-    EXPECT_TRUE(occlusion.surfaceOccluded(child1.get(), IntRect(420, -10, 70, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(419, -10, 70, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(420, -11, 70, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(421, -10, 70, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(420, -9, 70, 80)));
-
     occlusion.markOccludedBehindLayer(child1.get());
     occlusion.finishedTargetRenderSurface(child1.get(), child1->renderSurface());
     occlusion.leaveToTargetRenderSurface(parent->renderSurface());
@@ -1035,14 +1160,6 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpaceDifferentTransforms)
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(11, 20, 90, 80)));
     EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(10, 21, 90, 80)));
 
-    // |child1| and |child2| both draw into parent so they should not occlude it.
-    EXPECT_EQ_RECT(IntRect(10, 20, 90, 80), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(10, 20, 90, 80)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(parent.get(), IntRect(10, 20, 1, 1)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(parent.get(), IntRect(99, 20, 1, 1)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(parent.get(), IntRect(10, 9, 1, 1)));
-    EXPECT_FALSE(occlusion.surfaceOccluded(parent.get(), IntRect(99, 99, 1, 1)));
-
-
     /* Justification for the above occlusion:
                100
       +---------------------+
@@ -1068,10 +1185,11 @@ TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpaceDifferentTransforms)
      */
 }
 
-TEST(CCOcclusionTrackerTest, occlusionInteractionWithFilters)
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_surfaceOcclusionInScreenSpaceDifferentTransforms, surfaceOcclusionInScreenSpaceDifferentTransforms);
+
+void occlusionInteractionWithFilters(bool opaqueLayers)
 {
     // This tests that the right transforms are being used.
-    TestCCOcclusionTracker occlusion;
     const TransformationMatrix identityMatrix;
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromiumWithForcedDrawsContent> blurLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
@@ -1087,10 +1205,10 @@ TEST(CCOcclusionTrackerTest, occlusionInteractionWithFilters)
     layerTransform.rotate(90);
     layerTransform.translate(-250, -250);
 
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(blurLayer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
-    setLayerPropertiesForTesting(opaqueLayer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
-    setLayerPropertiesForTesting(opacityLayer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(100, 100));
+    setLayerPropertiesForTesting(blurLayer.get(), layerTransform, FloatPoint(30, 30), IntSize(500, 500), true, opaqueLayers);
+    setLayerPropertiesForTesting(opaqueLayer.get(), layerTransform, FloatPoint(30, 30), IntSize(500, 500), true, opaqueLayers);
+    setLayerPropertiesForTesting(opacityLayer.get(), layerTransform, FloatPoint(30, 30), IntSize(500, 500), true, opaqueLayers);
 
     {
         FilterOperations filters;
@@ -1121,6 +1239,9 @@ TEST(CCOcclusionTrackerTest, occlusionInteractionWithFilters)
 
     CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
 
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+
     // Opacity layer won't contribute to occlusion.
     occlusion.enterTargetRenderSurface(opacityLayer->renderSurface());
     occlusion.markOccludedBehindLayer(opacityLayer.get());
@@ -1170,4 +1291,922 @@ TEST(CCOcclusionTrackerTest, occlusionInteractionWithFilters)
     EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
 }
 
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_occlusionInteractionWithFilters, occlusionInteractionWithFilters);
+
+void layerScissorRectOverTile(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(200, 100, 100, 100));
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(200, 100, 100, 100)));
+
+    occlusion.useDefaultLayerScissorRect();
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(200, 100, 100, 100)));
+    occlusion.setLayerScissorRect(IntRect(200, 100, 100, 100));
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(200, 100, 100, 100), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)));
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerScissorRectOverTile, layerScissorRectOverTile);
+
+void screenScissorRectOverTile(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestCCOcclusionTracker occlusion(IntRect(200, 100, 100, 100));
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    // Occluded since its outside the surface bounds.
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(200, 100, 100, 100)));
+
+    // Test without any scissors.
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(200, 100, 100, 100)));
+    occlusion.useDefaultLayerScissorRect();
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(200, 100, 100, 100), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)));
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_screenScissorRectOverTile, screenScissorRectOverTile);
+
+void layerScissorRectOverCulledTile(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(100, 100, 100, 100));
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)).isEmpty());
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerScissorRectOverCulledTile, layerScissorRectOverCulledTile);
+
+void screenScissorRectOverCulledTile(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestCCOcclusionTracker occlusion(IntRect(100, 100, 100, 100));
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)).isEmpty());
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_screenScissorRectOverCulledTile, screenScissorRectOverCulledTile);
+
+void layerScissorRectOverPartialTiles(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(50, 50, 200, 200));
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(50, 50, 200, 200), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)));
+    EXPECT_EQ_RECT(IntRect(200, 50, 50, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 100)));
+    EXPECT_EQ_RECT(IntRect(200, 100, 50, 100), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 100, 300, 100)));
+    EXPECT_EQ_RECT(IntRect(200, 100, 50, 100), occlusion.unoccludedContentRect(parent.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_EQ_RECT(IntRect(100, 200, 100, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(100, 200, 100, 100)));
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerScissorRectOverPartialTiles, layerScissorRectOverPartialTiles);
+
+void screenScissorRectOverPartialTiles(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestCCOcclusionTracker occlusion(IntRect(50, 50, 200, 200));
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(50, 50, 200, 200), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)));
+    EXPECT_EQ_RECT(IntRect(200, 50, 50, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 100)));
+    EXPECT_EQ_RECT(IntRect(200, 100, 50, 100), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 100, 300, 100)));
+    EXPECT_EQ_RECT(IntRect(200, 100, 50, 100), occlusion.unoccludedContentRect(parent.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_EQ_RECT(IntRect(100, 200, 100, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(100, 200, 100, 100)));
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_screenScissorRectOverPartialTiles, screenScissorRectOverPartialTiles);
+
+void layerScissorRectOverNoTiles(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+    occlusion.setLayerScissorRect(IntRect(500, 500, 100, 100));
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 100)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 100, 300, 100)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(200, 100, 100, 100)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(100, 200, 100, 100)).isEmpty());
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerScissorRectOverNoTiles, layerScissorRectOverNoTiles);
+
+void screenScissorRectOverNoTiles(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestCCOcclusionTracker occlusion(IntRect(500, 500, 100, 100));
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 100)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 100, 300, 100)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(200, 100, 100, 100)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(100, 200, 100, 100)).isEmpty());
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_screenScissorRectOverNoTiles, screenScissorRectOverNoTiles);
+
+void layerScissorRectForLayerOffOrigin(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(100, 100), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    // This layer is translated when drawn into its target. So if the scissor rect given from the target surface
+    // is not in that target space, then after translating these query rects into the target, they will fall outside
+    // the scissor and be considered occluded.
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_layerScissorRectForLayerOffOrigin, layerScissorRectForLayerOffOrigin);
+
+void damageRectOverTile(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestDamageClient damage(FloatRect(200, 100, 100, 100));
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000), &damage);
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    // Outside the layer's clip rect.
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(200, 100, 100, 100)));
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(200, 100, 100, 100), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)));
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_damageRectOverTile, damageRectOverTile);
+
+void damageRectOverCulledTile(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestDamageClient damage(FloatRect(100, 100, 100, 100));
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000), &damage);
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)).isEmpty());
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_damageRectOverCulledTile, damageRectOverCulledTile);
+
+void damageRectOverPartialTiles(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestDamageClient damage(FloatRect(50, 50, 200, 200));
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000), &damage);
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(50, 50, 200, 200), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)));
+    EXPECT_EQ_RECT(IntRect(200, 50, 50, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 100)));
+    EXPECT_EQ_RECT(IntRect(200, 100, 50, 100), occlusion.unoccludedContentRect(parent.get(), IntRect(0, 100, 300, 100)));
+    EXPECT_EQ_RECT(IntRect(200, 100, 50, 100), occlusion.unoccludedContentRect(parent.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_EQ_RECT(IntRect(100, 200, 100, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(100, 200, 100, 100)));
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_damageRectOverPartialTiles, damageRectOverPartialTiles);
+
+void damageRectOverNoTiles(bool opaqueLayers)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> parentLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(parentLayer);
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    parentLayer->setFilters(filters);
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(parentLayer.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300), false, opaqueLayers);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true, opaqueLayers);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestDamageClient damage(FloatRect(500, 500, 100, 100));
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000), &damage);
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(parentLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 100, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 0, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(0, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(100, 200, 100, 100)));
+    EXPECT_TRUE(occlusion.occluded(parentLayer.get(), IntRect(200, 200, 100, 100)));
+
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 300)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 0, 300, 100)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(0, 100, 300, 100)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(200, 100, 100, 100)).isEmpty());
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(100, 200, 100, 100)).isEmpty());
+}
+
+TEST_OPAQUE_AND_PAINTED_OPAQUE(CCOcclusionTrackerTest_damageRectOverNoTiles, damageRectOverNoTiles);
+
+TEST(CCOcclusionTrackerTest, opaqueContentsRegionEmpty)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(layer);
+
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    layer->setFilters(filters);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(0, 0), IntSize(200, 200), false, false);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+
+    occlusion.enterTargetRenderSurface(layer->renderSurface());
+
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(0, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 0, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(0, 100, 100, 100)));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(100, 100, 100, 100)));
+
+    // Occluded since its outside the surface bounds.
+    EXPECT_TRUE(occlusion.occluded(layer.get(), IntRect(200, 100, 100, 100)));
+
+    // Test without any scissors.
+    occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+    EXPECT_FALSE(occlusion.occluded(layer.get(), IntRect(200, 100, 100, 100)));
+    occlusion.useDefaultLayerScissorRect();
+
+    occlusion.markOccludedBehindLayer(layer.get());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_TRUE(occlusion.occlusionInScreenSpace().bounds().isEmpty());
+    EXPECT_EQ(0u, occlusion.occlusionInScreenSpace().rects().size());
+}
+
+TEST(CCOcclusionTrackerTest, opaqueContentsRegionNonEmpty)
+{
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(layer);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, FloatPoint(100, 100), IntSize(200, 200), false, false);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    {
+        TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+        layer->setOpaquePaintRect(IntRect(0, 0, 100, 100));
+
+        occlusion.enterTargetRenderSurface(parent->renderSurface());
+        occlusion.markOccludedBehindLayer(layer.get());
+
+        EXPECT_EQ_RECT(IntRect(100, 100, 100, 100), occlusion.occlusionInScreenSpace().bounds());
+        EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+
+        EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(0, 100, 100, 100)));
+        EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(100, 100, 100, 100)));
+        EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(200, 200, 100, 100)));
+    }
+
+    {
+        TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+        layer->setOpaquePaintRect(IntRect(20, 20, 180, 180));
+
+        occlusion.enterTargetRenderSurface(parent->renderSurface());
+        occlusion.markOccludedBehindLayer(layer.get());
+
+        EXPECT_EQ_RECT(IntRect(120, 120, 180, 180), occlusion.occlusionInScreenSpace().bounds());
+        EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+
+        EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(0, 100, 100, 100)));
+        EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(100, 100, 100, 100)));
+        EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(200, 200, 100, 100)));
+    }
+
+    {
+        TestCCOcclusionTracker occlusion(IntRect(0, 0, 1000, 1000));
+        layer->setOpaquePaintRect(IntRect(150, 150, 100, 100));
+
+        occlusion.enterTargetRenderSurface(parent->renderSurface());
+        occlusion.markOccludedBehindLayer(layer.get());
+
+        EXPECT_EQ_RECT(IntRect(250, 250, 50, 50), occlusion.occlusionInScreenSpace().bounds());
+        EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+
+        EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(0, 100, 100, 100)));
+        EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(100, 100, 100, 100)));
+        EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(200, 200, 100, 100)));
+    }
+}
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
index d49703e14..42776bc94 100644
--- a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
@@ -64,6 +64,7 @@ void setQuads(CCSharedQuadState* rootState, CCSharedQuadState* childState, CCQua
 
 #define DECLARE_AND_INITIALIZE_TEST_QUADS               \
     CCQuadList quadList;                                \
+    CCOverdrawCounts overdraw;              \
     TransformationMatrix childTransform;                \
     IntSize rootSize = IntSize(300, 300);               \
     IntRect rootRect = IntRect(IntPoint(), rootSize);   \
@@ -79,8 +80,11 @@ TEST(CCQuadCullerTest, verifyCullChildLinesUpTopLeft)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 9u);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 90000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 0, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 40000, 1);
 }
 
 TEST(CCQuadCullerTest, verifyCullWhenChildOpacityNotOne)
@@ -92,8 +96,11 @@ TEST(CCQuadCullerTest, verifyCullWhenChildOpacityNotOne)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 13u);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 90000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 40000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 0, 1);
 }
 
 TEST(CCQuadCullerTest, verifyCullWhenChildOpaqueFlagFalse)
@@ -105,8 +112,11 @@ TEST(CCQuadCullerTest, verifyCullWhenChildOpaqueFlagFalse)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 13u);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 90000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 40000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 0, 1);
 }
 
 TEST(CCQuadCullerTest, verifyCullCenterTileOnly)
@@ -120,7 +130,7 @@ TEST(CCQuadCullerTest, verifyCullCenterTileOnly)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 12u);
 
     IntRect quadVisibleRect1 = quadList[1].get()->quadVisibleRect();
@@ -137,6 +147,10 @@ TEST(CCQuadCullerTest, verifyCullCenterTileOnly)
     IntRect quadVisibleRect6 = quadList[6].get()->quadVisibleRect();
     EXPECT_EQ(quadVisibleRect6.height(), 50);
     EXPECT_EQ(quadVisibleRect6.y(), 250);
+
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 100000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 0, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 30000, 1);
 }
 
 TEST(CCQuadCullerTest, verifyCullCenterTileNonIntegralSize1)
@@ -158,8 +172,12 @@ TEST(CCQuadCullerTest, verifyCullCenterTileNonIntegralSize1)
     quadList.append(MakeTileQuad(childState.get(), IntRect(IntPoint(), IntSize(100, 100))));
 
     EXPECT_EQ(quadList.size(), 2u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 2u);
+
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 20363, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 0, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 0, 1);
 }
 
 TEST(CCQuadCullerTest, verifyCullCenterTileNonIntegralSize2)
@@ -181,8 +199,12 @@ TEST(CCQuadCullerTest, verifyCullCenterTileNonIntegralSize2)
     quadList.append(MakeTileQuad(childState.get(), IntRect(IntPoint(), IntSize(100, 100))));
 
     EXPECT_EQ(quadList.size(), 2u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 2u);
+
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 19643, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 0, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 0, 1);
 }
 
 TEST(CCQuadCullerTest, verifyCullChildLinesUpBottomRight)
@@ -196,8 +218,11 @@ TEST(CCQuadCullerTest, verifyCullChildLinesUpBottomRight)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 9u);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 90000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 0, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 40000, 1);
 }
 
 TEST(CCQuadCullerTest, verifyCullSubRegion)
@@ -212,8 +237,11 @@ TEST(CCQuadCullerTest, verifyCullSubRegion)
 
     setQuads(rootState.get(), childState.get(), quadList, childOpaqueRect);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 12u);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 90000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 30000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 10000, 1);
 }
 
 TEST(CCQuadCullerTest, verifyCullSubRegion2)
@@ -228,8 +256,11 @@ TEST(CCQuadCullerTest, verifyCullSubRegion2)
 
     setQuads(rootState.get(), childState.get(), quadList, childOpaqueRect);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 12u);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 90000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 25000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 15000, 1);
 }
 
 TEST(CCQuadCullerTest, verifyCullSubRegionCheckOvercull)
@@ -244,7 +275,7 @@ TEST(CCQuadCullerTest, verifyCullSubRegionCheckOvercull)
 
     setQuads(rootState.get(), childState.get(), quadList, childOpaqueRect);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 13u);
 }
 
@@ -260,8 +291,11 @@ TEST(CCQuadCullerTest, verifyNonAxisAlignedQuadsDontOcclude)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 13u);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 130000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 0, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 0, 1);
 }
 
 // This test requires some explanation: here we are rotating the quads to be culled.
@@ -282,11 +316,14 @@ TEST(CCQuadCullerTest, verifyNonAxisAlignedQuadsSafelyCulled)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect(), &overdraw);
     EXPECT_EQ(quadList.size(), 12u);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 120000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 0, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 10000, 1);
 }
 
-TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverTile)
+TEST(CCQuadCullerTest, verifyCullOutsideScissorOverTile)
 {
     DECLARE_AND_INITIALIZE_TEST_QUADS
 
@@ -295,11 +332,14 @@ TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverTile)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(200, 100, 100, 100));
+    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(200, 100, 100, 100), &overdraw);
     EXPECT_EQ(quadList.size(), 1u);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 10000, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 0, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 120000, 1);
 }
 
-TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverCulledTile)
+TEST(CCQuadCullerTest, verifyCullOutsideScissorOverCulledTile)
 {
     DECLARE_AND_INITIALIZE_TEST_QUADS
 
@@ -308,11 +348,11 @@ TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverCulledTile)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(100, 100, 100, 100));
+    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(100, 100, 100, 100), &overdraw);
     EXPECT_EQ(quadList.size(), 1u);
 }
 
-TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverPartialTiles)
+TEST(CCQuadCullerTest, verifyCullOutsideScissorOverPartialTiles)
 {
     DECLARE_AND_INITIALIZE_TEST_QUADS
 
@@ -321,11 +361,11 @@ TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverPartialTiles)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(50, 50, 200, 200));
+    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(50, 50, 200, 200), &overdraw);
     EXPECT_EQ(quadList.size(), 9u);
 }
 
-TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverNoTiles)
+TEST(CCQuadCullerTest, verifyCullOutsideScissorOverNoTiles)
 {
     DECLARE_AND_INITIALIZE_TEST_QUADS
 
@@ -334,8 +374,11 @@ TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverNoTiles)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(500, 500, 100, 100));
+    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(500, 500, 100, 100), &overdraw);
     EXPECT_EQ(quadList.size(), 0u);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnOpaque, 0, 1);
+    EXPECT_NEAR(overdraw.m_pixelsDrawnTransparent, 0, 1);
+    EXPECT_NEAR(overdraw.m_pixelsCulled, 130000, 1);
 }
 
 
diff --git a/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp b/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
index c3b366dda..1201587c7 100644
--- a/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
+++ b/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
@@ -54,7 +54,7 @@ TEST(CCRenderSurfaceTest, verifySurfaceChangesAreTrackedProperly)
     // This will fake that we are on the correct thread for testing purposes.
     DebugScopedSetImplThread setImplThread;
 
-    RefPtr<CCLayerImpl> owningLayer = CCLayerImpl::create(0);
+    OwnPtr<CCLayerImpl> owningLayer = CCLayerImpl::create(0);
     owningLayer->createRenderSurface();
     ASSERT_TRUE(owningLayer->renderSurface());
     CCRenderSurface* renderSurface = owningLayer->renderSurface();
@@ -74,7 +74,7 @@ TEST(CCRenderSurfaceTest, verifySurfaceChangesAreTrackedProperly)
     EXECUTE_AND_VERIFY_SURFACE_DID_NOT_CHANGE(renderSurface->setClipRect(testRect));
     EXECUTE_AND_VERIFY_SURFACE_DID_NOT_CHANGE(renderSurface->setContentRect(testRect));
 
-    RefPtr<CCLayerImpl> dummyMask = CCLayerImpl::create(1);
+    OwnPtr<CCLayerImpl> dummyMask = CCLayerImpl::create(1);
     TransformationMatrix dummyMatrix;
     dummyMatrix.translate(1.0, 2.0);
 
diff --git a/Source/WebKit/chromium/tests/CCSchedulerStateMachineTest.cpp b/Source/WebKit/chromium/tests/CCSchedulerStateMachineTest.cpp
index 3908f40a9..0853e5a36 100644
--- a/Source/WebKit/chromium/tests/CCSchedulerStateMachineTest.cpp
+++ b/Source/WebKit/chromium/tests/CCSchedulerStateMachineTest.cpp
@@ -604,4 +604,178 @@ TEST(CCSchedulerStateMachineTest, TestGoesInvisibleMidCommit)
     EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
 }
 
+TEST(CCSchedulerStateMachineTest, TestContextLostWhenCompletelyIdle)
+{
+    StateMachine state;
+    state.setVisible(true);
+
+    state.didLoseContext();
+
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_CONTEXT_RECREATION, state.nextAction());
+    state.updateState(state.nextAction());
+
+    // Once context recreation begins, nothing should happen.
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
+
+    // Recreate the context
+    state.didRecreateContext();
+
+    // When the context is recreated, we should begin a commit
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_FRAME, state.nextAction());
+    state.updateState(state.nextAction());
+}
+
+TEST(CCSchedulerStateMachineTest, TestContextLostWhenIdleAndCommitRequestedWhileRecreating)
+{
+    StateMachine state;
+    state.setVisible(true);
+
+    state.didLoseContext();
+
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_CONTEXT_RECREATION, state.nextAction());
+    state.updateState(state.nextAction());
+
+    // Once context recreation begins, nothing should happen.
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
+
+    // While context is recreating, commits shouldn't begin.
+    state.setNeedsCommit(true);
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
+
+    // Recreate the context
+    state.didRecreateContext();
+
+    // When the context is recreated, we should begin a commit
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_FRAME, state.nextAction());
+    state.updateState(state.nextAction());
+
+    // Once the context is recreated, whether we draw should be based on
+    // setCanDraw.
+    state.setNeedsRedraw(true);
+    state.didEnterVSync();
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_DRAW, state.nextAction());
+    state.setCanDraw(false);
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
+    state.setCanDraw(true);
+    state.didLeaveVSync();
+}
+
+TEST(CCSchedulerStateMachineTest, TestContextLostWhileCommitInProgress)
+{
+    StateMachine state;
+    state.setVisible(true);
+
+    // Get a commit in flight.
+    state.setNeedsCommit(true);
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_FRAME, state.nextAction());
+    state.updateState(state.nextAction());
+
+    // Set damage and expect a draw.
+    state.setNeedsRedraw(true);
+    state.didEnterVSync();
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_DRAW, state.nextAction());
+    state.updateState(state.nextAction());
+    state.didLeaveVSync();
+
+    // Cause a lost context while the begin frame is in flight.
+    state.didLoseContext();
+
+    // Ask for another draw. Expect nothing happens.
+    state.setNeedsRedraw(true);
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
+
+    // Finish the frame, update resources, and commit.
+    state.beginFrameComplete();
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_UPDATE_MORE_RESOURCES, state.nextAction());
+    state.updateState(state.nextAction());
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
+    state.beginUpdateMoreResourcesComplete(false);
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_COMMIT, state.nextAction());
+    state.updateState(state.nextAction());
+
+    // Expect to be told to begin context recreation, independent of vsync state
+    state.didEnterVSync();
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_CONTEXT_RECREATION, state.nextAction());
+    state.didLeaveVSync();
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_CONTEXT_RECREATION, state.nextAction());
+}
+
+TEST(CCSchedulerStateMachineTest, TestContextLostWhileCommitInProgressAndAnotherCommitRequested)
+{
+    StateMachine state;
+    state.setVisible(true);
+
+    // Get a commit in flight.
+    state.setNeedsCommit(true);
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_FRAME, state.nextAction());
+    state.updateState(state.nextAction());
+
+    // Set damage and expect a draw.
+    state.setNeedsRedraw(true);
+    state.didEnterVSync();
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_DRAW, state.nextAction());
+    state.updateState(state.nextAction());
+    state.didLeaveVSync();
+
+    // Cause a lost context while the begin frame is in flight.
+    state.didLoseContext();
+
+    // Ask for another draw and also set needs commit. Expect nothing happens.
+    // Setting another commit will put us into
+    // COMMIT_STATE_WAITING_FOR_FIRST_DRAW after we finish the frame on the main
+    // thread.
+    state.setNeedsRedraw(true);
+    state.setNeedsCommit(true);
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
+
+    // Finish the frame, update resources, and commit.
+    state.beginFrameComplete();
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_UPDATE_MORE_RESOURCES, state.nextAction());
+    state.updateState(state.nextAction());
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
+    state.beginUpdateMoreResourcesComplete(false);
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_COMMIT, state.nextAction());
+    state.updateState(state.nextAction());
+
+    EXPECT_EQ(CCSchedulerStateMachine::COMMIT_STATE_WAITING_FOR_FIRST_DRAW, state.commitState());
+
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_DRAW, state.nextAction());
+    state.updateState(state.nextAction());
+
+    // Expect to be told to begin context recreation, independent of vsync state
+    state.didEnterVSync();
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_CONTEXT_RECREATION, state.nextAction());
+    state.didLeaveVSync();
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_CONTEXT_RECREATION, state.nextAction());
+}
+
+
+TEST(CCSchedulerStateMachineTest, TestFinishAllRenderingWhileContextLost)
+{
+    StateMachine state;
+    state.setVisible(true);
+
+    // Cause a lost context lost.
+    state.didLoseContext();
+
+    // Ask a forced redraw and verify it ocurrs.
+    state.setNeedsForcedRedraw(true);
+    state.didEnterVSync();
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_DRAW, state.nextAction());
+    state.didLeaveVSync();
+
+    // Clear the forced redraw bit.
+    state.setNeedsForcedRedraw(false);
+
+    // Expect to be told to begin context recreation, independent of vsync state
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_CONTEXT_RECREATION, state.nextAction());
+    state.updateState(state.nextAction());
+
+    // Ask a forced redraw and verify it ocurrs.
+    state.setNeedsForcedRedraw(true);
+    state.didEnterVSync();
+    EXPECT_EQ(CCSchedulerStateMachine::ACTION_DRAW, state.nextAction());
+    state.didLeaveVSync();
+}
+
 }
diff --git a/Source/WebKit/chromium/tests/CCSchedulerTest.cpp b/Source/WebKit/chromium/tests/CCSchedulerTest.cpp
index 475987f13..45f61b90b 100644
--- a/Source/WebKit/chromium/tests/CCSchedulerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCSchedulerTest.cpp
@@ -59,6 +59,7 @@ public:
     virtual void scheduledActionDrawAndSwap() { m_actions.push_back("scheduledActionDrawAndSwap"); }
     virtual void scheduledActionUpdateMoreResources() { m_actions.push_back("scheduledActionUpdateMoreResources"); }
     virtual void scheduledActionCommit() { m_actions.push_back("scheduledActionCommit"); }
+    virtual void scheduledActionBeginContextRecreation() { m_actions.push_back("scheduledActionBeginContextRecreation"); }
 
 protected:
     bool m_hasMoreResourceUpdates;
@@ -158,6 +159,7 @@ public:
 
     virtual void scheduledActionUpdateMoreResources() { }
     virtual void scheduledActionCommit() { }
+    virtual void scheduledActionBeginContextRecreation() { }
 
 protected:
     int m_numDraws;
@@ -215,6 +217,7 @@ public:
 
     virtual void scheduledActionUpdateMoreResources() { }
     virtual void scheduledActionCommit() { }
+    virtual void scheduledActionBeginContextRecreation() { }
 
 protected:
     int m_numDraws;
diff --git a/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
index 059ef2adc..02dc908ab 100644
--- a/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
@@ -46,7 +46,7 @@ TEST(CCSolidColorLayerImplTest, verifyTilingCompleteAndNoOverlap)
     IntSize layerSize = IntSize(800, 600);
     IntRect visibleLayerRect = IntRect(IntPoint(), layerSize);
 
-    RefPtr<CCSolidColorLayerImpl> layer = CCSolidColorLayerImpl::create(0);
+    OwnPtr<CCSolidColorLayerImpl> layer = CCSolidColorLayerImpl::create(0);
     layer->setVisibleLayerRect(visibleLayerRect);
     layer->setBounds(layerSize);
 
@@ -66,7 +66,7 @@ TEST(CCSolidColorLayerImplTest, verifyCorrectBackgroundColorInQuad)
     IntSize layerSize = IntSize(100, 100);
     IntRect visibleLayerRect = IntRect(IntPoint(), layerSize);
 
-    RefPtr<CCSolidColorLayerImpl> layer = CCSolidColorLayerImpl::create(0);
+    OwnPtr<CCSolidColorLayerImpl> layer = CCSolidColorLayerImpl::create(0);
     layer->setVisibleLayerRect(visibleLayerRect);
     layer->setBounds(layerSize);
     layer->setBackgroundColor(testColor);
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
index d55c0bc16..ff7daa3c9 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
@@ -39,9 +39,9 @@ namespace {
 
 // Create a default tiled layer with textures for all tiles and a default
 // visibility of the entire layer size.
-static PassRefPtr<CCTiledLayerImpl> createLayer(const IntSize& tileSize, const IntSize& layerSize, CCLayerTilingData::BorderTexelOption borderTexels)
+static PassOwnPtr<CCTiledLayerImpl> createLayer(const IntSize& tileSize, const IntSize& layerSize, CCLayerTilingData::BorderTexelOption borderTexels)
 {
-    RefPtr<CCTiledLayerImpl> layer = CCTiledLayerImpl::create(0);
+    OwnPtr<CCTiledLayerImpl> layer = CCTiledLayerImpl::create(0);
     OwnPtr<CCLayerTilingData> tiler = CCLayerTilingData::create(tileSize, borderTexels);
     tiler->setBounds(layerSize);
     layer->setTilingData(*tiler);
@@ -68,7 +68,7 @@ TEST(CCTiledLayerImplTest, emptyQuadList)
 
     // Verify default layer does creates quads
     {
-        RefPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
+        OwnPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
         CCQuadList quads;
         OwnPtr<CCSharedQuadState> sharedQuadState = layer->createSharedQuadState();
         layer->appendQuads(quads, sharedQuadState.get());
@@ -78,7 +78,7 @@ TEST(CCTiledLayerImplTest, emptyQuadList)
 
     // Layer with empty visible layer rect produces no quads
     {
-        RefPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
+        OwnPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
         layer->setVisibleLayerRect(IntRect());
 
         CCQuadList quads;
@@ -89,7 +89,7 @@ TEST(CCTiledLayerImplTest, emptyQuadList)
 
     // Layer with non-intersecting visible layer rect produces no quads
     {
-        RefPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
+        OwnPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
 
         IntRect outsideBounds(IntPoint(-100, -100), IntSize(50, 50));
         layer->setVisibleLayerRect(outsideBounds);
@@ -102,7 +102,7 @@ TEST(CCTiledLayerImplTest, emptyQuadList)
 
     // Layer with skips draw produces no quads
     {
-        RefPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
+        OwnPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
         layer->setSkipsDraw(true);
 
         CCQuadList quads;
@@ -121,7 +121,7 @@ TEST(CCTiledLayerImplTest, checkerboarding)
     const int numTilesY = 2;
     const IntSize layerSize(tileSize.width() * numTilesX, tileSize.height() * numTilesY);
 
-    RefPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
+    OwnPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
     OwnPtr<CCSharedQuadState> sharedQuadState = layer->createSharedQuadState();
 
     // No checkerboarding
@@ -150,7 +150,7 @@ TEST(CCTiledLayerImplTest, checkerboarding)
 
 static PassOwnPtr<CCSharedQuadState> getQuads(CCQuadList& quads, IntSize tileSize, const IntSize& layerSize, CCLayerTilingData::BorderTexelOption borderTexelOption, const IntRect& visibleLayerRect)
 {
-    RefPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, borderTexelOption);
+    OwnPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, borderTexelOption);
     layer->setVisibleLayerRect(visibleLayerRect);
     layer->setBounds(layerSize);
 
@@ -260,7 +260,7 @@ TEST(CCTiledLayerImplTest, backgroundCoversViewport)
     const int numTilesY = 2;
     const unsigned numTiles = numTilesX * numTilesY;
     const IntSize layerSize(tileSize.width() * numTilesX, tileSize.height() * numTilesY);
-    RefPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
+    OwnPtr<CCTiledLayerImpl> layer = createLayer(tileSize, layerSize, CCLayerTilingData::NoBorderTexels);
     layer->setBackgroundColor(Color::gray);
     layer->setBackgroundCoversViewport(true);
 
diff --git a/Source/WebKit/chromium/tests/Canvas2DLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/Canvas2DLayerChromiumTest.cpp
index ec0ce0c6a..580f15791 100644
--- a/Source/WebKit/chromium/tests/Canvas2DLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/Canvas2DLayerChromiumTest.cpp
@@ -131,7 +131,7 @@ protected:
         canvas->setBounds(IntSize(600, 300));
         canvas->setTextureId(backTextureId);
 
-        canvas->contentChanged();
+        canvas->setNeedsDisplay();
         EXPECT_TRUE(canvas->needsDisplay());
         Region occludedScreenSpace;
         canvas->paintContentsIfDirty(occludedScreenSpace);
@@ -139,7 +139,7 @@ protected:
         {
             DebugScopedSetImplThread scopedImplThread;
 
-            RefPtr<CCLayerImpl> layerImpl = canvas->createCCLayerImpl();
+            OwnPtr<CCLayerImpl> layerImpl = canvas->createCCLayerImpl();
             EXPECT_EQ(0u, static_cast<CCCanvasLayerImpl*>(layerImpl.get())->textureId());
 
             canvas->updateCompositorResources(implContext.get(), updater);
diff --git a/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h b/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h
index 23231038a..38876d737 100755
--- a/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h
+++ b/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h
@@ -37,12 +37,12 @@ public:
     virtual void updateAnimations(double frameBeginTime) { }
     virtual void layout() { }
     virtual void applyScrollAndScale(const IntSize& scrollDelta, float pageScale) { }
-    virtual PassRefPtr<GraphicsContext3D> createLayerTreeHostContext3D()
+    virtual PassRefPtr<GraphicsContext3D> createContext()
     {
         GraphicsContext3D::Attributes attrs;
         return createCompositorMockGraphicsContext3D(attrs);
     }
-    virtual void didRecreateGraphicsContext(bool success) { }
+    virtual void didRecreateContext(bool success) { }
     virtual void didCommitAndDrawFrame() { }
     virtual void didCompleteSwapBuffers() { }
 
diff --git a/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h b/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
index ae27da730..268dc1da3 100644
--- a/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
+++ b/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
@@ -35,8 +35,6 @@ namespace WebKit {
 // All operations are no-ops (returning 0 if necessary).
 class FakeWebGraphicsContext3D : public WebGraphicsContext3D {
 public:
-    virtual bool initialize(Attributes, WebView*, bool renderDirectlyToWebView) { return false; }
-
     virtual bool makeContextCurrent() { return true; }
 
     virtual int width() { return 0; }
diff --git a/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp b/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
index adceadf08..d60295a5f 100644
--- a/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
@@ -95,7 +95,7 @@ void checkKeyPathNumberValue(SerializedScriptValue* value, const String& keyPath
 
 TEST(IDBKeyFromValueAndKeyPathTest, TopLevelPropertyStringValue)
 {
-    V8LocalContext v8context;
+    V8AuxiliaryContext v8context;
     v8::Local<v8::Object> object = v8::Object::New();
     object->Set(v8::String::New("foo"), v8::String::New("zoo"));
 
@@ -107,7 +107,7 @@ TEST(IDBKeyFromValueAndKeyPathTest, TopLevelPropertyStringValue)
 
 TEST(IDBKeyFromValueAndKeyPathTest, TopLevelPropertyNumberValue)
 {
-    V8LocalContext v8context;
+    V8AuxiliaryContext v8context;
     v8::Local<v8::Object> object = v8::Object::New();
     object->Set(v8::String::New("foo"), v8::Number::New(456));
 
@@ -119,7 +119,7 @@ TEST(IDBKeyFromValueAndKeyPathTest, TopLevelPropertyNumberValue)
 
 TEST(IDBKeyFromValueAndKeyPathTest, SubProperty)
 {
-    V8LocalContext v8context;
+    V8AuxiliaryContext v8context;
     v8::Local<v8::Object> object = v8::Object::New();
     v8::Local<v8::Object> subProperty = v8::Object::New();
     subProperty->Set(v8::String::New("bar"), v8::String::New("zee"));
@@ -133,7 +133,7 @@ TEST(IDBKeyFromValueAndKeyPathTest, SubProperty)
 
 TEST(InjectIDBKeyTest, TopLevelPropertyStringValue)
 {
-    V8LocalContext v8context;
+    V8AuxiliaryContext v8context;
     v8::Local<v8::Object> object = v8::Object::New();
     object->Set(v8::String::New("foo"), v8::String::New("zoo"));
 
@@ -145,7 +145,7 @@ TEST(InjectIDBKeyTest, TopLevelPropertyStringValue)
 
 TEST(InjectIDBKeyTest, SubProperty)
 {
-    V8LocalContext v8context;
+    V8AuxiliaryContext v8context;
     v8::Local<v8::Object> object = v8::Object::New();
     v8::Local<v8::Object> subProperty = v8::Object::New();
     subProperty->Set(v8::String::New("bar"), v8::String::New("zee"));
diff --git a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
index 2e9ca9661..d8858cc12 100644
--- a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
@@ -489,7 +489,6 @@ TEST_F(LayerChromiumTest, checkPropertyChangeCausesCorrectBehavior)
     EXPECT_FALSE(testLayer->needsDisplay());
 
     // Test properties that should not call needsDisplay and needsCommit when changed.
-    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setName("Test Layer"));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setVisibleLayerRect(IntRect(0, 0, 40, 50)));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setUsesLayerClipping(true));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setIsNonCompositedContent(true));
@@ -515,10 +514,13 @@ TEST_F(LayerChromiumTest, checkPropertyChangeCausesCorrectBehavior)
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setReplicaLayer(dummyLayer.get()));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setSublayerTransform(TransformationMatrix(0, 0, 0, 0, 0, 0)));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setScrollable(true));
+    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setShouldScrollOnMainThread(true));
+    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setNonFastScrollableRegion(Region(IntRect(1, 1, 2, 2))));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setHaveWheelEventHandlers(true));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setScrollPosition(IntPoint(10, 10)));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setTransform(TransformationMatrix(0, 0, 0, 0, 0, 0)));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setDoubleSided(false));
+    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setDebugName("Test Layer"));
 
     // The above tests should not have caused a change to the needsDisplay flag.
     EXPECT_FALSE(testLayer->needsDisplay());
diff --git a/Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp b/Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp
new file mode 100644
index 000000000..6203d35d7
--- /dev/null
+++ b/Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LocalizedNumberICU.h"
+
+#include <gtest/gtest.h>
+#include <wtf/PassOwnPtr.h>
+
+using namespace WebCore;
+
+void testNumberIsReversible(const char* localeString, const char* original, const char* shouldHave = 0)
+{
+    OwnPtr<ICULocale> locale = ICULocale::create(localeString);
+    String localized = locale->convertToLocalizedNumber(original);
+    if (shouldHave)
+        EXPECT_TRUE(localized.contains(shouldHave));
+    String converted = locale->convertFromLocalizedNumber(localized);
+    EXPECT_EQ(original, converted);
+}
+
+void testNumbers(const char* localeString)
+{
+    testNumberIsReversible(localeString, "123456789012345678901234567890");
+    testNumberIsReversible(localeString, "-123.456");
+    testNumberIsReversible(localeString, ".456");
+    testNumberIsReversible(localeString, "-0.456");
+}
+
+TEST(LocalizedNumberICUTest, Reversible)
+{
+    testNumberIsReversible("en_US", "123456789012345678901234567890");
+    testNumberIsReversible("en_US", "-123.456", ".");
+    testNumberIsReversible("en_US", ".456", ".");
+    testNumberIsReversible("en_US", "-0.456", ".");
+
+    testNumberIsReversible("fr", "123456789012345678901234567890");
+    testNumberIsReversible("fr", "-123.456", ",");
+    testNumberIsReversible("fr", ".456", ",");
+    testNumberIsReversible("fr", "-0.456", ",");
+
+    // Persian locale has a negative prefix and a negative suffix.
+    testNumbers("fa");
+
+    // Test some of major locales.
+    testNumbers("ar");
+    testNumbers("de_DE");
+    testNumbers("es_ES");
+    testNumbers("ja_JP");
+    testNumbers("ko_KR");
+    testNumbers("zh_CN");
+    testNumbers("zh_HK");
+    testNumbers("zh_TW");
+}
diff --git a/Source/WebKit/chromium/tests/PlatformContextSkiaTest.cpp b/Source/WebKit/chromium/tests/PlatformContextSkiaTest.cpp
index d097c499a..b0d86ddf6 100644
--- a/Source/WebKit/chromium/tests/PlatformContextSkiaTest.cpp
+++ b/Source/WebKit/chromium/tests/PlatformContextSkiaTest.cpp
@@ -641,4 +641,44 @@ TEST(PlatformContextSkiaTest, layerTransformScaleOpaqueTest)
     EXPECT_EQ_RECT(IntRect(), platformContext.opaqueRegion().asRect());
 }
 
+TEST(PlatformContextSkiaTest, contextTransparencyLayerTest)
+{
+    SkBitmap bitmap;
+    bitmap.setConfig(SkBitmap::kARGB_8888_Config, 400, 400);
+    bitmap.allocPixels();
+    bitmap.eraseColor(0);
+    SkCanvas canvas(bitmap);
+    AffineTransform transform;
+    transform.scale(2);
+
+    PlatformContextSkia platformContext(&canvas);
+    platformContext.setTrackOpaqueRegion(true);
+    platformContext.setOpaqueRegionTransform(transform);
+    GraphicsContext context(&platformContext);
+    
+    Color opaque(1.0f, 0.0f, 0.0f, 1.0f);
+    
+    context.fillRect(FloatRect(20, 20, 10, 10), opaque, ColorSpaceDeviceRGB, CompositeSourceOver);
+    EXPECT_EQ_RECT(IntRect(40, 40, 20, 20), platformContext.opaqueRegion().asRect());
+    EXPECT_PIXELS_MATCH(bitmap, transform.inverse().mapRect(platformContext.opaqueRegion().asRect()));
+    
+    context.clearRect(FloatRect(20, 20, 10, 10));
+    EXPECT_EQ_RECT(IntRect(), platformContext.opaqueRegion().asRect());
+
+    context.beginTransparencyLayer(0.5);
+    context.save();
+    context.fillRect(FloatRect(20, 20, 10, 10), opaque, ColorSpaceDeviceRGB, CompositeSourceOver);
+    context.restore();
+    context.endTransparencyLayer();
+    EXPECT_EQ_RECT(IntRect(), platformContext.opaqueRegion().asRect());
+
+    context.clearRect(FloatRect(20, 20, 10, 10));
+    EXPECT_EQ_RECT(IntRect(), platformContext.opaqueRegion().asRect());
+
+    context.beginTransparencyLayer(0.5);
+    context.fillRect(FloatRect(20, 20, 10, 10), opaque, ColorSpaceDeviceRGB, CompositeSourceOver);
+    context.endTransparencyLayer();
+    EXPECT_EQ_RECT(IntRect(), platformContext.opaqueRegion().asRect());
+}
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/PlatformGestureCurveTest.cpp b/Source/WebKit/chromium/tests/PlatformGestureCurveTest.cpp
new file mode 100644
index 000000000..74ca57667
--- /dev/null
+++ b/Source/WebKit/chromium/tests/PlatformGestureCurveTest.cpp
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "PlatformGestureCurve.h"
+
+#include "ActivePlatformGestureAnimation.h"
+#include "PlatformGestureCurveTarget.h"
+#include "TouchFlingPlatformGestureCurve.h"
+#include "WheelFlingPlatformGestureCurve.h"
+#include "cc/CCActiveGestureAnimation.h"
+#include "cc/CCGestureCurve.h"
+#include <gtest/gtest.h>
+#include <wtf/OwnPtr.h>
+
+namespace {
+
+using namespace WebCore;
+
+class MockPlatformGestureCurveTarget : public PlatformGestureCurveTarget {
+public:
+    virtual void setScrollIncrement(const IntPoint& delta)
+    {
+        m_cumulativeDelta = m_cumulativeDelta + delta;
+    }
+
+    IntPoint cumulativeDelta() const { return  m_cumulativeDelta; }
+    void resetCumulativeDelta() { m_cumulativeDelta = IntPoint(); }
+
+private:
+    IntPoint m_cumulativeDelta;
+};
+
+TEST(PlatformGestureCurve, flingCurve)
+{
+    MockPlatformGestureCurveTarget target;
+    OwnPtr<ActivePlatformGestureAnimation> animation = ActivePlatformGestureAnimation::create(0, WheelFlingPlatformGestureCurve::create(FloatPoint(100, 0)), &target);
+
+    // Note: the expectations below are dependent on the value of sigma hard-coded in the Rayleigh
+    //       curve. If sigma changes, these test expectations will also change.
+    EXPECT_TRUE(animation->animate(0));
+    EXPECT_TRUE(animation->animate(0.25));
+    EXPECT_TRUE(animation->animate(0.45)); // Use non-uniform tick spacing.
+    EXPECT_TRUE(animation->animate(0.75));
+    EXPECT_TRUE(animation->animate(1000));
+    EXPECT_FALSE(animation->animate(1001));
+    // Since the Rayleigh CDF maxes out at 1, we expect the cumulative scroll increments to
+    // match the input velocity parameter.
+    // Since we can be off by +/-0.5 on each conversion to int for setScrollIncrement,
+    // pick the 'nearness' to be within the number of times animate returns true.
+    EXPECT_NEAR(target.cumulativeDelta().x(), 100, 1);
+    EXPECT_EQ(target.cumulativeDelta().y(), 0);
+
+    double baseTime = 42.42;
+    animation = ActivePlatformGestureAnimation::create(baseTime, WheelFlingPlatformGestureCurve::create(FloatPoint(100, 0)), &target);
+    target.resetCumulativeDelta();
+
+    EXPECT_TRUE(animation->animate(baseTime + 0.35));
+    EXPECT_TRUE(animation->animate(baseTime + 1.35));
+    EXPECT_FALSE(animation->animate(baseTime + 1000));
+    EXPECT_NEAR(target.cumulativeDelta().x(), 100, 1);
+
+    animation = ActivePlatformGestureAnimation::create(0, WheelFlingPlatformGestureCurve::create(FloatPoint(50, 150)), &target);
+    target.resetCumulativeDelta();
+
+    EXPECT_TRUE(animation->animate(0));
+    EXPECT_TRUE(animation->animate(0.25));
+    EXPECT_TRUE(animation->animate(0.45));
+    EXPECT_TRUE(animation->animate(0.75));
+    EXPECT_TRUE(animation->animate(1000));
+    EXPECT_FALSE(animation->animate(1001));
+    EXPECT_NEAR(target.cumulativeDelta().x(), 50, 1);
+    EXPECT_NEAR(target.cumulativeDelta().y(), 150, 1);
+}
+
+TEST(PlatformGestureCurve, flingCurveTouch)
+{
+    MockPlatformGestureCurveTarget target;
+    OwnPtr<ActivePlatformGestureAnimation> animation = ActivePlatformGestureAnimation::create(0, TouchFlingPlatformGestureCurve::create(FloatPoint(1000, 0)), &target);
+
+    // Note: the expectations below are dependent on the value of sigma hard-coded in the Rayleigh
+    //       curve. If sigma changes, these test expectations will also change.
+    EXPECT_TRUE(animation->animate(0));
+    EXPECT_TRUE(animation->animate(0.25));
+    EXPECT_TRUE(animation->animate(0.45)); // Use non-uniform tick spacing.
+    EXPECT_TRUE(animation->animate(0.75));
+    EXPECT_TRUE(animation->animate(0.9));
+    EXPECT_TRUE(animation->animate(1000));
+    EXPECT_FALSE(animation->animate(1001));
+    // Since we can be off by +/-0.5 on each conversion to int for setScrollIncrement,
+    // pick the 'nearness' to be within the 5 * number of times animate returns true.
+    EXPECT_NEAR(target.cumulativeDelta().x(), 1000, 1);
+    EXPECT_EQ(target.cumulativeDelta().y(), 0);
+}
+
+} // namespace anonymous
diff --git a/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp b/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp
index 85cca9066..9d21b8a9e 100644
--- a/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp
+++ b/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp
@@ -81,6 +81,9 @@ public:
     float currentX() { return m_currentPosX; }
     float currentY() { return m_currentPosY; }
 
+    FloatPoint m_fp;
+    int m_count;
+
     void reset()
     {
         stopAnimationTimerIfNeeded();
@@ -88,6 +91,14 @@ public:
         m_currentPosY = 0;
         m_horizontalData.reset();
         m_verticalData.reset();
+        m_fp = FloatPoint::zero();
+        m_count = 0;
+    }
+
+    virtual void fireUpAnAnimation(FloatPoint fp)
+    {
+        m_fp = fp;
+        m_count++;
     }
 
     MOCK_METHOD1(scrollToOffsetWithoutAnimation, void(const FloatPoint&));
@@ -120,6 +131,30 @@ TEST(ScrollAnimatorEnabled, Enabled)
     scrollAnimatorNone.reset();
 }
 
+TEST(ScrollAnimatorEnabled, flingScrollEncoding)
+{
+    MockScrollableArea scrollableArea(true);
+    MockScrollAnimatorNone scrollAnimatorNone(&scrollableArea);
+
+    scrollAnimatorNone.reset();
+
+    scrollAnimatorNone.scroll(HorizontalScrollbar, ScrollByPixelVelocity, 111, -42);
+    scrollAnimatorNone.scroll(VerticalScrollbar, ScrollByPixelVelocity, 222, 42);
+    EXPECT_EQ(-42, scrollAnimatorNone.m_fp.x());
+    EXPECT_EQ(42, scrollAnimatorNone.m_fp.y());
+    EXPECT_EQ(1, scrollAnimatorNone.m_count);
+    scrollAnimatorNone.reset();
+
+    scrollAnimatorNone.scroll(VerticalScrollbar, ScrollByPixelVelocity, 222, 42);
+    scrollAnimatorNone.scroll(HorizontalScrollbar, ScrollByPixelVelocity, 111, -42);
+    EXPECT_EQ(-42, scrollAnimatorNone.m_fp.x());
+    EXPECT_EQ(42, scrollAnimatorNone.m_fp.y());
+    EXPECT_EQ(1, scrollAnimatorNone.m_count);
+    scrollAnimatorNone.reset();
+}
+
+
+
 TEST(ScrollAnimatorEnabled, Disabled)
 {
     MockScrollableArea scrollableArea(false);
@@ -231,7 +266,8 @@ void ScrollAnimatorNoneTest::reset()
 
 bool ScrollAnimatorNoneTest::updateDataFromParameters(float step, float multiplier, float scrollableSize, double currentTime, ScrollAnimatorNone::Parameters* parameters)
 {
-    m_scrollingDown = (step * multiplier > 0);
+    if (step * multiplier)
+        m_scrollingDown = (step * multiplier > 0);
 
     double oldVelocity = m_data->m_currentVelocity;
     double oldDesiredVelocity = m_data->m_desiredVelocity;
@@ -249,16 +285,18 @@ bool ScrollAnimatorNoneTest::updateDataFromParameters(float step, float multipli
     double sustainTimeLeft = max(0., timeLeft - releaseTimeLeft - attackTimeLeft);
 
     // If we're getting near the finish, the desired velocity can decrease since the time left gets increased.
-    double allowedVelocityDecreaseFactor = 0.99 * oldTimeLeft / timeLeft;
-    allowedVelocityDecreaseFactor *= allowedVelocityDecreaseFactor;
-    if (m_scrollingDown)
-        EXPECT_LE(oldDesiredVelocity * allowedVelocityDecreaseFactor, m_data->m_desiredVelocity);
-    else
-        EXPECT_GE(oldDesiredVelocity * allowedVelocityDecreaseFactor, m_data->m_desiredVelocity);
-
-    double startPosition = attackTimeLeft ? m_data->m_attackPosition : m_currentPosition;
-    double expectedReleasePosition = startPosition + sustainTimeLeft * m_data->m_desiredVelocity;
-    EXPECT_NEAR(expectedReleasePosition, m_data->m_releasePosition, result ? .0001 : 1);
+    if (step * multiplier) {
+        double allowedVelocityDecreaseFactor = 0.99 * oldTimeLeft / timeLeft;
+        allowedVelocityDecreaseFactor *= allowedVelocityDecreaseFactor;
+        if (m_scrollingDown)
+            EXPECT_LE(oldDesiredVelocity * allowedVelocityDecreaseFactor, m_data->m_desiredVelocity);
+        else
+            EXPECT_GE(oldDesiredVelocity * allowedVelocityDecreaseFactor, m_data->m_desiredVelocity);
+
+        double startPosition = attackTimeLeft ? m_data->m_attackPosition : m_currentPosition;
+        double expectedReleasePosition = startPosition + sustainTimeLeft * m_data->m_desiredVelocity;
+        EXPECT_NEAR(expectedReleasePosition, m_data->m_releasePosition, result ? .0001 : 1);
+    }
 
     return result;
 }
@@ -427,7 +465,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollOnceLinear)
 {
     ScrollAnimatorNone::Parameters parameters(true, 7 * kTickTime, 0, ScrollAnimatorNone::Linear, 3 * kTickTime, ScrollAnimatorNone::Linear, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 1000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
     bool result = true;
     for (double t = kStartTime; result && t < kEndTime; t += kAnimationTime)
         result = animateScroll(t);
@@ -437,7 +475,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollOnceQuadratic)
 {
     ScrollAnimatorNone::Parameters parameters(true, 7 * kTickTime, 0, ScrollAnimatorNone::Quadratic, 3 * kTickTime, ScrollAnimatorNone::Quadratic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 1000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
     bool result = true;
     for (double t = kStartTime; result && t < kEndTime; t += kAnimationTime)
         result = animateScroll(t);
@@ -447,7 +485,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollLongQuadratic)
 {
     ScrollAnimatorNone::Parameters parameters(true, 20 * kTickTime, 0, ScrollAnimatorNone::Quadratic, 3 * kTickTime, ScrollAnimatorNone::Quadratic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 1000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
     bool result = true;
     for (double t = kStartTime; result && t < kEndTime; t += kAnimationTime)
         result = animateScroll(t);
@@ -457,7 +495,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollQuadraticNoSustain)
 {
     ScrollAnimatorNone::Parameters parameters(true, 8 * kTickTime, 0, ScrollAnimatorNone::Quadratic, 4 * kTickTime, ScrollAnimatorNone::Quadratic, 4 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 1000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
     bool result = true;
     for (double t = kStartTime; result && t < kEndTime; t += kAnimationTime)
         result = animateScroll(t);
@@ -467,7 +505,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollQuadraticSmoothed)
 {
     ScrollAnimatorNone::Parameters parameters(true, 8 * kTickTime, 8 * kTickTime, ScrollAnimatorNone::Quadratic, 4 * kTickTime, ScrollAnimatorNone::Quadratic, 4 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 1000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
     bool result = true;
     for (double t = kStartTime; result && t < kEndTime; t += kAnimationTime)
         result = animateScroll(t);
@@ -477,7 +515,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollOnceCubic)
 {
     ScrollAnimatorNone::Parameters parameters(true, 7 * kTickTime, 0, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 1000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
     bool result = true;
     for (double t = kStartTime; result && t < kEndTime; t += kAnimationTime)
         result = animateScroll(t);
@@ -487,7 +525,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollOnceQuartic)
 {
     ScrollAnimatorNone::Parameters parameters(true, 7 * kTickTime, 0, ScrollAnimatorNone::Quartic, 3 * kTickTime, ScrollAnimatorNone::Quartic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 1000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
     bool result = true;
     for (double t = kStartTime; result && t < kEndTime; t += kAnimationTime)
         result = animateScroll(t);
@@ -497,7 +535,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollOnceShort)
 {
     ScrollAnimatorNone::Parameters parameters(true, 7 * kTickTime, 0, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 1000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
     bool result = true;
     for (double t = kStartTime; result && t < kEndTime; t += kTickTime)
         result = animateScroll(t);
@@ -507,7 +545,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollTwiceQuadratic)
 {
     ScrollAnimatorNone::Parameters parameters(true, 7 * kTickTime, 0, ScrollAnimatorNone::Quadratic, 3 * kTickTime, ScrollAnimatorNone::Quadratic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 1000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
     bool result = true;
     double t;
     for (t = kStartTime; result && t < kStartTime + 1.5 * kTickTime; t += kAnimationTime)
@@ -538,7 +576,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollLotsQuadratic)
 {
     ScrollAnimatorNone::Parameters parameters(true, 7 * kTickTime, 0, ScrollAnimatorNone::Quadratic, 3 * kTickTime, ScrollAnimatorNone::Quadratic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 10000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 10000, kStartTime, &parameters));
     bool result = true;
     double t;
     for (t = kStartTime; result && t < kStartTime + 1.5 * kTickTime; t += kAnimationTime)
@@ -559,7 +597,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollLotsQuadraticSmoothed)
 {
     ScrollAnimatorNone::Parameters parameters(true, 10 * kTickTime, 6 * kTickTime, ScrollAnimatorNone::Quadratic, 3 * kTickTime, ScrollAnimatorNone::Quadratic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 10000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 10000, kStartTime, &parameters));
     bool result = true;
     double t;
     for (t = kStartTime; result && t < kStartTime + 1.5 * kTickTime; t += kAnimationTime)
@@ -580,7 +618,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollTwiceCubic)
 {
     ScrollAnimatorNone::Parameters parameters(true, 7 * kTickTime, 0, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 1000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
     bool result = true;
     double t;
     for (t = kStartTime; result && t < kStartTime + 1.5 * kTickTime; t += kAnimationTime)
@@ -611,7 +649,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollLotsCubic)
 {
     ScrollAnimatorNone::Parameters parameters(true, 7 * kTickTime, 0, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 10000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 10000, kStartTime, &parameters));
     bool result = true;
     double t;
     for (t = kStartTime; result && t < kStartTime + 1.5 * kTickTime; t += kAnimationTime)
@@ -632,7 +670,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollLotsCubicSmoothed)
 {
     ScrollAnimatorNone::Parameters parameters(true, 10 * kTickTime, 6 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 40, 10000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 10000, kStartTime, &parameters));
     bool result = true;
     double t;
     for (t = kStartTime; result && t < kStartTime + 1.5 * kTickTime; t += kAnimationTime)
@@ -761,7 +799,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollDownToBumper)
 {
     ScrollAnimatorNone::Parameters parameters(true, 10 * kTickTime, 7 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, 20, 200, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 20, 200, kStartTime, &parameters));
     bool result = true;
     double t = kStartTime;
     for (int i = 0; i < 10; ++i) {
@@ -781,7 +819,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollUpToBumper)
 {
     ScrollAnimatorNone::Parameters parameters(true, 10 * kTickTime, 7 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
-    updateDataFromParameters(1, -20, 200, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, -20, 200, kStartTime, &parameters));
     bool result = true;
     double t = kStartTime;
     for (int i = 0; i < 10; ++i) {
@@ -802,7 +840,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollUpToBumperCoast)
     ScrollAnimatorNone::Parameters parameters(true, 11 * kTickTime, 2 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Linear, 1);
 
     m_currentPosition = 40000;
-    updateDataFromParameters(1, -10000, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, -10000, 50000, kStartTime, &parameters));
     bool result = true;
     double t = kStartTime;
     for (int i = 0; i < 10; ++i) {
@@ -823,7 +861,7 @@ TEST_F(ScrollAnimatorNoneTest, ScrollDownToBumperCoast)
     ScrollAnimatorNone::Parameters parameters(true, 11 * kTickTime, 2 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Linear, 1);
 
     m_currentPosition = 10000;
-    updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters));
     bool result = true;
     double t = kStartTime;
     for (int i = 0; i < 10; ++i) {
@@ -844,27 +882,27 @@ TEST_F(ScrollAnimatorNoneTest, VaryingInputsEquivalency)
     ScrollAnimatorNone::Parameters parameters(true, 15 * kTickTime, 10 * kTickTime, ScrollAnimatorNone::Cubic, 5 * kTickTime, ScrollAnimatorNone::Cubic, 5 * kTickTime, ScrollAnimatorNone::Linear, 0);
 
     reset();
-    updateDataFromParameters(1, 300, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 300, 50000, kStartTime, &parameters));
     SavePerAxisData dataSingle(*m_data);
 
     reset();
-    updateDataFromParameters(1, 150, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 150, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 150, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 150, 50000, kStartTime, &parameters));
     SavePerAxisData dataDouble(*m_data);
 
     reset();
-    updateDataFromParameters(1, 100, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 100, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 100, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 100, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 100, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 100, 50000, kStartTime, &parameters));
     SavePerAxisData dataTriple(*m_data);
 
     reset();
-    updateDataFromParameters(1, 50, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 50, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 50, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 50, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 50, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 50, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 50, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 50, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 50, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 50, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 50, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 50, 50000, kStartTime, &parameters));
     SavePerAxisData dataMany(*m_data);
 
     EXPECT_EQ(dataSingle, dataDouble);
@@ -910,27 +948,27 @@ TEST_F(ScrollAnimatorNoneTest, VaryingInputsEquivalencyCoastLarge)
     ScrollAnimatorNone::Parameters parameters(true, 15 * kTickTime, 10 * kTickTime, ScrollAnimatorNone::Cubic, 5 * kTickTime, ScrollAnimatorNone::Cubic, 5 * kTickTime, ScrollAnimatorNone::Linear, 1);
 
     reset();
-    updateDataFromParameters(1, 30000, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 30000, 50000, kStartTime, &parameters));
     SavePerAxisData dataSingle(*m_data);
 
     reset();
-    updateDataFromParameters(1, 15000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 15000, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 15000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 15000, 50000, kStartTime, &parameters));
     SavePerAxisData dataDouble(*m_data);
 
     reset();
-    updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters));
     SavePerAxisData dataTriple(*m_data);
 
     reset();
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
     SavePerAxisData dataMany(*m_data);
 
     EXPECT_EQ(dataSingle, dataDouble);
@@ -943,27 +981,27 @@ TEST_F(ScrollAnimatorNoneTest, VaryingInputsEquivalencyCoastSteep)
     ScrollAnimatorNone::Parameters parameters(true, 15 * kTickTime, 10 * kTickTime, ScrollAnimatorNone::Cubic, 5 * kTickTime, ScrollAnimatorNone::Cubic, 5 * kTickTime, ScrollAnimatorNone::Quadratic, 1);
 
     reset();
-    updateDataFromParameters(1, 30000, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 30000, 50000, kStartTime, &parameters));
     SavePerAxisData dataSingle(*m_data);
 
     reset();
-    updateDataFromParameters(1, 15000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 15000, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 15000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 15000, 50000, kStartTime, &parameters));
     SavePerAxisData dataDouble(*m_data);
 
     reset();
-    updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 10000, 50000, kStartTime, &parameters));
     SavePerAxisData dataTriple(*m_data);
 
     reset();
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
-    updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters);
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
+    EXPECT_TRUE(updateDataFromParameters(1, 5000, 50000, kStartTime, &parameters));
     SavePerAxisData dataMany(*m_data);
 
     EXPECT_EQ(dataSingle, dataDouble);
@@ -971,5 +1009,50 @@ TEST_F(ScrollAnimatorNoneTest, VaryingInputsEquivalencyCoastSteep)
     EXPECT_EQ(dataSingle, dataMany);
 }
 
+TEST_F(ScrollAnimatorNoneTest, ScrollStopInMiddle)
+{
+    ScrollAnimatorNone::Parameters parameters(true, 7 * kTickTime, 0, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
+
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
+    bool result = true;
+    double t;
+    for (t = kStartTime; result && t < kStartTime + 1.5 * kTickTime; t += kAnimationTime)
+        result = animateScroll(t);
+
+    result = result && animateScroll(t);
+    EXPECT_TRUE(result);
+    double before = m_currentPosition;
+    result = result && updateDataFromParameters(0, 0, 1000, t, &parameters);
+    EXPECT_FALSE(result);
+    result = result && animateScroll(t);
+    double after = m_currentPosition;
+    EXPECT_EQ(before, after);
+    checkDesiredPosition(after);
+}
+
+TEST_F(ScrollAnimatorNoneTest, ReverseInMiddle)
+{
+    ScrollAnimatorNone::Parameters parameters(true, 7 * kTickTime, 0, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Cubic, 3 * kTickTime, ScrollAnimatorNone::Linear, 0);
+
+    EXPECT_TRUE(updateDataFromParameters(1, 40, 1000, kStartTime, &parameters));
+    bool result = true;
+    double t;
+    for (t = kStartTime; result && t < kStartTime + 1.5 * kTickTime; t += kAnimationTime)
+        result = animateScroll(t);
+
+    result = result && animateScroll(t);
+    EXPECT_TRUE(result);
+    double before = m_currentPosition;
+    result = result && updateDataFromParameters(1, -10, 1000, t, &parameters);
+    EXPECT_TRUE(result);
+    result = result && animateScroll(t);
+    double after = m_currentPosition;
+    EXPECT_GE(before, after);
+
+    t += kAnimationTime;
+    for (; result && t < kEndTime; t += kAnimationTime)
+        result = result && animateScroll(t);
+    EXPECT_GE(before, m_currentPosition);
+}
 
 #endif // ENABLE(SMOOTH_SCROLLING)
diff --git a/Source/WebKit/chromium/tests/ScrollbarLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/ScrollbarLayerChromiumTest.cpp
new file mode 100644
index 000000000..78b96b495
--- /dev/null
+++ b/Source/WebKit/chromium/tests/ScrollbarLayerChromiumTest.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "ScrollbarLayerChromium.h"
+
+#include "Scrollbar.h"
+#include "TreeSynchronizer.h"
+#include "cc/CCScrollbarLayerImpl.h"
+#include "cc/CCSingleThreadProxy.h"
+#include <gtest/gtest.h>
+
+using namespace WebCore;
+
+namespace {
+
+class MockScrollbar : public Scrollbar {
+public:
+    virtual int x() const { return 0; }
+    virtual int y() const { return 0; }
+    virtual int width() const { return 0; }
+    virtual int height() const { return 0; }
+    virtual IntSize size() const { return IntSize(); }
+    virtual IntPoint location() const { return IntPoint(); }
+
+    virtual ScrollView* parent() const { return 0; }
+    virtual ScrollView* root() const { return 0; }
+
+    virtual void setFrameRect(const IntRect&) { }
+    virtual IntRect frameRect() const { return IntRect(); }
+
+    virtual void invalidate() { }
+    virtual void invalidateRect(const IntRect&) { }
+
+    virtual ScrollbarOverlayStyle scrollbarOverlayStyle() const { return ScrollbarOverlayStyleDefault; }
+    virtual void getTickmarks(Vector<IntRect>&) const { }
+    virtual bool isScrollableAreaActive() const { return false; }
+    virtual bool isScrollViewScrollbar() const { return false; }
+
+    virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint) { return IntPoint(); }
+
+    virtual bool isCustomScrollbar() const { return false; }
+    virtual ScrollbarOrientation orientation() const { return HorizontalScrollbar; }
+
+    virtual int value() const { return 0; }
+    virtual float currentPos() const { return 0; }
+    virtual int visibleSize() const { return 1; }
+    virtual int totalSize() const { return 1; }
+    virtual int maximum() const { return 0; }
+    virtual ScrollbarControlSize controlSize() const { return RegularScrollbar; }
+
+    virtual int lineStep() const { return 0; }
+    virtual int pageStep() const { return 0; }
+
+    virtual ScrollbarPart pressedPart() const { return NoPart; }
+    virtual ScrollbarPart hoveredPart() const { return NoPart; }
+
+    virtual void styleChanged() { }
+
+    virtual bool enabled() const { return false; }
+    virtual void setEnabled(bool) { }
+
+    MockScrollbar() : Scrollbar(0, HorizontalScrollbar, RegularScrollbar) { }
+    virtual ~MockScrollbar() { }
+};
+
+TEST(ScrollbarLayerChromiumTest, resolveScrollLayerPointer)
+{
+    DebugScopedSetImplThread impl;
+
+    {
+        RefPtr<MockScrollbar> scrollbar = adoptRef(new MockScrollbar);
+        RefPtr<LayerChromium> layerTreeRoot = LayerChromium::create();
+        RefPtr<LayerChromium> child1 = LayerChromium::create();
+        RefPtr<LayerChromium> child2 = ScrollbarLayerChromium::create(scrollbar.get(), child1->id());
+        layerTreeRoot->addChild(child1);
+        layerTreeRoot->addChild(child2);
+
+        OwnPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), nullptr);
+
+        CCLayerImpl* ccChild1 = ccLayerTreeRoot->children()[0].get();
+        CCScrollbarLayerImpl* ccChild2 = static_cast<CCScrollbarLayerImpl*>(ccLayerTreeRoot->children()[1].get());
+
+        EXPECT_EQ(ccChild1, ccChild2->scrollLayer());
+    }
+
+    { // another traverse order
+        RefPtr<MockScrollbar> scrollbar = adoptRef(new MockScrollbar);
+        RefPtr<LayerChromium> layerTreeRoot = LayerChromium::create();
+        RefPtr<LayerChromium> child2 = LayerChromium::create();
+        RefPtr<LayerChromium> child1 = ScrollbarLayerChromium::create(scrollbar.get(), child2->id());
+        layerTreeRoot->addChild(child1);
+        layerTreeRoot->addChild(child2);
+
+        OwnPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), nullptr);
+
+        CCScrollbarLayerImpl* ccChild1 = static_cast<CCScrollbarLayerImpl*>(ccLayerTreeRoot->children()[0].get());
+        CCLayerImpl* ccChild2 = ccLayerTreeRoot->children()[1].get();
+
+        EXPECT_EQ(ccChild1->scrollLayer(), ccChild2);
+    }
+}
+
+}
diff --git a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
index e03559046..2523230e0 100644
--- a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
@@ -68,6 +68,7 @@ public:
         virtual ~Texture() { }
 
         virtual void updateRect(GraphicsContext3D*, TextureAllocator*, const IntRect&, const IntRect&) { m_layer->updateRect(); }
+        virtual void prepareRect(const IntRect&) { m_layer->prepareRect(); }
 
     private:
         FakeLayerTextureUpdater* m_layer;
@@ -76,6 +77,7 @@ public:
     FakeLayerTextureUpdater()
         : m_prepareCount(0)
         , m_updateCount(0)
+        , m_prepareRectCount(0)
     {
     }
     virtual ~FakeLayerTextureUpdater() { }
@@ -93,6 +95,11 @@ public:
     void clearUpdateCount() { m_updateCount = 0; }
     void updateRect() { m_updateCount++; }
 
+    // Number of times prepareRect() has been invoked on a texture.
+    int prepareRectCount() const { return m_prepareRectCount; }
+    void clearPrepareRectCount() { m_prepareRectCount = 0; }
+    void prepareRect() { m_prepareRectCount++; }
+
     void setOpaquePaintRect(const IntRect& opaquePaintRect) { m_opaquePaintRect = opaquePaintRect; }
 
     // Last rect passed to prepareToUpdate().
@@ -105,6 +112,7 @@ public:
 private:
     int m_prepareCount;
     int m_updateCount;
+    int m_prepareRectCount;
     IntRect m_rectToInvalidate;
     IntRect m_lastUpdateRect;
     IntRect m_opaquePaintRect;
@@ -142,14 +150,14 @@ public:
         TiledLayerChromium::invalidateRect(rect);
     }
 
-    void prepareToUpdate(const IntRect& rect)
+    void prepareToUpdate(const IntRect& rect, const Region& occluded)
     {
-        TiledLayerChromium::prepareToUpdate(rect);
+        TiledLayerChromium::prepareToUpdate(rect, occluded);
     }
 
-    void prepareToUpdateIdle(const IntRect& rect)
+    void prepareToUpdateIdle(const IntRect& rect, const Region& occluded)
     {
-        TiledLayerChromium::prepareToUpdateIdle(rect);
+        TiledLayerChromium::prepareToUpdateIdle(rect, occluded);
     }
 
     bool needsIdlePaint(const IntRect& rect)
@@ -174,9 +182,9 @@ public:
 
     virtual TextureManager* textureManager() const { return m_textureManager; }
 
-    virtual void paintContentsIfDirty(const Region& /* occludedScreenSpace */)
+    virtual void paintContentsIfDirty(const Region& occludedScreenSpace)
     {
-        prepareToUpdate(visibleLayerRect());
+        prepareToUpdate(visibleLayerRect(), occludedScreenSpace);
     }
 
 private:
@@ -231,7 +239,8 @@ TEST(TiledLayerChromiumTest, pushDirtyTiles)
     OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    RefPtr<FakeCCTiledLayerImpl> layerImpl = adoptRef(new FakeCCTiledLayerImpl(0));
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+    Region noOcclusion;
 
     FakeTextureAllocator textureAllocator;
     CCTextureUpdater updater(&textureAllocator);
@@ -239,7 +248,7 @@ TEST(TiledLayerChromiumTest, pushDirtyTiles)
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
     layer->invalidateRect(IntRect(0, 0, 100, 200));
-    layer->prepareToUpdate(IntRect(0, 0, 100, 200));
+    layer->prepareToUpdate(IntRect(0, 0, 100, 200), noOcclusion);
     layer->updateCompositorResources(0, updater);
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -252,7 +261,7 @@ TEST(TiledLayerChromiumTest, pushDirtyTiles)
     // Invalidates both tiles...
     layer->invalidateRect(IntRect(0, 0, 100, 200));
     // ....but then only update one of them.
-    layer->prepareToUpdate(IntRect(0, 0, 100, 100));
+    layer->prepareToUpdate(IntRect(0, 0, 100, 100), noOcclusion);
     layer->updateCompositorResources(0, updater);
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -261,12 +270,49 @@ TEST(TiledLayerChromiumTest, pushDirtyTiles)
     EXPECT_FALSE(layerImpl->hasTileAt(0, 1));
 }
 
+TEST(TiledLayerChromiumTest, pushOccludedDirtyTiles)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    DebugScopedSetImplThread implThread;
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+    Region noOcclusion;
+
+    FakeTextureAllocator textureAllocator;
+    CCTextureUpdater updater(&textureAllocator);
+
+    // The tile size is 100x100, so this invalidates and then paints two tiles.
+    layer->setBounds(IntSize(100, 200));
+    layer->invalidateRect(IntRect(0, 0, 100, 200));
+    layer->prepareToUpdate(IntRect(0, 0, 100, 200), noOcclusion);
+    layer->updateCompositorResources(0, updater);
+    layer->pushPropertiesTo(layerImpl.get());
+
+    // We should have both tiles on the impl side.
+    EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
+    EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
+
+    textureManager->unprotectAllTextures();
+
+    // Invalidates part of the top tile...
+    layer->invalidateRect(IntRect(0, 0, 50, 50));
+    // ....but the area is occluded.
+    Region occlusion(IntRect(0, 0, 50, 50));
+    layer->prepareToUpdate(IntRect(0, 0, 100, 100), occlusion);
+    layer->updateCompositorResources(0, updater);
+    layer->pushPropertiesTo(layerImpl.get());
+
+    // We should still have both tiles, as part of the top tile is still unoccluded.
+    EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
+    EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
+}
+
 TEST(TiledLayerChromiumTest, pushIdlePaintTiles)
 {
     OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    RefPtr<FakeCCTiledLayerImpl> layerImpl = adoptRef(new FakeCCTiledLayerImpl(0));
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
 
     FakeTextureAllocator textureAllocator;
     CCTextureUpdater updater(&textureAllocator);
@@ -275,12 +321,13 @@ TEST(TiledLayerChromiumTest, pushIdlePaintTiles)
     IntSize contentBounds(500, 500);
     IntRect contentRect(IntPoint::zero(), contentBounds);
     IntRect visibleRect(200, 200, 100, 100);
+    Region noOcclusion;
 
     // This invalidates 25 tiles and then paints one visible tile.
     layer->setBounds(contentBounds);
     layer->setVisibleLayerRect(visibleRect);
     layer->invalidateRect(contentRect);
-    layer->prepareToUpdate(visibleRect);
+    layer->prepareToUpdate(visibleRect, noOcclusion);
 
     // We should need idle-painting for 3x3 tiles in the center.
     EXPECT_TRUE(layer->needsIdlePaint(visibleRect));
@@ -295,9 +342,9 @@ TEST(TiledLayerChromiumTest, pushIdlePaintTiles)
 
     // For the next four updates, we should detect we still need idle painting.
     for (int i = 0; i < 4; i++) {
-        layer->prepareToUpdate(visibleRect);
+        layer->prepareToUpdate(visibleRect, noOcclusion);
         EXPECT_TRUE(layer->needsIdlePaint(visibleRect));
-        layer->prepareToUpdateIdle(visibleRect);
+        layer->prepareToUpdateIdle(visibleRect, noOcclusion);
         layer->updateCompositorResources(0, updater);
         layer->pushPropertiesTo(layerImpl.get());
         textureManager->unprotectAllTextures();
@@ -318,6 +365,105 @@ TEST(TiledLayerChromiumTest, pushIdlePaintTiles)
     }
 }
 
+TEST(TiledLayerChromiumTest, pushTilesMarkedDirtyDuringPaint)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    DebugScopedSetImplThread implThread;
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+
+    FakeTextureAllocator textureAllocator;
+    CCTextureUpdater updater(&textureAllocator);
+    Region noOcclusion;
+
+    // The tile size is 100x100, so this invalidates and then paints two tiles.
+    // However, during the paint, we invalidate one of the tiles. This should
+    // not prevent the tile from being pushed.
+    layer->setBounds(IntSize(100, 200));
+    layer->invalidateRect(IntRect(0, 0, 100, 200));
+    layer->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer.get());
+    layer->prepareToUpdate(IntRect(0, 0, 100, 200), noOcclusion);
+    layer->updateCompositorResources(0, updater);
+    layer->pushPropertiesTo(layerImpl.get());
+
+    // We should have both tiles on the impl side.
+    EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
+    EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
+}
+
+TEST(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnNextLayer)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer1 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer2 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    DebugScopedSetImplThread implThread;
+    OwnPtr<FakeCCTiledLayerImpl> layer1Impl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+    OwnPtr<FakeCCTiledLayerImpl> layer2Impl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+
+    FakeTextureAllocator textureAllocator;
+    CCTextureUpdater updater(&textureAllocator);
+    Region noOcclusion;
+
+    layer1->setBounds(IntSize(100, 200));
+    layer1->invalidateRect(IntRect(0, 0, 100, 200));
+    layer2->setBounds(IntSize(100, 200));
+    layer2->invalidateRect(IntRect(0, 0, 100, 200));
+
+    layer1->prepareToUpdate(IntRect(0, 0, 100, 200), noOcclusion);
+
+    // Invalidate a tile on layer1
+    layer2->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer1.get());
+    layer2->prepareToUpdate(IntRect(0, 0, 100, 200), noOcclusion);
+
+    layer1->updateCompositorResources(0, updater);
+    layer2->updateCompositorResources(0, updater);
+
+    layer1->pushPropertiesTo(layer1Impl.get());
+    layer2->pushPropertiesTo(layer2Impl.get());
+
+    // We should have both tiles on the impl side for all layers.
+    EXPECT_TRUE(layer1Impl->hasTileAt(0, 0));
+    EXPECT_TRUE(layer1Impl->hasTileAt(0, 1));
+    EXPECT_TRUE(layer2Impl->hasTileAt(0, 0));
+    EXPECT_TRUE(layer2Impl->hasTileAt(0, 1));
+}
+
+TEST(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnPreviousLayer)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer1 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer2 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    DebugScopedSetImplThread implThread;
+    OwnPtr<FakeCCTiledLayerImpl> layer1Impl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+    OwnPtr<FakeCCTiledLayerImpl> layer2Impl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+
+    FakeTextureAllocator textureAllocator;
+    CCTextureUpdater updater(&textureAllocator);
+    Region noOcclusion;
+
+    layer1->setBounds(IntSize(100, 200));
+    layer1->invalidateRect(IntRect(0, 0, 100, 200));
+    layer2->setBounds(IntSize(100, 200));
+    layer2->invalidateRect(IntRect(0, 0, 100, 200));
+
+    // Invalidate a tile on layer2
+    layer1->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer2.get());
+    layer1->prepareToUpdate(IntRect(0, 0, 100, 200), noOcclusion);
+
+    layer2->prepareToUpdate(IntRect(0, 0, 100, 200), noOcclusion);
+
+    layer1->updateCompositorResources(0, updater);
+    layer2->updateCompositorResources(0, updater);
+
+    layer1->pushPropertiesTo(layer1Impl.get());
+    layer2->pushPropertiesTo(layer2Impl.get());
+
+    // We should have both tiles on the impl side for all layers.
+    EXPECT_TRUE(layer1Impl->hasTileAt(0, 0));
+    EXPECT_TRUE(layer1Impl->hasTileAt(0, 1));
+    EXPECT_TRUE(layer2Impl->hasTileAt(0, 0));
+    EXPECT_TRUE(layer2Impl->hasTileAt(0, 1));
+}
 
 TEST(TiledLayerChromiumTest, idlePaintOutOfMemory)
 {
@@ -325,6 +471,7 @@ TEST(TiledLayerChromiumTest, idlePaintOutOfMemory)
     IntSize contentBounds(300, 300);
     IntRect contentRect(IntPoint::zero(), contentBounds);
     IntRect visibleRect(100, 100, 100, 100);
+    Region noOcclusion;
 
     // We have enough memory for only the visible rect, so we will run out of memory in first idle paint.
     int memoryLimit = 4 * 100 * 100; // 2 tiles, 4 bytes per pixel.
@@ -332,7 +479,7 @@ TEST(TiledLayerChromiumTest, idlePaintOutOfMemory)
     OwnPtr<TextureManager> textureManager = TextureManager::create(memoryLimit, memoryLimit / 2, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    RefPtr<FakeCCTiledLayerImpl> layerImpl = adoptRef(new FakeCCTiledLayerImpl(0));
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
 
     FakeTextureAllocator textureAllocator;
     CCTextureUpdater updater(&textureAllocator);
@@ -341,7 +488,7 @@ TEST(TiledLayerChromiumTest, idlePaintOutOfMemory)
     layer->setBounds(contentBounds);
     layer->setVisibleLayerRect(visibleRect);
     layer->invalidateRect(contentRect);
-    layer->prepareToUpdate(visibleRect);
+    layer->prepareToUpdate(visibleRect, noOcclusion);
 
     // We should need idle-painting for 3x3 tiles surounding visible tile.
     EXPECT_TRUE(layer->needsIdlePaint(visibleRect));
@@ -353,8 +500,8 @@ TEST(TiledLayerChromiumTest, idlePaintOutOfMemory)
     EXPECT_TRUE(layerImpl->hasTileAt(1, 1));
 
     textureManager->unprotectAllTextures();
-    layer->prepareToUpdate(visibleRect);
-    layer->prepareToUpdateIdle(visibleRect);
+    layer->prepareToUpdate(visibleRect, noOcclusion);
+    layer->prepareToUpdateIdle(visibleRect, noOcclusion);
 
     // We shouldn't signal we need another idle paint after we run out of memory.
     EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
@@ -368,7 +515,8 @@ TEST(TiledLayerChromiumTest, invalidateFromPrepare)
     OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    RefPtr<FakeCCTiledLayerImpl> layerImpl = adoptRef(new FakeCCTiledLayerImpl(0));
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+    Region noOcclusion;
 
     FakeTextureAllocator textureAllocator;
     CCTextureUpdater updater(&textureAllocator);
@@ -376,7 +524,7 @@ TEST(TiledLayerChromiumTest, invalidateFromPrepare)
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
     layer->invalidateRect(IntRect(0, 0, 100, 200));
-    layer->prepareToUpdate(IntRect(0, 0, 100, 200));
+    layer->prepareToUpdate(IntRect(0, 0, 100, 200), noOcclusion);
     layer->updateCompositorResources(0, updater);
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -389,18 +537,18 @@ TEST(TiledLayerChromiumTest, invalidateFromPrepare)
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
     // Invoke prepareToUpdate again. As the layer is valid prepareToUpdate shouldn't be invoked on
     // the LayerTextureUpdater.
-    layer->prepareToUpdate(IntRect(0, 0, 100, 200));
+    layer->prepareToUpdate(IntRect(0, 0, 100, 200), noOcclusion);
     EXPECT_EQ(0, layer->fakeLayerTextureUpdater()->prepareCount());
 
     layer->invalidateRect(IntRect(0, 0, 50, 50));
     // setRectToInvalidate triggers invalidateRect() being invoked from prepareToUpdate.
     layer->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(25, 25, 50, 50), layer.get());
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
-    layer->prepareToUpdate(IntRect(0, 0, 100, 200));
+    layer->prepareToUpdate(IntRect(0, 0, 100, 200), noOcclusion);
     EXPECT_EQ(1, layer->fakeLayerTextureUpdater()->prepareCount());
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
     // The layer should still be invalid as prepareToUpdate invoked invalidate.
-    layer->prepareToUpdate(IntRect(0, 0, 100, 200));
+    layer->prepareToUpdate(IntRect(0, 0, 100, 200), noOcclusion);
     EXPECT_EQ(1, layer->fakeLayerTextureUpdater()->prepareCount());
 }
 
@@ -411,6 +559,7 @@ TEST(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
 
     OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
     RefPtr<FakeTiledLayerWithScaledBounds> layer = adoptRef(new FakeTiledLayerWithScaledBounds(textureManager.get()));
+    Region noOcclusion;
 
     FakeTextureAllocator textureAllocator;
     CCTextureUpdater updater(&textureAllocator);
@@ -425,20 +574,20 @@ TEST(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
     // On first update, the updateRect includes all tiles, even beyond the boundaries of the layer.
     // However, it should still be in layer space, not content space.
     layer->invalidateRect(contentBounds);
-    layer->prepareToUpdate(contentBounds);
+    layer->prepareToUpdate(contentBounds, noOcclusion);
     layer->updateCompositorResources(0, updater);
     EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 300, 300 * 0.8), layer->updateRect());
 
     // After the tiles are updated once, another invalidate only needs to update the bounds of the layer.
     layer->invalidateRect(contentBounds);
-    layer->prepareToUpdate(contentBounds);
+    layer->prepareToUpdate(contentBounds, noOcclusion);
     layer->updateCompositorResources(0, updater);
     EXPECT_FLOAT_RECT_EQ(FloatRect(layerBounds), layer->updateRect());
 
     // Partial re-paint should also be represented by the updateRect in layer space, not content space.
     IntRect partialDamage(30, 100, 10, 10);
     layer->invalidateRect(partialDamage);
-    layer->prepareToUpdate(contentBounds);
+    layer->prepareToUpdate(contentBounds, noOcclusion);
     layer->updateCompositorResources(0, updater);
     EXPECT_FLOAT_RECT_EQ(FloatRect(45, 80, 15, 8), layer->updateRect());
 }
@@ -448,10 +597,11 @@ TEST(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    RefPtr<FakeCCTiledLayerImpl> layerImpl = adoptRef(new FakeCCTiledLayerImpl(0));
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
 
     FakeTextureAllocator textureAllocator;
     CCTextureUpdater updater(&textureAllocator);
+    Region noOcclusion;
 
     // Create a layer with one tile.
     layer->setBounds(IntSize(100, 100));
@@ -461,7 +611,7 @@ TEST(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 100, 100), layer->lastNeedsDisplayRect());
 
     // Push the tiles to the impl side and check that there is exactly one.
-    layer->prepareToUpdate(IntRect(0, 0, 100, 100));
+    layer->prepareToUpdate(IntRect(0, 0, 100, 100), noOcclusion);
     layer->updateCompositorResources(0, updater);
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
@@ -475,7 +625,7 @@ TEST(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 100, 100), layer->lastNeedsDisplayRect());
 
     // The impl side should get 2x2 tiles now.
-    layer->prepareToUpdate(IntRect(0, 0, 200, 200));
+    layer->prepareToUpdate(IntRect(0, 0, 200, 200), noOcclusion);
     layer->updateCompositorResources(0, updater);
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
@@ -486,6 +636,7 @@ TEST(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     // Invalidate the entire layer again, but do not paint. All tiles should be gone now from the
     // impl side.
     layer->setNeedsDisplay();
+    layer->prepareToUpdate(IntRect(0, 0, 0, 0), noOcclusion);
     layer->updateCompositorResources(0, updater);
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
@@ -547,132 +698,15 @@ TEST(TiledLayerChromiumTest, skipsDrawGetsReset)
     WebKit::WebCompositor::shutdown();
 }
 
-TEST(TiledLayerChromiumTest, layerAddsSelfToOccludedRegion)
-{
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
-
-    // The tile size is 100x100, so this invalidates and then paints two tiles in various ways.
-
-    Region occluded;
-    IntRect contentBounds = IntRect(0, 0, 100, 200);
-    IntRect visibleBounds = IntRect(0, 0, 100, 150);
-
-    layer->setBounds(contentBounds.size());
-    layer->setVisibleLayerRect(visibleBounds);
-    layer->setDrawOpacity(1);
-
-    // The screenSpaceTransform is verified in CCLayerTreeHostCommonTests
-    TransformationMatrix screenSpaceTransform;
-    layer->setScreenSpaceTransform(screenSpaceTransform);
-
-    // If the layer is opaque then the occluded region should be the whole layer's visible region.
-    layer->setOpaque(true);
-    layer->invalidateRect(contentBounds);
-    layer->prepareToUpdate(contentBounds);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    EXPECT_EQ_RECT(visibleBounds, occluded.bounds());
-    EXPECT_EQ(1u, occluded.rects().size());
-
-    // If the layer is not opaque then the occluded region should be empty.
-    layer->setOpaque(false);
-    layer->invalidateRect(contentBounds);
-    layer->prepareToUpdate(contentBounds);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    EXPECT_EQ_RECT(IntRect(), occluded.bounds());
-    EXPECT_EQ(0u, occluded.rects().size());
-
-    // If the layer paints opaque content, then the occluded region should match the visible opaque content.
-    IntRect opaquePaintRect = IntRect(10, 10, 90, 190);
-    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(opaquePaintRect);
-    layer->invalidateRect(contentBounds);
-    layer->prepareToUpdate(contentBounds);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), occluded.bounds());
-    EXPECT_EQ(1u, occluded.rects().size());
-
-    // If we paint again without invalidating, the same stuff should be occluded.
-    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
-    layer->prepareToUpdate(contentBounds);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), occluded.bounds());
-    EXPECT_EQ(1u, occluded.rects().size());
-
-    // If we repaint a non-opaque part of the tile, then it shouldn't lose its opaque-ness. And other tiles should
-    // not be affected.
-    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
-    layer->invalidateRect(IntRect(0, 0, 1, 1));
-    layer->prepareToUpdate(contentBounds);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), occluded.bounds());
-    EXPECT_EQ(1u, occluded.rects().size());
-
-    // If we repaint an opaque part of the tile, then it should lose its opaque-ness. But other tiles should still
-    // not be affected.
-    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
-    layer->invalidateRect(IntRect(10, 10, 1, 1));
-    layer->prepareToUpdate(contentBounds);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    EXPECT_EQ_RECT(intersection(IntRect(10, 100, 90, 100), visibleBounds), occluded.bounds());
-    EXPECT_EQ(1u, occluded.rects().size());
-
-    // If the layer is transformed then the resulting occluded area needs to be transformed to its target space.
-    TransformationMatrix transform;
-    transform.translate(contentBounds.width() / 2.0, contentBounds.height() / 2.0);
-    transform.rotate(90);
-    transform.translate(-contentBounds.width() / 2.0, -contentBounds.height() / 2.0);
-    transform.translate(10, 10);
-    screenSpaceTransform.translate(contentBounds.width() / 2.0, contentBounds.height() / 2.0);
-    screenSpaceTransform *= transform;
-    screenSpaceTransform.translate(-contentBounds.width() / 2.0, -contentBounds.height() / 2.0);
-    layer->setScreenSpaceTransform(screenSpaceTransform);
-    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(opaquePaintRect);
-    layer->invalidateRect(opaquePaintRect);
-    layer->prepareToUpdate(contentBounds);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    EXPECT_EQ_RECT(screenSpaceTransform.mapRect(intersection(opaquePaintRect, visibleBounds)), occluded.bounds());
-    EXPECT_EQ(1u, occluded.rects().size());
-
-    // But a non-axis-aligned transform does not get considered for occlusion.
-    transform.translate(contentBounds.width() / 2.0, contentBounds.height() / 2.0);
-    transform.rotate(5);
-    transform.translate(-contentBounds.width() / 2.0, -contentBounds.height() / 2.0);
-    screenSpaceTransform.translate(contentBounds.width() / 2.0, contentBounds.height() / 2.0);
-    screenSpaceTransform *= transform;
-    screenSpaceTransform.translate(-contentBounds.width() / 2.0, -contentBounds.height() / 2.0);
-    layer->setScreenSpaceTransform(screenSpaceTransform);
-    layer->prepareToUpdate(contentBounds);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    // FIXME: If we find an opaque rect contained in the rotated non-axis-aligned rect, then
-    // this won't be an empty result.
-    EXPECT_EQ_RECT(IntRect(), occluded.bounds());
-    EXPECT_EQ(0u, occluded.rects().size());
-}
-
 TEST(TiledLayerChromiumTest, resizeToSmaller)
 {
     OwnPtr<TextureManager> textureManager = TextureManager::create(60*1024*1024, 60*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    Region noOcclusion;
 
     layer->setBounds(IntSize(700, 700));
     layer->invalidateRect(IntRect(0, 0, 700, 700));
-    layer->prepareToUpdate(IntRect(0, 0, 700, 700));
+    layer->prepareToUpdate(IntRect(0, 0, 700, 700), noOcclusion);
 
     layer->setBounds(IntSize(200, 200));
     layer->invalidateRect(IntRect(0, 0, 200, 200));
@@ -749,4 +783,238 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     WebKit::WebCompositor::shutdown();
 }
 
+TEST(TiledLayerChromiumTest, tilesPaintedWithoutOcclusion)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    Region occluded;
+
+    // The tile size is 100x100, so this invalidates and then paints two tiles.
+    layer->setBounds(IntSize(100, 200));
+
+    layer->invalidateRect(IntRect(0, 0, 100, 200));
+    layer->prepareToUpdate(IntRect(0, 0, 100, 200), occluded);
+    EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->prepareRectCount());
+}
+
+TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    Region occluded;
+
+    // The tile size is 100x100.
+
+    layer->setBounds(IntSize(600, 600));
+
+    occluded = IntRect(200, 200, 300, 100);
+    layer->setVisibleLayerRect(IntRect(IntPoint(), layer->bounds()));
+    layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
+
+    layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+
+    occluded = IntRect(250, 200, 300, 100);
+    layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    EXPECT_EQ(36-2, layer->fakeLayerTextureUpdater()->prepareRectCount());
+
+    layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+
+    occluded = IntRect(250, 250, 300, 100);
+    layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    EXPECT_EQ(36, layer->fakeLayerTextureUpdater()->prepareRectCount());
+}
+
+TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    Region occluded;
+
+    // The tile size is 100x100.
+
+    layer->setBounds(IntSize(600, 600));
+
+    // The partially occluded tiles (by the 150 occlusion height) are visible beyond the occlusion, so not culled.
+    occluded = IntRect(200, 200, 300, 150);
+    layer->setVisibleLayerRect(IntRect(0, 0, 600, 360));
+    layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
+
+    layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+
+    // Now the visible region stops at the edge of the occlusion so the partly visible tiles become fully occluded.
+    occluded = IntRect(200, 200, 300, 150);
+    layer->setVisibleLayerRect(IntRect(0, 0, 600, 350));
+    layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    EXPECT_EQ(36-6, layer->fakeLayerTextureUpdater()->prepareRectCount());
+
+    layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+
+    // Now the visible region is even smaller than the occlusion, it should have the same result.
+    occluded = IntRect(200, 200, 300, 150);
+    layer->setVisibleLayerRect(IntRect(0, 0, 600, 340));
+    layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    EXPECT_EQ(36-6, layer->fakeLayerTextureUpdater()->prepareRectCount());
+}
+
+TEST(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    Region occluded;
+
+    // The tile size is 100x100.
+
+    layer->setBounds(IntSize(600, 600));
+
+    occluded = IntRect(200, 200, 300, 100);
+    layer->setVisibleLayerRect(IntRect(0, 0, 600, 600));
+    layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
+
+    layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+
+    // Repaint without marking it dirty.
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    EXPECT_EQ(0, layer->fakeLayerTextureUpdater()->prepareRectCount());
+}
+
+TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndTransforms)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    Region occluded;
+
+    // The tile size is 100x100.
+
+    // This makes sure the painting works when the occluded region (in screen space)
+    // is transformed differently than the layer.
+    layer->setBounds(IntSize(600, 600));
+    TransformationMatrix screenTransform;
+    screenTransform.scale(0.5);
+    layer->setScreenSpaceTransform(screenTransform);
+
+    occluded = IntRect(100, 100, 150, 50);
+    layer->setVisibleLayerRect(IntRect(IntPoint(), layer->bounds()));
+    layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
+}
+
+TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    Region occluded;
+
+    // The tile size is 100x100.
+
+    // This makes sure the painting works when the content space is scaled to
+    // a different layer space. In this case tiles are scaled to be 200x200
+    // pixels, which means none should be occluded.
+    layer->setContentsScale(0.5);
+    layer->setBounds(IntSize(600, 600));
+
+    occluded = IntRect(200, 200, 300, 100);
+    layer->setVisibleLayerRect(IntRect(IntPoint(), layer->bounds()));
+    layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    // The content is half the size of the layer (so the number of tiles is fewer).
+    // In this case, the content is 300x300, and since the tile size is 100, the
+    // number of tiles 3x3.
+    EXPECT_EQ(9, layer->fakeLayerTextureUpdater()->prepareRectCount());
+
+    layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+
+    // This makes sure the painting works when the content space is scaled to
+    // a different layer space. In this case the occluded region catches the
+    // blown up tiles.
+    occluded = IntRect(200, 200, 300, 200);
+    layer->setVisibleLayerRect(IntRect(IntPoint(), layer->bounds()));
+    layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    EXPECT_EQ(9-1, layer->fakeLayerTextureUpdater()->prepareRectCount());
+
+    layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+
+    // This makes sure content scaling and transforms work together.
+    TransformationMatrix screenTransform;
+    screenTransform.scale(0.5);
+    layer->setScreenSpaceTransform(screenTransform);
+
+    occluded = IntRect(100, 100, 150, 100);
+    layer->setVisibleLayerRect(IntRect(IntPoint(), layer->bounds()));
+    layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->prepareToUpdate(IntRect(0, 0, 600, 600), occluded);
+    EXPECT_EQ(9-1, layer->fakeLayerTextureUpdater()->prepareRectCount());
+}
+
+TEST(TiledLayerChromiumTest, opaqueContentsRegion)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+
+    // The tile size is 100x100, so this invalidates and then paints two tiles in various ways.
+
+    IntRect opaquePaintRect;
+    Region opaqueContents;
+    Region noOcclusion;
+
+    IntRect contentBounds = IntRect(0, 0, 100, 200);
+    IntRect visibleBounds = IntRect(0, 0, 100, 150);
+
+    layer->setBounds(contentBounds.size());
+    layer->setVisibleLayerRect(visibleBounds);
+    layer->setDrawOpacity(1);
+
+    // If the layer doesn't paint opaque content, then the opaqueContentsRegion should be empty.
+    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(opaquePaintRect);
+    layer->invalidateRect(contentBounds);
+    layer->prepareToUpdate(contentBounds, noOcclusion);
+    opaqueContents = layer->opaqueContentsRegion();
+    EXPECT_TRUE(opaqueContents.isEmpty());
+
+    // opaqueContentsRegion should match the visible part of what is painted opaque.
+    opaquePaintRect = IntRect(10, 10, 90, 190);
+    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(opaquePaintRect);
+    layer->invalidateRect(contentBounds);
+    layer->prepareToUpdate(contentBounds, noOcclusion);
+    opaqueContents = layer->opaqueContentsRegion();
+    EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
+    EXPECT_EQ(1u, opaqueContents.rects().size());
+
+    // If we paint again without invalidating, the same stuff should be opaque.
+    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
+    layer->prepareToUpdate(contentBounds, noOcclusion);
+    opaqueContents = layer->opaqueContentsRegion();
+    EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
+    EXPECT_EQ(1u, opaqueContents.rects().size());
+
+    // If we repaint a non-opaque part of the tile, then it shouldn't lose its opaque-ness. And other tiles should
+    // not be affected.
+    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
+    layer->invalidateRect(IntRect(0, 0, 1, 1));
+    layer->prepareToUpdate(contentBounds, noOcclusion);
+    opaqueContents = layer->opaqueContentsRegion();
+    EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
+    EXPECT_EQ(1u, opaqueContents.rects().size());
+
+    // If we repaint an opaque part of the tile, then it should lose its opaque-ness. But other tiles should still
+    // not be affected.
+    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
+    layer->invalidateRect(IntRect(10, 10, 1, 1));
+    layer->prepareToUpdate(contentBounds, noOcclusion);
+    opaqueContents = layer->opaqueContentsRegion();
+    EXPECT_EQ_RECT(intersection(IntRect(10, 100, 90, 100), visibleBounds), opaqueContents.bounds());
+    EXPECT_EQ(1u, opaqueContents.rects().size());
+}
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/TransparencyWinTest.cpp b/Source/WebKit/chromium/tests/TransparencyWinTest.cpp
index 54898ca8a..5052bb166 100644
--- a/Source/WebKit/chromium/tests/TransparencyWinTest.cpp
+++ b/Source/WebKit/chromium/tests/TransparencyWinTest.cpp
@@ -100,7 +100,7 @@ static std::ostream& operator<<(std::ostream& out, const Color& c)
 
 TEST(TransparencyWin, NoLayer)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(17, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(17, 16), 1, ColorSpaceDeviceRGB));
 
     // KeepTransform
     {
@@ -139,7 +139,7 @@ TEST(TransparencyWin, NoLayer)
 
 TEST(TransparencyWin, WhiteLayer)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), 1, ColorSpaceDeviceRGB));
 
     // KeepTransform
     {
@@ -191,7 +191,7 @@ TEST(TransparencyWin, WhiteLayer)
 
 TEST(TransparencyWin, TextComposite)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), 1, ColorSpaceDeviceRGB));
 
     // KeepTransform is the only valid transform mode for TextComposite.
     {
@@ -210,7 +210,7 @@ TEST(TransparencyWin, TextComposite)
 
 TEST(TransparencyWin, OpaqueCompositeLayer)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), 1, ColorSpaceDeviceRGB));
 
     // KeepTransform
     {
@@ -280,7 +280,7 @@ TEST(TransparencyWin, OpaqueCompositeLayer)
 TEST(TransparencyWin, WhiteLayerPixelTest)
 {
     // Make a total transparent buffer, and draw the white layer inset by 1 px.
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), 1, ColorSpaceDeviceRGB));
 
     {
         TransparencyWin helper;
@@ -309,7 +309,7 @@ TEST(TransparencyWin, OpaqueCompositeLayerPixel)
     Color green(0xFF00FF00);
 
     // Make a red bottom layer, followed by a half green next layer @ 50%.
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), 1, ColorSpaceDeviceRGB));
 
     FloatRect fullRect(0, 0, 16, 16);
     src->context()->fillRect(fullRect, red, ColorSpaceDeviceRGB);
@@ -362,7 +362,7 @@ TEST(TransparencyWin, OpaqueCompositeLayerPixel)
 TEST(TransparencyWin, TranslateOpaqueCompositeLayer)
 {
     // Fill with white.
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), 1, ColorSpaceDeviceRGB));
     Color white(0xFFFFFFFF);
     FloatRect fullRect(0, 0, 16, 16);
     src->context()->fillRect(fullRect, white, ColorSpaceDeviceRGB);
@@ -399,7 +399,7 @@ TEST(TransparencyWin, TranslateOpaqueCompositeLayer)
 // tests that the propert transform is applied to the copied layer.
 TEST(TransparencyWin, RotateOpaqueCompositeLayer)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), 1, ColorSpaceDeviceRGB));
 
     // The background is white.
     Color white(0xFFFFFFFF);
@@ -478,7 +478,7 @@ TEST(TransparencyWin, RotateOpaqueCompositeLayer)
 
 TEST(TransparencyWin, DISABLED_TranslateScaleOpaqueCompositeLayer)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), 1, ColorSpaceDeviceRGB));
 
     // The background is white on top with red on bottom.
     Color white(0xFFFFFFFF);
@@ -526,7 +526,7 @@ TEST(TransparencyWin, DISABLED_TranslateScaleOpaqueCompositeLayer)
 TEST(TransparencyWin, Scale)
 {
     // Create an opaque white buffer.
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), 1, ColorSpaceDeviceRGB));
     FloatRect fullBuffer(0, 0, 16, 16);
     src->context()->fillRect(fullBuffer, Color::white, ColorSpaceDeviceRGB);
 
@@ -579,7 +579,7 @@ TEST(TransparencyWin, Scale)
 TEST(TransparencyWin, ScaleTransparency)
 {
     // Create an opaque white buffer.
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), 1, ColorSpaceDeviceRGB));
     FloatRect fullBuffer(0, 0, 16, 16);
     src->context()->fillRect(fullBuffer, Color::white, ColorSpaceDeviceRGB);
 
@@ -637,7 +637,7 @@ TEST(TransparencyWin, ScaleTransparency)
 
 TEST(TransparencyWin, Text)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), 1, ColorSpaceDeviceRGB));
 
     // Our text should end up 50% transparent blue-green.
     Color fullResult(0x80008080);
diff --git a/Source/WebKit/chromium/tests/TreeSynchronizerTest.cpp b/Source/WebKit/chromium/tests/TreeSynchronizerTest.cpp
index 4724b4a43..eb3850dab 100644
--- a/Source/WebKit/chromium/tests/TreeSynchronizerTest.cpp
+++ b/Source/WebKit/chromium/tests/TreeSynchronizerTest.cpp
@@ -41,9 +41,9 @@ namespace {
 
 class MockCCLayerImpl : public CCLayerImpl {
 public:
-    static PassRefPtr<MockCCLayerImpl> create(int layerId)
+    static PassOwnPtr<MockCCLayerImpl> create(int layerId)
     {
-        return adoptRef(new MockCCLayerImpl(layerId));
+        return adoptPtr(new MockCCLayerImpl(layerId));
     }
     virtual ~MockCCLayerImpl()
     {
@@ -72,7 +72,7 @@ public:
 
     virtual ~MockLayerChromium() { }
 
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl()
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl()
     {
         return MockCCLayerImpl::create(m_layerId);
     }
@@ -134,7 +134,7 @@ void expectTreesAreIdentical(LayerChromium* layer, CCLayerImpl* ccLayer)
         expectTreesAreIdentical(layer->replicaLayer(), ccLayer->replicaLayer());
 
     const Vector<RefPtr<LayerChromium> >& layerChildren = layer->children();
-    const Vector<RefPtr<CCLayerImpl> >& ccLayerChildren = ccLayer->children();
+    const Vector<OwnPtr<CCLayerImpl> >& ccLayerChildren = ccLayer->children();
 
     ASSERT_EQ(layerChildren.size(), ccLayerChildren.size());
 
@@ -150,7 +150,7 @@ TEST(TreeSynchronizerTest, syncSimpleTreeFromEmpty)
     layerTreeRoot->addChild(LayerChromium::create());
     layerTreeRoot->addChild(LayerChromium::create());
 
-    RefPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), 0);
+    OwnPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), nullptr);
 
     expectTreesAreIdentical(layerTreeRoot.get(), ccLayerTreeRoot.get());
 }
@@ -165,7 +165,7 @@ TEST(TreeSynchronizerTest, syncSimpleTreeReusingLayers)
     layerTreeRoot->addChild(MockLayerChromium::create(&ccLayerDestructionList));
     layerTreeRoot->addChild(MockLayerChromium::create(&ccLayerDestructionList));
 
-    RefPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), 0);
+    OwnPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), nullptr);
     expectTreesAreIdentical(layerTreeRoot.get(), ccLayerTreeRoot.get());
 
     // Add a new layer to the LayerChromium side
@@ -199,7 +199,7 @@ TEST(TreeSynchronizerTest, syncSimpleTreeAndProperties)
     IntSize secondChildBounds = IntSize(25, 53);
     layerTreeRoot->children()[1]->setBounds(secondChildBounds);
 
-    RefPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), 0);
+    OwnPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), nullptr);
     expectTreesAreIdentical(layerTreeRoot.get(), ccLayerTreeRoot.get());
 
     // Check that the property values we set on the LayerChromium tree are reflected in the CCLayerImpl tree.
@@ -236,7 +236,7 @@ TEST(TreeSynchronizerTest, reuseCCLayersAfterStructuralChange)
     layerB->addChild(MockLayerChromium::create(&ccLayerDestructionList));
     RefPtr<LayerChromium> layerD = layerB->children()[1].get();
 
-    RefPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), 0);
+    OwnPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), nullptr);
     expectTreesAreIdentical(layerTreeRoot.get(), ccLayerTreeRoot.get());
 
     // Now restructure the tree to look like this:
@@ -274,7 +274,7 @@ TEST(TreeSynchronizerTest, syncSimpleTreeThenDestroy)
     int oldTreeFirstChildLayerId = oldLayerTreeRoot->children()[0]->id();
     int oldTreeSecondChildLayerId = oldLayerTreeRoot->children()[1]->id();
 
-    RefPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(oldLayerTreeRoot.get(), 0);
+    OwnPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(oldLayerTreeRoot.get(), nullptr);
     expectTreesAreIdentical(oldLayerTreeRoot.get(), ccLayerTreeRoot.get());
 
     // Remove all children on the LayerChromium side.
@@ -314,23 +314,23 @@ TEST(TreeSynchronizerTest, syncMaskReplicaAndReplicaMaskLayers)
     replicaLayerWithMask->setMaskLayer(replicaMaskLayer.get());
     layerTreeRoot->children()[2]->setReplicaLayer(replicaLayerWithMask.get());
 
-    RefPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), 0);
+    OwnPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), nullptr);
 
     expectTreesAreIdentical(layerTreeRoot.get(), ccLayerTreeRoot.get());
 
     // Remove the mask layer.
     layerTreeRoot->children()[0]->setMaskLayer(0);
-    ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), ccLayerTreeRoot.get());
+    ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), ccLayerTreeRoot.release());
     expectTreesAreIdentical(layerTreeRoot.get(), ccLayerTreeRoot.get());
 
     // Remove the replica layer.
     layerTreeRoot->children()[1]->setReplicaLayer(0);
-    ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), ccLayerTreeRoot.get());
+    ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), ccLayerTreeRoot.release());
     expectTreesAreIdentical(layerTreeRoot.get(), ccLayerTreeRoot.get());
 
     // Remove the replica mask.
     replicaLayerWithMask->setMaskLayer(0);
-    ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), ccLayerTreeRoot.get());
+    ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), ccLayerTreeRoot.release());
     expectTreesAreIdentical(layerTreeRoot.get(), ccLayerTreeRoot.get());
 }
 
@@ -343,8 +343,8 @@ TEST(TreeSynchronizerTest, synchronizeAnimations)
 
     EXPECT_FALSE(static_cast<FakeLayerAnimationController*>(layerTreeRoot->layerAnimationController())->synchronizedAnimations());
 
-    RefPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), 0);
-    ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), ccLayerTreeRoot.get());
+    OwnPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), nullptr);
+    ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), ccLayerTreeRoot.release());
 
     EXPECT_TRUE(static_cast<FakeLayerAnimationController*>(layerTreeRoot->layerAnimationController())->synchronizedAnimations());
 }
diff --git a/Source/WebKit/chromium/tests/WebFrameTest.cpp b/Source/WebKit/chromium/tests/WebFrameTest.cpp
index f61e98648..481bd916f 100644
--- a/Source/WebKit/chromium/tests/WebFrameTest.cpp
+++ b/Source/WebKit/chromium/tests/WebFrameTest.cpp
@@ -186,27 +186,27 @@ TEST_F(WebFrameTest, DivAutoZoomParamsTest)
     EXPECT_EQ(vScroll, scroll.y);
 
     // Test zoom out to overview scale.
-    webViewImpl->applyScrollAndScale(WebCore::IntSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
+    webViewImpl->applyScrollAndScale(WebSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
     webViewImpl->computeScaleAndScrollForHitRect(doubleTapPoint, WebViewImpl::DoubleTap, scale, scroll);
     EXPECT_FLOAT_EQ(1, scale);
     EXPECT_EQ(WebPoint(0, 0), scroll);
 
     // Tests for clamped scaling.
     // Test clamp to device scale:
-    webViewImpl->applyScrollAndScale(WebCore::IntSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
+    webViewImpl->applyScrollAndScale(WebSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
     webViewImpl->setDeviceScaleFactor(2.5);
     webViewImpl->computeScaleAndScrollForHitRect(doubleTapPoint, WebViewImpl::DoubleTap, scale, scroll);
     EXPECT_FLOAT_EQ(2.5, scale);
 
     // Test clamp to minimum scale:
-    webViewImpl->applyScrollAndScale(WebCore::IntSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
+    webViewImpl->applyScrollAndScale(WebSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
     webViewImpl->setPageScaleFactorLimits(1.5 / webViewImpl->deviceScaleFactor(), 4 / webViewImpl->deviceScaleFactor());
     webViewImpl->computeScaleAndScrollForHitRect(doubleTapPoint, WebViewImpl::DoubleTap, scale, scroll);
     EXPECT_FLOAT_EQ(1.5, scale);
     EXPECT_EQ(WebPoint(0, 0), scroll);
 
     // Test clamp to maximum scale:
-    webViewImpl->applyScrollAndScale(WebCore::IntSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
+    webViewImpl->applyScrollAndScale(WebSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
     webViewImpl->setDeviceScaleFactor(4);
     webViewImpl->setPageScaleFactorLimits(0, 3 / webViewImpl->deviceScaleFactor());
     webViewImpl->computeScaleAndScrollForHitRect(doubleTapPoint, WebViewImpl::DoubleTap, scale, scroll);
@@ -322,12 +322,12 @@ public:
     std::vector<Notification*> releaseNotifications;
 
  private:
-    virtual void didCreateScriptContext(WebFrame* frame, v8::Handle<v8::Context> context, int worldId)
+    virtual void didCreateScriptContext(WebFrame* frame, v8::Handle<v8::Context> context, int extensionGroup, int worldId) OVERRIDE
     {
         createNotifications.push_back(new Notification(frame, context, worldId));
     }
 
-    virtual void willReleaseScriptContext(WebFrame* frame, v8::Handle<v8::Context> context, int worldId)
+    virtual void willReleaseScriptContext(WebFrame* frame, v8::Handle<v8::Context> context, int worldId) OVERRIDE
     {
         releaseNotifications.push_back(new Notification(frame, context, worldId));
     }
diff --git a/Source/WebKit/chromium/tests/WebLayerTest.cpp b/Source/WebKit/chromium/tests/WebLayerTest.cpp
index e0cab87bd..1eed81aea 100644
--- a/Source/WebKit/chromium/tests/WebLayerTest.cpp
+++ b/Source/WebKit/chromium/tests/WebLayerTest.cpp
@@ -57,6 +57,8 @@ public:
     virtual void applyScrollAndScale(const WebSize& scrollDelta, float scaleFactor) { }
     virtual WebGraphicsContext3D* createContext3D() { return CompositorFakeWebGraphicsContext3D::create(WebGraphicsContext3D::Attributes()).leakPtr(); }
     virtual void didRebindGraphicsContext(bool success) { }
+    virtual void didCommitAndDrawFrame() { }
+    virtual void didCompleteSwapBuffers() { }
 };
 
 class MockWebContentLayerClient : public WebContentLayerClient {
@@ -72,7 +74,7 @@ public:
         WebKit::WebCompositor::initialize(0);
         m_rootLayer = WebLayer::create();
         EXPECT_CALL(m_client, scheduleComposite()).Times(AnyNumber());
-        m_view = WebLayerTreeView::create(&m_client, m_rootLayer, WebLayerTreeView::Settings());
+        EXPECT_TRUE(m_view.initialize(&m_client, m_rootLayer, WebLayerTreeView::Settings()));
         Mock::VerifyAndClearExpectations(&m_client);
     }
 
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index db22d44eb..09d0e7796 100644
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,166 @@
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Rename NotificationPresenter to NotificationClient
+        https://bugs.webkit.org/show_bug.cgi?id=80488
+        <rdar://problem/10965558>
+
+        Reviewed by Kentaro Hara.
+
+        Refactor to use renamed WebCore::NotificationClient.
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        (WebCore::ChromeClientEfl::notificationPresenter):
+        * WebCoreSupport/ChromeClientEfl.h:
+        (ChromeClientEfl):
+
+2012-03-08  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [Texmap][EFL] Implementation of AcceleratedCompositingContext for EFL port
+        https://bugs.webkit.org/show_bug.cgi?id=80266
+
+        Reviewed by Noam Rosenthal.
+
+        This patch adds EFL's implementation of AcceleratedCompositingContext to WebCoreSupport.
+
+        * WebCoreSupport/AcceleratedCompositingContextEfl.cpp: Added.
+        (WebCore):
+        (WebCore::AcceleratedCompositingContext::create):
+        (WebCore::AcceleratedCompositingContext::AcceleratedCompositingContext):
+        (WebCore::AcceleratedCompositingContext::~AcceleratedCompositingContext):
+        (WebCore::AcceleratedCompositingContext::initialize):
+        (WebCore::AcceleratedCompositingContext::syncLayersNow):
+        (WebCore::AcceleratedCompositingContext::renderLayers):
+        (WebCore::AcceleratedCompositingContext::attachRootGraphicsLayer):
+        (WebCore::AcceleratedCompositingContext::context):
+        * WebCoreSupport/AcceleratedCompositingContextEfl.h: Added.
+        (WebCore):
+        (AcceleratedCompositingContext):
+
+2012-03-02  Grzegorz Czajkowski  <g.czajkowski@samsung.com>
+
+        [EFL] Enabling 'Inspect Element' in Ewk_Context_Menu_Action.
+        https://bugs.webkit.org/show_bug.cgi?id=79646
+
+        Reviewed by Andreas Kling.
+
+        INSPECTOR feature is already enabled for WebKit-Efl port (OptionsEfl.cmake).
+        As a result WebCore's ContextMenuAction contains ContextMenuItemTagInspectElement
+        and enums order has been changed. WebKit-Efl has to synchronize ContextMenuAction
+        with Ewk_Context_Menu_Action.
+        To avoid similar case in the feature I added checks between WebCore and
+        WebKit-EFL's enums by using COMPILE_ASSERT_MATCHING_ENUM.
+
+        * WebCoreSupport/AssertMatchingEnums.cpp:
+        * ewk/ewk_contextmenu.h:
+
+2012-02-29  Tomasz Morawski  <t.morawski@samsung.com>
+
+        [EFL] Replace malloc/calloc/free to new/delete.
+        https://bugs.webkit.org/show_bug.cgi?id=75848
+
+        Reviewed by Hajime Morita.
+
+        Replaced almost all malloc/calloc/free to new/delete operator and where it was possible smart pointers were also
+        used. Left few c memory allocation by intention to not mix c and c++ memory managment. Left malloc for Ewk_Tile
+        object due to const fields present in Ewk_tile structure.
+
+        * ewk/ewk_auth_soup.cpp:
+        * ewk/ewk_contextmenu.cpp:
+        (ewk_context_menu_unref):
+        (ewk_context_menu_item_new):
+        (ewk_context_menu_item_free):
+        (ewk_context_menu_new):
+        * ewk/ewk_cookies.cpp:
+        (ewk_cookies_get_all):
+        (ewk_cookies_cookie_free):
+        * ewk/ewk_frame.cpp:
+        (ewk_frame_hit_test_free):
+        (ewk_frame_hit_test_new):
+        * ewk/ewk_history.cpp:
+        (ewk_history_item_new_from_core):
+        (_ewk_history_item_free):
+        (ewk_history_new):
+        (ewk_history_free):
+        * ewk/ewk_tiled_backing_store.cpp:
+        (_Ewk_Tiled_Backing_Store_Item):
+        (_ewk_tiled_backing_store_pre_render_request_add):
+        (_ewk_tiled_backing_store_pre_render_request_del):
+        (_ewk_tiled_backing_store_pre_render_request_flush):
+        (_ewk_tiled_backing_store_pre_render_request_clear):
+        (_ewk_tiled_backing_store_item_add):
+        (_ewk_tiled_backing_store_item_del):
+        * ewk/ewk_tiled_matrix.cpp:
+        (_ewk_tile_matrix_tile_free):
+        (ewk_tile_matrix_new):
+        (ewk_tile_matrix_zoom_level_set):
+        (ewk_tile_matrix_invalidate):
+        (ewk_tile_matrix_free):
+        * ewk/ewk_tiled_model.cpp:
+        (tile_account):
+        (ewk_tile_unused_cache_new):
+        (_ewk_tile_unused_cache_free):
+        (ewk_tile_unused_cache_clear):
+        (ewk_tile_unused_cache_flush):
+        (ewk_tile_unused_cache_tile_get):
+        (ewk_tile_unused_cache_tile_put):
+        * ewk/ewk_tiled_private.h:
+        * ewk/ewk_view.cpp:
+        (_Ewk_View_Private_Data):
+        (_ewk_view_core_frame_new):
+        (_ewk_view_priv_new):
+        (_ewk_view_priv_del):
+        (ewk_view_core_page_get):
+        (ewk_view_popup_new):
+        (ewk_view_popup_destroy):
+        (EWKPrivate::corePage):
+        * ewk/ewk_window_features.cpp:
+        (ewk_window_features_unref):
+        (ewk_window_features_new_from_core):
+
+2012-02-27  JungJik Lee  <jungjik.lee@samsung.com>
+
+        [EFL] Pairing up between evas_object_image_data_get and evas_object_image_data_set.
+        https://bugs.webkit.org/show_bug.cgi?id=79031
+
+        Reviewed by Zoltan Herczeg.
+
+        - Get the pixel data when the cairo surface is created.
+        - evas_object_image_data_get increases the reference count and returns the image buffer pointer.
+        evas_object_image_data_set decreases the reference count and when the ref count become zero,
+        the function releases the cached image inside evas engine.
+        We should make a pair between evas_object_image_data_set/get to return evas resource.
+
+        * ewk/ewk_tiled_backing_store.h:
+        (_Ewk_Tile):
+        * ewk/ewk_tiled_model.cpp:
+        (tile_account):
+        (ewk_tile_new):
+        * ewk/ewk_view_tiled.cpp:
+        (_ewk_view_tiled_render_cb):
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        * WebCoreSupport/ChromeClientEfl.h:
+        (ChromeClientEfl):
+
+2012-02-24  Grzegorz Czajkowski  <g.czajkowski@samsung.com>
+
+        [EFL][DRT] Implement setValueForUser and setAutofilled.
+        https://bugs.webkit.org/show_bug.cgi?id=79237
+
+        Reviewed by Andreas Kling.
+
+        Adds missing implementation setValueForUser and setAutofilled to EFL's DumpRenderTreeSupport.
+
+        * WebCoreSupport/DumpRenderTreeSupportEfl.cpp:
+        (DumpRenderTreeSupportEfl::setValueForUser):
+        (DumpRenderTreeSupportEfl::setAutofilled):
+        * WebCoreSupport/DumpRenderTreeSupportEfl.h:
+
 2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
 
         SpellCheckRequest needs to know the context where the spellcheck happened.
diff --git a/Source/WebKit/efl/WebCoreSupport/AcceleratedCompositingContextEfl.cpp b/Source/WebKit/efl/WebCoreSupport/AcceleratedCompositingContextEfl.cpp
new file mode 100755
index 000000000..75f8632f5
--- /dev/null
+++ b/Source/WebKit/efl/WebCoreSupport/AcceleratedCompositingContextEfl.cpp
@@ -0,0 +1,121 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER_GL)
+
+#include "AcceleratedCompositingContextEfl.h"
+
+#include "FrameView.h"
+#include "GraphicsContext3D.h"
+#include "HostWindow.h"
+#include "PageClientEfl.h"
+#include "TextureMapperGL.h"
+#include "TextureMapperLayer.h"
+
+namespace WebCore {
+
+PassOwnPtr<AcceleratedCompositingContext> AcceleratedCompositingContext::create(HostWindow* hostWindow)
+{
+    OwnPtr<AcceleratedCompositingContext> context = adoptPtr(new AcceleratedCompositingContext);
+    if (!context->initialize(hostWindow))
+        return nullptr;
+
+    return context.release();
+}
+
+AcceleratedCompositingContext::AcceleratedCompositingContext()
+    : m_view(0)
+    , m_rootTextureMapperLayer(0)
+{
+}
+
+AcceleratedCompositingContext::~AcceleratedCompositingContext()
+{
+}
+
+bool AcceleratedCompositingContext::initialize(HostWindow* hostWindow)
+{
+    m_view = hostWindow->platformPageClient()->view();
+    if (!m_view)
+        return false;
+
+    m_context3D = GraphicsContext3D::create(GraphicsContext3D::Attributes(), hostWindow, WebCore::GraphicsContext3D::RenderDirectlyToHostWindow);
+    if (!m_context3D)
+        return false;
+
+    return true;
+}
+
+void AcceleratedCompositingContext::syncLayersNow()
+{
+    if (m_rootGraphicsLayer)
+        m_rootGraphicsLayer->syncCompositingStateForThisLayerOnly();
+
+    ewk_view_core_page_get(m_view)->mainFrame()->view()->syncCompositingStateIncludingSubframes();
+}
+
+void AcceleratedCompositingContext::renderLayers()
+{
+    if (!m_rootGraphicsLayer)
+        return;
+
+    if (!m_context3D->makeContextCurrent())
+        return;
+
+    int width = 0;
+    int height = 0;
+    evas_object_geometry_get(m_view, 0, 0, &width, &height);
+    m_context3D->viewport(0, 0, width, height);
+
+    m_textureMapper->beginPainting();
+    m_rootTextureMapperLayer->paint();
+    m_textureMapper->endPainting();
+}
+
+void AcceleratedCompositingContext::attachRootGraphicsLayer(GraphicsLayer* rootLayer)
+{
+    if (!rootLayer) {
+        m_rootGraphicsLayer.clear();
+        m_rootTextureMapperLayer = 0;
+        return;
+    }
+
+    m_rootGraphicsLayer = WebCore::GraphicsLayer::create(0);
+    m_rootTextureMapperLayer = toTextureMapperLayer(m_rootGraphicsLayer.get());
+    m_rootGraphicsLayer->addChild(rootLayer);
+    m_rootGraphicsLayer->setDrawsContent(false);
+    m_rootGraphicsLayer->setMasksToBounds(false);
+    m_rootGraphicsLayer->setSize(WebCore::IntSize(1, 1));
+
+    m_textureMapper = TextureMapperGL::create();
+    m_rootTextureMapperLayer->setTextureMapper(m_textureMapper.get());
+
+    m_rootGraphicsLayer->syncCompositingStateForThisLayerOnly();
+}
+
+GraphicsContext3D* AcceleratedCompositingContext::context()
+{
+    return m_context3D.get();
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER_GL)
diff --git a/Source/WebKit/efl/WebCoreSupport/AcceleratedCompositingContextEfl.h b/Source/WebKit/efl/WebCoreSupport/AcceleratedCompositingContextEfl.h
new file mode 100755
index 000000000..50b89b9ca
--- /dev/null
+++ b/Source/WebKit/efl/WebCoreSupport/AcceleratedCompositingContextEfl.h
@@ -0,0 +1,64 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef AcceleratedCompositingContextEfl_h
+#define AcceleratedCompositingContextEfl_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER_GL)
+
+#include "ewk_private.h"
+
+namespace WebCore {
+
+class HostWindow;
+class TextureMapper;
+class TextureMapperLayer;
+
+class AcceleratedCompositingContext {
+    WTF_MAKE_NONCOPYABLE(AcceleratedCompositingContext);
+public:
+    static PassOwnPtr<AcceleratedCompositingContext> create(HostWindow*);
+    virtual ~AcceleratedCompositingContext();
+
+    virtual void syncLayersNow();
+    virtual void renderLayers();
+    virtual void attachRootGraphicsLayer(GraphicsLayer* rootLayer);
+    virtual GraphicsContext3D* context();
+
+private:
+    AcceleratedCompositingContext();
+
+    virtual bool initialize(HostWindow*);
+
+    Evas_Object* m_view;
+
+    OwnPtr<TextureMapper> m_textureMapper;
+    OwnPtr<GraphicsLayer> m_rootGraphicsLayer;
+    TextureMapperLayer* m_rootTextureMapperLayer;
+
+    RefPtr<GraphicsContext3D> m_context3D;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER_GL)
+#endif // AcceleratedCompositingContextEfl_h
diff --git a/Source/WebKit/efl/WebCoreSupport/AssertMatchingEnums.cpp b/Source/WebKit/efl/WebCoreSupport/AssertMatchingEnums.cpp
index bff2fcd3b..158cf0123 100644
--- a/Source/WebKit/efl/WebCoreSupport/AssertMatchingEnums.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/AssertMatchingEnums.cpp
@@ -23,8 +23,10 @@
 
 #include "config.h"
 
+#include "ContextMenuItem.h"
 #include "Page.h"
 #include "VisibleSelection.h"
+#include "ewk_contextmenu.h"
 #include "ewk_frame.h"
 #include "ewk_view.h"
 #include <wtf/Assertions.h>
@@ -62,3 +64,81 @@ COMPILE_ASSERT_MATCHING_ENUM(EWK_VIEW_MODE_FLOATING, Page::ViewModeFloating);
 COMPILE_ASSERT_MATCHING_ENUM(EWK_VIEW_MODE_FULLSCREEN, Page::ViewModeFullscreen);
 COMPILE_ASSERT_MATCHING_ENUM(EWK_VIEW_MODE_MAXIMIZED, Page::ViewModeMaximized);
 COMPILE_ASSERT_MATCHING_ENUM(EWK_VIEW_MODE_MINIMIZED, Page::ViewModeMinimized);
+
+#if ENABLE(CONTEXT_MENUS)
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_NO_ACTION, ContextMenuItemTagNoAction);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_OPEN_LINK_IN_NEW_WINDOW, ContextMenuItemTagOpenLinkInNewWindow);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_DOWNLOAD_LINK_TO_DISK, ContextMenuItemTagDownloadLinkToDisk);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_COPY_LINK_TO_CLIPBOARD, ContextMenuItemTagCopyLinkToClipboard);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_OPEN_IMAGE_IN_NEW_WINDOW, ContextMenuItemTagOpenImageInNewWindow);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_DOWNLOAD_IMAGE_TO_DISK, ContextMenuItemTagDownloadImageToDisk);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_COPY_IMAGE_TO_CLIPBOARD, ContextMenuItemTagCopyImageToClipboard);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_COPY_IMAGE_URL_TO_CLIPBOARD, ContextMenuItemTagCopyImageUrlToClipboard);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_OPEN_FRAME_IN_NEW_WINDOW, ContextMenuItemTagOpenFrameInNewWindow);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_COPY, ContextMenuItemTagCopy);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_GO_BACK, ContextMenuItemTagGoBack);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_GO_FORWARD, ContextMenuItemTagGoForward);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_STOP, ContextMenuItemTagStop);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_RELOAD, ContextMenuItemTagReload);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_CUT, ContextMenuItemTagCut);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_PASTE, ContextMenuItemTagPaste);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_SELECT_ALL, ContextMenuItemTagSelectAll);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_SPELLING_GUESS, ContextMenuItemTagSpellingGuess);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_NO_GUESSES_FOUND, ContextMenuItemTagNoGuessesFound);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_IGNORE_SPELLING, ContextMenuItemTagIgnoreSpelling);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_LEARN_SPELLING, ContextMenuItemTagLearnSpelling);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_OTHER, ContextMenuItemTagOther);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_SEARCH_IN_SPOTLIGHT, ContextMenuItemTagSearchInSpotlight);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_SEARCH_WEB, ContextMenuItemTagSearchWeb);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_LOOK_UP_IN_DICTIONARY, ContextMenuItemTagLookUpInDictionary);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_OPEN_WITH_DEFAULT_APPLICATION, ContextMenuItemTagOpenWithDefaultApplication);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_PDFACTUAL_SIZE, ContextMenuItemPDFActualSize);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_PDFZOOM_IN, ContextMenuItemPDFZoomIn);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_PDFZOOM_OUT, ContextMenuItemPDFZoomOut);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_PDFAUTO_SIZE, ContextMenuItemPDFAutoSize);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_PDFSINGLE_PAGE, ContextMenuItemPDFSinglePage);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_PDFFACING_PAGES, ContextMenuItemPDFFacingPages);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_PDFCONTINUOUS, ContextMenuItemPDFContinuous);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_PDFNEXT_PAGE, ContextMenuItemPDFNextPage);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_PDFPREVIOUS_PAGE, ContextMenuItemPDFPreviousPage);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_OPEN_LINK, ContextMenuItemTagOpenLink);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_IGNORE_GRAMMAR, ContextMenuItemTagIgnoreGrammar);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_SPELLING_MENU, ContextMenuItemTagSpellingMenu);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_SHOW_SPELLING_PANEL, ContextMenuItemTagShowSpellingPanel);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_CHECK_SPELLING, ContextMenuItemTagCheckSpelling);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_CHECK_SPELLING_WHILE_TYPING, ContextMenuItemTagCheckSpellingWhileTyping);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_CHECK_GRAMMAR_WITH_SPELLING, ContextMenuItemTagCheckGrammarWithSpelling);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_FONT_MENU, ContextMenuItemTagFontMenu);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_SHOW_FONTS, ContextMenuItemTagShowFonts);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_BOLD, ContextMenuItemTagBold);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_ITALIC, ContextMenuItemTagItalic);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_UNDERLINE, ContextMenuItemTagUnderline);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_OUTLINE, ContextMenuItemTagOutline);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_STYLES, ContextMenuItemTagStyles);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_SHOW_COLORS, ContextMenuItemTagShowColors);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_SPEECH_MENU, ContextMenuItemTagSpeechMenu);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_START_SPEAKING, ContextMenuItemTagStartSpeaking);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_STOP_SPEAKING, ContextMenuItemTagStopSpeaking);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_WRITING_DIRECTION_MENU, ContextMenuItemTagWritingDirectionMenu);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_DEFAULT_DIRECTION, ContextMenuItemTagDefaultDirection);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_LEFT_TO_RIGHT, ContextMenuItemTagLeftToRight);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_RIGHT_TO_LEFT, ContextMenuItemTagRightToLeft);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_PDFSINGLE_PAGE_SCROLLING, ContextMenuItemTagPDFSinglePageScrolling);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_PDFFACING_PAGES_SCROLLING, ContextMenuItemTagPDFFacingPagesScrolling);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_INSPECT_ELEMENT, ContextMenuItemTagInspectElement);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_MENU, ContextMenuItemTagTextDirectionMenu);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_DEFAULT, ContextMenuItemTagTextDirectionDefault);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_LEFT_TO_RIGHT, ContextMenuItemTagTextDirectionLeftToRight);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_RIGHT_TO_LEFT, ContextMenuItemTagTextDirectionRightToLeft);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_OPEN_MEDIA_IN_NEW_WINDOW, ContextMenuItemTagOpenMediaInNewWindow);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_COPY_MEDIA_LINK_TO_CLIPBOARD, ContextMenuItemTagCopyMediaLinkToClipboard);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_TOGGLE_MEDIA_CONTROLS, ContextMenuItemTagToggleMediaControls);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_TOGGLE_MEDIA_LOOP, ContextMenuItemTagToggleMediaLoop);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_ENTER_VIDEO_FULLSCREEN, ContextMenuItemTagEnterVideoFullscreen);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_MEDIA_PLAY_PAUSE, ContextMenuItemTagMediaPlayPause);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_TAG_MEDIA_MUTE, ContextMenuItemTagMediaMute);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_BASE_CUSTOM_TAG, ContextMenuItemBaseCustomTag);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_CUSTOM_TAG_NO_ACTION, ContextMenuItemCustomTagNoAction);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_LAST_CUSTOM_TAG, ContextMenuItemLastCustomTag);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_CONTEXT_MENU_ITEM_BASE_APPLICATION_TAG, ContextMenuItemBaseApplicationTag);
+#endif
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
index a25f9d0e4..a58a11b33 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
@@ -418,7 +418,7 @@ void ChromeClientEfl::exceededDatabaseQuota(Frame* frame, const String& database
 #endif
 
 #if ENABLE(NOTIFICATIONS)
-NotificationPresenter* ChromeClientEfl::notificationPresenter() const
+NotificationClient* ChromeClientEfl::notificationPresenter() const
 {
     notImplemented();
     return 0;
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
index 82512251f..1526245e4 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
@@ -29,7 +29,7 @@
 #include "PopupMenu.h"
 
 #if ENABLE(NOTIFICATIONS)
-#include "NotificationPresenter.h"
+#include "NotificationClient.h"
 #endif
 
 typedef struct _Evas_Object Evas_Object;
@@ -115,16 +115,12 @@ public:
 #endif
 
 #if ENABLE(NOTIFICATIONS)
-    virtual WebCore::NotificationPresenter* notificationPresenter() const;
+    virtual WebCore::NotificationClient* notificationPresenter() const;
 #endif
 
     virtual void reachedMaxAppCacheSize(int64_t spaceNeeded);
     virtual void reachedApplicationCacheOriginQuota(SecurityOrigin*, int64_t totalSpaceNeeded);
 
-#if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() { }
-#endif
-
 #if ENABLE(TOUCH_EVENTS)
     virtual void needTouchEvents(bool);
 #endif
diff --git a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
index 2a4a9fcc9..fd3d6b50b 100644
--- a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
@@ -31,13 +31,16 @@
 #include <FindOptions.h>
 #include <FloatSize.h>
 #include <FrameView.h>
+#include <HTMLInputElement.h>
 #include <IntRect.h>
+#include <JSElement.h>
 #include <PrintContext.h>
 #include <RenderTreeAsText.h>
 #include <Settings.h>
 #include <bindings/js/GCController.h>
 #include <history/HistoryItem.h>
 #include <workers/WorkerThread.h>
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/text/AtomicString.h>
 
 unsigned DumpRenderTreeSupportEfl::activeAnimationsCount(const Evas_Object* ewkFrame)
@@ -279,6 +282,35 @@ void DumpRenderTreeSupportEfl::suspendAnimations(Evas_Object* ewkFrame)
         animationController->suspendAnimations();
 }
 
+void DumpRenderTreeSupportEfl::setValueForUser(JSContextRef context, JSValueRef nodeObject, JSStringRef value)
+{
+    JSC::ExecState* exec = toJS(context);
+    WebCore::Element* element = WebCore::toElement(toJS(exec, nodeObject));
+    if (!element)
+        return;
+    WebCore::HTMLInputElement* inputElement = element->toInputElement();
+    if (!inputElement)
+        return;
+
+    size_t bufferSize = JSStringGetMaximumUTF8CStringSize(value);
+    OwnArrayPtr<char> valueBuffer = adoptArrayPtr(new char[bufferSize]);
+    JSStringGetUTF8CString(value, valueBuffer.get(), bufferSize);
+    inputElement->setValueForUser(String::fromUTF8(valueBuffer.get()));
+}
+
+void DumpRenderTreeSupportEfl::setAutofilled(JSContextRef context, JSValueRef nodeObject, bool autofilled)
+{
+    JSC::ExecState* exec = toJS(context);
+    WebCore::Element* element = WebCore::toElement(toJS(exec, nodeObject));
+    if (!element)
+        return;
+    WebCore::HTMLInputElement* inputElement = element->toInputElement();
+    if (!inputElement)
+        return;
+
+    inputElement->setAutofilled(autofilled);
+}
+
 bool DumpRenderTreeSupportEfl::findString(const Evas_Object* ewkView, const char* text, WebCore::FindOptions options)
 {
     WebCore::Page* page = EWKPrivate::corePage(ewkView);
diff --git a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
index 42af811d3..950a78d67 100644
--- a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
@@ -24,6 +24,8 @@
 #include <Eina.h>
 #include <FindOptions.h>
 #include <IntRect.h>
+#include <JavaScriptCore/APICast.h>
+#include <JavaScriptCore/JSStringRef.h>
 #include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
 
@@ -60,6 +62,8 @@ public:
     static WebCore::IntRect selectionRectangle(const Evas_Object* ewkFrame);
     static String suitableDRTFrameName(const Evas_Object* ewkFrame);
     static void suspendAnimations(Evas_Object* ewkFrame);
+    static void setValueForUser(JSContextRef, JSValueRef nodeObject, JSStringRef value);
+    static void setAutofilled(JSContextRef, JSValueRef nodeObject, bool autofilled);
 
     static bool findString(const Evas_Object* ewkView, const char* text, WebCore::FindOptions);
 
diff --git a/Source/WebKit/efl/ewk/ewk_auth_soup.cpp b/Source/WebKit/efl/ewk/ewk_auth_soup.cpp
index 834dac7ac..d85427ddc 100644
--- a/Source/WebKit/efl/ewk/ewk_auth_soup.cpp
+++ b/Source/WebKit/efl/ewk/ewk_auth_soup.cpp
@@ -93,19 +93,13 @@ static void session_authenticate(SoupSession* session, SoupMessage* message, Sou
     if (!ewk_auth_show_dialog_callback)
         return;
 
-    authenticationData = static_cast<Ewk_Auth_Data*>(calloc(1, sizeof(Ewk_Auth_Data)));
-
-    if (!authenticationData) {
-        CRITICAL("could not allocate Ewk_Auth_Data");
-        return;
-    }
-
     soup_session_pause_message(session, message);
     // We need to make sure the message sticks around when pausing it.
     g_object_ref(message);
     g_object_ref(session);
     g_object_ref(auth);
 
+    authenticationData = new Ewk_Auth_Data;
     authenticationData->message = message;
     authenticationData->auth = auth;
     authenticationData->session = session;
@@ -122,7 +116,7 @@ static void free_auth_data(Ewk_Auth_Data* authData)
     g_object_unref(authData->message);
     g_object_unref(authData->session);
     g_object_unref(authData->auth);
-    free(authData);
+    delete authData;
 }
 
 static void attach(SoupSessionFeature* manager, SoupSession* session)
diff --git a/Source/WebKit/efl/ewk/ewk_contextmenu.cpp b/Source/WebKit/efl/ewk/ewk_contextmenu.cpp
index d2b9f1974..6dfe909d9 100644
--- a/Source/WebKit/efl/ewk/ewk_contextmenu.cpp
+++ b/Source/WebKit/efl/ewk/ewk_contextmenu.cpp
@@ -75,7 +75,7 @@ void ewk_context_menu_unref(Ewk_Context_Menu* menu)
     EINA_LIST_FREE(menu->items, item)
         ewk_context_menu_item_free(static_cast<Ewk_Context_Menu_Item*>(item));
 
-    free(menu);
+    delete menu;
 }
 
 Eina_Bool ewk_context_menu_destroy(Ewk_Context_Menu* menu)
@@ -101,10 +101,7 @@ Ewk_Context_Menu_Item* ewk_context_menu_item_new(Ewk_Context_Menu_Item_Type type
                                                  Ewk_Context_Menu_Action action, Ewk_Context_Menu* submenu,
                                                  const char* title, Eina_Bool checked, Eina_Bool enabled)
 {
-    Ewk_Context_Menu_Item* item = static_cast<Ewk_Context_Menu_Item*>(malloc(sizeof(*item)));
-    if (!item)
-        return 0;
-
+    Ewk_Context_Menu_Item* item = new Ewk_Context_Menu_Item;
     item->type = type;
     item->action = action;
     item->title = eina_stringshare_add(title);
@@ -137,7 +134,7 @@ void ewk_context_menu_item_free(Ewk_Context_Menu_Item* item)
     EINA_SAFETY_ON_NULL_RETURN(item);
 
     eina_stringshare_del(item->title);
-    free(item);
+    delete item;
 }
 
 Ewk_Context_Menu_Item_Type ewk_context_menu_item_type_get(const Ewk_Context_Menu_Item* item)
@@ -226,11 +223,7 @@ Ewk_Context_Menu* ewk_context_menu_new(Evas_Object* view, WebCore::ContextMenuCo
     EINA_SAFETY_ON_NULL_RETURN_VAL(view, 0);
     EINA_SAFETY_ON_NULL_RETURN_VAL(controller, 0);
 
-    menu = static_cast<Ewk_Context_Menu*>(malloc(sizeof(*menu)));
-    if (!menu) {
-        CRITICAL("Could not allocate context menu memory.");
-        return 0;
-    }
+    menu = new Ewk_Context_Menu;
 
     menu->__ref = 1;
     menu->view = view;
diff --git a/Source/WebKit/efl/ewk/ewk_contextmenu.h b/Source/WebKit/efl/ewk/ewk_contextmenu.h
index e781f4d9c..2ed473898 100644
--- a/Source/WebKit/efl/ewk/ewk_contextmenu.h
+++ b/Source/WebKit/efl/ewk/ewk_contextmenu.h
@@ -109,7 +109,7 @@ enum _Ewk_Context_Menu_Action {
     EWK_CONTEXT_MENU_ITEM_TAG_RIGHT_TO_LEFT,
     EWK_CONTEXT_MENU_ITEM_TAG_PDFSINGLE_PAGE_SCROLLING,
     EWK_CONTEXT_MENU_ITEM_TAG_PDFFACING_PAGES_SCROLLING,
-    // EWK_CONTEXT_MENU_ITEM_TAG_INSPECT_ELEMENT, /**< This feature is disabled in WebKit-EFL - it is a subject to INSPECTOR build variable */
+    EWK_CONTEXT_MENU_ITEM_TAG_INSPECT_ELEMENT,
     EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_MENU, /**< text direction sub-menu */
     EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_DEFAULT,
     EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_LEFT_TO_RIGHT,
diff --git a/Source/WebKit/efl/ewk/ewk_cookies.cpp b/Source/WebKit/efl/ewk/ewk_cookies.cpp
index 7980c0120..6ef203478 100644
--- a/Source/WebKit/efl/ewk/ewk_cookies.cpp
+++ b/Source/WebKit/efl/ewk/ewk_cookies.cpp
@@ -76,7 +76,7 @@ Eina_List* ewk_cookies_get_all(void)
     list = soup_cookie_jar_all_cookies(cookieJar);
     for (p = list; p; p = p->next) {
         SoupCookie* cookie = static_cast<SoupCookie*>(p->data);
-        Ewk_Cookie* ewkCookie = static_cast<Ewk_Cookie*>(malloc(sizeof(*ewkCookie)));
+        Ewk_Cookie* ewkCookie = new Ewk_Cookie;
         ewkCookie->name = strdup(cookie->name);
         ewkCookie->value = strdup(cookie->value);
         ewkCookie->domain = strdup(cookie->domain);
@@ -121,7 +121,7 @@ void ewk_cookies_cookie_free(Ewk_Cookie* cookie)
     free(cookie->value);
     free(cookie->domain);
     free(cookie->path);
-    free(cookie);
+    delete cookie;
 }
 
 void ewk_cookies_policy_set(Ewk_Cookie_Policy cookiePolicy)
diff --git a/Source/WebKit/efl/ewk/ewk_frame.cpp b/Source/WebKit/efl/ewk/ewk_frame.cpp
index 29fe4f059..c229f8090 100644
--- a/Source/WebKit/efl/ewk/ewk_frame.cpp
+++ b/Source/WebKit/efl/ewk/ewk_frame.cpp
@@ -659,7 +659,7 @@ void ewk_frame_hit_test_free(Ewk_Hit_Test* hitTest)
     eina_stringshare_del(hitTest->link.title);
     eina_stringshare_del(hitTest->image_uri);
     eina_stringshare_del(hitTest->media_uri);
-    free(hitTest);
+    delete hitTest;
 }
 
 Ewk_Hit_Test* ewk_frame_hit_test_new(const Evas_Object* ewkFrame, int x, int y)
@@ -680,12 +680,7 @@ Ewk_Hit_Test* ewk_frame_hit_test_new(const Evas_Object* ewkFrame, int x, int y)
     if (!result.innerNode())
         return 0;
 
-    Ewk_Hit_Test* hitTest = static_cast<Ewk_Hit_Test*>(calloc(1, sizeof(Ewk_Hit_Test)));
-    if (!hitTest) {
-        CRITICAL("Could not allocate memory for hit test.");
-        return 0;
-    }
-
+    Ewk_Hit_Test* hitTest = new Ewk_Hit_Test;
     hitTest->x = result.point().x();
     hitTest->y = result.point().y();
 #if 0
diff --git a/Source/WebKit/efl/ewk/ewk_history.cpp b/Source/WebKit/efl/ewk/ewk_history.cpp
index faef0c805..c0a0b185d 100644
--- a/Source/WebKit/efl/ewk/ewk_history.cpp
+++ b/Source/WebKit/efl/ewk/ewk_history.cpp
@@ -241,13 +241,10 @@ Ewk_History_Item* ewk_history_item_new_from_core(WebCore::HistoryItem* core)
         return 0;
     }
 
-    item = (Ewk_History_Item*)calloc(1, sizeof(Ewk_History_Item));
-    if (!item) {
-        CRITICAL("Could not allocate item memory.");
-        return 0;
-    }
-
     core->ref();
+
+    item = new Ewk_History_Item;
+    memset(item, 0, sizeof(*item));
     item->core = core;
 
     return item;
@@ -265,7 +262,7 @@ Ewk_History_Item* ewk_history_item_new(const char* uri, const char* title)
 static inline void _ewk_history_item_free(Ewk_History_Item* item, WebCore::HistoryItem* core)
 {
     core->deref();
-    free(item);
+    delete item;
 }
 
 void ewk_history_item_free(Ewk_History_Item* item)
@@ -399,14 +396,9 @@ Ewk_History* ewk_history_new(WebCore::BackForwardListImpl* core)
     EINA_SAFETY_ON_NULL_RETURN_VAL(core, 0);
     DBG("core=%p", core);
 
-    history = static_cast<Ewk_History*>(malloc(sizeof(Ewk_History)));
-    if (!history) {
-        CRITICAL("Could not allocate history memory.");
-        return 0;
-    }
-
-    core->ref();
+    history = new Ewk_History;
     history->core = core;
+    core->ref();
 
     return history;
 }
@@ -423,7 +415,7 @@ void ewk_history_free(Ewk_History* history)
 {
     DBG("history=%p", history);
     history->core->deref();
-    free(history);
+    delete history;
 }
 
 namespace EWKPrivate {
diff --git a/Source/WebKit/efl/ewk/ewk_tiled_backing_store.cpp b/Source/WebKit/efl/ewk/ewk_tiled_backing_store.cpp
index e0dde4d74..3a46c80b6 100644
--- a/Source/WebKit/efl/ewk/ewk_tiled_backing_store.cpp
+++ b/Source/WebKit/efl/ewk/ewk_tiled_backing_store.cpp
@@ -26,6 +26,8 @@
 #include "ewk_tiled_private.h"
 #include <Ecore.h>
 #include <Eina.h>
+#include <OwnPtr.h>
+#include <PassOwnPtr.h>
 #include <algorithm>
 #include <errno.h>
 #include <math.h>
@@ -249,11 +251,7 @@ static void _ewk_tiled_backing_store_tile_dissociate_all(Ewk_Tiled_Backing_Store
 
 static inline Eina_Bool _ewk_tiled_backing_store_pre_render_request_add(Ewk_Tiled_Backing_Store_Data* priv, unsigned long column, unsigned long row, float zoom)
 {
-    Ewk_Tiled_Backing_Store_Pre_Render_Request* request;
-
-    request = static_cast<Ewk_Tiled_Backing_Store_Pre_Render_Request*>(malloc(sizeof(*request)));
-    if (!request)
-        return false;
+    Ewk_Tiled_Backing_Store_Pre_Render_Request* request = new Ewk_Tiled_Backing_Store_Pre_Render_Request;
 
     priv->render.preRenderRequests = eina_inlist_append
                                            (priv->render.preRenderRequests, EINA_INLIST_GET(request));
@@ -269,7 +267,7 @@ static inline void _ewk_tiled_backing_store_pre_render_request_del(Ewk_Tiled_Bac
 {
     priv->render.preRenderRequests = eina_inlist_remove
                                            (priv->render.preRenderRequests, EINA_INLIST_GET(request));
-    free(request);
+    delete request;
 }
 
 static inline Ewk_Tiled_Backing_Store_Pre_Render_Request* _ewk_tiled_backing_store_pre_render_request_first(const Ewk_Tiled_Backing_Store_Data* priv)
@@ -286,7 +284,7 @@ static void _ewk_tiled_backing_store_pre_render_request_flush(Ewk_Tiled_Backing_
         Ewk_Tiled_Backing_Store_Pre_Render_Request* request;
         request = _ewk_tiled_backing_store_pre_render_request_first(priv);
         *preRenderList = eina_inlist_remove(*preRenderList, *preRenderList);
-        free(request);
+        delete request;
     }
 }
 
@@ -301,7 +299,7 @@ static void _ewk_tiled_backing_store_pre_render_request_clear(Ewk_Tiled_Backing_
         next = iter->next;
         *preRenderList = eina_inlist_remove(*preRenderList, iter);
         iter = next;
-        free(request);
+        delete request;
     }
 }
 
@@ -471,31 +469,25 @@ end:
 
 static Ewk_Tiled_Backing_Store_Item* _ewk_tiled_backing_store_item_add(Ewk_Tiled_Backing_Store_Data* priv, unsigned long column, unsigned long row)
 {
-    Ewk_Tiled_Backing_Store_Item* item;
     Evas_Coord x, y, tileWidth, tileHeight;
 
     DBG("ewkBackingStore=%p", priv->self);
 
-    item = static_cast<Ewk_Tiled_Backing_Store_Item*>(malloc(sizeof(*item)));
-    if (!item)
-        return 0;
-
     tileWidth = priv->view.tile.width;
     tileHeight = priv->view.tile.height;
     x = priv->view.offset.base.x + priv->view.x + tileWidth * column;
     y = priv->view.offset.base.y + priv->view.y + tileHeight * row;
 
+    OwnPtr<Ewk_Tiled_Backing_Store_Item> item = adoptPtr(new Ewk_Tiled_Backing_Store_Item);
     item->tile = 0;
-
     item->smoothScale = priv->view.tile.zoomWeakSmoothScale;
-    _ewk_tiled_backing_store_item_move(item, x, y);
-    _ewk_tiled_backing_store_item_resize(item, tileWidth, tileHeight);
-    if (!_ewk_tiled_backing_store_item_fill(priv, item, column, row)) {
-        free(item);
+
+    _ewk_tiled_backing_store_item_move(item.get(), x, y);
+    _ewk_tiled_backing_store_item_resize(item.get(), tileWidth, tileHeight);
+    if (!_ewk_tiled_backing_store_item_fill(priv, item.get(), column, row))
         return 0;
-    }
 
-    return item;
+    return item.leakPtr();
 }
 
 static void _ewk_tiled_backing_store_item_del(Ewk_Tiled_Backing_Store_Data* priv, Ewk_Tiled_Backing_Store_Item* item)
@@ -505,7 +497,7 @@ static void _ewk_tiled_backing_store_item_del(Ewk_Tiled_Backing_Store_Data* priv
         _ewk_tiled_backing_store_tile_dissociate(priv, item, last_used);
     }
 
-    free(item);
+    delete item;
 }
 
 static void _ewk_tiled_backing_store_item_smooth_scale_set(Ewk_Tiled_Backing_Store_Item* item, Eina_Bool smoothScale)
diff --git a/Source/WebKit/efl/ewk/ewk_tiled_backing_store.h b/Source/WebKit/efl/ewk/ewk_tiled_backing_store.h
index 7b8ce0d6f..9e5a048d8 100644
--- a/Source/WebKit/efl/ewk/ewk_tiled_backing_store.h
+++ b/Source/WebKit/efl/ewk/ewk_tiled_backing_store.h
@@ -77,7 +77,6 @@ struct _Ewk_Tile {
                                    */
     int visible;                  /**< visibility counter of this tile */
     Evas_Object *image;           /**< Evas Image, the tile to be rendered */
-    uint8_t *pixels;
 };
 
 #include "ewk_tiled_matrix.h"
diff --git a/Source/WebKit/efl/ewk/ewk_tiled_matrix.cpp b/Source/WebKit/efl/ewk/ewk_tiled_matrix.cpp
index 5d991b436..55a0f5da1 100644
--- a/Source/WebKit/efl/ewk/ewk_tiled_matrix.cpp
+++ b/Source/WebKit/efl/ewk/ewk_tiled_matrix.cpp
@@ -25,6 +25,8 @@
 #include "ewk_tiled_backing_store.h"
 #include "ewk_tiled_private.h"
 #include <Eina.h>
+#include <OwnPtr.h>
+#include <PassOwnPtr.h>
 #include <errno.h>
 #include <inttypes.h>
 #include <math.h>
@@ -170,7 +172,7 @@ static void _ewk_tile_matrix_tile_free(void* data, Ewk_Tile* tile)
     if (!entry->count && entry->matrix != tileMatrix->matrix) {
         eina_matrixsparse_free(entry->matrix);
         tileMatrix->matrices = eina_inlist_remove(tileMatrix->matrices, EINA_INLIST_GET(entry));
-        free(entry);
+        delete entry;
     }
 
     ewk_tile_free(tile);
@@ -197,18 +199,16 @@ static void _ewk_tile_matrix_tile_free(void* data, Ewk_Tile* tile)
  */
 Ewk_Tile_Matrix* ewk_tile_matrix_new(Ewk_Tile_Unused_Cache* tileUnusedCache, unsigned long columns, unsigned long rows, float zoomLevel, Evas_Colorspace colorSpace, void (*renderCallback)(void* data, Ewk_Tile* tile, const Eina_Rectangle* update), const void* renderData)
 {
-    Ewk_Tile_Matrix* tileMatrix = static_cast<Ewk_Tile_Matrix*>(calloc(1, sizeof(Ewk_Tile_Matrix)));
-    if (!tileMatrix)
-        return 0;
+    OwnPtr<Ewk_Tile_Matrix> tileMatrix = adoptPtr(new Ewk_Tile_Matrix);
 
-    tileMatrix->matrix = eina_matrixsparse_new(rows, columns, _ewk_tile_matrix_cell_free, tileMatrix);
+    tileMatrix->matrix = eina_matrixsparse_new(rows, columns, _ewk_tile_matrix_cell_free, tileMatrix.get());
     if (!tileMatrix->matrix) {
         ERR("could not create sparse matrix.");
-        free(tileMatrix);
         return 0;
     }
 
-    ewk_tile_matrix_zoom_level_set(tileMatrix, zoomLevel);
+    tileMatrix->matrices = 0;
+    ewk_tile_matrix_zoom_level_set(tileMatrix.get(), zoomLevel);
 
     if (tileUnusedCache)
         tileMatrix->tileUnusedCache = ewk_tile_unused_cache_ref(tileUnusedCache);
@@ -217,7 +217,6 @@ Ewk_Tile_Matrix* ewk_tile_matrix_new(Ewk_Tile_Unused_Cache* tileUnusedCache, uns
         if (!tileMatrix->tileUnusedCache) {
             ERR("no cache of unused tile!");
             eina_matrixsparse_free(tileMatrix->matrix);
-            free(tileMatrix);
             return 0;
         }
     }
@@ -227,8 +226,16 @@ Ewk_Tile_Matrix* ewk_tile_matrix_new(Ewk_Tile_Unused_Cache* tileUnusedCache, uns
     tileMatrix->render.data = (void*)renderData;
     tileMatrix->tile.width = defaultTileWidth;
     tileMatrix->tile.height = defaultTileHeigth;
+    tileMatrix->frozen = 0;
+    tileMatrix->updates = 0;
 
-    return tileMatrix;
+#ifdef DEBUG_MEM_LEAKS
+    tileMatrix->stats.tiles.allocated = 0;
+    tileMatrix->stats.tiles.freed = 0;
+    tileMatrix->stats.bytes.allocated = 0;
+    tileMatrix->stats.bytes.freed = 0;
+#endif
+    return tileMatrix.leakPtr();
 }
 
 void ewk_tile_matrix_zoom_level_set(Ewk_Tile_Matrix* tileMatrix, float zoom)
@@ -249,12 +256,14 @@ void ewk_tile_matrix_zoom_level_set(Ewk_Tile_Matrix* tileMatrix, float zoom)
     }
 
     if (!entry) {
-        entry = static_cast<Ewk_Tile_Matrix_Entry*>(calloc(1, sizeof(Ewk_Tile_Matrix_Entry)));
-        entry->zoom = zoom;
+        entry = new Ewk_Tile_Matrix_Entry;
+        memset(entry, 0, sizeof(Ewk_Tile_Matrix_Entry));
         entry->matrix = eina_matrixsparse_new(rows, columns, _ewk_tile_matrix_cell_free, tileMatrix);
+        entry->count = 0;
+        entry->zoom = zoom;
         if (!entry->matrix) {
             ERR("could not create sparse matrix.");
-            free(entry);
+            delete entry;
             return;
         }
         tileMatrix->matrices = eina_inlist_prepend(tileMatrix->matrices, EINA_INLIST_GET(entry));
@@ -277,7 +286,7 @@ void ewk_tile_matrix_invalidate(Ewk_Tile_Matrix* tileMatrix)
         if (iterator->matrix != tileMatrix->matrix) {
             eina_matrixsparse_free(iterator->matrix);
             tileMatrix->matrices = eina_inlist_remove(tileMatrix->matrices, matrixList);
-            free(iterator);
+            delete iterator;
         }
 
         matrixList = next;
@@ -303,8 +312,8 @@ void ewk_tile_matrix_free(Ewk_Tile_Matrix* tileMatrix)
     entry = EINA_INLIST_CONTAINER_GET(tileMatrix->matrices, Ewk_Tile_Matrix_Entry);
     eina_matrixsparse_free(entry->matrix);
     tileMatrix->matrices = eina_inlist_remove(tileMatrix->matrices, reinterpret_cast<Eina_Inlist*>(entry));
-    free(entry);
     tileMatrix->matrices = 0;
+    delete entry;
 
     ewk_tile_unused_cache_thaw(tileMatrix->tileUnusedCache);
     ewk_tile_unused_cache_unref(tileMatrix->tileUnusedCache);
@@ -335,7 +344,7 @@ void ewk_tile_matrix_free(Ewk_Tile_Matrix* tileMatrix)
             tileMatrix->stats.bytes.allocated, tileMatrix->stats.bytes.freed);
 #endif
 
-    free(tileMatrix);
+    delete tileMatrix;
 }
 
 /**
diff --git a/Source/WebKit/efl/ewk/ewk_tiled_model.cpp b/Source/WebKit/efl/ewk/ewk_tiled_model.cpp
index 87fa83c11..c0e7020d6 100644
--- a/Source/WebKit/efl/ewk/ewk_tiled_model.cpp
+++ b/Source/WebKit/efl/ewk/ewk_tiled_model.cpp
@@ -221,7 +221,6 @@ Ewk_Tile* ewk_tile_new(Evas* evas, Evas_Coord width, Evas_Coord height, float zo
 
     evas_object_image_size_set(tile->image, tile->width, tile->height);
     evas_object_image_colorspace_set(tile->image, tile->cspace);
-    tile->pixels = static_cast<uint8_t*>(evas_object_image_data_get(tile->image, true));
     _ewk_tile_account_allocated(tile);
 
     return tile;
@@ -440,9 +439,8 @@ Ewk_Tile_Unused_Cache* ewk_tile_unused_cache_new(size_t max)
 {
     Ewk_Tile_Unused_Cache* tileUnusedCache;
 
-    tileUnusedCache = static_cast<Ewk_Tile_Unused_Cache*>(calloc(1, sizeof(Ewk_Tile_Unused_Cache)));
-    if (!tileUnusedCache)
-        return 0;
+    tileUnusedCache = new Ewk_Tile_Unused_Cache;
+    memset(tileUnusedCache, 0, sizeof(Ewk_Tile_Unused_Cache));
 
     DBG("tileUnusedCache=%p", tileUnusedCache);
     tileUnusedCache->memory.max = max;
@@ -492,7 +490,7 @@ static void _ewk_tile_unused_cache_free(Ewk_Tile_Unused_Cache* tileUnusedCache)
         tileUnusedCache->memory.max, tileUnusedCache->memory.used);
 
     ewk_tile_unused_cache_clear(tileUnusedCache);
-    free(tileUnusedCache);
+    delete tileUnusedCache;
 }
 
 /**
@@ -512,7 +510,7 @@ void ewk_tile_unused_cache_clear(Ewk_Tile_Unused_Cache* tileUnusedCache)
     EINA_LIST_FREE(tileUnusedCache->entries.list, item) {
         Ewk_Tile_Unused_Cache_Entry* itr = static_cast<Ewk_Tile_Unused_Cache_Entry*>(item);
         itr->tile_free.callback(itr->tile_free.data, itr->tile);
-        free(itr);
+        delete itr;
     }
 
     tileUnusedCache->memory.used = 0;
@@ -605,7 +603,7 @@ size_t ewk_tile_unused_cache_flush(Ewk_Tile_Unused_Cache* tileUnusedCache, size_
         done += ewk_tile_memory_size_get(itr->tile);
         itr->tile_free.callback(itr->tile_free.data, itr->tile);
         tileUnusedCache->entries.list = eina_list_remove_list(tileUnusedCache->entries.list, list);
-        free(itr);
+        delete itr;
         count++;
     }
 
@@ -670,28 +668,23 @@ void ewk_tile_unused_cache_thaw(Ewk_Tile_Unused_Cache* tileUnusedCache)
  */
 Eina_Bool ewk_tile_unused_cache_tile_get(Ewk_Tile_Unused_Cache* tileUnusedCache, Ewk_Tile* tile)
 {
-    Eina_List* foundEntry, *iterateEntry;
-
+    Eina_List* iterateEntry;
     void* item;
-    foundEntry = 0;
+
     EINA_LIST_FOREACH(tileUnusedCache->entries.list, iterateEntry, item) {
         Ewk_Tile_Unused_Cache_Entry* entry = static_cast<Ewk_Tile_Unused_Cache_Entry*>(item);
         if (entry->tile == tile) {
-            foundEntry = iterateEntry;
-            break;
+            tileUnusedCache->entries.count--;
+            tileUnusedCache->memory.used -= ewk_tile_memory_size_get(tile);
+            tileUnusedCache->entries.list = eina_list_remove_list(tileUnusedCache->entries.list, iterateEntry);
+            delete entry;
+
+            return true;
         }
     }
-    if (!foundEntry) {
-        ERR("tile %p not found in cache %p", tile, tileUnusedCache);
-        return false;
-    }
-
-    tileUnusedCache->entries.count--;
-    tileUnusedCache->memory.used -= ewk_tile_memory_size_get(tile);
-    tileUnusedCache->entries.list = eina_list_remove_list(tileUnusedCache->entries.list, foundEntry);
-    free(item);
 
-    return true;
+    ERR("tile %p not found in cache %p", tile, tileUnusedCache);
+    return false;
 }
 
 /**
@@ -725,9 +718,7 @@ Eina_Bool ewk_tile_unused_cache_tile_put(Ewk_Tile_Unused_Cache* tileUnusedCache,
         return false;
     }
 
-    unusedCacheEntry = static_cast<Ewk_Tile_Unused_Cache_Entry*>(malloc(sizeof(Ewk_Tile_Unused_Cache_Entry)));
-    if (!unusedCacheEntry)
-        return false;
+    unusedCacheEntry = new Ewk_Tile_Unused_Cache_Entry;
 
     tileUnusedCache->entries.list = eina_list_append(tileUnusedCache->entries.list, unusedCacheEntry);
     if (eina_error_get()) {
diff --git a/Source/WebKit/efl/ewk/ewk_tiled_private.h b/Source/WebKit/efl/ewk/ewk_tiled_private.h
index 94896c4ea..8a15aa226 100644
--- a/Source/WebKit/efl/ewk/ewk_tiled_private.h
+++ b/Source/WebKit/efl/ewk/ewk_tiled_private.h
@@ -29,34 +29,4 @@ extern int _ewk_tiled_log_dom;
 #define WRN(...) EINA_LOG_DOM_WARN(_ewk_tiled_log_dom, __VA_ARGS__)
 #define INF(...) EINA_LOG_DOM_INFO(_ewk_tiled_log_dom, __VA_ARGS__)
 #define DBG(...) EINA_LOG_DOM_DBG(_ewk_tiled_log_dom, __VA_ARGS__)
-#define OOM(op, size) CRITICAL("could not %s %zd bytes: %s", op, size, strerror(errno))
-#define MALLOC_OR_OOM_RET(ptr, size, ...)       \
-    do {                                        \
-        ptr = malloc(size);                     \
-        if (!ptr && (size) > 0) {               \
-            OOM("malloc", (size));              \
-            return __VA_ARGS__;                 \
-        }                                       \
-    } while (0)
-
-#define CALLOC_OR_OOM_RET(ptr, size, ...)       \
-    do {                                        \
-        ptr = calloc(1, size);                  \
-        if (!ptr && (size) > 0) {               \
-            OOM("calloc", (size));              \
-            return __VA_ARGS__;                 \
-        }                                       \
-    } while (0)
-
-#define REALLOC_OR_OOM_RET(ptr, size, ...)      \
-    do {                                        \
-        void* __tmp_ptr;                        \
-        __tmp_ptr = realloc(ptr, size);         \
-        if (!__tmp_ptr && (size) > 0) {         \
-            OOM("realloc", (size));             \
-            return __VA_ARGS__;                 \
-        }                                       \
-        ptr = __tmp_ptr;                        \
-    } while (0)
-
 #endif // ewk_tiled_private_h
diff --git a/Source/WebKit/efl/ewk/ewk_view.cpp b/Source/WebKit/efl/ewk/ewk_view.cpp
index 8a9674022..17a6ea069 100644
--- a/Source/WebKit/efl/ewk/ewk_view.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view.cpp
@@ -133,7 +133,7 @@ static const Evas_Smart_Cb_Description _ewk_view_callback_names[] = {
  * @internal
  */
 struct _Ewk_View_Private_Data {
-    WebCore::Page* page;
+    OwnPtr<WebCore::Page> page;
     WebCore::Settings* pageSettings;
     WebCore::Frame* mainFrame;
     WebCore::ViewportArguments viewportArguments;
@@ -589,47 +589,36 @@ static WTF::PassRefPtr<WebCore::Frame> _ewk_view_core_frame_new(Ewk_View_Smart_D
     }
     frameLoaderClient->setCustomUserAgent(String::fromUTF8(priv->settings.userAgent));
 
-    return WebCore::Frame::create(priv->page, owner, frameLoaderClient);
+    return WebCore::Frame::create(priv->page.get(), owner, frameLoaderClient);
 }
 
 static Evas_Smart_Class _parent_sc = EVAS_SMART_CLASS_INIT_NULL;
 
 static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
 {
-    Ewk_View_Private_Data* priv =
-        static_cast<Ewk_View_Private_Data*>(calloc(1, sizeof(Ewk_View_Private_Data)));
+    Ewk_View_Private_Data* priv = new Ewk_View_Private_Data;
+    memset(priv, 0, sizeof(Ewk_View_Private_Data));
     AtomicString string;
     WebCore::KURL url;
 
-    if (!priv) {
-        CRITICAL("could not allocate Ewk_View_Private_Data");
-        return 0;
-    }
-
     WebCore::Page::PageClients pageClients;
     pageClients.chromeClient = new WebCore::ChromeClientEfl(smartData->self);
     pageClients.editorClient = new WebCore::EditorClientEfl(smartData->self);
     pageClients.dragClient = new WebCore::DragClientEfl;
     pageClients.inspectorClient = new WebCore::InspectorClientEfl;
-    priv->page = new WebCore::Page(pageClients);
-    if (!priv->page) {
-        CRITICAL("Could not create WebKit Page");
-        goto error_page;
-    }
+
+    priv->page = adoptPtr(new WebCore::Page(pageClients));
+
 #if ENABLE(DEVICE_ORIENTATION)
-    WebCore::provideDeviceMotionTo(priv->page, new WebCore::DeviceMotionClientEfl);
-    WebCore::provideDeviceOrientationTo(priv->page, new WebCore::DeviceOrientationClientEfl);
+    WebCore::provideDeviceMotionTo(priv->page.get(), new WebCore::DeviceMotionClientEfl);
+    WebCore::provideDeviceOrientationTo(priv->page.get(), new WebCore::DeviceOrientationClientEfl);
 #endif
 
 #if ENABLE(VIBRATION)
-    WebCore::provideVibrationTo(priv->page, new WebCore::VibrationClientEfl(smartData->self));
+    WebCore::provideVibrationTo(priv->page.get(), new WebCore::VibrationClientEfl(smartData->self));
 #endif
 
     priv->pageSettings = priv->page->settings();
-    if (!priv->pageSettings) {
-        CRITICAL("Could not get page settings.");
-        goto error_settings;
-    }
 
     priv->viewportArguments.width = WebCore::ViewportArguments::ValueAuto;
     priv->viewportArguments.height = WebCore::ViewportArguments::ValueAuto;
@@ -714,29 +703,12 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
     priv->settings.domTimerInterval = priv->pageSettings->defaultMinDOMTimerInterval();
 
     priv->mainFrame = _ewk_view_core_frame_new(smartData, priv, 0).get();
-    if (!priv->mainFrame) {
-        CRITICAL("Could not create main frame.");
-        goto error_main_frame;
-    }
 
     priv->history = ewk_history_new(static_cast<WebCore::BackForwardListImpl*>(priv->page->backForwardList()));
-    if (!priv->history) {
-        CRITICAL("Could not create history instance for view.");
-        goto error_history;
-    }
 
     priv->soupSession = WebCore::ResourceHandle::defaultSession();
 
     return priv;
-
-error_history:
-    // delete priv->main_frame; /* do not delete priv->main_frame */
-error_main_frame:
-error_settings:
-    delete priv->page;
-error_page:
-    free(priv);
-    return 0;
 }
 
 static void _ewk_view_priv_del(Ewk_View_Private_Data* priv)
@@ -766,8 +738,7 @@ static void _ewk_view_priv_del(Ewk_View_Private_Data* priv)
 
     ewk_history_free(priv->history);
 
-    delete priv->page;
-    free(priv);
+    delete priv;
 }
 
 static void _ewk_view_smart_add(Evas_Object* ewkView)
@@ -3395,7 +3366,7 @@ WebCore::Page* ewk_view_core_page_get(const Evas_Object* ewkView)
 {
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
     EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
-    return priv->page;
+    return priv->page.get();
 }
 
 /**
@@ -3474,7 +3445,7 @@ void ewk_view_popup_new(Evas_Object* ewkView, WebCore::PopupMenuClient* client,
     // populate items
     const int size = client->listSize();
     for (int i = 0; i < size; ++i) {
-        Ewk_Menu_Item* item = static_cast<Ewk_Menu_Item*>(malloc(sizeof(*item)));
+        Ewk_Menu_Item* item = new Ewk_Menu_Item;
         if (client->itemIsSeparator(i))
             item->type = EWK_MENU_SEPARATOR;
         else if (client->itemIsLabel(i))
@@ -3508,7 +3479,7 @@ Eina_Bool ewk_view_popup_destroy(Evas_Object* ewkView)
     EINA_LIST_FREE(priv->popup.menu.items, itemv) {
         Ewk_Menu_Item* item = static_cast<Ewk_Menu_Item*>(itemv);
         eina_stringshare_del(item->text);
-        free(item);
+        delete item;
     }
     priv->popup.menuClient->popupDidHide();
     priv->popup.menuClient = 0;
@@ -3951,7 +3922,7 @@ WebCore::Page *corePage(const Evas_Object *ewkView)
 {
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
     EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
-    return priv->page;
+    return priv->page.get();
 }
 
 } // namespace EWKPrivate
diff --git a/Source/WebKit/efl/ewk/ewk_view_single.cpp b/Source/WebKit/efl/ewk/ewk_view_single.cpp
index 4981ef0cc..1dece06c9 100644
--- a/Source/WebKit/efl/ewk/ewk_view_single.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view_single.cpp
@@ -106,14 +106,14 @@ static inline void _ewk_view_screen_move(uint32_t* image, size_t destinationX, s
 
     uint32_t* source, * destination;
     if (sourceX >= destinationX) {
-        for (int i = 0; i < copyHeight; i++) {
+        for (size_t i = 0; i < copyHeight; i++) {
             source = sourceBegin + (frameWidth * startHeight);
             destination = destinationBegin + (frameWidth * startHeight);
             startHeight = startHeight + moveLineUpDown;
             memcpy(destination, source, copyLength);
         }
     } else {
-        for (int i = 0; i < copyHeight; i++) {
+        for (size_t i = 0; i < copyHeight; i++) {
             source = sourceBegin + (frameWidth * startHeight);
             destination = destinationBegin + (frameWidth * startHeight);
             startHeight = startHeight + moveLineUpDown;
diff --git a/Source/WebKit/efl/ewk/ewk_view_tiled.cpp b/Source/WebKit/efl/ewk/ewk_view_tiled.cpp
index bfb2d95f8..342cc4eb4 100644
--- a/Source/WebKit/efl/ewk/ewk_view_tiled.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view_tiled.cpp
@@ -49,7 +49,12 @@ static Eina_Bool _ewk_view_tiled_render_cb(void* data, Ewk_Tile* tile, const Ein
         return false;
     }
 
-    RefPtr<cairo_surface_t> surface = adoptRef(cairo_image_surface_create_for_data(tile->pixels, format, tile->width, tile->height, stride));
+    uint8_t* pixels = static_cast<uint8_t*>(evas_object_image_data_get(tile->image, true));
+    if (!pixels) {
+        ERR("fail to get the pixel data from the image object");
+        return false;
+    }
+    RefPtr<cairo_surface_t> surface = adoptRef(cairo_image_surface_create_for_data(pixels, format, tile->width, tile->height, stride));
     cairo_status_t status = cairo_surface_status(surface.get());
     if (status != CAIRO_STATUS_SUCCESS) {
         ERR("failed to create cairo surface: %s", cairo_status_to_string(status));
@@ -65,7 +70,9 @@ static Eina_Bool _ewk_view_tiled_render_cb(void* data, Ewk_Tile* tile, const Ein
 
     cairo_translate(cairo.get(), -tile->x, -tile->y);
 
-    return ewk_view_paint_contents(priv, cairo.get(), &rect);
+    bool result = ewk_view_paint_contents(priv, cairo.get(), &rect);
+    evas_object_image_data_set(tile->image, pixels);
+    return result;
 }
 
 static void* _ewk_view_tiled_updates_process_pre(void* data, Evas_Object* ewkView)
diff --git a/Source/WebKit/efl/ewk/ewk_window_features.cpp b/Source/WebKit/efl/ewk/ewk_window_features.cpp
index 982c7fa3a..6181bda06 100644
--- a/Source/WebKit/efl/ewk/ewk_window_features.cpp
+++ b/Source/WebKit/efl/ewk/ewk_window_features.cpp
@@ -45,7 +45,7 @@ void ewk_window_features_unref(Ewk_Window_Features* windowFeatures)
 
     delete windowFeatures->core;
     windowFeatures->core = 0;
-    free(windowFeatures);
+    delete windowFeatures;
 }
 
 void ewk_window_features_ref(Ewk_Window_Features* windowFeatures)
@@ -109,11 +109,7 @@ void ewk_window_features_int_property_get(const Ewk_Window_Features* windowFeatu
  */
 Ewk_Window_Features* ewk_window_features_new_from_core(const WebCore::WindowFeatures* core)
 {
-    Ewk_Window_Features* window_features = static_cast<Ewk_Window_Features*>(malloc(sizeof(*window_features)));
-    if (!window_features) {
-        CRITICAL("Could not allocate Ewk_Window_Features.");
-        return 0;
-    }
+    Ewk_Window_Features* window_features = new Ewk_Window_Features;
 
     if (core)
         window_features->core = new WebCore::WindowFeatures(*core);
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index 59bb90acb..7940ca3cd 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,185 @@
+2012-03-07  Kangil Han  <kangil.han@samsung.com>
+
+        [DRT] Remove PlainTextController implementations.
+        https://bugs.webkit.org/show_bug.cgi?id=79959
+
+        Reviewed by Hajime Morita.
+
+        PlainTextController usages in existing tests have been
+        replaced by internals API by bug 78570.
+        So this patch will remove PlainTextController implementations
+        to avoid further usage in new tests.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+        (DumpRenderTreeSupportGtk):
+
+2012-03-06  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix a compilation warning encountered during the GTK+ build.
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * tests/testcopyandpaste.c:
+        (test_copy_and_paste): Cast the WebKitWebView to a GtkWidget.
+
+2012-03-06  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] FrameLoader signals: gtk-doc fixes
+        https://bugs.webkit.org/show_bug.cgi?id=79495
+
+        Reviewed by Martin Robinson.
+
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_class_init):
+        * webkit/webkitwebresource.cpp:
+        (webkit_web_resource_class_init):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_class_init):
+
+2012-01-26  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] disable GStreamerGWorld when building against 0.11
+        https://bugs.webkit.org/show_bug.cgi?id=77088
+
+        Disable the FullscreenVideoController if we build against
+        GStreamer 0.11. This code depends on GStreamerGWorld which wasn't
+        ported to 0.11 because it will soon be removed anyway.
+
+        Reviewed by Martin Robinson.
+
+        * WebCoreSupport/FullscreenVideoController.cpp:
+        * WebCoreSupport/FullscreenVideoController.h:
+        * webkit/webkitwebview.cpp:
+        (webViewEnterFullscreen):
+        (webViewExitFullscreen):
+        * webkit/webkitwebviewprivate.h:
+        (_WebKitWebViewPrivate):
+
+2012-03-05  Zan Dobersek  <zandobersek@gmail.com>
+
+        [GTK] plugins/netscape-plugin-page-cache-works.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=74409
+
+        Reviewed by Martin Robinson.
+
+        Add a method to override page-cache-for-plugins preference.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::setPageCacheSupportsPlugins):
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+        (DumpRenderTreeSupportGtk):
+
+2012-03-04  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] "Console: undefined @0: ReferenceError: Can't find variable: WebInspector" during testwebinspector
+        https://bugs.webkit.org/show_bug.cgi?id=80235
+
+        Reviewed by Philippe Normand.
+
+        Wait to inspect the WebView until the page has finished loading. Also
+        clean up some minor style errors.
+
+        * tests/testwebinspector.c:
+        (closeInspector): Small style fixes.
+        (showInspector): Ditto.
+        (loadFinished): Ditto.
+        (test_webkit_web_inspector_close_and_inspect): Wait to inspect until the page has loaded.
+        (test_webkit_web_inspector_destroy_inspected_web_view): Ditto.
+        (main): Small style fixes.
+
+2012-03-04  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] REGRESSION: r108278 broke some tests that expect focus
+        https://bugs.webkit.org/show_bug.cgi?id=79084
+
+        Reviewed by Philippe Normand.
+
+        Grab focus before running the test. This ensures that if the
+        WebView lost focus, it has it before sending events.
+
+        * tests/testcopyandpaste.c:
+        (test_copy_and_paste): Grab focus.
+
+2012-02-18  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [AC] Generalize WindowContextGL
+        https://bugs.webkit.org/show_bug.cgi?id=78969
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Use GLContext instead of WindowContextGL. Remove a few unnecessary
+        namespace specifiers in the implementation of AcceleratedCompositingContext.
+
+        * WebCoreSupport/AcceleratedCompositingContext.h: Now we find the GLContext
+        of our widget, which is cached in WebCore. Remove m_initialized as it isn't needed.
+        (AcceleratedCompositingContext):
+        * WebCoreSupport/AcceleratedCompositingContextGL.cpp:
+        (WebKit::AcceleratedCompositingContext::AcceleratedCompositingContext): No longer initialize
+        m_initialized.
+        (WebKit::AcceleratedCompositingContext::glContext): Added.
+        (WebKit::AcceleratedCompositingContext::renderLayersToWindow): Use glContext() now.
+        (WebKit::AcceleratedCompositingContext::attachRootGraphicsLayer): Ditto.
+        (WebKit::AcceleratedCompositingContext::notifyAnimationStarted): Remove unnecessary namespace specifier.
+        (WebKit::AcceleratedCompositingContext::notifySyncRequired): Ditto.
+        (WebKit::AcceleratedCompositingContext::paintContents): Ditto.
+        (WebKit::AcceleratedCompositingContext::showDebugBorders): Ditto.
+        (WebKit::AcceleratedCompositingContext::showRepaintCounter): Ditto.
+
+2012-03-02  Zan Dobersek  <zandobersek@gmail.com>
+
+        [GTK] Smooth scrolling support
+        https://bugs.webkit.org/show_bug.cgi?id=16123
+
+        Reviewed by Martin Robinson.
+
+        Add a new settings option to enable smooth scrolling.
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+        (webkit_web_settings_set_property):
+        (webkit_web_settings_get_property):
+        * webkit/webkitwebsettingsprivate.h:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+        (webkit_web_view_settings_notify):
+
+2012-03-01  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Simplify the code to adjust font sizes depending on screen DPI
+        https://bugs.webkit.org/show_bug.cgi?id=80032
+
+        Reviewed by Martin Robinson.
+
+        * webkit/webkitwebview.cpp:
+        (screenDPI): Helper function to get the DPI of a given
+        GdkScreen. Added also fallback code when gdk_screen_resolution
+        returns -1.
+        (webViewGetDPI): Use screenDPI() from WebCore.
+        (webViewConvertFontSizeToPixels): This is the existing
+        pixelsFromSize(), renamed and moved to be used also in
+        webkit_web_view_screen_changed().
+        (webkit_web_view_screen_changed): Use
+        webViewConvertFontSizeToPixels() instead of duplicating the code.
+        (webkit_web_view_settings_notify): Use
+        webViewConvertFontSizeToPixels() instead of pixelsFromSize().
+
+2012-02-27  Vincent Untz  <vuntz@gnome.org>> and Gustavo Noronha Silva  <gns@gnome.org>
+
+        Build fix for building with GTK+ 2.x.
+
+        * tests/testwebview.c:
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        * WebCoreSupport/ChromeClientGtk.h:
+        (ChromeClient):
+
 2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
 
         SpellCheckRequest needs to know the context where the spellcheck happened.
diff --git a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h
index cad47495d..b2567eb5f 100644
--- a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h
+++ b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h
@@ -28,8 +28,8 @@
 #include <wtf/PassOwnPtr.h>
 
 #if USE(TEXTURE_MAPPER_GL)
+#include "GLContext.h"
 #include "TextureMapperLayer.h"
-#include "WindowGLContext.h"
 #endif
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -69,11 +69,8 @@ private:
 #if USE(CLUTTER)
     GtkWidget* m_rootLayerEmbedder;
 #elif USE(TEXTURE_MAPPER_GL)
-    void initializeIfNecessary();
-
-    bool m_initialized;
+    WebCore::GLContext* glContext();
     WebCore::TextureMapperLayer* m_rootTextureMapperLayer;
-    OwnPtr<WebCore::WindowGLContext> m_context;
     OwnPtr<WebCore::TextureMapper> m_textureMapper;
 #endif
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
index 8c4300f27..6d338970a 100644
--- a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
@@ -42,7 +42,6 @@ namespace WebKit {
 AcceleratedCompositingContext::AcceleratedCompositingContext(WebKitWebView* webView)
     : m_webView(webView)
     , m_syncTimerCallbackId(0)
-    , m_initialized(false)
     , m_rootTextureMapperLayer(0)
 {
 }
@@ -53,38 +52,30 @@ AcceleratedCompositingContext::~AcceleratedCompositingContext()
         g_source_remove(m_syncTimerCallbackId);
 }
 
-void AcceleratedCompositingContext::initializeIfNecessary()
-{
-    if (m_initialized)
-        return;
-
-    m_initialized = true;
-
-    // The GTK+ docs say that we can fail to create a native window.
-    // FIXME: We should fall back to the ImageBuffer TextureMapper when it exists.
-    if (!m_webView->priv->hasNativeWindow)
-        return;
-
-    m_context = WebCore::WindowGLContext::createContextWithGdkWindow(gtk_widget_get_window(GTK_WIDGET(m_webView)));
-}
-
 bool AcceleratedCompositingContext::enabled()
 {
     return m_rootTextureMapperLayer && m_textureMapper;
 }
 
+GLContext* AcceleratedCompositingContext::glContext()
+{
+    GLContext* context = GLContext::getContextForWidget(GTK_WIDGET(m_webView));
+    if (!context->canRenderToDefaultFramebuffer())
+        return 0;
+    return context;
+}
 
 bool AcceleratedCompositingContext::renderLayersToWindow(const IntRect& clipRect)
 {
     if (!enabled())
         return false;
 
-    // We initialize the context lazily here so that we know that the GdkWindow realized.
-    initializeIfNecessary();
-    if (!m_context)
+    GLContext* context = glContext();
+    if (!context)
         return false;
 
-    m_context->startDrawing();
+    if (!context->makeContextCurrent())
+        return false;
 
     GtkAllocation allocation;
     gtk_widget_get_allocation(GTK_WIDGET(m_webView), &allocation);
@@ -94,7 +85,7 @@ bool AcceleratedCompositingContext::renderLayersToWindow(const IntRect& clipRect
     m_rootTextureMapperLayer->paint();
     m_textureMapper->endPainting();
 
-    m_context->finishDrawing();
+    context->swapBuffers();
     return true;
 }
 
@@ -114,14 +105,14 @@ void AcceleratedCompositingContext::attachRootGraphicsLayer(GraphicsLayer* graph
     m_rootGraphicsLayer->setNeedsDisplay();
     m_rootGraphicsLayer->setSize(core(m_webView)->mainFrame()->view()->frameRect().size());
 
-    // We initialize the context lazily here so that we know that the GdkWindow realized.
-    initializeIfNecessary();
-    if (!m_context)
+    GLContext* context = glContext();
+    if (!context)
         return;
 
     // The context needs to be active when creating the texture mapper. It's fine to
-    // avoid calling endDrawing here, because it will just initialize shaders.
-    m_context->startDrawing();
+    // avoid calling swapBuffers here, because it will just initialize shaders.
+    if (!context->makeContextCurrent())
+        return;
 
     GtkAllocation allocation;
     gtk_widget_get_allocation(GTK_WIDGET(m_webView), &allocation);
@@ -188,28 +179,28 @@ void AcceleratedCompositingContext::syncLayersTimeout()
         m_syncTimerCallbackId = g_timeout_add_full(GDK_PRIORITY_EVENTS, 1000.0 / 60.0, reinterpret_cast<GSourceFunc>(syncLayersTimeoutCallback), this, 0);
 }
 
-void AcceleratedCompositingContext::notifyAnimationStarted(const WebCore::GraphicsLayer*, double time)
+void AcceleratedCompositingContext::notifyAnimationStarted(const GraphicsLayer*, double time)
 {
 
 }
-void AcceleratedCompositingContext::notifySyncRequired(const WebCore::GraphicsLayer*)
+void AcceleratedCompositingContext::notifySyncRequired(const GraphicsLayer*)
 {
 
 }
 
-void AcceleratedCompositingContext::paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext& context, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& rectToPaint)
+void AcceleratedCompositingContext::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase, const IntRect& rectToPaint)
 {
     cairo_t* cr = context.platformContext()->cr();
     copyRectFromCairoSurfaceToContext(m_webView->priv->backingStore->cairoSurface(), cr,
                                       IntSize(), rectToPaint);
 }
 
-bool AcceleratedCompositingContext::showDebugBorders(const WebCore::GraphicsLayer*) const
+bool AcceleratedCompositingContext::showDebugBorders(const GraphicsLayer*) const
 {
     return false;
 }
 
-bool AcceleratedCompositingContext::showRepaintCounter(const WebCore::GraphicsLayer*) const
+bool AcceleratedCompositingContext::showRepaintCounter(const GraphicsLayer*) const
 {
     return false;
 }
diff --git a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
index 5905f5679..dcea2f0c4 100644
--- a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
@@ -125,9 +125,6 @@ namespace WebKit {
 #endif
         virtual void reachedMaxAppCacheSize(int64_t spaceNeeded);
         virtual void reachedApplicationCacheOriginQuota(SecurityOrigin*, int64_t totalSpaceNeeded);
-#if ENABLE(CONTEXT_MENUS)
-        virtual void showContextMenu() { }
-#endif
         virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
         virtual void loadIconForFiles(const Vector<WTF::String>&, FileIconLoader*);
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
index 8e6e26b14..80437ffe5 100644
--- a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
@@ -46,7 +46,6 @@
 #include "JSElement.h"
 #include "JSLock.h"
 #include "JSNodeList.h"
-#include "JSRange.h"
 #include "JSValue.h"
 #include "NodeList.h"
 #include "PageGroup.h"
@@ -60,7 +59,6 @@
 #include "Settings.h"
 #include "TextIterator.h"
 #include "WebKitAccessibleWrapperAtk.h"
-#include "WebKitDOMRangePrivate.h"
 #include "WebKitMutationObserver.h"
 #include "WorkerThread.h"
 #include "webkitglobalsprivate.h"
@@ -131,20 +129,6 @@ JSValueRef DumpRenderTreeSupportGtk::nodesFromRect(JSContextRef context, JSValue
     return toRef(exec, toJS(exec, jsDocument->globalObject(), nodes.get()));
 }
 
-WebKitDOMRange* DumpRenderTreeSupportGtk::jsValueToDOMRange(JSContextRef context, JSValueRef value)
-{
-    if (!value)
-        return 0;
-
-    JSLock lock(SilenceAssertionsOnly);
-    ExecState* exec = toJS(context);
-
-    Range* range = toRange(toJS(exec, value));
-    if (!range)
-        return 0;
-    return kit(range);
-}
-
 /**
  * getFrameChildren:
  * @frame: a #WebKitWebFrame
@@ -894,6 +878,11 @@ void DumpRenderTreeSupportGtk::setHixie76WebSocketProtocolEnabled(WebKitWebView*
 #endif
 }
 
+void DumpRenderTreeSupportGtk::setPageCacheSupportsPlugins(WebKitWebView* webView, bool enabled)
+{
+    core(webView)->settings()->setPageCacheSupportsPlugins(enabled);
+}
+
 bool DumpRenderTreeSupportGtk::elementDoesAutoCompleteForElementWithId(WebKitWebFrame* frame, JSStringRef id)
 {
     Frame* coreFrame = core(frame);
diff --git a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
index 02b80c476..41ab40fff 100644
--- a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
@@ -23,7 +23,6 @@
 #include <atk/atk.h>
 #include <glib.h>
 #include <webkit/webkitdefines.h>
-#include <webkit/webkitdomdefines.h>
 #include <wtf/text/CString.h>
 
 namespace WebKit {
@@ -59,8 +58,6 @@ public:
 
     static void clearOpener(WebKitWebFrame*);
 
-    static WebKitDOMRange* jsValueToDOMRange(JSContextRef, JSValueRef);
-
     // FIXME: Move these to webkitwebframe.h once their API has been discussed.
     static GSList* getFrameChildren(WebKitWebFrame*);
     static WTF::CString getInnerText(WebKitWebFrame*);
@@ -128,6 +125,7 @@ public:
     static int numberOfPendingGeolocationPermissionRequests(WebKitWebView*);
 
     static void setHixie76WebSocketProtocolEnabled(WebKitWebView*, bool enabled);
+    static void setPageCacheSupportsPlugins(WebKitWebView*, bool enabled);
 
     static void deliverAllMutationsIfNecessary();
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/FullscreenVideoController.cpp b/Source/WebKit/gtk/WebCoreSupport/FullscreenVideoController.cpp
index 3300fe133..d14dc9754 100644
--- a/Source/WebKit/gtk/WebCoreSupport/FullscreenVideoController.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/FullscreenVideoController.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#if ENABLE(VIDEO)
+#if ENABLE(VIDEO) && !defined(GST_API_VERSION_1)
 
 #include "FullscreenVideoController.h"
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/FullscreenVideoController.h b/Source/WebKit/gtk/WebCoreSupport/FullscreenVideoController.h
index 3fb8b16f6..cbc5c2552 100644
--- a/Source/WebKit/gtk/WebCoreSupport/FullscreenVideoController.h
+++ b/Source/WebKit/gtk/WebCoreSupport/FullscreenVideoController.h
@@ -20,7 +20,7 @@
 #ifndef FullscreenVideoController_h
 #define FullscreenVideoController_h
 
-#if ENABLE(VIDEO)
+#if ENABLE(VIDEO) && !defined(GST_API_VERSION_1)
 
 #include "GRefPtr.h"
 #include "GStreamerGWorld.h"
diff --git a/Source/WebKit/gtk/po/ChangeLog b/Source/WebKit/gtk/po/ChangeLog
index 1a0a97921..6cd5910a0 100644
--- a/Source/WebKit/gtk/po/ChangeLog
+++ b/Source/WebKit/gtk/po/ChangeLog
@@ -1,3 +1,12 @@
+2012-03-02  Alexandre Rostovtsev  <tetromino@gentoo.org>
+
+        Make webkit-gtk translations respect LINGUAS
+        https://bugs.webkit.org/show_bug.cgi?id=79605
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am:
+
 2011-11-09  Philippe Normand  <pnormand@igalia.com>
 
         Esperanto-translation
diff --git a/Source/WebKit/gtk/po/GNUmakefile.am b/Source/WebKit/gtk/po/GNUmakefile.am
index 1c5598dfa..3eddaac2b 100644
--- a/Source/WebKit/gtk/po/GNUmakefile.am
+++ b/Source/WebKit/gtk/po/GNUmakefile.am
@@ -27,7 +27,15 @@ MSGMERGE_UPDATE := $(MSGMERGE) --update
 
 POFILES += $(shell ls $(srcdir)/Source/WebKit/gtk/po/*.po)
 
-MOFILES += $(shell echo $(POFILES) | tr ' ' '\n' | sed "s,^$(srcdir)/,,g" | sed 's/\.po/.mo/g')
+PO_LINGUAS += $(patsubst $(srcdir)/Source/WebKit/gtk/po/%.po,%,$(POFILES))
+
+USER_LINGUAS += $(filter $(LINGUAS),$(PO_LINGUAS))
+
+USE_LINGUAS += $(shell if test -n "$(USER_LINGUAS)" -o -n "$(LINGUAS)"; then LLINGUAS="$(USER_LINGUAS)"; else LLINGUAS="$(PO_LINGUAS)"; fi; for lang in $$LLINGUAS; do printf "$$lang "; done)
+
+MOFILES += $(USE_LINGUAS:%=Source/WebKit/gtk/po/%.mo)
+
+ALL_MOFILES := $(shell echo $(POFILES) | tr ' ' '\n' | sed "s,^$(srcdir)/,,g" | sed 's/\.po/.mo/g')
 
 .po.mo:
 	test -d Source/WebKit/gtk/po/ || mkdir -p Source/WebKit/gtk/po/
@@ -124,11 +132,11 @@ CLEANFILES += \
 	$(top_builddir)/stamp-po
 
 MAINTAINERCLEANFILES += \
-	$(MOFILES) \
+	$(ALL_MOFILES) \
 	$(top_builddir)/Source/WebKit/gtk/po/$(DOMAIN).pot
 
 DISTCLEANFILES += \
-	$(MOFILES) \
+	$(ALL_MOFILES) \
 	$(top_builddir)/Source/WebKit/gtk/po/$(DOMAIN).pot
 
 po-install-data-local: all
diff --git a/Source/WebKit/gtk/tests/testcopyandpaste.c b/Source/WebKit/gtk/tests/testcopyandpaste.c
index 7d8dd8f0d..f25969a73 100644
--- a/Source/WebKit/gtk/tests/testcopyandpaste.c
+++ b/Source/WebKit/gtk/tests/testcopyandpaste.c
@@ -126,6 +126,7 @@ static void test_copy_and_paste(CopyAndPasteFixture* fixture, gconstpointer data
     gtk_widget_show(fixture->window);
     gtk_widget_show(GTK_WIDGET(fixture->webView));
     gtk_window_present(GTK_WINDOW(fixture->window));
+    gtk_widget_grab_focus(GTK_WIDGET(fixture->webView));
 
     g_signal_connect(fixture->webView, "notify::load-status",
                      G_CALLBACK(load_status_cb), fixture);
diff --git a/Source/WebKit/gtk/tests/testwebinspector.c b/Source/WebKit/gtk/tests/testwebinspector.c
index 40aa55334..86a35b937 100644
--- a/Source/WebKit/gtk/tests/testwebinspector.c
+++ b/Source/WebKit/gtk/tests/testwebinspector.c
@@ -62,7 +62,7 @@ static WebKitWebView* inspectElementCallback(WebKitWebInspector *inspector, WebK
     return WEBKIT_WEB_VIEW(newWebView);
 }
 
-static gboolean closeInspector (WebKitWebInspector *inspector, int *timesClosed)
+static gboolean closeInspector(WebKitWebInspector *inspector, int *timesClosed)
 {
     *timesClosed = *timesClosed + 1;
 
@@ -70,23 +70,33 @@ static gboolean closeInspector (WebKitWebInspector *inspector, int *timesClosed)
     return TRUE;
 }
 
-static gboolean showInspector (WebKitWebInspector *inspector, gpointer data)
+static gboolean showInspector(WebKitWebInspector *inspector, gpointer data)
 {
     g_idle_add(quitLoop, NULL);
     return TRUE;
 }
 
+static void loadFinished(WebKitWebView *webView, WebKitWebFrame *frame, gboolean *isLoadFinished)
+{
+    *isLoadFinished = TRUE;
+    if (g_main_loop_is_running(loop))
+        g_main_loop_quit(loop);
+}
+
 static void test_webkit_web_inspector_close_and_inspect()
 {
     WebKitWebView *webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    loop = g_main_loop_new(NULL, TRUE);
 
-    WebKitWebSettings *settings = webkit_web_view_get_settings(webView);
-    g_object_set(settings, "enable-developer-extras", TRUE, NULL);
-
-    webkit_web_view_load_string (webView,
-                                 "<html><body><p>woohoo</p></body></html>",
-                                 "text/html", "UTF-8", "file://");
+    gboolean isLoadFinished = FALSE;
+    g_signal_connect(webView, "load-finished", G_CALLBACK(loadFinished), &isLoadFinished);
+    webkit_web_view_load_string(webView,
+                                "<html><body><p>woohoo</p></body></html>",
+                                "text/html", "UTF-8", "file://");
+    if (!isLoadFinished)
+        g_main_loop_run(loop);
 
+    g_object_set(webkit_web_view_get_settings(webView), "enable-developer-extras", TRUE, NULL);
     WebKitWebInspector *inspector = webkit_web_view_get_inspector(webView);
 
     int timesElementInspected = 0;
@@ -100,7 +110,6 @@ static void test_webkit_web_inspector_close_and_inspect()
     webkit_web_inspector_inspect_coordinates(inspector, 0.0, 0.0);
     g_assert_cmpint(timesElementInspected, ==, 1);
 
-    loop = g_main_loop_new(NULL, TRUE);
     g_main_loop_run(loop);
 
     webkit_web_inspector_close(inspector);
@@ -120,14 +129,17 @@ static void test_webkit_web_inspector_close_and_inspect()
 static void test_webkit_web_inspector_destroy_inspected_web_view()
 {
     WebKitWebView *webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    loop = g_main_loop_new(NULL, TRUE);
 
-    WebKitWebSettings *settings = webkit_web_view_get_settings(webView);
-    g_object_set(settings, "enable-developer-extras", TRUE, NULL);
-
-    webkit_web_view_load_string (webView,
-                                 "<html><body><p>woohoo</p></body></html>",
-                                 "text/html", "UTF-8", "file://");
+    gboolean isLoadFinished = FALSE;
+    g_signal_connect(webView, "load-finished", G_CALLBACK(loadFinished), &isLoadFinished);
+    webkit_web_view_load_string(webView,
+                                "<html><body><p>woohoo</p></body></html>",
+                                "text/html", "UTF-8", "file://");
+    if (!isLoadFinished)
+        g_main_loop_run(loop);
 
+    g_object_set(webkit_web_view_get_settings(webView), "enable-developer-extras", TRUE, NULL);
     WebKitWebInspector *inspector = webkit_web_view_get_inspector(webView);
 
     int timesElementInspected = 0;
@@ -141,7 +153,6 @@ static void test_webkit_web_inspector_destroy_inspected_web_view()
     webkit_web_inspector_inspect_coordinates(inspector, 0.0, 0.0);
     g_assert_cmpint(timesElementInspected, ==, 1);
 
-    loop = g_main_loop_new(NULL, TRUE);
     g_main_loop_run(loop);
 
     gtk_widget_destroy(GTK_WIDGET(webView));
@@ -154,17 +165,11 @@ int main(int argc, char** argv)
 {
     gtk_test_init(&argc, &argv, NULL);
 
-    testutils_relative_chdir("Programs/resources/inspector/inspector.html", argv[0]);
-
-    char *currentDir = g_get_current_dir();
-    g_setenv("WEBKIT_INSPECTOR_PATH", currentDir, TRUE);
-    g_free(currentDir);
-
     g_test_bug_base("https://bugs.webkit.org/");
     g_test_add_func("/webkit/webinspector/destroy-inspected-web-view", test_webkit_web_inspector_destroy_inspected_web_view);
     g_test_add_func("/webkit/webinspector/close-and-inspect", test_webkit_web_inspector_close_and_inspect);
 
-    return g_test_run ();
+    return g_test_run();
 }
 
 #else
diff --git a/Source/WebKit/gtk/tests/testwebview.c b/Source/WebKit/gtk/tests/testwebview.c
index ab3bd5576..22dff131c 100644
--- a/Source/WebKit/gtk/tests/testwebview.c
+++ b/Source/WebKit/gtk/tests/testwebview.c
@@ -27,6 +27,8 @@
 
 #include <glib.h>
 #include <glib/gstdio.h>
+#include <gdk/gdk.h>
+#include <gdk/gdkkeysyms.h>
 #include <gtk/gtk.h>
 #include <webkit/webkit.h>
 
@@ -389,7 +391,12 @@ static void test_webkit_web_view_does_not_steal_focus()
     GtkWidget *window = gtk_offscreen_window_new();
     GtkWidget *webView = webkit_web_view_new();
     GtkWidget *entry = gtk_entry_new();
+
+#ifdef GTK_API_VERSION_2
+    GtkWidget *box = gtk_hbox_new(FALSE, 0);
+#else
     GtkWidget *box = gtk_box_new(GTK_ORIENTATION_HORIZONTAL, 0);
+#endif
 
     gtk_container_add(GTK_CONTAINER(box), webView);
     gtk_container_add(GTK_CONTAINER(box), entry);
@@ -424,8 +431,10 @@ static gboolean emitKeyStroke(WebKitWebView* webView)
     pressEvent->key.window = window;
     g_object_ref(pressEvent->key.window);
 
+#ifndef GTK_API_VERSION_2
     GdkDeviceManager* manager = gdk_display_get_device_manager(gdk_window_get_display(window));
     gdk_event_set_device(pressEvent, gdk_device_manager_get_client_pointer(manager));
+#endif
 
     // When synthesizing an event, an invalid hardware_keycode value
     // can cause it to be badly processed by Gtk+.
diff --git a/Source/WebKit/gtk/webkit/webkitwebframe.cpp b/Source/WebKit/gtk/webkit/webkitwebframe.cpp
index 4de192704..39bdbb3aa 100644
--- a/Source/WebKit/gtk/webkit/webkitwebframe.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebframe.cpp
@@ -351,13 +351,13 @@ static void webkit_web_frame_class_init(WebKitWebFrameClass* frameClass)
             WEBKIT_TYPE_NETWORK_REQUEST,
             WEBKIT_TYPE_NETWORK_RESPONSE);
 
-    /*
-     * WebKitWebFrame::resource-response-received
-     * @webFrame: the #WebKitWebFrame the response was received for
-     * @webResource: the #WebKitWebResource being loaded
+    /**
+     * WebKitWebFrame::resource-response-received:
+     * @web_frame: the #WebKitWebFrame the response was received for
+     * @web_resource: the #WebKitWebResource being loaded
      * @response: the #WebKitNetworkResponse that was received.
      *
-     * Emitted when the first byte of data arrives
+     * Emitted when the response is received from the server.
      *
      * Since: 1.7.5
      */
@@ -371,10 +371,10 @@ static void webkit_web_frame_class_init(WebKitWebFrameClass* frameClass)
             WEBKIT_TYPE_WEB_RESOURCE,
             WEBKIT_TYPE_NETWORK_RESPONSE);
 
-    /*
-     * WebKitWebFrame::resource-load-finished
-     * @webFrame: the #WebKitWebFrame the response was received for
-     * @webResource: the #WebKitWebResource being loaded
+    /**
+     * WebKitWebFrame::resource-load-finished:
+     * @web_frame: the #WebKitWebFrame the response was received for
+     * @web_resource: the #WebKitWebResource being loaded
      *
      * Emitted when all the data for the resource was loaded.
      *
@@ -389,13 +389,16 @@ static void webkit_web_frame_class_init(WebKitWebFrameClass* frameClass)
             G_TYPE_NONE, 1,
             WEBKIT_TYPE_WEB_RESOURCE);
 
-    /*
-     * WebKitWebFrame::resource-content-length-received
-     * @webFrame: the #WebKitWebFrame the response was received for
-     * @webResource: the #WebKitWebResource that was loaded
-     * @lengthReceived: the resource data length in bytes
+    /**
+     * WebKitWebFrame::resource-content-length-received:
+     * @web_frame: the #WebKitWebFrame the response was received for
+     * @web_resource: the #WebKitWebResource that was loaded
+     * @length_received: the amount of data received since the last signal emission
      *
-     * Emitted when all the data for the resource was loaded.
+     * Emitted when new resource data has been received. The
+     * @length_received variable stores the amount of bytes received
+     * since the last time this signal was emitted. This is useful to
+     * provide progress information about the resource load operation.
      *
      * Since: 1.7.5
      */
@@ -409,11 +412,11 @@ static void webkit_web_frame_class_init(WebKitWebFrameClass* frameClass)
             WEBKIT_TYPE_WEB_RESOURCE,
             G_TYPE_INT);
 
-    /*
-     * WebKitWebFrame::resource-load-failed
-     * @webFrame: the #WebKitWebFrame the response was received for
-     * @webResource: the #WebKitWebResource that was loaded
-     * @webError: the #GError that was triggered
+    /**
+     * WebKitWebFrame::resource-load-failed:
+     * @web_frame: the #WebKitWebFrame the response was received for
+     * @web_resource: the #WebKitWebResource that was loaded
+     * @error: the #GError that was triggered
      *
      * Invoked when a resource failed to load.
      *
diff --git a/Source/WebKit/gtk/webkit/webkitwebresource.cpp b/Source/WebKit/gtk/webkit/webkitwebresource.cpp
index f3239626b..4bd198077 100644
--- a/Source/WebKit/gtk/webkit/webkitwebresource.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebresource.cpp
@@ -122,12 +122,12 @@ static void webkit_web_resource_class_init(WebKitWebResourceClass* webResourceCl
     gobject_class->get_property = webkit_web_resource_get_property;
     gobject_class->set_property = webkit_web_resource_set_property;
 
-    /*
-     * WebKitWebResource::response-received
-     * @webResource: the #WebKitWebResource being loaded
+    /**
+     * WebKitWebResource::response-received:
+     * @web_resource: the #WebKitWebResource being loaded
      * @response: the #WebKitNetworkResponse that was received
      *
-     * Emitted when the first byte of data arrives
+     * Emitted when the response is received from the server.
      *
      * Since: 1.7.5
      */
@@ -140,12 +140,12 @@ static void webkit_web_resource_class_init(WebKitWebResourceClass* webResourceCl
             G_TYPE_NONE, 1,
             WEBKIT_TYPE_NETWORK_RESPONSE);
 
-    /*
-     * WebKitWebResource::load-failed
-     * @webResource: the #WebKitWebResource that was loaded
-     * @webError: the #GError that was triggered
+    /**
+     * WebKitWebResource::load-failed:
+     * @web_resource: the #WebKitWebResource that was loaded
+     * @error: the #GError that was triggered
      *
-     * Invoked when a resource failed to load
+     * Invoked when the @web_resource failed to load
      *
      * Since: 1.7.5
      */
@@ -158,9 +158,9 @@ static void webkit_web_resource_class_init(WebKitWebResourceClass* webResourceCl
             G_TYPE_NONE, 1,
             G_TYPE_POINTER);
 
-    /*
-     * WebKitWebResource::load-finished
-     * @webResource: the #WebKitWebResource being loaded
+    /**
+     * WebKitWebResource::load-finished:
+     * @web_resource: the #WebKitWebResource being loaded
      *
      * Emitted when all the data for the resource was loaded
      *
@@ -174,12 +174,15 @@ static void webkit_web_resource_class_init(WebKitWebResourceClass* webResourceCl
             g_cclosure_marshal_VOID__VOID,
             G_TYPE_NONE, 0);
 
-    /*
-     * WebKitWebResource::content-length-received
-     * @webResource: the #WebKitWebResource that was loaded
-     * @lengthReceived: the resource data length in bytes
+    /**
+     * WebKitWebResource::content-length-received:
+     * @web_resource: the #WebKitWebResource that was loaded
+     * @length_received: the amount of data received since the last signal emission
      *
-     * Emitted when all the data for the resource was loaded
+     * Emitted when new resource data has been received. The
+     * @length_received variable stores the amount of bytes received
+     * since the last time this signal was emitted. This is useful to
+     * provide progress information about the resource load operation.
      *
      * Since: 1.7.5
      */
diff --git a/Source/WebKit/gtk/webkit/webkitwebsettings.cpp b/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
index bf6ff600d..2531258b3 100644
--- a/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
@@ -120,7 +120,8 @@ enum {
     PROP_ENABLE_DNS_PREFETCHING,
     PROP_ENABLE_WEBGL,
     PROP_ENABLE_WEB_AUDIO,
-    PROP_ENABLE_ACCELERATED_COMPOSITING
+    PROP_ENABLE_ACCELERATED_COMPOSITING,
+    PROP_ENABLE_SMOOTH_SCROLLING
 };
 
 // Create a default user agent string
@@ -953,6 +954,22 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
                                                          _("Whether WebKit prefetches domain names"),
                                                          TRUE,
                                                          flags));
+
+    /**
+    * WebKitWebSettings:enable-smooth-scrolling
+    *
+    * Enable or disable support for smooth scrolling. The current implementation relies upon
+    * CPU work to produce a smooth scrolling experience.
+    *
+    * Since: 1.9.0
+    */
+    g_object_class_install_property(gobject_class,
+                                    PROP_ENABLE_SMOOTH_SCROLLING,
+                                    g_param_spec_boolean("enable-smooth-scrolling",
+                                                         _("Enable smooth scrolling"),
+                                                         _("Whether to enable smooth scrolling"),
+                                                         FALSE,
+                                                         flags));
 }
 
 static void webkit_web_settings_init(WebKitWebSettings* web_settings)
@@ -1128,6 +1145,9 @@ static void webkit_web_settings_set_property(GObject* object, guint prop_id, con
     case PROP_ENABLE_ACCELERATED_COMPOSITING:
         priv->enableAcceleratedCompositing = g_value_get_boolean(value);
         break;
+    case PROP_ENABLE_SMOOTH_SCROLLING:
+        priv->enableSmoothScrolling = g_value_get_boolean(value);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -1293,6 +1313,9 @@ static void webkit_web_settings_get_property(GObject* object, guint prop_id, GVa
     case PROP_ENABLE_ACCELERATED_COMPOSITING:
         g_value_set_boolean(value, priv->enableAcceleratedCompositing);
         break;
+    case PROP_ENABLE_SMOOTH_SCROLLING:
+        g_value_set_boolean(value, priv->enableSmoothScrolling);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
diff --git a/Source/WebKit/gtk/webkit/webkitwebsettingsprivate.h b/Source/WebKit/gtk/webkit/webkitwebsettingsprivate.h
index d7d082e5b..240d79fad 100644
--- a/Source/WebKit/gtk/webkit/webkitwebsettingsprivate.h
+++ b/Source/WebKit/gtk/webkit/webkitwebsettingsprivate.h
@@ -80,6 +80,7 @@ struct _WebKitWebSettingsPrivate {
     gboolean enableWebgl;
     gboolean enableWebAudio;
     gboolean enableAcceleratedCompositing;
+    gboolean enableSmoothScrolling;
 };
 
 WEBKIT_API void webkit_web_settings_add_extra_plugin_directory(WebKitWebView*, const gchar* directory);
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.cpp b/Source/WebKit/gtk/webkit/webkitwebview.cpp
index 89b9c228f..880f24438 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebview.cpp
@@ -1416,6 +1416,19 @@ static AtkObject* webkit_web_view_get_accessible(GtkWidget* widget)
     return axRoot;
 }
 
+static double screenDPI(GdkScreen* screen)
+{
+    // gdk_screen_get_resolution() returns -1 when no DPI is set.
+    double dpi = gdk_screen_get_resolution(screen);
+    if (dpi != -1)
+        return dpi;
+
+    static const double kMillimetresPerInch = 25.4;
+    double diagonalSizeInPixels = hypot(gdk_screen_get_width(screen), gdk_screen_get_height(screen));
+    double diagonalSizeInInches = hypot(gdk_screen_get_width_mm(screen), gdk_screen_get_height_mm(screen)) / kMillimetresPerInch;
+    return diagonalSizeInPixels / diagonalSizeInInches;
+}
+
 static gdouble webViewGetDPI(WebKitWebView* webView)
 {
     if (webView->priv->webSettings->priv->enforce96DPI)
@@ -1423,12 +1436,12 @@ static gdouble webViewGetDPI(WebKitWebView* webView)
 
     static const double defaultDPI = 96;
     GdkScreen* screen = gtk_widget_has_screen(GTK_WIDGET(webView)) ? gtk_widget_get_screen(GTK_WIDGET(webView)) : gdk_screen_get_default();
-    if (!screen) 
-        return defaultDPI;
+    return screen ? screenDPI(screen) : defaultDPI;
+}
 
-    // gdk_screen_get_resolution() returns -1 when no DPI is set.
-    gdouble DPI = gdk_screen_get_resolution(screen);
-    return DPI != -1 ? DPI : defaultDPI;
+static inline gint webViewConvertFontSizeToPixels(WebKitWebView* webView, double fontSize)
+{
+    return fontSize / 72.0 * webViewGetDPI(webView);
 }
 
 static void webkit_web_view_screen_changed(GtkWidget* widget, GdkScreen* previousScreen)
@@ -1441,8 +1454,6 @@ static void webkit_web_view_screen_changed(GtkWidget* widget, GdkScreen* previou
 
     WebKitWebSettings* webSettings = priv->webSettings.get();
     Settings* settings = core(webView)->settings();
-    gdouble DPI = webViewGetDPI(webView);
-
     guint defaultFontSize, defaultMonospaceFontSize, minimumFontSize, minimumLogicalFontSize;
 
     g_object_get(webSettings,
@@ -1452,10 +1463,10 @@ static void webkit_web_view_screen_changed(GtkWidget* widget, GdkScreen* previou
                  "minimum-logical-font-size", &minimumLogicalFontSize,
                  NULL);
 
-    settings->setDefaultFontSize(defaultFontSize / 72.0 * DPI);
-    settings->setDefaultFixedFontSize(defaultMonospaceFontSize / 72.0 * DPI);
-    settings->setMinimumFontSize(minimumFontSize / 72.0 * DPI);
-    settings->setMinimumLogicalFontSize(minimumLogicalFontSize / 72.0 * DPI);
+    settings->setDefaultFontSize(webViewConvertFontSizeToPixels(webView, defaultFontSize));
+    settings->setDefaultFixedFontSize(webViewConvertFontSizeToPixels(webView, defaultMonospaceFontSize));
+    settings->setMinimumFontSize(webViewConvertFontSizeToPixels(webView, minimumFontSize));
+    settings->setMinimumLogicalFontSize(webViewConvertFontSizeToPixels(webView, minimumLogicalFontSize));
 }
 
 static void webkit_web_view_drag_end(GtkWidget* widget, GdkDragContext* context)
@@ -2520,8 +2531,8 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
      * purpose, to make them not be catched by gtk-doc.
      */
 
-    /*
-     * WebKitWebView::document-load-finished
+    /**
+     * WebKitWebView::document-load-finished:
      * @web_view: the object which received the signal
      * @web_frame: the #WebKitWebFrame whose load dispatched this request
      *
@@ -2537,8 +2548,8 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
             G_TYPE_NONE, 1,
             WEBKIT_TYPE_WEB_FRAME);
 
-    /*
-     * WebKitWebView::frame-created
+    /**
+     * WebKitWebView::frame-created:
      * @web_view: the object which received the signal
      * @web_frame: the #WebKitWebFrame which was just created.
      *
@@ -2720,11 +2731,11 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
                          webkit_marshal_BOOLEAN__OBJECT,
                          G_TYPE_BOOLEAN, 1, WEBKIT_TYPE_DOM_HTML_ELEMENT);
 
-    /*
-     * WebKitWebView::resource-response-received
-     * @webView: the object which received the signal
-     * @webFrame: the #WebKitWebFrame the response was received for
-     * @webResource: the #WebKitWebResource being loaded
+    /**
+     * WebKitWebView::resource-response-received:
+     * @web_view: the object which received the signal
+     * @web_frame: the #WebKitWebFrame the response was received for
+     * @web_resource: the #WebKitWebResource being loaded
      * @response: the #WebKitNetworkResponse that was received
      *
      * Emitted when the first byte of data arrives
@@ -2742,11 +2753,11 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
             WEBKIT_TYPE_WEB_RESOURCE,
             WEBKIT_TYPE_NETWORK_RESPONSE);
 
-    /*
-     * WebKitWebView::resource-load-finished
-     * @webView: the object which received the signal
-     * @webFrame: the #WebKitWebFrame the response was received for
-     * @webResource: the #WebKitWebResource that was loaded
+    /**
+     * WebKitWebView::resource-load-finished:
+     * @web_view: the object which received the signal
+     * @web_frame: the #WebKitWebFrame the response was received for
+     * @web_resource: the #WebKitWebResource that was loaded
      *
      * Emitted when all the data for the resource was loaded
      *
@@ -2762,15 +2773,17 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
             WEBKIT_TYPE_WEB_FRAME,
             WEBKIT_TYPE_WEB_RESOURCE);
 
-    /*
-     * WebKitWebView::resource-content-length-received
-     * @webView: the object which received the signal
-     * @webFrame: the #WebKitWebFrame the response was received for
-     * @webResource: the #WebKitWebResource that was loaded
-     * @lengthReceived: the resource data length in bytes
+    /**
+     * WebKitWebView::resource-content-length-received:
+     * @web_view: the object which received the signal
+     * @web_frame: the #WebKitWebFrame the response was received for
+     * @web_resource: the #WebKitWebResource that was loaded
+     * @length_received: the amount of data received since the last signal emission
      *
-     * Emitted when the HTTP Content-Length response header has been
-     * received and parsed successfully.
+     * Emitted when new resource data has been received. The
+     * @length_received variable stores the amount of bytes received
+     * since the last time this signal was emitted. This is useful to
+     * provide progress information about the resource load operation.
      *
      * Since: 1.7.5
      */
@@ -2785,12 +2798,12 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
             WEBKIT_TYPE_WEB_RESOURCE,
             G_TYPE_INT);
 
-    /*
-     * WebKitWebView::resource-load-failed
-     * @webView: the object which received the signal
-     * @webFrame: the #WebKitWebFrame the response was received for
-     * @webResource: the #WebKitWebResource that was loaded
-     * @webError: the #GError that was triggered
+    /**
+     * WebKitWebView::resource-load-failed:
+     * @web_view: the object which received the signal
+     * @web_frame: the #WebKitWebFrame the response was received for
+     * @web_resource: the #WebKitWebResource that was loaded
+     * @error: the #GError that was triggered
      *
      * Invoked when a resource failed to load
      *
@@ -3330,17 +3343,16 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
     coreSettings->setUseHixie76WebSocketProtocol(false);
 #endif
 
+#if ENABLE(SMOOTH_SCROLLING)
+    coreSettings->setEnableScrollAnimator(settingsPrivate->enableSmoothScrolling);
+#endif
+
     if (Page* page = core(webView))
         page->setTabKeyCyclesThroughElements(settingsPrivate->tabKeyCyclesThroughElements);
 
     webkit_web_view_screen_changed(GTK_WIDGET(webView), NULL);
 }
 
-static inline gint pixelsFromSize(WebKitWebView* webView, gint size)
-{
-    return size / 72.0 * webViewGetDPI(webView);
-}
-
 static void webkit_web_view_settings_notify(WebKitWebSettings* webSettings, GParamSpec* pspec, WebKitWebView* webView)
 {
     Settings* settings = core(webView)->settings();
@@ -3365,13 +3377,13 @@ static void webkit_web_view_settings_notify(WebKitWebSettings* webSettings, GPar
     else if (name == g_intern_string("serif-font-family"))
         settings->setSerifFontFamily(g_value_get_string(&value));
     else if (name == g_intern_string("default-font-size"))
-        settings->setDefaultFontSize(pixelsFromSize(webView, g_value_get_int(&value)));
+        settings->setDefaultFontSize(webViewConvertFontSizeToPixels(webView, g_value_get_int(&value)));
     else if (name == g_intern_string("default-monospace-font-size"))
-        settings->setDefaultFixedFontSize(pixelsFromSize(webView, g_value_get_int(&value)));
+        settings->setDefaultFixedFontSize(webViewConvertFontSizeToPixels(webView, g_value_get_int(&value)));
     else if (name == g_intern_string("minimum-font-size"))
-        settings->setMinimumFontSize(pixelsFromSize(webView, g_value_get_int(&value)));
+        settings->setMinimumFontSize(webViewConvertFontSizeToPixels(webView, g_value_get_int(&value)));
     else if (name == g_intern_string("minimum-logical-font-size"))
-        settings->setMinimumLogicalFontSize(pixelsFromSize(webView, g_value_get_int(&value)));
+        settings->setMinimumLogicalFontSize(webViewConvertFontSizeToPixels(webView, g_value_get_int(&value)));
     else if (name == g_intern_string("enforce-96-dpi"))
         webkit_web_view_screen_changed(GTK_WIDGET(webView), NULL);
     else if (name == g_intern_string("auto-load-images"))
@@ -3464,6 +3476,11 @@ static void webkit_web_view_settings_notify(WebKitWebSettings* webSettings, GPar
         settings->setWebAudioEnabled(g_value_get_boolean(&value));
 #endif
 
+#if ENABLE(SMOOTH_SCROLLING)
+    else if (name == g_intern_string("enable-smooth-scrolling"))
+        settings->setEnableScrollAnimator(g_value_get_boolean(&value));
+#endif
+
     else if (!g_object_class_find_property(G_OBJECT_GET_CLASS(webSettings), name))
         g_warning("Unexpected setting '%s'", name);
     g_value_unset(&value);
@@ -5099,7 +5116,7 @@ void webViewEnterFullscreen(WebKitWebView* webView, Node* node)
     if (!node->hasTagName(HTMLNames::videoTag))
         return;
 
-#if ENABLE(VIDEO)
+#if ENABLE(VIDEO) && !defined(GST_API_VERSION_1)
     HTMLMediaElement* videoElement = static_cast<HTMLMediaElement*>(node);
     WebKitWebViewPrivate* priv = webView->priv;
 
@@ -5115,7 +5132,7 @@ void webViewEnterFullscreen(WebKitWebView* webView, Node* node)
 
 void webViewExitFullscreen(WebKitWebView* webView)
 {
-#if ENABLE(VIDEO)
+#if ENABLE(VIDEO) && !defined(GST_API_VERSION_1)
     WebKitWebViewPrivate* priv = webView->priv;
     if (priv->fullscreenVideoController)
         priv->fullscreenVideoController->exitFullscreen();
diff --git a/Source/WebKit/gtk/webkit/webkitwebviewprivate.h b/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
index 75ba14cbe..2967da92f 100644
--- a/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
+++ b/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
@@ -80,7 +80,7 @@ struct _WebKitWebViewPrivate {
 
     gboolean disposing;
 
-#if ENABLE(VIDEO)
+#if ENABLE(VIDEO) && !defined(GST_API_VERSION_1)
     FullscreenVideoController* fullscreenVideoController;
 #endif
 
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index 898482ec1..cdef8f903 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,433 @@
+2012-03-11  Timothy Hatcher  <timothy@apple.com>
+
+        Update how the Web Inspector resources are loaded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=80798
+        rdar://problem/10359959
+
+        Reviewed by Brian Weinstein.
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (useWebKitWebInspector): Return if we are using the WebCore resources for compatibility
+        with local and nightly builds.
+        (WebInspectorFrontendClient::localizedStringsURL): Decide what path to use.
+        (-[WebInspectorWindowController init]): Ditto.
+        (-[WebInspectorWindowController window]): Decide if the window is textured or not.
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Rename NotificationPresenter to NotificationClient
+        https://bugs.webkit.org/show_bug.cgi?id=80488
+        <rdar://problem/10965558>
+
+        Reviewed by Kentaro Hara.
+
+        Refactor to use renamed WebCore::NotificationClient.
+        * WebCoreSupport/WebNotificationClient.h:
+        * WebCoreSupport/WebNotificationClient.mm:
+        (WebNotificationClient::checkPermission):
+        * WebView/WebViewPrivate.h:
+
+2012-03-09  Enrica Casucci  <enrica@apple.com>
+
+        Move WebNSURLExtras code down to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=80611
+
+        Reviewed by Alexey Proskuryakov.
+
+        Changed the implementation to use newly moved WebCore functions.
+
+        * Misc/WebKitNSStringExtras.mm:
+        (-[NSString _webkit_hasCaseInsensitivePrefix:]):
+        * Misc/WebNSURLExtras.mm:
+        (+[NSURL _web_URLWithUserTypedString:]):
+        (+[NSURL _web_URLWithDataAsString:relativeToURL:]):
+        (+[NSURL _web_URLWithData:]):
+        (+[NSURL _web_URLWithData:relativeToURL:]):
+        (-[NSURL _web_originalData]):
+        (-[NSURL _web_originalDataAsString]):
+        (-[NSURL _web_userVisibleString]):
+        (-[NSURL _web_isEmpty]):
+        (-[NSURL _web_URLCString]):
+        (-[NSURL _web_URLByTruncatingOneCharacterBeforeComponent:]):
+        (-[NSURL _webkit_URLByRemovingFragment]):
+        (-[NSURL _webkit_URLByRemovingResourceSpecifier]):
+        (-[NSURL _web_URLByRemovingUserInfo]):
+        (-[NSURL _web_dataForURLComponentType:]):
+        (-[NSURL _web_schemeData]):
+        (-[NSURL _web_hostData]):
+        (-[NSString _web_isUserVisibleURL]):
+        (-[NSString _web_hostNameNeedsDecodingWithRange:]):
+        (-[NSString _web_hostNameNeedsEncodingWithRange:]):
+        (-[NSString _web_decodeHostNameWithRange:]):
+        (-[NSString _web_encodeHostNameWithRange:]):
+        (-[NSString _web_decodeHostName]):
+        (-[NSString _web_encodeHostName]):
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2012-03-09  Emil A Eklund  <eae@chromium.org>
+
+        Add roundedPoint to HitTestResult and change platform code to use it
+        https://bugs.webkit.org/show_bug.cgi?id=80715
+
+        Reviewed by James Robinson.
+
+        Change ports to use roundedPoint to avoid exposing subpixel types to
+        platform code.
+
+        * WebCoreSupport/WebContextMenuClient.mm:
+        (WebContextMenuClient::showContextMenu):
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Add support for ENABLE(LEGACY_NOTIFICATIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=80497
+
+        Reviewed by Adam Barth.
+
+        Prep for b80472: Update API for Web Notifications
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix for micro data API.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed Snow Leopard build fix.
+
+        On Leopard and Snow Leopard, provide an implementation for -[NSWindow convertRectToScreen:].
+
+        * WebView/WebFullScreenController.mm:
+        (-[NSWindow convertRectToScreen:]):
+
+2012-02-20  Jer Noble  <jer.noble@apple.com>
+
+        Full Screen Refactor Part 4: Animate into Full Screen mode using new animation classes, WebKit edition.
+        https://bugs.webkit.org/show_bug.cgi?id=78930
+
+        Reviewed by Anders Carlsson.
+
+        Revise WebFullScreenController to have the same general functionality and code path as WKFullScreenWindowController
+        in WebKit2.  As such, the following functions are copies of their equivalents in WKFullScreenWindowController:
+        * WebView/WebFullScreenController.mm:
+        (-[WebFullScreenController init]):
+        (-[WebFullScreenController dealloc]):
+        (-[WebFullScreenController windowDidLoad]):
+        (-[WebFullScreenController cancelOperation:]):
+        (-[WebFullScreenController applicationDidResignActive:]):
+        (-[WebFullScreenController applicationDidChangeScreenParameters:]):
+        (-[WebFullScreenController finishedEnterFullScreenAnimation:]):
+        (-[WebFullScreenController finishedExitFullScreenAnimation:]):
+        (-[WebFullScreenController close]):
+        (-[WebFullScreenController animationDidEnd:]):
+        (-[WebFullScreenController _updateMenuAndDockForFullScreen]):
+        (-[WebFullScreenController _swapView:with:]):
+        (createBackgroundFullscreenWindow):
+        (windowFrameFromApparentFrames):
+        (-[WebFullScreenController _startEnterFullScreenAnimationWithDuration:]):
+        (-[WebFullScreenController _startExitFullScreenAnimationWithDuration:]):
+
+        The following is a copy of the equivalent function in WebFullScreenManager:
+        * WebView/WebFullScreenController.mm:
+        (screenRectOfContents):        
+
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::fullScreenRendererChanged): No longer tell the WebView the renderer changed (as it doesn't care.)
+        * WebView/WebFullScreenController.h:
+        * WebView/WebFullScreenController.mm:
+        (-[WebFullScreenController setElement:]): No need to add event listeners to the media element.
+        (-[WebFullScreenController enterFullScreen:]): Same as WKFullScreenWindowController, but not asynchronous.
+        (-[WebFullScreenController exitFullScreen]): Ditto.
+        * WebView/WebView.mm:
+        (-[WebView _enterFullScreenForElement:WebCore::]): Fullscreen -> FullScreen.
+        (-[WebView _exitFullScreenForElement:WebCore::]): Ditto.
+
+2012-03-08  Matt Lilek  <mrl@apple.com>
+
+        Don't enable VIDEO_TRACK on all OS X platforms
+        https://bugs.webkit.org/show_bug.cgi?id=80635
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        <http://webkit.org/b/80510> Web Inspector crash (iCab)
+
+        Reviewed by Timothy Hatcher.
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (WebInspectorClient::didResizeMainFrame):
+
+2012-03-06  Benjamin Poulain  <bpoulain@apple.com>
+
+        [Mac] Update the configuration files for iOS
+        https://bugs.webkit.org/show_bug.cgi?id=80435
+
+        Reviewed by David Kilzer.
+
+        * Configurations/WebKit.xcconfig:
+
+2012-03-06  Eric Seidel  <eric@webkit.org>
+
+        Make WTF public headers use fully-qualified include paths and remove ForwardingHeaders/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=80363
+
+        Reviewed by Mark Rowe.
+
+        ForwardingHeaders/wtf is no longer necessary (or functional) now that JavaScriptCore
+        no longer includes the WTF headers as private headers.
+
+        * ForwardingHeaders/wtf/ASCIICType.h: Removed.
+        * ForwardingHeaders/wtf/AlwaysInline.h: Removed.
+        * ForwardingHeaders/wtf/Assertions.h: Removed.
+        * ForwardingHeaders/wtf/Deque.h: Removed.
+        * ForwardingHeaders/wtf/DisallowCType.h: Removed.
+        * ForwardingHeaders/wtf/FastMalloc.h: Removed.
+        * ForwardingHeaders/wtf/Forward.h: Removed.
+        * ForwardingHeaders/wtf/GetPtr.h: Removed.
+        * ForwardingHeaders/wtf/HashCountedSet.h: Removed.
+        * ForwardingHeaders/wtf/HashMap.h: Removed.
+        * ForwardingHeaders/wtf/HashSet.h: Removed.
+        * ForwardingHeaders/wtf/HashTraits.h: Removed.
+        * ForwardingHeaders/wtf/ListHashSet.h: Removed.
+        * ForwardingHeaders/wtf/ListRefPtr.h: Removed.
+        * ForwardingHeaders/wtf/Locker.h: Removed.
+        * ForwardingHeaders/wtf/MathExtras.h: Removed.
+        * ForwardingHeaders/wtf/Noncopyable.h: Removed.
+        * ForwardingHeaders/wtf/OwnArrayPtr.h: Removed.
+        * ForwardingHeaders/wtf/OwnPtr.h: Removed.
+        * ForwardingHeaders/wtf/OwnPtrCommon.h: Removed.
+        * ForwardingHeaders/wtf/PassOwnPtr.h: Removed.
+        * ForwardingHeaders/wtf/PassRefPtr.h: Removed.
+        * ForwardingHeaders/wtf/Platform.h: Removed.
+        * ForwardingHeaders/wtf/RefCounted.h: Removed.
+        * ForwardingHeaders/wtf/RefCountedLeakCounter.h: Removed.
+        * ForwardingHeaders/wtf/RefPtr.h: Removed.
+        * ForwardingHeaders/wtf/RetainPtr.h: Removed.
+        * ForwardingHeaders/wtf/StdLibExtras.h: Removed.
+        * ForwardingHeaders/wtf/TemporaryChange.h: Removed.
+        * ForwardingHeaders/wtf/Threading.h: Removed.
+        * ForwardingHeaders/wtf/UnusedParam.h: Removed.
+        * ForwardingHeaders/wtf/VMTags.h: Removed.
+        * ForwardingHeaders/wtf/ValueCheck.h: Removed.
+        * ForwardingHeaders/wtf/Vector.h: Removed.
+        * ForwardingHeaders/wtf/VectorTraits.h: Removed.
+        * ForwardingHeaders/wtf/unicode/Unicode.h: Removed.
+        * ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h: Removed.
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Hide dock button when not allowed to dock
+        https://bugs.webkit.org/show_bug.cgi?id=78575
+
+        Reviewed by Pavel Feldman.
+
+        * WebCoreSupport/WebInspectorClient.h:
+        (WebCore):
+        (WebInspectorClient):
+        * WebCoreSupport/WebInspectorClient.mm:
+        (WebInspectorClient::didResizeMainFrame):
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        putByIndex should throw in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=80335
+
+        Reviewed by Filip Pizlo.
+
+        Make the MethodTable PutByIndex trap take a boolean 'shouldThrow' parameter.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::setProperty):
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed rollout of r109858 for restructuring.
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        <http://webkit.org/b/78575> Web Inspector: Hide dock button when not allowed to dock
+
+        Reviewed by Timothy Hatcher.
+
+        * WebCoreSupport/WebInspectorClient.h:
+        (WebInspectorClient):
+        * WebCoreSupport/WebInspectorClient.mm:
+        (WebInspectorClient::updateDockingAvailability):
+
+2012-03-02  Jon Lee  <jonlee@apple.com>
+
+        Add support for notification replaceId in Mac WebKit and WK2
+        https://bugs.webkit.org/show_bug.cgi?id=80206
+        <rdar://problem/10965574>
+
+        Reviewed by Sam Weinig.
+
+        * WebView/WebNotification.h: Add replaceID method.
+        * WebView/WebNotification.mm:
+        (-[WebNotification replaceID]):
+
+2012-03-05  Adam Barth  <abarth@webkit.org>
+
+        Geolocation should use a ScriptExecutionContext as its context object
+        https://bugs.webkit.org/show_bug.cgi?id=80248
+
+        Reviewed by Kentaro Hara.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _cacheabilityDictionary]):
+            - We no longer special-case Geolocation.
+
+2012-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove the redundant method KURL::protocolInHTTPFamily()
+        https://bugs.webkit.org/show_bug.cgi?id=80216
+
+        Reviewed by Anders Carlsson.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::createPlugin):
+
+2012-03-03  Hans Wennborg  <hans@chromium.org>
+
+        Implement Speech JavaScript API
+        https://bugs.webkit.org/show_bug.cgi?id=80019
+
+        Reviewed by Adam Barth.
+
+        Add ENABLE_SCRIPTED_SPEECH.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-03  Anders Carlsson  <andersca@apple.com>
+
+        Fix build with newer versions of clang.
+
+        * Panels/WebAuthenticationPanel.m:
+        (-[WebAuthenticationPanel setUpForChallenge:]):
+        Use %ld and cast to long.
+
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView getVariable:value:]):
+        Cast the switch parameter to unsigned to prevent warnings about case values not being part of the enum type.
+
+2012-03-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Unreviewed, rolling out r109255.
+        http://trac.webkit.org/changeset/109255
+        https://bugs.webkit.org/show_bug.cgi?id=79932
+
+        Breaks rounded rects with dashed strokes in SVG
+
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2012-02-29  Adam Barth  <abarth@webkit.org>
+
+        ScriptExecutionContext has too many ifdef ENABLE(SQL_DATABASE)
+        https://bugs.webkit.org/show_bug.cgi?id=79633
+
+        Reviewed by Eric Seidel.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _cacheabilityDictionary]):
+
+2012-02-29  Tim Horton  <timothy_horton@apple.com>
+
+        Make use of CG rounded-rect primitives
+        https://bugs.webkit.org/show_bug.cgi?id=79932
+        <rdar://problem/9274953>
+
+        Reviewed by Simon Fraser.
+
+        Add wkCGPathAddRoundedRect.
+
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2012-02-29  Enrica Casucci  <enrica@apple.com>
+
+        Crash at -[WebFrame(WebInternal) _setTypingStyle:withUndoAction:]
+        https://bugs.webkit.org/show_bug.cgi?id=79937
+        <rdar://problem/10942936>
+
+        Reviewed by Dan Bernstein.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _setTypingStyle:withUndoAction:]): Adding a null check.
+
+2012-02-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Update WebKitSystemInterface.
+
+        Reviewed by Sam Weinig.
+
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2012-02-28  Enrica Casucci  <enrica@apple.com>
+
+        More Pasteboard code cleanup.
+        https://bugs.webkit.org/show_bug.cgi?id=79816
+
+        Removing the last references to NSPasteboard.
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCoreSupport/WebEditorClient.h:
+        * WebCoreSupport/WebEditorClient.mm:
+        (WebEditorClient::setInsertionPasteboard):
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        * WebCoreSupport/WebContextMenuClient.h:
+        (WebContextMenuClient):
+        * WebCoreSupport/WebContextMenuClient.mm:
+        (WebContextMenuClient::showContextMenu): Moved from WebChromeClient
+        * WebCoreSupport/WebChromeClient.h:
+        * WebCoreSupport/WebChromeClient.mm:
+
+2012-02-25  Sam Weinig  <sam@webkit.org>
+
+        QuickLook events don't make it to WebKit plugins.
+        <rdar://problem/10931721>
+
+        Reviewed by Anders Carlsson.
+
+        * WebView/WebHTMLView.mm:
+        (isQuickLookEvent):
+        (-[WebHTMLView hitTest:]):
+        Allow QuickLook events to hit test down to subviews.
+
+2012-02-24  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/10805709> and https://bugs.webkit.org/show_bug.cgi?id=79421
+        Need a WK1 Mac API to filter which subframes go into WebArchives as they are created
+
+        Reviewed by Sam Weinig (with additional comments by Adam Roben)
+
+        Add webArchiveByFilteringSubframes: which takes a callback block:
+        * DOM/WebDOMOperationsPrivate.h:
+
+        Add FrameFilter that adapts the block, and use it to implement the new SPI:
+        * DOM/WebDOMOperations.mm:
+        (WebFrameFilter):
+        (WebFrameFilter::WebFrameFilter):
+        (WebFrameFilter::~WebFrameFilter):
+        (WebFrameFilter::shouldIncludeSubframe):
+        (-[DOMNode webArchiveByFilteringSubframes:]):
+
 2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
 
         SpellCheckRequest needs to know the context where the spellcheck happened.
diff --git a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
index 3e2090355..58a02f521 100644
--- a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -90,12 +90,14 @@ ENABLE_INDEXED_DATABASE = ;
 ENABLE_INPUT_COLOR = ;
 ENABLE_INPUT_SPEECH = ;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
+ENABLE_LEGACY_NOTIFICATIONS = ENABLE_LEGACY_NOTIFICATIONS;
 ENABLE_LINK_PREFETCH = ;
 ENABLE_MATHML = ENABLE_MATHML;
 ENABLE_MEDIA_SOURCE = ;
 ENABLE_MEDIA_STATISTICS = ;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_MHTML = ;
+ENABLE_MICRODATA = ;
 ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 
 ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
@@ -109,6 +111,7 @@ ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 ENABLE_QUOTA = ;
 ENABLE_REGISTER_PROTOCOL_HANDLER = ;
 ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
+ENABLE_SCRIPTED_SPEECH = ;
 ENABLE_SHADOW_DOM = ;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SQL_DATABASE = ENABLE_SQL_DATABASE;
@@ -118,7 +121,10 @@ ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
 ENABLE_VIDEO = ENABLE_VIDEO;
-ENABLE_VIDEO_TRACK = ENABLE_VIDEO_TRACK;
+
+ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(REAL_PLATFORM_NAME));
+ENABLE_VIDEO_TRACK_macosx = ENABLE_VIDEO_TRACK;
+
 ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
@@ -126,4 +132,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LINK_PREFETCH) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebKit/mac/Configurations/Version.xcconfig b/Source/WebKit/mac/Configurations/Version.xcconfig
index 5344a720d..be7e0399c 100644
--- a/Source/WebKit/mac/Configurations/Version.xcconfig
+++ b/Source/WebKit/mac/Configurations/Version.xcconfig
@@ -21,8 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-MAJOR_VERSION = 535;
-MINOR_VERSION = 23;
+MAJOR_VERSION = 536;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit/mac/Configurations/WebKit.xcconfig b/Source/WebKit/mac/Configurations/WebKit.xcconfig
index 0a0cf9f41..41ab11f37 100644
--- a/Source/WebKit/mac/Configurations/WebKit.xcconfig
+++ b/Source/WebKit/mac/Configurations/WebKit.xcconfig
@@ -30,9 +30,8 @@ EXCLUDED_SOURCE_FILE_NAMES_iphonesimulator = $(EXCLUDED_SOURCE_FILE_NAMES_iphone
 
 EXPORTED_SYMBOLS_FILE = $(EXPORTED_SYMBOLS_FILE_$(CURRENT_ARCH));
 EXPORTED_SYMBOLS_FILE_ = mac/WebKit.exp;
-EXPORTED_SYMBOLS_FILE_armv5 = mac/WebKit.exp;
-EXPORTED_SYMBOLS_FILE_armv6 = mac/WebKit.exp;
-EXPORTED_SYMBOLS_FILE_armv7 = mac/WebKit.exp;
+EXPORTED_SYMBOLS_FILE_armv6 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit/WebKit.generated.exp;
+EXPORTED_SYMBOLS_FILE_armv7 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit/WebKit.generated.exp;
 EXPORTED_SYMBOLS_FILE_i386 = mac/WebKit.exp;
 EXPORTED_SYMBOLS_FILE_ppc = mac/WebKit.exp;
 EXPORTED_SYMBOLS_FILE_ppc64 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit/WebKit.LP64.exp;
@@ -54,15 +53,22 @@ GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) $(FEATURE_DEFINES) FRAMEWORK_NAM
 HEADER_SEARCH_PATHS = $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders $(WEBCORE_PRIVATE_HEADERS_DIR)/icu $(WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH) "${BUILT_PRODUCTS_DIR}/DerivedSources/WebKit" $(HEADER_SEARCH_PATHS);
 INFOPLIST_FILE = mac/Info.plist;
 INSTALL_PATH = $(INSTALL_PATH_$(REAL_PLATFORM_NAME));
+INSTALL_PATH_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+INSTALL_PATH_iphonesimulator = $(INDIGO_INSTALL_PATH_PREFIX)$(INSTALL_PATH_ACTUAL);
 INSTALL_PATH_macosx = $(WEBKIT_FRAMEWORKS_DIR);
-DYLIB_INSTALL_NAME_BASE = $(NORMAL_WEBKIT_FRAMEWORKS_DIR);
+INSTALL_PATH_ACTUAL = $(INSTALL_PATH_ACTUAL_$(REAL_PLATFORM_NAME));
+INSTALL_PATH_ACTUAL_iphonesimulator = $(INSTALL_PATH_iphoneos);
+DYLIB_INSTALL_NAME_BASE = $(DYLIB_INSTALL_NAME_BASE_$(REAL_PLATFORM_NAME));
+DYLIB_INSTALL_NAME_BASE_macosx = $(NORMAL_WEBKIT_FRAMEWORKS_DIR);
+DYLIB_INSTALL_NAME_BASE_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+DYLIB_INSTALL_NAME_BASE_iphonesimulator =  $(SDKROOT)$(DYLIB_INSTALL_NAME_BASE_iphoneos);
 INSTALLHDRS_COPY_PHASE = YES;
 INSTALLHDRS_SCRIPT_PHASE = YES;
 PRODUCT_NAME = WebKit;
 UMBRELLA_FRAMEWORKS_DIR = $(PRODUCTION_FRAMEWORKS_DIR)/WebKit.framework/Versions/A/Frameworks;
 
 OTHER_LDFLAGS = $(OTHER_LDFLAGS_$(REAL_PLATFORM_NAME));
-OTHER_LDFLAGS_iphoneos = -lobjc -framework CFNetwork -framework CoreFoundation -framework CoreGraphics -framework Foundation -framework GraphicsServices -framework ImageIO -framework WebCore;
+OTHER_LDFLAGS_iphoneos = -lobjc -framework CFNetwork -framework CoreFoundation -framework CoreGraphics -framework CoreText -framework Foundation -framework GraphicsServices -framework ImageIO -framework QuartzCore;
 OTHER_LDFLAGS_iphonesimulator = $(OTHER_LDFLAGS_iphoneos);
 OTHER_LDFLAGS_macosx = -sub_umbrella WebCore $(OTHER_LDFLAGS) $(OTHER_LDFLAGS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 OTHER_LDFLAGS_macosx_1070 = -Xlinker -objc_gc_compaction;
@@ -83,7 +89,7 @@ WEBKIT_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_NO = $(NORMAL_WEBKIT_FRAME
 WEBKIT_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_YES = $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
 NORMAL_PRODUCTION_FRAMEWORKS_DIR = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
-NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_macosx = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks;
 
@@ -117,5 +123,8 @@ WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH = $(WEBKITSYSTEMINTERFA
 WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_Debug = $(WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering);
 WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_Release = $(WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering);
 WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_Production = $(PRODUCTION_ROOT)/usr/local/include;
-WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering = $(BUILT_PRODUCTS_DIR)/usr/local/include;
+WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering = $(WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering_$(REAL_PLATFORM_NAME));
+WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering_iphoneos = $(BUILT_PRODUCTS_DIR)/usr/local/include;
+WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering_iphonesimulator = $(BUILT_PRODUCTS_DIR)$(PRODUCTION_ROOT_iphonesimulator)/usr/local/include;
+WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering_macosx = $(BUILT_PRODUCTS_DIR)/usr/local/include;
 
diff --git a/Source/WebKit/mac/DOM/WebDOMOperations.mm b/Source/WebKit/mac/DOM/WebDOMOperations.mm
index 5ea99461f..d3b254500 100644
--- a/Source/WebKit/mac/DOM/WebDOMOperations.mm
+++ b/Source/WebKit/mac/DOM/WebDOMOperations.mm
@@ -35,10 +35,12 @@
 #import "WebArchiveInternal.h"
 #import "WebDataSourcePrivate.h"
 #import "WebFrameInternal.h"
+#import "WebFrameLoaderClient.h"
 #import "WebFramePrivate.h"
 #import "WebKitNSStringExtras.h"
 #import <JavaScriptCore/APICast.h>
 #import <WebCore/Document.h>
+#import <WebCore/Frame.h>
 #import <WebCore/HTMLInputElement.h>
 #import <WebCore/HTMLParserIdioms.h>
 #import <WebCore/JSElement.h>
@@ -76,6 +78,35 @@ using namespace JSC;
 
 @end
 
+class WebFrameFilter : public WebCore::FrameFilter {
+public:
+    WebFrameFilter(WebArchiveSubframeFilter filterBlock);
+    ~WebFrameFilter();
+private:
+    virtual bool shouldIncludeSubframe(Frame*) const OVERRIDE;
+
+    WebArchiveSubframeFilter m_filterBlock;
+};
+
+WebFrameFilter::WebFrameFilter(WebArchiveSubframeFilter filterBlock)
+    : m_filterBlock(Block_copy(filterBlock))
+{
+}
+
+WebFrameFilter::~WebFrameFilter()
+{
+    Block_release(m_filterBlock);
+}
+
+bool WebFrameFilter::shouldIncludeSubframe(Frame* frame) const
+{
+    if (!m_filterBlock)
+        return true;
+        
+    WebFrame* webFrame = static_cast<WebFrameLoaderClient*>(frame->loader()->client())->webFrame();
+    return m_filterBlock(webFrame);
+}
+
 @implementation DOMNode (WebDOMNodeOperations)
 
 - (WebArchive *)webArchive
@@ -83,6 +114,12 @@ using namespace JSC;
     return [[[WebArchive alloc] _initWithCoreLegacyWebArchive:LegacyWebArchive::create(core(self))] autorelease];
 }
 
+- (WebArchive *)webArchiveByFilteringSubframes:(WebArchiveSubframeFilter)webArchiveSubframeFilter
+{
+    WebFrameFilter filter(webArchiveSubframeFilter);
+    return [[[WebArchive alloc] _initWithCoreLegacyWebArchive:LegacyWebArchive::create(core(self), &filter)] autorelease];
+}
+
 @end
 
 @implementation DOMNode (WebDOMNodeOperationsPendingPublic)
diff --git a/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h b/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h
index b579a6f87..d3bf68c52 100644
--- a/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h
+++ b/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h
@@ -47,3 +47,9 @@
 - (NSString *)markupString;
 - (NSRect)_renderRect:(bool *)isReplaced;
 @end
+
+typedef BOOL (^WebArchiveSubframeFilter)(WebFrame* subframe);
+
+@interface DOMNode (WebDOMNodeOperationsPrivate)
+- (WebArchive *)webArchiveByFilteringSubframes:(WebArchiveSubframeFilter)webArchiveSubframeFilter;
+@end
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/ASCIICType.h b/Source/WebKit/mac/ForwardingHeaders/wtf/ASCIICType.h
deleted file mode 100644
index f2258d298..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/ASCIICType.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/ASCIICType.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/AlwaysInline.h b/Source/WebKit/mac/ForwardingHeaders/wtf/AlwaysInline.h
deleted file mode 100644
index 156bd34ca..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/AlwaysInline.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/AlwaysInline.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/Assertions.h b/Source/WebKit/mac/ForwardingHeaders/wtf/Assertions.h
deleted file mode 100644
index c4cc25cf3..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/Assertions.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/Assertions.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/Deque.h b/Source/WebKit/mac/ForwardingHeaders/wtf/Deque.h
deleted file mode 100644
index f1721ca14..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/Deque.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/Deque.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/DisallowCType.h b/Source/WebKit/mac/ForwardingHeaders/wtf/DisallowCType.h
deleted file mode 100644
index 445944be9..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/DisallowCType.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/DisallowCType.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/FastMalloc.h b/Source/WebKit/mac/ForwardingHeaders/wtf/FastMalloc.h
deleted file mode 100644
index 8733b5fbf..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/FastMalloc.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/FastMalloc.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/Forward.h b/Source/WebKit/mac/ForwardingHeaders/wtf/Forward.h
deleted file mode 100644
index 2d707ecb7..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/Forward.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/Forward.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/GetPtr.h b/Source/WebKit/mac/ForwardingHeaders/wtf/GetPtr.h
deleted file mode 100644
index 61baf6df8..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/GetPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/GetPtr.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/HashCountedSet.h b/Source/WebKit/mac/ForwardingHeaders/wtf/HashCountedSet.h
deleted file mode 100644
index 23120ed16..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/HashCountedSet.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/HashCountedSet.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/HashMap.h b/Source/WebKit/mac/ForwardingHeaders/wtf/HashMap.h
deleted file mode 100644
index 4d7d60f91..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/HashMap.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/HashMap.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/HashSet.h b/Source/WebKit/mac/ForwardingHeaders/wtf/HashSet.h
deleted file mode 100644
index 03b7a7098..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/HashSet.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/HashSet.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/HashTraits.h b/Source/WebKit/mac/ForwardingHeaders/wtf/HashTraits.h
deleted file mode 100644
index fa2ce1c45..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/HashTraits.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/HashTraits.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/ListHashSet.h b/Source/WebKit/mac/ForwardingHeaders/wtf/ListHashSet.h
deleted file mode 100644
index 8ed045dd6..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/ListHashSet.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/ListHashSet.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/ListRefPtr.h b/Source/WebKit/mac/ForwardingHeaders/wtf/ListRefPtr.h
deleted file mode 100644
index 2aa23116d..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/ListRefPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/ListRefPtr.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/Locker.h b/Source/WebKit/mac/ForwardingHeaders/wtf/Locker.h
deleted file mode 100644
index 7718305b7..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/Locker.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/Locker.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/MathExtras.h b/Source/WebKit/mac/ForwardingHeaders/wtf/MathExtras.h
deleted file mode 100644
index 865479e00..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/MathExtras.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/MathExtras.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/Noncopyable.h b/Source/WebKit/mac/ForwardingHeaders/wtf/Noncopyable.h
deleted file mode 100644
index 050802453..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/Noncopyable.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/Noncopyable.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/OwnArrayPtr.h b/Source/WebKit/mac/ForwardingHeaders/wtf/OwnArrayPtr.h
deleted file mode 100644
index f10532cdd..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/OwnArrayPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/OwnArrayPtr.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/OwnPtr.h b/Source/WebKit/mac/ForwardingHeaders/wtf/OwnPtr.h
deleted file mode 100644
index ccf0e22ed..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/OwnPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/OwnPtr.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/OwnPtrCommon.h b/Source/WebKit/mac/ForwardingHeaders/wtf/OwnPtrCommon.h
deleted file mode 100644
index efffb81b7..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/OwnPtrCommon.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/PassOwnPtr.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/PassOwnPtr.h b/Source/WebKit/mac/ForwardingHeaders/wtf/PassOwnPtr.h
deleted file mode 100644
index efffb81b7..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/PassOwnPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/PassOwnPtr.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/PassRefPtr.h b/Source/WebKit/mac/ForwardingHeaders/wtf/PassRefPtr.h
deleted file mode 100644
index f1eb4666f..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/PassRefPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/PassRefPtr.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/Platform.h b/Source/WebKit/mac/ForwardingHeaders/wtf/Platform.h
deleted file mode 100644
index 18eaa34b9..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/Platform.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/Platform.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/RefCounted.h b/Source/WebKit/mac/ForwardingHeaders/wtf/RefCounted.h
deleted file mode 100644
index 02c1236f6..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/RefCounted.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/RefCounted.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/RefCountedLeakCounter.h b/Source/WebKit/mac/ForwardingHeaders/wtf/RefCountedLeakCounter.h
deleted file mode 100644
index 3f229d1aa..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/RefCountedLeakCounter.h
+++ /dev/null
@@ -1,2 +0,0 @@
-#include <JavaScriptCore/RefCountedLeakCounter.h>
-
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/RefPtr.h b/Source/WebKit/mac/ForwardingHeaders/wtf/RefPtr.h
deleted file mode 100644
index 33c43be7b..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/RefPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/RefPtr.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/RetainPtr.h b/Source/WebKit/mac/ForwardingHeaders/wtf/RetainPtr.h
deleted file mode 100644
index 8471d5d6d..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/RetainPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/RetainPtr.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/StdLibExtras.h b/Source/WebKit/mac/ForwardingHeaders/wtf/StdLibExtras.h
deleted file mode 100644
index d48b3242c..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/StdLibExtras.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/StdLibExtras.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/TemporaryChange.h b/Source/WebKit/mac/ForwardingHeaders/wtf/TemporaryChange.h
deleted file mode 100644
index 3367eb2d2..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/TemporaryChange.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/TemporaryChange.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/Threading.h b/Source/WebKit/mac/ForwardingHeaders/wtf/Threading.h
deleted file mode 100644
index 771edd126..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/Threading.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/Threading.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/UnusedParam.h b/Source/WebKit/mac/ForwardingHeaders/wtf/UnusedParam.h
deleted file mode 100644
index f1a660060..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/UnusedParam.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/UnusedParam.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/VMTags.h b/Source/WebKit/mac/ForwardingHeaders/wtf/VMTags.h
deleted file mode 100644
index 701e514f7..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/VMTags.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/VMTags.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/ValueCheck.h b/Source/WebKit/mac/ForwardingHeaders/wtf/ValueCheck.h
deleted file mode 100644
index 7a067ff57..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/ValueCheck.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/ValueCheck.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/Vector.h b/Source/WebKit/mac/ForwardingHeaders/wtf/Vector.h
deleted file mode 100644
index 769a55043..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/Vector.h
+++ /dev/null
@@ -1 +0,0 @@
-#import <JavaScriptCore/Vector.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/VectorTraits.h b/Source/WebKit/mac/ForwardingHeaders/wtf/VectorTraits.h
deleted file mode 100644
index 2fc115827..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/VectorTraits.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/VectorTraits.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/unicode/Unicode.h b/Source/WebKit/mac/ForwardingHeaders/wtf/unicode/Unicode.h
deleted file mode 100644
index 623917f76..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/unicode/Unicode.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/Unicode.h>
diff --git a/Source/WebKit/mac/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h b/Source/WebKit/mac/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
deleted file mode 100644
index 6b64eb509..000000000
--- a/Source/WebKit/mac/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/UnicodeIcu.h>
diff --git a/Source/WebKit/mac/Misc/WebKitNSStringExtras.mm b/Source/WebKit/mac/Misc/WebKitNSStringExtras.mm
index 2ba333fdd..08f8e6aff 100644
--- a/Source/WebKit/mac/Misc/WebKitNSStringExtras.mm
+++ b/Source/WebKit/mac/Misc/WebKitNSStringExtras.mm
@@ -184,7 +184,7 @@ static BOOL canUseFastRenderer(const UniChar *buffer, unsigned length)
 
 -(BOOL)_webkit_hasCaseInsensitivePrefix:(NSString *)prefix
 {
-    return [self rangeOfString:prefix options:(NSCaseInsensitiveSearch | NSAnchoredSearch)].location != NSNotFound;
+    return hasCaseInsensitivePrefix(self, prefix);
 }
 
 -(BOOL)_webkit_hasCaseInsensitiveSuffix:(NSString *)suffix
diff --git a/Source/WebKit/mac/Misc/WebNSFileManagerExtras.mm b/Source/WebKit/mac/Misc/WebNSFileManagerExtras.mm
index 39d489cfd..fa150233d 100644
--- a/Source/WebKit/mac/Misc/WebNSFileManagerExtras.mm
+++ b/Source/WebKit/mac/Misc/WebNSFileManagerExtras.mm
@@ -31,7 +31,7 @@
 #import "WebKitNSStringExtras.h"
 #import "WebNSObjectExtras.h"
 #import "WebNSURLExtras.h"
-#import <JavaScriptCore/Assertions.h>
+#import <wtf/Assertions.h>
 #import <WebKitSystemInterface.h>
 #import <sys/stat.h>
 #import <wtf/RetainPtr.h>
diff --git a/Source/WebKit/mac/Misc/WebNSURLExtras.mm b/Source/WebKit/mac/Misc/WebNSURLExtras.mm
index c2351dd3d..98fff7aaa 100644
--- a/Source/WebKit/mac/Misc/WebNSURLExtras.mm
+++ b/Source/WebKit/mac/Misc/WebNSURLExtras.mm
@@ -37,366 +37,27 @@
 #import <Foundation/NSURLRequest.h>
 #import <WebCore/KURL.h>
 #import <WebCore/LoaderNSURLExtras.h>
+#import <WebCore/WebCoreNSURLExtras.h>
 #import <WebKitSystemInterface.h>
 #import <wtf/Assertions.h>
 #import <unicode/uchar.h>
-#import <unicode/uidna.h>
 #import <unicode/uscript.h>
 
 using namespace WebCore;
 using namespace WTF;
 
-typedef void (* StringRangeApplierFunction)(NSString *string, NSRange range, void *context);
-
-// Needs to be big enough to hold an IDN-encoded name.
-// For host names bigger than this, we won't do IDN encoding, which is almost certainly OK.
-#define HOST_NAME_BUFFER_LENGTH 2048
-
 #define URL_BYTES_BUFFER_LENGTH 2048
 
-static pthread_once_t IDNScriptWhiteListFileRead = PTHREAD_ONCE_INIT;
-static uint32_t IDNScriptWhiteList[(USCRIPT_CODE_LIMIT + 31) / 32];
-
-static inline BOOL isLookalikeCharacter(int charCode)
-{
-// FIXME: Move this code down into WebCore so it can be shared with other platforms.
-
-// This function treats the following as unsafe, lookalike characters:
-// any non-printable character, any character considered as whitespace that isn't already converted to a space by ICU, 
-// and any ignorable character.
-
-// We also considered the characters in Mozilla's blacklist (http://kb.mozillazine.org/Network.IDN.blacklist_chars), 
-// and included all of these characters that ICU can encode.
-
-    if (!u_isprint(charCode) || u_isUWhiteSpace(charCode) || u_hasBinaryProperty(charCode, UCHAR_DEFAULT_IGNORABLE_CODE_POINT))
-        return YES;
-
-    switch (charCode) {
-        case 0x00ED: /* LATIN SMALL LETTER I WITH ACUTE */
-        case 0x01C3: /* LATIN LETTER RETROFLEX CLICK */
-        case 0x0251: /* LATIN SMALL LETTER ALPHA */
-        case 0x0261: /* LATIN SMALL LETTER SCRIPT G */
-        case 0x0337: /* COMBINING SHORT SOLIDUS OVERLAY */
-        case 0x0338: /* COMBINING LONG SOLIDUS OVERLAY */
-        case 0x05B4: /* HEBREW POINT HIRIQ */
-        case 0x05BC: /* HEBREW POINT DAGESH OR MAPIQ */
-        case 0x05C3: /* HEBREW PUNCTUATION SOF PASUQ */
-        case 0x05F4: /* HEBREW PUNCTUATION GERSHAYIM */
-        case 0x0660: /* ARABIC INDIC DIGIT ZERO */
-        case 0x06D4: /* ARABIC FULL STOP */
-        case 0x06F0: /* EXTENDED ARABIC INDIC DIGIT ZERO */
-        case 0x2027: /* HYPHENATION POINT */
-        case 0x2039: /* SINGLE LEFT-POINTING ANGLE QUOTATION MARK */
-        case 0x203A: /* SINGLE RIGHT-POINTING ANGLE QUOTATION MARK */
-        case 0x2044: /* FRACTION SLASH */
-        case 0x2215: /* DIVISION SLASH */
-        case 0x2216: /* SET MINUS */
-        case 0x233F: /* APL FUNCTIONAL SYMBOL SLASH BAR */
-        case 0x23AE: /* INTEGRAL EXTENSION */
-        case 0x244A: /* OCR DOUBLE BACKSLASH */
-        case 0x2571: /* BOX DRAWINGS LIGHT DIAGONAL UPPER RIGHT TO LOWER LEFT */
-        case 0x2572: /* BOX DRAWINGS LIGHT DIAGONAL UPPER LEFT TO LOWER RIGHT */
-        case 0x29F8: /* BIG SOLIDUS */
-        case 0x29f6: /* SOLIDUS WITH OVERBAR */
-        case 0x2AFB: /* TRIPLE SOLIDUS BINARY RELATION */
-        case 0x2AFD: /* DOUBLE SOLIDUS OPERATOR */
-        case 0x3008: /* LEFT ANGLE BRACKET */
-        case 0x3014: /* LEFT TORTOISE SHELL BRACKET */
-        case 0x3015: /* RIGHT TORTOISE SHELL BRACKET */
-        case 0x3033: /* VERTICAL KANA REPEAT MARK UPPER HALF */
-        case 0x3035: /* VERTICAL KANA REPEAT MARK LOWER HALF */
-        case 0x321D: /* PARENTHESIZED KOREAN CHARACTER OJEON */
-        case 0x321E: /* PARENTHESIZED KOREAN CHARACTER O HU */
-        case 0x33DF: /* SQUARE A OVER M */
-        case 0xFE14: /* PRESENTATION FORM FOR VERTICAL SEMICOLON */
-        case 0xFE15: /* PRESENTATION FORM FOR VERTICAL EXCLAMATION MARK */
-        case 0xFE3F: /* PRESENTATION FORM FOR VERTICAL LEFT ANGLE BRACKET */
-        case 0xFE5D: /* SMALL LEFT TORTOISE SHELL BRACKET */
-        case 0xFE5E: /* SMALL RIGHT TORTOISE SHELL BRACKET */
-            return YES;
-        default:
-            return NO;
-    }
-}
-
-static char hexDigit(int i)
-{
-    if (i < 0 || i > 16) {
-        LOG_ERROR("illegal hex digit");
-        return '0';
-    }
-    int h = i;
-    if (h >= 10) {
-        h = h - 10 + 'A'; 
-    }
-    else {
-        h += '0';
-    }
-    return h;
-}
-
-static BOOL isHexDigit(char c)
-{
-    return (c >= '0' && c <= '9') || (c >= 'A' && c <= 'F') || (c >= 'a' && c <= 'f');
-}
-
-static int hexDigitValue(char c)
-{
-    if (c >= '0' && c <= '9') {
-        return c - '0';
-    }
-    if (c >= 'A' && c <= 'F') {
-        return c - 'A' + 10;
-    }
-    if (c >= 'a' && c <= 'f') {
-        return c - 'a' + 10;
-    }
-    LOG_ERROR("illegal hex digit");
-    return 0;
-}
-
-static void applyHostNameFunctionToMailToURLString(NSString *string, StringRangeApplierFunction f, void *context)
-{
-    // In a mailto: URL, host names come after a '@' character and end with a '>' or ',' or '?' character.
-    // Skip quoted strings so that characters in them don't confuse us.
-    // When we find a '?' character, we are past the part of the URL that contains host names.
-
-    static NSCharacterSet *hostNameOrStringStartCharacters;
-    if (hostNameOrStringStartCharacters == nil) {
-        hostNameOrStringStartCharacters = [NSCharacterSet characterSetWithCharactersInString:@"\"@?"];
-        CFRetain(hostNameOrStringStartCharacters);
-    }
-    static NSCharacterSet *hostNameEndCharacters;
-    if (hostNameEndCharacters == nil) {
-        hostNameEndCharacters = [NSCharacterSet characterSetWithCharactersInString:@">,?"];
-        CFRetain(hostNameEndCharacters);
-    }
-    static NSCharacterSet *quotedStringCharacters;
-    if (quotedStringCharacters == nil) {
-        quotedStringCharacters = [NSCharacterSet characterSetWithCharactersInString:@"\"\\"];
-        CFRetain(quotedStringCharacters);
-    }
-
-    unsigned stringLength = [string length];
-    NSRange remaining = NSMakeRange(0, stringLength);
-    
-    while (1) {
-        // Find start of host name or of quoted string.
-        NSRange hostNameOrStringStart = [string rangeOfCharacterFromSet:hostNameOrStringStartCharacters options:0 range:remaining];
-        if (hostNameOrStringStart.location == NSNotFound) {
-            return;
-        }
-        unichar c = [string characterAtIndex:hostNameOrStringStart.location];
-        remaining.location = NSMaxRange(hostNameOrStringStart);
-        remaining.length = stringLength - remaining.location;
-
-        if (c == '?') {
-            return;
-        }
-        
-        if (c == '@') {
-            // Find end of host name.
-            unsigned hostNameStart = remaining.location;
-            NSRange hostNameEnd = [string rangeOfCharacterFromSet:hostNameEndCharacters options:0 range:remaining];
-            BOOL done;
-            if (hostNameEnd.location == NSNotFound) {
-                hostNameEnd.location = stringLength;
-                done = YES;
-            } else {
-                remaining.location = hostNameEnd.location;
-                remaining.length = stringLength - remaining.location;
-                done = NO;
-            }
-
-            // Process host name range.
-            f(string, NSMakeRange(hostNameStart, hostNameEnd.location - hostNameStart), context);
-
-            if (done) {
-                return;
-            }
-        } else {
-            // Skip quoted string.
-            ASSERT(c == '"');
-            while (1) {
-                NSRange escapedCharacterOrStringEnd = [string rangeOfCharacterFromSet:quotedStringCharacters options:0 range:remaining];
-                if (escapedCharacterOrStringEnd.location == NSNotFound) {
-                    return;
-                }
-                c = [string characterAtIndex:escapedCharacterOrStringEnd.location];
-                remaining.location = NSMaxRange(escapedCharacterOrStringEnd);
-                remaining.length = stringLength - remaining.location;
-                
-                // If we are the end of the string, then break from the string loop back to the host name loop.
-                if (c == '"') {
-                    break;
-                }
-                
-                // Skip escaped character.
-                ASSERT(c == '\\');
-                if (remaining.length == 0) {
-                    return;
-                }                
-                remaining.location += 1;
-                remaining.length -= 1;
-            }
-        }
-    }
-}
-
-static void applyHostNameFunctionToURLString(NSString *string, StringRangeApplierFunction f, void *context)
-{
-    // Find hostnames. Too bad we can't use any real URL-parsing code to do this,
-    // but we have to do it before doing all the %-escaping, and this is the only
-    // code we have that parses mailto URLs anyway.
-
-    // Maybe we should implement this using a character buffer instead?
-
-    if ([string _webkit_hasCaseInsensitivePrefix:@"mailto:"]) {
-        applyHostNameFunctionToMailToURLString(string, f, context);
-        return;
-    }
-
-    // Find the host name in a hierarchical URL.
-    // It comes after a "://" sequence, with scheme characters preceding.
-    // If ends with the end of the string or a ":", "/", or a "?".
-    // If there is a "@" character, the host part is just the part after the "@".
-    NSRange separatorRange = [string rangeOfString:@"://"];
-    if (separatorRange.location == NSNotFound) {
-        return;
-    }
-
-    // Check that all characters before the :// are valid scheme characters.
-    static NSCharacterSet *nonSchemeCharacters;
-    if (nonSchemeCharacters == nil) {
-        nonSchemeCharacters = [[NSCharacterSet characterSetWithCharactersInString:@"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-."] invertedSet];
-        CFRetain(nonSchemeCharacters);
-    }
-    if ([string rangeOfCharacterFromSet:nonSchemeCharacters options:0 range:NSMakeRange(0, separatorRange.location)].location != NSNotFound) {
-        return;
-    }
-
-    unsigned stringLength = [string length];
-
-    static NSCharacterSet *hostTerminators;
-    if (hostTerminators == nil) {
-        hostTerminators = [NSCharacterSet characterSetWithCharactersInString:@":/?#"];
-        CFRetain(hostTerminators);
-    }
-
-    // Start after the separator.
-    unsigned authorityStart = NSMaxRange(separatorRange);
-
-    // Find terminating character.
-    NSRange hostNameTerminator = [string rangeOfCharacterFromSet:hostTerminators options:0 range:NSMakeRange(authorityStart, stringLength - authorityStart)];
-    unsigned hostNameEnd = hostNameTerminator.location == NSNotFound ? stringLength : hostNameTerminator.location;
-
-    // Find "@" for the start of the host name.
-    NSRange userInfoTerminator = [string rangeOfString:@"@" options:0 range:NSMakeRange(authorityStart, hostNameEnd - authorityStart)];
-    unsigned hostNameStart = userInfoTerminator.location == NSNotFound ? authorityStart : NSMaxRange(userInfoTerminator);
-
-    f(string, NSMakeRange(hostNameStart, hostNameEnd - hostNameStart), context);
-}
-
 @implementation NSURL (WebNSURLExtras)
 
-static void collectRangesThatNeedMapping(NSString *string, NSRange range, void *context, BOOL encode)
-{
-    BOOL needsMapping = encode
-        ? [string _web_hostNameNeedsEncodingWithRange:range]
-        : [string _web_hostNameNeedsDecodingWithRange:range];
-    if (!needsMapping) {
-        return;
-    }
-
-    NSMutableArray **array = (NSMutableArray **)context;
-    if (*array == nil) {
-        *array = [[NSMutableArray alloc] init];
-    }
-
-    [*array addObject:[NSValue valueWithRange:range]];
-}
-
-static void collectRangesThatNeedEncoding(NSString *string, NSRange range, void *context)
-{
-    return collectRangesThatNeedMapping(string, range, context, YES);
-}
-
-static void collectRangesThatNeedDecoding(NSString *string, NSRange range, void *context)
-{
-    return collectRangesThatNeedMapping(string, range, context, NO);
-}
-
-static NSString *mapHostNames(NSString *string, BOOL encode)
-{
-    // Generally, we want to optimize for the case where there is one host name that does not need mapping.
-    
-    if (encode && [string canBeConvertedToEncoding:NSASCIIStringEncoding])
-        return string;
-
-    // Make a list of ranges that actually need mapping.
-    NSMutableArray *hostNameRanges = nil;
-    StringRangeApplierFunction f = encode
-        ? collectRangesThatNeedEncoding
-        : collectRangesThatNeedDecoding;
-    applyHostNameFunctionToURLString(string, f, &hostNameRanges);
-    if (hostNameRanges == nil)
-        return string;
-
-    // Do the mapping.
-    NSMutableString *mutableCopy = [string mutableCopy];
-    unsigned i = [hostNameRanges count];
-    while (i-- != 0) {
-        NSRange hostNameRange = [[hostNameRanges objectAtIndex:i] rangeValue];
-        NSString *mappedHostName = encode
-            ? [string _web_encodeHostNameWithRange:hostNameRange]
-            : [string _web_decodeHostNameWithRange:hostNameRange];
-        [mutableCopy replaceCharactersInRange:hostNameRange withString:mappedHostName];
-    }
-    [hostNameRanges release];
-    return [mutableCopy autorelease];
-}
-
 + (NSURL *)_web_URLWithUserTypedString:(NSString *)string relativeToURL:(NSURL *)URL
 {
-    if (string == nil) {
-        return nil;
-    }
-    string = mapHostNames([string _webkit_stringByTrimmingWhitespace], YES);
-
-    NSData *userTypedData = [string dataUsingEncoding:NSUTF8StringEncoding];
-    ASSERT(userTypedData);
-
-    const UInt8 *inBytes = static_cast<const UInt8 *>([userTypedData bytes]);
-    int inLength = [userTypedData length];
-    if (inLength == 0) {
-        return [NSURL URLWithString:@""];
-    }
-    
-    char *outBytes = static_cast<char *>(malloc(inLength * 3)); // large enough to %-escape every character
-    char *p = outBytes;
-    int outLength = 0;
-    int i;
-    for (i = 0; i < inLength; i++) {
-        UInt8 c = inBytes[i];
-        if (c <= 0x20 || c >= 0x7f) {
-            *p++ = '%';
-            *p++ = hexDigit(c >> 4);
-            *p++ = hexDigit(c & 0xf);
-            outLength += 3;
-        }
-        else {
-            *p++ = c;
-            outLength++;
-        }
-    }
- 
-    NSData *data = [NSData dataWithBytesNoCopy:outBytes length:outLength]; // adopts outBytes
-    return [self _web_URLWithData:data relativeToURL:URL];
+    return URLWithUserTypedString(string, URL);
 }
 
 + (NSURL *)_web_URLWithUserTypedString:(NSString *)string
 {
-    return [self _web_URLWithUserTypedString:string relativeToURL:nil];
+    return URLWithUserTypedString(string, nil);
 }
 
 + (NSURL *)_web_URLWithDataAsString:(NSString *)string
@@ -414,191 +75,45 @@ static NSString *mapHostNames(NSString *string, BOOL encode)
     }
     string = [string _webkit_stringByTrimmingWhitespace];
     NSData *data = [string dataUsingEncoding:NSISOLatin1StringEncoding];
-    return [self _web_URLWithData:data relativeToURL:baseURL];
+    return URLWithData(data, baseURL);
 }
 
 + (NSURL *)_web_URLWithData:(NSData *)data
 {
-    return [NSURL _web_URLWithData:data relativeToURL:nil];
+    return URLWithData(data, nil);
 }      
 
 + (NSURL *)_web_URLWithData:(NSData *)data relativeToURL:(NSURL *)baseURL
 {
-    if (data == nil)
-        return nil;
-    
-    NSURL *result = nil;
-    size_t length = [data length];
-    if (length > 0) {
-        // work around <rdar://4470771>: CFURLCreateAbsoluteURLWithBytes(.., TRUE) doesn't remove non-path components.
-        baseURL = [baseURL _webkit_URLByRemovingResourceSpecifier];
-        
-        const UInt8 *bytes = static_cast<const UInt8*>([data bytes]);
-
-        // CFURLCreateAbsoluteURLWithBytes would complain to console if we passed a path to it.
-        if (bytes[0] == '/' && !baseURL)
-            return nil;
-
-        // NOTE: We use UTF-8 here since this encoding is used when computing strings when returning URL components
-        // (e.g calls to NSURL -path). However, this function is not tolerant of illegal UTF-8 sequences, which
-        // could either be a malformed string or bytes in a different encoding, like shift-jis, so we fall back
-        // onto using ISO Latin 1 in those cases.
-        result = WebCFAutorelease(CFURLCreateAbsoluteURLWithBytes(NULL, bytes, length, kCFStringEncodingUTF8, (CFURLRef)baseURL, YES));
-        if (!result)
-            result = WebCFAutorelease(CFURLCreateAbsoluteURLWithBytes(NULL, bytes, length, kCFStringEncodingISOLatin1, (CFURLRef)baseURL, YES));
-    } else
-        result = [NSURL URLWithString:@""];
-    
-    return result;
+    return URLWithData(data, baseURL);
 }
 
 - (NSData *)_web_originalData
 {
-    UInt8 *buffer = (UInt8 *)malloc(URL_BYTES_BUFFER_LENGTH);
-    CFIndex bytesFilled = CFURLGetBytes((CFURLRef)self, buffer, URL_BYTES_BUFFER_LENGTH);
-    if (bytesFilled == -1) {
-        CFIndex bytesToAllocate = CFURLGetBytes((CFURLRef)self, NULL, 0);
-        buffer = (UInt8 *)realloc(buffer, bytesToAllocate);
-        bytesFilled = CFURLGetBytes((CFURLRef)self, buffer, bytesToAllocate);
-        ASSERT(bytesFilled == bytesToAllocate);
-    }
-    
-    // buffer is adopted by the NSData
-    NSData *data = [NSData dataWithBytesNoCopy:buffer length:bytesFilled freeWhenDone:YES];
-    
-    NSURL *baseURL = (NSURL *)CFURLGetBaseURL((CFURLRef)self);
-    if (baseURL)
-        return [[NSURL _web_URLWithData:data relativeToURL:baseURL] _web_originalData];
-    return data;
+    return originalURLData(self);
 }
 
 - (NSString *)_web_originalDataAsString
 {
-    return [[[NSString alloc] initWithData:[self _web_originalData] encoding:NSISOLatin1StringEncoding] autorelease];
-}
-
-static CFStringRef createStringWithEscapedUnsafeCharacters(CFStringRef string)
-{
-    CFIndex length = CFStringGetLength(string);
-    Vector<UChar, 2048> sourceBuffer(length);
-    CFStringGetCharacters(string, CFRangeMake(0, length), sourceBuffer.data());
-
-    Vector<UChar, 2048> outBuffer;
-
-    CFIndex i = 0;
-    while (i < length) {
-        UChar32 c;
-        U16_NEXT(sourceBuffer, i, length, c)
-
-        if (isLookalikeCharacter(c)) {
-            uint8_t utf8Buffer[4];
-            CFIndex offset = 0;
-            UBool failure = false;
-            U8_APPEND(utf8Buffer, offset, 4, c, failure)
-            ASSERT(!failure);
-
-            for (CFIndex j = 0; j < offset; ++j) {
-                outBuffer.append('%');
-                outBuffer.append(hexDigit(utf8Buffer[j] >> 4));
-                outBuffer.append(hexDigit(utf8Buffer[j] & 0xf));
-            }
-        } else {
-            UChar utf16Buffer[2];
-            CFIndex offset = 0;
-            UBool failure = false;
-            U16_APPEND(utf16Buffer, offset, 2, c, failure)
-            ASSERT(!failure);
-            for (CFIndex j = 0; j < offset; ++j)
-                outBuffer.append(utf16Buffer[j]);
-        }
-    }
-
-    return CFStringCreateWithCharacters(NULL, outBuffer.data(), outBuffer.size());
+    return [[[NSString alloc] initWithData:originalURLData(self) encoding:NSISOLatin1StringEncoding] autorelease];
 }
 
 - (NSString *)_web_userVisibleString
 {
-    NSData *data = [self _web_originalData];
-    const unsigned char *before = static_cast<const unsigned char*>([data bytes]);
-    int length = [data length];
-
-    bool needsHostNameDecoding = false;
-
-    const unsigned char *p = before;
-    int bufferLength = (length * 3) + 1;
-    char *after = static_cast<char *>(malloc(bufferLength)); // large enough to %-escape every character
-    char *q = after;
-    int i;
-    for (i = 0; i < length; i++) {
-        unsigned char c = p[i];
-        // unescape escape sequences that indicate bytes greater than 0x7f
-        if (c == '%' && (i + 1 < length && isHexDigit(p[i + 1])) && i + 2 < length && isHexDigit(p[i + 2])) {
-            unsigned char u = (hexDigitValue(p[i + 1]) << 4) | hexDigitValue(p[i + 2]);
-            if (u > 0x7f) {
-                // unescape
-                *q++ = u;
-            } else {
-                // do not unescape
-                *q++ = p[i];
-                *q++ = p[i + 1];
-                *q++ = p[i + 2];
-            }
-            i += 2;
-        } else {
-            *q++ = c;
-
-            // Check for "xn--" in an efficient, non-case-sensitive, way.
-            if (c == '-' && i >= 3 && !needsHostNameDecoding && (q[-4] | 0x20) == 'x' && (q[-3] | 0x20) == 'n' && q[-2] == '-')
-                needsHostNameDecoding = true;
-        }
-    }
-    *q = '\0';
-    
-    // Check string to see if it can be converted to display using UTF-8  
-    NSString *result = [NSString stringWithUTF8String:after];
-    if (!result) {
-        // Could not convert to UTF-8.
-        // Convert characters greater than 0x7f to escape sequences.
-        // Shift current string to the end of the buffer
-        // then we will copy back bytes to the start of the buffer 
-        // as we convert.
-        int afterlength = q - after;
-        char *p = after + bufferLength - afterlength - 1;
-        memmove(p, after, afterlength + 1); // copies trailing '\0'
-        char *q = after;
-        while (*p) {
-            unsigned char c = *p;
-            if (c > 0x7f) {
-                *q++ = '%';
-                *q++ = hexDigit(c >> 4);
-                *q++ = hexDigit(c & 0xf);
-            } else {
-                *q++ = *p;
-            }
-            p++;
-        }
-        *q = '\0';
-        result = [NSString stringWithUTF8String:after];
-    }
-
-    free(after);
-
-    result = mapHostNames(result, !needsHostNameDecoding);
-    result = [result precomposedStringWithCanonicalMapping];
-    return WebCFAutorelease(createStringWithEscapedUnsafeCharacters((CFStringRef)result));
+    return userVisibleString(self);
 }
 
 - (BOOL)_web_isEmpty
 {
     if (!CFURLGetBaseURL((CFURLRef)self))
         return CFURLGetBytes((CFURLRef)self, NULL, 0) == 0;
-    return [[self _web_originalData] length] == 0;
+    return [originalURLData(self) length] == 0;
 }
 
 - (const char *)_web_URLCString
 {
     NSMutableData *data = [NSMutableData data];
-    [data appendData:[self _web_originalData]];
+    [data appendData:originalURLData(self)];
     [data appendBytes:"\0" length:1];
     return (const char *)[data bytes];
  }
@@ -626,76 +141,22 @@ static CFStringRef createStringWithEscapedUnsafeCharacters(CFStringRef string)
 
 - (NSURL *)_web_URLByTruncatingOneCharacterBeforeComponent:(CFURLComponentType)component
 {
-    CFRange fragRg = CFURLGetByteRangeForComponent((CFURLRef)self, component, NULL);
-    if (fragRg.location == kCFNotFound)
-        return self;
- 
-    UInt8 *urlBytes, buffer[2048];
-    CFIndex numBytes = CFURLGetBytes((CFURLRef)self, buffer, 2048);
-    if (numBytes == -1) {
-        numBytes = CFURLGetBytes((CFURLRef)self, NULL, 0);
-        urlBytes = static_cast<UInt8*>(malloc(numBytes));
-        CFURLGetBytes((CFURLRef)self, urlBytes, numBytes);
-    } else
-        urlBytes = buffer;
-     
-    NSURL *result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, fragRg.location - 1, kCFStringEncodingUTF8, NULL));
-    if (!result)
-        result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, fragRg.location - 1, kCFStringEncodingISOLatin1, NULL));
-     
-    if (urlBytes != buffer) free(urlBytes);
-    return result ? [result autorelease] : self;
+    return URLByTruncatingOneCharacterBeforeComponent(self, component);
 }
 
 - (NSURL *)_webkit_URLByRemovingFragment
 {
-    return [self _web_URLByTruncatingOneCharacterBeforeComponent:kCFURLComponentFragment];
+    return URLByTruncatingOneCharacterBeforeComponent(self, kCFURLComponentFragment);
 }
 
 - (NSURL *)_webkit_URLByRemovingResourceSpecifier
 {
-    return [self _web_URLByTruncatingOneCharacterBeforeComponent:kCFURLComponentResourceSpecifier];
-}
-
-- (NSURL *)_web_URLByRemovingComponentAndSubsequentCharacter:(CFURLComponentType)component
-{
-    CFRange range = CFURLGetByteRangeForComponent((CFURLRef)self, component, 0);
-    if (range.location == kCFNotFound)
-        return self;
-
-    // Remove one subsequent character.
-    ++range.length;
-
-    UInt8* urlBytes;
-    UInt8 buffer[2048];
-    CFIndex numBytes = CFURLGetBytes((CFURLRef)self, buffer, 2048);
-    if (numBytes == -1) {
-        numBytes = CFURLGetBytes((CFURLRef)self, NULL, 0);
-        urlBytes = static_cast<UInt8*>(malloc(numBytes));
-        CFURLGetBytes((CFURLRef)self, urlBytes, numBytes);
-    } else
-        urlBytes = buffer;
-
-    if (numBytes < range.location)
-        return self;
-    if (numBytes < range.location + range.length)
-        range.length = numBytes - range.location;
-
-    memmove(urlBytes + range.location, urlBytes + range.location + range.length, numBytes - range.location + range.length);
-
-    NSURL *result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, numBytes - range.length, kCFStringEncodingUTF8, NULL));
-    if (!result)
-        result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, numBytes - range.length, kCFStringEncodingISOLatin1, NULL));
-
-    if (urlBytes != buffer)
-        free(urlBytes);
-
-    return result ? [result autorelease] : self;
+    return URLByTruncatingOneCharacterBeforeComponent(self, kCFURLComponentResourceSpecifier);
 }
 
 - (NSURL *)_web_URLByRemovingUserInfo
 {
-    return [self _web_URLByRemovingComponentAndSubsequentCharacter:kCFURLComponentUserInfo];
+    return URLByRemovingUserInfo(self);
 }
 
 - (BOOL)_webkit_isJavaScriptURL
@@ -764,16 +225,6 @@ static CFStringRef createStringWithEscapedUnsafeCharacters(CFStringRef string)
 }
 
 
--(BOOL)_web_hasQuestionMarkOnlyQueryString
-{
-    CFRange rangeWithSeparators;
-    CFURLGetByteRangeForComponent((CFURLRef)self, kCFURLComponentQuery, &rangeWithSeparators);
-    if (rangeWithSeparators.location != kCFNotFound && rangeWithSeparators.length == 1) {
-        return YES;
-    }
-    return NO;
-}
-
 -(NSData *)_web_schemeSeparatorWithoutColon
 {
     NSData *result = nil;
@@ -790,77 +241,19 @@ static CFStringRef createStringWithEscapedUnsafeCharacters(CFStringRef string)
     return result;
 }
 
-#define completeURL (CFURLComponentType)-1
-
 -(NSData *)_web_dataForURLComponentType:(CFURLComponentType)componentType
 {
-    static int URLComponentTypeBufferLength = 2048;
-    
-    UInt8 staticAllBytesBuffer[URLComponentTypeBufferLength];
-    UInt8 *allBytesBuffer = staticAllBytesBuffer;
-    
-    CFIndex bytesFilled = CFURLGetBytes((CFURLRef)self, allBytesBuffer, URLComponentTypeBufferLength);
-    if (bytesFilled == -1) {
-        CFIndex bytesToAllocate = CFURLGetBytes((CFURLRef)self, NULL, 0);
-        allBytesBuffer = static_cast<UInt8 *>(malloc(bytesToAllocate));
-        bytesFilled = CFURLGetBytes((CFURLRef)self, allBytesBuffer, bytesToAllocate);
-    }
-    
-    CFRange range;
-    if (componentType != completeURL) {
-        range = CFURLGetByteRangeForComponent((CFURLRef)self, componentType, NULL);
-        if (range.location == kCFNotFound) {
-            return nil;
-        }
-    }
-    else {
-        range.location = 0;
-        range.length = bytesFilled;
-    }
-    
-    NSData *componentData = [NSData dataWithBytes:allBytesBuffer + range.location length:range.length]; 
-    
-    const unsigned char *bytes = static_cast<const unsigned char *>([componentData bytes]);
-    NSMutableData *resultData = [NSMutableData data];
-    // NOTE: add leading '?' to query strings non-zero length query strings.
-    // NOTE: retain question-mark only query strings.
-    if (componentType == kCFURLComponentQuery) {
-        if (range.length > 0 || [self _web_hasQuestionMarkOnlyQueryString]) {
-            [resultData appendBytes:"?" length:1];    
-        }
-    }
-    int i;
-    for (i = 0; i < range.length; i++) {
-        unsigned char c = bytes[i];
-        if (c <= 0x20 || c >= 0x7f) {
-            char escaped[3];
-            escaped[0] = '%';
-            escaped[1] = hexDigit(c >> 4);
-            escaped[2] = hexDigit(c & 0xf);
-            [resultData appendBytes:escaped length:3];    
-        }
-        else {
-            char b[1];
-            b[0] = c;
-            [resultData appendBytes:b length:1];    
-        }               
-    }
-    
-    if (staticAllBytesBuffer != allBytesBuffer) {
-        free(allBytesBuffer);
-    }
-    
-    return resultData;
+    return dataForURLComponentType(self, componentType);
 }
 
 -(NSData *)_web_schemeData
 {
-    return [self _web_dataForURLComponentType:kCFURLComponentScheme];
+    return dataForURLComponentType(self, kCFURLComponentScheme);
 }
 
 -(NSData *)_web_hostData
 {
-    NSData *result = [self _web_dataForURLComponentType:kCFURLComponentHost];
+    NSData *result = dataForURLComponentType(self, kCFURLComponentHost);
     NSData *scheme = [self _web_schemeData];
     // Take off localhost for file
     if ([scheme _web_isCaseInsensitiveEqualToCString:"file"]) {
@@ -897,49 +290,9 @@ static CFStringRef createStringWithEscapedUnsafeCharacters(CFStringRef string)
 
 - (BOOL)_web_isUserVisibleURL
 {
-    BOOL valid = YES;
-    // get buffer
-
-    char static_buffer[1024];
-    const char *p;
-    BOOL success = CFStringGetCString((CFStringRef)self, static_buffer, 1023, kCFStringEncodingUTF8);
-    if (success) {
-        p = static_buffer;
-    } else {
-        p = [self UTF8String];
-    }
-
-    int length = strlen(p);
-
-    // check for characters <= 0x20 or >=0x7f, %-escape sequences of %7f, and xn--, these
-    // are the things that will lead _web_userVisibleString to actually change things.
-    int i;
-    for (i = 0; i < length; i++) {
-        unsigned char c = p[i];
-        // escape control characters, space, and delete
-        if (c <= 0x20 || c == 0x7f) {
-            valid = NO;
-            break;
-        } else if (c == '%' && (i + 1 < length && isHexDigit(p[i + 1])) && i + 2 < length && isHexDigit(p[i + 2])) {
-            unsigned char u = (hexDigitValue(p[i + 1]) << 4) | hexDigitValue(p[i + 2]);
-            if (u > 0x7f) {
-                valid = NO;
-                break;
-            }
-            i += 2;
-        } else {
-            // Check for "xn--" in an efficient, non-case-sensitive, way.
-            if (c == '-' && i >= 3 && (p[i - 3] | 0x20) == 'x' && (p[i - 2] | 0x20) == 'n' && p[i - 1] == '-') {
-                valid = NO;
-                break;
-            }
-        }
-    }
-
-    return valid;
+    return isUserVisibleURL(self);
 }
 
-
 - (BOOL)_webkit_isJavaScriptURL
 {
     return [self _webkit_hasCaseInsensitivePrefix:@"javascript:"];
@@ -973,204 +326,34 @@ static CFStringRef createStringWithEscapedUnsafeCharacters(CFStringRef string)
     return lastChar == '/' && [self _webkit_hasCaseInsensitivePrefix:@"ftp:"];
 }
 
-
-static BOOL readIDNScriptWhiteListFile(NSString *filename)
-{
-    if (!filename) {
-        return NO;
-    }
-    FILE *file = fopen([filename fileSystemRepresentation], "r");
-    if (file == NULL) {
-        return NO;
-    }
-
-    // Read a word at a time.
-    // Allow comments, starting with # character to the end of the line.
-    while (1) {
-        // Skip a comment if present.
-        int result = fscanf(file, " #%*[^\n\r]%*[\n\r]");
-        if (result == EOF) {
-            break;
-        }
-
-        // Read a script name if present.
-        char word[33];
-        result = fscanf(file, " %32[^# \t\n\r]%*[^# \t\n\r] ", word);
-        if (result == EOF) {
-            break;
-        }
-        if (result == 1) {
-            // Got a word, map to script code and put it into the array.
-            int32_t script = u_getPropertyValueEnum(UCHAR_SCRIPT, word);
-            if (script >= 0 && script < USCRIPT_CODE_LIMIT) {
-                size_t index = script / 32;
-                uint32_t mask = 1 << (script % 32);
-                IDNScriptWhiteList[index] |= mask;
-            }
-        }
-    }
-    fclose(file);
-    return YES;
-}
-
-static void readIDNScriptWhiteList(void)
-{
-    // Read white list from library.
-    NSArray *dirs = NSSearchPathForDirectoriesInDomains(NSLibraryDirectory, NSAllDomainsMask, YES);
-    int i, numDirs = [dirs count];
-    for (i = 0; i < numDirs; i++) {
-        NSString *dir = [dirs objectAtIndex:i];
-        if (readIDNScriptWhiteListFile([dir stringByAppendingPathComponent:@"IDNScriptWhiteList.txt"])) {
-            return;
-        }
-    }
-
-    // Fall back on white list inside bundle.
-    NSBundle *bundle = [NSBundle bundleWithIdentifier:@"com.apple.WebKit"];
-    readIDNScriptWhiteListFile([bundle pathForResource:@"IDNScriptWhiteList" ofType:@"txt"]);
-}
-
-static BOOL allCharactersInIDNScriptWhiteList(const UChar *buffer, int32_t length)
-{
-    pthread_once(&IDNScriptWhiteListFileRead, readIDNScriptWhiteList);
-
-    int32_t i = 0;
-    while (i < length) {
-        UChar32 c;
-        U16_NEXT(buffer, i, length, c)
-        UErrorCode error = U_ZERO_ERROR;
-        UScriptCode script = uscript_getScript(c, &error);
-        if (error != U_ZERO_ERROR) {
-            LOG_ERROR("got ICU error while trying to look at scripts: %d", error);
-            return NO;
-        }
-        if (script < 0) {
-            LOG_ERROR("got negative number for script code from ICU: %d", script);
-            return NO;
-        }
-        if (script >= USCRIPT_CODE_LIMIT) {
-            return NO;
-        }
-        size_t index = script / 32;
-        uint32_t mask = 1 << (script % 32);
-        if (!(IDNScriptWhiteList[index] & mask)) {
-            return NO;
-        }
-
-        if (isLookalikeCharacter(c))
-            return NO;
-    }
-    return YES;
-}
-
-static BOOL allCharactersAllowedByTLDRules(const UChar* buffer, int32_t length)
-{
-    // Skip trailing dot for root domain.
-    if (buffer[length - 1] == '.')
-        --length;
-
-    if (length > 3
-        && buffer[length - 3] == '.'
-        && buffer[length - 2] == 0x0440 // CYRILLIC SMALL LETTER ER
-        && buffer[length - 1] == 0x0444) // CYRILLIC SMALL LETTER EF
-    {
-        // Rules defined by <http://www.cctld.ru/ru/docs/rulesrf.php>. This code only checks requirements that matter for presentation purposes.
-        for (int32_t i = length - 4; i; --i) {
-            UChar ch = buffer[i];
-
-            // Only modern Russian letters, digits and dashes are allowed.
-            if ((ch >= 0x0430 && ch <= 0x044f)
-                || ch == 0x0451
-                || (ch >= '0' && ch <= '9')
-                || ch == '-')
-                continue;
-
-            // Only check top level domain. Lower level registrars may have different rules.
-            if (ch == '.')
-                break;
-
-            return NO;
-        }
-        return YES;
-    }
-
-    // Not a known top level domain with special rules.
-    return NO;
-}
-
-// Return value of nil means no mapping is necessary.
-// If makeString is NO, then return value is either nil or self to indicate mapping is necessary.
-// If makeString is YES, then return value is either nil or the mapped string.
-- (NSString *)_web_mapHostNameWithRange:(NSRange)range encode:(BOOL)encode makeString:(BOOL)makeString
-{
-    if (range.length > HOST_NAME_BUFFER_LENGTH) {
-        return nil;
-    }
-
-    if ([self length] == 0)
-        return nil;
-    
-    UChar sourceBuffer[HOST_NAME_BUFFER_LENGTH];
-    UChar destinationBuffer[HOST_NAME_BUFFER_LENGTH];
-    
-    NSString *string = self;
-    if (encode && [self rangeOfString:@"%" options:NSLiteralSearch range:range].location != NSNotFound) {
-        NSString *substring = [self substringWithRange:range];
-        substring = WebCFAutorelease(CFURLCreateStringByReplacingPercentEscapes(NULL, (CFStringRef)substring, CFSTR("")));
-        if (substring != nil) {
-            string = substring;
-            range = NSMakeRange(0, [string length]);
-        }
-    }
-    
-    int length = range.length;
-    [string getCharacters:sourceBuffer range:range];
-
-    UErrorCode error = U_ZERO_ERROR;
-    int32_t numCharactersConverted = (encode ? uidna_IDNToASCII : uidna_IDNToUnicode)
-        (sourceBuffer, length, destinationBuffer, HOST_NAME_BUFFER_LENGTH, UIDNA_ALLOW_UNASSIGNED, NULL, &error);
-    if (error != U_ZERO_ERROR) {
-        return nil;
-    }
-    if (numCharactersConverted == length && memcmp(sourceBuffer, destinationBuffer, length * sizeof(UChar)) == 0) {
-        return nil;
-    }
-    if (!encode && !allCharactersInIDNScriptWhiteList(destinationBuffer, numCharactersConverted) && !allCharactersAllowedByTLDRules(destinationBuffer, numCharactersConverted)) {
-        return nil;
-    }
-    return makeString ? (NSString *)[NSString stringWithCharacters:destinationBuffer length:numCharactersConverted] : (NSString *)self;
-}
-
 - (BOOL)_web_hostNameNeedsDecodingWithRange:(NSRange)range
 {
-    return [self _web_mapHostNameWithRange:range encode:NO makeString:NO] != nil;
+    return hostNameNeedsDecodingWithRange(self, range);
 }
 
 - (BOOL)_web_hostNameNeedsEncodingWithRange:(NSRange)range
 {
-    return [self _web_mapHostNameWithRange:range encode:YES makeString:NO] != nil;
+    return hostNameNeedsEncodingWithRange(self, range);
 }
 
 - (NSString *)_web_decodeHostNameWithRange:(NSRange)range
 {
-    return [self _web_mapHostNameWithRange:range encode:NO makeString:YES];
+    return decodeHostNameWithRange(self, range);
 }
 
 - (NSString *)_web_encodeHostNameWithRange:(NSRange)range
 {
-    return [self _web_mapHostNameWithRange:range encode:YES makeString:YES];
+    return encodeHostNameWithRange(self, range);
 }
 
 - (NSString *)_web_decodeHostName
 {
-    NSString *name = [self _web_mapHostNameWithRange:NSMakeRange(0, [self length]) encode:NO makeString:YES];
-    return name == nil ? self : name;
+    return decodeHostName(self);
 }
 
 - (NSString *)_web_encodeHostName
 {
-    NSString *name = [self _web_mapHostNameWithRange:NSMakeRange(0, [self length]) encode:YES makeString:YES];
-    return name == nil ? self : name;
+    return encodeHostName(self);
 }
 
 -(NSRange)_webkit_rangeOfURLScheme
diff --git a/Source/WebKit/mac/Panels/WebAuthenticationPanel.m b/Source/WebKit/mac/Panels/WebAuthenticationPanel.m
index e2f483e0f..f843f3208 100644
--- a/Source/WebKit/mac/Panels/WebAuthenticationPanel.m
+++ b/Source/WebKit/mac/Panels/WebAuthenticationPanel.m
@@ -125,7 +125,7 @@
     if ([space port] == 0) {
         host = [[space host] _web_decodeHostName];
     } else {
-        host = [NSString stringWithFormat:@"%@:%u", [[space host] _web_decodeHostName], [space port]];
+        host = [NSString stringWithFormat:@"%@:%ld", [[space host] _web_decodeHostName], (long)[space port]];
     }
 
     NSString *realm = [space realm];
diff --git a/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm b/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
index 7248f464b..609ccf0cc 100644
--- a/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
+++ b/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
@@ -1085,7 +1085,7 @@ bool NetscapePluginInstanceProxy::setProperty(uint32_t objectID, unsigned proper
     JSLock lock(SilenceAssertionsOnly);    
     
     JSValue value = demarshalValue(exec, valueData, valueLength);
-    object->methodTable()->putByIndex(object, exec, propertyName, value);
+    object->methodTable()->putByIndex(object, exec, propertyName, value, false);
     
     exec->clearException();
     return true;
diff --git a/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm b/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm
index 57df2fe02..5f1f55694 100644
--- a/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm
+++ b/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm
@@ -1998,7 +1998,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
 
 - (NPError)getVariable:(NPNVariable)variable value:(void *)value
 {
-    switch (variable) {
+    switch (static_cast<unsigned>(variable)) {
         case NPNVWindowNPObject:
         {
             Frame* frame = core([self webFrame]);
diff --git a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
index 66fa060b5..46d1201d5 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
@@ -184,10 +184,6 @@ public:
     virtual PassRefPtr<WebCore::PopupMenu> createPopupMenu(WebCore::PopupMenuClient*) const OVERRIDE;
     virtual PassRefPtr<WebCore::SearchPopupMenu> createSearchPopupMenu(WebCore::PopupMenuClient*) const OVERRIDE;
 
-#if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() OVERRIDE;
-#endif
-    
     virtual void numWheelEventHandlersChanged(unsigned) OVERRIDE { }
     virtual void numTouchEventHandlersChanged(unsigned) OVERRIDE { }
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const OVERRIDE { return false; }
diff --git a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm
index 3bac87b9c..fc3a1f2b4 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm
@@ -857,35 +857,6 @@ PassRefPtr<WebCore::SearchPopupMenu> WebChromeClient::createSearchPopupMenu(WebC
     return adoptRef(new SearchPopupMenuMac(client));
 }
 
-#if ENABLE(CONTEXT_MENUS)
-void WebChromeClient::showContextMenu()
-{
-    Page* page = [m_webView page];
-    if (!page)
-        return;
-
-    ContextMenuController* controller = page->contextMenuController();
-    Node* node = controller->hitTestResult().innerNonSharedNode();
-    if (!node)
-        return;
-    Frame* frame = node->document()->frame();
-    if (!frame)
-        return;
-    FrameView* frameView = frame->view();
-    if (!frameView)
-        return;
-    NSView* view = frameView->documentView();
-    
-    IntPoint point = frameView->contentsToWindow(controller->hitTestResult().point());
-    NSPoint nsScreenPoint = [view convertPoint:point toView:nil];
-    // Show the contextual menu for this event.
-    NSEvent* event = [NSEvent mouseEventWithType:NSRightMouseDown location:nsScreenPoint modifierFlags:0 timestamp:0 windowNumber:[[view window] windowNumber] context:0 eventNumber:0 clickCount:1 pressure:1];
-    NSMenu* nsMenu = [view menuForEvent:event];
-    if (nsMenu)
-        [NSMenu popUpContextMenu:nsMenu withEvent:event forView:view];    
-}
-#endif
-
 #if USE(ACCELERATED_COMPOSITING)
 
 void WebChromeClient::attachRootGraphicsLayer(Frame* frame, GraphicsLayer* graphicsLayer)
@@ -983,8 +954,6 @@ void WebChromeClient::fullScreenRendererChanged(RenderBox* renderer)
     SEL selector = @selector(webView:fullScreenRendererChanged:);
     if ([[m_webView UIDelegate] respondsToSelector:selector])
         CallUIDelegate(m_webView, selector, (id)renderer);
-    else
-        [m_webView _fullScreenRendererChanged:renderer];
 }
 
 @implementation WebKitFullScreenListener
diff --git a/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.h b/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.h
index 21b0d0f25..e536f3c24 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.h
@@ -46,6 +46,7 @@ public:
     virtual void speak(const WTF::String&) OVERRIDE;
     virtual void stopSpeaking() OVERRIDE;
     virtual void searchWithSpotlight() OVERRIDE;
+    virtual void showContextMenu() OVERRIDE;
 
     WebView *webView() { return m_webView; }
         
diff --git a/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.mm b/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.mm
index 08c0d6087..e31313603 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.mm
@@ -42,9 +42,12 @@
 #import "WebViewInternal.h"
 #import <WebCore/ContextMenu.h>
 #import <WebCore/ContextMenuController.h>
+#import <WebCore/Document.h>
 #import <WebCore/KURL.h>
 #import <WebCore/LocalizedStrings.h>
 #import <WebCore/Page.h>
+#import <WebCore/Frame.h>
+#import <WebCore/FrameView.h>
 #import <WebCore/RuntimeApplicationChecks.h>
 #import <WebKit/DOMPrivate.h>
 
@@ -346,3 +349,29 @@ void WebContextMenuClient::stopSpeaking()
 {
     [NSApp stopSpeaking:nil];
 }
+
+void WebContextMenuClient::showContextMenu()
+{
+    Page* page = [m_webView page];
+    if (!page)
+        return;
+    ContextMenuController* controller = page->contextMenuController();
+    Node* node = controller->hitTestResult().innerNonSharedNode();
+    if (!node)
+        return;
+    Frame* frame = node->document()->frame();
+    if (!frame)
+        return;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return;
+
+    IntPoint point = frameView->contentsToWindow(controller->hitTestResult().roundedPoint());
+    NSView* view = frameView->documentView();
+    NSPoint nsScreenPoint = [view convertPoint:point toView:nil];
+    // Show the contextual menu for this event.
+    NSEvent* event = [NSEvent mouseEventWithType:NSRightMouseDown location:nsScreenPoint modifierFlags:0 timestamp:0 windowNumber:[[view window] windowNumber] context:0 eventNumber:0 clickCount:1 pressure:1];
+    NSMenu* nsMenu = [view menuForEvent:event];
+    if (nsMenu)
+        [NSMenu popUpContextMenu:nsMenu withEvent:event forView:view];
+}
diff --git a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
index c75fee09f..06fca8d0e 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
@@ -72,7 +72,7 @@ public:
 
     virtual NSString* userVisibleString(NSURL *) OVERRIDE;
     virtual WebCore::DocumentFragment* documentFragmentFromAttributedString(NSAttributedString *, Vector< RefPtr<WebCore::ArchiveResource> >&) OVERRIDE;
-    virtual void setInsertionPasteboard(NSPasteboard *) OVERRIDE;
+    virtual void setInsertionPasteboard(const String&) OVERRIDE;
     virtual NSURL* canonicalizeURL(NSURL*) OVERRIDE;
     virtual NSURL* canonicalizeURLString(NSString*) OVERRIDE;
     
diff --git a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
index 478553034..4ffef315d 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
@@ -373,9 +373,9 @@ DocumentFragment* WebEditorClient::documentFragmentFromAttributedString(NSAttrib
     return core(fragment);
 }
 
-void WebEditorClient::setInsertionPasteboard(NSPasteboard *pasteboard)
+void WebEditorClient::setInsertionPasteboard(const String& pasteboardName)
 {
-    [m_webView _setInsertionPasteboard:pasteboard];
+    [m_webView _setInsertionPasteboard:[NSPasteboard pasteboardWithName:pasteboardName]];
 }
 
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
index 819dd16ce..8ff420c6a 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
@@ -1714,7 +1714,7 @@ PassRefPtr<Widget> WebFrameLoaderClient::createPlugin(const IntSize& size, HTMLP
         WebResourceDelegateImplementationCache* implementations = WebViewGetResourceLoadDelegateImplementations(webView);
         if (implementations->plugInFailedWithErrorFunc) {
             KURL pluginPageURL = document->completeURL(stripLeadingAndTrailingHTMLSpaces(parameterValue(paramNames, paramValues, "pluginspage")));
-            if (!pluginPageURL.protocolInHTTPFamily())
+            if (!pluginPageURL.protocolIsInHTTPFamily())
                 pluginPageURL = KURL();
             NSString *pluginName = pluginPackage ? (NSString *)[pluginPackage pluginInfo].name : nil;
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h
index 2239d5e7f..b145dc4e4 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h
@@ -47,6 +47,7 @@ class WebView;
 
 namespace WebCore {
 
+class Frame;
 class Page;
 
 }
@@ -62,6 +63,7 @@ public:
     virtual void openInspectorFrontend(WebCore::InspectorController*) OVERRIDE;
     virtual void closeInspectorFrontend() OVERRIDE;
     virtual void bringFrontendToFront() OVERRIDE;
+    virtual void didResizeMainFrame(WebCore::Frame*) OVERRIDE;
 
     virtual void highlight() OVERRIDE;
     virtual void hideHighlight() OVERRIDE;
diff --git a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
index 2ae865951..b288f9f97 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
@@ -41,10 +41,13 @@
 #import "WebViewInternal.h"
 #import <WebCore/InspectorController.h>
 #import <WebCore/Page.h>
+#import <WebCore/SoftLinking.h>
 #import <WebKit/DOMExtensions.h>
 #import <WebKitSystemInterface.h>
 #import <wtf/PassOwnPtr.h>
 
+SOFT_LINK_PRIVATE_FRAMEWORK_OPTIONAL(WebInspector)
+
 using namespace WebCore;
 
 @interface WebInspectorWindowController : NSWindowController <NSWindowDelegate> {
@@ -111,6 +114,12 @@ void WebInspectorClient::bringFrontendToFront()
     m_frontendClient->bringToFront();
 }
 
+void WebInspectorClient::didResizeMainFrame(Frame*)
+{
+    if (m_frontendClient)
+        m_frontendClient->setDockingUnavailable(!m_frontendClient->canAttachWindow());
+}
+
 void WebInspectorClient::highlight()
 {
     [m_highlighter.get() highlight];
@@ -154,10 +163,20 @@ void WebInspectorFrontendClient::frontendLoaded()
     setAttachedWindow(attached);
 }
 
+static bool useWebKitWebInspector()
+{
+    // Call the soft link framework function to dlopen it, then [NSBundle bundleWithIdentifier:] will work.
+    WebInspectorLibrary();
+
+    return [[NSUserDefaults standardUserDefaults] boolForKey:@"UseWebKitWebInspector"] ||
+        ![[NSBundle bundleWithIdentifier:@"com.apple.WebInspector"] pathForResource:@"Main" ofType:@"html"];
+}
+
 String WebInspectorFrontendClient::localizedStringsURL()
 {
-    NSString *path = [[NSBundle bundleWithIdentifier:@"com.apple.WebCore"] pathForResource:@"localizedStrings" ofType:@"js"];
-    if (path)
+    NSBundle *bundle = useWebKitWebInspector() ? [NSBundle bundleWithIdentifier:@"com.apple.WebCore"] : [NSBundle bundleWithIdentifier:@"com.apple.WebInspector"]; 
+    NSString *path = [bundle pathForResource:@"localizedStrings" ofType:@"js"];
+    if ([path length])
         return [[NSURL fileURLWithPath:path] absoluteString];
     return String();
 }
@@ -252,7 +271,14 @@ void WebInspectorFrontendClient::updateWindowTitle() const
 
     [preferences release];
 
-    NSString *path = [[NSBundle bundleWithIdentifier:@"com.apple.WebCore"] pathForResource:@"inspector" ofType:@"html" inDirectory:@"inspector"];
+    NSString *path;
+    if (useWebKitWebInspector())
+        path = [[NSBundle bundleWithIdentifier:@"com.apple.WebCore"] pathForResource:@"inspector" ofType:@"html" inDirectory:@"inspector"];
+    else
+        path = [[NSBundle bundleWithIdentifier:@"com.apple.WebInspector"] pathForResource:@"Main" ofType:@"html"];
+
+    ASSERT([path length]);
+
     NSURLRequest *request = [[NSURLRequest alloc] initWithURL:[NSURL fileURLWithPath:path]];
     [[_webView mainFrame] loadRequest:request];
     [request release];
@@ -289,18 +315,22 @@ void WebInspectorFrontendClient::updateWindowTitle() const
     if (window)
         return window;
 
+    bool useTexturedWindow = useWebKitWebInspector();
+
     NSUInteger styleMask = (NSTitledWindowMask | NSClosableWindowMask | NSMiniaturizableWindowMask | NSResizableWindowMask);
 
-    styleMask |= NSTexturedBackgroundWindowMask;
+    if (useTexturedWindow)
+        styleMask |= NSTexturedBackgroundWindowMask;
 
     window = [[NSWindow alloc] initWithContentRect:NSMakeRect(60.0, 200.0, 750.0, 650.0) styleMask:styleMask backing:NSBackingStoreBuffered defer:NO];
     [window setDelegate:self];
     [window setMinSize:NSMakeSize(400.0, 400.0)];
 
-    [window setAutorecalculatesContentBorderThickness:NO forEdge:NSMaxYEdge];
-    [window setContentBorderThickness:55. forEdge:NSMaxYEdge];
-
-    WKNSWindowMakeBottomCornersSquare(window);
+    if (useTexturedWindow) {
+        [window setAutorecalculatesContentBorderThickness:NO forEdge:NSMaxYEdge];
+        [window setContentBorderThickness:55. forEdge:NSMaxYEdge];
+        WKNSWindowMakeBottomCornersSquare(window);
+    }
 
     [self setWindow:window];
     [window release];
diff --git a/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.h b/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.h
index a40ce81e5..d68d92275 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.h
@@ -23,7 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import <WebCore/NotificationPresenter.h>
+#import <WebCore/NotificationClient.h>
 
 #if ENABLE(NOTIFICATIONS)
 #import <WebCore/Notification.h>
@@ -41,7 +41,7 @@ class VoidCallback;
 @class WebNotification;
 @class WebView;
 
-class WebNotificationClient : public WebCore::NotificationPresenter {
+class WebNotificationClient : public WebCore::NotificationClient {
 public:
     WebNotificationClient(WebView *);
     WebView *webView() { return m_webView; }
@@ -54,7 +54,7 @@ private:
     virtual void notificationControllerDestroyed() OVERRIDE;
     virtual void requestPermission(WebCore::ScriptExecutionContext*, PassRefPtr<WebCore::VoidCallback>) OVERRIDE;
     virtual void cancelRequestsForPermission(WebCore::ScriptExecutionContext*) OVERRIDE { }
-    virtual WebCore::NotificationPresenter::Permission checkPermission(WebCore::ScriptExecutionContext*) OVERRIDE;
+    virtual WebCore::NotificationClient::Permission checkPermission(WebCore::ScriptExecutionContext*) OVERRIDE;
 
     WebView *m_webView;
 #if ENABLE(NOTIFICATIONS)
diff --git a/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.mm b/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.mm
index 2f7cd5411..3fdf0bc7f 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.mm
@@ -171,29 +171,29 @@ void WebNotificationClient::requestPermission(ScriptExecutionContext* context, P
 #endif
 }
 
-NotificationPresenter::Permission WebNotificationClient::checkPermission(ScriptExecutionContext* context)
+NotificationClient::Permission WebNotificationClient::checkPermission(ScriptExecutionContext* context)
 {
 #if ENABLE(NOTIFICATIONS)
     if (!context || !context->isDocument())
-        return NotificationPresenter::PermissionDenied;
+        return NotificationClient::PermissionDenied;
     if (![[m_webView preferences] notificationsEnabled])
-        return NotificationPresenter::PermissionDenied;
+        return NotificationClient::PermissionDenied;
     WebSecurityOrigin *webOrigin = [[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:context->securityOrigin()];
     WebNotificationPermission permission = [[m_webView _notificationProvider] policyForOrigin:webOrigin];
     [webOrigin release];
     switch (permission) {
         case WebNotificationPermissionAllowed:
-            return NotificationPresenter::PermissionAllowed;
+            return NotificationClient::PermissionAllowed;
         case WebNotificationPermissionDenied:
-            return NotificationPresenter::PermissionDenied;
+            return NotificationClient::PermissionDenied;
         case WebNotificationPermissionNotAllowed:
-            return NotificationPresenter::PermissionNotAllowed;
+            return NotificationClient::PermissionNotAllowed;
         default:
-            return NotificationPresenter::PermissionNotAllowed;
+            return NotificationClient::PermissionNotAllowed;
     }
 #else
     UNUSED_PARAM(context);
-    return NotificationPresenter::PermissionDenied;
+    return NotificationClient::PermissionDenied;
 #endif
 }
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm b/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
index 2a76c98a9..86a44d675 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
@@ -43,6 +43,9 @@ void InitWebCoreSystemInterface(void)
         return;
 
     INIT(AdvanceDefaultButtonPulseAnimation);
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    INIT(CALayerEnumerateRectsBeingDrawnWithBlock);
+#endif
     INIT(CGContextGetShouldSmoothFonts);
     INIT(CGPatternCreateWithImageAndTransform);
     INIT(CGContextResetClip);
@@ -166,6 +169,8 @@ void InitWebCoreSystemInterface(void)
     INIT(CopyCFURLResponseSuggestedFilename);
     INIT(SetCFURLResponseMIMEType);
 
+    INIT(SetMetadataURL);
+    
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
     INIT(CreateVMPressureDispatchOnMainQueue);
 #endif
diff --git a/Source/WebKit/mac/WebView/WebArchiveInternal.h b/Source/WebKit/mac/WebView/WebArchiveInternal.h
index 071d4ab70..4ff5096a6 100644
--- a/Source/WebKit/mac/WebView/WebArchiveInternal.h
+++ b/Source/WebKit/mac/WebView/WebArchiveInternal.h
@@ -27,7 +27,7 @@
  */
 
 #import "WebArchive.h"
-#import <JavaScriptCore/Forward.h>
+#import <wtf/Forward.h>
 
 namespace WebCore {
     class LegacyWebArchive;
diff --git a/Source/WebKit/mac/WebView/WebFrame.mm b/Source/WebKit/mac/WebView/WebFrame.mm
index 24bb8f39c..e085bc17f 100644
--- a/Source/WebKit/mac/WebView/WebFrame.mm
+++ b/Source/WebKit/mac/WebView/WebFrame.mm
@@ -60,6 +60,7 @@
 #import <WebCore/Chrome.h>
 #import <WebCore/ColorMac.h>
 #import <WebCore/DOMImplementation.h>
+#import <WebCore/DatabaseContext.h>
 #import <WebCore/DocumentFragment.h>
 #import <WebCore/DocumentLoader.h>
 #import <WebCore/DocumentMarkerController.h>
@@ -797,7 +798,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
 
 - (void)_setTypingStyle:(DOMCSSStyleDeclaration *)style withUndoAction:(EditAction)undoAction
 {
-    if (!_private->coreFrame)
+    if (!_private->coreFrame || !style)
         return;
     // FIXME: We shouldn't have to create a copy here.
     _private->coreFrame->editor()->computeAndSetTypingStyle(core(style)->copy().get(), undoAction);
@@ -1120,13 +1121,9 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     
     if (Document* document = _private->coreFrame->document()) {
 #if ENABLE(SQL_DATABASE)
-        if (document->hasOpenDatabases())
+        if (DatabaseContext::hasOpenDatabases(document))
             [result setObject:[NSNumber numberWithBool:YES] forKey:WebFrameUsesDatabases];
 #endif
-            
-        if (document->usingGeolocation())
-            [result setObject:[NSNumber numberWithBool:YES] forKey:WebFrameUsesGeolocation];
-            
         if (!document->canSuspendActiveDOMObjects())
             [result setObject:[NSNumber numberWithBool:YES] forKey:WebFrameCanSuspendActiveDOMObjects];
     }
diff --git a/Source/WebKit/mac/WebView/WebFullScreenController.h b/Source/WebKit/mac/WebView/WebFullScreenController.h
index 0cb25d974..ea03af4ba 100644
--- a/Source/WebKit/mac/WebView/WebFullScreenController.h
+++ b/Source/WebKit/mac/WebView/WebFullScreenController.h
@@ -27,8 +27,10 @@
 
 #import <wtf/OwnPtr.h>
 #import <wtf/RefPtr.h>
+#import <wtf/RetainPtr.h>
 
 @class WebWindowFadeAnimation;
+@class WebWindowScaleAnimation;
 @class WebView;
 namespace WebCore {
     class DisplaySleepDisabler;
@@ -40,16 +42,18 @@ namespace WebCore {
 @interface WebFullScreenController : NSWindowController {
 @private
     RefPtr<WebCore::Element> _element;
-    WebCore::RenderBox* _renderer; // (set)
     WebView *_webView;
-    NSView* _placeholderView;
-    RefPtr<WebCore::EventListener> _mediaEventListener; 
+    RetainPtr<NSView> _webViewPlaceholder;
+    RetainPtr<WebWindowScaleAnimation> _scaleAnimation;
+    RetainPtr<WebWindowFadeAnimation> _fadeAnimation;
+    RetainPtr<NSWindow> _backgroundWindow;
+    NSRect _initialFrame;
+    NSRect _finalFrame;
 
-    BOOL _isAnimating;
-    BOOL _isFullscreen;
-    BOOL _forceDisableAnimation;
-    OwnPtr<WebCore::DisplaySleepDisabler> _displaySleepDisabler;
-    CGRect _initialFrame;
+    BOOL _isEnteringFullScreen;
+    BOOL _isExitingFullScreen;
+    BOOL _isFullScreen;
+    BOOL _isPlaying;
 }
 
 - (WebView*)webView;
@@ -58,12 +62,9 @@ namespace WebCore {
 - (void)setElement:(PassRefPtr<WebCore::Element>)element;
 - (WebCore::Element*)element;
 
-- (void)setRenderer:(WebCore::RenderBox*)renderer;
-- (WebCore::RenderBox*)renderer;
-
-- (void)enterFullscreen:(NSScreen *)screen;
-- (void)exitFullscreen;
-
+- (void)enterFullScreen:(NSScreen *)screen;
+- (void)exitFullScreen;
+- (void)close;
 @end
 
 #endif // ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit/mac/WebView/WebFullScreenController.mm b/Source/WebKit/mac/WebView/WebFullScreenController.mm
index aae92e841..eda499cd9 100644
--- a/Source/WebKit/mac/WebView/WebFullScreenController.mm
+++ b/Source/WebKit/mac/WebView/WebFullScreenController.mm
@@ -30,72 +30,61 @@
 #import "WebNSWindowExtras.h"
 #import "WebPreferencesPrivate.h"
 #import "WebViewInternal.h"
-#import <IOKit/pwr_mgt/IOPMLib.h>
-#import <OSServices/Power.h>
-#import <WebCore/AnimationList.h>
-#import <WebCore/CSSPropertyNames.h>
-#import <WebCore/Color.h>
-#import <WebCore/DOMDocument.h>
-#import <WebCore/DOMDocumentInternal.h>
-#import <WebCore/DOMHTMLElement.h>
-#import <WebCore/DOMWindow.h>
-#import <WebCore/DisplaySleepDisabler.h>
 #import <WebCore/Document.h>
-#import <WebCore/EventListener.h>
-#import <WebCore/EventNames.h>
+#import <WebCore/Element.h>
+#import <WebCore/FloatRect.h>
 #import <WebCore/HTMLElement.h>
-#import <WebCore/HTMLMediaElement.h>
-#import <WebCore/HTMLNames.h>
 #import <WebCore/IntRect.h>
-#import <WebCore/NodeList.h>
-#import <WebCore/RenderBlock.h>
+#import <WebCore/Page.h>
 #import <WebCore/RenderLayer.h>
 #import <WebCore/RenderLayerBacking.h>
+#import <WebCore/RenderObject.h>
+#import <WebCore/RenderView.h>
 #import <WebCore/SoftLinking.h>
-#import <objc/objc-runtime.h>
+#import <WebCore/WebCoreFullScreenWindow.h>
+#import <WebCore/WebWindowAnimation.h>
+#import <WebKitSystemInterface.h>
 #import <wtf/RetainPtr.h>
 #import <wtf/UnusedParam.h>
 
-static NSString* const isEnteringFullscreenKey = @"isEnteringFullscreen";
-
 using namespace WebCore;
 
-@interface WebFullscreenWindow : NSWindow
-#ifndef BUILDING_ON_LEOPARD
-<NSAnimationDelegate>
-#endif
+static const CFTimeInterval defaultAnimationDuration = 0.5;
+
+static IntRect screenRectOfContents(Element* element)
 {
-    NSView* _animationView;
-    
-    CALayer* _rendererLayer;
-    CALayer* _backgroundLayer;
+    ASSERT(element);
+    if (element->renderer() && element->renderer()->hasLayer() && element->renderer()->enclosingLayer()->isComposited()) {
+        FloatQuad contentsBox = static_cast<FloatRect>(element->renderer()->enclosingLayer()->backing()->contentsBox());
+        contentsBox = element->renderer()->localToAbsoluteQuad(contentsBox);
+        return element->renderer()->view()->frameView()->contentsToScreen(contentsBox.enclosingBoundingBox());
+    }
+    return element->screenRect();
 }
-- (CALayer*)rendererLayer;
-- (void)setRendererLayer:(CALayer*)rendererLayer;
-- (CALayer*)backgroundLayer;
-- (NSView*)animationView;
-@end
 
-class MediaEventListener : public EventListener {
-public:
-    static PassRefPtr<MediaEventListener> create(WebFullScreenController* delegate);
-    virtual bool operator==(const EventListener&);
-    virtual void handleEvent(ScriptExecutionContext*, Event*);
-
-private:
-    MediaEventListener(WebFullScreenController* delegate); 
-    WebFullScreenController* delegate;
-};
-
-@interface WebFullScreenController(Private)
-- (void)_requestExitFullscreenWithAnimation:(BOOL)animation;
-- (void)_updateMenuAndDockForFullscreen;
-- (void)_updatePowerAssertions;
-- (WebFullscreenWindow *)_fullscreenWindow;
+@interface WebFullScreenController(Private)<NSAnimationDelegate>
+- (void)_updateMenuAndDockForFullScreen;
+- (void)_swapView:(NSView*)view with:(NSView*)otherView;
 - (Document*)_document;
-- (CFTimeInterval)_animationDuration;
-- (BOOL)_isAnyMoviePlaying;
+- (void)_startEnterFullScreenAnimationWithDuration:(NSTimeInterval)duration;
+- (void)_startExitFullScreenAnimationWithDuration:(NSTimeInterval)duration;
+@end
+
+#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+@interface NSWindow(convertRectToScreenForLeopardAndSnowLeopard)
+- (NSRect)convertRectToScreen:(NSRect)aRect;
+@end
+
+@implementation NSWindow(convertRectToScreenForLeopardAndSnowLeopard)
+- (NSRect)convertRectToScreen:(NSRect)rect
+{
+    NSRect frame = [self frame];
+    rect.origin.x += frame.origin.x;
+    rect.origin.y += frame.origin.y;
+    return rect;
+}
 @end
+#endif
 
 @interface NSWindow(IsOnActiveSpaceAdditionForTigerAndLeopard)
 - (BOOL)isOnActiveSpace;
@@ -108,21 +97,21 @@ private:
 - (id)init
 {
     // Do not defer window creation, to make sure -windowNumber is created (needed by WebWindowScaleAnimation).
-    NSWindow *window = [[WebFullscreenWindow alloc] initWithContentRect:NSZeroRect styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:NO];
+    NSWindow *window = [[WebCoreFullScreenWindow alloc] initWithContentRect:NSZeroRect styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:NO];
     self = [super initWithWindow:window];
     [window release];
     if (!self)
         return nil;
     [self windowDidLoad];
-    _mediaEventListener = MediaEventListener::create(self);
+
     return self;
-    
 }
 
 - (void)dealloc
 {
     [self setWebView:nil];
-    [_placeholderView release];
+
+    [NSObject cancelPreviousPerformRequestsWithTarget:self];
     
     [[NSNotificationCenter defaultCenter] removeObserver:self];
     [super dealloc];
@@ -130,7 +119,8 @@ private:
 
 - (void)windowDidLoad
 {
-    
+    [super windowDidLoad];
+
     [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(applicationDidResignActive:) name:NSApplicationDidResignActiveNotification object:NSApp];
     [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(applicationDidChangeScreenParameters:) name:NSApplicationDidChangeScreenParametersNotification object:NSApp];
 }
@@ -157,157 +147,25 @@ private:
 
 - (void)setElement:(PassRefPtr<Element>)element
 {
-    // When a new Element is set as the current full screen element, register event
-    // listeners on that Element's window, listening for changes in media play states.
-    // We will use these events to determine whether to disable the screensaver and 
-    // display sleep timers when playing video in full screen. Make sure to unregister
-    // the events on the old element's window, if necessary, as well.
-    
-    EventNames& eventNames = WebCore::eventNames();
-    
-    if (_element) {
-        DOMWindow* window = _element->document()->domWindow();
-        if (window) {
-            window->removeEventListener(eventNames.playEvent,  _mediaEventListener.get(), true);
-            window->removeEventListener(eventNames.pauseEvent, _mediaEventListener.get(), true);
-            window->removeEventListener(eventNames.endedEvent, _mediaEventListener.get(), true);
-        }
-    }
-        
     _element = element;
-    
-    if (_element) {
-        DOMWindow* window = _element->document()->domWindow();
-        if (window) {
-            window->addEventListener(eventNames.playEvent,  _mediaEventListener, true);
-            window->addEventListener(eventNames.pauseEvent, _mediaEventListener, true);
-            window->addEventListener(eventNames.endedEvent, _mediaEventListener, true);
-        }
-    }
 }
 
-- (RenderBox*)renderer 
-{
-    return _renderer;
-}
+#pragma mark -
+#pragma mark NSWindowController overrides
 
-- (void)setRenderer:(RenderBox*)renderer
+- (void)cancelOperation:(id)sender
 {
-    _renderer = renderer;
+    [self performSelector:@selector(exitFullScreen) withObject:nil afterDelay:0];
 }
 
 #pragma mark -
 #pragma mark Notifications
 
-- (void)windowDidExitFullscreen:(BOOL)finished
-{
-    if (!_isAnimating)
-        return;
-    
-    if (_isFullscreen)
-        return;
-    
-    NSDisableScreenUpdates();
-    ASSERT(_element);
-    [self _document]->setFullScreenRendererBackgroundColor(Color::black);
-    [self _document]->webkitDidExitFullScreenForElement(_element.get());
-    [self setElement:nil];
-
-    if (finished) {
-        [self _updateMenuAndDockForFullscreen];   
-        [self _updatePowerAssertions];
-        
-        [[_webView window] display];
-        [[self _fullscreenWindow] setRendererLayer:nil];
-        [[self window] close];
-    }
-
-    NSEnableScreenUpdates();
-
-    _isAnimating = NO;
-    [self autorelease]; // Associated -retain is in -exitFullscreen.
-}
-
-- (void)windowDidEnterFullscreen:(BOOL)finished
-{
-    if (!_isAnimating)
-        return;
-    
-    if (!_isFullscreen)
-        return;
-    
-    NSDisableScreenUpdates();
-    [self _document]->webkitDidEnterFullScreenForElement(_element.get());
-    [self _document]->setFullScreenRendererBackgroundColor(Color::black);
-    
-    if (finished) {
-        [self _updateMenuAndDockForFullscreen];
-        [self _updatePowerAssertions];
-        [NSCursor setHiddenUntilMouseMoves:YES];
-    
-        // Move the webView into our fullscreen Window
-        if (!_placeholderView)
-            _placeholderView = [[NSView alloc] init];
-
-        WebView *webView = [self webView];
-        NSWindow *webWindow = [webView window];
-        NSResponder *webWindowFirstResponder = [webWindow firstResponder];
-
-        // Do not swap the placeholder into place if already is in a window,
-        // assuming the placeholder's window will always be the webView's 
-        // original window.
-        if (![_placeholderView window]) {
-            [_placeholderView setFrame:[webView frame]];        
-            [_placeholderView setAutoresizingMask:[webView autoresizingMask]];
-            [_placeholderView removeFromSuperview];
-            [[webView superview] replaceSubview:webView with:_placeholderView];
-            
-            [[[self window] contentView] addSubview:webView];
-            [[self window] makeResponder:webWindowFirstResponder firstResponderIfDescendantOfView:webView];
-            [webView setAutoresizingMask:NSViewWidthSizable|NSViewHeightSizable];
-            [webView setFrame:[(NSView *)[[self window] contentView] bounds]];
-        }
-
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-        // In Lion, NSWindow will animate into and out of orderOut operations. Suppress that
-        // behavior here, making sure to reset the animation behavior afterward.
-        NSWindowAnimationBehavior animationBehavior = [webWindow animationBehavior];
-        [webWindow setAnimationBehavior:NSWindowAnimationBehaviorNone];
-#endif
-        [webWindow orderOut:self];
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-        [webWindow setAnimationBehavior:animationBehavior];
-#endif
-        
-        WebFullscreenWindow* window = [self _fullscreenWindow];
-        [window setBackgroundColor:[NSColor blackColor]];
-        [window setOpaque:YES];
-
-        [CATransaction begin];
-        [CATransaction setValue:[NSNumber numberWithBool:YES] forKey:kCATransactionDisableActions];
-        [[[window animationView] layer] setOpacity:0];
-        [CATransaction commit];
-    }
-    NSEnableScreenUpdates();
-
-    _isAnimating = NO;
-}
-
-- (void)animationDidStop:(CAAnimation *)anim finished:(BOOL)finished
-{
-    BOOL isEnteringFullscreenAnimation = [[anim valueForKey:isEnteringFullscreenKey] boolValue];
-    
-    if (!isEnteringFullscreenAnimation)
-        [self windowDidExitFullscreen:finished];
-    else
-        [self windowDidEnterFullscreen:finished];
-}
-
 - (void)applicationDidResignActive:(NSNotification*)notification
 {   
     // Check to see if the fullscreenWindow is on the active space; this function is available
     // on 10.6 and later, so default to YES if the function is not available:
-    NSWindow* fullscreenWindow = [self _fullscreenWindow];
+    NSWindow* fullscreenWindow = [self window];
     BOOL isOnActiveSpace = ([fullscreenWindow respondsToSelector:@selector(isOnActiveSpace)] ? [fullscreenWindow isOnActiveSpace] : YES);
 
     // Replicate the QuickTime Player (X) behavior when losing active application status:
@@ -315,7 +173,7 @@ private:
     // single screen is available.)  Is the fullscreen screen on the current space? IFF so, 
     // then exit fullscreen mode. 
     if ([fullscreenWindow screen] == [[NSScreen screens] objectAtIndex:0] && isOnActiveSpace)
-         [self _requestExitFullscreenWithAnimation:NO];
+         [self cancelOperation:self];
 }
 
 - (void)applicationDidChangeScreenParameters:(NSNotification*)notification
@@ -324,306 +182,230 @@ private:
     // the Dock's size or location, or they may have changed the fullscreen screen's dimensions. 
     // Update our presentation parameters, and ensure that the full screen window occupies the 
     // entire screen:
-    [self _updateMenuAndDockForFullscreen];
+    [self _updateMenuAndDockForFullScreen];
     NSWindow* window = [self window];
-    [window setFrame:[[window screen] frame] display:YES];
+    NSRect screenFrame = [[window screen] frame];
+    [window setFrame:screenFrame display:YES];
+    [_backgroundWindow.get() setFrame:screenFrame display:YES];
 }
 
 #pragma mark -
 #pragma mark Exposed Interface
 
-- (void)enterFullscreen:(NSScreen *)screen
+- (void)enterFullScreen:(NSScreen *)screen
 {
-    // Disable animation if we are already in full-screen mode.
-    BOOL shouldAnimate = !_isFullscreen;
-    
-    if (_isAnimating) {
-        // The CAAnimation delegate functions will only be called the
-        // next trip through the run-loop, so manually call the delegate
-        // function here, letting it know the animation did not complete:
-        [self windowDidExitFullscreen:NO];
-        ASSERT(!_isAnimating);
-    }
-    _isFullscreen = YES;
-    _isAnimating = YES;
-    
-    // setElement: must be called with a non-nil value before calling enterFullscreen:.
-    ASSERT(_element);
+    if (_isFullScreen)
+        return;
+    _isFullScreen = YES;
     
-    NSDisableScreenUpdates();
+    [self _updateMenuAndDockForFullScreen];   
     
     if (!screen)
         screen = [NSScreen mainScreen];
     NSRect screenFrame = [screen frame];
     
-    WebView* webView = [self webView];
-    NSRect webViewFrame = [webView convertRectToBase:[webView frame]];
-    webViewFrame.origin = [[webView window] convertBaseToScreen:webViewFrame.origin];
+    NSRect webViewFrame = [[_webView window] convertRectToScreen:
+                           [_webView convertRect:[_webView frame] toView:nil]];
     
-    NSRect elementFrame = _element->screenRect();
+    // Flip coordinate system:
+    webViewFrame.origin.y = NSMaxY([[[NSScreen screens] objectAtIndex:0] frame]) - NSMaxY(webViewFrame);
     
-    // In the case of a multi-monitor setup where the webView straddles two
-    // monitors, we must create a window large enough to contain the destination
-    // frame and the initial frame.
-    NSRect windowFrame = NSUnionRect(screenFrame, elementFrame);
-    [[self window] setFrame:windowFrame display:YES];
+    CGWindowID windowID = [[_webView window] windowNumber];
+    RetainPtr<CGImageRef> webViewContents = adoptCF(CGWindowListCreateImage(NSRectToCGRect(webViewFrame), kCGWindowListOptionIncludingWindow, windowID, kCGWindowImageShouldBeOpaque));
     
-    // In a previous incarnation, the NSWindow attached to this controller may have
-    // been on a different screen. Temporarily change the collectionBehavior of the window:
-    NSWindowCollectionBehavior behavior = [[self window] collectionBehavior];
-    [[self window] setCollectionBehavior:NSWindowCollectionBehaviorCanJoinAllSpaces];
-    [[self window] makeKeyAndOrderFront:self];
-    [[self window] setCollectionBehavior:behavior];
-    
-    NSView* animationView = [[self _fullscreenWindow] animationView];
-    
-    NSRect backgroundBounds = {[[self window] convertScreenToBase:screenFrame.origin], screenFrame.size};
-    backgroundBounds = [animationView convertRectFromBase:backgroundBounds];
-    // Flip the background layer's coordinate system.
-    backgroundBounds.origin.y = windowFrame.size.height - NSMaxY(backgroundBounds);
-    
-    // Set our fullscreen element's initial frame, and flip the coordinate systems from
-    // screen coordinates (bottom/left) to layer coordinates (top/left):
-    _initialFrame = NSRectToCGRect(NSIntersectionRect(elementFrame, webViewFrame));
-    _initialFrame.origin.y = screenFrame.size.height - CGRectGetMaxY(_initialFrame);
-    
-    // Inform the document that we will begin entering full screen. This will change
-    // pseudo-classes on the fullscreen element and the document element.
-    Document* document = [self _document];
-    document->webkitWillEnterFullScreenForElement(_element.get());
-    
-    // Check to see if the fullscreen renderer is composited. If not, accelerated graphics 
-    // may be disabled. In this case, do not attempt to animate the contents into place; 
-    // merely snap to the final position:
-    if (!shouldAnimate || !_renderer || !_renderer->layer()->isComposited()) {
-        [self windowDidEnterFullscreen:YES];
-        NSEnableScreenUpdates();
-        return;
-    }    
+    // Screen updates to be re-enabled in beganEnterFullScreenWithInitialFrame:finalFrame:
+    NSDisableScreenUpdates();
+    [[self window] setAutodisplay:NO];
     
-    // Set up the final style of the FullScreen render block. Set an absolute
-    // width and height equal to the size of the screen, and anchor the layer
-    // at the top, left at (0,0). The RenderFullScreen style is already set 
-    // to position:fixed.
-    [self _document]->setFullScreenRendererSize(IntSize(screenFrame.size));
-    [self _document]->setFullScreenRendererBackgroundColor(Color::transparent);
+    NSResponder *webWindowFirstResponder = [[_webView window] firstResponder];
+    [[self window] setFrame:screenFrame display:NO];
+
+    _initialFrame = screenRectOfContents(_element.get());
+
+    // Swap the webView placeholder into place.
+    if (!_webViewPlaceholder) {
+        _webViewPlaceholder.adoptNS([[NSView alloc] init]);
+        [_webViewPlaceholder.get() setLayer:[CALayer layer]];
+        [_webViewPlaceholder.get() setWantsLayer:YES];
+    }
+    [[_webViewPlaceholder.get() layer] setContents:(id)webViewContents.get()];
+    [self _swapView:_webView with:_webViewPlaceholder.get()];
     
-    // Cause the document to layout, thus calculating a new fullscreen element size:
-    [self _document]->updateLayout();
+    // Then insert the WebView into the full screen window
+    NSView* contentView = [[self window] contentView];
+    [contentView addSubview:_webView positioned:NSWindowBelow relativeTo:nil];
+    [_webView setFrame:[contentView bounds]];
     
-    // FIXME: try to use the fullscreen element's calculated x, y, width, and height instead of the
-    // renderBox functions:
-    RenderBox* childRenderer = _renderer->firstChildBox();
-    CGRect destinationFrame = CGRectMake(childRenderer->x(), childRenderer->y(), childRenderer->width(), childRenderer->height());    
-    
-    // Some properties haven't propogated from the GraphicsLayer to the CALayer yet. So
-    // tell the renderer's layer to sync it's compositing state:
-    GraphicsLayer* rendererGraphics = _renderer->layer()->backing()->graphicsLayer();
-    rendererGraphics->syncCompositingState(destinationFrame);    
-
-    CALayer* rendererLayer = rendererGraphics->platformLayer();
-    [[self _fullscreenWindow] setRendererLayer:rendererLayer];    
-    
-    CFTimeInterval duration = [self _animationDuration];
-
-    // Create a transformation matrix that will transform the renderer layer such that 
-    // the fullscreen element appears to move from its starting position and size to its
-    // final one. Perform the transformation in two steps, using the CALayer's matrix 
-    // math to calculate the effects of each step:
-    // 1. Apply a scale tranform to shrink the apparent size of the layer to the original
-    //    element screen size.
-    // 2. Apply a translation transform to move the shrunk layer into the same screen position
-    //    as the original element.
-    CATransform3D shrinkTransform = CATransform3DMakeScale(_initialFrame.size.width / destinationFrame.size.width, _initialFrame.size.height / destinationFrame.size.height, 1);
-    [rendererLayer setTransform:shrinkTransform];
-    CGRect shrunkDestinationFrame = [rendererLayer convertRect:destinationFrame toLayer:[animationView layer]];
-    CATransform3D moveTransform = CATransform3DMakeTranslation(_initialFrame.origin.x - shrunkDestinationFrame.origin.x, _initialFrame.origin.y - shrunkDestinationFrame.origin.y, 0);
-    CATransform3D finalTransform = CATransform3DConcat(shrinkTransform, moveTransform);
-    [rendererLayer setTransform:finalTransform];
-
-    CALayer* backgroundLayer = [[self _fullscreenWindow] backgroundLayer];
-
-    // Start the opacity animation. We can use implicit animations here because we don't care when
-    // the animation finishes.
-    [CATransaction begin];
-    [CATransaction setValue:[NSNumber numberWithDouble:duration] forKey:kCATransactionAnimationDuration];
-    [backgroundLayer setOpacity:1];
-    [CATransaction commit];
+    [[self window] makeResponder:webWindowFirstResponder firstResponderIfDescendantOfView:_webView];
     
-    // Use a CABasicAnimation here for the zoom effect. We want to be notified that the animation has 
-    // completed by way of the CAAnimation delegate.
-    CABasicAnimation* zoomAnimation = [CABasicAnimation animationWithKeyPath:@"transform"];
-    [zoomAnimation setFromValue:[NSValue valueWithCATransform3D:finalTransform]];
-    [zoomAnimation setToValue:[NSValue valueWithCATransform3D:CATransform3DIdentity]];
-    [zoomAnimation setDelegate:self];
-    [zoomAnimation setDuration:duration];
-    [zoomAnimation setTimingFunction:[CAMediaTimingFunction functionWithName:kCAMediaTimingFunctionEaseInEaseOut]];
-    [zoomAnimation setFillMode:kCAFillModeForwards];
-    [zoomAnimation setValue:(id)kCFBooleanTrue forKey:isEnteringFullscreenKey];
-    
-    // Disable implicit animations and set the layer's transformation matrix to its final state.
-    [CATransaction begin];
-    [CATransaction setValue:[NSNumber numberWithBool:YES] forKey:kCATransactionDisableActions];
-    [rendererLayer setTransform:CATransform3DIdentity];
-    [rendererLayer addAnimation:zoomAnimation forKey:@"zoom"];
-    [backgroundLayer setFrame:NSRectToCGRect(backgroundBounds)];
-    [CATransaction commit];
+    [self _document]->webkitWillEnterFullScreenForElement(_element.get());
+    [self _document]->setAnimatingFullScreen(true);
+    [self _document]->updateLayout();
+
+    _finalFrame = screenRectOfContents(_element.get());
     
-    NSEnableScreenUpdates();
+    [self _updateMenuAndDockForFullScreen];   
+    
+    [self _startEnterFullScreenAnimationWithDuration:defaultAnimationDuration];
+
+    _isEnteringFullScreen = true;
 }
 
-- (void)exitFullscreen
+- (void)finishedEnterFullScreenAnimation:(bool)completed
 {
-    if (!_isFullscreen)
-        return;    
-      
-    CATransform3D startTransform = CATransform3DIdentity;
-    if (_isAnimating) {
-        if (_renderer && _renderer->layer()->isComposited()) {
-            CALayer* rendererLayer = _renderer->layer()->backing()->graphicsLayer()->platformLayer();
-            startTransform = [[rendererLayer presentationLayer] transform];
-        }
-        
-        // The CAAnimation delegate functions will only be called the
-        // next trip through the run-loop, so manually call the delegate
-        // function here, letting it know the animation did not complete:
-        [self windowDidEnterFullscreen:NO];
-        ASSERT(!_isAnimating);
-    }
-    _isFullscreen = NO;
-    _isAnimating = YES;
-    
-    NSDisableScreenUpdates();
-    
+    if (!_isEnteringFullScreen)
+        return;
+    _isEnteringFullScreen = NO;
     
-    // The fullscreen animation may have been cancelled before the 
-    // webView was moved to the fullscreen window. Check to see
-    // if the _placeholderView exists and is in a window before
-    // attempting to swap the webView back to it's original tree:
-    if (_placeholderView && [_placeholderView window]) {
-        // Move the webView back to its own native window:
-        WebView* webView = [self webView];
-        NSResponder *fullScreenWindowFirstResponder = [[self window] firstResponder];
-        [webView setFrame:[_placeholderView frame]];
-        [webView setAutoresizingMask:[_placeholderView autoresizingMask]];
-        [webView removeFromSuperview];
-        [[_placeholderView superview] replaceSubview:_placeholderView with:webView];
-        [[webView window] makeResponder:fullScreenWindowFirstResponder firstResponderIfDescendantOfView:webView];
+    if (completed) {
+        // Screen updates to be re-enabled at the end of this block
+        NSDisableScreenUpdates();
+        [self _document]->setAnimatingFullScreen(false);
+        [self _document]->webkitDidEnterFullScreenForElement(_element.get());
         
-        NSWindow *webWindow = [[self webView] window];
+        NSRect windowBounds = [[self window] frame];
+        windowBounds.origin = NSZeroPoint;
+        WKWindowSetClipRect([self window], windowBounds);
+        
+        NSWindow *webWindow = [_webViewPlaceholder.get() window];
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
         // In Lion, NSWindow will animate into and out of orderOut operations. Suppress that
         // behavior here, making sure to reset the animation behavior afterward.
         NSWindowAnimationBehavior animationBehavior = [webWindow animationBehavior];
         [webWindow setAnimationBehavior:NSWindowAnimationBehaviorNone];
 #endif
-        // The user may have moved the fullscreen window in Spaces, so temporarily change 
-        // the collectionBehavior of the fullscreen window:
+        [webWindow orderOut:self];
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+        [webWindow setAnimationBehavior:animationBehavior];
+#endif
+        
+        [_fadeAnimation.get() stopAnimation];
+        [_fadeAnimation.get() setWindow:nil];
+        _fadeAnimation = nullptr;
+        
+        [_backgroundWindow.get() orderOut:self];
+        [_backgroundWindow.get() setFrame:NSZeroRect display:YES];
+        NSEnableScreenUpdates();
+    } else
+        [_scaleAnimation.get() stopAnimation];
+}
+
+- (void)exitFullScreen
+{
+    if (!_isFullScreen)
+        return;
+    _isFullScreen = NO;
+    
+    // Screen updates to be re-enabled in beganExitFullScreenWithInitialFrame:finalFrame:
+    NSDisableScreenUpdates();
+    [[self window] setAutodisplay:NO];
+
+    _finalFrame = screenRectOfContents(_element.get());
+
+    [self _document]->webkitWillExitFullScreenForElement(_element.get());
+    [self _document]->setAnimatingFullScreen(true);
+
+    if (_isEnteringFullScreen)
+        [self finishedEnterFullScreenAnimation:NO];
+    
+    [self _updateMenuAndDockForFullScreen];
+    
+    NSWindow* webWindow = [_webViewPlaceholder.get() window];
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    // In Lion, NSWindow will animate into and out of orderOut operations. Suppress that
+    // behavior here, making sure to reset the animation behavior afterward.
+    NSWindowAnimationBehavior animationBehavior = [webWindow animationBehavior];
+    [webWindow setAnimationBehavior:NSWindowAnimationBehaviorNone];
+#endif
+    // If the user has moved the fullScreen window into a new space, temporarily change
+    // the collectionBehavior of the webView's window so that it is pulled into the active space:
+    if (![webWindow isOnActiveSpace]) {
         NSWindowCollectionBehavior behavior = [webWindow collectionBehavior];
         [webWindow setCollectionBehavior:NSWindowCollectionBehaviorCanJoinAllSpaces];
         [webWindow orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
         [webWindow setCollectionBehavior:behavior];
+    } else
+        [webWindow orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-        [webWindow setAnimationBehavior:animationBehavior];
+    [webWindow setAnimationBehavior:animationBehavior];
 #endif
 
-        // Because the animation view is layer-hosted, make sure to 
-        // disable animations when changing the layer's opacity. Other-
-        // wise, the content will appear to fade into view.
-        [CATransaction begin];
-        [CATransaction setValue:[NSNumber numberWithBool:YES] forKey:kCATransactionDisableActions];
-        WebFullscreenWindow* window = [self _fullscreenWindow];
-        [[[window animationView] layer] setOpacity:1];
-        [window setBackgroundColor:[NSColor clearColor]];
-        [window setOpaque:NO];
-        [CATransaction commit];
-    }
-
-    NSView* animationView = [[self _fullscreenWindow] animationView];
-    CGRect layerEndFrame = NSRectToCGRect([animationView convertRect:NSRectFromCGRect(_initialFrame) fromView:nil]);
+    [self _startExitFullScreenAnimationWithDuration:defaultAnimationDuration];
+    _isExitingFullScreen = YES;    
+}
 
-    // The _renderer might be NULL due to its ancestor being removed:
-    CGRect layerStartFrame = CGRectZero;
-    if (_renderer) {
-        RenderBox* childRenderer = _renderer->firstChildBox();
-        layerStartFrame = CGRectMake(childRenderer->x(), childRenderer->y(), childRenderer->width(), childRenderer->height());
-    }
+- (void)finishedExitFullScreenAnimation:(bool)completed
+{
+    if (!_isExitingFullScreen)
+        return;
+    _isExitingFullScreen = NO;
     
-    [self _document]->webkitWillExitFullScreenForElement(_element.get());
-    [self _document]->updateLayout();
+    [self _updateMenuAndDockForFullScreen];
     
-    // We have to retain ourselves because we want to be alive for the end of the animation.
-    // If our owner releases us we could crash if this is not the case.
-    // Balanced in windowDidExitFullscreen
-    [self retain];
+    // Screen updates to be re-enabled at the end of this function
+    NSDisableScreenUpdates();
     
-    // Check to see if the fullscreen renderer is composited. If not, accelerated graphics 
-    // may be disabled. In this case, do not attempt to animate the contents into place; 
-    // merely snap to the final position:
-    if (!_renderer || !_renderer->layer()->isComposited()) {
-        [self windowDidExitFullscreen:YES];
-        NSEnableScreenUpdates();
-        return;
-    }
-        
-    GraphicsLayer* rendererGraphics = _renderer->layer()->backing()->graphicsLayer();
+    [self _document]->setAnimatingFullScreen(false);
+    [self _document]->webkitDidExitFullScreenForElement(_element.get());
     
-    [self _document]->setFullScreenRendererBackgroundColor(Color::transparent);
-
-    rendererGraphics->syncCompositingState(layerEndFrame);    
-
-    CALayer* rendererLayer = rendererGraphics->platformLayer();
-    [[self _fullscreenWindow] setRendererLayer:rendererLayer];    
+    NSResponder *firstResponder = [[self window] firstResponder];
+    [self _swapView:_webViewPlaceholder.get() with:_webView];
+    [[_webView window] makeResponder:firstResponder firstResponderIfDescendantOfView:_webView];
     
-    // Create a transformation matrix that will transform the renderer layer such that 
-    // the fullscreen element appears to move from the full screen to its original position 
-    // and size. Perform the transformation in two steps, using the CALayer's matrix 
-    // math to calculate the effects of each step:
-    // 1. Apply a scale tranform to shrink the apparent size of the layer to the original
-    //    element screen size.
-    // 2. Apply a translation transform to move the shrunk layer into the same screen position
-    //    as the original element.
-    CATransform3D shrinkTransform = CATransform3DMakeScale(layerEndFrame.size.width / layerStartFrame.size.width, layerEndFrame.size.height / layerStartFrame.size.height, 1);
-    [rendererLayer setTransform:shrinkTransform];
-    CGRect shrunkDestinationFrame = [rendererLayer convertRect:layerStartFrame toLayer:[animationView layer]];
-    CATransform3D moveTransform = CATransform3DMakeTranslation(layerEndFrame.origin.x - shrunkDestinationFrame.origin.x, layerEndFrame.origin.y - shrunkDestinationFrame.origin.y, 0);
-    CATransform3D finalTransform = CATransform3DConcat(shrinkTransform, moveTransform);
-    [rendererLayer setTransform:finalTransform];
-
-    CFTimeInterval duration = [self _animationDuration];
-
-    CALayer* backgroundLayer = [[self _fullscreenWindow] backgroundLayer];
-    [CATransaction begin];
-    [CATransaction setValue:[NSNumber numberWithDouble:duration] forKey:kCATransactionAnimationDuration];
-    [backgroundLayer setOpacity:0];
-    [CATransaction commit];
+    NSRect windowBounds = [[self window] frame];
+    windowBounds.origin = NSZeroPoint;
+    WKWindowSetClipRect([self window], windowBounds);
+    
+    [[self window] orderOut:self];
+    [[self window] setFrame:NSZeroRect display:YES];
     
-    CABasicAnimation* zoomAnimation = [CABasicAnimation animationWithKeyPath:@"transform"];
-    [zoomAnimation setFromValue:[NSValue valueWithCATransform3D:startTransform]];
-    [zoomAnimation setToValue:[NSValue valueWithCATransform3D:finalTransform]];
-    [zoomAnimation setDelegate:self];
-    [zoomAnimation setDuration:duration];
-    [zoomAnimation setTimingFunction:[CAMediaTimingFunction functionWithName:kCAMediaTimingFunctionEaseInEaseOut]];
-    [zoomAnimation setFillMode:kCAFillModeBoth];
-    [zoomAnimation setRemovedOnCompletion:NO];
-    [zoomAnimation setValue:(id)kCFBooleanFalse forKey:isEnteringFullscreenKey];
+    [_fadeAnimation.get() stopAnimation];
+    [_fadeAnimation.get() setWindow:nil];
+    _fadeAnimation = nullptr;
     
-    [rendererLayer addAnimation:zoomAnimation forKey:@"zoom"];
+    [_backgroundWindow.get() orderOut:self];
+    [_backgroundWindow.get() setFrame:NSZeroRect display:YES];
     
     NSEnableScreenUpdates();
 }
 
+- (void)close
+{
+    // We are being asked to close rapidly, most likely because the page 
+    // has closed or the web process has crashed.  Just walk through our
+    // normal exit full screen sequence, but don't wait to be called back
+    // in response.
+    if (_isFullScreen)
+        [self exitFullScreen];
+    
+    if (_isExitingFullScreen)
+        [self finishedExitFullScreenAnimation:YES];
+    
+    [super close];
+}
+
+#pragma mark -
+#pragma mark NSAnimation delegate
+
+- (void)animationDidEnd:(NSAnimation*)animation
+{
+    if (_isFullScreen)
+        [self finishedEnterFullScreenAnimation:YES];
+    else
+        [self finishedExitFullScreenAnimation:YES];
+}
+
 #pragma mark -
 #pragma mark Internal Interface
 
-- (void)_updateMenuAndDockForFullscreen
+- (void)_updateMenuAndDockForFullScreen
 {
     // NSApplicationPresentationOptions is available on > 10.6 only:
 #ifndef BUILDING_ON_LEOPARD
     NSApplicationPresentationOptions options = NSApplicationPresentationDefault;
     NSScreen* fullscreenScreen = [[self window] screen];
     
-    if (_isFullscreen) {
+    if (_isFullScreen) {
         // Auto-hide the menu bar if the fullscreenScreen contains the menu bar:
         // NOTE: if the fullscreenScreen contains the menu bar but not the dock, we must still 
         // auto-hide the dock, or an exception will be thrown.
@@ -640,212 +422,145 @@ private:
         [NSApp setPresentationOptions:options];
     else
 #endif
-        SetSystemUIMode(_isFullscreen ? kUIModeNormal : kUIModeAllHidden, 0);
+        SetSystemUIMode(_isFullScreen ? kUIModeNormal : kUIModeAllHidden, 0);
 }
 
-- (void)_updatePowerAssertions
-{
-    BOOL isPlaying = [self _isAnyMoviePlaying];
-    
-    if (isPlaying && _isFullscreen) {
-        if (!_displaySleepDisabler)
-            _displaySleepDisabler = DisplaySleepDisabler::create("com.apple.WebKit - Fullscreen video");
-    } else
-        _displaySleepDisabler = nullptr;
-}
-
-- (void)_requestExit
-{
-    [self exitFullscreen];
-    _forceDisableAnimation = NO;
-}
+#pragma mark -
+#pragma mark Utility Functions
 
-- (void)_requestExitFullscreenWithAnimation:(BOOL)animation
+- (Document*)_document 
 {
-    _forceDisableAnimation = !animation;
-    [self performSelector:@selector(_requestExit) withObject:nil afterDelay:0];
-
+    return _element->document();
 }
 
-- (BOOL)_isAnyMoviePlaying
+- (void)_swapView:(NSView*)view with:(NSView*)otherView
 {
-#if ENABLE(VIDEO)
-    if (!_element)
-        return NO;
-    
-    Node* nextNode = _element.get();
-    while (nextNode)
-    {
-        if (nextNode->hasTagName(HTMLNames::videoTag) && static_cast<Element*>(nextNode)->isMediaElement()) {
-            HTMLMediaElement* element = static_cast<HTMLMediaElement*>(nextNode);
-            if (!element->paused() && !element->ended())
-                return YES;
-        }
-        
-        nextNode = nextNode->traverseNextNode(_element.get());
-    }
-#endif
-    
-    return NO;
+    [CATransaction begin];
+    [CATransaction setDisableActions:YES];
+    [otherView setFrame:[view frame]];        
+    [otherView setAutoresizingMask:[view autoresizingMask]];
+    [otherView removeFromSuperview];
+    [[view superview] replaceSubview:view with:otherView];
+    [CATransaction commit];
 }
 
-#pragma mark -
-#pragma mark Utility Functions
-
-- (WebFullscreenWindow *)_fullscreenWindow
+static RetainPtr<NSWindow> createBackgroundFullscreenWindow(NSRect frame)
 {
-    return (WebFullscreenWindow *)[self window];
+    NSWindow *window = [[NSWindow alloc] initWithContentRect:frame styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:NO];
+    [window setOpaque:YES];
+    [window setBackgroundColor:[NSColor blackColor]];
+    [window setReleasedWhenClosed:NO];
+    return adoptNS(window);
 }
 
-- (Document*)_document 
+static NSRect windowFrameFromApparentFrames(NSRect screenFrame, NSRect initialFrame, NSRect finalFrame)
 {
-    return _element->document();
+    NSRect initialWindowFrame;
+    CGFloat xScale = NSWidth(screenFrame) / NSWidth(finalFrame);
+    CGFloat yScale = NSHeight(screenFrame) / NSHeight(finalFrame);
+    CGFloat xTrans = NSMinX(screenFrame) - NSMinX(finalFrame);
+    CGFloat yTrans = NSMinY(screenFrame) - NSMinY(finalFrame);
+    initialWindowFrame.size = NSMakeSize(NSWidth(initialFrame) * xScale, NSHeight(initialFrame) * yScale);
+    initialWindowFrame.origin = NSMakePoint
+    ( NSMinX(initialFrame) + xTrans / (NSWidth(finalFrame) / NSWidth(initialFrame))
+     , NSMinY(initialFrame) + yTrans / (NSHeight(finalFrame) / NSHeight(initialFrame)));
+    return initialWindowFrame;
 }
 
-- (CFTimeInterval)_animationDuration
+- (void)_startEnterFullScreenAnimationWithDuration:(NSTimeInterval)duration
 {
-    static const CFTimeInterval defaultDuration = 0.5;
-    CFTimeInterval duration = defaultDuration;
-#ifndef BUILDING_ON_LEOPARD
-    NSUInteger modifierFlags = [NSEvent modifierFlags];
-#else
-    NSUInteger modifierFlags = [[NSApp currentEvent] modifierFlags];
-#endif
-    if ((modifierFlags & NSControlKeyMask) == NSControlKeyMask)
-        duration *= 2;
-    if ((modifierFlags & NSShiftKeyMask) == NSShiftKeyMask)
-        duration *= 10;
-    if (_forceDisableAnimation) {
-        // This will disable scale animation
-        duration = 0;
+    NSRect screenFrame = [[[self window] screen] frame];
+    NSRect initialWindowFrame = windowFrameFromApparentFrames(screenFrame, _initialFrame, _finalFrame);
+    
+    _scaleAnimation = adoptNS([[WebWindowScaleAnimation alloc] initWithHintedDuration:duration window:[self window] initalFrame:initialWindowFrame finalFrame:screenFrame]);
+    
+    [_scaleAnimation.get() setAnimationBlockingMode:NSAnimationNonblocking];
+    [_scaleAnimation.get() setDelegate:self];
+    [_scaleAnimation.get() setCurrentProgress:0];
+    [_scaleAnimation.get() startAnimation];
+    
+    // WKWindowSetClipRect takes window coordinates, so convert from screen coordinates here:
+    NSRect finalBounds = _finalFrame;
+    finalBounds.origin = [[self window] convertScreenToBase:finalBounds.origin];
+    WKWindowSetClipRect([self window], finalBounds);
+    
+    [[self window] makeKeyAndOrderFront:self];
+    
+    if (!_backgroundWindow)
+        _backgroundWindow = createBackgroundFullscreenWindow(screenFrame);
+    else
+        [_backgroundWindow.get() setFrame:screenFrame display:NO];
+    
+    CGFloat currentAlpha = 0;
+    if (_fadeAnimation) {
+        currentAlpha = [_fadeAnimation.get() currentAlpha];
+        [_fadeAnimation.get() stopAnimation];
+        [_fadeAnimation.get() setWindow:nil];
     }
-    return duration;
+    
+    _fadeAnimation = adoptNS([[WebWindowFadeAnimation alloc] initWithDuration:duration 
+                                                                       window:_backgroundWindow.get() 
+                                                                 initialAlpha:currentAlpha 
+                                                                   finalAlpha:1]);
+    [_fadeAnimation.get() setAnimationBlockingMode:NSAnimationNonblocking];
+    [_fadeAnimation.get() setCurrentProgress:0];
+    [_fadeAnimation.get() startAnimation];
+    
+    [_backgroundWindow.get() orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
+    
+    [[self window] setAutodisplay:YES];
+    [[self window] displayIfNeeded];
+    // Screen updates disabled in enterFullScreen:
+    NSEnableScreenUpdates();
 }
 
-@end
-
-#pragma mark -
-@implementation WebFullscreenWindow
-
-- (id)initWithContentRect:(NSRect)contentRect styleMask:(NSUInteger)aStyle backing:(NSBackingStoreType)bufferingType defer:(BOOL)flag
+- (void)_startExitFullScreenAnimationWithDuration:(NSTimeInterval)duration
 {
-    UNUSED_PARAM(aStyle);
-    self = [super initWithContentRect:contentRect styleMask:NSBorderlessWindowMask backing:bufferingType defer:flag];
-    if (!self)
-        return nil;
-    [self setOpaque:NO];
-    [self setBackgroundColor:[NSColor clearColor]];
-    [self setIgnoresMouseEvents:NO];
-    [self setAcceptsMouseMovedEvents:YES];
-    [self setReleasedWhenClosed:NO];
-    [self setHasShadow:YES];
-#ifndef BUILDING_ON_LEOPARD
-    [self setMovable:NO];
-#else
-    [self setMovableByWindowBackground:NO];
-#endif
+    NSRect screenFrame = [[[self window] screen] frame];
+    NSRect initialWindowFrame = windowFrameFromApparentFrames(screenFrame, _initialFrame, _finalFrame);
     
-    NSView* contentView = [self contentView];
-    _animationView = [[NSView alloc] initWithFrame:[contentView bounds]];
+    NSRect currentFrame = _scaleAnimation ? [_scaleAnimation.get() currentFrame] : [[self window] frame];
+    _scaleAnimation = adoptNS([[WebWindowScaleAnimation alloc] initWithHintedDuration:duration window:[self window] initalFrame:currentFrame finalFrame:initialWindowFrame]);
     
-    RetainPtr<CALayer> contentLayer(AdoptNS, [[CALayer alloc] init]);
-    [_animationView setLayer:contentLayer.get()];
-    [_animationView setWantsLayer:YES];
-    [_animationView setAutoresizingMask:NSViewWidthSizable|NSViewHeightSizable];
-    [contentView addSubview:_animationView];
+    [_scaleAnimation.get() setAnimationBlockingMode:NSAnimationNonblocking];
+    [_scaleAnimation.get() setDelegate:self];
+    [_scaleAnimation.get() setCurrentProgress:0];
+    [_scaleAnimation.get() startAnimation];
     
-    _backgroundLayer = [[CALayer alloc] init];
-    [contentLayer.get() addSublayer:_backgroundLayer];
-#ifndef BUILDING_ON_LEOPARD
-    [contentLayer.get() setGeometryFlipped:YES];
-#else
-    [contentLayer.get() setSublayerTransform:CATransform3DMakeScale(1, -1, 1)];
-#endif
-    [contentLayer.get() setOpacity:0];
+    if (!_backgroundWindow)
+        _backgroundWindow = createBackgroundFullscreenWindow(screenFrame);
+    else
+        [_backgroundWindow.get() setFrame:screenFrame display:NO];
     
-    [_backgroundLayer setBackgroundColor:CGColorGetConstantColor(kCGColorBlack)];
-    [_backgroundLayer setOpacity:0];
-    return self;
-}
-
-- (void)dealloc
-{
-    [_animationView release];
-    [_backgroundLayer release];
-    [_rendererLayer release];
-    [super dealloc];
-}
-
-- (BOOL)canBecomeKeyWindow
-{
-    return YES;
-}
-
-- (void)keyDown:(NSEvent *)theEvent
-{
-    if ([[theEvent charactersIgnoringModifiers] isEqual:@"\e"]) // Esacpe key-code
-        [self cancelOperation:self];
-    else [super keyDown:theEvent];
-}
-
-- (void)cancelOperation:(id)sender
-{
-    UNUSED_PARAM(sender);
-    [[self windowController] _requestExitFullscreenWithAnimation:YES];
-}
-
-- (CALayer*)rendererLayer
-{
-    return _rendererLayer;
-}
-
-- (void)setRendererLayer:(CALayer *)rendererLayer
-{
-    [CATransaction begin];
-    [CATransaction setValue:[NSNumber numberWithBool:YES] forKey:kCATransactionDisableActions];
-    [rendererLayer retain];
-    [_rendererLayer removeFromSuperlayer];
-    [_rendererLayer release];
-    _rendererLayer = rendererLayer;
-    
-    if (_rendererLayer)
-        [[[self animationView] layer] addSublayer:_rendererLayer];
-    [CATransaction commit];
-}
+    CGFloat currentAlpha = 1;
+    if (_fadeAnimation) {
+        currentAlpha = [_fadeAnimation.get() currentAlpha];
+        [_fadeAnimation.get() stopAnimation];
+        [_fadeAnimation.get() setWindow:nil];
+    }
+    _fadeAnimation = adoptNS([[WebWindowFadeAnimation alloc] initWithDuration:duration 
+                                                                       window:_backgroundWindow.get() 
+                                                                 initialAlpha:currentAlpha 
+                                                                   finalAlpha:0]);
+    [_fadeAnimation.get() setAnimationBlockingMode:NSAnimationNonblocking];
+    [_fadeAnimation.get() setCurrentProgress:0];
+    [_fadeAnimation.get() startAnimation];
+    
+    [_backgroundWindow.get() orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
+    
+    // WKWindowSetClipRect takes window coordinates, so convert from screen coordinates here:
+    NSRect finalBounds = _finalFrame;
+    finalBounds.origin = [[self window] convertScreenToBase:finalBounds.origin];
+    WKWindowSetClipRect([self window], finalBounds);
+    
+    [[self window] setAutodisplay:YES];
+    [[self window] displayIfNeeded];
 
-- (CALayer*)backgroundLayer
-{
-    return _backgroundLayer;
+    // Screen updates disabled in exitFullScreen:
+    NSEnableScreenUpdates();
 }
 
-- (NSView*)animationView
-{
-    return _animationView;
-}
 @end
 
-#pragma mark -
-#pragma mark MediaEventListener
-
-MediaEventListener::MediaEventListener(WebFullScreenController* delegate)
-    : EventListener(CPPEventListenerType)
-    , delegate(delegate)
-{ 
-}
-
-PassRefPtr<MediaEventListener> MediaEventListener::create(WebFullScreenController* delegate) 
-{ 
-    return adoptRef(new MediaEventListener(delegate)); 
-}
-
-bool MediaEventListener::operator==(const EventListener& listener)
-{
-    return this == &listener;
-}
-
-void MediaEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
-{
-    [delegate _updatePowerAssertions];
-}
 
 #endif /* ENABLE(FULLSCREEN_API) */
diff --git a/Source/WebKit/mac/WebView/WebHTMLView.mm b/Source/WebKit/mac/WebView/WebHTMLView.mm
index 7052fca0b..a9b291e49 100644
--- a/Source/WebKit/mac/WebView/WebHTMLView.mm
+++ b/Source/WebKit/mac/WebView/WebHTMLView.mm
@@ -1372,6 +1372,16 @@ static NSURL* uniqueURLWithRelativePart(NSString *relativePart)
     return self != [self _topHTMLView];
 }
 
+static BOOL isQuickLookEvent(NSEvent *event)
+{
+#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+    const int kCGSEventSystemSubtypeHotKeyCombinationReleased = 9;
+    return [event type] == NSSystemDefined && [event subtype] == kCGSEventSystemSubtypeHotKeyCombinationReleased && [event data1] == 'lkup';
+#else
+    return NO;
+#endif
+}
+
 - (NSView *)hitTest:(NSPoint)point
 {
     // WebHTMLView objects handle all events for objects inside them.
@@ -1412,7 +1422,8 @@ static NSURL* uniqueURLWithRelativePart(NSString *relativePart)
         captureHitsOnSubviews = !([event type] == NSMouseMoved
             || [event type] == NSRightMouseDown
             || ([event type] == NSLeftMouseDown && ([event modifierFlags] & NSControlKeyMask) != 0)
-            || [event type] == NSFlagsChanged);
+            || [event type] == NSFlagsChanged
+            || isQuickLookEvent(event));
     }
 
     if (!captureHitsOnSubviews) {
diff --git a/Source/WebKit/mac/WebView/WebNotification.h b/Source/WebKit/mac/WebView/WebNotification.h
index c04b2ad07..8ecc10686 100644
--- a/Source/WebKit/mac/WebView/WebNotification.h
+++ b/Source/WebKit/mac/WebView/WebNotification.h
@@ -36,6 +36,7 @@
 
 - (NSString *)title;
 - (NSString *)body;
+- (NSString *)replaceID;
 - (WebSecurityOrigin *)origin;
 - (uint64_t)notificationID;
 
diff --git a/Source/WebKit/mac/WebView/WebNotification.mm b/Source/WebKit/mac/WebView/WebNotification.mm
index bbd0248f6..557332cba 100644
--- a/Source/WebKit/mac/WebView/WebNotification.mm
+++ b/Source/WebKit/mac/WebView/WebNotification.mm
@@ -101,6 +101,16 @@ Notification* core(WebNotification *notification)
 #endif
 }
 
+- (NSString *)replaceID
+{
+#if ENABLE(NOTIFICATIONS)
+    ASSERT(core(self));
+    return core(self)->replaceId();
+#else
+    return nil;
+#endif
+}
+
 - (WebSecurityOrigin *)origin
 {
 #if ENABLE(NOTIFICATIONS)
diff --git a/Source/WebKit/mac/WebView/WebPDFDocumentExtras.mm b/Source/WebKit/mac/WebView/WebPDFDocumentExtras.mm
index f2c6c833b..3e701cf5c 100644
--- a/Source/WebKit/mac/WebView/WebPDFDocumentExtras.mm
+++ b/Source/WebKit/mac/WebView/WebPDFDocumentExtras.mm
@@ -26,8 +26,8 @@
 #import "WebPDFDocumentExtras.h"
 
 #import "WebTypesInternal.h"
-#import <JavaScriptCore/Vector.h>
-#import <JavaScriptCore/RetainPtr.h>
+#import <wtf/Vector.h>
+#import <wtf/RetainPtr.h>
 #import <PDFKit/PDFDocument.h>
 #import <objc/objc-runtime.h>
 
diff --git a/Source/WebKit/mac/WebView/WebPDFRepresentation.mm b/Source/WebKit/mac/WebView/WebPDFRepresentation.mm
index 44a1362f3..a36853349 100644
--- a/Source/WebKit/mac/WebView/WebPDFRepresentation.mm
+++ b/Source/WebKit/mac/WebView/WebPDFRepresentation.mm
@@ -35,7 +35,7 @@
 #import "WebPDFDocumentExtras.h"
 #import "WebPDFView.h"
 #import "WebTypesInternal.h"
-#import <JavaScriptCore/Assertions.h>
+#import <wtf/Assertions.h>
 #import <JavaScriptCore/JSContextRef.h>
 #import <JavaScriptCore/JSStringRef.h>
 #import <JavaScriptCore/JSStringRefCF.h>
diff --git a/Source/WebKit/mac/WebView/WebResource.mm b/Source/WebKit/mac/WebView/WebResource.mm
index 463f76846..3964f6f79 100644
--- a/Source/WebKit/mac/WebView/WebResource.mm
+++ b/Source/WebKit/mac/WebView/WebResource.mm
@@ -35,7 +35,7 @@
 #import "WebNSObjectExtras.h"
 #import "WebNSURLExtras.h"
 #import <JavaScriptCore/InitializeThreading.h>
-#import <JavaScriptCore/PassRefPtr.h>
+#import <wtf/PassRefPtr.h>
 #import <WebCore/ArchiveResource.h>
 #import <WebCore/LegacyWebArchive.h>
 #import <WebCore/RunLoop.h>
diff --git a/Source/WebKit/mac/WebView/WebTextIterator.mm b/Source/WebKit/mac/WebView/WebTextIterator.mm
index e80d4671f..9b1bd8feb 100644
--- a/Source/WebKit/mac/WebView/WebTextIterator.mm
+++ b/Source/WebKit/mac/WebView/WebTextIterator.mm
@@ -28,7 +28,7 @@
 #import "DOMNodeInternal.h"
 #import "DOMRangeInternal.h"
 #import "WebTypesInternal.h"
-#import <JavaScriptCore/Vector.h>
+#import <wtf/Vector.h>
 #import <WebCore/RunLoop.h>
 #import <WebCore/TextIterator.h>
 #import <WebCore/WebCoreObjCExtras.h>
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index 9b722026e..9cfe8b348 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -6304,21 +6304,14 @@ bool LayerFlushController::flushLayers()
 
     [_private->newFullscreenController setElement:element];
     [_private->newFullscreenController setWebView:self];
-    [_private->newFullscreenController enterFullscreen:[[self window] screen]];        
+    [_private->newFullscreenController enterFullScreen:[[self window] screen]];        
 }
 
 - (void)_exitFullScreenForElement:(WebCore::Element*)element
 {
     if (!_private->newFullscreenController)
         return;
-    [_private->newFullscreenController exitFullscreen];
-}
-
-- (void)_fullScreenRendererChanged:(WebCore::RenderBox*)renderer
-{
-    if (!_private->newFullscreenController)
-        _private->newFullscreenController = [[WebFullScreenController alloc] init];
-    [_private->newFullscreenController setRenderer:renderer];
+    [_private->newFullscreenController exitFullScreen];
 }
 #endif
 
diff --git a/Source/WebKit/mac/WebView/WebViewPrivate.h b/Source/WebKit/mac/WebView/WebViewPrivate.h
index e0fee81d1..1b61821d1 100644
--- a/Source/WebKit/mac/WebView/WebViewPrivate.h
+++ b/Source/WebKit/mac/WebView/WebViewPrivate.h
@@ -106,7 +106,7 @@ typedef enum {
     WebPaginationModeVertical,
 } WebPaginationMode;
 
-// This needs to be in sync with WebCore::NotificationPresenter::Permission
+// This needs to be in sync with WebCore::NotificationClient::Permission
 typedef enum {
     WebNotificationPermissionAllowed,
     WebNotificationPermissionNotAllowed,
diff --git a/Source/WebKit/qt/Api/qwebelement.cpp b/Source/WebKit/qt/Api/qwebelement.cpp
index 40c69f4bf..3fc64c96f 100644
--- a/Source/WebKit/qt/Api/qwebelement.cpp
+++ b/Source/WebKit/qt/Api/qwebelement.cpp
@@ -33,6 +33,7 @@
 #include "GraphicsContext.h"
 #include "HTMLElement.h"
 #include "StylePropertySet.h"
+#include "StyleRule.h"
 #if USE(JSC)
 #include "Completion.h"
 #include "JSGlobalObject.h"
@@ -843,7 +844,7 @@ QString QWebElement::styleProperty(const QString &name, StyleResolveStrategy str
     if (!propID)
         return QString();
 
-    StylePropertySet* style = static_cast<StyledElement*>(m_element)->ensureInlineStyleDecl();
+    const StylePropertySet* style = static_cast<StyledElement*>(m_element)->ensureInlineStyle();
 
     if (strategy == InlineStyle)
         return style->getPropertyValue(propID);
@@ -865,11 +866,11 @@ QString QWebElement::styleProperty(const QString &name, StyleResolveStrategy str
             for (int i = rules->length(); i > 0; --i) {
                 CSSStyleRule* rule = static_cast<CSSStyleRule*>(rules->item(i - 1));
 
-                if (rule->declaration()->propertyIsImportant(propID))
-                    return rule->declaration()->getPropertyValue(propID);
+                if (rule->styleRule()->properties()->propertyIsImportant(propID))
+                    return rule->styleRule()->properties()->getPropertyValue(propID);
 
                 if (style->getPropertyValue(propID).isEmpty())
-                    style = rule->declaration();
+                    style = rule->styleRule()->properties();
             }
         }
 
@@ -908,11 +909,7 @@ void QWebElement::setStyleProperty(const QString &name, const QString &value)
         return;
 
     int propID = cssPropertyID(name);
-    StylePropertySet* style = static_cast<StyledElement*>(m_element)->ensureInlineStyleDecl();
-    if (!propID || !style)
-        return;
-
-    style->setProperty(propID, value);
+    static_cast<StyledElement*>(m_element)->setInlineStyleProperty(propID, value);
 }
 
 /*!
diff --git a/Source/WebKit/qt/Api/qwebframe.cpp b/Source/WebKit/qt/Api/qwebframe.cpp
index 211f0ef20..dcf23061d 100644
--- a/Source/WebKit/qt/Api/qwebframe.cpp
+++ b/Source/WebKit/qt/Api/qwebframe.cpp
@@ -783,12 +783,12 @@ QString QWebFrame::title() const
 
     Given the above HTML code the metaData() function will return a map with two entries:
     \table
-    \header \o Key
-            \o Value
-    \row    \o "description"
-            \o "This document is a tutorial about Qt development"
-    \row    \o "keywords"
-            \o "Qt, WebKit, Programming"
+    \header \li Key
+            \li Value
+    \row    \li "description"
+            \li "This document is a tutorial about Qt development"
+    \row    \li "keywords"
+            \li "Qt, WebKit, Programming"
     \endtable
 
     This function returns a multi map to support multiple meta tags with the same attribute name.
@@ -1750,7 +1750,7 @@ QWebHitTestResultPrivate::QWebHitTestResultPrivate(const WebCore::HitTestResult
 {
     if (!hitTest.innerNode())
         return;
-    pos = hitTest.point();
+    pos = hitTest.roundedPoint();
     WebCore::TextDirection dir;
     title = hitTest.title(dir);
     linkText = hitTest.textContent();
diff --git a/Source/WebKit/qt/Api/qwebhistory.cpp b/Source/WebKit/qt/Api/qwebhistory.cpp
index 33bad4174..fc5bdd5fc 100644
--- a/Source/WebKit/qt/Api/qwebhistory.cpp
+++ b/Source/WebKit/qt/Api/qwebhistory.cpp
@@ -53,13 +53,13 @@ enum {
   the functions used to access them.
 
   \table
-  \header \o Function      \o Description
-  \row    \o title()       \o The page title.
-  \row    \o url()         \o The location of the page.
-  \row    \o originalUrl() \o The URL used to access the page.
-  \row    \o lastVisited() \o The date and time of the user's last visit to the page.
-  \row    \o icon()        \o The icon associated with the page that was provided by the server.
-  \row    \o userData()    \o The user specific data that was stored with the history item.
+  \header \li Function      \li Description
+  \row    \li title()       \li The page title.
+  \row    \li url()         \li The location of the page.
+  \row    \li originalUrl() \li The URL used to access the page.
+  \row    \li lastVisited() \li The date and time of the user's last visit to the page.
+  \row    \li icon()        \li The icon associated with the page that was provided by the server.
+  \row    \li userData()    \li The user specific data that was stored with the history item.
   \endtable
 
   \note QWebHistoryItem objects are value based, but \e{explicitly shared}. Changing
diff --git a/Source/WebKit/qt/Api/qwebinspector.cpp b/Source/WebKit/qt/Api/qwebinspector.cpp
index 52feb8895..2fbbab249 100644
--- a/Source/WebKit/qt/Api/qwebinspector.cpp
+++ b/Source/WebKit/qt/Api/qwebinspector.cpp
@@ -50,8 +50,8 @@
 
     \note A QWebInspector will display a blank widget if either:
     \list
-        \o page() is null
-        \o QWebSettings::DeveloperExtrasEnabled is false
+        \li page() is null
+        \li QWebSettings::DeveloperExtrasEnabled is false
     \endlist
 
     \section1 Resources
@@ -60,8 +60,8 @@
     Most of the resources needed by the inspector are owned by the associated
     QWebPage and are allocated the first time that:
     \list
-        \o an element is inspected
-        \o the QWebInspector is shown.
+        \li an element is inspected
+        \li the QWebInspector is shown.
     \endlist
 
     \section1 Inspector configuration persistence
@@ -98,12 +98,12 @@ QWebInspector::~QWebInspector()
 /*!
     Bind this inspector to the QWebPage to be inspected.
 
-    \bold {Notes:}
+    \b {Notes:}
     \list
-        \o There can only be one QWebInspector associated with a QWebPage
+        \li There can only be one QWebInspector associated with a QWebPage
            and vice versa.
-        \o Calling this method with a null \a page will break the current association, if any.
-        \o If \a page is already associated to another QWebInspector, the association
+        \li Calling this method with a null \a page will break the current association, if any.
+        \li If \a page is already associated to another QWebInspector, the association
            will be replaced and the previous QWebInspector will become unbound
     \endlist
 
diff --git a/Source/WebKit/qt/Api/qwebpage.cpp b/Source/WebKit/qt/Api/qwebpage.cpp
index 898899bf5..4928318d6 100644
--- a/Source/WebKit/qt/Api/qwebpage.cpp
+++ b/Source/WebKit/qt/Api/qwebpage.cpp
@@ -3290,15 +3290,11 @@ bool QWebPage::swallowContextMenuEvent(QContextMenuEvent *event)
 {
     d->page->contextMenuController()->clearContextMenu();
 
-#if HAVE(QSTYLE)
-    if (!RenderThemeQt::useMobileTheme()) {
-        if (QWebFrame* webFrame = frameAt(event->pos())) {
-            Frame* frame = QWebFramePrivate::core(webFrame);
-            if (Scrollbar* scrollbar = frame->view()->scrollbarAtPoint(convertMouseEvent(event, 1).position()))
-                return handleScrollbarContextMenuEvent(scrollbar, event);
-        }
+    if (QWebFrame* webFrame = frameAt(event->pos())) {
+        Frame* frame = QWebFramePrivate::core(webFrame);
+        if (Scrollbar* scrollbar = frame->view()->scrollbarAtPoint(convertMouseEvent(event, 1).position()))
+            return handleScrollbarContextMenuEvent(scrollbar, event);
     }
-#endif
 
     WebCore::Frame* focusedFrame = d->page->focusController()->focusedOrMainFrame();
     focusedFrame->eventHandler()->sendContextMenuEvent(convertMouseEvent(event, 1));
@@ -3744,11 +3740,11 @@ QWebPluginFactory *QWebPage::pluginFactory() const
 
     In this string the following values are replaced at run-time:
     \list
-    \o %Platform% expands to the windowing system followed by "; " if it is not Windows (e.g. "X11; ").
-    \o %Security% expands to "N; " if SSL is disabled.
-    \o %Subplatform% expands to the operating system version (e.g. "Windows NT 6.1" or "Intel Mac OS X 10.5").
-    \o %WebKitVersion% is the version of WebKit the application was compiled against.
-    \o %AppVersion% expands to QCoreApplication::applicationName()/QCoreApplication::applicationVersion() if they're set; otherwise defaulting to Qt and the current Qt version.
+    \li %Platform% expands to the windowing system followed by "; " if it is not Windows (e.g. "X11; ").
+    \li %Security% expands to "N; " if SSL is disabled.
+    \li %Subplatform% expands to the operating system version (e.g. "Windows NT 6.1" or "Intel Mac OS X 10.5").
+    \li %WebKitVersion% is the version of WebKit the application was compiled against.
+    \li %AppVersion% expands to QCoreApplication::applicationName()/QCoreApplication::applicationVersion() if they're set; otherwise defaulting to Qt and the current Qt version.
     \endlist
 */
 QString QWebPage::userAgentForUrl(const QUrl&) const
diff --git a/Source/WebKit/qt/Api/qwebpluginfactory.cpp b/Source/WebKit/qt/Api/qwebpluginfactory.cpp
index b9180be94..34ea05265 100644
--- a/Source/WebKit/qt/Api/qwebpluginfactory.cpp
+++ b/Source/WebKit/qt/Api/qwebpluginfactory.cpp
@@ -181,16 +181,16 @@ void QWebPluginFactory::refreshPlugins()
 
     The above object element will result in a call to create() with the following arguments:
     \table
-    \header \o Parameter
-            \o Value
-    \row    \o mimeType
-            \o "application/x-pdf"
-    \row    \o url
-            \o "http://qt.nokia.com/document.pdf"
-    \row    \o argumentNames
-            \o "showTableOfContents" "hideThumbnails"
-    \row    \o argumentVaues
-            \o "true" "false"
+    \header \li Parameter
+            \li Value
+    \row    \li mimeType
+            \li "application/x-pdf"
+    \row    \li url
+            \li "http://qt.nokia.com/document.pdf"
+    \row    \li argumentNames
+            \li "showTableOfContents" "hideThumbnails"
+    \row    \li argumentVaues
+            \li "true" "false"
     \endtable
 
     \note Ownership of the returned object will be transferred to the caller.
diff --git a/Source/WebKit/qt/Api/qwebsettings.cpp b/Source/WebKit/qt/Api/qwebsettings.cpp
index 2885f01ee..0f55b0b89 100644
--- a/Source/WebKit/qt/Api/qwebsettings.cpp
+++ b/Source/WebKit/qt/Api/qwebsettings.cpp
@@ -703,7 +703,7 @@ void QWebSettings::clearIconDatabase()
 /*!
     Returns the web site's icon for \a url.
 
-    If the web site does not specify an icon \bold OR if the icon is not in the
+    If the web site does not specify an icon \b OR if the icon is not in the
     database, a null QIcon is returned.
 
     \note The returned icon's size is arbitrary.
@@ -850,10 +850,10 @@ int QWebSettings::maximumPagesInCache()
    dead objects should consume when the cache is under pressure.
 
    \a cacheMaxDead is the \e maximum number of bytes that dead objects should
-   consume when the cache is \bold not under pressure.
+   consume when the cache is \b not under pressure.
 
    \a totalCapacity specifies the \e maximum number of bytes that the cache
-   should consume \bold overall.
+   should consume \b overall.
 
    The cache is enabled by default. Calling setObjectCacheCapacities(0, 0, 0)
    will disable the cache. Calling it with one non-zero enables it again.
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index 175b43df2..d9c4ee953 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,316 @@
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Rename NotificationPresenter to NotificationClient
+        https://bugs.webkit.org/show_bug.cgi?id=80488
+        <rdar://problem/10965558>
+
+        Reviewed by Kentaro Hara.
+
+        Refactor to use renamed WebCore::NotificationClient.
+        * WebCoreSupport/NotificationPresenterClientQt.cpp:
+        (WebCore::NotificationPresenterClientQt::checkPermission):
+        (WebCore::NotificationPresenterClientQt::allowNotificationForFrame):
+        * WebCoreSupport/NotificationPresenterClientQt.h:
+        (NotificationPresenterClientQt):
+
+2012-03-09  Emil A Eklund  <eae@chromium.org>
+
+        Add roundedPoint to HitTestResult and change platform code to use it
+        https://bugs.webkit.org/show_bug.cgi?id=80715
+
+        Reviewed by James Robinson.
+
+        Change ports to use roundedPoint to avoid exposing subpixel types to
+        platform code.
+
+        * Api/qwebframe.cpp:
+        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Add support for ENABLE(LEGACY_NOTIFICATIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=80497
+
+        Reviewed by Adam Barth.
+
+        Prep for b80472: Update API for Web Notifications
+        * examples/platformplugin/platformplugin.pro:
+
+2012-03-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Fix compilation without QtQuick1
+        https://bugs.webkit.org/show_bug.cgi?id=80503
+
+        Qt 4.8 API test fix after r110050.
+
+        Reviewed by Zoltan Herczeg.
+
+        * declarative/public.pri: Add load(features) to ensure HAVE_QQUICK1=1 is set.
+
+2012-03-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Use Qt's module system for install rules and depending on QtWebKit
+
+        Instead of rolling our own install rules we now use the same approach as
+        every other Qt module, by loading qt_module.prf and qt_module_config.prf.
+
+        This ensures that we follow the same semantics as the rest of Qt on
+        what sort of config options are enabled by default (create_cmake eg.).
+        It also allows us to use QT += webkit instead of the workaround we had
+        with CONFIG += qtwebkit.
+
+        We do however force Qt to always treat our build as a non-developer build,
+        so the libraries will end up in the WebKit lib directory instead of the
+        qtbase directory (as with a normal developer-build). This allows us to
+        keep the webkit-build self-contained. If Qt is a developer build we still
+        copy the module file manually to Qt, so that you don't have to install
+        WebKit to make it available.
+
+        For non-developer builds of Qt, it is still possible to use the built
+        WebKit libraries without having to install them, by having the variable
+        QMAKE_EXTRA_MODULE_FORWARDS set in the project's .qmake.cache file,
+        pointing to $WEBKITOUTUTDIR/$CONFIGURATION/modules.
+
+        https://bugs.webkit.org/show_bug.cgi?id=80590
+
+        Reviewed by Simon Hausmann.
+
+        * declarative/experimental/experimental.pri:
+        * declarative/experimental/plugin.cpp:
+        * declarative/plugin.cpp:
+        * declarative/public.pri:
+        * tests/tests.pri:
+
+2012-03-08  Antti Koivisto  <antti@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80370
+        Enable matched declaration caching for elements with a style attribute
+
+        Reviewed by Andreas Kling
+
+        * Api/qwebelement.cpp:
+        (QWebElement::styleProperty):
+        (QWebElement::setStyleProperty):
+
+2012-03-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix compilation without QtQuick1
+        https://bugs.webkit.org/show_bug.cgi?id=80503
+
+        Reviewed by Tor Arne Vestbø.
+
+        Compile and enable the QtQuick1/QML1 plugin and webview
+        only if we're using Qt 4 at the moment. QQuick1 clashes
+        with QQuick2 right now because both declare QDeclarativeEngine
+        and friends as classes.
+
+        * declarative/plugin.cpp:
+        (WebKitQmlPlugin::registerTypes):
+        * declarative/public.pri:
+        * tests/tests.pri:
+
+2012-03-07  Kangil Han  <kangil.han@samsung.com>
+
+        [DRT] Remove PlainTextController implementations.
+        https://bugs.webkit.org/show_bug.cgi?id=79959
+
+        Reviewed by Hajime Morita.
+
+        PlainTextController usages in existing tests have been
+        replaced by internals API by bug 78570.
+        So this patch will remove PlainTextController implementations
+        to avoid further usage in new tests.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2012-03-06  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] disable GStreamerGWorld when building against 0.11
+        https://bugs.webkit.org/show_bug.cgi?id=77088
+
+        Reviewed by Martin Robinson.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::ChromeClientQt):
+        (WebCore::ChromeClientQt::~ChromeClientQt):
+        (WebCore):
+        * WebCoreSupport/FullScreenVideoQt.cpp:
+        (WebCore):
+        (WebCore::FullScreenVideoQt::FullScreenVideoQt):
+        (WebCore::FullScreenVideoQt::~FullScreenVideoQt):
+        (WebCore::FullScreenVideoQt::enterFullScreenForNode):
+        (WebCore::FullScreenVideoQt::exitFullScreenForNode):
+        (WebCore::FullScreenVideoQt::isValid):
+        * WebCoreSupport/FullScreenVideoQt.h:
+        (WebCore):
+
+2012-03-03  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix static_libs_as_shared build
+        https://bugs.webkit.org/show_bug.cgi?id=80214
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add helper function to be called by WebProcess main
+        to potentially initialize the QStyle theme.
+
+        * WebCoreSupport/InitWebCoreQt.cpp:
+        (WebKit):
+        (WebKit::initializeWebKit2Theme):
+
+2012-03-02  Casper van Donderen  <casper.vandonderen@nokia.com>
+
+        [Qt] Documentation cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=80131
+
+        Reviewed by Simon Hausmann.
+
+        QDoc uses different commands to do bold, lists, and italics.
+        This change updates the documentation accordingly.
+        QTBUG-24578
+
+        * Api/qwebframe.cpp:
+        * Api/qwebhistory.cpp:
+        * Api/qwebinspector.cpp:
+        * Api/qwebpage.cpp:
+        * Api/qwebpluginfactory.cpp:
+        * Api/qwebsettings.cpp:
+        * declarative/qdeclarativewebview.cpp:
+        * docs/qtwebkit-bridge.qdoc:
+        * docs/qtwebkit.qdoc:
+        * docs/qtwebkit.qdocconf:
+
+2012-03-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Build system cleanup
+
+        Rubber-stamped by Antti Koivisto.
+
+        * tests/MIMESniffing/MIMESniffing.pro: Don't link in WTFAssertions.cpp for ASSERT, now
+        that the symbols are properly exported with export macros from the DLL.
+
+2012-03-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move QStyle theming code out of WebCore into WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=80128
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moved the bulk of the QStyle dependant code here, where it's okay to depend on QtWidgets/QStyle.
+        Install the QStyle factory functions in initWebCoreQt.cpp.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::swallowContextMenuEvent):
+        * WebCoreSupport/InitWebCoreQt.cpp:
+        (WebCore::initializeWebCoreQt):
+        * WebCoreSupport/RenderThemeQStyle.cpp: Renamed from Source/WebCore/platform/qt/RenderThemeQStyle.cpp.
+        (WebCore):
+        (WebCore::initStyleOption):
+        (WebCore::RenderThemeQStyle::getStylePainter):
+        (WebCore::StylePainterQStyle::StylePainterQStyle):
+        (WebCore::StylePainterQStyle::init):
+        (WebCore::RenderThemeQStyle::create):
+        (WebCore::RenderThemeQStyle::RenderThemeQStyle):
+        (WebCore::RenderThemeQStyle::~RenderThemeQStyle):
+        (WebCore::RenderThemeQStyle::fallbackStyle):
+        (WebCore::RenderThemeQStyle::qStyle):
+        (WebCore::RenderThemeQStyle::findFrameLineWidth):
+        (WebCore::RenderThemeQStyle::inflateButtonRect):
+        (WebCore::RenderThemeQStyle::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQStyle::adjustButtonStyle):
+        (WebCore::RenderThemeQStyle::setButtonPadding):
+        (WebCore::RenderThemeQStyle::paintButton):
+        (WebCore::RenderThemeQStyle::paintTextField):
+        (WebCore::RenderThemeQStyle::adjustTextAreaStyle):
+        (WebCore::RenderThemeQStyle::paintTextArea):
+        (WebCore::RenderThemeQStyle::setPopupPadding):
+        (WebCore::RenderThemeQStyle::paintMenuList):
+        (WebCore::RenderThemeQStyle::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeQStyle::paintMenuListButton):
+        (WebCore::RenderThemeQStyle::animationDurationForProgressBar):
+        (WebCore::RenderThemeQStyle::paintProgressBar):
+        (WebCore::RenderThemeQStyle::paintSliderTrack):
+        (WebCore::RenderThemeQStyle::adjustSliderTrackStyle):
+        (WebCore::RenderThemeQStyle::paintSliderThumb):
+        (WebCore::RenderThemeQStyle::adjustSliderThumbStyle):
+        (WebCore::RenderThemeQStyle::paintSearchField):
+        (WebCore::RenderThemeQStyle::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeQStyle::paintSearchFieldDecoration):
+        (WebCore::RenderThemeQStyle::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeQStyle::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeQStyle::paintInnerSpinButton):
+        (WebCore::RenderThemeQStyle::initializeCommonQStyleOptions):
+        (WebCore::RenderThemeQStyle::adjustSliderThumbSize):
+        * WebCoreSupport/RenderThemeQStyle.h: Renamed from Source/WebCore/platform/qt/RenderThemeQStyle.h.
+        (WebCore):
+        (RenderThemeQStyle):
+        (StylePainterQStyle):
+        (WebCore::StylePainterQStyle::isValid):
+        (WebCore::StylePainterQStyle::drawPrimitive):
+        (WebCore::StylePainterQStyle::drawControl):
+        (WebCore::StylePainterQStyle::drawComplexControl):
+        * WebCoreSupport/ScrollbarThemeQStyle.cpp: Copied from Source/WebCore/platform/qt/ScrollbarThemeQt.cpp.
+        (WebCore):
+        (WebCore::ScrollbarThemeQStyle::~ScrollbarThemeQStyle):
+        (WebCore::scPart):
+        (WebCore::scrollbarPart):
+        (WebCore::styleOptionSlider):
+        (WebCore::ScrollbarThemeQStyle::paint):
+        (WebCore::ScrollbarThemeQStyle::hitTest):
+        (WebCore::ScrollbarThemeQStyle::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeQStyle::invalidatePart):
+        (WebCore::ScrollbarThemeQStyle::scrollbarThickness):
+        (WebCore::ScrollbarThemeQStyle::thumbPosition):
+        (WebCore::ScrollbarThemeQStyle::thumbLength):
+        (WebCore::ScrollbarThemeQStyle::trackPosition):
+        (WebCore::ScrollbarThemeQStyle::trackLength):
+        (WebCore::ScrollbarThemeQStyle::paintScrollCorner):
+        (WebCore::ScrollbarThemeQStyle::style):
+        * WebCoreSupport/ScrollbarThemeQStyle.h: Renamed from Source/WebCore/platform/qt/ScrollbarThemeQt.h.
+        (WebCore):
+        (ScrollbarThemeQStyle):
+
+2012-02-27  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] Move registration of experimental types to the proper plugin
+        https://bugs.webkit.org/show_bug.cgi?id=79706
+
+        Reviewed by Tor Arne Vestbø.
+
+        * declarative/experimental/plugin.cpp:
+        * declarative/plugin.cpp:
+        (WebKitQmlPlugin::registerTypes):
+
+2012-02-28  Antti Koivisto  <antti@apple.com>
+
+        Try to fix build.
+
+        Not reviewed.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::styleProperty):
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        * WebCoreSupport/ChromeClientQt.h:
+        (ChromeClientQt):
+
+2012-02-24  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] API: Unify the loading properties and signals.
+        https://bugs.webkit.org/show_bug.cgi?id=79486
+
+        Reviewed by Simon Hausmann.
+
+        * declarative/plugin.cpp:
+        (WebKitQmlPlugin::registerTypes):
+
 2012-02-24  Holger Hans Peter Freyther  <holger@moiji-mobile.com>
 
         [Qt] Build fix. macro "QSKIP" now only takes 1 argument on Qt5
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index f129b5871..aee2cf8fc 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -73,7 +73,7 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/qt/UtilsQt.h>
 
-#if ENABLE(VIDEO) && (USE(GSTREAMER) || USE(QT_MULTIMEDIA) || USE(QTKIT))
+#if ENABLE(VIDEO) && ((USE(GSTREAMER) && !defined(GST_API_VERSION_1)) || USE(QT_MULTIMEDIA) || USE(QTKIT))
 #include "FullScreenVideoQt.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
@@ -90,7 +90,7 @@ bool ChromeClientQt::dumpVisitedLinksCallbacks = false;
 ChromeClientQt::ChromeClientQt(QWebPage* webPage)
     : m_webPage(webPage)
     , m_eventLoop(0)
-#if ENABLE(VIDEO) && (USE(GSTREAMER) || USE(QT_MULTIMEDIA) || USE(QTKIT))
+#if ENABLE(VIDEO) && ((USE(GSTREAMER) && !defined(GST_API_VERSION_1)) || USE(QT_MULTIMEDIA) || USE(QTKIT))
     , m_fullScreenVideo(0)
 #endif
 {
@@ -102,7 +102,7 @@ ChromeClientQt::~ChromeClientQt()
     if (m_eventLoop)
         m_eventLoop->exit();
 
-#if ENABLE(VIDEO) && (USE(GSTREAMER) || USE(QT_MULTIMEDIA) || USE(QTKIT))
+#if ENABLE(VIDEO) && ((USE(GSTREAMER) && !defined(GST_API_VERSION_1)) || USE(QT_MULTIMEDIA) || USE(QTKIT))
     delete m_fullScreenVideo;
 #endif
 }
@@ -650,7 +650,7 @@ IntRect ChromeClientQt::visibleRectForTiledBackingStore() const
 }
 #endif
 
-#if ENABLE(VIDEO) && (USE(GSTREAMER) || USE(QT_MULTIMEDIA) || USE(QTKIT))
+#if ENABLE(VIDEO) && ((USE(GSTREAMER) && !defined(GST_API_VERSION_1)) || USE(QT_MULTIMEDIA) || USE(QTKIT))
 FullScreenVideoQt* ChromeClientQt::fullScreenVideo()
 {
     if (!m_fullScreenVideo)
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index 3d45b7b51..386b986d4 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -138,9 +138,6 @@ public:
 #endif
     virtual void reachedMaxAppCacheSize(int64_t spaceNeeded);
     virtual void reachedApplicationCacheOriginQuota(SecurityOrigin*, int64_t totalSpaceNeeded);
-#if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() { }
-#endif
 
 #if USE(ACCELERATED_COMPOSITING)
     // This is a hook for WebCore to tell us what we need to do with the GraphicsLayers.
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index 92c98cd37..457b49e26 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -992,15 +992,6 @@ void DumpRenderTreeSupportQt::simulateDesktopNotificationClick(const QString& ti
 #endif
 }
 
-QString DumpRenderTreeSupportQt::plainText(const QVariant& range)
-{
-    QMap<QString, QVariant> map = range.toMap();
-    QVariant startContainer  = map.value(QLatin1String("startContainer"));
-    map = startContainer.toMap();
-
-    return map.value(QLatin1String("innerText")).toString();
-}
-
 QVariantList DumpRenderTreeSupportQt::nodesFromRect(const QWebElement& document, int x, int y, unsigned top, unsigned right, unsigned bottom, unsigned left, bool ignoreClipping)
 {
     QVariantList res;
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index 4b0314350..d949e5154 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -167,7 +167,6 @@ public:
 
     static QString markerTextForListItem(const QWebElement& listItem);
     static QVariantMap computedStyleIncludingVisitedInfo(const QWebElement& element);
-    static QString plainText(const QVariant& rng);
 
     static void dumpFrameLoader(bool b);
     static void dumpProgressFinishedCallback(bool);
diff --git a/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.cpp b/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.cpp
index 81d2720b5..3b244c657 100644
--- a/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.cpp
@@ -47,7 +47,7 @@
 
 namespace WebCore {
 
-#if USE(GSTREAMER)
+#if USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 GStreamerFullScreenVideoHandler::GStreamerFullScreenVideoHandler()
     : m_videoElement(0)
     , m_fullScreenWidget(0)
@@ -148,7 +148,7 @@ FullScreenVideoQt::FullScreenVideoQt(ChromeClientQt* chromeClient)
         connect(m_FullScreenVideoHandler, SIGNAL(fullScreenClosed()), this, SLOT(aboutToClose()));
 #endif
 
-#if USE(GSTREAMER)
+#if USE(GSTREAMER) && !defined(GST_API_VERSION_1)
     m_FullScreenVideoHandlerGStreamer = new GStreamerFullScreenVideoHandler;
 #endif
 
@@ -162,7 +162,7 @@ FullScreenVideoQt::~FullScreenVideoQt()
 #if USE(QT_MULTIMEDIA)
     delete m_FullScreenVideoHandler;
 #endif
-#if USE(GSTREAMER)
+#if USE(GSTREAMER) && !defined(GST_API_VERSION_1)
     delete m_FullScreenVideoHandlerGStreamer;
 #endif
 #if USE(QTKIT)
@@ -192,7 +192,7 @@ void FullScreenVideoQt::enterFullScreenForNode(Node* node)
     m_FullScreenVideoHandler->enterFullScreen(mediaPlayerQt->mediaPlayer());
 #endif
 
-#if USE(GSTREAMER)
+#if USE(GSTREAMER) && !defined(GST_API_VERSION_1)
     m_FullScreenVideoHandlerGStreamer->setVideoElement(m_videoElement);
     m_FullScreenVideoHandlerGStreamer->enterFullScreen();
 #endif
@@ -223,7 +223,7 @@ void FullScreenVideoQt::exitFullScreenForNode(Node* node)
     MediaPlayerPrivateQt* mediaPlayerQt = mediaPlayer();
     mediaPlayerQt->restoreVideoItem();
 #endif
-#if USE(GSTREAMER)
+#if USE(GSTREAMER) && !defined(GST_API_VERSION_1)
     m_FullScreenVideoHandlerGStreamer->exitFullScreen();
 #endif
 
@@ -262,7 +262,7 @@ bool FullScreenVideoQt::isValid() const
 #if USE(QT_MULTIMEDIA)
     return m_FullScreenVideoHandler;
 #endif
-#if USE(GSTREAMER)
+#if USE(GSTREAMER) && !defined(GST_API_VERSION_1)
     return m_FullScreenVideoHandlerGStreamer;
 #elif USE(QTKIT)
     return m_FullScreenVideoHandlerQTKit;
diff --git a/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.h b/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.h
index 06438ea46..6c7c7e926 100644
--- a/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.h
@@ -43,7 +43,7 @@ class QTKitFullScreenVideoHandler;
 #endif
 
 // We do not use ENABLE or USE because moc does not expand these macros.
-#if defined(WTF_USE_GSTREAMER) && WTF_USE_GSTREAMER
+#if defined(WTF_USE_GSTREAMER) && WTF_USE_GSTREAMER && !defined(GST_API_VERSION_1)
 class FullScreenVideoWindow;
 
 class GStreamerFullScreenVideoHandler : public QObject {
diff --git a/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp b/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp
index 5cbd82c58..b09413345 100644
--- a/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp
@@ -33,7 +33,9 @@
 #include "Image.h"
 #include "NotImplemented.h"
 #include "PlatformStrategiesQt.h"
+#include "RenderThemeQStyle.h"
 #include "ScriptController.h"
+#include "ScrollbarThemeQStyle.h"
 #include "SecurityPolicy.h"
 #if USE(QTKIT)
 #include "WebSystemInterface.h"
@@ -46,6 +48,17 @@
 #include <runtime/InitializeThreading.h>
 #include <wtf/MainThread.h>
 
+namespace WebKit {
+
+// Called also from WebKit2's WebProcess.
+Q_DECL_EXPORT void initializeWebKit2Theme()
+{
+    if (qgetenv("QT_WEBKIT_THEME_NAME") == "qstyle")
+        WebCore::RenderThemeQt::setCustomTheme(WebCore::RenderThemeQStyle::create, new WebCore::ScrollbarThemeQStyle);
+}
+
+}
+
 namespace WebCore {
 
 void initializeWebCoreQt()
@@ -62,6 +75,8 @@ void initializeWebCoreQt()
     PlatformStrategiesQt::initialize();
     QtWebElementRuntime::initialize();
 
+    RenderThemeQt::setCustomTheme(RenderThemeQStyle::create, new ScrollbarThemeQStyle);
+
 #if USE(QTKIT)
     InitWebCoreSystemInterface();
 #endif
diff --git a/Source/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.cpp
index 8200664ad..00052184a 100644
--- a/Source/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.cpp
@@ -337,9 +337,9 @@ void NotificationPresenterClientQt::requestPermission(ScriptExecutionContext* co
     }
 }
 
-NotificationPresenter::Permission NotificationPresenterClientQt::checkPermission(ScriptExecutionContext* context)
+NotificationClient::Permission NotificationPresenterClientQt::checkPermission(ScriptExecutionContext* context)
 {
-    return m_cachedPermissions.value(context, NotificationPresenter::PermissionNotAllowed);
+    return m_cachedPermissions.value(context, NotificationClient::PermissionNotAllowed);
 }
 
 void NotificationPresenterClientQt::cancelRequestsForPermission(ScriptExecutionContext* context)
@@ -367,7 +367,7 @@ void NotificationPresenterClientQt::cancelRequestsForPermission(ScriptExecutionC
 
 void NotificationPresenterClientQt::allowNotificationForFrame(Frame* frame)
 {
-    m_cachedPermissions.insert(frame->document(), NotificationPresenter::PermissionAllowed);
+    m_cachedPermissions.insert(frame->document(), NotificationClient::PermissionAllowed);
 
     QHash<ScriptExecutionContext*,  CallbacksInfo>::iterator iter = m_pendingPermissionRequests.begin();
     while (iter != m_pendingPermissionRequests.end()) {
diff --git a/Source/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.h b/Source/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.h
index 77dcd3bc8..12b06fe9b 100644
--- a/Source/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.h
@@ -33,7 +33,7 @@
 #define NotificationPresenterClientQt_h
 
 #include "Notification.h"
-#include "NotificationPresenter.h"
+#include "NotificationClient.h"
 #include "QtPlatformPlugin.h"
 #include "Timer.h"
 
@@ -81,18 +81,18 @@ public:
 
 typedef QHash <Notification*, NotificationWrapper*> NotificationsQueue;
 
-class NotificationPresenterClientQt : public NotificationPresenter {
+class NotificationPresenterClientQt : public NotificationClient {
 public:
     NotificationPresenterClientQt();
     ~NotificationPresenterClientQt();
 
-    /* WebCore::NotificationPresenter interface */
+    /* WebCore::NotificationClient interface */
     virtual bool show(Notification*);
     virtual void cancel(Notification*);
     virtual void notificationObjectDestroyed(Notification*);
     virtual void notificationControllerDestroyed();
     virtual void requestPermission(ScriptExecutionContext*, PassRefPtr<VoidCallback>);
-    virtual NotificationPresenter::Permission checkPermission(ScriptExecutionContext*);
+    virtual NotificationClient::Permission checkPermission(ScriptExecutionContext*);
     virtual void cancelRequestsForPermission(ScriptExecutionContext*);
 
     void cancel(NotificationWrapper*);
@@ -125,7 +125,7 @@ private:
         QList<RefPtr<VoidCallback> > m_callbacks;
     };
     QHash<ScriptExecutionContext*,  CallbacksInfo > m_pendingPermissionRequests;
-    QHash<ScriptExecutionContext*, NotificationPresenter::Permission> m_cachedPermissions;
+    QHash<ScriptExecutionContext*, NotificationClient::Permission> m_cachedPermissions;
 
     NotificationsQueue m_notifications;
     QtPlatformPlugin m_platformPlugin;
diff --git a/Source/WebCore/platform/qt/RenderThemeQStyle.cpp b/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.cpp
index 75859d8b4..ac42fdd8b 100644
--- a/Source/WebCore/platform/qt/RenderThemeQStyle.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.cpp
@@ -1,7 +1,7 @@
 /*
  * This file is part of the WebKit project.
  *
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008-2012 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
  *               2006 Dirk Mueller <mueller@kde.org>
@@ -47,13 +47,12 @@
 #include "Page.h"
 #include "PaintInfo.h"
 #include "QWebPageClient.h"
-#include "QtStyleOptionWebComboBox.h"
 #include "RenderBox.h"
 #if ENABLE(PROGRESS_TAG)
 #include "RenderProgress.h"
 #endif
 #include "RenderSlider.h"
-#include "ScrollbarThemeQt.h"
+#include "ScrollbarThemeQStyle.h"
 #include "SliderThumbElement.h"
 #include "UserAgentStyleSheets.h"
 
@@ -81,15 +80,13 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-inline static void initStyleOption(QWidget *widget, QStyleOption& option)
+inline static void initStyleOption(QWidget* widget, QStyleOption& option)
 {
     if (widget)
         option.initFrom(widget);
     else {
-        /*
-          If a widget is not directly available for rendering, we fallback to default
-          value for an active widget.
-         */
+        // If a widget is not directly available for rendering, we fallback to default
+        // value for an active widget.
         option.state = QStyle::State_Active | QStyle::State_Enabled;
     }
 }
@@ -106,7 +103,7 @@ StylePainterQStyle::StylePainterQStyle(RenderThemeQStyle* theme, const PaintInfo
     init(paintInfo.context ? paintInfo.context : 0, theme->qStyle());
 }
 
-StylePainterQStyle::StylePainterQStyle(ScrollbarThemeQt* theme, GraphicsContext* context)
+StylePainterQStyle::StylePainterQStyle(ScrollbarThemeQStyle* theme, GraphicsContext* context)
     : StylePainter()
 {
     init(context, theme->style());
@@ -442,7 +439,7 @@ bool RenderThemeQStyle::paintMenuList(RenderObject* o, const PaintInfo& i, const
     if (!p.isValid())
         return true;
 
-    QtStyleOptionWebComboBox opt(o);
+    QStyleOptionComboBox opt;
     initStyleOption(p.widget, opt);
     initializeCommonQStyleOptions(opt, o);
 
@@ -482,7 +479,7 @@ bool RenderThemeQStyle::paintMenuListButton(RenderObject* o, const PaintInfo& i,
     if (!p.isValid())
         return true;
 
-    QtStyleOptionWebComboBox option(o);
+    QStyleOptionComboBox option;
     initStyleOption(p.widget, option);
     initializeCommonQStyleOptions(option, o);
     option.rect = r;
diff --git a/Source/WebCore/platform/qt/RenderThemeQStyle.h b/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.h
index 28b76f272..a83e02f5a 100644
--- a/Source/WebCore/platform/qt/RenderThemeQStyle.h
+++ b/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.h
@@ -1,7 +1,7 @@
 /*
  * This file is part of the theme implementation for form controls in WebCore.
  *
- * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
+ * Copyright (C) 2011-2012 Nokia Corporation and/or its subsidiary(-ies).
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -36,7 +36,7 @@ QT_END_NAMESPACE
 
 namespace WebCore {
 
-class ScrollbarThemeQt;
+class ScrollbarThemeQStyle;
 
 class RenderThemeQStyle : public RenderThemeQt {
 private:
@@ -119,7 +119,7 @@ private:
 class StylePainterQStyle : public StylePainter {
 public:
     explicit StylePainterQStyle(RenderThemeQStyle*, const PaintInfo&);
-    explicit StylePainterQStyle(ScrollbarThemeQt*, GraphicsContext*);
+    explicit StylePainterQStyle(ScrollbarThemeQStyle*, GraphicsContext*);
 
     bool isValid() const { return style && StylePainter::isValid(); }
 
diff --git a/Source/WebKit/qt/WebCoreSupport/ScrollbarThemeQStyle.cpp b/Source/WebKit/qt/WebCoreSupport/ScrollbarThemeQStyle.cpp
new file mode 100644
index 000000000..b0827fea4
--- /dev/null
+++ b/Source/WebKit/qt/WebCoreSupport/ScrollbarThemeQStyle.cpp
@@ -0,0 +1,253 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2007 Staikos Computing Services Inc. <info@staikos.net>
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScrollbarThemeQStyle.h"
+
+#include "GraphicsContext.h"
+#include "PlatformMouseEvent.h"
+#include "RenderThemeQStyle.h"
+#include "RenderThemeQtMobile.h"
+#include "ScrollView.h"
+#include "Scrollbar.h"
+
+#include <QApplication>
+#ifdef Q_WS_MAC
+#include <QMacStyle>
+#endif
+#include <QMenu>
+#include <QPainter>
+#include <QStyle>
+#include <QStyleOptionSlider>
+
+namespace WebCore {
+
+ScrollbarThemeQStyle::~ScrollbarThemeQStyle()
+{
+}
+
+static QStyle::SubControl scPart(const ScrollbarPart& part)
+{
+    switch (part) {
+    case NoPart:
+        return QStyle::SC_None;
+    case BackButtonStartPart:
+    case BackButtonEndPart:
+        return QStyle::SC_ScrollBarSubLine;
+    case BackTrackPart:
+        return QStyle::SC_ScrollBarSubPage;
+    case ThumbPart:
+        return QStyle::SC_ScrollBarSlider;
+    case ForwardTrackPart:
+        return QStyle::SC_ScrollBarAddPage;
+    case ForwardButtonStartPart:
+    case ForwardButtonEndPart:
+        return QStyle::SC_ScrollBarAddLine;
+    }
+
+    return QStyle::SC_None;
+}
+
+static ScrollbarPart scrollbarPart(const QStyle::SubControl& sc)
+{
+    switch (sc) {
+    case QStyle::SC_None:
+        return NoPart;
+    case QStyle::SC_ScrollBarSubLine:
+        return BackButtonStartPart;
+    case QStyle::SC_ScrollBarSubPage:
+        return BackTrackPart;
+    case QStyle::SC_ScrollBarSlider:
+        return ThumbPart;
+    case QStyle::SC_ScrollBarAddPage:
+        return ForwardTrackPart;
+    case QStyle::SC_ScrollBarAddLine:
+        return ForwardButtonStartPart;
+    }
+    return NoPart;
+}
+
+static QStyleOptionSlider* styleOptionSlider(ScrollbarThemeClient* scrollbar, QWidget* widget = 0)
+{
+    static QStyleOptionSlider opt;
+    if (widget)
+        opt.initFrom(widget);
+    else
+        opt.state |= QStyle::State_Active;
+
+    opt.state &= ~QStyle::State_HasFocus;
+
+    opt.rect = scrollbar->frameRect();
+    if (scrollbar->enabled())
+        opt.state |= QStyle::State_Enabled;
+    if (scrollbar->controlSize() != RegularScrollbar)
+        opt.state |= QStyle::State_Mini;
+    opt.orientation = (scrollbar->orientation() == VerticalScrollbar) ? Qt::Vertical : Qt::Horizontal;
+
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        opt.state |= QStyle::State_Horizontal;
+    else
+        opt.state &= ~QStyle::State_Horizontal;
+
+    opt.sliderValue = scrollbar->value();
+    opt.sliderPosition = opt.sliderValue;
+    opt.pageStep = scrollbar->pageStep();
+    opt.singleStep = scrollbar->lineStep();
+    opt.minimum = 0;
+    opt.maximum = qMax(0, scrollbar->maximum());
+    ScrollbarPart pressedPart = scrollbar->pressedPart();
+    ScrollbarPart hoveredPart = scrollbar->hoveredPart();
+    if (pressedPart != NoPart) {
+        opt.activeSubControls = scPart(scrollbar->pressedPart());
+        if (pressedPart == BackButtonStartPart || pressedPart == ForwardButtonStartPart
+            || pressedPart == BackButtonEndPart || pressedPart == ForwardButtonEndPart
+            || pressedPart == ThumbPart)
+            opt.state |= QStyle::State_Sunken;
+    } else
+        opt.activeSubControls = scPart(hoveredPart);
+    if (hoveredPart != NoPart)
+        opt.state |= QStyle::State_MouseOver;
+    return &opt;
+}
+
+bool ScrollbarThemeQStyle::paint(ScrollbarThemeClient* scrollbar, GraphicsContext* graphicsContext, const IntRect& dirtyRect)
+{
+    if (graphicsContext->updatingControlTints()) {
+       scrollbar->invalidateRect(dirtyRect);
+       return false;
+    }
+
+    StylePainterQStyle p(this, graphicsContext);
+    if (!p.isValid())
+      return true;
+
+    p.painter->save();
+    QStyleOptionSlider* opt = styleOptionSlider(scrollbar, p.widget);
+
+    p.painter->setClipRect(opt->rect.intersected(dirtyRect), Qt::IntersectClip);
+
+#ifdef Q_WS_MAC
+    // FIXME: We also need to check the widget style but today ScrollbarTheme is not aware of the page so we
+    // can't get the widget.
+    if (qobject_cast<QMacStyle*>(style()))
+        p.drawComplexControl(QStyle::CC_ScrollBar, *opt);
+    else
+#endif
+    {
+        // The QStyle expects the background to be already filled.
+        p.painter->fillRect(opt->rect, opt->palette.background());
+
+        const QPoint topLeft = opt->rect.topLeft();
+        p.painter->translate(topLeft);
+        opt->rect.moveTo(QPoint(0, 0));
+        p.drawComplexControl(QStyle::CC_ScrollBar, *opt);
+        opt->rect.moveTo(topLeft);
+    }
+    p.painter->restore();
+
+    return true;
+}
+
+ScrollbarPart ScrollbarThemeQStyle::hitTest(ScrollbarThemeClient* scrollbar, const PlatformMouseEvent& evt)
+{
+    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
+    const QPoint pos = scrollbar->convertFromContainingWindow(evt.position());
+    opt->rect.moveTo(QPoint(0, 0));
+    QStyle::SubControl sc = style()->hitTestComplexControl(QStyle::CC_ScrollBar, opt, pos, 0);
+    return scrollbarPart(sc);
+}
+
+bool ScrollbarThemeQStyle::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
+{
+    // Middle click centers slider thumb (if supported).
+    return style()->styleHint(QStyle::SH_ScrollBar_MiddleClickAbsolutePosition) && evt.button() == MiddleButton;
+}
+
+void ScrollbarThemeQStyle::invalidatePart(ScrollbarThemeClient* scrollbar, ScrollbarPart)
+{
+    // FIXME: Do more precise invalidation.
+    scrollbar->invalidate();
+}
+
+int ScrollbarThemeQStyle::scrollbarThickness(ScrollbarControlSize controlSize)
+{
+    QStyleOptionSlider o;
+    o.orientation = Qt::Vertical;
+    o.state &= ~QStyle::State_Horizontal;
+    if (controlSize != RegularScrollbar)
+        o.state |= QStyle::State_Mini;
+    return style()->pixelMetric(QStyle::PM_ScrollBarExtent, &o, 0);
+}
+
+int ScrollbarThemeQStyle::thumbPosition(ScrollbarThemeClient* scrollbar)
+{
+    if (scrollbar->enabled()) {
+        float pos = (float)scrollbar->currentPos() * (trackLength(scrollbar) - thumbLength(scrollbar)) / scrollbar->maximum();
+        return (pos < 1 && pos > 0) ? 1 : pos;
+    }
+    return 0;
+}
+
+int ScrollbarThemeQStyle::thumbLength(ScrollbarThemeClient* scrollbar)
+{
+    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
+    IntRect thumb = style()->subControlRect(QStyle::CC_ScrollBar, opt, QStyle::SC_ScrollBarSlider, 0);
+    return scrollbar->orientation() == HorizontalScrollbar ? thumb.width() : thumb.height();
+}
+
+int ScrollbarThemeQStyle::trackPosition(ScrollbarThemeClient* scrollbar)
+{
+    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
+    IntRect track = style()->subControlRect(QStyle::CC_ScrollBar, opt, QStyle::SC_ScrollBarGroove, 0);
+    return scrollbar->orientation() == HorizontalScrollbar ? track.x() - scrollbar->x() : track.y() - scrollbar->y();
+}
+
+int ScrollbarThemeQStyle::trackLength(ScrollbarThemeClient* scrollbar)
+{
+    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
+    IntRect track = style()->subControlRect(QStyle::CC_ScrollBar, opt, QStyle::SC_ScrollBarGroove, 0);
+    return scrollbar->orientation() == HorizontalScrollbar ? track.width() : track.height();
+}
+
+void ScrollbarThemeQStyle::paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& rect)
+{
+    StylePainterQStyle p(this, context);
+    if (!p.isValid())
+        return;
+
+    QStyleOption option;
+    option.rect = rect;
+    p.drawPrimitive(QStyle::PE_PanelScrollAreaCorner, option);
+}
+
+QStyle* ScrollbarThemeQStyle::style() const
+{
+    return QApplication::style();
+}
+
+}
+
diff --git a/Source/WebCore/platform/qt/ScrollbarThemeQt.h b/Source/WebKit/qt/WebCoreSupport/ScrollbarThemeQStyle.h
index cf4882da2..2537b9ae4 100644
--- a/Source/WebCore/platform/qt/ScrollbarThemeQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/ScrollbarThemeQStyle.h
@@ -20,11 +20,11 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScrollbarThemeQt_h
-#define ScrollbarThemeQt_h
+#ifndef ScrollbarThemeQStyle_h
+#define ScrollbarThemeQStyle_h
 
 #include "ScrollbarTheme.h"
 
@@ -36,23 +36,23 @@ QT_END_NAMESPACE
 
 namespace WebCore {
 
-class ScrollbarThemeQt : public ScrollbarTheme {
+class ScrollbarThemeQStyle : public ScrollbarTheme {
 public:
-    virtual ~ScrollbarThemeQt();
+    virtual ~ScrollbarThemeQStyle();
 
-    virtual bool paint(Scrollbar*, GraphicsContext*, const IntRect& damageRect);
+    virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& dirtyRect);
     virtual void paintScrollCorner(ScrollView*, GraphicsContext*, const IntRect& cornerRect);
 
-    virtual ScrollbarPart hitTest(Scrollbar*, const PlatformMouseEvent&);
+    virtual ScrollbarPart hitTest(ScrollbarThemeClient*, const PlatformMouseEvent&);
 
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
 
-    virtual void invalidatePart(Scrollbar*, ScrollbarPart);
+    virtual void invalidatePart(ScrollbarThemeClient*, ScrollbarPart);
 
-    virtual int thumbPosition(Scrollbar*);
-    virtual int thumbLength(Scrollbar*);
-    virtual int trackPosition(Scrollbar*);
-    virtual int trackLength(Scrollbar*);
+    virtual int thumbPosition(ScrollbarThemeClient*);
+    virtual int thumbLength(ScrollbarThemeClient*);
+    virtual int trackPosition(ScrollbarThemeClient*);
+    virtual int trackLength(ScrollbarThemeClient*);
 
     virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
 
diff --git a/Source/WebKit/qt/declarative/experimental/experimental.pri b/Source/WebKit/qt/declarative/experimental/experimental.pri
index bbecabb5c..583726f62 100644
--- a/Source/WebKit/qt/declarative/experimental/experimental.pri
+++ b/Source/WebKit/qt/declarative/experimental/experimental.pri
@@ -24,9 +24,7 @@ contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
 
 wince*:LIBS += $$QMAKE_LIBS_GUI
 
-CONFIG += qtwebkit qtwebkit-private
-
-QT += declarative widgets network quick
+QT += declarative widgets network quick webkit webkit-private
 
 DESTDIR = $${ROOT_BUILD_DIR}/imports/$${TARGET.module_name}
 
@@ -37,8 +35,8 @@ SOURCES += plugin.cpp
 
 DEFINES += HAVE_WEBKIT2
 
+# FIXME: Why are these needed, and why can't we use WEBKIT += ... ?
 INCLUDEPATH += \
-    ../../../../WebKit2/UIProcess/API/qt \
     ../../../../WebKit2/Shared/qt \
     ../../../../JavaScriptCore \
     ../../../../JavaScriptCore/wtf \
diff --git a/Source/WebKit/qt/declarative/experimental/plugin.cpp b/Source/WebKit/qt/declarative/experimental/plugin.cpp
index da228521f..7d380e66a 100644
--- a/Source/WebKit/qt/declarative/experimental/plugin.cpp
+++ b/Source/WebKit/qt/declarative/experimental/plugin.cpp
@@ -19,14 +19,16 @@
 
 #include "config.h"
 
-#include "qquicknetworkreply_p.h"
-#include "qquicknetworkrequest_p.h"
-#include "qquickwebpage_p.h"
-#include "qquickwebview_p.h"
-#include "qwebdownloaditem_p.h"
-#include "qwebviewportinfo_p.h"
-
-#include "qwebnavigationhistory_p.h"
+#include "private/qquicknetworkreply_p.h"
+#include "private/qquicknetworkrequest_p.h"
+#include "private/qquickwebpage_p.h"
+#include "private/qquickwebview_p.h"
+#include "private/qtwebsecurityorigin_p.h"
+#include "private/qwebdownloaditem_p.h"
+#include "private/qwebnavigationhistory_p.h"
+#include "private/qwebpermissionrequest_p.h"
+#include "private/qwebpreferences_p.h"
+#include "private/qwebviewportinfo_p.h"
 
 #include <QtDeclarative/qdeclarative.h>
 #include <QtDeclarative/qdeclarativeextensionplugin.h>
@@ -54,6 +56,10 @@ public:
         qmlRegisterUncreatableType<QWebDownloadItem>(uri, 1, 0, "DownloadItem", QObject::tr("Cannot create separate instance of DownloadItem"));
         qmlRegisterUncreatableType<QWebNavigationListModel>(uri, 1, 0, "NavigationListModel", QObject::tr("Cannot create separate instance of NavigationListModel"));
         qmlRegisterUncreatableType<QWebNavigationHistory>(uri, 1, 0, "NavigationHistory", QObject::tr("Cannot create separate instance of NavigationHistory"));
+        qmlRegisterUncreatableType<QWebPreferences>(uri, 1, 0, "WebPreferences", QObject::tr("Cannot create separate instance of WebPreferences"));
+        qmlRegisterUncreatableType<QWebPermissionRequest>(uri, 1, 0, "PermissionRequest", QObject::tr("Cannot create separate instance of PermissionRequest"));
+        qmlRegisterUncreatableType<QtWebSecurityOrigin>(uri, 1, 0, "SecurityOrigin", QObject::tr("Cannot create separate instance of SecurityOrigin"));
+
         qmlRegisterExtendedType<QQuickWebView, QQuickWebViewExperimentalExtension>(uri, 1, 0, "WebView");
         qmlRegisterUncreatableType<QQuickWebViewExperimental>(uri, 1, 0, "WebViewExperimental",
             QObject::tr("Cannot create separate instance of WebViewExperimental"));
diff --git a/Source/WebKit/qt/declarative/plugin.cpp b/Source/WebKit/qt/declarative/plugin.cpp
index e2f0fb3ec..968b1fe18 100644
--- a/Source/WebKit/qt/declarative/plugin.cpp
+++ b/Source/WebKit/qt/declarative/plugin.cpp
@@ -17,19 +17,19 @@
     Boston, MA 02110-1301, USA.
 */
 
+#if defined(HAVE_QQUICK1)
 #include "qdeclarativewebview_p.h"
+#endif
 
 #include <QtDeclarative/qdeclarative.h>
 #include <QtDeclarative/qdeclarativeextensionplugin.h>
 
 #if defined(HAVE_WEBKIT2)
-#include "qquickwebpage_p.h"
-#include "qquickwebview_p.h"
-#include "qtwebsecurityorigin_p.h"
-#include "qwebiconimageprovider_p.h"
-#include "qwebnavigationrequest_p.h"
-#include "qwebpermissionrequest_p.h"
-#include "qwebpreferences_p.h"
+#include "private/qquickwebpage_p.h"
+#include "private/qquickwebview_p.h"
+#include "private/qwebiconimageprovider_p.h"
+#include "private/qwebloadrequest_p.h"
+#include "private/qwebnavigationrequest_p.h"
 
 #include <QtDeclarative/qdeclarativeengine.h>
 #include <QtNetwork/qnetworkreply.h>
@@ -51,6 +51,7 @@ public:
     virtual void registerTypes(const char* uri)
     {
         Q_ASSERT(QLatin1String(uri) == QLatin1String("QtWebKit"));
+#if defined(HAVE_QQUICK1)
         qmlRegisterType<QDeclarativeWebSettings>();
         qmlRegisterType<QDeclarativeWebView>(uri, 1, 0, "WebView");
 #ifdef Q_REVISION
@@ -58,16 +59,14 @@ public:
         qmlRegisterRevision<QDeclarativeWebView, 0>("QtWebKit", 1, 0);
         qmlRegisterRevision<QDeclarativeWebView, 1>("QtWebKit", 1, 1);
 #endif
+#endif
 
 #if defined(HAVE_WEBKIT2)
         qmlRegisterType<QQuickWebView>(uri, 3, 0, "WebView");
-        qmlRegisterUncreatableType<QWebPreferences>(uri, 3, 0, "WebPreferences", QObject::tr("Cannot create separate instance of WebPreferences"));
         qmlRegisterUncreatableType<QQuickWebPage>(uri, 3, 0, "WebPage", QObject::tr("Cannot create separate instance of WebPage, use WebView"));
         qmlRegisterUncreatableType<QNetworkReply>(uri, 3, 0, "NetworkReply", QObject::tr("Cannot create separate instance of NetworkReply"));
-        qmlRegisterUncreatableType<QWebPermissionRequest>(uri, 3, 0, "PermissionRequest", QObject::tr("Cannot create separate instance of PermissionRequest"));
         qmlRegisterUncreatableType<QWebNavigationRequest>(uri, 3, 0, "NavigationRequest", QObject::tr("Cannot create separate instance of NavigationRequest"));
-        qmlRegisterUncreatableType<QtWebSecurityOrigin>(uri, 3, 0, "SecurityOrigin", QObject::tr("Cannot create separate instance of SecurityOrigin"));
-
+        qmlRegisterUncreatableType<QWebLoadRequest>(uri, 3, 0, "WebLoadRequest", QObject::tr("Cannot create separate instance of WebLoadRequest"));
 #endif
     }
 };
@@ -77,4 +76,3 @@ QT_END_NAMESPACE
 #include "plugin.moc"
 
 Q_EXPORT_PLUGIN2(qmlwebkitplugin, QT_PREPEND_NAMESPACE(WebKitQmlPlugin));
-
diff --git a/Source/WebKit/qt/declarative/public.pri b/Source/WebKit/qt/declarative/public.pri
index a6665eda6..e389e38eb 100644
--- a/Source/WebKit/qt/declarative/public.pri
+++ b/Source/WebKit/qt/declarative/public.pri
@@ -11,6 +11,8 @@ TARGET.module_name = QtWebKit
 
 CONFIG += qt plugin
 
+load(features)
+
 QMLDIRFILE = $${_PRO_FILE_PWD_}/qmldir
 copy2build.input = QMLDIRFILE
 copy2build.output = $${ROOT_BUILD_DIR}/imports/$${TARGET.module_name}/qmldir
@@ -24,24 +26,27 @@ contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
 
 wince*:LIBS += $$QMAKE_LIBS_GUI
 
-CONFIG += qtwebkit qtwebkit-private
+QT += declarative webkit webkit-private
+haveQt(5): QT += widgets quick
 
-QT += declarative
-haveQt(5): QT += widgets quick quick1
+contains(DEFINES, HAVE_QQUICK1=1) {
+    SOURCES += qdeclarativewebview.cpp
+    HEADERS += qdeclarativewebview_p.h
+}
 
 DESTDIR = $${ROOT_BUILD_DIR}/imports/$${TARGET.module_name}
 
 CONFIG += rpath
 RPATHDIR_RELATIVE_TO_DESTDIR = ../../lib
 
+# FIXME: Why are these needed, and why can't we use WEBKIT += ... ?
 INCLUDEPATH += \
     ../../../WebKit2/Shared/qt \
     ../../../JavaScriptCore \
     ../../../JavaScriptCore/runtime \
     ../../../JavaScriptCore/wtf
 
-SOURCES += qdeclarativewebview.cpp plugin.cpp
-HEADERS += qdeclarativewebview_p.h
+SOURCES += plugin.cpp
 
 !no_webkit2: {
     DEFINES += HAVE_WEBKIT2
diff --git a/Source/WebKit/qt/declarative/qdeclarativewebview.cpp b/Source/WebKit/qt/declarative/qdeclarativewebview.cpp
index abf9bb218..d184c087e 100644
--- a/Source/WebKit/qt/declarative/qdeclarativewebview.cpp
+++ b/Source/WebKit/qt/declarative/qdeclarativewebview.cpp
@@ -162,7 +162,7 @@ bool GraphicsWebView::sceneEvent(QEvent *event)
 
     This type is made available by importing the \c QtWebKit module:
 
-    \bold{import QtWebKit 1.0}
+    \b{import QtWebKit 1.0}
 
     The WebView item includes no scrolling, scaling, toolbars, or other common browser
     components. These must be implemented around WebView. See the \l{QML Web Browser}
@@ -577,11 +577,11 @@ void QDeclarativeWebView::setRenderingEnabled(bool enabled)
 
     Finds a zoom that:
     \list
-    \i shows a whole item
-    \i includes (\a clickX, \a clickY)
-    \i fits into the preferredWidth and preferredHeight
-    \i zooms by no more than \a maxZoom
-    \i is more than 10% above the current zoom
+    \li shows a whole item
+    \li includes (\a clickX, \a clickY)
+    \li fits into the preferredWidth and preferredHeight
+    \li zooms by no more than \a maxZoom
+    \li is more than 10% above the current zoom
     \endlist
 
     If such a zoom exists, emits zoomTo(zoom,centerX,centerY) and returns true; otherwise,
diff --git a/Source/WebKit/qt/docs/qtwebkit-bridge.qdoc b/Source/WebKit/qt/docs/qtwebkit-bridge.qdoc
index 877eb4d33..807cdaec0 100644
--- a/Source/WebKit/qt/docs/qtwebkit-bridge.qdoc
+++ b/Source/WebKit/qt/docs/qtwebkit-bridge.qdoc
@@ -79,20 +79,20 @@
     with the QtWebKit bridge:
 
     \list
-    \i \bold{Hybrid C++/script}: C++ application code connects a
+    \li \b{Hybrid C++/script}: C++ application code connects a
     signal to a script function. This approach is useful if you have
     a QObject but don't want to expose the object itself to the scripting
     environment. You just want to define how the script responds to a
     signal and leave it up to the C++ side of your application to establish
     the connection between the C++ signal and the JavaScript slot.
 
-    \i \bold{Hybrid script/C++}: A script can connect signals and slots
+    \li \b{Hybrid script/C++}: A script can connect signals and slots
     to establish connections between pre-defined objects that the
     application exposes to the scripting environment. In this scenario,
     the slots themselves are still written in C++, but the definition of
     the connections is fully dynamic (script-defined).
 
-    \i \bold{Purely script-defined}: A script can both define signal
+    \li \b{Purely script-defined}: A script can both define signal
     handler functions (effectively "slots written in JavaScript"),
     \e{and} set up the connections that utilize those handlers. For
     example, a script can define a function that will handle the
diff --git a/Source/WebKit/qt/docs/qtwebkit.qdoc b/Source/WebKit/qt/docs/qtwebkit.qdoc
index 710d19478..f8cd8e702 100644
--- a/Source/WebKit/qt/docs/qtwebkit.qdoc
+++ b/Source/WebKit/qt/docs/qtwebkit.qdoc
@@ -106,54 +106,54 @@
     The following locations are searched for plugins:
 
     \table
-    \header \o Linux/Unix (X11)
-    \row \o
+    \header \li Linux/Unix (X11)
+    \row \li
     \list
-    \o \c{.mozilla/plugins} in the user's home directory
-    \o \c{.netscape/plugins} in the user's home directory
-    \o System locations, such as
+    \li \c{.mozilla/plugins} in the user's home directory
+    \li \c{.netscape/plugins} in the user's home directory
+    \li System locations, such as
     \list
-    \o \c{/usr/lib/browser/plugins}
-    \o \c{/usr/local/lib/mozilla/plugins}
-    \o \c{/usr/lib/firefox/plugins}
-    \o \c{/usr/lib64/browser-plugins}
-    \o \c{/usr/lib/browser-plugins}
-    \o \c{/usr/lib/mozilla/plugins}
-    \o \c{/usr/local/netscape/plugins}
-    \o \c{/opt/mozilla/plugins}
-    \o \c{/opt/mozilla/lib/plugins}
-    \o \c{/opt/netscape/plugins}
-    \o \c{/opt/netscape/communicator/plugins}
-    \o \c{/usr/lib/netscape/plugins}
-    \o \c{/usr/lib/netscape/plugins-libc5}
-    \o \c{/usr/lib/netscape/plugins-libc6}
-    \o \c{/usr/lib64/netscape/plugins}
-    \o \c{/usr/lib64/mozilla/plugins}
+    \li \c{/usr/lib/browser/plugins}
+    \li \c{/usr/local/lib/mozilla/plugins}
+    \li \c{/usr/lib/firefox/plugins}
+    \li \c{/usr/lib64/browser-plugins}
+    \li \c{/usr/lib/browser-plugins}
+    \li \c{/usr/lib/mozilla/plugins}
+    \li \c{/usr/local/netscape/plugins}
+    \li \c{/opt/mozilla/plugins}
+    \li \c{/opt/mozilla/lib/plugins}
+    \li \c{/opt/netscape/plugins}
+    \li \c{/opt/netscape/communicator/plugins}
+    \li \c{/usr/lib/netscape/plugins}
+    \li \c{/usr/lib/netscape/plugins-libc5}
+    \li \c{/usr/lib/netscape/plugins-libc6}
+    \li \c{/usr/lib64/netscape/plugins}
+    \li \c{/usr/lib64/mozilla/plugins}
     \endlist
-    \o Locations specified by environment variables:
+    \li Locations specified by environment variables:
     \list
-    \o \c{$MOZILLA_HOME/plugins}
-    \o \c{$MOZ_PLUGIN_PATH}
-    \o \c{$QTWEBKIT_PLUGIN_PATH}
+    \li \c{$MOZILLA_HOME/plugins}
+    \li \c{$MOZ_PLUGIN_PATH}
+    \li \c{$QTWEBKIT_PLUGIN_PATH}
     \endlist
     \endlist
     \endtable
 
     \table
-    \header  \o Windows
-    \row \o
+    \header  \li Windows
+    \row \li
     \list
-    \o The user's \c{Application Data\Mozilla\plugins} directory
-    \o Standard system locations of plugins for Quicktime, Flash, etc.
+    \li The user's \c{Application Data\Mozilla\plugins} directory
+    \li Standard system locations of plugins for Quicktime, Flash, etc.
     \endlist
     \endtable
 
     \table
-    \header \o Mac OS X
-    \row \o
+    \header \li Mac OS X
+    \row \li
     \list
-    \o \c{Library/Internet Plug-Ins} in the user's home directory
-    \o The system \c{/Library/Internet Plug-Ins} directory
+    \li \c{Library/Internet Plug-Ins} in the user's home directory
+    \li The system \c{/Library/Internet Plug-Ins} directory
     \endlist
     \endtable
     
diff --git a/Source/WebKit/qt/docs/qtwebkit.qdocconf b/Source/WebKit/qt/docs/qtwebkit.qdocconf
index 4f11d18bb..278d77ba8 100644
--- a/Source/WebKit/qt/docs/qtwebkit.qdocconf
+++ b/Source/WebKit/qt/docs/qtwebkit.qdocconf
@@ -17,17 +17,17 @@ indexes = $QTDIR/doc/html/qt.index
 
 macro.aring.HTML        = "&aring;"
 macro.Auml.HTML         = "&Auml;"
-macro.author            = "\\bold{Author:}"
+macro.author            = "\\b{Author:}"
 macro.br.HTML           = "<br />"
 macro.BR.HTML           = "<br />"
 macro.aacute.HTML       = "&aacute;"
 macro.eacute.HTML       = "&eacute;"
 macro.iacute.HTML       = "&iacute;"
-macro.gui               = "\\bold"
+macro.gui               = "\\b"
 macro.hr.HTML           = "<hr />"
-macro.key               = "\\bold"
-macro.menu              = "\\bold"
-macro.note              = "\\bold{Note:}"
+macro.key               = "\\b"
+macro.menu              = "\\b"
+macro.note              = "\\b{Note:}"
 macro.oslash.HTML       = "&oslash;"
 macro.ouml.HTML         = "&ouml;"
 macro.QA                = "\\e{Qt Assistant}"
@@ -50,24 +50,24 @@ macro.0                         = "\\\\0"
 macro.b                         = "\\\\b"
 macro.n                         = "\\\\n"
 macro.r                         = "\\\\r"
-macro.i                         = "\\o"
-macro.i11                       = "\\o{1,1}"
-macro.i12                       = "\\o{1,2}"
-macro.i13                       = "\\o{1,3}"
-macro.i14                       = "\\o{1,4}"
-macro.i15                       = "\\o{1,5}"
-macro.i16                       = "\\o{1,6}"
-macro.i17                       = "\\o{1,7}"
-macro.i18                       = "\\o{1,8}"
-macro.i19                       = "\\o{1,9}"
-macro.i21                       = "\\o{2,1}"
-macro.i31                       = "\\o{3,1}"
-macro.i41                       = "\\o{4,1}"
-macro.i51                       = "\\o{5,1}"
-macro.i61                       = "\\o{6,1}"
-macro.i71                       = "\\o{7,1}"
-macro.i81                       = "\\o{8,1}"
-macro.i91                       = "\\o{9,1}"
+macro.i                         = "\\li"
+macro.i11                       = "\\li{1,1}"
+macro.i12                       = "\\li{1,2}"
+macro.i13                       = "\\li{1,3}"
+macro.i14                       = "\\li{1,4}"
+macro.i15                       = "\\li{1,5}"
+macro.i16                       = "\\li{1,6}"
+macro.i17                       = "\\li{1,7}"
+macro.i18                       = "\\li{1,8}"
+macro.i19                       = "\\li{1,9}"
+macro.i21                       = "\\li{2,1}"
+macro.i31                       = "\\li{3,1}"
+macro.i41                       = "\\li{4,1}"
+macro.i51                       = "\\li{5,1}"
+macro.i61                       = "\\li{6,1}"
+macro.i71                       = "\\li{7,1}"
+macro.i81                       = "\\li{8,1}"
+macro.i91                       = "\\li{9,1}"
 macro.img                       = "\\image"
 macro.endquote                  = "\\endquotation"
 
diff --git a/Source/WebKit/qt/examples/platformplugin/platformplugin.pro b/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
index 896da8a3e..db3789958 100644
--- a/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
+++ b/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
@@ -31,4 +31,5 @@ HEADERS += \
     qwebkitplatformplugin.h \
     WebNotificationPresenter.h
 
+!contains(DEFINES, ENABLE_LEGACY_NOTIFICATIONS=.): DEFINES += ENABLE_LEGACY_NOTIFICATIONS=1
 !contains(DEFINES, ENABLE_NOTIFICATIONS=.): DEFINES += ENABLE_NOTIFICATIONS=1
diff --git a/Source/WebKit/qt/tests/MIMESniffing/MIMESniffing.pro b/Source/WebKit/qt/tests/MIMESniffing/MIMESniffing.pro
index e960c0f6a..fe50f1b34 100644
--- a/Source/WebKit/qt/tests/MIMESniffing/MIMESniffing.pro
+++ b/Source/WebKit/qt/tests/MIMESniffing/MIMESniffing.pro
@@ -12,8 +12,4 @@ INCLUDEPATH += \
     ../../../../JavaScriptCore \
     ../../../../JavaScriptCore/runtime
 
-debug {
-    SOURCES += ../../../../JavaScriptCore/wtf/Assertions.cpp
-}
-
 RESOURCES += resources.qrc
diff --git a/Source/WebKit/qt/tests/tests.pri b/Source/WebKit/qt/tests/tests.pri
index c4a5818f9..90c61f093 100644
--- a/Source/WebKit/qt/tests/tests.pri
+++ b/Source/WebKit/qt/tests/tests.pri
@@ -16,16 +16,10 @@ INCLUDEPATH += \
     $$PWD \
     $$PWD/../Api
 
-QT += testlib network
+QT += testlib network webkit
 haveQt(5): QT += widgets
 
-CONFIG += qtwebkit
-
-haveQt(5) {
-    QT += declarative quick1
-} else {
-    contains(QT_CONFIG, declarative): QT += declarative
-}
+haveQt(4): haveQtModule(declarative): QT += declarative
 
 # This define is used by some tests to look up resources in the source tree
 DEFINES += TESTS_SOURCE_DIR=\\\"$$PWD/\\\"
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index 1c7f320a2..795dca1af 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,67 @@
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Rename NotificationPresenter to NotificationClient
+        https://bugs.webkit.org/show_bug.cgi?id=80488
+        <rdar://problem/10965558>
+
+        Reviewed by Kentaro Hara.
+
+        Refactor to use renamed WebCore::NotificationClient.
+        * WebCoreSupport/WebChromeClient.h:
+        (WebChromeClient::notificationPresenter):
+        * WebCoreSupport/WebDesktopNotificationsDelegate.cpp:
+        (WebDesktopNotificationsDelegate::checkPermission):
+        * WebCoreSupport/WebDesktopNotificationsDelegate.h:
+        (WebDesktopNotificationsDelegate):
+
+2012-03-09  Emil A Eklund  <eae@chromium.org>
+
+        Add roundedPoint to HitTestResult and change platform code to use it
+        https://bugs.webkit.org/show_bug.cgi?id=80715
+
+        Reviewed by James Robinson.
+
+        Change ports to use roundedPoint to avoid exposing subpixel types to
+        platform code.
+
+        * WebView.cpp:
+        (WebView::handleContextMenuEvent):
+
+2012-03-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Separate WTF parts of JavaScriptCoreGenerated into WTFGenerated for Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=80657
+
+        Preparation for WTF separation from JavaScriptCore.
+        The "Generated" vcproj files on Windows are necessary so Visual Studio can calculate correct
+        dependencies for generated files.
+
+        Reviewed by Jessie Berlin.
+
+        * WebKit.vcproj/WebKit.sln: Add WTFGenerated, update dependent projects.
+
+2012-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove the redundant method KURL::protocolInHTTPFamily()
+        https://bugs.webkit.org/show_bug.cgi?id=80216
+
+        Reviewed by Anders Carlsson.
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchDidFailToStartPlugin):
+        * WebHistory.cpp:
+        (WebHistory::visitedURL):
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        * WebCoreSupport/WebChromeClient.h:
+        (WebChromeClient):
+
 2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
 
         SpellCheckRequest needs to know the context where the spellcheck happened.
diff --git a/Source/WebKit/win/WebCoreSupport/WebChromeClient.h b/Source/WebKit/win/WebCoreSupport/WebChromeClient.h
index 2a9a8fe7f..478f5d53b 100644
--- a/Source/WebKit/win/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit/win/WebCoreSupport/WebChromeClient.h
@@ -120,10 +120,6 @@ public:
     virtual void reachedMaxAppCacheSize(int64_t spaceNeeded);
     virtual void reachedApplicationCacheOriginQuota(WebCore::SecurityOrigin*, int64_t totalSpaceNeeded);
 
-#if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() { }
-#endif
-
     virtual void populateVisitedLinks();
 
     virtual void runOpenPanel(WebCore::Frame*, PassRefPtr<WebCore::FileChooser>);
@@ -160,7 +156,7 @@ public:
 #endif
 
 #if ENABLE(NOTIFICATIONS)
-    virtual WebCore::NotificationPresenter* notificationPresenter() const { return reinterpret_cast<WebCore::NotificationPresenter*>(m_notificationsDelegate.get()); }
+    virtual WebCore::NotificationClient* notificationPresenter() const { return reinterpret_cast<WebCore::NotificationClient*>(m_notificationsDelegate.get()); }
 #endif
 
     virtual bool selectItemWritingDirectionIsNatural();
diff --git a/Source/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.cpp b/Source/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.cpp
index b80590687..70ed482c3 100644
--- a/Source/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.cpp
@@ -180,13 +180,13 @@ void WebDesktopNotificationsDelegate::cancelRequestsForPermission(ScriptExecutio
 {
 }
 
-NotificationPresenter::Permission WebDesktopNotificationsDelegate::checkPermission(const KURL& url)
+NotificationClient::Permission WebDesktopNotificationsDelegate::checkPermission(const KURL& url)
 {
     int out = 0;
     BString org(SecurityOrigin::create(url)->toString());
     if (hasNotificationDelegate())
         notificationDelegate()->checkNotificationPermission(org, &out);
-    return (NotificationPresenter::Permission) out;
+    return (NotificationClient::Permission) out;
 }
 
 bool WebDesktopNotificationsDelegate::hasNotificationDelegate()
diff --git a/Source/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.h b/Source/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.h
index f0441cffe..a1a1185c5 100644
--- a/Source/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.h
+++ b/Source/WebKit/win/WebCoreSupport/WebDesktopNotificationsDelegate.h
@@ -30,7 +30,7 @@
 
 #include <WebCore/COMPtr.h>
 #include <WebCore/Notification.h>
-#include <WebCore/NotificationPresenter.h>
+#include <WebCore/NotificationClient.h>
 
 #if ENABLE(NOTIFICATIONS)
 
@@ -41,18 +41,18 @@ class Document;
 class KURL;
 }
 
-class WebDesktopNotificationsDelegate : public WebCore::NotificationPresenter {
+class WebDesktopNotificationsDelegate : public WebCore::NotificationClient {
 public:
     WebDesktopNotificationsDelegate(WebView* view);
 
-    /* WebCore::NotificationPresenter interface */
+    /* WebCore::NotificationClient interface */
     virtual bool show(WebCore::Notification* object);
     virtual void cancel(WebCore::Notification* object);
     virtual void notificationObjectDestroyed(WebCore::Notification* object);
     virtual void notificationControllerDestroyed();
     virtual void requestPermission(WebCore::SecurityOrigin* origin, PassRefPtr<WebCore::VoidCallback> callback);
     virtual void cancelRequestsForPermission(WebCore::ScriptExecutionContext*);
-    virtual WebCore::NotificationPresenter::Permission checkPermission(const KURL& url);
+    virtual WebCore::NotificationClient::Permission checkPermission(const KURL&);
 
 private:
     bool hasNotificationDelegate();
diff --git a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
index daaf26a7c..f2e81aca4 100644
--- a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -826,7 +826,7 @@ void WebFrameLoaderClient::dispatchDidFailToStartPlugin(const PluginView* plugin
 
     if (!pluginView->pluginsPage().isNull()) {
         KURL pluginPageURL = frame->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(pluginView->pluginsPage()));
-        if (pluginPageURL.protocolInHTTPFamily()) {
+        if (pluginPageURL.protocolIsInHTTPFamily()) {
             static CFStringRef key = MarshallingHelpers::LPCOLESTRToCFStringRef(WebKitErrorPlugInPageURLStringKey);
             RetainPtr<CFStringRef> str(AdoptCF, pluginPageURL.string().createCFString());
             CFDictionarySetValue(userInfo.get(), key, str.get());
diff --git a/Source/WebKit/win/WebHistory.cpp b/Source/WebKit/win/WebHistory.cpp
index 69dab5c67..e842c1407 100644
--- a/Source/WebKit/win/WebHistory.cpp
+++ b/Source/WebKit/win/WebHistory.cpp
@@ -735,7 +735,7 @@ void WebHistory::visitedURL(const KURL& url, const String& title, const String&
 
     entryPrivate->setLastVisitWasFailure(wasFailure);
     if (!httpMethod.isEmpty())
-        entryPrivate->setLastVisitWasHTTPNonGet(!equalIgnoringCase(httpMethod, "GET") && url.protocolInHTTPFamily());
+        entryPrivate->setLastVisitWasHTTPNonGet(!equalIgnoringCase(httpMethod, "GET") && url.protocolIsInHTTPFamily());
 
     COMPtr<WebHistoryItem> item(Query, entry);
     item->historyItem()->setRedirectURLs(nullptr);
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKit.sln b/Source/WebKit/win/WebKit.vcproj/WebKit.sln
index 6b3fc061d..a41ab21ae 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKit.sln
+++ b/Source/WebKit/win/WebKit.vcproj/WebKit.sln
@@ -3,7 +3,7 @@ Microsoft Visual Studio Solution File, Format Version 9.00
 # Visual Studio 2005
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCore", "..\..\..\JavaScriptCore\JavaScriptCore.vcproj\JavaScriptCore\JavaScriptCore.vcproj", "{011D10F1-B656-4A1B-A0C3-3842F02122C5}"
 	ProjectSection(ProjectDependencies) = postProject
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}
 	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WebCore", "..\..\..\WebCore\WebCore.vcproj\WebCore.vcproj", "{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}"
@@ -13,7 +13,7 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WebCore", "..\..\..\WebCore
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTF", "..\..\..\JavaScriptCore\JavaScriptCore.vcproj\WTF\WTF.vcproj", "{AA8A5A85-592B-4357-BC60-E0E91E026AF6}"
 	ProjectSection(ProjectDependencies) = postProject
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950} = {5AE5F5E4-782D-4F63-B4D7-3977B52B9950}
 	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "..\..\..\JavaScriptCore\JavaScriptCore.vcproj\jsc\jsc.vcproj", "{C59E5129-B453-49B7-A52B-1E104715F76E}"
@@ -24,6 +24,9 @@ EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "JavaScriptCore Folder", "JavaScriptCore Folder", "{557FA164-0E39-4DEC-B66C-8795C8E52399}"
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "..\..\..\JavaScriptCore\JavaScriptCore.vcproj\JavaScriptCore\JavaScriptCoreGenerated.vcproj", "{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"
+	ProjectSection(ProjectDependencies) = postProject
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}
+	EndProjectSection
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "WebCore Folder", "WebCore Folder", "{63FB6F8A-C601-43E3-BD16-A00A465C2CB6}"
 EndProject
@@ -183,6 +186,10 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WebKitTestRunnerLauncher",
 		{3B99669B-1817-443B-BCBE-835580146668} = {3B99669B-1817-443B-BCBE-835580146668}
 	EndProjectSection
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "WTF", "WTF", "{A671AE22-FBCE-4C41-A723-82939FCA3E92}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTFGenerated", "..\..\..\JavaScriptCore\JavaScriptCore.vcproj\WTF\WTFGenerated.vcproj", "{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
@@ -611,12 +618,23 @@ Global
 		{C13FA6EF-B531-4BAD-9A23-18E2BEB8B040}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
 		{C13FA6EF-B531-4BAD-9A23-18E2BEB8B040}.Release|Win32.ActiveCfg = Release|Win32
 		{C13FA6EF-B531-4BAD-9A23-18E2BEB8B040}.Release|Win32.Build.0 = Release|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_All|Win32.Build.0 = Debug_All|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug|Win32.ActiveCfg = Debug|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug|Win32.Build.0 = Debug|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Production|Win32.ActiveCfg = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Production|Win32.Build.0 = Production|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release|Win32.ActiveCfg = Release|Win32
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
 	EndGlobalSection
 	GlobalSection(NestedProjects) = preSolution
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {557FA164-0E39-4DEC-B66C-8795C8E52399}
 		{C59E5129-B453-49B7-A52B-1E104715F76E} = {557FA164-0E39-4DEC-B66C-8795C8E52399}
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5} = {557FA164-0E39-4DEC-B66C-8795C8E52399}
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {557FA164-0E39-4DEC-B66C-8795C8E52399}
@@ -651,5 +669,7 @@ Global
 		{DD7949B6-F2B4-47C2-9C42-E21E84CB1017} = {62DCDFE4-EAD2-48E1-A2BD-BD54AD3C7459}
 		{2974EA02-840B-4995-8719-8920A61006F1} = {62DCDFE4-EAD2-48E1-A2BD-BD54AD3C7459}
 		{C13FA6EF-B531-4BAD-9A23-18E2BEB8B040} = {62DCDFE4-EAD2-48E1-A2BD-BD54AD3C7459}
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {A671AE22-FBCE-4C41-A723-82939FCA3E92}
+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950} = {A671AE22-FBCE-4C41-A723-82939FCA3E92}
 	EndGlobalSection
 EndGlobal
diff --git a/Source/WebKit/win/WebView.cpp b/Source/WebKit/win/WebView.cpp
index 5927c9664..141d36c95 100644
--- a/Source/WebKit/win/WebView.cpp
+++ b/Source/WebKit/win/WebView.cpp
@@ -1349,7 +1349,7 @@ bool WebView::handleContextMenuEvent(WPARAM wParam, LPARAM lParam)
     if (!view)
         return false;
 
-    POINT point(view->contentsToWindow(contextMenuController->hitTestResult().point()));
+    POINT point(view->contentsToWindow(contextMenuController->hitTestResult().roundedPoint()));
 
     // Translate the point to screen coordinates
     if (!::ClientToScreen(m_viewWindow, &point))
diff --git a/Source/WebKit/wince/ChangeLog b/Source/WebKit/wince/ChangeLog
index 998f5d165..5ca6d91b7 100644
--- a/Source/WebKit/wince/ChangeLog
+++ b/Source/WebKit/wince/ChangeLog
@@ -1,3 +1,25 @@
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Rename NotificationPresenter to NotificationClient
+        https://bugs.webkit.org/show_bug.cgi?id=80488
+        <rdar://problem/10965558>
+
+        Reviewed by Kentaro Hara.
+
+        Refactor to use renamed WebCore::NotificationClient.
+        * WebCoreSupport/ChromeClientWinCE.h:
+        (ChromeClientWinCE):
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        * WebCoreSupport/ChromeClientWinCE.h:
+        (ChromeClientWinCE):
+
 2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
 
         SpellCheckRequest needs to know the context where the spellcheck happened.
diff --git a/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h b/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
index 613783a03..41792026b 100644
--- a/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
+++ b/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
@@ -131,12 +131,8 @@ public:
     // for this origin.
     virtual void reachedApplicationCacheOriginQuota(WebCore::SecurityOrigin*, int64_t totalSpaceNeeded);
 
-#if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() { }
-#endif
-
 #if ENABLE(NOTIFICATIONS)
-    virtual WebCore::NotificationPresenter* notificationPresenter() const;
+    virtual WebCore::NotificationClient* notificationPresenter() const;
 #endif
 
     // This can be either a synchronous or asynchronous call. The ChromeClient can display UI asking the user for permission
diff --git a/Source/WebKit/wx/ChangeLog b/Source/WebKit/wx/ChangeLog
index 0c6021eab..de5aef92c 100644
--- a/Source/WebKit/wx/ChangeLog
+++ b/Source/WebKit/wx/ChangeLog
@@ -1,3 +1,13 @@
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        * WebKitSupport/ChromeClientWx.h:
+        (ChromeClientWx):
+
 2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
 
         SpellCheckRequest needs to know the context where the spellcheck happened.
diff --git a/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h b/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h
index 2b6cdef61..f95871ba6 100644
--- a/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h
+++ b/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h
@@ -126,11 +126,6 @@ public:
 
     virtual void reachedMaxAppCacheSize(int64_t spaceNeeded);
     virtual void reachedApplicationCacheOriginQuota(SecurityOrigin*, int64_t totalSpaceNeeded);
-
-#if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() { }
-#endif
-
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
     virtual void loadIconForFiles(const Vector<String>&, FileIconLoader*);
 
diff --git a/Source/WebKit2/CMakeLists.txt b/Source/WebKit2/CMakeLists.txt
index 0dc836c00..e53b958a2 100644
--- a/Source/WebKit2/CMakeLists.txt
+++ b/Source/WebKit2/CMakeLists.txt
@@ -155,6 +155,8 @@ SET(WebKit2_SOURCES
     Shared/WebPopupItem.cpp
     Shared/WebPreferencesStore.cpp
     Shared/WebProcessCreationParameters.cpp
+    Shared/WebRenderLayer.cpp
+    Shared/WebRenderObject.cpp
     Shared/WebTouchEvent.cpp
     Shared/WebURLRequest.cpp
     Shared/WebURLResponse.cpp
@@ -173,6 +175,8 @@ SET(WebKit2_SOURCES
     Shared/API/c/WKMutableArray.cpp
     Shared/API/c/WKMutableDictionary.cpp
     Shared/API/c/WKNumber.cpp
+    Shared/API/c/WKRenderLayer.cpp
+    Shared/API/c/WKRenderObject.cpp
     Shared/API/c/WKSecurityOrigin.cpp
     Shared/API/c/WKSerializedScriptValue.cpp
     Shared/API/c/WKString.cpp
@@ -516,6 +520,7 @@ ADD_DEPENDENCIES(${WebKit2_LIBRARY_NAME} ${WebCore_LIBRARY_NAME})
 ADD_DEPENDENCIES(${WebKit2_LIBRARY_NAME} ${ForwardingHeaders_NAME})
 ADD_DEPENDENCIES(${WebKit2_LIBRARY_NAME} ${ForwardingNetworkHeaders_NAME})
 TARGET_LINK_LIBRARIES(${WebKit2_LIBRARY_NAME} ${WebKit2_LIBRARIES})
+SET_TARGET_PROPERTIES(${WebKit2_LIBRARY_NAME} PROPERTIES LINK_INTERFACE_LIBRARIES "")
 
 ADD_EXECUTABLE(${WebProcess_NAME} ${WebProcess_SOURCES})
 TARGET_LINK_LIBRARIES(${WebProcess_NAME} ${WebProcess_LIBRARIES})
@@ -526,4 +531,4 @@ IF (WebKit2_LINK_FLAGS)
     ADD_TARGET_PROPERTIES(${WebProcess_NAME} LINK_FLAGS "${WebKit2_LINK_FLAGS}")
 ENDIF ()
 
-INSTALL(TARGETS ${WebKit2_LIBRARY_NAME} DESTINATION lib)
+INSTALL(TARGETS ${WebKit2_LIBRARY_NAME} DESTINATION "${LIB_INSTALL_DIR}")
diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index 85a7f4bde..3a3c77856 100644
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,2820 @@
+2012-03-11  Andy Estes  <aestes@apple.com>
+
+        Remove unnecessary call to NSSizeToCGSize().
+        https://bugs.webkit.org/show_bug.cgi?id=80817
+
+        Reviewed by Dan Bernstein.
+
+        There is no need to call NSSizeToCGSize() to convert an IntSize to a
+        CGSize. IntSize defines a conversion function to CGSize that will do
+        this for us implicitly.
+
+        * UIProcess/mac/BackingStoreMac.mm:
+        (WebKit::BackingStore::backingStoreContext): Do not call NSSizeToCGSize().
+
+2012-03-11  Dan Bernstein  <mitz@apple.com>
+
+        WebKit2 lacks API for obtaining a representation of the RenderLayer tree of a page, like WebRenderLayer
+        <http://webkit.org/b/80791>
+
+        Reviewed by Anders Carlsson.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+
+        * Shared/API/c/WKBase.h: Added a type definition of WKRenderLayerRef.
+
+        * Shared/API/c/WKRenderLayer.cpp: Added.
+        (WKRenderLayerGetTypeID): Added. Returns the WKRenderLayer type ID.
+        (WKRenderLayerCopyRendererName): Added this getter wrapper.
+        (WKRenderLayerCopyElementTagName): Ditto.
+        (WKRenderLayerCopyElementID): Ditto.
+        (WKRenderLayerGetElementClassNames): Ditto.
+        (WKRenderLayerGetAbsoluteBounds): Ditto.
+        (WKRenderLayerIsClipping): Ditto.
+        (WKRenderLayerIsClipped): Ditto.
+        (WKRenderLayerIsReflection): Ditto.
+        (WKRenderLayerGetCompositingLayerType): Ditto.
+        (WKRenderLayerGetNegativeZOrderList): Ditto.
+        (WKRenderLayerGetNormalFlowList): Ditto.
+        (WKRenderLayerGetPositiveZOrderList): Ditto.
+
+        * Shared/API/c/WKRenderLayer.h: Added.
+
+        * Shared/APIObject.h: Added TypeRenderLayer to the APIObject::Type enum.
+
+        * Shared/UserMessageCoders.h:
+        (WebKit::UserMessageEncoder::baseEncode): Added WebRenderLayer encoding.
+        (WebKit::UserMessageDecoder::baseDecode): Added WebRenderLayer decoding.
+
+        * Shared/WebRenderLayer.cpp: Added.
+        (WebKit::WebRenderLayer::create): Added. Creates a WebRenderLayer for the page’s main
+        frame’s root layer.
+        (WebKit::WebRenderLayer::createArrayFromLayerList): Added this helper function.
+        (WebKit::WebRenderLayer::WebRenderLayer): Added. Constructs a WebRenderLayer with the
+        renderer name, element tag, ID and class names, metrics, child lists, and compositing
+        layer properties of the given RenderLayer.
+
+        * Shared/WebRenderLayer.h: Added.
+        (WebKit::WebRenderLayer::create):
+        (WebKit::WebRenderLayer::negativeZOrderList):
+        (WebKit::WebRenderLayer::normalFlowList):
+        (WebKit::WebRenderLayer::positiveZOrderList):
+        (WebKit::WebRenderLayer::renderObjectName):
+        (WebKit::WebRenderLayer::elementTagName):
+        (WebKit::WebRenderLayer::elementID):
+        (WebKit::WebRenderLayer::elementClassNames):
+        (WebKit::WebRenderLayer::isReflection):
+        (WebKit::WebRenderLayer::isClipping):
+        (WebKit::WebRenderLayer::isClipped):
+        (WebKit::WebRenderLayer::compositingLayerType):
+        (WebKit::WebRenderLayer::absoluteBoundingBox):
+        (WebKit::WebRenderLayer::WebRenderLayer):
+
+        * Target.pri
+
+        * UIProcess/API/C/WKAPICast.h: Added a mapping between WKRenderLayerRef and WebRenderLayer.
+
+        * WebKit2.xcodeproj/project.pbxproj: Added WebRenderLayer.{cpp,h} and WKRenderLayer.{cpp,h}.
+
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.cpp:
+        (WKBundlePageCopyRenderLayerTree): Added this bundle API for getting the layer tree.
+
+        * WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h:
+
+        * win/WebKit2.vcproj:
+
+2012-03-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        <http://webkit.org/b/80782> Web Inspector: Crash using released frontendClient when resizing window with closed inspector
+
+        The WebInspectorFrontendClient reference should be cleared when the
+        WebInspectorClient::closeInspectorFrontend is called. This adds a
+        destroyInspectorPage to mirror createInspectorPage and clear the weak
+        pointers that are no longer valid.
+
+        Reviewed by Pavel Feldman.
+
+        * WebProcess/WebCoreSupport/WebInspectorClient.cpp:
+        (WebKit::WebInspectorClient::closeInspectorFrontend):
+        (WebKit::WebInspectorClient::didResizeMainFrame):
+        * WebProcess/WebPage/WebInspector.cpp:
+        (WebKit::WebInspector::destroyInspectorPage):
+        * WebProcess/WebPage/WebInspector.h:
+
+2012-03-11  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        [Qt] [WK2] Support threaded renderer in WK2
+        https://bugs.webkit.org/show_bug.cgi?id=76661
+
+        Reviewed by Noam Rosenthal.
+
+        Implement Qt5 threaded rendering support for Qt WebKit2.
+        Parts of LayerTreeHostProxy which contain layer tree and layer painting objects 
+        are moved to separate class called WebLayerTreeRenderer. WebLayerTreeRenderer is 
+        thread safe ref counted and referenced by LayerTreeHostProxy and paint node.
+        All layer tree and graphics objects are created, accessed and deallocated from Qt 
+        Scenegraph's paint thread only.
+        Layer tree updates from render queue are fetched in updatePaintNode call stack when 
+        main thread is locked.
+        Messages from paint thread to web process are passed through MainThreadGuardedInvoker 
+        call gate (implemented by Noam Rosenthal and previously reviewed by Kenneth Rohde 
+        Christiansen).
+
+        * Target.pri:
+        * UIProcess/API/qt/qquickwebpage.cpp:
+        (PageProxyNode::PageProxyNode):
+        (PageProxyNode::render):
+        (PageProxyNode::~PageProxyNode):
+        (PageProxyNode::layerTreeRenderer):
+        (PageProxyNode):
+        (PageProxyNode::setScale):
+        (QQuickWebPage::updatePaintNode):
+        (QQuickWebPagePrivate::~QQuickWebPagePrivate):
+        * UIProcess/LayerTreeHostProxy.cpp: Added.
+        (WebKit):
+        (WebKit::LayerTreeHostProxy::LayerTreeHostProxy):
+        (WebKit::LayerTreeHostProxy::~LayerTreeHostProxy):
+        (WebKit::LayerTreeHostProxy::paintToCurrentGLContext):
+        (WebKit::LayerTreeHostProxy::paintToGraphicsContext):
+        (WebKit::LayerTreeHostProxy::updateViewport):
+        (WebKit::LayerTreeHostProxy::dispatchUpdate):
+        (WebKit::LayerTreeHostProxy::createTileForLayer):
+        (WebKit::LayerTreeHostProxy::updateTileForLayer):
+        (WebKit::LayerTreeHostProxy::removeTileForLayer):
+        (WebKit::LayerTreeHostProxy::deleteCompositingLayer):
+        (WebKit::LayerTreeHostProxy::setRootCompositingLayer):
+        (WebKit::LayerTreeHostProxy::syncCompositingLayerState):
+        (WebKit::LayerTreeHostProxy::didRenderFrame):
+        (WebKit::LayerTreeHostProxy::createDirectlyCompositedImage):
+        (WebKit::LayerTreeHostProxy::destroyDirectlyCompositedImage):
+        (WebKit::LayerTreeHostProxy::setVisibleContentsRectForPanning):
+        (WebKit::LayerTreeHostProxy::setVisibleContentsRectForScaling):
+        (WebKit::LayerTreeHostProxy::renderNextFrame):
+        (WebKit::LayerTreeHostProxy::purgeBackingStores):
+        * UIProcess/LayerTreeHostProxy.h:
+        (WebKit):
+        (LayerTreeHostProxy):
+        (WebKit::LayerTreeHostProxy::layerTreeRenderer):
+        * UIProcess/WebLayerTreeRenderer.cpp: Renamed from Source/WebKit2/UIProcess/qt/LayerTreeHostProxyQt.cpp.
+        (WebKit):
+        (MainThreadGuardedInvoker):
+        (WebKit::MainThreadGuardedInvoker::call):
+        (WebKit::MainThreadGuardedInvoker::MainThreadGuardedInvoker):
+        (WebKit::MainThreadGuardedInvoker::invoke):
+        (WebKit::WebLayerTreeRenderer::callOnMainTread):
+        (WebKit::WebLayerTreeRenderer::WebLayerTreeRenderer):
+        (WebKit::WebLayerTreeRenderer::~WebLayerTreeRenderer):
+        (WebKit::WebLayerTreeRenderer::createLayer):
+        (WebKit::WebLayerTreeRenderer::paintToCurrentGLContext):
+        (WebKit::WebLayerTreeRenderer::syncAnimations):
+        (WebKit::WebLayerTreeRenderer::paintToGraphicsContext):
+        (WebKit::WebLayerTreeRenderer::setVisibleContentsRectForScaling):
+        (WebKit::WebLayerTreeRenderer::updateViewport):
+        (WebKit::WebLayerTreeRenderer::syncLayerParameters):
+        (WebKit::WebLayerTreeRenderer::deleteLayer):
+        (WebKit::WebLayerTreeRenderer::ensureLayer):
+        (WebKit::WebLayerTreeRenderer::setRootLayerID):
+        (WebKit::WebLayerTreeRenderer::getBackingStore):
+        (WebKit::WebLayerTreeRenderer::createTile):
+        (WebKit::WebLayerTreeRenderer::removeTile):
+        (WebKit::WebLayerTreeRenderer::updateTile):
+        (WebKit::WebLayerTreeRenderer::createImage):
+        (WebKit::WebLayerTreeRenderer::destroyImage):
+        (WebKit::WebLayerTreeRenderer::assignImageToLayer):
+        (WebKit::WebLayerTreeRenderer::swapBuffers):
+        (WebKit::WebLayerTreeRenderer::flushLayerChanges):
+        (WebKit::WebLayerTreeRenderer::renderNextFrame):
+        (WebKit::WebLayerTreeRenderer::ensureRootLayer):
+        (WebKit::WebLayerTreeRenderer::syncRemoteContent):
+        (WebKit::WebLayerTreeRenderer::purgeGLResources):
+        (WebKit::WebLayerTreeRenderer::purgeBackingStores):
+        (WebKit::WebLayerTreeRenderer::detach):
+        (WebKit::WebLayerTreeRenderer::appendUpdate):
+        * UIProcess/WebLayerTreeRenderer.h: Copied from Source/WebKit2/UIProcess/LayerTreeHostProxy.h.
+        (WebKit):
+        (WebLayerTreeRenderer):
+        (WebKit::WebLayerTreeRenderer::layerByID):
+        (WebKit::WebLayerTreeRenderer::rootLayer):
+        (WebKit::WebLayerTreeRenderer::notifyAnimationStarted):
+        (WebKit::WebLayerTreeRenderer::notifySyncRequired):
+        (WebKit::WebLayerTreeRenderer::showDebugBorders):
+        (WebKit::WebLayerTreeRenderer::showRepaintCounter):
+        (WebKit::WebLayerTreeRenderer::paintContents):
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Rename NotificationPresenter to NotificationClient
+        https://bugs.webkit.org/show_bug.cgi?id=80488
+        <rdar://problem/10965558>
+
+        Reviewed by Kentaro Hara.
+
+        Refactor to use renamed WebCore::NotificationClient.
+        * UIProcess/Notifications/WebNotificationManagerProxy.h:
+        * WebProcess/Notifications/NotificationPermissionRequestManager.cpp:
+        (WebKit::NotificationPermissionRequestManager::startRequest):
+        (WebKit::NotificationPermissionRequestManager::permissionLevel):
+        * WebProcess/Notifications/NotificationPermissionRequestManager.h:
+        (NotificationPermissionRequestManager):
+        * WebProcess/Notifications/WebNotificationManager.cpp:
+        (WebKit::WebNotificationManager::policyForOrigin):
+        * WebProcess/Notifications/WebNotificationManager.h:
+        (WebNotificationManager):
+        * WebProcess/WebCoreSupport/WebNotificationClient.cpp:
+        (WebKit::WebNotificationClient::checkPermission):
+        * WebProcess/WebCoreSupport/WebNotificationClient.h:
+        (WebNotificationClient):
+
+2012-03-09  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        [Qt] [WK2] Shouldn't use item for clipping rect calculation in paint node.
+        https://bugs.webkit.org/show_bug.cgi?id=80714
+
+        Reviewed by Noam Rosenthal.
+
+        Replace item based clip-rect calculation with clipping-nodes based calculation.
+        This is required for threaded rendering, since we don't have access to the QSGItems
+        from the render thread.
+
+        * UIProcess/API/qt/qquickwebpage.cpp:
+        (QQuickWebPage::QQuickWebPage):
+        (QQuickWebPagePrivate::paintToCurrentGLContext):
+        (PageProxyNode::render):
+        (PageProxyNode::clipRect):
+        (PageProxyNode):
+        * UIProcess/API/qt/qquickwebpage_p_p.h:
+        (QQuickWebPagePrivate):
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebView::QQuickWebView):
+
+2012-03-09  Enrica Casucci  <enrica@apple.com>
+
+        Move WebNSURLExtras code down to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=80611
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2012-03-09  Jeff Miller  <jeffm@apple.com>
+
+        Add WKPageEndPrinting() to balance WKPageBeginPrinting()
+        https://bugs.webkit.org/show_bug.cgi?id=80739
+
+        Reviewed by Dan Bernstein.
+
+        * UIProcess/API/C/WKPage.cpp:
+        (WKPageEndPrinting): Added.
+        
+        * UIProcess/API/C/WKPagePrivate.h: Added WKPageEndPrinting().
+
+2012-03-09  Emil A Eklund  <eae@chromium.org>
+
+        Add roundedPoint to HitTestResult and change platform code to use it
+        https://bugs.webkit.org/show_bug.cgi?id=80715
+
+        Reviewed by James Robinson.
+
+        Change ports to use roundedPoint to avoid exposing subpixel types to
+        platform code.
+
+        * WebProcess/WebPage/WebContextMenu.cpp:
+        (WebKit::WebContextMenu::show):
+
+2012-03-09  Alexey Proskuryakov  <ap@apple.com>
+
+        [Mac] Pass sandbox profiles through preprocessor
+        https://bugs.webkit.org/show_bug.cgi?id=80651
+
+        Reviewed by Mark Rowe.
+
+        * DerivedSources.make: Preprocess sandbox profiles.
+
+        * PluginProcess/mac/com.apple.WebKit.PluginProcess.sb: Removed.
+        * PluginProcess/mac/com.apple.WebKit.PluginProcess.sb.in: Copied from Source/WebKit2/PluginProcess/mac/com.apple.WebKit.PluginProcess.sb.
+        * WebProcess/com.apple.WebProcess.sb: Removed.
+        * WebProcess/com.apple.WebProcess.sb.in: Copied from Source/WebKit2/WebProcess/com.apple.WebProcess.sb.
+        Renamed to avoid make finding the wrong original in default paths.
+
+        * WebKit2.xcodeproj/project.pbxproj: Copy preprocessed files to Resources, not originals.
+        Also, changed DerivedSources target to use BaseTarget.xcconfig to have correct include paths.
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Add support for ENABLE(LEGACY_NOTIFICATIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=80497
+
+        Reviewed by Adam Barth.
+
+        Prep for b80472: Update API for Web Notifications
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-09  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        Bash scripts should support LF endings only
+        https://bugs.webkit.org/show_bug.cgi?id=79509
+
+        Reviewed by David Kilzer.
+
+        * win/build-generated-files.sh: Added properties svn:executable and svn:eol-style.
+
+2012-03-08  Enrica Casucci  <enrica@apple.com>
+
+        REGRESSION (r109022): Files dragged onto input controls cannot be read due to sandbox violation.
+        https://bugs.webkit.org/show_bug.cgi?id=80203
+        <rdar://problem/10976643>
+
+        Reviewed by Alexey Proskuryakov.
+
+        This patch reverts a small part fo r109022, leaving access to
+        NSPasteboard in the WebProcess when retrieving pathnames for
+        files being dragged. This avoid the sandbox violation until we
+        implement a mechanism to provide a sandbox extension to the WebProcess.
+        
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebKit::WebPlatformStrategies::getPathnamesForType):
+
+2012-03-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110191, r110202, and r110279.
+        http://trac.webkit.org/changeset/110191
+        http://trac.webkit.org/changeset/110202
+        http://trac.webkit.org/changeset/110279
+        https://bugs.webkit.org/show_bug.cgi?id=80694
+
+        They broke !ENABLE(INSPECTOR) builds (Requested by Ossy on
+        #webkit).
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-03-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Use Qt's module system for install rules and depending on QtWebKit
+
+        Instead of rolling our own install rules we now use the same approach as
+        every other Qt module, by loading qt_module.prf and qt_module_config.prf.
+
+        This ensures that we follow the same semantics as the rest of Qt on
+        what sort of config options are enabled by default (create_cmake eg.).
+        It also allows us to use QT += webkit instead of the workaround we had
+        with CONFIG += qtwebkit.
+
+        We do however force Qt to always treat our build as a non-developer build,
+        so the libraries will end up in the WebKit lib directory instead of the
+        qtbase directory (as with a normal developer-build). This allows us to
+        keep the webkit-build self-contained. If Qt is a developer build we still
+        copy the module file manually to Qt, so that you don't have to install
+        WebKit to make it available.
+
+        For non-developer builds of Qt, it is still possible to use the built
+        WebKit libraries without having to install them, by having the variable
+        QMAKE_EXTRA_MODULE_FORWARDS set in the project's .qmake.cache file,
+        pointing to $WEBKITOUTUTDIR/$CONFIGURATION/modules.
+
+        https://bugs.webkit.org/show_bug.cgi?id=80590
+
+        Reviewed by Simon Hausmann.
+
+        * UIProcess/API/qt/tests/publicapi/publicapi.pro:
+        * UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior.pro:
+        * UIProcess/API/qt/tests/qmltests/WebView.pro:
+        * UIProcess/API/qt/tests/qmltests/tst_qmltests.cpp:
+        * UIProcess/API/qt/tests/qquickwebview/qquickwebview.pro:
+        * UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp:
+        * UIProcess/API/qt/tests/tests.pri:
+        * UIProcess/API/qt/tests/util.cpp:
+        * WebProcess.pro:
+
+2012-03-08  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Allow transparent WebViews
+        https://bugs.webkit.org/show_bug.cgi?id=80608
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added support for transparentBackground in QQuickWebViewExperimental.
+        This uses the existing drawsTransparentBackground property in WebKit2.
+        Also, changed LayerTreeHostQt to set the contentsOpaque flag when the root layer changes,
+        otherwise the change doesn't take effect.
+
+        A new API test was added.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::setTransparentBackground):
+        (QQuickWebViewPrivate::transparentBackground):
+        (QQuickWebViewExperimental::transparentBackground):
+        (QQuickWebViewExperimental::setTransparentBackground):
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        * UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp:
+        (tst_QQuickWebView):
+        (tst_QQuickWebView::transparentWebViews):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.cpp:
+        (WebKit::LayerTreeHostQt::LayerTreeHostQt):
+        (WebKit::LayerTreeHostQt::setRootCompositingLayer):
+
+2012-03-08  Gustavo Noronha Silva  <gns@gnome.org>
+
+        GTK+ build fix. Only try to get the backing from the layer in when
+        ACCELERATED_COMPOSITING is enabled.
+
+        Rubber-stamped by Ryosuke Niwa.
+
+        * WebProcess/FullScreen/WebFullScreenManager.cpp:
+        (WebKit::screenRectOfContents):
+
+2012-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix for micro data API.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+>>>>>>> .r110352
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed Snow Leopard build fix.
+
+        On Leopard and Snow Leopard, provide an implementation for -[NSWindow convertRectToScreen:].
+
+        * UIProcess/mac/WKFullScreenWindowController.mm:
+        (-[NSWindow convertRectToScreen:]):
+
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Further unreviewed build fix.
+
+        Add in the WebCore namespace, so that IntRect is pulled in.
+
+        * UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp:
+        * UIProcess/qt/WebFullScreenManagerProxyQt.cpp:
+        * UIProcess/win/WebFullScreenManagerProxyWin.cpp:
+
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed build fix.
+        
+        Add stub implementations of beganEnterFullScreen and beganExitFullScreen
+        to platform-specific WebFullScreenManagerProxy implementations.
+
+        * UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp:
+        (WebKit::WebFullScreenManagerProxy::beganEnterFullScreen):
+        (WebKit::WebFullScreenManagerProxy::beganExitFullScreen):
+        * UIProcess/qt/WebFullScreenManagerProxyQt.cpp:
+        (WebKit::WebFullScreenManagerProxy::beganEnterFullScreen):
+        (WebKit::WebFullScreenManagerProxy::beganExitFullScreen):
+        * UIProcess/win/WebFullScreenManagerProxyWin.cpp:
+        (WebKit::WebFullScreenManagerProxy::beganEnterFullScreen):
+        (WebKit::WebFullScreenManagerProxy::beganExitFullScreen):
+
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Full Screen Refactor Part 3: Animate into Full Screen mode using new animation classes.
+        https://bugs.webkit.org/show_bug.cgi?id=78928
+
+        Reviewed by Anders Carlsson.
+
+        Boilerplate changes to WebKit2 IPC messages and supporting functions.
+        * UIProcess/WebFullScreenManagerProxy.cpp:
+        (WebKit::WebFullScreenManagerProxy::setAnimatingFullScreen): Added boilerplate.
+        * UIProcess/WebFullScreenManagerProxy.h:
+        * UIProcess/WebFullScreenManagerProxy.messages.in:
+        * UIProcess/mac/WebFullScreenManagerProxyMac.mm:
+        (WebKit::WebFullScreenManagerProxy::beganEnterFullScreen): Added boilerplate.
+        (WebKit::WebFullScreenManagerProxy::beganExitFullScreen): Added boilerplate.
+        * WebProcess/FullScreen/WebFullScreenManager.cpp:
+        (WebKit::screenRectOfContents): Added.  Calculates the screen rect of an element's contents.
+        (WebKit::WebFullScreenManager::enterFullScreenForElement): Use screenRectOfContents()
+        (WebKit::WebFullScreenManager::willEnterFullScreen): Ditto. Do not set the background color. Call new BeganEnterFullScreen
+            XPC message.
+        (WebKit::WebFullScreenManager::didEnterFullScreen): Do not set the background color.
+        (WebKit::WebFullScreenManager::willExitFullScreen): Use screenRectOfContents. Do not set the background color. Call new
+            BeganExitFullScreen XPC message.
+        (WebKit::WebFullScreenManager::didExitFullScreen): Do not set the background color.
+        (WebKit::WebFullScreenManager::setAnimatingFullScreen): Added boilerplate.
+        * WebProcess/FullScreen/WebFullScreenManager.h:
+        * WebProcess/FullScreen/WebFullScreenManager.messages.in:
+
+        * UIProcess/mac/WKFullScreenWindowController.h:
+        * UIProcess/mac/WKFullScreenWindowController.mm:
+        (-[WKFullScreenWindowController cancelOperation:]): Renamed from _requestExitWithAnimation:.
+        (-[WKFullScreenWindowController applicationDidResignActive:]): Call cancelOperation: instead
+            of _requestExitWithAnimation.
+        (-[WKFullScreenWindowController applicationDidChangeScreenParameters:]): Set the frame of
+            both the full screen window and the background window.
+        (-[WKFullScreenWindowController enterFullScreen:]): Save a rendered image of the current
+            page to use in the placeholder.
+        (-[WKFullScreenWindowController beganEnterFullScreenWithInitialFrame:WebCore::finalFrame:WebCore::]): Renamed from 
+            beganEnterFullScreenAnimation.
+        (-[WKFullScreenWindowController finishedEnterFullScreenAnimation:]): No need to swap 
+            placeholder views here, as they were already swapped in beganEnter...:.
+        (-[WKFullScreenWindowController exitFullScreen]):
+        (-[WKFullScreenWindowController beganExitFullScreenWithInitialFrame:WebCore::finalFrame:WebCore::]): Renamed from 
+            beganExitFullScreenAnimation.
+        (-[WKFullScreenWindowController finishedExitFullScreenAnimation:]): Swap web view back into place.
+        (-[WKFullScreenWindowController close]):
+        (-[WKFullScreenWindowController animationDidEnd:]): Added.
+        (createBackgroundFullscreenWindow): Added.
+        (windowFrameFromApparentFrames): Added.
+        (-[WKFullScreenWindowController _startEnterFullScreenAnimationWithDuration:]): Added.
+        (-[WKFullScreenWindowController _startExitFullScreenAnimationWithDuration:]): Added.
+
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Full Screen Refactor Part 2: Remove unnecessary WebKit2 APIs for Full Screen made
+        https://bugs.webkit.org/show_bug.cgi?id=78926
+
+        Reviewed by John Sullivan.
+
+        The following functions (and also their Proxy versions) were removed completely:
+        WebFullScreenManager::enterAcceleratedCompositingMode(const LayerTreeContext&)
+        WebFullScreenManager::exitAcceleratedCompositingMode()
+        WebFullScreenManager::beganEnterFullScreenAnimation()
+        WebFullScreenManager::finishedEnterFullScreenAnimation(bool)
+        WebFullScreenManager::beganExitFullScreenAnimation()
+        WebFullScreenManager::finishedExitFullScreenAnimation(bool)
+        WebFullScreenManager::getFullScreenRect(WebCore::IntRect&)
+
+        * UIProcess/WebFullScreenManagerProxy.cpp:
+        * UIProcess/WebFullScreenManagerProxy.h:
+        (WebKit::WebFullScreenManagerProxy::beginEnterFullScreenAnimation):
+        (WebKit::WebFullScreenManagerProxy::beginExitFullScreenAnimation):
+        (WebKit::WebFullScreenManagerProxy::disposeOfLayerClient):
+        (WebFullScreenManagerProxy):
+        * UIProcess/WebFullScreenManagerProxy.messages.in:
+        * UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp:
+        * UIProcess/mac/WebFullScreenManagerProxyMac.mm:
+        * UIProcess/qt/WebFullScreenManagerProxyQt.cpp:
+        * UIProcess/win/WebFullScreenManagerProxyWin.cpp:
+        (WebKit::WebFullScreenManagerProxy::finishedExitFullScreenAnimation):
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/FullScreen/WebFullScreenManager.cpp:
+        (WebKit::WebFullScreenManager::create):
+        (WebKit::WebFullScreenManager::~WebFullScreenManager):
+        * WebProcess/FullScreen/WebFullScreenManager.h:
+        (WebFullScreenManager):
+        * WebProcess/FullScreen/WebFullScreenManager.messages.in:
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::exitFullScreenForElement):
+        * WebProcess/WebCoreSupport/WebChromeClient.h:
+        (WebChromeClient):
+
+        Additionally, the platform-specific WebFullScreenManager subclasses were removed, as no
+        platform-specific implementations remained after the above functions were removed:
+        * GNUmakefile.am:
+        * Target.pri:
+        * win/WebKit2.vcproj:
+        * WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.cpp: Removed.
+        * WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.h: Removed.
+        * WebProcess/FullScreen/mac/WebFullScreenManagerMac.h: Removed.
+        * WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm: Removed.
+        * WebProcess/FullScreen/qt/WebFullScreenManagerQt.cpp: Removed.
+        * WebProcess/FullScreen/qt/WebFullScreenManagerQt.h: Removed.
+        * WebProcess/FullScreen/win/WebFullScreenManagerWin.cpp: Removed.
+        * WebProcess/FullScreen/win/WebFullScreenManagerWin.h: Removed.
+
+2012-03-08  Matt Lilek  <mrl@apple.com>
+
+        Don't enable VIDEO_TRACK on all OS X platforms
+        https://bugs.webkit.org/show_bug.cgi?id=80635
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-08  Max Vujovic  <mvujovic@adobe.com>
+
+        Add a method to window.internals to enable testing of inspector highlight rects
+        https://bugs.webkit.org/show_bug.cgi?id=80338
+
+        Reviewed by Pavel Feldman.
+
+        * win/WebKit2.def: Export symbols for win.
+        * win/WebKit2CFLite.def: Same as above.
+
+2012-03-08  Dinu Jacob  <dinu.jacob@nokia.com>
+
+        [Qt WK2] Remove duplicate code related to dialog handling in QQuickWebView
+        https://bugs.webkit.org/show_bug.cgi?id=80557
+
+        Reviewed by Simon Hausmann.
+
+        Move common code related to running QtDialogRunner into a separate function
+ 
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::runJavaScriptAlert):
+        (QQuickWebViewPrivate::runJavaScriptConfirm):
+        (QQuickWebViewPrivate::runJavaScriptPrompt):
+        (QQuickWebViewPrivate::handleAuthenticationRequiredRequest):
+        (QQuickWebViewPrivate::handleProxyAuthenticationRequiredRequest):
+        (QQuickWebViewPrivate::handleCertificateVerificationRequest):
+        (QQuickWebViewPrivate::execDialogRunner):
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+
+2012-03-07  Dinu Jacob  <dinu.jacob@nokia.com>
+
+        [Qt] Authentication dialog does not work
+        https://bugs.webkit.org/show_bug.cgi?id=79738
+
+        Reviewed by Simon Hausmann.
+
+        QQuickWebView should accept touch events only if there is
+        no active dialog.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::QQuickWebViewPrivate):
+        (QQuickWebViewPrivate::runJavaScriptAlert):
+        (QQuickWebViewPrivate::runJavaScriptConfirm):
+        (QQuickWebViewPrivate::runJavaScriptPrompt):
+        (QQuickWebViewPrivate::handleAuthenticationRequiredRequest):
+        (QQuickWebViewPrivate::handleProxyAuthenticationRequiredRequest):
+        (QQuickWebViewPrivate::handleCertificateVerificationRequest):
+        (QQuickWebView::touchEvent):
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+
+2012-03-07  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/8494396> WebKit2 lacks API for obtaining a representation of the render tree of a page, like WebRenderNode
+        https://bugs.webkit.org/show_bug.cgi?id=80230
+
+        Reviewed by Beth Dakin.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+
+        * Shared/API/c/WKBase.h: Added a type definition of WKRenderObjectRef.
+
+        * Shared/API/c/WKRenderObject.cpp: Added.
+        (WKRenderObjectGetTypeID): Added. Returns the WKRenderObject type ID.
+        (WKRenderObjectCopyName): Added this getter wrapper.
+        (WKRenderObjectGetAbsolutePosition): Ditto.
+        (WKRenderObjectGetFrameRect): Ditto.
+        (WKRenderObjectGetChildren): Ditto.
+
+        * Shared/API/c/WKRenderObject.h: Added.
+
+        * Shared/APIObject.h: Added TypeRenderObject to the APIObject::Type enum.
+        * Shared/UserMessageCoders.h:
+        (WebKit::UserMessageEncoder::baseEncode): Added WebRenderObject encoding.
+        (WebKit::UserMessageDecoder::baseDecode): Added WebRenderObject decoding.
+        * Shared/WebRenderObject.cpp: Added.
+        (WebKit::WebRenderObject::create): Added. Creates a WebRenderObject for the page’s main
+        frame content renderer.
+        (WebKit::WebRenderObject::WebRenderObject): Added. Constructs a WebRenderObject with the
+        name, metrics and children of the given RenderObject, following the rules used in WebKit1
+        WebRenderNode. In particular, a RenderWidget representing a frame gets the frame’s content
+        renderer as a child.
+
+        * Shared/WebRenderObject.h: Added.
+        (WebKit::WebRenderObject::create):
+        (WebKit::WebRenderObject::children):
+        (WebKit::WebRenderObject::name):
+        (WebKit::WebRenderObject::absolutePosition):
+        (WebKit::WebRenderObject::frameRect):
+        (WebKit::WebRenderObject::WebRenderObject):
+
+        * Target.pri:
+
+        * UIProcess/API/C/WKAPICast.h: Added a mapping between WKRenderObjectRef and WebRenderObject.
+
+        * WebKit2.xcodeproj/project.pbxproj: Added WebRenderObject.{cpp,h} and WKRenderObject.{cpp.h}.
+
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.cpp:
+        (WKBundlePageCopyRenderTree): Added this bundle API for getting the render tree.
+
+        * WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h:
+
+        * win/WebKit2.vcproj:
+
+2012-03-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Pinch zoom acts weirdly on nytimes.com while loading
+        https://webkit.org/b/80508
+
+        Reviewed by Simon Hausmann.
+
+        Make sure to suspend the page while doing pinch zooming.
+        If the page is suspended (which happens while pinch zooming)
+        then do not send touch events to the page, even if it has
+        listeners.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::handleTouchEvent):
+        * UIProcess/qt/QtViewportInteractionEngine.cpp:
+        (WebKit::QtViewportInteractionEngine::pinchGestureStarted):
+
+2012-03-05  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] QWebNavigationRequest 'action' property should have an enum type instead of int
+        https://bugs.webkit.org/show_bug.cgi?id=80164
+
+        Reviewed by Simon Hausmann.
+
+        Use the appropriate enum type instead of int. Make IgnoreRequest have a bigger
+        value that give some room for us to put Experimental values in the middle. This
+        way the Experimental values are in a valid range for the original enumeration. To
+        avoid confusion, the Experimental enumeration was renamed.
+
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qwebnavigationrequest.cpp:
+        (QWebNavigationRequestPrivate):
+        (QWebNavigationRequest::setAction):
+        (QWebNavigationRequest::action):
+        * UIProcess/API/qt/qwebnavigationrequest_p.h:
+        * UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp:
+
+2012-03-07  Andras Becsi  <andras.becsi@nokia.com>
+
+        [WK2] Make it possible to build without geolocation support
+        https://bugs.webkit.org/show_bug.cgi?id=80426
+
+        Reviewed by Simon Hausmann.
+
+        Add missing guards.
+
+        * UIProcess/GeolocationPermissionRequestManagerProxy.cpp:
+        (WebKit::GeolocationPermissionRequestManagerProxy::didReceiveGeolocationPermissionDecision):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::close):
+        (WebKit::WebPageProxy::processDidCrash):
+        * WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+        (WebKit):
+        * WebProcess/WebPage/WebPage.h:
+        (WebPage):
+        * WebProcess/WebPage/WebPage.messages.in:
+
+2012-03-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Make the removal of transitive library dependencies work with CMake < 2.8.7.
+        https://bugs.webkit.org/show_bug.cgi?id=80469
+
+        Reviewed by Antonio Gomes.
+
+        * CMakeLists.txt: Manually set the LINK_INTERFACE_LIBRARIES target
+        property on the library being created.
+
+2012-03-06  Hugo Parente Lima  <hugo.lima@openbossa.org>
+
+        MiniBrowser --window-size 480x800 www.nytimes.com doesn't paint bottom tiles.
+        https://bugs.webkit.org/show_bug.cgi?id=80313
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix the math to get the visible rectangle and add a method to get it.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::visibleContentsRect):
+        (QQuickWebViewFlickablePrivate::_q_commitScaleChange):
+        (QQuickWebViewPrivate::_q_commitPositionChange):
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Hide dock button when not allowed to dock
+        https://bugs.webkit.org/show_bug.cgi?id=78575
+
+        Reviewed by Pavel Feldman.
+
+        * WebProcess/WebCoreSupport/WebInspectorClient.cpp:
+        (WebKit::WebInspectorClient::didResizeMainFrame):
+        * WebProcess/WebCoreSupport/WebInspectorClient.h:
+        * WebProcess/WebPage/WebInspector.cpp:
+        (WebKit::WebInspector::updateDockingAvailability):
+        * WebProcess/WebPage/WebInspector.h:
+
+2012-03-06  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt] Interaction Engine suspends content during pageload.
+        https://bugs.webkit.org/show_bug.cgi?id=80294
+
+        Only suspend content when viewport updates are deferred
+        for a non-instantanious interaction.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/qt/QtViewportInteractionEngine.cpp:
+        (WebKit::ViewportUpdateDeferrer::ViewportUpdateDeferrer):
+        (WebKit::ViewportUpdateDeferrer::~ViewportUpdateDeferrer):
+        (WebKit::QtViewportInteractionEngine::QtViewportInteractionEngine):
+        (WebKit::QtViewportInteractionEngine::flickableMoveStarted):
+        (WebKit::QtViewportInteractionEngine::scaleAnimationStateChanged):
+        * UIProcess/qt/QtViewportInteractionEngine.h:
+        (QtViewportInteractionEngine):
+
+2012-03-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Make QQuickWebView's url property work with a flickable webview
+
+        Reviewed by Tor Arne Vestbø.
+
+        QQuickWebViewPrivate::onComponentComplete implements the deferred url loading
+        when the url property is set in the component instantiation. QQuickWebViewFlickablePrivate
+        is the private sub-class used for a flickable webview, which re-implemented onComponentComplete
+        but forgot to call the base implementation.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewFlickablePrivate::onComponentComplete):
+
+2012-03-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Fix several documentation issues in WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=80281
+
+        Reviewed by Martin Robinson.
+
+        * UIProcess/API/gtk/WebKitFindController.cpp:
+        * UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp:
+        (webkit_navigation_policy_decision_class_init):
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp:
+        * UIProcess/API/gtk/WebKitWebView.h:
+
+2012-03-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Use a single signal for script dialogs in WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=80271
+
+        Reviewed by Martin Robinson.
+
+        Add a new signal WebKitWebView::script-dialog that passes a
+        WebKitScriptDialog boxed type that can be used to build the dialog
+        and set the responses. It simplifies the API and makes it bindings
+        friendly.
+
+        * GNUmakefile.am:
+        * UIProcess/API/gtk/WebKitScriptDialog.cpp: Added.
+        (webkitScriptDialogCopy): Copy method for boxed type.
+        (webkitScriptDialogFree): Free method for boxed type.
+        (webkit_script_dialog_get_dialog_type): Return the type of dialog:
+        alert, confirm or prompt.
+        (webkit_script_dialog_get_message): Return the message of the dialog.
+        (webkit_script_dialog_confirm_set_confirmed): Set whether user
+        confirmed the dialog, for confirm dialogs.
+        (webkit_script_dialog_prompt_get_default_text): Get the default
+        text of prompt dialogs.
+        (webkit_script_dialog_prompt_set_text): Set the text entered by
+        the user, for prompt dialogs.
+        * UIProcess/API/gtk/WebKitScriptDialog.h: Added.
+        * UIProcess/API/gtk/WebKitScriptDialogPrivate.h: Added.
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkitWebViewScriptDialog): Default implementation of
+        WebKitWebView::script-dialog signal.
+        (webkit_web_view_class_init): Add WebKitWebView::script-dialog and
+        remove alert, confirm and propmpt.
+        (webkitWebViewRunJavaScriptAlert): Create a WebKitScriptDialog and
+        emit WebKitWebView::script-dialog signal.
+        (webkitWebViewRunJavaScriptConfirm): Ditto.
+        (webkitWebViewRunJavaScriptPrompt): Ditto.
+        * UIProcess/API/gtk/WebKitWebView.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt: Add new
+        symbols.
+        * UIProcess/API/gtk/docs/webkit2gtk.types: Add webkit_script_dialog_get_type().
+        * UIProcess/API/gtk/tests/TestWebKitWebView.cpp:
+        (testWebViewJavaScriptDialogs): Update javascript dialog test to
+        use the new API.
+        * UIProcess/API/gtk/webkit2marshal.list:
+        * UIProcess/API/gtk/webkit2.h:
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        putByIndex should throw in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=80335
+
+        Reviewed by Filip Pizlo.
+
+        Make the MethodTable PutByIndex trap take a boolean 'shouldThrow' parameter.
+
+        * WebProcess/Plugins/Netscape/NPJSObject.cpp:
+        (WebKit::NPJSObject::setProperty):
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed rollout of r109858 for restructuring.
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        <http://webkit.org/b/78575> Web Inspector: Hide dock button when not allowed to dock
+
+        Reviewed by Timothy Hatcher.
+
+        * WebProcess/WebCoreSupport/WebInspectorClient.cpp:
+        (WebKit::WebInspectorClient::updateDockingAvailability):
+        * WebProcess/WebCoreSupport/WebInspectorClient.h:
+        * WebProcess/WebPage/WebInspector.cpp:
+        (WebKit::WebInspector::updateDockingAvailability):
+        * WebProcess/WebPage/WebInspector.h:
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        pinch-to-zoom and double-tap flicker when using the new scrolling model
+        https://bugs.webkit.org/show_bug.cgi?id=80368
+        <rdar://problem/10866221>
+
+        Reviewed by Sam Weinig.
+
+        Add a way for drawing areas to respond to callback based force repaint requests asynchronously.
+        This is currently needed for the tiled drawing area when there might be outstanding scroll updates
+        that are sent from the scrolling thread to the main thread and we need to ensure that they're processed
+        before sending a message back.
+
+        * WebProcess/WebPage/DrawingArea.h:
+        (WebKit::DrawingArea::forceRepaintAsync):
+        Add new member function.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::forceRepaint):
+        Try forceRepaintAsync first.
+
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+        (WebKit::forceRepaintAndSendMessage):
+        Force the repaint and send the message.
+
+        (WebKit::dispatchBackToMainThread):
+        Dispatch a call to forceRepaintAndSendMessage to the main thread.
+
+        (WebKit::TiledCoreAnimationDrawingArea::forceRepaintAsync):
+        Dispatch a function on the scrolling thread. Its sole purpose is to dispatch a function back to the
+        main thread, ensuring that all previously dispatched functions have been executed.
+
+2012-03-05  Enrica Casucci  <enrica@apple.com>
+
+        Can't type on some websites (plug-ins steal key events).
+        <rdar://problem/10892291>
+
+        When the plugin is disabled, it is necessary to reset _pluginComplexTextInputIdentifier
+        in order to return the correct input context. Failure to do so results in the inputContext
+        method to return the plugin input context instead of the context of the browser view.
+        
+        Reviewed by Sam Weinig.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView _setPluginComplexTextInputState:]):
+        (-[WKView _handlePluginComplexTextInputKeyDown:]):
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Be more aggressive about repainting page overlays
+        https://bugs.webkit.org/show_bug.cgi?id=80336
+        <rdar://problem/10965943>
+
+        Reviewed by Simon Fraser.
+
+        Whenever we're flushing layers and we have a page overlay, check if the main frame
+        has scrolled or if the main frame root content layer needs to be repainted and force the
+        overlay layer to be repainted if either of those conditions are true.
+
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:
+        (TiledCoreAnimationDrawingArea):
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+        (WebKit::TiledCoreAnimationDrawingArea::flushLayers):
+        (WebKit::TiledCoreAnimationDrawingArea::shouldRepaintPageOverlayLayer):
+        (WebKit):
+
+2012-03-05  Sam Weinig  <sam@webkit.org>
+
+        Add support for hosting layers in the window server in WebKit2
+        <rdar://problem/10400246>
+        https://bugs.webkit.org/show_bug.cgi?id=80310
+
+        Reviewed by Anders Carlsson.
+
+        This currently only works if you are using TiledCoreAnimation drawing model.
+
+        * Platform/mac/LayerHostingContext.h: Renamed from Source/WebKit2/Platform/mac/RemoteLayerClient.h.
+        * Platform/mac/LayerHostingContext.mm: Renamed from Source/WebKit2/Platform/mac/RemoteLayerClient.mm.
+        (WebKit::LayerHostingContext::createForPort):
+        (WebKit::LayerHostingContext::LayerHostingContext):
+        (WebKit::LayerHostingContext::createForWindowServer):
+        (WebKit::LayerHostingContext::~LayerHostingContext):
+        (WebKit::LayerHostingContext::setRootLayer):
+        (WebKit::LayerHostingContext::rootLayer):
+        (WebKit::LayerHostingContext::contextID):
+        (WebKit::LayerHostingContext::invalidate):
+        Renamed RemoteLayerClient to LayerHostingContext and add ability to use the window server
+        as the remote context.
+
+        * PluginProcess/PluginControllerProxy.cpp:
+        * PluginProcess/PluginControllerProxy.h:
+        * PluginProcess/mac/PluginControllerProxyMac.mm:
+        Update for new names.
+
+        * Shared/LayerTreeContext.h:
+        Add LayerHostingMode enum.
+
+        * UIProcess/PageClient.h:
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::layerHostingMode):
+        (WebKit::PageClientImpl::updateAcceleratedCompositingMode):
+        Add PageClient access points to get the current layer hosting mode,
+        and a hook to tell the underlying view that the layer hosting context
+        has changed.
+
+        * UIProcess/API/mac/WKViewInternal.h:
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView _updateAcceleratedCompositingMode:WebKit::]):
+        Implement responding to a new layer hosting context as a simple
+        exit and re-entrance of compositing.
+
+        * UIProcess/DrawingAreaProxy.h:
+        (WebKit::DrawingAreaProxy::layerHostingModeDidChange):
+        (WebKit::DrawingAreaProxy::updateAcceleratedCompositingMode):
+        * UIProcess/DrawingAreaProxy.messages.in:
+        * UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.h:
+        (TiledCoreAnimationDrawingAreaProxy):
+        * UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm:
+        (WebKit::TiledCoreAnimationDrawingAreaProxy::layerHostingModeDidChange):
+        (WebKit::TiledCoreAnimationDrawingAreaProxy::updateAcceleratedCompositingMode):
+        Pipe layer hosting changes around.
+
+        * UIProcess/WebPageProxy.h:
+        (WebKit::WebPageProxy::layerHostingMode):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::WebPageProxy):
+        (WebKit::WebPageProxy::viewStateDidChange):
+        Cache the current layer hosting mode so we don't overzealously
+        tell the WebProcess to reset its context. Re-check layer hosting
+        mode each time we are added/removed from a window.
+
+        * WebProcess/FullScreen/mac/WebFullScreenManagerMac.h:
+        * WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm:
+        Update for new names.
+
+        * WebProcess/WebPage/DrawingArea.h:
+        (WebKit::DrawingArea::setDeviceScaleFactor):
+        (WebKit::DrawingArea::setLayerHostingMode):
+        * WebProcess/WebPage/DrawingArea.messages.in:
+        Pipe layer hosting changes around.
+
+        * WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.h:
+        * WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm:
+        (WebKit::LayerTreeHostCAMac::~LayerTreeHostCAMac):
+        (WebKit::LayerTreeHostCAMac::platformInitialize):
+        (WebKit::LayerTreeHostCAMac::invalidate):
+        Update for new names.
+
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+        (WebKit::TiledCoreAnimationDrawingArea::TiledCoreAnimationDrawingArea):
+        (WebKit::TiledCoreAnimationDrawingArea::setLayerHostingMode):
+        Respond to a change in the layer hosting mode by invalidating our old context,
+        making a new one of the right type, and informing the UIProcess of our new context.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+        Add new files.
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Always update the scroll layer position on the main thread when we have an overlay
+        https://bugs.webkit.org/show_bug.cgi?id=80324
+
+        Reviewed by Sam Weinig.
+
+        Call setForceMainThreadScrollLayerPositionUpdates when installing and uninstalling page overlays,
+        so we'll be able to synchronize painting between the tile cache and the page overlays.
+
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+        (WebKit::TiledCoreAnimationDrawingArea::didInstallPageOverlay):
+        (WebKit::TiledCoreAnimationDrawingArea::didUninstallPageOverlay):
+
+2012-03-05  Timothy Hatcher  <timothy@apple.com>
+
+        Change how the Web Inspector Develop menu actions work.
+
+        This removes the methods used by Safari's Develop menu. They can now be implemented in Safari.
+
+        https://webkit.org/b/80308
+
+        Reviewed by John Sullivan.
+
+        * UIProcess/API/C/mac/WKInspectorPrivateMac.h: Renamed from Source/WebKit2/UIProcess/API/C/mac/WKInspectorMac.h.
+        * UIProcess/mac/WebInspectorProxyMac.mm:
+        (-[WKWebInspectorProxyObjCAdapter inspectorRef]): Added.
+        * WebKit2.xcodeproj/project.pbxproj: Renamed WKInspectorPrivateMac.h to better reflect its private nature.
+
+2012-03-02  Jon Lee  <jonlee@apple.com>
+
+        Add support for notification replaceId in Mac WebKit and WK2
+        https://bugs.webkit.org/show_bug.cgi?id=80206
+        <rdar://problem/10965574>
+
+        Reviewed by Sam Weinig.
+
+        * UIProcess/API/C/WKNotification.cpp: Add WK API.
+        (WKNotificationCopyReplaceID):
+        * UIProcess/API/C/WKNotification.h:
+        * UIProcess/Notifications/WebNotification.cpp:
+        (WebKit::WebNotification::WebNotification):
+        * UIProcess/Notifications/WebNotification.h: Add replaceID member.
+        (WebKit::WebNotification::create):
+        (WebKit::WebNotification::replaceID):
+        (WebNotification):
+        * UIProcess/Notifications/WebNotificationManagerProxy.cpp:
+        (WebKit::WebNotificationManagerProxy::show):
+        * UIProcess/Notifications/WebNotificationManagerProxy.h:
+        (WebNotificationManagerProxy):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::showNotification):
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+        * UIProcess/WebPageProxy.messages.in: Add replaceID to the showNotification message.
+        * WebProcess/Notifications/WebNotificationManager.cpp:
+        (WebKit::WebNotificationManager::show):
+
+2012-03-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r109748.
+        http://trac.webkit.org/changeset/109748
+        https://bugs.webkit.org/show_bug.cgi?id=80296
+
+        Made some tests crash, will fix and recommit (Requested by
+        noamr on #webkit).
+
+        * Target.pri:
+        * UIProcess/API/qt/qquickwebpage.cpp:
+        (QQuickWebPagePrivate::paintToCurrentGLContext):
+        (PageProxyNode::PageProxyNode):
+        (PageProxyNode):
+        (PageProxyNode::changedStates):
+        (PageProxyNode::render):
+        (PageProxyNode::~PageProxyNode):
+        (QQuickWebPage::updatePaintNode):
+        (QQuickWebPagePrivate::updateSize):
+        (QQuickWebPagePrivate::resetPaintNode):
+        (QQuickWebPagePrivate::~QQuickWebPagePrivate):
+        * UIProcess/API/qt/qquickwebpage_p_p.h:
+        (QQuickWebPagePrivate):
+        * UIProcess/DrawingAreaProxy.h:
+        (WebKit):
+        (WebKit::DrawingAreaProxy::layerTreeHostProxy):
+        (DrawingAreaProxy):
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::DrawingAreaProxyImpl):
+        (WebKit::DrawingAreaProxyImpl::enterAcceleratedCompositingMode):
+        * UIProcess/LayerTreeHostProxy.h:
+        (LayerTreeHostProxy):
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp:
+        (WebKit::LayerTreeHostProxy::syncAnimations):
+        (WebKit::LayerTreeHostProxy::updateViewport):
+        (WebKit::LayerTreeHostProxy::syncLayerParameters):
+        (WebKit::LayerTreeHostProxy::flushLayerChanges):
+        (WebKit::LayerTreeHostProxy::ensureRootLayer):
+        (WebKit::LayerTreeHostProxy::syncRemoteContent):
+        (WebKit::LayerTreeHostProxy::dispatchUpdate):
+        (WebKit):
+        (WebKit::LayerTreeHostProxy::createDirectlyCompositedImage):
+        (WebKit::LayerTreeHostProxy::purgeGLResources):
+        * UIProcess/qt/QtWebPageSGNode.cpp: Removed.
+        * UIProcess/qt/QtWebPageSGNode.h: Removed.
+
+2012-03-05  Joone Hur  <joone.hur@collabora.co.uk>
+
+        [GTK] zlib link error with --enable-webkit2
+        https://bugs.webkit.org/show_bug.cgi?id=79877
+
+        Reviewed by Martin Robinson.
+
+        zlib should be linked properly.
+
+        * GNUmakefile.am: Link $(ZLIB_LIBS) with libwebkit2gtk instead of
+        linking it with WebKitWebProcess.
+
+2012-03-05  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [WK2] WKPageGetContextMenuFromProposedContextMenuCallback should pass a HitTestResult
+        https://bugs.webkit.org/show_bug.cgi?id=77208
+
+        Reviewed by Anders Carlsson.
+
+        A HitTestResultData is now passed to ShowContextMenu WebPageProxy
+        message instead of the ContextMenuState. ContextMenu client has
+        been updated to pass the HitTestResult to the
+        getContextMenuFromProposedMenu callback.
+
+        * GNUmakefile.am: Remove ContextMenuState.h.
+        * Shared/APIClientTraits.h:
+        * Shared/ContextMenuState.h: Removed.
+        * Shared/WebHitTestResult.h:
+        (WebKit::WebHitTestResult::Data::Data): Add constructor that takes
+        a WebCore::HitTestResult.
+        * UIProcess/API/C/WKPage.h: Add HitTestResult parameter to
+        getContextMenuFromProposedMenu callback and deprecate the old
+        version.
+        * UIProcess/WebPageContextMenuClient.cpp:
+        (WebKit::WebPageContextMenuClient::getContextMenuFromProposedMenu):
+        Pass a HitTestResult to getContextMenuFromProposedMenu or use the
+        deprecated one if client version is an old one.
+        * UIProcess/WebPageContextMenuClient.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::showContextMenu):
+        (WebKit::WebPageProxy::internalShowContextMenu): Save the
+        WebHitTestResult::Data to use it for handling context menu actions.
+        (WebKit::WebPageProxy::contextMenuItemSelected): Use the saved
+        WebHitTestResult::Data.
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * WebKit2.xcodeproj/project.pbxproj: Remove ContextMenuState.h.
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::mouseDidMoveOverElement): Use the new
+        WebHitTestResult::Data constructor that takes a WebCore::HitTestResult.
+        * WebProcess/WebPage/WebContextMenu.cpp:
+        (WebKit::WebContextMenu::show): Create a WebHitTestResult::Data
+        instead of a ContextMenuState and pass it to ShowContextMenu message.
+        * win/WebKit2.vcproj: ContextMenuState.h.
+
+2012-03-05  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] [WK2] Support threaded renderer in WK2
+        https://bugs.webkit.org/show_bug.cgi?id=76661
+
+        Made the appropriate fixes in the UI process code to make rendering thread-safe.
+        - Separated the scenegraph node code to QtWebPageSGNode. QtWebPageSGNode has direct access
+          to LayerTreeHostProxy.
+
+        - Each function in LayerTreeHostProxy can be either called from the main thread (handling
+          messages from the web process), or from the renderer thread (handling the GL context).
+          The render-queue is locked with a mutex, and messages back to the web process are sent
+          via callOnMainThread.
+
+        - LayerTreeHostProxy is now ThreadSafeRefCounted. That is done to make sure that the GL
+          resources it creates are only freed when the QtWebPageSGNode is deleted, which can be
+          before or after the owning DrawingAreaProxy is deleted. This ensures that the class is
+          deleted only after its GL resources are freed, otherwise those resources may leak.
+
+        Based on a patch by Viatcheslav Ostapenko.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Target.pri: Added new files.
+        * UIProcess/API/qt/qquickwebpage.cpp: Moved QtWebPageSGNode out.
+        (QQuickWebPage::updatePaintNode): Call QtWebPageSGNode
+        (QQuickWebPagePrivate::updateSize): Call QtWebPageSGNode
+        (QQuickWebPagePrivate::didDeleteSGWebPageNode): Override QtWebPageSGNode::Client
+        (QQuickWebPagePrivate::~QQuickWebPagePrivate):
+        * UIProcess/API/qt/qquickwebpage_p_p.h:
+        (QQuickWebPagePrivate):
+        * UIProcess/DrawingAreaProxy.h:
+        (WebKit):
+        (WebKit::DrawingAreaProxy::layerTreeHostProxy): Made LayerTreeHostProxy ref-counted.
+        (DrawingAreaProxy):
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::DrawingAreaProxyImpl):
+        (WebKit::DrawingAreaProxyImpl::enterAcceleratedCompositingMode):
+        * UIProcess/LayerTreeHostProxy.h:
+        (WebKit):
+        (WebKit::LayerTreeHostProxy::create):
+        (LayerTreeHostProxy):
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp:
+        (WebKit::LayerTreeHostProxy::paintToCurrentGLContext):
+        (WebKit):
+        (MainThreadGuardedInvoker):
+            A class that allows invoking functions in the main thread, while guarding a ref-
+            counted object.
+
+        (WebKit::MainThreadGuardedInvoker::call):
+        (WebKit::MainThreadGuardedInvoker::MainThreadGuardedInvoker):
+        (WebKit::MainThreadGuardedInvoker::invoke):
+        (WebKit::LayerTreeHostProxy::syncAnimations):
+        (WebKit::LayerTreeHostProxy::updateViewport):
+        (WebKit::LayerTreeHostProxy::detachDrawingArea):
+        (WebKit::LayerTreeHostProxy::syncLayerParameters):
+        (WebKit::LayerTreeHostProxy::setShouldRenderNextFrame):
+        (WebKit::LayerTreeHostProxy::flushLayerChanges):
+        (WebKit::LayerTreeHostProxy::ensureRootLayer):
+        (WebKit::LayerTreeHostProxy::syncRemoteContent):
+        (WebKit::LayerTreeHostProxy::dispatchUpdate):
+        (WebKit::LayerTreeHostProxy::createDirectlyCompositedImage):
+        (WebKit::LayerTreeHostProxy::purgeGLResources):
+        * UIProcess/qt/QtWebPageSGNode.cpp: Added.
+        * UIProcess/qt/QtWebPageSGNode.h: Added.
+
+2012-03-04  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Libraries are installed to /usr/lib and not /usr/lib64 on x86_64
+        https://bugs.webkit.org/show_bug.cgi?id=71507
+
+        Reviewed by Antonio Gomes.
+
+        * CMakeLists.txt: Use ${LIB_INSTALL_DIR} instead of hardcoding "lib".
+
+2012-03-03  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix static_libs_as_shared build
+        https://bugs.webkit.org/show_bug.cgi?id=80214
+
+        Reviewed by Tor Arne Vestbø.
+
+        Replace (static) link time dependency to WK1 with entrypoint
+        in the separate WebProcess for activating the QStyle theme if
+        necessary.
+
+        * Target.pri:
+        * UIProcess/Launcher/ProcessLauncher.h:
+        * WebProcess/qt/WebProcessMainQt.cpp:
+        (WebKit::WebProcessMainQt):
+        * qt/MainQt.cpp:
+        (WebKit):
+        (main):
+
+2012-03-03  Hans Wennborg  <hans@chromium.org>
+
+        Implement Speech JavaScript API
+        https://bugs.webkit.org/show_bug.cgi?id=80019
+
+        Reviewed by Adam Barth.
+
+        Add ENABLE_SCRIPTED_SPEECH.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-03  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Use the existing inheritedOpacity/matrix properties of QSGNode
+        https://bugs.webkit.org/show_bug.cgi?id=79543
+
+        Use QSGNode::inheritedOpacity() and QSGNode::matrix().
+        Also, remove flags from changedStates() that we don't actually touch.
+        This is covered by existing API tests.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/API/qt/qquickwebpage.cpp:
+        (QQuickWebPagePrivate::paintToCurrentGLContext):
+        (PageProxyNode::changedStates):
+        (PageProxyNode::render):
+        * UIProcess/API/qt/qquickwebpage_p_p.h:
+        (QQuickWebPagePrivate):
+
+2012-03-03  Anders Carlsson  <andersca@apple.com>
+
+        Fix build with newer versions of clang.
+
+        * WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:
+        (WebKit::NPN_GetValue):
+        Cast the switch parameter to unsigned to prevent warnings about case values not being part of the enum type.
+
+2012-03-02  Andy Estes  <aestes@apple.com>
+
+        Move nsStringFromWebCoreString out of PageClientImpl
+        https://bugs.webkit.org/show_bug.cgi?id=80202
+
+        Reviewed by Sam Weinig.
+
+        nsStringFromWebCoreString() doesn't really belong in PageClientImpl.mm,
+        and it makes us include PageClientImpl.h in places where we shouldn't.
+        Move this function into StringUtilities.{h, mm}.
+
+        * Platform/mac/StringUtilities.h: Added.
+        * Platform/mac/StringUtilities.mm: Added.
+        (WebKit::nsStringFromWebCoreString):
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        * UIProcess/API/mac/WKView.mm:
+        * UIProcess/mac/WebContextMenuProxyMac.mm:
+        * UIProcess/mac/WebPageProxyMac.mm:
+        * UIProcess/mac/WebPopupMenuProxyMac.mm:
+        * UIProcess/mac/WebPreferencesMac.mm:
+        * WebKit2.xcodeproj/project.pbxproj:
+
+2012-03-02  Andy Estes  <aestes@apple.com>
+
+        Remove com.apple.WebKit.PluginProcess.sb from WebKit2.xcodeproj's Headers build phase
+        https://bugs.webkit.org/show_bug.cgi?id=80197
+
+        Reviewed by Alexey Proskuryakov.
+
+        It doesn't belong there, and it makes Xcode consider the project to be
+        invalid, triggering assertions in some builds of Xcode.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+
+2012-03-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Fix spelling mistake in header guard
+
+        Reviewed by Noam Rosenthal.
+
+        * UIProcess/API/qt/qwebviewportinfo_p.h:
+
+2012-03-02  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Invalid check in webkit_web_view_set_zoom_level() when zoom-text-only is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=80150
+
+        Reviewed by Philippe Normand.
+
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkit_web_view_set_zoom_level): Use
+        webkit_web_view_get_zoom_level() instead of
+        WKPageGetPageZoomFactor() to get the current effective zoom level
+        depending on zoom-text-only setting.
+
+2012-03-02  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Fix build on AppleWebKit after 109548.
+
+        * mac/WebKit2.order:
+
+2012-03-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix tests run with WTR not using QStyle theme
+        https://bugs.webkit.org/show_bug.cgi?id=80147
+
+        Reviewed by Csaba Osztrogonác.
+
+        Use an environment variable (set by WTR) to select the QStyle theme.
+        This is a temporary kludge until we rebase the layout tests to use the
+        QStyle independent "mobile" theme. This also temporarily breaks the
+        force_static_libs_as_shared build.
+
+        * Target.pri:
+        * WebProcess/qt/WebProcessMainQt.cpp:
+        (WebKit::WebProcessMainQt):
+
+2012-03-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Compile WebCore without QtWidgets
+        https://bugs.webkit.org/show_bug.cgi?id=80141
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Shared/qt/WebEventFactoryQt.cpp: Removed unnecessary include.
+        * Target.pri: Require widgets for WK2 for the moment, until bug #79458
+        is fixed.
+
+2012-03-02  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Suspend/Resume API for pausing timers and animations.
+        https://bugs.webkit.org/show_bug.cgi?id=76063
+
+        Based on the initial work of Zalan Bujtas <zalan.bujtas@nokia.com>,
+
+        Adds suspend and resume API for WebKit2 and uses it in Qt to
+        suspend animations and DOM timers during panning and zoom.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewFlickablePrivate::_q_suspend):
+        (QQuickWebViewFlickablePrivate::_q_resume):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::WebPageProxy):
+        (WebKit::WebPageProxy::resumeActiveDOMObjectsAndAnimations):
+        (WebKit::WebPageProxy::suspendActiveDOMObjectsAndAnimations):
+        (WebKit::WebPageProxy::processDidCrash):
+        * UIProcess/WebPageProxy.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::suspendActiveDOMObjectsAndAnimations):
+        (WebKit::WebPage::resumeActiveDOMObjectsAndAnimations):
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in:
+
+2012-03-02  Joone Hur  <joone.hur@collabora.co.uk>
+
+        Unreviewed. Fix WebKit2 GTK+ build.
+
+        * GNUmakefile.am: allow WebKitWebProcess to link with zlib properly.
+
+2012-03-01  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Make the interaction with the Flickable work on the N9
+        https://bugs.webkit.org/show_bug.cgi?id=80029
+
+        Reviewed by Simon Hausmann.
+
+        Because the WebView item accepts all touch events it receives and sends
+        them to the web process before propagating them to the gesture recognizers,
+        which is correct behaviour, we can not rely on the touch->mouse conversion
+        of Qt5 when controlling Flickable. Hence we need to convert the received
+        touch events to mouse events in the QtFlickProvider.
+
+        * UIProcess/qt/QtFlickProvider.cpp:
+        (QtFlickProvider::handleTouchFlickEvent):
+        Do the touch to mouse event conversion for the Flickable.
+        * UIProcess/qt/QtPanGestureRecognizer.cpp:
+        (WebKit::QtPanGestureRecognizer::recognize):
+        A touch begin event should cancel the previous pan gesture
+        and stop the ongoing flick animation.
+
+2012-03-01  Anders Carlsson  <andersca@apple.com>
+
+        Assertion failure in pageContainsAnyHorizontalScrollbars() (scrollableArea->isOnActivePage()) when leaving pages with embedded PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=80044
+        <rdar://problem/10919940>
+
+        Reviewed by Brady Eidson.
+
+        Remove the code that would add and remove wheel event handlers since that's not what we want to track.
+        Instead, dynamically add and remove the view as its scrollbars come and go.
+
+        * WebProcess/Plugins/PDF/BuiltInPDFView.cpp:
+        (WebKit::BuiltInPDFView::updateScrollbars):
+        (WebKit::BuiltInPDFView::initialize):
+        * WebProcess/Plugins/PDF/BuiltInPDFView.h:
+        (BuiltInPDFView):
+
+2012-03-01  Kangil Han  <kangil.han@samsung.com>
+
+        [DRT] Remove all PlainTextController usages in existing tests by adding internal API
+        https://bugs.webkit.org/show_bug.cgi?id=78570
+
+        Reviewed by Hajime Morita.
+
+        This patch will remove all PlainTextController usages
+        in existing DRT tests by adding internal API to WebCore/testing/Internals
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-03-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Unreviewed, rolling out r109255.
+        http://trac.webkit.org/changeset/109255
+        https://bugs.webkit.org/show_bug.cgi?id=79932
+
+        Breaks rounded rects with dashed strokes in SVG
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2012-03-01  Sergio Villar Senin  <svillar@igalia.com>
+
+        [WK2] [GTK] [libsoup] SoupSession should use system CA
+        https://bugs.webkit.org/show_bug.cgi?id=79657
+
+        Reviewed by Martin Robinson.
+
+        SoupSession sould use system CA list to validate SSL
+        certificates. Do not use strict certificate validation though as
+        we want clients to decide whether or not accept/decline invalid
+        certificates (API to be added later).
+
+        No new tests required as current behaviour does not change at all
+        as we continue to accept invalid certificates by default.
+
+        * WebProcess/gtk/WebProcessMainGtk.cpp:
+        (WebKit::WebProcessMainGtk):
+
+2012-03-01  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix WebKit2 GTK+ build.
+
+        * UIProcess/API/gtk/WebKitDefines.h:
+        * UIProcess/API/gtk/WebKitWebView.h:
+
+2012-02-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt][WK2] QQuickWebView::event should lookup faster which events QQuickWebPage can handle
+        https://bugs.webkit.org/show_bug.cgi?id=78047
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Replaced double-dispatch of events with direct forwarding of events from QQuickWebView::*Event to
+        QtWebPageEventHandler::handle*Event.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebView::keyPressEvent):
+        (QQuickWebView::keyReleaseEvent):
+        (QQuickWebView::inputMethodEvent):
+        (QQuickWebView::focusInEvent):
+        (QQuickWebView::focusOutEvent):
+        (QQuickWebView::touchEvent):
+        (QQuickWebView::mousePressEvent):
+        (QQuickWebView::mouseMoveEvent):
+        (QQuickWebView::mouseReleaseEvent):
+        (QQuickWebView::mouseDoubleClickEvent):
+        (QQuickWebView::wheelEvent):
+        (QQuickWebView::hoverEnterEvent):
+        (QQuickWebView::hoverMoveEvent):
+        (QQuickWebView::hoverLeaveEvent):
+        (QQuickWebView::dragMoveEvent):
+        (QQuickWebView::dragEnterEvent):
+        (QQuickWebView::dragLeaveEvent):
+        (QQuickWebView::dropEvent):
+        (QQuickWebView::event):
+        * UIProcess/qt/QtWebPageEventHandler.cpp:
+        (QtWebPageEventHandler::handleMouseMoveEvent):
+        (QtWebPageEventHandler::handleMousePressEvent):
+        (QtWebPageEventHandler::handleMouseReleaseEvent):
+        (QtWebPageEventHandler::handleWheelEvent):
+        (QtWebPageEventHandler::handleHoverLeaveEvent):
+        (QtWebPageEventHandler::handleHoverMoveEvent):
+        (QtWebPageEventHandler::handleDragEnterEvent):
+        (QtWebPageEventHandler::handleDragLeaveEvent):
+        (QtWebPageEventHandler::handleDragMoveEvent):
+        (QtWebPageEventHandler::handleDropEvent):
+        (QtWebPageEventHandler::handleKeyPressEvent):
+        (QtWebPageEventHandler::handleKeyReleaseEvent):
+        (QtWebPageEventHandler::handleFocusInEvent):
+        (QtWebPageEventHandler::handleFocusOutEvent):
+        (QtWebPageEventHandler::handleInputMethodEvent):
+        (QtWebPageEventHandler::handleTouchEvent):
+        * UIProcess/qt/QtWebPageEventHandler.h:
+        (QtWebPageEventHandler):
+
+2012-03-01  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt][WK2] Unreviewed buildfix after r109277.
+
+        * WebProcess/qt/QtBuiltinBundlePage.cpp:
+        (WebKit::QtBuiltinBundlePage::QtBuiltinBundlePage):
+
+2012-02-29  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Get rid of the #ifdef mess in LayerTreeHost[Proxy]
+        https://bugs.webkit.org/show_bug.cgi?id=79501
+
+        Use a new UI_SIDE_COMPOSITING flag instead of the several #ifdef flags we currently use.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Shared/WebLayerTreeInfo.cpp:
+        * Shared/WebLayerTreeInfo.h:
+        * UIProcess/DrawingAreaProxy.cpp:
+        (WebKit):
+        * UIProcess/DrawingAreaProxy.h:
+        (DrawingAreaProxy):
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::DrawingAreaProxyImpl):
+        (WebKit::DrawingAreaProxyImpl::enterAcceleratedCompositingMode):
+        (WebKit):
+        * UIProcess/DrawingAreaProxyImpl.h:
+        (DrawingAreaProxyImpl):
+        * UIProcess/LayerTreeHostProxy.h:
+        (LayerTreeHostProxy):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didReceiveMessage):
+        * UIProcess/qt/LayerBackingStore.cpp:
+        * UIProcess/qt/LayerBackingStore.h:
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp:
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.cpp:
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.h:
+        * WebProcess/WebPage/DrawingArea.h:
+        (DrawingArea):
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit):
+        * WebProcess/WebPage/DrawingAreaImpl.h:
+        (DrawingAreaImpl):
+        * WebProcess/WebPage/LayerTreeHost.cpp:
+        (WebKit::LayerTreeHost::create):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.cpp:
+        (WebKit::LayerTreeHostQt::purgeBackingStores):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.h:
+        (LayerTreeHostQt):
+
+2012-02-28  Brian Weinstein  <bweinstein@apple.com>
+
+        WebKit2: didNewFirstVisuallyNonEmptyLayout should be sent to injected bundle
+        https://bugs.webkit.org/show_bug.cgi?id=79849
+        
+        Tell the injected bundle about didNewFirstVisuallyNonEmptyLayout (we currently
+        just tell the UI process).
+
+        Reviewed by Beth Dakin.
+
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.h: Add didNewFirstVisuallyNonEmptyLayout to version 1.
+        * WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp:
+        (WebKit::InjectedBundlePageLoaderClient::didNewFirstVisuallyNonEmptyLayout): Call through to the
+            client.
+        * WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h:
+        (InjectedBundlePageLoaderClient):
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::dispatchDidNewFirstVisuallyNonEmptyLayout): Tell the injected
+            bundle.
+
+2012-02-29  Tim Horton  <timothy_horton@apple.com>
+
+        Make use of CG rounded-rect primitives
+        https://bugs.webkit.org/show_bug.cgi?id=79932
+        <rdar://problem/9274953>
+
+        Reviewed by Simon Fraser.
+
+        Add wkCGPathAddRoundedRect.
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2012-02-29  Andy Estes  <aestes@apple.com>
+
+        CFURLDownloadScheduleWithCurrentMessageQueue only exists on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=79936
+
+        Reviewed by Brady Eidson.
+
+        CFURLDownloadScheduleWithCurrentMessageQueue only exists on Windows
+        platforms. Non-Windows platforms that use CFNetwork-based downloads
+        should omit this call.
+
+        * WebProcess/Downloads/cfnet/DownloadCFNet.cpp:
+        (WebKit::Download::start):
+
+2012-02-29  Rafael Brandao  <rafael.lobo@openbossa.org>
+
+        [Qt][WK2] We should not add NetscapeBrowserFuncs.cpp as header
+        https://bugs.webkit.org/show_bug.cgi?id=79847
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Target.pri: Fix typo, so we can add ".h" file instead.
+
+2012-02-29  Sam Weinig  <sam@webkit.org>
+
+        When invoking Lookup while zoomed in, the highlighted word renders out of line
+        <rdar://problem/10812527>
+
+        Reviewed by Simon Fraser.
+
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::performDictionaryLookupForRange):
+        Make sure to scale the ascent when determining the origin for the overlay.
+
+2012-02-29  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Use text or page zoom factor in WebKitWebView depending on zoom-text-only
+        https://bugs.webkit.org/show_bug.cgi?id=75252
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (zoomTextOnlyChanged): Update text/page zoom factor when
+        zoom-text-only setting changes.
+        (webkitWebViewSetSettings): Helper function to set the settings
+        object for the web view, initializing the settings for the page
+        and connecting to notify::zoom-text-only signal.
+        (webkitWebViewConstructed): Use webkitWebViewSetSettings().
+        (webkit_web_view_set_settings): Use webkitWebViewSetSettings() and
+        disconnect from the notify::zoom-text-only signal of the previous
+        settings object.
+        (webkit_web_view_set_zoom_level): Set text/page zoom factor
+        depending on WebKitSettings:zoom-text-only property.
+        (webkit_web_view_get_zoom_level): Get text/page zoom factor
+        depending on WebKitSettings:zoom-text-only property.
+        * UIProcess/API/gtk/tests/TestWebKitWebView.cpp:
+        (testWebViewZoomLevel):
+
+2012-02-29  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add zoom-text-only setting to WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=75249
+
+        Reviewed by Gustavo Noronha Silva.
+
+        To set whether zoom level of web view should affect only the text
+        or all page contents. It's disabled by default.
+
+        * UIProcess/API/gtk/WebKitSettings.cpp:
+        (webKitSettingsSetProperty):
+        (webKitSettingsGetProperty):
+        (webkit_settings_class_init): Add WebKitSettings:zoom-text-only
+        property.
+        (webkit_settings_set_zoom_text_only): Set
+        WebKitSettings:zoom-text-only.
+        (webkit_settings_get_zoom_text_only): Get
+        WebKitSettings:zoom-text-only.
+        * UIProcess/API/gtk/WebKitSettings.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt: Add new
+        symbols.
+        * UIProcess/API/gtk/tests/TestWebKitSettings.cpp:
+        (testWebKitSettings):
+
+2012-02-29  Sergio Villar Senin  <svillar@igalia.com>
+
+        DidFindString should be emitted even if FindOptionsShowOverlay is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=76522
+
+        Reviewed by Darin Adler.
+
+        DidFindString message should be issued always even if neither
+        FindOptionsShowOverlay or FindOptionsShowHighlight are
+        provided. The difference is that if any of those flags are present
+        the find operation will look for all the appearances of the text
+        in the web view, otherwise it will just look and report the next
+        occurrence.
+
+        This patch removes the temporary workaround added in r109222 to
+        the WebKitFindController unit tests.
+
+        * UIProcess/API/gtk/tests/TestWebKitFindController.cpp:
+        * WebProcess/WebPage/FindController.cpp:
+        (WebKit::FindController::findString):
+
+2012-01-19  Sergio Villar Senin  <svillar@igalia.com>
+
+        [GTK] [WK2] Add Find API
+        https://bugs.webkit.org/show_bug.cgi?id=76070
+
+        Reviewed by Martin Robinson.
+
+        This patch adds a new public find API for the Gtk+ WK2 port. It
+        defines a new object called WebKitFindController owned by each
+        WebKitWebView. Clients will use this new object to search strings
+        in the WebKitWebView.
+
+        Changes include also documentation and unit tests for the new
+        public API.
+
+        * GNUmakefile.am:
+        * UIProcess/API/gtk/WebKitDefines.h:
+        * UIProcess/API/gtk/WebKitFindController.cpp: Added.
+        (didFindString): implementation of the WKPage Find interface.
+        (didFailToFindString): Ditto.
+        (didCountStringMatches): Ditto.
+        (webkit_find_controller_init):
+        (getWKPageFromWebKitWebView):
+        (webkitFindControllerConstructed):
+        (webkitFindControllerGetProperty):
+        (webkitFindControllerSetProperty):
+        (webkitFindControllerFinalize):
+        (webkit_find_controller_class_init):
+        (webkit_find_controller_get_search_text):
+        (webkit_find_controller_get_options):
+        (webkit_find_controller_get_max_match_count):
+        (webkit_find_controller_get_web_view):
+        (webKitFindControllerPerform):
+        (webKitFindControllerSetSearchData):
+        (webkit_find_controller_search): asynchronously looks for the
+        search string in the WebKitWebView.
+        (webkit_find_controller_search_finish): unhighlights text matches.
+        (webkit_find_controller_search_next):
+        (webkit_find_controller_search_previous):
+        (webkit_find_controller_count_matches): asynchronously counts the
+        number of matches of the search string in the WebKitWebView.
+        * UIProcess/API/gtk/WebKitFindController.h: Added.
+        * UIProcess/API/gtk/WebKitPrivate.h:
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkit_web_view_get_find_controller): returns the
+        WebKitFindController instance owned by the WebKitWebView.
+        * UIProcess/API/gtk/WebKitWebView.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-docs.sgml:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt:
+        * UIProcess/API/gtk/docs/webkit2gtk.types:
+        * UIProcess/API/gtk/tests/GNUmakefile.am:
+        * UIProcess/API/gtk/tests/TestWebKitFindController.cpp: Added.
+        (testFindControllerTextFound):
+        (testFindControllerTextNotFound):
+        (testFindControllerMatchCount):
+        (testFindControllerMaxMatchCount):
+        (testFindControllerNext):
+        (testFindControllerPrevious):
+        (testFindControllerCountedMatches):
+        (testFindControllerOptions):
+        (testFindControllerInstance):
+        (testFindControllerGetters):
+        (testFindControllerHide):
+        (beforeAll):
+        (afterAll):
+        * UIProcess/API/gtk/webkit2.h:
+
+2012-02-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Update WebKitSystemInterface.
+
+        Reviewed by Sam Weinig.
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2012-02-28  Hugo Parente Lima  <hugo.lima@openbossa.org>
+
+        All mouse events after a right click are ignored when they came from WebkitTestRunner
+        https://bugs.webkit.org/show_bug.cgi?id=77350
+
+        Reviewed by Chang Shu.
+
+        Never ignore mouse events when using sync events, even if the context menu is being
+        show but the Ui did replied the ShowContextMenu event with a ContextMenuHidden.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::mouseEventSyncForTesting):
+
+2012-02-28  Alexey Proskuryakov  <ap@apple.com>
+
+        More build fix.
+
+        * WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm: Check for build platform
+        properly.
+
+2012-02-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp: (WebKit::NPN_GetValue):
+        Check for build platform properly.
+
+2012-02-28  Enrica Casucci  <enrica@apple.com>
+
+        More Pasteboard code cleanup.
+        https://bugs.webkit.org/show_bug.cgi?id=79816
+
+        Removing the last references to NSPasteboard.
+        
+        Reviewed by Alexey Proskuryakov.
+
+        * WebProcess/WebCoreSupport/WebEditorClient.h:
+        * WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm:
+        (WebKit::WebEditorClient::setInsertionPasteboard):
+
+2012-02-28  Alexey Proskuryakov  <ap@apple.com>
+
+        [Mac] Add an experimental SPI for plug-ins to enter sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=79709
+
+        Reviewed by Anders Carlsson.
+
+        * PluginProcess/PluginProcess.h: (WebKit::PluginProcess::pluginPath): Exposed plugin path.
+
+        * PluginProcess/mac/com.apple.WebKit.PluginProcess.sb: Added.
+
+        * WebKit2.xcodeproj/project.pbxproj: Added new files.
+
+        * WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp: (WebKit::NPN_GetValue): Exposed
+        a function to access sandboxing functions when available.
+
+        * WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.h: Added.
+        * WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm: Added.
+
+2012-02-28  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        [Qt] Allow read/write to the WebView.url property
+        https://bugs.webkit.org/show_bug.cgi?id=77554
+
+        Reviewed by Tor Arne Vestbø.
+
+        Change QML API WebView.url to read/write to reflect either the url requested by the user.
+        Also removed WebView.load(url). Defers setting url (loading page) until onComponentComplete is triggered. 
+        Fixed c++ and qml tests to reflect the new API.
+
+        * Target.pri:
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::QQuickWebViewPrivate):
+        (QQuickWebViewPrivate::onComponentComplete):
+        (QQuickWebView::setUrl):
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        * UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_itemSelector.qml:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_linkHovered.qml:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_messaging.qml:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_navigationRequested.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_applicationScheme.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_download.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_favIconLoad.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_geopermission.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_javaScriptDialogs.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_loadFail.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgress.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgressSignal.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_loadUrl.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_navigationHistory.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_origin.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_preferences.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_properties.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_titleChanged.qml:
+        * UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp:
+        (tst_QQuickWebView::loadEmptyPageViewHidden):
+        (tst_QQuickWebView::loadNonexistentFileUrl):
+
+2012-02-28  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Signal and property cleanup in QQuickWebView
+        https://bugs.webkit.org/show_bug.cgi?id=78820
+
+        Reviewed by Noam Rosenthal.
+
+        - Remove parameters from property change notify signals:
+          titleChanged, urlChanged, iconChanged, loadProgressChanged
+        - Rename the parameters of linkHovered to prevent shadoing properties of WebView
+        - Rename navigationStateChanged to navigationHistoryChanged
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::QQuickWebViewPrivate):
+        (QQuickWebViewPrivate::initialize):
+        (QQuickWebViewPrivate::_q_onUrlChanged):
+        (QQuickWebViewPrivate::setIcon):
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        * UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_linkHovered.qml:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_loadHtml.qml:
+        * UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp:
+        (tst_QQuickWebView::loadProgress):
+        * UIProcess/qt/QtWebPageLoadClient.cpp:
+        (QtWebPageLoadClient::didCommitLoadForFrame):
+        (QtWebPageLoadClient::didSameDocumentNavigationForFrame):
+        (QtWebPageLoadClient::didReceiveTitleForFrame):
+        (QtWebPageLoadClient::setLoadProgress):
+        * UIProcess/qt/QtWebPageLoadClient.h:
+        (QtWebPageLoadClient):
+
+2012-02-28  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add GMainLoop and GMainContext to be handled by GRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=79496
+
+        Reviewed by Martin Robinson.
+
+        Updated places where raw pointers to GMainLoop and GMainContext
+        were being used, replacing them with GRefPtr-based code.
+
+        * Platform/WorkQueue.h:
+        (WorkQueue):
+        * Platform/gtk/WorkQueueGtk.cpp:
+        (WorkQueue::platformInitialize):
+        (WorkQueue::platformInvalidate):
+        (WorkQueue::workQueueThreadBody):
+        (WorkQueue::registerEventSourceHandler):
+        (WorkQueue::dispatchOnSource):
+        * UIProcess/gtk/WebPopupMenuProxyGtk.cpp:
+        (WebKit::WebPopupMenuProxyGtk::WebPopupMenuProxyGtk):
+        (WebKit::WebPopupMenuProxyGtk::showPopupMenu):
+        (WebKit::WebPopupMenuProxyGtk::shutdownRunLoop):
+        * UIProcess/gtk/WebPopupMenuProxyGtk.h:
+        (WebPopupMenuProxyGtk):
+
+2012-02-28  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Initialize QtWebContext as much as we can in its constructor.
+        https://bugs.webkit.org/show_bug.cgi?id=79809
+
+        Reviewed by Tor Arne Vestbø.
+
+        The icon database wouldn't be initialized on the QtWebContext while in WebKitTestRunner
+        since it doesn't call the initialize method on it after creating it.
+        Remove the initialize method, move the download manager and icon database initialization
+        in the constructor and call initializeContextInjectedBundleClient directly in
+        defaultContext to prevent overriding WKTR's injected bundle client.
+
+        * UIProcess/qt/QtWebContext.cpp:
+        (WebKit::QtWebContext::QtWebContext):
+        (WebKit::QtWebContext::defaultContext):
+        * UIProcess/qt/QtWebContext.h:
+        (QtWebContext):
+
+2012-02-28  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Inconsistent state of WebKitWebView when replacing content in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=79775
+
+        Reviewed by Martin Robinson.
+
+        Use an enum instead of a boolean to track the status of a
+        replace_content() load operation. We need to know when the load of
+        the replace content actually starts to not ignore valid load
+        events of a previous ongoing load operation.
+
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkitWebViewLoadChanged): Transit to new replace content state
+        when replacing content depending on the load event.
+        (webkitWebViewLoadFailed): Ignore load failed events when
+        replacing content.
+        (webkitWebViewSetEstimatedLoadProgress): Ignore load progress when
+        replacing content.
+        (webkit_web_view_replace_content): Set replace content status to
+        WillReplaceContent.
+        * UIProcess/API/gtk/tests/TestWebKitWebView.cpp:
+        (replaceContentLoadCallback):
+        (testWebViewReplaceContent):
+        * UIProcess/API/gtk/tests/WebViewTest.cpp:
+        (titleChanged):
+        (WebViewTest::waitUntilTitleChanged): Convenient method to wait
+        until title changes. Use with replaceConent() since load events
+        are not emitted when replacing content.
+        * UIProcess/API/gtk/tests/WebViewTest.h:
+
+2012-02-27  Anders Carlsson  <andersca@apple.com>
+
+        Add basic page overlay support to TiledCoreAnimationDrawingArea
+        https://bugs.webkit.org/show_bug.cgi?id=79716
+        <rdar://problem/10923079>
+
+        Reviewed by Sam Weinig.
+
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:
+        Make TiledCoreAnimationDrawingArea a GraphicsLayerClient.
+
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+        (WebKit::TiledCoreAnimationDrawingArea::didInstallPageOverlay):
+        Create the page overlay layer.
+
+        (WebKit::TiledCoreAnimationDrawingArea::didUninstallPageOverlay):
+        Destroy the page overlay layer.
+
+        (WebKit::TiledCoreAnimationDrawingArea::setPageOverlayNeedsDisplay):
+        Mark the page overlay layer as needing display.
+
+        (WebKit::TiledCoreAnimationDrawingArea::notifyAnimationStarted):
+        (WebKit::TiledCoreAnimationDrawingArea::notifySyncRequired):
+        Add empty GraphisLayerClient member function implementations.
+
+        (WebKit::TiledCoreAnimationDrawingArea::paintContents):
+        Ask the page overlay to paint itself.
+
+        (WebKit::TiledCoreAnimationDrawingArea::flushLayers):
+        Flush the page overlay layer.
+        
+        (WebKit::TiledCoreAnimationDrawingArea::updateGeometry):
+        Resize the page overlay layer.
+
+        (WebKit::TiledCoreAnimationDrawingArea::setRootCompositingLayer):
+        If we have a page overlay layer, add it as a sublayer of the root layer.
+
+        (WebKit::TiledCoreAnimationDrawingArea::createPageOverlayLayer):
+        Create the page overlay layer and add it as a sublayer of the root layer.
+
+        (WebKit::TiledCoreAnimationDrawingArea::destroyPageOverlayLayer):
+        Remove the page overlay layer and destroy it.
+
+2012-02-28  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Remove virtual methods of WebKitDownload signals in WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=79804
+
+        Reviewed by Martin Robinson.
+
+        That comes from the first patch that followed the approach of the
+        first LoaderClient implementation. With current implementation
+        download signals, except decide-destination, don't need to be
+        true_handled, and they won't have a default handler
+        implementation. Also the download object is not supposed to be
+        inheritable, since instances are created privately by the
+        WebContext, so it's not possible to override the virtual methods
+        in derived classes.
+
+        * UIProcess/API/gtk/WebKitDownload.cpp:
+        (webkit_download_class_init):
+        (webkitDownloadNotifyProgress):
+        (webkitDownloadFailed):
+        (webkitDownloadFinished):
+        * UIProcess/API/gtk/WebKitDownload.h:
+        (_WebKitDownloadClass):
+        * UIProcess/API/gtk/webkit2marshal.list:
+
+2012-02-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] Fix build for WK2, do not use enum type if values can be outside the enum
+        https://bugs.webkit.org/show_bug.cgi?id=79800
+
+        Reviewed by Csaba Osztrogonác.
+
+        We have two different enums called NavigationRequestAction. If we use one of them
+        to store the variables, compilers can rightfully warn about comparison with
+        values from other enums.
+
+        We might revisit the strategy of exposing different enumerations in experimental,
+        but for now, fallback to using int for the 'action' property in
+        QWebNavigationRequest.
+
+        * UIProcess/API/qt/qwebnavigationrequest.cpp:
+        (QWebNavigationRequestPrivate):
+        (QWebNavigationRequest::setAction):
+        (QWebNavigationRequest::action):
+        * UIProcess/API/qt/qwebnavigationrequest_p.h:
+        * UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp:
+
+2012-02-27  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] API changes to QWebNavigationRequest
+        https://bugs.webkit.org/show_bug.cgi?id=78821
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Changes discussed in API review at Szeged: rename 'button' to 'mouseButton',
+        rename 'modifiers' to 'keyboardModifiers', remove 'originatingUrl' and
+        use the enum type for 'action'.
+
+        * UIProcess/API/qt/qwebnavigationrequest.cpp:
+        (QWebNavigationRequestPrivate::QWebNavigationRequestPrivate):
+        (QWebNavigationRequestPrivate):
+        (QWebNavigationRequest::QWebNavigationRequest):
+        (QWebNavigationRequest::setAction):
+        (QWebNavigationRequest::mouseButton):
+        (QWebNavigationRequest::keyboardModifiers):
+        (QWebNavigationRequest::action):
+        * UIProcess/API/qt/qwebnavigationrequest_p.h:
+        * UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_navigationRequested.qml:
+        * UIProcess/qt/QtWebPagePolicyClient.cpp:
+        (QtWebPagePolicyClient::decidePolicyForNavigationAction):
+        * UIProcess/qt/QtWebPagePolicyClient.h:
+        (QtWebPagePolicyClient):
+
+2012-02-28  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Element should be able to have multiple shadow roots.
+        https://bugs.webkit.org/show_bug.cgi?id=77931
+
+        Reviewed by Hajime Morita.
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-02-28  Hugo Parente Lima  <hugo.lima@openbossa.org>
+
+        [Qt][WK2] Use movementStarted/Ended signals instead of movingChanged on QtViewportInterationEngine
+        https://bugs.webkit.org/show_bug.cgi?id=79521
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        movingChanged() signal is emitted many times, so the use of movementStarted() and
+        movementEnded() is a better choice.
+
+        * UIProcess/qt/QtFlickProvider.cpp:
+        (QtFlickProvider::QtFlickProvider):
+        * UIProcess/qt/QtFlickProvider.h:
+        (QtFlickProvider):
+        * UIProcess/qt/QtViewportInteractionEngine.cpp:
+        (WebKit::QtViewportInteractionEngine::QtViewportInteractionEngine):
+        * UIProcess/qt/QtViewportInteractionEngine.h:
+        (QtViewportInteractionEngine):
+
+2012-02-27  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Element::removeShadowRoot() and setShadowRoot() should be moved into ShadowTree.
+        https://bugs.webkit.org/show_bug.cgi?id=78313
+
+        Reviewed by Hajime Morita.
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-02-27  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/10924993> and https://bugs.webkit.org/show_bug.cgi?id=79725
+        <a ping> doesn't work in WebKit2
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences): Push the WK2 <a ping> setting to WebCore::Settings.
+
+2012-02-27  Enrica Casucci  <enrica@apple.com>
+
+        WebKit2: implement platform strategy to access Pasteboard in the UI process.
+        https://bugs.webkit.org/show_bug.cgi?id=79253
+        <rdar://problem/9971876>
+
+        Reviewed by Alexey Proskuryakov.
+
+        * UIProcess/WebContext.h:
+        * UIProcess/WebContext.messages.in: Added messages to access NSPasteboard
+        in the UI process.
+        * UIProcess/mac/WebContextMac.mm: Added methods corresponding to the
+        new messages.
+        (WebKit::WebContext::getPasteboardTypes):
+        (WebKit::WebContext::getPasteboardPathnamesForType):
+        (WebKit::WebContext::getPasteboardStringForType):
+        (WebKit::WebContext::getPasteboardBufferForType):
+        (WebKit::WebContext::pasteboardCopy):
+        (WebKit::WebContext::getPasteboardChangeCount):
+        (WebKit::WebContext::getPasteboardUniqueName):
+        (WebKit::WebContext::getPasteboardColor):
+        (WebKit::WebContext::setPasteboardTypes):
+        (WebKit::WebContext::setPasteboardPathnamesForType):
+        (WebKit::WebContext::setPasteboardStringForType):
+        (WebKit::WebContext::setPasteboardBufferForType):
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp: New implementation of the PasteboardStrategy using message exchange
+        with the UI process.
+        (WebKit::WebPlatformStrategies::getTypes):
+        (WebKit::WebPlatformStrategies::bufferForType):
+        (WebKit::WebPlatformStrategies::getPathnamesForType):
+        (WebKit::WebPlatformStrategies::stringForType):
+        (WebKit::WebPlatformStrategies::copy):
+        (WebKit::WebPlatformStrategies::changeCount):
+        (WebKit::WebPlatformStrategies::uniqueName):
+        (WebKit::WebPlatformStrategies::color):
+        (WebKit::WebPlatformStrategies::setTypes):
+        (WebKit::WebPlatformStrategies::setBufferForType):
+        (WebKit::WebPlatformStrategies::setPathnamesForType):
+        (WebKit::WebPlatformStrategies::setStringForType):
+
+2012-02-27  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/9557598> REGRESSION (WebKit2): Non-activating links sometimes don’t work
+        https://bugs.webkit.org/show_bug.cgi?id=79607
+
+        Reviewed by Adele Peterson.
+
+        Test: TestWebKitAPI/Tests/mac/AcceptsFirstMouse.mm
+
+        This was caused by not mapping the mouse event coordinates from window coordinates to
+        document coordinates.
+
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::performDictionaryLookupAtLocation): Convert the point to main frame
+        coordinates when performing the hit test.
+        (WebKit::WebPage::shouldDelayWindowOrderingEvent): Convert the point to the main or focused
+        frame coordinates when perfomring the hit test.
+        (WebKit::WebPage::acceptsFirstMouse): Ditto.
+
+2012-02-27  Timothy Hatcher  <timothy@apple.com>
+
+        Add WKInspector API to know when the Web Inspector is the frontmost window.
+
+        Also makes the Safari Develop menu items work when the Web Inspector is frontmost.
+
+        https://webkit.org/b/79649
+
+        Reviewed by John Sullivan.
+
+        * UIProcess/API/C/WKInspector.cpp:
+        (WKInspectorIsFront): Added. Call WebInspectorProxy::isFront.
+        * UIProcess/API/C/WKInspector.h:
+        * UIProcess/WebInspectorProxy.cpp:
+        (WebKit::WebInspectorProxy::isFront): Added. Call platformIsFront.
+        * UIProcess/WebInspectorProxy.h:
+        * UIProcess/efl/WebInspectorEfl.cpp:
+        (WebKit::WebInspectorProxy::platformIsFront): Added stub.
+        * UIProcess/gtk/WebInspectorGtk.cpp:
+        (WebKit::WebInspectorProxy::platformIsFront): Added stub.
+        * UIProcess/mac/WebInspectorProxyMac.mm:
+        (-[WKWebInspectorProxyObjCAdapter showWebInspector:]): Added. Makes the Develop menu items in Safari work when
+        the Web Inspector window is front.
+        (-[WKWebInspectorProxyObjCAdapter showErrorConsole:]): Added. Ditto.
+        (-[WKWebInspectorProxyObjCAdapter showResources:]): Added. Ditto.
+        (-[WKWebInspectorProxyObjCAdapter viewSource:]): Added. Ditto.
+        (-[WKWebInspectorProxyObjCAdapter toggleDebuggingJavaScript:]): Added. Ditto.
+        (-[WKWebInspectorProxyObjCAdapter toggleProfilingJavaScript:]): Added. Ditto.
+        (-[WKWebInspectorProxyObjCAdapter validateUserInterfaceItem:]): Added. Update the menu item titles.
+        (WebKit::WebInspectorProxy::platformIsFront): Added. Return if visible and the window is main.
+        * UIProcess/qt/WebInspectorProxyQt.cpp:
+        (WebKit::WebInspectorProxy::platformIsFront): Added stub.
+        * UIProcess/win/WebInspectorProxyWin.cpp:
+        (WebKit::WebInspectorProxy::platformIsFront): Added stub.
+
+2012-02-26  YoungTaeck Song  <youngtaeck.song@samsung.com>
+
+        [EFL][WK2] Add InjectedBundleEfl.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=75463
+
+        Reviewed by Andreas Kling.
+
+        Add first version of InjectedBundleEfl.cpp including load() and placeholder for activateMacFontAscentHack().
+
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+        * WebProcess/InjectedBundle/efl/InjectedBundleEfl.cpp:
+        (WebKit::InjectedBundle::load):
+        (WebKit::InjectedBundle::activateMacFontAscentHack):
+
+2012-02-26  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Rename ShadowRootList to ShadowTree.
+        https://bugs.webkit.org/show_bug.cgi?id=79342
+
+        Reviewed by Hajime Morita.
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        * WebProcess/WebCoreSupport/WebChromeClient.h:
+        (WebChromeClient):
+        * WebProcess/WebCoreSupport/WebContextMenuClient.cpp:
+        (WebKit):
+        (WebKit::WebContextMenuClient::showContextMenu): Moved from WebChromeClient
+        * WebProcess/WebCoreSupport/WebContextMenuClient.h:
+        (WebContextMenuClient):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::handleContextMenuEvent):
+        (WebKit::handleMouseEvent):
+        (WebKit::WebPage::mouseEvent):
+        (WebKit::WebPage::mouseEventSyncForTesting):
+
+2012-02-26  Huang Dongsung  <luxtella@company100.net>
+
+        Use Functional instead of a MessageQueue for messages to the LayerTreeHostProxy
+        renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=79478
+
+        This makes a lot of the broilerplate code for message-passing unnecessary, and
+        results in a much more succinct implementation.
+
+        Reviewed by Noam Rosenthal.
+
+        * UIProcess/LayerTreeHostProxy.h:
+        (WebKit):
+        (LayerTreeHostProxy):
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp:
+        (WebKit):
+        (WebKit::LayerTreeHostProxy::updateTile):
+        (WebKit::LayerTreeHostProxy::createImage):
+        (WebKit::LayerTreeHostProxy::syncRemoteContent):
+        (WebKit::LayerTreeHostProxy::dispatchUpdate):
+        (WebKit::LayerTreeHostProxy::createTileForLayer):
+        (WebKit::LayerTreeHostProxy::updateTileForLayer):
+        (WebKit::LayerTreeHostProxy::removeTileForLayer):
+        (WebKit::LayerTreeHostProxy::deleteCompositingLayer):
+        (WebKit::LayerTreeHostProxy::setRootCompositingLayer):
+        (WebKit::LayerTreeHostProxy::syncCompositingLayerState):
+        (WebKit::LayerTreeHostProxy::didRenderFrame):
+        (WebKit::LayerTreeHostProxy::createDirectlyCompositedImage):
+        (WebKit::LayerTreeHostProxy::destroyDirectlyCompositedImage):
+
+2012-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix for SL.
+
+        * Platform/mac/RemoteLayerClient.mm:
+        (WebKit::RemoteLayerClient::RemoteLayerClient):
+
+2012-02-26  Sam Weinig  <sam@webkit.org>
+
+        Encapsulate uses of WKSI to setup a remote layer into a new RemoteLayerClient class
+        https://bugs.webkit.org/show_bug.cgi?id=79612
+
+        Reviewed by Anders Carlsson.
+
+        * Platform/mac/RemoteLayerClient.h: 
+        * Platform/mac/RemoteLayerClient.mm: 
+        (WebKit::RemoteLayerClient::create):
+        (WebKit::RemoteLayerClient::RemoteLayerClient):
+        (WebKit::RemoteLayerClient::~RemoteLayerClient):
+        (WebKit::RemoteLayerClient::clientID):
+        (WebKit::RemoteLayerClient::invalidate):
+        New class that encapsulates calls to WKSI WKCARemoteLayerClient*. For platforms
+        where the use of WKSI is not necessary, due to CARemoteLayerClient being available,
+        stop using WKSI.
+
+        * PluginProcess/PluginControllerProxy.cpp:
+        * PluginProcess/PluginControllerProxy.h:
+        * PluginProcess/mac/PluginControllerProxyMac.mm:
+        (WebKit::PluginControllerProxy::platformInitialize):
+        (WebKit::PluginControllerProxy::platformDestroy):
+        (WebKit::PluginControllerProxy::remoteLayerClientID):
+        (WebKit::PluginControllerProxy::platformGeometryDidChange):
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/FullScreen/mac/WebFullScreenManagerMac.h:
+        * WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm:
+        (WebKit::WebFullScreenManagerMac::setRootFullScreenLayer):
+        (WebKit::WebFullScreenManagerMac::disposeOfLayerClient):
+        * WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.h:
+        (LayerTreeHostCAMac):
+        * WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm:
+        (WebKit::LayerTreeHostCAMac::platformInitialize):
+        (WebKit::LayerTreeHostCAMac::invalidate):
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+        (WebKit::TiledCoreAnimationDrawingArea::TiledCoreAnimationDrawingArea):
+        Switch to using RemoteLayerClient.
+
+        * UIProcess/mac/WebContextMac.mm:
+        (WebKit::WebContext::platformInitializeWebProcess):
+        * UIProcess/Plugins/mac/PluginProcessProxyMac.mm:
+        (WebKit::PluginProcessProxy::platformInitializePluginProcess):
+        Use CARemoteLayerServer directly if available.
+
+2012-02-25  Anders Carlsson  <andersca@apple.com>
+
+        Address review feedback from Andreas Kling.
+
+        * WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:
+        (WebKit::NetscapePlugin::platformHandleMouseEvent):
+
+2012-02-25  Anders Carlsson  <andersca@apple.com>
+
+        Mouse tracking incorrect in Silverlight when using multi monitor with offset arrangement
+        https://bugs.webkit.org/show_bug.cgi?id=79589
+        <rdar://problem/9719592>
+
+        Reviewed by Sam Weinig.
+
+        In the Carbon event model, mouse event coordinates are flipped relative to the first screen,
+        whereas the coordinates we get from the WebMouseEvent are flipped relative to the screen where
+        the containing WKView is on.
+
+        Instead of passing the global coordinates to NPP_HandleEvent, convert them to the flipped screen coordinate
+        system that the plug-in expects.
+
+        * WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:
+        (WebKit::NetscapePlugin::platformHandleMouseEvent):
+
+2012-02-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108900.
+        http://trac.webkit.org/changeset/108900
+        https://bugs.webkit.org/show_bug.cgi?id=79587
+
+        broke some API tests, will investigate and re-commit
+        (Requested by noamr on #webkit).
+
+        * UIProcess/API/qt/qquickwebpage.cpp:
+        (computeEffectiveOpacity):
+        (QQuickWebPagePrivate::paintToCurrentGLContext):
+        (PageProxyNode::changedStates):
+        (PageProxyNode::render):
+        * UIProcess/API/qt/qquickwebpage_p_p.h:
+        (QQuickWebPagePrivate):
+
+2012-02-25  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Use the existing inheritedOpacity/matrix properties of QSGNode
+        https://bugs.webkit.org/show_bug.cgi?id=79543
+
+        Use QSGNode::inheritedOpacity() and QSGNode::matrix().
+        Also, remove flags from changedStates() that we don't actually touch.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/API/qt/qquickwebpage.cpp:
+        (QQuickWebPagePrivate::paintToCurrentGLContext):
+        (PageProxyNode::changedStates):
+        (PageProxyNode::render):
+        * UIProcess/API/qt/qquickwebpage_p_p.h:
+        (QQuickWebPagePrivate):
+
+2012-02-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108816.
+        http://trac.webkit.org/changeset/108816
+        https://bugs.webkit.org/show_bug.cgi?id=79562
+
+        It made many tests crash and timeout on Qt-WK2 (Requested by
+        ossy__ on #webkit).
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::QQuickWebViewPrivate):
+        (QQuickWebViewPrivate::initialize):
+        (QQuickWebViewPrivate::setIcon):
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        * UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_linkHovered.qml:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_loadHtml.qml:
+        * UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp:
+        (tst_QQuickWebView::loadProgress):
+        * UIProcess/qt/QtWebPageLoadClient.cpp:
+        (QtWebPageLoadClient::didCommitLoadForFrame):
+        (QtWebPageLoadClient::didSameDocumentNavigationForFrame):
+        (QtWebPageLoadClient::didReceiveTitleForFrame):
+        (QtWebPageLoadClient::setLoadProgress):
+        * UIProcess/qt/QtWebPageLoadClient.h:
+        (QtWebPageLoadClient):
+
+2012-02-24  Andy Estes  <aestes@apple.com>
+
+        REGRESSION (r108730): Webkit nightlies fails to start due to WKPreferencesGetSuppressIncrementalRendering renaming
+        https://bugs.webkit.org/show_bug.cgi?id=79515
+
+        Reviewed by Alexey Proskuryakov.
+
+        Some versions of Safari contain call sites to two functions in WebKit2
+        that were removed in r108730. Restore these two functions so that these
+        versions of Safari can be used with WebKit nightly builds.
+
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetSuppressIncrementalRendering):
+        (WKPreferencesGetSuppressIncrementalRendering):
+        * UIProcess/API/C/WKPreferences.h:
+
+2012-02-24  Jessie Berlin  <jberlin@apple.com>
+
+        requestPermission callback not invoked if the WebProcess doesn't have to ask the UI Process
+        about the permission level.
+        https://bugs.webkit.org/show_bug.cgi?id=79494
+
+        Reviewed by Jon Honeycutt.
+
+        Invoke the callback in the case where the permission level is known and no message is sent
+        to the UI Process.
+
+        * WebProcess/Notifications/NotificationPermissionRequestManager.cpp:
+        (WebKit::NotificationPermissionRequestManager::startRequest):
+
+2012-02-24  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Signal and property cleanup in QQuickWebView
+        https://bugs.webkit.org/show_bug.cgi?id=78820
+
+        Reviewed by Simon Hausmann.
+
+        - Remove parameters from property change notify signals:
+          titleChanged, urlChanged, iconChanged, loadProgressChanged
+        - Rename the parameters of linkHovered to prevent shadoing properties of WebView
+        - Rename navigationStateChanged to navigationHistoryChanged
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::QQuickWebViewPrivate):
+        (QQuickWebViewPrivate::initialize):
+        (QQuickWebViewPrivate::_q_onUrlChanged):
+        (QQuickWebViewPrivate::setIcon):
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        * UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_linkHovered.qml:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_loadHtml.qml:
+        * UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp:
+        (tst_QQuickWebView::loadProgress):
+        * UIProcess/qt/QtWebPageLoadClient.cpp:
+        (QtWebPageLoadClient::didCommitLoadForFrame):
+        (QtWebPageLoadClient::didSameDocumentNavigationForFrame):
+        (QtWebPageLoadClient::didReceiveTitleForFrame):
+        (QtWebPageLoadClient::setLoadProgress):
+        * UIProcess/qt/QtWebPageLoadClient.h:
+        (QtWebPageLoadClient):
+
+2012-02-24  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] API: Unify the loading properties and signals.
+        https://bugs.webkit.org/show_bug.cgi?id=79486
+
+        Reviewed by Simon Hausmann.
+
+        - Remove the canReload signal, instead assume that calling reload in those cases
+          won't have any effect.
+        - Replace loadStarted, loadSucceeded and loadFailed by a single signal: loadingChanged.
+          The signal carries an argument with a status and error codes giving the intended context.
+        - Use loadingChanged as the notification signal for the property "loading" instead of
+          navigationStateChanged.
+
+        Also update all API tests to use the new loading signals and add some utility functions
+        to track the loading since the new API aims to be more adapted to declarative logic
+        and the auto tests are using an imperative logic.
+
+        * Target.pri:
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::QQuickWebViewPrivate):
+        (QQuickWebViewPrivate::loadDidSucceed):
+        (QQuickWebViewPrivate::didChangeLoadingState):
+        (QQuickWebViewPrivate::processDidCrash):
+        (QQuickWebViewPrivate::didRelaunchProcess):
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        * UIProcess/API/qt/qwebloadrequest.cpp: Added.
+        (QWebLoadRequestPrivate):
+        (QWebLoadRequestPrivate::QWebLoadRequestPrivate):
+        (QWebLoadRequest::QWebLoadRequest):
+        (QWebLoadRequest::~QWebLoadRequest):
+        (QWebLoadRequest::url):
+        (QWebLoadRequest::status):
+        (QWebLoadRequest::errorString):
+        (QWebLoadRequest::errorDomain):
+        (QWebLoadRequest::errorCode):
+        * UIProcess/API/qt/qwebloadrequest_p.h: Added.
+        * UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_itemSelector.qml:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_linkHovered.qml:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_loadHtml.qml:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_messaging.qml:
+        * UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_navigationRequested.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_favIconLoad.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_javaScriptDialogs.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_loadFail.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_loadHtml.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgress.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgressSignal.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_loadUrl.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_navigationHistory.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_preferences.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_properties.qml:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_titleChanged.qml:
+        * UIProcess/API/qt/tests/qmltests/common/TestWebView.qml: Added.
+        * UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp:
+        (tst_QQuickWebView::navigationStatusAtStartup):
+        (LoadStartedCatcher::LoadStartedCatcher):
+        (LoadStartedCatcher::onLoadingChanged):
+        (tst_QQuickWebView::stopEnabledAfterLoadStarted):
+        (tst_QQuickWebView::loadEmptyPageViewHidden):
+        (tst_QQuickWebView::loadNonexistentFileUrl):
+        (tst_QQuickWebView::backAndForward):
+        (tst_QQuickWebView::reload):
+        (tst_QQuickWebView::stop):
+        (tst_QQuickWebView::loadProgress):
+        (tst_QQuickWebView::showWebView):
+        (tst_QQuickWebView::multipleWebViewWindows):
+        (tst_QQuickWebView::multipleWebViews):
+        (tst_QQuickWebView::scrollRequest):
+        * UIProcess/API/qt/tests/util.cpp:
+        (LoadSpy):
+        (LoadSpy::LoadSpy):
+        (LoadSpy::onLoadingChanged):
+        (waitForLoadSucceeded):
+        (waitForLoadFailed):
+        * UIProcess/API/qt/tests/util.h:
+        * UIProcess/qt/QtWebError.h:
+        * UIProcess/qt/QtWebPageLoadClient.cpp:
+        (QtWebPageLoadClient::didStartProvisionalLoadForFrame):
+        (QtWebPageLoadClient::dispatchLoadFailed):
+        * UIProcess/qt/QtWebPageLoadClient.h:
+        (QtWebPageLoadClient):
+
+2012-02-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed, rolling out r108798.
+        http://trac.webkit.org/changeset/108798
+        https://bugs.webkit.org/show_bug.cgi?id=78047
+
+        Broke too many Qt WK2 tests.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebView::keyPressEvent):
+        (QQuickWebView::keyReleaseEvent):
+        (QQuickWebView::inputMethodEvent):
+        (QQuickWebView::focusInEvent):
+        (QQuickWebView::focusOutEvent):
+        (QQuickWebView::touchEvent):
+        (QQuickWebView::mousePressEvent):
+        (QQuickWebView::mouseMoveEvent):
+        (QQuickWebView::mouseReleaseEvent):
+        (QQuickWebView::mouseDoubleClickEvent):
+        (QQuickWebView::wheelEvent):
+        (QQuickWebView::hoverEnterEvent):
+        (QQuickWebView::hoverMoveEvent):
+        (QQuickWebView::hoverLeaveEvent):
+        (QQuickWebView::dragMoveEvent):
+        (QQuickWebView::dragEnterEvent):
+        (QQuickWebView::dragLeaveEvent):
+        (QQuickWebView::dropEvent):
+        (QQuickWebView::event):
+        * UIProcess/qt/QtWebPageEventHandler.cpp:
+        (QtWebPageEventHandler::handleEvent):
+        (QtWebPageEventHandler::handleMouseMoveEvent):
+        (QtWebPageEventHandler::handleMousePressEvent):
+        (QtWebPageEventHandler::handleMouseReleaseEvent):
+        (QtWebPageEventHandler::handleWheelEvent):
+        (QtWebPageEventHandler::handleHoverLeaveEvent):
+        (QtWebPageEventHandler::handleHoverMoveEvent):
+        (QtWebPageEventHandler::handleDragEnterEvent):
+        (QtWebPageEventHandler::handleDragLeaveEvent):
+        (QtWebPageEventHandler::handleDragMoveEvent):
+        (QtWebPageEventHandler::handleDropEvent):
+        (QtWebPageEventHandler::handleKeyPressEvent):
+        (QtWebPageEventHandler::handleKeyReleaseEvent):
+        (QtWebPageEventHandler::handleFocusInEvent):
+        (QtWebPageEventHandler::handleFocusOutEvent):
+        (QtWebPageEventHandler::inputMethodEvent):
+        (QtWebPageEventHandler::touchEvent):
+        * UIProcess/qt/QtWebPageEventHandler.h:
+        (QtWebPageEventHandler):
+
+2012-02-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt][WK2] QQuickWebView::event should lookup faster which events QQuickWebPage can handle
+        https://bugs.webkit.org/show_bug.cgi?id=78047
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Replaced double-dispatch of events with direct forwarding of events from QQuickWebView::*Event to
+        QtWebPageEventHandler::handle*Event.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebView::keyPressEvent):
+        (QQuickWebView::keyReleaseEvent):
+        (QQuickWebView::inputMethodEvent):
+        (QQuickWebView::focusInEvent):
+        (QQuickWebView::focusOutEvent):
+        (QQuickWebView::touchEvent):
+        (QQuickWebView::mousePressEvent):
+        (QQuickWebView::mouseMoveEvent):
+        (QQuickWebView::mouseReleaseEvent):
+        (QQuickWebView::mouseDoubleClickEvent):
+        (QQuickWebView::wheelEvent):
+        (QQuickWebView::hoverEnterEvent):
+        (QQuickWebView::hoverMoveEvent):
+        (QQuickWebView::hoverLeaveEvent):
+        (QQuickWebView::dragMoveEvent):
+        (QQuickWebView::dragEnterEvent):
+        (QQuickWebView::dragLeaveEvent):
+        (QQuickWebView::dropEvent):
+        (QQuickWebView::event):
+        * UIProcess/qt/QtWebPageEventHandler.cpp:
+        (QtWebPageEventHandler::handleMouseMoveEvent):
+        (QtWebPageEventHandler::handleMousePressEvent):
+        (QtWebPageEventHandler::handleMouseReleaseEvent):
+        (QtWebPageEventHandler::handleWheelEvent):
+        (QtWebPageEventHandler::handleHoverLeaveEvent):
+        (QtWebPageEventHandler::handleHoverMoveEvent):
+        (QtWebPageEventHandler::handleDragEnterEvent):
+        (QtWebPageEventHandler::handleDragLeaveEvent):
+        (QtWebPageEventHandler::handleDragMoveEvent):
+        (QtWebPageEventHandler::handleDropEvent):
+        (QtWebPageEventHandler::handleKeyPressEvent):
+        (QtWebPageEventHandler::handleKeyReleaseEvent):
+        (QtWebPageEventHandler::handleFocusInEvent):
+        (QtWebPageEventHandler::handleFocusOutEvent):
+        (QtWebPageEventHandler::handleInputMethodEvent):
+        (QtWebPageEventHandler::handleTouchEvent):
+        * UIProcess/qt/QtWebPageEventHandler.h:
+        (QtWebPageEventHandler):
+
 2012-02-24  Simon Hausmann  <simon.hausmann@nokia.com>
 
         [Qt] Use private QSGRenderNode in QQuickWebView for improved Qt Scene Graph integration
diff --git a/Source/WebKit2/Configurations/FeatureDefines.xcconfig b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
index 3e2090355..58a02f521 100644
--- a/Source/WebKit2/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
@@ -90,12 +90,14 @@ ENABLE_INDEXED_DATABASE = ;
 ENABLE_INPUT_COLOR = ;
 ENABLE_INPUT_SPEECH = ;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
+ENABLE_LEGACY_NOTIFICATIONS = ENABLE_LEGACY_NOTIFICATIONS;
 ENABLE_LINK_PREFETCH = ;
 ENABLE_MATHML = ENABLE_MATHML;
 ENABLE_MEDIA_SOURCE = ;
 ENABLE_MEDIA_STATISTICS = ;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_MHTML = ;
+ENABLE_MICRODATA = ;
 ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 
 ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
@@ -109,6 +111,7 @@ ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 ENABLE_QUOTA = ;
 ENABLE_REGISTER_PROTOCOL_HANDLER = ;
 ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
+ENABLE_SCRIPTED_SPEECH = ;
 ENABLE_SHADOW_DOM = ;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SQL_DATABASE = ENABLE_SQL_DATABASE;
@@ -118,7 +121,10 @@ ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
 ENABLE_VIDEO = ENABLE_VIDEO;
-ENABLE_VIDEO_TRACK = ENABLE_VIDEO_TRACK;
+
+ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(REAL_PLATFORM_NAME));
+ENABLE_VIDEO_TRACK_macosx = ENABLE_VIDEO_TRACK;
+
 ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
@@ -126,4 +132,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LINK_PREFETCH) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebKit2/Configurations/Version.xcconfig b/Source/WebKit2/Configurations/Version.xcconfig
index 8df936db5..3d9cb1d70 100644
--- a/Source/WebKit2/Configurations/Version.xcconfig
+++ b/Source/WebKit2/Configurations/Version.xcconfig
@@ -21,8 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-MAJOR_VERSION = 535;
-MINOR_VERSION = 23;
+MAJOR_VERSION = 536;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit2/DerivedSources.make b/Source/WebKit2/DerivedSources.make
index abe2621c3..f1101fb68 100644
--- a/Source/WebKit2/DerivedSources.make
+++ b/Source/WebKit2/DerivedSources.make
@@ -23,6 +23,7 @@
 VPATH = \
     $(WebKit2) \
     $(WebKit2)/PluginProcess \
+    $(WebKit2)/PluginProcess/mac \
     $(WebKit2)/Shared/Plugins \
     $(WebKit2)/WebProcess/ApplicationCache \
     $(WebKit2)/WebProcess/Authentication \
@@ -110,6 +111,25 @@ all : \
 	@echo Generating message receiver for $*...
 	@python $(WebKit2)/Scripts/generate-messages-header.py $< > $@
 
+# Mac-specific rules
+
+ifeq ($(OS),MACOS)
+
+FRAMEWORK_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_SEARCH_PATHS) | perl -e 'print "-F " . join(" -F ", split(" ", <>));')
+HEADER_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(HEADER_SEARCH_PATHS) | perl -e 'print "-I" . join(" -I", split(" ", <>));')
+
+SANDBOX_PROFILES = \
+	com.apple.WebProcess.sb \
+	com.apple.WebKit.PluginProcess.sb
+
+all: $(SANDBOX_PROFILES)
+
+%.sb : %.sb.in
+	@echo Pre-processing $* sandbox profile...
+	$(CC) -E -P -w -x c -std=c89 $(FRAMEWORK_FLAGS) $(HEADER_FLAGS) -include "wtf/Platform.h" $< > $@
+
+endif # MACOS
+
 # ------------------------
 
 # Windows-specific rules
diff --git a/Source/WebKit2/GNUmakefile.am b/Source/WebKit2/GNUmakefile.am
index 0e13715a3..a601aef75 100644
--- a/Source/WebKit2/GNUmakefile.am
+++ b/Source/WebKit2/GNUmakefile.am
@@ -19,6 +19,8 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_HEA
 	$(WebKit2)/Shared/API/c/WKMutableDictionary.h \
 	$(WebKit2)/Shared/API/c/WKNumber.h \
 	$(WebKit2)/Shared/API/c/WKPageLoadTypes.h \
+	$(WebKit2)/Shared/API/c/WKRenderLayer.h \
+	$(WebKit2)/Shared/API/c/WKRenderObject.h \
 	$(WebKit2)/Shared/API/c/WKSecurityOrigin.h \
 	$(WebKit2)/Shared/API/c/WKSerializedScriptValue.h \
 	$(WebKit2)/Shared/API/c/WKSerializedScriptValuePrivate.h \
@@ -88,11 +90,13 @@ libwebkit2gtkinclude_HEADERS = \
 	$(WebKit2)/UIProcess/API/gtk/WebKitDownload.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitEditingCommands.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitError.h \
+	$(WebKit2)/UIProcess/API/gtk/WebKitFindController.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitHitTestResult.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitNavigationPolicyDecision.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitPolicyDecision.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitPrintOperation.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitResponsePolicyDecision.h \
+	$(WebKit2)/UIProcess/API/gtk/WebKitScriptDialog.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitSettings.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitURIRequest.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitURIResponse.h \
@@ -242,7 +246,6 @@ webkit2_sources += \
 	Source/WebKit2/PluginProcess/WebProcessConnection.h \
 	Source/WebKit2/PluginProcess/gtk/PluginControllerProxyGtk.cpp \
 	Source/WebKit2/PluginProcess/gtk/PluginProcessGtk.cpp \
-	Source/WebKit2/Shared/ContextMenuState.h \
 	Source/WebKit2/Shared/DragControllerAction.h \
 	Source/WebKit2/Shared/FontInfo.h \
 	Source/WebKit2/Shared/HTTPCookieAcceptPolicy.h \
@@ -287,6 +290,10 @@ webkit2_sources += \
 	Source/WebKit2/Shared/API/c/WKNumber.cpp \
 	Source/WebKit2/Shared/API/c/WKNumber.h \
 	Source/WebKit2/Shared/API/c/WKPageLoadTypes.h \
+	Source/WebKit2/Shared/API/c/WKRenderLayer.cpp \
+	Source/WebKit2/Shared/API/c/WKRenderLayer.h \
+	Source/WebKit2/Shared/API/c/WKRenderObject.cpp \
+	Source/WebKit2/Shared/API/c/WKRenderObject.h \
 	Source/WebKit2/Shared/API/c/WKSecurityOrigin.cpp \
 	Source/WebKit2/Shared/API/c/WKSecurityOrigin.h \
 	Source/WebKit2/Shared/API/c/WKSerializedScriptValue.cpp \
@@ -434,6 +441,10 @@ webkit2_sources += \
 	Source/WebKit2/Shared/WebPreferencesStore.h \
 	Source/WebKit2/Shared/WebProcessCreationParameters.cpp \
 	Source/WebKit2/Shared/WebProcessCreationParameters.h \
+	Source/WebKit2/Shared/WebRenderLayer.cpp \
+	Source/WebKit2/Shared/WebRenderLayer.h \
+	Source/WebKit2/Shared/WebRenderObject.cpp \
+	Source/WebKit2/Shared/WebRenderObject.h \
 	Source/WebKit2/Shared/WebSecurityOrigin.h \
 	Source/WebKit2/Shared/WebSerializedScriptValue.h \
 	Source/WebKit2/Shared/WebString.h \
@@ -546,6 +557,8 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResultPrivate.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp \
+	Source/WebKit2/UIProcess/API/gtk/WebKitFindController.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitFindController.cpp \
 	Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp \
 	Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecision.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecisionPrivate.h \
@@ -562,6 +575,9 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/API/gtk/WebKitResponsePolicyDecision.cpp \
 	Source/WebKit2/UIProcess/API/gtk/WebKitResponsePolicyDecision.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitResponsePolicyDecisionPrivate.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialog.cpp \
+	Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialog.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialogPrivate.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp \
 	Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitSettingsPrivate.h \
@@ -760,8 +776,6 @@ webkit2_sources += \
 	Source/WebKit2/WebProcess/Downloads/soup/DownloadSoup.cpp \
 	Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp \
 	Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h \
-	Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.cpp \
-	Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.h \
 	Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp \
 	Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.h \
 	Source/WebKit2/WebProcess/Geolocation/WebGeolocationManager.cpp \
@@ -1106,7 +1120,8 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LIB
 	$(SQLITE3_LIBS) \
 	$(UNICODE_LIBS) \
 	$(XRENDER_LIBS) \
-	$(XT_LIBS)
+	$(XT_LIBS) \
+	$(ZLIB_LIBS)
 
 if ENABLE_WEBKIT2
 pkgconfig_DATA += Source/WebKit2/webkit2gtk-@WEBKITGTK_API_VERSION@.pc
@@ -1276,8 +1291,7 @@ Programs_WebKitWebProcess_LDADD = \
 	$(GLIB_LIBS) \
 	$(GTK_LIBS) \
 	$(GTK_UNIX_PRINTING_LIBS) \
-	$(LIBSOUP_LIBS) \
-	$(ZLIB_CFLAGS)
+	$(LIBSOUP_LIBS)
 
 Programs_WebKitWebProcess_LDFLAGS = \
 	-no-fast-install \
@@ -1322,8 +1336,7 @@ libWebCoreGtk2_la_CPPFLAGS = \
 	$(SQLITE3_CFLAGS) \
 	$(UNICODE_CFLAGS) \
 	$(XRENDER_CFLAGS) \
-	$(XT_CFLAGS) \
-	$(ZLIB_LIBS)
+	$(XT_CFLAGS)
 
 libexec_PROGRAMS += \
 	Programs/WebKitPluginProcess
diff --git a/Source/WebKit2/Platform/WorkQueue.h b/Source/WebKit2/Platform/WorkQueue.h
index 7b4aff71c..ed894cbd3 100644
--- a/Source/WebKit2/Platform/WorkQueue.h
+++ b/Source/WebKit2/Platform/WorkQueue.h
@@ -48,8 +48,7 @@ class QObject;
 class QThread;
 #elif PLATFORM(GTK)
 #include "PlatformProcessIdentifier.h"
-typedef struct _GMainContext GMainContext;
-typedef struct _GMainLoop GMainLoop;
+#include <wtf/gobject/GRefPtr.h>
 typedef gboolean (*GSourceFunc) (gpointer data);
 #endif
 
@@ -171,9 +170,9 @@ private:
     void dispatchOnSource(GSource*, const Function<void()>&, GSourceFunc);
 
     ThreadIdentifier m_workQueueThread;
-    GMainContext* m_eventContext;
+    GRefPtr<GMainContext> m_eventContext;
     Mutex m_eventLoopLock;
-    GMainLoop* m_eventLoop;
+    GRefPtr<GMainLoop> m_eventLoop;
     Mutex m_eventSourcesLock;
     class EventSource;
     HashMap<int, Vector<EventSource*> > m_eventSources;
diff --git a/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp b/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp
index f0c11f977..1dfab83cc 100644
--- a/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp
+++ b/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp
@@ -103,9 +103,9 @@ static const size_t kVisualStudioThreadNameLimit = 31;
 
 void WorkQueue::platformInitialize(const char* name)
 {
-    m_eventContext = g_main_context_new();
+    m_eventContext = adoptGRef(g_main_context_new());
     ASSERT(m_eventContext);
-    m_eventLoop = g_main_loop_new(m_eventContext, FALSE);
+    m_eventLoop = adoptGRef(g_main_loop_new(m_eventContext.get(), FALSE));
     ASSERT(m_eventLoop);
 
     // This name can be com.apple.WebKit.ProcessLauncher or com.apple.CoreIPC.ReceiveQueue.
@@ -129,17 +129,12 @@ void WorkQueue::platformInvalidate()
     MutexLocker locker(m_eventLoopLock);
 
     if (m_eventLoop) {
-        if (g_main_loop_is_running(m_eventLoop))
-            g_main_loop_quit(m_eventLoop);
-
-        g_main_loop_unref(m_eventLoop);
-        m_eventLoop = 0;
+        if (g_main_loop_is_running(m_eventLoop.get()))
+            g_main_loop_quit(m_eventLoop.get());
+        m_eventLoop.clear();
     }
 
-    if (m_eventContext) {
-        g_main_context_unref(m_eventContext);
-        m_eventContext = 0;
-    }
+    m_eventContext.clear();
 }
 
 void WorkQueue::startWorkQueueThread(WorkQueue* workQueue)
@@ -149,7 +144,7 @@ void WorkQueue::startWorkQueueThread(WorkQueue* workQueue)
 
 void WorkQueue::workQueueThreadBody()
 {
-    g_main_loop_run(m_eventLoop);
+    g_main_loop_run(m_eventLoop.get());
 }
 
 void WorkQueue::registerEventSourceHandler(int fileDescriptor, int condition, const Function<void()>& function)
@@ -177,7 +172,7 @@ void WorkQueue::registerEventSourceHandler(int fileDescriptor, int condition, co
         m_eventSources.set(fileDescriptor, sources);
     }
 
-    g_source_attach(dispatchSource.get(), m_eventContext);
+    g_source_attach(dispatchSource.get(), m_eventContext.get());
 }
 
 void WorkQueue::unregisterEventSourceHandler(int fileDescriptor)
@@ -206,7 +201,7 @@ void WorkQueue::dispatchOnSource(GSource* dispatchSource, const Function<void()>
     g_source_set_callback(dispatchSource, sourceCallback, eventSource,
                           reinterpret_cast<GDestroyNotify>(&WorkQueue::EventSource::deleteEventSource));
 
-    g_source_attach(dispatchSource, m_eventContext);
+    g_source_attach(dispatchSource, m_eventContext.get());
 }
 
 void WorkQueue::dispatch(const Function<void()>& function)
diff --git a/Source/WebKit2/Platform/mac/LayerHostingContext.h b/Source/WebKit2/Platform/mac/LayerHostingContext.h
new file mode 100644
index 000000000..50c3adf4c
--- /dev/null
+++ b/Source/WebKit2/Platform/mac/LayerHostingContext.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LayerHostingContext_h
+#define LayerHostingContext_h
+
+#include "LayerTreeContext.h"
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/RetainPtr.h>
+
+OBJC_CLASS CALayer;
+typedef struct __WKCAContextRef *WKCAContextRef;
+
+namespace WebKit {
+
+class LayerHostingContext {
+    WTF_MAKE_NONCOPYABLE(LayerHostingContext);
+public:
+    static PassOwnPtr<LayerHostingContext> createForPort(mach_port_t serverPort);
+#if HAVE(LAYER_HOSTING_IN_WINDOW_SERVER)
+    static PassOwnPtr<LayerHostingContext> createForWindowServer();
+#endif
+    ~LayerHostingContext();
+
+    void setRootLayer(CALayer *);
+    CALayer *rootLayer() const;
+
+    uint32_t contextID() const;
+    void invalidate();
+
+    LayerHostingMode layerHostingMode() { return m_layerHostingMode; }
+
+private:
+    LayerHostingContext(mach_port_t serverPort);
+#if HAVE(LAYER_HOSTING_IN_WINDOW_SERVER)
+    LayerHostingContext();
+#endif
+
+    LayerHostingMode m_layerHostingMode;
+    RetainPtr<WKCAContextRef> m_context;
+};
+
+} // namespace WebKit
+
+#endif // LayerHostingContext_h
diff --git a/Source/WebKit2/Platform/mac/LayerHostingContext.mm b/Source/WebKit2/Platform/mac/LayerHostingContext.mm
new file mode 100644
index 000000000..874b35f05
--- /dev/null
+++ b/Source/WebKit2/Platform/mac/LayerHostingContext.mm
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "LayerHostingContext.h"
+
+#import <wtf/PassOwnPtr.h>
+#import <WebKitSystemInterface.h>
+
+namespace WebKit {
+
+PassOwnPtr<LayerHostingContext> LayerHostingContext::createForPort(mach_port_t serverPort)
+{
+    return adoptPtr(new LayerHostingContext(serverPort));
+}
+
+LayerHostingContext::LayerHostingContext(mach_port_t serverPort)
+{
+    m_layerHostingMode = LayerHostingModeDefault;
+    m_context = WKCAContextMakeRemoteWithServerPort(serverPort);
+}
+
+#if HAVE(LAYER_HOSTING_IN_WINDOW_SERVER)
+PassOwnPtr<LayerHostingContext> LayerHostingContext::createForWindowServer()
+{
+    return adoptPtr(new LayerHostingContext);
+}
+
+LayerHostingContext::LayerHostingContext()
+{
+    m_layerHostingMode = LayerHostingModeInWindowServer;
+    m_context = WKCAContextMakeRemoteForWindowServer();
+}
+#endif
+
+LayerHostingContext::~LayerHostingContext()
+{
+}
+
+void LayerHostingContext::setRootLayer(CALayer *rootLayer)
+{
+    WKCAContextSetLayer(m_context.get(), rootLayer);
+}
+
+CALayer *LayerHostingContext::rootLayer() const
+{
+    return WKCAContextGetLayer(m_context.get());
+}
+
+uint32_t LayerHostingContext::contextID() const
+{
+    return WKCAContextGetContextId(m_context.get());
+}
+
+void LayerHostingContext::invalidate()
+{
+    WKCAContextInvalidate(m_context.get());
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/FullScreen/qt/WebFullScreenManagerQt.h b/Source/WebKit2/Platform/mac/StringUtilities.h
index 8281f36f8..143857601 100644
--- a/Source/WebKit2/WebProcess/FullScreen/qt/WebFullScreenManagerQt.h
+++ b/Source/WebKit2/Platform/mac/StringUtilities.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,28 +23,17 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebFullScreenManagerQt_h
-#define WebFullScreenManagerQt_h
+#ifndef StringUtilities_h
+#define StringUtilities_h
 
-#if ENABLE(FULLSCREEN_API)
-
-#include "WebFullScreenManager.h"
+#import <wtf/Forward.h>
 
 namespace WebKit {
 
-class WebFullScreenManagerQt : public WebFullScreenManager {
-public:
-    WebFullScreenManagerQt(WebPage*);
-    virtual void setRootFullScreenLayer(WebCore::GraphicsLayer*);
-
-private:
-    virtual void beginEnterFullScreenAnimation(float duration);
-    virtual void beginExitFullScreenAnimation(float duration);
-
-};
+// NOTE: This does not use String::operator NSString*() since that function
+// expects to be called on the thread running WebCore.
+NSString* nsStringFromWebCoreString(const String&);
 
 }
 
-#endif // ENABLE(FULLSCREEN_API)
-
-#endif // WebFullScreenManagerQt_h
+#endif // StringUtilities_h
diff --git a/Source/WebKit2/Shared/ContextMenuState.h b/Source/WebKit2/Platform/mac/StringUtilities.mm
index 9e1487b29..6e276eb49 100644
--- a/Source/WebKit2/Shared/ContextMenuState.h
+++ b/Source/WebKit2/Platform/mac/StringUtilities.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,35 +23,19 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ContextMenuState_h
-#define ContextMenuState_h
+#import "config.h"
+#import "StringUtilities.h"
 
-#include "WebCoreArgumentCoders.h"
-#include <wtf/text/WTFString.h>
+#import <WebCore/FoundationExtras.h>
+#import "WKSharedAPICast.h"
+#import "WKStringCF.h"
+#import <wtf/text/WTFString.h>
 
 namespace WebKit {
 
-struct ContextMenuState {
-    String absoluteLinkURLString;
-    String absoluteImageURLString;
+NSString* nsStringFromWebCoreString(const String& string)
+{
+    return string.impl() ? HardAutorelease(WKStringCopyCFString(0, toAPI(string.impl()))) : @"";
+}
 
-    void encode(CoreIPC::ArgumentEncoder* encoder) const
-    {
-        encoder->encode(absoluteLinkURLString);
-        encoder->encode(absoluteImageURLString);
-    }
-
-    static bool decode(CoreIPC::ArgumentDecoder* decoder, ContextMenuState& result)
-    {
-        if (!decoder->decode(result.absoluteLinkURLString))
-            return false;
-        if (!decoder->decode(result.absoluteImageURLString))
-            return false;
-    
-        return true;
-    }
-};
-
-} // namespace WebKit
-
-#endif // ContextMenuState_h
+}
diff --git a/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp b/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
index b548f8126..1fd1b1124 100644
--- a/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
+++ b/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
@@ -45,6 +45,10 @@
 #include <WebCore/NotImplemented.h>
 #include <wtf/text/WTFString.h>
 
+#if PLATFORM(MAC)
+#include "LayerHostingContext.h"
+#endif
+
 using namespace WebCore;
 
 namespace WebKit {
diff --git a/Source/WebKit2/PluginProcess/PluginControllerProxy.h b/Source/WebKit2/PluginProcess/PluginControllerProxy.h
index c79211a8c..e860925c1 100644
--- a/Source/WebKit2/PluginProcess/PluginControllerProxy.h
+++ b/Source/WebKit2/PluginProcess/PluginControllerProxy.h
@@ -36,18 +36,13 @@
 #include <WebCore/RunLoop.h>
 #include <wtf/Noncopyable.h>
 
-#if PLATFORM(MAC)
-#include <wtf/RetainPtr.h>
-
-typedef struct __WKCARemoteLayerClientRef *WKCARemoteLayerClientRef;
-#endif
-
 namespace CoreIPC {
     class DataReference;
 }
 
 namespace WebKit {
 
+class LayerHostingContext;
 class ShareableBitmap;
 class WebProcessConnection;
 struct PluginCreationParameters;
@@ -191,7 +186,7 @@ private:
     bool m_isComplexTextInputEnabled;
 
     // For CA plug-ins, this holds the information needed to export the layer hierarchy to the UI process.
-    RetainPtr<WKCARemoteLayerClientRef> m_remoteLayerClient;
+    OwnPtr<LayerHostingContext> m_layerHostingContext;
 #endif
 
     // The contents scale factor of this plug-in.
diff --git a/Source/WebKit2/PluginProcess/PluginProcess.h b/Source/WebKit2/PluginProcess/PluginProcess.h
index 0cf39c6e5..633bb4103 100644
--- a/Source/WebKit2/PluginProcess/PluginProcess.h
+++ b/Source/WebKit2/PluginProcess/PluginProcess.h
@@ -52,6 +52,8 @@ public:
 
     NetscapePluginModule* netscapePluginModule();
 
+    const String& pluginPath() const { return m_pluginPath; }
+
 #if PLATFORM(MAC)
     void initializeShim();
 
diff --git a/Source/WebKit2/PluginProcess/mac/PluginControllerProxyMac.mm b/Source/WebKit2/PluginProcess/mac/PluginControllerProxyMac.mm
index 95feaa56d..aa2ea4979 100644
--- a/Source/WebKit2/PluginProcess/mac/PluginControllerProxyMac.mm
+++ b/Source/WebKit2/PluginProcess/mac/PluginControllerProxyMac.mm
@@ -28,9 +28,9 @@
 
 #if ENABLE(PLUGIN_PROCESS)
 
+#import "LayerHostingContext.h"
 #import "PluginProcess.h"
 #import "PluginProxyMessages.h"
-#import "WebKitSystemInterface.h"
 #import "WebProcessConnection.h"
 #import <QuartzCore/QuartzCore.h>
 
@@ -59,34 +59,31 @@ void PluginControllerProxy::platformInitialize()
     if (!platformLayer)
         return;
 
-    ASSERT(!m_remoteLayerClient);
-
-    m_remoteLayerClient = WKCARemoteLayerClientMakeWithServerPort(PluginProcess::shared().compositingRenderServerPort());
-    ASSERT(m_remoteLayerClient);
-
-    WKCARemoteLayerClientSetLayer(m_remoteLayerClient.get(), platformLayer);
+    ASSERT(!m_layerHostingContext);
+    m_layerHostingContext = LayerHostingContext::createForPort(PluginProcess::shared().compositingRenderServerPort());
+    m_layerHostingContext->setRootLayer(platformLayer);
 }
 
 void PluginControllerProxy::platformDestroy()
 {
-    if (!m_remoteLayerClient)
+    if (!m_layerHostingContext)
         return;
 
-    WKCARemoteLayerClientInvalidate(m_remoteLayerClient.get());
-    m_remoteLayerClient = nullptr;
+    m_layerHostingContext->invalidate();
+    m_layerHostingContext = nullptr;
 }
 
 uint32_t PluginControllerProxy::remoteLayerClientID() const
 {
-    if (!m_remoteLayerClient)
+    if (!m_layerHostingContext)
         return 0;
 
-    return WKCARemoteLayerClientGetClientId(m_remoteLayerClient.get());
+    return m_layerHostingContext->contextID();
 }
 
 void PluginControllerProxy::platformGeometryDidChange()
 {
-    CALayer * pluginLayer = m_plugin->pluginLayer();
+    CALayer *pluginLayer = m_plugin->pluginLayer();
 
     // We don't want to animate to the new size so we disable actions for this transaction.
     [CATransaction begin];
diff --git a/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.PluginProcess.sb.in b/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.PluginProcess.sb.in
new file mode 100644
index 000000000..ea5241a39
--- /dev/null
+++ b/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.PluginProcess.sb.in
@@ -0,0 +1,191 @@
+(version 1)
+(deny default (with partial-symbolication))
+(allow ipc-posix-shm system-audit system-socket file-read-metadata)
+
+(import "system.sb")
+
+;; Utility functions for home directory relative path filters
+(define (home-regex home-relative-regex)
+  (regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex)))
+
+(define (home-subpath home-relative-subpath)
+  (subpath (string-append (param "HOME_DIR") home-relative-subpath)))
+
+(define (home-literal home-relative-literal)
+  (literal (string-append (param "HOME_DIR") home-relative-literal)))
+
+;; Read-only preferences and data
+(allow file-read*
+       ;; Basic system paths
+       (subpath "/Library/Frameworks")
+       (subpath "/private/var/db/mds")
+
+       ;; System and user preferences
+       (literal "/Library/Preferences/.GlobalPreferences.plist")
+       (literal "/Library/Preferences/com.apple.Bluetooth.plist")
+       (literal "/Library/Preferences/com.apple.QuickTime.plist")
+       (regex #"^/Library/Preferences/com\.apple\.security")
+       (home-literal "/.CFUserTextEncoding")
+       (home-subpath "/Library/Audio")
+       (home-subpath "/Library/ColorPickers")
+       (home-subpath "/Library/ColorSync")
+       (home-subpath "/Library/Components")
+       (home-subpath "/Library/Input Methods")
+       (home-subpath "/Library/KeyBindings")
+       (home-subpath "/Library/Keyboard Layouts")
+       (home-subpath "/Library/Fonts")
+       (home-subpath "/Library/PDF Services")
+       (home-literal "/Library/Preferences/.GlobalPreferences.plist")
+       (home-regex #"/Library/Preferences/ByHost/\.GlobalPreferences\.")
+       (home-regex #"/Library/Preferences/ByHost/com\.apple\.Bluetooth\.")
+       (home-literal "/Library/Preferences/com.apple.ATS.plist")
+       (home-literal "/Library/Preferences/com.apple.driver.AppleBluetoothMultitouch.mouse.plist")
+       (home-literal "/Library/Preferences/com.apple.driver.AppleBluetoothMultitouch.trackpad.plist")
+       (home-literal "/Library/Preferences/com.apple.driver.AppleHIDMouse.plist")
+       (home-literal "/Library/Preferences/com.apple.inputmethodkit.plist")
+       (home-literal "/Library/Preferences/com.apple.iWork.Pages.plist")
+       (home-literal "/Library/Preferences/com.apple.LaunchServices.plist")
+       (home-literal "/Library/Preferences/com.apple.MultitouchSupport.plist")
+       (home-literal "/Library/Preferences/com.apple.opengl.plist")
+       (home-literal "/Library/Preferences/com.apple.security.plist")
+       (home-literal "/Library/Preferences/com.apple.security_common.plist")
+       (home-literal "/Library/Preferences/com.apple.speech.voice.prefs.plist")
+       (home-literal "/Library/Preferences/com.apple.speech.synthesis.general.prefs.plist")
+       (home-literal "/Library/Preferences/com.apple.systemsound.plist")
+       (home-literal "/Library/Preferences/com.apple.universalaccess.plist")
+       (home-literal "/Library/Preferences/com.apple.WebFoundation.plist")
+       (home-literal "/Library/Preferences/com.nvidia.OpenGL.plist")
+       (home-literal "/Library/Preferences/pbs.plist")
+       (home-literal "/Library/Preferences/com.apple.ServicesMenu.Services.plist")
+       (home-literal "/Library/Preferences/QuickTime Preferences")
+
+       (home-literal "/Library/Caches/com.apple.coreaudio.components.plist")
+
+       (subpath "/Library/Audio/Plug-Ins/Components")
+       (home-subpath "/Library/Audio/Plug-Ins/Components")
+       (subpath "/Library/Audio/Plug-Ins/HAL")
+       (subpath "/Library/QuickTime")
+       (home-subpath "/Library/QuickTime")
+       (subpath "/Library/Video/Plug-Ins")
+
+       (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")
+
+       (home-literal "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain")
+
+       ;; FIXME: This should be removed when <rdar://problem/10479685> is fixed.
+       (subpath "/Library/Keychains")
+)
+
+;; Read-write preferences and data
+(allow file*
+       (home-regex #"/Library/Preferences/com\.apple\.WebKit\.PluginProcess\.plist")
+
+       (home-subpath "/Library/Caches/QuickTime")
+
+       ;; FIXME: This should be removed when <rdar://problem/10479685> is fixed.
+       (home-subpath "/Library/Keychains"))
+
+;; IOKit user clients
+(allow iokit-open
+       (iokit-connection "IOAccelerator")
+       (iokit-user-client-class "AGPMClient")
+       (iokit-user-client-class "AppleGraphicsControlClient")
+       (iokit-user-client-class "AppleSNBFBUserClient")
+       (iokit-user-client-class "IOAccelerationUserClient")
+       (iokit-user-client-class "IOAudioControlUserClient")
+       (iokit-user-client-class "IOAudioEngineUserClient")
+       (iokit-user-client-class "IOFramebufferSharedUserClient")
+       (iokit-user-client-class "IOHIDParamUserClient")
+       (iokit-user-client-class "IOSurfaceRootUserClient")
+       (iokit-user-client-class "IOSurfaceSendRight")
+       (iokit-user-client-class "RootDomainUserClient"))
+
+;; Various services required by AppKit and other frameworks
+(allow mach-lookup
+       (global-name "com.apple.CoreServices.coreservicesd")
+       (global-name "com.apple.DiskArbitration.diskarbitrationd")
+       (global-name "com.apple.FileCoordination")
+       (global-name "com.apple.FontObjectsServer")
+       (global-name "com.apple.FontServer")
+       (global-name "com.apple.ImageCaptureExtension2.presence")
+       (global-name "com.apple.SecurityServer")
+       (global-name "com.apple.SystemConfiguration.configd")
+       (global-name "com.apple.audio.VDCAssistant")
+       (global-name "com.apple.audio.audiohald")
+       (global-name "com.apple.audio.coreaudiod")
+       (global-name "com.apple.cmio.VDCAssistant")
+       (global-name "com.apple.cookied") ;; FIXME: <rdar://problem/10790768> Limit access to cookies.
+       (global-name "com.apple.cvmsServ")
+       (global-name "com.apple.ocspd")
+       (global-name "com.apple.pasteboard.1")
+       (global-name "com.apple.window_proxies")
+       (global-name "com.apple.windowserver.active")
+       (global-name "com.apple.cfnetwork.AuthBrokerAgent")
+       (global-name "com.apple.PowerManagement.control")
+       (global-name-regex #"_OpenStep$")
+)
+
+;; Networking
+(allow system-socket (socket-domain AF_ROUTE))
+(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2))) ; SYSPROTO_CONTROL
+(allow network-outbound
+       ;; Kernel controls
+       (control-name "com.apple.network.statistics")
+       (control-name "com.apple.netsrc")
+
+       ;; Local mDNSResponder for DNS, arbitrary outbound TCP
+       (literal "/private/var/run/mDNSResponder")
+       (remote tcp))
+
+(allow mach-lookup
+       (global-name "com.apple.tsm.uiserver")
+       (local-name "com.apple.tsm.portname")
+)
+
+;; Open and Save panels
+(define (apply-read-and-issue-extension op path-filter)
+       (op file-read* path-filter)
+       (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") path-filter)))
+(define (apply-write-and-issue-extension op path-filter)
+       (op file-write* path-filter)
+       (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") path-filter)))
+(define (read-write-and-issue-extensions path-filter)
+       (apply-read-and-issue-extension allow path-filter)
+       (apply-write-and-issue-extension allow path-filter))
+(allow qtn-user
+       (extension "com.apple.app-sandbox.read-write"))
+(read-write-and-issue-extensions (extension "com.apple.app-sandbox.read-write"))
+
+;; Printing
+(allow network-outbound (literal "/private/var/run/cupsd"))
+(allow mach-lookup
+       (global-name "com.apple.printuitool.agent")
+       (global-name "com.apple.printtool.agent")
+       (global-name "com.apple.printtool.daemon"))
+(allow file-read*
+       (home-literal "/.cups/lpoptions")
+       (home-literal "/.cups/client.conf")
+       (literal "/private/etc/cups/client.conf")
+       (literal "/private/etc/cups/lpoptions")
+       (subpath "/private/etc/cups/ppd")
+       (subpath "/private/var/run/cupsd")
+       (home-literal "/Library/Preferences/org.cups.PrintingPrefs.plist"))
+
+;; Text Services Manager
+(allow iokit-set-properties (iokit-property "CapsLockDelayOverride"))
+
+;; Image Capture (used by print preview dialog)
+(allow appleevent-send (appleevent-destination "com.apple.imagecaptureextension2"))
+
+;; Silently block access to some files
+(deny file-read* file-write* (with no-log)
+       (home-regex #"/Library/Preferences/com\.apple\.internetconfigpriv\.plist")
+       (home-regex #"/Library/Preferences/com\.apple\.internetconfig\.plist")
+
+       ;; FIXME: Should be removed after <rdar://problem/9422957> is fixed.
+       (home-literal "/Library/Caches/Cache.db")
+
+       ;; FIXME: Should be removed after <rdar://problem/10463881> is fixed.
+       (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2")
+       (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-journal"))
+
diff --git a/Source/WebKit2/Shared/API/c/WKBase.h b/Source/WebKit2/Shared/API/c/WKBase.h
index adbce6d68..c8656e4a3 100644
--- a/Source/WebKit2/Shared/API/c/WKBase.h
+++ b/Source/WebKit2/Shared/API/c/WKBase.h
@@ -59,6 +59,8 @@ typedef const struct OpaqueWKGraphicsContext* WKGraphicsContextRef;
 typedef const struct OpaqueWKImage* WKImageRef;
 typedef const struct OpaqueWKPointRef* WKPointRef;
 typedef const struct OpaqueWKRectRef* WKRectRef;
+typedef const struct OpaqueWKRenderLayer* WKRenderLayerRef;
+typedef const struct OpaqueWKRenderObject* WKRenderObjectRef;
 typedef const struct OpaqueWKSecurityOrigin* WKSecurityOriginRef;
 typedef const struct OpaqueWKSerializedScriptValue* WKSerializedScriptValueRef;
 typedef const struct OpaqueWKSizeRef* WKSizeRef;
diff --git a/Source/WebKit2/Shared/API/c/WKRenderLayer.cpp b/Source/WebKit2/Shared/API/c/WKRenderLayer.cpp
new file mode 100644
index 000000000..7c2765100
--- /dev/null
+++ b/Source/WebKit2/Shared/API/c/WKRenderLayer.cpp
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKRenderLayer.h"
+
+#include "WKAPICast.h"
+#include "WebRenderLayer.h"
+
+using namespace WebCore;
+using namespace WebKit;
+
+WKTypeID WKRenderLayerGetTypeID()
+{
+    return toAPI(WebRenderLayer::APIType);
+}
+
+WKStringRef WKRenderLayerCopyRendererName(WKRenderLayerRef renderLayerRef)
+{
+    return toCopiedAPI(toImpl(renderLayerRef)->renderObjectName());
+}
+
+WKStringRef WKRenderLayerCopyElementTagName(WKRenderLayerRef renderLayerRef)
+{
+    WebRenderLayer* renderLayer = toImpl(renderLayerRef);
+    if (!renderLayer->elementTagName().isNull())
+        return toCopiedAPI(toImpl(renderLayerRef)->elementTagName());
+
+    return 0;
+}
+
+WKStringRef WKRenderLayerCopyElementID(WKRenderLayerRef renderLayerRef)
+{
+    WebRenderLayer* renderLayer = toImpl(renderLayerRef);
+    if (!renderLayer->elementID().isNull())
+        return toCopiedAPI(toImpl(renderLayerRef)->elementID());
+
+    return 0;
+}
+
+WKArrayRef WKRenderLayerGetElementClassNames(WKRenderLayerRef renderLayerRef)
+{
+    return toAPI(toImpl(renderLayerRef)->elementClassNames());
+}
+
+WKRect WKRenderLayerGetAbsoluteBounds(WKRenderLayerRef renderLayerRef)
+{
+    IntRect bounds = toImpl(renderLayerRef)->absoluteBoundingBox();
+    return WKRectMake(bounds.x(), bounds.y(), bounds.width(), bounds.height());
+}
+
+bool WKRenderLayerIsClipping(WKRenderLayerRef renderLayerRef)
+{
+    return toImpl(renderLayerRef)->isClipping();
+}
+
+bool WKRenderLayerIsClipped(WKRenderLayerRef renderLayerRef)
+{
+    return toImpl(renderLayerRef)->isClipped();
+}
+
+bool WKRenderLayerIsReflection(WKRenderLayerRef renderLayerRef)
+{
+    return toImpl(renderLayerRef)->isReflection();
+}
+
+WKCompositingLayerType WKRenderLayerGetCompositingLayerType(WKRenderLayerRef renderLayerRef)
+{
+    switch (toImpl(renderLayerRef)->compositingLayerType()) {
+    case WebRenderLayer::None:
+        return kWKCompositingLayerTypeNone;
+    case WebRenderLayer::Normal:
+        return kWKCompositingLayerTypeNormal;
+    case WebRenderLayer::Tiled:
+        return kWKCompositingLayerTypeTiled;
+    case WebRenderLayer::Media:
+        return kWKCompositingLayerTypeMedia;
+    case WebRenderLayer::Container:
+        return kWKCompositingLayerTypeContainer;
+    }
+
+    ASSERT_NOT_REACHED();
+    return kWKCompositingLayerTypeNone;
+}
+
+WKArrayRef WKRenderLayerGetNegativeZOrderList(WKRenderLayerRef renderLayerRef)
+{
+    return toAPI(toImpl(renderLayerRef)->negativeZOrderList());
+}
+
+WKArrayRef WKRenderLayerGetNormalFlowList(WKRenderLayerRef renderLayerRef)
+{
+    return toAPI(toImpl(renderLayerRef)->normalFlowList());
+}
+
+WKArrayRef WKRenderLayerGetPositiveZOrderList(WKRenderLayerRef renderLayerRef)
+{
+    return toAPI(toImpl(renderLayerRef)->positiveZOrderList());
+}
diff --git a/Source/WebKit2/Shared/API/c/WKRenderLayer.h b/Source/WebKit2/Shared/API/c/WKRenderLayer.h
new file mode 100644
index 000000000..6683d87b4
--- /dev/null
+++ b/Source/WebKit2/Shared/API/c/WKRenderLayer.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKRenderLayer_h
+#define WKRenderLayer_h
+
+
+#include <WebKit2/WKBase.h>
+#include <WebKit2/WKGeometry.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT WKTypeID WKRenderLayerGetTypeID();
+
+WK_EXPORT WKStringRef WKRenderLayerCopyRendererName(WKRenderLayerRef renderLayer);
+
+WK_EXPORT WKStringRef WKRenderLayerCopyElementTagName(WKRenderLayerRef renderLayer);
+WK_EXPORT WKStringRef WKRenderLayerCopyElementID(WKRenderLayerRef renderLayer);
+WK_EXPORT WKArrayRef WKRenderLayerGetElementClassNames(WKRenderLayerRef renderLayer);
+
+WK_EXPORT WKRect WKRenderLayerGetAbsoluteBounds(WKRenderLayerRef renderLayer);
+
+WK_EXPORT bool WKRenderLayerIsClipping(WKRenderLayerRef renderLayer);
+WK_EXPORT bool WKRenderLayerIsClipped(WKRenderLayerRef renderLayer);
+WK_EXPORT bool WKRenderLayerIsReflection(WKRenderLayerRef renderLayer);
+
+enum WKCompositingLayerType {
+    kWKCompositingLayerTypeNone,
+    kWKCompositingLayerTypeNormal,
+    kWKCompositingLayerTypeTiled,
+    kWKCompositingLayerTypeMedia,
+    kWKCompositingLayerTypeContainer
+};
+typedef enum WKCompositingLayerType WKCompositingLayerType;
+
+WK_EXPORT WKCompositingLayerType WKRenderLayerGetCompositingLayerType(WKRenderLayerRef renderLayer);
+
+WK_EXPORT WKArrayRef WKRenderLayerGetNegativeZOrderList(WKRenderLayerRef renderLayer);
+WK_EXPORT WKArrayRef WKRenderLayerGetNormalFlowList(WKRenderLayerRef renderLayer);
+WK_EXPORT WKArrayRef WKRenderLayerGetPositiveZOrderList(WKRenderLayerRef renderLayer);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // WKRenderLayer_h
diff --git a/Source/WebKit2/WebProcess/FullScreen/win/WebFullScreenManagerWin.h b/Source/WebKit2/Shared/API/c/WKRenderObject.cpp
index 22f74f1cf..1c7274985 100644
--- a/Source/WebKit2/WebProcess/FullScreen/win/WebFullScreenManagerWin.h
+++ b/Source/WebKit2/Shared/API/c/WKRenderObject.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,35 +23,38 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebFullScreenManagerWin_h
-#define WebFullScreenManagerWin_h
+#include "config.h"
+#include "WKRenderObject.h"
 
-#if ENABLE(FULLSCREEN_API)
+#include "WKAPICast.h"
+#include "WebRenderObject.h"
 
-#include "WebFullScreenManager.h"
+using namespace WebCore;
+using namespace WebKit;
 
-#include <WebCore/IntRect.h>
-
-namespace WebKit {
-
-class WebFullScreenManagerWin : public WebFullScreenManager {
-public:
-    static PassRefPtr<WebFullScreenManagerWin> create(WebPage*);
-
-private:
-    WebFullScreenManagerWin(WebPage*);
-    virtual ~WebFullScreenManagerWin();
-
-    virtual void setRootFullScreenLayer(WebCore::GraphicsLayer*);
-    virtual void beginEnterFullScreenAnimation(float duration);
-    virtual void beginExitFullScreenAnimation(float duration);
+WKTypeID WKRenderObjectGetTypeID()
+{
+    return toAPI(WebRenderObject::APIType);
+}
 
-    OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
-    WebCore::GraphicsLayer* m_fullScreenRootLayer;
-};
+WKStringRef WKRenderObjectCopyName(WKRenderObjectRef renderObjectRef)
+{
+    return toCopiedAPI(toImpl(renderObjectRef)->name());
+}
 
+WKPoint WKRenderObjectGetAbsolutePosition(WKRenderObjectRef renderObjectRef)
+{
+    IntPoint absolutePosition = toImpl(renderObjectRef)->absolutePosition();
+    return WKPointMake(absolutePosition.x(), absolutePosition.y());
 }
 
-#endif // ENABLE(FULLSCREEN_API)
+WKRect WKRenderObjectGetFrameRect(WKRenderObjectRef renderObjectRef)
+{
+    IntRect frameRect = toImpl(renderObjectRef)->frameRect();
+    return WKRectMake(frameRect.x(), frameRect.y(), frameRect.width(), frameRect.height());
+}
 
-#endif // WebFullScreenManagerWin_h
+WKArrayRef WKRenderObjectGetChildren(WKRenderObjectRef renderObjectRef)
+{
+    return toAPI(toImpl(renderObjectRef)->children().get());
+}
diff --git a/Source/WebKit2/Shared/API/c/WKRenderObject.h b/Source/WebKit2/Shared/API/c/WKRenderObject.h
new file mode 100644
index 000000000..51d1e22db
--- /dev/null
+++ b/Source/WebKit2/Shared/API/c/WKRenderObject.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKRenderObject_h
+#define WKRenderObject_h
+
+#include <WebKit2/WKBase.h>
+#include <WebKit2/WKGeometry.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT WKTypeID WKRenderObjectGetTypeID();
+
+WK_EXPORT WKStringRef WKRenderObjectCopyName(WKRenderObjectRef renderObject);
+WK_EXPORT WKPoint WKRenderObjectGetAbsolutePosition(WKRenderObjectRef renderObject);
+WK_EXPORT WKRect WKRenderObjectGetFrameRect(WKRenderObjectRef renderObject);
+WK_EXPORT WKArrayRef WKRenderObjectGetChildren(WKRenderObjectRef renderObject);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // WKRenderObject_h
diff --git a/Source/WebKit2/Shared/APIClientTraits.h b/Source/WebKit2/Shared/APIClientTraits.h
index 27c81e4db..0f60fb1d5 100644
--- a/Source/WebKit2/Shared/APIClientTraits.h
+++ b/Source/WebKit2/Shared/APIClientTraits.h
@@ -45,7 +45,7 @@ template<> struct APIClientTraits<WKBundlePageResourceLoadClient> {
 };
 
 template<> struct APIClientTraits<WKPageContextMenuClient> {
-    static const size_t interfaceSizesByVersion[2];
+    static const size_t interfaceSizesByVersion[3];
 };
 
 template<> struct APIClientTraits<WKPageLoaderClient> {
diff --git a/Source/WebKit2/Shared/APIObject.h b/Source/WebKit2/Shared/APIObject.h
index 183cea0a4..d6cc03043 100644
--- a/Source/WebKit2/Shared/APIObject.h
+++ b/Source/WebKit2/Shared/APIObject.h
@@ -48,6 +48,8 @@ public:
         TypeGraphicsContext,
         TypeImage,
         TypeProtectionSpace,
+        TypeRenderLayer,
+        TypeRenderObject,
         TypeSecurityOrigin,
         TypeSerializedScriptValue,
         TypeString,
diff --git a/Source/WebKit2/Shared/LayerTreeContext.h b/Source/WebKit2/Shared/LayerTreeContext.h
index 2db584e57..f33fa9772 100644
--- a/Source/WebKit2/Shared/LayerTreeContext.h
+++ b/Source/WebKit2/Shared/LayerTreeContext.h
@@ -33,6 +33,13 @@ namespace CoreIPC {
 
 namespace WebKit {
 
+enum LayerHostingMode {
+    LayerHostingModeDefault,
+#if HAVE(LAYER_HOSTING_IN_WINDOW_SERVER)
+    LayerHostingModeInWindowServer
+#endif
+};
+
 class LayerTreeContext {
 public:
     LayerTreeContext();
diff --git a/Source/WebKit2/Shared/UserMessageCoders.h b/Source/WebKit2/Shared/UserMessageCoders.h
index df3860805..9672f28df 100644
--- a/Source/WebKit2/Shared/UserMessageCoders.h
+++ b/Source/WebKit2/Shared/UserMessageCoders.h
@@ -38,6 +38,8 @@
 #include "WebGeometry.h"
 #include "WebImage.h"
 #include "WebNumber.h"
+#include "WebRenderLayer.h"
+#include "WebRenderObject.h"
 #include "WebSerializedScriptValue.h"
 #include "WebString.h"
 #include "WebURL.h"
@@ -56,6 +58,8 @@ namespace WebKit {
 //   - WebData -> WebData
 //   - WebDouble -> WebDouble
 //   - WebImage -> WebImage
+//   - WebRenderLayer -> WebRenderLayer
+//   - WebRenderObject -> WebRenderObject
 //   - WebUInt64 -> WebUInt64
 //   - WebURL -> WebURL
 //   - WebURLRequest -> WebURLRequest
@@ -139,6 +143,30 @@ public:
             encoder->encode(rectObject->rect().size.height);
             return true;
         }
+        case APIObject::TypeRenderLayer: {
+            WebRenderLayer* renderLayer = static_cast<WebRenderLayer*>(m_root);
+            encoder->encode(renderLayer->renderObjectName());
+            encoder->encode(renderLayer->elementTagName());
+            encoder->encode(renderLayer->elementID());
+            encoder->encode(Owner(renderLayer->elementClassNames()));
+            encoder->encode(renderLayer->isReflection());
+            encoder->encode(renderLayer->isClipping());
+            encoder->encode(renderLayer->isClipped());
+            encoder->encode(static_cast<uint32_t>(renderLayer->compositingLayerType()));
+            encoder->encode(renderLayer->absoluteBoundingBox());
+            encoder->encode(Owner(renderLayer->negativeZOrderList()));
+            encoder->encode(Owner(renderLayer->normalFlowList()));
+            encoder->encode(Owner(renderLayer->positiveZOrderList()));
+            return true;
+        }
+        case APIObject::TypeRenderObject: {
+            WebRenderObject* renderObject = static_cast<WebRenderObject*>(m_root);
+            encoder->encode(renderObject->name());
+            encoder->encode(renderObject->absolutePosition());
+            encoder->encode(renderObject->frameRect());
+            encoder->encode(Owner(renderObject->children().get()));
+            return true;
+        }
         case APIObject::TypeURL: {
             WebURL* urlObject = static_cast<WebURL*>(m_root);
             encoder->encode(urlObject->string());
@@ -338,6 +366,74 @@ public:
             coder.m_root = WebRect::create(WKRectMake(x, y, width, height));
             break;
         }
+        case APIObject::TypeRenderLayer: {
+            String renderObjectName;
+            String elementTagName;
+            String elementID;
+            RefPtr<APIObject> elementClassNames;
+            bool isReflection;
+            bool isClipping;
+            bool isClipped;
+            uint32_t compositingLayerTypeAsUInt32;
+            WebCore::IntRect absoluteBoundingBox;
+            RefPtr<APIObject> negativeZOrderList;
+            RefPtr<APIObject> normalFlowList;
+            RefPtr<APIObject> positiveZOrderList;
+
+            if (!decoder->decode(renderObjectName))
+                return false;
+            if (!decoder->decode(elementTagName))
+                return false;
+            if (!decoder->decode(elementID))
+                return false;
+            Owner classNamesCoder(coder, elementClassNames);
+            if (!decoder->decode(classNamesCoder))
+                return false;
+            if (!decoder->decodeBool(isReflection))
+                return false;
+            if (!decoder->decodeBool(isClipping))
+                return false;
+            if (!decoder->decodeBool(isClipped))
+                return false;
+            if (!decoder->decodeUInt32(compositingLayerTypeAsUInt32))
+                return false;
+            if (!decoder->decode(absoluteBoundingBox))
+                return false;
+            Owner negativeZOrderListCoder(coder, negativeZOrderList);
+            if (!decoder->decode(negativeZOrderListCoder))
+                return false;
+            Owner normalFlowListCoder(coder, normalFlowList);
+            if (!decoder->decode(normalFlowListCoder))
+                return false;
+            Owner positiveZOrderListCoder(coder, positiveZOrderList);
+            if (!decoder->decode(positiveZOrderListCoder))
+                return false;
+            coder.m_root = WebRenderLayer::create(renderObjectName, elementTagName, elementID, static_pointer_cast<MutableArray>(elementClassNames),
+                isReflection, isClipping, isClipped, static_cast<WebRenderLayer::CompositingLayerType>(compositingLayerTypeAsUInt32),
+                absoluteBoundingBox, static_pointer_cast<MutableArray>(negativeZOrderList), static_pointer_cast<MutableArray>(normalFlowList),
+                static_pointer_cast<MutableArray>(positiveZOrderList));
+            break;
+        }
+        case APIObject::TypeRenderObject: {
+            String name;
+            WebCore::IntPoint absolutePosition;
+            WebCore::IntRect frameRect;
+            RefPtr<APIObject> children;
+            
+            if (!decoder->decode(name))
+                return false;
+            if (!decoder->decode(absolutePosition))
+                return false;
+            if (!decoder->decode(frameRect))
+                return false;
+            Owner messageCoder(coder, children);
+            if (!decoder->decode(messageCoder))
+                return false;
+            if (children->type() != APIObject::TypeArray)
+                return false;
+            coder.m_root = WebRenderObject::create(name, absolutePosition, frameRect, WTF::static_pointer_cast<MutableArray>(children));
+            break;
+        }
         case APIObject::TypeURL: {
             String string;
             if (!decoder->decode(string))
diff --git a/Source/WebKit2/Shared/WebHitTestResult.h b/Source/WebKit2/Shared/WebHitTestResult.h
index 9bf63fca1..d16dcddd4 100644
--- a/Source/WebKit2/Shared/WebHitTestResult.h
+++ b/Source/WebKit2/Shared/WebHitTestResult.h
@@ -49,6 +49,20 @@ public:
         String linkLabel;
         String linkTitle;
 
+        Data()
+        {
+        }
+
+        explicit Data(const WebCore::HitTestResult& hitTestResult)
+            : absoluteImageURL(hitTestResult.absoluteImageURL().string())
+            , absolutePDFURL(hitTestResult.absolutePDFURL().string())
+            , absoluteLinkURL(hitTestResult.absoluteLinkURL().string())
+            , absoluteMediaURL(hitTestResult.absoluteMediaURL().string())
+            , linkLabel(hitTestResult.textContent())
+            , linkTitle(hitTestResult.titleDisplayString())
+        {
+        }
+
         void encode(CoreIPC::ArgumentEncoder*) const;
         static bool decode(CoreIPC::ArgumentDecoder*, WebHitTestResult::Data&);
     };
diff --git a/Source/WebKit2/Shared/WebLayerTreeInfo.cpp b/Source/WebKit2/Shared/WebLayerTreeInfo.cpp
index 164f3c0db..bbf26cd75 100644
--- a/Source/WebKit2/Shared/WebLayerTreeInfo.cpp
+++ b/Source/WebKit2/Shared/WebLayerTreeInfo.cpp
@@ -19,8 +19,7 @@
 
 #include "config.h"
 
-#if USE(ACCELERATED_COMPOSITING)
-
+#if USE(UI_SIDE_COMPOSITING)
 #include "WebLayerTreeInfo.h"
 
 #include "Arguments.h"
diff --git a/Source/WebKit2/Shared/WebLayerTreeInfo.h b/Source/WebKit2/Shared/WebLayerTreeInfo.h
index 54e1cb5ba..723cafd4e 100644
--- a/Source/WebKit2/Shared/WebLayerTreeInfo.h
+++ b/Source/WebKit2/Shared/WebLayerTreeInfo.h
@@ -20,7 +20,7 @@
 #ifndef WebLayerTreeInfo_h
 #define WebLayerTreeInfo_h
 
-#if USE(ACCELERATED_COMPOSITING)
+#if USE(UI_SIDE_COMPOSITING)
 
 #include "ArgumentDecoder.h"
 #include "ArgumentEncoder.h"
diff --git a/Source/WebKit2/Shared/WebRenderLayer.cpp b/Source/WebKit2/Shared/WebRenderLayer.cpp
new file mode 100644
index 000000000..586f1362e
--- /dev/null
+++ b/Source/WebKit2/Shared/WebRenderLayer.cpp
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebRenderLayer.h"
+
+#include "WebPage.h"
+#include "WebString.h"
+#include <WebCore/Frame.h>
+#include <WebCore/FrameLoaderClient.h>
+#include <WebCore/RenderLayer.h>
+#include <WebCore/RenderLayerBacking.h>
+#include <WebCore/RenderView.h>
+#include <WebCore/StyledElement.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+PassRefPtr<WebRenderLayer> WebRenderLayer::create(WebPage* page)
+{
+    Frame* mainFrame = page->mainFrame();
+    if (!mainFrame)
+        return 0;
+
+    if (!mainFrame->loader()->client()->hasHTMLView())
+        return 0;
+
+    RenderView* contentRenderer = mainFrame->contentRenderer();
+    if (!contentRenderer)
+        return 0;
+
+    RenderLayer* rootLayer = contentRenderer->layer();
+    if (!rootLayer)
+        return 0;
+
+    return adoptRef(new WebRenderLayer(rootLayer));
+}
+
+PassRefPtr<MutableArray> WebRenderLayer::createArrayFromLayerList(Vector<RenderLayer*>* list)
+{
+    if (!list || !list->size())
+        return 0;
+
+    RefPtr<MutableArray> array = MutableArray::create();
+    for (size_t i = 0; i < list->size(); ++i) {
+        RefPtr<WebRenderLayer> layer = adoptRef(new WebRenderLayer(list->at(i)));
+        array->append(layer.get());
+    }
+
+    return array.release();
+}
+
+WebRenderLayer::WebRenderLayer(RenderLayer* layer)
+{
+    RenderBoxModelObject* renderer = layer->renderer();
+
+    m_renderObjectName = renderer->renderName();
+
+    if (Node* node = renderer->node()) {
+        if (node->isElementNode()) {
+            Element* element = toElement(node);
+            m_elementTagName = element->tagName();
+            m_elementID = element->getIdAttribute();
+            if (element->isStyledElement() && element->hasClass()) {
+                StyledElement* styledElement = static_cast<StyledElement*>(element);
+                if (size_t classNameCount = styledElement->classNames().size()) {
+                    m_elementClassNames = MutableArray::create();
+                    for (size_t i = 0; i < classNameCount; ++i)
+                        m_elementClassNames->append(WebString::create(styledElement->classNames()[i]).get());
+                }
+            }
+
+        }
+    }
+
+    m_isReflection = layer->isReflection();
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (layer->isComposited()) {
+        RenderLayerBacking* backing = layer->backing();
+        m_isClipping = backing->hasClippingLayer();
+        m_isClipped = backing->hasAncestorClippingLayer();
+        switch (backing->compositingLayerType()) {
+        case NormalCompositingLayer:
+            m_compositingLayerType = Normal;
+            break;
+        case TiledCompositingLayer:
+            m_compositingLayerType = Tiled;
+            break;
+        case MediaCompositingLayer:
+            m_compositingLayerType = Media;
+            break;
+        case ContainerCompositingLayer:
+            m_compositingLayerType = Container;
+            break;
+        }
+    } else {
+#endif
+        m_isClipping = false;
+        m_isClipped = false;
+        m_compositingLayerType = None;
+#if USE(ACCELERATED_COMPOSITING)
+    }
+#endif
+
+    m_absoluteBoundingBox = layer->absoluteBoundingBox();
+
+    m_negativeZOrderList = createArrayFromLayerList(layer->negZOrderList());
+    m_normalFlowList = createArrayFromLayerList(layer->normalFlowList());
+    m_positiveZOrderList = createArrayFromLayerList(layer->posZOrderList());
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/Shared/WebRenderLayer.h b/Source/WebKit2/Shared/WebRenderLayer.h
new file mode 100644
index 000000000..f3323bc40
--- /dev/null
+++ b/Source/WebKit2/Shared/WebRenderLayer.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebRenderLayer_h
+#define WebRenderLayer_h
+
+#include "APIObject.h"
+#include "MutableArray.h"
+#include <WebCore/IntRect.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+    class RenderLayer;
+}
+
+namespace WebKit {
+
+class WebPage;
+
+class WebRenderLayer : public APIObject {
+public:
+    static const Type APIType = TypeRenderLayer;
+
+    enum CompositingLayerType { None, Normal, Tiled, Media, Container };
+
+    static PassRefPtr<WebRenderLayer> create(WebPage*);
+    static PassRefPtr<WebRenderLayer> create(const String& renderObjectName, const String& elementTagName, const String& elementID, PassRefPtr<MutableArray> elementClassNames,
+        bool isReflection, bool isClipping, bool isClipped, CompositingLayerType type, WebCore::IntRect absoluteBoundingBox,
+        PassRefPtr<MutableArray> negativeZOrderList, PassRefPtr<MutableArray> normalFlowList, PassRefPtr<MutableArray> positiveZOrderList)
+    {
+        return adoptRef(new WebRenderLayer(renderObjectName, elementTagName, elementID, elementClassNames, isReflection, isClipping, isClipped,
+            type, absoluteBoundingBox, negativeZOrderList, normalFlowList, positiveZOrderList));
+    }
+
+    ImmutableArray* negativeZOrderList() const { return m_negativeZOrderList.get(); }
+    ImmutableArray* normalFlowList() const { return m_normalFlowList.get(); }
+    ImmutableArray* positiveZOrderList() const { return m_positiveZOrderList.get(); }
+
+    const String& renderObjectName() const { return m_renderObjectName; }
+    const String& elementTagName() const { return m_elementTagName; }
+    const String& elementID() const { return m_elementID; }
+    ImmutableArray* elementClassNames() const { return m_elementClassNames.get(); }
+    bool isReflection() const { return m_isReflection; }
+    bool isClipping() const { return m_isClipping; }
+    bool isClipped() const { return m_isClipped; }
+    CompositingLayerType compositingLayerType() const { return m_compositingLayerType; } 
+    WebCore::IntRect absoluteBoundingBox() const { return m_absoluteBoundingBox; }
+
+private:
+    WebRenderLayer(WebCore::RenderLayer*);
+    WebRenderLayer(const String& renderObjectName, const String& elementTagName, const String& elementID, PassRefPtr<MutableArray> elementClassNames,
+        bool isReflection, bool isClipping, bool isClipped, CompositingLayerType type, WebCore::IntRect absoluteBoundingBox,
+        PassRefPtr<MutableArray> negativeZOrderList, PassRefPtr<MutableArray> normalFlowList, PassRefPtr<MutableArray> positiveZOrderList)
+        : m_renderObjectName(renderObjectName)
+        , m_elementTagName(elementTagName)
+        , m_elementID(elementID)
+        , m_elementClassNames(elementClassNames)
+        , m_isReflection(isReflection)
+        , m_isClipping(isClipping)
+        , m_isClipped(isClipped)
+        , m_compositingLayerType(type)
+        , m_absoluteBoundingBox(absoluteBoundingBox)
+        , m_negativeZOrderList(negativeZOrderList)
+        , m_normalFlowList(normalFlowList)
+        , m_positiveZOrderList(positiveZOrderList)
+    {
+    }
+
+    virtual Type type() const OVERRIDE { return APIType; }
+
+    static PassRefPtr<MutableArray> createArrayFromLayerList(Vector<WebCore::RenderLayer*>*);
+
+    String m_renderObjectName;
+    String m_elementTagName;
+    String m_elementID;
+    RefPtr<MutableArray> m_elementClassNames;
+    bool m_isReflection;
+    bool m_isClipping;
+    bool m_isClipped;
+    CompositingLayerType m_compositingLayerType;
+    WebCore::IntRect m_absoluteBoundingBox;
+
+    RefPtr<MutableArray> m_negativeZOrderList;
+    RefPtr<MutableArray> m_normalFlowList;
+    RefPtr<MutableArray> m_positiveZOrderList;
+};
+
+} // namespace WebKit
+
+#endif // WebRenderLayer_h
diff --git a/Source/WebKit2/Shared/WebRenderObject.cpp b/Source/WebKit2/Shared/WebRenderObject.cpp
new file mode 100644
index 000000000..6f3bcffd3
--- /dev/null
+++ b/Source/WebKit2/Shared/WebRenderObject.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebRenderObject.h"
+
+#include "WebPage.h"
+#include <WebCore/Frame.h>
+#include <WebCore/FrameLoaderClient.h>
+#include <WebCore/RenderText.h>
+#include <WebCore/RenderView.h>
+#include <WebCore/RenderWidget.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+PassRefPtr<WebRenderObject> WebRenderObject::create(WebPage* page)
+{
+    Frame* mainFrame = page->mainFrame();
+    if (!mainFrame)
+        return 0;
+
+    if (!mainFrame->loader()->client()->hasHTMLView())
+        return 0;
+
+    RenderView* contentRenderer = mainFrame->contentRenderer();
+    if (!contentRenderer)
+        return 0;
+
+    return adoptRef(new WebRenderObject(contentRenderer));
+}
+
+WebRenderObject::WebRenderObject(RenderObject* renderer)
+{
+    m_name = renderer->renderName();
+
+    // FIXME: broken with transforms
+    m_absolutePosition = flooredIntPoint(renderer->localToAbsolute(FloatPoint()));
+
+    if (renderer->isBox())
+        m_frameRect = toRenderBox(renderer)->frameRect();
+    else if (renderer->isText()) {
+        m_frameRect = toRenderText(renderer)->linesBoundingBox();
+        m_frameRect.setX(toRenderText(renderer)->firstRunX());
+        m_frameRect.setY(toRenderText(renderer)->firstRunY());
+    } else if (renderer->isRenderInline())
+        m_frameRect = toRenderBoxModelObject(renderer)->borderBoundingBox();
+
+    m_children = MutableArray::create();
+    for (RenderObject* coreChild = renderer->firstChild(); coreChild; coreChild = coreChild->nextSibling()) {
+        RefPtr<WebRenderObject> child = adoptRef(new WebRenderObject(coreChild));
+        m_children->append(child.get());
+    }
+
+    if (!renderer->isWidget())
+        return;
+
+    Widget* widget = toRenderWidget(renderer)->widget();
+    if (!widget || !widget->isFrameView())
+        return;
+
+    FrameView* frameView = static_cast<FrameView*>(widget);
+    if (RenderView* coreContentRenderer = frameView->frame()->contentRenderer()) {
+        RefPtr<WebRenderObject> contentRenderer = adoptRef(new WebRenderObject(coreContentRenderer));
+        m_children->append(contentRenderer.get());
+    }
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/Shared/WebRenderObject.h b/Source/WebKit2/Shared/WebRenderObject.h
new file mode 100644
index 000000000..1fcb03ca1
--- /dev/null
+++ b/Source/WebKit2/Shared/WebRenderObject.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebRenderObject_h
+#define WebRenderObject_h
+
+#include "APIObject.h"
+#include "MutableArray.h"
+#include <WebCore/IntRect.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+    class RenderObject;
+}
+
+namespace WebKit {
+
+class WebPage;
+
+class WebRenderObject : public APIObject {
+public:
+    static const Type APIType = TypeRenderObject;
+
+    static PassRefPtr<WebRenderObject> create(WebPage*);
+    static PassRefPtr<WebRenderObject> create(const String& name, WebCore::IntPoint absolutePosition, WebCore::IntRect frameRect, PassRefPtr<MutableArray> children)
+    {
+        return adoptRef(new WebRenderObject(name, absolutePosition, frameRect, children));
+    }
+
+    RefPtr<ImmutableArray> children() const { return m_children; }
+
+    const String& name() const { return m_name; }
+    WebCore::IntPoint absolutePosition() const { return m_absolutePosition; }
+    WebCore::IntRect frameRect() const { return m_frameRect; }
+
+private:
+    WebRenderObject(WebCore::RenderObject*);
+    WebRenderObject(const String& name, WebCore::IntPoint absolutePosition, WebCore::IntRect frameRect, PassRefPtr<MutableArray> children)
+        : m_children(children)
+        , m_name(name)
+        , m_absolutePosition(absolutePosition)
+        , m_frameRect(frameRect)
+    {
+    }
+
+    virtual Type type() const OVERRIDE { return APIType; }
+
+    RefPtr<MutableArray> m_children;
+
+    String m_name;
+    WebCore::IntPoint m_absolutePosition;
+    WebCore::IntRect m_frameRect;
+};
+
+} // namespace WebKit
+
+#endif // WebRenderObject_h
diff --git a/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp b/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp
index 4eaff2c7e..4812602f9 100644
--- a/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp
+++ b/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp
@@ -26,7 +26,6 @@
 
 #include "config.h"
 #include "WebEventFactoryQt.h"
-#include <qgraphicssceneevent.h>
 #include <QApplication>
 #include <QKeyEvent>
 #include <QTransform>
diff --git a/Source/WebKit2/Target.pri b/Source/WebKit2/Target.pri
index 2efe7f34c..5968237a1 100644
--- a/Source/WebKit2/Target.pri
+++ b/Source/WebKit2/Target.pri
@@ -12,7 +12,7 @@ load(features)
 include(WebKit2.pri)
 
 WEBKIT += wtf javascriptcore webcore
-QT += declarative quick quick-private
+QT += declarative quick quick-private widgets
 
 CONFIG += staticlib
 
@@ -49,6 +49,8 @@ HEADERS += \
     Shared/API/c/WKMutableDictionary.h \
     Shared/API/c/WKNumber.h \
     Shared/API/c/WKPageLoadTypes.h \
+    Shared/API/c/WKRenderLayer.h \
+    Shared/API/c/WKRenderObject.h \
     Shared/API/c/WKSecurityOrigin.h \
     Shared/API/c/WKSerializedScriptValue.h \
     Shared/API/c/WKSharedAPICast.h \
@@ -112,6 +114,8 @@ HEADERS += \
     Shared/WebPopupItem.h \
     Shared/WebPreferencesStore.h \
     Shared/WebProcessCreationParameters.h \
+    Shared/WebRenderLayer.h \
+    Shared/WebRenderObject.h \
     Shared/WebURLRequest.h \
     Shared/WebURLResponse.h \
     Shared/WebUserContentURLPattern.h \
@@ -174,6 +178,7 @@ HEADERS += \
     UIProcess/API/qt/qwebdownloaditem_p_p.h \
     UIProcess/API/qt/qwebpermissionrequest_p.h \
     UIProcess/API/qt/qtwebsecurityorigin_p.h \
+    UIProcess/API/qt/qwebloadrequest_p.h \
     UIProcess/API/qt/qwebnavigationrequest_p.h \
     UIProcess/API/qt/qquickwebpage_p.h \
     UIProcess/API/qt/qquickwebpage_p_p.h \
@@ -241,6 +246,7 @@ HEADERS += \
     UIProcess/WebIconDatabaseClient.h \
     UIProcess/WebInspectorProxy.h \
     UIProcess/WebKeyValueStorageManagerProxy.h \
+    UIProcess/WebLayerTreeRenderer.h \
     UIProcess/WebLoaderClient.h \
     UIProcess/WebMediaCacheManagerProxy.h \
     UIProcess/WebNavigationData.h \
@@ -282,7 +288,6 @@ HEADERS += \
     WebProcess/Downloads/DownloadManager.h \
     WebProcess/Downloads/qt/QtFileDownloader.h \
     WebProcess/FullScreen/WebFullScreenManager.h \
-    WebProcess/FullScreen/qt/WebFullScreenManagerQt.h \
     WebProcess/Geolocation/GeolocationPermissionRequestManager.h \
     WebProcess/Geolocation/WebGeolocationManager.h \
     WebProcess/IconDatabase/WebIconDatabaseProxy.h \
@@ -318,7 +323,7 @@ HEADERS += \
     WebProcess/Plugins/Netscape/NPJSObject.h \
     WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h \
     WebProcess/Plugins/Netscape/NPRuntimeUtilities.h \
-    WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp \
+    WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.h \
     WebProcess/Plugins/Netscape/NetscapePlugin.h \
     WebProcess/Plugins/Netscape/NetscapePluginStream.h \
     WebProcess/Plugins/Plugin.h \
@@ -392,6 +397,8 @@ SOURCES += \
     Shared/API/c/WKImage.cpp \
     Shared/API/c/WKMutableDictionary.cpp \
     Shared/API/c/WKNumber.cpp \
+    Shared/API/c/WKRenderLayer.cpp \
+    Shared/API/c/WKRenderObject.cpp \
     Shared/API/c/WKSecurityOrigin.cpp \
     Shared/API/c/WKSerializedScriptValue.cpp \
     Shared/API/c/WKString.cpp \
@@ -454,6 +461,8 @@ SOURCES += \
     Shared/WebPopupItem.cpp \
     Shared/WebPreferencesStore.cpp \
     Shared/WebProcessCreationParameters.cpp \
+    Shared/WebRenderLayer.cpp \
+    Shared/WebRenderObject.cpp \
     Shared/WebTouchEvent.cpp \
     Shared/WebURLRequest.cpp \
     Shared/WebURLResponse.cpp \
@@ -503,6 +512,7 @@ SOURCES += \
     UIProcess/API/qt/qwebdownloaditem.cpp \
     UIProcess/API/qt/qwebpermissionrequest.cpp \
     UIProcess/API/qt/qtwebsecurityorigin.cpp \
+    UIProcess/API/qt/qwebloadrequest.cpp \
     UIProcess/API/qt/qwebnavigationrequest.cpp \
     UIProcess/API/qt/qquickwebpage.cpp \
     UIProcess/API/qt/qwebnavigationhistory.cpp \
@@ -530,6 +540,7 @@ SOURCES += \
     UIProcess/Launcher/ThreadLauncher.cpp \
     UIProcess/Launcher/qt/ProcessLauncherQt.cpp \
     UIProcess/Launcher/qt/ThreadLauncherQt.cpp \
+    UIProcess/LayerTreeHostProxy.cpp \
     UIProcess/Notifications/NotificationPermissionRequest.cpp \
     UIProcess/Notifications/NotificationPermissionRequestManagerProxy.cpp \
     UIProcess/Notifications/WebNotification.cpp \
@@ -570,6 +581,7 @@ SOURCES += \
     UIProcess/WebIconDatabaseClient.cpp \
     UIProcess/WebInspectorProxy.cpp \
     UIProcess/WebKeyValueStorageManagerProxy.cpp \
+    UIProcess/WebLayerTreeRenderer.cpp \
     UIProcess/WebLoaderClient.cpp \
     UIProcess/WebMediaCacheManagerProxy.cpp \
     UIProcess/WebNavigationData.cpp \
@@ -585,7 +597,6 @@ SOURCES += \
     UIProcess/WebUIClient.cpp \
     UIProcess/qt/QtWebContext.cpp \
     UIProcess/qt/LayerBackingStore.cpp \
-    UIProcess/qt/LayerTreeHostProxyQt.cpp \
     UIProcess/qt/QtWebPageEventHandler.cpp \
     UIProcess/qt/QtGestureRecognizer.cpp \
     UIProcess/qt/QtPanGestureRecognizer.cpp \
@@ -619,7 +630,6 @@ SOURCES += \
     WebProcess/Downloads/qt/DownloadQt.cpp \
     WebProcess/Downloads/qt/QtFileDownloader.cpp \
     WebProcess/FullScreen/WebFullScreenManager.cpp \
-    WebProcess/FullScreen/qt/WebFullScreenManagerQt.cpp \
     WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp \
     WebProcess/Geolocation/WebGeolocationManager.cpp \
     WebProcess/IconDatabase/WebIconDatabaseProxy.cpp \
@@ -723,7 +733,6 @@ SOURCES += \
     WebProcess/qt/WebProcessMainQt.cpp \
     WebProcess/qt/WebProcessQt.cpp
 
-
 mac: {
     INCLUDEPATH += \
         Platform/mac \
diff --git a/Source/WebKit2/UIProcess/API/C/WKAPICast.h b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
index 0e7175a42..bd3fa2d74 100644
--- a/Source/WebKit2/UIProcess/API/C/WKAPICast.h
+++ b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
@@ -83,6 +83,8 @@ class WebPageProxy;
 class WebPluginSiteDataManager;
 class WebPreferences;
 class WebProtectionSpace;
+class WebRenderLayer;
+class WebRenderObject;
 class WebTextChecker;
 
 WK_ADD_API_MAPPING(WKApplicationCacheManagerRef, WebApplicationCacheManagerProxy)
@@ -119,6 +121,8 @@ WK_ADD_API_MAPPING(WKPageRef, WebPageProxy)
 WK_ADD_API_MAPPING(WKPluginSiteDataManagerRef, WebPluginSiteDataManager)
 WK_ADD_API_MAPPING(WKPreferencesRef, WebPreferences)
 WK_ADD_API_MAPPING(WKProtectionSpaceRef, WebProtectionSpace)
+WK_ADD_API_MAPPING(WKRenderLayerRef, WebRenderLayer)
+WK_ADD_API_MAPPING(WKRenderObjectRef, WebRenderObject)
 WK_ADD_API_MAPPING(WKTextCheckerRef, WebTextChecker)
 
 #if ENABLE(INSPECTOR)
diff --git a/Source/WebKit2/UIProcess/API/C/WKInspector.cpp b/Source/WebKit2/UIProcess/API/C/WKInspector.cpp
index 1a4ecc7c9..7e2187dda 100644
--- a/Source/WebKit2/UIProcess/API/C/WKInspector.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKInspector.cpp
@@ -48,6 +48,11 @@ bool WKInspectorIsVisible(WKInspectorRef inspectorRef)
     return toImpl(inspectorRef)->isVisible();
 }
 
+bool WKInspectorIsFront(WKInspectorRef inspectorRef)
+{
+    return toImpl(inspectorRef)->isFront();
+}
+
 void WKInspectorShow(WKInspectorRef inspectorRef)
 {
     toImpl(inspectorRef)->show();
diff --git a/Source/WebKit2/UIProcess/API/C/WKInspector.h b/Source/WebKit2/UIProcess/API/C/WKInspector.h
index 2e85688d0..a00d103de 100644
--- a/Source/WebKit2/UIProcess/API/C/WKInspector.h
+++ b/Source/WebKit2/UIProcess/API/C/WKInspector.h
@@ -43,6 +43,7 @@ WK_EXPORT WKTypeID WKInspectorGetTypeID();
 WK_EXPORT WKPageRef WKInspectorGetPage(WKInspectorRef inspector);
 
 WK_EXPORT bool WKInspectorIsVisible(WKInspectorRef inspector);
+WK_EXPORT bool WKInspectorIsFront(WKInspectorRef inspector);
 WK_EXPORT void WKInspectorShow(WKInspectorRef inspector);
 WK_EXPORT void WKInspectorClose(WKInspectorRef inspector);
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKNotification.cpp b/Source/WebKit2/UIProcess/API/C/WKNotification.cpp
index 634aa9824..5dfcbba29 100644
--- a/Source/WebKit2/UIProcess/API/C/WKNotification.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKNotification.cpp
@@ -52,6 +52,11 @@ WKStringRef WKNotificationCopyIconURL(WKNotificationRef notification)
     return toCopiedAPI(toImpl(notification)->iconURL());
 }
 
+WKStringRef WKNotificationCopyReplaceID(WKNotificationRef notification)
+{
+    return toCopiedAPI(toImpl(notification)->replaceID());
+}
+
 WKSecurityOriginRef WKNotificationGetSecurityOrigin(WKNotificationRef notification)
 {
     return toAPI(toImpl(notification)->origin());
diff --git a/Source/WebKit2/UIProcess/API/C/WKNotification.h b/Source/WebKit2/UIProcess/API/C/WKNotification.h
index 7c2723896..11ea97275 100644
--- a/Source/WebKit2/UIProcess/API/C/WKNotification.h
+++ b/Source/WebKit2/UIProcess/API/C/WKNotification.h
@@ -37,6 +37,7 @@ WK_EXPORT WKTypeID WKNotificationGetTypeID();
 WK_EXPORT WKStringRef WKNotificationCopyTitle(WKNotificationRef notification);
 WK_EXPORT WKStringRef WKNotificationCopyBody(WKNotificationRef notification);
 WK_EXPORT WKStringRef WKNotificationCopyIconURL(WKNotificationRef notification);
+WK_EXPORT WKStringRef WKNotificationCopyReplaceID(WKNotificationRef notification);
 WK_EXPORT WKSecurityOriginRef WKNotificationGetSecurityOrigin(WKNotificationRef notification);
 WK_EXPORT uint64_t WKNotificationGetID(WKNotificationRef notification);
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.cpp b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
index 3010016c3..130dd0e45 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
@@ -660,6 +660,11 @@ void WKPageDrawPagesToPDF(WKPageRef page, WKFrameRef frame, WKPrintInfo printInf
 {
     toImpl(page)->drawPagesToPDF(toImpl(frame), printInfoFromWKPrintInfo(printInfo), first, count, DataCallback::create(context, callback));
 }
+
+void WKPageEndPrinting(WKPageRef page)
+{
+    toImpl(page)->endPrinting();
+}
 #endif
 
 WKImageRef WKPageCreateSnapshotOfVisibleContent(WKPageRef)
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.h b/Source/WebKit2/UIProcess/API/C/WKPage.h
index 96d097c60..05b7aff0c 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.h
@@ -285,24 +285,29 @@ enum {
 };
 
 // ContextMenu client
-typedef void (*WKPageGetContextMenuFromProposedContextMenuCallback)(WKPageRef page, WKArrayRef proposedMenu, WKArrayRef* newMenu, WKTypeRef userData, const void* clientInfo);
+typedef void (*WKPageGetContextMenuFromProposedContextMenuCallback)(WKPageRef page, WKArrayRef proposedMenu, WKArrayRef* newMenu, WKHitTestResultRef hitTestResult, WKTypeRef userData, const void* clientInfo);
 typedef void (*WKPageCustomContextMenuItemSelectedCallback)(WKPageRef page, WKContextMenuItemRef contextMenuItem, const void* clientInfo);
 typedef void (*WKPageContextMenuDismissedCallback)(WKPageRef page, const void* clientInfo);
 
+// Deprecated
+typedef void (*WKPageGetContextMenuFromProposedContextMenuCallback_deprecatedForUseWithV0)(WKPageRef page, WKArrayRef proposedMenu, WKArrayRef* newMenu, WKTypeRef userData, const void* clientInfo);
 struct WKPageContextMenuClient {
-    int                                                                 version;
-    const void *                                                        clientInfo;
-    
+    int                                                                          version;
+    const void *                                                                 clientInfo;
+
     // Version 0
-    WKPageGetContextMenuFromProposedContextMenuCallback                 getContextMenuFromProposedMenu;
-    WKPageCustomContextMenuItemSelectedCallback                         customContextMenuItemSelected;
-    
+    WKPageGetContextMenuFromProposedContextMenuCallback_deprecatedForUseWithV0   getContextMenuFromProposedMenu_deprecatedForUseWithV0;
+    WKPageCustomContextMenuItemSelectedCallback                                  customContextMenuItemSelected;
+
     // Version 1
-    WKPageContextMenuDismissedCallback                                  contextMenuDismissed;
+    WKPageContextMenuDismissedCallback                                           contextMenuDismissed;
+
+    // Version 2
+    WKPageGetContextMenuFromProposedContextMenuCallback                          getContextMenuFromProposedMenu;
 };
 typedef struct WKPageContextMenuClient WKPageContextMenuClient;
 
-enum { kWKPageContextMenuClientCurrentVersion = 1 };
+enum { kWKPageContextMenuClientCurrentVersion = 2 };
 
 WK_EXPORT WKTypeID WKPageGetTypeID();
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKPagePrivate.h b/Source/WebKit2/UIProcess/API/C/WKPagePrivate.h
index 097aabfe1..18860fd74 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPagePrivate.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPagePrivate.h
@@ -83,6 +83,7 @@ WK_EXPORT void WKPageComputePagesForPrinting(WKPageRef page, WKFrameRef frame, W
 typedef void (*WKPageDrawToPDFFunction)(WKDataRef data, WKErrorRef error, void* functionContext);
 WK_EXPORT void WKPageBeginPrinting(WKPageRef page, WKFrameRef frame, WKPrintInfo printInfo);
 WK_EXPORT void WKPageDrawPagesToPDF(WKPageRef page, WKFrameRef frame, WKPrintInfo printInfo, uint32_t first, uint32_t count, WKPageDrawToPDFFunction callback, void* context);
+WK_EXPORT void WKPageEndPrinting(WKPageRef page);
 
 // FIXME https://bugs.webkit.org/show_bug.cgi?id=66979: Remove this sync call.
 WK_EXPORT WKImageRef WKPageCreateSnapshotOfVisibleContent(WKPageRef page);
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
index 87d32ed2f..39903bcb5 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
@@ -688,6 +688,16 @@ bool WKPreferencesGetSuppressesIncrementalRendering(WKPreferencesRef preferences
     return toImpl(preferencesRef)->suppressesIncrementalRendering();
 }
 
+void WKPreferencesSetSuppressIncrementalRendering(WKPreferencesRef preferencesRef, bool enabled)
+{
+    WKPreferencesSetSuppressesIncrementalRendering(preferencesRef, enabled);
+}
+
+bool WKPreferencesGetSuppressIncrementalRendering(WKPreferencesRef preferencesRef)
+{
+    return WKPreferencesGetSuppressesIncrementalRendering(preferencesRef);
+}
+
 void WKPreferencesSetBackspaceKeyNavigationEnabled(WKPreferencesRef preferencesRef, bool enabled)
 {
     toImpl(preferencesRef)->setBackspaceKeyNavigationEnabled(enabled);
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.h b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
index 8054e00f3..501c5a5d6 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
@@ -172,6 +172,11 @@ WK_EXPORT bool WKPreferencesGetWebAudioEnabled(WKPreferencesRef preferencesRef);
 // Defaults to false
 WK_EXPORT void WKPreferencesSetSuppressesIncrementalRendering(WKPreferencesRef preferencesRef, bool enabled);
 WK_EXPORT bool WKPreferencesGetSuppressesIncrementalRendering(WKPreferencesRef preferencesRef);
+    
+// Defaults to false
+// These functions are deprecated. See <rdar://problem/10929617> Remove WKPreferences[Get|Set]SuppressIncrementalRendering from WKPreferences.h.
+WK_EXPORT void WKPreferencesSetSuppressIncrementalRendering(WKPreferencesRef preferencesRef, bool enabled);
+WK_EXPORT bool WKPreferencesGetSuppressIncrementalRendering(WKPreferencesRef preferencesRef);
 
 // Defaults to true
 WK_EXPORT void WKPreferencesSetBackspaceKeyNavigationEnabled(WKPreferencesRef preferencesRef, bool enabled);
diff --git a/Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.h b/Source/WebKit2/UIProcess/API/C/mac/WKInspectorPrivateMac.h
index 51f5527fc..aef86a5d9 100644
--- a/Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.h
+++ b/Source/WebKit2/UIProcess/API/C/mac/WKInspectorPrivateMac.h
@@ -23,28 +23,27 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebFullScreenManagerGtk_h
-#define WebFullScreenManagerGtk_h
+#ifndef WKInspectorPrivateMac_h
+#define WKInspectorPrivateMac_h
 
-#if ENABLE(FULLSCREEN_API)
+#ifdef __cplusplus
+extern "C" {
+#endif
 
-#include "WebFullScreenManager.h"
+const NSInteger WKInspectorViewTag = 1000;
 
-namespace WebKit {
-
-class WebFullScreenManagerGtk : public WebFullScreenManager {
-public:
-    WebFullScreenManagerGtk(WebPage*);
-    virtual void setRootFullScreenLayer(WebCore::GraphicsLayer*);
+// This class is the Web Inspector window delegate. It can be used to add interface
+// actions that need to work when the Web Inspector window is key.
+WK_EXPORT @interface WKWebInspectorProxyObjCAdapter : NSObject <NSWindowDelegate> {
+    void* _inspectorProxy;
+}
 
-private:
-    virtual void beginEnterFullScreenAnimation(float duration);
-    virtual void beginExitFullScreenAnimation(float duration);
+@property (readonly) WKInspectorRef inspectorRef;
 
-};
+@end
 
+#ifdef __cplusplus
 }
+#endif
 
-#endif // ENABLE(FULLSCREEN_API)
-
-#endif // WebFullScreenManagerGtk_h
+#endif // WKInspectorPrivateMac_h
diff --git a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp
index a56265adb..c21162903 100644
--- a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp
@@ -213,6 +213,11 @@ void PageClientImpl::exitAcceleratedCompositingMode()
 {
     notImplemented();
 }
+
+void PageClientImpl::updateAcceleratedCompositingMode(const LayerTreeContext&)
+{
+    notImplemented();
+}
 #endif // USE(ACCELERATED_COMPOSITING)
 
 void PageClientImpl::didChangeScrollbarsForMainFrame() const
diff --git a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h
index 2522153d4..40af3b23f 100644
--- a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h
@@ -85,6 +85,7 @@ private:
 #if USE(ACCELERATED_COMPOSITING)
     virtual void enterAcceleratedCompositingMode(const LayerTreeContext&);
     virtual void exitAcceleratedCompositingMode();
+    virtual void updateAcceleratedCompositingMode(const LayerTreeContext&);
 #endif
 
     virtual void didChangeScrollbarsForMainFrame() const;
diff --git a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
index c3ad3f764..9fadbeab5 100644
--- a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
@@ -242,6 +242,11 @@ void PageClientImpl::exitAcceleratedCompositingMode()
 {
     notImplemented();
 }
+
+void PageClientImpl::updateAcceleratedCompositingMode(const LayerTreeContext&)
+{
+    notImplemented();
+}
 #endif // USE(ACCELERATED_COMPOSITING)
 
 void PageClientImpl::didCommitLoadForMainFrame(bool useCustomRepresentation)
diff --git a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h
index 291ba212b..6a1cb2459 100644
--- a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h
@@ -92,6 +92,7 @@ private:
 #if USE(ACCELERATED_COMPOSITING)
     virtual void enterAcceleratedCompositingMode(const LayerTreeContext&);
     virtual void exitAcceleratedCompositingMode();
+    virtual void updateAcceleratedCompositingMode(const LayerTreeContext&);
 #endif
 
     virtual void didCommitLoadForMainFrame(bool useCustomRepresentation);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h b/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h
index 8c3eec2a4..96bcb4ea2 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h
@@ -33,6 +33,8 @@
 #include <glib.h>
 
 typedef struct _WebKitPrintOperation WebKitPrintOperation;
+typedef struct _WebKitFindController WebKitFindController;
+typedef struct _WebKitWebView        WebKitWebView;
 
 #ifdef G_OS_WIN32
 #    ifdef BUILDING_WEBKIT
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.cpp
index 4d4eba18d..018f08d3d 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.cpp
@@ -169,18 +169,14 @@ static void webkit_download_class_init(WebKitDownloadClass* downloadClass)
      * This signal is emitted after response is received,
      * every time new data has been written to the destination. It's
      * useful to know the progress of the download operation.
-     *
-     * Returns: %TRUE to stop other handlers from being invoked for the event.
-     *   %FALSE to propagate the event further.
      */
     signals[RECEIVED_DATA] =
         g_signal_new("received-data",
                      G_TYPE_FROM_CLASS(objectClass),
                      G_SIGNAL_RUN_LAST,
-                     G_STRUCT_OFFSET(WebKitDownloadClass, received_data),
-                     g_signal_accumulator_true_handled, NULL,
-                     webkit_marshal_BOOLEAN__UINT64,
-                     G_TYPE_BOOLEAN, 1,
+                     0, 0, 0,
+                     webkit_marshal_VOID__UINT64,
+                     G_TYPE_NONE, 1,
                      G_TYPE_UINT64);
 
     /**
@@ -189,18 +185,14 @@ static void webkit_download_class_init(WebKitDownloadClass* downloadClass)
      *
      * This signal is emitted when download finishes successfully or due to an error.
      * In case of errors #WebKitDownload::failed signal is emitted before this one.
-     *
-     * Returns: %TRUE to stop other handlers from being invoked for the event.
-     *   %FALSE to propagate the event further.
      */
     signals[FINISHED] =
         g_signal_new("finished",
                      G_TYPE_FROM_CLASS(objectClass),
                      G_SIGNAL_RUN_LAST,
-                     G_STRUCT_OFFSET(WebKitDownloadClass, finished),
-                     g_signal_accumulator_true_handled, NULL,
-                     webkit_marshal_BOOLEAN__VOID,
-                     G_TYPE_BOOLEAN, 0);
+                     0, 0, 0,
+                     g_cclosure_marshal_VOID__VOID,
+                     G_TYPE_NONE, 0);
 
     /**
      * WebKitDownload::failed:
@@ -213,18 +205,14 @@ static void webkit_download_class_init(WebKitDownloadClass* downloadClass)
      * with webkit_download_cancel(), this signal is emitted with error
      * %WEBKIT_DOWNLOAD_ERROR_CANCELLED_BY_USER. The download operation finishes
      * after an error and #WebKitDownload::finished signal is emitted after this one.
-     *
-     * Returns: %TRUE to stop other handlers from being invoked for the event.
-     *   %FALSE to propagate the event further.
      */
     signals[FAILED] =
         g_signal_new("failed",
                      G_TYPE_FROM_CLASS(objectClass),
                      G_SIGNAL_RUN_LAST,
-                     G_STRUCT_OFFSET(WebKitDownloadClass, failed),
-                     g_signal_accumulator_true_handled, NULL,
-                     webkit_marshal_BOOLEAN__POINTER,
-                     G_TYPE_BOOLEAN, 1,
+                     0, 0, 0,
+                     g_cclosure_marshal_VOID__POINTER,
+                     G_TYPE_NONE, 1,
                      G_TYPE_POINTER);
 
     /**
@@ -258,17 +246,13 @@ static void webkit_download_class_init(WebKitDownloadClass* downloadClass)
      * This signal is emitted after #WebKitDownload::decide-destination and before
      * #WebKitDownload::received-data to notify that destination file has been
      * created successfully at @destination.
-     *
-     * Returns: %TRUE to stop other handlers from being invoked for the event.
-     *   %FALSE to propagate the event further.
      */
     signals[CREATED_DESTINATION] =
         g_signal_new("created-destination",
                      G_TYPE_FROM_CLASS(objectClass),
                      G_SIGNAL_RUN_LAST,
-                     G_STRUCT_OFFSET(WebKitDownloadClass, created_destination),
-                     g_signal_accumulator_true_handled, NULL,
-                     webkit_marshal_BOOLEAN__STRING,
+                     0, 0, 0,
+                     g_cclosure_marshal_VOID__STRING,
                      G_TYPE_BOOLEAN, 1,
                      G_TYPE_STRING);
 
@@ -304,8 +288,7 @@ void webkitDownloadNotifyProgress(WebKitDownload* download, guint64 bytesReceive
         download->priv->timer.set(g_timer_new());
 
     priv->currentSize += bytesReceived;
-    gboolean returnValue;
-    g_signal_emit(download, signals[RECEIVED_DATA], 0, bytesReceived, &returnValue);
+    g_signal_emit(download, signals[RECEIVED_DATA], 0, bytesReceived);
 
     // Throttle progress notification to not consume high amounts of
     // CPU on fast links, except when the last notification occured
@@ -333,9 +316,9 @@ void webkitDownloadFailed(WebKitDownload* download, const ResourceError& resourc
                                                  resourceError.localizedDescription().utf8().data()));
     if (download->priv->timer)
         g_timer_stop(download->priv->timer.get());
-    gboolean returnValue;
-    g_signal_emit(download, signals[FAILED], 0, webError.get(), &returnValue);
-    g_signal_emit(download, signals[FINISHED], 0, &returnValue);
+
+    g_signal_emit(download, signals[FAILED], 0, webError.get());
+    g_signal_emit(download, signals[FINISHED], 0, NULL);
 }
 
 void webkitDownloadCancelled(WebKitDownload* download)
@@ -356,8 +339,7 @@ void webkitDownloadFinished(WebKitDownload* download)
     }
     if (download->priv->timer)
         g_timer_stop(download->priv->timer.get());
-    gboolean returnValue;
-    g_signal_emit(download, signals[FINISHED], 0, &returnValue);
+    g_signal_emit(download, signals[FINISHED], 0, NULL);
 }
 
 CString webkitDownloadDecideDestinationWithSuggestedFilename(WebKitDownload* download, const CString& suggestedFilename)
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.h b/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.h
index e200fec53..b6c51fea5 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.h
@@ -50,15 +50,8 @@ struct _WebKitDownload {
 struct _WebKitDownloadClass {
     GObjectClass parent_class;
 
-    gboolean (* received_data)       (WebKitDownload *download,
-                                      guint64         data_length);
-    gboolean (* finished)            (WebKitDownload *download);
-    gboolean (* failed)              (WebKitDownload *download,
-                                      GError         *error);
     gboolean (* decide_destination)  (WebKitDownload *download,
                                       const gchar    *suggested_filename);
-    gboolean (* created_destination) (WebKitDownload *download,
-                                      const gchar    *destination);
 };
 
 WEBKIT_API GType
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitFindController.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitFindController.cpp
new file mode 100644
index 000000000..360137e16
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitFindController.cpp
@@ -0,0 +1,475 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2,1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebKitFindController.h"
+
+#include "WebKitEnumTypes.h"
+#include "WebKitPrivate.h"
+#include "WebKitWebViewBasePrivate.h"
+#include <glib/gi18n-lib.h>
+#include <wtf/gobject/GRefPtr.h>
+#include <wtf/text/CString.h>
+
+using namespace WebCore;
+
+enum {
+    FOUND_TEXT,
+    FAILED_TO_FIND_TEXT,
+    COUNTED_MATCHES,
+
+    LAST_SIGNAL
+};
+
+enum {
+    PROP_0,
+
+    PROP_TEXT,
+    PROP_OPTIONS,
+    PROP_MAX_MATCH_COUNT,
+    PROP_WEB_VIEW
+};
+
+typedef enum {
+    FindOperation,
+    CountOperation
+} WebKitFindControllerOperation;
+
+struct _WebKitFindControllerPrivate {
+    CString searchText;
+    uint32_t findOptions;
+    unsigned maxMatchCount;
+    WebKitWebView* webView;
+};
+
+static guint signals[LAST_SIGNAL] = { 0, };
+
+G_DEFINE_TYPE(WebKitFindController, webkit_find_controller, G_TYPE_OBJECT)
+
+COMPILE_ASSERT_MATCHING_ENUM(WEBKIT_FIND_OPTIONS_CASE_INSENSITIVE, kWKFindOptionsCaseInsensitive);
+COMPILE_ASSERT_MATCHING_ENUM(WEBKIT_FIND_OPTIONS_AT_WORD_STARTS, kWKFindOptionsAtWordStarts);
+COMPILE_ASSERT_MATCHING_ENUM(WEBKIT_FIND_OPTIONS_TREAT_MEDIAL_CAPITAL_AS_WORD_START, kWKFindOptionsTreatMedialCapitalAsWordStart);
+COMPILE_ASSERT_MATCHING_ENUM(WEBKIT_FIND_OPTIONS_BACKWARDS, kWKFindOptionsBackwards);
+COMPILE_ASSERT_MATCHING_ENUM(WEBKIT_FIND_OPTIONS_WRAP_AROUND, kWKFindOptionsWrapAround);
+
+static void didFindString(WKPageRef page, WKStringRef string, unsigned matchCount, const void* clientInfo)
+{
+    g_signal_emit(WEBKIT_FIND_CONTROLLER(clientInfo), signals[FOUND_TEXT], 0, matchCount);
+}
+
+static void didFailToFindString(WKPageRef page, WKStringRef string, const void* clientInfo)
+{
+    g_signal_emit(WEBKIT_FIND_CONTROLLER(clientInfo), signals[FAILED_TO_FIND_TEXT], 0);
+}
+
+static void didCountStringMatches(WKPageRef page, WKStringRef string, unsigned matchCount, const void* clientInfo)
+{
+    g_signal_emit(WEBKIT_FIND_CONTROLLER(clientInfo), signals[COUNTED_MATCHES], 0, matchCount);
+}
+
+static void webkit_find_controller_init(WebKitFindController* findController)
+{
+    WebKitFindControllerPrivate* priv = G_TYPE_INSTANCE_GET_PRIVATE(findController, WEBKIT_TYPE_FIND_CONTROLLER, WebKitFindControllerPrivate);
+    findController->priv = priv;
+    new (priv) WebKitFindControllerPrivate();
+}
+
+static WKPageRef inline getWKPageFromWebKitWebView(WebKitWebView* webView)
+{
+    return toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView)));
+}
+
+static void webkitFindControllerConstructed(GObject* object)
+{
+    WebKitFindController* findController = WEBKIT_FIND_CONTROLLER(object);
+    WKPageFindClient wkFindClient = {
+        kWKPageFindClientCurrentVersion,
+        findController, // clientInfo
+        didFindString,
+        didFailToFindString,
+        didCountStringMatches
+    };
+
+    WKPageSetPageFindClient(getWKPageFromWebKitWebView(findController->priv->webView), &wkFindClient);
+}
+
+static void webkitFindControllerGetProperty(GObject* object, guint propId, GValue* value, GParamSpec* paramSpec)
+{
+    WebKitFindController* findController = WEBKIT_FIND_CONTROLLER(object);
+
+    switch (propId) {
+    case PROP_TEXT:
+        g_value_set_string(value, webkit_find_controller_get_search_text(findController));
+        break;
+    case PROP_OPTIONS:
+        g_value_set_uint(value, webkit_find_controller_get_options(findController));
+        break;
+    case PROP_MAX_MATCH_COUNT:
+        g_value_set_uint(value, webkit_find_controller_get_max_match_count(findController));
+        break;
+    case PROP_WEB_VIEW:
+        g_value_set_object(value, webkit_find_controller_get_web_view(findController));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
+    }
+}
+
+static void webkitFindControllerSetProperty(GObject* object, guint propId, const GValue* value, GParamSpec* paramSpec)
+{
+    WebKitFindController* findController = WEBKIT_FIND_CONTROLLER(object);
+
+    switch (propId) {
+    case PROP_WEB_VIEW:
+        findController->priv->webView = WEBKIT_WEB_VIEW(g_value_get_object(value));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
+    }
+}
+
+static void webkitFindControllerFinalize(GObject* object)
+{
+    WEBKIT_FIND_CONTROLLER(object)->priv->~WebKitFindControllerPrivate();
+    G_OBJECT_CLASS(webkit_find_controller_parent_class)->finalize(object);
+}
+
+static void webkit_find_controller_class_init(WebKitFindControllerClass* findClass)
+{
+    GObjectClass* gObjectClass = G_OBJECT_CLASS(findClass);
+
+    gObjectClass->constructed = webkitFindControllerConstructed;
+    gObjectClass->get_property = webkitFindControllerGetProperty;
+    gObjectClass->set_property = webkitFindControllerSetProperty;
+    gObjectClass->finalize = webkitFindControllerFinalize;
+
+    g_type_class_add_private(findClass, sizeof(WebKitFindControllerPrivate));
+
+    /**
+     * WebKitFindController:text:
+     *
+     * The current search text for this #WebKitFindController.
+     */
+    g_object_class_install_property(gObjectClass,
+                                    PROP_TEXT,
+                                    g_param_spec_string("text",
+                                                        _("Search text"),
+                                                        _("Text to search for in the view"),
+                                                        0,
+                                                        WEBKIT_PARAM_READABLE));
+
+    /**
+     * WebKitFindController:options:
+     *
+     * The options to be used in the search operation.
+     */
+    g_object_class_install_property(gObjectClass,
+                                    PROP_OPTIONS,
+                                    g_param_spec_flags("options",
+                                                       _("Search Options"),
+                                                       _("Search options to be used in the search operation"),
+                                                       WEBKIT_TYPE_FIND_OPTIONS,
+                                                       WEBKIT_FIND_OPTIONS_NONE,
+                                                       WEBKIT_PARAM_READABLE));
+
+    /**
+     * WebKitFindController:max-match-count:
+     *
+     * The maximum number of matches to report for a given search.
+     */
+    g_object_class_install_property(gObjectClass,
+                                    PROP_MAX_MATCH_COUNT,
+                                    g_param_spec_uint("max-match-count",
+                                                      _("Maximum matches count"),
+                                                      _("The maximum number of matches in a given text to report"),
+                                                      0, G_MAXUINT, 0,
+                                                      WEBKIT_PARAM_READABLE));
+
+    /**
+     * WebKitFindController:web-view:
+     *
+     * The #WebKitWebView this controller is associated to.
+     */
+    g_object_class_install_property(gObjectClass,
+                                    PROP_WEB_VIEW,
+                                    g_param_spec_object("web-view",
+                                                        _("WebView"),
+                                                        _("The WebView associated with this find controller"),
+                                                        WEBKIT_TYPE_WEB_VIEW,
+                                                        static_cast<GParamFlags>(WEBKIT_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY)));
+
+    /**
+     * WebKitFindController::found-text:
+     * @find_controller: the #WebKitFindController
+     * @match_count: the number of matches found of the search text
+     *
+     * This signal is emitted when a given text is found in the web
+     * page text. It will be issued if the text is found
+     * asynchronously after a call to webkit_find_controller_search(),
+     * webkit_find_controller_search_next() or
+     * webkit_find_controller_search_previous().
+     */
+    signals[FOUND_TEXT] =
+        g_signal_new("found-text",
+                     G_TYPE_FROM_CLASS(gObjectClass),
+                     G_SIGNAL_RUN_LAST,
+                     0, 0, 0,
+                     g_cclosure_marshal_VOID__UINT,
+                     G_TYPE_NONE, 1, G_TYPE_UINT);
+
+    /**
+     * WebKitFindController::failed-to-find-text:
+     * @find_controller: the #WebKitFindController
+     *
+     * This signal is emitted when a search operation does not find
+     * any result for the given text. It will be issued if the text
+     * is not found asynchronously after a call to
+     * webkit_find_controller_search(), webkit_find_controller_search_next()
+     * or webkit_find_controller_search_previous().
+     */
+    signals[FAILED_TO_FIND_TEXT] =
+        g_signal_new("failed-to-find-text",
+                     G_TYPE_FROM_CLASS(gObjectClass),
+                     G_SIGNAL_RUN_LAST,
+                     0, 0, 0,
+                     g_cclosure_marshal_VOID__VOID,
+                     G_TYPE_NONE, 0);
+
+    /**
+     * WebKitFindController::counted-matches:
+     * @find_controller: the #WebKitFindController
+     * @match_count: the number of matches of the search text
+     *
+     * This signal is emitted when the #WebKitFindController has
+     * counted the number of matches for a given text after a call
+     * to webkit_find_controller_count_matches().
+     */
+    signals[COUNTED_MATCHES] =
+        g_signal_new("counted-matches",
+                     G_TYPE_FROM_CLASS(gObjectClass),
+                     G_SIGNAL_RUN_LAST,
+                     0, 0, 0,
+                     g_cclosure_marshal_VOID__UINT,
+                     G_TYPE_NONE, 1, G_TYPE_UINT);
+}
+
+/**
+ * webkit_find_controller_get_search_text:
+ * @find_controller: the #WebKitFindController
+ *
+ * Gets the text that @find_controller is currently searching
+ * for. This text is passed to either
+ * webkit_find_controller_search() or
+ * webkit_find_controller_count_matches().
+ *
+ * Returns: the text to look for in the #WebKitWebView.
+ */
+const char* webkit_find_controller_get_search_text(WebKitFindController* findController)
+{
+    g_return_val_if_fail(WEBKIT_IS_FIND_CONTROLLER(findController), 0);
+
+    return findController->priv->searchText.data();
+}
+
+/**
+ * webkit_find_controller_get_options:
+ * @find_controller: the #WebKitFindController
+ *
+ * Gets a bitmask containing the #WebKitFindOptions associated with
+ * the current search.
+ *
+ * Returns: a bitmask containing the #WebKitFindOptions associated
+ * with the current search.
+ */
+guint32 webkit_find_controller_get_options(WebKitFindController* findController)
+{
+    g_return_val_if_fail(WEBKIT_IS_FIND_CONTROLLER(findController), WEBKIT_FIND_OPTIONS_NONE);
+
+    return findController->priv->findOptions;
+}
+
+/**
+ * webkit_find_controller_get_max_match_count:
+ * @find_controller: the #WebKitFindController
+ *
+ * Gets the maximum number of matches to report during a text
+ * lookup. This number is passed as the last argument of
+ * webkit_find_controller_search() or
+ * webkit_find_controller_count_matches().
+ *
+ * Returns: the maximum number of matches to report.
+ */
+guint webkit_find_controller_get_max_match_count(WebKitFindController* findController)
+{
+    g_return_val_if_fail(WEBKIT_IS_FIND_CONTROLLER(findController), 0);
+
+    return findController->priv->maxMatchCount;
+}
+
+/**
+ * webkit_find_controller_get_web_view:
+ * @find_controller: the #WebKitFindController
+ *
+ * Gets the #WebKitWebView this find controller is associated to. Do
+ * not unref the returned instance as it belongs to the
+ * #WebKitFindController.
+ *
+ * Returns: (transfer none): the #WebKitWebView.
+ */
+WebKitWebView* webkit_find_controller_get_web_view(WebKitFindController* findController)
+{
+    g_return_val_if_fail(WEBKIT_IS_FIND_CONTROLLER(findController), 0);
+
+    return findController->priv->webView;
+}
+
+static void webKitFindControllerPerform(WebKitFindController* findController, WebKitFindControllerOperation operation)
+{
+    WKFindOptions wkFindOptions = static_cast<WKFindOptions>(findController->priv->findOptions);
+    WKRetainPtr<WKStringRef> wkSearchText(AdoptWK, WKStringCreateWithUTF8CString(findController->priv->searchText.data()));
+    WKPageRef wkPage = getWKPageFromWebKitWebView(findController->priv->webView);
+
+    if (operation == FindOperation) {
+        // Unconditionally highlight text matches. WK1 API was forcing
+        // clients to enable/disable highlighting. Since most of them
+        // (all?) where using highlighting we decided to simplify the
+        // WK2 API and unconditionally show highlights.
+        wkFindOptions = static_cast<WKFindOptions>(findController->priv->findOptions | kWKFindOptionsShowHighlight);
+        WKPageFindString(wkPage, wkSearchText.get(), wkFindOptions, findController->priv->maxMatchCount);
+        return;
+    }
+
+    WKPageCountStringMatches(wkPage, wkSearchText.get(), wkFindOptions, findController->priv->maxMatchCount);
+}
+
+static inline void webKitFindControllerSetSearchData(WebKitFindController* findController, const gchar* searchText, guint32 findOptions, guint maxMatchCount)
+{
+    findController->priv->searchText = searchText;
+    findController->priv->findOptions = findOptions;
+    findController->priv->maxMatchCount = maxMatchCount;
+}
+
+/**
+ * webkit_find_controller_search:
+ * @find_controller: the #WebKitFindController
+ * @search_text: the text to look for
+ * @find_options: a bitmask with the #WebKitFindOptions used in the search
+ * @max_match_count: the maximum number of matches allowed in the search
+ *
+ * Looks for @search_text in the #WebKitWebView associated with
+ * @find_controller since the beginning of the document highlighting
+ * up to @max_match_count matches. The outcome of the search will be
+ * asynchronously provided by the #WebKitFindController::found-text
+ * and #WebKitFindController::failed-to-find-text signals.
+ *
+ * To look for the next or previous occurrences of the same text
+ * with the same find options use webkit_find_controller_search_next()
+ * and/or webkit_find_controller_search_previous(). The
+ * #WebKitFindController will use the same text and options for the
+ * following searches unless they are modified by another call to this
+ * method.
+ *
+ * Note that if the number of matches is higher than @max_match_count
+ * then #WebKitFindController::found-text will report %G_MAXUINT matches
+ * instead of the actual number.
+ *
+ * Callers should call webkit_find_controller_search_finish() to
+ * finish the current search operation.
+ */
+void webkit_find_controller_search(WebKitFindController* findController, const gchar* searchText, guint findOptions, guint maxMatchCount)
+{
+    g_return_if_fail(WEBKIT_IS_FIND_CONTROLLER(findController));
+    g_return_if_fail(searchText);
+
+    webKitFindControllerSetSearchData(findController, searchText, findOptions, maxMatchCount);
+    webKitFindControllerPerform(findController, FindOperation);
+}
+
+/**
+ * webkit_find_controller_search_next:
+ * @find_controller: the #WebKitFindController
+ *
+ * Looks for the next occurrence of the search text.
+ *
+ * Calling this method before webkit_find_controller_search() or
+ * webkit_find_controller_count_matches() is a programming error.
+ */
+void webkit_find_controller_search_next(WebKitFindController* findController)
+{
+    g_return_if_fail(WEBKIT_IS_FIND_CONTROLLER(findController));
+
+    findController->priv->findOptions = findController->priv->findOptions & ~WEBKIT_FIND_OPTIONS_BACKWARDS;
+    webKitFindControllerPerform(findController, FindOperation);
+}
+
+/**
+ * webkit_find_controller_search_previous:
+ * @find_controller: the #WebKitFindController
+ *
+ * Looks for the previous occurrence of the search text.
+ *
+ * Calling this method before webkit_find_controller_search() or
+ * webkit_find_controller_count_matches() is a programming error.
+ */
+void webkit_find_controller_search_previous(WebKitFindController* findController)
+{
+    g_return_if_fail(WEBKIT_IS_FIND_CONTROLLER(findController));
+
+    findController->priv->findOptions = findController->priv->findOptions | WEBKIT_FIND_OPTIONS_BACKWARDS;
+    webKitFindControllerPerform(findController, FindOperation);
+}
+
+/**
+ * webkit_find_controller_count_matches:
+ * @find_controller: the #WebKitFindController
+ * @search_text: the text to look for
+ * @find_options: a bitmask with the #WebKitFindOptions used in the search
+ * @max_match_count: the maximum number of matches allowed in the search
+ *
+ * Counts the number of matches for @search_text found in the
+ * #WebKitWebView with the provided @find_options. The number of
+ * matches will be provided by the
+ * #WebKitFindController::counted-matches signal.
+ */
+void webkit_find_controller_count_matches(WebKitFindController* findController, const gchar* searchText, guint32 findOptions, guint maxMatchCount)
+{
+    g_return_if_fail(WEBKIT_IS_FIND_CONTROLLER(findController));
+    g_return_if_fail(searchText);
+
+    webKitFindControllerSetSearchData(findController, searchText, findOptions, maxMatchCount);
+    webKitFindControllerPerform(findController, CountOperation);
+}
+
+/**
+ * webkit_find_controller_search_finish:
+ * @find_controller: a #WebKitFindController
+ *
+ * Finishes a find operation started by
+ * webkit_find_controller_search(). It will basically unhighlight
+ * every text match found.
+ *
+ * This method will be typically called when the search UI is
+ * closed/hidden by the client application.
+ */
+void webkit_find_controller_search_finish(WebKitFindController* findController)
+{
+    g_return_if_fail(WEBKIT_IS_FIND_CONTROLLER(findController));
+
+    WKPageHideFindUI(getWKPageFromWebKitWebView(findController->priv->webView));
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitFindController.h b/Source/WebKit2/UIProcess/API/gtk/WebKitFindController.h
new file mode 100644
index 000000000..3a47f99d4
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitFindController.h
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2,1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#if !defined(__WEBKIT2_H_INSIDE__) && !defined(WEBKIT2_COMPILATION)
+#error "Only <webkit2/webkit2.h> can be included directly."
+#endif
+
+#ifndef WebKitFindController_h
+#define WebKitFindController_h
+
+#include <glib-object.h>
+#include <webkit2/WebKitDefines.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_FIND_CONTROLLER            (webkit_find_controller_get_type())
+#define WEBKIT_FIND_CONTROLLER(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_FIND_CONTROLLER, WebKitFindController))
+#define WEBKIT_FIND_CONTROLLER_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_FIND_CONTROLLER, WebKitFindControllerClass))
+#define WEBKIT_IS_FIND_CONTROLLER(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_FIND_CONTROLLER))
+#define WEBKIT_IS_FIND_CONTROLLER_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_FIND_CONTROLLER))
+#define WEBKIT_FIND_CONTROLLER_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_FIND_CONTROLLER, WebKitFindControllerClass))
+
+typedef struct _WebKitFindControllerPrivate WebKitFindControllerPrivate;
+typedef struct _WebKitFindControllerClass   WebKitFindControllerClass;
+
+/**
+ * WebKitFindOptions:
+ * @WEBKIT_FIND_OPTIONS_NONE: no search flags, this means a case
+ *   sensitive, no wrap, forward only search.
+ * @WEBKIT_FIND_OPTIONS_CASE_INSENSITIVE: case insensitive search.
+ * @WEBKIT_FIND_OPTIONS_AT_WORD_STARTS: search text only at the
+ *   begining of the words.
+ * @WEBKIT_FIND_OPTIONS_TREAT_MEDIAL_CAPITAL_AS_WORD_START: treat
+ *   capital letters in the middle of words as word start.
+ * @WEBKIT_FIND_OPTIONS_BACKWARDS: search backwards.
+ * @WEBKIT_FIND_OPTIONS_WRAP_AROUND: if not present search will stop
+ *   at the end of the document.
+ *
+ * Enum values used to specify search options.
+ */
+typedef enum {
+  WEBKIT_FIND_OPTIONS_NONE,
+
+  WEBKIT_FIND_OPTIONS_CASE_INSENSITIVE =                   1 << 0,
+  WEBKIT_FIND_OPTIONS_AT_WORD_STARTS =                     1 << 1,
+  WEBKIT_FIND_OPTIONS_TREAT_MEDIAL_CAPITAL_AS_WORD_START = 1 << 2,
+  WEBKIT_FIND_OPTIONS_BACKWARDS =                          1 << 3,
+  WEBKIT_FIND_OPTIONS_WRAP_AROUND =                        1 << 4,
+} WebKitFindOptions;
+
+struct _WebKitFindController {
+    GObject parent;
+
+  /*< private >*/
+  WebKitFindControllerPrivate *priv;
+};
+
+struct _WebKitFindControllerClass {
+    GObjectClass parent_class;
+};
+
+WEBKIT_API GType
+webkit_find_controller_get_type            (void);
+
+WEBKIT_API void
+webkit_find_controller_search              (WebKitFindController *find_controller,
+                                            const gchar          *search_text,
+                                            guint32               find_options,
+                                            guint                 max_match_count);
+
+WEBKIT_API void
+webkit_find_controller_search_finish       (WebKitFindController *find_controller);
+
+WEBKIT_API void
+webkit_find_controller_search_next         (WebKitFindController *find_controller);
+
+WEBKIT_API void
+webkit_find_controller_search_previous     (WebKitFindController *find_controller);
+
+WEBKIT_API void
+webkit_find_controller_count_matches       (WebKitFindController *find_controller,
+                                            const gchar          *search_text,
+                                            guint32               find_options,
+                                            guint                 max_match_count);
+
+WEBKIT_API const gchar *
+webkit_find_controller_get_search_text     (WebKitFindController *find_controller);
+
+WEBKIT_API guint32
+webkit_find_controller_get_options         (WebKitFindController *find_controller);
+
+WEBKIT_API guint
+webkit_find_controller_get_max_match_count (WebKitFindController *find_controller);
+
+WEBKIT_API WebKitWebView *
+webkit_find_controller_get_web_view        (WebKitFindController *find_controller);
+
+G_END_DECLS
+
+#endif
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp
index 94d13eab2..e40fde76e 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp
@@ -38,7 +38,7 @@ using namespace WebKit;
  * @See_also: #WebKitPolicyDecision, #WebKitWebView
  *
  * WebKitNavigationPolicyDecision represents a policy decision for events associated with
- * navigations. If the value of WebKitNavigationPolicyDecision:mouse-button is not 0, then
+ * navigations. If the value of #WebKitNavigationPolicyDecision:mouse-button is not 0, then
  * the navigation was triggered by a mouse event.
  */
 
@@ -143,7 +143,7 @@ static void webkit_navigation_policy_decision_class_init(WebKitNavigationPolicyD
      *
      * If the navigation associated with this policy decision was originally
      * triggered by a mouse event, this property contains a bitmask of various
-     * GdkModifierType values describing the modifiers used for that click.
+     * #GdkModifierType values describing the modifiers used for that click.
      * If the navigation was not triggered by a mouse event or no modifiers
      * were active, the value of this property will be zero.
      */
@@ -248,7 +248,7 @@ WebKitURIRequest* webkit_navigation_policy_decision_get_request(WebKitNavigation
  *
  * Gets the value of the #WebKitNavigationPolicyDecision:frame-name property.
  *
- * Returns: The name of the new frame this navigation action targets or %NULL 
+ * Returns: The name of the new frame this navigation action targets or %NULL
  */
 const char* webkit_navigation_policy_decision_get_frame_name(WebKitNavigationPolicyDecision* decision)
 {
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.cpp
index a20ccb2a6..d79d40149 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.cpp
@@ -367,7 +367,7 @@ void webkit_print_operation_set_page_setup(WebKitPrintOperation* printOperation,
  * the user. This method returns when the print dialog is closed.
  * If the print dialog is cancelled %WEBKIT_PRINT_OPERATION_RESPONSE_CANCEL
  * is returned. If the user clicks on the print button, %WEBKIT_PRINT_OPERATION_RESPONSE_PRINT
- * is returned and the print operation starts. In this case, the WebKitPrintOperation::finished
+ * is returned and the print operation starts. In this case, the #WebKitPrintOperation::finished
  * signal is emitted when the operation finishes.
  * If the print dialog is not cancelled current print settings and page setup of @print_operation
  * are updated with options selected by the user when Print button is pressed in print dialog.
@@ -394,7 +394,7 @@ WebKitPrintOperationResponse webkit_print_operation_run_dialog(WebKitPrintOperat
  * are not set with webkit_print_operation_set_print_settings() and
  * webkit_print_operation_set_page_setup(), the default options will be used
  * and the print job will be sent to the default printer.
- * The WebKitPrintOperation::finished signal is emitted when the printing
+ * The #WebKitPrintOperation::finished signal is emitted when the printing
  * operation finishes.
  */
 void webkit_print_operation_print(WebKitPrintOperation* printOperation)
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h
index 43d26cc85..e785c3638 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h
@@ -28,7 +28,9 @@
 
 #include <WebKit2/WKAPICast.h>
 #include <WebKit2/WKDownload.h>
+#include <WebKit2/WKFindOptions.h>
 #include <WebKit2/WKRetainPtr.h>
+#include <WebKit2/WKString.h>
 #include <WebKit2/WebKit2.h>
 #include <glib.h>
 #include <wtf/Assertions.h>
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialog.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialog.cpp
new file mode 100644
index 000000000..863665d71
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialog.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebKitScriptDialog.h"
+
+#include "WebKitScriptDialogPrivate.h"
+
+static WebKitScriptDialog* webkitScriptDialogCopy(WebKitScriptDialog* dialog)
+{
+    WebKitScriptDialog* copy = g_slice_new0(WebKitScriptDialog);
+    new (copy) WebKitScriptDialog(dialog);
+    return copy;
+}
+
+static void webkitScriptDialogFree(WebKitScriptDialog* dialog)
+{
+    dialog->~WebKitScriptDialog();
+    g_slice_free(WebKitScriptDialog, dialog);
+}
+
+G_DEFINE_BOXED_TYPE(WebKitScriptDialog, webkit_script_dialog, webkitScriptDialogCopy, webkitScriptDialogFree)
+
+/**
+ * webkit_script_dialog_get_dialog_type:
+ * @dialog: a #WebKitScriptDialog
+ *
+ * Get the dialog type of a #WebKitScriptDialog.
+ *
+ * Returns: the #WebKitScriptDialogType of @dialog
+ */
+WebKitScriptDialogType webkit_script_dialog_get_dialog_type(WebKitScriptDialog* dialog)
+{
+    g_return_val_if_fail(dialog, WEBKIT_SCRIPT_DIALOG_ALERT);
+
+    return static_cast<WebKitScriptDialogType>(dialog->type);
+}
+
+/**
+ * webkit_script_dialog_get_message:
+ * @dialog: a #WebKitScriptDialog
+ *
+ * Get the message of a #WebKitScriptDialog.
+ *
+ * Returns: the message of @dialog.
+ */
+const char* webkit_script_dialog_get_message(WebKitScriptDialog* dialog)
+{
+    g_return_val_if_fail(dialog, 0);
+
+    return dialog->message.data();
+}
+
+/**
+ * webkit_script_dialog_confirm_set_confirmed:
+ * @dialog: a #WebKitScriptDialog
+ * @confirmed: whether user confirmed the dialog
+ *
+ * This method is used for %WEBKIT_SCRIPT_DIALOG_CONFIRM dialogs when
+ * #WebKitWebView::script-dialog signal is emitted to set whether the user
+ * confirmed the dialog or not. The default implementation of #WebKitWebView::script-dialog
+ * signal sets %TRUE when the OK button is clicked and %FALSE otherwise.
+ * It's an error to use this method with a #WebKitScriptDialog that is not of type
+ * %WEBKIT_SCRIPT_DIALOG_CONFIRM.
+ */
+void webkit_script_dialog_confirm_set_confirmed(WebKitScriptDialog* dialog, gboolean confirmed)
+{
+    g_return_if_fail(dialog);
+    g_return_if_fail(dialog->type == WEBKIT_SCRIPT_DIALOG_CONFIRM);
+
+    dialog->confirmed = confirmed;
+}
+
+/**
+ * webkit_script_dialog_prompt_get_default_text:
+ * @dialog: a #WebKitScriptDialog
+ *
+ * Get the default text of a #WebKitScriptDialog of type %WEBKIT_SCRIPT_DIALOG_PROMPT.
+ * It's an error to use this method with a #WebKitScriptDialog that is not of type
+ * %WEBKIT_SCRIPT_DIALOG_PROMPT.
+ *
+ * Returns: the default text of @dialog
+ */
+const char* webkit_script_dialog_prompt_get_default_text(WebKitScriptDialog* dialog)
+{
+    g_return_val_if_fail(dialog, 0);
+    g_return_val_if_fail(dialog->type == WEBKIT_SCRIPT_DIALOG_PROMPT, 0);
+
+    return dialog->defaultText.data();
+}
+
+/**
+ * webkit_script_dialog_prompt_set_text:
+ * @dialog: a #WebKitScriptDialog
+ * @text: the text to set
+ *
+ * This method is used for %WEBKIT_SCRIPT_DIALOG_PROMPT dialogs when
+ * #WebKitWebView::script-dialog signal is emitted to set the text
+ * entered by the user. The default implementation of #WebKitWebView::script-dialog
+ * signal sets the text of the entry form when OK button is clicked, otherwise %NULL is set.
+ * It's an error to use this method with a #WebKitScriptDialog that is not of type
+ * %WEBKIT_SCRIPT_DIALOG_PROMPT.
+ */
+void webkit_script_dialog_prompt_set_text(WebKitScriptDialog* dialog, const char* text)
+{
+    g_return_if_fail(dialog);
+    g_return_if_fail(dialog->type == WEBKIT_SCRIPT_DIALOG_PROMPT);
+
+    dialog->text = text;
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialog.h b/Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialog.h
new file mode 100644
index 000000000..cf88535ad
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialog.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#if !defined(__WEBKIT2_H_INSIDE__) && !defined(WEBKIT2_COMPILATION)
+#error "Only <webkit2/webkit2.h> can be included directly."
+#endif
+
+#ifndef WebKitScriptDialog_h
+#define WebKitScriptDialog_h
+
+#include <glib-object.h>
+#include <webkit2/WebKitDefines.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_SCRIPT_DIALOG (webkit_script_dialog_get_type())
+
+typedef struct _WebKitScriptDialog WebKitScriptDialog;
+
+/**
+ * WebKitScriptDialogType:
+ * @WEBKIT_SCRIPT_DIALOG_ALERT: Alert script dialog, used to show a
+ * message to the user.
+ * @WEBKIT_SCRIPT_DIALOG_CONFIRM: Confirm script dialog, used to ask
+ * confirmation to the user.
+ * @WEBKIT_SCRIPT_DIALOG_PROMPT: Prompt script dialog, used to ask
+ * information to the user.
+ *
+ * Enum values used for determining the type of #WebKitScriptDialog
+ */
+typedef enum {
+    WEBKIT_SCRIPT_DIALOG_ALERT,
+    WEBKIT_SCRIPT_DIALOG_CONFIRM,
+    WEBKIT_SCRIPT_DIALOG_PROMPT
+} WebKitScriptDialogType;
+
+WEBKIT_API GType
+webkit_script_dialog_get_type                (void);
+
+WEBKIT_API WebKitScriptDialogType
+webkit_script_dialog_get_dialog_type         (WebKitScriptDialog *dialog);
+
+WEBKIT_API const gchar *
+webkit_script_dialog_get_message             (WebKitScriptDialog *dialog);
+
+WEBKIT_API void
+webkit_script_dialog_confirm_set_confirmed   (WebKitScriptDialog *dialog,
+                                              gboolean            confirmed);
+
+WEBKIT_API const gchar *
+webkit_script_dialog_prompt_get_default_text (WebKitScriptDialog *dialog);
+
+WEBKIT_API void
+webkit_script_dialog_prompt_set_text         (WebKitScriptDialog *dialog,
+                                              const gchar        *text);
+
+G_END_DECLS
+
+#endif
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialogPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialogPrivate.h
new file mode 100644
index 000000000..5f1a43d94
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitScriptDialogPrivate.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WebKitScriptDialogPrivate_h
+#define WebKitScriptDialogPrivate_h
+
+#include "WebKitScriptDialog.h"
+#include <wtf/text/CString.h>
+
+struct _WebKitScriptDialog {
+    _WebKitScriptDialog(unsigned type, const CString& message)
+        : type(type)
+        , message(message)
+        , confirmed(false)
+    {
+    }
+
+    _WebKitScriptDialog(unsigned type, const CString& message, const CString& defaultText)
+        : type(type)
+        , message(message)
+        , defaultText(defaultText)
+        , confirmed(false)
+    {
+        ASSERT(type == WEBKIT_SCRIPT_DIALOG_PROMPT);
+    }
+
+    _WebKitScriptDialog(WebKitScriptDialog* dialog)
+        : type(dialog->type)
+        , message(dialog->message)
+        , defaultText(dialog->defaultText)
+        , confirmed(dialog->confirmed)
+        , text(dialog->text)
+    {
+    }
+
+    unsigned type;
+    CString message;
+    CString defaultText;
+
+    bool confirmed;
+    CString text;
+};
+
+#endif // WebKitScriptDialogPrivate_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
index c1c4a970b..b4b267d1b 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
@@ -46,6 +46,7 @@ struct _WebKitSettingsPrivate {
     CString fantasyFontFamily;
     CString pictographFontFamily;
     CString defaultCharset;
+    bool zoomTextOnly;
 };
 
 /**
@@ -103,7 +104,8 @@ enum {
     PROP_ENABLE_FULLSCREEN,
     PROP_PRINT_BACKGROUNDS,
     PROP_ENABLE_WEBAUDIO,
-    PROP_ENABLE_WEBGL
+    PROP_ENABLE_WEBGL,
+    PROP_ZOOM_TEXT_ONLY
 };
 
 static void webKitSettingsSetProperty(GObject* object, guint propId, const GValue* value, GParamSpec* paramSpec)
@@ -210,6 +212,9 @@ static void webKitSettingsSetProperty(GObject* object, guint propId, const GValu
     case PROP_ENABLE_WEBGL:
         webkit_settings_set_enable_webgl(settings, g_value_get_boolean(value));
         break;
+    case PROP_ZOOM_TEXT_ONLY:
+        webkit_settings_set_zoom_text_only(settings, g_value_get_boolean(value));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
         break;
@@ -320,6 +325,9 @@ static void webKitSettingsGetProperty(GObject* object, guint propId, GValue* val
     case PROP_ENABLE_WEBGL:
         g_value_set_boolean(value, webkit_settings_get_enable_webgl(settings));
         break;
+    case PROP_ZOOM_TEXT_ONLY:
+        g_value_set_boolean(value, webkit_settings_get_zoom_text_only(settings));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
         break;
@@ -816,6 +824,22 @@ static void webkit_settings_class_init(WebKitSettingsClass* klass)
                                                          FALSE,
                                                          readWriteConstructParamFlags));
 
+    /**
+     * WebKitSettings:zoom-text-only:
+     *
+     * Whether #WebKitWebView:zoom-level affects only the
+     * text of the page or all the contents. Other contents containing text
+     * like form controls will be also affected by zoom factor when
+     * this property is enabled.
+     */
+    g_object_class_install_property(gObjectClass,
+                                    PROP_ZOOM_TEXT_ONLY,
+                                    g_param_spec_boolean("zoom-text-only",
+                                                         _("Zoom Text Only"),
+                                                         _("Whether zoom level of web view changes only the text size"),
+                                                         FALSE,
+                                                         readWriteConstructParamFlags));
+
     g_type_class_add_private(klass, sizeof(WebKitSettingsPrivate));
 }
 
@@ -2073,3 +2097,39 @@ void webkit_settings_set_enable_webgl(WebKitSettings* settings, gboolean enabled
     WKPreferencesSetWebGLEnabled(priv->preferences.get(), enabled);
     g_object_notify(G_OBJECT(settings), "enable-webgl");
 }
+
+/**
+ * webkit_settings_set_zoom_text_only:
+ * @settings: a #WebKitSettings
+ * @zoom_text_only: Value to be set
+ *
+ * Set the #WebKitSettings:zoom-text-only property.
+ */
+void webkit_settings_set_zoom_text_only(WebKitSettings* settings, gboolean zoomTextOnly)
+{
+    g_return_if_fail(WEBKIT_IS_SETTINGS(settings));
+
+    WebKitSettingsPrivate* priv = settings->priv;
+    if (priv->zoomTextOnly == zoomTextOnly)
+        return;
+
+    priv->zoomTextOnly = zoomTextOnly;
+    g_object_notify(G_OBJECT(settings), "zoom-text-only");
+}
+
+/**
+ * webkit_settings_get_zoom_text_only:
+ * @settings: a #WebKitSettings
+ *
+ * Get the #WebKitSettings:zoom-text-only property.
+ *
+ * Returns: %TRUE If zoom level of the view should only affect the text
+ *    or %FALSE if all view contents should be scaled.
+ */
+gboolean webkit_settings_get_zoom_text_only(WebKitSettings* settings)
+{
+    g_return_val_if_fail(WEBKIT_IS_SETTINGS(settings), FALSE);
+
+    return settings->priv->zoomTextOnly;
+}
+
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
index b22ba00ff..25a78aca3 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
@@ -307,6 +307,13 @@ WEBKIT_API void
 webkit_settings_set_enable_webgl                               (WebKitSettings *settings,
                                                                 gboolean        enabled);
 
+WEBKIT_API void
+webkit_settings_set_zoom_text_only                             (WebKitSettings *settings,
+                                                                gboolean        zoom_text_only);
+
+WEBKIT_API gboolean
+webkit_settings_get_zoom_text_only                             (WebKitSettings *settings);
+
 G_END_DECLS
 
 #endif /* WebKitSettings_h */
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
index be590ff33..4f17d4669 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
@@ -30,6 +30,7 @@
 #include "WebKitPolicyClient.h"
 #include "WebKitPrintOperationPrivate.h"
 #include "WebKitPrivate.h"
+#include "WebKitScriptDialogPrivate.h"
 #include "WebKitSettingsPrivate.h"
 #include "WebKitUIClient.h"
 #include "WebKitWebContextPrivate.h"
@@ -55,9 +56,7 @@ enum {
     READY_TO_SHOW,
     CLOSE,
 
-    SCRIPT_ALERT,
-    SCRIPT_CONFIRM,
-    SCRIPT_PROMPT,
+    SCRIPT_DIALOG,
 
     DECIDE_POLICY,
 
@@ -78,13 +77,20 @@ enum {
     PROP_ZOOM_LEVEL
 };
 
+typedef enum {
+    NotReplacingContent,
+    WillReplaceContent,
+    ReplacingContent,
+    DidReplaceContent
+} ReplaceContentStatus;
+
 struct _WebKitWebViewPrivate {
     WebKitWebContext* context;
     CString title;
     CString customTextEncoding;
     double estimatedLoadProgress;
     CString activeURI;
-    bool replacingContent;
+    ReplaceContentStatus replaceContentStatus;
 
     GRefPtr<WebKitBackForwardList> backForwardList;
     GRefPtr<WebKitSettings> settings;
@@ -92,6 +98,8 @@ struct _WebKitWebViewPrivate {
 
     GRefPtr<WebKitHitTestResult> mouseTargetHitTestResult;
     unsigned mouseTargetModifiers;
+
+    GRefPtr<WebKitFindController> findController;
 };
 
 static guint signals[LAST_SIGNAL] = { 0, };
@@ -128,39 +136,56 @@ static GtkWidget* webkitWebViewCreateJavaScriptDialog(WebKitWebView* webView, Gt
     return dialog;
 }
 
-static gboolean webkitWebViewScriptAlert(WebKitWebView* webView, const char* message)
+static gboolean webkitWebViewScriptDialog(WebKitWebView* webView, WebKitScriptDialog* scriptDialog)
 {
-    GtkWidget* dialog = webkitWebViewCreateJavaScriptDialog(webView, GTK_MESSAGE_WARNING, GTK_BUTTONS_CLOSE, GTK_RESPONSE_CLOSE, message);
-    gtk_dialog_run(GTK_DIALOG(dialog));
+    GtkWidget* dialog = 0;
+
+    switch (scriptDialog->type) {
+    case WEBKIT_SCRIPT_DIALOG_ALERT:
+        dialog = webkitWebViewCreateJavaScriptDialog(webView, GTK_MESSAGE_WARNING, GTK_BUTTONS_CLOSE, GTK_RESPONSE_CLOSE, scriptDialog->message.data());
+        gtk_dialog_run(GTK_DIALOG(dialog));
+        break;
+    case WEBKIT_SCRIPT_DIALOG_CONFIRM:
+        dialog = webkitWebViewCreateJavaScriptDialog(webView, GTK_MESSAGE_QUESTION, GTK_BUTTONS_OK_CANCEL, GTK_RESPONSE_OK, scriptDialog->message.data());
+        scriptDialog->confirmed = gtk_dialog_run(GTK_DIALOG(dialog)) == GTK_RESPONSE_OK;
+        break;
+    case WEBKIT_SCRIPT_DIALOG_PROMPT:
+        dialog = webkitWebViewCreateJavaScriptDialog(webView, GTK_MESSAGE_QUESTION, GTK_BUTTONS_OK_CANCEL, GTK_RESPONSE_OK, scriptDialog->message.data());
+        GtkWidget* entry = gtk_entry_new();
+        gtk_entry_set_text(GTK_ENTRY(entry), scriptDialog->defaultText.data());
+        gtk_container_add(GTK_CONTAINER(gtk_dialog_get_content_area(GTK_DIALOG(dialog))), entry);
+        gtk_entry_set_activates_default(GTK_ENTRY(entry), TRUE);
+        gtk_widget_show(entry);
+        if (gtk_dialog_run(GTK_DIALOG(dialog)) == GTK_RESPONSE_OK)
+            scriptDialog->text = gtk_entry_get_text(GTK_ENTRY(entry));
+        break;
+    }
+
     gtk_widget_destroy(dialog);
+
     return TRUE;
 }
 
-static gboolean webkitWebViewScriptConfirm(WebKitWebView* webView, const char* message, gboolean* confirmed)
+static gboolean webkitWebViewDecidePolicy(WebKitWebView*, WebKitPolicyDecision* decision, WebKitPolicyDecisionType)
 {
-    GtkWidget* dialog = webkitWebViewCreateJavaScriptDialog(webView, GTK_MESSAGE_QUESTION, GTK_BUTTONS_OK_CANCEL, GTK_RESPONSE_OK, message);
-    *confirmed = gtk_dialog_run(GTK_DIALOG(dialog)) == GTK_RESPONSE_OK;
-    gtk_widget_destroy(dialog);
+    webkit_policy_decision_use(decision);
     return TRUE;
 }
 
-static gboolean webkitWebViewScriptPrompt(WebKitWebView* webView, const char* message, const char* defaultText, char** text)
+static void zoomTextOnlyChanged(WebKitSettings* settings, GParamSpec*, WebKitWebView* webView)
 {
-    GtkWidget* dialog = webkitWebViewCreateJavaScriptDialog(webView, GTK_MESSAGE_QUESTION, GTK_BUTTONS_OK_CANCEL, GTK_RESPONSE_OK, message);
-    GtkWidget* entry = gtk_entry_new();
-    gtk_entry_set_text(GTK_ENTRY(entry), defaultText);
-    gtk_container_add(GTK_CONTAINER(gtk_dialog_get_content_area(GTK_DIALOG(dialog))), entry);
-    gtk_entry_set_activates_default(GTK_ENTRY(entry), TRUE);
-    gtk_widget_show(entry);
-
-    *text = (gtk_dialog_run(GTK_DIALOG(dialog)) == GTK_RESPONSE_OK) ? g_strdup(gtk_entry_get_text(GTK_ENTRY(entry))) : 0;
-    return TRUE;
+    WKPageRef wkPage = toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView)));
+    gboolean zoomTextOnly = webkit_settings_get_zoom_text_only(settings);
+    gdouble pageZoomLevel = zoomTextOnly ? 1 : WKPageGetTextZoomFactor(wkPage);
+    gdouble textZoomLevel = zoomTextOnly ? WKPageGetPageZoomFactor(wkPage) : 1;
+    WKPageSetPageAndTextZoomFactors(wkPage, pageZoomLevel, textZoomLevel);
 }
 
-static gboolean webkitWebViewDecidePolicy(WebKitWebView*, WebKitPolicyDecision* decision, WebKitPolicyDecisionType)
+static void webkitWebViewSetSettings(WebKitWebView* webView, WebKitSettings* settings, WKPageRef wkPage)
 {
-    webkit_policy_decision_use(decision);
-    return TRUE;
+    webView->priv->settings = settings;
+    webkitSettingsAttachSettingsToPage(webView->priv->settings.get(), wkPage);
+    g_signal_connect(settings, "notify::zoom-text-only", G_CALLBACK(zoomTextOnlyChanged), webView);
 }
 
 static void webkitWebViewConstructed(GObject* object)
@@ -180,8 +205,9 @@ static void webkitWebViewConstructed(GObject* object)
 
     WebPageProxy* page = webkitWebViewBaseGetPage(webViewBase);
     priv->backForwardList = adoptGRef(webkitBackForwardListCreate(WKPageGetBackForwardList(toAPI(page))));
-    priv->settings = adoptGRef(webkit_settings_new());
-    webkitSettingsAttachSettingsToPage(priv->settings.get(), toAPI(page));
+
+    GRefPtr<WebKitSettings> settings = adoptGRef(webkit_settings_new());
+    webkitWebViewSetSettings(webView, settings.get(), toAPI(page));
 }
 
 static void webkitWebViewSetProperty(GObject* object, guint propId, const GValue* value, GParamSpec* paramSpec)
@@ -262,9 +288,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     webViewClass->load_failed = webkitWebViewLoadFail;
     webViewClass->create = webkitWebViewCreate;
-    webViewClass->script_alert = webkitWebViewScriptAlert;
-    webViewClass->script_confirm = webkitWebViewScriptConfirm;
-    webViewClass->script_prompt = webkitWebViewScriptPrompt;
+    webViewClass->script_dialog = webkitWebViewScriptDialog;
     webViewClass->decide_policy = webkitWebViewDecidePolicy;
 
     g_type_class_add_private(webViewClass, sizeof(WebKitWebViewPrivate));
@@ -494,75 +518,40 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
                      G_TYPE_NONE, 0);
 
     /**
-     * WebKitWebView::script-alert:
-     * @web_view: the #WebKitWebView on which the signal is emitted
-     * @message: the message text
-     *
-     * Emitted when JavaScript code calls <function>window.alert</function>. If the
-     * signal is not handled a message dialog with a single Close button will be
-     * shown with the message text.
-     *
-     * Returns: %TRUE to stop other handlers from being invoked for the event.
-     *    %FALSE to propagate the event further.
-     */
-    signals[SCRIPT_ALERT] =
-            g_signal_new("script-alert",
-                         G_TYPE_FROM_CLASS(webViewClass),
-                         G_SIGNAL_RUN_LAST,
-                         G_STRUCT_OFFSET(WebKitWebViewClass, script_alert),
-                         g_signal_accumulator_true_handled, 0,
-                         webkit_marshal_BOOLEAN__STRING,
-                         G_TYPE_BOOLEAN, 1,
-                         G_TYPE_STRING);
-
-    /**
-     * WebKitWebView::script-confirm:
-     * @web_view: the #WebKitWebView on which the signal is emitted
-     * @message: the message text
-     * @confirmed: (out): return location for confirm dialog response
-     *
-     * Emitted when JavaScript code calls <function>confirm</function>. If the
-     * signal is not handled a message dialog with OK and Cancel buttons will be
-     * shown with the message text. If OK button is clicked @confirmed will be
-     * set to %TRUE, otherwise it will be %FALSE.
-     *
-     * Returns: %TRUE to stop other handlers from being invoked for the event.
-     *    %FALSE to propagate the event further.
-     */
-    signals[SCRIPT_CONFIRM] =
-            g_signal_new("script-confirm",
-                         G_TYPE_FROM_CLASS(webViewClass),
-                         G_SIGNAL_RUN_LAST,
-                         G_STRUCT_OFFSET(WebKitWebViewClass, script_confirm),
-                         g_signal_accumulator_true_handled, 0,
-                         webkit_marshal_BOOLEAN__STRING_POINTER,
-                         G_TYPE_BOOLEAN, 2,
-                         G_TYPE_STRING, G_TYPE_POINTER);
-
-    /**
-     * WebKitWebView::script-prompt:
+     * WebKitWebView::script-dialog:
      * @web_view: the #WebKitWebView on which the signal is emitted
-     * @message: the message text
-     * @default (allow-none): the default text
-     * @text: (out): return location for prompt dialog text response
+     * @dialog: the #WebKitScriptDialog to show
      *
-     * Emitted when JavaScript code calls <function>prompt</function>. If the
-     * signal is not handled a message dialog with OK and Cancel buttons and
-     * a text entry will be shown with the message text. If OK button is clicked
-     * @text will contain the text entered by the user, otherwise it will be %NULL.
+     * Emitted when JavaScript code calls <function>window.alert</function>,
+     * <function>window.confirm</function> or <function>window.prompt</function>.
+     * The @dialog parameter should be used to build the dialog.
+     * If the signal is not handled a different dialog will be built and shown depending
+     * on the dialog type:
+     * <itemizedlist>
+     * <listitem><para>
+     *  %WEBKIT_SCRIPT_DIALOG_ALERT: message dialog with a single Close button.
+     * </para></listitem>
+     * <listitem><para>
+     *  %WEBKIT_SCRIPT_DIALOG_CONFIRM: message dialog with OK and Cancel buttons.
+     * </para></listitem>
+     * <listitem><para>
+     *  %WEBKIT_SCRIPT_DIALOG_PROMPT: message dialog with OK and Cancel buttons and
+     *  a text entry with the default text.
+     * </para></listitem>
+     * </itemizedlist>
      *
      * Returns: %TRUE to stop other handlers from being invoked for the event.
      *    %FALSE to propagate the event further.
      */
-    signals[SCRIPT_PROMPT] =
-            g_signal_new("script-prompt",
-                         G_TYPE_FROM_CLASS(webViewClass),
-                         G_SIGNAL_RUN_LAST,
-                         G_STRUCT_OFFSET(WebKitWebViewClass, script_prompt),
-                         g_signal_accumulator_true_handled, 0,
-                         webkit_marshal_BOOLEAN__STRING_STRING_POINTER,
-                         G_TYPE_BOOLEAN, 3,
-                         G_TYPE_STRING, G_TYPE_STRING, G_TYPE_POINTER);
+    signals[SCRIPT_DIALOG] =
+        g_signal_new("script-dialog",
+                     G_TYPE_FROM_CLASS(webViewClass),
+                     G_SIGNAL_RUN_LAST,
+                     G_STRUCT_OFFSET(WebKitWebViewClass, script_dialog),
+                     g_signal_accumulator_true_handled, 0,
+                     webkit_marshal_BOOLEAN__BOXED,
+                     G_TYPE_BOOLEAN, 1,
+                     WEBKIT_TYPE_SCRIPT_DIALOG | G_SIGNAL_TYPE_STATIC_SCOPE);
 
     /**
      * WebKitWebView::decide-policy:
@@ -679,14 +668,30 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
                      WEBKIT_TYPE_PRINT_OPERATION);
 }
 
-void webkitWebViewLoadChanged(WebKitWebView* webView, WebKitLoadEvent loadEvent)
+static bool updateReplaceContentStatus(WebKitWebView* webView, WebKitLoadEvent loadEvent)
 {
-    if (webView->priv->replacingContent) {
+    if (webView->priv->replaceContentStatus == ReplacingContent) {
         if (loadEvent == WEBKIT_LOAD_FINISHED)
-            webView->priv->replacingContent = false;
-        return;
+            webView->priv->replaceContentStatus = DidReplaceContent;
+        return true;
+    }
+
+    if (loadEvent == WEBKIT_LOAD_STARTED) {
+        if (webView->priv->replaceContentStatus == WillReplaceContent) {
+            webView->priv->replaceContentStatus = ReplacingContent;
+            return true;
+        }
+        webView->priv->replaceContentStatus = NotReplacingContent;
     }
 
+    return false;
+}
+
+void webkitWebViewLoadChanged(WebKitWebView* webView, WebKitLoadEvent loadEvent)
+{
+    if (updateReplaceContentStatus(webView, loadEvent))
+        return;
+
     if (loadEvent != WEBKIT_LOAD_FINISHED)
         webkitWebViewUpdateURI(webView);
     g_signal_emit(webView, signals[LOAD_CHANGED], 0, loadEvent);
@@ -694,7 +699,7 @@ void webkitWebViewLoadChanged(WebKitWebView* webView, WebKitLoadEvent loadEvent)
 
 void webkitWebViewLoadFailed(WebKitWebView* webView, WebKitLoadEvent loadEvent, const char* failingURI, GError *error)
 {
-    if (webView->priv->replacingContent)
+    if (webView->priv->replaceContentStatus == ReplacingContent)
         return;
 
     gboolean returnValue;
@@ -714,7 +719,7 @@ void webkitWebViewSetTitle(WebKitWebView* webView, const CString& title)
 
 void webkitWebViewSetEstimatedLoadProgress(WebKitWebView* webView, double estimatedLoadProgress)
 {
-    if (webView->priv->replacingContent)
+    if (webView->priv->replaceContentStatus != NotReplacingContent)
         return;
 
     if (webView->priv->estimatedLoadProgress == estimatedLoadProgress)
@@ -763,23 +768,25 @@ void webkitWebViewClosePage(WebKitWebView* webView)
 
 void webkitWebViewRunJavaScriptAlert(WebKitWebView* webView, const CString& message)
 {
+    WebKitScriptDialog dialog(WEBKIT_SCRIPT_DIALOG_ALERT, message);
     gboolean returnValue;
-    g_signal_emit(webView, signals[SCRIPT_ALERT], 0, message.data(), &returnValue);
+    g_signal_emit(webView, signals[SCRIPT_DIALOG], 0, &dialog, &returnValue);
 }
 
 bool webkitWebViewRunJavaScriptConfirm(WebKitWebView* webView, const CString& message)
 {
-    gboolean returnValue, confirmed;
-    g_signal_emit(webView, signals[SCRIPT_CONFIRM], 0, message.data(), &confirmed, &returnValue);
-    return confirmed;
+    WebKitScriptDialog dialog(WEBKIT_SCRIPT_DIALOG_CONFIRM, message);
+    gboolean returnValue;
+    g_signal_emit(webView, signals[SCRIPT_DIALOG], 0, &dialog, &returnValue);
+    return dialog.confirmed;
 }
 
 WKStringRef webkitWebViewRunJavaScriptPrompt(WebKitWebView* webView, const CString& message, const CString& defaultText)
 {
+    WebKitScriptDialog dialog(WEBKIT_SCRIPT_DIALOG_PROMPT, message, defaultText);
     gboolean returnValue;
-    GOwnPtr<char> text;
-    g_signal_emit(webView, signals[SCRIPT_PROMPT], 0, message.data(), defaultText.data(), &text.outPtr(), &returnValue);
-    return text ? WKStringCreateWithUTF8CString(text.get()) : 0;
+    g_signal_emit(webView, signals[SCRIPT_DIALOG], 0, &dialog, &returnValue);
+    return dialog.text.isNull() ? 0 : WKStringCreateWithUTF8CString(dialog.text.data());
 }
 
 void webkitWebViewMakePolicyDecision(WebKitWebView* webView, WebKitPolicyDecisionType type, WebKitPolicyDecision* decision)
@@ -965,7 +972,7 @@ void webkit_web_view_replace_content(WebKitWebView* webView, const gchar* conten
     g_return_if_fail(content);
     g_return_if_fail(contentURI);
 
-    webView->priv->replacingContent = true;
+    webView->priv->replaceContentStatus = WillReplaceContent;
 
     WKRetainPtr<WKStringRef> htmlString(AdoptWK, WKStringCreateWithUTF8CString(content));
     WKRetainPtr<WKURLRef> contentURL(AdoptWK, WKURLCreateWithUTF8CString(contentURI));
@@ -1279,8 +1286,8 @@ void webkit_web_view_set_settings(WebKitWebView* webView, WebKitSettings* settin
     if (webView->priv->settings == settings)
         return;
 
-    webView->priv->settings = settings;
-    webkitSettingsAttachSettingsToPage(settings, toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView))));
+    g_signal_handlers_disconnect_by_func(webView->priv->settings.get(), reinterpret_cast<gpointer>(zoomTextOnlyChanged), webView);
+    webkitWebViewSetSettings(webView, settings, toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView))));
 }
 
 /**
@@ -1338,11 +1345,14 @@ void webkit_web_view_set_zoom_level(WebKitWebView* webView, gdouble zoomLevel)
 {
     g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
 
-    WKPageRef wkPage = toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView)));
-    if (WKPageGetPageZoomFactor(wkPage) == zoomLevel)
+    if (webkit_web_view_get_zoom_level(webView) == zoomLevel)
         return;
 
-    WKPageSetPageZoomFactor(wkPage, zoomLevel);
+    WKPageRef wkPage = toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView)));
+    if (webkit_settings_get_zoom_text_only(webView->priv->settings.get()))
+        WKPageSetTextZoomFactor(wkPage, zoomLevel);
+    else
+        WKPageSetPageZoomFactor(wkPage, zoomLevel);
     g_object_notify(G_OBJECT(webView), "zoom-level");
 }
 
@@ -1360,10 +1370,10 @@ gdouble webkit_web_view_get_zoom_level(WebKitWebView* webView)
     g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), 1);
 
     WKPageRef wkPage = toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView)));
-    return WKPageGetPageZoomFactor(wkPage);
+    gboolean zoomTextOnly = webkit_settings_get_zoom_text_only(webView->priv->settings.get());
+    return zoomTextOnly ? WKPageGetTextZoomFactor(wkPage) : WKPageGetPageZoomFactor(wkPage);
 }
 
-
 static void didValidateCommand(WKStringRef command, bool isEnabled, int32_t state, WKErrorRef, void* context)
 {
     GRefPtr<GSimpleAsyncResult> result = adoptGRef(G_SIMPLE_ASYNC_RESULT(context));
@@ -1436,3 +1446,23 @@ void webkit_web_view_execute_editing_command(WebKitWebView* webView, const char*
     WKRetainPtr<WKStringRef> wkCommand(AdoptWK, WKStringCreateWithUTF8CString(command));
     WKPageExecuteCommand(toAPI(page), wkCommand.get());
 }
+
+/**
+ * webkit_web_view_get_find_controller:
+ * @web_view: the #WebKitWebView
+ *
+ * Gets the #WebKitFindController that will allow the caller to query
+ * the #WebKitWebView for the text to look for.
+ *
+ * Returns: (transfer none): the #WebKitFindController associated to
+ * this particular #WebKitWebView.
+ */
+WebKitFindController* webkit_web_view_get_find_controller(WebKitWebView* webView)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), 0);
+
+    if (!webView->priv->findController)
+        webView->priv->findController = adoptGRef(WEBKIT_FIND_CONTROLLER(g_object_new(WEBKIT_TYPE_FIND_CONTROLLER, "web-view", webView, NULL)));
+
+    return webView->priv->findController.get();
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
index a1b21420b..fb4c48a2d 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
@@ -30,7 +30,9 @@
 
 #include <webkit2/WebKitBackForwardList.h>
 #include <webkit2/WebKitDefines.h>
+#include <webkit2/WebKitFindController.h>
 #include <webkit2/WebKitHitTestResult.h>
+#include <webkit2/WebKitScriptDialog.h>
 #include <webkit2/WebKitSettings.h>
 #include <webkit2/WebKitURIRequest.h>
 #include <webkit2/WebKitWebContext.h>
@@ -47,7 +49,6 @@ G_BEGIN_DECLS
 #define WEBKIT_IS_WEB_VIEW_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_WEB_VIEW))
 #define WEBKIT_WEB_VIEW_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_WEB_VIEW, WebKitWebViewClass))
 
-typedef struct _WebKitWebView WebKitWebView;
 typedef struct _WebKitWebViewClass WebKitWebViewClass;
 typedef struct _WebKitWebViewPrivate WebKitWebViewPrivate;
 
@@ -77,7 +78,7 @@ typedef struct _WebKitWebViewPrivate WebKitWebViewPrivate;
  *   or to block the transfer of resources entirely.
  *
  * Enum values used for determining the type of a policy decision during
- * WebKitWebView::decide-policy.
+ * #WebKitWebView::decide-policy.
  */
 typedef enum {
     WEBKIT_POLICY_DECISION_TYPE_NAVIGATION_ACTION,
@@ -86,7 +87,7 @@ typedef enum {
 } WebKitPolicyDecisionType;
 
 /**
- * WebKitLoadEvent
+ * WebKitLoadEvent:
  * @WEBKIT_LOAD_STARTED: A new load request has been made.
  * No data has been received yet, empty structures have
  * been allocated to perform the load; the load may still
@@ -99,6 +100,9 @@ typedef enum {
  * load is being performed.
  * @WEBKIT_LOAD_FINISHED: Load completed. All resources are done loading
  * or there was an error during the load operation.
+ *
+ * Enum values used to denote the different events that happen during a
+ * #WebKitWebView load operation.
  */
 typedef enum {
     WEBKIT_LOAD_STARTED,
@@ -128,15 +132,9 @@ struct _WebKitWebViewClass {
     void       (* ready_to_show)        (WebKitWebView             *web_view);
     void       (* close)                (WebKitWebView             *web_view);
 
-    gboolean   (* script_alert)         (WebKitWebView             *web_view,
-                                         const gchar               *message);
-    gboolean   (* script_confirm)       (WebKitWebView             *web_view,
-                                         const gchar               *message,
-                                         gboolean                  *confirmed);
-    gboolean   (* script_prompt)        (WebKitWebView             *web_view,
-                                         const gchar               *message,
-                                         const gchar               *default_text,
-                                         gchar                    **text);
+    gboolean   (* script_dialog)        (WebKitWebView             *web_view,
+                                         WebKitScriptDialog        *dialog);
+
     gboolean   (* decide_policy)        (WebKitWebView             *web_view,
                                          WebKitPolicyDecision      *decision,
                                          WebKitPolicyDecisionType   type);
@@ -265,6 +263,10 @@ webkit_web_view_can_execute_editing_command_finish (WebKitWebView             *w
 WEBKIT_API void
 webkit_web_view_execute_editing_command            (WebKitWebView             *web_view,
                                                     const gchar               *command);
+
+WEBKIT_API WebKitFindController *
+webkit_web_view_get_find_controller                (WebKitWebView             *web_view);
+
 G_END_DECLS
 
 #endif
diff --git a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml
index 5cd859dad..4a9cc798c 100644
--- a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml
+++ b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml
@@ -27,6 +27,7 @@
     <xi:include href="xml/WebKitHitTestResult.xml"/>
     <xi:include href="xml/WebKitPrintOperation.xml"/>
     <xi:include href="xml/WebKitError.xml"/>
+    <xi:include href="xml/WebKitFindController.xml"/>
   </chapter>
 
   <index id="index-all">
diff --git a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
index 5bfc129b2..a8f54083a 100644
--- a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
+++ b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
@@ -49,6 +49,8 @@ webkit_web_context_get_type
 WebKitWebView
 WebKitLoadEvent
 WebKitPolicyDecisionType
+WebKitScriptDialog
+WebKitScriptDialogType
 
 <SUBSECTION Editing Commands>
 WEBKIT_EDITING_COMMAND_CUT
@@ -86,6 +88,12 @@ webkit_web_view_get_zoom_level
 webkit_web_view_can_execute_editing_command
 webkit_web_view_can_execute_editing_command_finish
 webkit_web_view_execute_editing_command
+webkit_web_view_get_find_controller
+webkit_script_dialog_get_dialog_type
+webkit_script_dialog_get_message
+webkit_script_dialog_confirm_set_confirmed
+webkit_script_dialog_prompt_get_default_text
+webkit_script_dialog_prompt_set_text
 
 <SUBSECTION Standard>
 WebKitWebViewClass
@@ -95,9 +103,11 @@ WEBKIT_TYPE_WEB_VIEW
 WEBKIT_WEB_VIEW_CLASS
 WEBKIT_IS_WEB_VIEW_CLASS
 WEBKIT_WEB_VIEW_GET_CLASS
+WEBKIT_TYPE_SCRIPT_DIALOG
 
 <SUBSECTION Private>
 webkit_web_view_get_type
+webkit_script_dialog_get_type
 WebKitWebViewPrivate
 </SECTION>
 
@@ -220,6 +230,8 @@ webkit_settings_get_enable_webaudio
 webkit_settings_set_enable_webaudio
 webkit_settings_get_enable_webgl
 webkit_settings_set_enable_webgl
+webkit_settings_get_zoom_text_only
+webkit_settings_set_zoom_text_only
 
 <SUBSECTION Standard>
 WebKitSettingsClass
@@ -461,3 +473,30 @@ webkit_policy_error_quark
 webkit_download_error_quark
 </SECTION>
 
+<SECTION>
+<FILE>WebKitFindController</FILE>
+WebKitFindController
+WebKitFindOptions
+webkit_find_controller_search
+webkit_find_controller_search_finish
+webkit_find_controller_search_next
+webkit_find_controller_search_previous
+webkit_find_controller_get_search_text
+webkit_find_controller_count_matches
+webkit_find_controller_get_options
+webkit_find_controller_get_max_match_count
+webkit_find_controller_get_web_view
+
+<SUBSECTION Standard>
+WebKitFindControllerClass
+WEBKIT_TYPE_FIND_CONTROLLER
+WEBKIT_FIND_CONTROLLER
+WEBKIT_IS_FIND_CONTROLLER
+WEBKIT_FIND_CONTROLLER_CLASS
+WEBKIT_IS_FIND_CONTROLLER_CLASS
+WEBKIT_FIND_CONTROLLER_GET_CLASS
+
+<SUBSECTION Private>
+WebKitFindControllerPrivate
+webkit_find_controller_get_type
+</SECTION>
diff --git a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk.types b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk.types
index cba2df42c..8e8d7b13a 100644
--- a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk.types
+++ b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk.types
@@ -9,4 +9,5 @@ webkit_uri_response_get_type
 webkit_uri_request_get_type
 webkit_window_properties_get_type
 webkit_download_get_type
-
+webkit_find_controller_get_type
+webkit_script_dialog_get_type
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am b/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
index 35ece6845..6adb2d5cd 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
@@ -1,15 +1,16 @@
 if ENABLE_WEBKIT2
 
 TEST_PROGS += \
-	Programs/WebKit2APITests/TestWebKitWebContext \
-	Programs/WebKit2APITests/TestWebKitWebView \
-	Programs/WebKit2APITests/TestLoaderClient \
-	Programs/WebKit2APITests/TestWebKitSettings \
 	Programs/WebKit2APITests/TestBackForwardList \
 	Programs/WebKit2APITests/TestDownloads \
+	Programs/WebKit2APITests/TestLoaderClient \
+	Programs/WebKit2APITests/TestPrinting \
+	Programs/WebKit2APITests/TestWebKitFindController \
 	Programs/WebKit2APITests/TestWebKitPolicyClient \
-	Programs/WebKit2APITests/TestWebViewEditor \
-	Programs/WebKit2APITests/TestPrinting
+	Programs/WebKit2APITests/TestWebKitSettings \
+	Programs/WebKit2APITests/TestWebKitWebContext \
+	Programs/WebKit2APITests/TestWebKitWebView \
+	Programs/WebKit2APITests/TestWebViewEditor
 
 noinst_PROGRAMS += $(TEST_PROGS)
 
@@ -128,4 +129,10 @@ Programs_WebKit2APITests_TestPrinting_CPPFLAGS = $(webkit2_tests_cppflags) $(GTK
 Programs_WebKit2APITests_TestPrinting_LDADD = $(webkit2_tests_ldadd) $(GTK_UNIX_PRINTING_LIBS)
 Programs_WebKit2APITests_TestPrinting_LDFLAGS = $(webkit2_tests_ldflags)
 
+Programs_WebKit2APITests_TestWebKitFindController_SOURCES = \
+	Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitFindController.cpp
+Programs_WebKit2APITests_TestWebKitFindController_CPPFLAGS = $(webkit2_tests_cppflags)
+Programs_WebKit2APITests_TestWebKitFindController_LDADD = $(webkit2_tests_ldadd)
+Programs_WebKit2APITests_TestWebKitFindController_LDFLAGS = $(webkit2_tests_ldflags)
+
 endif # ENABLE_WEBKIT2
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitFindController.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitFindController.cpp
new file mode 100644
index 000000000..ae9ff2f7a
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitFindController.cpp
@@ -0,0 +1,379 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2,1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#include "LoadTrackingTest.h"
+#include <gtk/gtk.h>
+#include <webkit2/webkit2.h>
+#include <wtf/gobject/GRefPtr.h>
+
+static const char* testString = "<html><body>first testing second testing secondHalf</body></html>";
+
+class FindControllerTest: public WebViewTest {
+public:
+    MAKE_GLIB_TEST_FIXTURE(FindControllerTest);
+
+    FindControllerTest()
+        : m_findController(webkit_web_view_get_find_controller(m_webView))
+        , m_runFindUntilCompletion(false)
+    {
+        assertObjectIsDeletedWhenTestFinishes(G_OBJECT(m_findController.get()));
+    }
+
+    ~FindControllerTest()
+    {
+        if (m_findController)
+            g_signal_handlers_disconnect_matched(m_findController.get(), G_SIGNAL_MATCH_DATA, 0, 0, 0, 0, this);
+    }
+
+    void find(const char* searchText, guint32 findOptions, guint maxMatchCount)
+    {
+        g_signal_connect(m_findController.get(), "found-text", G_CALLBACK(foundTextCallback), this);
+        g_signal_connect(m_findController.get(), "failed-to-find-text", G_CALLBACK(failedToFindTextCallback), this);
+        webkit_find_controller_search(m_findController.get(), searchText, findOptions, maxMatchCount);
+    }
+
+    void count(const char* searchText, guint32 findOptions, guint maxMatchCount)
+    {
+        g_signal_connect(m_findController.get(), "counted-matches", G_CALLBACK(countedMatchesCallback), this);
+        webkit_find_controller_count_matches(m_findController.get(), searchText, findOptions, maxMatchCount);
+    }
+
+    void waitUntilFindFinished()
+    {
+        m_runFindUntilCompletion = true;
+        g_main_loop_run(m_mainLoop);
+    }
+
+    void waitUntilWebViewDrawSignal()
+    {
+        g_signal_connect_after(m_webView, "draw", G_CALLBACK(webViewDraw), this);
+        g_main_loop_run(m_mainLoop);
+    }
+
+    GRefPtr<WebKitFindController> m_findController;
+    bool m_textFound;
+    unsigned m_matchCount;
+
+private:
+    bool m_runFindUntilCompletion;
+
+    static void webViewDraw(GtkWidget *widget, cairo_t *cr, FindControllerTest* test)
+    {
+        g_main_loop_quit(test->m_mainLoop);
+        g_signal_handlers_disconnect_matched(widget, G_SIGNAL_MATCH_DATA, 0, 0, 0, 0, test);
+    }
+
+    static void foundTextCallback(WebKitFindController*, guint matchCount, FindControllerTest* test)
+    {
+        test->m_textFound = true;
+        test->m_matchCount = matchCount;
+        if (test->m_runFindUntilCompletion)
+            g_main_loop_quit(test->m_mainLoop);
+    }
+
+    static void failedToFindTextCallback(WebKitFindController*, FindControllerTest* test)
+    {
+        test->m_textFound = false;
+        if (test->m_runFindUntilCompletion)
+            g_main_loop_quit(test->m_mainLoop);
+    }
+
+    static void countedMatchesCallback(WebKitFindController*, guint matchCount, FindControllerTest* test)
+    {
+        test->m_matchCount = matchCount;
+        if (test->m_runFindUntilCompletion)
+            g_main_loop_quit(test->m_mainLoop);
+    }
+};
+
+static void testFindControllerTextFound(FindControllerTest* test, gconstpointer)
+{
+    test->loadHtml(testString, 0);
+    test->waitUntilLoadFinished();
+
+    test->find("testing", WEBKIT_FIND_OPTIONS_NONE, 1);
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_textFound);
+}
+
+static void testFindControllerTextNotFound(FindControllerTest* test, gconstpointer)
+{
+    test->loadHtml(testString, 0);
+    test->waitUntilLoadFinished();
+
+    test->find("notFound", WEBKIT_FIND_OPTIONS_NONE, 1);
+    test->waitUntilFindFinished();
+
+    g_assert(!test->m_textFound);
+}
+
+static void testFindControllerMatchCount(FindControllerTest* test, gconstpointer)
+{
+    test->loadHtml(testString, 0);
+    test->waitUntilLoadFinished();
+
+    test->find("testing", WEBKIT_FIND_OPTIONS_NONE, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_matchCount == 2);
+    g_assert(test->m_textFound);
+}
+
+static void testFindControllerMaxMatchCount(FindControllerTest* test, gconstpointer)
+{
+    test->loadHtml(testString, 0);
+    test->waitUntilLoadFinished();
+
+    test->find("testing", WEBKIT_FIND_OPTIONS_NONE, 1);
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_matchCount == G_MAXUINT);
+    g_assert(test->m_textFound);
+}
+
+static void testFindControllerNext(FindControllerTest* test, gconstpointer)
+{
+    test->loadHtml(testString, 0);
+    test->waitUntilLoadFinished();
+
+    test->find("testing", WEBKIT_FIND_OPTIONS_NONE, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_textFound);
+    g_assert(test->m_matchCount == 2);
+
+    webkit_find_controller_search_next(test->m_findController.get());
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_textFound);
+    g_assert(test->m_matchCount == 2);
+    g_assert(!(webkit_find_controller_get_options(test->m_findController.get()) & WEBKIT_FIND_OPTIONS_BACKWARDS));
+
+    webkit_find_controller_search_next(test->m_findController.get());
+    test->waitUntilFindFinished();
+
+    g_assert(!test->m_textFound);
+    g_assert(test->m_matchCount == 2);
+    g_assert(!(webkit_find_controller_get_options(test->m_findController.get()) & WEBKIT_FIND_OPTIONS_BACKWARDS));
+}
+
+static void testFindControllerPrevious(FindControllerTest* test, gconstpointer)
+{
+    test->loadHtml(testString, 0);
+    test->waitUntilLoadFinished();
+
+    test->find("testing", WEBKIT_FIND_OPTIONS_NONE, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_matchCount == 2);
+    g_assert(test->m_textFound);
+
+    webkit_find_controller_search_next(test->m_findController.get());
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_textFound);
+    g_assert(test->m_matchCount == 2);
+    g_assert(!(webkit_find_controller_get_options(test->m_findController.get()) & WEBKIT_FIND_OPTIONS_BACKWARDS));
+
+    webkit_find_controller_search_previous(test->m_findController.get());
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_textFound);
+    g_assert(test->m_matchCount == 2);
+    g_assert(webkit_find_controller_get_options(test->m_findController.get()) & WEBKIT_FIND_OPTIONS_BACKWARDS);
+}
+
+static void testFindControllerCountedMatches(FindControllerTest* test, gconstpointer)
+{
+    test->loadHtml(testString, 0);
+    test->waitUntilLoadFinished();
+
+    test->count("testing", WEBKIT_FIND_OPTIONS_NONE, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_matchCount == 2);
+
+    test->count("first", WEBKIT_FIND_OPTIONS_NONE, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_matchCount == 1);
+
+    test->count("notFound", WEBKIT_FIND_OPTIONS_NONE, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(!test->m_matchCount);
+}
+
+static void testFindControllerOptions(FindControllerTest* test, gconstpointer)
+{
+    test->loadHtml(testString, 0);
+    test->waitUntilLoadFinished();
+
+    test->find("Testing", WEBKIT_FIND_OPTIONS_NONE, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(!test->m_textFound);
+
+    test->find("Testing", WEBKIT_FIND_OPTIONS_CASE_INSENSITIVE, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_textFound);
+
+    test->find("esting", WEBKIT_FIND_OPTIONS_NONE, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_textFound);
+
+    test->find("esting", WEBKIT_FIND_OPTIONS_AT_WORD_STARTS, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(!test->m_textFound);
+
+    test->find("Half", WEBKIT_FIND_OPTIONS_AT_WORD_STARTS, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(!test->m_textFound);
+
+    test->find("Half", WEBKIT_FIND_OPTIONS_AT_WORD_STARTS | WEBKIT_FIND_OPTIONS_TREAT_MEDIAL_CAPITAL_AS_WORD_START, 2);
+    test->waitUntilFindFinished();
+
+    g_assert(test->m_textFound);
+
+    test->find("testing", WEBKIT_FIND_OPTIONS_WRAP_AROUND, 3);
+    test->waitUntilFindFinished();
+    g_assert(test->m_textFound);
+
+    webkit_find_controller_search_next(test->m_findController.get());
+    test->waitUntilFindFinished();
+    g_assert(test->m_textFound);
+
+    webkit_find_controller_search_next(test->m_findController.get());
+    test->waitUntilFindFinished();
+    g_assert(test->m_textFound);
+}
+
+static gboolean gdkPixbufEqual(GdkPixbuf* firstPixbuf, GdkPixbuf* secondPixbuf)
+{
+    if (gdk_pixbuf_get_bits_per_sample(firstPixbuf) != gdk_pixbuf_get_bits_per_sample(secondPixbuf)
+        || gdk_pixbuf_get_has_alpha(firstPixbuf) != gdk_pixbuf_get_has_alpha(secondPixbuf)
+        || gdk_pixbuf_get_height(firstPixbuf) != gdk_pixbuf_get_height(secondPixbuf)
+        || gdk_pixbuf_get_n_channels(firstPixbuf) != gdk_pixbuf_get_n_channels(secondPixbuf)
+        || gdk_pixbuf_get_rowstride(firstPixbuf) != gdk_pixbuf_get_rowstride(secondPixbuf)
+        || gdk_pixbuf_get_width(firstPixbuf) != gdk_pixbuf_get_width(secondPixbuf))
+        return FALSE;
+
+    int pixbufRowstride = gdk_pixbuf_get_rowstride(firstPixbuf);
+    int pixbufHeight = gdk_pixbuf_get_height(firstPixbuf);
+    int pixbufWidth = gdk_pixbuf_get_width(firstPixbuf);
+    int numberOfChannels = gdk_pixbuf_get_n_channels(firstPixbuf);
+    int bitsPerSample = gdk_pixbuf_get_bits_per_sample(firstPixbuf);
+
+    // Last row can be of different length. Taken from gdk-pixbuf documentation.
+    int totalLength = (pixbufHeight - 1) * pixbufRowstride \
+        + pixbufWidth * ((numberOfChannels * bitsPerSample + 7) / 8);
+
+    guchar* firstPixels = gdk_pixbuf_get_pixels(firstPixbuf);
+    guchar* secondPixels = gdk_pixbuf_get_pixels(secondPixbuf);
+    for (int i = 0; i < totalLength; i++)
+        if (firstPixels[i] != secondPixels[i])
+            return FALSE;
+
+    return TRUE;
+}
+
+static void testFindControllerHide(FindControllerTest* test, gconstpointer)
+{
+    test->loadHtml(testString, 0);
+    test->waitUntilLoadFinished();
+
+    test->showInWindowAndWaitUntilMapped();
+    int allocatedHeight = gtk_widget_get_allocated_height(GTK_WIDGET(test->m_webView));
+    int allocatedWidth = gtk_widget_get_allocated_width(GTK_WIDGET(test->m_webView));
+    GdkWindow* webViewGdkWindow = gtk_widget_get_window(GTK_WIDGET(test->m_webView));
+    g_assert(webViewGdkWindow);
+
+    test->waitUntilWebViewDrawSignal();
+    GRefPtr<GdkPixbuf> originalPixbuf = gdk_pixbuf_get_from_window(webViewGdkWindow, 0, 0, allocatedHeight, allocatedWidth);
+    g_assert(originalPixbuf);
+
+    test->find("testing", WEBKIT_FIND_OPTIONS_NONE, 1);
+    test->waitUntilFindFinished();
+    g_assert(test->m_textFound);
+
+    test->waitUntilWebViewDrawSignal();
+    GRefPtr<GdkPixbuf> highlightPixbuf = gdk_pixbuf_get_from_window(webViewGdkWindow, 0, 0, allocatedHeight, allocatedWidth);
+    g_assert(highlightPixbuf);
+    g_assert(!gdkPixbufEqual(originalPixbuf.get(), highlightPixbuf.get()));
+
+#if (0)
+    // Requires http://webkit.org/b/77747 to be fixed
+    WebKitFindController* findController = webkit_web_view_get_find_controller(test->m_webView);
+    webkit_find_controller_search_finish(findController);
+    webkit_web_view_execute_editing_command(test->m_webView, "Unselect");
+
+    test->waitUntilWebViewDrawSignal();
+    GRefPtr<GdkPixbuf> unhighlightPixbuf = gdk_pixbuf_get_from_window(webViewGdkWindow, 0, 0, allocatedHeight, allocatedWidth);
+    g_assert(unhighlightPixbuf);
+    g_assert(gdkPixbufEqual(originalPixbuf.get(), unhighlightPixbuf.get()));
+#endif
+}
+
+static void testFindControllerInstance(FindControllerTest* test, gconstpointer)
+{
+    WebKitFindController* findController1 = webkit_web_view_get_find_controller(test->m_webView);
+    WebKitFindController* findController2 = webkit_web_view_get_find_controller(test->m_webView);
+
+    g_assert(findController1 == findController2);
+}
+
+static void testFindControllerGetters(FindControllerTest* test, gconstpointer)
+{
+    const char* searchText = "testing";
+    guint maxMatchCount = 1;
+    guint32 findOptions = WEBKIT_FIND_OPTIONS_WRAP_AROUND | WEBKIT_FIND_OPTIONS_AT_WORD_STARTS;
+    WebKitFindController* findController = webkit_web_view_get_find_controller(test->m_webView);
+
+    webkit_find_controller_search(findController, searchText, findOptions, maxMatchCount);
+    g_assert(webkit_find_controller_get_web_view(findController) == test->m_webView);
+    g_assert(!g_strcmp0(webkit_find_controller_get_search_text(findController), searchText));
+    g_assert(webkit_find_controller_get_max_match_count(findController) == maxMatchCount);
+    g_assert(webkit_find_controller_get_options(findController) == findOptions);
+}
+
+void beforeAll()
+{
+    FindControllerTest::add("WebKitFindController", "getters", testFindControllerGetters);
+    FindControllerTest::add("WebKitFindController", "instance", testFindControllerInstance);
+    FindControllerTest::add("WebKitFindController", "text-found", testFindControllerTextFound);
+    FindControllerTest::add("WebKitFindController", "text-not-found", testFindControllerTextNotFound);
+    FindControllerTest::add("WebKitFindController", "match-count", testFindControllerMatchCount);
+    FindControllerTest::add("WebKitFindController", "max-match-count", testFindControllerMaxMatchCount);
+    FindControllerTest::add("WebKitFindController", "next", testFindControllerNext);
+    FindControllerTest::add("WebKitFindController", "previous", testFindControllerPrevious);
+    FindControllerTest::add("WebKitFindController", "counted-matches", testFindControllerCountedMatches);
+    FindControllerTest::add("WebKitFindController", "options", testFindControllerOptions);
+    FindControllerTest::add("WebKitFindController", "hide", testFindControllerHide);
+}
+
+void afterAll()
+{
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
index a3ce7dece..03c5f2fe8 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
@@ -199,6 +199,11 @@ static void testWebKitSettings(Test*, gconstpointer)
     webkit_settings_set_enable_webgl(settings, TRUE);
     g_assert(webkit_settings_get_enable_webgl(settings));
 
+    // Zoom text only is disabled by default.
+    g_assert(!webkit_settings_get_zoom_text_only(settings));
+    webkit_settings_set_zoom_text_only(settings, TRUE);
+    g_assert(webkit_settings_get_zoom_text_only(settings));
+
     g_object_unref(G_OBJECT(settings));
 }
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
index 47da98eb3..bfeda169f 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
@@ -71,24 +71,22 @@ static void testWebViewSettings(WebViewTest* test, gconstpointer)
     g_assert(webkit_settings_get_enable_javascript(settings));
 }
 
-static void replaceContentTitleChangedCallback(WebViewTest* test)
+static void replaceContentLoadCallback(WebKitWebView* webView, WebKitLoadEvent loadEvent, WebViewTest* test)
 {
-    g_main_loop_quit(test->m_mainLoop);
-}
-
-static void replaceContentLoadCallback()
-{
-    g_assert_not_reached();
+    // There might be an event from a previous load,
+    // but never a WEBKIT_LOAD_STARTED after webkit_web_view_replace_content().
+    g_assert_cmpint(loadEvent, !=, WEBKIT_LOAD_STARTED);
 }
 
 static void testWebViewReplaceContent(WebViewTest* test, gconstpointer)
 {
-    g_signal_connect_swapped(test->m_webView, "notify::title", G_CALLBACK(replaceContentTitleChangedCallback), test);
+    test->loadHtml("<html><head><title>Replace Content Test</title></head><body>Content to replace</body></html>", 0);
+    test->waitUntilTitleChangedTo("Replace Content Test");
+
     g_signal_connect(test->m_webView, "load-changed", G_CALLBACK(replaceContentLoadCallback), test);
-    g_signal_connect(test->m_webView, "load-failed", G_CALLBACK(replaceContentLoadCallback), test);
-    test->replaceContent("<html><head><title>Content Replaced</title></head><body>New Content</body></html>",
+    test->replaceContent("<html><body onload='document.title=\"Content Replaced\"'>New Content</body></html>",
                          "http://foo.com/bar", 0);
-    g_main_loop_run(test->m_mainLoop);
+    test->waitUntilTitleChangedTo("Content Replaced");
 }
 
 static const char* kAlertDialogMessage = "WebKitGTK+ alert dialog message";
@@ -106,12 +104,6 @@ public:
         Close
     };
 
-    enum ScriptType {
-        Alert,
-        Confirm,
-        Prompt
-    };
-
     class WindowProperties {
     public:
         WindowProperties()
@@ -226,43 +218,52 @@ public:
         return newWebView;
     }
 
-    static gboolean scriptAlert(WebKitWebView*, const char* message, UIClientTest* test)
+    void scriptAlert(WebKitScriptDialog* dialog)
     {
-        switch (test->m_scriptType) {
-        case UIClientTest::Alert:
-            g_assert_cmpstr(message, ==, kAlertDialogMessage);
+        switch (m_scriptDialogType) {
+        case WEBKIT_SCRIPT_DIALOG_ALERT:
+            g_assert_cmpstr(webkit_script_dialog_get_message(dialog), ==, kAlertDialogMessage);
             break;
-        case UIClientTest::Confirm:
-            g_assert(test->m_scriptDialogConfirmed);
-            g_assert_cmpstr(message, ==, "confirmed");
+        case WEBKIT_SCRIPT_DIALOG_CONFIRM:
+            g_assert(m_scriptDialogConfirmed);
+            g_assert_cmpstr(webkit_script_dialog_get_message(dialog), ==, "confirmed");
 
             break;
-        case UIClientTest::Prompt:
-            g_assert_cmpstr(message, ==, kPromptDialogReturnedText);
+        case WEBKIT_SCRIPT_DIALOG_PROMPT:
+            g_assert_cmpstr(webkit_script_dialog_get_message(dialog), ==, kPromptDialogReturnedText);
             break;
         }
 
-        g_main_loop_quit(test->m_mainLoop);
-
-        return TRUE;
+        g_main_loop_quit(m_mainLoop);
     }
 
-    static gboolean scriptConfirm(WebKitWebView*, const char* message, gboolean* confirmed, UIClientTest* test)
+    void scriptConfirm(WebKitScriptDialog* dialog)
     {
-        g_assert_cmpstr(message, ==, kConfirmDialogMessage);
-        g_assert(confirmed);
-        test->m_scriptDialogConfirmed = !test->m_scriptDialogConfirmed;
-        *confirmed = test->m_scriptDialogConfirmed;
+        g_assert_cmpstr(webkit_script_dialog_get_message(dialog), ==, kConfirmDialogMessage);
+        m_scriptDialogConfirmed = !m_scriptDialogConfirmed;
+        webkit_script_dialog_confirm_set_confirmed(dialog, m_scriptDialogConfirmed);
+    }
 
-        return TRUE;
+    void scriptPrompt(WebKitScriptDialog* dialog)
+    {
+        g_assert_cmpstr(webkit_script_dialog_get_message(dialog), ==, kPromptDialogMessage);
+        g_assert_cmpstr(webkit_script_dialog_prompt_get_default_text(dialog), ==, "default");
+        webkit_script_dialog_prompt_set_text(dialog, kPromptDialogReturnedText);
     }
 
-    static gboolean scriptPrompt(WebKitWebView*, const char* message, const char* defaultText, char **text, UIClientTest* test)
+    static gboolean scriptDialog(WebKitWebView*, WebKitScriptDialog* dialog, UIClientTest* test)
     {
-        g_assert_cmpstr(message, ==, kPromptDialogMessage);
-        g_assert_cmpstr(defaultText, ==, "default");
-        g_assert(text);
-        *text = g_strdup(kPromptDialogReturnedText);
+        switch (webkit_script_dialog_get_dialog_type(dialog)) {
+        case WEBKIT_SCRIPT_DIALOG_ALERT:
+            test->scriptAlert(dialog);
+            break;
+        case WEBKIT_SCRIPT_DIALOG_CONFIRM:
+            test->scriptConfirm(dialog);
+            break;
+        case WEBKIT_SCRIPT_DIALOG_PROMPT:
+            test->scriptPrompt(dialog);
+            break;
+        }
 
         return TRUE;
     }
@@ -278,15 +279,13 @@ public:
     }
 
     UIClientTest()
-        : m_scriptType(Alert)
+        : m_scriptDialogType(WEBKIT_SCRIPT_DIALOG_ALERT)
         , m_scriptDialogConfirmed(true)
         , m_mouseTargetModifiers(0)
     {
         webkit_settings_set_javascript_can_open_windows_automatically(webkit_web_view_get_settings(m_webView), TRUE);
         g_signal_connect(m_webView, "create", G_CALLBACK(viewCreate), this);
-        g_signal_connect(m_webView, "script-alert", G_CALLBACK(scriptAlert), this);
-        g_signal_connect(m_webView, "script-confirm", G_CALLBACK(scriptConfirm), this);
-        g_signal_connect(m_webView, "script-prompt", G_CALLBACK(scriptPrompt), this);
+        g_signal_connect(m_webView, "script-dialog", G_CALLBACK(scriptDialog), this);
         g_signal_connect(m_webView, "mouse-target-changed", G_CALLBACK(mouseTargetChanged), this);
     }
 
@@ -313,7 +312,7 @@ public:
     }
 
     Vector<WebViewEvents> m_webViewEvents;
-    ScriptType m_scriptType;
+    WebKitScriptDialogType m_scriptDialogType;
     bool m_scriptDialogConfirmed;
     WindowProperties m_windowProperties;
     HashSet<WTF::String> m_windowPropertiesChanged;
@@ -340,19 +339,19 @@ static void testWebViewJavaScriptDialogs(UIClientTest* test, gconstpointer)
     static const char* jsConfirmFormat = "do { confirmed = confirm('%s'); } while (!confirmed); alert('confirmed');";
     static const char* jsPromptFormat = "alert(prompt('%s', 'default'));";
 
-    test->m_scriptType = UIClientTest::Alert;
+    test->m_scriptDialogType = WEBKIT_SCRIPT_DIALOG_ALERT;
     GOwnPtr<char> alertDialogMessage(g_strdup_printf(jsAlertFormat, kAlertDialogMessage));
     GOwnPtr<char> alertHTML(g_strdup_printf(htmlOnLoadFormat, alertDialogMessage.get()));
     test->loadHtml(alertHTML.get(), 0);
     test->waitUntilMainLoopFinishes();
 
-    test->m_scriptType = UIClientTest::Confirm;
+    test->m_scriptDialogType = WEBKIT_SCRIPT_DIALOG_CONFIRM;
     GOwnPtr<char> confirmDialogMessage(g_strdup_printf(jsConfirmFormat, kConfirmDialogMessage));
     GOwnPtr<char> confirmHTML(g_strdup_printf(htmlOnLoadFormat, confirmDialogMessage.get()));
     test->loadHtml(confirmHTML.get(), 0);
     test->waitUntilMainLoopFinishes();
 
-    test->m_scriptType = UIClientTest::Prompt;
+    test->m_scriptDialogType = WEBKIT_SCRIPT_DIALOG_PROMPT;
     GOwnPtr<char> promptDialogMessage(g_strdup_printf(jsPromptFormat, kPromptDialogMessage));
     GOwnPtr<char> promptHTML(g_strdup_printf(htmlOnLoadFormat, promptDialogMessage.get()));
     test->loadHtml(promptHTML.get(), 0);
@@ -447,6 +446,10 @@ static void testWebViewZoomLevel(WebViewTest* test, gconstpointer)
     g_assert_cmpfloat(webkit_web_view_get_zoom_level(test->m_webView), ==, 1);
     webkit_web_view_set_zoom_level(test->m_webView, 2.5);
     g_assert_cmpfloat(webkit_web_view_get_zoom_level(test->m_webView), ==, 2.5);
+
+    webkit_settings_set_zoom_text_only(webkit_web_view_get_settings(test->m_webView), TRUE);
+    // The zoom level shouldn't change when zoom-text-only setting changes.
+    g_assert_cmpfloat(webkit_web_view_get_zoom_level(test->m_webView), ==, 2.5);
 }
 
 void beforeAll()
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp
index 00d3b3e20..31de72911 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp
@@ -136,6 +136,28 @@ void WebViewTest::waitUntilLoadFinished()
     g_main_loop_run(m_mainLoop);
 }
 
+static void titleChanged(WebKitWebView* webView, GParamSpec*, WebViewTest* test)
+{
+    if (!test->m_expectedTitle.isNull() && test->m_expectedTitle != webkit_web_view_get_title(webView))
+        return;
+
+    g_signal_handlers_disconnect_by_func(webView, reinterpret_cast<void*>(titleChanged), test);
+    g_main_loop_quit(test->m_mainLoop);
+}
+
+void WebViewTest::waitUntilTitleChangedTo(const char* expectedTitle)
+{
+    m_expectedTitle = expectedTitle;
+    g_signal_connect(m_webView, "notify::title", G_CALLBACK(titleChanged), this);
+    g_main_loop_run(m_mainLoop);
+    m_expectedTitle = CString();
+}
+
+void WebViewTest::waitUntilTitleChanged()
+{
+    waitUntilTitleChangedTo(0);
+}
+
 static gboolean parentWindowMapped(GtkWidget* widget, GdkEvent*, WebViewTest* test)
 {
     g_signal_handlers_disconnect_by_func(widget, reinterpret_cast<void*>(parentWindowMapped), test);
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h
index 95a569cd6..01f468562 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h
@@ -42,6 +42,8 @@ public:
 
     void wait(double seconds);
     void waitUntilLoadFinished();
+    void waitUntilTitleChangedTo(const char* expectedTitle);
+    void waitUntilTitleChanged();
     void showInWindowAndWaitUntilMapped();
 
     void mouseMoveTo(int x, int y, unsigned int mouseModifiers = 0);
@@ -50,6 +52,7 @@ public:
     GMainLoop* m_mainLoop;
     CString m_activeURI;
     GtkWidget* m_parentWindow;
+    CString m_expectedTitle;
 };
 
 #endif // WebViewTest_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/webkit2.h b/Source/WebKit2/UIProcess/API/gtk/webkit2.h
index f78b873a3..0a807bc3d 100644
--- a/Source/WebKit2/UIProcess/API/gtk/webkit2.h
+++ b/Source/WebKit2/UIProcess/API/gtk/webkit2.h
@@ -30,8 +30,10 @@
 #include <webkit2/WebKitEditingCommands.h>
 #include <webkit2/WebKitEnumTypes.h>
 #include <webkit2/WebKitError.h>
+#include <webkit2/WebKitFindController.h>
 #include <webkit2/WebKitHitTestResult.h>
 #include <webkit2/WebKitPrintOperation.h>
+#include <webkit2/WebKitScriptDialog.h>
 #include <webkit2/WebKitSettings.h>
 #include <webkit2/WebKitURIRequest.h>
 #include <webkit2/WebKitURIResponse.h>
diff --git a/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list b/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list
index 77d269a75..5f7356039 100644
--- a/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list
+++ b/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list
@@ -1,15 +1,10 @@
+BOOLEAN:BOXED
 BOOLEAN:ENUM,STRING,POINTER
 BOOLEAN:OBJECT
 BOOLEAN:OBJECT,ENUM
-BOOLEAN:OBJECT,STRING,POINTER
-BOOLEAN:POINTER
 BOOLEAN:STRING
-BOOLEAN:STRING,POINTER
-BOOLEAN:STRING,STRING,POINTER
-BOOLEAN:UINT64
-BOOLEAN:VOID
 OBJECT:VOID
-VOID:ENUM
 VOID:OBJECT,UINT
 VOID:OBJECT,POINTER
+VOID:UINT64
 
diff --git a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
index 953c378e1..dbe947a39 100644
--- a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
@@ -37,10 +37,6 @@ namespace WebKit {
 
 class FindIndicatorWindow;
 
-// NOTE: This does not use String::operator NSString*() since that function
-// expects to be called on the thread running WebCore.
-NSString* nsStringFromWebCoreString(const String&);
-
 class PageClientImpl : public PageClient {
 public:
     static PassOwnPtr<PageClientImpl> create(WKView*);
@@ -59,7 +55,8 @@ private:
     virtual bool isViewFocused();
     virtual bool isViewVisible();
     virtual bool isViewInWindow();
-    
+    virtual LayerHostingMode layerHostingMode();
+
     virtual void processDidCrash();
     virtual void pageClosed();
     virtual void didRelaunchProcess();
@@ -95,6 +92,7 @@ private:
 
     virtual void enterAcceleratedCompositingMode(const LayerTreeContext&);
     virtual void exitAcceleratedCompositingMode();
+    virtual void updateAcceleratedCompositingMode(const LayerTreeContext&);
 
     virtual void accessibilityWebProcessTokenReceived(const CoreIPC::DataReference&);
 
diff --git a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
index 35e0e2e70..71a1a5075 100644
--- a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
+++ b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
@@ -33,6 +33,7 @@
 #import "WKAPICast.h"
 #import "WKStringCF.h"
 #import "WKViewInternal.h"
+#import "StringUtilities.h"
 #import "WebContextMenuProxyMac.h"
 #import "WebEditCommandProxy.h"
 #import "WebPopupMenuProxyMac.h"
@@ -51,6 +52,12 @@
 - (NSCursor *)_cursorRectCursor;
 @end
 
+#if HAVE(LAYER_HOSTING_IN_WINDOW_SERVER)
+@interface NSWindow (WebNSWindowDetails)
+- (BOOL)_hostsLayersInWindowServer;
+@end
+#endif
+
 using namespace WebCore;
 using namespace WebKit;
 
@@ -104,11 +111,6 @@ using namespace WebKit;
 
 namespace WebKit {
 
-NSString* nsStringFromWebCoreString(const String& string)
-{
-    return string.impl() ? HardAutorelease(WKStringCopyCFString(0, toAPI(string.impl()))) : @"";
-}
-
 PassOwnPtr<PageClientImpl> PageClientImpl::create(WKView* wkView)
 {
     return adoptPtr(new PageClientImpl(wkView));
@@ -188,6 +190,18 @@ bool PageClientImpl::isViewInWindow()
     return [m_wkView window];
 }
 
+LayerHostingMode PageClientImpl::layerHostingMode()
+{
+#if HAVE(LAYER_HOSTING_IN_WINDOW_SERVER)
+    if (![m_wkView window])
+        return LayerHostingModeDefault;
+
+    return [[m_wkView window] _hostsLayersInWindowServer] ? LayerHostingModeInWindowServer : LayerHostingModeDefault;
+#else
+    return LayerHostingModeDefault;
+#endif
+}
+
 void PageClientImpl::processDidCrash()
 {
     [m_wkView _processDidCrash];
@@ -341,6 +355,11 @@ void PageClientImpl::exitAcceleratedCompositingMode()
 {
     [m_wkView _exitAcceleratedCompositingMode];
 }
+
+void PageClientImpl::updateAcceleratedCompositingMode(const LayerTreeContext& layerTreeContext)
+{
+    [m_wkView _updateAcceleratedCompositingMode:layerTreeContext];
+}
 #endif // USE(ACCELERATED_COMPOSITING)
 
 void PageClientImpl::pluginFocusOrWindowFocusChanged(uint64_t pluginComplexTextInputIdentifier, bool pluginHasFocusAndWindowHasFocus)
diff --git a/Source/WebKit2/UIProcess/API/mac/WKView.mm b/Source/WebKit2/UIProcess/API/mac/WKView.mm
index d50a7269a..a326dd089 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKView.mm
+++ b/Source/WebKit2/UIProcess/API/mac/WKView.mm
@@ -40,6 +40,7 @@
 #import "PDFViewController.h"
 #import "PageClientImpl.h"
 #import "PasteboardTypes.h"
+#import "StringUtilities.h"
 #import "TextChecker.h"
 #import "TextCheckerState.h"
 #import "TiledCoreAnimationDrawingAreaProxy.h"
@@ -373,6 +374,7 @@ struct WKViewInterpretKeyEventsParameters {
 
     // Send back an empty string to the plug-in. This will disable text input.
     _data->_page->sendComplexTextInputToPlugin(_data->_pluginComplexTextInputIdentifier, String());
+    _data->_pluginComplexTextInputIdentifier = 0;   // Always reset the identifier when the plugin is disabled.
 }
 
 typedef HashMap<SEL, String> SelectorNameMap;
@@ -1262,8 +1264,10 @@ static const short kIOHIDEventTypeScroll = 6;
     if (string) {
         _data->_page->sendComplexTextInputToPlugin(_data->_pluginComplexTextInputIdentifier, string);
 
-        if (!usingLegacyCocoaTextInput)
+        if (!usingLegacyCocoaTextInput) {
             _data->_pluginComplexTextInputState = PluginComplexTextInputDisabled;
+            _data->_pluginComplexTextInputIdentifier = 0;   // Always reset the identifier when the plugin is disabled.
+        }
     }
 
     return didHandleEvent;
@@ -2458,6 +2462,12 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_layerHostingView = nullptr;
 }
 
+- (void)_updateAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)layerTreeContext
+{
+    [self _exitAcceleratedCompositingMode];
+    [self _enterAcceleratedCompositingMode:layerTreeContext];
+}
+
 - (void)_setAccessibilityWebProcessToken:(NSData *)data
 {
     _data->_remoteAccessibilityChild = WKAXRemoteElementForToken(data);
diff --git a/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h b/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
index fd3e152e9..83346d3f1 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
+++ b/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
@@ -64,6 +64,7 @@ namespace WebKit {
 
 - (void)_enterAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)layerTreeContext;
 - (void)_exitAcceleratedCompositingMode;
+- (void)_updateAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)layerTreeContext;
 
 - (void)_setAccessibilityWebProcessToken:(NSData *)data;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp b/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
index d164a6b85..9293c972f 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
@@ -24,8 +24,10 @@
 #include "LayerTreeHostProxy.h"
 #include "QtWebPageEventHandler.h"
 #include "TransformationMatrix.h"
+#include "WebLayerTreeRenderer.h"
 #include "qquickwebpage_p_p.h"
 #include "qquickwebview_p.h"
+#include <QPolygonF>
 #include <QtQuick/QQuickCanvas>
 #include <QtQuick/QSGGeometryNode>
 #include <QtQuick/QSGMaterial>
@@ -36,6 +38,7 @@ QQuickWebPage::QQuickWebPage(QQuickWebView* viewportItem)
     , d(new QQuickWebPagePrivate(this, viewportItem))
 {
     setFlag(ItemHasContents);
+    setClip(true);
 
     // We do the transform from the top left so the viewport can assume the position 0, 0
     // is always where rendering starts.
@@ -63,18 +66,6 @@ void QQuickWebPagePrivate::initialize(WebKit::WebPageProxy* webPageProxy)
     eventHandler.reset(new QtWebPageEventHandler(toAPI(webPageProxy), q, viewportItem));
 }
 
-static float computeEffectiveOpacity(const QQuickItem* item)
-{
-    if (!item)
-        return 1;
-
-    float opacity = item->opacity();
-    if (opacity < 0.01)
-        return 0;
-
-    return opacity * computeEffectiveOpacity(item->parentItem());
-}
-
 void QQuickWebPagePrivate::setDrawingAreaSize(const QSize& size)
 {
     DrawingAreaProxy* drawingArea = webPageProxy->drawingArea();
@@ -89,69 +80,109 @@ void QQuickWebPagePrivate::paint(QPainter* painter)
         webPageProxy->drawingArea()->paintLayerTree(painter);
 }
 
-void QQuickWebPagePrivate::paintToCurrentGLContext()
-{
-    if (!q->isVisible())
-        return;
-
-    QTransform transform = q->itemTransform(0, 0);
-    transform.scale(contentsScale, contentsScale);
-
-    float opacity = computeEffectiveOpacity(q);
-    QRectF clipRect = viewportItem->mapRectToScene(viewportItem->boundingRect());
-
-    if (!clipRect.isValid())
-        return;
-
-    DrawingAreaProxy* drawingArea = webPageProxy->drawingArea();
-    if (!drawingArea)
-        return;
-
-    drawingArea->paintToCurrentGLContext(transform, opacity, clipRect);
-}
-
 struct PageProxyNode : public QSGRenderNode {
-    PageProxyNode(QQuickWebPagePrivate* page)
-        : m_pagePrivate(page)
+    PageProxyNode(PassRefPtr<WebLayerTreeRenderer> renderer)
+        : m_renderer(renderer)
+        , m_scale(1)
     {
     }
 
     virtual StateFlags changedStates()
     {
-        return StateFlags(DepthState) | StencilState | ScissorState | ColorState | BlendState
-               | CullState | ViewportState;
+        return StateFlags(StencilState) | ColorState | BlendState;
     }
 
-    virtual void render(const RenderState &)
+    virtual void render(const RenderState&)
     {
-        if (m_pagePrivate)
-            m_pagePrivate->paintToCurrentGLContext();
+        QMatrix4x4 renderMatrix = matrix() ? *matrix() : QMatrix4x4();
+
+        // Have to apply render scale manualy because it is not applied on page item.
+        // http://trac.webkit.org/changeset/104450
+        renderMatrix.scale(m_scale);
+
+        // FIXME: Support non-rectangular clippings.
+        layerTreeRenderer()->paintToCurrentGLContext(renderMatrix, inheritedOpacity(), clipRect());
     }
 
     ~PageProxyNode()
     {
-        if (m_pagePrivate)
-            m_pagePrivate->resetPaintNode();
+        layerTreeRenderer()->purgeGLResources();
     }
 
-    QQuickWebPagePrivate* m_pagePrivate;
+    WebLayerTreeRenderer* layerTreeRenderer() const { return m_renderer.get(); }
+    void setScale(float scale) { m_scale = scale; }
+
+private:
+    QRectF clipRect() const
+    {
+        // Start with an invalid rect.
+        QRectF resultRect(0, 0, -1, -1);
+
+        for (const QSGClipNode* clip = clipList(); clip; clip = clip->clipList()) {
+            QMatrix4x4 clipMatrix;
+            if (clip->matrix())
+                clipMatrix = *clip->matrix();
+            QRectF currentClip;
+
+            if (clip->isRectangular())
+                currentClip = clipMatrix.mapRect(clip->clipRect());
+            else {
+                const QSGGeometry* geometry = clip->geometry();
+                // Assume here that clipNode has only coordinate data.
+                const QSGGeometry::Point2D* geometryPoints = geometry->vertexDataAsPoint2D();
+
+                // Clip region should be at least triangle to make valid clip.
+                if (geometry->vertexCount() < 3)
+                    continue;
+
+                QPolygonF polygon;
+
+                for (int i = 0; i < geometry->vertexCount(); i++)
+                    polygon.append(clipMatrix.map(QPoint(geometryPoints[i].x, geometryPoints[i].y)));
+                currentClip = polygon.boundingRect();
+            }
+
+            if (currentClip.isEmpty())
+                continue;
+
+            if (resultRect.isValid())
+                resultRect &= currentClip;
+            else
+                resultRect = currentClip;
+        }
+
+        return resultRect;
+    }
+
+    RefPtr<WebLayerTreeRenderer> m_renderer;
+    float m_scale;
 };
 
 QSGNode* QQuickWebPage::updatePaintNode(QSGNode* oldNode, UpdatePaintNodeData*)
 {
-    if (!(flags() & ItemHasContents)) {
-        if (oldNode)
-            delete oldNode;
-        return 0;
-    }
+    if (!d->webPageProxy->drawingArea())
+        return oldNode;
+
+    LayerTreeHostProxy* layerTreeHostProxy = d->webPageProxy->drawingArea()->layerTreeHostProxy();
+    WebLayerTreeRenderer* renderer = layerTreeHostProxy->layerTreeRenderer();
 
-    PageProxyNode* proxyNode = static_cast<PageProxyNode*>(oldNode);
-    if (!proxyNode) {
-        proxyNode = new PageProxyNode(d);
-        d->m_paintNode = proxyNode;
+    PageProxyNode* node = static_cast<PageProxyNode*>(oldNode);
+
+    if (node && node->layerTreeRenderer() != renderer) {
+        // This means that LayerTreeHostProxy was deleted and recreated while old paint node survived.
+        // This could happen if web process have crashed. In this case we have to recreate paint node.
+        delete node;
+        node = 0;
     }
 
-    return proxyNode;
+    renderer->syncRemoteContent();
+
+    if (!node)
+        node = new PageProxyNode(renderer);
+
+    node->setScale(d->contentsScale);
+
+    return node;
 }
 
 QtWebPageEventHandler* QQuickWebPage::eventHandler() const
@@ -205,18 +236,8 @@ void QQuickWebPagePrivate::updateSize()
     viewportItem->updateContentsSize(scaledSize);
 }
 
-void QQuickWebPagePrivate::resetPaintNode()
-{
-    m_paintNode = 0;
-    DrawingAreaProxy* drawingArea = webPageProxy->drawingArea();
-    if (drawingArea && drawingArea->layerTreeHostProxy())
-        drawingArea->layerTreeHostProxy()->purgeGLResources();
-}
-
 QQuickWebPagePrivate::~QQuickWebPagePrivate()
 {
-    if (m_paintNode)
-        static_cast<PageProxyNode*>(m_paintNode)->m_pagePrivate = 0;
 }
 
 #include "moc_qquickwebpage_p.cpp"
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebpage_p_p.h b/Source/WebKit2/UIProcess/API/qt/qquickwebpage_p_p.h
index dfd223dbe..b28174124 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebpage_p_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebpage_p_p.h
@@ -41,7 +41,7 @@ public:
 
     void updateSize();
 
-    void paintToCurrentGLContext();
+    void paintToCurrentGLContext(const QTransform&, float opacity, const QRectF& clipRect);
     void paint(QPainter*);
     void resetPaintNode();
 
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
index f40e28924..6e518ff12 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
@@ -23,7 +23,6 @@
 
 #include "DownloadProxy.h"
 #include "DrawingAreaProxyImpl.h"
-#include "QtDialogRunner.h"
 #include "QtDownloadManager.h"
 #include "QtWebContext.h"
 #include "QtWebIconDatabaseClient.h"
@@ -38,6 +37,7 @@
 #include "qquickwebpage_p_p.h"
 #include "qquickwebview_p_p.h"
 #include "qwebdownloaditem_p_p.h"
+#include "qwebloadrequest_p.h"
 #include "qwebnavigationhistory_p.h"
 #include "qwebnavigationhistory_p_p.h"
 #include "qwebpreferences_p.h"
@@ -79,9 +79,12 @@ QQuickWebViewPrivate::QQuickWebViewPrivate(QQuickWebView* viewport)
     , userDidOverrideContentHeight(false)
     , m_navigatorQtObjectEnabled(false)
     , m_renderToOffscreenBuffer(false)
+    , m_loadStartedSignalSent(false)
+    , m_dialogRunnerActive(false)
 {
     viewport->setFlags(QQuickItem::ItemClipsChildrenToShape);
     QObject::connect(viewport, SIGNAL(visibleChanged()), viewport, SLOT(_q_onVisibleChanged()));
+    QObject::connect(viewport, SIGNAL(urlChanged()), viewport, SLOT(_q_onUrlChanged()));
     pageView.reset(new QQuickWebPage(viewport));
 }
 
@@ -112,7 +115,6 @@ void QQuickWebViewPrivate::initialize(WKContextRef contextRef, WKPageGroupRef pa
 
     QtWebIconDatabaseClient* iconDatabase = context->iconDatabase();
     QObject::connect(iconDatabase, SIGNAL(iconChangedForPageURL(QUrl, QUrl)), q_ptr, SLOT(_q_onIconChangedForPageURL(QUrl, QUrl)));
-    QObject::connect(q_ptr, SIGNAL(urlChanged(QUrl)), iconDatabase, SLOT(requestIconForPageURL(QUrl)));
 
     // Any page setting should preferrable be set before creating the page.
     webPageProxy->pageGroup()->preferences()->setAcceleratedCompositingEnabled(true);
@@ -123,6 +125,16 @@ void QQuickWebViewPrivate::initialize(WKContextRef contextRef, WKPageGroupRef pa
     webPageProxy->initializeWebPage();
 }
 
+void QQuickWebViewPrivate::setTransparentBackground(bool enable)
+{
+    webPageProxy->setDrawsTransparentBackground(enable);
+}
+
+bool QQuickWebViewPrivate::transparentBackground() const
+{
+    return webPageProxy->drawsTransparentBackground();
+}
+
 void QQuickWebViewPrivate::enableMouseEvents()
 {
     Q_Q(QQuickWebView);
@@ -146,8 +158,17 @@ QPointF QQuickWebViewPrivate::pageItemPos()
 void QQuickWebViewPrivate::loadDidSucceed()
 {
     Q_Q(QQuickWebView);
-    emit q->navigationStateChanged();
-    emit q->loadSucceeded();
+    ASSERT(!q->loading());
+    QWebLoadRequest loadRequest(q->url(), QQuickWebView::LoadSucceededStatus);
+    emit q->loadingChanged(&loadRequest);
+}
+
+void QQuickWebViewPrivate::onComponentComplete()
+{
+    if (m_deferedUrlToLoad.isEmpty())
+        return;
+
+    q_ptr->setUrl(m_deferedUrlToLoad);
 }
 
 void QQuickWebViewPrivate::setNeedsDisplay()
@@ -173,6 +194,14 @@ void QQuickWebViewPrivate::_q_onIconChangedForPageURL(const QUrl& pageURL, const
     setIcon(iconURL);
 }
 
+void QQuickWebViewPrivate::didChangeLoadingState(QWebLoadRequest* loadRequest)
+{
+    Q_Q(QQuickWebView);
+    ASSERT(q->loading() == (loadRequest->status() == QQuickWebView::LoadStartedStatus));
+    emit q->loadingChanged(loadRequest);
+    m_loadStartedSignalSent = loadRequest->status() == QQuickWebView::LoadStartedStatus;
+}
+
 void QQuickWebViewPrivate::didChangeBackForwardList()
 {
     navigationHistory->d->reset();
@@ -180,15 +209,17 @@ void QQuickWebViewPrivate::didChangeBackForwardList()
 
 void QQuickWebViewPrivate::processDidCrash()
 {
-    emit q_ptr->navigationStateChanged();
     pageView->eventHandler()->resetGestureRecognizers();
-    WebCore::KURL url(WebCore::ParsedURLString, webPageProxy->urlAtProcessExit());
-    qWarning("WARNING: The web process experienced a crash on '%s'.", qPrintable(QUrl(url).toString(QUrl::RemoveUserInfo)));
+    QUrl url(KURL(WebCore::ParsedURLString, webPageProxy->urlAtProcessExit()));
+    if (m_loadStartedSignalSent) {
+        QWebLoadRequest loadRequest(url, QQuickWebView::LoadFailedStatus, QLatin1String("The web process crashed."), QQuickWebView::InternalErrorDomain, 0);
+        didChangeLoadingState(&loadRequest);
+    }
+    qWarning("WARNING: The web process experienced a crash on '%s'.", qPrintable(url.toString(QUrl::RemoveUserInfo)));
 }
 
 void QQuickWebViewPrivate::didRelaunchProcess()
 {
-    emit q_ptr->navigationStateChanged();
     qWarning("WARNING: The web process has been successfully restarted.");
     pageView->d->setDrawingAreaSize(viewSize());
 }
@@ -217,6 +248,12 @@ void QQuickWebViewPrivate::_q_onVisibleChanged()
     webPageProxy->viewStateDidChange(WebPageProxy::ViewIsVisible);
 }
 
+void QQuickWebViewPrivate::_q_onUrlChanged()
+{
+    Q_Q(QQuickWebView);
+    context->iconDatabase()->requestIconForPageURL(q->url());
+}
+
 void QQuickWebViewPrivate::_q_onReceivedResponseFromDownload(QWebDownloadItem* downloadItem)
 {
     // Now that our downloadItem has everything we need we can emit downloadRequested.
@@ -237,11 +274,8 @@ void QQuickWebViewPrivate::runJavaScriptAlert(const QString& alertText)
     QtDialogRunner dialogRunner;
     if (!dialogRunner.initForAlert(alertDialog, q, alertText))
         return;
-    setViewInAttachedProperties(dialogRunner.dialog());
 
-    disableMouseEvents();
-    dialogRunner.exec();
-    enableMouseEvents();
+    execDialogRunner(dialogRunner);
 }
 
 bool QQuickWebViewPrivate::runJavaScriptConfirm(const QString& message)
@@ -253,11 +287,8 @@ bool QQuickWebViewPrivate::runJavaScriptConfirm(const QString& message)
     QtDialogRunner dialogRunner;
     if (!dialogRunner.initForConfirm(confirmDialog, q, message))
         return true;
-    setViewInAttachedProperties(dialogRunner.dialog());
 
-    disableMouseEvents();
-    dialogRunner.exec();
-    enableMouseEvents();
+    execDialogRunner(dialogRunner);
 
     return dialogRunner.wasAccepted();
 }
@@ -275,11 +306,8 @@ QString QQuickWebViewPrivate::runJavaScriptPrompt(const QString& message, const
         ok = true;
         return defaultValue;
     }
-    setViewInAttachedProperties(dialogRunner.dialog());
 
-    disableMouseEvents();
-    dialogRunner.exec();
-    enableMouseEvents();
+    execDialogRunner(dialogRunner);
 
     ok = dialogRunner.wasAccepted();
     return dialogRunner.result();
@@ -295,11 +323,7 @@ void QQuickWebViewPrivate::handleAuthenticationRequiredRequest(const QString& ho
     if (!dialogRunner.initForAuthentication(authenticationDialog, q, hostname, realm, prefilledUsername))
         return;
 
-    setViewInAttachedProperties(dialogRunner.dialog());
-
-    disableMouseEvents();
-    dialogRunner.exec();
-    enableMouseEvents();
+    execDialogRunner(dialogRunner);
 
     username = dialogRunner.username();
     password = dialogRunner.password();
@@ -315,10 +339,7 @@ void QQuickWebViewPrivate::handleProxyAuthenticationRequiredRequest(const QStrin
     if (!dialogRunner.initForProxyAuthentication(proxyAuthenticationDialog, q, hostname, port, prefilledUsername))
         return;
 
-    setViewInAttachedProperties(dialogRunner.dialog());
-    disableMouseEvents();
-    dialogRunner.exec();
-    enableMouseEvents();
+    execDialogRunner(dialogRunner);
 
     username = dialogRunner.username();
     password = dialogRunner.password();
@@ -334,13 +355,21 @@ bool QQuickWebViewPrivate::handleCertificateVerificationRequest(const QString& h
     if (!dialogRunner.initForCertificateVerification(certificateVerificationDialog, q, hostname))
         return false;
 
+    execDialogRunner(dialogRunner);
+
+    return dialogRunner.wasAccepted();
+}
+
+void QQuickWebViewPrivate::execDialogRunner(QtDialogRunner& dialogRunner)
+{
     setViewInAttachedProperties(dialogRunner.dialog());
 
     disableMouseEvents();
+    m_dialogRunnerActive = true;
+
     dialogRunner.exec();
+    m_dialogRunnerActive = false;
     enableMouseEvents();
-
-    return dialogRunner.wasAccepted();
 }
 
 void QQuickWebViewPrivate::chooseFiles(WKOpenPanelResultListenerRef listenerRef, const QStringList& selectedFileNames, QtWebPageUIClient::FileChooserType type)
@@ -417,7 +446,7 @@ void QQuickWebViewPrivate::setIcon(const QUrl& iconURL)
     }
 
     m_iconURL = iconURL;
-    emit q->iconChanged(m_iconURL);
+    emit q->iconChanged();
 }
 
 bool QQuickWebViewPrivate::navigatorQtObjectEnabled() const
@@ -433,6 +462,14 @@ void QQuickWebViewPrivate::setNavigatorQtObjectEnabled(bool enabled)
     context->setNavigatorQtObjectEnabled(webPageProxy.get(), enabled);
 }
 
+QRect QQuickWebViewPrivate::visibleContentsRect() const
+{
+    Q_Q(const QQuickWebView);
+    const QRectF visibleRect(q->boundingRect().intersected(pageView->boundingRect()));
+
+    return q->mapRectToWebContent(visibleRect).toAlignedRect();
+}
+
 WebCore::IntSize QQuickWebViewPrivate::viewSize() const
 {
     return WebCore::IntSize(pageView->width(), pageView->height());
@@ -547,6 +584,8 @@ void QQuickWebViewFlickablePrivate::onComponentComplete()
 
     // Trigger setting of correct visibility flags after everything was allocated and initialized.
     _q_onVisibleChanged();
+
+    QQuickWebViewPrivate::onComponentComplete();
 }
 
 void QQuickWebViewFlickablePrivate::loadDidSucceed()
@@ -609,16 +648,14 @@ void QQuickWebViewFlickablePrivate::_q_commitScaleChange()
         return;
 
     Q_Q(QQuickWebView);
-    const QRectF visibleRectInCSSCoordinates = q->mapRectToWebContent(q->boundingRect()).intersected(pageView->boundingRect());
-    float scale = pageView->contentsScale();
-
     // This is only for our QML ViewportInfo debugging API.
     q->experimental()->viewportInfo()->didUpdateCurrentScale();
 
-    QRect alignedVisibleContentRect = visibleRectInCSSCoordinates.toAlignedRect();
-    drawingArea->setVisibleContentsRectForScaling(alignedVisibleContentRect, scale);
+    const QRect visibleRect(visibleContentsRect());
+    float scale = pageView->contentsScale();
 
-    webPageProxy->setFixedVisibleContentRect(alignedVisibleContentRect);
+    drawingArea->setVisibleContentsRectForScaling(visibleRect, scale);
+    webPageProxy->setFixedVisibleContentRect(visibleRect);
 }
 
 void QQuickWebViewPrivate::_q_commitPositionChange(const QPointF& trajectoryVector)
@@ -627,21 +664,19 @@ void QQuickWebViewPrivate::_q_commitPositionChange(const QPointF& trajectoryVect
     if (!drawingArea)
         return;
 
-    Q_Q(QQuickWebView);
-    const QRectF visibleRectInCSSCoordinates = q->mapRectToWebContent(q->boundingRect()).intersected(pageView->boundingRect());
-
-    QRect alignedVisibleContentRect = visibleRectInCSSCoordinates.toAlignedRect();
-    drawingArea->setVisibleContentsRectForPanning(alignedVisibleContentRect, trajectoryVector);
+    const QRect visibleRect(visibleContentsRect());
+    drawingArea->setVisibleContentsRectForPanning(visibleRect, trajectoryVector);
 
     if (!trajectoryVector.isNull())
         return;
 
-    webPageProxy->setFixedVisibleContentRect(alignedVisibleContentRect);
+    webPageProxy->setFixedVisibleContentRect(visibleRect);
 }
 
 void QQuickWebViewFlickablePrivate::_q_suspend()
 {
     pageIsSuspended = true;
+    webPageProxy->suspendActiveDOMObjectsAndAnimations();
 }
 
 void QQuickWebViewFlickablePrivate::_q_resume()
@@ -650,6 +685,7 @@ void QQuickWebViewFlickablePrivate::_q_resume()
         return;
 
     pageIsSuspended = false;
+    webPageProxy->resumeActiveDOMObjectsAndAnimations();
 
     if (isTransitioningToNewPage) {
         isTransitioningToNewPage = false;
@@ -786,6 +822,17 @@ bool QQuickWebViewExperimental::renderToOffscreenBuffer() const
     return d->renderToOffscreenBuffer();
 }
 
+bool QQuickWebViewExperimental::transparentBackground() const
+{
+    Q_D(const QQuickWebView);
+    return d->transparentBackground();
+}
+void QQuickWebViewExperimental::setTransparentBackground(bool enable)
+{
+    Q_D(QQuickWebView);
+    d->setTransparentBackground(enable);
+}
+
 void QQuickWebViewExperimental::setFlickableViewportEnabled(bool enable)
 {
     s_flickableViewportEnabled = enable;
@@ -1093,6 +1140,7 @@ QQuickWebView::QQuickWebView(WKContextRef contextRef, WKPageGroupRef pageGroupRe
 {
     Q_D(QQuickWebView);
     d->initialize(contextRef, pageGroupRef);
+    setClip(true);
 }
 
 QQuickWebView::~QQuickWebView()
@@ -1105,15 +1153,6 @@ QQuickWebPage* QQuickWebView::page()
     return d->pageView.data();
 }
 
-void QQuickWebView::load(const QUrl& url)
-{
-    if (url.isEmpty())
-        return;
-
-    Q_D(QQuickWebView);
-    d->webPageProxy->loadURL(url.toString());
-}
-
 void QQuickWebView::goBack()
 {
     Q_D(QQuickWebView);
@@ -1148,6 +1187,21 @@ QUrl QQuickWebView::url() const
     return QUrl(QString(mainFrame->url()));
 }
 
+void QQuickWebView::setUrl(const QUrl& url)
+{
+    Q_D(QQuickWebView);
+
+    if (url.isEmpty())
+        return;
+
+    if (!isComponentComplete()) {
+        d->m_deferedUrlToLoad = url;
+        return;
+    }
+
+    d->webPageProxy->loadURL(url.toString());
+}
+
 QUrl QQuickWebView::icon() const
 {
     Q_D(const QQuickWebView);
@@ -1179,15 +1233,6 @@ bool QQuickWebView::loading() const
     return mainFrame && !(WebFrameProxy::LoadStateFinished == mainFrame->loadState());
 }
 
-bool QQuickWebView::canReload() const
-{
-    Q_D(const QQuickWebView);
-    RefPtr<WebKit::WebFrameProxy> mainFrame = d->webPageProxy->mainFrame();
-    if (mainFrame)
-        return (WebFrameProxy::LoadStateFinished == mainFrame->loadState());
-    return d->webPageProxy->backForwardList()->currentItem();
-}
-
 QPointF QQuickWebView::mapToWebContent(const QPointF& pointInViewCoordinates) const
 {
     Q_D(const QQuickWebView);
@@ -1281,128 +1326,125 @@ void QQuickWebView::componentComplete()
 
 void QQuickWebView::keyPressEvent(QKeyEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleKeyPressEvent(event);
 }
 
 void QQuickWebView::keyReleaseEvent(QKeyEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleKeyReleaseEvent(event);
 }
 
 void QQuickWebView::inputMethodEvent(QInputMethodEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleInputMethodEvent(event);
 }
 
 void QQuickWebView::focusInEvent(QFocusEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleFocusInEvent(event);
 }
 
 void QQuickWebView::focusOutEvent(QFocusEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleFocusOutEvent(event);
 }
 
 void QQuickWebView::touchEvent(QTouchEvent* event)
 {
+    Q_D(QQuickWebView);
+    if (d->m_dialogRunnerActive) {
+        event->ignore();
+        return;
+    }
+
     forceActiveFocus();
-    this->event(event);
+    d->pageView->eventHandler()->handleTouchEvent(event);
 }
 
 void QQuickWebView::mousePressEvent(QMouseEvent* event)
 {
+    Q_D(QQuickWebView);
     forceActiveFocus();
-    this->event(event);
+    d->pageView->eventHandler()->handleMousePressEvent(event);
 }
 
 void QQuickWebView::mouseMoveEvent(QMouseEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleMouseMoveEvent(event);
 }
 
 void QQuickWebView::mouseReleaseEvent(QMouseEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleMouseReleaseEvent(event);
 }
 
 void QQuickWebView::mouseDoubleClickEvent(QMouseEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    // If a MouseButtonDblClick was received then we got a MouseButtonPress before
+    // handleMousePressEvent will take care of double clicks.
+    d->pageView->eventHandler()->handleMousePressEvent(event);
 }
 
 void QQuickWebView::wheelEvent(QWheelEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleWheelEvent(event);
 }
 
 void QQuickWebView::hoverEnterEvent(QHoverEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    // Map HoverEnter to Move, for WebKit the distinction doesn't matter.
+    d->pageView->eventHandler()->handleHoverMoveEvent(event);
 }
 
 void QQuickWebView::hoverMoveEvent(QHoverEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleHoverMoveEvent(event);
 }
 
 void QQuickWebView::hoverLeaveEvent(QHoverEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleHoverLeaveEvent(event);
 }
 
 void QQuickWebView::dragMoveEvent(QDragMoveEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleDragMoveEvent(event);
 }
 
 void QQuickWebView::dragEnterEvent(QDragEnterEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleDragEnterEvent(event);
 }
 
 void QQuickWebView::dragLeaveEvent(QDragLeaveEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleDragLeaveEvent(event);
 }
 
 void QQuickWebView::dropEvent(QDropEvent* event)
 {
-    this->event(event);
+    Q_D(QQuickWebView);
+    d->pageView->eventHandler()->handleDropEvent(event);
 }
 
 bool QQuickWebView::event(QEvent* ev)
 {
-    Q_D(QQuickWebView);
-
-    switch (ev->type()) {
-    case QEvent::MouseMove:
-    case QEvent::MouseButtonPress:
-    case QEvent::MouseButtonRelease:
-    case QEvent::MouseButtonDblClick:
-    case QEvent::Wheel:
-    case QEvent::HoverLeave:
-    case QEvent::HoverEnter:
-    case QEvent::HoverMove:
-    case QEvent::DragEnter:
-    case QEvent::DragLeave:
-    case QEvent::DragMove:
-    case QEvent::Drop:
-    case QEvent::KeyPress:
-    case QEvent::KeyRelease:
-    case QEvent::FocusIn:
-    case QEvent::FocusOut:
-    case QEvent::TouchBegin:
-    case QEvent::TouchEnd:
-    case QEvent::TouchCancel:
-    case QEvent::TouchUpdate:
-        if (d->pageView->eventHandler()->handleEvent(ev))
-            return true;
-    }
-
-    if (ev->type() == QEvent::InputMethod)
-        return false; // This is necessary to avoid an endless loop in connection with QQuickItem::event().
-
+    // Re-implemented for possible future use without breaking binary compatibility.
     return QQuickItem::event(ev);
 }
 
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
index 674c18fe7..5302916eb 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
@@ -30,6 +30,7 @@ class QWebNavigationRequest;
 class QDeclarativeComponent;
 class QQuickWebPage;
 class QQuickWebViewAttached;
+class QWebLoadRequest;
 class QQuickWebViewPrivate;
 class QQuickWebViewExperimental;
 class QWebDownloadItem;
@@ -67,24 +68,30 @@ QT_END_NAMESPACE
 class QWEBKIT_EXPORT QQuickWebView : public QQuickItem {
     Q_OBJECT
     Q_PROPERTY(QString title READ title NOTIFY titleChanged)
-    Q_PROPERTY(QUrl url READ url NOTIFY urlChanged)
+    Q_PROPERTY(QUrl url READ url WRITE setUrl NOTIFY urlChanged)
     Q_PROPERTY(QUrl icon READ icon NOTIFY iconChanged FINAL)
+    Q_PROPERTY(bool canGoBack READ canGoBack NOTIFY navigationHistoryChanged FINAL)
+    Q_PROPERTY(bool canGoForward READ canGoForward NOTIFY navigationHistoryChanged FINAL)
+    Q_PROPERTY(bool loading READ loading NOTIFY loadingChanged FINAL)
     Q_PROPERTY(int loadProgress READ loadProgress NOTIFY loadProgressChanged)
-    Q_PROPERTY(bool canGoBack READ canGoBack NOTIFY navigationStateChanged FINAL)
-    Q_PROPERTY(bool canGoForward READ canGoForward NOTIFY navigationStateChanged FINAL)
-    Q_PROPERTY(bool loading READ loading NOTIFY navigationStateChanged FINAL)
-    Q_PROPERTY(bool canReload READ canReload NOTIFY navigationStateChanged FINAL)
     Q_ENUMS(NavigationRequestAction)
+    Q_ENUMS(LoadStatus)
     Q_ENUMS(ErrorDomain)
     Q_ENUMS(NavigationType)
 
 public:
     enum NavigationRequestAction {
         AcceptRequest,
-        IgnoreRequest
+        // Make room in the valid range of the enum for extra actions exposed in Experimental.
+        IgnoreRequest = 0xFF
+    };
+    enum LoadStatus {
+        LoadStartedStatus,
+        LoadSucceededStatus,
+        LoadFailedStatus
     };
-
     enum ErrorDomain {
+        NoErrorDomain,
         InternalErrorDomain,
         NetworkErrorDomain,
         HttpErrorDomain,
@@ -104,6 +111,7 @@ public:
     virtual ~QQuickWebView();
 
     QUrl url() const;
+    void setUrl(const QUrl&);
     QUrl icon() const;
     QString title() const;
     int loadProgress() const;
@@ -111,7 +119,6 @@ public:
     bool canGoBack() const;
     bool canGoForward() const;
     bool loading() const;
-    bool canReload() const;
 
     virtual QVariant inputMethodQuery(Qt::InputMethodQuery property) const;
 
@@ -132,7 +139,6 @@ public:
     QPointF pageItemPos();
 
 public Q_SLOTS:
-    void load(const QUrl&);
     void loadHtml(const QString& html, const QUrl& baseUrl = QUrl());
 
     void goBack();
@@ -141,15 +147,13 @@ public Q_SLOTS:
     void reload();
 
 Q_SIGNALS:
-    void titleChanged(const QString& title);
-    void loadStarted();
-    void loadSucceeded();
-    void loadFailed(QQuickWebView::ErrorDomain errorDomain, int errorCode, const QUrl& url, const QString& description);
-    void loadProgressChanged(int progress);
-    void urlChanged(const QUrl& url);
-    void iconChanged(const QUrl& iconURL);
-    void linkHovered(const QUrl& url, const QString& title);
-    void navigationStateChanged();
+    void titleChanged();
+    void navigationHistoryChanged();
+    void loadingChanged(QWebLoadRequest* loadRequest);
+    void loadProgressChanged();
+    void urlChanged();
+    void iconChanged();
+    void linkHovered(const QUrl& hoveredUrl, const QString& hoveredTitle);
     void navigationRequested(QWebNavigationRequest* request);
 
 protected:
@@ -189,6 +193,7 @@ private:
     Q_PRIVATE_SLOT(d_func(), void _q_onOpenPanelFilesSelected());
     Q_PRIVATE_SLOT(d_func(), void _q_onOpenPanelFinished(int result));
     Q_PRIVATE_SLOT(d_func(), void _q_onVisibleChanged());
+    Q_PRIVATE_SLOT(d_func(), void _q_onUrlChanged());
     Q_PRIVATE_SLOT(d_func(), void _q_onReceivedResponseFromDownload(QWebDownloadItem*));
     Q_PRIVATE_SLOT(d_func(), void _q_onIconChangedForPageURL(const QUrl&, const QUrl&));
     // Hides QObject::d_ptr allowing us to use the convenience macros.
@@ -233,6 +238,7 @@ class QWEBKIT_EXPORT QQuickWebViewExperimental : public QObject {
     Q_PROPERTY(qreal contentY READ contentY WRITE setContentY NOTIFY contentYChanged)
     Q_PROPERTY(QQuickItem* contentItem READ contentItem CONSTANT)
     Q_PROPERTY(QDeclarativeListProperty<QObject> flickableData READ flickableData)
+    Q_PROPERTY(bool transparentBackground WRITE setTransparentBackground READ transparentBackground)
 
     Q_PROPERTY(QWebNavigationHistory* navigationHistory READ navigationHistory CONSTANT FINAL)
     Q_PROPERTY(QDeclarativeComponent* alertDialog READ alertDialog WRITE setAlertDialog NOTIFY alertDialogChanged)
@@ -245,11 +251,11 @@ class QWEBKIT_EXPORT QQuickWebViewExperimental : public QObject {
     Q_PROPERTY(QWebPreferences* preferences READ preferences CONSTANT FINAL)
     Q_PROPERTY(QWebViewportInfo* viewportInfo READ viewportInfo CONSTANT FINAL)
     Q_PROPERTY(QDeclarativeListProperty<QQuickUrlSchemeDelegate> urlSchemeDelegates READ schemeDelegates)
-    Q_ENUMS(NavigationRequestAction)
+    Q_ENUMS(NavigationRequestActionExperimental)
 
 public:
-    enum NavigationRequestAction {
-        DownloadRequest = 2
+    enum NavigationRequestActionExperimental {
+        DownloadRequest = QQuickWebView::IgnoreRequest - 1
     };
 
     QQuickWebViewExperimental(QQuickWebView* webView);
@@ -294,6 +300,8 @@ public:
     void setContentX(qreal);
     qreal contentY() const;
     void setContentY(qreal);
+    bool transparentBackground() const;
+    void setTransparentBackground(bool);
 
     // C++ only
     bool renderToOffscreenBuffer() const;
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
index 300b4759d..39a14a7a6 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
@@ -22,6 +22,7 @@
 #define qquickwebview_p_p_h
 
 #include "DrawingAreaProxy.h"
+#include "QtDialogRunner.h"
 #include "QtFlickProvider.h"
 #include "QtPageClient.h"
 #include "QtViewportInteractionEngine.h"
@@ -73,10 +74,11 @@ public:
     virtual void updateContentsSize(const QSizeF&) { }
 
     virtual void loadDidSucceed();
-    virtual void onComponentComplete() { }
+    virtual void onComponentComplete();
     virtual void loadDidCommit() { }
     virtual void didFinishFirstNonEmptyLayout() { }
     virtual void didChangeViewportProperties(const WebCore::ViewportArguments& args) { }
+    void didChangeLoadingState(QWebLoadRequest* loadRequest);
     void didChangeBackForwardList();
 
     void setNeedsDisplay();
@@ -94,6 +96,7 @@ public:
     void _q_onOpenPanelFilesSelected();
     void _q_onOpenPanelFinished(int result);
     void _q_onVisibleChanged();
+    void _q_onUrlChanged();
     void _q_onReceivedResponseFromDownload(QWebDownloadItem*);
     void _q_onIconChangedForPageURL(const QUrl& pageURL, const QUrl& iconURLString);
 
@@ -106,14 +109,20 @@ public:
     bool handleCertificateVerificationRequest(const QString& hostname);
     void handleProxyAuthenticationRequiredRequest(const QString& hostname, uint16_t port, const QString& prefilledUsername, QString& username, QString& password);
 
+    void execDialogRunner(QtDialogRunner&);
+
     void setRenderToOffscreenBuffer(bool enable) { m_renderToOffscreenBuffer = enable; }
+    void setTransparentBackground(bool);
     void setViewInAttachedProperties(QObject*);
     void setIcon(const QUrl&);
 
     bool navigatorQtObjectEnabled() const;
     bool renderToOffscreenBuffer() const { return m_renderToOffscreenBuffer; }
+    bool transparentBackground() const;
     void setNavigatorQtObjectEnabled(bool);
 
+    QRect visibleContentsRect() const;
+
     // PageClient.
     WebCore::IntSize viewSize() const;
     void didReceiveMessageFromNavigatorQtObject(const String& message);
@@ -158,7 +167,10 @@ protected:
     bool userDidOverrideContentHeight;
     bool m_navigatorQtObjectEnabled;
     bool m_renderToOffscreenBuffer;
+    bool m_loadStartedSignalSent;
+    bool m_dialogRunnerActive;
     QUrl m_iconURL;
+    QUrl m_deferedUrlToLoad;
 };
 
 class QQuickWebViewLegacyPrivate : public QQuickWebViewPrivate {
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebloadrequest.cpp b/Source/WebKit2/UIProcess/API/qt/qwebloadrequest.cpp
new file mode 100644
index 000000000..0b249a61a
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/qwebloadrequest.cpp
@@ -0,0 +1,75 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qwebloadrequest_p.h"
+
+class QWebLoadRequestPrivate {
+public:
+    QWebLoadRequestPrivate(const QUrl& url, QQuickWebView::LoadStatus status, const QString& errorString, QQuickWebView::ErrorDomain errorDomain, int errorCode)
+        : url(url)
+        , status(status)
+        , errorString(errorString)
+        , errorDomain(errorDomain)
+        , errorCode(errorCode)
+    {
+    }
+
+    QUrl url;
+    QQuickWebView::LoadStatus status;
+    QString errorString;
+    QQuickWebView::ErrorDomain errorDomain;
+    int errorCode;
+};
+
+QWebLoadRequest::QWebLoadRequest(const QUrl& url, QQuickWebView::LoadStatus status, const QString& errorString, QQuickWebView::ErrorDomain errorDomain, int errorCode, QObject* parent)
+    : QObject(parent)
+    , d(new QWebLoadRequestPrivate(url, status, errorString, errorDomain, errorCode))
+{
+}
+
+QWebLoadRequest::~QWebLoadRequest()
+{
+}
+
+QUrl QWebLoadRequest::url() const
+{
+    return d->url;
+}
+
+QQuickWebView::LoadStatus QWebLoadRequest::status() const
+{
+    return d->status;
+}
+
+QString QWebLoadRequest::errorString() const
+{
+    return d->errorString;
+}
+
+QQuickWebView::ErrorDomain QWebLoadRequest::errorDomain() const
+{
+    return d->errorDomain;
+}
+
+int QWebLoadRequest::errorCode() const
+{
+    return d->errorCode;
+}
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebloadrequest_p.h b/Source/WebKit2/UIProcess/API/qt/qwebloadrequest_p.h
new file mode 100644
index 000000000..ebff399a7
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/qwebloadrequest_p.h
@@ -0,0 +1,51 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qwebloadrequest_p_h
+#define qwebloadrequest_p_h
+
+#include "qquickwebview_p.h"
+#include <QtCore/QObject>
+#include <QtCore/QScopedPointer>
+#include <QtCore/QUrl>
+
+class QWebLoadRequestPrivate;
+
+class QWEBKIT_EXPORT QWebLoadRequest : public QObject {
+    Q_OBJECT
+    Q_PROPERTY(QUrl url READ url)
+    Q_PROPERTY(QQuickWebView::LoadStatus status READ status)
+    Q_PROPERTY(QString errorString READ errorString)
+    Q_PROPERTY(QQuickWebView::ErrorDomain errorDomain READ errorDomain)
+    Q_PROPERTY(int errorCode READ errorCode)
+
+public:
+    QWebLoadRequest(const QUrl& url, QQuickWebView::LoadStatus status, const QString& errorString = QString(), QQuickWebView::ErrorDomain errorDomain = QQuickWebView::NoErrorDomain, int errorCode = 0, QObject* parent = 0);
+    ~QWebLoadRequest();
+    QUrl url() const;
+    QQuickWebView::LoadStatus status() const;
+    QString errorString() const;
+    QQuickWebView::ErrorDomain errorDomain() const;
+    int errorCode() const;
+
+private:
+    QScopedPointer<QWebLoadRequestPrivate> d;
+};
+
+#endif // qwebloadrequest_p_h
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest.cpp b/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest.cpp
index 3a63f80e3..92af27179 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest.cpp
@@ -25,12 +25,10 @@
 
 class QWebNavigationRequestPrivate {
 public:
-    QWebNavigationRequestPrivate(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton button,
-                                 Qt::KeyboardModifiers modifiers, QQuickWebView::NavigationType navigationType)
+    QWebNavigationRequestPrivate(const QUrl& url, Qt::MouseButton mouseButton, Qt::KeyboardModifiers keyboardModifiers, QQuickWebView::NavigationType navigationType)
         : url(url)
-        , originatingUrl(originatingUrl)
-        , button(button)
-        , modifiers(modifiers)
+        , mouseButton(mouseButton)
+        , keyboardModifiers(keyboardModifiers)
         , action(QQuickWebView::AcceptRequest)
         , navigationType(navigationType)
     {
@@ -41,17 +39,15 @@ public:
     }
 
     QUrl url;
-    QUrl originatingUrl;
-    Qt::MouseButton button;
-    Qt::KeyboardModifiers modifiers;
-    int action;
+    Qt::MouseButton mouseButton;
+    Qt::KeyboardModifiers keyboardModifiers;
+    QQuickWebView::NavigationRequestAction action;
     QQuickWebView::NavigationType navigationType;
 };
 
-QWebNavigationRequest::QWebNavigationRequest(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton button,
-                                             Qt::KeyboardModifiers modifiers, QQuickWebView::NavigationType navigationType, QObject* parent)
+QWebNavigationRequest::QWebNavigationRequest(const QUrl& url, Qt::MouseButton mouseButton, Qt::KeyboardModifiers keyboardModifiers, QQuickWebView::NavigationType navigationType, QObject* parent)
     : QObject(parent)
-    , d(new QWebNavigationRequestPrivate(url, originatingUrl, button, modifiers, navigationType))
+    , d(new QWebNavigationRequestPrivate(url, mouseButton, keyboardModifiers, navigationType))
 {
 }
 
@@ -60,7 +56,7 @@ QWebNavigationRequest::~QWebNavigationRequest()
     delete d;
 }
 
-void QWebNavigationRequest::setAction(int action)
+void QWebNavigationRequest::setAction(QQuickWebView::NavigationRequestAction action)
 {
     if (d->action == action)
         return;
@@ -74,24 +70,19 @@ QUrl QWebNavigationRequest::url() const
     return d->url;
 }
 
-QUrl QWebNavigationRequest::originatingUrl() const
+int QWebNavigationRequest::mouseButton() const
 {
-    return d->originatingUrl;
+    return int(d->mouseButton);
 }
 
-int QWebNavigationRequest::button() const
+int QWebNavigationRequest::keyboardModifiers() const
 {
-    return int(d->button);
+    return int(d->keyboardModifiers);
 }
 
-int QWebNavigationRequest::modifiers() const
+QQuickWebView::NavigationRequestAction QWebNavigationRequest::action() const
 {
-    return int(d->modifiers);
-}
-
-int QWebNavigationRequest::action() const
-{
-    return int(d->action);
+    return d->action;
 }
 
 QQuickWebView::NavigationType QWebNavigationRequest::navigationType() const
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest_p.h b/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest_p.h
index 46333f0e8..b401deda5 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest_p.h
@@ -31,24 +31,21 @@ class QWebNavigationRequestPrivate;
 class QWEBKIT_EXPORT QWebNavigationRequest : public QObject {
     Q_OBJECT
     Q_PROPERTY(QUrl url READ url CONSTANT FINAL)
-    Q_PROPERTY(QUrl originatingUrl READ originatingUrl CONSTANT FINAL)
-    Q_PROPERTY(int button READ button CONSTANT FINAL)
-    Q_PROPERTY(int modifiers READ modifiers CONSTANT FINAL)
-    Q_PROPERTY(int action READ action WRITE setAction NOTIFY actionChanged FINAL)
+    Q_PROPERTY(int mouseButton READ mouseButton CONSTANT FINAL)
+    Q_PROPERTY(int keyboardModifiers READ keyboardModifiers CONSTANT FINAL)
+    Q_PROPERTY(QQuickWebView::NavigationRequestAction action READ action WRITE setAction NOTIFY actionChanged FINAL)
     Q_PROPERTY(QQuickWebView::NavigationType navigationType READ navigationType CONSTANT FINAL)
 
 public:
-    QWebNavigationRequest(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton button, Qt::KeyboardModifiers modifiers,
-                          QQuickWebView::NavigationType navigationType, QObject* parent = 0);
+    QWebNavigationRequest(const QUrl& url, Qt::MouseButton mouseButton, Qt::KeyboardModifiers keyboardModifiers, QQuickWebView::NavigationType navigationType, QObject* parent = 0);
     ~QWebNavigationRequest();
 
     QUrl url() const;
-    QUrl originatingUrl() const;
-    int button() const;
-    int modifiers() const;
-    int action() const;
+    int mouseButton() const;
+    int keyboardModifiers() const;
+    QQuickWebView::NavigationRequestAction action() const;
 
-    void setAction(int action);
+    void setAction(QQuickWebView::NavigationRequestAction action);
     QQuickWebView::NavigationType navigationType() const;
 
 Q_SIGNALS:
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebviewportinfo_p.h b/Source/WebKit2/UIProcess/API/qt/qwebviewportinfo_p.h
index 653018221..ab422e4e7 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebviewportinfo_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwebviewportinfo_p.h
@@ -18,7 +18,7 @@
  *
  */
 
-#ifndef qwebviewportinfp_p_h
+#ifndef qwebviewportinfo_p_h
 #define qwebviewportinfo_p_h
 
 #include "qwebkitglobal.h"
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/publicapi/publicapi.pro b/Source/WebKit2/UIProcess/API/qt/tests/publicapi/publicapi.pro
index 0f0d4f52c..02dc197c7 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/publicapi/publicapi.pro
+++ b/Source/WebKit2/UIProcess/API/qt/tests/publicapi/publicapi.pro
@@ -1,3 +1,3 @@
 include(../tests.pri)
 SOURCES += $${TARGET}.cpp
-CONFIG += qtwebkit-private
+QT += webkit-private
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp b/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp
index 3ad4729a9..f5f976663 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp
@@ -23,8 +23,9 @@
 #include <QMetaProperty>
 #include <QMetaType>
 #include <QtTest/QtTest>
-#include <qquickwebview_p.h>
-#include <qwebnavigationrequest_p.h>
+#include <private/qquickwebview_p.h>
+#include <private/qwebloadrequest_p.h>
+#include <private/qwebnavigationrequest_p.h>
 
 class tst_publicapi : public QObject {
     Q_OBJECT
@@ -34,11 +35,16 @@ private slots:
 
 static QList<const QMetaObject*> typesToCheck = QList<const QMetaObject*>()
     << &QQuickWebView::staticMetaObject
+    << &QWebLoadRequest::staticMetaObject
     << &QWebNavigationRequest::staticMetaObject;
 
 static QStringList expectedAPI = QStringList()
     << "QQuickWebView.AcceptRequest --> NavigationRequestAction"
     << "QQuickWebView.IgnoreRequest --> NavigationRequestAction"
+    << "QQuickWebView.LoadStartedStatus --> LoadStatus"
+    << "QQuickWebView.LoadSucceededStatus --> LoadStatus"
+    << "QQuickWebView.LoadFailedStatus --> LoadStatus"
+    << "QQuickWebView.NoErrorDomain --> ErrorDomain"
     << "QQuickWebView.InternalErrorDomain --> ErrorDomain"
     << "QQuickWebView.NetworkErrorDomain --> ErrorDomain"
     << "QQuickWebView.HttpErrorDomain --> ErrorDomain"
@@ -52,33 +58,33 @@ static QStringList expectedAPI = QStringList()
     << "QQuickWebView.title --> QString"
     << "QQuickWebView.url --> QUrl"
     << "QQuickWebView.icon --> QUrl"
-    << "QQuickWebView.loadProgress --> int"
     << "QQuickWebView.canGoBack --> bool"
     << "QQuickWebView.canGoForward --> bool"
     << "QQuickWebView.loading --> bool"
-    << "QQuickWebView.canReload --> bool"
-    << "QQuickWebView.titleChanged(QString) --> void"
-    << "QQuickWebView.loadStarted() --> void"
-    << "QQuickWebView.loadSucceeded() --> void"
-    << "QQuickWebView.loadFailed(QQuickWebView::ErrorDomain,int,QUrl,QString) --> void"
-    << "QQuickWebView.loadProgressChanged(int) --> void"
-    << "QQuickWebView.urlChanged(QUrl) --> void"
-    << "QQuickWebView.iconChanged(QUrl) --> void"
+    << "QQuickWebView.loadProgress --> int"
+    << "QQuickWebView.titleChanged() --> void"
+    << "QQuickWebView.navigationHistoryChanged() --> void"
+    << "QQuickWebView.loadingChanged(QWebLoadRequest*) --> void"
+    << "QQuickWebView.loadProgressChanged() --> void"
+    << "QQuickWebView.urlChanged() --> void"
+    << "QQuickWebView.iconChanged() --> void"
     << "QQuickWebView.linkHovered(QUrl,QString) --> void"
-    << "QQuickWebView.navigationStateChanged() --> void"
     << "QQuickWebView.navigationRequested(QWebNavigationRequest*) --> void"
-    << "QQuickWebView.load(QUrl) --> void"
     << "QQuickWebView.loadHtml(QString,QUrl) --> void"
     << "QQuickWebView.loadHtml(QString) --> void"
     << "QQuickWebView.goBack() --> void"
     << "QQuickWebView.goForward() --> void"
     << "QQuickWebView.stop() --> void"
     << "QQuickWebView.reload() --> void"
+    << "QWebLoadRequest.url --> QUrl"
+    << "QWebLoadRequest.status --> QQuickWebView::LoadStatus"
+    << "QWebLoadRequest.errorString --> QString"
+    << "QWebLoadRequest.errorDomain --> QQuickWebView::ErrorDomain"
+    << "QWebLoadRequest.errorCode --> int"
     << "QWebNavigationRequest.url --> QUrl"
-    << "QWebNavigationRequest.originatingUrl --> QUrl"
-    << "QWebNavigationRequest.button --> int"
-    << "QWebNavigationRequest.modifiers --> int"
-    << "QWebNavigationRequest.action --> int"
+    << "QWebNavigationRequest.mouseButton --> int"
+    << "QWebNavigationRequest.keyboardModifiers --> int"
+    << "QWebNavigationRequest.action --> QQuickWebView::NavigationRequestAction"
     << "QWebNavigationRequest.navigationType --> QQuickWebView::NavigationType"
     << "QWebNavigationRequest.actionChanged() --> void"
     ;
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior.pro b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior.pro
index 8b5b3cbb8..9d16a7bdd 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior.pro
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior.pro
@@ -3,7 +3,7 @@ SOURCES += tst_qmltests.cpp
 TARGET = tst_qmltests_DesktopBehavior
 OBJECTS_DIR = obj_DesktopBehavior/$$activeBuildConfig()
 
-CONFIG += qtwebkit-private
+QT += webkit-private
 CONFIG += warn_on testcase
 
 QT -= testlib
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_itemSelector.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_itemSelector.qml
index 432416a63..18763bfef 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_itemSelector.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_itemSelector.qml
@@ -2,10 +2,11 @@ import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
 import QtWebKit.experimental 1.0
+import "../common"
 
 // FIXME: Moved to Desktop tests because we want to have mouseClick() to open the <select> tag. We can move it back
 // when TestCase starts supporting touch events, see https://bugreports.qt.nokia.com/browse/QTBUG-23083.
-WebView {
+TestWebView {
     id: webView
 
     width: 400
@@ -37,12 +38,6 @@ WebView {
     }
 
     SignalSpy {
-        id: loadSpy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
-    SignalSpy {
         id: titleSpy
         target: webView
         signalName: "titleChanged"
@@ -58,9 +53,8 @@ WebView {
             webView.finalSelection = -1
             webView.useAcceptDirectly = false
             webView.selectorLoaded = false
-            loadSpy.clear()
-            webView.load(Qt.resolvedUrl("../common/select.html"))
-            loadSpy.wait()
+            webView.url = Qt.resolvedUrl("../common/select.html")
+            verify(webView.waitForLoadSucceeded())
             titleSpy.clear()
         }
 
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_linkHovered.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_linkHovered.qml
index b8ab29496..e035dc2a9 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_linkHovered.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_linkHovered.qml
@@ -1,8 +1,9 @@
 import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
     width: 200
     height: 400
@@ -17,15 +18,9 @@ WebView {
         signalName: "linkHovered"
     }
 
-    SignalSpy {
-        id: loadSpy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
     onLinkHovered: {
-        webView.lastUrl = url
-        webView.lastTitle = title
+        webView.lastUrl = hoveredUrl
+        webView.lastTitle = hoveredTitle
     }
 
     TestCase {
@@ -48,8 +43,8 @@ WebView {
 
         function test_linkHovered() {
             compare(spy.count, 0)
-            webView.load(Qt.resolvedUrl("../common/test2.html"))
-            loadSpy.wait()
+            webView.url = Qt.resolvedUrl("../common/test2.html")
+            verify(webView.waitForLoadSucceeded())
             mouseMove(webView, 100, 100)
             spy.wait()
             compare(spy.count, 1)
@@ -64,8 +59,8 @@ WebView {
 
         function test_linkHoveredDoesntEmitRepeated() {
             compare(spy.count, 0)
-            webView.load(Qt.resolvedUrl("../common/test2.html"))
-            loadSpy.wait()
+            webView.url = Qt.resolvedUrl("../common/test2.html")
+            verify(webView.waitForLoadSucceeded())
 
             for (var i = 0; i < 100; i += 10)
                 mouseMove(webView, 100, 100 + i)
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_loadHtml.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_loadHtml.qml
index 9e173d56a..b50aec371 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_loadHtml.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_loadHtml.qml
@@ -1,8 +1,9 @@
 import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
     width: 200
     height: 400
@@ -11,19 +12,13 @@ WebView {
     property string lastUrl
 
     SignalSpy {
-        id: loadSpy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
-    SignalSpy {
         id: linkHoveredSpy
         target: webView
         signalName: "linkHovered"
     }
 
     onLinkHovered: {
-        webView.lastUrl = url
+        webView.lastUrl = hoveredUrl
     }
 
     TestCase {
@@ -41,15 +36,13 @@ WebView {
         function init() {
             webView.lastUrl = ""
             linkHoveredSpy.clear()
-            loadSpy.clear()
         }
 
         function test_baseUrlAfterLoadHtml() {
-            loadSpy.clear()
             linkHoveredSpy.clear()
             compare(linkHoveredSpy.count, 0)
             webView.loadHtml("<html><head><title>Test page with huge link area</title></head><body><a title=\"A title\" href=\"test1.html\"><img width=200 height=200></a></body></html>", "http://www.example.foo.com")
-            loadSpy.wait()
+            verify(webView.waitForLoadSucceeded())
             compare("http://www.example.foo.com/", webView.url)
             mouseMove(webView, 100, 100)
             linkHoveredSpy.wait()
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_messaging.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_messaging.qml
index eb18a8216..1b3ab6314 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_messaging.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_messaging.qml
@@ -2,9 +2,10 @@ import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
 import QtWebKit.experimental 1.0
+import "../common"
 
 Item {
-    WebView {
+    TestWebView {
         id: webView
         property variant lastMessage
         experimental.preferences.navigatorQtObjectEnabled: true
@@ -13,7 +14,7 @@ Item {
         }
     }
 
-    WebView {
+    TestWebView {
         id: otherWebView
         property variant lastMessage
         experimental.preferences.navigatorQtObjectEnabled: true
@@ -22,7 +23,7 @@ Item {
         }
     }
 
-    WebView {
+    TestWebView {
         id: disabledWebView
         property bool receivedMessage
         experimental.preferences.navigatorQtObjectEnabled: false
@@ -32,51 +33,31 @@ Item {
     }
 
     SignalSpy {
-        id: loadSpy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
-    SignalSpy {
         id: messageSpy
         target: webView.experimental
         signalName: "messageReceived"
     }
 
     SignalSpy {
-        id: otherLoadSpy
-        target: otherWebView
-        signalName: "loadSucceeded"
-    }
-
-    SignalSpy {
         id: otherMessageSpy
         target: otherWebView.experimental
         signalName: "messageReceived"
     }
 
-    SignalSpy {
-        id: disabledWebViewLoadSpy
-        target: disabledWebView
-        signalName: "loadSucceeded"
-    }
-
     TestCase {
         name: "DesktopWebViewMessaging"
         property url testUrl: Qt.resolvedUrl("../common/messaging.html")
 
         function init() {
-            loadSpy.clear()
             messageSpy.clear()
             webView.lastMessage = null
-            otherLoadSpy.clear()
             otherMessageSpy.clear()
             otherWebView.lastMessage = null
         }
 
         function test_basic() {
-            webView.load(testUrl)
-            loadSpy.wait()
+            webView.url = testUrl
+            verify(webView.waitForLoadSucceeded())
             webView.experimental.postMessage("HELLO")
             messageSpy.wait()
             compare(webView.lastMessage.data, "OLLEH")
@@ -84,10 +65,10 @@ Item {
         }
 
         function test_twoWebViews() {
-            webView.load(testUrl)
-            otherWebView.load(testUrl)
-            loadSpy.wait()
-            otherLoadSpy.wait()
+            webView.url = testUrl
+            otherWebView.url = testUrl
+            verify(webView.waitForLoadSucceeded())
+            verify(otherWebView.waitForLoadSucceeded())
             webView.experimental.postMessage("FIRST")
             otherWebView.experimental.postMessage("SECOND")
             messageSpy.wait()
@@ -97,9 +78,9 @@ Item {
         }
 
         function test_disabled() {
-            disabledWebView.load(testUrl)
+            disabledWebView.url = testUrl
             verify(!disabledWebView.experimental.preferences.navigatorQtObjectEnabled)
-            disabledWebViewLoadSpy.wait()
+            verify(disabledWebView.waitForLoadSucceeded())
             disabledWebView.experimental.postMessage("HI")
             wait(1000)
             verify(!disabledWebView.receivedMessage)
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_navigationRequested.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_navigationRequested.qml
index 169a0273e..2aefce537 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_navigationRequested.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/DesktopBehavior/tst_navigationRequested.qml
@@ -2,16 +2,16 @@ import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
 import QtWebKit.experimental 1.0
+import "../common"
 
 Item {
     property int expectedLength: 0
     property int totalBytes: 0
     property bool shouldDownload: false
-    property string originatingUrl: ""
     property url beginUrl: Qt.resolvedUrl("../common/test2.html")
     property url endUrl: Qt.resolvedUrl("../common/test1.html")
 
-    WebView {
+    TestWebView {
         id: webView
         width: 200
         height: 200
@@ -21,11 +21,10 @@ Item {
         onNavigationRequested: {
             if (shouldDownload)
                 request.action = WebViewExperimental.DownloadRequest
-            else if (request.button == Qt.MiddleButton && request.modifiers & Qt.ControlModifier) {
-                otherWebView.load(request.url)
+            else if (request.mouseButton == Qt.MiddleButton && request.keyboardModifiers & Qt.ControlModifier) {
+                otherWebView.url = request.url
                 request.action = WebView.IgnoreRequest
             }
-            originatingUrl = request.originatingUrl
         }
 
         experimental.onDownloadRequested: {
@@ -45,23 +44,11 @@ Item {
         }
     }
 
-    SignalSpy {
-        id: spy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
-    WebView {
+    TestWebView {
         id: otherWebView
     }
 
     SignalSpy {
-        id: otherSpy
-        target: otherWebView
-        signalName: "loadSucceeded"
-    }
-
-    SignalSpy {
         id: downloadSpy
         target: webView.experimental
         signalName: "downloadRequested"
@@ -86,45 +73,34 @@ Item {
         }
 
         function init() {
-            spy.clear()
-            otherSpy.clear()
             downloadSpy.clear()
             downloadFinishedSpy.clear()
             shouldDownload = false
-            originatingUrl = ""
         }
 
         function test_usePolicy() {
-            webView.load(beginUrl)
-            spy.wait()
-            spy.clear()
+            webView.url = beginUrl
+            verify(webView.waitForLoadSucceeded())
             mouseClick(webView, 100, 100, Qt.LeftButton)
-            spy.wait()
-            compare(spy.count, 1)
+            verify(webView.waitForLoadSucceeded())
             compare(webView.title, "Test page 1")
             compare(webView.url, endUrl)
         }
 
         function test_ignorePolicy() {
-            webView.load(beginUrl)
-            spy.wait()
-            spy.clear()
-            compare(spy.count, 0)
-            compare(otherSpy.count, 0)
+            webView.url = beginUrl
+            verify(webView.waitForLoadSucceeded())
             mouseClick(webView, 100, 100, Qt.MiddleButton, Qt.ControlModifier)
-            otherSpy.wait()
-            compare(spy.count, 0)
-            compare(otherSpy.count, 1)
+            verify(otherWebView.waitForLoadSucceeded())
+            verify(webView.loadStatus == null)
             compare(webView.url, beginUrl)
             compare(otherWebView.title, "Test page 1")
             compare(otherWebView.url, endUrl)
         }
 
         function test_downloadPolicy() {
-            webView.load(beginUrl)
-            spy.wait()
-            spy.clear()
-            compare(spy.count, 0)
+            webView.url = beginUrl
+            verify(webView.waitForLoadSucceeded())
             downloadSpy.clear()
             downloadFinishedSpy.clear()
             expectedLength = 0
@@ -136,16 +112,5 @@ Item {
             compare(downloadFinishedSpy.count, 1)
             compare(totalBytes, expectedLength)
         }
-
-        function test_originatingUrl() {
-            webView.load(beginUrl)
-            spy.wait()
-            spy.clear()
-            mouseClick(webView, 100, 100, Qt.LeftButton)
-            spy.wait()
-            compare(webView.title, "Test page 1")
-            compare(webView.url, endUrl)
-            compare(originatingUrl, beginUrl)
-        }
     }
 }
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView.pro b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView.pro
index 7f4e3d12f..57307f07a 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView.pro
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView.pro
@@ -3,7 +3,7 @@ SOURCES += tst_qmltests.cpp
 TARGET = tst_qmltests_WebView
 OBJECTS_DIR = obj_WebView/$$activeBuildConfig()
 
-CONFIG += qtwebkit-private
+QT += webkit-private
 CONFIG += warn_on testcase
 
 QT -= testlib
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_applicationScheme.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_applicationScheme.qml
index 8bcb5eccb..875bcd060 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_applicationScheme.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_applicationScheme.qml
@@ -78,7 +78,7 @@ WebView {
             spyTitle.clear()
             compare(spyTitle.count, 0)
             var testUrl = "applicationScheme://something"
-            webView.load(testUrl)
+            webView.url = testUrl
             spyTitle.wait()
             compare(webView.title, "Test Application Scheme")
         }
@@ -88,12 +88,12 @@ WebView {
             spyTitle.clear()
             compare(spyTitle.count, 0)
             var testUrl = "scheme2://some-url-string"
-            webView.load(testUrl)
+            webView.url = testUrl
             spyTitle.wait()
             compare(webView.title, "Scheme2 Reply")
 
             testUrl = "scheme1://some-url-string"
-            webView.load(testUrl)
+            webView.url = testUrl
             spyTitle.wait()
             compare(webView.title, "Scheme1 Reply")
 
@@ -104,12 +104,12 @@ WebView {
             spyTitle.clear()
             compare(spyTitle.count, 0)
             var testUrl = "scheme3://url1"
-            webView.load(testUrl)
+            webView.url = testUrl
             spyTitle.wait()
             compare(webView.title, "Scheme3 Reply1")
 
             testUrl = "scheme3://url2"
-            webView.load(testUrl)
+            webView.url = testUrl
             spyTitle.wait()
             compare(webView.title, "Scheme3 Reply2")
 
@@ -120,12 +120,12 @@ WebView {
             spyTitle.clear()
             compare(spyTitle.count, 0)
             var testUrl = "schemeCharset://latin1"
-            webView.load(testUrl)
+            webView.url = testUrl
             spyTitle.wait()
             compare(webView.title, "title with copyright ©")
 
             testUrl = "schemeCharset://utf-8"
-            webView.load(testUrl)
+            webView.url = testUrl
             spyTitle.wait()
             compare(webView.title, "title with copyright ©")
         }
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_download.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_download.qml
index f8324a606..9f1d43231 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_download.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_download.qml
@@ -61,14 +61,14 @@ WebView {
 
         function test_downloadRequest() {
             compare(spy.count, 0)
-            webView.load(Qt.resolvedUrl("../common/download.zip"))
+            webView.url = Qt.resolvedUrl("../common/download.zip")
             spy.wait()
             compare(spy.count, 1)
         }
 
         function test_expectedLength() {
             compare(spy.count, 0)
-            webView.load(Qt.resolvedUrl("../common/download.zip"))
+            webView.url = Qt.resolvedUrl("../common/download.zip")
             spy.wait()
             compare(spy.count, 1)
             compare(expectedLength, 325)
@@ -76,7 +76,7 @@ WebView {
 
         function test_succeeded() {
             compare(spy.count, 0)
-            webView.load(Qt.resolvedUrl("../common/download.zip"))
+            webView.url = Qt.resolvedUrl("../common/download.zip")
             spy.wait()
             compare(spy.count, 1)
             downloadFinishedSpy.wait()
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_favIconLoad.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_favIconLoad.qml
index 121809316..20d538fbf 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_favIconLoad.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_favIconLoad.qml
@@ -1,8 +1,9 @@
 import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
 
     SignalSpy {
@@ -11,12 +12,6 @@ WebView {
         signalName: "iconChanged"
     }
 
-    SignalSpy {
-        id: loadSpy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
     Image {
         id: favicon
         source: webView.icon
@@ -29,18 +24,17 @@ WebView {
         function init() {
             if (webView.icon != '') {
                 // If this is not the first test, then load a blank page without favicon, restoring the initial state.
-                webView.load('about:blank')
+                webView.url = 'about:blank'
                 spy.wait()
-                loadSpy.wait()
+                verify(webView.waitForLoadSucceeded())
             }
-            loadSpy.clear()
             spy.clear()
         }
 
         function test_favIconLoad() {
             compare(spy.count, 0)
             var url = Qt.resolvedUrl("../common/favicon.html")
-            webView.load(url)
+            webView.url = url
             spy.wait()
             compare(spy.count, 1)
             compare(favicon.width, 48)
@@ -50,7 +44,7 @@ WebView {
         function test_favIconLoadEncodedUrl() {
             compare(spy.count, 0)
             var url = Qt.resolvedUrl("../common/favicon2.html?favicon=load should work with#whitespace!")
-            webView.load(url)
+            webView.url = url
             spy.wait()
             compare(spy.count, 1)
             compare(favicon.width, 16)
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_geopermission.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_geopermission.qml
index fd898a78e..41097bbcf 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_geopermission.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_geopermission.qml
@@ -46,7 +46,7 @@ WebView {
 
         function test_permissionRequest() {
             compare(spy.count, 0)
-            webView.load(Qt.resolvedUrl("../common/geolocation.html"))
+            webView.url = Qt.resolvedUrl("../common/geolocation.html")
             spy.wait()
             compare(spy.count, 1)
         }
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_javaScriptDialogs.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_javaScriptDialogs.qml
index 13adb3b2d..4e15c2344 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_javaScriptDialogs.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_javaScriptDialogs.qml
@@ -2,8 +2,9 @@ import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
 import QtWebKit.experimental 1.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
 
     property bool modelMessageEqualsMessage: false
@@ -54,12 +55,6 @@ WebView {
         }
     }
 
-    SignalSpy {
-        id: loadSpy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
     TestCase {
         id: test
         name: "WebViewJavaScriptDialogs"
@@ -69,55 +64,48 @@ WebView {
             webView.messageFromAlertDialog = ""
             webView.confirmCount = 0
             webView.promptCount = 0
-            loadSpy.clear()
         }
 
         function test_alert() {
-            webView.load(Qt.resolvedUrl("../common/alert.html"))
-            loadSpy.wait()
-            compare(loadSpy.count, 1)
+            webView.url = Qt.resolvedUrl("../common/alert.html")
+            verify(webView.waitForLoadSucceeded())
             compare(webView.messageFromAlertDialog, "Hello Qt")
             verify(webView.modelMessageEqualsMessage)
         }
 
         function test_alertWithoutDialog() {
             webView.experimental.alertDialog = null
-            webView.load(Qt.resolvedUrl("../common/alert.html"))
-            loadSpy.wait()
-            compare(loadSpy.count, 1)
+            webView.url = Qt.resolvedUrl("../common/alert.html")
+            verify(webView.waitForLoadSucceeded())
             compare(webView.messageFromAlertDialog, "")
         }
 
         function test_confirm() {
-            webView.load(Qt.resolvedUrl("../common/confirm.html"))
-            loadSpy.wait()
-            compare(loadSpy.count, 1)
+            webView.url = Qt.resolvedUrl("../common/confirm.html")
+            verify(webView.waitForLoadSucceeded())
             compare(webView.confirmCount, 2)
             compare(webView.title, "ACCEPTED REJECTED")
         }
 
         function test_confirmWithoutDialog() {
             webView.experimental.confirmDialog = null
-            webView.load(Qt.resolvedUrl("../common/confirm.html"))
-            loadSpy.wait()
-            compare(loadSpy.count, 1)
+            webView.url = Qt.resolvedUrl("../common/confirm.html")
+            verify(webView.waitForLoadSucceeded())
             compare(webView.confirmCount, 0)
             compare(webView.title, "ACCEPTED ACCEPTED")
         }
 
         function test_prompt() {
-            webView.load(Qt.resolvedUrl("../common/prompt.html"))
-            loadSpy.wait()
-            compare(loadSpy.count, 1)
+            webView.url = Qt.resolvedUrl("../common/prompt.html")
+            verify(webView.waitForLoadSucceeded())
             compare(webView.promptCount, 2)
             compare(webView.title, "tQ olleH")
         }
 
         function test_promptWithoutDialog() {
             webView.experimental.promptDialog = null
-            webView.load(Qt.resolvedUrl("../common/prompt.html"))
-            loadSpy.wait()
-            compare(loadSpy.count, 1)
+            webView.url = Qt.resolvedUrl("../common/prompt.html")
+            verify(webView.waitForLoadSucceeded())
             compare(webView.promptCount, 0)
             compare(webView.title, "FAIL")
         }
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadFail.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadFail.qml
index 26a42c0b7..51c1f7dd0 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadFail.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadFail.qml
@@ -1,35 +1,30 @@
 import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
     width: 400
     height: 300
 
     property variant testUrl
 
-    SignalSpy {
-        id: spy
-        target: webView
-        signalName: "loadFailed"
-    }
-
     TestCase {
         id: test
         name: "WebViewLoadFail"
         function test_fail() {
-            compare(spy.count, 0)
             testUrl = Qt.resolvedUrl("file_that_does_not_exist.html")
-            webView.load(testUrl)
-            spy.wait()
-            compare(spy.count, 1)
+            webView.url = testUrl
+            verify(webView.waitForLoadFailed())
         }
     }
 
-    onLoadFailed: {
-        test.compare(url, testUrl)
-        test.compare(errorCode, NetworkReply.ContentNotFoundError)
-        test.compare(errorDomain, WebView.NetworkErrorDomain)
+    onLoadingChanged: {
+        if (loadRequest.status == WebView.LoadFailedStatus) {
+            test.compare(loadRequest.url, testUrl)
+            test.compare(loadRequest.errorCode, NetworkReply.ContentNotFoundError)
+            test.compare(loadRequest.errorDomain, WebView.NetworkErrorDomain)
+        }
     }
 }
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadHtml.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadHtml.qml
index b57df66a6..297c082e5 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadHtml.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadHtml.qml
@@ -1,27 +1,20 @@
 import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
     width: 200
     height: 400
 
-    SignalSpy {
-        id: loadSpy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
     TestCase {
         name: "WebViewLoadHtml"
 
         function test_loadProgressAfterLoadHtml() {
-            loadSpy.clear()
-            compare(loadSpy.count, 0)
             compare(webView.loadProgress, 0)
             webView.loadHtml("<html><head><title>Test page 1</title></head><body>Hello.</body></html>")
-            loadSpy.wait()
+            verify(webView.waitForLoadSucceeded())
             compare(webView.loadProgress, 100)
         }
     }
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgress.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgress.qml
index a51d6f69f..2f95ef11d 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgress.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgress.qml
@@ -1,27 +1,21 @@
 import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
     width: 400
     height: 300
 
-    SignalSpy {
-        id: spy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
     TestCase {
         name: "WebViewLoadProgress"
 
         function test_loadProgress() {
-            compare(spy.count, 0)
             compare(webView.loadProgress, 0)
-            webView.load(Qt.resolvedUrl("../common/test1.html"))
+            webView.url = Qt.resolvedUrl("../common/test1.html")
             compare(webView.loadProgress, 0)
-            spy.wait()
+            verify(webView.waitForLoadSucceeded())
             compare(webView.loadProgress, 100)
         }
     }
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgressSignal.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgressSignal.qml
index 10ac879a8..620686003 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgressSignal.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadProgressSignal.qml
@@ -1,19 +1,14 @@
 import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
     width: 400
     height: 300
 
     SignalSpy {
-        id: spy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
-    SignalSpy {
         id: spyProgress
         target: webView
         signalName: "loadProgressChanged"
@@ -25,11 +20,11 @@ WebView {
         function test_loadProgressSignal() {
             compare(spyProgress.count, 0)
             compare(webView.loadProgress, 0)
-            webView.load(Qt.resolvedUrl("../common/test1.html"))
+            webView.url = Qt.resolvedUrl("../common/test1.html")
             spyProgress.wait()
             compare(true, webView.loadProgress > -1 && webView.loadProgress < 101)
             if (webView.loadProgress > 0 && webView.loadProgress < 100) {
-                spy.wait()
+                verify(webView.waitForLoadSucceeded())
                 spyProgress.wait()
                 compare(webView.loadProgress, 100)
             }
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadUrl.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadUrl.qml
index d70976c4a..8fcbae54a 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadUrl.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_loadUrl.qml
@@ -1,11 +1,14 @@
 import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
     property variant lastUrl
     property bool watchProgress: false
+    property int numLoadStarted: 0
+    property int numLoadSucceeded: 0
 
     onLoadProgressChanged: {
         if (watchProgress && webView.loadProgress != 100) {
@@ -14,40 +17,44 @@ WebView {
         }
     }
 
-    SignalSpy {
-        id: spy
-        target: webView
-        signalName: "loadSucceeded"
+    onLoadingChanged: {
+        if (loadRequest.status == WebView.LoadStartedStatus)
+            ++numLoadStarted
+        if (loadRequest.status == WebView.LoadSucceededStatus)
+            ++numLoadSucceeded
     }
 
     TestCase {
         id: test
         name: "WebViewLoadUrl"
         function test_loadIgnoreEmptyUrl() {
-            compare(spy.count, 0)
             var url = Qt.resolvedUrl("../common/test1.html")
 
-            webView.load(url)
-            spy.wait()
-            compare(spy.count, 1)
+            webView.url = url
+            verify(webView.waitForLoadSucceeded())
+            compare(numLoadStarted, 1)
+            compare(numLoadSucceeded, 1)
             compare(webView.url, url)
 
             lastUrl = webView.url
-            webView.load('')
+            webView.url = ''
             wait(1000)
-            compare(spy.count, 1)
+            compare(numLoadStarted, 1)
+            compare(numLoadSucceeded, 1)
             compare(webView.url, lastUrl)
 
-            webView.load('about:blank')
-            spy.wait()
-            compare(spy.count, 2)
+            webView.url = 'about:blank'
+            verify(webView.waitForLoadSucceeded())
+            compare(numLoadStarted, 2)
+            compare(numLoadSucceeded, 2)
             compare(webView.url, 'about:blank')
 
             // It shouldn't interrupt any ongoing load when an empty url is used.
             watchProgress = true
-            webView.load(url)
-            spy.wait()
-            compare(spy.count, 3)
+            webView.url = url
+            webView.waitForLoadSucceeded()
+            compare(numLoadStarted, 3)
+            compare(numLoadSucceeded, 3)
             verify(!watchProgress)
             compare(webView.url, url)
         }
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_navigationHistory.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_navigationHistory.qml
index b886e48f3..3b51c9cc1 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_navigationHistory.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_navigationHistory.qml
@@ -2,18 +2,13 @@ import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
 import QtWebKit.experimental 1.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
     width: 400
     height: 300
 
-    SignalSpy {
-        id: spy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
     ListView {
         id: backItemsList
         anchors.fill: parent
@@ -40,64 +35,56 @@ WebView {
         name: "WebViewNavigationHistory"
 
         function test_navigationHistory() {
-            compare(spy.count, 0)
             compare(webView.loadProgress, 0)
-            webView.load(Qt.resolvedUrl("../common/test1.html"))
-            spy.wait()
+            webView.url = Qt.resolvedUrl("../common/test1.html")
+            verify(webView.waitForLoadSucceeded())
             compare(webView.canGoBack, false)
             compare(webView.canGoForward, false)
             compare(backItemsList.count, 0)
             compare(forwardItemsList.count, 0)
-            spy.clear()
-            webView.load(Qt.resolvedUrl("../common/test2.html"))
-            spy.wait()
+            webView.url = Qt.resolvedUrl("../common/test2.html")
+            verify(webView.waitForLoadSucceeded())
             compare(webView.url, Qt.resolvedUrl("../common/test2.html"))
             compare(webView.canGoBack, true)
             compare(webView.canGoForward, false)
             compare(backItemsList.count, 1)
-            spy.clear()
             webView.experimental.goBackTo(0)
-            spy.wait()
+            verify(webView.waitForLoadSucceeded())
             compare(webView.url, Qt.resolvedUrl("../common/test1.html"))
             compare(webView.canGoBack, false)
             compare(webView.canGoForward, true)
             compare(backItemsList.count, 0)
             compare(forwardItemsList.count, 1)
-            spy.clear()
             webView.goForward()
-            spy.wait()
+            verify(webView.waitForLoadSucceeded())
             compare(webView.url, Qt.resolvedUrl("../common/test2.html"))
             compare(webView.canGoBack, true)
             compare(webView.canGoForward, false)
             compare(backItemsList.count, 1)
             compare(forwardItemsList.count, 0)
-            spy.clear()
-            webView.load(Qt.resolvedUrl("../common/javascript.html"))
-            spy.wait()
+            webView.url = Qt.resolvedUrl("../common/javascript.html")
+            verify(webView.waitForLoadSucceeded())
             compare(webView.url, Qt.resolvedUrl("../common/javascript.html"))
             compare(webView.canGoBack, true)
             compare(webView.canGoForward, false)
             compare(backItemsList.count, 2)
             compare(forwardItemsList.count, 0)
-            spy.clear()
             webView.experimental.goBackTo(1)
-            spy.wait()
+            verify(webView.waitForLoadSucceeded())
             compare(webView.url, Qt.resolvedUrl("../common/test1.html"))
             compare(webView.canGoBack, false)
             compare(webView.canGoForward, true)
             compare(backItemsList.count, 0)
             compare(forwardItemsList.count, 2)
-            spy.clear()
             webView.experimental.goForwardTo(1)
-            spy.wait()
+            verify(webView.waitForLoadSucceeded())
             compare(webView.url, Qt.resolvedUrl("../common/javascript.html"))
             compare(webView.canGoBack, true)
             compare(webView.canGoForward, false)
             compare(backItemsList.count, 2)
             compare(forwardItemsList.count, 0)
-            spy.clear()
             webView.goBack()
-            spy.wait()
+            verify(webView.waitForLoadSucceeded())
             compare(webView.url, Qt.resolvedUrl("../common/test2.html"))
             compare(webView.canGoBack, true)
             compare(webView.canGoForward, true)
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_origin.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_origin.qml
index 70745d8d6..660ca7326 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_origin.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_origin.qml
@@ -48,7 +48,7 @@ WebView {
 
         function test_permissionRequest() {
             compare(spy.count, 0)
-            webView.load(Qt.resolvedUrl("../common/geolocation.html"))
+            webView.url = Qt.resolvedUrl("../common/geolocation.html")
             spy.wait()
             compare(spy.count, 1)
             compare(webView.success, true)
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_preferences.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_preferences.qml
index 917b689e6..4f356e88b 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_preferences.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_preferences.qml
@@ -2,9 +2,10 @@ import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
 import QtWebKit.experimental 1.0
+import "../common"
 
 Item {
-    WebView {
+    TestWebView {
         id: webView
         width: 400
         height: 300
@@ -13,19 +14,13 @@ Item {
         experimental.preferences.localStorageEnabled: true
         experimental.preferences.pluginsEnabled: true
 
-        WebView {
+        TestWebView {
             id: webView2
             width: 400
             height: 300
         }
 
         SignalSpy {
-            id: spy
-            target: webView
-            signalName: "loadSucceeded"
-        }
-
-        SignalSpy {
             id: titleSpy
             target: webView
             signalName: "titleChanged"
@@ -85,12 +80,6 @@ Item {
             signalName: "defaultFixedFontSizeChanged"
         }
 
-        SignalSpy {
-            id: otherSpy
-            target: webView2
-            signalName: "loadSucceeded"
-        }
-
         TestCase {
             name: "WebViewPreferences"
 
@@ -132,9 +121,8 @@ Item {
                     webView.experimental.preferences.defaultFixedFontSize = defaultFixedFontSize
 
                     if (webView.url != '' && webView.url != 'about:blank') {
-                        spy.clear()
-                        webView.load('about:blank')
-                        spy.wait()
+                        webView.url = 'about:blank'
+                        verify(webView.waitForLoadSucceeded())
                     }
 
                     standardFontFamilySpy.clear()
@@ -151,42 +139,40 @@ Item {
                 webView.experimental.preferences.javascriptEnabled = true
                 webView.experimental.preferences.localStorageEnabled = true
                 webView.experimental.preferences.pluginsEnabled = true
-                spy.clear()
                 titleSpy.clear()
             }
 
             function test_javascriptEnabled() {
                 webView.experimental.preferences.javascriptEnabled = true
                 var testUrl = Qt.resolvedUrl("../common/javascript.html")
-                webView.load(testUrl)
-                spy.wait()
+                webView.url = testUrl
+                verify(webView.waitForLoadSucceeded())
                 compare(webView.title, "New Title")
             }
 
             function test_javascriptDisabled() {
                 webView.experimental.preferences.javascriptEnabled = false
                 var testUrl = Qt.resolvedUrl("../common/javascript.html")
-                webView.load(testUrl)
-                spy.wait()
+                webView.url = testUrl
+                verify(webView.waitForLoadSucceeded())
                 compare(webView.title, "Original Title")
             }
 
             function test_localStorageDisabled() {
                 webView.experimental.preferences.localStorageEnabled = false
                 var testUrl = Qt.resolvedUrl("../common/localStorage.html")
-                webView.load(testUrl)
-                spy.wait()
+                webView.url = testUrl
+                verify(webView.waitForLoadSucceeded())
                 compare(webView.title, "Original Title")
             }
 
             function test_localStorageEnabled() {
                 webView.experimental.preferences.localStorageEnabled = true
                 var testUrl = Qt.resolvedUrl("../common/localStorage.html")
-                webView.load(testUrl)
-                spy.wait()
-                spy.clear()
-                webView.load(testUrl)
-                spy.wait()
+                webView.url = testUrl
+                verify(webView.waitForLoadSucceeded())
+                webView.url = testUrl
+                verify(webView.waitForLoadSucceeded())
                 compare(webView.title, "New Title")
             }
 
@@ -194,26 +180,24 @@ Item {
                 webView.experimental.preferences.javascriptEnabled = true
                 webView2.experimental.preferences.javascriptEnabled = true
                 var testUrl = Qt.resolvedUrl("../common/javascript.html")
-                webView.load(testUrl)
-                spy.wait()
-                webView2.load(testUrl)
-                otherSpy.wait()
+                webView.url = testUrl
+                verify(webView.waitForLoadSucceeded())
+                webView2.url = testUrl
+                verify(webView2.waitForLoadSucceeded())
                 compare(webView.title, "New Title")
                 compare(webView2.title, "New Title")
-                spy.clear()
-                otherSpy.clear()
                 webView.experimental.preferences.javascriptEnabled = false
-                webView.load(testUrl)
-                spy.wait()
-                webView2.load(testUrl)
-                otherSpy.wait()
+                webView.url = testUrl
+                verify(webView.waitForLoadSucceeded())
+                webView2.url = testUrl
+                verify(webView2.waitForLoadSucceeded())
                 compare(webView.title, "Original Title")
                 compare(webView2.title, "New Title")
             }
 
             function test_standardFontFamilyChanged() {
                 var url = Qt.resolvedUrl("../common/font-preferences.html?standard#font-family")
-                webView.load(url)
+                webView.url = url
                 titleSpy.wait()
                 compare(webView.title, "Original Title")
                 titleSpy.wait()
@@ -222,7 +206,7 @@ Item {
                 webView.experimental.preferences.standardFontFamily = "foobar"
                 standardFontFamilySpy.wait()
                 compare(standardFontFamilySpy.count, 1)
-                webView.load(url)
+                webView.url = url
                 titleSpy.wait()
                 compare(webView.title, "Original Title")
                 titleSpy.wait()
@@ -231,7 +215,7 @@ Item {
 
             function test_fontSizeChanged() {
                 var url = Qt.resolvedUrl("../common/font-preferences.html?standard#font-size")
-                webView.load(url)
+                webView.url = url
                 titleSpy.wait()
                 compare(webView.title, "Original Title")
                 titleSpy.wait()
@@ -240,7 +224,7 @@ Item {
                 webView.experimental.preferences.defaultFontSize = defaultFontSize + 1
                 defaultFontSizeSpy.wait()
                 compare(defaultFontSizeSpy.count, 1)
-                webView.load(url)
+                webView.url = url
                 titleSpy.wait()
                 compare(webView.title, "Original Title")
                 titleSpy.wait()
@@ -249,7 +233,7 @@ Item {
 
             function test_fixedFontSizeChanged() {
                 var url = Qt.resolvedUrl("../common/font-preferences.html?fixed#font-size")
-                webView.load(url)
+                webView.url = url
                 titleSpy.wait()
                 compare(webView.title, "Original Title")
                 titleSpy.wait()
@@ -258,13 +242,13 @@ Item {
                 webView.experimental.preferences.defaultFixedFontSize = defaultFixedFontSize + 1
                 defaultFixedFontSizeSpy.wait()
                 compare(defaultFixedFontSizeSpy.count, 1)
-                webView.load(url)
+                webView.url = url
                 titleSpy.wait()
                 compare(webView.title, "Original Title")
                 titleSpy.wait()
                 compare(webView.title, (defaultFixedFontSize + 1).toString() + "px")
 
-                webView.load(Qt.resolvedUrl("../common/font-preferences.html?standard#font-size"))
+                webView.url = Qt.resolvedUrl("../common/font-preferences.html?standard#font-size")
                 titleSpy.wait()
                 compare(webView.title, "Original Title")
                 titleSpy.wait()
@@ -274,7 +258,7 @@ Item {
             function test_minimumFontSizeChanged() {
                 verify(defaultMinimumFontSize < defaultFontSize)
                 var url = Qt.resolvedUrl("../common/font-preferences.html?minimum#font-size")
-                webView.load(url)
+                webView.url = url
                 titleSpy.wait()
                 compare(webView.title, "Original Title")
                 titleSpy.wait()
@@ -286,7 +270,7 @@ Item {
                 webView.experimental.preferences.minimumFontSize = defaultFontSize
                 minimumFontSizeSpy.wait()
                 compare(minimumFontSizeSpy.count, 1)
-                webView.load(url)
+                webView.url = url
                 titleSpy.wait()
                 compare(webView.title, "Original Title")
                 titleSpy.wait()
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_properties.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_properties.qml
index 4761cd322..036ee9d86 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_properties.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_properties.qml
@@ -1,33 +1,26 @@
 import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
     width: 400
     height: 300
 
-    SignalSpy {
-        id: spy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
     TestCase {
         name: "WebViewProperties"
 
         function test_title() {
-            compare(spy.count, 0)
-            webView.load(Qt.resolvedUrl("../common/test1.html"))
-            spy.wait()
+            webView.url =  Qt.resolvedUrl("../common/test1.html")
+            verify(webView.waitForLoadSucceeded())
             compare(webView.title, "Test page 1")
         }
 
         function test_url() {
-            compare(spy.count, 1)
             var testUrl = Qt.resolvedUrl("../common/test1.html")
-            webView.load(testUrl)
-            spy.wait()
+            webView.url = testUrl
+            verify(webView.waitForLoadSucceeded())
             compare(webView.url, testUrl)
         }
     }
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_titleChanged.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_titleChanged.qml
index f36ea8579..04f2c7e13 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_titleChanged.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_titleChanged.qml
@@ -1,19 +1,14 @@
 import QtQuick 2.0
 import QtTest 1.0
 import QtWebKit 3.0
+import "../common"
 
-WebView {
+TestWebView {
     id: webView
     width: 400
     height: 300
 
     SignalSpy {
-        id: spy
-        target: webView
-        signalName: "loadSucceeded"
-    }
-
-    SignalSpy {
         id: spyTitle
         target: webView
         signalName: "titleChanged"
@@ -25,7 +20,8 @@ WebView {
         function test_titleFirstLoad() {
             compare(spyTitle.count, 0)
             var testUrl = Qt.resolvedUrl("../common/test3.html")
-            webView.load(testUrl)
+            webView.url = testUrl
+            verify(webView.waitForLoadSucceeded())
             spyTitle.wait()
             compare(webView.title, "Test page 3")
             spyTitle.wait()
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/TestWebView.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/TestWebView.qml
new file mode 100644
index 000000000..aa0baae4f
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/TestWebView.qml
@@ -0,0 +1,36 @@
+import QtQuick 2.0
+import QtTest 1.0
+import QtWebKit 3.0
+import QtWebKit.experimental 1.0
+
+WebView {
+    property var loadStatus: null
+
+    function waitForLoadSucceeded() {
+        var timeout = 5000
+        var i = 0
+        while (i < timeout && loadStatus != WebView.LoadSucceededStatus) {
+            testResult.wait(50)
+            i += 50
+        }
+        var success = loadStatus == WebView.LoadSucceededStatus
+        loadStatus = null
+        return success
+    }
+    function waitForLoadFailed() {
+        var timeout = 5000
+        var i = 0
+        while (i < timeout && loadStatus != WebView.LoadFailedStatus) {
+            testResult.wait(50)
+            i += 50
+        }
+        var failure = loadStatus == WebView.LoadFailedStatus
+        loadStatus = null
+        return failure
+    }
+
+    TestResult { id: testResult }
+
+    onLoadingChanged: loadStatus = loadRequest.status
+}
+
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests.cpp b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests.cpp
index bcc246db4..782b041ca 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests.cpp
@@ -20,7 +20,7 @@
 #include "../bytearraytestdata.h"
 #include "../util.h"
 
-#include "qquickwebview_p.h"
+#include "private/qquickwebview_p.h"
 #include <QGuiApplication>
 #include <QVarLengthArray>
 #include <QtQuickTest/quicktest.h>
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/qquickwebview.pro b/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/qquickwebview.pro
index 25cd8324f..4a8d86f80 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/qquickwebview.pro
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/qquickwebview.pro
@@ -1,4 +1,4 @@
 include(../tests.pri)
 SOURCES += $${TARGET}.cpp
-CONFIG += qtwebkit-private
+QT += webkit-private
 DEFINES += IMPORT_DIR=\"\\\"$${ROOT_BUILD_DIR}$${QMAKE_DIR_SEP}imports\\\"\"
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp b/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
index 12886b314..a6b13990a 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
@@ -23,8 +23,9 @@
 #include <QDeclarativeEngine>
 #include <QScopedPointer>
 #include <QtTest/QtTest>
-#include <qquickwebpage_p.h>
-#include <qquickwebview_p.h>
+#include <private/qquickwebpage_p.h>
+#include <private/qquickwebview_p.h>
+#include <private/qwebloadrequest_p.h>
 
 class tst_QQuickWebView : public QObject {
     Q_OBJECT
@@ -54,6 +55,7 @@ private slots:
     void removeFromCanvas();
     void multipleWebViewWindows();
     void multipleWebViews();
+    void transparentWebViews();
 
 private:
     void prepareWebViewComponent();
@@ -120,8 +122,6 @@ void tst_QQuickWebView::navigationStatusAtStartup()
     QCOMPARE(webView()->canGoForward(), false);
 
     QCOMPARE(webView()->loading(), false);
-
-    QCOMPARE(webView()->canReload(), false);
 }
 
 class LoadStartedCatcher : public QObject {
@@ -130,15 +130,17 @@ public:
     LoadStartedCatcher(QQuickWebView* webView)
         : m_webView(webView)
     {
-        connect(m_webView, SIGNAL(loadStarted()), this, SLOT(onLoadStarted()));
+        connect(m_webView, SIGNAL(loadingChanged(QWebLoadRequest*)), this, SLOT(onLoadingChanged(QWebLoadRequest*)));
     }
 
 public slots:
-    void onLoadStarted()
+    void onLoadingChanged(QWebLoadRequest* loadRequest)
     {
-        QMetaObject::invokeMethod(this, "finished", Qt::QueuedConnection);
+        if (loadRequest->status() == QQuickWebView::LoadStartedStatus) {
+            QMetaObject::invokeMethod(this, "finished", Qt::QueuedConnection);
 
-        QCOMPARE(m_webView->loading(), true);
+            QCOMPARE(m_webView->loading(), true);
+        }
     }
 
 signals:
@@ -153,12 +155,12 @@ void tst_QQuickWebView::stopEnabledAfterLoadStarted()
     QCOMPARE(webView()->loading(), false);
 
     LoadStartedCatcher catcher(webView());
-    webView()->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
+    webView()->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
     waitForSignal(&catcher, SIGNAL(finished()));
 
     QCOMPARE(webView()->loading(), true);
 
-    waitForSignal(webView(), SIGNAL(loadSucceeded()));
+    QVERIFY(waitForLoadSucceeded(webView()));
 }
 
 void tst_QQuickWebView::baseUrl()
@@ -169,8 +171,8 @@ void tst_QQuickWebView::baseUrl()
 
 void tst_QQuickWebView::loadEmptyUrl()
 {
-    webView()->load(QUrl());
-    webView()->load(QUrl(QLatin1String("")));
+    webView()->setUrl(QUrl());
+    webView()->setUrl(QUrl(QLatin1String("")));
 }
 
 void tst_QQuickWebView::loadEmptyPageViewVisible()
@@ -181,64 +183,64 @@ void tst_QQuickWebView::loadEmptyPageViewVisible()
 
 void tst_QQuickWebView::loadEmptyPageViewHidden()
 {
-    QSignalSpy loadStartedSpy(webView(), SIGNAL(loadStarted()));
+    QSignalSpy loadSpy(webView(), SIGNAL(loadingChanged(QWebLoadRequest*)));
 
-    webView()->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadSucceeded())));
+    webView()->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
+    QVERIFY(waitForLoadSucceeded(webView()));
 
-    QCOMPARE(loadStartedSpy.size(), 1);
+    QCOMPARE(loadSpy.size(), 2);
 }
 
 void tst_QQuickWebView::loadNonexistentFileUrl()
 {
-    QSignalSpy loadFailedSpy(webView(), SIGNAL(loadStarted()));
+    QSignalSpy loadSpy(webView(), SIGNAL(loadingChanged(QWebLoadRequest*)));
 
-    webView()->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/file_that_does_not_exist.html")));
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadFailed(QQuickWebView::ErrorDomain, int, QUrl, QString))));
+    webView()->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/file_that_does_not_exist.html")));
+    QVERIFY(waitForLoadFailed(webView()));
 
-    QCOMPARE(loadFailedSpy.size(), 1);
+    QCOMPARE(loadSpy.size(), 2);
 }
 
 void tst_QQuickWebView::backAndForward()
 {
-    webView()->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadSucceeded())));
+    webView()->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
+    QVERIFY(waitForLoadSucceeded(webView()));
 
     QCOMPARE(webView()->url().path(), QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html"));
 
-    webView()->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page2.html")));
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadSucceeded())));
+    webView()->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page2.html")));
+    QVERIFY(waitForLoadSucceeded(webView()));
 
     QCOMPARE(webView()->url().path(), QLatin1String(TESTS_SOURCE_DIR "/html/basic_page2.html"));
 
     webView()->goBack();
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadSucceeded())));
+    QVERIFY(waitForLoadSucceeded(webView()));
 
     QCOMPARE(webView()->url().path(), QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html"));
 
     webView()->goForward();
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadSucceeded())));
+    QVERIFY(waitForLoadSucceeded(webView()));
 
     QCOMPARE(webView()->url().path(), QLatin1String(TESTS_SOURCE_DIR "/html/basic_page2.html"));
 }
 
 void tst_QQuickWebView::reload()
 {
-    webView()->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadSucceeded())));
+    webView()->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
+    QVERIFY(waitForLoadSucceeded(webView()));
 
     QCOMPARE(webView()->url().path(), QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html"));
 
     webView()->reload();
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadSucceeded())));
+    QVERIFY(waitForLoadSucceeded(webView()));
 
     QCOMPARE(webView()->url().path(), QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html"));
 }
 
 void tst_QQuickWebView::stop()
 {
-    webView()->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadSucceeded())));
+    webView()->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
+    QVERIFY(waitForLoadSucceeded(webView()));
 
     QCOMPARE(webView()->url().path(), QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html"));
 
@@ -250,9 +252,9 @@ void tst_QQuickWebView::loadProgress()
 {
     QCOMPARE(webView()->loadProgress(), 0);
 
-    webView()->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
-    QSignalSpy loadProgressChangedSpy(webView(), SIGNAL(loadProgressChanged(int)));
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadSucceeded())));
+    webView()->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
+    QSignalSpy loadProgressChangedSpy(webView(), SIGNAL(loadProgressChanged()));
+    QVERIFY(waitForLoadSucceeded(webView()));
 
     QVERIFY(loadProgressChangedSpy.count() >= 1);
 
@@ -271,8 +273,8 @@ void tst_QQuickWebView::showWebView()
 {
     webView()->setSize(QSizeF(300, 400));
 
-    webView()->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/direct-image-compositing.html")));
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadSucceeded())));
+    webView()->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/direct-image-compositing.html")));
+    QVERIFY(waitForLoadSucceeded(webView()));
 
     m_window->show();
     // This should not crash.
@@ -307,14 +309,14 @@ void tst_QQuickWebView::multipleWebViewWindows()
     QScopedPointer<TestWindow> window2(new TestWindow(webView2));
 
     webView1->setSize(QSizeF(300, 400));
-    webView1->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/scroll.html")));
-    QVERIFY(waitForSignal(webView1, SIGNAL(loadSucceeded())));
+    webView1->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/scroll.html")));
+    QVERIFY(waitForLoadSucceeded(webView1));
     window1->show();
     webView1->setVisible(true);
 
     webView2->setSize(QSizeF(300, 400));
-    webView2->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
-    QVERIFY(waitForSignal(webView2, SIGNAL(loadSucceeded())));
+    webView2->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
+    QVERIFY(waitForLoadSucceeded(webView2));
     window2->show();
     webView2->setVisible(true);
     QTest::qWait(200);
@@ -331,23 +333,50 @@ void tst_QQuickWebView::multipleWebViews()
     webView2->setParentItem(m_window->rootItem());
 
     webView1->setSize(QSizeF(300, 400));
-    webView1->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/scroll.html")));
-    QVERIFY(waitForSignal(webView1.data(), SIGNAL(loadSucceeded())));
+    webView1->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/scroll.html")));
+    QVERIFY(waitForLoadSucceeded(webView1.data()));
     webView1->setVisible(true);
 
     webView2->setSize(QSizeF(300, 400));
-    webView2->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
-    QVERIFY(waitForSignal(webView2.data(), SIGNAL(loadSucceeded())));
+    webView2->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
+    QVERIFY(waitForLoadSucceeded(webView2.data()));
     webView2->setVisible(true);
     QTest::qWait(200);
 }
 
+void tst_QQuickWebView::transparentWebViews()
+{
+    showWebView();
+
+    // This should not crash.
+    QScopedPointer<QQuickWebView> webView1(newWebView());
+    webView1->setParentItem(m_window->rootItem());
+    QScopedPointer<QQuickWebView> webView2(newWebView());
+    webView2->setParentItem(m_window->rootItem());
+    QVERIFY(!webView1->experimental()->transparentBackground());
+    webView2->experimental()->setTransparentBackground(true);
+    QVERIFY(webView2->experimental()->transparentBackground());
+
+    webView1->setSize(QSizeF(300, 400));
+    webView1->loadHtml("<html><body bgcolor=\"red\"></body></html>");
+    QVERIFY(waitForLoadSucceeded(webView1.data()));
+    webView1->setVisible(true);
+
+    webView2->setSize(QSizeF(300, 400));
+    webView2->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
+    QVERIFY(waitForLoadSucceeded(webView2.data()));
+    webView2->setVisible(true);
+
+    QTest::qWait(200);
+    // FIXME: test actual rendering results; https://bugs.webkit.org/show_bug.cgi?id=80609.
+}
+
 void tst_QQuickWebView::scrollRequest()
 {
     webView()->setSize(QSizeF(300, 400));
 
-    webView()->load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/scroll.html")));
-    QVERIFY(waitForSignal(webView(), SIGNAL(loadSucceeded())));
+    webView()->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/scroll.html")));
+    QVERIFY(waitForLoadSucceeded(webView()));
 
     // COMPARE with the position requested in the html
     // Use qRound as that is also used when calculating the position
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/tests.pri b/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
index faf445397..aa8da8bc9 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
+++ b/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
@@ -9,9 +9,7 @@ SOURCES += ../util.cpp \
            ../bytearraytestdata.cpp
 INCLUDEPATH += $$PWD
 
-QT += testlib declarative quick
-
-CONFIG += qtwebkit
+QT += testlib declarative quick webkit
 
 DEFINES += TESTS_SOURCE_DIR=\\\"$$PWD\\\" \
            QWP_PATH=\\\"$${ROOT_BUILD_DIR}/bin\\\"
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/util.cpp b/Source/WebKit2/UIProcess/API/qt/tests/util.cpp
index e230221e6..43a6696ef 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/util.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/util.cpp
@@ -18,6 +18,8 @@
 */
 
 #include "util.h"
+#include "private/qquickwebview_p.h"
+#include "private/qwebloadrequest_p.h"
 #include <stdio.h>
 
 void addQtWebProcessToPath()
@@ -50,6 +52,58 @@ bool waitForSignal(QObject* obj, const char* signal, int timeout)
     return timeoutSpy.isEmpty();
 }
 
+class LoadSpy : public QEventLoop {
+    Q_OBJECT
+public:
+    LoadSpy(QQuickWebView* webView)
+    {
+        connect(webView, SIGNAL(loadingChanged(QWebLoadRequest*)), SLOT(onLoadingChanged(QWebLoadRequest*)));
+    }
+signals:
+    void loadSucceeded();
+    void loadFailed();
+private slots:
+    void onLoadingChanged(QWebLoadRequest* loadRequest)
+    {
+        if (loadRequest->status() == QQuickWebView::LoadSucceededStatus)
+            emit loadSucceeded();
+        else if (loadRequest->status() == QQuickWebView::LoadFailedStatus)
+            emit loadFailed();
+    }
+};
+
+bool waitForLoadSucceeded(QQuickWebView* webView, int timeout)
+{
+    QEventLoop loop;
+    LoadSpy loadSpy(webView);
+    QObject::connect(&loadSpy, SIGNAL(loadSucceeded()), &loop, SLOT(quit()));
+    QTimer timer;
+    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
+    if (timeout > 0) {
+        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
+        timer.setSingleShot(true);
+        timer.start(timeout);
+    }
+    loop.exec();
+    return timeoutSpy.isEmpty();
+}
+
+bool waitForLoadFailed(QQuickWebView* webView, int timeout)
+{
+    QEventLoop loop;
+    LoadSpy loadSpy(webView);
+    QObject::connect(&loadSpy, SIGNAL(loadFailed()), &loop, SLOT(quit()));
+    QTimer timer;
+    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
+    if (timeout > 0) {
+        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
+        timer.setSingleShot(true);
+        timer.start(timeout);
+    }
+    loop.exec();
+    return timeoutSpy.isEmpty();
+}
+
 static void messageHandler(QtMsgType type, const char* message)
 {
     if (type == QtCriticalMsg) {
@@ -65,3 +119,5 @@ void suppressDebugOutput()
     if (qgetenv("QT_WEBKIT_SUPPRESS_WEB_PROCESS_OUTPUT").isEmpty()) \
         qputenv("QT_WEBKIT_SUPPRESS_WEB_PROCESS_OUTPUT", "1");
 }
+
+#include "util.moc"
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/util.h b/Source/WebKit2/UIProcess/API/qt/tests/util.h
index 1c052bc9a..f7be8b11e 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/util.h
+++ b/Source/WebKit2/UIProcess/API/qt/tests/util.h
@@ -22,10 +22,14 @@
 #include <QSignalSpy>
 #include <QTimer>
 
+class QQuickWebView;
+
 #if !defined(TESTS_SOURCE_DIR)
 #define TESTS_SOURCE_DIR ""
 #endif
 
 void addQtWebProcessToPath();
 bool waitForSignal(QObject*, const char* signal, int timeout = 10000);
+bool waitForLoadSucceeded(QQuickWebView* webView, int timeout = 10000);
+bool waitForLoadFailed(QQuickWebView* webView, int timeout = 10000);
 void suppressDebugOutput();
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxy.cpp b/Source/WebKit2/UIProcess/DrawingAreaProxy.cpp
index 9bb9783ca..08b225743 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxy.cpp
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxy.cpp
@@ -28,7 +28,7 @@
 
 #include "WebPageProxy.h"
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(UI_SIDE_COMPOSITING)
 #include "LayerTreeHostProxy.h"
 #include <CoreIPC/MessageID.h>
 #endif
@@ -58,7 +58,7 @@ void DrawingAreaProxy::setSize(const IntSize& size, const IntSize& scrollOffset)
     sizeDidChange();
 }
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(UI_SIDE_COMPOSITING)
 void DrawingAreaProxy::updateViewport()
 {
     m_webPageProxy->setViewNeedsDisplay(viewportVisibleRect());
@@ -69,12 +69,9 @@ WebCore::IntRect DrawingAreaProxy::contentsRect() const
     return IntRect(IntPoint::zero(), m_webPageProxy->viewSize());
 }
 
-#if USE(TILED_BACKING_STORE)
 void DrawingAreaProxy::didReceiveLayerTreeHostProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
 }
 #endif
 
-#endif
-
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxy.h b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
index e78c3cdf0..8b8dc2b0d 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxy.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
@@ -74,6 +74,8 @@ public:
 
     // FIXME: These should be pure virtual.
     virtual void visibilityDidChange() { }
+    virtual void layerHostingModeDidChange() { }
+
     virtual void setBackingStoreIsDiscardable(bool) { }
 
     virtual void waitForBackingStoreUpdateOnNextPaint() { }
@@ -83,7 +85,7 @@ public:
 
     virtual void pageCustomRepresentationChanged() { }
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(UI_SIDE_COMPOSITING)
     virtual void updateViewport();
     virtual WebCore::IntRect viewportVisibleRect() const { return contentsRect(); }
     virtual WebCore::IntRect contentsRect() const;
@@ -91,8 +93,6 @@ public:
     virtual void paintToCurrentGLContext(const WebCore::TransformationMatrix&, float, const WebCore::FloatRect&) { }
     virtual void paintLayerTree(BackingStore::PlatformGraphicsContext) { }
     LayerTreeHostProxy* layerTreeHostProxy() const { return m_layerTreeHostProxy.get(); }
-
-#if USE(TILED_BACKING_STORE)
     virtual void setVisibleContentsRectForScaling(const WebCore::IntRect& visibleContentsRect, float scale) { }
     virtual void setVisibleContentsRectForPanning(const WebCore::IntRect& visibleContentsRect, const WebCore::FloatPoint& trajectoryVector) { }
     virtual void createTileForLayer(int layerID, int tileID, const WebKit::UpdateInfo&) { }
@@ -102,7 +102,6 @@ public:
 
     WebPageProxy* page() { return m_webPageProxy; }
 #endif
-#endif
 protected:
     explicit DrawingAreaProxy(DrawingAreaType, WebPageProxy*);
 
@@ -112,7 +111,7 @@ protected:
     WebCore::IntSize m_size;
     WebCore::IntSize m_scrollOffset;
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(UI_SIDE_COMPOSITING)
     OwnPtr<LayerTreeHostProxy> m_layerTreeHostProxy;
 #endif
 
@@ -126,6 +125,7 @@ private:
 #if USE(ACCELERATED_COMPOSITING)
     virtual void enterAcceleratedCompositingMode(uint64_t backingStoreStateID, const LayerTreeContext&) { }
     virtual void exitAcceleratedCompositingMode(uint64_t backingStoreStateID, const UpdateInfo&) { }
+    virtual void updateAcceleratedCompositingMode(uint64_t backingStoreStateID, const LayerTreeContext&) { }
 #endif
 #if PLATFORM(MAC)
     virtual void didUpdateGeometry() { }
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxy.messages.in b/Source/WebKit2/UIProcess/DrawingAreaProxy.messages.in
index e27b5bf26..7dbdcebab 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxy.messages.in
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxy.messages.in
@@ -26,6 +26,7 @@ messages -> DrawingAreaProxy {
 #if USE(ACCELERATED_COMPOSITING)
     EnterAcceleratedCompositingMode(uint64_t backingStoreStateID, WebKit::LayerTreeContext context)
     ExitAcceleratedCompositingMode(uint64_t backingStoreStateID, WebKit::UpdateInfo updateInfo)
+    UpdateAcceleratedCompositingMode(uint64_t backingStoreStateID, WebKit::LayerTreeContext context)
 #endif
 
 #if PLATFORM(MAC)
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
index 220f9ece2..c0d044bf8 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
@@ -36,7 +36,7 @@
 #include "WebProcessProxy.h"
 #include <WebCore/Region.h>
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(UI_SIDE_COMPOSITING)
 #include "LayerTreeHostProxy.h"
 #endif
 
@@ -58,7 +58,7 @@ DrawingAreaProxyImpl::DrawingAreaProxyImpl(WebPageProxy* webPageProxy)
     , m_isBackingStoreDiscardable(true)
     , m_discardBackingStoreTimer(RunLoop::current(), this, &DrawingAreaProxyImpl::discardBackingStore)
 {
-#if USE(TEXTURE_MAPPER)
+#if USE(UI_SIDE_COMPOSITING)
     // Construct the proxy early to allow messages to be sent to the web process while AC is entered there.
     if (webPageProxy->pageGroup()->preferences()->forceCompositingMode())
         m_layerTreeHostProxy = adoptPtr(new LayerTreeHostProxy(this));
@@ -335,13 +335,13 @@ void DrawingAreaProxyImpl::enterAcceleratedCompositingMode(const LayerTreeContex
     m_backingStore = nullptr;
     m_layerTreeContext = layerTreeContext;
     m_webPageProxy->enterAcceleratedCompositingMode(layerTreeContext);
-#if USE(TEXTURE_MAPPER)
+#if USE(UI_SIDE_COMPOSITING)
     if (!m_layerTreeHostProxy)
         m_layerTreeHostProxy = adoptPtr(new LayerTreeHostProxy(this));
 #endif
 }
 
-#if USE(TILED_BACKING_STORE)
+#if USE(UI_SIDE_COMPOSITING)
 void DrawingAreaProxyImpl::didReceiveLayerTreeHostProxyMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
     if (m_layerTreeHostProxy)
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
index 25c279b0b..613073bab 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
@@ -77,7 +77,7 @@ private:
 
     bool isInAcceleratedCompositingMode() const { return !m_layerTreeContext.isEmpty(); }
 
-#if USE(TILED_BACKING_STORE)
+#if USE(UI_SIDE_COMPOSITING)
     virtual void setVisibleContentsRectForScaling(const WebCore::IntRect& visibleContentsRect, float scale);
     virtual void setVisibleContentsRectForPanning(const WebCore::IntRect& visibleContentsRect, const WebCore::FloatPoint&);
     virtual void paintToCurrentGLContext(const WebCore::TransformationMatrix&, float opacity, const WebCore::FloatRect&);
diff --git a/Source/WebKit2/UIProcess/GeolocationPermissionRequestManagerProxy.cpp b/Source/WebKit2/UIProcess/GeolocationPermissionRequestManagerProxy.cpp
index 38bbd6a16..71beaf5a5 100644
--- a/Source/WebKit2/UIProcess/GeolocationPermissionRequestManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/GeolocationPermissionRequestManagerProxy.cpp
@@ -63,7 +63,10 @@ void GeolocationPermissionRequestManagerProxy::didReceiveGeolocationPermissionDe
     if (it == m_pendingRequests.end())
         return;
 
+#if ENABLE(GEOLOCATION)
     m_page->process()->send(Messages::WebPage::DidReceiveGeolocationPermissionDecision(geolocationID, allowed), m_page->pageID());
+#endif
+
     m_pendingRequests.remove(it);
 }
 
diff --git a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
index 8dbfb1101..09c5589f3 100644
--- a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
+++ b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
@@ -31,10 +31,6 @@
 #include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
 
-#if PLATFORM(QT)
-class QLocalSocket;
-#endif
-
 namespace WebKit {
 
 class ProcessLauncher : public ThreadSafeRefCounted<ProcessLauncher> {
diff --git a/Source/WebKit2/UIProcess/LayerTreeHostProxy.cpp b/Source/WebKit2/UIProcess/LayerTreeHostProxy.cpp
new file mode 100644
index 000000000..e760a7dae
--- /dev/null
+++ b/Source/WebKit2/UIProcess/LayerTreeHostProxy.cpp
@@ -0,0 +1,143 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if USE(UI_SIDE_COMPOSITING)
+#include "LayerTreeHostProxy.h"
+
+#include "LayerTreeHostMessages.h"
+#include "UpdateInfo.h"
+#include "WebCoreArgumentCoders.h"
+#include "WebLayerTreeInfo.h"
+#include "WebLayerTreeRenderer.h"
+#include "WebPageProxy.h"
+#include "WebProcessProxy.h"
+
+namespace WebKit {
+
+using namespace WebCore;
+
+LayerTreeHostProxy::LayerTreeHostProxy(DrawingAreaProxy* drawingAreaProxy)
+    : m_drawingAreaProxy(drawingAreaProxy)
+    , m_renderer(adoptRef(new WebLayerTreeRenderer(this)))
+{
+}
+
+LayerTreeHostProxy::~LayerTreeHostProxy()
+{
+    m_renderer->detach();
+}
+
+void LayerTreeHostProxy::paintToCurrentGLContext(const WebCore::TransformationMatrix& matrix, float opacity, const WebCore::FloatRect& rect)
+{
+    m_renderer->syncRemoteContent();
+    m_renderer->paintToCurrentGLContext(matrix, opacity, rect);
+}
+
+void LayerTreeHostProxy::paintToGraphicsContext(BackingStore::PlatformGraphicsContext context)
+{
+    m_renderer->paintToGraphicsContext(context);
+}
+
+void LayerTreeHostProxy::updateViewport()
+{
+    m_drawingAreaProxy->updateViewport();
+}
+
+void LayerTreeHostProxy::dispatchUpdate(const Function<void()>& function)
+{
+    m_renderer->appendUpdate(function);
+    updateViewport();
+}
+
+void LayerTreeHostProxy::createTileForLayer(int layerID, int tileID, const WebKit::UpdateInfo& updateInfo)
+{
+    dispatchUpdate(bind(&WebLayerTreeRenderer::createTile, m_renderer.get(), layerID, tileID, updateInfo.updateScaleFactor));
+    updateTileForLayer(layerID, tileID, updateInfo);
+}
+
+void LayerTreeHostProxy::updateTileForLayer(int layerID, int tileID, const WebKit::UpdateInfo& updateInfo)
+{
+    ASSERT(updateInfo.updateRects.size() == 1);
+    IntRect sourceRect = updateInfo.updateRects.first();
+    IntRect targetRect = updateInfo.updateRectBounds;
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::create(updateInfo.bitmapHandle);
+    dispatchUpdate(bind(&WebLayerTreeRenderer::updateTile, m_renderer.get(), layerID, tileID, sourceRect, targetRect, bitmap));
+}
+
+void LayerTreeHostProxy::removeTileForLayer(int layerID, int tileID)
+{
+    dispatchUpdate(bind(&WebLayerTreeRenderer::removeTile, m_renderer.get(), layerID, tileID));
+}
+
+void LayerTreeHostProxy::deleteCompositingLayer(WebLayerID id)
+{
+    dispatchUpdate(bind(&WebLayerTreeRenderer::deleteLayer, m_renderer.get(), id));
+}
+
+void LayerTreeHostProxy::setRootCompositingLayer(WebLayerID id)
+{
+    dispatchUpdate(bind(&WebLayerTreeRenderer::setRootLayerID, m_renderer.get(), id));
+}
+
+void LayerTreeHostProxy::syncCompositingLayerState(const WebLayerInfo& info)
+{
+    dispatchUpdate(bind(&WebLayerTreeRenderer::syncLayerParameters, m_renderer.get(), info));
+}
+
+void LayerTreeHostProxy::didRenderFrame()
+{
+    dispatchUpdate(bind(&WebLayerTreeRenderer::flushLayerChanges, m_renderer.get()));
+}
+
+void LayerTreeHostProxy::createDirectlyCompositedImage(int64_t key, const WebKit::ShareableBitmap::Handle& handle)
+{
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::create(handle);
+    dispatchUpdate(bind(&WebLayerTreeRenderer::createImage, m_renderer.get(), key, bitmap));
+}
+
+void LayerTreeHostProxy::destroyDirectlyCompositedImage(int64_t key)
+{
+    dispatchUpdate(bind(&WebLayerTreeRenderer::destroyImage, m_renderer.get(), key));
+}
+
+void LayerTreeHostProxy::setVisibleContentsRectForPanning(const IntRect& rect, const FloatPoint& trajectoryVector)
+{
+    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::SetVisibleContentsRectForPanning(rect, trajectoryVector), m_drawingAreaProxy->page()->pageID());
+}
+
+void LayerTreeHostProxy::setVisibleContentsRectForScaling(const IntRect& rect, float scale)
+{
+    m_renderer->setVisibleContentsRectForScaling(rect, scale);
+    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::SetVisibleContentsRectForScaling(rect, scale), m_drawingAreaProxy->page()->pageID());
+}
+
+void LayerTreeHostProxy::renderNextFrame()
+{
+    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::RenderNextFrame(), m_drawingAreaProxy->page()->pageID());
+}
+
+void LayerTreeHostProxy::purgeBackingStores()
+{
+    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::PurgeBackingStores(), m_drawingAreaProxy->page()->pageID());
+}
+
+}
+#endif // USE(UI_SIDE_COMPOSITING)
diff --git a/Source/WebKit2/UIProcess/LayerTreeHostProxy.h b/Source/WebKit2/UIProcess/LayerTreeHostProxy.h
index 504c4e19e..f6c31d1bc 100644
--- a/Source/WebKit2/UIProcess/LayerTreeHostProxy.h
+++ b/Source/WebKit2/UIProcess/LayerTreeHostProxy.h
@@ -20,9 +20,10 @@
 #ifndef LayerTreeHostProxy_h
 #define LayerTreeHostProxy_h
 
+#if USE(UI_SIDE_COMPOSITING)
+
 #include "BackingStore.h"
 #include "DrawingAreaProxy.h"
-#include "MessageQueue.h"
 #include "Region.h"
 #include "WebLayerTreeInfo.h"
 #include <WebCore/GraphicsContext.h>
@@ -31,22 +32,18 @@
 #include <WebCore/IntSize.h>
 #include <WebCore/RunLoop.h>
 #include <WebCore/Timer.h>
+#include <wtf/Functional.h>
 #include <wtf/HashSet.h>
 
-#if USE(TEXTURE_MAPPER)
-#include "TextureMapper.h"
-#include "TextureMapperBackingStore.h"
-#endif
+class QSGNode;
 
 namespace WebKit {
 
-class LayerBackingStore;
 class WebLayerInfo;
+class WebLayerTreeRenderer;
 class WebLayerUpdateInfo;
 
-class LayerTreeMessageToRenderer;
-
-class LayerTreeHostProxy : public WebCore::GraphicsLayerClient {
+class LayerTreeHostProxy {
 public:
     LayerTreeHostProxy(DrawingAreaProxy*);
     virtual ~LayerTreeHostProxy();
@@ -54,14 +51,11 @@ public:
     void deleteCompositingLayer(WebLayerID);
     void setRootCompositingLayer(WebLayerID);
     void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
-    void paintToCurrentGLContext(const WebCore::TransformationMatrix&, float, const WebCore::FloatRect&);
+    void paintToCurrentGLContext(const WebCore::TransformationMatrix&, float opacity, const WebCore::FloatRect& clip);
     void paintToGraphicsContext(BackingStore::PlatformGraphicsContext);
     void purgeGLResources();
     void setVisibleContentsRectForScaling(const WebCore::IntRect&, float);
     void setVisibleContentsRectForPanning(const WebCore::IntRect&, const WebCore::FloatPoint&);
-#if USE(TILED_BACKING_STORE)
-    void syncRemoteContent();
-    void swapContentBuffers();
     void didRenderFrame();
     void createTileForLayer(int layerID, int tileID, const WebKit::UpdateInfo&);
     void updateTileForLayer(int layerID, int tileID, const WebKit::UpdateInfo&);
@@ -70,64 +64,19 @@ public:
     void destroyDirectlyCompositedImage(int64_t);
     void didReceiveLayerTreeHostProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
     void updateViewport();
-#endif
+    void renderNextFrame();
+    void purgeBackingStores();
+    WebLayerTreeRenderer* layerTreeRenderer() const { return m_renderer.get(); }
 
 protected:
-    PassOwnPtr<WebCore::GraphicsLayer> createLayer(WebLayerID);
-
-    WebCore::GraphicsLayer* layerByID(WebLayerID id) { return (id == InvalidWebLayerID) ? 0 : m_layers.get(id); }
-    WebCore::GraphicsLayer* rootLayer() { return m_rootLayer.get(); }
-
-    // Reimplementations from WebCore::GraphicsLayerClient.
-    virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double) { }
-    virtual void notifySyncRequired(const WebCore::GraphicsLayer*) { }
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const { return false; }
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const { return false; }
-    void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect&) { }
+    void dispatchUpdate(const Function<void()>&);
 
     DrawingAreaProxy* m_drawingAreaProxy;
-
-    typedef HashMap<WebLayerID, WebCore::GraphicsLayer*> LayerMap;
-    WebCore::IntRect m_visibleContentsRect;
-    float m_contentsScale;
-
-    MessageQueue<LayerTreeMessageToRenderer> m_messagesToRenderer;
-    void pushUpdateToQueue(PassOwnPtr<LayerTreeMessageToRenderer>);
-
-#if USE(TEXTURE_MAPPER)
-    OwnPtr<WebCore::TextureMapper> m_textureMapper;
-#endif
-
-#if PLATFORM(QT)
-    void scheduleWebViewUpdate();
-    void synchronizeViewport();
-    void deleteLayer(WebLayerID);
-    void setRootLayerID(WebLayerID);
-    void syncLayerParameters(const WebLayerInfo&);
-    void createTile(WebLayerID, int, float scale);
-    void removeTile(WebLayerID, int);
-    void updateTile(WebLayerID, int, const WebCore::IntRect&, const WebCore::IntRect&, ShareableBitmap*);
-    void createImage(int64_t, ShareableBitmap*);
-    void destroyImage(int64_t);
-    void assignImageToLayer(WebCore::GraphicsLayer*, int64_t imageID);
-    void flushLayerChanges();
-    void ensureRootLayer();
-    void ensureLayer(WebLayerID);
-    PassRefPtr<LayerBackingStore> getBackingStore(WebLayerID);
-    void swapBuffers();
-    void syncAnimations();
-#endif
-
-    OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
-    Vector<WebLayerID> m_layersToDelete;
-    HashMap<int64_t, RefPtr<WebCore::TextureMapperBackingStore> > m_directlyCompositedImages;
-    HashSet<RefPtr<LayerBackingStore> > m_backingStoresWithPendingBuffers;
-
-    LayerMap m_layers;
-    WebLayerID m_rootLayerID;
-    int m_id;
+    RefPtr<WebLayerTreeRenderer> m_renderer;
 };
 
 }
 
+#endif
+
 #endif // LayerTreeHostProxy_h
diff --git a/Source/WebKit2/UIProcess/Notifications/WebNotification.cpp b/Source/WebKit2/UIProcess/Notifications/WebNotification.cpp
index d6b209286..99ba0ede1 100644
--- a/Source/WebKit2/UIProcess/Notifications/WebNotification.cpp
+++ b/Source/WebKit2/UIProcess/Notifications/WebNotification.cpp
@@ -33,10 +33,11 @@
 
 namespace WebKit {
 
-WebNotification::WebNotification(const String& title, const String& body, const String& iconURL, const String& originString, uint64_t notificationID)
+WebNotification::WebNotification(const String& title, const String& body, const String& iconURL, const String& replaceID, const String& originString, uint64_t notificationID)
     : m_title(title)
     , m_body(body)
     , m_iconURL(iconURL)
+    , m_replaceID(replaceID)
     , m_origin(WebSecurityOrigin::createFromString(originString))
     , m_notificationID(notificationID)
 {
diff --git a/Source/WebKit2/UIProcess/Notifications/WebNotification.h b/Source/WebKit2/UIProcess/Notifications/WebNotification.h
index 4a6fc7e49..19bda4050 100644
--- a/Source/WebKit2/UIProcess/Notifications/WebNotification.h
+++ b/Source/WebKit2/UIProcess/Notifications/WebNotification.h
@@ -45,26 +45,28 @@ class WebNotification : public APIObject {
 public:
     static const Type APIType = TypeNotification;
     
-    static PassRefPtr<WebNotification> create(const String& title, const String& body, const String& iconURL, const String& originString, uint64_t notificationID)
+    static PassRefPtr<WebNotification> create(const String& title, const String& body, const String& iconURL, const String& replaceID, const String& originString, uint64_t notificationID)
     {
-        return adoptRef(new WebNotification(title, body, iconURL, originString, notificationID));
+        return adoptRef(new WebNotification(title, body, iconURL, replaceID, originString, notificationID));
     }
     
     const String& title() const { return m_title; }
     const String& body() const { return m_body; }
     const String& iconURL() const { return m_iconURL; }
+    const String& replaceID() const { return m_replaceID; }
     WebSecurityOrigin* origin() const { return m_origin.get(); }
     
     uint64_t notificationID() const { return m_notificationID; }
 
 private:
-    WebNotification(const String& title, const String& body, const String& iconURL, const String& originString, uint64_t notificationID);
+    WebNotification(const String& title, const String& body, const String& iconURL, const String& replaceID, const String& originString, uint64_t notificationID);
 
     virtual Type type() const { return APIType; }
     
     String m_title;
     String m_body;
     String m_iconURL;
+    String m_replaceID;
     RefPtr<WebSecurityOrigin> m_origin;
     uint64_t m_notificationID;
 };
diff --git a/Source/WebKit2/UIProcess/Notifications/WebNotificationManagerProxy.cpp b/Source/WebKit2/UIProcess/Notifications/WebNotificationManagerProxy.cpp
index 0c0850bee..27a889e26 100644
--- a/Source/WebKit2/UIProcess/Notifications/WebNotificationManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/Notifications/WebNotificationManagerProxy.cpp
@@ -77,12 +77,12 @@ void WebNotificationManagerProxy::didReceiveMessage(CoreIPC::Connection* connect
     didReceiveWebNotificationManagerProxyMessage(connection, messageID, arguments);
 }
 
-void WebNotificationManagerProxy::show(WebPageProxy* page, const String& title, const String& body, const String& iconURL, const String& originString, uint64_t notificationID)
+void WebNotificationManagerProxy::show(WebPageProxy* page, const String& title, const String& body, const String& iconURL, const String& replaceID, const String& originString, uint64_t notificationID)
 {
     if (!isNotificationIDValid(notificationID))
         return;
     
-    RefPtr<WebNotification> notification = WebNotification::create(title, body, iconURL, originString, notificationID);
+    RefPtr<WebNotification> notification = WebNotification::create(title, body, iconURL, replaceID, originString, notificationID);
     m_notifications.set(notificationID, notification);
     m_provider.show(page, notification.get());
 }
diff --git a/Source/WebKit2/UIProcess/Notifications/WebNotificationManagerProxy.h b/Source/WebKit2/UIProcess/Notifications/WebNotificationManagerProxy.h
index d62b9f28f..edfccc179 100644
--- a/Source/WebKit2/UIProcess/Notifications/WebNotificationManagerProxy.h
+++ b/Source/WebKit2/UIProcess/Notifications/WebNotificationManagerProxy.h
@@ -29,7 +29,7 @@
 #include "APIObject.h"
 #include "MessageID.h"
 #include "WebNotificationProvider.h"
-#include <WebCore/NotificationPresenter.h>
+#include <WebCore/NotificationClient.h>
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -60,7 +60,7 @@ public:
     void initializeProvider(const WKNotificationProvider*);
     void populateCopyOfNotificationPermissions(HashMap<String, bool>&);
 
-    void show(WebPageProxy*, const String& title, const String& body, const String& iconURL, const String& originString, uint64_t notificationID);
+    void show(WebPageProxy*, const String& title, const String& body, const String& iconURL, const String& replaceID, const String& originString, uint64_t notificationID);
 
     void providerDidShowNotification(uint64_t notificationID);
     void providerDidClickNotification(uint64_t notificationID);
diff --git a/Source/WebKit2/UIProcess/PageClient.h b/Source/WebKit2/UIProcess/PageClient.h
index 70ddf07fa..f06d8271f 100644
--- a/Source/WebKit2/UIProcess/PageClient.h
+++ b/Source/WebKit2/UIProcess/PageClient.h
@@ -93,7 +93,10 @@ public:
 
     // Return whether the view is in a window.
     virtual bool isViewInWindow() = 0;
-    
+
+    // Return the layer hosting mode for the view.
+    virtual LayerHostingMode viewLayerHostingMode() { return LayerHostingModeDefault; }
+
     virtual void processDidCrash() = 0;
     virtual void didRelaunchProcess() = 0;
     virtual void pageClosed() = 0;
@@ -165,6 +168,7 @@ public:
 #if USE(ACCELERATED_COMPOSITING)
     virtual void enterAcceleratedCompositingMode(const LayerTreeContext&) = 0;
     virtual void exitAcceleratedCompositingMode() = 0;
+    virtual void updateAcceleratedCompositingMode(const LayerTreeContext&) = 0;
 #endif
 
 #if PLATFORM(WIN)
diff --git a/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
index b072417fe..4e539beaa 100644
--- a/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
+++ b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
@@ -35,6 +35,10 @@
 #import <spawn.h>
 #import <wtf/text/CString.h>
 
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+#import <QuartzCore/CARemoteLayerServer.h>
+#endif
+
 @interface WKPlaceholderModalWindow : NSWindow 
 @end
 
@@ -116,7 +120,12 @@ void PluginProcessProxy::platformInitializePluginProcess(PluginProcessCreationPa
 {
 #if USE(ACCELERATED_COMPOSITING) && HAVE(HOSTED_CORE_ANIMATION)
     parameters.parentProcessName = [[NSProcessInfo processInfo] processName];
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    mach_port_t renderServerPort = [[CARemoteLayerServer sharedServer] serverPort];
+#else
     mach_port_t renderServerPort = WKInitializeRenderServer();
+#endif
+
     if (renderServerPort != MACH_PORT_NULL)
         parameters.acceleratedCompositingPort = CoreIPC::MachPort(renderServerPort, MACH_MSG_TYPE_COPY_SEND);
 #endif
diff --git a/Source/WebKit2/UIProcess/WebContext.h b/Source/WebKit2/UIProcess/WebContext.h
index 21f219149..c378725dc 100644
--- a/Source/WebKit2/UIProcess/WebContext.h
+++ b/Source/WebKit2/UIProcess/WebContext.h
@@ -224,7 +224,22 @@ private:
     void didGetSitesWithPluginData(const Vector<String>& sites, uint64_t callbackID);
     void didClearPluginSiteData(uint64_t callbackID);
 #endif
-    
+
+#if PLATFORM(MAC)
+    void getPasteboardTypes(const String& pasteboardName, Vector<String>& pasteboardTypes);
+    void getPasteboardPathnamesForType(const String& pasteboardName, const String& pasteboardType, Vector<String>& pathnames);
+    void getPasteboardStringForType(const String& pasteboardName, const String& pasteboardType, String&);
+    void getPasteboardBufferForType(const String& pasteboardName, const String& pasteboardType, SharedMemory::Handle&, uint64_t& size);
+    void pasteboardCopy(const String& fromPasteboard, const String& toPasteboard);
+    void getPasteboardChangeCount(const String& pasteboardName, uint64_t& changeCount);
+    void getPasteboardUniqueName(String& pasteboardName);
+    void getPasteboardColor(const String& pasteboardName, WebCore::Color&);
+    void setPasteboardTypes(const String& pasteboardName, const Vector<String>& pasteboardTypes);
+    void setPasteboardPathnamesForType(const String& pasteboardName, const String& pasteboardType, const Vector<String>& pathnames);
+    void setPasteboardStringForType(const String& pasteboardName, const String& pasteboardType, const String&);
+    void setPasteboardBufferForType(const String& pasteboardName, const String& pasteboardType, const SharedMemory::Handle&, uint64_t size);
+#endif
+
     void didGetWebCoreStatistics(const StatisticsData&, uint64_t callbackID);
         
     // Implemented in generated WebContextMessageReceiver.cpp
diff --git a/Source/WebKit2/UIProcess/WebContext.messages.in b/Source/WebKit2/UIProcess/WebContext.messages.in
index 954894f1e..4bc3ec7d4 100644
--- a/Source/WebKit2/UIProcess/WebContext.messages.in
+++ b/Source/WebKit2/UIProcess/WebContext.messages.in
@@ -42,4 +42,20 @@ messages -> WebContext {
 
     DidGetWebCoreStatistics(WebKit::StatisticsData statisticsData, uint64_t callbackID)
 
+#if PLATFORM(MAC)
+    # Pasteboard messages.
+    
+    GetPasteboardTypes(WTF::String pasteboardName) -> (Vector<WTF::String> types)
+    GetPasteboardPathnamesForType(WTF::String pasteboardName, WTF::String pasteboardType) -> (Vector<WTF::String> pathnames)
+    GetPasteboardStringForType(WTF::String pasteboardName, WTF::String pasteboardType) -> (WTF::String string)
+    GetPasteboardBufferForType(WTF::String pasteboardName, WTF::String pasteboardType) -> (WebKit::SharedMemory::Handle handle, uint64_t size)
+    PasteboardCopy(WTF::String fromPasteboard, WTF::String toPasteboard)
+    GetPasteboardChangeCount(WTF::String pasteboardName) -> (uint64_t changeCount)
+    GetPasteboardUniqueName() -> (WTF::String pasteboardName)
+    GetPasteboardColor(WTF::String pasteboardName) -> (WebCore::Color color)
+    SetPasteboardTypes(WTF::String pasteboardName, Vector<WTF::String> pasteboardTypes)
+    SetPasteboardPathnamesForType(WTF::String pasteboardName, WTF::String pasteboardType, Vector<WTF::String> pathnames)
+    SetPasteboardStringForType(WTF::String pasteboardName, WTF::String pasteboardType, WTF::String string)
+    SetPasteboardBufferForType(WTF::String pasteboardName, WTF::String pasteboardType, WebKit::SharedMemory::Handle handle, uint64_t size)
+#endif
 }
diff --git a/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp
index 729b62e9d..17c070b6d 100644
--- a/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp
@@ -84,19 +84,9 @@ void WebFullScreenManagerProxy::didExitFullScreen()
     m_page->process()->send(Messages::WebFullScreenManager::DidExitFullScreen(), m_page->pageID());
 }
 
-void WebFullScreenManagerProxy::beginEnterFullScreenAnimation(float duration)
+void WebFullScreenManagerProxy::setAnimatingFullScreen(bool animating)
 {
-    m_page->process()->send(Messages::WebFullScreenManager::BeginEnterFullScreenAnimation(duration), m_page->pageID());
-}
-
-void WebFullScreenManagerProxy::beginExitFullScreenAnimation(float duration)
-{
-    m_page->process()->send(Messages::WebFullScreenManager::BeginExitFullScreenAnimation(duration), m_page->pageID());
-}
-
-void WebFullScreenManagerProxy::disposeOfLayerClient()
-{
-    m_page->process()->send(Messages::WebFullScreenManager::DisposeOfLayerClient(), m_page->pageID());
+    m_page->process()->send(Messages::WebFullScreenManager::SetAnimatingFullScreen(animating), m_page->pageID());
 }
 
 void WebFullScreenManagerProxy::supportsFullScreen(bool withKeyboard, bool& supports)
diff --git a/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.h b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.h
index 1a1c94c93..c947f1652 100644
--- a/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.h
+++ b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.h
@@ -80,9 +80,7 @@ public:
     void didEnterFullScreen();
     void willExitFullScreen();
     void didExitFullScreen();
-    void beginEnterFullScreenAnimation(float duration);
-    void beginExitFullScreenAnimation(float duration);
-    void disposeOfLayerClient();
+    void setAnimatingFullScreen(bool);
 
 private:
     WebFullScreenManagerProxy(WebPageProxy*);
@@ -90,13 +88,8 @@ private:
     void supportsFullScreen(bool withKeyboard, bool&);
     void enterFullScreen();
     void exitFullScreen();
-    void beganEnterFullScreenAnimation();
-    void finishedEnterFullScreenAnimation(bool completed);
-    void beganExitFullScreenAnimation();
-    void finishedExitFullScreenAnimation(bool completed);
-    void enterAcceleratedCompositingMode(const LayerTreeContext&);
-    void exitAcceleratedCompositingMode();
-    void getFullScreenRect(WebCore::IntRect&);
+    void beganEnterFullScreen(const WebCore::IntRect& initialFrame, const WebCore::IntRect& finalFrame);
+    void beganExitFullScreen(const WebCore::IntRect& initialFrame, const WebCore::IntRect& finalFrame);
 
     WebPageProxy* m_page;
     PlatformWebView* m_webView;
diff --git a/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.messages.in b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.messages.in
index 007e30916..c52cea92e 100644
--- a/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.messages.in
@@ -25,14 +25,7 @@ messages -> WebFullScreenManagerProxy {
     SupportsFullScreen(bool withKeyboard) -> (bool supportsFullScreen)
     EnterFullScreen()
     ExitFullScreen()
-    BeganEnterFullScreenAnimation()
-    FinishedEnterFullScreenAnimation(bool completed)
-    BeganExitFullScreenAnimation()
-    FinishedExitFullScreenAnimation(bool completed)
-    GetFullScreenRect() -> (WebCore::IntRect rect)
-#if USE(ACCELERATED_COMPOSITING)
-    EnterAcceleratedCompositingMode(WebKit::LayerTreeContext context)
-    ExitAcceleratedCompositingMode()
-#endif
+    BeganEnterFullScreen(WebCore::IntRect initialRect, WebCore::IntRect finalRect)
+    BeganExitFullScreen(WebCore::IntRect initialRect, WebCore::IntRect finalRect)
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/WebInspectorProxy.cpp b/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
index 6da04a9cb..6bf7a6bd9 100644
--- a/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
@@ -100,6 +100,14 @@ void WebInspectorProxy::invalidate()
 }
 
 // Public APIs
+bool WebInspectorProxy::isFront()
+{
+    if (!m_page)
+        return false;
+
+    return platformIsFront();
+}
+
 void WebInspectorProxy::show()
 {
     if (!m_page)
diff --git a/Source/WebKit2/UIProcess/WebInspectorProxy.h b/Source/WebKit2/UIProcess/WebInspectorProxy.h
index aebb6f9b9..884b66621 100644
--- a/Source/WebKit2/UIProcess/WebInspectorProxy.h
+++ b/Source/WebKit2/UIProcess/WebInspectorProxy.h
@@ -80,6 +80,8 @@ public:
     WebPageProxy* page() const { return m_page; }
 
     bool isVisible() const { return m_isVisible; }
+    bool isFront();
+
     void show();
     void close();
     
@@ -126,6 +128,7 @@ private:
     void platformOpen();
     void platformDidClose();
     void platformBringToFront();
+    bool platformIsFront();
     void platformInspectedURLChanged(const String&);
     unsigned platformInspectedWindowHeight();
     void platformAttach();
diff --git a/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp b/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp
new file mode 100644
index 000000000..f2c049592
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp
@@ -0,0 +1,410 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if USE(UI_SIDE_COMPOSITING)
+
+#include "WebLayerTreeRenderer.h"
+
+#include "GraphicsLayerTextureMapper.h"
+#include "LayerBackingStore.h"
+#include "LayerTreeHostProxy.h"
+#include "MainThread.h"
+#include "MessageID.h"
+#include "ShareableBitmap.h"
+#include "TextureMapper.h"
+#include "TextureMapperBackingStore.h"
+#include "TextureMapperLayer.h"
+#include "UpdateInfo.h"
+#include <OpenGLShims.h>
+#include <wtf/Atomics.h>
+
+namespace WebKit {
+
+using namespace WebCore;
+
+template<class T> class MainThreadGuardedInvoker {
+public:
+    static void call(PassRefPtr<T> objectToGuard, const Function<void()>& function)
+    {
+        MainThreadGuardedInvoker<T>* invoker = new MainThreadGuardedInvoker<T>(objectToGuard, function);
+        callOnMainThread(invoke, invoker);
+    }
+
+private:
+    MainThreadGuardedInvoker(PassRefPtr<T> object, const Function<void()>& newFunction)
+        : objectToGuard(object)
+        , function(newFunction)
+    {
+    }
+
+    RefPtr<T> objectToGuard;
+    Function<void()> function;
+    static void invoke(void* data)
+    {
+        MainThreadGuardedInvoker<T>* invoker = static_cast<MainThreadGuardedInvoker<T>*>(data);
+        invoker->function();
+        delete invoker;
+    }
+};
+
+void WebLayerTreeRenderer::callOnMainTread(const Function<void()>& function)
+{
+    if (isMainThread())
+        function();
+    else
+        MainThreadGuardedInvoker<WebLayerTreeRenderer>::call(this, function);
+}
+
+WebLayerTreeRenderer::WebLayerTreeRenderer(LayerTreeHostProxy* layerTreeHostProxy)
+    : m_layerTreeHostProxy(layerTreeHostProxy)
+    , m_rootLayerID(0)
+{
+}
+
+WebLayerTreeRenderer::~WebLayerTreeRenderer()
+{
+}
+
+PassOwnPtr<GraphicsLayer> WebLayerTreeRenderer::createLayer(WebLayerID layerID)
+{
+    GraphicsLayer* newLayer = new GraphicsLayerTextureMapper(this);
+    TextureMapperLayer* layer = toTextureMapperLayer(newLayer);
+    layer->setShouldUpdateBackingStoreFromLayer(false);
+    return adoptPtr(newLayer);
+}
+
+void WebLayerTreeRenderer::paintToCurrentGLContext(const TransformationMatrix& matrix, float opacity, const FloatRect& clipRect)
+{
+    if (!m_textureMapper)
+        m_textureMapper = TextureMapper::create(TextureMapper::OpenGLMode);
+    ASSERT(m_textureMapper->accelerationMode() == TextureMapper::OpenGLMode);
+
+    syncRemoteContent();
+    GraphicsLayer* currentRootLayer = rootLayer();
+    if (!currentRootLayer)
+        return;
+
+    TextureMapperLayer* layer = toTextureMapperLayer(currentRootLayer);
+
+    if (!layer)
+        return;
+
+    layer->setTextureMapper(m_textureMapper.get());
+    m_textureMapper->beginPainting();
+    m_textureMapper->bindSurface(0);
+    m_textureMapper->beginClip(TransformationMatrix(), clipRect);
+
+    if (currentRootLayer->opacity() != opacity || currentRootLayer->transform() != matrix) {
+        currentRootLayer->setOpacity(opacity);
+        currentRootLayer->setTransform(matrix);
+        currentRootLayer->syncCompositingStateForThisLayerOnly();
+    }
+
+    layer->paint();
+    m_textureMapper->endClip();
+    m_textureMapper->endPainting();
+
+    syncAnimations();
+}
+
+void WebLayerTreeRenderer::syncAnimations()
+{
+    TextureMapperLayer* layer = toTextureMapperLayer(rootLayer());
+    ASSERT(layer);
+
+    layer->syncAnimationsRecursively();
+    if (layer->descendantsOrSelfHaveRunningAnimations())
+        callOnMainThread(bind(&WebLayerTreeRenderer::updateViewport, this));
+}
+
+void WebLayerTreeRenderer::paintToGraphicsContext(QPainter* painter)
+{
+    if (!m_textureMapper)
+        m_textureMapper = TextureMapper::create();
+    ASSERT(m_textureMapper->accelerationMode() == TextureMapper::SoftwareMode);
+    syncRemoteContent();
+    TextureMapperLayer* layer = toTextureMapperLayer(rootLayer());
+
+    if (!layer)
+        return;
+
+    GraphicsContext graphicsContext(painter);
+    m_textureMapper->setGraphicsContext(&graphicsContext);
+    m_textureMapper->beginPainting();
+    m_textureMapper->bindSurface(0);
+    layer->paint();
+    m_textureMapper->endPainting();
+    m_textureMapper->setGraphicsContext(0);
+}
+
+void WebLayerTreeRenderer::setVisibleContentsRectForScaling(const IntRect& rect, float scale)
+{
+    m_visibleContentsRect = rect;
+    m_contentsScale = scale;
+}
+
+void WebLayerTreeRenderer::updateViewport()
+{
+    if (m_layerTreeHostProxy)
+        m_layerTreeHostProxy->updateViewport();
+}
+
+void WebLayerTreeRenderer::syncLayerParameters(const WebLayerInfo& layerInfo)
+{
+    WebLayerID id = layerInfo.id;
+    ensureLayer(id);
+    LayerMap::iterator it = m_layers.find(id);
+    GraphicsLayer* layer = it->second;
+    bool needsToUpdateImageTiles = layerInfo.imageIsUpdated || (layerInfo.contentsRect != layer->contentsRect() && layerInfo.imageBackingStoreID);
+
+    layer->setName(layerInfo.name);
+
+    layer->setReplicatedByLayer(layerByID(layerInfo.replica));
+    layer->setMaskLayer(layerByID(layerInfo.mask));
+
+    layer->setPosition(layerInfo.pos);
+    layer->setSize(layerInfo.size);
+    layer->setTransform(layerInfo.transform);
+    layer->setAnchorPoint(layerInfo.anchorPoint);
+    layer->setChildrenTransform(layerInfo.childrenTransform);
+    layer->setBackfaceVisibility(layerInfo.backfaceVisible);
+    layer->setContentsOpaque(layerInfo.contentsOpaque);
+    layer->setContentsRect(layerInfo.contentsRect);
+    layer->setDrawsContent(layerInfo.drawsContent);
+
+    if (needsToUpdateImageTiles)
+        assignImageToLayer(layer, layerInfo.imageBackingStoreID);
+
+    // Never make the root layer clip.
+    layer->setMasksToBounds(layerInfo.isRootLayer ? false : layerInfo.masksToBounds);
+    layer->setOpacity(layerInfo.opacity);
+    layer->setPreserves3D(layerInfo.preserves3D);
+    Vector<GraphicsLayer*> children;
+
+    for (size_t i = 0; i < layerInfo.children.size(); ++i) {
+        WebLayerID childID = layerInfo.children[i];
+        GraphicsLayer* child = layerByID(childID);
+        if (!child) {
+            child = createLayer(childID).leakPtr();
+            m_layers.add(childID, child);
+        }
+        children.append(child);
+    }
+    layer->setChildren(children);
+
+    for (size_t i = 0; i < layerInfo.animations.size(); ++i) {
+        const WebKit::WebLayerAnimation anim = layerInfo.animations[i];
+
+        switch (anim.operation) {
+        case WebKit::WebLayerAnimation::AddAnimation: {
+            const IntSize boxSize = anim.boxSize;
+            layer->addAnimation(anim.keyframeList, boxSize, anim.animation.get(), anim.name, anim.startTime);
+            break;
+        }
+        case WebKit::WebLayerAnimation::RemoveAnimation:
+            layer->removeAnimation(anim.name);
+            break;
+        case WebKit::WebLayerAnimation::PauseAnimation:
+            double offset = WTF::currentTime() - anim.startTime;
+            layer->pauseAnimation(anim.name, offset);
+            break;
+        }
+    }
+
+    if (layerInfo.isRootLayer && m_rootLayerID != id)
+        setRootLayerID(id);
+}
+
+void WebLayerTreeRenderer::deleteLayer(WebLayerID layerID)
+{
+    GraphicsLayer* layer = layerByID(layerID);
+    if (!layer)
+        return;
+
+    layer->removeFromParent();
+    m_layers.remove(layerID);
+    delete layer;
+}
+
+
+void WebLayerTreeRenderer::ensureLayer(WebLayerID id)
+{
+    // We have to leak the new layer's pointer and manage it ourselves,
+    // because OwnPtr is not copyable.
+    if (m_layers.find(id) == m_layers.end())
+        m_layers.add(id, createLayer(id).leakPtr());
+}
+
+void WebLayerTreeRenderer::setRootLayerID(WebLayerID layerID)
+{
+    if (layerID == m_rootLayerID)
+        return;
+
+    m_rootLayerID = layerID;
+
+    m_rootLayer->removeAllChildren();
+
+    if (!layerID)
+        return;
+
+    GraphicsLayer* layer = layerByID(layerID);
+    if (!layer)
+        return;
+
+    m_rootLayer->addChild(layer);
+}
+
+PassRefPtr<LayerBackingStore> WebLayerTreeRenderer::getBackingStore(WebLayerID id)
+{
+    ensureLayer(id);
+    TextureMapperLayer* layer = toTextureMapperLayer(layerByID(id));
+    RefPtr<LayerBackingStore> backingStore = static_cast<LayerBackingStore*>(layer->backingStore().get());
+    if (!backingStore) {
+        backingStore = LayerBackingStore::create();
+        layer->setBackingStore(backingStore.get());
+    }
+    ASSERT(backingStore);
+    return backingStore;
+}
+
+void WebLayerTreeRenderer::createTile(WebLayerID layerID, int tileID, float scale)
+{
+    getBackingStore(layerID)->createTile(tileID, scale);
+}
+
+void WebLayerTreeRenderer::removeTile(WebLayerID layerID, int tileID)
+{
+    getBackingStore(layerID)->removeTile(tileID);
+}
+
+void WebLayerTreeRenderer::updateTile(WebLayerID layerID, int tileID, const IntRect& sourceRect, const IntRect& targetRect, PassRefPtr<ShareableBitmap> weakBitmap)
+{
+    RefPtr<ShareableBitmap> bitmap = weakBitmap;
+    RefPtr<LayerBackingStore> backingStore = getBackingStore(layerID);
+    backingStore->updateTile(tileID, sourceRect, targetRect, bitmap.get());
+    m_backingStoresWithPendingBuffers.add(backingStore);
+}
+
+void WebLayerTreeRenderer::createImage(int64_t imageID, PassRefPtr<ShareableBitmap> weakBitmap)
+{
+    RefPtr<ShareableBitmap> bitmap = weakBitmap;
+    RefPtr<TextureMapperTiledBackingStore> backingStore = TextureMapperTiledBackingStore::create();
+    backingStore->updateContents(m_textureMapper.get(), bitmap->createImage().get(), BitmapTexture::BGRAFormat);
+    m_directlyCompositedImages.set(imageID, backingStore);
+}
+
+void WebLayerTreeRenderer::destroyImage(int64_t imageID)
+{
+    m_directlyCompositedImages.remove(imageID);
+}
+
+void WebLayerTreeRenderer::assignImageToLayer(GraphicsLayer* layer, int64_t imageID)
+{
+    HashMap<int64_t, RefPtr<TextureMapperBackingStore> >::iterator it = m_directlyCompositedImages.find(imageID);
+    ASSERT(it != m_directlyCompositedImages.end());
+    layer->setContentsToMedia(it->second.get());
+}
+
+void WebLayerTreeRenderer::swapBuffers()
+{
+    HashSet<RefPtr<LayerBackingStore> >::iterator end = m_backingStoresWithPendingBuffers.end();
+    for (HashSet<RefPtr<LayerBackingStore> >::iterator it = m_backingStoresWithPendingBuffers.begin(); it != end; ++it)
+        (*it)->swapBuffers(m_textureMapper.get());
+
+    m_backingStoresWithPendingBuffers.clear();
+}
+
+void WebLayerTreeRenderer::flushLayerChanges()
+{
+    m_rootLayer->syncCompositingState(FloatRect());
+    swapBuffers();
+
+    // The pending tiles state is on its way for the screen, tell the web process to render the next one.
+    callOnMainThread(bind(&WebLayerTreeRenderer::renderNextFrame, this));
+}
+
+void WebLayerTreeRenderer::renderNextFrame()
+{
+    if (m_layerTreeHostProxy)
+        m_layerTreeHostProxy->renderNextFrame();
+}
+
+void WebLayerTreeRenderer::ensureRootLayer()
+{
+    if (m_rootLayer)
+        return;
+    if (!m_textureMapper)
+        m_textureMapper = TextureMapper::create(TextureMapper::OpenGLMode);
+
+    m_rootLayer = createLayer(InvalidWebLayerID);
+    m_rootLayer->setMasksToBounds(false);
+    m_rootLayer->setDrawsContent(false);
+    m_rootLayer->setAnchorPoint(FloatPoint3D(0, 0, 0));
+
+    // The root layer should not have zero size, or it would be optimized out.
+    m_rootLayer->setSize(FloatSize(1.0, 1.0));
+    toTextureMapperLayer(m_rootLayer.get())->setTextureMapper(m_textureMapper.get());
+}
+
+void WebLayerTreeRenderer::syncRemoteContent()
+{
+    // We enqueue messages and execute them during paint, as they require an active GL context.
+    ensureRootLayer();
+
+    for (size_t i = 0; i < m_renderQueue.size(); ++i)
+        m_renderQueue[i]();
+
+    m_renderQueue.clear();
+}
+
+void WebLayerTreeRenderer::purgeGLResources()
+{
+    TextureMapperLayer* layer = toTextureMapperLayer(rootLayer());
+
+    if (layer)
+        layer->clearBackingStoresRecursive();
+
+    m_directlyCompositedImages.clear();
+    m_textureMapper.clear();
+    m_backingStoresWithPendingBuffers.clear();
+
+    callOnMainThread(bind(&WebLayerTreeRenderer::purgeBackingStores, this));
+}
+
+void WebLayerTreeRenderer::purgeBackingStores()
+{
+    if (m_layerTreeHostProxy)
+        m_layerTreeHostProxy->purgeBackingStores();
+}
+
+void WebLayerTreeRenderer::detach()
+{
+    m_layerTreeHostProxy = 0;
+}
+
+void WebLayerTreeRenderer::appendUpdate(const Function<void()>& function)
+{
+    m_renderQueue.append(function);
+}
+
+} // namespace WebKit
+
+#endif // USE(UI_SIDE_COMPOSITING)
diff --git a/Source/WebKit2/UIProcess/WebLayerTreeRenderer.h b/Source/WebKit2/UIProcess/WebLayerTreeRenderer.h
new file mode 100644
index 000000000..6c788652a
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebLayerTreeRenderer.h
@@ -0,0 +1,122 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef WebLayerTreeRenderer_h
+#define WebLayerTreeRenderer_h
+
+#if USE(UI_SIDE_COMPOSITING)
+
+#include "BackingStore.h"
+#include "TextureMapper.h"
+#include "TextureMapperBackingStore.h"
+#include "WebLayerTreeInfo.h"
+#include <WebCore/GraphicsContext.h>
+#include <WebCore/GraphicsLayer.h>
+#include <WebCore/IntRect.h>
+#include <WebCore/IntSize.h>
+#include <WebCore/RunLoop.h>
+#include <WebCore/Timer.h>
+#include <wtf/Functional.h>
+#include <wtf/HashSet.h>
+#include <wtf/ThreadingPrimitives.h>
+
+namespace WebKit {
+
+class LayerBackingStore;
+class LayerTreeHostProxy;
+class WebLayerInfo;
+class WebLayerUpdateInfo;
+
+class WebLayerTreeRenderer : public ThreadSafeRefCounted<WebLayerTreeRenderer>, public WebCore::GraphicsLayerClient {
+public:
+    WebLayerTreeRenderer(LayerTreeHostProxy*);
+    virtual ~WebLayerTreeRenderer();
+    void purgeGLResources();
+    void paintToCurrentGLContext(const WebCore::TransformationMatrix&, float, const WebCore::FloatRect&);
+    void paintToGraphicsContext(BackingStore::PlatformGraphicsContext);
+    void syncRemoteContent();
+    void setVisibleContentsRectForScaling(const WebCore::IntRect&, float);
+
+    void detach();
+    void appendUpdate(const Function<void()>&);
+    void updateViewport();
+
+    void deleteLayer(WebLayerID);
+    void setRootLayerID(WebLayerID);
+    void syncLayerParameters(const WebLayerInfo&);
+    void createTile(WebLayerID, int, float scale);
+    void removeTile(WebLayerID, int);
+    void updateTile(WebLayerID, int, const WebCore::IntRect&, const WebCore::IntRect&, PassRefPtr<ShareableBitmap>);
+    void flushLayerChanges();
+    void createImage(int64_t, PassRefPtr<ShareableBitmap>);
+    void destroyImage(int64_t);
+
+private:
+    PassOwnPtr<WebCore::GraphicsLayer> createLayer(WebLayerID);
+
+    WebCore::GraphicsLayer* layerByID(WebLayerID id) { return (id == InvalidWebLayerID) ? 0 : m_layers.get(id); }
+    WebCore::GraphicsLayer* rootLayer() { return m_rootLayer.get(); }
+
+    // Reimplementations from WebCore::GraphicsLayerClient.
+    virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double) { }
+    virtual void notifySyncRequired(const WebCore::GraphicsLayer*) { }
+    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const { return false; }
+    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const { return false; }
+    void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect&) { }
+    void callOnMainTread(const Function<void()>&);
+
+    typedef HashMap<WebLayerID, WebCore::GraphicsLayer*> LayerMap;
+    WebCore::IntRect m_visibleContentsRect;
+    float m_contentsScale;
+
+    // Render queue can be accessed ony from main thread or updatePaintNode call stack!
+    Vector<Function<void()> > m_renderQueue;
+
+#if USE(TEXTURE_MAPPER)
+    OwnPtr<WebCore::TextureMapper> m_textureMapper;
+    PassRefPtr<LayerBackingStore> getBackingStore(WebLayerID);
+    HashMap<int64_t, RefPtr<WebCore::TextureMapperBackingStore> > m_directlyCompositedImages;
+    HashSet<RefPtr<LayerBackingStore> > m_backingStoresWithPendingBuffers;
+#endif
+
+    void scheduleWebViewUpdate();
+    void synchronizeViewport();
+    void assignImageToLayer(WebCore::GraphicsLayer*, int64_t imageID);
+    void ensureRootLayer();
+    void ensureLayer(WebLayerID);
+    void swapBuffers();
+    void syncAnimations();
+    void renderNextFrame();
+    void purgeBackingStores();
+
+    LayerTreeHostProxy* m_layerTreeHostProxy;
+    OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
+    Vector<WebLayerID> m_layersToDelete;
+
+    LayerMap m_layers;
+    WebLayerID m_rootLayerID;
+};
+
+};
+
+#endif // USE(UI_SIDE_COMPOSITING)
+
+#endif // WebLayerTreeRenderer_h
+
+
diff --git a/Source/WebKit2/UIProcess/WebPageContextMenuClient.cpp b/Source/WebKit2/UIProcess/WebPageContextMenuClient.cpp
index 897511cc5..3f7d0289f 100644
--- a/Source/WebKit2/UIProcess/WebPageContextMenuClient.cpp
+++ b/Source/WebKit2/UIProcess/WebPageContextMenuClient.cpp
@@ -34,11 +34,14 @@
 
 namespace WebKit {
 
-bool WebPageContextMenuClient::getContextMenuFromProposedMenu(WebPageProxy* page, const Vector<WebContextMenuItemData>& proposedMenuVector, Vector<WebContextMenuItemData>& customMenu, APIObject* userData)
+bool WebPageContextMenuClient::getContextMenuFromProposedMenu(WebPageProxy* page, const Vector<WebContextMenuItemData>& proposedMenuVector, Vector<WebContextMenuItemData>& customMenu, const WebHitTestResult::Data& hitTestResultData, APIObject* userData)
 {
-    if (!m_client.getContextMenuFromProposedMenu)
+    if (!m_client.getContextMenuFromProposedMenu && !m_client.getContextMenuFromProposedMenu_deprecatedForUseWithV0)
         return false;
-        
+
+    if (m_client.version == kWKPageContextMenuClientCurrentVersion && !m_client.getContextMenuFromProposedMenu)
+        return false;
+
     unsigned size = proposedMenuVector.size();
     RefPtr<MutableArray> proposedMenu = MutableArray::create();
     proposedMenu->reserveCapacity(size);
@@ -46,7 +49,12 @@ bool WebPageContextMenuClient::getContextMenuFromProposedMenu(WebPageProxy* page
         proposedMenu->append(WebContextMenuItem::create(proposedMenuVector[i]).get());
         
     WKArrayRef newMenu = 0;
-    m_client.getContextMenuFromProposedMenu(toAPI(page), toAPI(proposedMenu.get()), &newMenu, toAPI(userData), m_client.clientInfo);
+    if (m_client.version == kWKPageContextMenuClientCurrentVersion) {
+        RefPtr<WebHitTestResult> webHitTestResult = WebHitTestResult::create(hitTestResultData);
+        m_client.getContextMenuFromProposedMenu(toAPI(page), toAPI(proposedMenu.get()), &newMenu, toAPI(webHitTestResult.get()), toAPI(userData), m_client.clientInfo);
+    } else
+        m_client.getContextMenuFromProposedMenu_deprecatedForUseWithV0(toAPI(page), toAPI(proposedMenu.get()), &newMenu, toAPI(userData), m_client.clientInfo);
+
     RefPtr<ImmutableArray> array = adoptRef(toImpl(newMenu));
     
     customMenu.clear();
diff --git a/Source/WebKit2/UIProcess/WebPageContextMenuClient.h b/Source/WebKit2/UIProcess/WebPageContextMenuClient.h
index 5cbb335d9..9e738bba4 100644
--- a/Source/WebKit2/UIProcess/WebPageContextMenuClient.h
+++ b/Source/WebKit2/UIProcess/WebPageContextMenuClient.h
@@ -27,6 +27,7 @@
 #define WebPageContextMenuClient_h
 
 #include "APIClient.h"
+#include "WebHitTestResult.h"
 #include "WKPage.h"
 #include <wtf/Vector.h>
 
@@ -38,7 +39,7 @@ class WebPageProxy;
 
 class WebPageContextMenuClient : public APIClient<WKPageContextMenuClient, kWKPageContextMenuClientCurrentVersion> {
 public:
-    bool getContextMenuFromProposedMenu(WebPageProxy*, const Vector<WebContextMenuItemData>& proposedMenu, Vector<WebContextMenuItemData>& customMenu, APIObject* userData);
+    bool getContextMenuFromProposedMenu(WebPageProxy*, const Vector<WebContextMenuItemData>& proposedMenu, Vector<WebContextMenuItemData>& customMenu, const WebHitTestResult::Data&, APIObject* userData);
     void customContextMenuItemSelected(WebPageProxy*, const WebContextMenuItemData&);
     void contextMenuDismissed(WebPageProxy*);
 };
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.cpp b/Source/WebKit2/UIProcess/WebPageProxy.cpp
index 8ea3fe4a1..40973449a 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebPageProxy.cpp
@@ -85,7 +85,7 @@
 #include <WebCore/WindowFeatures.h>
 #include <stdio.h>
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(UI_SIDE_COMPOSITING)
 #include "LayerTreeHostProxyMessages.h"
 #endif
 
@@ -161,6 +161,7 @@ WebPageProxy::WebPageProxy(PageClient* pageClient, PassRefPtr<WebProcessProxy> p
     , m_pageScaleFactor(1)
     , m_intrinsicDeviceScaleFactor(1)
     , m_customDeviceScaleFactor(0)
+    , m_layerHostingMode(LayerHostingModeDefault)
     , m_drawsBackground(true)
     , m_drawsTransparentBackground(false)
     , m_areMemoryCacheClientCallsEnabled(true)
@@ -186,6 +187,7 @@ WebPageProxy::WebPageProxy(PageClient* pageClient, PassRefPtr<WebProcessProxy> p
     , m_needTouchEvents(false)
 #endif
     , m_pageID(pageID)
+    , m_isPageSuspended(false)
 #if PLATFORM(MAC)
     , m_isSmartInsertDeleteEnabled(TextChecker::isSmartInsertDeleteEnabled())
 #endif
@@ -372,7 +374,10 @@ void WebPageProxy::close()
         m_openPanelResultListener = 0;
     }
 
+#if ENABLE(GEOLOCATION)
     m_geolocationPermissionRequestManager.invalidateRequests();
+#endif
+
     m_notificationPermissionRequestManager.invalidateRequests();
 
     m_toolTip = String();
@@ -759,6 +764,12 @@ void WebPageProxy::viewStateDidChange(ViewStateFlags flags)
             m_isInWindow = isInWindow;
             process()->send(Messages::WebPage::SetIsInWindow(isInWindow), m_pageID);
         }
+
+        LayerHostingMode layerHostingMode = m_pageClient->viewLayerHostingMode();
+        if (m_layerHostingMode != layerHostingMode) {
+            m_layerHostingMode = layerHostingMode;
+            m_drawingArea->layerHostingModeDidChange();
+        }
     }
 
     updateBackingStoreDiscardableState();
@@ -999,7 +1010,10 @@ void WebPageProxy::handleTouchEvent(const NativeWebTouchEvent& event)
     if (!isValid())
         return;
 
-    if (m_needTouchEvents) {
+    // If the page is suspended, which should be the case during panning, pinching
+    // and animation on the page itself (kinetic scrolling, tap to zoom) etc, then
+    // we do not send any of the events to the page even if is has listeners.
+    if (m_needTouchEvents && !m_isPageSuspended) {
         m_touchEventQueue.append(event);
         process()->responsivenessTimer()->start();
         if (m_shouldSendEventsSynchronously) {
@@ -1126,6 +1140,26 @@ void WebPageProxy::setCustomUserAgent(const String& customUserAgent)
     setUserAgent(m_customUserAgent);
 }
 
+void WebPageProxy::resumeActiveDOMObjectsAndAnimations()
+{
+    if (!isValid() || !m_isPageSuspended)
+        return;
+
+    m_isPageSuspended = false;
+
+    process()->send(Messages::WebPage::ResumeActiveDOMObjectsAndAnimations(), m_pageID);
+}
+
+void WebPageProxy::suspendActiveDOMObjectsAndAnimations()
+{
+    if (!isValid() || m_isPageSuspended)
+        return;
+
+    m_isPageSuspended = true;
+
+    process()->send(Messages::WebPage::SuspendActiveDOMObjectsAndAnimations(), m_pageID);
+}
+
 bool WebPageProxy::supportsTextEncoding() const
 {
     return !m_mainFrameHasCustomRepresentation && m_mainFrame && !m_mainFrame->isDisplayingStandaloneImageDocument();
@@ -1542,7 +1576,7 @@ void WebPageProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::M
         return;
     }
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER) && USE(TILED_BACKING_STORE)
+#if USE(UI_SIDE_COMPOSITING)
     if (messageID.is<CoreIPC::MessageClassLayerTreeHostProxy>()) {
         m_drawingArea->didReceiveLayerTreeHostProxyMessage(connection, messageID, arguments);
         return;
@@ -2604,22 +2638,22 @@ void WebPageProxy::hidePopupMenu()
     m_activePopupMenu = 0;
 }
 
-void WebPageProxy::showContextMenu(const IntPoint& menuLocation, const ContextMenuState& contextMenuState, const Vector<WebContextMenuItemData>& proposedItems, CoreIPC::ArgumentDecoder* arguments)
+void WebPageProxy::showContextMenu(const IntPoint& menuLocation, const WebHitTestResult::Data& hitTestResultData, const Vector<WebContextMenuItemData>& proposedItems, CoreIPC::ArgumentDecoder* arguments)
 {
-    internalShowContextMenu(menuLocation, contextMenuState, proposedItems, arguments);
+    internalShowContextMenu(menuLocation, hitTestResultData, proposedItems, arguments);
     
     // No matter the result of internalShowContextMenu, always notify the WebProcess that the menu is hidden so it starts handling mouse events again.
     process()->send(Messages::WebPage::ContextMenuHidden(), m_pageID);
 }
 
-void WebPageProxy::internalShowContextMenu(const IntPoint& menuLocation, const ContextMenuState& contextMenuState, const Vector<WebContextMenuItemData>& proposedItems, CoreIPC::ArgumentDecoder* arguments)
+void WebPageProxy::internalShowContextMenu(const IntPoint& menuLocation, const WebHitTestResult::Data& hitTestResultData, const Vector<WebContextMenuItemData>& proposedItems, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
     WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
-    m_activeContextMenuState = contextMenuState;
+    m_activeContextMenuHitTestResultData = hitTestResultData;
 
     if (m_activeContextMenu) {
         m_activeContextMenu->hideContextMenu();
@@ -2633,7 +2667,7 @@ void WebPageProxy::internalShowContextMenu(const IntPoint& menuLocation, const C
 
     // Give the PageContextMenuClient one last swipe at changing the menu.
     Vector<WebContextMenuItemData> items;
-    if (!m_contextMenuClient.getContextMenuFromProposedMenu(this, proposedItems, items, userData.get()))
+    if (!m_contextMenuClient.getContextMenuFromProposedMenu(this, proposedItems, items, hitTestResultData, userData.get()))
         m_activeContextMenu->showContextMenu(menuLocation, proposedItems);
     else
         m_activeContextMenu->showContextMenu(menuLocation, items);
@@ -2685,11 +2719,11 @@ void WebPageProxy::contextMenuItemSelected(const WebContextMenuItemData& item)
     }
 #endif
     if (item.action() == ContextMenuItemTagDownloadImageToDisk) {
-        m_process->context()->download(this, KURL(KURL(), m_activeContextMenuState.absoluteImageURLString));
+        m_process->context()->download(this, KURL(KURL(), m_activeContextMenuHitTestResultData.absoluteImageURL));
         return;    
     }
     if (item.action() == ContextMenuItemTagDownloadLinkToDisk) {
-        m_process->context()->download(this, KURL(KURL(), m_activeContextMenuState.absoluteLinkURLString));
+        m_process->context()->download(this, KURL(KURL(), m_activeContextMenuHitTestResultData.absoluteLinkURL));
         return;
     }
     if (item.action() == ContextMenuItemTagCheckSpellingWhileTyping) {
@@ -3191,6 +3225,7 @@ void WebPageProxy::processDidCrash()
     ASSERT(m_pageClient);
 
     m_isValid = false;
+    m_isPageSuspended = false;
 
     if (m_mainFrame) {
         m_urlAtProcessExit = m_mainFrame->url();
@@ -3219,7 +3254,10 @@ void WebPageProxy::processDidCrash()
         m_openPanelResultListener = nullptr;
     }
 
+#if ENABLE(GEOLOCATION)
     m_geolocationPermissionRequestManager.invalidateRequests();
+#endif
+
     m_notificationPermissionRequestManager.invalidateRequests();
 
     m_toolTip = String();
@@ -3335,6 +3373,11 @@ void WebPageProxy::exitAcceleratedCompositingMode()
 {
     m_pageClient->exitAcceleratedCompositingMode();
 }
+
+void WebPageProxy::updateAcceleratedCompositingMode(const LayerTreeContext& layerTreeContext)
+{
+    m_pageClient->updateAcceleratedCompositingMode(layerTreeContext);
+}
 #endif // USE(ACCELERATED_COMPOSITING)
 
 void WebPageProxy::backForwardClear()
@@ -3397,9 +3440,9 @@ void WebPageProxy::requestNotificationPermission(uint64_t requestID, const Strin
         request->deny();
 }
 
-void WebPageProxy::showNotification(const String& title, const String& body, const String& iconURL, const String& originString, uint64_t notificationID)
+void WebPageProxy::showNotification(const String& title, const String& body, const String& iconURL, const String& replaceID, const String& originString, uint64_t notificationID)
 {
-    m_process->context()->notificationManagerProxy()->show(this, title, body, iconURL, originString, notificationID);
+    m_process->context()->notificationManagerProxy()->show(this, title, body, iconURL, replaceID, originString, notificationID);
 }
 
 float WebPageProxy::headerHeight(WebFrameProxy* frame)
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.h b/Source/WebKit2/UIProcess/WebPageProxy.h
index af8da1bef..5049228e2 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.h
+++ b/Source/WebKit2/UIProcess/WebPageProxy.h
@@ -28,7 +28,6 @@
 
 #include "APIObject.h"
 #include "Connection.h"
-#include "ContextMenuState.h"
 #include "DragControllerAction.h"
 #include "DrawingAreaProxy.h"
 #include "EditorState.h"
@@ -39,6 +38,7 @@
 #if PLATFORM(QT)
 #include "QtNetworkRequestData.h"
 #endif
+#include "LayerTreeContext.h"
 #include "NotificationPermissionRequestManagerProxy.h"
 #include "PlatformProcessIdentifier.h"
 #include "SandboxExtension.h"
@@ -46,6 +46,7 @@
 #include "WKBase.h"
 #include "WKPagePrivate.h"
 #include "WebContextMenuItemData.h"
+#include "WebCoreArgumentCoders.h"
 #include "WebFindClient.h"
 #include "WebFormClient.h"
 #include "WebFrameProxy.h"
@@ -407,6 +408,9 @@ public:
     void setCustomTextEncodingName(const String&);
     String customTextEncodingName() const { return m_customTextEncodingName; }
 
+    void resumeActiveDOMObjectsAndAnimations();
+    void suspendActiveDOMObjectsAndAnimations();
+
     double estimatedProgress() const;
 
     void terminateProcess();
@@ -429,7 +433,9 @@ public:
     void setIntrinsicDeviceScaleFactor(float);
     void setCustomDeviceScaleFactor(float);
     void windowScreenDidChange(PlatformDisplayID);
-    
+
+    LayerHostingMode layerHostingMode() const { return m_layerHostingMode; }
+
     void setUseFixedLayout(bool);
     void setFixedLayoutSize(const WebCore::IntSize&);
     bool useFixedLayout() const { return m_useFixedLayout; };
@@ -528,6 +534,7 @@ public:
 #if USE(ACCELERATED_COMPOSITING)
     virtual void enterAcceleratedCompositingMode(const LayerTreeContext&);
     virtual void exitAcceleratedCompositingMode();
+    virtual void updateAcceleratedCompositingMode(const LayerTreeContext&);
 #endif
     
     void didDraw();
@@ -727,7 +734,7 @@ private:
     void reattachToWebProcessWithItem(WebBackForwardListItem*);
 
     void requestNotificationPermission(uint64_t notificationID, const String& originString);
-    void showNotification(const String& title, const String& body, const String& iconURL, const String& originString, uint64_t notificationID);
+    void showNotification(const String& title, const String& body, const String& iconURL, const String& replaceID, const String& originString, uint64_t notificationID);
     
 #if USE(TILED_BACKING_STORE)
     void pageDidRequestScroll(const WebCore::IntPoint&);
@@ -779,8 +786,8 @@ private:
 #endif
 
     // Context Menu.
-    void showContextMenu(const WebCore::IntPoint& menuLocation, const ContextMenuState&, const Vector<WebContextMenuItemData>&, CoreIPC::ArgumentDecoder*);
-    void internalShowContextMenu(const WebCore::IntPoint& menuLocation, const ContextMenuState&, const Vector<WebContextMenuItemData>&, CoreIPC::ArgumentDecoder*);
+    void showContextMenu(const WebCore::IntPoint& menuLocation, const WebHitTestResult::Data&, const Vector<WebContextMenuItemData>&, CoreIPC::ArgumentDecoder*);
+    void internalShowContextMenu(const WebCore::IntPoint& menuLocation, const WebHitTestResult::Data&, const Vector<WebContextMenuItemData>&, CoreIPC::ArgumentDecoder*);
 
     // Search popup results
     void saveRecentSearches(const String&, const Vector<String>&);
@@ -910,7 +917,7 @@ private:
 
     RefPtr<WebPopupMenuProxy> m_activePopupMenu;
     RefPtr<WebContextMenuProxy> m_activeContextMenu;
-    ContextMenuState m_activeContextMenuState;
+    WebHitTestResult::Data m_activeContextMenuHitTestResultData;
     RefPtr<WebOpenPanelResultListenerProxy> m_openPanelResultListener;
     GeolocationPermissionRequestManagerProxy m_geolocationPermissionRequestManager;
     NotificationPermissionRequestManagerProxy m_notificationPermissionRequestManager;
@@ -942,6 +949,8 @@ private:
     float m_intrinsicDeviceScaleFactor;
     float m_customDeviceScaleFactor;
 
+    LayerHostingMode m_layerHostingMode;
+
     bool m_drawsBackground;
     bool m_drawsTransparentBackground;
 
@@ -992,6 +1001,8 @@ private:
 
     uint64_t m_pageID;
 
+    bool m_isPageSuspended;
+
 #if PLATFORM(MAC)
     bool m_isSmartInsertDeleteEnabled;
 #endif
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.messages.in b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
index cb0c629e6..347aa933d 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
@@ -194,7 +194,7 @@ messages -> WebPageProxy {
 #endif
 
     # ContextMenu messages
-    ShowContextMenu(WebCore::IntPoint menuLocation, WebKit::ContextMenuState state, Vector<WebKit::WebContextMenuItemData> items, WebKit::InjectedBundleUserMessageEncoder userData)
+    ShowContextMenu(WebCore::IntPoint menuLocation, WebKit::WebHitTestResult::Data hitTestResultData, Vector<WebKit::WebContextMenuItemData> items, WebKit::InjectedBundleUserMessageEncoder userData)
 
     # Authentication messages
     CanAuthenticateAgainstProtectionSpaceInFrame(uint64_t frameID, WebCore::ProtectionSpace protectionSpace) -> (bool canAuthenticate)
@@ -208,7 +208,7 @@ messages -> WebPageProxy {
     
     # Notification messages
     RequestNotificationPermission(uint64_t requestID, WTF::String originIdentifier)
-    ShowNotification(WTF::String title, WTF::String body, WTF::String iconURL, WTF::String originIdentifier, uint64_t notificationID)
+    ShowNotification(WTF::String title, WTF::String body, WTF::String iconURL, WTF::String replaceID, WTF::String originIdentifier, uint64_t notificationID)
 
     # Spelling and grammar messages
 #if USE(UNIFIED_TEXT_CHECKING)  
diff --git a/Source/WebKit2/UIProcess/efl/WebInspectorEfl.cpp b/Source/WebKit2/UIProcess/efl/WebInspectorEfl.cpp
index 9e7696716..a2683ba2e 100644
--- a/Source/WebKit2/UIProcess/efl/WebInspectorEfl.cpp
+++ b/Source/WebKit2/UIProcess/efl/WebInspectorEfl.cpp
@@ -54,6 +54,12 @@ void WebInspectorProxy::platformBringToFront()
     notImplemented();
 }
 
+bool WebInspectorProxy::platformIsFront()
+{
+    notImplemented();
+    return false;
+}
+
 void WebInspectorProxy::platformInspectedURLChanged(const String&)
 {
     notImplemented();
diff --git a/Source/WebKit2/UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp b/Source/WebKit2/UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp
index 5b5bf0242..a136008cd 100644
--- a/Source/WebKit2/UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp
+++ b/Source/WebKit2/UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp
@@ -29,6 +29,8 @@
 
 #include <WebCore/NotImplemented.h>
 
+using namespace WebCore;
+
 namespace WebKit {
 
 void WebFullScreenManagerProxy::invalidate()
@@ -46,37 +48,12 @@ void WebFullScreenManagerProxy::exitFullScreen()
     notImplemented();
 }
 
-void WebFullScreenManagerProxy::beganEnterFullScreenAnimation()
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerProxy::finishedEnterFullScreenAnimation(bool completed)
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerProxy::beganExitFullScreenAnimation()
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerProxy::finishedExitFullScreenAnimation(bool completed)
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerProxy::enterAcceleratedCompositingMode(const LayerTreeContext& context)
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerProxy::exitAcceleratedCompositingMode()
+void WebFullScreenManagerProxy::beganEnterFullScreen(const IntRect& initialFrame, const IntRect& finalFrame)
 {
     notImplemented();
 }
 
-void WebFullScreenManagerProxy::getFullScreenRect(WebCore::IntRect& rect)
+void WebFullScreenManagerProxy::beganExitFullScreen(const IntRect& initialFrame, const IntRect& finalFrame)
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/UIProcess/gtk/WebInspectorGtk.cpp b/Source/WebKit2/UIProcess/gtk/WebInspectorGtk.cpp
index 1be2a0000..3aaab77e2 100644
--- a/Source/WebKit2/UIProcess/gtk/WebInspectorGtk.cpp
+++ b/Source/WebKit2/UIProcess/gtk/WebInspectorGtk.cpp
@@ -110,6 +110,12 @@ void WebInspectorProxy::platformBringToFront()
     notImplemented();
 }
 
+bool WebInspectorProxy::platformIsFront()
+{
+    notImplemented();
+    return false;
+}
+
 void WebInspectorProxy::platformInspectedURLChanged(const String& url)
 {
     GOwnPtr<gchar> title(g_strdup_printf("%s - %s", _("Web Inspector"), url.utf8().data()));
diff --git a/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.cpp b/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.cpp
index 521cf5320..db94d6f33 100644
--- a/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.cpp
+++ b/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.cpp
@@ -41,7 +41,6 @@ WebPopupMenuProxyGtk::WebPopupMenuProxyGtk(GtkWidget* webView, WebPopupMenuProxy
     : WebPopupMenuProxy(client)
     , m_webView(webView)
     , m_activeItem(-1)
-    , m_runLoop(0)
 {
 }
 
@@ -96,14 +95,13 @@ void WebPopupMenuProxyGtk::showPopupMenu(const IntRect& rect, TextDirection text
 
     // WebPageProxy expects the menu to run in a nested run loop, since it invalidates the
     // menu right after calling WebPopupMenuProxy::showPopupMenu().
-    m_runLoop = g_main_loop_new(0, FALSE);
+    m_runLoop = adoptGRef(g_main_loop_new(0, FALSE));
 
     GDK_THREADS_LEAVE();
-    g_main_loop_run(m_runLoop);
+    g_main_loop_run(m_runLoop.get());
     GDK_THREADS_ENTER();
 
-    g_main_loop_unref(m_runLoop);
-    m_runLoop = 0;
+    m_runLoop.clear();
 
     g_signal_handler_disconnect(m_popup->platformMenu(), unmapHandler);
 
@@ -120,8 +118,8 @@ void WebPopupMenuProxyGtk::hidePopupMenu()
 
 void WebPopupMenuProxyGtk::shutdownRunLoop()
 {
-    if (g_main_loop_is_running(m_runLoop))
-        g_main_loop_quit(m_runLoop);
+    if (g_main_loop_is_running(m_runLoop.get()))
+        g_main_loop_quit(m_runLoop.get());
 }
 
 void WebPopupMenuProxyGtk::menuItemActivated(GtkAction* action, WebPopupMenuProxyGtk* popupMenu)
diff --git a/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.h b/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.h
index 9399ec11f..4b335bcde 100644
--- a/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.h
+++ b/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.h
@@ -23,6 +23,7 @@
 #include "WebPopupMenuProxy.h"
 #include <WebCore/GtkPopupMenu.h>
 #include <WebCore/IntRect.h>
+#include <wtf/gobject/GRefPtr.h>
 
 typedef struct _GMainLoop GMainLoop;
 
@@ -53,7 +54,7 @@ private:
     GtkWidget* m_webView;
     OwnPtr<WebCore::GtkPopupMenu> m_popup;
     int m_activeItem;
-    GMainLoop* m_runLoop;
+    GRefPtr<GMainLoop> m_runLoop;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/mac/BackingStoreMac.mm b/Source/WebKit2/UIProcess/mac/BackingStoreMac.mm
index 2d159137e..9ec30b216 100644
--- a/Source/WebKit2/UIProcess/mac/BackingStoreMac.mm
+++ b/Source/WebKit2/UIProcess/mac/BackingStoreMac.mm
@@ -143,7 +143,7 @@ CGContextRef BackingStore::backingStoreContext()
 
     // Try to create a layer.
     if (CGContextRef containingWindowContext = m_webPageProxy->containingWindowGraphicsContext()) {
-        m_cgLayer.adoptCF(CGLayerCreateWithContext(containingWindowContext, NSSizeToCGSize(m_size), 0));
+        m_cgLayer.adoptCF(CGLayerCreateWithContext(containingWindowContext, m_size, 0));
         CGContextRef layerContext = CGLayerGetContext(m_cgLayer.get());
         
         CGContextSetBlendMode(layerContext, kCGBlendModeCopy);
diff --git a/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.h b/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.h
index 75b95c408..df6c41179 100644
--- a/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.h
+++ b/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.h
@@ -41,9 +41,12 @@ private:
 
     // DrawingAreaProxy
     virtual void deviceScaleFactorDidChange() OVERRIDE;
+    virtual void layerHostingModeDidChange() OVERRIDE;
     virtual void sizeDidChange() OVERRIDE;
+
     virtual void enterAcceleratedCompositingMode(uint64_t backingStoreStateID, const LayerTreeContext&) OVERRIDE;
     virtual void exitAcceleratedCompositingMode(uint64_t backingStoreStateID, const UpdateInfo&) OVERRIDE;
+    virtual void updateAcceleratedCompositingMode(uint64_t backingStoreStateID, const LayerTreeContext&) OVERRIDE;
 
     // Message handlers.
     virtual void didUpdateGeometry() OVERRIDE;
diff --git a/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm b/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm
index 319bcb401..d8f7d9d49 100644
--- a/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm
+++ b/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm
@@ -56,6 +56,11 @@ void TiledCoreAnimationDrawingAreaProxy::deviceScaleFactorDidChange()
     m_webPageProxy->process()->send(Messages::DrawingArea::SetDeviceScaleFactor(m_webPageProxy->deviceScaleFactor()), m_webPageProxy->pageID());
 }
 
+void TiledCoreAnimationDrawingAreaProxy::layerHostingModeDidChange()
+{
+    m_webPageProxy->process()->send(Messages::DrawingArea::SetLayerHostingMode(m_webPageProxy->layerHostingMode()), m_webPageProxy->pageID());
+}
+
 void TiledCoreAnimationDrawingAreaProxy::sizeDidChange()
 {
     if (!m_webPageProxy->isValid())
@@ -87,6 +92,11 @@ void TiledCoreAnimationDrawingAreaProxy::exitAcceleratedCompositingMode(uint64_t
     ASSERT_NOT_REACHED();
 }
 
+void TiledCoreAnimationDrawingAreaProxy::updateAcceleratedCompositingMode(uint64_t backingStoreStateID, const LayerTreeContext& layerTreeContext)
+{
+    m_webPageProxy->updateAcceleratedCompositingMode(layerTreeContext);
+}
+
 void TiledCoreAnimationDrawingAreaProxy::didUpdateGeometry()
 {
     ASSERT(m_isWaitingForDidUpdateGeometry);
diff --git a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.h b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.h
index 74e794704..4e9cbf08b 100644
--- a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.h
+++ b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.h
@@ -38,19 +38,23 @@ class IntRect;
 }
 
 @class WKView;
+@class WebWindowScaleAnimation;
+@class WebWindowFadeAnimation;
 
 @interface WKFullScreenWindowController : NSWindowController {
 @private
     WKView *_webView;
-    RetainPtr<NSView> _webViewPlaceholder;
-    RetainPtr<NSView> _layerHostingView;
+    RetainPtr<NSImageView> _webViewPlaceholder;
+    RetainPtr<WebWindowScaleAnimation> _scaleAnimation;
+    RetainPtr<WebWindowFadeAnimation> _fadeAnimation;
+    RetainPtr<NSWindow> _backgroundWindow;
+    NSRect _initialFrame;
+    NSRect _finalFrame;
     
     BOOL _isEnteringFullScreen;
     BOOL _isExitingFullScreen;
     BOOL _isFullScreen;
-    BOOL _forceDisableAnimation;
     BOOL _isPlaying;
-    OwnPtr<WebCore::DisplaySleepDisabler> _displaySleepDisabler;
 }
 
 - (WKView*)webView;
@@ -58,14 +62,9 @@ class IntRect;
 
 - (void)enterFullScreen:(NSScreen *)screen;
 - (void)exitFullScreen;
-- (void)beganEnterFullScreenAnimation;
-- (void)beganExitFullScreenAnimation;
-- (void)finishedEnterFullScreenAnimation:(bool)completed;
-- (void)finishedExitFullScreenAnimation:(bool)completed;
-- (void)enterAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)context;
-- (void)exitAcceleratedCompositingMode;
-- (WebCore::IntRect)getFullScreenRect;
 - (void)close;
+- (void)beganEnterFullScreenWithInitialFrame:(const WebCore::IntRect&)initialFrame finalFrame:(const WebCore::IntRect&)finalFrame;
+- (void)beganExitFullScreenWithInitialFrame:(const WebCore::IntRect&)initialFrame finalFrame:(const WebCore::IntRect&)finalFrame;
 
 @end
 
diff --git a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
index 204439fa9..b32d5c9ee 100644
--- a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
+++ b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
@@ -35,11 +35,12 @@
 #import "WKViewPrivate.h"
 #import "WebFullScreenManagerProxy.h"
 #import "WebPageProxy.h"
-#import <Carbon/Carbon.h> // For SetSystemUIMode()
 #import <QuartzCore/QuartzCore.h>
 #import <WebCore/DisplaySleepDisabler.h>
 #import <WebCore/FloatRect.h>
 #import <WebCore/IntRect.h>
+#import <WebCore/WebCoreFullScreenWindow.h>
+#import <WebCore/WebWindowAnimation.h>
 #import <WebKit/WebNSWindowExtras.h>
 #import <WebKitSystemInterface.h>
 #import <wtf/UnusedParam.h>
@@ -47,48 +48,34 @@
 using namespace WebKit;
 using namespace WebCore;
 
-#if defined(BUILDING_ON_LEOPARD)
-@interface CATransaction(SnowLeopardConvenienceFunctions)
-+ (void)setDisableActions:(BOOL)flag;
-+ (void)setAnimationDuration:(CFTimeInterval)dur;
-@end
+static RetainPtr<NSWindow> createBackgroundFullscreenWindow(NSRect frame);
 
-@implementation CATransaction(SnowLeopardConvenienceFunctions)
-+ (void)setDisableActions:(BOOL)flag
-{
-    [self setValue:[NSNumber numberWithBool:flag] forKey:kCATransactionDisableActions];
-}
+static const CFTimeInterval defaultAnimationDuration = 0.5;
 
-+ (void)setAnimationDuration:(CFTimeInterval)dur
-{
-    [self setValue:[NSNumber numberWithDouble:dur] forKey:kCATransactionAnimationDuration];
-}
+@interface WKFullScreenWindowController(Private)<NSAnimationDelegate>
+- (void)_updateMenuAndDockForFullScreen;
+- (void)_swapView:(NSView*)view with:(NSView*)otherView;
+- (WebPageProxy*)_page;
+- (WebFullScreenManagerProxy*)_manager;
+- (void)_startEnterFullScreenAnimationWithDuration:(NSTimeInterval)duration;
+- (void)_startExitFullScreenAnimationWithDuration:(NSTimeInterval)duration;
 @end
 
-#endif
+#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+@interface NSWindow(convertRectToScreenForLeopardAndSnowLeopard)
+- (NSRect)convertRectToScreen:(NSRect)aRect;
+@end
 
-@interface WKFullScreenWindow : NSWindow
+@implementation NSWindow(convertRectToScreenForLeopardAndSnowLeopard)
+- (NSRect)convertRectToScreen:(NSRect)rect
 {
-    NSView* _animationView;
-    CALayer* _backgroundLayer;
+    NSRect frame = [self frame];
+    rect.origin.x += frame.origin.x;
+    rect.origin.y += frame.origin.y;
+    return rect;
 }
-- (CALayer*)backgroundLayer;
-- (NSView*)animationView;
-@end
-
-static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, void* context);
-
-@interface WKFullScreenWindowController(Private)
-- (void)_requestExitFullScreenWithAnimation:(BOOL)animation;
-- (void)_updateMenuAndDockForFullScreen;
-- (void)_updatePowerAssertions;
-- (WKFullScreenWindow *)_fullScreenWindow;
-- (CFTimeInterval)_animationDuration;
-- (void)_swapView:(NSView*)view with:(NSView*)otherView;
-- (WebPageProxy*)_page;
-- (WebFullScreenManagerProxy*)_manager;
-- (void)_continueExitCompositingModeAfterRepaint;
 @end
+#endif
 
 @interface NSWindow(IsOnActiveSpaceAdditionForTigerAndLeopard)
 - (BOOL)isOnActiveSpace;
@@ -100,7 +87,7 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
 #pragma mark Initialization
 - (id)init
 {
-    NSWindow *window = [[WKFullScreenWindow alloc] initWithContentRect:NSZeroRect styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:NO];
+    NSWindow *window = [[WebCoreFullScreenWindow alloc] initWithContentRect:NSZeroRect styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:NO];
     self = [super initWithWindow:window];
     [window release];
     if (!self)
@@ -144,13 +131,21 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
 }
 
 #pragma mark -
+#pragma mark NSWindowController overrides
+
+- (void)cancelOperation:(id)sender
+{
+    [self performSelector:@selector(exitFullScreen) withObject:nil afterDelay:0];
+}
+
+#pragma mark -
 #pragma mark Notifications
 
 - (void)applicationDidResignActive:(NSNotification*)notification
-{   
+{
     // Check to see if the fullScreenWindow is on the active space; this function is available
     // on 10.6 and later, so default to YES if the function is not available:
-    NSWindow* fullScreenWindow = [self _fullScreenWindow];
+    NSWindow* fullScreenWindow = [self window];
     BOOL isOnActiveSpace = ([fullScreenWindow respondsToSelector:@selector(isOnActiveSpace)] ? [fullScreenWindow isOnActiveSpace] : YES);
     
     // Replicate the QuickTime Player (X) behavior when losing active application status:
@@ -158,7 +153,7 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
     // single screen is available.)  Is the fullScreen screen on the current space? IFF so, 
     // then exit fullScreen mode. 
     if ([fullScreenWindow screen] == [[NSScreen screens] objectAtIndex:0] && isOnActiveSpace)
-        [self _requestExitFullScreenWithAnimation:NO];
+        [self cancelOperation:self];
 }
 
 - (void)applicationDidChangeScreenParameters:(NSNotification*)notification
@@ -169,7 +164,9 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
     // entire screen:
     [self _updateMenuAndDockForFullScreen];
     NSWindow* window = [self window];
-    [window setFrame:[[window screen] frame] display:YES];
+    NSRect screenFrame = [[window screen] frame];
+    [window setFrame:screenFrame display:YES];
+    [_backgroundWindow.get() setFrame:screenFrame display:YES];
 }
 
 #pragma mark -
@@ -179,72 +176,62 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
 {
     if (_isFullScreen)
         return;
-    
     _isFullScreen = YES;
-    
-    NSDisableScreenUpdates();
-    
+
+    [self _updateMenuAndDockForFullScreen];   
+
     if (!screen)
         screen = [NSScreen mainScreen];
     NSRect screenFrame = [screen frame];
-    
-#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
-    NSRect webViewFrame = [_webView convertRectToBase:[_webView frame]];
-    webViewFrame.origin = [[_webView window] convertBaseToScreen:webViewFrame.origin];
-#else
+
     NSRect webViewFrame = [[_webView window] convertRectToScreen:
-        [_webView convertRect:[_webView frame] toView:nil]];
-#endif
-        
-    // In the case of a multi-monitor setup where the webView straddles two
-    // monitors, we must create a window large enough to contain the destination
-    // frame and the initial frame.
-    NSRect windowFrame = NSUnionRect(screenFrame, webViewFrame);
-    
-    [CATransaction begin];
-    [CATransaction setDisableActions:YES];
-    [[self window] setFrame:windowFrame display:YES];
-    
-    CALayer* backgroundLayer = [[self _fullScreenWindow] backgroundLayer];
-    NSRect backgroundFrame = {[[self window] convertScreenToBase:screenFrame.origin], screenFrame.size};
-    backgroundFrame = [[[self window] contentView] convertRectFromBase:backgroundFrame];
+                           [_webView convertRect:[_webView frame] toView:nil]];
+
+    // Flip coordinate system:
+    webViewFrame.origin.y = NSMaxY([[[NSScreen screens] objectAtIndex:0] frame]) - NSMaxY(webViewFrame);
+
+    CGWindowID windowID = [[_webView window] windowNumber];
+    RetainPtr<CGImageRef> webViewContents(AdoptCF, CGWindowListCreateImage(NSRectToCGRect(webViewFrame), kCGWindowListOptionIncludingWindow, windowID, kCGWindowImageShouldBeOpaque));
+
+    // Screen updates to be re-enabled in beganEnterFullScreenWithInitialFrame:finalFrame:
+    NSDisableScreenUpdates();
+    [[self window] setAutodisplay:NO];
+
+    NSResponder *webWindowFirstResponder = [[_webView window] firstResponder];
+    [[self window] setFrame:screenFrame display:NO];
+
+    // Swap the webView placeholder into place.
+    if (!_webViewPlaceholder) {
+        _webViewPlaceholder.adoptNS([[NSImageView alloc] init]);
+        [_webViewPlaceholder.get() setLayer:[CALayer layer]];
+        [_webViewPlaceholder.get() setWantsLayer:YES];
+    }
+    [[_webViewPlaceholder.get() layer] setContents:(id)webViewContents.get()];
+    [self _swapView:_webView with:_webViewPlaceholder.get()];
     
-    [backgroundLayer setFrame:NSRectToCGRect(backgroundFrame)];
-    [CATransaction commit];
+    // Then insert the WebView into the full screen window
+    NSView* contentView = [[self window] contentView];
+    [contentView addSubview:_webView positioned:NSWindowBelow relativeTo:nil];
+    [_webView setFrame:[contentView bounds]];
+
+    [[self window] makeResponder:webWindowFirstResponder firstResponderIfDescendantOfView:_webView];
 
-    CFTimeInterval duration = [self _animationDuration];
     [self _manager]->willEnterFullScreen();
-    [self _manager]->beginEnterFullScreenAnimation(duration);
+    [self _manager]->setAnimatingFullScreen(true);
 }
 
-- (void)beganEnterFullScreenAnimation
+- (void)beganEnterFullScreenWithInitialFrame:(const WebCore::IntRect&)initialFrame finalFrame:(const WebCore::IntRect&)finalFrame
 {
     if (_isEnteringFullScreen)
         return;
     _isEnteringFullScreen = YES;
 
-    if (_isExitingFullScreen)
-        [self finishedExitFullScreenAnimation:NO];
+    _initialFrame = initialFrame;
+    _finalFrame = finalFrame;
 
     [self _updateMenuAndDockForFullScreen];   
-    [self _updatePowerAssertions];
-    
-    // In a previous incarnation, the NSWindow attached to this controller may have
-    // been on a different screen. Temporarily change the collectionBehavior of the window:
-    NSWindow* fullScreenWindow = [self window];
-    NSWindowCollectionBehavior behavior = [fullScreenWindow collectionBehavior];
-    [fullScreenWindow setCollectionBehavior:NSWindowCollectionBehaviorCanJoinAllSpaces];
-    [fullScreenWindow makeKeyAndOrderFront:self];
-    [fullScreenWindow setCollectionBehavior:behavior];
-
-    // Start the opacity animation. We can use implicit animations here because we don't care when
-    // the animation finishes.
-    [CATransaction begin];
-    [CATransaction setAnimationDuration:[self _animationDuration]];
-    [[[self _fullScreenWindow] backgroundLayer] setOpacity:1];
-    [CATransaction commit];
 
-    NSEnableScreenUpdates();
+    [self _startEnterFullScreenAnimationWithDuration:defaultAnimationDuration];
 }
 
 - (void)finishedEnterFullScreenAnimation:(bool)completed
@@ -252,22 +239,17 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
     if (!_isEnteringFullScreen)
         return;
     _isEnteringFullScreen = NO;
-    
-    if (completed) {                
+
+    if (completed) {
+        // Screen updates to be re-enabled ta the end of the current block.
         NSDisableScreenUpdates();
+        [self _manager]->setAnimatingFullScreen(false);
+        [self _manager]->didEnterFullScreen();
+
+        NSRect windowBounds = [[self window] frame];
+        windowBounds.origin = NSZeroPoint;
+        WKWindowSetClipRect([self window], windowBounds);
 
-        // Swap the webView placeholder into place.
-        if (!_webViewPlaceholder)
-            _webViewPlaceholder.adoptNS([[NSView alloc] init]);
-        NSResponder *webWindowFirstResponder = [[_webView window] firstResponder];
-        [self _swapView:_webView with:_webViewPlaceholder.get()];
-        
-        // Then insert the WebView into the full screen window
-        NSView* contentView = [[self _fullScreenWindow] contentView];
-        [contentView addSubview:_webView positioned:NSWindowBelow relativeTo:nil];
-        [_webView setFrame:[contentView bounds]];
-        [[self window] makeResponder:webWindowFirstResponder firstResponderIfDescendantOfView:_webView];
-        
         NSWindow *webWindow = [_webViewPlaceholder.get() window];
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
         // In Lion, NSWindow will animate into and out of orderOut operations. Suppress that
@@ -279,26 +261,33 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
         [webWindow setAnimationBehavior:animationBehavior];
 #endif
-        [self _manager]->didEnterFullScreen();
-    }
 
-    // Complete the animation once -(void)exitCompositingMode is called.
+        [_fadeAnimation.get() stopAnimation];
+        [_fadeAnimation.get() setWindow:nil];
+        _fadeAnimation = nullptr;
+        
+        [_backgroundWindow.get() orderOut:self];
+        [_backgroundWindow.get() setFrame:NSZeroRect display:YES];
+        NSEnableScreenUpdates();
+    } else
+        [_scaleAnimation.get() stopAnimation];
 }
 
 - (void)exitFullScreen
 {
     if (!_isFullScreen)
         return;
-    
     _isFullScreen = NO;
-    
+
+    // Screen updates to be re-enabled in beganExitFullScreenWithInitialFrame:finalFrame:
     NSDisableScreenUpdates();
-    
+    [[self window] setAutodisplay:NO];
+
     [self _manager]->willExitFullScreen();
-    [self _manager]->beginExitFullScreenAnimation([self _animationDuration]);
+    [self _manager]->setAnimatingFullScreen(true);
 }
 
-- (void)beganExitFullScreenAnimation
+- (void)beganExitFullScreenWithInitialFrame:(const WebCore::IntRect&)initialFrame finalFrame:(const WebCore::IntRect&)finalFrame
 {
     if (_isExitingFullScreen)
         return;
@@ -307,52 +296,30 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
     if (_isEnteringFullScreen)
         [self finishedEnterFullScreenAnimation:NO];
 
-    [self _updateMenuAndDockForFullScreen];   
-    [self _updatePowerAssertions];
+    [self _updateMenuAndDockForFullScreen];
     
-    // Swap the webView back into its original position:
-    if ([_webView window] == [self window]) {
-        NSResponder *fullScreenWindowFirstResponder = [[self _fullScreenWindow] firstResponder];
-#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
-        // Work around a bug in AppKit <rdar://problem/9443385> where moving a 
-        // layer-hosted view from a layer-backed view to a non-layer-backed view
-        // generates an exception.
-        if (![_webView wantsLayer] && [_webView layer]) {
-            [_webView removeFromSuperview];
-            for (NSView* child in [_webView subviews])
-                [[child layer] removeFromSuperlayer];
-        }
-#endif
-        [self _swapView:_webViewPlaceholder.get() with:_webView];
-        [[_webView window] makeResponder:fullScreenWindowFirstResponder firstResponderIfDescendantOfView:_webView];
-        NSWindow* webWindow = [_webView window];
+    NSWindow* webWindow = [_webViewPlaceholder.get() window];
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-        // In Lion, NSWindow will animate into and out of orderOut operations. Suppress that
-        // behavior here, making sure to reset the animation behavior afterward.
-        NSWindowAnimationBehavior animationBehavior = [webWindow animationBehavior];
-        [webWindow setAnimationBehavior:NSWindowAnimationBehaviorNone];
+    // In Lion, NSWindow will animate into and out of orderOut operations. Suppress that
+    // behavior here, making sure to reset the animation behavior afterward.
+    NSWindowAnimationBehavior animationBehavior = [webWindow animationBehavior];
+    [webWindow setAnimationBehavior:NSWindowAnimationBehaviorNone];
 #endif
-        // If the user has moved the fullScreen window into a new space, temporarily change
-        // the collectionBehavior of the webView's window so that it is pulled into the active space:
-        if (![webWindow isOnActiveSpace]) {
-            NSWindowCollectionBehavior behavior = [webWindow collectionBehavior];
-            [webWindow setCollectionBehavior:NSWindowCollectionBehaviorCanJoinAllSpaces];
-            [webWindow orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
-            [webWindow setCollectionBehavior:behavior];
-        } else
-            [webWindow orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
-
+    // If the user has moved the fullScreen window into a new space, temporarily change
+    // the collectionBehavior of the webView's window so that it is pulled into the active space:
+    if (![webWindow isOnActiveSpace]) {
+        NSWindowCollectionBehavior behavior = [webWindow collectionBehavior];
+        [webWindow setCollectionBehavior:NSWindowCollectionBehaviorCanJoinAllSpaces];
+        [webWindow orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
+        [webWindow setCollectionBehavior:behavior];
+    } else
+        [webWindow orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
+    
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-        [webWindow setAnimationBehavior:animationBehavior];
+    [webWindow setAnimationBehavior:animationBehavior];
 #endif
-    }
-    
-    [CATransaction begin];
-    [CATransaction setAnimationDuration:[self _animationDuration]];
-    [[[self _fullScreenWindow] backgroundLayer] setOpacity:0];
-    [CATransaction commit];
-    
-    NSEnableScreenUpdates();
+
+    [self _startExitFullScreenAnimationWithDuration:defaultAnimationDuration];
 }
 
 - (void)finishedExitFullScreenAnimation:(bool)completed
@@ -361,84 +328,33 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
         return;
     _isExitingFullScreen = NO;
 
-    NSDisableScreenUpdates();
-    
     [self _updateMenuAndDockForFullScreen];
-    [self _updatePowerAssertions];
-    [NSCursor setHiddenUntilMouseMoves:YES];
 
+    // Screen updates to be re-enabled ta the end of the current function.
+    NSDisableScreenUpdates();
+
+    [self _manager]->setAnimatingFullScreen(false);
     [self _manager]->didExitFullScreen();
-}
 
-- (void)enterAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)layerTreeContext
-{
-    if (_layerHostingView)
-        return;
-    
-    // Create an NSView that will host our layer tree.
-    _layerHostingView.adoptNS([[NSView alloc] initWithFrame:[[self window] frame]]);
-    [_layerHostingView.get() setAutoresizingMask:NSViewWidthSizable | NSViewHeightSizable];
-    
-    [CATransaction begin];
-    [CATransaction setDisableActions:YES];
-    WKFullScreenWindow* window = [self _fullScreenWindow];
-    [[window contentView] addSubview:_layerHostingView.get() positioned:NSWindowAbove relativeTo:nil];
-    
-    // Create a root layer that will back the NSView.
-    RetainPtr<CALayer> rootLayer(AdoptNS, [[CALayer alloc] init]);
-#ifndef NDEBUG
-    [rootLayer.get() setName:@"Hosting root layer"];
-#endif
-    
-    CALayer *renderLayer = WKMakeRenderLayer(layerTreeContext.contextID);
-    [rootLayer.get() addSublayer:renderLayer];
-    
-    [_layerHostingView.get() setLayer:rootLayer.get()];
-    [_layerHostingView.get() setWantsLayer:YES];
-    [[window backgroundLayer] setHidden:NO];
-    [CATransaction commit];
-}
+    NSResponder *firstResponder = [[self window] firstResponder];
+    [self _swapView:_webViewPlaceholder.get() with:_webView];
+    [[_webView window] makeResponder:firstResponder firstResponderIfDescendantOfView:_webView];
 
-- (void)exitAcceleratedCompositingMode
-{
-    if (!_layerHostingView)
-        return;
+    NSRect windowBounds = [[self window] frame];
+    windowBounds.origin = NSZeroPoint;
+    WKWindowSetClipRect([self window], windowBounds);
 
-    [CATransaction begin];
-    [CATransaction setDisableActions:YES];
-    [_layerHostingView.get() removeFromSuperview];
-    [_layerHostingView.get() setLayer:nil];
-    [_layerHostingView.get() setWantsLayer:NO];
-    [[[self _fullScreenWindow] backgroundLayer] setHidden:YES];
-    [CATransaction commit];
+    [[self window] orderOut:self];
+    [[self window] setFrame:NSZeroRect display:YES];
 
-    // Complete the animation out of full-screen mode
-    // by hiding the full-screen window:
-    if (!_isFullScreen) {
-        [[_webView window] display];
-        [[self window] orderOut:self];
-        [[_webView window] makeKeyAndOrderFront:self];
-    }
-    
-    _layerHostingView = 0;
-    [self _page]->forceRepaint(VoidCallback::create(self, continueExitCompositingModeAfterRepaintCallback));
-}
+    [_fadeAnimation.get() stopAnimation];
+    [_fadeAnimation.get() setWindow:nil];
+    _fadeAnimation = nullptr;
 
-static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, void* context)
-{
-    [(WKFullScreenWindowController*)context _continueExitCompositingModeAfterRepaint];
-}
+    [_backgroundWindow.get() orderOut:self];
+    [_backgroundWindow.get() setFrame:NSZeroRect display:YES];
 
-- (void)_continueExitCompositingModeAfterRepaint
-{
     NSEnableScreenUpdates();
-
-    [self _manager]->disposeOfLayerClient();
-}
-
-- (WebCore::IntRect)getFullScreenRect
-{
-    return enclosingIntRect([[self window] frame]);
 }
 
 - (void)close
@@ -447,10 +363,8 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
     // has closed or the web process has crashed.  Just walk through our
     // normal exit full screen sequence, but don't wait to be called back
     // in response.
-    if (_isFullScreen) {
+    if (_isFullScreen)
         [self exitFullScreen];
-        [self beganExitFullScreenAnimation];
-    }
     
     if (_isExitingFullScreen)
         [self finishedExitFullScreenAnimation:YES];
@@ -459,6 +373,17 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
 }
 
 #pragma mark -
+#pragma mark NSAnimation delegate
+
+- (void)animationDidEnd:(NSAnimation*)animation
+{
+    if (_isFullScreen)
+        [self finishedEnterFullScreenAnimation:YES];
+    else
+        [self finishedExitFullScreenAnimation:YES];
+}
+
+#pragma mark -
 #pragma mark Internal Interface
 
 - (void)_updateMenuAndDockForFullScreen
@@ -488,16 +413,6 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
         SetSystemUIMode(_isFullScreen ? kUIModeNormal : kUIModeAllHidden, 0);
 }
 
-- (void)_updatePowerAssertions
-{
-    // FIXME: _isPlaying is never modified so we never disable display sleep here! (<rdar://problem/10151029>)
-    if (_isPlaying && _isFullScreen) {
-        if (!_displaySleepDisabler)
-            _displaySleepDisabler = DisplaySleepDisabler::create("com.apple.WebKit2 - Fullscreen video");
-    } else
-        _displaySleepDisabler = nullptr;
-}
-
 - (WebPageProxy*)_page
 {
     return toImpl([_webView pageRef]);
@@ -511,19 +426,6 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
     return webPage->fullScreenManager();
 }
 
-- (void)_requestExit
-{
-    [self exitFullScreen];
-    _forceDisableAnimation = NO;
-}
-
-- (void)_requestExitFullScreenWithAnimation:(BOOL)animation
-{
-    _forceDisableAnimation = !animation;
-    [self performSelector:@selector(_requestExit) withObject:nil afterDelay:0];
-    
-}
-
 - (void)_swapView:(NSView*)view with:(NSView*)otherView
 {
     [CATransaction begin];
@@ -535,109 +437,117 @@ static void continueExitCompositingModeAfterRepaintCallback(WKErrorRef error, vo
     [CATransaction commit];
 }
 
-#pragma mark -
-#pragma mark Utility Functions
-
-- (WKFullScreenWindow *)_fullScreenWindow
+static RetainPtr<NSWindow> createBackgroundFullscreenWindow(NSRect frame)
 {
-    ASSERT([[self window] isKindOfClass:[WKFullScreenWindow class]]);
-    return (WKFullScreenWindow *)[self window];
+    NSWindow *window = [[NSWindow alloc] initWithContentRect:frame styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:NO];
+    [window setOpaque:YES];
+    [window setBackgroundColor:[NSColor blackColor]];
+    [window setReleasedWhenClosed:NO];
+    return adoptNS(window);
 }
 
-- (CFTimeInterval)_animationDuration
+static NSRect windowFrameFromApparentFrames(NSRect screenFrame, NSRect initialFrame, NSRect finalFrame)
 {
-    static const CFTimeInterval defaultDuration = 0.5;
-    CFTimeInterval duration = defaultDuration;
-#ifndef BUILDING_ON_LEOPARD
-    NSUInteger modifierFlags = [NSEvent modifierFlags];
-#else
-    NSUInteger modifierFlags = [[NSApp currentEvent] modifierFlags];
-#endif
-    if ((modifierFlags & NSControlKeyMask) == NSControlKeyMask)
-        duration *= 2;
-    if ((modifierFlags & NSShiftKeyMask) == NSShiftKeyMask)
-        duration *= 10;
-    if (_forceDisableAnimation) {
-        // This will disable scale animation
-        duration = 0;
-    }
-    return duration;
+    NSRect initialWindowFrame;
+    CGFloat xScale = NSWidth(screenFrame) / NSWidth(finalFrame);
+    CGFloat yScale = NSHeight(screenFrame) / NSHeight(finalFrame);
+    CGFloat xTrans = NSMinX(screenFrame) - NSMinX(finalFrame);
+    CGFloat yTrans = NSMinY(screenFrame) - NSMinY(finalFrame);
+    initialWindowFrame.size = NSMakeSize(NSWidth(initialFrame) * xScale, NSHeight(initialFrame) * yScale);
+    initialWindowFrame.origin = NSMakePoint
+        ( NSMinX(initialFrame) + xTrans / (NSWidth(finalFrame) / NSWidth(initialFrame))
+        , NSMinY(initialFrame) + yTrans / (NSHeight(finalFrame) / NSHeight(initialFrame)));
+    return initialWindowFrame;
 }
 
-@end
-
-#pragma mark -
-@implementation WKFullScreenWindow
-
-- (id)initWithContentRect:(NSRect)contentRect styleMask:(NSUInteger)aStyle backing:(NSBackingStoreType)bufferingType defer:(BOOL)flag
+- (void)_startEnterFullScreenAnimationWithDuration:(NSTimeInterval)duration
 {
-    UNUSED_PARAM(aStyle);
-    self = [super initWithContentRect:contentRect styleMask:NSBorderlessWindowMask backing:bufferingType defer:flag];
-    if (!self)
-        return nil;
-    [self setOpaque:NO];
-    [self setBackgroundColor:[NSColor clearColor]];
-    [self setIgnoresMouseEvents:NO];
-    [self setAcceptsMouseMovedEvents:YES];
-    [self setReleasedWhenClosed:NO];
-    [self setHasShadow:YES];
-#ifndef BUILDING_ON_LEOPARD
-    [self setMovable:NO];
-#else
-    [self setMovableByWindowBackground:NO];
-#endif
+    NSRect screenFrame = [[[self window] screen] frame];
+    NSRect initialWindowFrame = windowFrameFromApparentFrames(screenFrame, _initialFrame, _finalFrame);
     
-    NSView* contentView = [self contentView];
-    [contentView setWantsLayer:YES];
-    _animationView = [[NSView alloc] initWithFrame:[contentView bounds]];
+    _scaleAnimation.adoptNS([[WebWindowScaleAnimation alloc] initWithHintedDuration:duration window:[self window] initalFrame:initialWindowFrame finalFrame:screenFrame]);
     
-    CALayer* contentLayer = [[CALayer alloc] init];
-    [_animationView setLayer:contentLayer];
-    [_animationView setWantsLayer:YES];
-    [_animationView setAutoresizingMask:NSViewWidthSizable|NSViewHeightSizable];
-    [contentView addSubview:_animationView];
-    
-    _backgroundLayer = [[CALayer alloc] init];
-    [contentLayer addSublayer:_backgroundLayer];
-    
-    [_backgroundLayer setBackgroundColor:CGColorGetConstantColor(kCGColorBlack)];
-    [_backgroundLayer setOpacity:0];
-    return self;
-}
+    [_scaleAnimation.get() setAnimationBlockingMode:NSAnimationNonblocking];
+    [_scaleAnimation.get() setDelegate:self];
+    [_scaleAnimation.get() setCurrentProgress:0];
+    [_scaleAnimation.get() startAnimation];
 
-- (void)dealloc
-{
-    [_animationView release];
-    [_backgroundLayer release];
-    [super dealloc];
-}
+    // WKWindowSetClipRect takes window coordinates, so convert from screen coordinates here:
+    NSRect finalBounds = _finalFrame;
+    finalBounds.origin = [[self window] convertScreenToBase:finalBounds.origin];
+    WKWindowSetClipRect([self window], finalBounds);
 
-- (BOOL)canBecomeKeyWindow
-{
-    return YES;
-}
+    [[self window] makeKeyAndOrderFront:self];
 
-- (void)keyDown:(NSEvent *)theEvent
-{
-    if ([[theEvent charactersIgnoringModifiers] isEqual:@"\e"]) // Esacpe key-code
-        [self cancelOperation:self];
-    else [super keyDown:theEvent];
-}
+    if (!_backgroundWindow)
+        _backgroundWindow = createBackgroundFullscreenWindow(screenFrame);
+    else
+        [_backgroundWindow.get() setFrame:screenFrame display:NO];
 
-- (void)cancelOperation:(id)sender
-{
-    UNUSED_PARAM(sender);
-    [[self windowController] _requestExitFullScreenWithAnimation:YES];
-}
+    CGFloat currentAlpha = 0;
+    if (_fadeAnimation) {
+        currentAlpha = [_fadeAnimation.get() currentAlpha];
+        [_fadeAnimation.get() stopAnimation];
+        [_fadeAnimation.get() setWindow:nil];
+    }
 
-- (CALayer*)backgroundLayer
-{
-    return _backgroundLayer;
+    _fadeAnimation.adoptNS([[WebWindowFadeAnimation alloc] initWithDuration:duration 
+                                                                     window:_backgroundWindow.get() 
+                                                               initialAlpha:currentAlpha 
+                                                                 finalAlpha:1]);
+    [_fadeAnimation.get() setAnimationBlockingMode:NSAnimationNonblocking];
+    [_fadeAnimation.get() setCurrentProgress:0];
+    [_fadeAnimation.get() startAnimation];
+
+    [_backgroundWindow.get() orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
+
+    [[self window] setAutodisplay:YES];
+    [[self window] displayIfNeeded];
+    NSEnableScreenUpdates();
 }
 
-- (NSView*)animationView
+- (void)_startExitFullScreenAnimationWithDuration:(NSTimeInterval)duration
 {
-    return _animationView;
+    NSRect screenFrame = [[[self window] screen] frame];
+    NSRect initialWindowFrame = windowFrameFromApparentFrames(screenFrame, _initialFrame, _finalFrame);
+
+    NSRect currentFrame = _scaleAnimation ? [_scaleAnimation.get() currentFrame] : [[self window] frame];
+    _scaleAnimation.adoptNS([[WebWindowScaleAnimation alloc] initWithHintedDuration:duration window:[self window] initalFrame:currentFrame finalFrame:initialWindowFrame]);
+
+    [_scaleAnimation.get() setAnimationBlockingMode:NSAnimationNonblocking];
+    [_scaleAnimation.get() setDelegate:self];
+    [_scaleAnimation.get() setCurrentProgress:0];
+    [_scaleAnimation.get() startAnimation];
+
+    if (!_backgroundWindow)
+        _backgroundWindow = createBackgroundFullscreenWindow(screenFrame);
+    else
+        [_backgroundWindow.get() setFrame:screenFrame display:NO];
+
+    CGFloat currentAlpha = 1;
+    if (_fadeAnimation) {
+        currentAlpha = [_fadeAnimation.get() currentAlpha];
+        [_fadeAnimation.get() stopAnimation];
+        [_fadeAnimation.get() setWindow:nil];
+    }
+    _fadeAnimation.adoptNS([[WebWindowFadeAnimation alloc] initWithDuration:duration 
+                                                                     window:_backgroundWindow.get() 
+                                                               initialAlpha:currentAlpha 
+                                                                 finalAlpha:0]);
+    [_fadeAnimation.get() setAnimationBlockingMode:NSAnimationNonblocking];
+    [_fadeAnimation.get() setCurrentProgress:0];
+    [_fadeAnimation.get() startAnimation];
+
+    [_backgroundWindow.get() orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
+
+    // WKWindowSetClipRect takes window coordinates, so convert from screen coordinates here:
+    NSRect finalBounds = _finalFrame;
+    finalBounds.origin = [[self window] convertScreenToBase:finalBounds.origin];
+    WKWindowSetClipRect([self window], finalBounds);
+
+    [[self window] setAutodisplay:YES];
+    [[self window] displayIfNeeded];
+    NSEnableScreenUpdates();
 }
 @end
 
diff --git a/Source/WebKit2/UIProcess/mac/WebContextMac.mm b/Source/WebKit2/UIProcess/mac/WebContextMac.mm
index 5270b7396..ab5721bb8 100644
--- a/Source/WebKit2/UIProcess/mac/WebContextMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebContextMac.mm
@@ -28,9 +28,15 @@
 
 #import "WebKitSystemInterface.h"
 #import "WebProcessCreationParameters.h"
+#import <WebCore/Color.h>
 #import <WebCore/FileSystem.h>
+#import <WebCore/PlatformPasteboard.h>
 #import <sys/param.h>
 
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+#import <QuartzCore/CARemoteLayerServer.h>
+#endif
+
 using namespace WebCore;
 
 NSString *WebDatabaseDirectoryDefaultsKey = @"WebDatabaseDirectory";
@@ -93,7 +99,11 @@ void WebContext::platformInitializeWebProcess(WebProcessCreationParameters& para
 #endif
 
 #if USE(ACCELERATED_COMPOSITING) && HAVE(HOSTED_CORE_ANIMATION)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    mach_port_t renderServerPort = [[CARemoteLayerServer sharedServer] serverPort];
+#else
     mach_port_t renderServerPort = WKInitializeRenderServer();
+#endif
     if (renderServerPort != MACH_PORT_NULL)
         parameters.acceleratedCompositingPort = CoreIPC::MachPort(renderServerPort, MACH_MSG_TYPE_COPY_SEND);
 #endif
@@ -147,5 +157,77 @@ bool WebContext::omitPDFSupport()
     return [[NSUserDefaults standardUserDefaults] boolForKey:@"WebKitOmitPDFSupport"];
 }
 
+void WebContext::getPasteboardTypes(const String& pasteboardName, Vector<String>& pasteboardTypes)
+{
+    PlatformPasteboard(pasteboardName).getTypes(pasteboardTypes);
+}
+
+void WebContext::getPasteboardPathnamesForType(const String& pasteboardName, const String& pasteboardType, Vector<String>& pathnames)
+{
+    PlatformPasteboard(pasteboardName).getPathnamesForType(pathnames, pasteboardType);
+}
+
+void WebContext::getPasteboardStringForType(const String& pasteboardName, const String& pasteboardType, String& string)
+{
+    string = PlatformPasteboard(pasteboardName).stringForType(pasteboardType);
+}
+
+void WebContext::getPasteboardBufferForType(const String& pasteboardName, const String& pasteboardType, SharedMemory::Handle& handle, uint64_t& size)
+{
+    RefPtr<SharedBuffer> buffer = PlatformPasteboard(pasteboardName).bufferForType(pasteboardType);
+    if (!buffer)
+        return;
+    size = buffer->size();
+    RefPtr<SharedMemory> sharedMemoryBuffer = SharedMemory::create(size);
+    memcpy(sharedMemoryBuffer->data(), buffer->data(), size);
+    sharedMemoryBuffer->createHandle(handle, SharedMemory::ReadOnly);
+}
+
+void WebContext::pasteboardCopy(const String& fromPasteboard, const String& toPasteboard)
+{
+    PlatformPasteboard(toPasteboard).copy(fromPasteboard);
+}
+
+void WebContext::getPasteboardChangeCount(const String& pasteboardName, uint64_t& changeCount)
+{
+    changeCount = PlatformPasteboard(pasteboardName).changeCount();
+}
+
+void WebContext::getPasteboardUniqueName(String& pasteboardName)
+{
+    pasteboardName = PlatformPasteboard::uniqueName();
+}
+
+void WebContext::getPasteboardColor(const String& pasteboardName, WebCore::Color& color)
+{
+    color = PlatformPasteboard(pasteboardName).color();    
+}
+
+void WebContext::setPasteboardTypes(const String& pasteboardName, const Vector<String>& pasteboardTypes)
+{
+    PlatformPasteboard(pasteboardName).setTypes(pasteboardTypes);
+}
+
+void WebContext::setPasteboardPathnamesForType(const String& pasteboardName, const String& pasteboardType, const Vector<String>& pathnames)
+{
+    PlatformPasteboard(pasteboardName).setPathnamesForType(pathnames, pasteboardType);
+}
+
+void WebContext::setPasteboardStringForType(const String& pasteboardName, const String& pasteboardType, const String& string)
+{
+    PlatformPasteboard(pasteboardName).setStringForType(string, pasteboardType);    
+}
+
+void WebContext::setPasteboardBufferForType(const String& pasteboardName, const String& pasteboardType, const SharedMemory::Handle& handle, uint64_t size)
+{
+    if (handle.isNull()) {
+        PlatformPasteboard(pasteboardName).setBufferForType(0, pasteboardType);
+        return;
+    }
+    RefPtr<SharedMemory> sharedMemoryBuffer = SharedMemory::create(handle, SharedMemory::ReadOnly);
+    RefPtr<SharedBuffer> buffer = SharedBuffer::create(static_cast<unsigned char *>(sharedMemoryBuffer->data()), size);
+    PlatformPasteboard(pasteboardName).setBufferForType(buffer, pasteboardType);
+}
+
 } // namespace WebKit
 
diff --git a/Source/WebKit2/UIProcess/mac/WebContextMenuProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebContextMenuProxyMac.mm
index 81552dc5e..74c64464d 100644
--- a/Source/WebKit2/UIProcess/mac/WebContextMenuProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebContextMenuProxyMac.mm
@@ -27,6 +27,7 @@
 #import "WebContextMenuProxyMac.h"
 
 #import "PageClientImpl.h"
+#import "StringUtilities.h"
 #import "WebContextMenuItemData.h"
 #import "WKView.h"
 
diff --git a/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm
index 20e92c054..04667b6cd 100644
--- a/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm
@@ -33,6 +33,8 @@
 
 #if ENABLE(FULLSCREEN_API)
 
+using namespace WebCore;
+
 namespace WebKit {
 
 void WebFullScreenManagerProxy::invalidate()
@@ -57,54 +59,17 @@ void WebFullScreenManagerProxy::exitFullScreen()
         return;
     [[m_webView fullScreenWindowController] exitFullScreen];
 }
-
-void WebFullScreenManagerProxy::beganEnterFullScreenAnimation()
-{
-    if (!m_webView)
-        return;
-    [[m_webView fullScreenWindowController] beganEnterFullScreenAnimation];
-}
-
-void WebFullScreenManagerProxy::finishedEnterFullScreenAnimation(bool completed)
-{
-    if (!m_webView)
-        return;
-    [[m_webView fullScreenWindowController] finishedEnterFullScreenAnimation:completed];
-}
-
-void WebFullScreenManagerProxy::beganExitFullScreenAnimation()
-{
-    if (!m_webView)
-        return;
-    [[m_webView fullScreenWindowController] beganExitFullScreenAnimation];
-}
-
-void WebFullScreenManagerProxy::finishedExitFullScreenAnimation(bool completed)
-{
-    if (!m_webView)
-        return;
-    [[m_webView fullScreenWindowController] finishedExitFullScreenAnimation:completed];
-}
     
-void WebFullScreenManagerProxy::enterAcceleratedCompositingMode(const LayerTreeContext& context)
+void WebFullScreenManagerProxy::beganEnterFullScreen(const IntRect& initialFrame, const IntRect& finalFrame)
 {
-    if (!m_webView)
-        return;
-    [[m_webView fullScreenWindowController] enterAcceleratedCompositingMode:context];
+    if (m_webView)
+        [[m_webView fullScreenWindowController] beganEnterFullScreenWithInitialFrame:initialFrame finalFrame:finalFrame];
 }
 
-void WebFullScreenManagerProxy::exitAcceleratedCompositingMode()
+void WebFullScreenManagerProxy::beganExitFullScreen(const IntRect& initialFrame, const IntRect& finalFrame)
 {
-    if (!m_webView)
-        return;
-    [[m_webView fullScreenWindowController] exitAcceleratedCompositingMode];
-}
-
-void WebFullScreenManagerProxy::getFullScreenRect(WebCore::IntRect& rect)
-{
-    if (!m_webView)
-        return;
-    rect = [[m_webView fullScreenWindowController] getFullScreenRect];
+    if (m_webView)
+        [[m_webView fullScreenWindowController] beganExitFullScreenWithInitialFrame:initialFrame finalFrame:finalFrame];
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
index d90ad1215..0db662c42 100644
--- a/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
@@ -30,7 +30,7 @@
 
 #import "WKAPICast.h"
 #import "WebContext.h"
-#import "WKInspectorMac.h"
+#import "WKInspectorPrivateMac.h"
 #import "WKViewPrivate.h"
 #import "WebPageGroup.h"
 #import "WebPageProxy.h"
@@ -51,9 +51,7 @@ static const CGFloat windowContentBorderThickness = 55;
 // WKWebInspectorProxyObjCAdapter is a helper ObjC object used as a delegate or notification observer
 // for the sole purpose of getting back into the C++ code from an ObjC caller.
 
-@interface WKWebInspectorProxyObjCAdapter : NSObject <NSWindowDelegate> {
-    WebInspectorProxy* _inspectorProxy; // Not retained to prevent cycles
-}
+@interface WKWebInspectorProxyObjCAdapter ()
 
 - (id)initWithWebInspectorProxy:(WebInspectorProxy*)inspectorProxy;
 
@@ -61,6 +59,11 @@ static const CGFloat windowContentBorderThickness = 55;
 
 @implementation WKWebInspectorProxyObjCAdapter
 
+- (WKInspectorRef)inspectorRef
+{
+    return toAPI(static_cast<WebInspectorProxy*>(_inspectorProxy));
+}
+
 - (id)initWithWebInspectorProxy:(WebInspectorProxy*)inspectorProxy
 {
     ASSERT_ARG(inspectorProxy, inspectorProxy);
@@ -68,19 +71,19 @@ static const CGFloat windowContentBorderThickness = 55;
     if (!(self = [super init]))
         return nil;
 
-    _inspectorProxy = inspectorProxy; // Not retained to prevent cycles
+    _inspectorProxy = static_cast<void*>(inspectorProxy); // Not retained to prevent cycles
 
     return self;
 }
 
 - (void)windowWillClose:(NSNotification *)notification
 {
-    _inspectorProxy->close();
+    static_cast<WebInspectorProxy*>(_inspectorProxy)->close();
 }
 
 - (void)inspectedViewFrameDidChange:(NSNotification *)notification
 {
-    _inspectorProxy->inspectedViewFrameDidChange();
+    static_cast<WebInspectorProxy*>(_inspectorProxy)->inspectedViewFrameDidChange();
 }
 
 @end
@@ -191,10 +194,16 @@ void WebInspectorProxy::platformDidClose()
 
 void WebInspectorProxy::platformBringToFront()
 {
-    // FIXME: this will not bring a background tab in Safari to the front, only its window.
+    // FIXME <rdar://problem/10937688>: this will not bring a background tab in Safari to the front, only its window.
     [m_inspectorView.get().window makeKeyAndOrderFront:nil];
 }
 
+bool WebInspectorProxy::platformIsFront()
+{
+    // FIXME <rdar://problem/10937688>: this will not return false for a background tab in Safari, only a background window.
+    return m_isVisible && [m_inspectorView.get().window isMainWindow];
+}
+
 void WebInspectorProxy::platformInspectedURLChanged(const String& urlString)
 {
     m_urlString = urlString;
diff --git a/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm
index 192eb419f..120dc5d28 100644
--- a/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm
@@ -34,6 +34,7 @@
 #import "PluginComplexTextInputState.h"
 #import "PageClient.h"
 #import "PageClientImpl.h"
+#import "StringUtilities.h"
 #import "TextChecker.h"
 #import "WebPageMessages.h"
 #import "WebProcessProxy.h"
diff --git a/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm
index 30e2e2087..c5c715437 100644
--- a/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm
@@ -29,6 +29,7 @@
 #import "NativeWebMouseEvent.h"
 #import "PageClientImpl.h"
 #import "PlatformPopupMenuData.h"
+#import "StringUtilities.h"
 #import "WKView.h"
 #import "WebPopupItem.h"
 #import <WebKitSystemInterface.h>
diff --git a/Source/WebKit2/UIProcess/mac/WebPreferencesMac.mm b/Source/WebKit2/UIProcess/mac/WebPreferencesMac.mm
index f2f41d331..6fd41d389 100644
--- a/Source/WebKit2/UIProcess/mac/WebPreferencesMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebPreferencesMac.mm
@@ -26,7 +26,7 @@
 #import "config.h"
 #import "WebPreferences.h"
 
-#import "PageClientImpl.h"
+#import "StringUtilities.h"
 #import <wtf/text/StringConcatenate.h>
 
 namespace WebKit {
diff --git a/Source/WebKit2/UIProcess/qt/LayerBackingStore.cpp b/Source/WebKit2/UIProcess/qt/LayerBackingStore.cpp
index c6df57efb..d66cc19b7 100644
--- a/Source/WebKit2/UIProcess/qt/LayerBackingStore.cpp
+++ b/Source/WebKit2/UIProcess/qt/LayerBackingStore.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "LayerBackingStore.h"
 
+#if USE(UI_SIDE_COMPOSITING)
 #include "GraphicsLayer.h"
 #include "TextureMapper.h"
 
@@ -141,3 +142,4 @@ void LayerBackingStore::swapBuffers(TextureMapper* textureMapper)
 }
 
 }
+#endif
diff --git a/Source/WebKit2/UIProcess/qt/LayerBackingStore.h b/Source/WebKit2/UIProcess/qt/LayerBackingStore.h
index e62fcc840..9b9913e38 100644
--- a/Source/WebKit2/UIProcess/qt/LayerBackingStore.h
+++ b/Source/WebKit2/UIProcess/qt/LayerBackingStore.h
@@ -20,6 +20,7 @@
 #ifndef LayerBackingStore_h
 #define LayerBackingStore_h
 
+#if USE(UI_SIDE_COMPOSITING)
 #include "HashMap.h"
 #include "ShareableBitmap.h"
 #include "TextureMapper.h"
@@ -65,4 +66,6 @@ private:
 };
 
 }
+#endif
+
 #endif // LayerBackingStore_h
diff --git a/Source/WebKit2/UIProcess/qt/LayerTreeHostProxyQt.cpp b/Source/WebKit2/UIProcess/qt/LayerTreeHostProxyQt.cpp
deleted file mode 100644
index ee05eaf41..000000000
--- a/Source/WebKit2/UIProcess/qt/LayerTreeHostProxyQt.cpp
+++ /dev/null
@@ -1,592 +0,0 @@
-/*
-    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if USE(ACCELERATED_COMPOSITING)
-#include "LayerTreeHostProxy.h"
-
-#include "GraphicsLayerTextureMapper.h"
-#include "LayerBackingStore.h"
-#include "LayerTreeHostMessages.h"
-#include "MainThread.h"
-#include "MessageID.h"
-#include "ShareableBitmap.h"
-#include "TextureMapper.h"
-#include "TextureMapperBackingStore.h"
-#include "TextureMapperLayer.h"
-#include "UpdateInfo.h"
-#include "WebCoreArgumentCoders.h"
-#include "WebLayerTreeInfo.h"
-#include "WebPageProxy.h"
-#include "WebProcessProxy.h"
-#include <OpenGLShims.h>
-#include <QDateTime>
-
-namespace WebKit {
-
-class LayerTreeMessageToRenderer {
-public:
-    enum Type {
-        DeleteLayer,
-        CreateTile,
-        RemoveTile,
-        UpdateTile,
-        CreateImage,
-        DestroyImage,
-        SyncLayerParameters,
-        FlushLayerChanges,
-        SetRootLayer
-    };
-    virtual ~LayerTreeMessageToRenderer() { }
-    virtual Type type() const = 0;
-};
-
-using namespace WebCore;
-
-template<class MessageData, LayerTreeMessageToRenderer::Type messageType>
-class LayerTreeMessageToRendererWithData : public LayerTreeMessageToRenderer {
-public:
-    virtual Type type() const { return messageType; }
-
-    static PassOwnPtr<LayerTreeMessageToRenderer> create(const MessageData& data = MessageData())
-    {
-        return adoptPtr(new LayerTreeMessageToRendererWithData(data));
-    }
-
-    const MessageData& data() const
-    {
-        return m_data;
-    }
-
-private:
-    LayerTreeMessageToRendererWithData(const MessageData& data)
-        : m_data(data)
-    {
-    }
-
-    MessageData m_data;
-};
-
-
-namespace {
-struct CreateTileMessageData {
-    WebLayerID layerID;
-    int remoteTileID;
-    float scale;
-};
-
-struct UpdateTileMessageData {
-    WebLayerID layerID;
-    int remoteTileID;
-    IntRect sourceRect;
-    IntRect targetRect;
-    RefPtr<ShareableBitmap> bitmap;
-};
-
-struct RemoveTileMessageData {
-    WebLayerID layerID;
-    int remoteTileID;
-};
-
-struct CreateImageMessageData {
-    int64_t imageID;
-    RefPtr<ShareableBitmap> bitmap;
-};
-
-struct DestroyImageMessageData {
-    int64_t imageID;
-};
-
-struct SyncLayerParametersMessageData {
-    WebLayerInfo layerInfo;
-};
-
-struct EmptyMessageData { };
-struct DeleteLayerMessageData {
-    WebLayerID layerID;
-};
-struct SetRootLayerMessageData {
-    WebLayerID layerID;
-};
-
-class CreateTileMessage
-        : public LayerTreeMessageToRendererWithData<CreateTileMessageData, LayerTreeMessageToRenderer::CreateTile> { };
-class UpdateTileMessage
-        : public LayerTreeMessageToRendererWithData<UpdateTileMessageData, LayerTreeMessageToRenderer::UpdateTile> { };
-class RemoveTileMessage
-        : public LayerTreeMessageToRendererWithData<RemoveTileMessageData, LayerTreeMessageToRenderer::RemoveTile> { };
-class CreateImageMessage
-        : public LayerTreeMessageToRendererWithData<CreateImageMessageData, LayerTreeMessageToRenderer::CreateImage> { };
-class DestroyImageMessage
-        : public LayerTreeMessageToRendererWithData<DestroyImageMessageData, LayerTreeMessageToRenderer::DestroyImage> { };
-class FlushLayerChangesMessage
-        : public LayerTreeMessageToRendererWithData<EmptyMessageData, LayerTreeMessageToRenderer::FlushLayerChanges> { };
-class SyncLayerParametersMessage
-        : public LayerTreeMessageToRendererWithData<SyncLayerParametersMessageData, LayerTreeMessageToRenderer::SyncLayerParameters> { };
-class DeleteLayerMessage
-        : public LayerTreeMessageToRendererWithData<DeleteLayerMessageData, LayerTreeMessageToRenderer::DeleteLayer> { };
-class SetRootLayerMessage
-        : public LayerTreeMessageToRendererWithData<SetRootLayerMessageData, LayerTreeMessageToRenderer::SetRootLayer> { };
-}
-
-PassOwnPtr<GraphicsLayer> LayerTreeHostProxy::createLayer(WebLayerID layerID)
-{
-    GraphicsLayer* newLayer = new GraphicsLayerTextureMapper(this);
-    TextureMapperLayer* layer = toTextureMapperLayer(newLayer);
-    layer->setShouldUpdateBackingStoreFromLayer(false);
-    return adoptPtr(newLayer);
-}
-
-LayerTreeHostProxy::LayerTreeHostProxy(DrawingAreaProxy* drawingAreaProxy)
-    : m_drawingAreaProxy(drawingAreaProxy)
-    , m_rootLayerID(0)
-{
-}
-
-LayerTreeHostProxy::~LayerTreeHostProxy()
-{
-}
-
-// This function needs to be reentrant.
-void LayerTreeHostProxy::paintToCurrentGLContext(const TransformationMatrix& matrix, float opacity, const FloatRect& clipRect)
-{
-    if (!m_textureMapper)
-        m_textureMapper = TextureMapper::create(TextureMapper::OpenGLMode);
-    ASSERT(m_textureMapper->accelerationMode() == TextureMapper::OpenGLMode);
-
-    syncRemoteContent();
-    GraphicsLayer* currentRootLayer = rootLayer();
-    if (!currentRootLayer)
-        return;
-
-    TextureMapperLayer* layer = toTextureMapperLayer(currentRootLayer);
-
-    if (!layer)
-        return;
-
-    layer->setTextureMapper(m_textureMapper.get());
-    m_textureMapper->beginPainting();
-    m_textureMapper->bindSurface(0);
-    m_textureMapper->beginClip(TransformationMatrix(), clipRect);
-
-    if (currentRootLayer->opacity() != opacity || currentRootLayer->transform() != matrix) {
-        currentRootLayer->setOpacity(opacity);
-        currentRootLayer->setTransform(matrix);
-        currentRootLayer->syncCompositingStateForThisLayerOnly();
-    }
-
-    layer->paint();
-    m_textureMapper->endClip();
-    m_textureMapper->endPainting();
-
-    syncAnimations();
-}
-
-void LayerTreeHostProxy::syncAnimations()
-{
-    TextureMapperLayer* layer = toTextureMapperLayer(rootLayer());
-    ASSERT(layer);
-
-    layer->syncAnimationsRecursively();
-    if (layer->descendantsOrSelfHaveRunningAnimations())
-        updateViewport();
-}
-
-void LayerTreeHostProxy::paintToGraphicsContext(QPainter* painter)
-{
-    if (!m_textureMapper)
-        m_textureMapper = TextureMapper::create();
-    ASSERT(m_textureMapper->accelerationMode() == TextureMapper::SoftwareMode);
-    syncRemoteContent();
-    TextureMapperLayer* layer = toTextureMapperLayer(rootLayer());
-
-    if (!layer)
-        return;
-
-    GraphicsContext graphicsContext(painter);
-    m_textureMapper->setGraphicsContext(&graphicsContext);
-    m_textureMapper->beginPainting();
-    m_textureMapper->bindSurface(0);
-    layer->paint();
-    m_textureMapper->endPainting();
-    m_textureMapper->setGraphicsContext(0);
-}
-
-void LayerTreeHostProxy::updateViewport()
-{
-    m_drawingAreaProxy->updateViewport();
-}
-
-void LayerTreeHostProxy::syncLayerParameters(const WebLayerInfo& layerInfo)
-{
-    WebLayerID id = layerInfo.id;
-    ensureLayer(id);
-    LayerMap::iterator it = m_layers.find(id);
-    GraphicsLayer* layer = it->second;
-    bool needsToUpdateImageTiles = layerInfo.imageIsUpdated || (layerInfo.contentsRect != layer->contentsRect() && layerInfo.imageBackingStoreID);
-
-    layer->setName(layerInfo.name);
-
-    layer->setReplicatedByLayer(layerByID(layerInfo.replica));
-    layer->setMaskLayer(layerByID(layerInfo.mask));
-
-    layer->setPosition(layerInfo.pos);
-    layer->setSize(layerInfo.size);
-    layer->setTransform(layerInfo.transform);
-    layer->setAnchorPoint(layerInfo.anchorPoint);
-    layer->setChildrenTransform(layerInfo.childrenTransform);
-    layer->setBackfaceVisibility(layerInfo.backfaceVisible);
-    layer->setContentsOpaque(layerInfo.contentsOpaque);
-    layer->setContentsRect(layerInfo.contentsRect);
-    layer->setDrawsContent(layerInfo.drawsContent);
-
-    if (needsToUpdateImageTiles)
-        assignImageToLayer(layer, layerInfo.imageBackingStoreID);
-
-    // Never make the root layer clip.
-    layer->setMasksToBounds(layerInfo.isRootLayer ? false : layerInfo.masksToBounds);
-    layer->setOpacity(layerInfo.opacity);
-    layer->setPreserves3D(layerInfo.preserves3D);
-    Vector<GraphicsLayer*> children;
-
-    for (size_t i = 0; i < layerInfo.children.size(); ++i) {
-        WebLayerID childID = layerInfo.children[i];
-        GraphicsLayer* child = layerByID(childID);
-        if (!child) {
-            child = createLayer(childID).leakPtr();
-            m_layers.add(childID, child);
-        }
-        children.append(child);
-    }
-    layer->setChildren(children);
-
-    for (size_t i = 0; i < layerInfo.animations.size(); ++i) {
-        const WebKit::WebLayerAnimation anim = layerInfo.animations[i];
-
-        switch (anim.operation) {
-        case WebKit::WebLayerAnimation::AddAnimation: {
-            const IntSize boxSize = anim.boxSize;
-            layer->addAnimation(anim.keyframeList, boxSize, anim.animation.get(), anim.name, anim.startTime);
-            break;
-        }
-        case WebKit::WebLayerAnimation::RemoveAnimation:
-            layer->removeAnimation(anim.name);
-            break;
-        case WebKit::WebLayerAnimation::PauseAnimation:
-            double offset = WTF::currentTime() - anim.startTime;
-            layer->pauseAnimation(anim.name, offset);
-            break;
-        }
-    }
-
-    if (layerInfo.isRootLayer && m_rootLayerID != id)
-        setRootLayerID(id);
-}
-
-void LayerTreeHostProxy::deleteLayer(WebLayerID layerID)
-{
-    GraphicsLayer* layer = layerByID(layerID);
-    if (!layer)
-        return;
-
-    layer->removeFromParent();
-    m_layers.remove(layerID);
-    delete layer;
-}
-
-
-void LayerTreeHostProxy::ensureLayer(WebLayerID id)
-{
-    // We have to leak the new layer's pointer and manage it ourselves,
-    // because OwnPtr is not copyable.
-    if (m_layers.find(id) == m_layers.end())
-        m_layers.add(id, createLayer(id).leakPtr());
-}
-
-void LayerTreeHostProxy::setRootLayerID(WebLayerID layerID)
-{
-    if (layerID == m_rootLayerID)
-        return;
-
-    m_rootLayerID = layerID;
-
-    m_rootLayer->removeAllChildren();
-
-    if (!layerID)
-        return;
-
-    GraphicsLayer* layer = layerByID(layerID);
-    if (!layer)
-        return;
-
-    m_rootLayer->addChild(layer);
-}
-
-PassRefPtr<LayerBackingStore> LayerTreeHostProxy::getBackingStore(WebLayerID id)
-{
-    ensureLayer(id);
-    TextureMapperLayer* layer = toTextureMapperLayer(layerByID(id));
-    RefPtr<LayerBackingStore> backingStore = static_cast<LayerBackingStore*>(layer->backingStore().get());
-    if (!backingStore) {
-        backingStore = LayerBackingStore::create();
-        layer->setBackingStore(backingStore.get());
-    }
-    ASSERT(backingStore);
-    return backingStore;
-}
-
-void LayerTreeHostProxy::createTile(WebLayerID layerID, int tileID, float scale)
-{
-    getBackingStore(layerID)->createTile(tileID, scale);
-}
-
-void LayerTreeHostProxy::removeTile(WebLayerID layerID, int tileID)
-{
-    getBackingStore(layerID)->removeTile(tileID);
-}
-
-void LayerTreeHostProxy::updateTile(WebLayerID layerID, int tileID, const IntRect& sourceRect, const IntRect& targetRect, ShareableBitmap* bitmap)
-{
-    RefPtr<LayerBackingStore> backingStore = getBackingStore(layerID);
-    backingStore->updateTile(tileID, sourceRect, targetRect, bitmap);
-    m_backingStoresWithPendingBuffers.add(backingStore);
-}
-
-void LayerTreeHostProxy::createImage(int64_t imageID, ShareableBitmap* bitmap)
-{
-    RefPtr<TextureMapperTiledBackingStore> backingStore = TextureMapperTiledBackingStore::create();
-    backingStore->updateContents(m_textureMapper.get(), bitmap->createImage().get(), BitmapTexture::BGRAFormat);
-    m_directlyCompositedImages.set(imageID, backingStore);
-}
-
-void LayerTreeHostProxy::destroyImage(int64_t imageID)
-{
-    m_directlyCompositedImages.remove(imageID);
-}
-
-void LayerTreeHostProxy::assignImageToLayer(GraphicsLayer* layer, int64_t imageID)
-{
-    HashMap<int64_t, RefPtr<TextureMapperBackingStore> >::iterator it = m_directlyCompositedImages.find(imageID);
-    ASSERT(it != m_directlyCompositedImages.end());
-    layer->setContentsToMedia(it->second.get());
-}
-
-void LayerTreeHostProxy::swapBuffers()
-{
-    HashSet<RefPtr<LayerBackingStore> >::iterator end = m_backingStoresWithPendingBuffers.end();
-    for (HashSet<RefPtr<LayerBackingStore> >::iterator it = m_backingStoresWithPendingBuffers.begin(); it != end; ++it)
-        (*it)->swapBuffers(m_textureMapper.get());
-
-    m_backingStoresWithPendingBuffers.clear();
-}
-
-void LayerTreeHostProxy::flushLayerChanges()
-{
-    m_rootLayer->syncCompositingState(FloatRect());
-    swapBuffers();
-
-    // The pending tiles state is on its way for the screen, tell the web process to render the next one.
-    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::RenderNextFrame(), m_drawingAreaProxy->page()->pageID());
-}
-
-void LayerTreeHostProxy::ensureRootLayer()
-{
-    if (m_rootLayer)
-        return;
-    m_rootLayer = createLayer(InvalidWebLayerID);
-    m_rootLayer->setMasksToBounds(false);
-    m_rootLayer->setDrawsContent(false);
-    m_rootLayer->setAnchorPoint(FloatPoint3D(0, 0, 0));
-
-    // The root layer should not have zero size, or it would be optimized out.
-    m_rootLayer->setSize(FloatSize(1.0, 1.0));
-    if (!m_textureMapper)
-        m_textureMapper = TextureMapper::create(TextureMapper::OpenGLMode);
-    toTextureMapperLayer(m_rootLayer.get())->setTextureMapper(m_textureMapper.get());
-}
-
-void LayerTreeHostProxy::syncRemoteContent()
-{
-    // We enqueue messages and execute them during paint, as they require an active GL context.
-    ensureRootLayer();
-
-    while (OwnPtr<LayerTreeMessageToRenderer> nextMessage = m_messagesToRenderer.tryGetMessage()) {
-        switch (nextMessage->type()) {
-        case LayerTreeMessageToRenderer::SetRootLayer: {
-            const SetRootLayerMessageData& data = static_cast<SetRootLayerMessage*>(nextMessage.get())->data();
-            setRootLayerID(data.layerID);
-            break;
-        }
-
-        case LayerTreeMessageToRenderer::DeleteLayer: {
-            const DeleteLayerMessageData& data = static_cast<DeleteLayerMessage*>(nextMessage.get())->data();
-            deleteLayer(data.layerID);
-            break;
-        }
-
-        case LayerTreeMessageToRenderer::SyncLayerParameters: {
-            const SyncLayerParametersMessageData& data = static_cast<SyncLayerParametersMessage*>(nextMessage.get())->data();
-            syncLayerParameters(data.layerInfo);
-            break;
-        }
-
-        case LayerTreeMessageToRenderer::CreateTile: {
-            const CreateTileMessageData& data = static_cast<CreateTileMessage*>(nextMessage.get())->data();
-            createTile(data.layerID, data.remoteTileID, data.scale);
-            break;
-        }
-
-        case LayerTreeMessageToRenderer::RemoveTile: {
-            const RemoveTileMessageData& data = static_cast<RemoveTileMessage*>(nextMessage.get())->data();
-            removeTile(data.layerID, data.remoteTileID);
-            break;
-        }
-
-        case LayerTreeMessageToRenderer::UpdateTile: {
-            const UpdateTileMessageData& data = static_cast<UpdateTileMessage*>(nextMessage.get())->data();
-            updateTile(data.layerID, data.remoteTileID, data.sourceRect, data.targetRect, data.bitmap.get());
-            break;
-        }
-
-        case LayerTreeMessageToRenderer::CreateImage: {
-            const CreateImageMessageData& data = static_cast<CreateImageMessage*>(nextMessage.get())->data();
-            createImage(data.imageID, data.bitmap.get());
-            break;
-        }
-
-        case LayerTreeMessageToRenderer::DestroyImage: {
-            const DestroyImageMessageData& data = static_cast<DestroyImageMessage*>(nextMessage.get())->data();
-            destroyImage(data.imageID);
-            break;
-        }
-
-        case LayerTreeMessageToRenderer::FlushLayerChanges:
-            flushLayerChanges();
-            break;
-        }
-    }
-}
-
-void LayerTreeHostProxy::pushUpdateToQueue(PassOwnPtr<LayerTreeMessageToRenderer> message)
-{
-    m_messagesToRenderer.append(message);
-    updateViewport();
-}
-
-void LayerTreeHostProxy::createTileForLayer(int layerID, int tileID, const WebKit::UpdateInfo& updateInfo)
-{
-    CreateTileMessageData data;
-    data.layerID = layerID;
-    data.remoteTileID = tileID;
-    data.scale = updateInfo.updateScaleFactor;
-    pushUpdateToQueue(CreateTileMessage::create(data));
-    updateTileForLayer(layerID, tileID, updateInfo);
-}
-
-void LayerTreeHostProxy::updateTileForLayer(int layerID, int tileID, const WebKit::UpdateInfo& updateInfo)
-{
-    UpdateTileMessageData data;
-    data.layerID = layerID;
-    data.remoteTileID = tileID;
-    data.bitmap = ShareableBitmap::create(updateInfo.bitmapHandle);
-    ASSERT(updateInfo.updateRects.size() == 1);
-    data.sourceRect = updateInfo.updateRects.first();
-    data.targetRect = updateInfo.updateRectBounds;
-    pushUpdateToQueue(UpdateTileMessage::create(data));
-}
-
-void LayerTreeHostProxy::removeTileForLayer(int layerID, int tileID)
-{
-    RemoveTileMessageData data;
-    data.layerID = layerID;
-    data.remoteTileID = tileID;
-    pushUpdateToQueue(RemoveTileMessage::create(data));
-}
-
-
-void LayerTreeHostProxy::deleteCompositingLayer(WebLayerID id)
-{
-    DeleteLayerMessageData data;
-    data.layerID = id;
-    pushUpdateToQueue(DeleteLayerMessage::create(data));
-}
-
-void LayerTreeHostProxy::setRootCompositingLayer(WebLayerID id)
-{
-    SetRootLayerMessageData data;
-    data.layerID = id;
-    pushUpdateToQueue(SetRootLayerMessage::create(data));
-}
-
-void LayerTreeHostProxy::syncCompositingLayerState(const WebLayerInfo& info)
-{
-    SyncLayerParametersMessageData data;
-    data.layerInfo = info;
-    pushUpdateToQueue(SyncLayerParametersMessage::create(data));
-}
-
-void LayerTreeHostProxy::didRenderFrame()
-{
-    pushUpdateToQueue(FlushLayerChangesMessage::create());
-    updateViewport();
-}
-
-void LayerTreeHostProxy::createDirectlyCompositedImage(int64_t key, const WebKit::ShareableBitmap::Handle& handle)
-{
-    CreateImageMessageData data;
-    data.imageID = key;
-    data.bitmap = ShareableBitmap::create(handle);
-    pushUpdateToQueue(CreateImageMessage::create(data));
-}
-
-void LayerTreeHostProxy::destroyDirectlyCompositedImage(int64_t key)
-{
-    DestroyImageMessageData data;
-    data.imageID = key;
-    pushUpdateToQueue(DestroyImageMessage::create(data));
-}
-
-void LayerTreeHostProxy::setVisibleContentsRectForPanning(const IntRect& rect, const FloatPoint& trajectoryVector)
-{
-    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::SetVisibleContentsRectForPanning(rect, trajectoryVector), m_drawingAreaProxy->page()->pageID());
-}
-
-void LayerTreeHostProxy::setVisibleContentsRectForScaling(const IntRect& rect, float scale)
-{
-    m_visibleContentsRect = rect;
-    m_contentsScale = scale;
-    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::SetVisibleContentsRectForScaling(rect, scale), m_drawingAreaProxy->page()->pageID());
-}
-
-void LayerTreeHostProxy::purgeGLResources()
-{
-    TextureMapperLayer* layer = toTextureMapperLayer(rootLayer());
-
-    if (layer)
-        layer->clearBackingStoresRecursive();
-
-    m_directlyCompositedImages.clear();
-    m_textureMapper.clear();
-    m_backingStoresWithPendingBuffers.clear();
-    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::PurgeBackingStores(), m_drawingAreaProxy->page()->pageID());
-}
-
-}
-#endif
diff --git a/Source/WebKit2/UIProcess/qt/QtFlickProvider.cpp b/Source/WebKit2/UIProcess/qt/QtFlickProvider.cpp
index 3760c0cfb..b34bba642 100644
--- a/Source/WebKit2/UIProcess/qt/QtFlickProvider.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtFlickProvider.cpp
@@ -26,7 +26,9 @@
 
 #include <QCoreApplication>
 #include <QDeclarativeEngine>
+#include <QMouseEvent>
 #include <QPointF>
+#include <QQuickCanvas>
 #include <QQuickItem>
 #include <QTouchEvent>
 #include <wtf/Assertions.h>
@@ -106,7 +108,8 @@ QtFlickProvider::QtFlickProvider(QQuickWebView* viewItem, QQuickWebPage* pageIte
     pageItem->setParentItem(m_contentItem);
 
     // Propagate flickable signals.
-    connect(m_flickable, SIGNAL(movingChanged()), SIGNAL(movingChanged()), Qt::DirectConnection);
+    connect(m_flickable, SIGNAL(movementStarted()), SIGNAL(movementStarted()), Qt::DirectConnection);
+    connect(m_flickable, SIGNAL(movementEnded()), SIGNAL(movementEnded()), Qt::DirectConnection);
     connect(m_flickable, SIGNAL(flickingChanged()), SIGNAL(flickingChanged()), Qt::DirectConnection);
     connect(m_flickable, SIGNAL(draggingChanged()), SIGNAL(draggingChanged()), Qt::DirectConnection);
     connect(m_flickable, SIGNAL(contentWidthChanged()), SIGNAL(contentWidthChanged()), Qt::DirectConnection);
@@ -115,9 +118,42 @@ QtFlickProvider::QtFlickProvider(QQuickWebView* viewItem, QQuickWebPage* pageIte
     connect(m_flickable, SIGNAL(contentYChanged()), SIGNAL(contentYChanged()), Qt::DirectConnection);
 }
 
-void QtFlickProvider::handleTouchFlickEvent(QTouchEvent* event)
+void QtFlickProvider::handleTouchFlickEvent(QTouchEvent* touchEvent)
 {
-    QCoreApplication::sendEvent(m_flickable, event);
+    // Since the Flickable does not handle touch events directly the sent
+    // touch event would end up in the WebView again and would thus trigger
+    // an infinite loop.
+    // Hence do the touch to mouse event conversion for the Flickable here.
+    QEvent::Type mouseEventType = QEvent::None;
+    Qt::MouseButton mouseButton = Qt::NoButton;
+
+    switch (touchEvent->type()) {
+    case QEvent::TouchBegin:
+        mouseEventType = QEvent::MouseButtonPress;
+
+        // We need to set the mouse button so that the Flickable
+        // item receives the initial mouse press event.
+        mouseButton = Qt::LeftButton;
+        break;
+    case QEvent::TouchUpdate:
+        mouseEventType = QEvent::MouseMove;
+        break;
+    case QEvent::TouchEnd:
+        mouseEventType = QEvent::MouseButtonRelease;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+
+    QPointF touchPosition = touchEvent->touchPoints().last().pos();
+    QMouseEvent mouseEvent(mouseEventType, touchPosition, mouseButton, mouseButton, Qt::NoModifier);
+
+    // Send the event to the canvas and let the canvas propagate it
+    // to the Flickable. This makes sure that the Flickable grabs
+    // the mouse so that it also receives the events of gestures
+    // which started inside the viewport but ended outside of it.
+    QCoreApplication::sendEvent(m_flickable->canvas(), &mouseEvent);
 }
 
 QQuickItem* QtFlickProvider::contentItem()
diff --git a/Source/WebKit2/UIProcess/qt/QtFlickProvider.h b/Source/WebKit2/UIProcess/qt/QtFlickProvider.h
index f388a0b4b..275810bbf 100644
--- a/Source/WebKit2/UIProcess/qt/QtFlickProvider.h
+++ b/Source/WebKit2/UIProcess/qt/QtFlickProvider.h
@@ -72,7 +72,8 @@ Q_SIGNALS:
     void contentHeightChanged();
     void contentXChanged();
     void contentYChanged();
-    void movingChanged();
+    void movementStarted();
+    void movementEnded();
     void flickingChanged();
     void draggingChanged();
 
diff --git a/Source/WebKit2/UIProcess/qt/QtPageClient.cpp b/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
index 8d6ebbb03..d7049cb3b 100644
--- a/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
@@ -289,3 +289,8 @@ void QtPageClient::exitAcceleratedCompositingMode()
     // FIXME: Implement.
 }
 
+void QtPageClient::updateAcceleratedCompositingMode(const LayerTreeContext&)
+{
+    // FIXME: Implement.
+}
+
diff --git a/Source/WebKit2/UIProcess/qt/QtPageClient.h b/Source/WebKit2/UIProcess/qt/QtPageClient.h
index f4ffa18ad..f09db8243 100644
--- a/Source/WebKit2/UIProcess/qt/QtPageClient.h
+++ b/Source/WebKit2/UIProcess/qt/QtPageClient.h
@@ -65,6 +65,7 @@ public:
 #if USE(ACCELERATED_COMPOSITING)
     virtual void enterAcceleratedCompositingMode(const LayerTreeContext&);
     virtual void exitAcceleratedCompositingMode();
+    virtual void updateAcceleratedCompositingMode(const LayerTreeContext&);
 #endif // USE(ACCELERATED_COMPOSITING)
     virtual void pageClosed() { }
     virtual void startDrag(const WebCore::DragData&, PassRefPtr<ShareableBitmap> dragImage);
diff --git a/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp b/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp
index 1787391b7..be17aacbf 100644
--- a/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp
@@ -63,6 +63,7 @@ bool QtPanGestureRecognizer::recognize(const QTouchEvent* event)
         m_state = GestureRecognitionStarted;
         m_firstPosition = touchPoint.screenPos();
         m_touchBegin.reset(new QTouchEvent(*event));
+        interactionEngine()->panGestureCancelled();
         return false;
     case QEvent::TouchUpdate: {
         ASSERT(m_state != NoGesture);
diff --git a/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.cpp b/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.cpp
index bfec37138..c838767b6 100644
--- a/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.cpp
@@ -61,13 +61,18 @@ static const int kScaleAnimationDurationMillis = 250;
 
 class ViewportUpdateDeferrer {
 public:
-    ViewportUpdateDeferrer(QtViewportInteractionEngine* engine)
+    enum SuspendContentFlag { DeferUpdate, DeferUpdateAndSuspendContent };
+    ViewportUpdateDeferrer(QtViewportInteractionEngine* engine, SuspendContentFlag suspendContentFlag = DeferUpdate)
         : engine(engine)
     {
-        if (engine->m_suspendCount++)
-            return;
-
-        emit engine->contentSuspendRequested();
+        engine->m_suspendCount++;
+
+        // There is no need to suspend content for immediate updates
+        // only during animations or longer gestures.
+        if (suspendContentFlag == DeferUpdateAndSuspendContent && !engine->m_hasSuspendedContent) {
+            engine->m_hasSuspendedContent = true;
+            emit engine->contentSuspendRequested();
+        }
     }
 
     ~ViewportUpdateDeferrer()
@@ -75,7 +80,10 @@ public:
         if (--(engine->m_suspendCount))
             return;
 
-        emit engine->contentResumeRequested();
+        if (engine->m_hasSuspendedContent) {
+            engine->m_hasSuspendedContent = false;
+            emit engine->contentResumeRequested();
+        }
 
         // Make sure that tiles all around the viewport will be requested.
         emit engine->contentWasMoved(QPointF());
@@ -117,6 +125,7 @@ QtViewportInteractionEngine::QtViewportInteractionEngine(QQuickWebView* viewport
     , m_content(content)
     , m_flickProvider(flickProvider)
     , m_suspendCount(0)
+    , m_hasSuspendedContent(false)
     , m_hadUserInteraction(false)
     , m_scaleAnimation(new ScaleAnimation(this))
     , m_pinchStartScale(-1)
@@ -125,7 +134,8 @@ QtViewportInteractionEngine::QtViewportInteractionEngine(QQuickWebView* viewport
 
     connect(m_content, SIGNAL(widthChanged()), SLOT(itemSizeChanged()), Qt::DirectConnection);
     connect(m_content, SIGNAL(heightChanged()), SLOT(itemSizeChanged()), Qt::DirectConnection);
-    connect(m_flickProvider, SIGNAL(movingChanged()), SLOT(flickableMovingStateChanged()), Qt::DirectConnection);
+    connect(m_flickProvider, SIGNAL(movementStarted()), SLOT(flickableMoveStarted()), Qt::DirectConnection);
+    connect(m_flickProvider, SIGNAL(movementEnded()), SLOT(flickableMoveEnded()), Qt::DirectConnection);
 
     connect(m_scaleAnimation, SIGNAL(valueChanged(QVariant)),
             SLOT(scaleAnimationValueChanged(QVariant)), Qt::DirectConnection);
@@ -187,27 +197,19 @@ bool QtViewportInteractionEngine::animateItemRectVisible(const QRectF& itemRect)
     return true;
 }
 
-void QtViewportInteractionEngine::flickableMovingStateChanged()
-{
-    if (m_flickProvider->isMoving()) {
-        if (m_scrollUpdateDeferrer)
-            return; // We get the isMoving() signal multiple times.
-        panMoveStarted();
-    } else
-        panMoveEnded();
-}
-
-void QtViewportInteractionEngine::panMoveStarted()
+void QtViewportInteractionEngine::flickableMoveStarted()
 {
-    m_scrollUpdateDeferrer = adoptPtr(new ViewportUpdateDeferrer(this));
+    Q_ASSERT(m_flickProvider->isMoving());
+    m_scrollUpdateDeferrer = adoptPtr(new ViewportUpdateDeferrer(this, ViewportUpdateDeferrer::DeferUpdateAndSuspendContent));
 
     m_lastScrollPosition = m_flickProvider->contentPos();
     connect(m_flickProvider, SIGNAL(contentXChanged()), SLOT(flickableMovingPositionUpdate()));
     connect(m_flickProvider, SIGNAL(contentYChanged()), SLOT(flickableMovingPositionUpdate()));
 }
 
-void QtViewportInteractionEngine::panMoveEnded()
+void QtViewportInteractionEngine::flickableMoveEnded()
 {
+    Q_ASSERT(!m_flickProvider->isMoving());
     // This method is called on the end of the pan or pan kinetic animation.
     m_scrollUpdateDeferrer.clear();
 
@@ -230,7 +232,7 @@ void QtViewportInteractionEngine::scaleAnimationStateChanged(QAbstractAnimation:
     switch (newState) {
     case QAbstractAnimation::Running:
         if (!m_scaleUpdateDeferrer)
-            m_scaleUpdateDeferrer = adoptPtr(new ViewportUpdateDeferrer(this));
+            m_scaleUpdateDeferrer = adoptPtr(new ViewportUpdateDeferrer(this, ViewportUpdateDeferrer::DeferUpdateAndSuspendContent));
         break;
     case QAbstractAnimation::Stopped:
         m_scaleUpdateDeferrer.clear();
@@ -507,7 +509,7 @@ void QtViewportInteractionEngine::pinchGestureStarted(const QPointF& pinchCenter
 
     m_hadUserInteraction = true;
 
-    m_scaleUpdateDeferrer = adoptPtr(new ViewportUpdateDeferrer(this));
+    m_scaleUpdateDeferrer = adoptPtr(new ViewportUpdateDeferrer(this, ViewportUpdateDeferrer::DeferUpdateAndSuspendContent));
 
     m_lastPinchCenterInViewportCoordinates = pinchCenterInViewportCoordinates;
     m_pinchStartScale = m_content->contentsScale();
diff --git a/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.h b/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.h
index 9419be0f6..017c307cd 100644
--- a/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.h
+++ b/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.h
@@ -113,12 +113,14 @@ private Q_SLOTS:
     // Respond to changes of content that are not driven by us, like the page resizing itself.
     void itemSizeChanged();
 
-    void flickableMovingStateChanged();
     void flickableMovingPositionUpdate();
 
     void scaleAnimationStateChanged(QAbstractAnimation::State, QAbstractAnimation::State);
     void scaleAnimationValueChanged(QVariant value) { setItemRectVisible(value.toRectF()); }
 
+    void flickableMoveStarted(); // Called when panning starts.
+    void flickableMoveEnded(); //   Called when panning (+ kinetic animation) ends.
+
 private:
     friend class ViewportUpdateDeferrer;
 
@@ -130,9 +132,6 @@ private:
     qreal innerBoundedCSSScale(qreal);
     qreal outerBoundedCSSScale(qreal);
 
-    void panMoveStarted(); // Called when panning starts.
-    void panMoveEnded(); //   Called when panning (+ kinetic animation) ends.
-
     QRectF computePosRangeForItemAtScale(qreal itemScale) const;
     bool ensureContentWithinViewportBoundary(bool immediate = false);
 
@@ -146,6 +145,7 @@ private:
     Constraints m_constraints;
 
     int m_suspendCount;
+    bool m_hasSuspendedContent;
     OwnPtr<ViewportUpdateDeferrer> m_scaleUpdateDeferrer;
     OwnPtr<ViewportUpdateDeferrer> m_scrollUpdateDeferrer;
 
diff --git a/Source/WebKit2/UIProcess/qt/QtWebContext.cpp b/Source/WebKit2/UIProcess/qt/QtWebContext.cpp
index df27961b5..a800fef15 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebContext.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebContext.cpp
@@ -45,9 +45,11 @@ static HashMap<uint64_t, QtWebContext*> contextMap;
 QtWebContext* QtWebContext::s_defaultContext = 0;
 
 QtWebContext::QtWebContext(WebContext* context)
-    : m_context(context)
+    : m_contextID(generateContextID())
+    , m_context(context)
+    , m_downloadManager(adoptPtr(new QtDownloadManager(context)))
+    , m_iconDatabase(adoptPtr(new QtWebIconDatabaseClient(this)))
 {
-    m_contextID = generateContextID();
     contextMap.set(m_contextID, this);
 }
 
@@ -72,7 +74,8 @@ PassRefPtr<QtWebContext> QtWebContext::defaultContext()
     RefPtr<WebContext> context = WebContext::sharedProcessContext();
     RefPtr<QtWebContext> defaultContext = QtWebContext::create(context.get());
     s_defaultContext = defaultContext.get();
-    defaultContext->initialize();
+    // Make sure that this doesn't get called in WebKitTestRunner (defaultContext isn't used there).
+    defaultContext->initializeContextInjectedBundleClient();
 
     return defaultContext.release();
 }
@@ -107,13 +110,6 @@ QtWebContext* QtWebContext::contextByID(uint64_t id)
     return contextMap.get(id);
 }
 
-void QtWebContext::initialize()
-{
-    m_downloadManager = adoptPtr(new QtDownloadManager(m_context.get()));
-    m_iconDatabase = adoptPtr(new QtWebIconDatabaseClient(this));
-    initializeContextInjectedBundleClient();
-}
-
 void QtWebContext::initializeContextInjectedBundleClient()
 {
     WKContextInjectedBundleClient injectedBundleClient;
diff --git a/Source/WebKit2/UIProcess/qt/QtWebContext.h b/Source/WebKit2/UIProcess/qt/QtWebContext.h
index 202db2242..7703db459 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebContext.h
+++ b/Source/WebKit2/UIProcess/qt/QtWebContext.h
@@ -63,7 +63,6 @@ public:
 private:
     explicit QtWebContext(WebContext*);
 
-    void initialize();
     void initializeContextInjectedBundleClient();
 
     static void didReceiveMessageFromInjectedBundle(WKContextRef, WKStringRef messageName, WKTypeRef messageBody, const void*);
diff --git a/Source/WebKit2/UIProcess/qt/QtWebError.h b/Source/WebKit2/UIProcess/qt/QtWebError.h
index 3bd7bd508..3fe9eb906 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebError.h
+++ b/Source/WebKit2/UIProcess/qt/QtWebError.h
@@ -34,6 +34,7 @@ QT_END_NAMESPACE
 class QtWebError {
 public:
     enum Type {
+        NoError,
         InternalError,
         NetworkError,
         HttpError,
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
index 7d089929a..95ed43191 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
@@ -106,57 +106,7 @@ QtWebPageEventHandler::~QtWebPageEventHandler()
     disconnect(qApp->inputPanel(), SIGNAL(visibleChanged()), this, SLOT(inputPanelVisibleChanged()));
 }
 
-bool QtWebPageEventHandler::handleEvent(QEvent* ev)
-{
-    switch (ev->type()) {
-    case QEvent::MouseMove:
-        return handleMouseMoveEvent(static_cast<QMouseEvent*>(ev));
-    case QEvent::MouseButtonPress:
-    case QEvent::MouseButtonDblClick:
-        // If a MouseButtonDblClick was received then we got a MouseButtonPress before
-        // handleMousePressEvent will take care of double clicks.
-        return handleMousePressEvent(static_cast<QMouseEvent*>(ev));
-    case QEvent::MouseButtonRelease:
-        return handleMouseReleaseEvent(static_cast<QMouseEvent*>(ev));
-    case QEvent::Wheel:
-        return handleWheelEvent(static_cast<QWheelEvent*>(ev));
-    case QEvent::HoverLeave:
-        return handleHoverLeaveEvent(static_cast<QHoverEvent*>(ev));
-    case QEvent::HoverEnter: // Fall-through, for WebKit the distinction doesn't matter.
-    case QEvent::HoverMove:
-        return handleHoverMoveEvent(static_cast<QHoverEvent*>(ev));
-    case QEvent::DragEnter:
-        return handleDragEnterEvent(static_cast<QDragEnterEvent*>(ev));
-    case QEvent::DragLeave:
-        return handleDragLeaveEvent(static_cast<QDragLeaveEvent*>(ev));
-    case QEvent::DragMove:
-        return handleDragMoveEvent(static_cast<QDragMoveEvent*>(ev));
-    case QEvent::Drop:
-        return handleDropEvent(static_cast<QDropEvent*>(ev));
-    case QEvent::KeyPress:
-        return handleKeyPressEvent(static_cast<QKeyEvent*>(ev));
-    case QEvent::KeyRelease:
-        return handleKeyReleaseEvent(static_cast<QKeyEvent*>(ev));
-    case QEvent::FocusIn:
-        return handleFocusInEvent(static_cast<QFocusEvent*>(ev));
-    case QEvent::FocusOut:
-        return handleFocusOutEvent(static_cast<QFocusEvent*>(ev));
-    case QEvent::TouchBegin:
-    case QEvent::TouchEnd:
-    case QEvent::TouchCancel:
-    case QEvent::TouchUpdate:
-        touchEvent(static_cast<QTouchEvent*>(ev));
-        return true;
-    case QEvent::InputMethod:
-        inputMethodEvent(static_cast<QInputMethodEvent*>(ev));
-        return false; // This is necessary to avoid an endless loop in connection with QQuickItem::event().
-    }
-
-    // FIXME: Move all common event handling here.
-    return false;
-}
-
-bool QtWebPageEventHandler::handleMouseMoveEvent(QMouseEvent* ev)
+void QtWebPageEventHandler::handleMouseMoveEvent(QMouseEvent* ev)
 {
     // For some reason mouse press results in mouse hover (which is
     // converted to mouse move for WebKit). We ignore these hover
@@ -167,15 +117,13 @@ bool QtWebPageEventHandler::handleMouseMoveEvent(QMouseEvent* ev)
     QTransform fromItemTransform = m_webPage->transformFromItem();
     QPointF webPagePoint = fromItemTransform.map(ev->localPos());
     if (lastPos == webPagePoint)
-        return ev->isAccepted();
+        return;
     lastPos = webPagePoint;
 
     m_webPageProxy->handleMouseEvent(NativeWebMouseEvent(ev, fromItemTransform, /*eventClickCount*/ 0));
-
-    return ev->isAccepted();
 }
 
-bool QtWebPageEventHandler::handleMousePressEvent(QMouseEvent* ev)
+void QtWebPageEventHandler::handleMousePressEvent(QMouseEvent* ev)
 {
     QTransform fromItemTransform = m_webPage->transformFromItem();
     QPointF webPagePoint = fromItemTransform.map(ev->localPos());
@@ -193,48 +141,43 @@ bool QtWebPageEventHandler::handleMousePressEvent(QMouseEvent* ev)
 
     m_lastClick = webPagePoint;
     m_clickTimer.start(qApp->styleHints()->mouseDoubleClickInterval(), this);
-
-    return ev->isAccepted();
 }
 
-bool QtWebPageEventHandler::handleMouseReleaseEvent(QMouseEvent* ev)
+void QtWebPageEventHandler::handleMouseReleaseEvent(QMouseEvent* ev)
 {
     QTransform fromItemTransform = m_webPage->transformFromItem();
     m_webPageProxy->handleMouseEvent(NativeWebMouseEvent(ev, fromItemTransform, /*eventClickCount*/ 0));
-    return ev->isAccepted();
 }
 
-bool QtWebPageEventHandler::handleWheelEvent(QWheelEvent* ev)
+void QtWebPageEventHandler::handleWheelEvent(QWheelEvent* ev)
 {
     QTransform fromItemTransform = m_webPage->transformFromItem();
     m_webPageProxy->handleWheelEvent(NativeWebWheelEvent(ev, fromItemTransform));
     // FIXME: Handle whether the page used the wheel event or not.
     if (m_interactionEngine)
         m_interactionEngine->wheelEvent(ev);
-    return ev->isAccepted();
 }
 
-bool QtWebPageEventHandler::handleHoverLeaveEvent(QHoverEvent* ev)
+void QtWebPageEventHandler::handleHoverLeaveEvent(QHoverEvent* ev)
 {
     // To get the correct behavior of mouseout, we need to turn the Leave event of our webview into a mouse move
     // to a very far region.
     QTransform fromItemTransform = m_webPage->transformFromItem();
     QHoverEvent fakeEvent(QEvent::HoverMove, QPoint(INT_MIN, INT_MIN), fromItemTransform.map(ev->oldPosF()));
     fakeEvent.setTimestamp(ev->timestamp());
-    return handleHoverMoveEvent(&fakeEvent);
+    handleHoverMoveEvent(&fakeEvent);
 }
 
-bool QtWebPageEventHandler::handleHoverMoveEvent(QHoverEvent* ev)
+void QtWebPageEventHandler::handleHoverMoveEvent(QHoverEvent* ev)
 {
     QTransform fromItemTransform = m_webPage->transformFromItem();
     QMouseEvent me(QEvent::MouseMove, fromItemTransform.map(ev->posF()), Qt::NoButton, Qt::NoButton, Qt::NoModifier);
     me.setAccepted(ev->isAccepted());
     me.setTimestamp(ev->timestamp());
-
-    return handleMouseMoveEvent(&me);
+    handleMouseMoveEvent(&me);
 }
 
-bool QtWebPageEventHandler::handleDragEnterEvent(QDragEnterEvent* ev)
+void QtWebPageEventHandler::handleDragEnterEvent(QDragEnterEvent* ev)
 {
     m_webPageProxy->resetDragOperation();
     QTransform fromItemTransform = m_webPage->transformFromItem();
@@ -242,10 +185,9 @@ bool QtWebPageEventHandler::handleDragEnterEvent(QDragEnterEvent* ev)
     DragData dragData(ev->mimeData(), fromItemTransform.map(ev->pos()), QCursor::pos(), dropActionToDragOperation(ev->possibleActions()));
     m_webPageProxy->dragEntered(&dragData);
     ev->acceptProposedAction();
-    return true;
 }
 
-bool QtWebPageEventHandler::handleDragLeaveEvent(QDragLeaveEvent* ev)
+void QtWebPageEventHandler::handleDragLeaveEvent(QDragLeaveEvent* ev)
 {
     bool accepted = ev->isAccepted();
 
@@ -255,10 +197,9 @@ bool QtWebPageEventHandler::handleDragLeaveEvent(QDragLeaveEvent* ev)
     m_webPageProxy->resetDragOperation();
 
     ev->setAccepted(accepted);
-    return accepted;
 }
 
-bool QtWebPageEventHandler::handleDragMoveEvent(QDragMoveEvent* ev)
+void QtWebPageEventHandler::handleDragMoveEvent(QDragMoveEvent* ev)
 {
     bool accepted = ev->isAccepted();
 
@@ -271,10 +212,9 @@ bool QtWebPageEventHandler::handleDragMoveEvent(QDragMoveEvent* ev)
         ev->accept();
 
     ev->setAccepted(accepted);
-    return accepted;
 }
 
-bool QtWebPageEventHandler::handleDropEvent(QDropEvent* ev)
+void QtWebPageEventHandler::handleDropEvent(QDropEvent* ev)
 {
     bool accepted = ev->isAccepted();
     QTransform fromItemTransform = m_webPage->transformFromItem();
@@ -286,7 +226,6 @@ bool QtWebPageEventHandler::handleDropEvent(QDropEvent* ev)
     ev->accept();
 
     ev->setAccepted(accepted);
-    return accepted;
 }
 
 void QtWebPageEventHandler::handlePotentialSingleTapEvent(const QTouchEvent::TouchPoint& point)
@@ -319,28 +258,24 @@ void QtWebPageEventHandler::timerEvent(QTimerEvent* ev)
         QObject::timerEvent(ev);
 }
 
-bool QtWebPageEventHandler::handleKeyPressEvent(QKeyEvent* ev)
+void QtWebPageEventHandler::handleKeyPressEvent(QKeyEvent* ev)
 {
     m_webPageProxy->handleKeyboardEvent(NativeWebKeyboardEvent(ev));
-    return true;
 }
 
-bool QtWebPageEventHandler::handleKeyReleaseEvent(QKeyEvent* ev)
+void QtWebPageEventHandler::handleKeyReleaseEvent(QKeyEvent* ev)
 {
     m_webPageProxy->handleKeyboardEvent(NativeWebKeyboardEvent(ev));
-    return true;
 }
 
-bool QtWebPageEventHandler::handleFocusInEvent(QFocusEvent*)
+void QtWebPageEventHandler::handleFocusInEvent(QFocusEvent*)
 {
     m_webPageProxy->viewStateDidChange(WebPageProxy::ViewIsFocused | WebPageProxy::ViewWindowIsActive);
-    return true;
 }
 
-bool QtWebPageEventHandler::handleFocusOutEvent(QFocusEvent*)
+void QtWebPageEventHandler::handleFocusOutEvent(QFocusEvent*)
 {
     m_webPageProxy->viewStateDidChange(WebPageProxy::ViewIsFocused | WebPageProxy::ViewWindowIsActive);
-    return true;
 }
 
 void QtWebPageEventHandler::setViewportInteractionEngine(QtViewportInteractionEngine* engine)
@@ -348,7 +283,7 @@ void QtWebPageEventHandler::setViewportInteractionEngine(QtViewportInteractionEn
     m_interactionEngine = engine;
 }
 
-void QtWebPageEventHandler::inputMethodEvent(QInputMethodEvent* ev)
+void QtWebPageEventHandler::handleInputMethodEvent(QInputMethodEvent* ev)
 {
     QString commit = ev->commitString();
     QString composition = ev->preeditString();
@@ -415,7 +350,7 @@ void QtWebPageEventHandler::inputMethodEvent(QInputMethodEvent* ev)
     ev->accept();
 }
 
-void QtWebPageEventHandler::touchEvent(QTouchEvent* event)
+void QtWebPageEventHandler::handleTouchEvent(QTouchEvent* event)
 {
 #if ENABLE(TOUCH_EVENTS)
     QTransform fromItemTransform = m_webPage->transformFromItem();
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.h b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.h
index ebe95dd8d..519ec5471 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.h
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.h
@@ -43,7 +43,22 @@ public:
     QtWebPageEventHandler(WKPageRef, QQuickWebPage*, QQuickWebView*);
     ~QtWebPageEventHandler();
 
-    bool handleEvent(QEvent*);
+    void handleKeyPressEvent(QKeyEvent*);
+    void handleKeyReleaseEvent(QKeyEvent*);
+    void handleFocusInEvent(QFocusEvent*);
+    void handleFocusOutEvent(QFocusEvent*);
+    void handleMouseMoveEvent(QMouseEvent*);
+    void handleMousePressEvent(QMouseEvent*);
+    void handleMouseReleaseEvent(QMouseEvent*);
+    void handleWheelEvent(QWheelEvent*);
+    void handleHoverLeaveEvent(QHoverEvent*);
+    void handleHoverMoveEvent(QHoverEvent*);
+    void handleDragEnterEvent(QDragEnterEvent*);
+    void handleDragLeaveEvent(QDragLeaveEvent*);
+    void handleDragMoveEvent(QDragMoveEvent*);
+    void handleDropEvent(QDropEvent*);
+    void handleInputMethodEvent(QInputMethodEvent*);
+    void handleTouchEvent(QTouchEvent*);
 
     void setViewportInteractionEngine(QtViewportInteractionEngine*);
 
@@ -74,26 +89,8 @@ private slots:
     void inputPanelVisibleChanged();
 
 private:
-    bool handleKeyPressEvent(QKeyEvent*);
-    bool handleKeyReleaseEvent(QKeyEvent*);
-    bool handleFocusInEvent(QFocusEvent*);
-    bool handleFocusOutEvent(QFocusEvent*);
-    bool handleMouseMoveEvent(QMouseEvent*);
-    bool handleMousePressEvent(QMouseEvent*);
-    bool handleMouseReleaseEvent(QMouseEvent*);
-    bool handleWheelEvent(QWheelEvent*);
-    bool handleHoverLeaveEvent(QHoverEvent*);
-    bool handleHoverMoveEvent(QHoverEvent*);
-    bool handleDragEnterEvent(QDragEnterEvent*);
-    bool handleDragLeaveEvent(QDragLeaveEvent*);
-    bool handleDragMoveEvent(QDragMoveEvent*);
-    bool handleDropEvent(QDropEvent*);
-
     void timerEvent(QTimerEvent*);
 
-    void touchEvent(QTouchEvent*);
-    void inputMethodEvent(QInputMethodEvent*);
-
     QPointF m_lastClick;
     QBasicTimer m_clickTimer;
     Qt::MouseButton m_previousClickButton;
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageLoadClient.cpp b/Source/WebKit2/UIProcess/qt/QtWebPageLoadClient.cpp
index 2601f4802..de22a9fb3 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageLoadClient.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageLoadClient.cpp
@@ -24,6 +24,7 @@
 #include "WKStringQt.h"
 #include "qquickwebview_p.h"
 #include "qquickwebview_p_p.h"
+#include "qwebloadrequest_p.h"
 #include <WKFrame.h>
 
 QtWebPageLoadClient::QtWebPageLoadClient(WKPageRef pageRef, QQuickWebView* webView)
@@ -49,28 +50,28 @@ QtWebPageLoadClient::QtWebPageLoadClient(WKPageRef pageRef, QQuickWebView* webVi
     WKPageSetPageLoaderClient(pageRef, &loadClient);
 }
 
-void QtWebPageLoadClient::didStartProvisionalLoadForFrame()
+void QtWebPageLoadClient::didStartProvisionalLoadForFrame(const QUrl& url)
 {
-    emit m_webView->navigationStateChanged();
-    emit m_webView->loadStarted();
+    QWebLoadRequest loadRequest(url, QQuickWebView::LoadStartedStatus);
+    m_webView->d_func()->didChangeLoadingState(&loadRequest);
 }
 
-void QtWebPageLoadClient::didCommitLoadForFrame(const QUrl& url)
+void QtWebPageLoadClient::didCommitLoadForFrame()
 {
-    emit m_webView->navigationStateChanged();
-    emit m_webView->urlChanged(url);
+    emit m_webView->navigationHistoryChanged();
+    emit m_webView->urlChanged();
     m_webView->d_func()->loadDidCommit();
 }
 
-void QtWebPageLoadClient::didSameDocumentNavigationForFrame(const QUrl& url)
+void QtWebPageLoadClient::didSameDocumentNavigationForFrame()
 {
-    emit m_webView->navigationStateChanged();
-    emit m_webView->urlChanged(url);
+    emit m_webView->navigationHistoryChanged();
+    emit m_webView->urlChanged();
 }
 
-void QtWebPageLoadClient::didReceiveTitleForFrame(const QString& title)
+void QtWebPageLoadClient::didReceiveTitleForFrame()
 {
-    emit m_webView->titleChanged(title);
+    emit m_webView->titleChanged();
 }
 
 void QtWebPageLoadClient::didFirstVisuallyNonEmptyLayoutForFrame()
@@ -90,20 +91,22 @@ void QtWebPageLoadClient::dispatchLoadSucceeded()
 
 void QtWebPageLoadClient::dispatchLoadFailed(WKErrorRef error)
 {
-    emit m_webView->navigationStateChanged();
-
     int errorCode = WKErrorGetErrorCode(error);
-    if (toImpl(error)->platformError().isCancellation() || errorCode == kWKErrorCodeFrameLoadInterruptedByPolicyChange || errorCode == kWKErrorCodePlugInWillHandleLoad)
+    if (toImpl(error)->platformError().isCancellation() || errorCode == kWKErrorCodeFrameLoadInterruptedByPolicyChange || errorCode == kWKErrorCodePlugInWillHandleLoad) {
+        // Make sure that LoadStartedStatus has a counterpart when e.g. requesting a download.
+        dispatchLoadSucceeded();
         return;
+    }
 
     QtWebError qtError(error);
-    emit m_webView->loadFailed(static_cast<QQuickWebView::ErrorDomain>(qtError.type()), qtError.errorCode(), qtError.url(), qtError.description());
+    QWebLoadRequest loadRequest(qtError.url(), QQuickWebView::LoadFailedStatus, qtError.description(), static_cast<QQuickWebView::ErrorDomain>(qtError.type()), qtError.errorCode());
+    emit m_webView->loadingChanged(&loadRequest);
 }
 
 void QtWebPageLoadClient::setLoadProgress(int loadProgress)
 {
     m_loadProgress = loadProgress;
-    emit m_webView->loadProgressChanged(m_loadProgress);
+    emit m_webView->loadProgressChanged();
 }
 
 static QtWebPageLoadClient* toQtWebPageLoadClient(const void* clientInfo)
@@ -116,7 +119,10 @@ void QtWebPageLoadClient::didStartProvisionalLoadForFrame(WKPageRef, WKFrameRef
 {
     if (!WKFrameIsMainFrame(frame))
         return;
-    toQtWebPageLoadClient(clientInfo)->didStartProvisionalLoadForFrame();
+    WebFrameProxy* wkframe = toImpl(frame);
+    QString urlStr(wkframe->provisionalURL());
+    QUrl qUrl = urlStr;
+    toQtWebPageLoadClient(clientInfo)->didStartProvisionalLoadForFrame(qUrl);
 }
 
 void QtWebPageLoadClient::didFailProvisionalLoadWithErrorForFrame(WKPageRef, WKFrameRef frame, WKErrorRef error, WKTypeRef, const void* clientInfo)
@@ -130,10 +136,7 @@ void QtWebPageLoadClient::didCommitLoadForFrame(WKPageRef, WKFrameRef frame, WKT
 {
     if (!WKFrameIsMainFrame(frame))
         return;
-    WebFrameProxy* wkframe = toImpl(frame);
-    QString urlStr(wkframe->url());
-    QUrl qUrl = urlStr;
-    toQtWebPageLoadClient(clientInfo)->didCommitLoadForFrame(qUrl);
+    toQtWebPageLoadClient(clientInfo)->didCommitLoadForFrame();
 }
 
 void QtWebPageLoadClient::didFinishLoadForFrame(WKPageRef, WKFrameRef frame, WKTypeRef, const void* clientInfo)
@@ -152,18 +155,14 @@ void QtWebPageLoadClient::didFailLoadWithErrorForFrame(WKPageRef, WKFrameRef fra
 
 void QtWebPageLoadClient::didSameDocumentNavigationForFrame(WKPageRef page, WKFrameRef frame, WKSameDocumentNavigationType type, WKTypeRef userData, const void* clientInfo)
 {
-    WebFrameProxy* wkframe = toImpl(frame);
-    QString urlStr(wkframe->url());
-    QUrl qUrl = urlStr;
-    toQtWebPageLoadClient(clientInfo)->didSameDocumentNavigationForFrame(qUrl);
+    toQtWebPageLoadClient(clientInfo)->didSameDocumentNavigationForFrame();
 }
 
 void QtWebPageLoadClient::didReceiveTitleForFrame(WKPageRef, WKStringRef title, WKFrameRef frame, WKTypeRef, const void* clientInfo)
 {
     if (!WKFrameIsMainFrame(frame))
         return;
-    QString qTitle = WKStringCopyQString(title);
-    toQtWebPageLoadClient(clientInfo)->didReceiveTitleForFrame(qTitle);
+    toQtWebPageLoadClient(clientInfo)->didReceiveTitleForFrame();
 }
 
 void QtWebPageLoadClient::didStartProgress(WKPageRef, const void* clientInfo)
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageLoadClient.h b/Source/WebKit2/UIProcess/qt/QtWebPageLoadClient.h
index fbdb92e7b..672597af7 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageLoadClient.h
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageLoadClient.h
@@ -35,10 +35,10 @@ public:
     int loadProgress() const { return m_loadProgress; }
 
 private:
-    void didStartProvisionalLoadForFrame();
-    void didCommitLoadForFrame(const QUrl&);
-    void didSameDocumentNavigationForFrame(const QUrl&);
-    void didReceiveTitleForFrame(const QString&);
+    void didStartProvisionalLoadForFrame(const QUrl&);
+    void didCommitLoadForFrame();
+    void didSameDocumentNavigationForFrame();
+    void didReceiveTitleForFrame();
     void didFirstVisuallyNonEmptyLayoutForFrame();
     void didChangeBackForwardList();
 
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.cpp b/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.cpp
index ad8ced73f..ad5f6aa12 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.cpp
@@ -41,12 +41,11 @@ QtWebPagePolicyClient::QtWebPagePolicyClient(WKPageRef pageRef, QQuickWebView* w
     WKPageSetPagePolicyClient(pageRef, &policyClient);
 }
 
-void QtWebPagePolicyClient::decidePolicyForNavigationAction(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton mouseButton,
-                                                            Qt::KeyboardModifiers keyboardModifiers, QQuickWebView::NavigationType navigationType, WKFramePolicyListenerRef listener)
+void QtWebPagePolicyClient::decidePolicyForNavigationAction(const QUrl& url, Qt::MouseButton mouseButton, Qt::KeyboardModifiers keyboardModifiers, QQuickWebView::NavigationType navigationType, WKFramePolicyListenerRef listener)
 {
     // NOTE: even though the C API (and the WebKit2 IPC) supports an asynchronous answer, this is not currently working.
     // We are expected to call the listener immediately. See the patch for https://bugs.webkit.org/show_bug.cgi?id=53785.
-    QWebNavigationRequest navigationRequest(url, originatingUrl, mouseButton, keyboardModifiers, navigationType);
+    QWebNavigationRequest navigationRequest(url, mouseButton, keyboardModifiers, navigationType);
     emit m_webView->navigationRequested(&navigationRequest);
 
     switch (navigationRequest.action()) {
@@ -123,9 +122,8 @@ void QtWebPagePolicyClient::decidePolicyForNavigationAction(WKPageRef, WKFrameRe
 {
     WKRetainPtr<WKURLRef> frameURL(AdoptWK, WKFrameCopyURL(frame));
     WKRetainPtr<WKURLRef> requestURL(AdoptWK, WKURLRequestCopyURL(request));
-    QUrl qUrlFrame = WKURLCopyQUrl(frameURL.get());
     QUrl qUrl = WKURLCopyQUrl(requestURL.get());
-    toQtWebPagePolicyClient(clientInfo)->decidePolicyForNavigationAction(qUrl, qUrlFrame, toQtMouseButton(mouseButton), toQtKeyboardModifiers(modifiers), toQuickWebViewNavigationType(navigationType), listener);
+    toQtWebPagePolicyClient(clientInfo)->decidePolicyForNavigationAction(qUrl, toQtMouseButton(mouseButton), toQtKeyboardModifiers(modifiers), toQuickWebViewNavigationType(navigationType), listener);
 }
 
 void QtWebPagePolicyClient::decidePolicyForResponse(WKPageRef page, WKFrameRef frame, WKURLResponseRef response, WKURLRequestRef, WKFramePolicyListenerRef listener, WKTypeRef, const void*)
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.h b/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.h
index e393d54f3..9e397fb77 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.h
+++ b/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.h
@@ -31,7 +31,7 @@ public:
     QtWebPagePolicyClient(WKPageRef, QQuickWebView*);
 
 private:
-    void decidePolicyForNavigationAction(const QUrl&, const QUrl&, Qt::MouseButton, Qt::KeyboardModifiers, QQuickWebView::NavigationType, WKFramePolicyListenerRef);
+    void decidePolicyForNavigationAction(const QUrl&, Qt::MouseButton, Qt::KeyboardModifiers, QQuickWebView::NavigationType, WKFramePolicyListenerRef);
 
     // WKPagePolicyClient callbacks.
     static void decidePolicyForNavigationAction(WKPageRef, WKFrameRef, WKFrameNavigationType, WKEventModifiers, WKEventMouseButton, WKURLRequestRef, WKFramePolicyListenerRef, WKTypeRef userData, const void* clientInfo);
diff --git a/Source/WebKit2/UIProcess/qt/WebFullScreenManagerProxyQt.cpp b/Source/WebKit2/UIProcess/qt/WebFullScreenManagerProxyQt.cpp
index c4a13fad8..bea1aebac 100644
--- a/Source/WebKit2/UIProcess/qt/WebFullScreenManagerProxyQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebFullScreenManagerProxyQt.cpp
@@ -29,6 +29,8 @@
 
 #include <WebCore/NotImplemented.h>
 
+using namespace WebCore;
+
 namespace WebKit {
 
 void WebFullScreenManagerProxy::invalidate()
@@ -46,37 +48,12 @@ void WebFullScreenManagerProxy::exitFullScreen()
     notImplemented();
 }
 
-void WebFullScreenManagerProxy::beganEnterFullScreenAnimation()
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerProxy::finishedEnterFullScreenAnimation(bool completed)
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerProxy::beganExitFullScreenAnimation()
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerProxy::finishedExitFullScreenAnimation(bool completed)
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerProxy::enterAcceleratedCompositingMode(const LayerTreeContext& context)
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerProxy::exitAcceleratedCompositingMode()
+void WebFullScreenManagerProxy::beganEnterFullScreen(const IntRect& initialFrame, const IntRect& finalFrame)
 {
     notImplemented();
 }
 
-void WebFullScreenManagerProxy::getFullScreenRect(WebCore::IntRect& rect)
+void WebFullScreenManagerProxy::beganExitFullScreen(const IntRect& initialFrame, const IntRect& finalFrame)
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/UIProcess/qt/WebInspectorProxyQt.cpp b/Source/WebKit2/UIProcess/qt/WebInspectorProxyQt.cpp
index 6b69e9975..dcc05b947 100644
--- a/Source/WebKit2/UIProcess/qt/WebInspectorProxyQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebInspectorProxyQt.cpp
@@ -54,6 +54,12 @@ void WebInspectorProxy::platformBringToFront()
     notImplemented();
 }
 
+bool WebInspectorProxy::platformIsFront()
+{
+    notImplemented();
+    return false;
+}
+
 void WebInspectorProxy::platformInspectedURLChanged(const String&)
 {
     notImplemented();
diff --git a/Source/WebKit2/UIProcess/win/WebFullScreenManagerProxyWin.cpp b/Source/WebKit2/UIProcess/win/WebFullScreenManagerProxyWin.cpp
index 878fa134e..fe11c7127 100644
--- a/Source/WebKit2/UIProcess/win/WebFullScreenManagerProxyWin.cpp
+++ b/Source/WebKit2/UIProcess/win/WebFullScreenManagerProxyWin.cpp
@@ -32,6 +32,8 @@
 #include <WebCore/FullScreenController.h>
 #include <WebCore/IntRect.h>
 
+using namespace WebCore;
+
 namespace WebKit {
 
 void WebFullScreenManagerProxy::invalidate()
@@ -57,53 +59,14 @@ void WebFullScreenManagerProxy::exitFullScreen()
     m_webView->fullScreenController()->exitFullScreen();
 }
 
-void WebFullScreenManagerProxy::beganEnterFullScreenAnimation()
-{
-    if (!m_webView)
-        return;
-    // FIXME: Implement
-}
-
-void WebFullScreenManagerProxy::finishedEnterFullScreenAnimation(bool completed)
-{
-    if (!m_webView)
-        return;
-    // FIXME: Implement
-}
-
-void WebFullScreenManagerProxy::beganExitFullScreenAnimation()
-{
-    if (!m_webView)
-        return;
-    // FIXME: Implement
-}
-
-void WebFullScreenManagerProxy::finishedExitFullScreenAnimation(bool completed)
-{
-    if (!m_webView)
-        return;
-    // FIXME: Implement
-}
-    
-void WebFullScreenManagerProxy::enterAcceleratedCompositingMode(const LayerTreeContext& context)
+void WebFullScreenManagerProxy::beganEnterFullScreen(const IntRect& initialFrame, const IntRect& finalFrame)
 {
-    if (!m_webView)
-        return;
-    // FIXME: Implement
+    // No-op.
 }
 
-void WebFullScreenManagerProxy::exitAcceleratedCompositingMode()
+void WebFullScreenManagerProxy::beganExitFullScreen(const IntRect& initialFrame, const IntRect& finalFrame)
 {
-    if (!m_webView)
-        return;
-    // FIXME: Implement
-}
-
-void WebFullScreenManagerProxy::getFullScreenRect(WebCore::IntRect& rect)
-{
-    if (!m_webView)
-        return;
-    // FIXME: Implement
+    // No-op.
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/win/WebInspectorProxyWin.cpp b/Source/WebKit2/UIProcess/win/WebInspectorProxyWin.cpp
index f0c533410..67cfcf676 100644
--- a/Source/WebKit2/UIProcess/win/WebInspectorProxyWin.cpp
+++ b/Source/WebKit2/UIProcess/win/WebInspectorProxyWin.cpp
@@ -33,6 +33,7 @@
 #include "WebProcessProxy.h"
 #include "WebView.h"
 #include <WebCore/InspectorFrontendClientLocal.h>
+#include <WebCore/NotImplemented.h>
 #include <WebCore/WebCoreInstanceHandle.h>
 #include <WebCore/WindowMessageBroadcaster.h>
 #include <wtf/PassRefPtr.h>
@@ -240,6 +241,12 @@ void WebInspectorProxy::platformBringToFront()
     ::SetWindowPos(parentWindow, HWND_TOP, 0, 0, 0, 0, SWP_SHOWWINDOW | SWP_NOMOVE | SWP_NOSIZE);
 }
 
+bool WebInspectorProxy::platformIsFront()
+{
+    notImplemented();
+    return false;
+}
+
 void WebInspectorProxy::platformInspectedURLChanged(const String& urlString)
 {
     // FIXME: this should be made localizable once WebKit2 supports it. <rdar://problem/8728860>
diff --git a/Source/WebKit2/UIProcess/win/WebView.cpp b/Source/WebKit2/UIProcess/win/WebView.cpp
index c0e9f1729..4e4e33f1f 100644
--- a/Source/WebKit2/UIProcess/win/WebView.cpp
+++ b/Source/WebKit2/UIProcess/win/WebView.cpp
@@ -1564,6 +1564,9 @@ void WebView::exitAcceleratedCompositingMode()
 #endif
 }
 
+void WebView::updateAcceleratedCompositingMode(const LayerTreeContext&)
+{
+}
 #endif // USE(ACCELERATED_COMPOSITING)
 
 HWND WebView::nativeWindow()
diff --git a/Source/WebKit2/UIProcess/win/WebView.h b/Source/WebKit2/UIProcess/win/WebView.h
index ecd708071..daa13c17b 100644
--- a/Source/WebKit2/UIProcess/win/WebView.h
+++ b/Source/WebKit2/UIProcess/win/WebView.h
@@ -204,6 +204,7 @@ private:
 #if USE(ACCELERATED_COMPOSITING)
     virtual void enterAcceleratedCompositingMode(const LayerTreeContext&);
     virtual void exitAcceleratedCompositingMode();
+    virtual void updateAcceleratedCompositingMode(const LayerTreeContext&);
 #endif
 
     void didCommitLoadForMainFrame(bool useCustomRepresentation);
diff --git a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
index a4f5e3ac2..179c961f4 100644
--- a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
+++ b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
@@ -80,7 +80,6 @@
 		1A24BF3A120896A600FBB059 /* SharedMemoryMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A24BF39120896A600FBB059 /* SharedMemoryMac.cpp */; };
 		1A2BB6D014117B4D000F35D4 /* PluginProcessConnectionMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A2BB6CE14117B4D000F35D4 /* PluginProcessConnectionMessageReceiver.cpp */; };
 		1A2BB6D114117B4D000F35D4 /* PluginProcessConnectionMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A2BB6CF14117B4D000F35D4 /* PluginProcessConnectionMessages.h */; };
-		1A2C307112D555450063DAA2 /* ContextMenuState.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A2C306F12D555450063DAA2 /* ContextMenuState.h */; };
 		1A2D82A4127F4EAB001EB962 /* NPObjectMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A1FA35C127A45BF0050E709 /* NPObjectMessageReceiver.cpp */; };
 		1A2D82A5127F4EAB001EB962 /* NPObjectMessageReceiver.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A1FA35B127A45BF0050E709 /* NPObjectMessageReceiver.h */; };
 		1A2D82A6127F4EAB001EB962 /* NPObjectProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A1FA284127A13BC0050E709 /* NPObjectProxy.cpp */; };
@@ -249,6 +248,8 @@
 		1CA8B945127C882A00576C2B /* WebInspectorProxyMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1CA8B943127C882A00576C2B /* WebInspectorProxyMessageReceiver.cpp */; };
 		1CA8B946127C882A00576C2B /* WebInspectorProxyMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 1CA8B944127C882A00576C2B /* WebInspectorProxyMessages.h */; };
 		1CA8B954127C891500576C2B /* WebInspectorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1C8E2DAD1278C5B200BC7BD0 /* WebInspectorMac.mm */; };
+		296BD85D15019BC30071F424 /* StringUtilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 296BD85B15019BC30071F424 /* StringUtilities.h */; };
+		296BD85E15019BC30071F424 /* StringUtilities.mm in Sources */ = {isa = PBXBuildFile; fileRef = 296BD85C15019BC30071F424 /* StringUtilities.mm */; };
 		29CD55AA128E294F00133C85 /* WKAccessibilityWebPageObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 29CD55A8128E294F00133C85 /* WKAccessibilityWebPageObject.h */; };
 		29CD55AB128E294F00133C85 /* WKAccessibilityWebPageObject.mm in Sources */ = {isa = PBXBuildFile; fileRef = 29CD55A9128E294F00133C85 /* WKAccessibilityWebPageObject.mm */; };
 		31099973146C75A20029DEB9 /* WebNotificationClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 31099971146C759B0029DEB9 /* WebNotificationClient.cpp */; };
@@ -314,7 +315,15 @@
 		33D3A3CA1339617900709BE4 /* WebMediaCacheManagerProxyMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33D3A3C61339617900709BE4 /* WebMediaCacheManagerProxyMessageReceiver.cpp */; };
 		33D3A3CB1339617900709BE4 /* WebMediaCacheManagerProxyMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 33D3A3C71339617900709BE4 /* WebMediaCacheManagerProxyMessages.h */; };
 		33F9D5B91312F1EE000D683F /* WebResourceCacheManagerCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33F9D5B81312F1EE000D683F /* WebResourceCacheManagerCFNet.cpp */; };
+		3760881E150413E900FC82C7 /* WebRenderObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3760881C150413E900FC82C7 /* WebRenderObject.cpp */; };
+		3760881F150413E900FC82C7 /* WebRenderObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 3760881D150413E900FC82C7 /* WebRenderObject.h */; };
+		37608822150414F700FC82C7 /* WKRenderObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37608820150414F700FC82C7 /* WKRenderObject.cpp */; };
+		37608823150414F700FC82C7 /* WKRenderObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 37608821150414F700FC82C7 /* WKRenderObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3788A05C14743C90006319E5 /* WKBrowsingContextControllerPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 3788A05B14743C90006319E5 /* WKBrowsingContextControllerPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		37948403150C350600E52CE9 /* WebRenderLayer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37948401150C350600E52CE9 /* WebRenderLayer.cpp */; };
+		37948404150C350600E52CE9 /* WebRenderLayer.h in Headers */ = {isa = PBXBuildFile; fileRef = 37948402150C350600E52CE9 /* WebRenderLayer.h */; };
+		37948408150C4B9700E52CE9 /* WKRenderLayer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37948406150C4B9600E52CE9 /* WKRenderLayer.cpp */; };
+		37948409150C4B9700E52CE9 /* WKRenderLayer.h in Headers */ = {isa = PBXBuildFile; fileRef = 37948407150C4B9600E52CE9 /* WKRenderLayer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37C4E9F6131C6E7E0029BD5A /* config.h in Headers */ = {isa = PBXBuildFile; fileRef = B396EA5512E0ED2D00F4FEB7 /* config.h */; };
 		37F623B812A57B6200E3FDF6 /* WKFindOptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 37F623B712A57B6200E3FDF6 /* WKFindOptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37F90DE31376560E0051CF68 /* HTTPCookieAcceptPolicy.h in Headers */ = {isa = PBXBuildFile; fileRef = F638954F133BEF38008941D5 /* HTTPCookieAcceptPolicy.h */; };
@@ -434,8 +443,7 @@
 		6501BD1A12F1243400E9F248 /* WKBundleInspector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65B86F1712F11D7B00B7DD8A /* WKBundleInspector.cpp */; };
 		659C551E130006410025C0C2 /* InjectedBundlePageResourceLoadClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6546A82913000164000CEB1C /* InjectedBundlePageResourceLoadClient.cpp */; };
 		65B86F1E12F11DE300B7DD8A /* WKBundleInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = 65B86F1812F11D7B00B7DD8A /* WKBundleInspector.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		6D8A91A611F0EFD100DD01FE /* com.apple.WebProcess.sb in Resources */ = {isa = PBXBuildFile; fileRef = 6D8A91A511F0EFD100DD01FE /* com.apple.WebProcess.sb */; };
-		6EE849C81368D9390038D481 /* WKInspectorMac.h in Headers */ = {isa = PBXBuildFile; fileRef = 6EE849C61368D92D0038D481 /* WKInspectorMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		6EE849C81368D9390038D481 /* WKInspectorPrivateMac.h in Headers */ = {isa = PBXBuildFile; fileRef = 6EE849C61368D92D0038D481 /* WKInspectorPrivateMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		762B748D120BC75C00819339 /* WKPreferencesPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 762B7484120BBA2D00819339 /* WKPreferencesPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7801C099142290C400FAF9AF /* WebHitTestResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7801C095142290C400FAF9AF /* WebHitTestResult.cpp */; };
 		7801C09A142290C400FAF9AF /* WebHitTestResult.h in Headers */ = {isa = PBXBuildFile; fileRef = 7801C096142290C400FAF9AF /* WebHitTestResult.h */; };
@@ -790,6 +798,8 @@
 		BCDE093B13272496001259FB /* MainMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6FA31011E3921E00DB1371 /* MainMac.cpp */; };
 		BCDE093D13272496001259FB /* PluginProcessShim.dylib in Copy Plug-in Process Shim */ = {isa = PBXBuildFile; fileRef = 1AC25FB012A48EA700BD2671 /* PluginProcessShim.dylib */; };
 		BCDE0ABF13272708001259FB /* PluginProcess.app in CopyFiles */ = {isa = PBXBuildFile; fileRef = BCDE094213272496001259FB /* PluginProcess.app */; };
+		BCE0937714FB128C001138D9 /* LayerHostingContext.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCE0937514FB128B001138D9 /* LayerHostingContext.mm */; };
+		BCE0937814FB128C001138D9 /* LayerHostingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE0937614FB128B001138D9 /* LayerHostingContext.h */; };
 		BCE17B7D1381F1170012A641 /* WKPagePrivateMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCE17B7B1381F1170012A641 /* WKPagePrivateMac.cpp */; };
 		BCE17B7E1381F1170012A641 /* WKPagePrivateMac.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE17B7C1381F1170012A641 /* WKPagePrivateMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCE2315D122C30CA00D5C35A /* WebURLRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE2315B122C30CA00D5C35A /* WebURLRequest.h */; };
@@ -873,7 +883,6 @@
 		CDCA85C9132ABA4E00E961DF /* WKFullScreenWindowController.h in Headers */ = {isa = PBXBuildFile; fileRef = CDCA85C7132ABA4E00E961DF /* WKFullScreenWindowController.h */; };
 		CDCA85D5132AC2B300E961DF /* IOKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = CDCA85D4132AC2B300E961DF /* IOKit.framework */; };
 		CDCA85EE132AD70100E961DF /* WebFullScreenManagerProxyMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = CDCA85DE132AD05300E961DF /* WebFullScreenManagerProxyMac.mm */; };
-		CDCA8603132ADC0500E961DF /* WebFullScreenManagerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = CDCA85E6132AD33000E961DF /* WebFullScreenManagerMac.mm */; };
 		D3B9484611FF4B6500032B39 /* WebPopupMenu.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D3B9484211FF4B6500032B39 /* WebPopupMenu.cpp */; };
 		D3B9484711FF4B6500032B39 /* WebPopupMenu.h in Headers */ = {isa = PBXBuildFile; fileRef = D3B9484311FF4B6500032B39 /* WebPopupMenu.h */; };
 		D3B9484811FF4B6500032B39 /* WebSearchPopupMenu.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D3B9484411FF4B6500032B39 /* WebSearchPopupMenu.cpp */; };
@@ -884,7 +893,11 @@
 		E134F01A12EA5D99004EC58D /* WKPrintingView.mm in Sources */ = {isa = PBXBuildFile; fileRef = E134F01912EA5D99004EC58D /* WKPrintingView.mm */; };
 		E179FD9C134D38060015B883 /* ArgumentCodersMac.h in Headers */ = {isa = PBXBuildFile; fileRef = E179FD9B134D38060015B883 /* ArgumentCodersMac.h */; };
 		E179FD9F134D38250015B883 /* ArgumentCodersMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = E179FD9E134D38250015B883 /* ArgumentCodersMac.mm */; };
+		E17BF99614D0A73E00A5A069 /* NetscapeSandboxFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = E17BF99514D0A73E00A5A069 /* NetscapeSandboxFunctions.h */; };
+		E17BF99814D0AA8300A5A069 /* NetscapeSandboxFunctions.mm in Sources */ = {isa = PBXBuildFile; fileRef = E17BF99714D0AA8300A5A069 /* NetscapeSandboxFunctions.mm */; };
 		E18C92F412DB9E7100CF2AEB /* PrintInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18C92F312DB9E7100CF2AEB /* PrintInfo.cpp */; };
+		E1967E36150AB5D500C73169 /* com.apple.WebKit.PluginProcess.sb in Resources */ = {isa = PBXBuildFile; fileRef = E1967E35150AB5D500C73169 /* com.apple.WebKit.PluginProcess.sb */; };
+		E1967E38150AB5E200C73169 /* com.apple.WebProcess.sb in Resources */ = {isa = PBXBuildFile; fileRef = E1967E37150AB5E200C73169 /* com.apple.WebProcess.sb */; };
 		E199875E142C045400BB2DE7 /* BuiltInPDFView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E199875C142BFC9700BB2DE7 /* BuiltInPDFView.cpp */; };
 		E1A31732134CEA6C007C9A4F /* AttributedString.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A31731134CEA6C007C9A4F /* AttributedString.h */; };
 		E1A31735134CEA80007C9A4F /* AttributedString.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1A31734134CEA80007C9A4F /* AttributedString.mm */; };
@@ -1066,7 +1079,6 @@
 		1A2BB6CC14117A5F000F35D4 /* PluginProcessConnection.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PluginProcessConnection.messages.in; sourceTree = "<group>"; };
 		1A2BB6CE14117B4D000F35D4 /* PluginProcessConnectionMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginProcessConnectionMessageReceiver.cpp; sourceTree = "<group>"; };
 		1A2BB6CF14117B4D000F35D4 /* PluginProcessConnectionMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginProcessConnectionMessages.h; sourceTree = "<group>"; };
-		1A2C306F12D555450063DAA2 /* ContextMenuState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContextMenuState.h; sourceTree = "<group>"; };
 		1A2D8411127F64E8001EB962 /* NPObjectMessageReceiver.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = NPObjectMessageReceiver.messages.in; sourceTree = "<group>"; };
 		1A2D8437127F65D5001EB962 /* NPObjectMessageReceiverMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NPObjectMessageReceiverMessageReceiver.cpp; sourceTree = "<group>"; };
 		1A2D8438127F65D5001EB962 /* NPObjectMessageReceiverMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NPObjectMessageReceiverMessages.h; sourceTree = "<group>"; };
@@ -1243,6 +1255,8 @@
 		1CA8B935127C774E00576C2B /* WebInspectorProxyMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebInspectorProxyMac.mm; sourceTree = "<group>"; };
 		1CA8B943127C882A00576C2B /* WebInspectorProxyMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebInspectorProxyMessageReceiver.cpp; sourceTree = "<group>"; };
 		1CA8B944127C882A00576C2B /* WebInspectorProxyMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebInspectorProxyMessages.h; sourceTree = "<group>"; };
+		296BD85B15019BC30071F424 /* StringUtilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringUtilities.h; sourceTree = "<group>"; };
+		296BD85C15019BC30071F424 /* StringUtilities.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = StringUtilities.mm; sourceTree = "<group>"; };
 		29CD55A8128E294F00133C85 /* WKAccessibilityWebPageObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKAccessibilityWebPageObject.h; sourceTree = "<group>"; };
 		29CD55A9128E294F00133C85 /* WKAccessibilityWebPageObject.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WKAccessibilityWebPageObject.mm; sourceTree = "<group>"; };
 		31099968146C71F50029DEB9 /* WebNotificationClient.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = WebNotificationClient.h; sourceTree = "<group>"; };
@@ -1318,7 +1332,15 @@
 		33D3A3C61339617900709BE4 /* WebMediaCacheManagerProxyMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebMediaCacheManagerProxyMessageReceiver.cpp; sourceTree = "<group>"; };
 		33D3A3C71339617900709BE4 /* WebMediaCacheManagerProxyMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebMediaCacheManagerProxyMessages.h; sourceTree = "<group>"; };
 		33F9D5B81312F1EE000D683F /* WebResourceCacheManagerCFNet.cpp */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; name = WebResourceCacheManagerCFNet.cpp; path = ResourceCache/cf/WebResourceCacheManagerCFNet.cpp; sourceTree = "<group>"; };
+		3760881C150413E900FC82C7 /* WebRenderObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebRenderObject.cpp; sourceTree = "<group>"; };
+		3760881D150413E900FC82C7 /* WebRenderObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebRenderObject.h; sourceTree = "<group>"; };
+		37608820150414F700FC82C7 /* WKRenderObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKRenderObject.cpp; sourceTree = "<group>"; };
+		37608821150414F700FC82C7 /* WKRenderObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKRenderObject.h; sourceTree = "<group>"; };
 		3788A05B14743C90006319E5 /* WKBrowsingContextControllerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKBrowsingContextControllerPrivate.h; sourceTree = "<group>"; };
+		37948401150C350600E52CE9 /* WebRenderLayer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebRenderLayer.cpp; sourceTree = "<group>"; };
+		37948402150C350600E52CE9 /* WebRenderLayer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebRenderLayer.h; sourceTree = "<group>"; };
+		37948406150C4B9600E52CE9 /* WKRenderLayer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKRenderLayer.cpp; sourceTree = "<group>"; };
+		37948407150C4B9600E52CE9 /* WKRenderLayer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKRenderLayer.h; sourceTree = "<group>"; };
 		37F623B712A57B6200E3FDF6 /* WKFindOptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKFindOptions.h; sourceTree = "<group>"; };
 		510031F61379CACB00C8DFE4 /* WebProcessShim.dylib */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.dylib"; includeInIndex = 0; path = WebProcessShim.dylib; sourceTree = BUILT_PRODUCTS_DIR; };
 		51021E9B12B16788005C033C /* WebContextMenuClientMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebContextMenuClientMac.mm; sourceTree = "<group>"; };
@@ -1446,8 +1468,8 @@
 		6546A82A13000164000CEB1C /* InjectedBundlePageResourceLoadClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundlePageResourceLoadClient.h; sourceTree = "<group>"; };
 		65B86F1712F11D7B00B7DD8A /* WKBundleInspector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKBundleInspector.cpp; sourceTree = "<group>"; };
 		65B86F1812F11D7B00B7DD8A /* WKBundleInspector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKBundleInspector.h; sourceTree = "<group>"; };
-		6D8A91A511F0EFD100DD01FE /* com.apple.WebProcess.sb */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = com.apple.WebProcess.sb; path = WebProcess/com.apple.WebProcess.sb; sourceTree = "<group>"; };
-		6EE849C61368D92D0038D481 /* WKInspectorMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WKInspectorMac.h; path = mac/WKInspectorMac.h; sourceTree = "<group>"; };
+		6D8A91A511F0EFD100DD01FE /* com.apple.WebProcess.sb.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = com.apple.WebProcess.sb.in; path = WebProcess/com.apple.WebProcess.sb.in; sourceTree = "<group>"; };
+		6EE849C61368D92D0038D481 /* WKInspectorPrivateMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WKInspectorPrivateMac.h; path = mac/WKInspectorPrivateMac.h; sourceTree = "<group>"; };
 		762B7481120BBA0100819339 /* FontSmoothingLevel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontSmoothingLevel.h; sourceTree = "<group>"; };
 		762B7484120BBA2D00819339 /* WKPreferencesPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKPreferencesPrivate.h; sourceTree = "<group>"; };
 		7801C095142290C400FAF9AF /* WebHitTestResult.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebHitTestResult.cpp; sourceTree = "<group>"; };
@@ -1809,6 +1831,8 @@
 		BCDE059911CDA8AE00E41AF1 /* WebContextInjectedBundleClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebContextInjectedBundleClient.h; sourceTree = "<group>"; };
 		BCDE059A11CDA8AE00E41AF1 /* WebContextInjectedBundleClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebContextInjectedBundleClient.cpp; sourceTree = "<group>"; };
 		BCDE094213272496001259FB /* PluginProcess.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = PluginProcess.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		BCE0937514FB128B001138D9 /* LayerHostingContext.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LayerHostingContext.mm; sourceTree = "<group>"; };
+		BCE0937614FB128B001138D9 /* LayerHostingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LayerHostingContext.h; sourceTree = "<group>"; };
 		BCE17B7B1381F1170012A641 /* WKPagePrivateMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WKPagePrivateMac.cpp; path = mac/WKPagePrivateMac.cpp; sourceTree = "<group>"; };
 		BCE17B7C1381F1170012A641 /* WKPagePrivateMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WKPagePrivateMac.h; path = mac/WKPagePrivateMac.h; sourceTree = "<group>"; };
 		BCE2315B122C30CA00D5C35A /* WebURLRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebURLRequest.h; sourceTree = "<group>"; };
@@ -1913,8 +1937,6 @@
 		CDCA85C7132ABA4E00E961DF /* WKFullScreenWindowController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKFullScreenWindowController.h; sourceTree = "<group>"; };
 		CDCA85D4132AC2B300E961DF /* IOKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = IOKit.framework; path = /System/Library/Frameworks/IOKit.framework; sourceTree = "<absolute>"; };
 		CDCA85DE132AD05300E961DF /* WebFullScreenManagerProxyMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebFullScreenManagerProxyMac.mm; sourceTree = "<group>"; };
-		CDCA85E5132AD33000E961DF /* WebFullScreenManagerMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebFullScreenManagerMac.h; sourceTree = "<group>"; };
-		CDCA85E6132AD33000E961DF /* WebFullScreenManagerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebFullScreenManagerMac.mm; sourceTree = "<group>"; };
 		D3B9484211FF4B6500032B39 /* WebPopupMenu.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebPopupMenu.cpp; sourceTree = "<group>"; };
 		D3B9484311FF4B6500032B39 /* WebPopupMenu.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebPopupMenu.h; sourceTree = "<group>"; };
 		D3B9484411FF4B6500032B39 /* WebSearchPopupMenu.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSearchPopupMenu.cpp; sourceTree = "<group>"; };
@@ -1928,7 +1950,12 @@
 		E14E99F914D879C9001D221F /* add-entitlements.sh */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = "add-entitlements.sh"; sourceTree = "<group>"; };
 		E179FD9B134D38060015B883 /* ArgumentCodersMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArgumentCodersMac.h; sourceTree = "<group>"; };
 		E179FD9E134D38250015B883 /* ArgumentCodersMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ArgumentCodersMac.mm; sourceTree = "<group>"; };
+		E17BF99514D0A73E00A5A069 /* NetscapeSandboxFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NetscapeSandboxFunctions.h; sourceTree = "<group>"; };
+		E17BF99714D0AA8300A5A069 /* NetscapeSandboxFunctions.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = NetscapeSandboxFunctions.mm; sourceTree = "<group>"; };
+		E17BF99914D0CBF100A5A069 /* com.apple.WebKit.PluginProcess.sb.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = com.apple.WebKit.PluginProcess.sb.in; sourceTree = "<group>"; };
 		E18C92F312DB9E7100CF2AEB /* PrintInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PrintInfo.cpp; sourceTree = "<group>"; };
+		E1967E35150AB5D500C73169 /* com.apple.WebKit.PluginProcess.sb */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = com.apple.WebKit.PluginProcess.sb; sourceTree = "<group>"; };
+		E1967E37150AB5E200C73169 /* com.apple.WebProcess.sb */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = com.apple.WebProcess.sb; sourceTree = "<group>"; };
 		E199875A142BF9B800BB2DE7 /* BuiltInPDFView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BuiltInPDFView.h; path = PDF/BuiltInPDFView.h; sourceTree = "<group>"; };
 		E199875C142BFC9700BB2DE7 /* BuiltInPDFView.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = BuiltInPDFView.cpp; path = PDF/BuiltInPDFView.cpp; sourceTree = "<group>"; };
 		E1A31731134CEA6C007C9A4F /* AttributedString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AttributedString.h; sourceTree = "<group>"; };
@@ -2055,7 +2082,7 @@
 				BC122FA51327085D00F7EAC1 /* PluginProcess */,
 				BC8A500E11765AD400757573 /* WebKit2 */,
 				BC8A500F11765AE300757573 /* WebProcess */,
-				6D8A91A511F0EFD100DD01FE /* com.apple.WebProcess.sb */,
+				6D8A91A511F0EFD100DD01FE /* com.apple.WebProcess.sb.in */,
 				089C1666FE841158C02AAC07 /* InfoPlist.strings */,
 			);
 			name = Resources;
@@ -2119,6 +2146,7 @@
 				1A0EC802124BD41E007EF4A5 /* PluginProcessMainMac.mm */,
 				1AC25F8912A48E0300BD2671 /* PluginProcessShim.h */,
 				1AC25F8A12A48E0300BD2671 /* PluginProcessShim.mm */,
+				E17BF99914D0CBF100A5A069 /* com.apple.WebKit.PluginProcess.sb.in */,
 				E14E99F914D879C9001D221F /* add-entitlements.sh */,
 			);
 			path = mac;
@@ -2246,6 +2274,8 @@
 			isa = PBXGroup;
 			children = (
 				1AE5B7F911E7AED200BA6767 /* NetscapePluginMac.mm */,
+				E17BF99514D0A73E00A5A069 /* NetscapeSandboxFunctions.h */,
+				E17BF99714D0AA8300A5A069 /* NetscapeSandboxFunctions.mm */,
 				1A2D92201281DC1B001EB962 /* PluginProxyMac.mm */,
 			);
 			path = mac;
@@ -2258,7 +2288,11 @@
 				1A24B5F011F531E800C38269 /* MachUtilities.cpp */,
 				1A24B5F111F531E800C38269 /* MachUtilities.h */,
 				C0E3AA481209E45000A49D01 /* ModuleMac.mm */,
+				BCE0937514FB128B001138D9 /* LayerHostingContext.mm */,
+				BCE0937614FB128B001138D9 /* LayerHostingContext.h */,
 				1A24BF39120896A600FBB059 /* SharedMemoryMac.cpp */,
+				296BD85B15019BC30071F424 /* StringUtilities.h */,
+				296BD85C15019BC30071F424 /* StringUtilities.mm */,
 				BC0092F6115837A300E0AE2A /* WorkQueueMac.cpp */,
 			);
 			path = mac;
@@ -2299,7 +2333,6 @@
 				1A2D956E12848564001EB962 /* ChildProcess.cpp */,
 				1A2D956D12848564001EB962 /* ChildProcess.h */,
 				1A6F9F8E11E13EFC00DB1371 /* CommandLine.h */,
-				1A2C306F12D555450063DAA2 /* ContextMenuState.h */,
 				BCE81D96131AE02000241910 /* DictionaryPopupInfo.cpp */,
 				BCE81D97131AE02100241910 /* DictionaryPopupInfo.h */,
 				C517388012DF8F4F00EE3F47 /* DragControllerAction.h */,
@@ -2397,6 +2430,10 @@
 				BCD598AA112B7FDF00EC8C23 /* WebPreferencesStore.h */,
 				BC306823125A6B9400E71278 /* WebProcessCreationParameters.cpp */,
 				BC306822125A6B9400E71278 /* WebProcessCreationParameters.h */,
+				37948401150C350600E52CE9 /* WebRenderLayer.cpp */,
+				37948402150C350600E52CE9 /* WebRenderLayer.h */,
+				3760881C150413E900FC82C7 /* WebRenderObject.cpp */,
+				3760881D150413E900FC82C7 /* WebRenderObject.h */,
 				F634445512A885C8000612D8 /* WebSecurityOrigin.h */,
 				A72D5D7F1236CBA800A88B15 /* WebSerializedScriptValue.h */,
 				BCF04C8E11FF9F6E00F86A58 /* WebString.h */,
@@ -2689,7 +2726,7 @@
 		6EE849C41368D9040038D481 /* mac */ = {
 			isa = PBXGroup;
 			children = (
-				6EE849C61368D92D0038D481 /* WKInspectorMac.h */,
+				6EE849C61368D92D0038D481 /* WKInspectorPrivateMac.h */,
 				BCE17B7B1381F1170012A641 /* WKPagePrivateMac.cpp */,
 				BCE17B7C1381F1170012A641 /* WKPagePrivateMac.h */,
 			);
@@ -3473,6 +3510,10 @@
 				BC4075E5124FF0270068F20A /* WKNumber.cpp */,
 				BC4075E6124FF0270068F20A /* WKNumber.h */,
 				BC2D021812AC426C00E732A3 /* WKPageLoadTypes.h */,
+				37948406150C4B9600E52CE9 /* WKRenderLayer.cpp */,
+				37948407150C4B9600E52CE9 /* WKRenderLayer.h */,
+				37608820150414F700FC82C7 /* WKRenderObject.cpp */,
+				37608821150414F700FC82C7 /* WKRenderObject.h */,
 				F634445A12A885E9000612D8 /* WKSecurityOrigin.cpp */,
 				F634445B12A885E9000612D8 /* WKSecurityOrigin.h */,
 				BC4075E7124FF0270068F20A /* WKSerializedScriptValue.cpp */,
@@ -3605,6 +3646,8 @@
 				33367652130C9ECA006C9DE2 /* WebResourceCacheManagerMessages.h */,
 				33367653130C9ECA006C9DE2 /* WebResourceCacheManagerProxyMessageReceiver.cpp */,
 				33367654130C9ECA006C9DE2 /* WebResourceCacheManagerProxyMessages.h */,
+				E1967E35150AB5D500C73169 /* com.apple.WebKit.PluginProcess.sb */,
+				E1967E37150AB5E200C73169 /* com.apple.WebProcess.sb */,
 			);
 			name = "Derived Sources";
 			path = DerivedSources/WebKit2;
@@ -3650,8 +3693,6 @@
 		CDCA85E4132AD33000E961DF /* mac */ = {
 			isa = PBXGroup;
 			children = (
-				CDCA85E5132AD33000E961DF /* WebFullScreenManagerMac.h */,
-				CDCA85E6132AD33000E961DF /* WebFullScreenManagerMac.mm */,
 			);
 			name = mac;
 			path = FullScreen/mac;
@@ -3719,7 +3760,6 @@
 				1A6F9F9011E13EFC00DB1371 /* CommandLine.h in Headers */,
 				37C4E9F6131C6E7E0029BD5A /* config.h in Headers */,
 				BC032DAB10F437D10058C15A /* Connection.h in Headers */,
-				1A2C307112D555450063DAA2 /* ContextMenuState.h in Headers */,
 				BC131BC911726C2800B69727 /* CoreIPCMessageKinds.h in Headers */,
 				B878B615133428DC006888E9 /* CorrectionPanel.h in Headers */,
 				1A8EFDFA1253CAA200F7067F /* DataReference.h in Headers */,
@@ -4081,7 +4121,7 @@
 				BCCF6AC312C91F34008F9C35 /* WKImage.h in Headers */,
 				BCCF6ACA12C91F59008F9C35 /* WKImageCG.h in Headers */,
 				1C8E293912761E5B00BC7BD0 /* WKInspector.h in Headers */,
-				6EE849C81368D9390038D481 /* WKInspectorMac.h in Headers */,
+				6EE849C81368D9390038D481 /* WKInspectorPrivateMac.h in Headers */,
 				51A9E10B1315CD18009E7031 /* WKKeyValueStorageManager.h in Headers */,
 				33D3A3B61339600B00709BE4 /* WKMediaCacheManager.h in Headers */,
 				BC4075FE124FF0270068F20A /* WKMutableArray.h in Headers */,
@@ -4131,6 +4171,13 @@
 				BFA6179F12F0B99D0033E0CA /* WKViewPrivate.h in Headers */,
 				BC2E6E8E1141971500A63B1E /* WorkQueue.h in Headers */,
 				1AB42E8714BBBBB2004272F7 /* KeychainShimResponseMap.h in Headers */,
+				E17BF99614D0A73E00A5A069 /* NetscapeSandboxFunctions.h in Headers */,
+				BCE0937814FB128C001138D9 /* LayerHostingContext.h in Headers */,
+				296BD85D15019BC30071F424 /* StringUtilities.h in Headers */,
+				3760881F150413E900FC82C7 /* WebRenderObject.h in Headers */,
+				37608823150414F700FC82C7 /* WKRenderObject.h in Headers */,
+				37948404150C350600E52CE9 /* WebRenderLayer.h in Headers */,
+				37948409150C4B9700E52CE9 /* WKRenderLayer.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -4275,9 +4322,9 @@
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				6D8A91A611F0EFD100DD01FE /* com.apple.WebProcess.sb in Resources */,
 				1AA575FE1496B6F300A4EE06 /* EventDispatcher.messages.in in Resources */,
 				E133FD8A1423DD7F00FC7BFB /* WebKit.icns in Resources */,
+				E1967E38150AB5E200C73169 /* com.apple.WebProcess.sb in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -4293,6 +4340,7 @@
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				E1967E36150AB5D500C73169 /* com.apple.WebKit.PluginProcess.sb in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -4672,7 +4720,6 @@
 				BCB9F6A11123A84B00A137E0 /* WebFramePolicyListenerProxy.cpp in Sources */,
 				BC111B0E112F5E4F00337BAB /* WebFrameProxy.cpp in Sources */,
 				CD73BA53131B645B00EEDED2 /* WebFullScreenManager.cpp in Sources */,
-				CDCA8603132ADC0500E961DF /* WebFullScreenManagerMac.mm in Sources */,
 				CD73BA4E131ACDB700EEDED2 /* WebFullScreenManagerMessageReceiver.cpp in Sources */,
 				CD6F75F4131B66D000D6B21E /* WebFullScreenManagerProxy.cpp in Sources */,
 				CDCA85EE132AD70100E961DF /* WebFullScreenManagerProxyMac.mm in Sources */,
@@ -4867,6 +4914,13 @@
 				BC8699B6116AADAA002A925B /* WKView.mm in Sources */,
 				BC2E6E8D1141971500A63B1E /* WorkQueue.cpp in Sources */,
 				BC0092F8115837A300E0AE2A /* WorkQueueMac.cpp in Sources */,
+				E17BF99814D0AA8300A5A069 /* NetscapeSandboxFunctions.mm in Sources */,
+				BCE0937714FB128C001138D9 /* LayerHostingContext.mm in Sources */,
+				296BD85E15019BC30071F424 /* StringUtilities.mm in Sources */,
+				3760881E150413E900FC82C7 /* WebRenderObject.cpp in Sources */,
+				37608822150414F700FC82C7 /* WKRenderObject.cpp in Sources */,
+				37948403150C350600E52CE9 /* WebRenderLayer.cpp in Sources */,
+				37948408150C4B9700E52CE9 /* WKRenderLayer.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -5113,6 +5167,7 @@
 		};
 		C0CE72861247E66800BC0EC4 /* Debug */ = {
 			isa = XCBuildConfiguration;
+			baseConfigurationReference = 5DAD73F1116FF90C00EE5396 /* BaseTarget.xcconfig */;
 			buildSettings = {
 				COPY_PHASE_STRIP = NO;
 				GCC_DYNAMIC_NO_PIC = NO;
@@ -5123,6 +5178,7 @@
 		};
 		C0CE72871247E66800BC0EC4 /* Release */ = {
 			isa = XCBuildConfiguration;
+			baseConfigurationReference = 5DAD73F1116FF90C00EE5396 /* BaseTarget.xcconfig */;
 			buildSettings = {
 				COPY_PHASE_STRIP = YES;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
@@ -5132,6 +5188,7 @@
 		};
 		C0CE72881247E66800BC0EC4 /* Production */ = {
 			isa = XCBuildConfiguration;
+			baseConfigurationReference = 5DAD73F1116FF90C00EE5396 /* BaseTarget.xcconfig */;
 			buildSettings = {
 				PRODUCT_NAME = "Derived Sources";
 			};
diff --git a/Source/WebKit2/WebProcess.pro b/Source/WebKit2/WebProcess.pro
index e40077f95..e3d2dde4b 100644
--- a/Source/WebKit2/WebProcess.pro
+++ b/Source/WebKit2/WebProcess.pro
@@ -11,9 +11,7 @@ DESTDIR = $${ROOT_BUILD_DIR}/bin
 
 SOURCES += qt/MainQt.cpp
 
-CONFIG += qtwebkit
-
-QT += network
+QT += network webkit
 macx: QT += xml
 
 contains(QT_CONFIG, opengl) {
diff --git a/Source/WebKit2/WebProcess/Downloads/cfnet/DownloadCFNet.cpp b/Source/WebKit2/WebProcess/Downloads/cfnet/DownloadCFNet.cpp
index 22906dc31..1629677ca 100644
--- a/Source/WebKit2/WebProcess/Downloads/cfnet/DownloadCFNet.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/cfnet/DownloadCFNet.cpp
@@ -100,7 +100,9 @@ void Download::start(WebPage*)
     // FIXME: Allow this to be changed by the client.
     CFURLDownloadSetDeletesUponFailure(m_download.get(), false);
 
+#if OS(WINDOWS)
     CFURLDownloadScheduleWithCurrentMessageQueue(m_download.get());
+#endif
     CFURLDownloadScheduleDownloadWithRunLoop(m_download.get(), loaderRunLoop(), kCFRunLoopDefaultMode);
 
     CFURLDownloadStart(m_download.get());
diff --git a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp
index 237fd4cf6..7e4a4e3c2 100644
--- a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp
+++ b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp
@@ -36,12 +36,34 @@
 #include <WebCore/Color.h>
 #include <WebCore/Element.h>
 #include <WebCore/Page.h>
+#include <WebCore/RenderLayer.h>
+#include <WebCore/RenderLayerBacking.h>
+#include <WebCore/RenderObject.h>
+#include <WebCore/RenderView.h>
 #include <WebCore/Settings.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
+static IntRect screenRectOfContents(Element* element)
+{
+    ASSERT(element);
+#if USE(ACCELERATED_COMPOSITING)
+    if (element->renderer() && element->renderer()->hasLayer() && element->renderer()->enclosingLayer()->isComposited()) {
+        FloatQuad contentsBox = static_cast<FloatRect>(element->renderer()->enclosingLayer()->backing()->contentsBox());
+        contentsBox = element->renderer()->localToAbsoluteQuad(contentsBox);
+        return element->renderer()->view()->frameView()->contentsToScreen(contentsBox.enclosingBoundingBox());
+    }
+#endif
+    return element->screenRect();
+}
+
+PassRefPtr<WebFullScreenManager> WebFullScreenManager::create(WebPage* page)
+{
+    return adoptRef(new WebFullScreenManager(page));
+}
+
 WebFullScreenManager::WebFullScreenManager(WebPage* page)
     : m_page(page)
 {
@@ -49,7 +71,6 @@ WebFullScreenManager::WebFullScreenManager(WebPage* page)
     
 WebFullScreenManager::~WebFullScreenManager()
 {
-    
 }
 
 WebCore::Element* WebFullScreenManager::element() 
@@ -68,14 +89,13 @@ bool WebFullScreenManager::supportsFullScreen(bool withKeyboard)
         return false;
 
     return m_page->injectedBundleFullScreenClient().supportsFullScreen(m_page.get(), withKeyboard);
-
 }
 
 void WebFullScreenManager::enterFullScreenForElement(WebCore::Element* element)
 {
     ASSERT(element);
     m_element = element;
-    m_initialFrame = m_element->screenRect();
+    m_initialFrame = screenRectOfContents(m_element.get());
     m_page->injectedBundleFullScreenClient().enterFullScreenForElement(m_page.get(), element);
 }
 
@@ -86,61 +106,41 @@ void WebFullScreenManager::exitFullScreenForElement(WebCore::Element* element)
     m_page->injectedBundleFullScreenClient().exitFullScreenForElement(m_page.get(), element);
 }
 
-void WebFullScreenManager::beganEnterFullScreenAnimation()
-{
-    m_page->send(Messages::WebFullScreenManagerProxy::BeganEnterFullScreenAnimation());
-}
-
-void WebFullScreenManager::finishedEnterFullScreenAnimation(bool completed)
-{
-    m_page->send(Messages::WebFullScreenManagerProxy::FinishedEnterFullScreenAnimation(completed));
-}
-
-void WebFullScreenManager::beganExitFullScreenAnimation()
-{
-    m_page->send(Messages::WebFullScreenManagerProxy::BeganExitFullScreenAnimation());
-}
-
-void WebFullScreenManager::finishedExitFullScreenAnimation(bool completed)
-{
-    m_page->send(Messages::WebFullScreenManagerProxy::FinishedExitFullScreenAnimation(completed));
-}
-    
-IntRect WebFullScreenManager::getFullScreenRect()
-{
-    IntRect rect;
-    m_page->sendSync(Messages::WebFullScreenManagerProxy::GetFullScreenRect(), Messages::WebFullScreenManagerProxy::GetFullScreenRect::Reply(rect));
-    return rect;
-}
-
 void WebFullScreenManager::willEnterFullScreen()
 {
     ASSERT(m_element);
     m_element->document()->webkitWillEnterFullScreenForElement(m_element.get());
-    m_element->document()->setFullScreenRendererBackgroundColor(Color::transparent);
+    m_element->document()->updateLayout();
+    m_page->forceRepaintWithoutCallback();
+    m_finalFrame = screenRectOfContents(m_element.get());
+    m_page->send(Messages::WebFullScreenManagerProxy::BeganEnterFullScreen(m_initialFrame, m_finalFrame));
 }
 
 void WebFullScreenManager::didEnterFullScreen()
 {
     ASSERT(m_element);
-    m_element->document()->setFullScreenRendererBackgroundColor(Color::black);
     m_element->document()->webkitDidEnterFullScreenForElement(m_element.get());
 }
 
 void WebFullScreenManager::willExitFullScreen()
 {
     ASSERT(m_element);
+    m_finalFrame = screenRectOfContents(m_element.get());
     m_element->document()->webkitWillExitFullScreenForElement(m_element.get());
-    m_element->document()->setFullScreenRendererBackgroundColor(Color::transparent);
+    m_page->send(Messages::WebFullScreenManagerProxy::BeganExitFullScreen(m_finalFrame, m_initialFrame));
 }
 
 void WebFullScreenManager::didExitFullScreen()
 {
     ASSERT(m_element);
     m_element->document()->webkitDidExitFullScreenForElement(m_element.get());
-    m_element->document()->setFullScreenRendererBackgroundColor(Color::black);
 }
 
+void WebFullScreenManager::setAnimatingFullScreen(bool animating)
+{
+    ASSERT(m_element);
+    m_element->document()->setAnimatingFullScreen(animating);
+}
 
 } // namespace WebKit
 
diff --git a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h
index a2b992f8f..9724d55e5 100644
--- a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h
+++ b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h
@@ -57,11 +57,6 @@ public:
     bool supportsFullScreen(bool withKeyboard);
     void enterFullScreenForElement(WebCore::Element*);
     void exitFullScreenForElement(WebCore::Element*);
-    void beganEnterFullScreenAnimation();
-    void finishedEnterFullScreenAnimation(bool completed);
-    void beganExitFullScreenAnimation();
-    void finishedExitFullScreenAnimation(bool completed);
-    virtual void setRootFullScreenLayer(WebCore::GraphicsLayer*) = 0;
 
     void willEnterFullScreen();
     void didEnterFullScreen();
@@ -73,14 +68,12 @@ public:
 protected:
     WebFullScreenManager(WebPage*);
 
-    virtual void beginEnterFullScreenAnimation(float duration) = 0;
-    virtual void beginExitFullScreenAnimation(float duration) = 0;
-    virtual void disposeOfLayerClient() { }
-    WebCore::IntRect getFullScreenRect();
+    void setAnimatingFullScreen(bool);
 
     void didReceiveWebFullScreenManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
     WebCore::IntRect m_initialFrame;
+    WebCore::IntRect m_finalFrame;
     RefPtr<WebPage> m_page;
     RefPtr<WebCore::Element> m_element;
 };
diff --git a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.messages.in b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.messages.in
index 82eee3da6..d4ac9464d 100644
--- a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.messages.in
+++ b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.messages.in
@@ -26,8 +26,6 @@ messages -> WebFullScreenManager {
     DidEnterFullScreen()
     WillExitFullScreen()
     DidExitFullScreen()
-    BeginEnterFullScreenAnimation(float duration)
-    BeginExitFullScreenAnimation(float duration)
-    DisposeOfLayerClient()
+    SetAnimatingFullScreen(bool animating)
 }
 #endif
diff --git a/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.h b/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.h
deleted file mode 100644
index 27e8aff20..000000000
--- a/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.h
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebFullScreenManagerMac_h
-#define WebFullScreenManagerMac_h
-
-#if ENABLE(FULLSCREEN_API)
-
-#import "LayerTreeContext.h"
-#import "WebFullScreenManager.h"
-
-#import <WebCore/GraphicsLayer.h>
-#import <WebCore/IntRect.h>
-#import <wtf/RetainPtr.h>
-
-typedef struct __WKCARemoteLayerClientRef* WKCARemoteLayerClientRef;
-OBJC_CLASS WebFullScreenManagerAnimationListener;
-
-namespace WebKit {
-
-class WebFullScreenManagerMac : public WebFullScreenManager {
-public:
-    static PassRefPtr<WebFullScreenManagerMac> create(WebPage*);
-
-    virtual void setRootFullScreenLayer(WebCore::GraphicsLayer*);
-
-private:
-    WebFullScreenManagerMac(WebPage*);
-    virtual ~WebFullScreenManagerMac();
-
-    virtual void beginEnterFullScreenAnimation(float duration);
-    virtual void beginExitFullScreenAnimation(float duration);
-    virtual void disposeOfLayerClient();
-
-    void animateFullScreen(const CATransform3D& startTransform, const CATransform3D& endTransform, float duration, id listener);
-    CATransform3D windowedCGTransform();
-
-    OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
-    LayerTreeContext m_layerTreeContext;
-    RetainPtr<WKCARemoteLayerClientRef> m_remoteLayerClient;
-    RetainPtr<id> m_enterFullScreenListener;
-    RetainPtr<id> m_exitFullScreenListener;
-};
-
-}
-
-#endif // ENABLE(FULLSCREEN_API)
-
-#endif // WebFullScreenManagerMac_h
diff --git a/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm b/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm
deleted file mode 100644
index 07060078d..000000000
--- a/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm
+++ /dev/null
@@ -1,311 +0,0 @@
-/*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-#import "config.h"
-#import "WebFullScreenManagerMac.h"
-
-#if ENABLE(FULLSCREEN_API)
-
-#import "Connection.h"
-#import "LayerTreeContext.h"
-#import "MessageID.h"
-#import "WebFullScreenManagerProxyMessages.h"
-#import "WebPage.h"
-#import "WebProcess.h"
-#import <QuartzCore/QuartzCore.h>
-#import <WebCore/Frame.h>
-#import <WebCore/FrameView.h>
-#import <WebCore/GraphicsLayer.h>
-#import <WebCore/Page.h>
-#import <WebCore/RenderLayer.h>
-#import <WebCore/RenderLayerBacking.h>
-#import <WebCore/RenderObject.h>
-#import <WebCore/Settings.h>
-#import <WebKitSystemInterface.h>
-
-using namespace WebCore;
-
-typedef void (WebKit::WebFullScreenManager::*AnimationBeganFunction)();
-typedef void (WebKit::WebFullScreenManager::*AnimationFinishedFunction)(bool);
-
-#if defined(BUILDING_ON_LEOPARD)
-@interface CATransaction(SnowLeopardConvenienceFunctions)
-+ (void)setDisableActions:(BOOL)flag;
-@end
-
-@implementation CATransaction(SnowLeopardConvenienceFunctions)
-+ (void)setDisableActions:(BOOL)flag
-{
-    [self setValue:[NSNumber numberWithBool:flag] forKey:kCATransactionDisableActions];
-}
-@end
-#endif
-
-@interface WKFullScreenManagerAnimationListener : NSObject {
-    WebKit::WebFullScreenManager* _manager;
-    AnimationBeganFunction _began;
-    AnimationFinishedFunction _finished;
-}
-- (id)initWithManager:(WebKit::WebFullScreenManager*)manager began:(AnimationBeganFunction)began finished:(AnimationFinishedFunction)finished;
-- (void)animationDidStart:(CAAnimation *)anim;
-- (void)animationDidStop:(CAAnimation *)anim finished:(BOOL)flag;
-- (void)invalidate;
-@end
-
-@implementation WKFullScreenManagerAnimationListener
-- (id)initWithManager:(WebKit::WebFullScreenManager*)manager began:(AnimationBeganFunction)began finished:(AnimationFinishedFunction)finished
-{
-    self = [super init];
-    if (!self)
-        return nil;
-
-    _manager = manager;
-    _began = began;
-    _finished = finished;
-    return self;
-}
-
-- (void)animationDidStart:(CAAnimation *)anim
-{
-    if (_manager && _began)
-        (_manager->*_began)();
-}
-
-- (void)animationDidStop:(CAAnimation *)anim finished:(BOOL)flag
-{
-    if (_manager && _finished)
-        (_manager->*_finished)(flag);
-}
-
-- (void)invalidate
-{
-    _manager = 0;
-    _began = 0;
-    _finished = 0;
-}
-@end
-
-namespace WebKit {
-
-PassRefPtr<WebFullScreenManager> WebFullScreenManager::create(WebPage* page)
-{
-    return WebFullScreenManagerMac::create(page);
-}
-
-PassRefPtr<WebFullScreenManagerMac> WebFullScreenManagerMac::create(WebPage* page)
-{
-    return adoptRef(new WebFullScreenManagerMac(page));
-}
-
-WebFullScreenManagerMac::WebFullScreenManagerMac(WebPage* page)
-    : WebFullScreenManager(page)
-{
-    m_enterFullScreenListener.adoptNS([[WKFullScreenManagerAnimationListener alloc] initWithManager:this began:&WebFullScreenManagerMac::beganEnterFullScreenAnimation finished:&WebFullScreenManagerMac::finishedEnterFullScreenAnimation]);
-    m_exitFullScreenListener.adoptNS([[WKFullScreenManagerAnimationListener alloc] initWithManager:this began:&WebFullScreenManagerMac::beganExitFullScreenAnimation finished:&WebFullScreenManagerMac::finishedExitFullScreenAnimation]);
-}
-
-WebFullScreenManagerMac::~WebFullScreenManagerMac()
-{
-    m_page->send(Messages::WebFullScreenManagerProxy::ExitAcceleratedCompositingMode());
-    [m_enterFullScreenListener.get() invalidate];
-    [m_exitFullScreenListener.get() invalidate];
-}
-
-void WebFullScreenManagerMac::setRootFullScreenLayer(WebCore::GraphicsLayer* layer)
-{
-    if (!m_rootLayer && !layer)
-        return;
-
-    if (!layer) {
-        PlatformLayer* rootPlatformLayer = m_rootLayer->platformLayer();
-        [[NSNotificationCenter defaultCenter] postNotificationName:@"WebKitLayerHostChanged" object:rootPlatformLayer userInfo:nil];
-        m_rootLayer->removeAllChildren();
-        m_rootLayer->syncCompositingStateForThisLayerOnly();
-        m_rootLayer = nullptr;
-
-        m_page->forceRepaintWithoutCallback();
-        m_page->send(Messages::WebFullScreenManagerProxy::ExitAcceleratedCompositingMode());
-        return;
-    }
-
-    if (m_rootLayer && m_rootLayer->children().contains(layer))
-        return;
-
-    if (!m_rootLayer) {
-        mach_port_t serverPort = WebProcess::shared().compositingRenderServerPort();
-        m_remoteLayerClient = WKCARemoteLayerClientMakeWithServerPort(serverPort);
-
-        m_rootLayer = GraphicsLayer::create(NULL);
-#ifndef NDEBUG
-        m_rootLayer->setName("Full screen root layer");
-#endif
-        m_rootLayer->setDrawsContent(false);
-        m_rootLayer->setSize(getFullScreenRect().size());
-
-        [m_rootLayer->platformLayer() setGeometryFlipped:YES];
-        WKCARemoteLayerClientSetLayer(m_remoteLayerClient.get(), m_rootLayer->platformLayer());
-        m_layerTreeContext.contextID = WKCARemoteLayerClientGetClientId(m_remoteLayerClient.get());
-        m_page->send(Messages::WebFullScreenManagerProxy::EnterAcceleratedCompositingMode(m_layerTreeContext));
-    }
-
-    [CATransaction begin];
-    [CATransaction setDisableActions:YES];
-    m_rootLayer->removeAllChildren();
-    m_rootLayer->addChild(layer);
-    m_rootLayer->syncCompositingState(getFullScreenRect());
-    [CATransaction commit];
-
-    [[NSNotificationCenter defaultCenter] postNotificationName:@"WebKitLayerHostChanged" object:m_rootLayer->platformLayer() userInfo:nil];
-}
-
-void WebFullScreenManagerMac::disposeOfLayerClient()
-{
-    if (!m_remoteLayerClient)
-        return;
-    WKCARemoteLayerClientSetLayer(m_remoteLayerClient.get(), 0);
-    WKCARemoteLayerClientInvalidate(m_remoteLayerClient.get());
-    m_remoteLayerClient = nullptr;
-}
-
-void WebFullScreenManagerMac::beginEnterFullScreenAnimation(float duration)
-{
-    ASSERT(m_element);
-    
-    if (!m_rootLayer || m_rootLayer->children().isEmpty()) {
-        // If we don't have a root layer, we can't animate in and out of full screen
-        m_page->send(Messages::WebFullScreenManagerProxy::EnterAcceleratedCompositingMode(m_layerTreeContext));
-        this->beganEnterFullScreenAnimation();
-        this->finishedEnterFullScreenAnimation(true);
-        m_page->send(Messages::WebFullScreenManagerProxy::ExitAcceleratedCompositingMode());
-        return;
-    }
-
-    IntRect destinationFrame = getFullScreenRect();
-    m_element->document()->setFullScreenRendererSize(destinationFrame.size());
-    m_rootLayer->syncCompositingState(destinationFrame);
-
-    // FIXME: Once we gain the ability to do native WebKit animations of generated
-    // content, this can change to use them.  Meanwhile, we'll have to animate the
-    // CALayer directly.
-    animateFullScreen(windowedCGTransform(), CATransform3DIdentity, duration, m_enterFullScreenListener.get());
-}
-
-void WebFullScreenManagerMac::beginExitFullScreenAnimation(float duration)
-{
-    ASSERT(m_element);
-    
-    if (!m_rootLayer || m_rootLayer->children().isEmpty()) {
-        // If we don't have a root layer, we can't animate in and out of full screen
-        m_page->send(Messages::WebFullScreenManagerProxy::EnterAcceleratedCompositingMode(m_layerTreeContext));
-        this->beganExitFullScreenAnimation();
-        this->finishedExitFullScreenAnimation(true);
-        m_page->send(Messages::WebFullScreenManagerProxy::ExitAcceleratedCompositingMode());
-        return;
-    }
-
-    IntRect destinationFrame = getFullScreenRect();
-    m_element->document()->setFullScreenRendererSize(destinationFrame.size());
-    m_rootLayer->syncCompositingState(destinationFrame);
-
-    // FIXME: Once we gain the ability to do native WebKit animations of generated
-    // content, this can change to use them.  Meanwhile, we'll have to animate the
-    // CALayer directly.
-    CALayer* caLayer = m_rootLayer->children().first()->platformLayer();
-    CALayer* presentationLayer = [caLayer presentationLayer] ? (CALayer*)[caLayer presentationLayer] : caLayer;
-    animateFullScreen([presentationLayer transform], windowedCGTransform(), duration, m_exitFullScreenListener.get());
-}
-
-void WebFullScreenManagerMac::animateFullScreen(const CATransform3D& startTransform, const CATransform3D& endTransform, float duration, id listener)
-{
-    // This is the full size of the screen.
-    IntRect fullScreenRect = getFullScreenRect();    
-    CALayer* caLayer = m_rootLayer->children().first()->platformLayer();
-
-    // This animation represents the zoom effect.
-    CABasicAnimation* zoomAnimation = [CABasicAnimation animationWithKeyPath:@"transform"];
-    [zoomAnimation setFromValue:[NSValue valueWithCATransform3D:startTransform]];
-    [zoomAnimation setToValue:[NSValue valueWithCATransform3D:endTransform]];
-    
-    // This animation provides a position correction to the CALayer, which might be offset based on the page's
-    // scroll position. We animate it instead of just setting the property because others might try to
-    // alter its position while the animation is playing.
-    CGPoint layerAnchor = [caLayer anchorPoint];
-    CGPoint fullScreenPosition = CGPointMake(
-        fullScreenRect.x() + fullScreenRect.width() * layerAnchor.x,
-        fullScreenRect.y() + fullScreenRect.height() * layerAnchor.y);
-    CABasicAnimation* positionCorrection = [CABasicAnimation animationWithKeyPath:@"position"];
-    [positionCorrection setFromValue:[NSValue valueWithPoint:NSPointFromCGPoint(fullScreenPosition)]];
-    [positionCorrection setToValue:[NSValue valueWithPoint:NSPointFromCGPoint(fullScreenPosition)]];
-    
-    // We want to be notified that the animation has completed by way of the CAAnimation delegate.
-    CAAnimationGroup* transitionAnimation = [CAAnimationGroup animation];
-    [transitionAnimation setAnimations:[NSArray arrayWithObjects:zoomAnimation, positionCorrection, nil]];
-    [transitionAnimation setDelegate:listener];
-    [transitionAnimation setDuration:duration];
-    [transitionAnimation setTimingFunction:[CAMediaTimingFunction functionWithName:kCAMediaTimingFunctionEaseInEaseOut]];
-    [transitionAnimation setFillMode:kCAFillModeForwards];
-    [transitionAnimation setRemovedOnCompletion:NO];
-    
-    // Disable implicit animations and set the layer's transformation matrix to its final state.
-    [CATransaction begin];
-    [CATransaction setDisableActions:YES];
-    [caLayer addAnimation:transitionAnimation forKey:@"zoom"];
-    [CATransaction commit];
-}
-
-CATransform3D WebFullScreenManagerMac::windowedCGTransform()
-{
-    IntRect fullScreenRect = getFullScreenRect();
-    RenderLayer* layer = m_element->renderer() ? m_element->renderer()->enclosingLayer() : 0;
-    RenderLayerBacking* backing = layer ? layer->backing() : 0;
-    IntSize fullScreenSize = fullScreenRect.size();
-    if (backing)
-        fullScreenSize = backing->contentsBox().size();
-
-    CALayer* caLayer = m_rootLayer->children().first()->platformLayer();
-
-    // Create a transformation matrix that will transform the renderer layer such that
-    // the fullscreen element appears to move from its starting position and size to its
-    // final one.
-    CGPoint layerAnchor = [caLayer anchorPoint];
-    CGPoint fullScreenPosition = CGPointMake(
-        fullScreenRect.x() + fullScreenRect.width() * layerAnchor.x,
-        fullScreenRect.y() + fullScreenRect.height() * layerAnchor.y); //[presentationLayer position];
-    CGPoint windowedPosition = CGPointMake(
-        m_initialFrame.x() + m_initialFrame.width() * layerAnchor.x,
-        m_initialFrame.y() + m_initialFrame.height() * layerAnchor.y);
-    CATransform3D shrinkTransform = CATransform3DMakeScale(
-        static_cast<CGFloat>(m_initialFrame.width()) / fullScreenSize.width(),
-        static_cast<CGFloat>(m_initialFrame.height()) / fullScreenSize.height(), 1);
-    CATransform3D shiftTransform = CATransform3DMakeTranslation(
-        windowedPosition.x - fullScreenPosition.x,
-        // Drawing is flipped here, and so must be the translation transformation
-        fullScreenPosition.y - windowedPosition.y, 0);
-    
-    return CATransform3DConcat(shrinkTransform, shiftTransform);
-}
-
-} // namespace WebKit
-
-#endif // ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit2/WebProcess/FullScreen/qt/WebFullScreenManagerQt.cpp b/Source/WebKit2/WebProcess/FullScreen/qt/WebFullScreenManagerQt.cpp
deleted file mode 100644
index 5467e5661..000000000
--- a/Source/WebKit2/WebProcess/FullScreen/qt/WebFullScreenManagerQt.cpp
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "WebFullScreenManagerQt.h"
-
-#if ENABLE(FULLSCREEN_API)
-
-#include <WebCore/NotImplemented.h>
-
-namespace WebKit {
-
-WebFullScreenManagerQt::WebFullScreenManagerQt(WebPage* page)
-    : WebFullScreenManager(page)
-{
-}
-
-PassRefPtr<WebFullScreenManager> WebFullScreenManager::create(WebPage* page)
-{
-    return adoptRef(new WebFullScreenManagerQt(page));
-}
-
-void WebFullScreenManagerQt::setRootFullScreenLayer(WebCore::GraphicsLayer* layer)
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerQt::beginEnterFullScreenAnimation(float duration)
-{
-    notImplemented();
-}
-
-void WebFullScreenManagerQt::beginExitFullScreenAnimation(float duration)
-{
-    notImplemented();
-}
-
-} // namespace WebKit
-
-#endif // ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit2/WebProcess/FullScreen/win/WebFullScreenManagerWin.cpp b/Source/WebKit2/WebProcess/FullScreen/win/WebFullScreenManagerWin.cpp
deleted file mode 100644
index 28ea54b70..000000000
--- a/Source/WebKit2/WebProcess/FullScreen/win/WebFullScreenManagerWin.cpp
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "WebFullScreenManagerWin.h"
-
-#if ENABLE(FULLSCREEN_API)
-
-#include "MessageID.h"
-#include "WebFullScreenManagerProxyMessages.h"
-#include "WebPage.h"
-#include "WebProcess.h"
-#include <WebCore/Frame.h>
-#include <WebCore/FrameView.h>
-#include <WebCore/GraphicsLayer.h>
-#include <WebCore/Page.h>
-#include <WebKitSystemInterface/WebKitSystemInterface.h>
-
-using namespace WebCore;
-
-namespace WebKit {
-
-PassRefPtr<WebFullScreenManager> WebFullScreenManager::create(WebPage* page)
-{
-    return WebFullScreenManagerWin::create(page);
-}
-
-PassRefPtr<WebFullScreenManagerWin> WebFullScreenManagerWin::create(WebPage* page)
-{
-    return adoptRef(new WebFullScreenManagerWin(page));
-}
-
-WebFullScreenManagerWin::WebFullScreenManagerWin(WebPage* page)
-    : WebFullScreenManager(page)
-{
-}
-
-WebFullScreenManagerWin::~WebFullScreenManagerWin()
-{
-    m_page->send(Messages::WebFullScreenManagerProxy::ExitAcceleratedCompositingMode());
-}
-
-void WebFullScreenManagerWin::setRootFullScreenLayer(WebCore::GraphicsLayer* layer)
-{
-    // Host the full screen layer if its given to us; otherwise it will be disconnected 
-    // from the layer heirarchy and cause an ASSERT during resync.
-    // FIXME: Disable setting RenderLayer::setAnimating() to make this unnecessary.
-    if (m_fullScreenRootLayer == layer)
-        return;
-    m_fullScreenRootLayer = layer;
-
-    if (!m_fullScreenRootLayer) {
-        m_page->send(Messages::WebFullScreenManagerProxy::ExitAcceleratedCompositingMode());
-        if (m_rootLayer) {
-            m_rootLayer->removeAllChildren();
-            m_rootLayer = nullptr;
-        }
-        return;
-    }
-
-    if (!m_rootLayer) {
-        m_rootLayer = GraphicsLayer::create(0);
-#ifndef NDEBUG
-        m_rootLayer->setName("Full screen root layer");
-#endif
-        m_rootLayer->setDrawsContent(false);
-        m_rootLayer->setSize(getFullScreenRect().size());
-    }
-
-    m_rootLayer->removeAllChildren();
-
-    if (m_fullScreenRootLayer)
-        m_rootLayer->addChild(m_fullScreenRootLayer);
-
-    m_rootLayer->syncCompositingStateForThisLayerOnly();
-    m_page->corePage()->mainFrame()->view()->syncCompositingStateIncludingSubframes();
-}
-
-void WebFullScreenManagerWin::beginEnterFullScreenAnimation(float)
-{
-    // FIXME: Add support for animating the content into full screen.
-}
-
-void WebFullScreenManagerWin::beginExitFullScreenAnimation(float)
-{
-    // FIXME: Add support for animating the content into full screen.
-}
-
-} // namespace WebKit
-
-#endif // ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp b/Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp
index 1ac23b1d7..d6bdb8e15 100644
--- a/Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp
+++ b/Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "GeolocationPermissionRequestManager.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "WebCoreArgumentCoders.h"
 #include "WebFrame.h"
 #include "WebPage.h"
@@ -89,3 +91,5 @@ void GeolocationPermissionRequestManager::didReceiveGeolocationPermissionDecisio
 }
 
 } // namespace WebKit
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
index 3090c6e65..4a9ee0554 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
@@ -34,6 +34,8 @@
 #include "WebFullScreenManager.h"
 #include "WebImage.h"
 #include "WebPage.h"
+#include "WebRenderLayer.h"
+#include "WebRenderObject.h"
 #include "WebURL.h"
 #include "WebURLRequest.h"
 
@@ -328,6 +330,16 @@ uint64_t WKBundlePageGetRenderTreeSize(WKBundlePageRef pageRef)
     return toImpl(pageRef)->renderTreeSize();
 }
 
+WKRenderObjectRef WKBundlePageCopyRenderTree(WKBundlePageRef pageRef)
+{
+    return toAPI(WebRenderObject::create(toImpl(pageRef)).leakRef());
+}
+
+WKRenderLayerRef WKBundlePageCopyRenderLayerTree(WKBundlePageRef pageRef)
+{
+    return toAPI(WebRenderLayer::create(toImpl(pageRef)).leakRef());
+}
+
 void WKBundlePageSetPaintedObjectsCounterThreshold(WKBundlePageRef page, uint64_t threshold)
 {
     toImpl(page)->setPaintedObjectsCounterThreshold(threshold);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
index 53276b089..c75337acf 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
@@ -95,6 +95,7 @@ typedef void (*WKBundlePageDidRunInsecureContentForFrameCallback)(WKBundlePageRe
 typedef void (*WKBundlePageDidDetectXSSForFrameCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKTypeRef* userData, const void *clientInfo);
 typedef void (*WKBundlePageDidFirstLayoutForFrameCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKTypeRef* userData, const void *clientInfo);
 typedef void (*WKBundlePageDidFirstVisuallyNonEmptyLayoutForFrameCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKTypeRef* userData, const void *clientInfo);
+typedef void (*WKBundlePageDidNewFirstVisuallyNonEmptyLayoutCallback)(WKBundlePageRef page, WKTypeRef* userData, const void *clientInfo);
 typedef void (*WKBundlePageDidLayoutForFrameCallback)(WKBundlePageRef page, WKBundleFrameRef frame, const void* clientInfo);
 typedef void (*WKBundlePageDidClearWindowObjectForFrameCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKBundleScriptWorldRef world, const void *clientInfo);
 typedef void (*WKBundlePageDidCancelClientRedirectForFrameCallback)(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo);
@@ -127,6 +128,7 @@ struct WKBundlePageLoaderClient {
 
     // Version 1.
     WKBundlePageDidLayoutForFrameCallback                               didLayoutForFrame;
+    WKBundlePageDidNewFirstVisuallyNonEmptyLayoutCallback               didNewFirstVisuallyNonEmptyLayout;
     WKBundlePageDidDetectXSSForFrameCallback                            didDetectXSSForFrame;
 };
 typedef struct WKBundlePageLoaderClient WKBundlePageLoaderClient;
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
index 312331e77..6baf7860e 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
@@ -55,6 +55,9 @@ WK_EXPORT void WKBundlePageSimulateMouseMotion(WKBundlePageRef page, WKPoint pos
 
 WK_EXPORT uint64_t WKBundlePageGetRenderTreeSize(WKBundlePageRef page);
 
+WK_EXPORT WKRenderObjectRef WKBundlePageCopyRenderTree(WKBundlePageRef page);
+WK_EXPORT WKRenderLayerRef WKBundlePageCopyRenderLayerTree(WKBundlePageRef page);
+
 // FIXME: This is temporary. Ultimately WebKit should choose the threshold itself.
 WK_EXPORT void WKBundlePageSetPaintedObjectsCounterThreshold(WKBundlePageRef page, uint64_t threshold);
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
index d7498dff4..3bc660294 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
@@ -43,6 +43,10 @@
 typedef struct _GModule GModule;
 #endif
 
+#if PLATFORM(EFL)
+#include <Eina.h>
+#endif
+
 namespace CoreIPC {
     class ArgumentDecoder;
     class Connection;
@@ -59,6 +63,8 @@ typedef HMODULE PlatformBundle;
 typedef QLibrary PlatformBundle;
 #elif PLATFORM(GTK)
 typedef ::GModule* PlatformBundle;
+#elif PLATFORM(EFL)
+typedef Eina_Module* PlatformBundle;
 #endif
 
 class ImmutableArray;
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp
index 69e357ebe..24a3b818a 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp
@@ -186,7 +186,6 @@ void InjectedBundlePageLoaderClient::didFirstVisuallyNonEmptyLayoutForFrame(WebP
     userData = adoptRef(toImpl(userDataToPass));
 }
 
-
 void InjectedBundlePageLoaderClient::didLayoutForFrame(WebPage* page, WebFrame* frame)
 {
     if (!m_client.didLayoutForFrame)
@@ -195,6 +194,16 @@ void InjectedBundlePageLoaderClient::didLayoutForFrame(WebPage* page, WebFrame*
     m_client.didLayoutForFrame(toAPI(page), toAPI(frame), m_client.clientInfo);
 }
 
+void InjectedBundlePageLoaderClient::didNewFirstVisuallyNonEmptyLayout(WebPage* page, RefPtr<APIObject>& userData)
+{
+    if (!m_client.didNewFirstVisuallyNonEmptyLayout)
+        return;
+    
+    WKTypeRef userDataToPass = 0;
+    m_client.didNewFirstVisuallyNonEmptyLayout(toAPI(page), &userDataToPass, m_client.clientInfo);
+    userData = adoptRef(toImpl(userDataToPass));
+}    
+
 void InjectedBundlePageLoaderClient::didClearWindowObjectForFrame(WebPage* page, WebFrame* frame, DOMWrapperWorld* world)
 {
     if (!m_client.didClearWindowObjectForFrame)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h
index c366c6d00..1cc41a681 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h
@@ -64,6 +64,7 @@ public:
     void didFirstLayoutForFrame(WebPage*, WebFrame*, RefPtr<APIObject>& userData);
     void didFirstVisuallyNonEmptyLayoutForFrame(WebPage*, WebFrame*, RefPtr<APIObject>& userData);
     void didLayoutForFrame(WebPage*, WebFrame*);
+    void didNewFirstVisuallyNonEmptyLayout(WebPage*, WTF::RefPtr<APIObject>& userData);
 
     void didClearWindowObjectForFrame(WebPage*, WebFrame*, WebCore::DOMWrapperWorld*);
     void didCancelClientRedirectForFrame(WebPage*, WebFrame*);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/efl/InjectedBundleEfl.cpp b/Source/WebKit2/WebProcess/InjectedBundle/efl/InjectedBundleEfl.cpp
index 294ca06a6..a2a61d47d 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/efl/InjectedBundleEfl.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/efl/InjectedBundleEfl.cpp
@@ -28,20 +28,38 @@
 
 #include "WKBundleAPICast.h"
 #include "WKBundleInitialize.h"
-#include <WebCore/NotImplemented.h>
+#include <wtf/text/CString.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-bool InjectedBundle::load(APIObject*)
+bool InjectedBundle::load(APIObject* initializationUserData)
 {
-    return false;
+    m_platformBundle = eina_module_new(m_path.utf8().data());
+    if (!m_platformBundle) {
+        EINA_LOG_CRIT("Error loading the injected bundle: eina_module_new() failed");
+        return false;
+    }
+    if (!eina_module_load(m_platformBundle)) {
+        EINA_LOG_CRIT("Error loading the injected bundle: %s", m_path.utf8().data());
+        eina_module_free(m_platformBundle);
+        m_platformBundle = 0;
+        return false;
+    }
+
+    WKBundleInitializeFunctionPtr initializeFunction = reinterpret_cast<WKBundleInitializeFunctionPtr>(eina_module_symbol_get(m_platformBundle, "WKBundleInitialize"));
+    if (!initializeFunction) {
+        EINA_LOG_CRIT("Error loading WKBundleInitialize symbol from injected bundle.");
+        return false;
+    }
+
+    initializeFunction(toAPI(this), toAPI(initializationUserData));
+    return true;
 }
 
 void InjectedBundle::activateMacFontAscentHack()
 {
-    notImplemented();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Notifications/NotificationPermissionRequestManager.cpp b/Source/WebKit2/WebProcess/Notifications/NotificationPermissionRequestManager.cpp
index 7d662f12d..73e71fbc9 100644
--- a/Source/WebKit2/WebProcess/Notifications/NotificationPermissionRequestManager.cpp
+++ b/Source/WebKit2/WebProcess/Notifications/NotificationPermissionRequestManager.cpp
@@ -62,8 +62,10 @@ NotificationPermissionRequestManager::NotificationPermissionRequestManager(WebPa
 void NotificationPermissionRequestManager::startRequest(SecurityOrigin* origin, PassRefPtr<VoidCallback> callback)
 {
 #if ENABLE(NOTIFICATIONS)
-    if (permissionLevel(origin) != NotificationPresenter::PermissionNotAllowed)
+    if (permissionLevel(origin) != NotificationClient::PermissionNotAllowed) {
+        callback->handleEvent();
         return;
+    }
 
     uint64_t requestID = generateRequestID();
     m_originToIDMap.set(origin, requestID);
@@ -90,16 +92,16 @@ void NotificationPermissionRequestManager::cancelRequest(SecurityOrigin* origin)
 #endif
 }
 
-NotificationPresenter::Permission NotificationPermissionRequestManager::permissionLevel(SecurityOrigin* securityOrigin)
+NotificationClient::Permission NotificationPermissionRequestManager::permissionLevel(SecurityOrigin* securityOrigin)
 {
 #if ENABLE(NOTIFICATIONS)
     if (!m_page->corePage()->settings()->notificationsEnabled())
-        return NotificationPresenter::PermissionDenied;
+        return NotificationClient::PermissionDenied;
     
     return WebProcess::shared().notificationManager().policyForOrigin(securityOrigin);
 #else
     UNUSED_PARAM(securityOrigin);
-    return NotificationPresenter::PermissionDenied;
+    return NotificationClient::PermissionDenied;
 #endif
 }
 
diff --git a/Source/WebKit2/WebProcess/Notifications/NotificationPermissionRequestManager.h b/Source/WebKit2/WebProcess/Notifications/NotificationPermissionRequestManager.h
index 5573c6a11..0397879ba 100644
--- a/Source/WebKit2/WebProcess/Notifications/NotificationPermissionRequestManager.h
+++ b/Source/WebKit2/WebProcess/Notifications/NotificationPermissionRequestManager.h
@@ -26,7 +26,7 @@
 #ifndef NotificationPermissionRequestManager_h
 #define NotificationPermissionRequestManager_h
 
-#include <WebCore/NotificationPresenter.h>
+#include <WebCore/NotificationClient.h>
 #include <WebCore/VoidCallback.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
@@ -50,7 +50,7 @@ public:
     void cancelRequest(WebCore::SecurityOrigin*);
     
     // Synchronous call to retrieve permission level for given security origin
-    WebCore::NotificationPresenter::Permission permissionLevel(WebCore::SecurityOrigin*);
+    WebCore::NotificationClient::Permission permissionLevel(WebCore::SecurityOrigin*);
     
     void didReceiveNotificationPermissionDecision(uint64_t notificationID, bool allowed);
     
diff --git a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
index 90a7f4021..9e5cf9546 100644
--- a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
+++ b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
@@ -90,18 +90,18 @@ void WebNotificationManager::didRemoveNotificationDecisions(const Vector<String>
 #endif
 }
 
-NotificationPresenter::Permission WebNotificationManager::policyForOrigin(WebCore::SecurityOrigin *origin) const
+NotificationClient::Permission WebNotificationManager::policyForOrigin(WebCore::SecurityOrigin *origin) const
 {
 #if ENABLE(NOTIFICATIONS)
     if (!origin)
-        return NotificationPresenter::PermissionNotAllowed;
+        return NotificationClient::PermissionNotAllowed;
     
     HashMap<String, bool>::const_iterator it = m_permissionsMap.find(origin->toString());
     if (it != m_permissionsMap.end())
-        return it->second ? NotificationPresenter::PermissionAllowed : NotificationPresenter::PermissionDenied;
+        return it->second ? NotificationClient::PermissionAllowed : NotificationClient::PermissionDenied;
 #endif
     
-    return NotificationPresenter::PermissionNotAllowed;
+    return NotificationClient::PermissionNotAllowed;
 }
 
 bool WebNotificationManager::show(Notification* notification, WebPage* page)
@@ -117,7 +117,7 @@ bool WebNotificationManager::show(Notification* notification, WebPage* page)
     NotificationContextMap::iterator it = m_notificationContextMap.add(notification->scriptExecutionContext(), Vector<uint64_t>()).first;
     it->second.append(notificationID);
     
-    m_process->connection()->send(Messages::WebPageProxy::ShowNotification(notification->contents().title, notification->contents().body, notification->iconURL().string(), notification->scriptExecutionContext()->securityOrigin()->toString(), notificationID), page->pageID());
+    m_process->connection()->send(Messages::WebPageProxy::ShowNotification(notification->contents().title, notification->contents().body, notification->iconURL().string(), notification->replaceId(), notification->scriptExecutionContext()->securityOrigin()->toString(), notificationID), page->pageID());
     return true;
 #else
     return false;
diff --git a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
index 3b788be20..142767e31 100644
--- a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
+++ b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
@@ -27,7 +27,7 @@
 #define WebNotificationManager_h
 
 #include "MessageID.h"
-#include <WebCore/NotificationPresenter.h>
+#include <WebCore/NotificationClient.h>
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/RefPtr.h>
@@ -66,7 +66,7 @@ public:
     void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
     
     // Looks in local cache for permission. If not found, returns DefaultDenied.
-    WebCore::NotificationPresenter::Permission policyForOrigin(WebCore::SecurityOrigin*) const;
+    WebCore::NotificationClient::Permission policyForOrigin(WebCore::SecurityOrigin*) const;
 
 private:
     // Implemented in generated WebNotificationManagerMessageReceiver.cpp
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
index f0ed9f74c..802c2dfde 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
@@ -190,7 +190,7 @@ bool NPJSObject::setProperty(NPIdentifier propertyName, const NPVariant* value)
         PutPropertySlot slot;
         m_jsObject->methodTable()->put(m_jsObject.get(), exec, identifierFromIdentifierRep(exec, identifierRep), jsValue, slot);
     } else
-        m_jsObject->methodTable()->putByIndex(m_jsObject.get(), exec, identifierRep->number(), jsValue);
+        m_jsObject->methodTable()->putByIndex(m_jsObject.get(), exec, identifierRep->number(), jsValue, false);
     exec->clearException();
     
     return true;
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
index e09ada40a..bdc6e9de9 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
@@ -36,6 +36,10 @@
 #include <WebCore/SharedBuffer.h>
 #include <utility>
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#include "NetscapeSandboxFunctions.h"
+#endif
+
 using namespace WebCore;
 using namespace std;
 
@@ -411,6 +415,8 @@ static const unsigned WKNVExpectsNonretainedLayer = 74657;
 // Whether plug-in code is allowed to enter (arbitrary) sandbox for the process.
 static const unsigned WKNVAllowedToEnterSandbox = 74658;
 
+// WKNVSandboxFunctions = 74659 is defined in NetscapeSandboxFunctions.h
+
 // The Core Animation render server port.
 static const unsigned WKNVCALayerRenderServerPort = 71879;
 
@@ -418,7 +424,7 @@ static const unsigned WKNVCALayerRenderServerPort = 71879;
 
 static NPError NPN_GetValue(NPP npp, NPNVariable variable, void *value)
 {
-    switch (variable) {
+    switch (static_cast<unsigned>(variable)) {
         case NPNVWindowNPObject: {
             RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
             PluginDestructionProtector protector(plugin.get());
@@ -502,6 +508,14 @@ static NPError NPN_GetValue(NPP npp, NPNVariable variable, void *value)
             *(NPBool*)value = true;
             break;
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+        case WKNVSandboxFunctions:
+        {
+            *(WKNSandboxFunctions **)value = netscapeSandboxFunctions();
+            break;
+        }
+#endif
+
 #ifndef NP_NO_QUICKDRAW
         case NPNVsupportsQuickDrawBool:
             // We don't support the QuickDraw drawing model.
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
index 7e436958c..c8d53819f 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
@@ -532,12 +532,12 @@ static NPCocoaEvent initializeMouseEvent(const WebMouseEvent& mouseEvent, const
 
 bool NetscapePlugin::platformHandleMouseEvent(const WebMouseEvent& mouseEvent)
 {
+    IntPoint eventPositionInPluginCoordinates;
+    if (!convertFromRootView(mouseEvent.position(), eventPositionInPluginCoordinates))
+        return true;
+
     switch (m_eventModel) {
         case NPEventModelCocoa: {
-            IntPoint eventPositionInPluginCoordinates;
-            if (!convertFromRootView(mouseEvent.position(), eventPositionInPluginCoordinates))
-                return true;
-
             NPCocoaEvent event = initializeMouseEvent(mouseEvent, eventPositionInPluginCoordinates);
 
             NPCocoaEvent* previousMouseEvent = m_currentMouseEvent;
@@ -579,8 +579,14 @@ bool NetscapePlugin::platformHandleMouseEvent(const WebMouseEvent& mouseEvent)
 
             EventRecord event = initializeEventRecord(eventKind);
             event.modifiers = modifiersForEvent(mouseEvent);
-            event.where.h = mouseEvent.globalPosition().x();
-            event.where.v = mouseEvent.globalPosition().y();
+
+            double globalX;
+            double globalY;
+            if (!convertPoint(eventPositionInPluginCoordinates.x(), eventPositionInPluginCoordinates.y(), NPCoordinateSpacePlugin, globalX, globalY, NPCoordinateSpaceFlippedScreen))
+                ASSERT_NOT_REACHED();
+
+            event.where.h = globalX;
+            event.where.v = globalY;
 
             NPP_HandleEvent(&event);
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.h b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.h
new file mode 100644
index 000000000..4c77981b6
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NetscapeSandboxFunctions_h
+#define NetscapeSandboxFunctions_h
+
+#include <WebCore/npapi.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+    
+#define WKNVSandboxFunctions 74659
+#define WKNVSandboxFunctionsVersionCurrent 1
+
+typedef NPError (*WKN_EnterSandboxProcPtr)(const char *readOnlyPaths[], const char *readWritePaths[]);
+typedef NPError (*WKN_FileStopAccessingProcPtr)(const char* path);
+
+NPError WKN_EnterSandbox(const char *readOnlyPaths[], const char *readWritePaths[]);
+NPError WKN_FileStopAccessing(const char* path);
+
+typedef struct _WKNSandboxFunctions {
+    uint16_t size;
+    uint16_t version;
+    
+    WKN_EnterSandboxProcPtr enterSandbox;
+    WKN_FileStopAccessingProcPtr fileStopAccessing;
+} WKNSandboxFunctions;
+
+WKNSandboxFunctions* netscapeSandboxFunctions();
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm
new file mode 100644
index 000000000..43aea5faa
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm
@@ -0,0 +1,180 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "NetscapeSandboxFunctions.h"
+
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+
+#import "PluginProcess.h"
+#import "WebKitSystemInterface.h"
+#import <WebCore/FileSystem.h>
+#import <WebCore/SoftLinking.h>
+#import <sys/stat.h>
+#import <sysexits.h>
+#import <wtf/RetainPtr.h>
+#import <wtf/Vector.h>
+#import <wtf/text/CString.h>
+
+SOFT_LINK_FRAMEWORK(CoreServices)
+SOFT_LINK_OPTIONAL(CoreServices, CFURLStopAccessingSecurityScopedResource, void, unused, (CFURLRef))
+
+using namespace WebKit;
+using namespace WebCore;
+
+WKNSandboxFunctions* netscapeSandboxFunctions()
+{
+    static WKNSandboxFunctions functions = {
+        sizeof(WKNSandboxFunctions),
+        WKNVSandboxFunctionsVersionCurrent,
+        WKN_EnterSandbox,
+        WKN_FileStopAccessing
+    };
+    return &functions;
+}
+
+static bool enteredSandbox;
+
+static CString readSandboxProfile()
+{
+    RetainPtr<CFURLRef> profileURL(AdoptCF, CFBundleCopyResourceURL(CFBundleGetMainBundle(), CFSTR("plugin"), CFSTR("sb"), 0));
+    char profilePath[PATH_MAX];
+    if (!CFURLGetFileSystemRepresentation(profileURL.get(), false, reinterpret_cast<UInt8*>(profilePath), sizeof(profilePath))) {
+        fprintf(stderr, "Could not get file system representation of plug-in sandbox URL\n");
+        return CString();
+    }
+
+    FILE *file = fopen(profilePath, "r");
+    if (!file) {
+        fprintf(stderr, "Could not open plug-in sandbox file '%s'\n", profilePath);
+        return CString();
+    }
+
+    struct stat fileInfo;
+    if (stat(profilePath, &fileInfo)) {
+        fprintf(stderr, "Could not get plug-in sandbox file size '%s'\n", profilePath);
+        return CString();
+    }
+
+    char* characterBuffer;
+    CString result = CString::newUninitialized(fileInfo.st_size, characterBuffer);
+
+    if (1 != fread(characterBuffer, fileInfo.st_size, 1, file)) {
+        fprintf(stderr, "Could not read plug-in sandbox file '%s'\n", profilePath);
+        return CString();
+    }
+
+    fclose(file);
+
+    return result;
+}
+
+NPError WKN_EnterSandbox(const char* readOnlyPaths[], const char* readWritePaths[])
+{
+    if (enteredSandbox)
+        return NPERR_GENERIC_ERROR;
+
+    CString profile = readSandboxProfile();
+    if (profile.isNull())
+        exit(EX_NOPERM);
+
+    Vector<const char*> extendedReadOnlyPaths;
+    if (readOnlyPaths) {
+        for (unsigned i = 0; readOnlyPaths[i]; ++i)
+            extendedReadOnlyPaths.append(readOnlyPaths[i]);
+    }
+
+    CString pluginModulePath = fileSystemRepresentation(PluginProcess::shared().pluginPath());
+    extendedReadOnlyPaths.append(pluginModulePath.data());
+
+    // On-disk WebKit framework locations, to account for debug installations.
+    // Allowing the whole directory containing WebKit2.framework for the sake of APIs that implicitly load other WebKit frameworks.
+    // We don't want to load them now, and thus don't have any better idea of where they are located on disk.
+    extendedReadOnlyPaths.append([[[[[NSBundle bundleWithIdentifier:@"com.apple.WebKit2"] bundleURL] URLByDeletingLastPathComponent] path] fileSystemRepresentation]);
+
+    extendedReadOnlyPaths.append(static_cast<const char*>(0));
+
+    Vector<const char*> extendedReadWritePaths;
+    if (readWritePaths) {
+        for (unsigned i = 0; readWritePaths[i]; ++i)
+            extendedReadWritePaths.append(readWritePaths[i]);
+    }
+
+    // FIXME: <rdar://problem/10785457> Use a custom temporary directory.
+    char darwinUserTempDirectory[PATH_MAX];
+    if (confstr(_CS_DARWIN_USER_TEMP_DIR, darwinUserTempDirectory, PATH_MAX) > 0)
+        extendedReadWritePaths.append(darwinUserTempDirectory);
+
+    // FIXME: <rdar://problem/10792047> Use a custom cache directory.
+    char darwinUserCacheDirectory[PATH_MAX];
+    size_t darwinUserCachePathSize = confstr(_CS_DARWIN_USER_CACHE_DIR, darwinUserCacheDirectory, PATH_MAX);
+    if (darwinUserCachePathSize > 0)
+        extendedReadWritePaths.append(darwinUserCacheDirectory);
+
+    RetainPtr<CFStringRef> cachePath(AdoptCF, WKCopyFoundationCacheDirectory());
+    extendedReadWritePaths.append([(NSString *)cachePath.get() fileSystemRepresentation]);
+
+    extendedReadWritePaths.append(static_cast<const char*>(0));
+
+    // WKEnterPluginSandbox canonicalizes path arrays, but not parameters (because it cannot know if one is a path).
+    char* homeDirectory = realpath([NSHomeDirectory() fileSystemRepresentation], 0);
+    if (!homeDirectory)
+        exit(EX_NOPERM);
+    const char* sandboxParameters[] = { "HOME_DIR", homeDirectory, 0, 0 };
+
+    if (!WKEnterPluginSandbox(profile.data(), sandboxParameters, extendedReadOnlyPaths.data(), extendedReadWritePaths.data())) {
+        fprintf(stderr, "Couldn't initialize sandbox profile\n");
+        exit(EX_NOPERM);
+    }
+
+    if (noErr != WKEnableSandboxStyleFileQuarantine()) {
+        fprintf(stderr, "Couldn't enable file quarantine\n");
+        exit(EX_NOPERM);
+    }
+
+    free(homeDirectory);
+    enteredSandbox = true;
+    return NPERR_NO_ERROR;
+}
+
+NPError WKN_FileStopAccessing(const char* path)
+{
+    if (!enteredSandbox)
+        return NPERR_GENERIC_ERROR;
+
+    if (!CFURLStopAccessingSecurityScopedResourcePtr())
+        return NPERR_NO_ERROR;
+
+    RetainPtr<CFStringRef> urlString(AdoptCF, CFStringCreateWithFileSystemRepresentation(0, path));
+    if (!urlString)
+        return NPERR_INVALID_PARAM;
+    RetainPtr<CFURLRef> url(AdoptCF, CFURLCreateWithFileSystemPath(0, urlString.get(), kCFURLPOSIXPathStyle, false));
+
+    CFURLStopAccessingSecurityScopedResourcePtr()(url.get());
+
+    return NPERR_NO_ERROR;
+}
+
+#endif
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.cpp b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.cpp
index 904a83dcd..d5b8353ee 100644
--- a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.cpp
@@ -227,34 +227,15 @@ void BuiltInPDFView::updateScrollbars()
             scrollbarRect.contract(0, m_horizontalScrollbar->height());
         m_verticalScrollbar->setFrameRect(scrollbarRect);
     }
-}
-
-void BuiltInPDFView::didAddHorizontalScrollbar(Scrollbar* scrollbar)
-{
-    pluginView()->frame()->document()->didAddWheelEventHandler();
-    ScrollableArea::didAddHorizontalScrollbar(scrollbar);
-}
-
-void BuiltInPDFView::willRemoveHorizontalScrollbar(Scrollbar* scrollbar)
-{
-    ScrollableArea::willRemoveHorizontalScrollbar(scrollbar);
-    // FIXME: Maybe need a separate ScrollableArea::didRemoveHorizontalScrollbar callback?
-    if (PluginView* pluginView = this->pluginView())
-        pluginView->frame()->document()->didRemoveWheelEventHandler();
-}
-
-void BuiltInPDFView::didAddVerticalScrollbar(Scrollbar* scrollbar)
-{
-    pluginView()->frame()->document()->didAddWheelEventHandler();
-    ScrollableArea::didAddVerticalScrollbar(scrollbar);
-}
+    
+    FrameView* frameView = m_frame->coreFrame()->view();
+    if (!frameView)
+        return;
 
-void BuiltInPDFView::willRemoveVerticalScrollbar(Scrollbar* scrollbar)
-{
-    ScrollableArea::willRemoveVerticalScrollbar(scrollbar);
-    // FIXME: Maybe need a separate ScrollableArea::didRemoveHorizontalScrollbar callback?
-    if (PluginView* pluginView = this->pluginView())
-        pluginView->frame()->document()->didRemoveWheelEventHandler();
+    if (m_verticalScrollbar || m_horizontalScrollbar)
+        frameView->addScrollableArea(this);
+    else
+        frameView->removeScrollableArea(this);
 }
 
 PassRefPtr<Scrollbar> BuiltInPDFView::createScrollbar(ScrollbarOrientation orientation)
@@ -348,8 +329,6 @@ void BuiltInPDFView::calculateSizes()
 
 bool BuiltInPDFView::initialize(const Parameters& parameters)
 {
-    m_frame->coreFrame()->view()->addScrollableArea(this);
-
     // Load the src URL if needed.
     m_sourceURL = parameters.url;
     if (!parameters.loadManually && !parameters.url.isEmpty())
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
index d6c364f00..e4a624a67 100644
--- a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
@@ -58,10 +58,6 @@ private:
     const PluginView* pluginView() const;
 
     void updateScrollbars();
-    void didAddHorizontalScrollbar(WebCore::Scrollbar*);
-    void willRemoveHorizontalScrollbar(WebCore::Scrollbar*);
-    void didAddVerticalScrollbar(WebCore::Scrollbar*);
-    void willRemoveVerticalScrollbar(WebCore::Scrollbar*);
     PassRefPtr<WebCore::Scrollbar> createScrollbar(WebCore::ScrollbarOrientation);
     void destroyScrollbar(WebCore::ScrollbarOrientation);
     void addArchiveResource();
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
index 5a48fff87..16cb22ae0 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
@@ -30,7 +30,6 @@
 #include "DrawingArea.h"
 #include "InjectedBundleNavigationAction.h"
 #include "InjectedBundleUserMessageCoders.h"
-#include "WebContextMenu.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebFrame.h"
 #include "WebFrameLoaderClient.h"
@@ -492,15 +491,8 @@ void WebChromeClient::mouseDidMoveOverElement(const HitTestResult& hitTestResult
     // Notify the bundle client.
     m_page->injectedBundleUIClient().mouseDidMoveOverElement(m_page, hitTestResult, static_cast<WebEvent::Modifiers>(modifierFlags), userData);
 
-    WebHitTestResult::Data webHitTestResultData;
-    webHitTestResultData.absoluteImageURL = hitTestResult.absoluteImageURL().string();
-    webHitTestResultData.absolutePDFURL = hitTestResult.absolutePDFURL().string();
-    webHitTestResultData.absoluteLinkURL = hitTestResult.absoluteLinkURL().string();
-    webHitTestResultData.absoluteMediaURL = hitTestResult.absoluteMediaURL().string();
-    webHitTestResultData.linkLabel = hitTestResult.textContent();
-    webHitTestResultData.linkTitle = hitTestResult.titleDisplayString();
-
     // Notify the UIProcess.
+    WebHitTestResult::Data webHitTestResultData(hitTestResult);
     m_page->send(Messages::WebPageProxy::MouseDidMoveOverElement(webHitTestResultData, modifierFlags, InjectedBundleUserMessageEncoder(userData.get())));
 }
 
@@ -670,13 +662,6 @@ PassRefPtr<WebCore::SearchPopupMenu> WebChromeClient::createSearchPopupMenu(WebC
     return WebSearchPopupMenu::create(m_page, client);
 }
 
-#if ENABLE(CONTEXT_MENUS)
-void WebChromeClient::showContextMenu()
-{
-    m_page->contextMenu()->show();
-}
-#endif
-
 #if USE(ACCELERATED_COMPOSITING)
 void WebChromeClient::attachRootGraphicsLayer(Frame*, GraphicsLayer* layer)
 {
@@ -727,12 +712,6 @@ void WebChromeClient::exitFullScreenForElement(WebCore::Element* element)
 {
     m_page->fullScreenManager()->exitFullScreenForElement(element);
 }
-    
-void WebChromeClient::setRootFullScreenLayer(GraphicsLayer* layer)
-{
-    m_page->fullScreenManager()->setRootFullScreenLayer(layer);
-}
-
 #endif
 
 void WebChromeClient::dispatchViewportPropertiesDidChange(const ViewportArguments& args) const
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
index 9761c154a..b68d8d476 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
@@ -174,10 +174,6 @@ private:
     virtual PassRefPtr<WebCore::PopupMenu> createPopupMenu(WebCore::PopupMenuClient*) const OVERRIDE;
     virtual PassRefPtr<WebCore::SearchPopupMenu> createSearchPopupMenu(WebCore::PopupMenuClient*) const OVERRIDE;
 
-#if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() OVERRIDE;
-#endif
-
 #if USE(ACCELERATED_COMPOSITING)
     virtual void attachRootGraphicsLayer(WebCore::Frame*, WebCore::GraphicsLayer*) OVERRIDE;
     virtual void setNeedsOneShotDrawingSynchronization() OVERRIDE;
@@ -206,7 +202,6 @@ private:
     virtual bool supportsFullScreenForElement(const WebCore::Element*, bool withKeyboard) OVERRIDE;
     virtual void enterFullScreenForElement(WebCore::Element*) OVERRIDE;
     virtual void exitFullScreenForElement(WebCore::Element*) OVERRIDE;
-    virtual void setRootFullScreenLayer(WebCore::GraphicsLayer*) OVERRIDE;
 #endif
 
 #if PLATFORM(MAC)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.cpp
index b2cdbcc31..bab9ff1b9 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "WebContextMenuClient.h"
 
+#include "WebContextMenu.h"
 #include "WebContextMenuItemData.h"
 #include "WebPage.h"
 #include <WebCore/ContextMenu.h>
@@ -87,4 +88,11 @@ void WebContextMenuClient::searchWithGoogle(const Frame* frame)
     }
 }
 
+#if USE(ACCESSIBILITY_CONTEXT_MENUS)
+void WebContextMenuClient::showContextMenu()
+{
+    m_page->contextMenu()->show();
+}
+#endif
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.h
index b437245c0..86b0a4898 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.h
@@ -59,7 +59,11 @@ private:
 #if PLATFORM(MAC)
     virtual void searchWithSpotlight() OVERRIDE;
 #endif
-    
+
+#if USE(ACCESSIBILITY_CONTEXT_MENUS)
+    void showContextMenu() OVERRIDE;
+#endif
+
     WebPage* m_page;
 };
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
index 2fb3150bd..010cd4b4f 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
@@ -94,7 +94,7 @@ private:
 #if PLATFORM(MAC)
     virtual NSString *userVisibleString(NSURL *) OVERRIDE;
     virtual WebCore::DocumentFragment* documentFragmentFromAttributedString(NSAttributedString *, Vector< RefPtr<WebCore::ArchiveResource> >&) OVERRIDE;
-    virtual void setInsertionPasteboard(NSPasteboard *) OVERRIDE;
+    virtual void setInsertionPasteboard(const String& pasteboardName) OVERRIDE;
     virtual NSURL* canonicalizeURL(NSURL*) OVERRIDE;
     virtual NSURL* canonicalizeURLString(NSString*) OVERRIDE;
 #endif
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
index 49d3b84c4..67f42b2a3 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -564,6 +564,9 @@ void WebFrameLoaderClient::dispatchDidNewFirstVisuallyNonEmptyLayout()
 
     RefPtr<APIObject> userData;
 
+    // Notify the bundle client.
+    webPage->injectedBundleLoaderClient().didNewFirstVisuallyNonEmptyLayout(webPage, userData);
+    
     // Notify the UIProcess.
     webPage->send(Messages::WebPageProxy::DidNewFirstVisuallyNonEmptyLayout(InjectedBundleUserMessageEncoder(userData.get())));
 }
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.cpp
index 8fd108ad2..8808566aa 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.cpp
@@ -19,8 +19,7 @@
 
 #include "config.h"
 
-#if USE(ACCELERATED_COMPOSITING)
-
+#if USE(UI_SIDE_COMPOSITING)
 #include "WebGraphicsLayer.h"
 
 #include "Animation.h"
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.h
index 4096d3764..0ca5aa54a 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.h
@@ -37,8 +37,7 @@
 #include <WebCore/RunLoop.h>
 #include <wtf/text/StringHash.h>
 
-#if USE(ACCELERATED_COMPOSITING)
-
+#if USE(UI_SIDE_COMPOSITING)
 namespace WebCore {
 class WebGraphicsLayer;
 }
@@ -65,10 +64,8 @@ public:
 namespace WebCore {
 
 class WebGraphicsLayer : public WebCore::GraphicsLayer
-#if USE(TILED_BACKING_STORE)
                        , public TiledBackingStoreClient
                        , public WebKit::TiledBackingStoreRemoteTileClient
-#endif
 {
 public:
     WebGraphicsLayer(GraphicsLayerClient*);
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.cpp
index ea15c7f93..90a870539 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.cpp
@@ -51,8 +51,10 @@ void WebInspectorClient::openInspectorFrontend(InspectorController*)
 
 void WebInspectorClient::closeInspectorFrontend()
 {
-    if (m_page->inspector())
+    if (m_page->inspector()) {
         m_page->inspector()->didClose();
+        m_page->inspector()->destroyInspectorPage();
+    }
 }
 
 void WebInspectorClient::bringFrontendToFront()
@@ -60,6 +62,12 @@ void WebInspectorClient::bringFrontendToFront()
     m_page->inspector()->bringToFront();
 }
 
+void WebInspectorClient::didResizeMainFrame(Frame*)
+{
+    if (m_page->inspector())
+        m_page->inspector()->updateDockingAvailability();
+}
+
 void WebInspectorClient::highlight()
 {
     if (!m_highlightOverlay) {
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.h
index 397003024..7926d5a80 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.h
@@ -55,6 +55,7 @@ private:
     virtual void openInspectorFrontend(WebCore::InspectorController*) OVERRIDE;
     virtual void closeInspectorFrontend() OVERRIDE;
     virtual void bringFrontendToFront() OVERRIDE;
+    virtual void didResizeMainFrame(WebCore::Frame*) OVERRIDE;
 
     virtual void highlight() OVERRIDE;
     virtual void hideHighlight() OVERRIDE;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebNotificationClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebNotificationClient.cpp
index 90eb161f2..643312440 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebNotificationClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebNotificationClient.cpp
@@ -82,10 +82,10 @@ void WebNotificationClient::cancelRequestsForPermission(ScriptExecutionContext*
     m_page->notificationPermissionRequestManager()->cancelRequest(context->securityOrigin());
 }
 
-NotificationPresenter::Permission WebNotificationClient::checkPermission(ScriptExecutionContext* context)
+NotificationClient::Permission WebNotificationClient::checkPermission(ScriptExecutionContext* context)
 {
     if (!context || !context->isDocument())
-        return NotificationPresenter::PermissionDenied;
+        return NotificationClient::PermissionDenied;
     return m_page->notificationPermissionRequestManager()->permissionLevel(context->securityOrigin());
 }
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebNotificationClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebNotificationClient.h
index 147a88ac1..8a84bea1e 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebNotificationClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebNotificationClient.h
@@ -28,7 +28,7 @@
 
 #if ENABLE(NOTIFICATIONS)
 
-#include <WebCore/NotificationPresenter.h>
+#include <WebCore/NotificationClient.h>
 
 namespace WebCore {
 class ScriptExecutionContext;
@@ -39,7 +39,7 @@ namespace WebKit {
 
 class WebPage;
 
-class WebNotificationClient : public WebCore::NotificationPresenter {
+class WebNotificationClient : public WebCore::NotificationClient {
 public:
     WebNotificationClient(WebPage*);
     virtual ~WebNotificationClient();
@@ -52,7 +52,7 @@ private:
     virtual void notificationControllerDestroyed() OVERRIDE;
     virtual void requestPermission(WebCore::ScriptExecutionContext*, PassRefPtr<WebCore::VoidCallback>) OVERRIDE;
     virtual void cancelRequestsForPermission(WebCore::ScriptExecutionContext*) OVERRIDE;
-    virtual NotificationPresenter::Permission checkPermission(WebCore::ScriptExecutionContext*) OVERRIDE;
+    virtual NotificationClient::Permission checkPermission(WebCore::ScriptExecutionContext*) OVERRIDE;
     
     WebPage* m_page;
 };
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
index 138b3eb63..1914efcbe 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
@@ -137,62 +137,92 @@ void WebPlatformStrategies::addVisitedLink(Page*, LinkHash linkHash)
 
 void WebPlatformStrategies::getTypes(Vector<String>& types, const String& pasteboardName)
 {
-    PlatformPasteboard(pasteboardName).getTypes(types);
+    WebProcess::shared().connection()->sendSync(Messages::WebContext::GetPasteboardTypes(pasteboardName),
+                                                Messages::WebContext::GetPasteboardTypes::Reply(types), 0);
 }
 
 PassRefPtr<WebCore::SharedBuffer> WebPlatformStrategies::bufferForType(const String& pasteboardType, const String& pasteboardName)
 {
-    return PlatformPasteboard(pasteboardName).bufferForType(pasteboardType);
+    SharedMemory::Handle handle;
+    uint64_t size = 0;
+    WebProcess::shared().connection()->sendSync(Messages::WebContext::GetPasteboardBufferForType(pasteboardName, pasteboardType),
+                                                Messages::WebContext::GetPasteboardBufferForType::Reply(handle, size), 0);
+    if (handle.isNull())
+        return 0;
+    RefPtr<SharedMemory> sharedMemoryBuffer = SharedMemory::create(handle, SharedMemory::ReadOnly);
+    return SharedBuffer::create(static_cast<unsigned char *>(sharedMemoryBuffer->data()), size);
 }
 
 void WebPlatformStrategies::getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType, const String& pasteboardName)
 {
+    // FIXME: this needs to be replaced with the code below, once we resolve the sandboxing issue.
+    // WebProcess::shared().connection()->sendSync(Messages::WebContext::GetPasteboardPathnamesForType(pasteboardName, pasteboardType),
+    //                                             Messages::WebContext::GetPasteboardPathnamesForType::Reply(pathnames), 0);
+    
     PlatformPasteboard(pasteboardName).getPathnamesForType(pathnames, pasteboardType);
 }
 
 String WebPlatformStrategies::stringForType(const String& pasteboardType, const String& pasteboardName)
 {
-    return PlatformPasteboard(pasteboardName).stringForType(pasteboardType);
+    String value;
+    WebProcess::shared().connection()->sendSync(Messages::WebContext::GetPasteboardStringForType(pasteboardName, pasteboardType),
+                                                Messages::WebContext::GetPasteboardStringForType::Reply(value), 0);
+    return value;
 }
 
 void WebPlatformStrategies::copy(const String& fromPasteboard, const String& toPasteboard)
 {
-    PlatformPasteboard(toPasteboard).copy(fromPasteboard);
+    WebProcess::shared().connection()->send(Messages::WebContext::PasteboardCopy(fromPasteboard, toPasteboard), 0);
 }
 
 int WebPlatformStrategies::changeCount(const WTF::String &pasteboardName)
 {
-    return PlatformPasteboard(pasteboardName).changeCount();
+    uint64_t changeCount;
+    WebProcess::shared().connection()->sendSync(Messages::WebContext::GetPasteboardChangeCount(pasteboardName),
+                                                Messages::WebContext::GetPasteboardChangeCount::Reply(changeCount), 0);
+    return changeCount;
 }
 
 String WebPlatformStrategies::uniqueName()
 {
-    return PlatformPasteboard::uniqueName();
+    String pasteboardName;
+    WebProcess::shared().connection()->sendSync(Messages::WebContext::GetPasteboardUniqueName(),
+                                                Messages::WebContext::GetPasteboardUniqueName::Reply(pasteboardName), 0);
+    return pasteboardName;
 }
 
 Color WebPlatformStrategies::color(const String& pasteboardName)
 {
-    return PlatformPasteboard(pasteboardName).color();    
+    Color color;
+    WebProcess::shared().connection()->sendSync(Messages::WebContext::GetPasteboardColor(pasteboardName),
+                                                Messages::WebContext::GetPasteboardColor::Reply(color), 0);
+    return color;
 }
 
 void WebPlatformStrategies::setTypes(const Vector<String>& pasteboardTypes, const String& pasteboardName)
 {
-    PlatformPasteboard(pasteboardName).setTypes(pasteboardTypes);
+    WebProcess::shared().connection()->send(Messages::WebContext::SetPasteboardTypes(pasteboardName, pasteboardTypes), 0);
 }
 
 void WebPlatformStrategies::setBufferForType(PassRefPtr<SharedBuffer> buffer, const String& pasteboardType, const String& pasteboardName)
 {
-    PlatformPasteboard(pasteboardName).setBufferForType(buffer, pasteboardType);
+    SharedMemory::Handle handle;
+    if (buffer) {
+        RefPtr<SharedMemory> sharedMemoryBuffer = SharedMemory::create(buffer->size());
+        memcpy(sharedMemoryBuffer->data(), buffer->data(), buffer->size());
+        sharedMemoryBuffer->createHandle(handle, SharedMemory::ReadOnly);
+    }
+    WebProcess::shared().connection()->send(Messages::WebContext::SetPasteboardBufferForType(pasteboardName, pasteboardType, handle, buffer ? buffer->size() : 0), 0);
 }
 
 void WebPlatformStrategies::setPathnamesForType(const Vector<String>& pathnames, const String& pasteboardType, const String& pasteboardName)
 {
-    PlatformPasteboard(pasteboardName).setPathnamesForType(pathnames, pasteboardType);
+    WebProcess::shared().connection()->send(Messages::WebContext::SetPasteboardPathnamesForType(pasteboardName, pasteboardType, pathnames), 0);
 }
 
 void WebPlatformStrategies::setStringForType(const String& string, const String& pasteboardType, const String& pasteboardName)
 {
-    PlatformPasteboard(pasteboardName).setStringForType(string, pasteboardType);    
+    WebProcess::shared().connection()->send(Messages::WebContext::SetPasteboardStringForType(pasteboardName, pasteboardType, string), 0);
 }
 #endif
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
index 9a27be83c..523cbdf72 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
@@ -126,7 +126,7 @@ DocumentFragment* WebEditorClient::documentFragmentFromAttributedString(NSAttrib
     return core(fragment);
 }
 
-void WebEditorClient::setInsertionPasteboard(NSPasteboard *)
+void WebEditorClient::setInsertionPasteboard(const String&)
 {
     // This is used only by Mail, no need to implement it now.
     notImplemented();
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
index 8d36fab5f..bfc7da53a 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
@@ -37,6 +37,9 @@ void InitWebCoreSystemInterface(void)
     
     dispatch_once(&initOnce, ^{
         INIT(AdvanceDefaultButtonPulseAnimation);
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+        INIT(CALayerEnumerateRectsBeingDrawnWithBlock);
+#endif
         INIT(CopyCFLocalizationPreferredName);
         INIT(CGContextGetShouldSmoothFonts);
         INIT(CGPatternCreateWithImageAndTransform);
@@ -151,6 +154,8 @@ void InitWebCoreSystemInterface(void)
         INIT(CopyCFURLResponseSuggestedFilename);
         INIT(SetCFURLResponseMIMEType);
 
+        INIT(SetMetadataURL);
+
 #if !defined(BUILDING_ON_SNOW_LEOPARD)
         INIT(CreateVMPressureDispatchOnMainQueue);
 #endif
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingArea.h b/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
index e9fa49c5d..2ee6557ea 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
@@ -66,6 +66,7 @@ public:
     // FIXME: These should be pure virtual.
     virtual void pageBackgroundTransparencyChanged() { }
     virtual void forceRepaint() { }
+    virtual bool forceRepaintAsync(uint64_t callbackID) { return false; }
     virtual void setLayerTreeStateIsFrozen(bool) { }
     virtual bool layerTreeStateIsFrozen() const { return false; }
 
@@ -79,9 +80,10 @@ public:
 #if USE(ACCELERATED_COMPOSITING)
     virtual void setRootCompositingLayer(WebCore::GraphicsLayer*) = 0;
     virtual void scheduleCompositingLayerSync() = 0;
-#if USE(TEXTURE_MAPPER) && USE(TILED_BACKING_STORE)
-    virtual void didReceiveLayerTreeHostMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) = 0;
 #endif
+
+#if USE(UI_SIDE_COMPOSITING)
+    virtual void didReceiveLayerTreeHostMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) = 0;
 #endif
 
 #if PLATFORM(WIN)
@@ -105,7 +107,8 @@ private:
 #if PLATFORM(MAC)
     // Used by TiledCoreAnimationDrawingArea.
     virtual void updateGeometry(const WebCore::IntSize& viewSize) { }
-    virtual void setDeviceScaleFactor(float deviceScaleFactor) { }
+    virtual void setDeviceScaleFactor(float) { }
+    virtual void setLayerHostingMode(uint32_t) { }
 #endif
 };
 
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in b/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in
index 857f87293..0d92a4986 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in
@@ -31,5 +31,6 @@ messages -> DrawingArea {
     // Used by TiledCoreAnimationDrawingArea.
     UpdateGeometry(WebCore::IntSize viewSize)
     SetDeviceScaleFactor(float deviceScaleFactor)
+    SetLayerHostingMode(uint32_t layerHostingMode)
 #endif
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
index 4cc1fe272..619b814a9 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
@@ -667,7 +667,7 @@ void DrawingAreaImpl::display(UpdateInfo& updateInfo)
     m_displayTimer.stop();
 }
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER) && USE(TILED_BACKING_STORE)
+#if USE(UI_SIDE_COMPOSITING)
 void DrawingAreaImpl::didReceiveLayerTreeHostMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
     if (m_layerTreeHost)
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
index bf86fcf19..2f99c337f 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
@@ -70,7 +70,7 @@ private:
     virtual void scheduleChildWindowGeometryUpdate(const WindowGeometry&);
 #endif
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER) && USE(TILED_BACKING_STORE)
+#if USE(UI_SIDE_COMPOSITING)
     virtual void didReceiveLayerTreeHostMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 #endif
 
diff --git a/Source/WebKit2/WebProcess/WebPage/FindController.cpp b/Source/WebKit2/WebProcess/WebPage/FindController.cpp
index 10cfdfc83..6b6156934 100644
--- a/Source/WebKit2/WebProcess/WebPage/FindController.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/FindController.cpp
@@ -109,24 +109,25 @@ void FindController::findString(const String& string, FindOptions options, unsig
         m_webPage->send(Messages::WebPageProxy::DidFailToFindString(string));
     } else {
         shouldShowOverlay = options & FindOptionsShowOverlay;
+        bool shouldShowHighlight = options & FindOptionsShowHighlight;
+        unsigned matchCount = 1;
 
-        if (shouldShowOverlay) {
-            bool shouldShowHighlight = options & FindOptionsShowHighlight;
+        if (shouldShowOverlay || shouldShowHighlight) {
 
             if (maxMatchCount == numeric_limits<unsigned>::max())
                 --maxMatchCount;
-            
-            unsigned matchCount = m_webPage->corePage()->markAllMatchesForText(string, core(options), shouldShowHighlight, maxMatchCount + 1);
+
+            matchCount = m_webPage->corePage()->markAllMatchesForText(string, core(options), shouldShowHighlight, maxMatchCount + 1);
 
             // Check if we have more matches than allowed.
             if (matchCount > maxMatchCount) {
                 shouldShowOverlay = false;
                 matchCount = static_cast<unsigned>(kWKMoreThanMaximumMatchCount);
             }
-
-            m_webPage->send(Messages::WebPageProxy::DidFindString(string, matchCount));
         }
 
+        m_webPage->send(Messages::WebPageProxy::DidFindString(string, matchCount));
+
         if (!(options & FindOptionsShowFindIndicator) || !updateFindIndicator(selectedFrame, shouldShowOverlay)) {
             // Either we shouldn't show the find indicator, or we couldn't update it.
             hideFindIndicator();
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
index 031c3fa6a..92eb40855 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
@@ -34,7 +34,7 @@
 #endif
 #endif
 
-#if PLATFORM(QT) && USE(TEXTURE_MAPPER)
+#if PLATFORM(QT)
 #include "qt/LayerTreeHostQt.h"
 #endif
 
@@ -48,7 +48,7 @@ PassRefPtr<LayerTreeHost> LayerTreeHost::create(WebPage* webPage)
     return LayerTreeHostCAMac::create(webPage);
 #elif PLATFORM(WIN) && HAVE(WKQCA)
     return LayerTreeHostCAWin::create(webPage);
-#elif PLATFORM(QT) && USE(TEXTURE_MAPPER)
+#elif PLATFORM(QT)
     return LayerTreeHostQt::create(webPage);
 #else
     return 0;
diff --git a/Source/WebKit2/WebProcess/WebPage/WebContextMenu.cpp b/Source/WebKit2/WebProcess/WebPage/WebContextMenu.cpp
index e7e2e745f..8ed674196 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebContextMenu.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebContextMenu.cpp
@@ -22,10 +22,10 @@
 #include "config.h"
 #include "WebContextMenu.h"
 
-#include "ContextMenuState.h"
 #include "InjectedBundleHitTestResult.h"
 #include "InjectedBundleUserMessageCoders.h"
 #include "WebCoreArgumentCoders.h"
+#include "WebHitTestResult.h"
 #include "WebPage.h"
 #include "WebPageProxyMessages.h"
 #include "WebProcess.h"
@@ -79,13 +79,11 @@ void WebContextMenu::show()
     if (m_page->injectedBundleContextMenuClient().getCustomMenuFromDefaultItems(m_page, hitTestResult.get(), proposedMenu, newMenu, userData))
         proposedMenu = newMenu;
 
-    ContextMenuState contextMenuState;
-    contextMenuState.absoluteImageURLString = controller->hitTestResult().absoluteImageURL().string();
-    contextMenuState.absoluteLinkURLString = controller->hitTestResult().absoluteLinkURL().string();
+    WebHitTestResult::Data webHitTestResultData(controller->hitTestResult());
 
     // Mark the WebPage has having a shown context menu then notify the UIProcess.
     m_page->contextMenuShowing();
-    m_page->send(Messages::WebPageProxy::ShowContextMenu(view->contentsToWindow(controller->hitTestResult().point()), contextMenuState, proposedMenu, InjectedBundleUserMessageEncoder(userData.get())));
+    m_page->send(Messages::WebPageProxy::ShowContextMenu(view->contentsToWindow(controller->hitTestResult().roundedPoint()), webHitTestResultData, proposedMenu, InjectedBundleUserMessageEncoder(userData.get())));
 }
 
 void WebContextMenu::itemSelected(const WebContextMenuItemData& item)
diff --git a/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp b/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
index 5a42d116e..417837df6 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
@@ -59,6 +59,9 @@ WebPage* WebInspector::createInspectorPage()
     if (!m_page)
         return 0;
 
+    ASSERT(!m_inspectorPage);
+    ASSERT(!m_frontendClient);
+
     uint64_t inspectorPageID = 0;
     WebPageCreationParameters parameters;
 
@@ -81,6 +84,12 @@ WebPage* WebInspector::createInspectorPage()
     return m_inspectorPage;
 }
 
+void WebInspector::destroyInspectorPage()
+{
+    m_inspectorPage = 0;
+    m_frontendClient = 0;
+}
+
 // Called from WebInspectorFrontendClient
 void WebInspector::didLoadInspectorPage()
 {
@@ -221,6 +230,12 @@ void WebInspector::stopPageProfiling()
         m_frontendClient->setTimelineProfilingEnabled(false);
 }
 
+void WebInspector::updateDockingAvailability()
+{
+    if (m_frontendClient)
+        m_frontendClient->setDockingUnavailable(!m_frontendClient->canAttachWindow());
+}
+
 } // namespace WebKit
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebKit2/WebProcess/WebPage/WebInspector.h b/Source/WebKit2/WebProcess/WebPage/WebInspector.h
index 221b97671..1c354f7af 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebInspector.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebInspector.h
@@ -75,6 +75,7 @@ private:
 
     // Called from WebInspectorClient
     WebPage* createInspectorPage();
+    void destroyInspectorPage();
 
     // Called from WebInspectorFrontendClient
     void didLoadInspectorPage();
@@ -102,6 +103,8 @@ private:
     void startJavaScriptProfiling();
     void stopJavaScriptProfiling();
 
+    void updateDockingAvailability();
+
     WebPage* m_page;
     WebPage* m_inspectorPage;
     WebInspectorFrontendClient* m_frontendClient;
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index dad810491..9f8b417a5 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -199,7 +199,9 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
 #if PLATFORM(QT)
     , m_tapHighlightController(this)
 #endif
+#if ENABLE(GEOLOCATION)
     , m_geolocationPermissionRequestManager(this)
+#endif
     , m_pageID(pageID)
     , m_canRunBeforeUnloadConfirmPanel(parameters.canRunBeforeUnloadConfirmPanel)
     , m_canRunModal(parameters.canRunModal)
@@ -1220,25 +1222,25 @@ static bool isContextClick(const PlatformMouseEvent& event)
     return false;
 }
 
-static bool handleContextMenuEvent(const PlatformMouseEvent& platformMouseEvent, Page* page)
+static bool handleContextMenuEvent(const PlatformMouseEvent& platformMouseEvent, WebPage* page)
 {
-    IntPoint point = page->mainFrame()->view()->windowToContents(platformMouseEvent.position());
-    HitTestResult result = page->mainFrame()->eventHandler()->hitTestResultAtPoint(point, false);
+    IntPoint point = page->corePage()->mainFrame()->view()->windowToContents(platformMouseEvent.position());
+    HitTestResult result = page->corePage()->mainFrame()->eventHandler()->hitTestResultAtPoint(point, false);
 
-    Frame* frame = page->mainFrame();
+    Frame* frame = page->corePage()->mainFrame();
     if (result.innerNonSharedNode())
         frame = result.innerNonSharedNode()->document()->frame();
     
     bool handled = frame->eventHandler()->sendContextMenuEvent(platformMouseEvent);
     if (handled)
-        page->chrome()->showContextMenu();
+        page->contextMenu()->show();
 
     return handled;
 }
 
-static bool handleMouseEvent(const WebMouseEvent& mouseEvent, Page* page, bool onlyUpdateScrollbars)
+static bool handleMouseEvent(const WebMouseEvent& mouseEvent, WebPage* page, bool onlyUpdateScrollbars)
 {
-    Frame* frame = page->mainFrame();
+    Frame* frame = page->corePage()->mainFrame();
     if (!frame->view())
         return false;
 
@@ -1247,7 +1249,7 @@ static bool handleMouseEvent(const WebMouseEvent& mouseEvent, Page* page, bool o
     switch (platformMouseEvent.type()) {
         case PlatformEvent::MousePressed: {
             if (isContextClick(platformMouseEvent))
-                page->contextMenuController()->clearContextMenu();
+                page->corePage()->contextMenuController()->clearContextMenu();
             
             bool handled = frame->eventHandler()->handleMousePressEvent(platformMouseEvent);
             if (isContextClick(platformMouseEvent))
@@ -1291,7 +1293,7 @@ void WebPage::mouseEvent(const WebMouseEvent& mouseEvent)
         // of those cases where the page is not active and the mouse is not pressed, then we can fire a more
         // efficient scrollbars-only version of the event.
         bool onlyUpdateScrollbars = !(m_page->focusController()->isActive() || (mouseEvent.button() != WebMouseEvent::NoButton));
-        handled = handleMouseEvent(mouseEvent, m_page.get(), onlyUpdateScrollbars);
+        handled = handleMouseEvent(mouseEvent, this, onlyUpdateScrollbars);
     }
 
     send(Messages::WebPageProxy::DidReceiveEvent(static_cast<uint32_t>(mouseEvent.type()), handled));
@@ -1299,12 +1301,6 @@ void WebPage::mouseEvent(const WebMouseEvent& mouseEvent)
 
 void WebPage::mouseEventSyncForTesting(const WebMouseEvent& mouseEvent, bool& handled)
 {
-    // Don't try to handle any pending mouse events if a context menu is showing.
-    if (m_isShowingContextMenu) {
-        handled = true;
-        return;
-    }
-
     handled = m_pageOverlay && m_pageOverlay->mouseEvent(mouseEvent);
 
     if (!handled) {
@@ -1316,7 +1312,7 @@ void WebPage::mouseEventSyncForTesting(const WebMouseEvent& mouseEvent, bool& ha
         // of those cases where the page is not active and the mouse is not pressed, then we can fire a more
         // efficient scrollbars-only version of the event.
         bool onlyUpdateScrollbars = !(m_page->focusController()->isActive() || (mouseEvent.button() != WebMouseEvent::NoButton));
-        handled = handleMouseEvent(mouseEvent, m_page.get(), onlyUpdateScrollbars);
+        handled = handleMouseEvent(mouseEvent, this, onlyUpdateScrollbars);
     }
 }
 
@@ -1660,7 +1656,20 @@ void WebPage::setUserAgent(const String& userAgent)
 {
     m_userAgent = userAgent;
 }
-  
+
+void WebPage::suspendActiveDOMObjectsAndAnimations()
+{
+    m_page->suspendActiveDOMObjectsAndAnimations();
+}
+
+void WebPage::resumeActiveDOMObjectsAndAnimations()
+{
+    m_page->resumeActiveDOMObjectsAndAnimations();
+
+    // We need to repaint on resume to kickstart animated painting again.
+    m_drawingArea->setNeedsDisplay(IntRect(IntPoint(0, 0), m_viewSize));
+}
+
 IntPoint WebPage::screenToWindow(const IntPoint& point)
 {
     IntPoint windowPoint;
@@ -1814,6 +1823,9 @@ void WebPage::forceRepaintWithoutCallback()
 
 void WebPage::forceRepaint(uint64_t callbackID)
 {
+    if (m_drawingArea->forceRepaintAsync(callbackID))
+        return;
+
     forceRepaintWithoutCallback();
     send(Messages::WebPageProxy::VoidCallback(callbackID));
 }
@@ -1893,6 +1905,7 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
     settings->setMediaPlaybackRequiresUserGesture(store.getBoolValueForKey(WebPreferencesKey::mediaPlaybackRequiresUserGestureKey()));
     settings->setMediaPlaybackAllowsInline(store.getBoolValueForKey(WebPreferencesKey::mediaPlaybackAllowsInlineKey()));
     settings->setMockScrollbarsEnabled(store.getBoolValueForKey(WebPreferencesKey::mockScrollbarsEnabledKey()));
+    settings->setHyperlinkAuditingEnabled(store.getBoolValueForKey(WebPreferencesKey::hyperlinkAuditingEnabledKey()));
 
     // <rdar://problem/10697417>: It is necessary to force compositing when accelerate drawing
     // is enabled on Mac so that scrollbars are always in their own layers.
@@ -2243,10 +2256,12 @@ void WebPage::extendSandboxForFileFromOpenPanel(const SandboxExtension::Handle&
 }
 #endif
 
+#if ENABLE(GEOLOCATION)
 void WebPage::didReceiveGeolocationPermissionDecision(uint64_t geolocationID, bool allowed)
 {
     m_geolocationPermissionRequestManager.didReceiveGeolocationPermissionDecision(geolocationID, allowed);
 }
+#endif
 
 void WebPage::didReceiveNotificationPermissionDecision(uint64_t notificationID, bool allowed)
 {
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.h b/Source/WebKit2/WebProcess/WebPage/WebPage.h
index 745bf4d4a..bc84e359c 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.h
@@ -324,7 +324,10 @@ public:
     TapHighlightController& tapHighlightController() { return m_tapHighlightController; }
 #endif
 
+#if ENABLE(GEOLOCATION)
     GeolocationPermissionRequestManager& geolocationPermissionRequestManager() { return m_geolocationPermissionRequestManager; }
+#endif
+
     NotificationPermissionRequestManager* notificationPermissionRequestManager();
 
     void pageDidScroll();
@@ -598,6 +601,8 @@ private:
     void didReceivePolicyDecision(uint64_t frameID, uint64_t listenerID, uint32_t policyAction, uint64_t downloadID);
     void setUserAgent(const String&);
     void setCustomTextEncodingName(const String&);
+    void suspendActiveDOMObjectsAndAnimations();
+    void resumeActiveDOMObjectsAndAnimations();
 
 #if PLATFORM(MAC)
     void performDictionaryLookupAtLocation(const WebCore::FloatPoint&);
@@ -633,6 +638,7 @@ private:
 #endif
 
     void didReceiveGeolocationPermissionDecision(uint64_t geolocationID, bool allowed);
+
     void didReceiveNotificationPermissionDecision(uint64_t notificationID, bool allowed);
 
     void advanceToNextMisspelling(bool startBeforeSelection);
@@ -743,9 +749,12 @@ private:
     RefPtr<WebPopupMenu> m_activePopupMenu;
     RefPtr<WebContextMenu> m_contextMenu;
     RefPtr<WebOpenPanelResultListener> m_activeOpenPanelResultListener;
-    GeolocationPermissionRequestManager m_geolocationPermissionRequestManager;
     RefPtr<NotificationPermissionRequestManager> m_notificationPermissionRequestManager;
 
+#if ENABLE(GEOLOCATION)
+    GeolocationPermissionRequestManager m_geolocationPermissionRequestManager;
+#endif
+
     OwnPtr<WebCore::PrintContext> m_printContext;
 #if PLATFORM(GTK)
     RefPtr<WebPrintOperationGtk> m_printOperation;
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
index 7813adf3c..2c9436042 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
@@ -101,6 +101,9 @@ messages -> WebPage {
     SetUserAgent(WTF::String userAgent)
     SetCustomTextEncodingName(WTF::String encodingName)
 
+    SuspendActiveDOMObjectsAndAnimations()
+    ResumeActiveDOMObjectsAndAnimations()
+
 #if USE(TILED_BACKING_STORE)
     SetFixedVisibleContentRect(WebCore::IntRect rect)
     SetViewportSize(WebCore::IntSize size)
@@ -176,9 +179,11 @@ messages -> WebPage {
     SetSmartInsertDeleteEnabled(bool isSmartInsertDeleteEnabled);
 #endif
 
+#if ENABLE(GEOLOCATION)
     # Geolocation
     DidReceiveGeolocationPermissionDecision(uint64_t geolocationID, bool allowed)
-    
+#endif
+
     # Notification
     DidReceiveNotificationPermissionDecision(uint64_t notificationID, bool allowed)
 
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.h b/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.h
index 153256b07..8f41355c3 100644
--- a/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.h
+++ b/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.h
@@ -29,12 +29,11 @@
 #include "LayerTreeHostCA.h"
 #include <WebCore/LayerFlushScheduler.h>
 #include <WebCore/LayerFlushSchedulerClient.h>
-#include <wtf/RetainPtr.h>
-
-typedef struct __WKCARemoteLayerClientRef* WKCARemoteLayerClientRef;
 
 namespace WebKit {
 
+class LayerHostingContext;
+
 class LayerTreeHostCAMac : public LayerTreeHostCA, public WebCore::LayerFlushSchedulerClient {
 public:
     static PassRefPtr<LayerTreeHostCAMac> create(WebPage*);
@@ -61,7 +60,7 @@ private:
     // LayerFlushSchedulerClient
     virtual bool flushLayers();
 
-    RetainPtr<WKCARemoteLayerClientRef> m_remoteLayerClient;
+    OwnPtr<LayerHostingContext> m_layerHostingContext;
     WebCore::LayerFlushScheduler m_layerFlushScheduler;
 };
 
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm b/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm
index d45837fd6..e72bd2293 100644
--- a/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm
+++ b/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm
@@ -26,10 +26,10 @@
 #import "config.h"
 #import "LayerTreeHostCAMac.h"
 
+#import "LayerHostingContext.h"
 #import "WebProcess.h"
 #import <QuartzCore/CATransaction.h>
 #import <WebCore/GraphicsLayer.h>
-#import <WebKitSystemInterface.h>
 
 using namespace WebCore;
 
@@ -54,17 +54,15 @@ LayerTreeHostCAMac::LayerTreeHostCAMac(WebPage* webPage)
 
 LayerTreeHostCAMac::~LayerTreeHostCAMac()
 {
-    ASSERT(!m_remoteLayerClient);
+    ASSERT(!m_layerHostingContext);
 }
 
 void LayerTreeHostCAMac::platformInitialize(LayerTreeContext& layerTreeContext)
 {
-    mach_port_t serverPort = WebProcess::shared().compositingRenderServerPort();
-    m_remoteLayerClient = WKCARemoteLayerClientMakeWithServerPort(serverPort);
+    m_layerHostingContext = LayerHostingContext::createForPort(WebProcess::shared().compositingRenderServerPort());
+    m_layerHostingContext->setRootLayer(rootLayer()->platformLayer());
 
-    WKCARemoteLayerClientSetLayer(m_remoteLayerClient.get(), rootLayer()->platformLayer());
-
-    layerTreeContext.contextID = WKCARemoteLayerClientGetClientId(m_remoteLayerClient.get());
+    layerTreeContext.contextID = m_layerHostingContext->contextID();
 }
 
 void LayerTreeHostCAMac::scheduleLayerFlush()
@@ -84,8 +82,8 @@ void LayerTreeHostCAMac::invalidate()
 {
     m_layerFlushScheduler.invalidate();
 
-    WKCARemoteLayerClientInvalidate(m_remoteLayerClient.get());
-    m_remoteLayerClient = nullptr;
+    m_layerHostingContext->invalidate();
+    m_layerHostingContext = nullptr;
 
     LayerTreeHostCA::invalidate();
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
index 806ead9cc..a86413f2f 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
+++ b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
@@ -27,6 +27,8 @@
 #define TiledCoreAnimationDrawingArea_h
 
 #include "DrawingArea.h"
+#include "LayerTreeContext.h"
+#include <WebCore/GraphicsLayerClient.h>
 #include <WebCore/LayerFlushScheduler.h>
 #include <WebCore/LayerFlushSchedulerClient.h>
 #include <wtf/RetainPtr.h>
@@ -34,11 +36,11 @@
 OBJC_CLASS CALayer;
 OBJC_CLASS WKContentLayer;
 
-typedef struct __WKCARemoteLayerClientRef* WKCARemoteLayerClientRef;
-
 namespace WebKit {
 
-class TiledCoreAnimationDrawingArea : public DrawingArea, private WebCore::LayerFlushSchedulerClient {
+class LayerHostingContext;
+
+class TiledCoreAnimationDrawingArea : public DrawingArea, WebCore::GraphicsLayerClient, WebCore::LayerFlushSchedulerClient {
 public:
     static PassOwnPtr<TiledCoreAnimationDrawingArea> create(WebPage*, const WebPageCreationParameters&);
     virtual ~TiledCoreAnimationDrawingArea();
@@ -51,26 +53,50 @@ private:
     virtual void scroll(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset) OVERRIDE;
 
     virtual void forceRepaint() OVERRIDE;
+    virtual bool forceRepaintAsync(uint64_t callbackID) OVERRIDE;
     virtual void setLayerTreeStateIsFrozen(bool) OVERRIDE;
     virtual bool layerTreeStateIsFrozen() const OVERRIDE;
     virtual void setRootCompositingLayer(WebCore::GraphicsLayer*) OVERRIDE;
     virtual void scheduleCompositingLayerSync() OVERRIDE;
 
+    virtual void didInstallPageOverlay() OVERRIDE;
+    virtual void didUninstallPageOverlay() OVERRIDE;
+    virtual void setPageOverlayNeedsDisplay(const WebCore::IntRect&) OVERRIDE;
+
+    // WebCore::GraphicsLayerClient
+    virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) OVERRIDE;
+    virtual void notifySyncRequired(const WebCore::GraphicsLayer*) OVERRIDE;
+    virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect) OVERRIDE;
+    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const OVERRIDE;
+    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const OVERRIDE;
+    virtual float deviceScaleFactor() const OVERRIDE;
+
     // WebCore::LayerFlushSchedulerClient
     virtual bool flushLayers() OVERRIDE;
 
     // Message handlers.
     virtual void updateGeometry(const WebCore::IntSize& viewSize) OVERRIDE;
     virtual void setDeviceScaleFactor(float) OVERRIDE;
+    virtual void setLayerHostingMode(uint32_t) OVERRIDE;
 
     void setRootCompositingLayer(CALayer *);
 
+    void createPageOverlayLayer();
+    void destroyPageOverlayLayer();
+
+    bool shouldRepaintPageOverlayLayer();
+
     bool m_layerTreeStateIsFrozen;
     WebCore::LayerFlushScheduler m_layerFlushScheduler;
 
-    RetainPtr<WKCARemoteLayerClientRef> m_remoteLayerClient;
+    OwnPtr<LayerHostingContext> m_layerHostingContext;
+    LayerHostingMode m_layerHostingMode;
+    
     RetainPtr<CALayer> m_rootLayer;
     RetainPtr<CALayer> m_pendingRootCompositingLayer;
+
+    OwnPtr<WebCore::GraphicsLayer> m_pageOverlayLayer;
+    WebCore::FloatPoint m_mainFrameScrollLayerPosition;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
index 26fca92bf..ddb4902b9 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
@@ -28,17 +28,22 @@
 
 #import "DrawingAreaProxyMessages.h"
 #import "EventDispatcher.h"
+#import "LayerHostingContext.h"
 #import "LayerTreeContext.h"
 #import "WebPage.h"
+#import "WebPageProxyMessages.h"
 #import "WebProcess.h"
 #import <QuartzCore/QuartzCore.h>
 #import <WebCore/Frame.h>
 #import <WebCore/FrameView.h>
 #import <WebCore/GraphicsContext.h>
 #import <WebCore/Page.h>
+#import <WebCore/RenderLayerCompositor.h>
+#import <WebCore/RenderView.h>
 #import <WebCore/ScrollingCoordinator.h>
+#import <WebCore/ScrollingThread.h>
 #import <WebCore/Settings.h>
-#import <WebKitSystemInterface.h>
+#import <wtf/MainThread.h>
 
 @interface CATransaction (Details)
 + (void)synchronize;
@@ -76,12 +81,11 @@ TiledCoreAnimationDrawingArea::TiledCoreAnimationDrawingArea(WebPage* webPage, c
     m_rootLayer.get().opaque = YES;
     m_rootLayer.get().geometryFlipped = YES;
 
-    mach_port_t serverPort = WebProcess::shared().compositingRenderServerPort();
-    m_remoteLayerClient = WKCARemoteLayerClientMakeWithServerPort(serverPort);
-    WKCARemoteLayerClientSetLayer(m_remoteLayerClient.get(), m_rootLayer.get());
-
+    m_layerHostingContext = LayerHostingContext::createForPort(WebProcess::shared().compositingRenderServerPort());
+    m_layerHostingContext->setRootLayer(m_rootLayer.get());
+    
     LayerTreeContext layerTreeContext;
-    layerTreeContext.contextID = WKCARemoteLayerClientGetClientId(m_remoteLayerClient.get());
+    layerTreeContext.contextID = m_layerHostingContext->contextID();
     m_webPage->send(Messages::DrawingAreaProxy::EnterAcceleratedCompositingMode(0, layerTreeContext));
 }
 
@@ -124,6 +128,36 @@ void TiledCoreAnimationDrawingArea::forceRepaint()
     [CATransaction synchronize];
 }
 
+#if ENABLE(THREADED_SCROLLING)
+static void forceRepaintAndSendMessage(uint64_t webPageID, uint64_t callbackID)
+{
+    WebPage* webPage = WebProcess::shared().webPage(webPageID);
+    if (!webPage)
+        return;
+
+    webPage->drawingArea()->forceRepaint();
+    webPage->send(Messages::WebPageProxy::VoidCallback(callbackID));
+}
+
+static void dispatchBackToMainThread(uint64_t webPageID, uint64_t callbackID)
+{
+    callOnMainThread(bind(forceRepaintAndSendMessage, webPageID, callbackID));
+}
+#endif
+
+bool TiledCoreAnimationDrawingArea::forceRepaintAsync(uint64_t callbackID)
+{
+#if ENABLE(THREADED_SCROLLING)
+    if (m_layerTreeStateIsFrozen)
+        return false;
+
+    ScrollingThread::dispatch(bind(dispatchBackToMainThread, m_webPage->pageID(), callbackID));
+    return true;
+#else
+    return false;
+#endif
+}
+
 void TiledCoreAnimationDrawingArea::setLayerTreeStateIsFrozen(bool layerTreeStateIsFrozen)
 {
     if (m_layerTreeStateIsFrozen == layerTreeStateIsFrozen)
@@ -146,6 +180,63 @@ void TiledCoreAnimationDrawingArea::scheduleCompositingLayerSync()
     m_layerFlushScheduler.schedule();
 }
 
+void TiledCoreAnimationDrawingArea::didInstallPageOverlay()
+{
+#if ENABLE(THREADED_SCROLLING)
+    m_webPage->corePage()->scrollingCoordinator()->setForceMainThreadScrollLayerPositionUpdates(true);
+#endif
+
+    createPageOverlayLayer();
+    scheduleCompositingLayerSync();
+}
+
+void TiledCoreAnimationDrawingArea::didUninstallPageOverlay()
+{
+#if ENABLE(THREADED_SCROLLING)
+    m_webPage->corePage()->scrollingCoordinator()->setForceMainThreadScrollLayerPositionUpdates(false);
+#endif
+
+    destroyPageOverlayLayer();
+    scheduleCompositingLayerSync();
+}
+
+void TiledCoreAnimationDrawingArea::setPageOverlayNeedsDisplay(const IntRect& rect)
+{
+    ASSERT(m_pageOverlayLayer);
+    m_pageOverlayLayer->setNeedsDisplayInRect(rect);
+    scheduleCompositingLayerSync();
+}
+
+void TiledCoreAnimationDrawingArea::notifyAnimationStarted(const GraphicsLayer*, double)
+{
+}
+
+void TiledCoreAnimationDrawingArea::notifySyncRequired(const GraphicsLayer*)
+{
+}
+
+void TiledCoreAnimationDrawingArea::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& graphicsContext, GraphicsLayerPaintingPhase, const IntRect& clipRect)
+{
+    ASSERT_UNUSED(graphicsLayer, graphicsLayer == m_pageOverlayLayer);
+
+    m_webPage->drawPageOverlay(graphicsContext, clipRect);
+}
+
+bool TiledCoreAnimationDrawingArea::showDebugBorders(const GraphicsLayer*) const
+{
+    return m_webPage->corePage()->settings()->showDebugBorders();
+}
+
+bool TiledCoreAnimationDrawingArea::showRepaintCounter(const GraphicsLayer*) const
+{
+    return m_webPage->corePage()->settings()->showRepaintCounter();
+}
+
+float TiledCoreAnimationDrawingArea::deviceScaleFactor() const
+{
+    return m_webPage->corePage()->deviceScaleFactor();
+}
+
 bool TiledCoreAnimationDrawingArea::flushLayers()
 {
     ASSERT(!m_layerTreeStateIsFrozen);
@@ -160,6 +251,13 @@ bool TiledCoreAnimationDrawingArea::flushLayers()
         m_pendingRootCompositingLayer = nullptr;
     }
 
+    if (m_pageOverlayLayer) {
+        if (shouldRepaintPageOverlayLayer())
+            m_pageOverlayLayer->setNeedsDisplay();
+
+        m_pageOverlayLayer->syncCompositingStateForThisLayerOnly();
+    }
+
     bool returnValue = m_webPage->corePage()->mainFrame()->view()->syncCompositingStateIncludingSubframes();
 
     [pool drain];
@@ -171,6 +269,9 @@ void TiledCoreAnimationDrawingArea::updateGeometry(const IntSize& viewSize)
     m_webPage->setSize(viewSize);
     m_webPage->layoutIfNeeded();
 
+    if (m_pageOverlayLayer)
+        m_pageOverlayLayer->setSize(viewSize);
+
     if (!m_layerTreeStateIsFrozen)
         flushLayers();
 
@@ -192,6 +293,37 @@ void TiledCoreAnimationDrawingArea::setDeviceScaleFactor(float deviceScaleFactor
     m_webPage->setDeviceScaleFactor(deviceScaleFactor);
 }
 
+void TiledCoreAnimationDrawingArea::setLayerHostingMode(uint32_t opaqueLayerHostingMode)
+{
+    LayerHostingMode layerHostingMode = static_cast<LayerHostingMode>(opaqueLayerHostingMode);
+    if (layerHostingMode != m_layerHostingContext->layerHostingMode()) {
+        // The mode has changed.
+        
+        // First, invalidate the old hosting context.
+        m_layerHostingContext->invalidate();
+        m_layerHostingContext = nullptr;
+
+        // Create a new context and set it up.
+        switch (layerHostingMode) {
+        case LayerHostingModeDefault:
+            m_layerHostingContext = LayerHostingContext::createForPort(WebProcess::shared().compositingRenderServerPort());
+            break;
+#if HAVE(LAYER_HOSTING_IN_WINDOW_SERVER)
+        case LayerHostingModeInWindowServer:
+            m_layerHostingContext = LayerHostingContext::createForWindowServer();        
+            break;
+#endif
+        }
+
+        m_layerHostingContext->setRootLayer(m_rootLayer.get());
+
+        // Finally, inform the UIProcess that the context has changed.
+        LayerTreeContext layerTreeContext;
+        layerTreeContext.contextID = m_layerHostingContext->contextID();
+        m_webPage->send(Messages::DrawingAreaProxy::UpdateAcceleratedCompositingMode(0, layerTreeContext));
+    }
+}
+
 void TiledCoreAnimationDrawingArea::setRootCompositingLayer(CALayer *layer)
 {
     ASSERT(!m_layerTreeStateIsFrozen);
@@ -201,10 +333,53 @@ void TiledCoreAnimationDrawingArea::setRootCompositingLayer(CALayer *layer)
 
     if (!layer)
         m_rootLayer.get().sublayers = nil;
-    else
+    else {
         m_rootLayer.get().sublayers = [NSArray arrayWithObject:layer];
 
+        if (m_pageOverlayLayer)
+            [m_rootLayer.get() addSublayer:m_pageOverlayLayer->platformLayer()];
+    }
+
     [CATransaction commit];
 }
 
+void TiledCoreAnimationDrawingArea::createPageOverlayLayer()
+{
+    ASSERT(!m_pageOverlayLayer);
+
+    m_pageOverlayLayer = GraphicsLayer::create(this);
+#ifndef NDEBUG
+    m_pageOverlayLayer->setName("page overlay content");
+#endif
+
+    m_pageOverlayLayer->setDrawsContent(true);
+    m_pageOverlayLayer->setSize(m_webPage->size());
+
+    [m_rootLayer.get() addSublayer:m_pageOverlayLayer->platformLayer()];
+}
+
+void TiledCoreAnimationDrawingArea::destroyPageOverlayLayer()
+{
+    ASSERT(m_pageOverlayLayer);
+
+    [m_pageOverlayLayer->platformLayer() removeFromSuperlayer];
+    m_pageOverlayLayer = nullptr;
+}
+
+bool TiledCoreAnimationDrawingArea::shouldRepaintPageOverlayLayer()
+{
+    RenderLayerCompositor* renderLayerCompositor = m_webPage->corePage()->mainFrame()->contentRenderer()->compositor();
+    GraphicsLayer* scrollLayer = renderLayerCompositor->scrollLayer();
+    if (m_mainFrameScrollLayerPosition != scrollLayer->position()) {
+        m_mainFrameScrollLayerPosition = scrollLayer->position();
+        return true;
+    }
+
+    GraphicsLayer* rootGraphicsLayer = renderLayerCompositor->rootRenderLayer()->backing()->graphicsLayer();
+    if (rootGraphicsLayer->needsDisplay())
+        return true;
+   
+    return false;
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
index bfee90207..d876a8d45 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
@@ -440,7 +440,7 @@ void WebPage::performDictionaryLookupAtLocation(const FloatPoint& floatPoint)
 
     // Find the frame the point is over.
     IntPoint point = roundedIntPoint(floatPoint);
-    HitTestResult result = frame->eventHandler()->hitTestResultAtPoint(point, false);
+    HitTestResult result = frame->eventHandler()->hitTestResultAtPoint(frame->view()->windowToContents(point), false);
     frame = result.innerNonSharedNode() ? result.innerNonSharedNode()->document()->frame() : m_page->focusController()->focusedOrMainFrame();
 
     IntPoint translatedPoint = frame->view()->windowToContents(point);
@@ -539,7 +539,7 @@ void WebPage::performDictionaryLookupForRange(DictionaryPopupInfo::Type type, Fr
     
     DictionaryPopupInfo dictionaryPopupInfo;
     dictionaryPopupInfo.type = type;
-    dictionaryPopupInfo.origin = FloatPoint(rangeRect.x(), rangeRect.y() + style->fontMetrics().ascent());
+    dictionaryPopupInfo.origin = FloatPoint(rangeRect.x(), rangeRect.y() + (style->fontMetrics().ascent() * pageScaleFactor()));
     dictionaryPopupInfo.fontInfo.fontAttributeDictionary = fontDescriptorAttributes;
 #if !defined(BUILDING_ON_SNOW_LEOPARD)
     dictionaryPopupInfo.options = (CFDictionaryRef)options;
@@ -687,7 +687,7 @@ void WebPage::shouldDelayWindowOrderingEvent(const WebKit::WebMouseEvent& event,
     if (!frame)
         return;
 
-    HitTestResult hitResult = frame->eventHandler()->hitTestResultAtPoint(event.position(), true);
+    HitTestResult hitResult = frame->eventHandler()->hitTestResultAtPoint(frame->view()->windowToContents(event.position()), true);
     if (hitResult.isSelected())
         result = frame->eventHandler()->eventMayStartDrag(platform(event));
 }
@@ -699,7 +699,7 @@ void WebPage::acceptsFirstMouse(int eventNumber, const WebKit::WebMouseEvent& ev
     if (!frame)
         return;
     
-    HitTestResult hitResult = frame->eventHandler()->hitTestResultAtPoint(event.position(), true);
+    HitTestResult hitResult = frame->eventHandler()->hitTestResultAtPoint(frame->view()->windowToContents(event.position()), true);
     frame->eventHandler()->setActivationEventNumber(eventNumber);
     if (hitResult.isSelected())
         result = frame->eventHandler()->eventMayStartDrag(platform(event));
diff --git a/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp b/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp
index 0005ce8ee..213743003 100644
--- a/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp
@@ -26,8 +26,6 @@
 
 #include "config.h"
 
-#if USE(ACCELERATED_COMPOSITING)
-
 #include "LayerTreeHostQt.h"
 
 #include "DrawingAreaImpl.h"
@@ -94,7 +92,6 @@ LayerTreeHostQt::LayerTreeHostQt(WebPage* webPage)
     m_nonCompositedContentLayer->setName("LayerTreeHostQt non-composited content");
 #endif
     m_nonCompositedContentLayer->setDrawsContent(true);
-    m_nonCompositedContentLayer->setContentsOpaque(m_webPage->drawsBackground() && !m_webPage->drawsTransparentBackground());
     m_nonCompositedContentLayer->setSize(m_webPage->size());
 
     m_rootLayer->addChild(m_nonCompositedContentLayer.get());
@@ -142,6 +139,7 @@ void LayerTreeHostQt::setShouldNotifyAfterNextScheduledLayerFlush(bool notifyAft
 void LayerTreeHostQt::setRootCompositingLayer(WebCore::GraphicsLayer* graphicsLayer)
 {
     m_nonCompositedContentLayer->removeAllChildren();
+    m_nonCompositedContentLayer->setContentsOpaque(m_webPage->drawsBackground() && !m_webPage->drawsTransparentBackground());
 
     // Add the accelerated layer tree hierarchy.
     if (graphicsLayer)
@@ -397,7 +395,6 @@ bool LayerTreeHost::supportsAcceleratedCompositing()
     return true;
 }
 
-#if USE(TILED_BACKING_STORE)
 void LayerTreeHostQt::createTile(WebLayerID layerID, int tileID, const UpdateInfo& updateInfo)
 {
     m_webPage->send(Messages::LayerTreeHostProxy::CreateTileForLayer(layerID, tileID, updateInfo));
@@ -459,20 +456,5 @@ void LayerTreeHostQt::purgeBackingStores()
 
     ASSERT(!m_directlyCompositedImageRefCounts.size());
 }
-#endif
-
-} // namespace WebKit
-#else
-#include "LayerTreeHost.h"
-
-using namespace WebCore;
-
-namespace WebKit {
-
-bool LayerTreeHost::supportsAcceleratedCompositing()
-{
-    return false;
-}
 
 } // namespace WebKit
-#endif
diff --git a/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.h b/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.h
index f5c433f9a..9db85b78d 100644
--- a/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.h
+++ b/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.h
@@ -33,9 +33,7 @@ class UpdateInfo;
 class WebPage;
 
 class LayerTreeHostQt : public LayerTreeHost, WebCore::GraphicsLayerClient
-#if USE(TILED_BACKING_STORE)
                       , public WebGraphicsLayerClient
-#endif
 {
 public:
     static PassRefPtr<LayerTreeHostQt> create(WebPage*);
@@ -65,7 +63,6 @@ public:
     virtual int64_t adoptImageBackingStore(WebCore::Image*);
     virtual void releaseImageBackingStore(int64_t);
 
-#if USE(TILED_BACKING_STORE)
     virtual void createTile(WebLayerID, int tileID, const UpdateInfo&);
     virtual void updateTile(WebLayerID, int tileID, const UpdateInfo&);
     virtual void removeTile(WebLayerID, int tileID);
@@ -78,7 +75,6 @@ public:
     virtual void didSyncCompositingStateForLayer(const WebLayerInfo&);
     virtual void attachLayer(WebCore::WebGraphicsLayer*);
     virtual void detachLayer(WebCore::WebGraphicsLayer*);
-#endif
 
 protected:
     explicit LayerTreeHostQt(WebPage*);
@@ -112,12 +108,12 @@ private:
 
     bool m_notifyAfterScheduledLayerFlush;
     bool m_isValid;
-#if USE(TILED_BACKING_STORE)
+
     bool m_waitingForUIProcess;
     bool m_isSuspended;
     WebCore::IntRect m_visibleContentsRect;
     float m_contentsScale;
-#endif
+
     LayerTreeContext m_layerTreeContext;
     bool m_shouldSyncFrame;
     bool m_shouldSyncRootLayer;
diff --git a/Source/WebKit2/WebProcess/com.apple.WebProcess.sb b/Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in
index 68b073bd8..68b073bd8 100644
--- a/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
+++ b/Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in
diff --git a/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp b/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
index aacc27b6b..45b8581b6 100644
--- a/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
+++ b/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
@@ -64,6 +64,12 @@ WK_EXPORT int WebProcessMainGtk(int argc, char* argv[])
     SoupSession* session = WebCore::ResourceHandle::defaultSession();
     soup_session_add_feature_by_type(session, WEB_TYPE_AUTH_DIALOG);
 
+    // Despite using system CAs to validate certificates we're
+    // accepting invalid certificates by default. New API will be
+    // added later to let client accept/discard invalid certificates.
+    g_object_set(session, SOUP_SESSION_SSL_USE_SYSTEM_CA_FILE, TRUE,
+                 SOUP_SESSION_SSL_STRICT, FALSE, NULL);
+
     RunLoop::run();
 
     return 0;
diff --git a/Source/WebKit2/WebProcess/qt/QtBuiltinBundlePage.cpp b/Source/WebKit2/WebProcess/qt/QtBuiltinBundlePage.cpp
index 2c89556b3..4a2d55491 100644
--- a/Source/WebKit2/WebProcess/qt/QtBuiltinBundlePage.cpp
+++ b/Source/WebKit2/WebProcess/qt/QtBuiltinBundlePage.cpp
@@ -67,6 +67,7 @@ QtBuiltinBundlePage::QtBuiltinBundlePage(QtBuiltinBundle* bundle, WKBundlePageRe
         0, // willPerformClientRedirectForFrame
         0, // didHandleOnloadEventsForFrame
         0, // didLayoutForFrame
+        0, // didNewFirstVisuallyNonEmptyLayoutForFrame
         0, // didDetectXSSForFrame
     };
     WKBundlePageSetPageLoaderClient(m_page, &loaderClient);
diff --git a/Source/WebKit2/mac/WebKit2.order b/Source/WebKit2/mac/WebKit2.order
index fae9784db..457a063e0 100644
--- a/Source/WebKit2/mac/WebKit2.order
+++ b/Source/WebKit2/mac/WebKit2.order
@@ -3382,3 +3382,5 @@ _WKDrawBezeledTextArea
 _WKGetFontInLanguageForCharacter
 _WKAdvanceDefaultButtonPulseAnimation
 _WKAppKitDrawDecoyWindow_isKeyWindow
+__ZN6WebKit7WebPage36suspendActiveDOMObjectsAndAnimationsEv
+__ZN6WebKit7WebPage35resumeActiveDOMObjectsAndAnimationsEv
diff --git a/Source/WebKit2/qt/MainQt.cpp b/Source/WebKit2/qt/MainQt.cpp
index d2435144c..cacb7c99d 100644
--- a/Source/WebKit2/qt/MainQt.cpp
+++ b/Source/WebKit2/qt/MainQt.cpp
@@ -28,6 +28,7 @@
 
 namespace WebKit {
 Q_DECL_IMPORT int WebProcessMainQt(int argc, char** argv);
+Q_DECL_IMPORT void initializeWebKit2Theme();
 }
 
 // The framework entry point.
@@ -35,5 +36,6 @@ Q_DECL_IMPORT int WebProcessMainQt(int argc, char** argv);
 // to reimplement the handling of command line arguments from QApplication.
 int main(int argc, char** argv)
 {
+    WebKit::initializeWebKit2Theme();
     return WebKit::WebProcessMainQt(argc, argv);
 }
diff --git a/Source/WebKit2/win/WebKit2.def b/Source/WebKit2/win/WebKit2.def
index 718dfa18b..6ca8489dc 100644
--- a/Source/WebKit2/win/WebKit2.def
+++ b/Source/WebKit2/win/WebKit2.def
@@ -176,7 +176,8 @@ EXPORTS
         ?page@Document@WebCore@@QBEPAVPage@2@XZ
         ?paintControlTints@FrameView@WebCore@@AAEXXZ
         ?rangeFromLocationAndLength@TextIterator@WebCore@@SA?AV?$PassRefPtr@VRange@WebCore@@@WTF@@PAVElement@2@HH_N@Z
-        ?removeShadowRoot@Element@WebCore@@QAEXXZ
+        ?removeAllShadowRoots@ShadowTree@WebCore@@QAEXXZ
+        ?s_info@JSNode@WebCore@@2UClassInfo@JSC@@B
         ?scriptExecutionContext@JSDOMGlobalObject@WebCore@@QBEPAVScriptExecutionContext@2@XZ
         ?scrollElementToRect@FrameView@WebCore@@QAEXPAVElement@2@ABVIntRect@2@@Z
         ?setDOMException@WebCore@@YAXPAVExecState@JSC@@H@Z
@@ -190,8 +191,9 @@ EXPORTS
         ?settings@Document@WebCore@@QBEPAVSettings@2@XZ
         ?settings@Frame@WebCore@@QBEPAVSettings@2@XZ
         ?setFixedElementsLayoutRelativeToFrame@Settings@WebCore@@QAEX_N@Z
-        ?shadowRootList@Element@WebCore@@QBEPAVShadowRootList@2@XZ
+        ?shadowTree@Element@WebCore@@QBEPAVShadowTree@2@XZ
         ?suggestedValue@HTMLInputElement@WebCore@@QBEABVString@WTF@@XZ
+        ?text@Range@WebCore@@QBE?AVString@WTF@@XZ
         ?toDocument@WebCore@@YAPAVDocument@1@VJSValue@JSC@@@Z
         ?toElement@WebCore@@YAPAVElement@1@VJSValue@JSC@@@Z
         ?toJS@WebCore@@YA?AVJSValue@JSC@@PAVExecState@3@PAVJSDOMGlobalObject@1@PAVClientRect@1@@Z
diff --git a/Source/WebKit2/win/WebKit2.vcproj b/Source/WebKit2/win/WebKit2.vcproj
index 167ba3d91..fb95a9d8f 100755
--- a/Source/WebKit2/win/WebKit2.vcproj
+++ b/Source/WebKit2/win/WebKit2.vcproj
@@ -427,10 +427,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\Shared\ContextMenuState.h"
-				>
-			</File>
-			<File
 				RelativePath="..\Shared\DictionaryPopupInfo.cpp"
 				>
 			</File>
@@ -791,6 +787,22 @@
 				>
 			</File>
 			<File
+				RelativePath="..\Shared\WebRenderLayer.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\Shared\WebRenderLayer.h"
+				>
+			</File>
+			<File
+				RelativePath="..\Shared\WebRenderObject.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\Shared\WebRenderObject.h"
+				>
+			</File>
+			<File
 				RelativePath="..\Shared\WebSecurityOrigin.h"
 				>
 			</File>
@@ -974,6 +986,22 @@
 					>
 				</File>
 				<File
+					RelativePath="..\Shared\API\c\WKRenderLayer.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Shared\API\c\WKRenderLayer.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Shared\API\c\WKRenderObject.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Shared\API\c\WKRenderObject.h"
+					>
+				</File>
+				<File
 					RelativePath="..\Shared\API\c\WKSecurityOrigin.cpp"
 					>
 				</File>
@@ -2705,18 +2733,6 @@
 					RelativePath="..\WebProcess\FullScreen\WebFullScreenManager.h"
 					>
 				</File>
-				<Filter
-					Name="win"
-					>
-					<File
-						RelativePath="..\WebProcess\FullScreen\win\WebFullScreenManagerWin.cpp"
-						>
-					</File>
-					<File
-						RelativePath="..\WebProcess\FullScreen\win\WebFullScreenManagerWin.h"
-						>
-					</File>
-				</Filter>
 			</Filter>
 			<Filter
 				Name="Notifications (User)"
diff --git a/Source/WebKit2/win/WebKit2CFLite.def b/Source/WebKit2/win/WebKit2CFLite.def
index c359ea6e3..e46f13f04 100644
--- a/Source/WebKit2/win/WebKit2CFLite.def
+++ b/Source/WebKit2/win/WebKit2CFLite.def
@@ -169,7 +169,8 @@ EXPORTS
         ?page@Document@WebCore@@QBEPAVPage@2@XZ
         ?paintControlTints@FrameView@WebCore@@AAEXXZ
         ?rangeFromLocationAndLength@TextIterator@WebCore@@SA?AV?$PassRefPtr@VRange@WebCore@@@WTF@@PAVElement@2@HH_N@Z
-        ?removeShadowRoot@Element@WebCore@@QAEXXZ
+        ?removeShadowRootList@Element@WebCore@@QAEXXZ
+        ?s_info@JSNode@WebCore@@2UClassInfo@JSC@@B
         ?scriptExecutionContext@JSDOMGlobalObject@WebCore@@QBEPAVScriptExecutionContext@2@XZ
         ?scrollElementToRect@FrameView@WebCore@@QAEXPAVElement@2@ABVIntRect@2@@Z
         ?setDOMException@WebCore@@YAXPAVExecState@JSC@@H@Z
@@ -183,8 +184,9 @@ EXPORTS
         ?settings@Document@WebCore@@QBEPAVSettings@2@XZ
         ?settings@Frame@WebCore@@QBEPAVSettings@2@XZ
         ?setFixedElementsLayoutRelativeToFrame@Settings@WebCore@@QAEX_N@Z
-        ?shadowRootList@Element@WebCore@@QBEPAVShadowRootList@2@XZ
+        ?shadowTree@Element@WebCore@@QBEPAVShadowTree@2@XZ
         ?suggestedValue@HTMLInputElement@WebCore@@QBEABVString@WTF@@XZ
+        ?text@Range@WebCore@@QBE?AVString@WTF@@XZ
         ?toDocument@WebCore@@YAPAVDocument@1@VJSValue@JSC@@@Z
         ?toElement@WebCore@@YAPAVElement@1@VJSValue@JSC@@@Z
         ?toJS@WebCore@@YA?AVJSValue@JSC@@PAVExecState@3@PAVJSDOMGlobalObject@1@PAVClientRect@1@@Z
diff --git a/Source/WebKit2/win/build-generated-files.sh b/Source/WebKit2/win/build-generated-files.sh
index fd8b59ebc..fd8b59ebc 100644..100755
--- a/Source/WebKit2/win/build-generated-files.sh
+++ b/Source/WebKit2/win/build-generated-files.sh
diff --git a/Source/api.pri b/Source/api.pri
index 9ca386f2f..8aa88e0a7 100644
--- a/Source/api.pri
+++ b/Source/api.pri
@@ -7,7 +7,104 @@
 TEMPLATE = lib
 TARGET = QtWebKit
 
-DESTDIR = $${ROOT_BUILD_DIR}/lib
+WEBKIT_DESTDIR = $${ROOT_BUILD_DIR}/lib
+
+haveQt(5) {
+    # Use Qt5's module system
+    load(qt_module)
+    MODULE = webkit
+    MODULE_PRI = $$QT.webkit.module_pri
+    CONFIG += module
+
+    BASE_TARGET = $$TARGET
+
+    load(qt_module_config)
+
+    # Make sure the module config doesn't override our preferred build config
+    debug_and_release:if(!debug|!release): CONFIG -= debug_and_release
+
+    # Allow doing a debug-only build of WebKit (not supported by Qt)
+    macx:!debug_and_release:debug: TARGET = $$BASE_TARGET
+
+    # ---------------- Custom developer-build handling -------------------
+    #
+    # The assumption for Qt developer builds is that the module file
+    # will be put into qtbase/mkspecs/modules, and the libraries into
+    # qtbase/lib, with rpath/install_name set to the Qt lib dir.
+    #
+    # For WebKit we don't want that behavior for the libraries, as we want
+    # them to be self-contained in the WebKit build dir. To achive that we
+    # trick Qt into thinking it's not a developer build, but setting QTDIR
+    # to a bogus path in default_pre.prf.
+    #
+    # We still want the module file to live in the Qt dir so the module can
+    # be used by setting QT += webkit, so we copy the file manually. We also
+    # have to make sure the rpath/install_name of the libraries are relative
+    # to the webkit build dir.
+
+    # We use private_tests to detect developer build, since the destdir will
+    # always be our webkit build dir. This might change as configure changes.
+    contains(QT_CONFIG, private_tests): CONFIG += qt_developer_build
+
+    !build_pass {
+        # Make a more accessible copy of the module forward file
+        # in the WebKit build directory.
+        convenience_module_path = $${ROOT_BUILD_DIR}/modules
+        module_filename = $$basename(QT.webkit.module_pri)
+
+        make_module_fwd_convenience.target = $$convenience_module_path/$$module_filename
+        make_module_fwd_convenience.commands = $$QMAKE_MKDIR $$convenience_module_path \
+            && echo \"include($$QMAKE_EXTRA_MODULE_FORWARDS/$$module_filename)\" > $$convenience_module_path/$$module_filename
+        make_module_fwd_convenience.depends = $$QMAKE_EXTRA_MODULE_FORWARDS/$$module_filename
+
+        QMAKE_EXTRA_TARGETS += make_module_fwd_convenience
+        DEFAULT_TARGETS += make_module_fwd_convenience
+
+        qt_developer_build {
+            # Copy the module forward file into Qt so that the module
+            # is immediately accessible.
+            qt_modules_path = $$[QT_INSTALL_PREFIX]/mkspecs/modules
+
+            copy_module_fwd_file.target = $$qt_modules_path/$$module_filename
+            copy_module_fwd_file.commands = $$QMAKE_COPY $$QMAKE_EXTRA_MODULE_FORWARDS/$$module_filename $$qt_modules_path
+            # FIXME: Add dependendy that ensures we copy the forward file if the target is updated
+            copy_module_fwd_file.depends = $$QMAKE_EXTRA_MODULE_FORWARDS/$$module_filename
+
+            QMAKE_EXTRA_TARGETS += copy_module_fwd_file
+            DEFAULT_TARGETS += copy_module_fwd_file
+        }
+    }
+
+    # Make sure the install_name of the QtWebKit library point to webkit
+    macx {
+        # We do our own absolute path so that we can trick qmake into
+        # using the webkit build path instead of the Qt install path.
+        CONFIG -= absolute_library_soname
+        QMAKE_LFLAGS_SONAME = $$QMAKE_LFLAGS_SONAME$$WEBKIT_DESTDIR/
+
+        !debug_and_release|build_pass {
+            # We also have to make sure the install_name is correct when
+            # the library is installed.
+            change_install_name.depends = install_target
+
+            # The install rules generated by qmake for frameworks are busted in
+            # that both the debug and the release makefile copy QtWebKit.framework
+            # into the install dir, so whatever changes we did to the release library
+            # will get overwritten when the debug library is installed. We work around
+            # that by running install_name on both, for both configs.
+            change_install_name.commands = framework_dir=\$\$(dirname $(TARGETD)); \
+                for file in \$\$(ls $$[QT_INSTALL_LIBS]/\$\$framework_dir/$$BASE_TARGET*); do \
+                    install_name_tool -id \$\$file \$\$file; \
+                done
+            default_install_target.target = install
+            default_install_target.depends += change_install_name
+
+            QMAKE_EXTRA_TARGETS += change_install_name default_install_target
+        }
+    }
+} else {
+    DESTDIR = $$WEBKIT_DESTDIR
+}
 
 runSyncQt() # Generate forwarding headers for the QtWebKit API
 
@@ -33,9 +130,10 @@ WEBKIT += webcore
 QT += network
 haveQt(5): QT += widgets printsupport quick
 
-win32*:!win32-msvc* {
+contains(DEFINES, WTF_USE_TEXTURE_MAPPER_GL=1)|contains(DEFINES, ENABLE_WEBGL=1) {
+    QT *= opengl
     # Make sure OpenGL libs are after the webcore lib so MinGW can resolve symbols
-    contains(DEFINES, ENABLE_WEBGL=1)|contains(CONFIG, texmap): LIBS += $$QMAKE_LIBS_OPENGL
+    win32*:!win32-msvc*: LIBS += $$QMAKE_LIBS_OPENGL
 }
 
 !static: DEFINES += QT_MAKEDLL
@@ -59,6 +157,8 @@ SOURCES += \
     $$PWD/WebKit/qt/WebCoreSupport/PageClientQt.cpp \
     $$PWD/WebKit/qt/WebCoreSupport/PopupMenuQt.cpp \
     $$PWD/WebKit/qt/WebCoreSupport/QtPlatformPlugin.cpp \
+    $$PWD/WebKit/qt/WebCoreSupport/RenderThemeQStyle.cpp \
+    $$PWD/WebKit/qt/WebCoreSupport/ScrollbarThemeQStyle.cpp \
     $$PWD/WebKit/qt/WebCoreSupport/SearchPopupMenuQt.cpp \
     $$PWD/WebKit/qt/WebCoreSupport/TextCheckerClientQt.cpp \
     $$PWD/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp \
@@ -74,8 +174,10 @@ HEADERS += \
     $$PWD/WebKit/qt/WebCoreSupport/GeolocationPermissionClientQt.h \
     $$PWD/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.h \
     $$PWD/WebKit/qt/WebCoreSupport/PageClientQt.h \
-    $$PWD/WebKit/qt/WebCoreSupport/QtPlatformPlugin.h \
     $$PWD/WebKit/qt/WebCoreSupport/PopupMenuQt.h \
+    $$PWD/WebKit/qt/WebCoreSupport/QtPlatformPlugin.h \
+    $$PWD/WebKit/qt/WebCoreSupport/RenderThemeQStyle.h \
+    $$PWD/WebKit/qt/WebCoreSupport/ScrollbarThemeQStyle.h \
     $$PWD/WebKit/qt/WebCoreSupport/SearchPopupMenuQt.h \
     $$PWD/WebKit/qt/WebCoreSupport/TextCheckerClientQt.h \
     $$PWD/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.h \
@@ -171,55 +273,53 @@ contains(CONFIG, texmap) {
     DEFINES += WTF_USE_TEXTURE_MAPPER=1
 }
 
+plugin_backend_xlib: PKGCONFIG += x11
 
 # ------------- Install rules -------------
 
-modulefile.files = $$QT.webkit.modulefile
-mkspecs = $$[QMAKE_MKSPECS]
-mkspecs = $$split(mkspecs, :)
-modulefile.path = $$last(mkspecs)/modules
-INSTALLS += modulefile
-
-# Syncqt has already run at this point, so we can use headers.pri
-# as a basis for our install-rules
-HEADERS_PRI = $${ROOT_BUILD_DIR}/include/$$TARGET/headers.pri
-!include($$HEADERS_PRI): error(Failed to resolve install headers)
-
-headers.files = $$SYNCQT.HEADER_FILES $$SYNCQT.HEADER_CLASSES
-!isEmpty(INSTALL_HEADERS): headers.path = $$INSTALL_HEADERS/$${TARGET}
-else: headers.path = $$[QT_INSTALL_HEADERS]/$${TARGET}
-INSTALLS += headers
-
-!isEmpty(INSTALL_LIBS): target.path = $$INSTALL_LIBS
-else: target.path = $$[QT_INSTALL_LIBS]
-INSTALLS += target
-
-unix {
-    CONFIG += create_pc create_prl
-    QMAKE_PKGCONFIG_LIBDIR = $$target.path
-    QMAKE_PKGCONFIG_INCDIR = $$headers.path
-    QMAKE_PKGCONFIG_DESTDIR = pkgconfig
-    lib_replace.match = $$re_escape($$DESTDIR)
-    lib_replace.replace = $$[QT_INSTALL_LIBS]
-    QMAKE_PKGCONFIG_INSTALL_REPLACE += lib_replace
-}
+haveQt(5) {
+    # Install rules handled by Qt's module system
+} else {
+    # For Qt4 we have to set up install rules manually
+
+    # Syncqt has already run at this point, so we can use headers.pri
+    # as a basis for our install-rules
+    HEADERS_PRI = $${ROOT_BUILD_DIR}/include/$${QT.webkit.name}/headers.pri
+    !include($$HEADERS_PRI): error(Failed to resolve install headers)
+
+    headers.files = $$SYNCQT.HEADER_FILES $$SYNCQT.HEADER_CLASSES
+    !isEmpty(INSTALL_HEADERS): headers.path = $$INSTALL_HEADERS/$${TARGET}
+    else: headers.path = $$[QT_INSTALL_HEADERS]/$${TARGET}
+    INSTALLS += headers
+
+    !isEmpty(INSTALL_LIBS): target.path = $$INSTALL_LIBS
+    else: target.path = $$[QT_INSTALL_LIBS]
+    INSTALLS += target
+
+    unix {
+        CONFIG += create_pc create_prl
+        QMAKE_PKGCONFIG_LIBDIR = $$target.path
+        QMAKE_PKGCONFIG_INCDIR = $$headers.path
+        QMAKE_PKGCONFIG_DESTDIR = pkgconfig
+        lib_replace.match = $$re_escape($$DESTDIR)
+        lib_replace.replace = $$[QT_INSTALL_LIBS]
+        QMAKE_PKGCONFIG_INSTALL_REPLACE += lib_replace
+    }
 
-mac {
-    !static:contains(QT_CONFIG, qt_framework) {
-        # Build QtWebKit as a framework, to match how Qt was built
-        CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
-
-        # For debug_and_release configs, only copy headers in release
-        !debug_and_release|if(build_pass:CONFIG(release, debug|release)) {
-            FRAMEWORK_HEADERS.version = Versions
-            FRAMEWORK_HEADERS.files = $${headers.files}
-            FRAMEWORK_HEADERS.path = Headers
-            QMAKE_BUNDLE_DATA += FRAMEWORK_HEADERS
+    mac {
+        !static:contains(QT_CONFIG, qt_framework) {
+            # Build QtWebKit as a framework, to match how Qt was built
+            CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
+
+            # For debug_and_release configs, only copy headers in release
+            !debug_and_release|if(build_pass:CONFIG(release, debug|release)) {
+                FRAMEWORK_HEADERS.version = Versions
+                FRAMEWORK_HEADERS.files = $${headers.files}
+                FRAMEWORK_HEADERS.path = Headers
+                QMAKE_BUNDLE_DATA += FRAMEWORK_HEADERS
+            }
         }
-    }
 
-    QMAKE_LFLAGS_SONAME = "$${QMAKE_LFLAGS_SONAME}$${DESTDIR}$${QMAKE_DIR_SEP}"
+        QMAKE_LFLAGS_SONAME = "$${QMAKE_LFLAGS_SONAME}$${DESTDIR}$${QMAKE_DIR_SEP}"
+    }
 }
-
-plugin_backend_xlib: PKGCONFIG += x11
-
diff --git a/Source/autotools/symbols.filter b/Source/autotools/symbols.filter
index ef70d81a4..2e71724f0 100644
--- a/Source/autotools/symbols.filter
+++ b/Source/autotools/symbols.filter
@@ -42,6 +42,7 @@ _ZN7WebCore10toDocumentEN3JSC7JSValueE;
 _ZN7WebCore10ClientRectC1Ev;
 _ZN7WebCore10ClientRectC1ERKNS_7IntRectE;
 _ZN7WebCore10ShadowRoot6createEPNS_7ElementERi;
+_ZN7WebCore10ShadowTree20removeAllShadowRootsEv;
 _ZN7WebCore11EventTarget17toGeneratedStreamEv;
 _ZN7WebCore11EventTarget8toStreamEv;
 _ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib;
@@ -66,7 +67,7 @@ _ZN7WebCore6JSNode10putVirtualEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueE
 _ZN7WebCore6JSNode20visitChildrenVirtualERN3JSC11SlotVisitorE;
 _ZN7WebCore6JSNode6s_infoE;
 _ZN7WebCore6toNodeEN3JSC7JSValueE;
-_ZN7WebCore7Element16removeShadowRootEv;
+_ZN7WebCore7Element20removeShadowRootListEv;
 _ZN7WebCore7toRangeEN3JSC7JSValueE;
 _ZN7WebCore9JSElement10putVirtualEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE;
 _ZN7WebCore9JSElement6s_infoE;
@@ -79,11 +80,12 @@ _ZNK7WebCore20CachedResourceLoader11isPreloadedERKN3WTF6StringE;
 _ZNK7WebCore26HTMLTextFormControlElement21lastChangeWasUserEditEv;
 _ZNK7WebCore5Frame8settingsEv;
 _ZNK7WebCore6JSNode21pushEventHandlerScopeEPN3JSC9ExecStateEPNS1_14ScopeChainNodeE;
+_ZNK7WebCore7Element10shadowTreeEv;
 _ZNK7WebCore7Element13hasShadowRootEv;
-_ZNK7WebCore7Element14shadowRootListEv;
 _ZNK7WebCore8Document4pageEv;
 _ZNK7WebCore8Document8settingsEv;
 _ZNK7WebCore8Document4viewEv;
+_ZNK7WebCore5Range4textEv;
 _ZNK7WebCore9TreeScope14getElementByIdERKN3WTF12AtomicStringE;
 _ZNK7WebCore14DocumentMarker11descriptionEv;
 _ZN7WebCore14ScrollableArea28setScrollOffsetFromInternalsERKNS_8IntPointE;
@@ -98,6 +100,8 @@ _ZN7WebCore24FrameDestructionObserver12observeFrameEPNS_5FrameE;
 _ZN7WebCore24FrameDestructionObserver14frameDestroyedEv;
 _ZN7WebCore24FrameDestructionObserver14willDetachPageEv;
 _ZN7WebCore22RuntimeEnabledFeatures31isMultipleShadowSubtreesEnabledE;
+_ZN7WebCore22RuntimeEnabledFeatures32setMultipleShadowSubtreesEnabledEb;
+_ZN7WebCore22RuntimeEnabledFeatures18isShadowDOMEnabledE;
 local:
 _Z*;
 cti*;
diff --git a/Source/cmake/OptionsBlackBerry.cmake b/Source/cmake/OptionsBlackBerry.cmake
index 7f9bffb50..a90c850f8 100644
--- a/Source/cmake/OptionsBlackBerry.cmake
+++ b/Source/cmake/OptionsBlackBerry.cmake
@@ -156,6 +156,7 @@ WEBKIT_FEATURE(ENABLE_INDEXED_DATABASE "Enable IndexDB" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_INPUT_COLOR "Enable Color Input" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_INSPECTOR "Enable inspector" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_JAVASCRIPT_DEBUGGER "Enable JavaScript debugger" DEFAULT ON)
+WEBKIT_FEATURE(ENABLE_LEGACY_NOTIFICATIONS "Enable legacy notifications" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_MATHML "Enable MathML" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_METER_TAG "Enable Meter Tag" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_NETSCAPE_PLUGIN_API "Enable Netscape plugin API" DEFAULT ON)
diff --git a/Source/cmake/OptionsCommon.cmake b/Source/cmake/OptionsCommon.cmake
index d94a942b8..a1d918ee8 100644
--- a/Source/cmake/OptionsCommon.cmake
+++ b/Source/cmake/OptionsCommon.cmake
@@ -14,3 +14,7 @@ ELSEIF (CMAKE_SYSTEM_NAME MATCHES QNX)
 ELSE ()
     SET(CODE_GENERATOR_PREPROCESSOR "${CMAKE_CXX_COMPILER} -E -P -x c++")
 ENDIF ()
+
+SET(LIB_SUFFIX "" CACHE STRING "Define suffix of directory name (32/64)")
+
+SET(LIB_INSTALL_DIR "lib${LIB_SUFFIX}" CACHE PATH "Where to install libraries (lib${LIB_SUFFIX})")
diff --git a/Source/cmake/OptionsEfl.cmake b/Source/cmake/OptionsEfl.cmake
index 42d28b847..926be91ba 100644
--- a/Source/cmake/OptionsEfl.cmake
+++ b/Source/cmake/OptionsEfl.cmake
@@ -79,9 +79,11 @@ WEBKIT_FEATURE(ENABLE_ICONDATABASE "Enable icon database" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_INSPECTOR "Enable inspector" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_JAVASCRIPT_DEBUGGER "Enable JavaScript debugger" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_JIT "Enable JIT code" DEFAULT ON)
+WEBKIT_FEATURE(ENABLE_LEGACY_NOTIFICATIONS "Enable legacy notifications" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_MATHML "Enable MathML" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_METER_TAG "Enable Meter tag" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_MICRODATA "Enable HTML5 microdata support" DEFAULT OFF)
+WEBKIT_FEATURE(ENABLE_MUTATION_OBSERVERS "Enable HTML5 mutation observers support" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_NETSCAPE_PLUGIN_API "Enable Netscape plugin API" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_NOTIFICATIONS "Enable notifications" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_ORIENTATION_EVENTS "Enable orientation events" DEFAULT OFF)
diff --git a/Source/cmake/OptionsWinCE.cmake b/Source/cmake/OptionsWinCE.cmake
index 71110e359..61478388c 100644
--- a/Source/cmake/OptionsWinCE.cmake
+++ b/Source/cmake/OptionsWinCE.cmake
@@ -33,6 +33,7 @@ WEBKIT_FEATURE(ENABLE_ICONDATABASE "Enable icon database" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_INSPECTOR "Enable inspector" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_JAVASCRIPT_DEBUGGER "Enable JavaScript debugger" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_JIT "Enable JIT code" DEFAULT OFF)
+WEBKIT_FEATURE(ENABLE_LEGACY_NOTIFICATIONS "Enable legacy notifications" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_MATHML "Enable MathML" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_MICRODATA "Enable HTML5 microdata support" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_NETSCAPE_PLUGIN_API "Enable Netscape plugin API" DEFAULT OFF)
diff --git a/Source/cmake/WebKitHelpers.cmake b/Source/cmake/WebKitHelpers.cmake
index b5448d990..2f6c1bee1 100644
--- a/Source/cmake/WebKitHelpers.cmake
+++ b/Source/cmake/WebKitHelpers.cmake
@@ -22,7 +22,12 @@ MACRO(WEBKIT_SET_EXTRA_COMPILER_FLAGS _target)
     ENDIF ()
 
     IF (NOT SHARED_CORE)
-        SET(OLD_COMPILE_FLAGS "-fPIC -fvisibility=hidden ${OLD_COMPILE_FLAGS}")
+        SET(OLD_COMPILE_FLAGS "-fvisibility=hidden ${OLD_COMPILE_FLAGS}")
+    ENDIF ()
+
+    GET_TARGET_PROPERTY(TARGET_TYPE ${_target} TYPE)
+    IF (${TARGET_TYPE} STREQUAL "STATIC_LIBRARY") # -fPIC is automatically added to shared libraries
+        SET(OLD_COMPILE_FLAGS "-fPIC")
     ENDIF ()
 
     SET(OLD_COMPILE_FLAGS "-fno-exceptions -fno-strict-aliasing ${OLD_COMPILE_FLAGS}")
diff --git a/Source/cmakeconfig.h.cmake b/Source/cmakeconfig.h.cmake
index b632fcc30..98db0b64a 100644
--- a/Source/cmakeconfig.h.cmake
+++ b/Source/cmakeconfig.h.cmake
@@ -24,9 +24,11 @@
 #cmakedefine01 ENABLE_INSPECTOR
 #cmakedefine01 ENABLE_JAVASCRIPT_DEBUGGER
 #cmakedefine01 ENABLE_JIT
+#cmakedefine01 ENABLE_LEGACY_NOTIFICATIONS
 #cmakedefine01 ENABLE_MATHML
 #cmakedefine01 ENABLE_METER_TAG
 #cmakedefine01 ENABLE_MICRODATA
+#cmakedefine01 ENABLE_MUTATION_OBSERVERS
 #cmakedefine01 ENABLE_NETSCAPE_PLUGIN_API
 #cmakedefine01 ENABLE_NOTIFICATIONS
 #cmakedefine01 ENABLE_ORIENTATION_EVENTS
diff --git a/Source/sync.profile b/Source/sync.profile
index 6cbcef33b..246b5c179 100644
--- a/Source/sync.profile
+++ b/Source/sync.profile
@@ -13,6 +13,6 @@
     "script" => "#include <QtScript/QtScript>\n",
 );
 %modulepris = (
-    "QtWebKit" => "$basedir/../Tools/qmake/mkspecs/modules/qt_webkit.pri",
+    "QtWebKit" => "$basedir/../Tools/qmake/qt_webkit.pri",
 );
 @ignore_for_master_contents = ( "qwebscriptworld.h", "testwindow.h", "util.h" );
diff --git a/Source/tests.pri b/Source/tests.pri
index c9a6b7af1..9d3102b3c 100644
--- a/Source/tests.pri
+++ b/Source/tests.pri
@@ -7,6 +7,8 @@
 TEMPLATE = subdirs
 CONFIG += ordered
 
+load(features)
+
 WEBKIT_TESTS_DIR = $$PWD/WebKit/qt/tests
 
 SUBDIRS += \
@@ -26,18 +28,19 @@ linux-* {
     SUBDIRS += $$WEBKIT_TESTS_DIR/MIMESniffing
 }
 
-contains(QT_CONFIG, declarative)|contains(QT_CONFIG, qtquick1) {
-    SUBDIRS += $$WEBKIT_TESTS_DIR/qdeclarativewebview
-}
+contains(DEFINES, HAVE_QQUICK1=1): SUBDIRS += $$WEBKIT_TESTS_DIR/qdeclarativewebview
 
 # Benchmarks
 SUBDIRS += \
     $$WEBKIT_TESTS_DIR/benchmarks/painting \
     $$WEBKIT_TESTS_DIR/benchmarks/loading
 
-contains(DEFINES, ENABLE_WEBGL=1) {
-    SUBDIRS += $$WEBKIT_TESTS_DIR/benchmarks/webgl
-}
+# WebGL performance tests are disabled temporarily.
+# https://bugs.webkit.org/show_bug.cgi?id=80503
+#
+#contains(DEFINES, ENABLE_WEBGL=1) {
+#    SUBDIRS += $$WEBKIT_TESTS_DIR/benchmarks/webgl
+#}
 
 !no_webkit2 {
     WEBKIT2_TESTS_DIR = $$PWD/WebKit2/UIProcess/API/qt/tests